------------[ cut here ]------------ WARNING: CPU: 0 PID: 4327 at fs/udf/udfdecl.h:127 udf_updated_lvid fs/udf/udfdecl.h:125 [inline] WARNING: CPU: 0 PID: 4327 at fs/udf/udfdecl.h:127 udf_add_free_space fs/udf/balloc.c:137 [inline] WARNING: CPU: 0 PID: 4327 at fs/udf/udfdecl.h:127 udf_table_free_blocks fs/udf/balloc.c:397 [inline] WARNING: CPU: 0 PID: 4327 at fs/udf/udfdecl.h:127 udf_free_blocks+0x113c/0x13c0 fs/udf/balloc.c:686 Modules linked in: CPU: 0 PID: 4327 Comm: syz-executor Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : udf_updated_lvid fs/udf/udfdecl.h:125 [inline] pc : udf_add_free_space fs/udf/balloc.c:137 [inline] pc : udf_table_free_blocks fs/udf/balloc.c:397 [inline] pc : udf_free_blocks+0x113c/0x13c0 fs/udf/balloc.c:686 lr : udf_updated_lvid fs/udf/udfdecl.h:125 [inline] lr : udf_add_free_space fs/udf/balloc.c:137 [inline] lr : udf_table_free_blocks fs/udf/balloc.c:397 [inline] lr : udf_free_blocks+0x113c/0x13c0 fs/udf/balloc.c:686 sp : ffff8000209573c0 x29: ffff800020957580 x28: ffff70000412ae90 x27: ffff800020957480 x26: ffff8000209577c0 x25: 0000000000000000 x24: dfff800000000000 x23: 1ffff0000412aef8 x22: 0000000000000003 x21: 0000000000000005 x20: ffff0000f930e01f x19: 00000000ee4e9e88 x18: 0000000000000000 x17: ffff800018381000 x16: ffff800011a529a8 x15: ffff800017e62000 x14: 0000000000000001 x13: 1ffff0000412ae28 x12: 0000000000ff0100 x11: ff0080000982b7a0 x10: 0000000000000000 x9 : ffff80000982b7a0 x8 : ffff0000da033800 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000020 x4 : 0000000000000000 x3 : ffff8000082d1134 x2 : ffff0000da033800 x1 : 00000000ee4e9e88 x0 : 0000000000000000 Call trace: udf_updated_lvid fs/udf/udfdecl.h:125 [inline] udf_add_free_space fs/udf/balloc.c:137 [inline] udf_table_free_blocks fs/udf/balloc.c:397 [inline] udf_free_blocks+0x113c/0x13c0 fs/udf/balloc.c:686 extent_trunc+0x2fc/0x3f4 fs/udf/truncate.c:56 udf_truncate_extents+0x2b4/0xbb0 fs/udf/truncate.c:213 udf_setsize+0xaec/0xda8 fs/udf/inode.c:1174 udf_evict_inode+0x80/0x388 fs/udf/inode.c:145 evict+0x3e0/0x828 fs/inode.c:705 iput_final fs/inode.c:1834 [inline] iput+0x754/0x7e4 fs/inode.c:1860 do_unlinkat+0x36c/0x500 fs/namei.c:4405 __do_sys_unlinkat fs/namei.c:4441 [inline] __se_sys_unlinkat fs/namei.c:4434 [inline] __arm64_sys_unlinkat+0xe0/0xfc fs/namei.c:4434 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x130 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 irq event stamp: 471184 hardirqs last enabled at (471183): [] kasan_quarantine_put+0xc4/0x200 mm/kasan/quarantine.c:242 hardirqs last disabled at (471184): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405 softirqs last enabled at (471010): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32 softirqs last disabled at (471008): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 ---[ end trace 0000000000000000 ]--- ================================================================== BUG: KASAN: use-after-free in le32_add_cpu include/linux/byteorder/generic.h:151 [inline] BUG: KASAN: use-after-free in udf_free_inode+0x214/0x284 fs/udf/ialloc.c:-1 Read of size 4 at addr ffff000191e78ca0 by task syz-executor/4327 CPU: 0 PID: 4327 Comm: syz-executor Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 Call trace: dump_backtrace+0x1c0/0x1ec arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106 print_address_description+0x88/0x218 mm/kasan/report.c:316 print_report+0x50/0x68 mm/kasan/report.c:420 kasan_report+0xa8/0xfc mm/kasan/report.c:524 __asan_report_load4_noabort+0x2c/0x38 mm/kasan/report_generic.c:350 le32_add_cpu include/linux/byteorder/generic.h:151 [inline] udf_free_inode+0x214/0x284 fs/udf/ialloc.c:-1 udf_evict_inode+0x2dc/0x388 fs/udf/inode.c:164 evict+0x3e0/0x828 fs/inode.c:705 iput_final fs/inode.c:1834 [inline] iput+0x754/0x7e4 fs/inode.c:1860 do_unlinkat+0x36c/0x500 fs/namei.c:4405 __do_sys_unlinkat fs/namei.c:4441 [inline] __se_sys_unlinkat fs/namei.c:4434 [inline] __arm64_sys_unlinkat+0xe0/0xfc fs/namei.c:4434 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x130 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 The buggy address belongs to the physical page: page:000000000f605b2b refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1d1e78 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 fffffc0006479e08 fffffc0006479e08 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff000191e78b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff000191e78c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff000191e78c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff000191e78d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff000191e78d80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== ------------[ cut here ]------------ WARNING: CPU: 1 PID: 4327 at fs/udf/udfdecl.h:127 udf_updated_lvid fs/udf/udfdecl.h:125 [inline] WARNING: CPU: 1 PID: 4327 at fs/udf/udfdecl.h:127 udf_free_inode+0x1d0/0x284 fs/udf/ialloc.c:41 Modules linked in: CPU: 1 PID: 4327 Comm: syz-executor Tainted: G B W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : udf_updated_lvid fs/udf/udfdecl.h:125 [inline] pc : udf_free_inode+0x1d0/0x284 fs/udf/ialloc.c:41 lr : udf_updated_lvid fs/udf/udfdecl.h:125 [inline] lr : udf_free_inode+0x1d0/0x284 fs/udf/ialloc.c:41 sp : ffff8000209579d0 x29: ffff8000209579e0 x28: ffff70000412af58 x27: dfff800000000000 x26: 1fffe0001f1404cf x25: ffff0000ca190c00 x24: dfff800000000000 x23: 0000000000008000 x22: 00000000ee4e9e88 x21: ffff0000f8a02678 x20: ffff0000f8a02000 x19: ffff0000e1fd0e28 x18: ffff800011babf60 x17: 1fffe00033ea397e x16: ffff800011a529a8 x15: 0000000040000000 x14: 0000000000000001 x13: 1ffff00002fc696c x12: 0000000000ff0100 x11: ff00800009830bf8 x10: 0000000000000000 x9 : ffff800009830bf8 x8 : ffff0000da033800 x7 : 0000000000000004 x6 : ffff800008258510 x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800008194608 x2 : 0000000000000001 x1 : 00000000ee4e9e88 x0 : 0000000000000000 Call trace: udf_updated_lvid fs/udf/udfdecl.h:125 [inline] udf_free_inode+0x1d0/0x284 fs/udf/ialloc.c:41 udf_evict_inode+0x2dc/0x388 fs/udf/inode.c:164 evict+0x3e0/0x828 fs/inode.c:705 iput_final fs/inode.c:1834 [inline] iput+0x754/0x7e4 fs/inode.c:1860 do_unlinkat+0x36c/0x500 fs/namei.c:4405 __do_sys_unlinkat fs/namei.c:4441 [inline] __se_sys_unlinkat fs/namei.c:4434 [inline] __arm64_sys_unlinkat+0xe0/0xfc fs/namei.c:4434 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x130 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 irq event stamp: 471677 hardirqs last enabled at (471677): [] raw_spin_rq_unlock_irq kernel/sched/sched.h:1374 [inline] hardirqs last enabled at (471677): [] finish_lock_switch+0xb0/0x1c4 kernel/sched/core.c:5004 hardirqs last disabled at (471676): [] __schedule+0x298/0x1b0c kernel/sched/core.c:6460 softirqs last enabled at (471420): [] softirq_handle_end kernel/softirq.c:439 [inline] softirqs last enabled at (471420): [] handle_softirqs+0xaec/0xc60 kernel/softirq.c:624 softirqs last disabled at (471187): [] __do_softirq+0x14/0x20 kernel/softirq.c:630 ---[ end trace 0000000000000000 ]--- UDF-fs: error (device loop1): udf_read_inode: (ino 1317) failed !bh UDF-fs: error (device loop1): udf_read_inode: (ino 1317) failed !bh