Extracting prog: 31.796626511s
Minimizing prog: 27m48.714049029s
Simplifying prog options: 0s
Extracting C: 1m16.564517659s
Simplifying C: 9m3.547893561s


extracting reproducer from 8 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4-prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-fsync-recvmmsg$unix-read$FUSE
detailed listing:
executing program 0:
syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYRES64=0x0, @ANYBLOB="644a0ce3a7d8a6cecbfc1f5c56d41c137c743ababa2b36ff835b00594da92f6c67dcd82c7f067560f0ae9c45a55703b2f63abe7b95fedddb78ffce323c6f2687610150e9336739"], 0x1, 0x1b4, &(0x7f00000001c0)="$eJzsmLFv2kAUxr+zwchVJbq2SysVCTrU2KatytABdezQSq1adQMVF5GYEIEHYCJ/RebMGTKjLPwfyZBkyhCyZYoUR2ef4xOCIBKCUPJ+w/Nn7vH87gEf0oEgiCfLyfHF0V42o3P9HBmkxOunapyjSPmD9OW7g/r3/W3z/HAw/FYcK6fN+/wEgGFJhSfufd/35SoZcf0FJdJJlOP1P2AwhC5DwW+hHTD8FXpN0k2ebxj/665j/Gu6VS5MHiwebB4K4/2NthiqUn9MWm93e+sV13Va9xdfeduTlmbNb1RS8EXqT/68otmY8fxgQYEldAEMP4X+rCKaTTgSaf+vEnF99WH2/0jFy/SMnCRWpdWVFXrsLMt8uvih9+d6FwMXZ/pyW12U2NWBxRSM/cnfYchK/pSQ/CPvNTbz7W7vfb1RqTk1Z8O2C5/MD6b50c4HRhTGW/xPD/zpmVQ/OSVXYxo6Fc9rWWG8ubc7KXgte5LjaoH/Kci9DbtmE/7kgq/JC/aGX3IqcOWHTG2aIAiCIAiCIAiCIAiCIAjiTrwGgx+dQPaFKEIXh6MR9o8g+zoAAP//uJxoHg==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x40)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000), 0x0)
r2 = accept4(r1, 0x0, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r3 = getpid()
sched_setscheduler(r3, 0x1, &(0x7f0000000240)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
connect$unix(r4, &(0x7f0000000180)=@abs, 0x6e)
sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r4, &(0x7f00000000c0), 0x0, 0x40000040, 0x0)
fsync(r5)
recvmmsg$unix(r2, &(0x7f0000002d40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x3, 0x0)
read$FUSE(r0, &(0x7f0000000940)={0x2020}, 0x2020)

program crashed: KASAN: use-after-free Read in z_erofs_transform_plain
single: successfully extracted reproducer
found reproducer with 18 syscalls
minimizing guilty program
testing program (duration=42.326202387s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4-prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-fsync-recvmmsg$unix
detailed listing:
executing program 0:
syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYRES64=0x0, @ANYBLOB="644a0ce3a7d8a6cecbfc1f5c56d41c137c743ababa2b36ff835b00594da92f6c67dcd82c7f067560f0ae9c45a55703b2f63abe7b95fedddb78ffce323c6f2687610150e9336739"], 0x1, 0x1b4, &(0x7f00000001c0)="$eJzsmLFv2kAUxr+zwchVJbq2SysVCTrU2KatytABdezQSq1adQMVF5GYEIEHYCJ/RebMGTKjLPwfyZBkyhCyZYoUR2ef4xOCIBKCUPJ+w/Nn7vH87gEf0oEgiCfLyfHF0V42o3P9HBmkxOunapyjSPmD9OW7g/r3/W3z/HAw/FYcK6fN+/wEgGFJhSfufd/35SoZcf0FJdJJlOP1P2AwhC5DwW+hHTD8FXpN0k2ebxj/665j/Gu6VS5MHiwebB4K4/2NthiqUn9MWm93e+sV13Va9xdfeduTlmbNb1RS8EXqT/68otmY8fxgQYEldAEMP4X+rCKaTTgSaf+vEnF99WH2/0jFy/SMnCRWpdWVFXrsLMt8uvih9+d6FwMXZ/pyW12U2NWBxRSM/cnfYchK/pSQ/CPvNTbz7W7vfb1RqTk1Z8O2C5/MD6b50c4HRhTGW/xPD/zpmVQ/OSVXYxo6Fc9rWWG8ubc7KXgte5LjaoH/Kci9DbtmE/7kgq/JC/aGX3IqcOWHTG2aIAiCIAiCIAiCIAiCIAjiTrwGgx+dQPaFKEIXh6MR9o8g+zoAAP//uJxoHg==")
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x40)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000), 0x0)
r1 = accept4(r0, 0x0, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r2 = getpid()
sched_setscheduler(r2, 0x1, &(0x7f0000000240)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e)
sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r3, &(0x7f00000000c0), 0x0, 0x40000040, 0x0)
fsync(r4)
recvmmsg$unix(r1, &(0x7f0000002d40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x3, 0x0)

program did not crash
testing program (duration=42.326202387s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4-prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-fsync-read$FUSE
detailed listing:
executing program 0:
syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYRES64=0x0, @ANYBLOB="644a0ce3a7d8a6cecbfc1f5c56d41c137c743ababa2b36ff835b00594da92f6c67dcd82c7f067560f0ae9c45a55703b2f63abe7b95fedddb78ffce323c6f2687610150e9336739"], 0x1, 0x1b4, &(0x7f00000001c0)="$eJzsmLFv2kAUxr+zwchVJbq2SysVCTrU2KatytABdezQSq1adQMVF5GYEIEHYCJ/RebMGTKjLPwfyZBkyhCyZYoUR2ef4xOCIBKCUPJ+w/Nn7vH87gEf0oEgiCfLyfHF0V42o3P9HBmkxOunapyjSPmD9OW7g/r3/W3z/HAw/FYcK6fN+/wEgGFJhSfufd/35SoZcf0FJdJJlOP1P2AwhC5DwW+hHTD8FXpN0k2ebxj/665j/Gu6VS5MHiwebB4K4/2NthiqUn9MWm93e+sV13Va9xdfeduTlmbNb1RS8EXqT/68otmY8fxgQYEldAEMP4X+rCKaTTgSaf+vEnF99WH2/0jFy/SMnCRWpdWVFXrsLMt8uvih9+d6FwMXZ/pyW12U2NWBxRSM/cnfYchK/pSQ/CPvNTbz7W7vfb1RqTk1Z8O2C5/MD6b50c4HRhTGW/xPD/zpmVQ/OSVXYxo6Fc9rWWG8ubc7KXgte5LjaoH/Kci9DbtmE/7kgq/JC/aGX3IqcOWHTG2aIAiCIAiCIAiCIAiCIAjiTrwGgx+dQPaFKEIXh6MR9o8g+zoAAP//uJxoHg==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x40)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000), 0x0)
accept4(r1, 0x0, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r2 = getpid()
sched_setscheduler(r2, 0x1, &(0x7f0000000240)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e)
sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r3, &(0x7f00000000c0), 0x0, 0x40000040, 0x0)
fsync(r4)
read$FUSE(r0, &(0x7f0000000940)={0x2020}, 0x2020)

