[ 79.811965][ T31] audit: type=1400 audit(1794645321.203:207): avc: denied { write } for pid=5994 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
Warning: Permanently added '10.128.1.187' (ED25519) to the list of known hosts.
[*] Starting reproducer for KASAN slab-out-of-bounds in super_90_validate...
[+] Successfully opened /dev/loop-control.
[+] Allocated loop device index: 0
[+] Created backing file /tmp/md_test_img0.
[+] Backing file truncated to 4MB.
[+] Opened loop device /dev/loop0.
[+] Attached backing file to /dev/loop0 via LOOP_SET_FD.
[+] Loop device /dev/loop0 ready, dev_t=(7, 0).
[+] Allocated loop device index: 1
[+] Created backing file /tmp/md_test_img1.
[+] Backing file truncated to 4MB.
[+] Opened loop device /dev/loop1.
[+] Attached backing file to /dev/loop1 via LOOP_SET_FD.
[+] Loop device /dev/loop1 ready, dev_t=(7, 1).
[+] Both backing loop devices set up successfully.
[*] /dev/md0 does not exist, creating node (9, 0)...
[+] mknod /dev/md0 successful.
[ 85.047627][ T31] audit: type=1400 audit(1794645326.433:208): avc: denied { read write } for pid=6009 comm="syz-executor291" name="loop-control" dev="devtmpfs" ino=644 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1
[ 85.053464][ T6009] loop0: detected capacity change from 0 to 8192
[+] Successfully opened /dev/md0.
[ 85.060191][ T31] audit: type=1400 audit(1794645326.443:209): avc: denied { open } for pid=6009 comm="syz-executor291" path="/dev/loop-control" dev="devtmpfs" ino=644 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1
[ 85.060227][ T31] audit: type=1400 audit(1794645326.443:210): avc: denied { ioctl } for pid=6009 comm="syz-executor291" path="/dev/loop-control" dev="devtmpfs" ino=644 ioctlcmd=0x4c82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1
[ 85.060257][ T31] audit: type=1400 audit(1794645326.443:211): avc: denied { write } for pid=6009 comm="syz-executor291" name="loop0" dev="devtmpfs" ino=645 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[ 85.068132][ T6009] loop1: detected capacity change from 0 to 8192
[ 85.071819][ T31] audit: type=1400 audit(1794645326.463:212): avc: denied { create } for pid=6009 comm="syz-executor291" name="md0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=blk_file permissive=1
[+] ioctl STOP_ARRAY successful.
[+] ioctl SET_ARRAY_INFO successful (level=1, raid_disks=35, not_persistent=1).
[ 85.074449][ T31] audit: type=1400 audit(1794645326.463:213): avc: denied { read write } for pid=6009 comm="syz-executor291" name="md0" dev="devtmpfs" ino=2789 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=blk_file permissive=1
[ 85.077717][ T31] audit: type=1400 audit(1794645326.463:214): avc: denied { open } for pid=6009 comm="syz-executor291" path="/dev/md0" dev="devtmpfs" ino=2789 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=blk_file permissive=1
[ 85.112292][ T6009] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
[+] ioctl ADD_NEW_DISK successful for initial active disk.
[ 85.112345][ T6009] block device autoloading is deprecated and will be removed.
[ 85.112993][ T31] audit: type=1400 audit(1794645326.503:215): avc: denied { ioctl } for pid=6009 comm="syz-executor291" path="/dev/md0" dev="devtmpfs" ino=2789 ioctlcmd=0x932 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=blk_file permissive=1
[ 85.192787][ T6009] md: md0 stopped.
[+] ioctl RUN_ARRAY successful (RAID1 started in degraded mode with 1 mirror).
[*] Adding hot-add journal disk (state=0x40000) to trigger OOB read in super_90_validate...
