Starting Permit User Sessions... Starting System Logging Service... [ OK ] Started Daily apt download activities. [ OK ] Started Daily apt upgrade and clean activities. [ OK ] Reached target Timers. [ OK ] Started Regular background program processing daemon. [ OK ] Started Permit User Sessions. [ OK ] Started System Logging Service. [ OK ] Started OpenBSD Secure Shell server. [ OK ] Started getty on tty2-tty6 if dbus and logind are not available. [ OK ] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch. [ OK ] Started Getty on tty6. [ OK ] Started Getty on tty5. [ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Getty on tty1. [ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.175' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 68.407933][ T28] audit: type=1400 audit(1596274722.337:8): avc: denied { execmem } for pid=6830 comm="syz-executor326" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 68.410744][ T6830] ================================================================== [ 68.436826][ T6830] BUG: KASAN: slab-out-of-bounds in qrtr_endpoint_post+0x5c1/0x1050 [ 68.444975][ T6830] Read of size 4294967294 at addr ffff8880a47fbcd0 by task syz-executor326/6830 [ 68.453962][ T6830] [ 68.456272][ T6830] CPU: 0 PID: 6830 Comm: syz-executor326 Not tainted 5.8.0-rc7-syzkaller #0 [ 68.465040][ T6830] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 68.475073][ T6830] Call Trace: [ 68.478348][ T6830] dump_stack+0x18f/0x20d [ 68.482681][ T6830] ? qrtr_endpoint_post+0x5c1/0x1050 [ 68.487945][ T6830] ? qrtr_endpoint_post+0x5c1/0x1050 [ 68.493207][ T6830] print_address_description.constprop.0.cold+0xae/0x436 [ 68.500206][ T6830] ? __might_fault+0x11f/0x1d0 [ 68.504977][ T6830] ? lockdep_hardirqs_off+0x66/0xa0 [ 68.510162][ T6830] ? vprintk_func+0x97/0x1a6 [ 68.514782][ T6830] ? qrtr_endpoint_post+0x5c1/0x1050 [ 68.520045][ T6830] kasan_report.cold+0x1f/0x37 [ 68.524898][ T6830] ? qrtr_endpoint_post+0x5c1/0x1050 [ 68.530174][ T6830] check_memory_region+0x13d/0x180 [ 68.535267][ T6830] memcpy+0x20/0x60 [ 68.539056][ T6830] qrtr_endpoint_post+0x5c1/0x1050 [ 68.544152][ T6830] qrtr_tun_write_iter+0xf5/0x180 [ 68.549156][ T6830] new_sync_write+0x422/0x650 [ 68.553811][ T6830] ? new_sync_read+0x6e0/0x6e0 [ 68.558555][ T6830] ? selinux_file_permission+0x92/0x520 [ 68.564081][ T6830] ? build_open_flags+0x650/0x650 [ 68.569083][ T6830] vfs_write+0x59d/0x6b0 [ 68.573330][ T6830] ksys_write+0x12d/0x250 [ 68.577635][ T6830] ? __ia32_sys_read+0xb0/0xb0 [ 68.582377][ T6830] ? lock_is_held_type+0xb0/0xe0 [ 68.587300][ T6830] ? do_syscall_64+0x1c/0xe0 [ 68.591879][ T6830] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 68.597834][ T6830] do_syscall_64+0x60/0xe0 [ 68.602242][ T6830] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 68.608121][ T6830] RIP: 0033:0x440259 [ 68.611995][ T6830] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 68.631578][ T6830] RSP: 002b:00007ffcd8012348 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 68.639962][ T6830] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440259 [ 68.647907][ T6830] RDX: 0000000000000010 RSI: 0000000020000040 RDI: 0000000000000003 [ 68.655854][ T6830] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 68.663798][ T6830] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a60 [ 68.671750][ T6830] R13: 0000000000401af0 R14: 0000000000000000 R15: 0000000000000000 [ 68.679719][ T6830] [ 68.682028][ T6830] Allocated by task 6830: [ 68.686345][ T6830] save_stack+0x1b/0x40 [ 68.690476][ T6830] __kasan_kmalloc.constprop.0+0xc2/0xd0 [ 68.696097][ T6830] __kmalloc+0x17a/0x340 [ 68.700325][ T6830] qrtr_tun_write_iter+0x8a/0x180 [ 68.705336][ T6830] new_sync_write+0x422/0x650 [ 68.710424][ T6830] vfs_write+0x59d/0x6b0 [ 68.714642][ T6830] ksys_write+0x12d/0x250 [ 68.718963][ T6830] do_syscall_64+0x60/0xe0 [ 68.723362][ T6830] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 68.729235][ T6830] [ 68.731541][ T6830] Freed by task 6755: [ 68.735505][ T6830] save_stack+0x1b/0x40 [ 68.739632][ T6830] __kasan_slab_free+0xf5/0x140 [ 68.744458][ T6830] kfree+0x103/0x2c0 [ 68.748329][ T6830] security_cred_free+0xc3/0x130 [ 68.753243][ T6830] put_cred_rcu+0x122/0x4a0 [ 