Warning: Permanently added '10.128.0.55' (ED25519) to the list of known hosts. executing program [ 50.573981][ T3501] loop0: detected capacity change from 0 to 2048 [ 50.640630][ T3501] ======================================================= [ 50.640630][ T3501] WARNING: The mand mount option has been deprecated and [ 50.640630][ T3501] and is ignored by this kernel. Remove the mand [ 50.640630][ T3501] option from the mount to silence this warning. [ 50.640630][ T3501] ======================================================= [ 50.693048][ T3501] UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 50.705327][ T3501] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 50.814632][ T3501] ================================================================== [ 50.822816][ T3501] BUG: KASAN: use-after-free in udf_close_lvid+0x6a4/0x9a0 [ 50.830055][ T3501] Write of size 1 at addr ffff88808c312068 by task syz-executor296/3501 [ 50.838370][ T3501] [ 50.840698][ T3501] CPU: 0 PID: 3501 Comm: syz-executor296 Not tainted 5.15.158-syzkaller #0 [ 50.849282][ T3501] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 50.859355][ T3501] Call Trace: [ 50.862624][ T3501] [ 50.865548][ T3501] dump_stack_lvl+0x1e3/0x2d0 [ 50.870222][ T3501] ? io_uring_drop_tctx_refs+0x1a0/0x1a0 [ 50.875846][ T3501] ? _printk+0xd1/0x120 [ 50.879996][ T3501] ? __wake_up_klogd+0xcc/0x100 [ 50.884843][ T3501] ? panic+0x860/0x860 [ 50.888900][ T3501] ? _raw_spin_lock_irqsave+0xdd/0x120 [ 50.894355][ T3501] print_address_description+0x63/0x3b0 [ 50.899893][ T3501] ? udf_close_lvid+0x6a4/0x9a0 [ 50.904742][ T3501] kasan_report+0x16b/0x1c0 [ 50.909236][ T3501] ? udf_close_lvid+0x6a4/0x9a0 [ 50.914079][ T3501] udf_close_lvid+0x6a4/0x9a0 [ 50.918753][ T3501] ? udf_open_lvid+0x5a0/0x5a0 [ 50.923510][ T3501] ? clear_inode+0x150/0x150 [ 50.928091][ T3501] udf_put_super+0xc9/0x160 [ 50.932587][ T3501] ? udf_free_in_core_inode+0x20/0x20 [ 50.937954][ T3501] generic_shutdown_super+0x136/0x2c0 [ 50.943330][ T3501] kill_block_super+0x7a/0xe0 [ 50.948006][ T3501] deactivate_locked_super+0xa0/0x110 [ 50.953373][ T3501] cleanup_mnt+0x44e/0x500 [ 50.957794][ T3501] ? lockdep_hardirqs_on+0x94/0x130 [ 50.962991][ T3501] task_work_run+0x129/0x1a0 [ 50.967587][ T3501] do_exit+0x6a3/0x2480 [ 50.971771][ T3501] ? put_task_struct+0x80/0x80 [ 50.976529][ T3501] ? lockdep_hardirqs_on_prepare+0x438/0x7a0 [ 50.982502][ T3501] ? vtime_user_exit+0x2d1/0x400 [ 50.987439][ T3501] do_group_exit+0x144/0x310 [ 50.992028][ T3501] __x64_sys_exit_group+0x3b/0x40 [ 50.997052][ T3501] do_syscall_64+0x3b/0xb0 [ 51.001454][ T3501] ? clear_bhb_loop+0x15/0x70 [ 51.006134][ T3501] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 51.012022][ T3501] RIP: 0033:0x7f7b9d456d89 [ 51.016427][ T3501] Code: Unable to access opcode bytes at RIP 0x7f7b9d456d5f. [ 51.023779][ T3501] RSP: 002b:00007ffc78616c38 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 51.032195][ T3501] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f7b9d456d89 [ 51.040159][ T3501] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 51.048122][ T3501] RBP: 00007f7b9d4f2390 R08: ffffffffffffffb8 R09: 000000000001f22c [ 51.056086][ T3501] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7b9d4f2390 [ 51.064045][ T3501] R13: 0000000000000000 R14: 00007f7b9d4f3100 R15: 00007f7b9d425060 [ 51.072025][ T3501] [ 51.075099][ T3501] [ 51.077450][ T3501] The buggy address belongs to the page: [ 51.083064][ T3501] page:ffffea000230c480 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8c312 [ 51.093198][ T3501] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 51.100314][ T3501] raw: 00fff00000000000 ffffea000230c488 ffffea000230c488 0000000000000000 [ 51.108888][ T3501] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 