[ 85.347027][ T6009] md/raid1:md0: active with 1 out of 35 mirrors
[ 85.347687][ T6009] md0: detected capacity change from 0 to 4096
[ 85.362429][ T6009] =========================
** replaying previous printk message **
[ 85.362429][ T6009] ==================================================================
[ 85.362439][ T6009] BUG: KASAN: use-after-free in super_90_validate+0x178b/0x18c0
[ 85.362461][ T6009] Read of size 4 at addr ffff888073d36390 by task syz-executor291/6009
[ 85.362473][ T6009]
[ 85.362481][ T6009] CPU: 1 UID: 0 PID: 6009 Comm: syz-executor291 Not tainted syzkaller #0 PREEMPT(full)
[ 85.362497][ T6009] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
[ 85.362506][ T6009] Call Trace:
[ 85.362511][ T6009]
[ 85.362516][ T6009] dump_stack_lvl+0x100/0x190
[ 85.362540][ T6009] print_report+0x13d/0x4b0
[ 85.362567][ T6009] ? __virt_addr_valid+0x239/0x430
[ 85.362586][ T6009] ? super_90_validate+0x178b/0x18c0
[ 85.362603][ T6009] kasan_report+0xdf/0x1c0
[ 85.362621][ T6009] ? super_90_validate+0x178b/0x18c0
[ 85.362640][ T6009] super_90_validate+0x178b/0x18c0
[ 85.362657][ T6009] ? __pfx_bind_rdev_to_array+0x10/0x10
[ 85.362680][ T6009] ? kobject_init+0x159/0x1b0
[ 85.362696][ T6009] add_bound_rdev+0x274/0x390
[ 85.362720][ T6009] md_add_new_disk+0xca1/0x1820
[ 85.362741][ T6009] md_ioctl+0x2c1d/0x3700
[ 85.362761][ T6009] ? __pfx_md_ioctl+0x10/0x10
[ 85.362779][ T6009] ? do_vfs_ioctl+0x241/0x13f0
[ 85.362799][ T6009] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10
[ 85.362823][ T6009] ? __pfx_md_ioctl+0x10/0x10
[ 85.362842][ T6009] blkdev_ioctl+0x5ad/0x6f0
[ 85.362863][ T6009] ? __pfx_blkdev_ioctl+0x10/0x10
[ 85.362882][ T6009] ? selinux_file_ioctl+0x1e0/0x290
[ 85.362900][ T6009] ? selinux_file_ioctl+0x1e7/0x290
[ 85.362918][ T6009] ? __pfx_blkdev_ioctl+0x10/0x10
[ 85.362938][ T6009] __x64_sys_ioctl+0x18e/0x210
[ 85.362956][ T6009] do_syscall_64+0x123/0x7b0
[ 85.362979][ T6009] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.362996][ T6009] RIP: 0033:0x7f27a95100ab
[ 85.363010][ T6009] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
[ 85.363025][ T6009] RSP: 002b:00007ffd4383a800 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 85.363042][ T6009] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f27a95100ab
[ 85.363052][ T6009] RDX: 00007ffd4383a890 RSI: 0000000040140921 RDI: 0000000000000003
[ 85.363062][ T6009] RBP: 00007ffd4383a890 R08: 0000000000000000 R09: 0000000000000000
[ 85.363072][ T6009] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f27a956cfc7
[ 85.363082][ T6009] R13: 0000000000000002 R14: 00007f27a9594cc0 R15: 0000000000000002
[ 85.363098][ T6009]
[ 85.363103][ T6009]
[ 85.363107][ T6009] The buggy address belongs to the physical page:
[ 85.363113][ T6009] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x73d36
[ 85.363127][ T6009] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 85.363139][ T6009] page_type: f0(buddy)
[ 85.363153][ T6009] raw: 00fff00000000000 ffffea0000d5ae88 ffffea0000d5af88 0000000000000000
[ 85.363167][ T6009] raw: 0000000000000000 0000000000000000 00000000f0000000 0000000000000000
[ 85.363174][ T6009] page dumped because: kasan: bad access detected
[ 85.363181][ T6009] page_owner tracks the page as freed
[ 85.363186][ T6009] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xcc0(GFP_KERNEL), pid 5639, tgid 5639 (syz-executor), ts 63888746915
[ 85.363205][ T6009] post_alloc_hook+0xfd/0x120
[ 85.363223][ T6009] get_page_from_freelist+0xdae/0x2c80
[ 85.363241][ T6009] __alloc_frozen_pages_noprof+0x2ad/0x31e0
[ 85.363262][ T6009] alloc_pages_bulk_noprof+0x77e/0x1420
[ 85.363280][ T6009] __kasan_populate_vmalloc+0xf0/0x210
[ 85.363293][ T6009] alloc_vmap_area+0x963/0x2bc0
[ 85.363304][ T6009] __get_vm_area_node+0x1ed/0x350
[ 85.363317][ T6009] __vmalloc_node_range_noprof+0x2ad/0x1440
[ 85.363331][ T6009] vmalloc_user_noprof+0x9e/0xe0
[ 85.363345][ T6009] kcov_ioctl+0x4d/0x750
[ 85.363357][ T6009] __x64_sys_ioctl+0x18e/0x210
