13 bridge0 1 0 333300000001 13 bridge0 1 0 01005e00006a 13 bridge0 1 0 33330000006a 13 bridge0 1 0 01005e000001 13 bridge0 1 0 3333ff00000c 13 bridge0 1 0 3333ffaaaa0c 15 bond0 3 0 333300000001 15 bond0 3 0 01005e000001 ================================================================== BUG: KASAN: global-out-of-bounds in record_print_text+0x3aa/0x3e0 kernel/printk/printk.c:1401 Write of size 1 at addr ffffffff8f934daa by task syz-executor.5/10642 CPU: 1 PID: 10642 Comm: syz-executor.5 Not tainted 5.11.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x183/0x22e lib/dump_stack.c:120 print_address_description+0x5f/0x3b0 mm/kasan/report.c:230 __kasan_report mm/kasan/report.c:396 [inline] kasan_report+0x15e/0x200 mm/kasan/report.c:413 record_print_text+0x3aa/0x3e0 kernel/printk/printk.c:1401 console_unlock+0x6f6/0xda0 kernel/printk/printk.c:2555 vprintk_emit+0x1b2/0x270 kernel/printk/printk.c:2092 printk+0xc0/0x103 kernel/printk/printk.c:2140 logfc+0x409/0x520 fs/fs_context.c:379 vfs_parse_fs_param+0x2c9/0x460 fs/fs_context.c:135 vfs_parse_fs_string+0x1af/0x280 fs/fs_context.c:161 shmem_parse_options+0x14f/0x200 mm/shmem.c:3570 do_new_mount fs/namespace.c:2877 [inline] path_mount+0x1906/0x2c50 fs/namespace.c:3211 do_mount fs/namespace.c:3224 [inline] __do_sys_mount fs/namespace.c:3432 [inline] __se_sys_mount+0x2f9/0x3b0 fs/namespace.c:3409 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45e219 Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f72b0e9ec68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000045e219 RDX: 0000000020000000 RSI: 0000000020000180 RDI: 0000000000000000 RBP: 000000000119bfd0 R08: 0000000020000240 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000119bf8c R13: 00007ffdbde01a3f R14: 00007f72b0e9f9c0 R15: 000000000119bf8c The buggy address belongs to the variable: console_owner+0x2a/0x40 Memory state around the buggy address: ffffffff8f934c80: 01 f9 f9 f9 f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9 ffffffff8f934d00: 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 >ffffffff8f934d80: 00 f9 f9 f9 f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9 ^ ffffffff8f934e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffffff8f934e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================