syzkaller syzkaller login: [ 28.900675][ T1048] sftp-server (1048) used greatest stack depth: 22944 bytes left [ 28.906754][ T1046] sshd (1046) used greatest stack depth: 22400 bytes left [ 35.504849][ T1064] cgroup: Unknown subsys name 'net' [ 35.600081][ T1064] cgroup: Unknown subsys name 'rlimit' [ 35.799065][ T1064] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 41.733676][ T1070] syz-executor.0 (1070) used greatest stack depth: 20744 bytes left Warning: Permanently added '10.128.1.158' (ED25519) to the list of known hosts. 2024/11/18 20:24:33 ignoring optional flag "sandboxArg"="0" 2024/11/18 20:24:33 ignoring optional flag "type"="gce" 2024/11/18 20:24:33 parsed 1 programs 2024/11/18 20:24:33 executed programs: 0 [ 60.503250][ T1501] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k 2024/11/18 20:24:39 executed programs: 1 [ 66.409412][ T1918] loop0: detected capacity change from 0 to 2048 [ 66.420197][ T1918] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 66.474633][ T1921] loop0: detected capacity change from 0 to 2048 [ 66.484613][ T1921] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 66.505160][ T1507] ================================================================== [ 66.513804][ T1507] BUG: KASAN: slab-out-of-bounds in crc_itu_t+0x178/0x240 [ 66.520922][ T1507] Read of size 1 at addr ffff88800cf9d0a8 by task syz-executor.0/1507 [ 66.529050][ T1507] [ 66.531367][ T1507] CPU: 1 PID: 1507 Comm: syz-executor.0 Not tainted 6.1.118-syzkaller #0 [ 66.539769][ T1507] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 [ 66.550020][ T1507] Call Trace: [ 66.553287][ T1507] [ 66.556208][ T1507] dump_stack_lvl+0xf4/0x251 [ 66.560872][ T1507] ? nf_tcp_handle_invalid+0x2f3/0x2f3 [ 66.566336][ T1507] ? panic+0x3fe/0x3fe [ 66.570388][ T1507] ? lock_acquire+0xbe/0x390 [ 66.575044][ T1507] ? read_lock_is_recursive+0x10/0x10 [ 66.580491][ T1507] ? __virt_addr_valid+0x139/0x270 [ 66.585583][ T1507] ? __virt_addr_valid+0x221/0x270 [ 66.590670][ T1507] print_report+0x15f/0x4f0 [ 66.595166][ T1507] ? __virt_addr_valid+0x139/0x270 [ 66.600258][ T1507] ? __virt_addr_valid+0x221/0x270 [ 66.605360][ T1507] ? crc_itu_t+0x178/0x240 [ 66.609784][ T1507] kasan_report+0x136/0x160 [ 66.614266][ T1507] ? crc_itu_t+0x178/0x240 [ 66.618661][ T1507] crc_itu_t+0x178/0x240 [ 66.622882][ T1507] udf_sync_fs+0x1bd/0x370 [ 66.627470][ T1507] ? udf_put_super+0x130/0x130 [ 66.632237][ T1507] ? dentry_kill+0xbb/0x1e0 [ 66.636726][ T1507] sync_filesystem+0xbf/0x180 [ 66.641385][ T1507] generic_shutdown_super+0x65/0x2c0 [ 66.646652][ T1507] kill_block_super+0x75/0xb0 [ 66.651396][ T1507] deactivate_locked_super+0x71/0xd0 [ 66.656749][ T1507] cleanup_mnt+0x2bd/0x330 [ 66.661182][ T1507] task_work_run+0x206/0x280 [ 66.665773][ T1507] ? task_work_cancel+0x280/0x280 [ 66.670810][ T1507] ? __x64_sys_umount+0xe4/0x120 [ 66.675829][ T1507] ? path_umount+0xc70/0xc70 [ 66.680413][ T1507] exit_to_user_mode_loop+0xa9/0xc0 [ 66.685599][ T1507] exit_to_user_mode_prepare+0x64/0xb0 [ 66.691041][ T1507] syscall_exit_to_user_mode+0x27/0x1b0 [ 66.696568][ T1507] do_syscall_64+0x47/0x80 [ 66.700981][ T1507] ? clear_bhb_loop+0x45/0xa0 [ 66.705640][ T1507] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 66.711529][ T1507] RIP: 0033:0x7fd84fc7de17 [ 66.715934][ T1507] Code: b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b0 ff ff ff f7 d8 64 89 02 b8 [ 66.735607][ T1507] RSP: 002b:00007ffcbaee8da8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 66.744004][ T1507] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fd84fc7de17 [ 66.751979][ T1507] RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007ffcbaee8e60 [ 66.759958][ T1507] RBP: 00007ffcbaee8e60 R08: 0000000000000000 R09: 0000000000000000 [ 66.767921][ T1507] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffcbaee9f20 [ 66.775875][ T1507] R13: 00007fd84fcc73b9 R14: 0000000000010382 R15: 0000000000000006 [ 66.783830][ T1507] [ 66.786835][ T1507] [ 66.789144][ T1507] Allocated by task 1: [ 66.793187][ T1507] kasan_set_track+0x4b/0x70 [ 66.797757][ T1507] __kasan_slab_alloc+0x65/0x70 [ 66.802588][ T1507] slab_post_alloc_hook+0x54/0x3e0 [ 66.807676][ T1507] kmem_cache_alloc+0x10c/0x290 [ 66.812508][ T1507] __kernfs_new_node+0xd7/0x6b0 [ 66.817336][ T1507] kernfs_new_node+0x109/0x1d0 [ 66.822075][ T1507] __kernfs_create_file+0x24/0x280 [ 66.827165][ T1507] sysfs_add_file_mode_ns+0x1c2/0x230 [ 66.832513][ T1507] internal_create_group+0x560/0xcf0 [ 66.837774][ T1507] sysfs_create_groups+0x62/0xe0 [ 66.842689][ T1507] device_add_attrs+0x162/0x4a0 [ 66.847520][ T1507] device_add+0x64a/0xd90 [ 66.851828][ T1507] usb_set_configuration+0x16dc/0x1cd0 [ 66.857280][ T1507] usb_generic_driver_probe+0x61/0xf0 [ 66.862651][ T1507] usb_probe_device+0xc3/0x1e0 [ 66.867400][ T1507] really_probe+0x330/0xad0 [ 66.871884][ T1507] __driver_probe_device+0x138/0x340 [ 66.877187][ T1507] driver_probe_device+0x4b/0x3a0 [ 66.882207][ T1507] __device_attach_driver+0x2c9/0x3e0 [ 66.887572][ T1507] bus_for_each_drv+0x152/0x1b0 [ 66.892410][ T1507] __device_attach+0x244/0x420 [ 66.897155][ T1507] bus_probe_device+0x82/0x190 [ 66.901901][ T1507] device_add+0x7b9/0xd90 [ 66.906223][ T1507] usb_new_device+0x845/0xf20 [ 66.910895][ T1507] register_root_hub+0x2da/0x4b0 [ 66.915855][ T1507] usb_add_hcd+0x94e/0x1100 [ 66.920337][ T1507] vhci_hcd_probe+0x172/0x2d0 [ 66.924993][ T1507] platform_probe+0xd5/0x120 [ 66.929564][ T1507] really_probe+0x330/0xad0 [ 66.934050][ T1507] __driver_probe_device+0x138/0x340 [ 66.939335][ T1507] driver_probe_device+0x4b/0x3a0 [ 66.944457][ T1507] __device_attach_driver+0x2c9/0x3e0 [ 66.949811][ T1507] bus_for_each_drv+0x152/0x1b0 [ 66.954643][ T1507] __device_attach+0x244/0x420 [ 66.959751][ T1507] bus_probe_device+0x82/0x190 [ 66.964501][ T1507] device_add+0x7b9/0xd90 [ 66.968818][ T1507] platform_device_add+0x3ba/0x6a0 [ 66.973912][ T1507] vhci_hcd_init+0x242/0x3d4 [ 66.978483][ T1507] do_one_initcall+0x19f/0x4c0 [ 66.983227][ T1507] do_initcall_level+0x11e/0x1cd [ 66.988232][ T1507] do_initcalls+0x46/0x74 [ 66.992541][ T1507] kernel_init_freeable+0x375/0x4e4 [ 66.997718][ T1507] kernel_init+0x14/0x190 [ 67.002030][ T1507] ret_from_fork+0x1f/0x30 [ 67.006431][ T1507] [ 67.008746][ T1507] The buggy address belongs to the object at ffff88800cf9d000 [ 67.008746][ T1507] which belongs to the cache kernfs_node_cache of size 168 [ 67.023300][ T1507] The buggy address is located 0 bytes to the right of [ 67.023300][ T1507] 168-byte region [ffff88800cf9d000, ffff88800cf9d0a8) [ 67.036953][ T1507] [ 67.039265][ T1507] The buggy address belongs to the physical page: [ 67.045670][ T1507] page:ffffea000033e740 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xcf9d [ 67.055710][ T1507] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 67.063237][ T1507] raw: 00fff00000000200 0000000000000000 dead000000000122 ffff888140009b40 [ 67.071848][ T1507] raw: 0000000000000000 0000000000110011 00000001ffffffff 0000000000000000 [ 67.080422][ T1507] page dumped because: kasan: bad access detected [ 67.086832][ T1507] page_owner tracks the page as allocated [ 67.092528][ T1507] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 4340412372, free_ts 3857035913 [ 67.109965][ T1507] post_alloc_hook+0x286/0x2b0 [ 67.114718][ T1507] get_page_from_freelist+0x340b/0x35b0 [ 67.120256][ T1507] __alloc_pages+0x251/0x640 [ 67.124826][ T1507] alloc_page_interleave+0xf/0x120 [ 67.129916][ T1507] alloc_slab_page+0x6a/0x150 [ 67.134588][ T1507] new_slab+0x70/0x250 [ 67.138657][ T1507] ___slab_alloc+0x9df/0xe70 [ 67.143327][ T1507] kmem_cache_alloc+0x18b/0x290 [ 67.148163][ T1507] __kernfs_new_node+0xd7/0x6b0 [ 67.153006][ T1507] kernfs_new_node+0x109/0x1d0 [ 67.157807][ T1507] __kernfs_create_file+0x24/0x280 [ 67.163090][ T1507] sysfs_add_file_mode_ns+0x1c2/0x230 [ 67.168454][ T1507] internal_create_group+0x560/0xcf0 [ 67.173726][ T1507] sysfs_create_groups+0x62/0xe0 [ 67.178824][ T1507] device_add_attrs+0x162/0x4a0 [ 67.183658][ T1507] device_add+0x64a/0xd90 [ 67.187971][ T1507] page last free stack trace: [ 67.192801][ T1507] free_unref_page_prepare+0xd6c/0xf00 [ 67.198305][ T1507] free_unref_page+0x33/0x390 [ 67.202966][ T1507] __vunmap+0x34e/0x700 [ 67.207127][ T1507] free_work+0x3d/0x70 [ 67.211196][ T1507] process_one_work+0x745/0xe90 [ 67.216029][ T1507] worker_thread+0x806/0xe60 [ 67.220621][ T1507] kthread+0x1e8/0x240 [ 67.224679][ T1507] ret_from_fork+0x1f/0x30 [ 67.229085][ T1507] [ 67.231399][ T1507] Memory state around the buggy address: [ 67.237014][ T1507] ffff88800cf9cf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.245150][ T1507] ffff88800cf9d000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.253194][ T1507] >ffff88800cf9d080: 00 00 00 00 00 fc fc fc fc fc fc fc fc 00 00 00 [ 67.261420][ T1507] ^ [ 67.266823][ T1507] ffff88800cf9d100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.274869][ T1507] ffff88800cf9d180: 00 00 fc fc fc fc fc fc fc fc 00 00 00 00 00 00 [ 67.283085][ T1507] ================================================================== [ 67.292391][ T1507] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 67.299920][ T1507] Kernel Offset: disabled [ 67.304255][ T1507] Rebooting in 86400 seconds..