program crashed: KASAN: use-after-free Read in z_erofs_transform_plain
testing program (duration=42.326202387s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4-prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-read$FUSE
detailed listing:
executing program 0:
syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYRES64=0x0, @ANYBLOB="644a0ce3a7d8a6cecbfc1f5c56d41c137c743ababa2b36ff835b00594da92f6c67dcd82c7f067560f0ae9c45a55703b2f63abe7b95fedddb78ffce323c6f2687610150e9336739"], 0x1, 0x1b4, &(0x7f00000001c0)="$eJzsmLFv2kAUxr+zwchVJbq2SysVCTrU2KatytABdezQSq1adQMVF5GYEIEHYCJ/RebMGTKjLPwfyZBkyhCyZYoUR2ef4xOCIBKCUPJ+w/Nn7vH87gEf0oEgiCfLyfHF0V42o3P9HBmkxOunapyjSPmD9OW7g/r3/W3z/HAw/FYcK6fN+/wEgGFJhSfufd/35SoZcf0FJdJJlOP1P2AwhC5DwW+hHTD8FXpN0k2ebxj/665j/Gu6VS5MHiwebB4K4/2NthiqUn9MWm93e+sV13Va9xdfeduTlmbNb1RS8EXqT/68otmY8fxgQYEldAEMP4X+rCKaTTgSaf+vEnF99WH2/0jFy/SMnCRWpdWVFXrsLMt8uvih9+d6FwMXZ/pyW12U2NWBxRSM/cnfYchK/pSQ/CPvNTbz7W7vfb1RqTk1Z8O2C5/MD6b50c4HRhTGW/xPD/zpmVQ/OSVXYxo6Fc9rWWG8ubc7KXgte5LjaoH/Kci9DbtmE/7kgq/JC/aGX3IqcOWHTG2aIAiCIAiCIAiCIAiCIAjiTrwGgx+dQPaFKEIXh6MR9o8g+zoAAP//uJxoHg==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x40)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000), 0x0)
accept4(r1, 0x0, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r2 = getpid()
sched_setscheduler(r2, 0x1, &(0x7f0000000240)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e)
sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r3, &(0x7f00000000c0), 0x0, 0x40000040, 0x0)
read$FUSE(r0, &(0x7f0000000940)={0x2020}, 0x2020)

program crashed: KASAN: use-after-free Read in z_erofs_transform_plain
testing program (duration=42.326202387s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4-prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-read$FUSE
detailed listing:
executing program 0:
syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYRES64=0x0, @ANYBLOB="644a0ce3a7d8a6cecbfc1f5c56d41c137c743ababa2b36ff835b00594da92f6c67dcd82c7f067560f0ae9c45a55703b2f63abe7b95fedddb78ffce323c6f2687610150e9336739"], 0x1, 0x1b4, &(0x7f00000001c0)="$eJzsmLFv2kAUxr+zwchVJbq2SysVCTrU2KatytABdezQSq1adQMVF5GYEIEHYCJ/RebMGTKjLPwfyZBkyhCyZYoUR2ef4xOCIBKCUPJ+w/Nn7vH87gEf0oEgiCfLyfHF0V42o3P9HBmkxOunapyjSPmD9OW7g/r3/W3z/HAw/FYcK6fN+/wEgGFJhSfufd/35SoZcf0FJdJJlOP1P2AwhC5DwW+hHTD8FXpN0k2ebxj/665j/Gu6VS5MHiwebB4K4/2NthiqUn9MWm93e+sV13Va9xdfeduTlmbNb1RS8EXqT/68otmY8fxgQYEldAEMP4X+rCKaTTgSaf+vEnF99WH2/0jFy/SMnCRWpdWVFXrsLMt8uvih9+d6FwMXZ/pyW12U2NWBxRSM/cnfYchK/pSQ/CPvNTbz7W7vfb1RqTk1Z8O2C5/MD6b50c4HRhTGW/xPD/zpmVQ/OSVXYxo6Fc9rWWG8ubc7KXgte5LjaoH/Kci9DbtmE/7kgq/JC/aGX3IqcOWHTG2aIAiCIAiCIAiCIAiCIAjiTrwGgx+dQPaFKEIXh6MR9o8g+zoAAP//uJxoHg==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x40)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000), 0x0)
accept4(r1, 0x0, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r2 = getpid()
sched_setscheduler(r2, 0x1, &(0x7f0000000240)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e)
sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0)
read$FUSE(r0, &(0x7f0000000940)={0x2020}, 0x2020)

program crashed: KASAN: use-after-free Read in z_erofs_transform_plain
testing program (duration=42.326202387s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4-prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-read$FUSE
detailed listing:
executing program 0:
syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYRES64=0x0, @ANYBLOB="644a0ce3a7d8a6cecbfc1f5c56d41c137c743ababa2b36ff835b00594da92f6c67dcd82c7f067560f0ae9c45a55703b2f63abe7b95fedddb78ffce323c6f2687610150e9336739"], 0x1, 0x1b4, &(0x7f00000001c0)="$eJzsmLFv2kAUxr+zwchVJbq2SysVCTrU2KatytABdezQSq1adQMVF5GYEIEHYCJ/RebMGTKjLPwfyZBkyhCyZYoUR2ef4xOCIBKCUPJ+w/Nn7vH87gEf0oEgiCfLyfHF0V42o3P9HBmkxOunapyjSPmD9OW7g/r3/W3z/HAw/FYcK6fN+/wEgGFJhSfufd/35SoZcf0FJdJJlOP1P2AwhC5DwW+hHTD8FXpN0k2ebxj/665j/Gu6VS5MHiwebB4K4/2NthiqUn9MWm93e+sV13Va9xdfeduTlmbNb1RS8EXqT/68otmY8fxgQYEldAEMP4X+rCKaTTgSaf+vEnF99WH2/0jFy/SMnCRWpdWVFXrsLMt8uvih9+d6FwMXZ/pyW12U2NWBxRSM/cnfYchK/pSQ/CPvNTbz7W7vfb1RqTk1Z8O2C5/MD6b50c4HRhTGW/xPD/zpmVQ/OSVXYxo6Fc9rWWG8ubc7KXgte5LjaoH/Kci9DbtmE/7kgq/JC/aGX3IqcOWHTG2aIAiCIAiCIAiCIAiCIAjiTrwGgx+dQPaFKEIXh6MR9o8g+zoAAP//uJxoHg==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x40)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000), 0x0)
accept4(r1, 0x0, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r2 = getpid()
sched_setscheduler(r2, 0x1, &(0x7f0000000240)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r3=>0xffffffffffffffff})
connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e)
read$FUSE(r0, &(0x7f0000000940)={0x2020}, 0x2020)

program crashed: KASAN: use-after-free Read in z_erofs_transform_plain
testing program (duration=42.326202387s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4-prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-read$FUSE
detailed listing:
executing program 0:
syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYRES64=0x0, @ANYBLOB="644a0ce3a7d8a6cecbfc1f5c56d41c137c743ababa2b36ff835b00594da92f6c67dcd82c7f067560f0ae9c45a55703b2f63abe7b95fedddb78ffce323c6f2687610150e9336739"], 0x1, 0x1b4, &(0x7f00000001c0)="$eJzsmLFv2kAUxr+zwchVJbq2SysVCTrU2KatytABdezQSq1adQMVF5GYEIEHYCJ/RebMGTKjLPwfyZBkyhCyZYoUR2ef4xOCIBKCUPJ+w/Nn7vH87gEf0oEgiCfLyfHF0V42o3P9HBmkxOunapyjSPmD9OW7g/r3/W3z/HAw/FYcK6fN+/wEgGFJhSfufd/35SoZcf0FJdJJlOP1P2AwhC5DwW+hHTD8FXpN0k2ebxj/665j/Gu6VS5MHiwebB4K4/2NthiqUn9MWm93e+sV13Va9xdfeduTlmbNb1RS8EXqT/68otmY8fxgQYEldAEMP4X+rCKaTTgSaf+vEnF99WH2/0jFy/SMnCRWpdWVFXrsLMt8uvih9+d6FwMXZ/pyW12U2NWBxRSM/cnfYchK/pSQ/CPvNTbz7W7vfb1RqTk1Z8O2C5/MD6b50c4HRhTGW/xPD/zpmVQ/OSVXYxo6Fc9rWWG8ubc7KXgte5LjaoH/Kci9DbtmE/7kgq/JC/aGX3IqcOWHTG2aIAiCIAiCIAiCIAiCIAjiTrwGgx+dQPaFKEIXh6MR9o8g+zoAAP//uJxoHg==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x40)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000), 0x0)
accept4(r1, 0x0, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r2 = getpid()
sched_setscheduler(r2, 0x1, &(0x7f0000000240)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200))
read$FUSE(r0, &(0x7f0000000940)={0x2020}, 0x2020)

