[v6.1] WARNING in udf_process_sequence

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 0bc96de781b4 Linux 6.1.148
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=146f1234580000
kernel config: https://syzkaller.appspot.com/x/.config?x=483f799cd9933afc
dashboard link: https://syzkaller.appspot.com/bug?extid=a66f771803158bb11e66
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/cd15350f801a/disk-0bc96de7.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/789a5d74139d/vmlinux-0bc96de7.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a1ef0a7e815a/Image-0bc96de7.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a66f77...@syzkaller.appspotmail.com

UDF-fs: error (device loop2): udf_read_tagged: tag checksum failed, block 98: 0x1f != 0x1e
UDF-fs: warning (device loop2): udf_verify_domain_identifier: Not OSTA UDF compliant logical volume descriptor.
------------[ cut here ]------------
WARNING: CPU: 1 PID: 4486 at mm/page_alloc.c:5590 __alloc_pages+0xd0/0x53c mm/page_alloc.c:5590
Modules linked in:
CPU: 1 PID: 4486 Comm: syz.2.11 Not tainted 6.1.148-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
pstate: 22400005 (nzCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : __alloc_pages+0xd0/0x53c mm/page_alloc.c:5590
lr : __alloc_pages+0xac/0x53c mm/page_alloc.c:5584
sp : ffff800020e47120
x29: ffff800020e471f0 x28: ffff7000041c8e7c x27: ffff800020e47140
x26: ffff800020e47980 x25: dfff800000000000 x24: ffff7000041c8e28
x23: ffff0000f5aad3a0 x22: 0000000000000000 x21: 0000000000040dc0
x20: 0000000000000000 x19: 0000000000000013 x18: 00000000000000ff
x17: 6f4e203a72656966 x16: ffff8000082d2370 x15: 0000000000000002
x14: 00000000ffffffff x13: 0000000000000001 x12: 0000000000000005
x11: 1ffff000041c8e2c x10: 0000000000000000 x9 : 0000000000000001
x8 : ffff800017a78000 x7 : 0000000000000000 x6 : 0000000000000001
x5 : ffff800020e46c58 x4 : 0000000000000000 x3 : 0000000000000020
x2 : 0000000000000008 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
__alloc_pages+0xd0/0x53c mm/page_alloc.c:5590
__alloc_pages_node include/linux/gfp.h:237 [inline]
alloc_pages_node include/linux/gfp.h:260 [inline]
__kmalloc_large_node+0xa8/0x1e0 mm/slab_common.c:1077
__do_kmalloc_node mm/slab_common.c:924 [inline]
__kmalloc+0x140/0x178 mm/slab_common.c:949
kmalloc_array include/linux/slab.h:615 [inline]
kcalloc include/linux/slab.h:646 [inline]
udf_sb_alloc_partition_maps fs/udf/super.c:260 [inline]
udf_load_logicalvol fs/udf/super.c:1434 [inline]
udf_process_sequence+0x1774/0x3a94 fs/udf/super.c:1790
udf_load_sequence fs/udf/super.c:1837 [inline]
udf_check_anchor_block+0x2c4/0x56c fs/udf/super.c:1876
udf_scan_anchors+0x124/0x4dc fs/udf/super.c:1909
udf_find_anchor fs/udf/super.c:1965 [inline]
udf_load_vrs+0x158/0x9f4 fs/udf/super.c:2030
udf_fill_super+0x538/0x13c8 fs/udf/super.c:2208
mount_bdev+0x264/0x358 fs/super.c:1443
udf_mount+0x44/0x58 fs/udf/super.c:129
legacy_get_tree+0xd4/0x16c fs/fs_context.c:632
vfs_get_tree+0x90/0x274 fs/super.c:1573
do_new_mount+0x228/0x810 fs/namespace.c:3063
path_mount+0x5b4/0xe78 fs/namespace.c:3393
do_mount fs/namespace.c:3406 [inline]
__do_sys_mount fs/namespace.c:3614 [inline]
__se_sys_mount fs/namespace.c:3591 [inline]
__arm64_sys_mount+0x49c/0x584 fs/namespace.c:3591
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 5344
hardirqs last enabled at (5343): [<ffff800008308488>] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:261
hardirqs last disabled at (5344): [<ffff800011948d00>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (5036): [<ffff8000081a9670>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last enabled at (5036): [<ffff8000081a9670>] handle_softirqs+0xaf8/0xc6c kernel/softirq.c:624
softirqs last disabled at (5021): [<ffff800008020164>] __do_softirq+0x14/0x20 kernel/softirq.c:630
---[ end trace 0000000000000000 ]---
UDF-fs: Scanning with blocksize 512 failed
UDF-fs: warning (device loop2): udf_load_vrs: No anchor found
UDF-fs: Scanning with blocksize 1024 failed
UDF-fs: error (device loop2): udf_read_tagged: read failed, block=512, location=512
UDF-fs: warning (device loop2): udf_load_vrs: No anchor found
UDF-fs: Scanning with blocksize 2048 failed
UDF-fs: error (device loop2): udf_read_tagged: read failed, block=256, location=256
UDF-fs: error (device loop2): udf_read_tagged: read failed, block=512, location=512
UDF-fs: warning (device loop2): udf_load_vrs: No anchor found
UDF-fs: Scanning with blocksize 4096 failed
UDF-fs: warning (device loop2): udf_fill_super: No partition found (1)


