Warning: Permanently added '10.128.1.170' (ED25519) to the list of known hosts. 2024/04/13 15:06:11 ignoring optional flag "sandboxArg"="0" 2024/04/13 15:06:11 parsed 1 programs 2024/04/13 15:06:12 executed programs: 0 [ 54.120025][ T1994] loop0: detected capacity change from 0 to 2048 [ 54.128201][ T1994] UDF-fs: error (device loop0): udf_read_tagged: tag version 0x0000 != 0x0002 || 0x0003, block 0 [ 54.139183][ T1994] UDF-fs: error (device loop0): udf_read_tagged: tag version 0x0000 != 0x0002 || 0x0003, block 0 [ 54.150541][ T1994] UDF-fs: error (device loop0): udf_read_tagged: tag version 0x0000 != 0x0002 || 0x0003, block 0 [ 54.161253][ T1994] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 54.169321][ T1994] UDF-fs: Scanning with blocksize 512 failed [ 54.176770][ T1994] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 54.228136][ T1583] ================================================================== [ 54.236269][ T1583] BUG: KASAN: use-after-free in crc_itu_t+0x178/0x240 [ 54.243104][ T1583] Read of size 1 at addr ffff88806bbbc000 by task syz-executor.0/1583 [ 54.251236][ T1583] [ 54.253551][ T1583] CPU: 0 PID: 1583 Comm: syz-executor.0 Not tainted 6.1.86-syzkaller #0 [ 54.261844][ T1583] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 54.271959][ T1583] Call Trace: [ 54.275562][ T1583] [ 54.278510][ T1583] dump_stack_lvl+0xf4/0x251 [ 54.283076][ T1583] ? nf_tcp_handle_invalid+0x2f3/0x2f3 [ 54.288528][ T1583] ? panic+0x3fe/0x3fe [ 54.292588][ T1583] ? lock_acquire+0xbe/0x390 [ 54.297184][ T1583] ? read_lock_is_recursive+0x10/0x10 [ 54.302546][ T1583] ? __virt_addr_valid+0x139/0x260 [ 54.307635][ T1583] ? __virt_addr_valid+0x211/0x260 [ 54.312734][ T1583] print_report+0x15f/0x4f0 [ 54.317306][ T1583] ? __virt_addr_valid+0x139/0x260 [ 54.322405][ T1583] ? __virt_addr_valid+0x211/0x260 [ 54.327507][ T1583] ? crc_itu_t+0x178/0x240 [ 54.331915][ T1583] kasan_report+0x136/0x160 [ 54.336411][ T1583] ? crc_itu_t+0x178/0x240 [ 54.340828][ T1583] crc_itu_t+0x178/0x240 [ 54.345056][ T1583] udf_sync_fs+0x1bd/0x370 [ 54.349478][ T1583] ? udf_put_super+0x130/0x130 [ 54.354317][ T1583] ? dentry_kill+0xbb/0x1e0 [ 54.358808][ T1583] sync_filesystem+0xbf/0x180 [ 54.363678][ T1583] generic_shutdown_super+0x65/0x2c0 [ 54.368951][ T1583] kill_block_super+0x75/0xb0 [ 54.373620][ T1583] deactivate_locked_super+0x71/0xd0 [ 54.378879][ T1583] cleanup_mnt+0x2bd/0x330 [ 54.383287][ T1583] task_work_run+0x206/0x280 [ 54.387849][ T1583] ? task_work_cancel+0x2a0/0x2a0 [ 54.392941][ T1583] ? __x64_sys_umount+0xe4/0x120 [ 54.397856][ T1583] ? path_umount+0xc70/0xc70 [ 54.402413][ T1583] exit_to_user_mode_loop+0xa9/0xc0 [ 54.407592][ T1583] exit_to_user_mode_prepare+0x64/0xb0 [ 54.413056][ T1583] syscall_exit_to_user_mode+0x27/0x1b0 [ 54.418573][ T1583] do_syscall_64+0x47/0x80 [ 54.422974][ T1583] ? clear_bhb_loop+0x45/0xa0 [ 54.427666][ T1583] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 54.433635][ T1583] RIP: 0033:0x7fce2807dc87 [ 54.438036][ T1583] Code: b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b0 ff ff ff f7 d8 64 89 02 b8 [ 54.457706][ T1583] RSP: 002b:00007ffd81641e78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 54.466231][ T1583] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fce2807dc87 [ 54.474182][ T1583] RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007ffd81641f30 [ 54.482151][ T1583] RBP: 00007ffd81641f30 R08: 0000000000000000 R09: 0000000000000000 [ 54.490129][ T1583] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd81642ff0 [ 54.498086][ T1583] R13: 00007fce280d7c5a R14: 000000000000d348 R15: 0000000000000006 [ 54.506038][ T1583] [ 54.509120][ T1583] [ 54.511417][ T1583] The buggy address belongs to the physical page: [ 54.517805][ T1583] page:ffffea0001aeef00 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x6bbbc [ 54.527930][ T1583] flags: 0xfff80000000000(node=0|zone=1|lastcpupid=0xfff) [ 54.535185][ T1583] raw: 00fff80000000000 ffffea0001aedbc8 ffffea0001aeddc8 0000000000000000 [ 54.543750][ T1583] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 54.552334][ T1583] page dumped because: kasan: bad access detected [ 54.558813][ T1583] page_owner tracks the page as freed [ 54.564155][ T1583] page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 1993, tgid 1993 (syz-executor.0), ts 54108102203, free_ts 54225271248 [ 54.582027][ T1583] post_alloc_hook+0x286/0x2b0 [ 54.586784][ T1583] get_page_from_freelist+0x2fdd/0x3170 [ 54.592326][ T1583] __alloc_pages+0x251/0x640 [ 54.596883][ T1583] __folio_alloc+0xf/0x30 [ 54.601268][ T1583] vma_alloc_folio+0x484/0x9e0 [ 54.606020][ T1583] wp_page_copy+0x226/0x1970 [ 54.610576][ T1583] handle_mm_fault+0x1f58/0x4260 [ 54.615483][ T1583] exc_page_fault+0x22a/0x5e0 [ 54.620235][ T1583] asm_exc_page_fault+0x22/0x30 [ 54.625062][ T1583] page last free stack trace: [ 54.629791][ T1583] free_unref_page_prepare+0xd4b/0xee0 [ 54.635327][ T1583] free_unref_page_list+0x54b/0x7e0 [ 54.641100][ T1583] release_pages+0x175c/0x1900 [ 54.645832][ T1583] tlb_flush_mmu+0xe5/0x1d0 [ 54.650303][ T1583] tlb_finish_mmu+0xb0/0x1b0 [ 54.654860][ T1583] exit_mmap+0x341/0x730 [ 54.659067][ T1583] __mmput+0x9b/0x2d0 [ 54.663100][ T1583] exit_mm+0x122/0x1b0 [ 54.667485][ T1583] do_exit+0x81e/0x23a0 [ 54.671630][ T1583] do_group_exit+0x1b5/0x280 [ 54.676360][ T1583] get_signal+0x1117/0x1260 [ 54.680918][ T1583] arch_do_signal_or_restart+0xb3/0x1240 [ 54.686522][ T1583] exit_to_user_mode_loop+0x61/0xc0 [ 54.691701][ T1583] exit_to_user_mode_prepare+0x64/0xb0 [ 54.697125][ T1583] syscall_exit_to_user_mode+0x27/0x1b0 [ 54.702635][ T1583] do_syscall_64+0x47/0x80 [ 54.707018][ T1583] [ 54.709314][ T1583] Memory state around the buggy address: [ 54.714909][ T1583] ffff88806bbbbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 54.722937][ T1583] ffff88806bbbbf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 54.730969][ T1583] >ffff88806bbbc000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.739092][ T1583] ^ [ 54.743139][ T1583] ffff88806bbbc080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.751259][ T1583] ffff88806bbbc100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.759287][ T1583] ================================================================== [ 54.768294][ T1583] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 54.775715][ T1583] Kernel Offset: disabled [ 54.780193][ T1583] Rebooting in 86400 seconds..