program crashed: KASAN: slab-out-of-bounds Read in z_erofs_transform_plain
testing program (duration=42.326202387s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4-prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-read$FUSE
detailed listing:
executing program 0:
syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYRES64=0x0, @ANYBLOB="644a0ce3a7d8a6cecbfc1f5c56d41c137c743ababa2b36ff835b00594da92f6c67dcd82c7f067560f0ae9c45a55703b2f63abe7b95fedddb78ffce323c6f2687610150e9336739"], 0x1, 0x1b4, &(0x7f00000001c0)="$eJzsmLFv2kAUxr+zwchVJbq2SysVCTrU2KatytABdezQSq1adQMVF5GYEIEHYCJ/RebMGTKjLPwfyZBkyhCyZYoUR2ef4xOCIBKCUPJ+w/Nn7vH87gEf0oEgiCfLyfHF0V42o3P9HBmkxOunapyjSPmD9OW7g/r3/W3z/HAw/FYcK6fN+/wEgGFJhSfufd/35SoZcf0FJdJJlOP1P2AwhC5DwW+hHTD8FXpN0k2ebxj/665j/Gu6VS5MHiwebB4K4/2NthiqUn9MWm93e+sV13Va9xdfeduTlmbNb1RS8EXqT/68otmY8fxgQYEldAEMP4X+rCKaTTgSaf+vEnF99WH2/0jFy/SMnCRWpdWVFXrsLMt8uvih9+d6FwMXZ/pyW12U2NWBxRSM/cnfYchK/pSQ/CPvNTbz7W7vfb1RqTk1Z8O2C5/MD6b50c4HRhTGW/xPD/zpmVQ/OSVXYxo6Fc9rWWG8ubc7KXgte5LjaoH/Kci9DbtmE/7kgq/JC/aGX3IqcOWHTG2aIAiCIAiCIAiCIAiCIAjiTrwGgx+dQPaFKEIXh6MR9o8g+zoAAP//uJxoHg==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x40)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000), 0x0)
accept4(r1, 0x0, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r2 = getpid()
sched_setscheduler(r2, 0x1, &(0x7f0000000240)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
read$FUSE(r0, &(0x7f0000000940)={0x2020}, 0x2020)

program crashed: KASAN: use-after-free Read in z_erofs_transform_plain
testing program (duration=42.326202387s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4-prlimit64-sched_setscheduler-getpid-sched_setscheduler-read$FUSE
detailed listing:
executing program 0:
syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYRES64=0x0, @ANYBLOB="644a0ce3a7d8a6cecbfc1f5c56d41c137c743ababa2b36ff835b00594da92f6c67dcd82c7f067560f0ae9c45a55703b2f63abe7b95fedddb78ffce323c6f2687610150e9336739"], 0x1, 0x1b4, &(0x7f00000001c0)="$eJzsmLFv2kAUxr+zwchVJbq2SysVCTrU2KatytABdezQSq1adQMVF5GYEIEHYCJ/RebMGTKjLPwfyZBkyhCyZYoUR2ef4xOCIBKCUPJ+w/Nn7vH87gEf0oEgiCfLyfHF0V42o3P9HBmkxOunapyjSPmD9OW7g/r3/W3z/HAw/FYcK6fN+/wEgGFJhSfufd/35SoZcf0FJdJJlOP1P2AwhC5DwW+hHTD8FXpN0k2ebxj/665j/Gu6VS5MHiwebB4K4/2NthiqUn9MWm93e+sV13Va9xdfeduTlmbNb1RS8EXqT/68otmY8fxgQYEldAEMP4X+rCKaTTgSaf+vEnF99WH2/0jFy/SMnCRWpdWVFXrsLMt8uvih9+d6FwMXZ/pyW12U2NWBxRSM/cnfYchK/pSQ/CPvNTbz7W7vfb1RqTk1Z8O2C5/MD6b50c4HRhTGW/xPD/zpmVQ/OSVXYxo6Fc9rWWG8ubc7KXgte5LjaoH/Kci9DbtmE/7kgq/JC/aGX3IqcOWHTG2aIAiCIAiCIAiCIAiCIAjiTrwGgx+dQPaFKEIXh6MR9o8g+zoAAP//uJxoHg==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x40)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000), 0x0)
accept4(r1, 0x0, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r2 = getpid()
sched_setscheduler(r2, 0x1, &(0x7f0000000240)=0x7)
read$FUSE(r0, &(0x7f0000000940)={0x2020}, 0x2020)

program crashed: KASAN: use-after-free Read in z_erofs_transform_plain
testing program (duration=42.326202387s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4-prlimit64-sched_setscheduler-getpid-read$FUSE
detailed listing:
executing program 0:
syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYRES64=0x0, @ANYBLOB="644a0ce3a7d8a6cecbfc1f5c56d41c137c743ababa2b36ff835b00594da92f6c67dcd82c7f067560f0ae9c45a55703b2f63abe7b95fedddb78ffce323c6f2687610150e9336739"], 0x1, 0x1b4, &(0x7f00000001c0)="$eJzsmLFv2kAUxr+zwchVJbq2SysVCTrU2KatytABdezQSq1adQMVF5GYEIEHYCJ/RebMGTKjLPwfyZBkyhCyZYoUR2ef4xOCIBKCUPJ+w/Nn7vH87gEf0oEgiCfLyfHF0V42o3P9HBmkxOunapyjSPmD9OW7g/r3/W3z/HAw/FYcK6fN+/wEgGFJhSfufd/35SoZcf0FJdJJlOP1P2AwhC5DwW+hHTD8FXpN0k2ebxj/665j/Gu6VS5MHiwebB4K4/2NthiqUn9MWm93e+sV13Va9xdfeduTlmbNb1RS8EXqT/68otmY8fxgQYEldAEMP4X+rCKaTTgSaf+vEnF99WH2/0jFy/SMnCRWpdWVFXrsLMt8uvih9+d6FwMXZ/pyW12U2NWBxRSM/cnfYchK/pSQ/CPvNTbz7W7vfb1RqTk1Z8O2C5/MD6b50c4HRhTGW/xPD/zpmVQ/OSVXYxo6Fc9rWWG8ubc7KXgte5LjaoH/Kci9DbtmE/7kgq/JC/aGX3IqcOWHTG2aIAiCIAiCIAiCIAiCIAjiTrwGgx+dQPaFKEIXh6MR9o8g+zoAAP//uJxoHg==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x40)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000), 0x0)
accept4(r1, 0x0, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
getpid()
read$FUSE(r0, &(0x7f0000000940)={0x2020}, 0x2020)