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 0bc96de781b4 Linux 6.1.148
git tree: linux-6.1.y

console output: https://syzkaller.appspot.com/x/log.txt?x=165ffaf0580000

kernel config: https://syzkaller.appspot.com/x/.config?x=483f799cd9933afc
dashboard link: https://syzkaller.appspot.com/bug?extid=a66f771803158bb11e66
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=100b2442580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=169a93a2580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/cd15350f801a/disk-0bc96de7.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/789a5d74139d/vmlinux-0bc96de7.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a1ef0a7e815a/Image-0bc96de7.gz.xz

mounted in repro: https://storage.googleapis.com/syzbot-assets/770df4ee56a6/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a66f77...@syzkaller.appspotmail.com

UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 98: 0x1f != 0x1e
UDF-fs: warning (device loop0): udf_verify_domain_identifier: Not OSTA UDF compliant logical volume descriptor.
------------[ cut here ]------------
WARNING: CPU: 0 PID: 4530 at mm/page_alloc.c:5590 __alloc_pages+0xd0/0x53c mm/page_alloc.c:5590
Modules linked in:
CPU: 0 PID: 4530 Comm: syz.0.17 Not tainted 6.1.148-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
pstate: 22400005 (nzCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : __alloc_pages+0xd0/0x53c mm/page_alloc.c:5590
lr : __alloc_pages+0xac/0x53c mm/page_alloc.c:5584

sp : ffff8000213a7120
x29: ffff8000213a71f0 x28: ffff700004274e7c x27: ffff8000213a7140
x26: ffff8000213a7980 x25: dfff800000000000 x24: ffff700004274e28
x23: ffff0000e0b1f910 x22: 0000000000000000 x21: 0000000000040dc0

x20: 0000000000000000 x19: 0000000000000013 x18: 00000000000000ff

x17: 6f4e203a72656966 x16: ffff8000082d2370 x15: 0000000000000000

x14: 00000000ffffffff x13: 0000000000000001 x12: 0000000000000005

x11: 1ffff00004274e2c x10: 0000000000000000 x9 : 0000000000000001

x8 : ffff800017a78000 x7 : 0000000000000000 x6 : 0000000000000001

x5 : ffff8000213a6c58 x4 : 0000000000000000 x3 : 0000000000000020

irq event stamp: 6804
hardirqs last enabled at (6803): [<ffff800008308488>] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:261
hardirqs last disabled at (6804): [<ffff800011948d00>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (6798): [<ffff8000081a9670>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last enabled at (6798): [<ffff8000081a9670>] handle_softirqs+0xaf8/0xc6c kernel/softirq.c:624
softirqs last disabled at (6737): [<ffff800008020164>] __do_softirq+0x14/0x20 kernel/softirq.c:630

