FAT-fs (loop0): bogus number of reserved sectors ================================================================== BUG: KASAN: use-after-free in ex_handler_refcount+0x18f/0x1c0 arch/x86/mm/extable.c:49 Write of size 4 at addr ffff88809c113380 by task kworker/0:3/22878 CPU: 0 PID: 22878 Comm: kworker/0:3 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 Workqueue: events sco_sock_timeout FAT-fs (loop0): Can't find a valid FAT filesystem Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 print_address_description.cold+0x54/0x219 mm/kasan/report.c:256 kasan_report_error.cold+0x8a/0x1b9 mm/kasan/report.c:354 kasan_report mm/kasan/report.c:412 [inline] __asan_report_store4_noabort+0x88/0x90 mm/kasan/report.c:437 ex_handler_refcount+0x18f/0x1c0 arch/x86/mm/extable.c:49 fixup_exception+0x8a/0xd0 arch/x86/mm/extable.c:197 do_trap_no_signal arch/x86/kernel/traps.c:209 [inline] do_trap+0x61/0x250 arch/x86/kernel/traps.c:258 do_error_trap+0x15d/0x310 arch/x86/kernel/traps.c:303 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1038 RIP: 0010:__noinstr_text_end+0x60f9/0x7813 Code: 8d 80 00 00 00 0f 0b 49 8d 8d e4 00 00 00 0f 0b 49 8d 8d 80 00 00 00 0f 0b 49 8d 8c 24 80 00 00 00 0f 0b 48 8d 8d 80 00 00 00 <0f> 0b 48 8d 8d 80 00 00 00 0f 0b 49 8d 8c 24 80 00 00 00 0f 0b 49 RSP: 0018:ffff888090defd28 EFLAGS: 00010287 RAX: ffff8880a4c225c0 RBX: 0000000000000000 RCX: ffff88809c113380 FAT-fs (loop4): bogus number of reserved sectors RDX: 0000000000000000 RSI: ffffffff87462a68 RDI: ffff8880a85ed840 RBP: ffff88809c113300 R08: 0000000000000001 R09: ffffed10150bdb01 R10: ffff8880a85ed80b R11: 0000000000074071 R12: ffff8880a85ed808 R13: ffff8880abd75f00 R14: ffff8880ba02a8c0 R15: ffff8880ba02f000 process_one_work+0x864/0x1570 kernel/workqueue.c:2153 FAT-fs (loop4): Can't find a valid FAT filesystem worker_thread+0x64c/0x1130 kernel/workqueue.c:2296 kthread+0x33f/0x460 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Allocated by task 17266: __do_kmalloc mm/slab.c:3727 [inline] __kmalloc+0x15a/0x3c0 mm/slab.c:3736 FAT-fs (loop2): bogus number of reserved sectors kmalloc include/linux/slab.h:520 [inline] kzalloc include/linux/slab.h:709 [inline] __register_sysctl_table+0x112/0x1090 fs/proc/proc_sysctl.c:1310 __devinet_sysctl_register+0x156/0x280 net/ipv4/devinet.c:2344 devinet_sysctl_register+0x160/0x230 net/ipv4/devinet.c:2384 inetdev_init+0x223/0x4a0 net/ipv4/devinet.c:269 inetdev_event+0x9cf/0x1270 net/ipv4/devinet.c:1477 FAT-fs (loop2): Can't find a valid FAT filesystem notifier_call_chain+0xc0/0x230 kernel/notifier.c:93 call_netdevice_notifiers net/core/dev.c:1762 [inline] register_netdevice+0xdd2/0x10f0 net/core/dev.c:8761 register_netdev+0x2d/0x50 net/core/dev.c:8859 gprs_attach+0x120/0x4a0 net/phonet/pep-gprs.c:269 pep_setsockopt+0x395/0x490 net/phonet/pep.c:1018 __sys_setsockopt+0x14d/0x240 net/socket.c:2013 __do_sys_setsockopt net/socket.c:2024 [inline] __se_sys_setsockopt net/socket.c:2021 [inline] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2021 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 9: __cache_free mm/slab.c:3503 [inline] kfree+0xcc/0x210 mm/slab.c:3822 __rcu_reclaim kernel/rcu/rcu.h:231 [inline] rcu_do_batch kernel/rcu/tree.c:2584 [inline] invoke_rcu_callbacks kernel/rcu/tree.c:2897 [inline] __rcu_process_callbacks kernel/rcu/tree.c:2864 [inline] rcu_process_callbacks+0xa0d/0x18b0 kernel/rcu/tree.c:2881 __do_softirq+0x265/0x980 kernel/softirq.c:292 The buggy address belongs to the object at ffff88809c113300 which belongs to the cache kmalloc-2048 of size 2048 The buggy address is located 128 bytes inside of 2048-byte region [ffff88809c113300, ffff88809c113b00) The buggy address belongs to the page: page:ffffea0002704480 count:1 mapcount:0 mapping:ffff88813bff0c40 index:0xffff88809c113300 compound_mapcount: 0 flags: 0xfff00000008100(slab|head) raw: 00fff00000008100 ffffea0001569d08 ffffea00023ead88 ffff88813bff0c40 raw: ffff88809c113300 ffff88809c112200 0000000100000002 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88809c113280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88809c113300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88809c113380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88809c113400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88809c113480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================