program crashed: KASAN: use-after-free Read in z_erofs_transform_plain
testing program (duration=42.326202387s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4-prlimit64-sched_setscheduler-read$FUSE
detailed listing:
executing program 0:
syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYRES64=0x0, @ANYBLOB="644a0ce3a7d8a6cecbfc1f5c56d41c137c743ababa2b36ff835b00594da92f6c67dcd82c7f067560f0ae9c45a55703b2f63abe7b95fedddb78ffce323c6f2687610150e9336739"], 0x1, 0x1b4, &(0x7f00000001c0)="$eJzsmLFv2kAUxr+zwchVJbq2SysVCTrU2KatytABdezQSq1adQMVF5GYEIEHYCJ/RebMGTKjLPwfyZBkyhCyZYoUR2ef4xOCIBKCUPJ+w/Nn7vH87gEf0oEgiCfLyfHF0V42o3P9HBmkxOunapyjSPmD9OW7g/r3/W3z/HAw/FYcK6fN+/wEgGFJhSfufd/35SoZcf0FJdJJlOP1P2AwhC5DwW+hHTD8FXpN0k2ebxj/665j/Gu6VS5MHiwebB4K4/2NthiqUn9MWm93e+sV13Va9xdfeduTlmbNb1RS8EXqT/68otmY8fxgQYEldAEMP4X+rCKaTTgSaf+vEnF99WH2/0jFy/SMnCRWpdWVFXrsLMt8uvih9+d6FwMXZ/pyW12U2NWBxRSM/cnfYchK/pSQ/CPvNTbz7W7vfb1RqTk1Z8O2C5/MD6b50c4HRhTGW/xPD/zpmVQ/OSVXYxo6Fc9rWWG8ubc7KXgte5LjaoH/Kci9DbtmE/7kgq/JC/aGX3IqcOWHTG2aIAiCIAiCIAiCIAiCIAjiTrwGgx+dQPaFKEIXh6MR9o8g+zoAAP//uJxoHg==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x40)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000), 0x0)
accept4(r1, 0x0, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
read$FUSE(r0, &(0x7f0000000940)={0x2020}, 0x2020)

program crashed: KASAN: slab-out-of-bounds Read in z_erofs_transform_plain
testing program (duration=42.326202387s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4-prlimit64-read$FUSE
detailed listing:
executing program 0:
syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYRES64=0x0, @ANYBLOB="644a0ce3a7d8a6cecbfc1f5c56d41c137c743ababa2b36ff835b00594da92f6c67dcd82c7f067560f0ae9c45a55703b2f63abe7b95fedddb78ffce323c6f2687610150e9336739"], 0x1, 0x1b4, &(0x7f00000001c0)="$eJzsmLFv2kAUxr+zwchVJbq2SysVCTrU2KatytABdezQSq1adQMVF5GYEIEHYCJ/RebMGTKjLPwfyZBkyhCyZYoUR2ef4xOCIBKCUPJ+w/Nn7vH87gEf0oEgiCfLyfHF0V42o3P9HBmkxOunapyjSPmD9OW7g/r3/W3z/HAw/FYcK6fN+/wEgGFJhSfufd/35SoZcf0FJdJJlOP1P2AwhC5DwW+hHTD8FXpN0k2ebxj/665j/Gu6VS5MHiwebB4K4/2NthiqUn9MWm93e+sV13Va9xdfeduTlmbNb1RS8EXqT/68otmY8fxgQYEldAEMP4X+rCKaTTgSaf+vEnF99WH2/0jFy/SMnCRWpdWVFXrsLMt8uvih9+d6FwMXZ/pyW12U2NWBxRSM/cnfYchK/pSQ/CPvNTbz7W7vfb1RqTk1Z8O2C5/MD6b50c4HRhTGW/xPD/zpmVQ/OSVXYxo6Fc9rWWG8ubc7KXgte5LjaoH/Kci9DbtmE/7kgq/JC/aGX3IqcOWHTG2aIAiCIAiCIAiCIAiCIAjiTrwGgx+dQPaFKEIXh6MR9o8g+zoAAP//uJxoHg==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x40)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000), 0x0)
accept4(r1, 0x0, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0)
read$FUSE(r0, &(0x7f0000000940)={0x2020}, 0x2020)

program crashed: KASAN: slab-out-of-bounds Read in z_erofs_transform_plain
testing program (duration=42.326202387s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4-read$FUSE
detailed listing:
executing program 0:
syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYRES64=0x0, @ANYBLOB="644a0ce3a7d8a6cecbfc1f5c56d41c137c743ababa2b36ff835b00594da92f6c67dcd82c7f067560f0ae9c45a55703b2f63abe7b95fedddb78ffce323c6f2687610150e9336739"], 0x1, 0x1b4, &(0x7f00000001c0)="$eJzsmLFv2kAUxr+zwchVJbq2SysVCTrU2KatytABdezQSq1adQMVF5GYEIEHYCJ/RebMGTKjLPwfyZBkyhCyZYoUR2ef4xOCIBKCUPJ+w/Nn7vH87gEf0oEgiCfLyfHF0V42o3P9HBmkxOunapyjSPmD9OW7g/r3/W3z/HAw/FYcK6fN+/wEgGFJhSfufd/35SoZcf0FJdJJlOP1P2AwhC5DwW+hHTD8FXpN0k2ebxj/665j/Gu6VS5MHiwebB4K4/2NthiqUn9MWm93e+sV13Va9xdfeduTlmbNb1RS8EXqT/68otmY8fxgQYEldAEMP4X+rCKaTTgSaf+vEnF99WH2/0jFy/SMnCRWpdWVFXrsLMt8uvih9+d6FwMXZ/pyW12U2NWBxRSM/cnfYchK/pSQ/CPvNTbz7W7vfb1RqTk1Z8O2C5/MD6b50c4HRhTGW/xPD/zpmVQ/OSVXYxo6Fc9rWWG8ubc7KXgte5LjaoH/Kci9DbtmE/7kgq/JC/aGX3IqcOWHTG2aIAiCIAiCIAiCIAiCIAjiTrwGgx+dQPaFKEIXh6MR9o8g+zoAAP//uJxoHg==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x40)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000), 0x0)
accept4(r1, 0x0, 0x0, 0x0)
read$FUSE(r0, &(0x7f0000000940)={0x2020}, 0x2020)

program crashed: KASAN: use-after-free Read in z_erofs_transform_plain
testing program (duration=42.326202387s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-read$FUSE
detailed listing:
executing program 0:
syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYRES64=0x0, @ANYBLOB="644a0ce3a7d8a6cecbfc1f5c56d41c137c743ababa2b36ff835b00594da92f6c67dcd82c7f067560f0ae9c45a55703b2f63abe7b95fedddb78ffce323c6f2687610150e9336739"], 0x1, 0x1b4, &(0x7f00000001c0)="$eJzsmLFv2kAUxr+zwchVJbq2SysVCTrU2KatytABdezQSq1adQMVF5GYEIEHYCJ/RebMGTKjLPwfyZBkyhCyZYoUR2ef4xOCIBKCUPJ+w/Nn7vH87gEf0oEgiCfLyfHF0V42o3P9HBmkxOunapyjSPmD9OW7g/r3/W3z/HAw/FYcK6fN+/wEgGFJhSfufd/35SoZcf0FJdJJlOP1P2AwhC5DwW+hHTD8FXpN0k2ebxj/665j/Gu6VS5MHiwebB4K4/2NthiqUn9MWm93e+sV13Va9xdfeduTlmbNb1RS8EXqT/68otmY8fxgQYEldAEMP4X+rCKaTTgSaf+vEnF99WH2/0jFy/SMnCRWpdWVFXrsLMt8uvih9+d6FwMXZ/pyW12U2NWBxRSM/cnfYchK/pSQ/CPvNTbz7W7vfb1RqTk1Z8O2C5/MD6b50c4HRhTGW/xPD/zpmVQ/OSVXYxo6Fc9rWWG8ubc7KXgte5LjaoH/Kci9DbtmE/7kgq/JC/aGX3IqcOWHTG2aIAiCIAiCIAiCIAiCIAjiTrwGgx+dQPaFKEIXh6MR9o8g+zoAAP//uJxoHg==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x40)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000), 0x0)
read$FUSE(r0, &(0x7f0000000940)={0x2020}, 0x2020)

