Warning: Permanently added '10.128.1.149' (ED25519) to the list of known hosts. 2024/03/23 16:19:19 ignoring optional flag "sandboxArg"="0" 2024/03/23 16:19:19 parsed 1 programs 2024/03/23 16:19:19 executed programs: 0 [ 52.690530][ T1582] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 57.640591][ T1998] loop0: detected capacity change from 0 to 2048 [ 57.649498][ T1998] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) 2024/03/23 16:19:24 executed programs: 2 [ 57.701987][ T2001] loop0: detected capacity change from 0 to 2048 [ 57.710781][ T2001] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 57.761187][ T2003] loop0: detected capacity change from 0 to 2048 [ 57.769802][ T2003] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 57.795806][ T1587] ================================================================== [ 57.803901][ T1587] BUG: KASAN: use-after-free in crc_itu_t+0x178/0x240 [ 57.810659][ T1587] Read of size 1 at addr ffff88806bb58000 by task syz-executor.0/1587 [ 57.818800][ T1587] [ 57.821131][ T1587] CPU: 1 PID: 1587 Comm: syz-executor.0 Not tainted 6.1.82-syzkaller #0 [ 57.829458][ T1587] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 [ 57.839670][ T1587] Call Trace: [ 57.842932][ T1587] [ 57.845844][ T1587] dump_stack_lvl+0xf4/0x251 [ 57.850519][ T1587] ? nf_tcp_handle_invalid+0x2f3/0x2f3 [ 57.856057][ T1587] ? panic+0x3f7/0x3f7 [ 57.860107][ T1587] ? lock_acquire+0xbe/0x390 [ 57.864709][ T1587] ? read_lock_is_recursive+0x10/0x10 [ 57.870256][ T1587] ? __virt_addr_valid+0x139/0x260 [ 57.875378][ T1587] ? __virt_addr_valid+0x211/0x260 [ 57.880563][ T1587] print_report+0x15f/0x4f0 [ 57.885070][ T1587] ? __virt_addr_valid+0x139/0x260 [ 57.890430][ T1587] ? __virt_addr_valid+0x211/0x260 [ 57.895521][ T1587] ? crc_itu_t+0x178/0x240 [ 57.899912][ T1587] kasan_report+0x136/0x160 [ 57.904392][ T1587] ? crc_itu_t+0x178/0x240 [ 57.908800][ T1587] crc_itu_t+0x178/0x240 [ 57.913174][ T1587] udf_sync_fs+0x1bd/0x370 [ 57.917611][ T1587] ? udf_put_super+0x130/0x130 [ 57.922515][ T1587] ? dentry_kill+0xbb/0x1e0 [ 57.927015][ T1587] sync_filesystem+0xbf/0x180 [ 57.931693][ T1587] generic_shutdown_super+0x65/0x2c0 [ 57.937143][ T1587] kill_block_super+0x75/0xb0 [ 57.941815][ T1587] deactivate_locked_super+0x71/0xd0 [ 57.947112][ T1587] cleanup_mnt+0x2bd/0x330 [ 57.951622][ T1587] task_work_run+0x206/0x280 [ 57.956203][ T1587] ? task_work_cancel+0x2a0/0x2a0 [ 57.961210][ T1587] ? __x64_sys_umount+0xe4/0x120 [ 57.966143][ T1587] ? path_umount+0xc70/0xc70 [ 57.971382][ T1587] exit_to_user_mode_loop+0xa9/0xc0 [ 57.976845][ T1587] exit_to_user_mode_prepare+0x64/0xb0 [ 57.982400][ T1587] syscall_exit_to_user_mode+0x27/0x1b0 [ 57.988282][ T1587] do_syscall_64+0x49/0x80 [ 57.992849][ T1587] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 57.998902][ T1587] RIP: 0033:0x7ff8c867de17 [ 58.003925][ T1587] Code: b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b0 ff ff ff f7 d8 64 89 02 b8 [ 58.023800][ T1587] RSP: 002b:00007ffceab4e008 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 58.032387][ T1587] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007ff8c867de17 [ 58.040364][ T1587] RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007ffceab4e0c0 [ 58.048595][ T1587] RBP: 00007ffceab4e0c0 R08: 0000000000000000 R09: 0000000000000000 [ 58.056738][ T1587] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffceab4f180 [ 58.064712][ T1587] R13: 00007ff8c86c73b9 R14: 000000000000e17a R15: 0000000000000006 [ 58.072773][ T1587] [ 58.075777][ T1587] [ 58.078166][ T1587] The buggy address belongs to the physical page: [ 58.084814][ T1587] page:ffffea0001aed600 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x6bb58 [ 58.094940][ T1587] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 58.102023][ T1587] raw: 00fff00000000000 ffffea0001aec808 ffffea0001aed308 0000000000000000 [ 58.110578][ T1587] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 58.119134][ T1587] page dumped because: kasan: bad access detected [ 58.125525][ T1587] page_owner tracks the page as freed [ 58.130952][ T1587] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 2001, tgid 2000 (syz-executor.0), ts 57694640848, free_ts 57701704961 [ 58.149845][ T1587] post_alloc_hook+0x286/0x2b0 [ 58.154586][ T1587] get_page_from_freelist+0x2fdd/0x3170 [ 58.160113][ T1587] __alloc_pages+0x251/0x640 [ 58.164851][ T1587] __folio_alloc+0xf/0x30 [ 58.169159][ T1587] vma_alloc_folio+0x484/0x9e0 [ 58.174156][ T1587] handle_mm_fault+0x232f/0x4260 [ 58.179070][ T1587] exc_page_fault+0x22a/0x5e0 [ 58.183949][ T1587] asm_exc_page_fault+0x22/0x30 [ 58.189345][ T1587] page last free stack trace: [ 58.194424][ T1587] free_unref_page_prepare+0xd4b/0xee0 [ 58.199966][ T1587] free_unref_page_list+0x54b/0x7e0 [ 58.205314][ T1587] release_pages+0x175c/0x1900 [ 58.210051][ T1587] tlb_flush_mmu+0xe5/0x1d0 [ 58.214530][ T1587] tlb_finish_mmu+0xb0/0x1b0 [ 58.219098][ T1587] unmap_region+0x265/0x2b0 [ 58.223573][ T1587] do_mas_align_munmap+0xa6c/0x11e0 [ 58.228752][ T1587] do_mas_munmap+0x195/0x1f0 [ 58.233339][ T1587] __vm_munmap+0x236/0x300 [ 58.237735][ T1587] __x64_sys_munmap+0x57/0x60 [ 58.242383][ T1587] do_syscall_64+0x3d/0x80 [ 58.246772][ T1587] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 58.252654][ T1587] [ 58.255853][ T1587] Memory state around the buggy address: [ 58.261458][ T1587] ffff88806bb57f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 58.269499][ T1587] ffff88806bb57f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 58.277563][ T1587] >ffff88806bb58000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 58.285682][ T1587] ^ [ 58.289722][ T1587] ffff88806bb58080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 58.297752][ T1587] ffff88806bb58100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 58.305806][ T1587] ================================================================== [ 58.316040][ T1587] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 58.323685][ T1587] Kernel Offset: disabled [ 58.328019][ T1587] Rebooting in 86400 seconds..