---[ end trace 0000000000000000 ]---
UDF-fs: Scanning with blocksize 512 failed

UDF-fs: warning (device loop0): udf_load_vrs: No anchor found

UDF-fs: Scanning with blocksize 1024 failed

UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512
UDF-fs: warning (device loop0): udf_load_vrs: No anchor found

UDF-fs: Scanning with blocksize 2048 failed

UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256
UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512
UDF-fs: warning (device loop0): udf_load_vrs: No anchor found

UDF-fs: Scanning with blocksize 4096 failed

UDF-fs: warning (device loop0): udf_fill_super: No partition found (1)


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: c79648372d02 Linux 5.15.189
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1757aba2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f3b1215b3cf4119f
dashboard link: https://syzkaller.appspot.com/bug?extid=16605f48927245445815

compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/fa511d2a8893/disk-c7964837.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f14b6c77bbb9/vmlinux-c7964837.xz
kernel image: https://storage.googleapis.com/syzbot-assets/388987ba15c6/bzImage-c7964837.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+16605f...@syzkaller.appspotmail.com

UDF-fs: error (device loop3): udf_read_tagged: tag checksum failed, block 98: 0x1f != 0x1e
UDF-fs: warning (device loop3): udf_verify_domain_identifier: Not OSTA UDF compliant logical volume descriptor.
------------[ cut here ]------------
WARNING: CPU: 0 PID: 4384 at mm/page_alloc.c:5449 current_gfp_context include/linux/sched/mm.h:-1 [inline]
WARNING: CPU: 0 PID: 4384 at mm/page_alloc.c:5449 __alloc_pages+0x391/0x470 mm/page_alloc.c:5461
Modules linked in:
CPU: 0 PID: 4384 Comm: syz.3.20 Not tainted 5.15.189-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:__alloc_pages+0x391/0x470 mm/page_alloc.c:5449
Code: 31 ff e9 b2 fe ff ff e8 7d b2 f5 07 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c 50 fd ff ff 4c 89 e7 e8 44 ac 09 00 e9 43 fd ff ff <0f> 0b 45 31 ff e9 ef fe ff ff 65 44 8b 2d 35 9a 4f 7e 41 83 fd 08
RSP: 0018:ffffc900036bf480 EFLAGS: 00010246
RAX: ffffc900036bf4c0 RBX: 1ffff920006d7e94 RCX: 0000000000000000
RDX: 0000000000000028 RSI: 0000000000000000 RDI: ffffc900036bf4e8
RBP: ffffc900036bf578 R08: dffffc0000000000 R09: ffffc900036bf4c0
R10: fffff520006d7e9d R11: 1ffff920006d7e98 R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000040dc0 R15: 0000000000000013
FS: 00007f6ab6ed36c0(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc795c04000 CR3: 0000000023287000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
kmalloc_order+0x40/0x150 mm/slab_common.c:986
kmalloc_order_trace+0x14/0xf0 mm/slab_common.c:1002
kmalloc_array include/linux/slab.h:644 [inline]
kcalloc include/linux/slab.h:673 [inline]
udf_sb_alloc_partition_maps fs/udf/super.c:260 [inline]
udf_load_logicalvol fs/udf/super.c:1435 [inline]
udf_process_sequence+0xe8b/0x45d0 fs/udf/super.c:1791
udf_load_sequence fs/udf/super.c:1838 [inline]
udf_check_anchor_block+0x3f3/0x720 fs/udf/super.c:1878
udf_scan_anchors+0x142/0x5c0 fs/udf/super.c:1911
udf_find_anchor fs/udf/super.c:1968 [inline]
udf_load_vrs+0x192/0xad0 fs/udf/super.c:2033
udf_fill_super+0x69f/0x18f0 fs/udf/super.c:2211
mount_bdev+0x287/0x3c0 fs/super.c:1400
legacy_get_tree+0xe6/0x180 fs/fs_context.c:611
vfs_get_tree+0x88/0x270 fs/super.c:1530
do_new_mount+0x24a/0xa40 fs/namespace.c:3014
do_mount fs/namespace.c:3357 [inline]
__do_sys_mount fs/namespace.c:3565 [inline]
__se_sys_mount+0x2d6/0x3c0 fs/namespace.c:3542
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f6ab8c6d38a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6ab6ed2e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f6ab6ed2ef0 RCX: 00007f6ab8c6d38a
RDX: 0000200000000c40 RSI: 00002000000000c0 RDI: 00007f6ab6ed2eb0
RBP: 0000200000000c40 R08: 00007f6ab6ed2ef0 R09: 0000000001800801
R10: 0000000001800801 R11: 0000000000000246 R12: 00002000000000c0
R13: 00007f6ab6ed2eb0 R14: 0000000000000c6b R15: 0000200000000000
</TASK>