program crashed: KASAN: use-after-free Read in z_erofs_transform_plain
testing program (duration=42.326202387s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-socket$alg-bind$alg-read$FUSE
detailed listing:
executing program 0:
syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYRES64=0x0, @ANYBLOB="644a0ce3a7d8a6cecbfc1f5c56d41c137c743ababa2b36ff835b00594da92f6c67dcd82c7f067560f0ae9c45a55703b2f63abe7b95fedddb78ffce323c6f2687610150e9336739"], 0x1, 0x1b4, &(0x7f00000001c0)="$eJzsmLFv2kAUxr+zwchVJbq2SysVCTrU2KatytABdezQSq1adQMVF5GYEIEHYCJ/RebMGTKjLPwfyZBkyhCyZYoUR2ef4xOCIBKCUPJ+w/Nn7vH87gEf0oEgiCfLyfHF0V42o3P9HBmkxOunapyjSPmD9OW7g/r3/W3z/HAw/FYcK6fN+/wEgGFJhSfufd/35SoZcf0FJdJJlOP1P2AwhC5DwW+hHTD8FXpN0k2ebxj/665j/Gu6VS5MHiwebB4K4/2NthiqUn9MWm93e+sV13Va9xdfeduTlmbNb1RS8EXqT/68otmY8fxgQYEldAEMP4X+rCKaTTgSaf+vEnF99WH2/0jFy/SMnCRWpdWVFXrsLMt8uvih9+d6FwMXZ/pyW12U2NWBxRSM/cnfYchK/pSQ/CPvNTbz7W7vfb1RqTk1Z8O2C5/MD6b50c4HRhTGW/xPD/zpmVQ/OSVXYxo6Fc9rWWG8ubc7KXgte5LjaoH/Kci9DbtmE/7kgq/JC/aGX3IqcOWHTG2aIAiCIAiCIAiCIAiCIAjiTrwGgx+dQPaFKEIXh6MR9o8g+zoAAP//uJxoHg==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x40)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-generic\x00'}, 0x58)
read$FUSE(r0, &(0x7f0000000940)={0x2020}, 0x2020)

program crashed: KASAN: use-after-free Read in z_erofs_transform_plain
testing program (duration=42.326202387s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-socket$alg-read$FUSE
detailed listing:
executing program 0:
syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYRES64=0x0, @ANYBLOB="644a0ce3a7d8a6cecbfc1f5c56d41c137c743ababa2b36ff835b00594da92f6c67dcd82c7f067560f0ae9c45a55703b2f63abe7b95fedddb78ffce323c6f2687610150e9336739"], 0x1, 0x1b4, &(0x7f00000001c0)="$eJzsmLFv2kAUxr+zwchVJbq2SysVCTrU2KatytABdezQSq1adQMVF5GYEIEHYCJ/RebMGTKjLPwfyZBkyhCyZYoUR2ef4xOCIBKCUPJ+w/Nn7vH87gEf0oEgiCfLyfHF0V42o3P9HBmkxOunapyjSPmD9OW7g/r3/W3z/HAw/FYcK6fN+/wEgGFJhSfufd/35SoZcf0FJdJJlOP1P2AwhC5DwW+hHTD8FXpN0k2ebxj/665j/Gu6VS5MHiwebB4K4/2NthiqUn9MWm93e+sV13Va9xdfeduTlmbNb1RS8EXqT/68otmY8fxgQYEldAEMP4X+rCKaTTgSaf+vEnF99WH2/0jFy/SMnCRWpdWVFXrsLMt8uvih9+d6FwMXZ/pyW12U2NWBxRSM/cnfYchK/pSQ/CPvNTbz7W7vfb1RqTk1Z8O2C5/MD6b50c4HRhTGW/xPD/zpmVQ/OSVXYxo6Fc9rWWG8ubc7KXgte5LjaoH/Kci9DbtmE/7kgq/JC/aGX3IqcOWHTG2aIAiCIAiCIAiCIAiCIAjiTrwGgx+dQPaFKEIXh6MR9o8g+zoAAP//uJxoHg==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x40)
socket$alg(0x26, 0x5, 0x0)
read$FUSE(r0, &(0x7f0000000940)={0x2020}, 0x2020)

program crashed: KASAN: use-after-free Read in z_erofs_transform_plain
testing program (duration=42.326202387s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-read$FUSE
detailed listing:
executing program 0:
syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYRES64=0x0, @ANYBLOB="644a0ce3a7d8a6cecbfc1f5c56d41c137c743ababa2b36ff835b00594da92f6c67dcd82c7f067560f0ae9c45a55703b2f63abe7b95fedddb78ffce323c6f2687610150e9336739"], 0x1, 0x1b4, &(0x7f00000001c0)="$eJzsmLFv2kAUxr+zwchVJbq2SysVCTrU2KatytABdezQSq1adQMVF5GYEIEHYCJ/RebMGTKjLPwfyZBkyhCyZYoUR2ef4xOCIBKCUPJ+w/Nn7vH87gEf0oEgiCfLyfHF0V42o3P9HBmkxOunapyjSPmD9OW7g/r3/W3z/HAw/FYcK6fN+/wEgGFJhSfufd/35SoZcf0FJdJJlOP1P2AwhC5DwW+hHTD8FXpN0k2ebxj/665j/Gu6VS5MHiwebB4K4/2NthiqUn9MWm93e+sV13Va9xdfeduTlmbNb1RS8EXqT/68otmY8fxgQYEldAEMP4X+rCKaTTgSaf+vEnF99WH2/0jFy/SMnCRWpdWVFXrsLMt8uvih9+d6FwMXZ/pyW12U2NWBxRSM/cnfYchK/pSQ/CPvNTbz7W7vfb1RqTk1Z8O2C5/MD6b50c4HRhTGW/xPD/zpmVQ/OSVXYxo6Fc9rWWG8ubc7KXgte5LjaoH/Kci9DbtmE/7kgq/JC/aGX3IqcOWHTG2aIAiCIAiCIAiCIAiCIAjiTrwGgx+dQPaFKEIXh6MR9o8g+zoAAP//uJxoHg==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x40)
read$FUSE(r0, &(0x7f0000000940)={0x2020}, 0x2020)

program crashed: KASAN: use-after-free Read in z_erofs_transform_plain
testing program (duration=42.326202387s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-read$FUSE
detailed listing:
executing program 0:
syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYRES64=0x0, @ANYBLOB="644a0ce3a7d8a6cecbfc1f5c56d41c137c743ababa2b36ff835b00594da92f6c67dcd82c7f067560f0ae9c45a55703b2f63abe7b95fedddb78ffce323c6f2687610150e9336739"], 0x1, 0x1b4, &(0x7f00000001c0)="$eJzsmLFv2kAUxr+zwchVJbq2SysVCTrU2KatytABdezQSq1adQMVF5GYEIEHYCJ/RebMGTKjLPwfyZBkyhCyZYoUR2ef4xOCIBKCUPJ+w/Nn7vH87gEf0oEgiCfLyfHF0V42o3P9HBmkxOunapyjSPmD9OW7g/r3/W3z/HAw/FYcK6fN+/wEgGFJhSfufd/35SoZcf0FJdJJlOP1P2AwhC5DwW+hHTD8FXpN0k2ebxj/665j/Gu6VS5MHiwebB4K4/2NthiqUn9MWm93e+sV13Va9xdfeduTlmbNb1RS8EXqT/68otmY8fxgQYEldAEMP4X+rCKaTTgSaf+vEnF99WH2/0jFy/SMnCRWpdWVFXrsLMt8uvih9+d6FwMXZ/pyW12U2NWBxRSM/cnfYchK/pSQ/CPvNTbz7W7vfb1RqTk1Z8O2C5/MD6b50c4HRhTGW/xPD/zpmVQ/OSVXYxo6Fc9rWWG8ubc7KXgte5LjaoH/Kci9DbtmE/7kgq/JC/aGX3IqcOWHTG2aIAiCIAiCIAiCIAiCIAjiTrwGgx+dQPaFKEIXh6MR9o8g+zoAAP//uJxoHg==")
read$FUSE(0xffffffffffffffff, &(0x7f0000000940)={0x2020}, 0x2020)

