Warning: Permanently added '10.128.10.47' (ED25519) to the list of known hosts. 2025/03/11 08:32:43 ignoring optional flag "sandboxArg"="0" 2025/03/11 08:32:43 ignoring optional flag "type"="gce" 2025/03/11 08:32:43 parsed 1 programs 2025/03/11 08:32:43 executed programs: 0 [ 52.323833][ T1502] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k 2025/03/11 08:32:49 executed programs: 1 [ 58.203274][ T1920] loop0: detected capacity change from 0 to 2048 [ 58.214027][ T1920] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 58.271969][ T1923] loop0: detected capacity change from 0 to 2048 [ 58.281975][ T1923] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 58.331724][ T1925] loop0: detected capacity change from 0 to 2048 [ 58.341161][ T1925] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 58.362878][ T1509] ================================================================== [ 58.371037][ T1509] BUG: KASAN: use-after-free in crc_itu_t+0x178/0x240 [ 58.377835][ T1509] Read of size 1 at addr ffff88806cb7d000 by task syz-executor.0/1509 [ 58.385992][ T1509] [ 58.388336][ T1509] CPU: 0 PID: 1509 Comm: syz-executor.0 Not tainted 6.1.130-syzkaller #0 [ 58.396752][ T1509] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 58.406805][ T1509] Call Trace: [ 58.410092][ T1509] [ 58.413023][ T1509] dump_stack_lvl+0xf4/0x251 [ 58.417596][ T1509] ? nf_tcp_handle_invalid+0x2f3/0x2f3 [ 58.423036][ T1509] ? panic+0x3fe/0x3fe [ 58.427086][ T1509] ? lock_acquire+0xbe/0x390 [ 58.431662][ T1509] ? read_lock_is_recursive+0x10/0x10 [ 58.437009][ T1509] ? __virt_addr_valid+0x139/0x270 [ 58.442101][ T1509] ? __virt_addr_valid+0x221/0x270 [ 58.447189][ T1509] print_report+0x15f/0x4f0 [ 58.451672][ T1509] ? __virt_addr_valid+0x139/0x270 [ 58.456761][ T1509] ? __virt_addr_valid+0x221/0x270 [ 58.461845][ T1509] ? crc_itu_t+0x178/0x240 [ 58.466238][ T1509] kasan_report+0x136/0x160 [ 58.470716][ T1509] ? crc_itu_t+0x178/0x240 [ 58.475125][ T1509] crc_itu_t+0x178/0x240 [ 58.479340][ T1509] udf_sync_fs+0x1bd/0x370 [ 58.483730][ T1509] ? udf_put_super+0x130/0x130 [ 58.488478][ T1509] ? dentry_kill+0xbb/0x1e0 [ 58.492969][ T1509] sync_filesystem+0xbf/0x180 [ 58.497639][ T1509] generic_shutdown_super+0x65/0x2c0 [ 58.502908][ T1509] kill_block_super+0x75/0xb0 [ 58.507566][ T1509] deactivate_locked_super+0x71/0xd0 [ 58.512829][ T1509] cleanup_mnt+0x2bd/0x330 [ 58.517223][ T1509] task_work_run+0x206/0x280 [ 58.521796][ T1509] ? task_work_cancel+0x280/0x280 [ 58.526796][ T1509] ? __x64_sys_umount+0xe4/0x120 [ 58.531711][ T1509] ? path_umount+0xc70/0xc70 [ 58.536313][ T1509] exit_to_user_mode_loop+0xa9/0xc0 [ 58.541496][ T1509] exit_to_user_mode_prepare+0x64/0xb0 [ 58.546942][ T1509] syscall_exit_to_user_mode+0x27/0x1b0 [ 58.552470][ T1509] do_syscall_64+0x47/0x80 [ 58.556886][ T1509] ? clear_bhb_loop+0x45/0xa0 [ 58.561541][ T1509] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 58.567416][ T1509] RIP: 0033:0x7f38b687de17 [ 58.571834][ T1509] Code: b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b0 ff ff ff f7 d8 64 89 02 b8 [ 58.591426][ T1509] RSP: 002b:00007ffd2e7ea9b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 58.599827][ T1509] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f38b687de17 [ 58.607783][ T1509] RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007ffd2e7eaa70 [ 58.615742][ T1509] RBP: 00007ffd2e7eaa70 R08: 0000000000000000 R09: 0000000000000000 [ 58.623692][ T1509] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd2e7ebb30 [ 58.631656][ T1509] R13: 00007f38b68c73b9 R14: 000000000000e3b7 R15: 0000000000000006 [ 58.639608][ T1509] [ 58.642610][ T1509] [ 58.644926][ T1509] The buggy address belongs to the physical page: [ 58.651327][ T1509] page:ffffea0001b2df40 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x6cb7d [ 58.661451][ T1509] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 58.668538][ T1509] raw: 00fff00000000000 ffffea0001b2db88 ffffea0001b2d2c8 0000000000000000 [ 58.677107][ T1509] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 58.685686][ T1509] page dumped because: kasan: bad access detected [ 58.692106][ T1509] page_owner tracks the page as freed [ 58.697470][ T1509] page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 1924, tgid 1924 (syz-executor.0), ts 58351108012, free_ts 58359651008 [ 58.715679][ T1509] post_alloc_hook+0x286/0x2b0 [ 58.720427][ T1509] get_page_from_freelist+0x340b/0x35b0 [ 58.725953][ T1509] __alloc_pages+0x251/0x640 [ 58.730518][ T1509] __folio_alloc+0xf/0x30 [ 58.734824][ T1509] vma_alloc_folio+0x484/0x9e0 [ 58.739581][ T1509] wp_page_copy+0x226/0x1970 [ 58.744146][ T1509] handle_mm_fault+0x1f06/0x4290 [ 58.749061][ T1509] exc_page_fault+0x22a/0x5a0 [ 58.753727][ T1509] asm_exc_page_fault+0x22/0x30 [ 58.758566][ T1509] page last free stack trace: [ 58.763224][ T1509] free_unref_page_prepare+0x10b7/0x13b0 [ 58.768833][ T1509] free_unref_page_list+0x54b/0x7e0 [ 58.774007][ T1509] release_pages+0x1c13/0x1dc0 [ 58.778746][ T1509] tlb_flush_mmu+0xe5/0x1d0 [ 58.783238][ T1509] tlb_finish_mmu+0xb0/0x1b0 [ 58.787810][ T1509] exit_mmap+0x330/0x6f0 [ 58.792043][ T1509] __mmput+0x9b/0x2e0 [ 58.795999][ T1509] exit_mm+0x122/0x1b0 [ 58.800059][ T1509] do_exit+0x819/0x23a0 [ 58.804200][ T1509] do_group_exit+0x1b5/0x280 [ 58.808767][ T1509] get_signal+0x1117/0x1260 [ 58.813241][ T1509] arch_do_signal_or_restart+0xb3/0x1240 [ 58.818850][ T1509] exit_to_user_mode_loop+0x61/0xc0 [ 58.824113][ T1509] exit_to_user_mode_prepare+0x64/0xb0 [ 58.829544][ T1509] syscall_exit_to_user_mode+0x27/0x1b0 [ 58.835061][ T1509] do_syscall_64+0x47/0x80 [ 58.839469][ T1509] [ 58.841771][ T1509] Memory state around the buggy address: [ 58.847389][ T1509] ffff88806cb7cf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 58.855425][ T1509] ffff88806cb7cf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 58.863547][ T1509] >ffff88806cb7d000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 58.871581][ T1509] ^ [ 58.875622][ T1509] ffff88806cb7d080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 58.883657][ T1509] ffff88806cb7d100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 58.891692][ T1509] ================================================================== [ 58.900734][ T1509] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 58.908230][ T1509] Kernel Offset: disabled [ 58.912540][ T1509] Rebooting in 86400 seconds..