Starting sshd: OK syzkaller syzkaller login: [ 24.656886][ T1056] cgroup: Unknown subsys name 'net' [ 24.777383][ T1056] cgroup: Unknown subsys name 'rlimit' [ 24.976563][ T1056] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 25.239735][ T1079] modprobe (1079) used greatest stack depth: 21640 bytes left [ 29.890384][ T1060] syz-executor.0 (1060) used greatest stack depth: 20456 bytes left Warning: Permanently added '10.128.1.99' (ED25519) to the list of known hosts. 2024/02/22 19:00:39 ignoring optional flag "sandboxArg"="0" 2024/02/22 19:00:39 parsed 1 programs 2024/02/22 19:00:39 executed programs: 0 [ 50.185874][ T1579] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 55.352523][ T1996] loop0: detected capacity change from 0 to 2048 [ 55.362128][ T1996] ======================================================= [ 55.362128][ T1996] WARNING: The mand mount option has been deprecated and [ 55.362128][ T1996] and is ignored by this kernel. Remove the mand [ 55.362128][ T1996] option from the mount to silence this warning. [ 55.362128][ T1996] ======================================================= [ 55.401969][ T1996] UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 55.414184][ T1996] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) 2024/02/22 19:00:44 executed programs: 1 [ 55.483529][ T1585] ================================================================== [ 55.491802][ T1585] BUG: KASAN: use-after-free in crc_itu_t+0x1c6/0x240 [ 55.498808][ T1585] Read of size 1 at addr ffff888069aa5000 by task syz-executor.0/1585 [ 55.507198][ T1585] [ 55.509687][ T1585] CPU: 1 PID: 1585 Comm: syz-executor.0 Not tainted 6.1.78-syzkaller #0 [ 55.518953][ T1585] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 [ 55.530472][ T1585] Call Trace: [ 55.533743][ T1585] [ 55.536751][ T1585] dump_stack_lvl+0xf4/0x251 [ 55.541699][ T1585] ? nf_tcp_handle_invalid+0x2f3/0x2f3 [ 55.547606][ T1585] ? panic+0x3f7/0x3f7 [ 55.551922][ T1585] ? lock_acquire+0xbe/0x390 [ 55.556487][ T1585] ? read_lock_is_recursive+0x10/0x10 [ 55.562093][ T1585] ? __virt_addr_valid+0x139/0x260 [ 55.567363][ T1585] ? __virt_addr_valid+0x211/0x260 [ 55.572619][ T1585] print_report+0x15f/0x4f0 [ 55.577193][ T1585] ? __virt_addr_valid+0x139/0x260 [ 55.582463][ T1585] ? __virt_addr_valid+0x211/0x260 [ 55.588016][ T1585] ? crc_itu_t+0x1c6/0x240 [ 55.592428][ T1585] kasan_report+0x136/0x160 [ 55.597001][ T1585] ? crc_itu_t+0x1c6/0x240 [ 55.601504][ T1585] crc_itu_t+0x1c6/0x240 [ 55.605833][ T1585] udf_sync_fs+0x1bd/0x370 [ 55.610332][ T1585] ? udf_put_super+0x130/0x130 [ 55.615579][ T1585] ? dentry_kill+0xbb/0x1e0 [ 55.620077][ T1585] sync_filesystem+0xbf/0x180 [ 55.624836][ T1585] generic_shutdown_super+0x65/0x2c0 [ 55.631078][ T1585] kill_block_super+0x75/0xb0 [ 55.636879][ T1585] deactivate_locked_super+0x71/0xd0 [ 55.642421][ T1585] cleanup_mnt+0x2bd/0x330 [ 55.647018][ T1585] task_work_run+0x206/0x280 [ 55.651674][ T1585] ? task_work_cancel+0x2a0/0x2a0 [ 55.656944][ T1585] ? __x64_sys_umount+0xe4/0x120 [ 55.662126][ T1585] ? path_umount+0xc70/0xc70 [ 55.666885][ T1585] exit_to_user_mode_loop+0xa9/0xc0 [ 55.672154][ T1585] exit_to_user_mode_prepare+0x64/0xb0 [ 55.678026][ T1585] syscall_exit_to_user_mode+0x27/0x1c0 [ 55.683742][ T1585] do_syscall_64+0x49/0x80 [ 55.688387][ T1585] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 55.694425][ T1585] RIP: 0033:0x7f2717e7de57 [ 55.698826][ T1585] Code: b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b0 ff ff ff f7 d8 64 89 02 b8 [ 55.719399][ T1585] RSP: 002b:00007fff5f961998 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 55.728269][ T1585] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f2717e7de57 [ 55.736486][ T1585] RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007fff5f961a50 [ 55.744953][ T1585] RBP: 00007fff5f961a50 R08: 0000000000000000 R09: 0000000000000000 [ 55.753603][ T1585] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fff5f962b10 [ 55.761904][ T1585] R13: 00007f2717ec73b9 R14: 000000000000d811 R15: 0000000000000006 [ 55.770487][ T1585] [ 55.773772][ T1585] [ 55.776247][ T1585] The buggy address belongs to the physical page: [ 55.782717][ T1585] page:ffffea0001a6a940 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x69aa5 [ 55.793014][ T1585] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 55.800447][ T1585] raw: 00fff00000000000 ffffea0001a69608 ffffea0001a6b288 0000000000000000 [ 55.809228][ T1585] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 55.818055][ T1585] page dumped because: kasan: bad access detected [ 55.825327][ T1585] page_owner tracks the page as freed [ 55.830676][ T1585] page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 1995, tgid 1995 (syz-executor.0), ts 55340104254, free_ts 55475898665 [ 55.849153][ T1585] post_alloc_hook+0x286/0x2b0 [ 55.854253][ T1585] get_page_from_freelist+0x2fdd/0x3170 [ 55.859986][ T1585] __alloc_pages+0x251/0x640 [ 55.864619][ T1585] __folio_alloc+0xf/0x30 [ 55.869042][ T1585] vma_alloc_folio+0x484/0x9e0 [ 55.873886][ T1585] wp_page_copy+0x226/0x1970 [ 55.878549][ T1585] handle_mm_fault+0x1f58/0x4260 [ 55.883480][ T1585] exc_page_fault+0x22a/0x5e0 [ 55.888252][ T1585] asm_exc_page_fault+0x22/0x30 [ 55.893520][ T1585] page last free stack trace: [ 55.898633][ T1585] free_unref_page_prepare+0xd4b/0xee0 [ 55.904607][ T1585] free_unref_page_list+0x54b/0x7e0 [ 55.909816][ T1585] release_pages+0x175c/0x1900 [ 55.914605][ T1585] tlb_flush_mmu+0xe5/0x1d0 [ 55.919121][ T1585] tlb_finish_mmu+0xb0/0x1b0 [ 55.924102][ T1585] exit_mmap+0x341/0x730 [ 55.928676][ T1585] __mmput+0x9b/0x2d0 [ 55.933056][ T1585] exit_mm+0x122/0x1b0 [ 55.937714][ T1585] do_exit+0x81e/0x23a0 [ 55.943212][ T1585] do_group_exit+0x1b5/0x280 [ 55.948256][ T1585] get_signal+0x1117/0x1260 [ 55.953092][ T1585] arch_do_signal_or_restart+0xb3/0x1240 [ 55.959073][ T1585] exit_to_user_mode_loop+0x61/0xc0 [ 55.964272][ T1585] exit_to_user_mode_prepare+0x64/0xb0 [ 55.969899][ T1585] syscall_exit_to_user_mode+0x27/0x1c0 [ 55.975466][ T1585] do_syscall_64+0x49/0x80 [ 55.979871][ T1585] [ 55.982276][ T1585] Memory state around the buggy address: [ 55.987921][ T1585] ffff888069aa4f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 55.996567][ T1585] ffff888069aa4f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 56.005297][ T1585] >ffff888069aa5000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 56.014025][ T1585] ^ [ 56.018271][ T1585] ffff888069aa5080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 56.026788][ T1585] ffff888069aa5100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 56.036594][ T1585] ================================================================== [ 56.046779][ T1585] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 56.056043][ T1585] Kernel Offset: disabled [ 56.060560][ T1585] Rebooting in 86400 seconds..