program did not crash
testing program (duration=42.326202387s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-read$FUSE
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x40)
read$FUSE(r0, &(0x7f0000000940)={0x2020}, 0x2020)

program did not crash
testing program (duration=42.326202387s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-read$FUSE
detailed listing:
executing program 0:
syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYRES64=0x0, @ANYBLOB="644a0ce3a7d8a6cecbfc1f5c56d41c137c743ababa2b36ff835b00594da92f6c67dcd82c7f067560f0ae9c45a55703b2f63abe7b95fedddb78ffce323c6f2687610150e9336739"], 0x1, 0x1b4, &(0x7f00000001c0)="$eJzsmLFv2kAUxr+zwchVJbq2SysVCTrU2KatytABdezQSq1adQMVF5GYEIEHYCJ/RebMGTKjLPwfyZBkyhCyZYoUR2ef4xOCIBKCUPJ+w/Nn7vH87gEf0oEgiCfLyfHF0V42o3P9HBmkxOunapyjSPmD9OW7g/r3/W3z/HAw/FYcK6fN+/wEgGFJhSfufd/35SoZcf0FJdJJlOP1P2AwhC5DwW+hHTD8FXpN0k2ebxj/665j/Gu6VS5MHiwebB4K4/2NthiqUn9MWm93e+sV13Va9xdfeduTlmbNb1RS8EXqT/68otmY8fxgQYEldAEMP4X+rCKaTTgSaf+vEnF99WH2/0jFy/SMnCRWpdWVFXrsLMt8uvih9+d6FwMXZ/pyW12U2NWBxRSM/cnfYchK/pSQ/CPvNTbz7W7vfb1RqTk1Z8O2C5/MD6b50c4HRhTGW/xPD/zpmVQ/OSVXYxo6Fc9rWWG8ubc7KXgte5LjaoH/Kci9DbtmE/7kgq/JC/aGX3IqcOWHTG2aIAiCIAiCIAiCIAiCIAjiTrwGgx+dQPaFKEIXh6MR9o8g+zoAAP//uJxoHg==")
r0 = openat(0xffffffffffffff9c, 0x0, 0x80000, 0x40)
read$FUSE(r0, &(0x7f0000000940)={0x2020}, 0x2020)

program did not crash
testing program (duration=42.326202387s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-read$FUSE
detailed listing:
executing program 0:
syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYRES64=0x0, @ANYBLOB="644a0ce3a7d8a6cecbfc1f5c56d41c137c743ababa2b36ff835b00594da92f6c67dcd82c7f067560f0ae9c45a55703b2f63abe7b95fedddb78ffce323c6f2687610150e9336739"], 0x1, 0x1b4, &(0x7f00000001c0)="$eJzsmLFv2kAUxr+zwchVJbq2SysVCTrU2KatytABdezQSq1adQMVF5GYEIEHYCJ/RebMGTKjLPwfyZBkyhCyZYoUR2ef4xOCIBKCUPJ+w/Nn7vH87gEf0oEgiCfLyfHF0V42o3P9HBmkxOunapyjSPmD9OW7g/r3/W3z/HAw/FYcK6fN+/wEgGFJhSfufd/35SoZcf0FJdJJlOP1P2AwhC5DwW+hHTD8FXpN0k2ebxj/665j/Gu6VS5MHiwebB4K4/2NthiqUn9MWm93e+sV13Va9xdfeduTlmbNb1RS8EXqT/68otmY8fxgQYEldAEMP4X+rCKaTTgSaf+vEnF99WH2/0jFy/SMnCRWpdWVFXrsLMt8uvih9+d6FwMXZ/pyW12U2NWBxRSM/cnfYchK/pSQ/CPvNTbz7W7vfb1RqTk1Z8O2C5/MD6b50c4HRhTGW/xPD/zpmVQ/OSVXYxo6Fc9rWWG8ubc7KXgte5LjaoH/Kci9DbtmE/7kgq/JC/aGX3IqcOWHTG2aIAiCIAiCIAiCIAiCIAjiTrwGgx+dQPaFKEIXh6MR9o8g+zoAAP//uJxoHg==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x40)
read$FUSE(r0, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=42.326202387s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-read$FUSE
program crashed: KASAN: use-after-free Read in z_erofs_transform_plain
simplifying C reproducer
testing compiled C program (duration=42.326202387s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-read$FUSE
program crashed: KASAN: slab-out-of-bounds Read in z_erofs_transform_plain
testing compiled C program (duration=42.326202387s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-read$FUSE
program did not crash
testing compiled C program (duration=42.326202387s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-read$FUSE
program crashed: KASAN: use-after-free Read in z_erofs_transform_plain
testing compiled C program (duration=42.326202387s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-read$FUSE
program crashed: KASAN: use-after-free Read in z_erofs_transform_plain
testing compiled C program (duration=42.326202387s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-read$FUSE
program crashed: KASAN: use-after-free Read in z_erofs_transform_plain
testing compiled C program (duration=42.326202387s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-read$FUSE
program crashed: KASAN: use-after-free Read in z_erofs_transform_plain
testing compiled C program (duration=42.326202387s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-read$FUSE
program crashed: KASAN: use-after-free Read in z_erofs_transform_plain
testing compiled C program (duration=42.326202387s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-read$FUSE
program did not crash
testing program (duration=42.326202387s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-read$FUSE
detailed listing:
executing program 0:
syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYRES64=0x0, @ANYBLOB="644a0ce3a7d8a6cecbfc1f5c56d41c137c743ababa2b36ff835b00594da92f6c67dcd82c7f067560f0ae9c45a55703b2f63abe7b95fedddb78ffce323c6f2687610150e9336739"], 0x1, 0x1b4, &(0x7f00000001c0)="$eJzsmLFv2kAUxr+zwchVJbq2SysVCTrU2KatytABdezQSq1adQMVF5GYEIEHYCJ/RebMGTKjLPwfyZBkyhCyZYoUR2ef4xOCIBKCUPJ+w/Nn7vH87gEf0oEgiCfLyfHF0V42o3P9HBmkxOunapyjSPmD9OW7g/r3/W3z/HAw/FYcK6fN+/wEgGFJhSfufd/35SoZcf0FJdJJlOP1P2AwhC5DwW+hHTD8FXpN0k2ebxj/665j/Gu6VS5MHiwebB4K4/2NthiqUn9MWm93e+sV13Va9xdfeduTlmbNb1RS8EXqT/68otmY8fxgQYEldAEMP4X+rCKaTTgSaf+vEnF99WH2/0jFy/SMnCRWpdWVFXrsLMt8uvih9+d6FwMXZ/pyW12U2NWBxRSM/cnfYchK/pSQ/CPvNTbz7W7vfb1RqTk1Z8O2C5/MD6b50c4HRhTGW/xPD/zpmVQ/OSVXYxo6Fc9rWWG8ubc7KXgte5LjaoH/Kci9DbtmE/7kgq/JC/aGX3IqcOWHTG2aIAiCIAiCIAiCIAiCIAjiTrwGgx+dQPaFKEIXh6MR9o8g+zoAAP//uJxoHg==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x40)
read$FUSE(r0, &(0x7f0000000940)={0x2020}, 0x2020)

