Warning: Permanently added '10.128.1.207' (ED25519) to the list of known hosts. 2024/05/23 16:53:21 ignoring optional flag "sandboxArg"="0" 2024/05/23 16:53:21 parsed 1 programs 2024/05/23 16:53:22 executed programs: 0 [ 49.774567][ T1584] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 54.499268][ T2001] loop0: detected capacity change from 0 to 2048 [ 54.509822][ T2001] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 54.531520][ T1590] ================================================================== [ 54.539608][ T1590] BUG: KASAN: use-after-free in crc_itu_t+0x178/0x240 [ 54.546458][ T1590] Read of size 1 at addr ffff888069c1e000 by task syz-executor.0/1590 [ 54.554581][ T1590] [ 54.556893][ T1590] CPU: 1 PID: 1590 Comm: syz-executor.0 Not tainted 6.1.91-syzkaller #0 [ 54.565273][ T1590] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 [ 54.575337][ T1590] Call Trace: [ 54.578593][ T1590] [ 54.581509][ T1590] dump_stack_lvl+0xf4/0x251 [ 54.586093][ T1590] ? nf_tcp_handle_invalid+0x2f3/0x2f3 [ 54.591522][ T1590] ? panic+0x3fe/0x3fe [ 54.595556][ T1590] ? lock_acquire+0xbe/0x390 [ 54.600117][ T1590] ? read_lock_is_recursive+0x10/0x10 [ 54.605470][ T1590] ? __virt_addr_valid+0x139/0x260 [ 54.610660][ T1590] ? __virt_addr_valid+0x211/0x260 [ 54.615742][ T1590] print_report+0x15f/0x4f0 [ 54.620389][ T1590] ? __virt_addr_valid+0x139/0x260 [ 54.625473][ T1590] ? __virt_addr_valid+0x211/0x260 [ 54.630562][ T1590] ? crc_itu_t+0x178/0x240 [ 54.634954][ T1590] kasan_report+0x136/0x160 [ 54.639422][ T1590] ? crc_itu_t+0x178/0x240 [ 54.643804][ T1590] crc_itu_t+0x178/0x240 [ 54.648010][ T1590] udf_sync_fs+0x1bd/0x370 [ 54.652388][ T1590] ? udf_put_super+0x130/0x130 [ 54.657115][ T1590] ? dentry_kill+0xbb/0x1e0 [ 54.661681][ T1590] sync_filesystem+0xbf/0x180 [ 54.666424][ T1590] generic_shutdown_super+0x65/0x2c0 [ 54.671675][ T1590] kill_block_super+0x75/0xb0 [ 54.676320][ T1590] deactivate_locked_super+0x71/0xd0 [ 54.681635][ T1590] cleanup_mnt+0x2bd/0x330 [ 54.686035][ T1590] task_work_run+0x206/0x280 [ 54.690616][ T1590] ? task_work_cancel+0x2a0/0x2a0 [ 54.695694][ T1590] ? __x64_sys_umount+0xe4/0x120 [ 54.700600][ T1590] ? path_umount+0xc70/0xc70 [ 54.705156][ T1590] exit_to_user_mode_loop+0xa9/0xc0 [ 54.710322][ T1590] exit_to_user_mode_prepare+0x64/0xb0 [ 54.715752][ T1590] syscall_exit_to_user_mode+0x27/0x1b0 [ 54.721269][ T1590] do_syscall_64+0x47/0x80 [ 54.725659][ T1590] ? clear_bhb_loop+0x45/0xa0 [ 54.730301][ T1590] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 54.736186][ T1590] RIP: 0033:0x7f81eec7de17 [ 54.740574][ T1590] Code: b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b0 ff ff ff f7 d8 64 89 02 b8 [ 54.760252][ T1590] RSP: 002b:00007fff01ab2f78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 54.768636][ T1590] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f81eec7de17 [ 54.776744][ T1590] RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007fff01ab3030 [ 54.784875][ T1590] RBP: 00007fff01ab3030 R08: 0000000000000000 R09: 0000000000000000 [ 54.792903][ T1590] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fff01ab40f0 [ 54.800842][ T1590] R13: 00007f81eecc73b9 R14: 000000000000d4ac R15: 0000000000000006 [ 54.808807][ T1590] [ 54.811815][ T1590] [ 54.814113][ T1590] The buggy address belongs to the physical page: [ 54.820762][ T1590] page:ffffea0001a70780 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x69c1e [ 54.830876][ T1590] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 54.837955][ T1590] raw: 00fff00000000000 ffffea0001a70108 ffffea0001a8ffc8 0000000000000000 [ 54.846504][ T1590] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 54.855117][ T1590] page dumped because: kasan: bad access detected [ 54.861505][ T1590] page_owner tracks the page as freed [ 54.866841][ T1590] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 2001, tgid 2000 (syz-executor.0), ts 54488731113, free_ts 54498937549 [ 54.885670][ T1590] post_alloc_hook+0x286/0x2b0 [ 54.890439][ T1590] get_page_from_freelist+0x2fdd/0x3170 [ 54.895966][ T1590] __alloc_pages+0x251/0x640 [ 54.900522][ T1590] __folio_alloc+0xf/0x30 [ 54.904818][ T1590] vma_alloc_folio+0x484/0x9e0 [ 54.909551][ T1590] handle_mm_fault+0x232f/0x4260 [ 54.914630][ T1590] exc_page_fault+0x22a/0x5e0 [ 54.919290][ T1590] asm_exc_page_fault+0x22/0x30 [ 54.924125][ T1590] page last free stack trace: [ 54.928768][ T1590] free_unref_page_prepare+0xd4b/0xee0 [ 54.934202][ T1590] free_unref_page_list+0x54b/0x7e0 [ 54.939379][ T1590] release_pages+0x175c/0x1900 [ 54.944130][ T1590] tlb_flush_mmu+0xe5/0x1d0 [ 54.948627][ T1590] tlb_finish_mmu+0xb0/0x1b0 [ 54.953204][ T1590] unmap_region+0x265/0x2b0 [ 54.957691][ T1590] do_mas_align_munmap+0xa6c/0x11e0 [ 54.962963][ T1590] do_mas_munmap+0x195/0x1f0 [ 54.967525][ T1590] __vm_munmap+0x236/0x300 [ 54.971911][ T1590] __x64_sys_munmap+0x57/0x60 [ 54.976571][ T1590] do_syscall_64+0x3b/0x80 [ 54.980956][ T1590] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 54.986882][ T1590] [ 54.989183][ T1590] Memory state around the buggy address: [ 54.994788][ T1590] ffff888069c1df00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 55.002992][ T1590] ffff888069c1df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 55.011054][ T1590] >ffff888069c1e000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 55.019086][ T1590] ^ [ 55.023121][ T1590] ffff888069c1e080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 55.031181][ T1590] ffff888069c1e100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 55.039310][ T1590] ================================================================== [ 55.048857][ T1590] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 55.056525][ T1590] Kernel Offset: disabled [ 55.060839][ T1590] Rebooting in 86400 seconds..