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: c79648372d02 Linux 5.15.189
git tree: linux-5.15.y

console output: https://syzkaller.appspot.com/x/log.txt?x=10e54ba2580000

kernel config: https://syzkaller.appspot.com/x/.config?x=f3b1215b3cf4119f
dashboard link: https://syzkaller.appspot.com/bug?extid=16605f48927245445815
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=111faba2580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=171006f0580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/fa511d2a8893/disk-c7964837.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f14b6c77bbb9/vmlinux-c7964837.xz
kernel image: https://storage.googleapis.com/syzbot-assets/388987ba15c6/bzImage-c7964837.xz

mounted in repro: https://storage.googleapis.com/syzbot-assets/a86962c4f9e3/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+16605f...@syzkaller.appspotmail.com

loop0: detected capacity change from 0 to 2048
UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 98: 0x1f != 0x1e
UDF-fs: warning (device loop0): udf_verify_domain_identifier: Not OSTA UDF compliant logical volume descriptor.
------------[ cut here ]------------
WARNING: CPU: 0 PID: 4319 at mm/page_alloc.c:5449 current_gfp_context include/linux/sched/mm.h:-1 [inline]
WARNING: CPU: 0 PID: 4319 at mm/page_alloc.c:5449 __alloc_pages+0x391/0x470 mm/page_alloc.c:5461
Modules linked in:
CPU: 0 PID: 4319 Comm: syz.0.17 Not tainted 5.15.189-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:__alloc_pages+0x391/0x470 mm/page_alloc.c:5449
Code: 31 ff e9 b2 fe ff ff e8 7d b2 f5 07 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c 50 fd ff ff 4c 89 e7 e8 44 ac 09 00 e9 43 fd ff ff <0f> 0b 45 31 ff e9 ef fe ff ff 65 44 8b 2d 35 9a 4f 7e 41 83 fd 08

RSP: 0018:ffffc9000330f480 EFLAGS: 00010246
RAX: ffffc9000330f4c0 RBX: 1ffff92000661e94 RCX: 0000000000000000
RDX: 0000000000000028 RSI: 0000000000000000 RDI: ffffc9000330f4e8
RBP: ffffc9000330f578 R08: dffffc0000000000 R09: ffffc9000330f4c0
R10: fffff52000661e9d R11: 1ffff92000661e98 R12: dffffc0000000000

R13: 0000000000000000 R14: 0000000000040dc0 R15: 0000000000000013

FS: 000055556fc3a500(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007f920ecf2020 CR3: 000000007c3aa000 CR4: 00000000003506f0

RIP: 0033:0x7f920ed1038a

Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007ffe0717cb28 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffe0717cbb0 RCX: 00007f920ed1038a
RDX: 0000200000000c40 RSI: 00002000000000c0 RDI: 00007ffe0717cb70
RBP: 0000200000000c40 R08: 00007ffe0717cbb0 R09: 0000000001800801

R10: 0000000001800801 R11: 0000000000000246 R12: 00002000000000c0

R13: 00007ffe0717cb70 R14: 0000000000000c6b R15: 0000200000000000
</TASK>


---

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: bb9c90ab9c5a Linux 6.6.102
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14eb4ba2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=7b989b97a0687b0a
dashboard link: https://syzkaller.appspot.com/bug?extid=8b744cf90a7a14692145

compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/44e2224124c3/disk-bb9c90ab.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/33e0aef7ff42/vmlinux-bb9c90ab.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0515bc436228/bzImage-bb9c90ab.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+8b744c...@syzkaller.appspotmail.com

