[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 58.679483][ T24] audit: type=1800 audit(1575501775.516:25): pid=8709 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 58.723502][ T24] audit: type=1800 audit(1575501775.516:26): pid=8709 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 58.762860][ T24] audit: type=1800 audit(1575501775.516:27): pid=8709 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.153' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 69.269067][ T8864] sp0: Synchronizing with TNC [ 69.275909][ T25] ================================================================== [ 69.284100][ T25] BUG: KASAN: slab-out-of-bounds in decode_data.part.0+0x23b/0x270 [ 69.291990][ T25] Write of size 1 at addr ffff8880993bd04e by task kworker/u4:2/25 [ 69.299871][ T25] [ 69.302206][ T25] CPU: 1 PID: 25 Comm: kworker/u4:2 Not tainted 5.4.0-syzkaller #0 [ 69.310087][ T25] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 69.320154][ T25] Workqueue: events_unbound flush_to_ldisc [ 69.325954][ T25] Call Trace: [ 69.329245][ T25] dump_stack+0x197/0x210 [ 69.333588][ T25] ? decode_data.part.0+0x23b/0x270 [ 69.338792][ T25] print_address_description.constprop.0.cold+0xd4/0x30b [ 69.345921][ T25] ? decode_data.part.0+0x23b/0x270 [ 69.351125][ T25] ? decode_data.part.0+0x23b/0x270 [ 69.356324][ T25] __kasan_report.cold+0x1b/0x41 [ 69.361269][ T25] ? decode_data.part.0+0x23b/0x270 [ 69.366470][ T25] kasan_report+0x12/0x20 [ 69.370804][ T25] __asan_report_store1_noabort+0x17/0x20 [ 69.376528][ T25] decode_data.part.0+0x23b/0x270 [ 69.381557][ T25] sixpack_receive_buf+0xde4/0x1420 [ 69.386760][ T25] ? sixpack_close+0x250/0x250 [ 69.391527][ T25] tty_ldisc_receive_buf+0x15f/0x1c0 [ 69.396812][ T25] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 69.403061][ T25] tty_port_default_receive_buf+0x7d/0xb0 [ 69.408785][ T25] flush_to_ldisc+0x222/0x390 [ 69.413469][ T25] process_one_work+0x9af/0x1740 [ 69.418420][ T25] ? pwq_dec_nr_in_flight+0x320/0x320 [ 69.423791][ T25] ? lock_acquire+0x190/0x410 [ 69.428477][ T25] worker_thread+0x98/0xe40 [ 69.432978][ T25] ? trace_hardirqs_on+0x67/0x240 [ 69.438018][ T25] kthread+0x361/0x430 [ 69.442087][ T25] ? process_one_work+0x1740/0x1740 [ 69.447399][ T25] ? kthread_mod_delayed_work+0x1f0/0x1f0 [ 69.453123][ T25] ret_from_fork+0x24/0x30 [ 69.457544][ T25] [ 69.459876][ T25] Allocated by task 8864: [ 69.464215][ T25] save_stack+0x23/0x90 [ 69.468369][ T25] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 69.474000][ T25] kasan_kmalloc+0x9/0x10 [ 69.478331][ T25] __kmalloc_node+0x4e/0x70 [ 69.482836][ T25] kvmalloc_node+0x68/0x100 [ 69.487336][ T25] alloc_netdev_mqs+0x98/0xde0 [ 69.492099][ T25] sixpack_open+0x104/0xaaf [ 69.496602][ T25] tty_ldisc_open.isra.0+0xa3/0x110 [ 69.501804][ T25] tty_set_ldisc+0x30e/0x6b0 [ 69.506391][ T25] tty_ioctl+0xe8d/0x14f0 [ 69.510698][ T25] do_vfs_ioctl+0x977/0x14e0 [ 69.515274][ T25] ksys_ioctl+0xab/0xd0 [ 69.519432][ T25] __x64_sys_ioctl+0x73/0xb0 [ 69.524023][ T25] do_syscall_64+0xfa/0x790 [ 69.528528][ T25] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 69.534403][ T25] [ 69.536708][ T25] Freed by task 8605: [ 69.540664][ T25] save_stack+0x23/0x90 [ 69.544793][ T25] __kasan_slab_free+0x102/0x150 [ 69.549704][ T25] kasan_slab_free+0xe/0x10 [ 69.554185][ T25] kfree+0x10a/0x2c0 [ 69.558056][ T25] skb_free_head+0x93/0xb0 [ 69.562450][ T25] skb_release_data+0x551/0x8d0 [ 69.567278][ T25] skb_release_all+0x4d/0x60 [ 69.571843][ T25] consume_skb+0xfb/0x410 [ 69.576148][ T25] skb_free_datagram+0x1b/0x100 [ 69.580974][ T25] netlink_recvmsg+0x6c6/0xf50 [ 69.585746][ T25] sock_recvmsg+0xce/0x110 [ 69.590274][ T25] ____sys_recvmsg+0x236/0x550 [ 69.595019][ T25] ___sys_recvmsg+0xff/0x190 [ 69.599584][ T25] __sys_recvmsg+0x102/0x1d0 [ 69.604145][ T25] __x64_sys_recvmsg+0x78/0xb0 [ 69.608883][ T25] do_syscall_64+0xfa/0x790 [ 69.613362][ T25] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 69.619224][ T25] [ 69.621530][ T25] The buggy address belongs to the object at ffff8880993bc000 [ 69.621530][ T25] which belongs to the cache kmalloc-4k of size 4096 [ 69.635565][ T25] The buggy address is located 78 bytes to the right of [ 69.635565][ T25] 4096-byte region [ffff8880993bc000, ffff8880993bd000) [ 69.649351][ T25] The buggy address belongs to the page: [ 69.654980][ T25] page:ffffea000264ef00 refcount:1 mapcount:0 mapping:ffff8880aa402000 index:0x0 compound_mapcount: 0 [ 69.665903][ T25] raw: 00fffe0000010200 ffffea000262c288 ffffea00029bc908 ffff8880aa402000 [ 69.674481][ T25] raw: 0000000000000000 ffff8880993bc000 0000000100000001 0000000000000000 [ 69.683089][ T25] page dumped because: kasan: bad access detected [ 69.689480][ T25] [ 69.691788][ T25] Memory state around the buggy address: [ 69.697409][ T25] ffff8880993bcf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 69.705456][ T25] ffff8880993bcf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 69.713504][ T25] >ffff8880993bd000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 69.721662][ T25] ^ [ 69.728065][ T25] ffff8880993bd080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 69.736113][ T25] ffff8880993bd100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 69.744152][ T25] ================================================================== [ 69.752239][ T25] Disabling lock debugging due to kernel taint [ 69.758898][ T25] Kernel panic - not syncing: panic_on_warn set ... [ 69.765482][ T25] CPU: 1 PID: 25 Comm: kworker/u4:2 Tainted: G B 5.4.0-syzkaller #0 [ 69.774735][ T25] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 69.784775][ T25] Workqueue: events_unbound flush_to_ldisc [ 69.790664][ T25] Call Trace: [ 69.793984][ T25] dump_stack+0x197/0x210 [ 69.798293][ T25] panic+0x2e3/0x75c [ 69.802161][ T25] ? add_taint.cold+0x16/0x16 [ 69.806827][ T25] ? decode_data.part.0+0x23b/0x270 [ 69.812018][ T25] ? preempt_schedule+0x4b/0x60 [ 69.816857][ T25] ? ___preempt_schedule+0x16/0x18 [ 69.821954][ T25] ? trace_hardirqs_on+0x5e/0x240 [ 69.826959][ T25] ? decode_data.part.0+0x23b/0x270 [ 69.832138][ T25] end_report+0x47/0x4f [ 69.836276][ T25] ? decode_data.part.0+0x23b/0x270 [ 69.841457][ T25] __kasan_report.cold+0xe/0x41 [ 69.846288][ T25] ? decode_data.part.0+0x23b/0x270 [ 69.851459][ T25] kasan_report+0x12/0x20 [ 69.855766][ T25] __asan_report_store1_noabort+0x17/0x20 [ 69.861461][ T25] decode_data.part.0+0x23b/0x270 [ 69.866471][ T25] sixpack_receive_buf+0xde4/0x1420 [ 69.871695][ T25] ? sixpack_close+0x250/0x250 [ 69.876440][ T25] tty_ldisc_receive_buf+0x15f/0x1c0 [ 69.881700][ T25] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 69.887914][ T25] tty_port_default_receive_buf+0x7d/0xb0 [ 69.893607][ T25] flush_to_ldisc+0x222/0x390 [ 69.898260][ T25] process_one_work+0x9af/0x1740 [ 69.903191][ T25] ? pwq_dec_nr_in_flight+0x320/0x320 [ 69.908547][ T25] ? lock_acquire+0x190/0x410 [ 69.913224][ T25] worker_thread+0x98/0xe40 [ 69.917720][ T25] ? trace_hardirqs_on+0x67/0x240 [ 69.922723][ T25] kthread+0x361/0x430 [ 69.926766][ T25] ? process_one_work+0x1740/0x1740 [ 69.931938][ T25] ? kthread_mod_delayed_work+0x1f0/0x1f0 [ 69.937643][ T25] ret_from_fork+0x24/0x30 [ 69.943409][ T25] Kernel Offset: disabled [ 69.947730][ T25] Rebooting in 86400 seconds..