[ 85.363370][ T6009] do_syscall_64+0x123/0x7b0
[ 85.363386][ T6009] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.363399][ T6009] page last free pid 5356 tgid 5356 ts 65501624162 stack trace:
[ 85.363409][ T6009] __free_frozen_pages+0x7b1/0x10f0
[ 85.363424][ T6009] kasan_depopulate_vmalloc_pte+0x5d/0x80
[ 85.363444][ T6009] __apply_to_page_range+0xb1d/0x1520
[ 85.363458][ T6009] __kasan_release_vmalloc+0xd7/0xe0
[ 85.363470][ T6009] purge_vmap_node+0x210/0xb40
[ 85.363488][ T6009] __purge_vmap_area_lazy+0x90a/0xc00
[ 85.363508][ T6009] drain_vmap_area_work+0x27/0x40
[ 85.363527][ T6009] process_one_work+0xac7/0x1b10
[ 85.363541][ T6009] worker_thread+0x5ef/0xe50
[ 85.363559][ T6009] kthread+0x373/0x450
[ 85.363571][ T6009] ret_from_fork+0x730/0xd60
[ 85.363587][ T6009] ret_from_fork_asm+0x1a/0x30
[ 85.363603][ T6009]
[ 85.363606][ T6009] Memory state around the buggy address:
[ 85.363613][ T6009] ffff888073d36280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 85.363622][ T6009] ffff888073d36300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 85.363631][ T6009] >ffff888073d36380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 85.363638][ T6009] ^
[ 85.363644][ T6009] ffff888073d36400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 85.363653][ T6009] ffff888073d36480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 85.363660][ T6009] ==================================================================
[ 85.366088][ T6009] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 85.889759][ T6009] CPU: 1 UID: 0 PID: 6009 Comm: syz-executor291 Not tainted syzkaller #0 PREEMPT(full)
[ 85.899470][ T6009] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
[ 85.909519][ T6009] Call Trace:
[ 85.912782][ T6009]
[ 85.915687][ T6009] dump_stack_lvl+0x100/0x190
[ 85.920344][ T6009] vpanic+0x2dc/0x6f8
[ 85.924297][ T6009] panic+0xd1/0xe0
[ 85.927984][ T6009] ? __pfx_panic+0x10/0x10
[ 85.932375][ T6009] ? super_90_validate+0x178b/0x18c0
[ 85.937647][ T6009] ? preempt_schedule+0x57/0xd0
[ 85.942486][ T6009] check_panic_on_warn.cold+0x19/0x34
[ 85.947837][ T6009] end_report.part.0+0x3a/0x90
[ 85.952584][ T6009] kasan_report.cold+0xe/0x18
[ 85.957257][ T6009] ? super_90_validate+0x178b/0x18c0
[ 85.962538][ T6009] super_90_validate+0x178b/0x18c0
[ 85.967640][ T6009] ? __pfx_bind_rdev_to_array+0x10/0x10
[ 85.973177][ T6009] ? kobject_init+0x159/0x1b0
[ 85.977838][ T6009] add_bound_rdev+0x274/0x390
[ 85.982509][ T6009] md_add_new_disk+0xca1/0x1820
[ 85.987349][ T6009] md_ioctl+0x2c1d/0x3700
[ 85.991663][ T6009] ? __pfx_md_ioctl+0x10/0x10
[ 85.996322][ T6009] ? do_vfs_ioctl+0x241/0x13f0
[ 86.001083][ T6009] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10
[ 86.007917][ T6009] ? __pfx_md_ioctl+0x10/0x10
[ 86.012576][ T6009] blkdev_ioctl+0x5ad/0x6f0
[ 86.017068][ T6009] ? __pfx_blkdev_ioctl+0x10/0x10
[ 86.022084][ T6009] ? selinux_file_ioctl+0x1e0/0x290
[ 86.027275][ T6009] ? selinux_file_ioctl+0x1e7/0x290
[ 86.032460][ T6009] ? __pfx_blkdev_ioctl+0x10/0x10
[ 86.037486][ T6009] __x64_sys_ioctl+0x18e/0x210
[ 86.042236][ T6009] do_syscall_64+0x123/0x7b0
[ 86.046819][ T6009] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.052711][ T6009] RIP: 0033:0x7f27a95100ab
[ 86.057115][ T6009] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
[ 86.076729][ T6009] RSP: 002b:00007ffd4383a800 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 86.085132][ T6009] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f27a95100ab
[ 86.093088][ T6009] RDX: 00007ffd4383a890 RSI: 0000000040140921 RDI: 0000000000000003
[ 86.101038][ T6009] RBP: 00007ffd4383a890 R08: 0000000000000000 R09: 0000000000000000
[ 86.108988][ T6009] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f27a956cfc7
[ 86.116938][ T6009] R13: 0000000000000002 R14: 00007f27a9594cc0 R15: 0000000000000002
[ 86.124907][ T6009]
[ 86.128095][ T6009] Kernel Offset: disabled
[ 86.132407][ T6009] Rebooting in 86400 seconds..