program crashed: KASAN: use-after-free Read in z_erofs_transform_plain
validation run: crashed=true
testing program (duration=42.326202387s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-read$FUSE
detailed listing:
executing program 0:
syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYRES64=0x0, @ANYBLOB="644a0ce3a7d8a6cecbfc1f5c56d41c137c743ababa2b36ff835b00594da92f6c67dcd82c7f067560f0ae9c45a55703b2f63abe7b95fedddb78ffce323c6f2687610150e9336739"], 0x1, 0x1b4, &(0x7f00000001c0)="$eJzsmLFv2kAUxr+zwchVJbq2SysVCTrU2KatytABdezQSq1adQMVF5GYEIEHYCJ/RebMGTKjLPwfyZBkyhCyZYoUR2ef4xOCIBKCUPJ+w/Nn7vH87gEf0oEgiCfLyfHF0V42o3P9HBmkxOunapyjSPmD9OW7g/r3/W3z/HAw/FYcK6fN+/wEgGFJhSfufd/35SoZcf0FJdJJlOP1P2AwhC5DwW+hHTD8FXpN0k2ebxj/665j/Gu6VS5MHiwebB4K4/2NthiqUn9MWm93e+sV13Va9xdfeduTlmbNb1RS8EXqT/68otmY8fxgQYEldAEMP4X+rCKaTTgSaf+vEnF99WH2/0jFy/SMnCRWpdWVFXrsLMt8uvih9+d6FwMXZ/pyW12U2NWBxRSM/cnfYchK/pSQ/CPvNTbz7W7vfb1RqTk1Z8O2C5/MD6b50c4HRhTGW/xPD/zpmVQ/OSVXYxo6Fc9rWWG8ubc7KXgte5LjaoH/Kci9DbtmE/7kgq/JC/aGX3IqcOWHTG2aIAiCIAiCIAiCIAiCIAjiTrwGgx+dQPaFKEIXh6MR9o8g+zoAAP//uJxoHg==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x40)
read$FUSE(r0, &(0x7f0000000940)={0x2020}, 0x2020)

program crashed: KASAN: use-after-free Read in z_erofs_transform_plain
validation run: crashed=true
testing program (duration=42.326202387s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-openat-read$FUSE
detailed listing:
executing program 0:
syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYRES64=0x0, @ANYBLOB="644a0ce3a7d8a6cecbfc1f5c56d41c137c743ababa2b36ff835b00594da92f6c67dcd82c7f067560f0ae9c45a55703b2f63abe7b95fedddb78ffce323c6f2687610150e9336739"], 0x1, 0x1b4, &(0x7f00000001c0)="$eJzsmLFv2kAUxr+zwchVJbq2SysVCTrU2KatytABdezQSq1adQMVF5GYEIEHYCJ/RebMGTKjLPwfyZBkyhCyZYoUR2ef4xOCIBKCUPJ+w/Nn7vH87gEf0oEgiCfLyfHF0V42o3P9HBmkxOunapyjSPmD9OW7g/r3/W3z/HAw/FYcK6fN+/wEgGFJhSfufd/35SoZcf0FJdJJlOP1P2AwhC5DwW+hHTD8FXpN0k2ebxj/665j/Gu6VS5MHiwebB4K4/2NthiqUn9MWm93e+sV13Va9xdfeduTlmbNb1RS8EXqT/68otmY8fxgQYEldAEMP4X+rCKaTTgSaf+vEnF99WH2/0jFy/SMnCRWpdWVFXrsLMt8uvih9+d6FwMXZ/pyW12U2NWBxRSM/cnfYchK/pSQ/CPvNTbz7W7vfb1RqTk1Z8O2C5/MD6b50c4HRhTGW/xPD/zpmVQ/OSVXYxo6Fc9rWWG8ubc7KXgte5LjaoH/Kci9DbtmE/7kgq/JC/aGX3IqcOWHTG2aIAiCIAiCIAiCIAiCIAjiTrwGgx+dQPaFKEIXh6MR9o8g+zoAAP//uJxoHg==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x40)
read$FUSE(r0, &(0x7f0000000940)={0x2020}, 0x2020)

program crashed: KASAN: slab-out-of-bounds Read in z_erofs_transform_plain
validation run: crashed=true
reproducing took 42m23.440307441s
repro crashed as (corrupted=false):
erofs: (device loop0): z_erofs_readahead: readahead error at page 3 @ nid 89
syz.0.17: attempt to access beyond end of device
loop0: rw=524288, sector=34359738360, nr_sectors = 8 limit=16
syz.0.17: attempt to access beyond end of device
loop0: rw=524288, sector=8, nr_sectors = 16 limit=16
==================================================================
BUG: KASAN: slab-out-of-bounds in memcpy_to_page include/linux/highmem.h:403 [inline]
BUG: KASAN: slab-out-of-bounds in z_erofs_transform_plain+0x39c/0x494 fs/erofs/decompressor.c:347
Read of size 4096 at addr ffff0000dc0c8000 by task syz.0.17/4507

CPU: 0 PID: 4507 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 print_address_description+0x88/0x218 mm/kasan/report.c:316
 print_report+0x50/0x68 mm/kasan/report.c:420
 kasan_report+0xa8/0xfc mm/kasan/report.c:524
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x258/0x290 mm/kasan/generic.c:189
 memcpy+0x48/0x90 mm/kasan/shadow.c:65
 memcpy_to_page include/linux/highmem.h:403 [inline]
 z_erofs_transform_plain+0x39c/0x494 fs/erofs/decompressor.c:347
 z_erofs_decompress+0x9c/0xd4 fs/erofs/decompressor.c:435
 z_erofs_decompress_pcluster fs/erofs/zdata.c:1159 [inline]
 z_erofs_decompress_queue+0x103c/0x1bf4 fs/erofs/zdata.c:1240
 z_erofs_runqueue+0x1508/0x16a8 fs/erofs/zdata.c:1603
 z_erofs_read_folio+0x2dc/0x5cc fs/erofs/zdata.c:1693
 filemap_read_folio+0x134/0x384 mm/filemap.c:2490
 filemap_update_page mm/filemap.c:2575 [inline]
 filemap_get_pages mm/filemap.c:2689 [inline]
 filemap_read+0x1290/0x20dc mm/filemap.c:2759
 generic_file_read_iter+0xf8/0x5ac mm/filemap.c:2941
 call_read_iter include/linux/fs.h:2259 [inline]
 new_sync_read fs/read_write.c:389 [inline]
 vfs_read+0x3cc/0x7b8 fs/read_write.c:470
 ksys_read+0x12c/0x228 fs/read_write.c:613
 __do_sys_read fs/read_write.c:623 [inline]
 __se_sys_read fs/read_write.c:621 [inline]
 __arm64_sys_read+0x7c/0x90 fs/read_write.c:621
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Allocated by task 4431:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4c/0x80 mm/kasan/common.c:53
 kasan_save_alloc_info+0x24/0x30 mm/kasan/generic.c:505
 ____kasan_kmalloc mm/kasan/common.c:375 [inline]
 __kasan_kmalloc+0xa0/0xb8 mm/kasan/common.c:384
 kasan_kmalloc include/linux/kasan.h:211 [inline]
 kmalloc_trace+0x7c/0x94 mm/slab_common.c:1031
 kmalloc include/linux/slab.h:563 [inline]
 __hw_addr_create net/core/dev_addr_lists.c:60 [inline]
 __hw_addr_add_ex+0x1cc/0x5b0 net/core/dev_addr_lists.c:118
 __dev_mc_add net/core/dev_addr_lists.c:867 [inline]
 dev_mc_add+0x8c/0xf8 net/core/dev_addr_lists.c:885
 ip_mc_filter_add net/ipv4/igmp.c:1155 [inline]
 igmp_group_added+0x18c/0x75c net/ipv4/igmp.c:1344
 ____ip_mc_inc_group+0x828/0xa50 net/ipv4/igmp.c:1478
 __ip_mc_inc_group net/ipv4/igmp.c:1487 [inline]
 ip_mc_inc_group net/ipv4/igmp.c:1493 [inline]
 ip_mc_up+0x118/0x31c net/ipv4/igmp.c:1792
 inetdev_event+0xbe4/0x12dc net/ipv4/devinet.c:1590
 notifier_call_chain kernel/notifier.c:87 [inline]
 raw_notifier_call_chain+0xd8/0x168 kernel/notifier.c:455
 call_netdevice_notifiers_info net/core/dev.c:2014 [inline]
 call_netdevice_notifiers_extack net/core/dev.c:2052 [inline]
 call_netdevice_notifiers net/core/dev.c:2066 [inline]
 __dev_notify_flags+0x260/0x490 net/core/dev.c:8715
 dev_change_flags+0xd0/0x15c net/core/dev.c:8753
 do_setlink+0x9d0/0x2158 net/core/rtnetlink.c:2845
 __rtnl_newlink net/core/rtnetlink.c:3622 [inline]
 rtnl_newlink+0x142c/0x1af0 net/core/rtnetlink.c:3669
 rtnetlink_rcv_msg+0x694/0xcc4 net/core/rtnetlink.c:6166
 netlink_rcv_skb+0x220/0x3ec net/netlink/af_netlink.c:2516
 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6184
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x5fc/0x80c net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x6f0/0x9d8 net/netlink/af_netlink.c:1877
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:730 [inline]
 __sys_sendto+0x324/0x440 net/socket.c:2153
 __do_sys_sendto net/socket.c:2165 [inline]
 __se_sys_sendto net/socket.c:2161 [inline]
 __arm64_sys_sendto+0xe4/0x104 net/socket.c:2161
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