UDF-fs: error (device loop2): udf_read_tagged: tag checksum failed, block 98: 0x1f != 0x1e
UDF-fs: warning (device loop2): udf_verify_domain_identifier: Not OSTA UDF compliant logical volume descriptor.
------------[ cut here ]------------
WARNING: CPU: 1 PID: 12209 at mm/page_alloc.c:4433 __alloc_pages+0x2de/0x460 mm/page_alloc.c:4433
Modules linked in:
CPU: 1 PID: 12209 Comm: syz.2.1012 Not tainted 6.6.102-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025

RIP: 0010:__alloc_pages+0x2de/0x460 mm/page_alloc.c:4433
Code: 0c 25 28 00 00 00 48 3b 8c 24 a0 00 00 00 0f 85 a0 00 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 c6 05 75 33 64 0c 01 <0f> 0b eb a5 a9 00 00 08 00 8b 74 24 0c 75 3e 44 89 f1 81 e1 7f ff
RSP: 0018:ffffc9000fcef460 EFLAGS: 00010246
RAX: ffffc9000fcef400 RBX: 1ffff92001f9de90 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000fcef4c8
RBP: ffffc9000fcef560 R08: ffffc9000fcef4c7 R09: 0000000000000000
R10: ffffc9000fcef4a0 R11: fffff52001f9de99 R12: 0000000000000013
R13: 0000000000000000 R14: 0000000000040dc0 R15: dffffc0000000000
FS: 00007f2cfe1c56c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007f8a6224c000 CR3: 000000002d4e1000 CR4: 00000000003506e0
Call Trace:
<TASK>

__alloc_pages_node include/linux/gfp.h:237 [inline]
alloc_pages_node include/linux/gfp.h:260 [inline]

__kmalloc_large_node+0x8c/0x1e0 mm/slab_common.c:1148
__do_kmalloc_node mm/slab_common.c:995 [inline]
__kmalloc+0x111/0x240 mm/slab_common.c:1020
kmalloc_array include/linux/slab.h:637 [inline]
kcalloc include/linux/slab.h:668 [inline]
udf_sb_alloc_partition_maps fs/udf/super.c:256 [inline]
udf_load_logicalvol fs/udf/super.c:1433 [inline]
udf_process_sequence+0x1cb3/0x4660 fs/udf/super.c:1789
udf_load_sequence fs/udf/super.c:1836 [inline]
udf_check_anchor_block+0x28d/0x540 fs/udf/super.c:1871
udf_scan_anchors fs/udf/super.c:1904 [inline]
udf_load_vrs+0x593/0xf00 fs/udf/super.c:1985
udf_fill_super+0x67d/0x1720 fs/udf/super.c:2163
mount_bdev+0x22b/0x2d0 fs/super.c:1643
legacy_get_tree+0xea/0x180 fs/fs_context.c:662
vfs_get_tree+0x8c/0x280 fs/super.c:1764
do_new_mount+0x24b/0xa40 fs/namespace.c:3371
do_mount fs/namespace.c:3711 [inline]
__do_sys_mount fs/namespace.c:3920 [inline]
__se_sys_mount+0x2da/0x3c0 fs/namespace.c:3897
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f2cfd39038a

Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007f2cfe1c4e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f2cfe1c4ef0 RCX: 00007f2cfd39038a
RDX: 0000200000000c40 RSI: 00002000000000c0 RDI: 00007f2cfe1c4eb0
RBP: 0000200000000c40 R08: 00007f2cfe1c4ef0 R09: 0000000001800801

