Warning: Permanently added '10.128.0.145' (ED25519) to the list of known hosts. 2024/08/12 17:37:33 ignoring optional flag "sandboxArg"="0" 2024/08/12 17:37:33 parsed 1 programs 2024/08/12 17:37:33 executed programs: 0 [ 55.424622][ T1499] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 60.172390][ T1916] loop0: detected capacity change from 0 to 2048 [ 60.182289][ T1916] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 60.228396][ T1919] loop0: detected capacity change from 0 to 2048 [ 60.237488][ T1919] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 60.258821][ T1505] ================================================================== [ 60.266892][ T1505] BUG: KASAN: use-after-free in crc_itu_t+0x178/0x240 [ 60.273645][ T1505] Read of size 1 at addr ffff88806bb0c000 by task syz-executor.0/1505 [ 60.281761][ T1505] [ 60.284093][ T1505] CPU: 1 PID: 1505 Comm: syz-executor.0 Not tainted 6.1.104-syzkaller #0 [ 60.292472][ T1505] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 60.302594][ T1505] Call Trace: [ 60.306015][ T1505] [ 60.308913][ T1505] dump_stack_lvl+0xf4/0x251 [ 60.313482][ T1505] ? nf_tcp_handle_invalid+0x2f3/0x2f3 [ 60.318932][ T1505] ? panic+0x3fe/0x3fe [ 60.322992][ T1505] ? lock_acquire+0xbe/0x390 [ 60.327546][ T1505] ? read_lock_is_recursive+0x10/0x10 [ 60.332890][ T1505] ? __virt_addr_valid+0x139/0x270 [ 60.337979][ T1505] ? __virt_addr_valid+0x221/0x270 [ 60.343055][ T1505] print_report+0x15f/0x4f0 [ 60.347522][ T1505] ? __virt_addr_valid+0x139/0x270 [ 60.352602][ T1505] ? __virt_addr_valid+0x221/0x270 [ 60.357702][ T1505] ? crc_itu_t+0x178/0x240 [ 60.362172][ T1505] kasan_report+0x136/0x160 [ 60.366638][ T1505] ? crc_itu_t+0x178/0x240 [ 60.371038][ T1505] crc_itu_t+0x178/0x240 [ 60.375243][ T1505] udf_sync_fs+0x1bd/0x370 [ 60.379621][ T1505] ? udf_put_super+0x130/0x130 [ 60.384349][ T1505] ? dentry_kill+0xbb/0x1e0 [ 60.388815][ T1505] sync_filesystem+0xbf/0x180 [ 60.393472][ T1505] generic_shutdown_super+0x65/0x2c0 [ 60.398733][ T1505] kill_block_super+0x75/0xb0 [ 60.403375][ T1505] deactivate_locked_super+0x71/0xd0 [ 60.408644][ T1505] cleanup_mnt+0x2bd/0x330 [ 60.413483][ T1505] task_work_run+0x206/0x280 [ 60.418057][ T1505] ? task_work_cancel+0x280/0x280 [ 60.423051][ T1505] ? __x64_sys_umount+0xe4/0x120 [ 60.427971][ T1505] ? path_umount+0xc70/0xc70 [ 60.432643][ T1505] exit_to_user_mode_loop+0xa9/0xc0 [ 60.437823][ T1505] exit_to_user_mode_prepare+0x64/0xb0 [ 60.443279][ T1505] syscall_exit_to_user_mode+0x27/0x1b0 [ 60.448796][ T1505] do_syscall_64+0x47/0x80 [ 60.453196][ T1505] ? clear_bhb_loop+0x45/0xa0 [ 60.457868][ T1505] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 60.463751][ T1505] RIP: 0033:0x7f1242a7de17 [ 60.468156][ T1505] Code: b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b0 ff ff ff f7 d8 64 89 02 b8 [ 60.487929][ T1505] RSP: 002b:00007fff615b0fa8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 60.496320][ T1505] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f1242a7de17 [ 60.504438][ T1505] RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007fff615b1060 [ 60.512390][ T1505] RBP: 00007fff615b1060 R08: 0000000000000000 R09: 0000000000000000 [ 60.520367][ T1505] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fff615b2120 [ 60.528311][ T1505] R13: 00007f1242ac73b9 R14: 000000000000eb28 R15: 0000000000000006 [ 60.536251][ T1505] [ 60.539242][ T1505] [ 60.541542][ T1505] The buggy address belongs to the physical page: [ 60.547923][ T1505] page:ffffea0001aec300 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x6bb0c [ 60.558040][ T1505] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 60.565118][ T1505] raw: 00fff00000000000 ffffea0001b28808 ffffea0001aebe08 0000000000000000 [ 60.573666][ T1505] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 60.582217][ T1505] page dumped because: kasan: bad access detected [ 60.588600][ T1505] page_owner tracks the page as freed [ 60.593935][ T1505] page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL|__GFP_MOVABLE), pid 1916, tgid 1915 (syz-executor.0), ts 60191637974, free_ts 60212121443 [ 60.614392][ T1505] post_alloc_hook+0x286/0x2b0 [ 60.619129][ T1505] get_page_from_freelist+0x2fe5/0x3170 [ 60.624647][ T1505] __alloc_pages+0x251/0x640 [ 60.629204][ T1505] folio_alloc+0xf/0x30 [ 60.633413][ T1505] filemap_alloc_folio+0xc2/0x390 [ 60.638658][ T1505] __filemap_get_folio+0x6ca/0x970 [ 60.643737][ T1505] pagecache_get_page+0x10/0x160 [ 60.648644][ T1505] __getblk_gfp+0x1b5/0x810 [ 60.653110][ T1505] __bread_gfp+0xa/0x1d0 [ 60.657316][ T1505] udf_read_tagged+0x106/0xe90 [ 60.662043][ T1505] __udf_iget+0x38f/0x3660 [ 60.666424][ T1505] udf_fill_super+0x12e5/0x1f80 [ 60.671269][ T1505] mount_bdev+0x26b/0x340 [ 60.675655][ T1505] legacy_get_tree+0xe5/0x170 [ 60.680383][ T1505] vfs_get_tree+0x7a/0x170 [ 60.684764][ T1505] do_new_mount+0x21a/0x910 [ 60.689229][ T1505] page last free stack trace: [ 60.693956][ T1505] free_unref_page_prepare+0xd6c/0xf00 [ 60.699378][ T1505] free_unref_page_list+0x54b/0x7e0 [ 60.704539][ T1505] release_pages+0x1e0a/0x1fe0 [ 60.709275][ T1505] __pagevec_release+0x62/0xd0 [ 60.714460][ T1505] truncate_inode_pages_range+0x38c/0xe40 [ 60.720141][ T1505] blkdev_flush_mapping+0xd7/0x1a0 [ 60.725215][ T1505] blkdev_put+0x3e4/0x5c0 [ 60.729505][ T1505] deactivate_locked_super+0x71/0xd0 [ 60.734762][ T1505] cleanup_mnt+0x2bd/0x330 [ 60.739156][ T1505] task_work_run+0x206/0x280 [ 60.743717][ T1505] exit_to_user_mode_loop+0xa9/0xc0 [ 60.748878][ T1505] exit_to_user_mode_prepare+0x64/0xb0 [ 60.754298][ T1505] syscall_exit_to_user_mode+0x27/0x1b0 [ 60.759809][ T1505] do_syscall_64+0x47/0x80 [ 60.764303][ T1505] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 60.770163][ T1505] [ 60.772462][ T1505] Memory state around the buggy address: [ 60.778055][ T1505] ffff88806bb0bf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 60.786171][ T1505] ffff88806bb0bf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 60.794201][ T1505] >ffff88806bb0c000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 60.802241][ T1505] ^ [ 60.806270][ T1505] ffff88806bb0c080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 60.814291][ T1505] ffff88806bb0c100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 60.822332][ T1505] ================================================================== [ 60.830999][ T1505] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 60.838481][ T1505] Kernel Offset: disabled [ 60.842796][ T1505] Rebooting in 86400 seconds..