Starting Permit User Sessions... [ OK ] Started System Logging Service. [ OK ] Started Permit User Sessions. [ OK ] Started OpenBSD Secure Shell server. [ OK ] Started getty on tty2-tty6 if dbus and logind are not available. [ OK ] Started Getty on tty6. [ OK ] Started Getty on tty5. [ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Getty on tty1. [ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.1.25' (ECDSA) to the list of known hosts. syzkaller login: [ 55.299013][ T6810] IPVS: ftp: loaded support on port[0] = 21 [ 55.312110][ T6816] IPVS: ftp: loaded support on port[0] = 21 [ 55.320776][ T6815] IPVS: ftp: loaded support on port[0] = 21 [ 55.324009][ T6818] IPVS: ftp: loaded support on port[0] = 21 [ 55.331462][ T6817] IPVS: ftp: loaded support on port[0] = 21 [ 55.334598][ T6812] IPVS: ftp: loaded support on port[0] = 21 executing program executing program executing program [ 55.543267][ T6900] netlink: 'syz-executor614': attribute type 3 has an invalid length. [ 55.575594][ T6934] netlink: 'syz-executor614': attribute type 3 has an invalid length. [ 55.578821][ T6928] netlink: 'syz-executor614': attribute type 3 has an invalid length. executing program executing program [ 55.584991][ T6934] netlink: 'syz-executor614': attribute type 8 has an invalid length. [ 55.609225][ T6939] netlink: 'syz-executor614': attribute type 3 has an invalid length. [ 55.610829][ T6900] netlink: 'syz-executor614': attribute type 8 has an invalid length. [ 55.621425][ T6940] netlink: 'syz-executor614': attribute type 3 has an invalid length. [ 55.628949][ T6900] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor614'. executing program executing program [ 55.634455][ T6928] netlink: 'syz-executor614': attribute type 8 has an invalid length. [ 55.645672][ T6934] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor614'. [ 55.656045][ T6939] netlink: 'syz-executor614': attribute type 8 has an invalid length. [ 55.671646][ T6945] netlink: 'syz-executor614': attribute type 3 has an invalid length. [ 55.674163][ T6946] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor614'. executing program executing program [ 55.680274][ T6940] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor614'. [ 55.693783][ T6947] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor614'. [ 55.700038][ T6945] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor614'. [ 55.718850][ T6948] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor614'. [ 55.719304][ T6939] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor614'. executing program executing program executing program executing program executing program [ 55.730003][ T6928] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor614'. [ 55.749679][ T6950] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor614'. [ 55.757549][ T6948] ================================================================== [ 55.767493][ T6948] BUG: KASAN: vmalloc-out-of-bounds in nl802154_dump_wpan_phy+0x98e/0x9c0 [ 55.775973][ T6948] Read of size 4 at addr ffffc900020e7018 by task syz-executor614/6948 [ 55.784217][ T6948] [ 55.786535][ T6948] CPU: 1 PID: 6948 Comm: syz-executor614 Not tainted 5.8.0-rc3-syzkaller #0 [ 55.795207][ T6948] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 55.805241][ T6948] Call Trace: [ 55.808536][ T6948] dump_stack+0x18f/0x20d [ 55.812865][ T6948] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 55.818399][ T6948] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 55.823947][ T6948] print_address_description.constprop.0.cold+0x5/0x436 [ 55.831745][ T6948] ? lockdep_hardirqs_off+0x66/0xa0 [ 55.836936][ T6948] ? vprintk_func+0x97/0x1a6 [ 55.841508][ T6948] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 55.847029][ T6948] kasan_report.cold+0x1f/0x37 [ 55.851780][ T6948] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 55.857316][ T6948] nl802154_dump_wpan_phy+0x98e/0x9c0 [ 55.862677][ T6948] ? kmem_cache_alloc_node_trace+0x3b0/0x400 [ 55.868656][ T6948] ? __kmalloc_node_track_caller+0x38/0x60 [ 55.874448][ T6948] ? nl802154_send_wpan_phy.constprop.0+0x21d0/0x21d0 [ 55.881186][ T6948] ? __phys_addr+0x9a/0x110 [ 55.885669][ T6948] ? memset+0x20/0x40 [ 55.889648][ T6948] genl_lock_dumpit+0x7f/0xb0 [ 55.894307][ T6948] netlink_dump+0x4cd/0xf60 [ 55.898815][ T6948] ? netlink_insert+0x1670/0x1670 [ 55.903835][ T6948] ? __mutex_unlock_slowpath+0xe2/0x610 [ 55.909373][ T6948] ? genl_start+0x45a/0x6e0 [ 55.913859][ T6948] __netlink_dump_start+0x643/0x900 [ 55.919060][ T6948] ? genl_rcv_msg+0x9e0/0x9e0 [ 55.923719][ T6948] ? nl802154_send_wpan_phy.constprop.0+0x21d0/0x21d0 [ 55.930464][ T6948] genl_family_rcv_msg_dumpit+0x2ac/0x310 [ 55.936161][ T6948] ? genl_rcv+0x40/0x40 [ 55.941250][ T6948] ? mutex_lock_io_nested+0xf60/0xf60 [ 55.946610][ T6948] ? mark_lock+0xbc/0x1710 [ 55.951037][ T6948] ? genl_rcv_msg+0x9e0/0x9e0 [ 55.955699][ T6948] ? genl_unlock+0x20/0x20 [ 55.960122][ T6948] ? genl_parallel_done+0x170/0x170 [ 55.965326][ T6948] ? __radix_tree_lookup+0x1f3/0x290 [ 55.970605][ T6948] genl_rcv_msg+0x797/0x9e0 [ 55.975093][ T6948] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 55.982009][ T6948] ? lock_acquire+0x1f1/0xad0 [ 55.986663][ T6948] ? genl_rcv+0x15/0x40 [ 55.990797][ T6948] ? lock_release+0x8d0/0x8d0 [ 55.995472][ T6948] netlink_rcv_skb+0x15a/0x430 [ 56.000216][ T6948] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 56.007142][ T6948] ? netlink_ack+0xa10/0xa10 [ 56.011732][ T6948] genl_rcv+0x24/0x40 [ 56.015703][ T6948] netlink_unicast+0x533/0x7d0 [ 56.020454][ T6948] ? netlink_attachskb+0x810/0x810 [ 56.025543][ T6948] ? _copy_from_iter_full+0x247/0x890 [ 56.030932][ T6948] ? __phys_addr_symbol+0x2c/0x70 [ 56.035962][ T6948] ? __check_object_size+0x171/0x3e4 [ 56.041224][ T6948] netlink_sendmsg+0x856/0xd90 [ 56.045985][ T6948] ? netlink_unicast+0x7d0/0x7d0 [ 56.050918][ T6948] ? netlink_unicast+0x7d0/0x7d0 [ 56.055890][ T6948] sock_sendmsg+0xcf/0x120 [ 56.060290][ T6948] ____sys_sendmsg+0x6e8/0x810 [ 56.065039][ T6948] ? kernel_sendmsg+0x50/0x50 [ 56.069697][ T6948] ? do_recvmmsg+0x6d0/0x6d0 [ 56.074268][ T6948] ? lock_acquire+0x1f1/0xad0 [ 56.078927][ T6948] ? do_huge_pmd_anonymous_page+0x120d/0x2230 [ 56.084990][ T6948] ? find_held_lock+0x2d/0x110 [ 56.089737][ T6948] ___sys_sendmsg+0xf3/0x170 [ 56.094317][ T6948] ? sendmsg_copy_msghdr+0x160/0x160 [ 56.099599][ T6948] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 56.105616][ T6948] ? do_huge_pmd_anonymous_page+0x8ef/0x2230 [ 56.111580][ T6948] ? handle_mm_fault+0xad9/0x43f0 [ 56.116584][ T6948] ? find_held_lock+0x2d/0x110 [ 56.121327][ T6948] ? __fget_light+0x215/0x280 [ 56.125995][ T6948] __sys_sendmsg+0xe5/0x1b0 [ 56.130490][ T6948] ? __sys_sendmsg_sock+0xb0/0xb0 [ 56.135520][ T6948] ? do_syscall_64+0x1c/0xe0 [ 56.140096][ T6948] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 56.146409][ T6948] do_syscall_64+0x60/0xe0 [ 56.150807][ T6948] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 56.156696][ T6948] RIP: 0033:0x441409 [ 56.160562][ T6948] Code: Bad RIP value. [ 56.164600][ T6948] RSP: 002b:00007ffc85b0b588 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 56.172985][ T6948] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441409 [ 56.180946][ T6948] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003 [ 56.188899][ T6948] RBP: 000000000000d980 R08: 0000000100000000 R09: 0000000100000000 [ 56.196847][ T6948] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000402220 [ 56.204810][ T6948] R13: 00000000004022b0 R14: 0000000000000000 R15: 0000000000000000 [ 56.212768][ T6948] [ 56.215073][ T6948] [ 56.217388][ T6948] Memory state around the buggy address: [ 56.222997][ T6948] ffffc900020e6f00: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 56.231061][ T6948] ffffc900020e6f80: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 56.239125][ T6948] >ffffc900020e7000: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 56.247261][ T6948] ^ [ 56.252091][ T6948] ffffc900020e7080: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 56.260148][ T6948] ffffc900020e7100: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 56.268189][ T6948] ================================================================== [ 56.276239][ T6948] Disabling lock debugging due to kernel taint [ 56.282941][ T6948] Kernel panic - not syncing: panic_on_warn set ... [ 56.289542][ T6948] CPU: 1 PID: 6948 Comm: syz-executor614 Tainted: G B 5.8.0-rc3-syzkaller #0 [ 56.299617][ T6948] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 56.309661][ T6948] Call Trace: [ 56.312992][ T6948] dump_stack+0x18f/0x20d [ 56.317309][ T6948] ? nl802154_dump_wpan_phy+0x8b0/0x9c0 [ 56.322830][ T6948] panic+0x2e3/0x75c [ 56.326699][ T6948] ? __warn_printk+0xf3/0xf3 [ 56.331283][ T6948] ? preempt_schedule_common+0x59/0xc0 [ 56.336722][ T6948] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 56.342257][ T6948] ? preempt_schedule_thunk+0x16/0x18 [ 56.347618][ T6948] ? trace_hardirqs_on+0x55/0x220 [ 56.352616][ T6948] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 56.358134][ T6948] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 56.363693][ T6948] end_report+0x4d/0x53 [ 56.367843][ T6948] kasan_report.cold+0xd/0x37 [ 56.372507][ T6948] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 56.378046][ T6948] nl802154_dump_wpan_phy+0x98e/0x9c0 [ 56.383686][ T6948] ? kmem_cache_alloc_node_trace+0x3b0/0x400 [ 56.389653][ T6948] ? __kmalloc_node_track_caller+0x38/0x60 [ 56.397099][ T6948] ? nl802154_send_wpan_phy.constprop.0+0x21d0/0x21d0 [ 56.403841][ T6948] ? __phys_addr+0x9a/0x110 [ 56.408322][ T6948] ? memset+0x20/0x40 [ 56.412287][ T6948] genl_lock_dumpit+0x7f/0xb0 [ 56.416948][ T6948] netlink_dump+0x4cd/0xf60 [ 56.421469][ T6948] ? netlink_insert+0x1670/0x1670 [ 56.426503][ T6948] ? __mutex_unlock_slowpath+0xe2/0x610 [ 56.432110][ T6948] ? genl_start+0x45a/0x6e0 [ 56.436586][ T6948] __netlink_dump_start+0x643/0x900 [ 56.441776][ T6948] ? genl_rcv_msg+0x9e0/0x9e0 [ 56.446432][ T6948] ? nl802154_send_wpan_phy.constprop.0+0x21d0/0x21d0 [ 56.453165][ T6948] genl_family_rcv_msg_dumpit+0x2ac/0x310 [ 56.458863][ T6948] ? genl_rcv+0x40/0x40 [ 56.462993][ T6948] ? mutex_lock_io_nested+0xf60/0xf60 [ 56.468338][ T6948] ? mark_lock+0xbc/0x1710 [ 56.472726][ T6948] ? genl_rcv_msg+0x9e0/0x9e0 [ 56.477374][ T6948] ? genl_unlock+0x20/0x20 [ 56.481762][ T6948] ? genl_parallel_done+0x170/0x170 [ 56.486934][ T6948] ? __radix_tree_lookup+0x1f3/0x290 [ 56.492191][ T6948] genl_rcv_msg+0x797/0x9e0 [ 56.496670][ T6948] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 56.503578][ T6948] ? lock_acquire+0x1f1/0xad0 [ 56.508226][ T6948] ? genl_rcv+0x15/0x40 [ 56.512365][ T6948] ? lock_release+0x8d0/0x8d0 [ 56.517031][ T6948] netlink_rcv_skb+0x15a/0x430 [ 56.521772][ T6948] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 56.528981][ T6948] ? netlink_ack+0xa10/0xa10 [ 56.534264][ T6948] genl_rcv+0x24/0x40 [ 56.538313][ T6948] netlink_unicast+0x533/0x7d0 [ 56.543057][ T6948] ? netlink_attachskb+0x810/0x810 [ 56.548147][ T6948] ? _copy_from_iter_full+0x247/0x890 [ 56.553506][ T6948] ? __phys_addr_symbol+0x2c/0x70 [ 56.558519][ T6948] ? __check_object_size+0x171/0x3e4 [ 56.563780][ T6948] netlink_sendmsg+0x856/0xd90 [ 56.568523][ T6948] ? netlink_unicast+0x7d0/0x7d0 [ 56.573453][ T6948] ? netlink_unicast+0x7d0/0x7d0 [ 56.578378][ T6948] sock_sendmsg+0xcf/0x120 [ 56.582773][ T6948] ____sys_sendmsg+0x6e8/0x810 [ 56.587512][ T6948] ? kernel_sendmsg+0x50/0x50 [ 56.592164][ T6948] ? do_recvmmsg+0x6d0/0x6d0 [ 56.596732][ T6948] ? lock_acquire+0x1f1/0xad0 [ 56.601574][ T6948] ? do_huge_pmd_anonymous_page+0x120d/0x2230 [ 56.607617][ T6948] ? find_held_lock+0x2d/0x110 [ 56.612370][ T6948] ___sys_sendmsg+0xf3/0x170 [ 56.616952][ T6948] ? sendmsg_copy_msghdr+0x160/0x160 [ 56.622324][ T6948] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 56.628286][ T6948] ? do_huge_pmd_anonymous_page+0x8ef/0x2230 [ 56.634241][ T6948] ? handle_mm_fault+0xad9/0x43f0 [ 56.639242][ T6948] ? find_held_lock+0x2d/0x110 [ 56.643986][ T6948] ? __fget_light+0x215/0x280 [ 56.648655][ T6948] __sys_sendmsg+0xe5/0x1b0 [ 56.653132][ T6948] ? __sys_sendmsg_sock+0xb0/0xb0 [ 56.658140][ T6948] ? do_syscall_64+0x1c/0xe0 [ 56.663141][ T6948] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 56.669114][ T6948] do_syscall_64+0x60/0xe0 [ 56.673524][ T6948] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 56.679388][ T6948] RIP: 0033:0x441409 [ 56.683382][ T6948] Code: Bad RIP value. [ 56.687424][ T6948] RSP: 002b:00007ffc85b0b588 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 56.695905][ T6948] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441409 [ 56.703880][ T6948] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003 [ 56.711839][ T6948] RBP: 000000000000d980 R08: 0000000100000000 R09: 0000000100000000 [ 56.719789][ T6948] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000402220 [ 56.727825][ T6948] R13: 00000000004022b0 R14: 0000000000000000 R15: 0000000000000000 [ 56.737090][ T6948] Kernel Offset: disabled [ 56.741858][ T6948] Rebooting in 86400 seconds..