R10: 0000000001800801 R11: 0000000000000246 R12: 00002000000000c0

R13: 00007f2cfe1c4eb0 R14: 0000000000000c6b R15: 0000200000000000
</TASK>


---

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: bb9c90ab9c5a Linux 6.6.102
git tree: linux-6.6.y

console output: https://syzkaller.appspot.com/x/log.txt?x=147c9234580000

kernel config: https://syzkaller.appspot.com/x/.config?x=7b989b97a0687b0a
dashboard link: https://syzkaller.appspot.com/bug?extid=8b744cf90a7a14692145
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12da06f0580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15a74ba2580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/44e2224124c3/disk-bb9c90ab.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/33e0aef7ff42/vmlinux-bb9c90ab.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0515bc436228/bzImage-bb9c90ab.xz

mounted in repro: https://storage.googleapis.com/syzbot-assets/d4a5982b74e8/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8b744c...@syzkaller.appspotmail.com

syz.0.17[5947]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set

loop0: detected capacity change from 0 to 2048

UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 98: 0x1f != 0x1e
UDF-fs: warning (device loop0): udf_verify_domain_identifier: Not OSTA UDF compliant logical volume descriptor.
------------[ cut here ]------------
WARNING: CPU: 1 PID: 5947 at mm/page_alloc.c:4433 __alloc_pages+0x2de/0x460 mm/page_alloc.c:4433
Modules linked in:
CPU: 1 PID: 5947 Comm: syz.0.17 Not tainted 6.6.102-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:__alloc_pages+0x2de/0x460 mm/page_alloc.c:4433
Code: 0c 25 28 00 00 00 48 3b 8c 24 a0 00 00 00 0f 85 a0 00 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 c6 05 75 33 64 0c 01 <0f> 0b eb a5 a9 00 00 08 00 8b 74 24 0c 75 3e 44 89 f1 81 e1 7f ff

RSP: 0018:ffffc90003257460 EFLAGS: 00010246
RAX: ffffc90003257400 RBX: 1ffff9200064ae90 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc900032574c8
RBP: ffffc90003257560 R08: ffffc900032574c7 R09: 0000000000000000
R10: ffffc900032574a0 R11: fffff5200064ae99 R12: 0000000000000013

R13: 0000000000000000 R14: 0000000000040dc0 R15: dffffc0000000000

FS: 0000555586da0500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000055e587b47788 CR3: 0000000078f7b000 CR4: 00000000003506e0

RIP: 0033:0x7f58e219038a

Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007fffcb50f678 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fffcb50f700 RCX: 00007f58e219038a
RDX: 0000200000000c40 RSI: 00002000000000c0 RDI: 00007fffcb50f6c0
RBP: 0000200000000c40 R08: 00007fffcb50f700 R09: 0000000001800801

R10: 0000000001800801 R11: 0000000000000246 R12: 00002000000000c0

R13: 00007fffcb50f6c0 R14: 0000000000000c6b R15: 0000200000000000
</TASK>


---

[syzbot]

syzbot suspects this issue was fixed by commit:

commit fc5d14e5bd3740f6e35594440f89a7f50aabba26
Author: Jan Kara <ja...@suse.cz>
Date: Fri Jul 11 17:01:20 2025 +0000

udf: Verify partition map count

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=16fdd2e2580000
start commit: 0bc96de781b4 Linux 6.1.148
git tree: linux-6.1.y

kernel config: https://syzkaller.appspot.com/x/.config?x=483f799cd9933afc
dashboard link: https://syzkaller.appspot.com/bug?extid=a66f771803158bb11e66

userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=150faba2580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=107a93a2580000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: udf: Verify partition map count

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

[syzbot]

syzbot suspects this issue was fixed by commit:

commit dc83df485f44367caa137479dd52c600d1cffdd5

Author: Jan Kara <ja...@suse.cz>
Date: Fri Jul 11 17:01:20 2025 +0000

udf: Verify partition map count

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=15be2092580000
start commit: c79648372d02 Linux 5.15.189
git tree: linux-5.15.y

kernel config: https://syzkaller.appspot.com/x/.config?x=f3b1215b3cf4119f
dashboard link: https://syzkaller.appspot.com/bug?extid=16605f48927245445815

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=111faba2580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=171006f0580000