51.117461][ T3501] page dumped because: kasan: bad access detected [ 51.123858][ T3501] page_owner info is not present (never set?) [ 51.129901][ T3501] [ 51.132207][ T3501] Memory state around the buggy address: [ 51.137816][ T3501] ffff88808c311f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 51.145862][ T3501] ffff88808c311f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 51.153908][ T3501] >ffff88808c312000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 51.161952][ T3501] ^ [ 51.169393][ T3501] ffff88808c312080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 51.177451][ T3501] ffff88808c312100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 51.185495][ T3501] ================================================================== [ 51.193586][ T3501] Disabling lock debugging due to kernel taint [ 51.204680][ T3501] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 51.211885][ T3501] CPU: 1 PID: 3501 Comm: syz-executor296 Tainted: G B 5.15.158-syzkaller #0 [ 51.221845][ T3501] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 51.231906][ T3501] Call Trace: [ 51.235174][ T3501] [ 51.238089][ T3501] dump_stack_lvl+0x1e3/0x2d0 [ 51.242755][ T3501] ? io_uring_drop_tctx_refs+0x1a0/0x1a0 [ 51.248372][ T3501] ? panic+0x860/0x860 [ 51.252425][ T3501] ? rcu_is_watching+0x11/0xa0 [ 51.257185][ T3501] ? preempt_schedule_common+0xa6/0xd0 [ 51.262637][ T3501] panic+0x318/0x860 [ 51.266520][ T3501] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 51.272659][ T3501] ? check_panic_on_warn+0x1d/0xa0 [ 51.277759][ T3501] ? fb_is_primary_device+0xd0/0xd0 [ 51.282958][ T3501] ? _raw_spin_unlock_irqrestore+0x128/0x130 [ 51.288942][ T3501] ? _raw_spin_unlock+0x40/0x40 [ 51.293793][ T3501] check_panic_on_warn+0x7e/0xa0 [ 51.298724][ T3501] ? udf_close_lvid+0x6a4/0x9a0 [ 51.303568][ T3501] end_report+0x6d/0xf0 [ 51.307722][ T3501] kasan_report+0x18e/0x1c0 [ 51.312225][ T3501] ? udf_close_lvid+0x6a4/0x9a0 [ 51.317072][ T3501] udf_close_lvid+0x6a4/0x9a0 [ 51.321738][ T3501] ? udf_open_lvid+0x5a0/0x5a0 [ 51.326488][ T3501] ? clear_inode+0x150/0x150 [ 51.331070][ T3501] udf_put_super+0xc9/0x160 [ 51.335571][ T3501] ? udf_free_in_core_inode+0x20/0x20 [ 51.340928][ T3501] generic_shutdown_super+0x136/0x2c0 [ 51.346291][ T3501] kill_block_super+0x7a/0xe0 [ 51.350952][ T3501] deactivate_locked_super+0xa0/0x110 [ 51.356314][ T3501] cleanup_mnt+0x44e/0x500 [ 51.360719][ T3501] ? lockdep_hardirqs_on+0x94/0x130 [ 51.365914][ T3501] task_work_run+0x129/0x1a0 [ 51.370505][ T3501] do_exit+0x6a3/0x2480 [ 51.374657][ T3501] ? put_task_struct+0x80/0x80 [ 51.379412][ T3501] ? lockdep_hardirqs_on_prepare+0x438/0x7a0 [ 51.385383][ T3501] ? vtime_user_exit+0x2d1/0x400 [ 51.390311][ T3501] do_group_exit+0x144/0x310 [ 51.394891][ T3501] __x64_sys_exit_group+0x3b/0x40 [ 51.399900][ T3501] do_syscall_64+0x3b/0xb0 [ 51.404305][ T3501] ? clear_bhb_loop+0x15/0x70 [ 51.408978][ T3501] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 51.414865][ T3501] RIP: 0033:0x7f7b9d456d89 [ 51.419267][ T3501] Code: Unable to access opcode bytes at RIP 0x7f7b9d456d5f. [ 51.426622][ T3501] RSP: 002b:00007ffc78616c38 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 51.435016][ T3501] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f7b9d456d89 [ 51.442979][ T3501] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 51.450937][ T3501] RBP: 00007f7b9d4f2390 R08: ffffffffffffffb8 R09: 000000000001f22c [ 51.458897][ T3501] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7b9d4f2390 [ 51.466858][ T3501] R13: 0000000000000000 R14: 00007f7b9d4f3100 R15: 00007f7b9d425060 [ 51.474843][ T3501] [ 51.478117][ T3501] Kernel Offset: disabled [ 51.482432][ T3501] Rebooting in 86400 seconds..