Warning: Permanently added '10.128.1.71' (ED25519) to the list of known hosts. 2023/10/30 11:41:39 ignoring optional flag "sandboxArg"="0" 2023/10/30 11:41:39 parsed 1 programs 2023/10/30 11:41:39 executed programs: 0 [ 53.980822][ T1997] loop0: detected capacity change from 0 to 2048 [ 53.989983][ T1997] UDF-fs: error (device loop0): udf_read_tagged: tag version 0x0000 != 0x0002 || 0x0003, block 0 [ 54.001843][ T1997] UDF-fs: error (device loop0): udf_read_tagged: tag version 0x0000 != 0x0002 || 0x0003, block 0 [ 54.013155][ T1997] UDF-fs: error (device loop0): udf_read_tagged: tag version 0x0000 != 0x0002 || 0x0003, block 0 [ 54.024322][ T1997] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 54.032822][ T1997] UDF-fs: Scanning with blocksize 512 failed [ 54.041427][ T1997] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 54.100224][ T1586] ================================================================== [ 54.108810][ T1586] BUG: KASAN: use-after-free in crc_itu_t+0x178/0x240 [ 54.115760][ T1586] Read of size 1 at addr ffff888069468000 by task syz-executor.0/1586 [ 54.124336][ T1586] [ 54.126767][ T1586] CPU: 0 PID: 1586 Comm: syz-executor.0 Not tainted 6.1.60-syzkaller #0 [ 54.135415][ T1586] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 54.145644][ T1586] Call Trace: [ 54.148988][ T1586] [ 54.152263][ T1586] dump_stack_lvl+0xf4/0x251 [ 54.157366][ T1586] ? nf_tcp_handle_invalid+0x2f3/0x2f3 [ 54.167867][ T1586] ? panic+0x3f7/0x3f7 [ 54.172625][ T1586] ? _printk+0xca/0x10a [ 54.177004][ T1586] ? ktime_get_real_ts64+0x340/0x340 [ 54.182637][ T1586] print_report+0x15f/0x4f0 [ 54.187235][ T1586] ? crc_itu_t+0x178/0x240 [ 54.191809][ T1586] kasan_report+0x136/0x160 [ 54.196480][ T1586] ? crc_itu_t+0x178/0x240 [ 54.200932][ T1586] crc_itu_t+0x178/0x240 [ 54.205843][ T1586] udf_sync_fs+0x1bd/0x370 [ 54.212147][ T1586] ? udf_put_super+0x130/0x130 [ 54.217713][ T1586] ? dentry_kill+0xbb/0x1e0 [ 54.222551][ T1586] ? dput+0x38/0x2b0 [ 54.226788][ T1586] sync_filesystem+0xbf/0x180 [ 54.231457][ T1586] generic_shutdown_super+0x65/0x2c0 [ 54.236897][ T1586] kill_block_super+0x75/0xb0 [ 54.241637][ T1586] deactivate_locked_super+0x71/0xd0 [ 54.247177][ T1586] cleanup_mnt+0x2bd/0x330 [ 54.251569][ T1586] task_work_run+0x206/0x280 [ 54.256257][ T1586] ? task_work_cancel+0x2a0/0x2a0 [ 54.261404][ T1586] ? __x64_sys_umount+0xe4/0x120 [ 54.266619][ T1586] ? path_umount+0xc70/0xc70 [ 54.271313][ T1586] exit_to_user_mode_loop+0xa9/0xc0 [ 54.276820][ T1586] exit_to_user_mode_prepare+0x64/0xb0 [ 54.282277][ T1586] syscall_exit_to_user_mode+0x27/0x1c0 [ 54.287898][ T1586] do_syscall_64+0x49/0x80 [ 54.292395][ T1586] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 54.298551][ T1586] RIP: 0033:0x7f724987dc87 [ 54.303002][ T1586] Code: b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b0 ff ff ff f7 d8 64 89 02 b8 [ 54.322790][ T1586] RSP: 002b:00007ffea61db1a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 54.331625][ T1586] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f724987dc87 [ 54.339797][ T1586] RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007ffea61db260 [ 54.347751][ T1586] RBP: 00007ffea61db260 R08: 0000000000000000 R09: 0000000000000000 [ 54.355840][ T1586] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffea61dc320 [ 54.363795][ T1586] R13: 00007f72498d7c5a R14: 000000000000d2a9 R15: 0000000000000006 [ 54.372283][ T1586] [ 54.375474][ T1586] [ 54.377863][ T1586] The buggy address belongs to the physical page: [ 54.384347][ T1586] page:ffffea0001a51a00 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x69468 [ 54.394584][ T1586] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 54.402043][ T1586] raw: 00fff00000000000 ffffea0001a7fe88 ffffea0001a52348 0000000000000000 [ 54.411057][ T1586] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 54.419893][ T1586] page dumped because: kasan: bad access detected [ 54.426571][ T1586] page_owner tracks the page as freed [ 54.432554][ T1586] page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 1996, tgid 1996 (syz-executor.0), ts 53969576719, free_ts 54098664570 [ 54.450851][ T1586] post_alloc_hook+0x286/0x2b0 [ 54.455684][ T1586] get_page_from_freelist+0x2fdd/0x3170 [ 54.461290][ T1586] __alloc_pages+0x251/0x640 [ 54.465871][ T1586] __folio_alloc+0xf/0x30 [ 54.470176][ T1586] vma_alloc_folio+0x484/0x9e0 [ 54.475120][ T1586] wp_page_copy+0x226/0x1970 [ 54.479794][ T1586] handle_mm_fault+0x1f58/0x4260 [ 54.485695][ T1586] exc_page_fault+0x22a/0x5e0 [ 54.490439][ T1586] asm_exc_page_fault+0x22/0x30 [ 54.495462][ T1586] page last free stack trace: [ 54.500456][ T1586] free_unref_page_prepare+0xd4b/0xee0 [ 54.506253][ T1586] free_unref_page_list+0x54b/0x7e0 [ 54.511554][ T1586] release_pages+0x175c/0x1900 [ 54.516758][ T1586] tlb_flush_mmu+0xe5/0x1d0 [ 54.521451][ T1586] tlb_finish_mmu+0xb0/0x1b0 [ 54.526372][ T1586] exit_mmap+0x341/0x730 [ 54.531552][ T1586] __mmput+0x9b/0x2d0 [ 54.535610][ T1586] exit_mm+0x122/0x1b0 [ 54.540141][ T1586] do_exit+0x81e/0x23a0 [ 54.546203][ T1586] do_group_exit+0x1b5/0x280 [ 54.551662][ T1586] get_signal+0x1117/0x1260 [ 54.556335][ T1586] arch_do_signal_or_restart+0xb3/0x1240 [ 54.563270][ T1586] exit_to_user_mode_loop+0x61/0xc0 [ 54.568733][ T1586] exit_to_user_mode_prepare+0x64/0xb0 [ 54.574420][ T1586] syscall_exit_to_user_mode+0x27/0x1c0 [ 54.580153][ T1586] do_syscall_64+0x49/0x80 [ 54.584822][ T1586] [ 54.587130][ T1586] Memory state around the buggy address: [ 54.593097][ T1586] ffff888069467f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 54.602405][ T1586] ffff888069467f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 54.610927][ T1586] >ffff888069468000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.619224][ T1586] ^ [ 54.623265][ T1586] ffff888069468080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.631481][ T1586] ffff888069468100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.640566][ T1586] ================================================================== [ 54.651232][ T1586] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 54.659882][ T1586] Kernel Offset: disabled [ 54.664956][ T1586] Rebooting in 86400 seconds..