Warning: Permanently added '10.128.0.14' (ED25519) to the list of known hosts. 2023/10/07 00:00:12 ignoring optional flag "sandboxArg"="0" 2023/10/07 00:00:12 parsed 1 programs 2023/10/07 00:00:12 executed programs: 0 [ 47.636599][ T2015] loop0: detected capacity change from 0 to 2048 [ 47.645117][ T2015] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 47.816978][ T2017] loop0: detected capacity change from 0 to 2048 [ 47.826446][ T2017] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 47.897147][ T1596] ================================================================== [ 47.905614][ T1596] BUG: KASAN: use-after-free in crc_itu_t+0x9c/0xc0 [ 47.912407][ T1596] Read of size 1 at addr ffff8880735a7000 by task syz-executor.0/1596 [ 47.920920][ T1596] [ 47.923231][ T1596] CPU: 1 PID: 1596 Comm: syz-executor.0 Not tainted 5.15.134-syzkaller #0 [ 47.931807][ T1596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 [ 47.942403][ T1596] Call Trace: [ 47.945748][ T1596] [ 47.948664][ T1596] dump_stack_lvl+0x41/0x5e [ 47.953281][ T1596] print_address_description.constprop.0.cold+0x6c/0x309 [ 47.960423][ T1596] ? crc_itu_t+0x9c/0xc0 [ 47.964645][ T1596] ? crc_itu_t+0x9c/0xc0 [ 47.968946][ T1596] kasan_report.cold+0x83/0xdf [ 47.973788][ T1596] ? crc_itu_t+0x9c/0xc0 [ 47.978055][ T1596] crc_itu_t+0x9c/0xc0 [ 47.982498][ T1596] udf_finalize_lvid+0xdb/0x1d0 [ 47.987427][ T1596] ? udf_mount+0x10/0x10 [ 47.991835][ T1596] udf_close_lvid+0x3db/0x590 [ 47.996585][ T1596] udf_put_super+0x167/0x1d0 [ 48.001366][ T1596] generic_shutdown_super+0x129/0x320 [ 48.007498][ T1596] kill_block_super+0x93/0xd0 [ 48.012351][ T1596] deactivate_locked_super+0x7b/0x130 [ 48.017705][ T1596] cleanup_mnt+0x2b8/0x3e0 [ 48.022182][ T1596] task_work_run+0xb8/0x140 [ 48.026856][ T1596] exit_to_user_mode_prepare+0x164/0x170 [ 48.032944][ T1596] syscall_exit_to_user_mode+0x12/0x30 [ 48.038539][ T1596] do_syscall_64+0x42/0x80 [ 48.043046][ T1596] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 48.049183][ T1596] RIP: 0033:0x7f7d0bec7c87 [ 48.053573][ T1596] Code: b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b0 ff ff ff f7 d8 64 89 02 b8 [ 48.073945][ T1596] RSP: 002b:00007ffd7802e268 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 48.083857][ T1596] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f7d0bec7c87 [ 48.092204][ T1596] RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007ffd7802e320 [ 48.101194][ T1596] RBP: 00007ffd7802e320 R08: 0000000000000000 R09: 0000000000000000 [ 48.109418][ T1596] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd7802f3e0 [ 48.117842][ T1596] R13: 00007f7d0bf21c5a R14: 000000000000baab R15: 0000000000000006 [ 48.125899][ T1596] [ 48.129088][ T1596] [ 48.131594][ T1596] Allocated by task 2013: [ 48.135934][ T1596] kasan_save_stack+0x1b/0x40 [ 48.140589][ T1596] __kasan_slab_alloc+0x61/0x80 [ 48.145500][ T1596] kmem_cache_alloc+0x223/0x340 [ 48.150408][ T1596] mempool_alloc+0xf8/0x2d0 [ 48.155666][ T1596] bio_alloc_bioset+0x190/0x1040 [ 48.160871][ T1596] submit_bh_wbc.constprop.0+0x14c/0x5b0 [ 48.167457][ T1596] block_read_full_page+0x6fa/0x940 [ 48.172647][ T1596] filemap_read_page+0xe2/0x360 [ 48.177472][ T1596] filemap_get_pages+0xbb9/0x1140 [ 48.182992][ T1596] filemap_read+0x24e/0xab0 [ 48.187697][ T1596] blkdev_read_iter+0xfb/0x180 [ 48.192667][ T1596] new_sync_read+0x35a/0x5f0 [ 48.197456][ T1596] vfs_read+0x206/0x460 [ 48.201687][ T1596] ksys_read+0xf4/0x1d0 [ 48.205831][ T1596] do_syscall_64+0x35/0x80 [ 48.210316][ T1596] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 48.216444][ T1596] [ 48.218745][ T1596] Freed by task 18: [ 48.223136][ T1596] kasan_save_stack+0x1b/0x40 [ 48.227987][ T1596] kasan_set_track+0x1c/0x30 [ 48.232678][ T1596] kasan_set_free_info+0x20/0x30 [ 48.237779][ T1596] __kasan_slab_free+0xe0/0x110 [ 48.242868][ T1596] kmem_cache_free+0x7e/0x470 [ 48.247609][ T1596] blk_update_request+0x6f4/0xdb0 [ 48.252704][ T1596] blk_mq_end_request+0x46/0x480 [ 48.257637][ T1596] blk_complete_reqs+0x90/0xc0 [ 48.262380][ T1596] __do_softirq+0x20d/0x60f [ 48.266864][ T1596] [ 48.269257][ T1596] The buggy address belongs to the object at ffff8880735a7000 [ 48.269257][ T1596] which belongs to the cache bio-160 of size 160 [ 48.282935][ T1596] The buggy address is located 0 bytes inside of [ 48.282935][ T1596] 160-byte region [ffff8880735a7000, ffff8880735a70a0) [ 48.296385][ T1596] The buggy address belongs to the page: [ 48.302188][ T1596] page:ffffea0001cd69c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x735a7 [ 48.312659][ T1596] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 48.320610][ T1596] raw: 00fff00000000200 0000000000000000 dead000000000122 ffff888143fe03c0 [ 48.330048][ T1596] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 48.338751][ T1596] page dumped because: kasan: bad access detected [ 48.345881][ T1596] page_owner tracks the page as allocated [ 48.352789][ T1596] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x192800(GFP_NOWAIT|__GFP_NOWARN|__GFP_NORETRY|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 2013, ts 47825650300, free_ts 47712145967 [ 48.372983][ T1596] get_page_from_freelist+0x1334/0x2dc0 [ 48.378884][ T1596] __alloc_pages+0x1b2/0x440 [ 48.383646][ T1596] allocate_slab+0x2eb/0x430 [ 48.388375][ T1596] ___slab_alloc+0xc94/0x10f0 [ 48.393119][ T1596] __slab_alloc.constprop.0+0x45/0x80 [ 48.398464][ T1596] kmem_cache_alloc+0x30c/0x340 [ 48.403369][ T1596] mempool_alloc+0xf8/0x2d0 [ 48.407842][ T1596] bio_alloc_bioset+0x190/0x1040 [ 48.412749][ T1596] submit_bh_wbc.constprop.0+0x14c/0x5b0 [ 48.418351][ T1596] block_read_full_page+0x6fa/0x940 [ 48.423525][ T1596] filemap_read_page+0xe2/0x360 [ 48.428814][ T1596] filemap_get_pages+0xbb9/0x1140 [ 48.434054][ T1596] filemap_read+0x24e/0xab0 [ 48.438885][ T1596] blkdev_read_iter+0xfb/0x180 [ 48.445141][ T1596] new_sync_read+0x35a/0x5f0 [ 48.449740][ T1596] vfs_read+0x206/0x460 [ 48.454968][ T1596] page last free stack trace: [ 48.459734][ T1596] free_pcp_prepare+0x379/0x850 [ 48.464944][ T1596] free_unref_page_list+0x16f/0xca0 [ 48.470222][ T1596] release_pages+0xb3a/0x1480 [ 48.475005][ T1596] __pagevec_release+0x59/0xe0 [ 48.479742][ T1596] truncate_inode_pages_range+0x250/0x9f0 [ 48.485717][ T1596] blkdev_put_whole+0x19b/0x210 [ 48.491180][ T1596] blkdev_put+0x385/0x700 [ 48.496366][ T1596] deactivate_locked_super+0x7b/0x130 [ 48.502739][ T1596] cleanup_mnt+0x2b8/0x3e0 [ 48.507257][ T1596] task_work_run+0xb8/0x140 [ 48.511978][ T1596] exit_to_user_mode_prepare+0x164/0x170 [ 48.517911][ T1596] syscall_exit_to_user_mode+0x12/0x30 [ 48.524049][ T1596] do_syscall_64+0x42/0x80 [ 48.528760][ T1596] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 48.535771][ T1596] [ 48.538199][ T1596] Memory state around the buggy address: [ 48.543899][ T1596] ffff8880735a6f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 48.552945][ T1596] ffff8880735a6f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 48.563020][ T1596] >ffff8880735a7000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 48.571143][ T1596] ^ [ 48.575466][ T1596] ffff8880735a7080: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc [ 48.583771][ T1596] ffff8880735a7100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 48.591826][ T1596] ================================================================== [ 48.600031][ T1596] Disabling lock debugging due to kernel taint [ 48.609021][ T1596] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 48.616653][ T1596] Kernel Offset: disabled [ 48.621000][ T1596] Rebooting in 86400 seconds..