68.757721][ T6830] __put_cred+0x1de/0x250 [ 68.762041][ T6830] revert_creds+0x1a8/0x1f0 [ 68.766527][ T6830] do_faccessat+0x2ca/0x820 [ 68.771005][ T6830] do_syscall_64+0x60/0xe0 [ 68.775397][ T6830] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 68.781256][ T6830] [ 68.783559][ T6830] The buggy address belongs to the object at ffff8880a47fbcc0 [ 68.783559][ T6830] which belongs to the cache kmalloc-32 of size 32 [ 68.797423][ T6830] The buggy address is located 16 bytes inside of [ 68.797423][ T6830] 32-byte region [ffff8880a47fbcc0, ffff8880a47fbce0) [ 68.810785][ T6830] The buggy address belongs to the page: [ 68.816411][ T6830] page:ffffea000291fec0 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880a47fbfc1 [ 68.826788][ T6830] flags: 0xfffe0000000200(slab) [ 68.831627][ T6830] raw: 00fffe0000000200 ffffea0002761b88 ffffea000291a208 ffff8880aa0001c0 [ 68.840196][ T6830] raw: ffff8880a47fbfc1 ffff8880a47fb000 0000000100000039 0000000000000000 [ 68.848761][ T6830] page dumped because: kasan: bad access detected [ 68.855140][ T6830] [ 68.857446][ T6830] Memory state around the buggy address: [ 68.863052][ T6830] ffff8880a47fbb80: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 68.871086][ T6830] ffff8880a47fbc00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 68.879118][ T6830] >ffff8880a47fbc80: fb fb fb fb fc fc fc fc 00 00 fc fc fc fc fc fc [ 68.887148][ T6830] ^ [ 68.893794][ T6830] ffff8880a47fbd00: fb fb fb fb fc fc fc fc 00 01 fc fc fc fc fc fc [ 68.901828][ T6830] ffff8880a47fbd80: 00 01 fc fc fc fc fc fc 00 00 01 fc fc fc fc fc [ 68.909882][ T6830] ================================================================== [ 68.917920][ T6830] Disabling lock debugging due to kernel taint [ 68.924507][ T6830] Kernel panic - not syncing: panic_on_warn set ... [ 68.931098][ T6830] CPU: 0 PID: 6830 Comm: syz-executor326 Tainted: G B 5.8.0-rc7-syzkaller #0 [ 68.941147][ T6830] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 68.951193][ T6830] Call Trace: [ 68.954486][ T6830] dump_stack+0x18f/0x20d [ 68.958808][ T6830] ? qrtr_endpoint_post+0x530/0x1050 [ 68.964066][ T6830] panic+0x2e3/0x75c [ 68.967935][ T6830] ? __warn_printk+0xf3/0xf3 [ 68.972500][ T6830] ? preempt_schedule_common+0x59/0xc0 [ 68.977942][ T6830] ? qrtr_endpoint_post+0x5c1/0x1050 [ 68.983288][ T6830] ? preempt_schedule_thunk+0x16/0x18 [ 68.988632][ T6830] ? trace_hardirqs_on+0x55/0x220 [ 68.993630][ T6830] ? qrtr_endpoint_post+0x5c1/0x1050 [ 68.998884][ T6830] ? qrtr_endpoint_post+0x5c1/0x1050 [ 69.004140][ T6830] end_report+0x4d/0x53 [ 69.008266][ T6830] kasan_report.cold+0xd/0x37 [ 69.012917][ T6830] ? qrtr_endpoint_post+0x5c1/0x1050 [ 69.018172][ T6830] check_memory_region+0x13d/0x180 [ 69.023255][ T6830] memcpy+0x20/0x60 [ 69.027050][ T6830] qrtr_endpoint_post+0x5c1/0x1050 [ 69.032134][ T6830] qrtr_tun_write_iter+0xf5/0x180 [ 69.037129][ T6830] new_sync_write+0x422/0x650 [ 69.041784][ T6830] ? new_sync_read+0x6e0/0x6e0 [ 69.046542][ T6830] ? selinux_file_permission+0x92/0x520 [ 69.052086][ T6830] ? build_open_flags+0x650/0x650 [ 69.057088][ T6830] vfs_write+0x59d/0x6b0 [ 69.061321][ T6830] ksys_write+0x12d/0x250 [ 69.065628][ T6830] ? __ia32_sys_read+0xb0/0xb0 [ 69.070391][ T6830] ? lock_is_held_type+0xb0/0xe0 [ 69.075300][ T6830] ? do_syscall_64+0x1c/0xe0 [ 69.079865][ T6830] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 69.085816][ T6830] do_syscall_64+0x60/0xe0 [ 69.090204][ T6830] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 69.096078][ T6830] RIP: 0033:0x440259 [ 69.099948][ T6830] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 69.119533][ T6830] RSP: 002b:00007ffcd8012348 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 69.127913][ T6830] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440259 [ 69.135868][ T6830] RDX: 0000000000000010 RSI: 0000000020000040 RDI: 0000000000000003 [ 69.143810][ T6830] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 69.151753][ T6830] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a60 [ 69.159693][ T6830] R13: 0000000000401af0 R14: 0000000000000000 R15: 0000000000000000 [ 69.169083][ T6830] Kernel Offset: disabled [ 69.173429][ T6830] Rebooting in 86400 seconds..