The buggy address belongs to the object at ffff0000dc0c8000
 which belongs to the cache kmalloc-128 of size 128
The buggy address is located 0 bytes inside of
 128-byte region [ffff0000dc0c8000, ffff0000dc0c8080)

The buggy address belongs to the physical page:
page:00000000ff3d2a5c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11c0c8
flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000200 0000000000000000 dead000000000122 ffff0000c0002300
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000dc0c7f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff0000dc0c7f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff0000dc0c8000: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
                                                          ^
 ffff0000dc0c8080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff0000dc0c8100: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
syz.0.17: attempt to access beyond end of device
loop0: rw=0, sector=34359738360, nr_sectors = 8 limit=16

final repro crashed as (corrupted=false):
erofs: (device loop0): z_erofs_readahead: readahead error at page 3 @ nid 89
syz.0.17: attempt to access beyond end of device
loop0: rw=524288, sector=34359738360, nr_sectors = 8 limit=16
syz.0.17: attempt to access beyond end of device
loop0: rw=524288, sector=8, nr_sectors = 16 limit=16
==================================================================
BUG: KASAN: slab-out-of-bounds in memcpy_to_page include/linux/highmem.h:403 [inline]
BUG: KASAN: slab-out-of-bounds in z_erofs_transform_plain+0x39c/0x494 fs/erofs/decompressor.c:347
Read of size 4096 at addr ffff0000dc0c8000 by task syz.0.17/4507

CPU: 0 PID: 4507 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 print_address_description+0x88/0x218 mm/kasan/report.c:316
 print_report+0x50/0x68 mm/kasan/report.c:420
 kasan_report+0xa8/0xfc mm/kasan/report.c:524
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x258/0x290 mm/kasan/generic.c:189
 memcpy+0x48/0x90 mm/kasan/shadow.c:65
 memcpy_to_page include/linux/highmem.h:403 [inline]
 z_erofs_transform_plain+0x39c/0x494 fs/erofs/decompressor.c:347
 z_erofs_decompress+0x9c/0xd4 fs/erofs/decompressor.c:435
 z_erofs_decompress_pcluster fs/erofs/zdata.c:1159 [inline]
 z_erofs_decompress_queue+0x103c/0x1bf4 fs/erofs/zdata.c:1240
 z_erofs_runqueue+0x1508/0x16a8 fs/erofs/zdata.c:1603
 z_erofs_read_folio+0x2dc/0x5cc fs/erofs/zdata.c:1693
 filemap_read_folio+0x134/0x384 mm/filemap.c:2490
 filemap_update_page mm/filemap.c:2575 [inline]
 filemap_get_pages mm/filemap.c:2689 [inline]
 filemap_read+0x1290/0x20dc mm/filemap.c:2759
 generic_file_read_iter+0xf8/0x5ac mm/filemap.c:2941
 call_read_iter include/linux/fs.h:2259 [inline]
 new_sync_read fs/read_write.c:389 [inline]
 vfs_read+0x3cc/0x7b8 fs/read_write.c:470
 ksys_read+0x12c/0x228 fs/read_write.c:613
 __do_sys_read fs/read_write.c:623 [inline]
 __se_sys_read fs/read_write.c:621 [inline]
 __arm64_sys_read+0x7c/0x90 fs/read_write.c:621
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Allocated by task 4431:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4c/0x80 mm/kasan/common.c:53
 kasan_save_alloc_info+0x24/0x30 mm/kasan/generic.c:505
 ____kasan_kmalloc mm/kasan/common.c:375 [inline]
 __kasan_kmalloc+0xa0/0xb8 mm/kasan/common.c:384
 kasan_kmalloc include/linux/kasan.h:211 [inline]
 kmalloc_trace+0x7c/0x94 mm/slab_common.c:1031
 kmalloc include/linux/slab.h:563 [inline]
 __hw_addr_create net/core/dev_addr_lists.c:60 [inline]
 __hw_addr_add_ex+0x1cc/0x5b0 net/core/dev_addr_lists.c:118
 __dev_mc_add net/core/dev_addr_lists.c:867 [inline]
 dev_mc_add+0x8c/0xf8 net/core/dev_addr_lists.c:885
 ip_mc_filter_add net/ipv4/igmp.c:1155 [inline]
 igmp_group_added+0x18c/0x75c net/ipv4/igmp.c:1344
 ____ip_mc_inc_group+0x828/0xa50 net/ipv4/igmp.c:1478
 __ip_mc_inc_group net/ipv4/igmp.c:1487 [inline]
 ip_mc_inc_group net/ipv4/igmp.c:1493 [inline]
 ip_mc_up+0x118/0x31c net/ipv4/igmp.c:1792
 inetdev_event+0xbe4/0x12dc net/ipv4/devinet.c:1590
 notifier_call_chain kernel/notifier.c:87 [inline]
 raw_notifier_call_chain+0xd8/0x168 kernel/notifier.c:455
 call_netdevice_notifiers_info net/core/dev.c:2014 [inline]
 call_netdevice_notifiers_extack net/core/dev.c:2052 [inline]
 call_netdevice_notifiers net/core/dev.c:2066 [inline]
 __dev_notify_flags+0x260/0x490 net/core/dev.c:8715
 dev_change_flags+0xd0/0x15c net/core/dev.c:8753
 do_setlink+0x9d0/0x2158 net/core/rtnetlink.c:2845
 __rtnl_newlink net/core/rtnetlink.c:3622 [inline]
 rtnl_newlink+0x142c/0x1af0 net/core/rtnetlink.c:3669
 rtnetlink_rcv_msg+0x694/0xcc4 net/core/rtnetlink.c:6166
 netlink_rcv_skb+0x220/0x3ec net/netlink/af_netlink.c:2516
 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6184
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x5fc/0x80c net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x6f0/0x9d8 net/netlink/af_netlink.c:1877
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:730 [inline]
 __sys_sendto+0x324/0x440 net/socket.c:2153
 __do_sys_sendto net/socket.c:2165 [inline]
 __se_sys_sendto net/socket.c:2161 [inline]
 __arm64_sys_sendto+0xe4/0x104 net/socket.c:2161
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

The buggy address belongs to the object at ffff0000dc0c8000
 which belongs to the cache kmalloc-128 of size 128
The buggy address is located 0 bytes inside of
 128-byte region [ffff0000dc0c8000, ffff0000dc0c8080)

The buggy address belongs to the physical page:
page:00000000ff3d2a5c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11c0c8
flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000200 0000000000000000 dead000000000122 ffff0000c0002300
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000dc0c7f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff0000dc0c7f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff0000dc0c8000: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
                                                          ^
 ffff0000dc0c8080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff0000dc0c8100: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
syz.0.17: attempt to access beyond end of device
loop0: rw=0, sector=34359738360, nr_sectors = 8 limit=16