forked to background, child pid 961 Starting sshd: OK syzkaller syzkaller login: [ 24.298752][ T1058] cgroup: Unknown subsys name 'net' [ 24.418792][ T1058] cgroup: Unknown subsys name 'rlimit' [ 24.612856][ T1058] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 29.291333][ T1061] syz-executor.0 (1061) used greatest stack depth: 20584 bytes left Warning: Permanently added '10.128.1.17' (ED25519) to the list of known hosts. 2023/09/17 03:36:10 ignoring optional flag "sandboxArg"="0" 2023/09/17 03:36:10 parsed 1 programs 2023/09/17 03:36:10 executed programs: 0 [ 49.198128][ T1579] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 53.862775][ T1995] loop0: detected capacity change from 0 to 2048 [ 53.869759][ T1995] ======================================================= [ 53.869759][ T1995] WARNING: The mand mount option has been deprecated and [ 53.869759][ T1995] and is ignored by this kernel. Remove the mand [ 53.869759][ T1995] option from the mount to silence this warning. [ 53.869759][ T1995] ======================================================= [ 53.907475][ T1995] UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 53.919255][ T1995] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 54.011724][ T1584] ================================================================== [ 54.020339][ T1584] BUG: KASAN: use-after-free in crc_itu_t+0x1c6/0x240 [ 54.027432][ T1584] Read of size 1 at addr ffff88806ceb6000 by task syz-executor.0/1584 [ 54.035903][ T1584] [ 54.038206][ T1584] CPU: 1 PID: 1584 Comm: syz-executor.0 Not tainted 6.1.53-syzkaller #0 [ 54.046762][ T1584] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 [ 54.057146][ T1584] Call Trace: [ 54.060503][ T1584] [ 54.063590][ T1584] dump_stack_lvl+0xf4/0x251 [ 54.068333][ T1584] ? nf_tcp_handle_invalid+0x2f3/0x2f3 [ 54.073778][ T1584] ? panic+0x3f7/0x3f7 [ 54.077997][ T1584] ? vprintk_emit+0x115/0x1e0 [ 54.082746][ T1584] ? _printk+0xca/0x10a [ 54.086958][ T1584] ? ktime_get_real_ts64+0x340/0x340 [ 54.092303][ T1584] print_report+0x15f/0x4f0 [ 54.096779][ T1584] ? crc_itu_t+0x1c6/0x240 [ 54.101426][ T1584] kasan_report+0x136/0x160 [ 54.106087][ T1584] ? crc_itu_t+0x1c6/0x240 [ 54.110524][ T1584] crc_itu_t+0x1c6/0x240 [ 54.115270][ T1584] udf_sync_fs+0x1bd/0x370 [ 54.119751][ T1584] ? udf_put_super+0x130/0x130 [ 54.124769][ T1584] ? dentry_kill+0xbb/0x1e0 [ 54.129504][ T1584] sync_filesystem+0xbf/0x180 [ 54.134152][ T1584] generic_shutdown_super+0x65/0x2c0 [ 54.140279][ T1584] kill_block_super+0x75/0xb0 [ 54.145119][ T1584] deactivate_locked_super+0x71/0xd0 [ 54.150373][ T1584] cleanup_mnt+0x2bd/0x330 [ 54.154848][ T1584] task_work_run+0x206/0x280 [ 54.159513][ T1584] ? task_work_cancel+0x2a0/0x2a0 [ 54.164798][ T1584] ? __x64_sys_umount+0xe4/0x120 [ 54.169828][ T1584] ? path_umount+0xc70/0xc70 [ 54.174486][ T1584] exit_to_user_mode_loop+0xa4/0xb0 [ 54.179921][ T1584] exit_to_user_mode_prepare+0x64/0xb0 [ 54.185373][ T1584] syscall_exit_to_user_mode+0x27/0x1c0 [ 54.191368][ T1584] do_syscall_64+0x49/0x80 [ 54.195995][ T1584] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 54.202086][ T1584] RIP: 0033:0x7f353747de57 [ 54.206674][ T1584] Code: b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b0 ff ff ff f7 d8 64 89 02 b8 [ 54.227656][ T1584] RSP: 002b:00007ffdf183d388 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 54.236045][ T1584] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f353747de57 [ 54.244339][ T1584] RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007ffdf183d440 [ 54.252284][ T1584] RBP: 00007ffdf183d440 R08: 0000000000000000 R09: 0000000000000000 [ 54.260905][ T1584] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffdf183e500 [ 54.268944][ T1584] R13: 00007f35374c73b9 R14: 000000000000d23f R15: 0000000000000006 [ 54.276978][ T1584] [ 54.279971][ T1584] [ 54.282267][ T1584] The buggy address belongs to the physical page: [ 54.288901][ T1584] page:ffffea0001b3ad80 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x6ceb6 [ 54.299140][ T1584] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 54.306261][ T1584] raw: 00fff00000000000 ffffea0001b6f788 ffffea0000157108 0000000000000000 [ 54.314820][ T1584] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 54.323372][ T1584] page dumped because: kasan: bad access detected [ 54.329759][ T1584] page_owner tracks the page as freed [ 54.336098][ T1584] page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 1870, tgid 1870 (modprobe), ts 52461785516, free_ts 52464135756 [ 54.354050][ T1584] post_alloc_hook+0x286/0x2b0 [ 54.358891][ T1584] get_page_from_freelist+0x3100/0x32a0 [ 54.364601][ T1584] __alloc_pages+0x251/0x640 [ 54.369346][ T1584] __folio_alloc+0xf/0x30 [ 54.373990][ T1584] vma_alloc_folio+0x484/0x9e0 [ 54.379187][ T1584] wp_page_copy+0x22a/0x1930 [ 54.383765][ T1584] handle_mm_fault+0x1e16/0x4340 [ 54.388681][ T1584] exc_page_fault+0x22a/0x5e0 [ 54.393348][ T1584] asm_exc_page_fault+0x22/0x30 [ 54.398179][ T1584] page last free stack trace: [ 54.402821][ T1584] free_unref_page_prepare+0xd4b/0xee0 [ 54.408251][ T1584] free_unref_page_list+0xf6/0x6d0 [ 54.413551][ T1584] release_pages+0x175c/0x1900 [ 54.418286][ T1584] tlb_flush_mmu+0xe5/0x1d0 [ 54.422774][ T1584] tlb_finish_mmu+0xb0/0x1b0 [ 54.427349][ T1584] exit_mmap+0x341/0x730 [ 54.431665][ T1584] __mmput+0x9b/0x2d0 [ 54.435631][ T1584] exit_mm+0x122/0x1b0 [ 54.439694][ T1584] do_exit+0x81e/0x23a0 [ 54.443886][ T1584] do_group_exit+0x1b5/0x280 [ 54.448456][ T1584] __x64_sys_exit_group+0x3b/0x40 [ 54.453454][ T1584] do_syscall_64+0x3d/0x80 [ 54.457851][ T1584] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 54.463737][ T1584] [ 54.466044][ T1584] Memory state around the buggy address: [ 54.471653][ T1584] ffff88806ceb5f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 54.479786][ T1584] ffff88806ceb5f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 54.487925][ T1584] >ffff88806ceb6000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.496121][ T1584] ^ [ 54.500347][ T1584] ffff88806ceb6080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.508393][ T1584] ffff88806ceb6100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.516825][ T1584] ================================================================== [ 54.525101][ T1584] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 54.533244][ T1584] Kernel Offset: disabled [ 54.537557][ T1584] Rebooting in 86400 seconds..