UDF-fs: warning (device loop0): udf_load_vrs: No VRS found UDF-fs: Scanning with blocksize 2048 failed UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) ================================================================== BUG: KASAN: use-after-free in udf_close_lvid.isra.0+0x5a1/0x630 fs/udf/super.c:2044 Write of size 1 at addr ffff88818daba060 by task syz-executor175/7996 CPU: 0 PID: 7996 Comm: syz-executor175 Not tainted 4.14.302-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252 kasan_report_error.cold+0x8a/0x191 mm/kasan/report.c:351 kasan_report mm/kasan/report.c:409 [inline] __asan_report_store1_noabort+0x68/0x70 mm/kasan/report.c:432 udf_close_lvid.isra.0+0x5a1/0x630 fs/udf/super.c:2044 udf_put_super+0x211/0x2a0 fs/udf/super.c:2354 generic_shutdown_super+0x144/0x370 fs/super.c:446 kill_block_super+0x95/0xe0 fs/super.c:1161 deactivate_locked_super+0x6c/0xd0 fs/super.c:319 deactivate_super+0x7f/0xa0 fs/super.c:350 cleanup_mnt+0x186/0x2c0 fs/namespace.c:1183 task_work_run+0x11f/0x190 kernel/task_work.c:113 exit_task_work include/linux/task_work.h:22 [inline] do_exit+0xa44/0x2850 kernel/exit.c:868 do_group_exit+0x100/0x2e0 kernel/exit.c:965 SYSC_exit_group kernel/exit.c:976 [inline] SyS_exit_group+0x19/0x20 kernel/exit.c:974 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x5e/0xd3 RIP: 0033:0x7f4595f468c9 RSP: 002b:00007ffd78cba6f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 00007f4595fcd470 RCX: 00007f4595f468c9 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 RBP: 0000000000000001 R08: ffffffffffffffb8 R09: 00007f4595fc7e90 R10: 000080001d00c0d0 R11: 0000000000000246 R12: 00007f4595fcd470 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 The buggy address belongs to the page: page:ffffea000636ae80 count:0 mapcount:0 mapping: (null) index:0x0 flags: 0x57ff00000000000() raw: 057ff00000000000 0000000000000000 0000000000000000 00000000ffffffff raw: ffffea000636aea0 ffffea000636aea0 0000000000000000 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88818dab9f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88818dab9f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff88818daba000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88818daba080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88818daba100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================