Warning: Permanently added '10.128.0.30' (ED25519) to the list of known hosts. 2025/01/07 19:27:51 ignoring optional flag "sandboxArg"="0" 2025/01/07 19:27:51 ignoring optional flag "type"="gce" 2025/01/07 19:27:51 parsed 1 programs 2025/01/07 19:27:51 executed programs: 0 [ 58.570473][ T1501] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k 2025/01/07 19:27:57 executed programs: 1 [ 64.389516][ T1919] loop0: detected capacity change from 0 to 2048 [ 64.399770][ T1919] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 64.427599][ T1507] ================================================================== [ 64.435674][ T1507] BUG: KASAN: use-after-free in crc_itu_t+0x178/0x240 [ 64.442466][ T1507] Read of size 1 at addr ffff88806c866000 by task syz-executor.0/1507 [ 64.450624][ T1507] [ 64.453035][ T1507] CPU: 0 PID: 1507 Comm: syz-executor.0 Not tainted 6.1.123-syzkaller #0 [ 64.461511][ T1507] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 64.471552][ T1507] Call Trace: [ 64.474823][ T1507] [ 64.477779][ T1507] dump_stack_lvl+0xf4/0x251 [ 64.482374][ T1507] ? nf_tcp_handle_invalid+0x2f3/0x2f3 [ 64.487837][ T1507] ? panic+0x3fe/0x3fe [ 64.491898][ T1507] ? lock_acquire+0xbe/0x390 [ 64.496556][ T1507] ? read_lock_is_recursive+0x10/0x10 [ 64.501915][ T1507] ? __virt_addr_valid+0x139/0x270 [ 64.507001][ T1507] ? __virt_addr_valid+0x221/0x270 [ 64.512087][ T1507] print_report+0x15f/0x4f0 [ 64.516564][ T1507] ? __virt_addr_valid+0x139/0x270 [ 64.521646][ T1507] ? __virt_addr_valid+0x221/0x270 [ 64.526750][ T1507] ? crc_itu_t+0x178/0x240 [ 64.531142][ T1507] kasan_report+0x136/0x160 [ 64.535623][ T1507] ? crc_itu_t+0x178/0x240 [ 64.540015][ T1507] crc_itu_t+0x178/0x240 [ 64.544250][ T1507] udf_sync_fs+0x1bd/0x370 [ 64.548642][ T1507] ? udf_put_super+0x130/0x130 [ 64.553380][ T1507] ? dentry_kill+0xbb/0x1e0 [ 64.557862][ T1507] sync_filesystem+0xbf/0x180 [ 64.562601][ T1507] generic_shutdown_super+0x65/0x2c0 [ 64.567870][ T1507] kill_block_super+0x75/0xb0 [ 64.572530][ T1507] deactivate_locked_super+0x71/0xd0 [ 64.577891][ T1507] cleanup_mnt+0x2bd/0x330 [ 64.582282][ T1507] task_work_run+0x206/0x280 [ 64.586866][ T1507] ? task_work_cancel+0x280/0x280 [ 64.591875][ T1507] ? __x64_sys_umount+0xe4/0x120 [ 64.596790][ T1507] ? path_umount+0xc70/0xc70 [ 64.601378][ T1507] exit_to_user_mode_loop+0xa9/0xc0 [ 64.606555][ T1507] exit_to_user_mode_prepare+0x64/0xb0 [ 64.611986][ T1507] syscall_exit_to_user_mode+0x27/0x1b0 [ 64.617524][ T1507] do_syscall_64+0x47/0x80 [ 64.621924][ T1507] ? clear_bhb_loop+0x45/0xa0 [ 64.626617][ T1507] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 64.632534][ T1507] RIP: 0033:0x7fc8df47de17 [ 64.636936][ T1507] Code: b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b0 ff ff ff f7 d8 64 89 02 b8 [ 64.656619][ T1507] RSP: 002b:00007ffd275d1de8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 64.665030][ T1507] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fc8df47de17 [ 64.673015][ T1507] RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007ffd275d1ea0 [ 64.681006][ T1507] RBP: 00007ffd275d1ea0 R08: 0000000000000000 R09: 0000000000000000 [ 64.688985][ T1507] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd275d2f60 [ 64.696944][ T1507] R13: 00007fc8df4c73b9 R14: 000000000000fb69 R15: 0000000000000006 [ 64.704898][ T1507] [ 64.707982][ T1507] [ 64.710287][ T1507] The buggy address belongs to the physical page: [ 64.716683][ T1507] page:ffffea0001b21980 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x6c866 [ 64.726829][ T1507] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 64.733927][ T1507] raw: 00fff00000000000 ffffea0001b24208 ffffea0001bbeac8 0000000000000000 [ 64.742581][ T1507] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 64.751142][ T1507] page dumped because: kasan: bad access detected [ 64.757567][ T1507] page_owner tracks the page as freed [ 64.762921][ T1507] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 1919, tgid 1918 (syz-executor.0), ts 64381214298, free_ts 64388943055 [ 64.781901][ T1507] post_alloc_hook+0x286/0x2b0 [ 64.786653][ T1507] get_page_from_freelist+0x340b/0x35b0 [ 64.792193][ T1507] __alloc_pages+0x251/0x640 [ 64.796758][ T1507] __folio_alloc+0xf/0x30 [ 64.801083][ T1507] vma_alloc_folio+0x484/0x9e0 [ 64.805918][ T1507] handle_mm_fault+0x2608/0x4290 [ 64.810948][ T1507] exc_page_fault+0x22a/0x5a0 [ 64.815606][ T1507] asm_exc_page_fault+0x22/0x30 [ 64.820457][ T1507] page last free stack trace: [ 64.825111][ T1507] free_unref_page_prepare+0x10b7/0x13b0 [ 64.830842][ T1507] free_unref_page_list+0x54b/0x7e0 [ 64.836028][ T1507] release_pages+0x1c13/0x1dc0 [ 64.840874][ T1507] tlb_flush_mmu+0xe5/0x1d0 [ 64.845358][ T1507] tlb_finish_mmu+0xb0/0x1b0 [ 64.849925][ T1507] unmap_region+0x265/0x2b0 [ 64.854412][ T1507] do_mas_align_munmap+0xa6c/0x11a0 [ 64.859644][ T1507] do_mas_munmap+0x195/0x1f0 [ 64.864219][ T1507] __vm_munmap+0x236/0x300 [ 64.868788][ T1507] __x64_sys_munmap+0x57/0x60 [ 64.873441][ T1507] do_syscall_64+0x3b/0x80 [ 64.877850][ T1507] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 64.883717][ T1507] [ 64.886018][ T1507] Memory state around the buggy address: [ 64.891625][ T1507] ffff88806c865f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.899669][ T1507] ffff88806c865f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.907721][ T1507] >ffff88806c866000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 64.915766][ T1507] ^ [ 64.919851][ T1507] ffff88806c866080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 64.927900][ T1507] ffff88806c866100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 64.935965][ T1507] ================================================================== [ 64.944362][ T1507] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 64.951962][ T1507] Kernel Offset: disabled [ 64.956280][ T1507] Rebooting in 86400 seconds..