[ 83.553604][ T26] audit: type=1800 audit(1581580211.099:26): pid=9515 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 84.517877][ T26] kauditd_printk_skb: 2 callbacks suppressed [ 84.517892][ T26] audit: type=1800 audit(1581580212.079:29): pid=9515 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 84.545323][ T26] audit: type=1800 audit(1581580212.089:30): pid=9515 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.136' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 96.375752][ T9665] ================================================================== [ 96.375809][ T9665] BUG: KASAN: null-ptr-deref in do_con_trol+0x3b9/0x61b0 [ 96.375820][ T9665] Read of size 4294967294 at addr 0000000000000012 by task syz-executor381/9665 [ 96.375824][ T9665] [ 96.375848][ T9665] CPU: 0 PID: 9665 Comm: syz-executor381 Not tainted 5.6.0-rc1-next-20200213-syzkaller #0 [ 96.375857][ T9665] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 96.375862][ T9665] Call Trace: [ 96.375882][ T9665] dump_stack+0x197/0x210 [ 96.375899][ T9665] ? do_con_trol+0x3b9/0x61b0 [ 96.375915][ T9665] ? do_con_trol+0x3b9/0x61b0 [ 96.375934][ T9665] __kasan_report.cold+0x5/0x32 [ 96.375952][ T9665] ? __lock_acquire+0x1a40/0x6320 [ 96.375965][ T9665] ? do_con_trol+0x3b9/0x61b0 [ 96.375985][ T9665] kasan_report+0x12/0x20 [ 96.376002][ T9665] check_memory_region+0x134/0x1a0 [ 96.376021][ T9665] memcpy+0x24/0x50 [ 96.376041][ T9665] do_con_trol+0x3b9/0x61b0 [ 96.376067][ T9665] ? reset_palette+0x190/0x190 [ 96.376082][ T9665] ? notifier_call_chain+0x1e0/0x230 [ 96.376111][ T9665] ? __atomic_notifier_call_chain+0xf8/0x1a0 [ 96.376140][ T9665] do_con_write.part.0+0xfd9/0x1ef0 [ 96.376190][ T9665] ? do_con_trol+0x61b0/0x61b0 [ 96.376204][ T9665] ? _raw_spin_unlock_irqrestore+0x66/0xe0 [ 96.376216][ T9665] ? add_wait_queue+0x112/0x170 [ 96.376229][ T9665] ? _raw_spin_unlock_irqrestore+0x66/0xe0 [ 96.376250][ T9665] ? trace_hardirqs_on+0x67/0x240 [ 96.376281][ T9665] con_write+0x46/0xd0 [ 96.376302][ T9665] n_tty_write+0x40e/0x1080 [ 96.376346][ T9665] ? n_tty_read+0x1bf0/0x1bf0 [ 96.376367][ T9665] ? prepare_to_wait_exclusive+0x320/0x320 [ 96.376392][ T9665] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 96.376409][ T9665] ? _copy_from_user+0x12c/0x1a0 [ 96.376429][ T9665] tty_write+0x496/0x7f0 [ 96.376448][ T9665] ? n_tty_read+0x1bf0/0x1bf0 [ 96.376473][ T9665] __vfs_write+0x8a/0x110 [ 96.376486][ T9665] ? hung_up_tty_compat_ioctl+0x40/0x40 [ 96.376502][ T9665] vfs_write+0x268/0x5d0 [ 96.376524][ T9665] ksys_write+0x14f/0x290 [ 96.376544][ T9665] ? __ia32_sys_read+0xb0/0xb0 [ 96.376564][ T9665] ? do_syscall_64+0x26/0x790 [ 96.376581][ T9665] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 96.376596][ T9665] ? do_syscall_64+0x26/0x790 [ 96.376620][ T9665] __x64_sys_write+0x73/0xb0 [ 96.376641][ T9665] do_syscall_64+0xfa/0x790 [ 96.376665][ T9665] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 96.376676][ T9665] RIP: 0033:0x4404f9 [ 96.376691][ T9665] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b 14 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 96.376700][ T9665] RSP: 002b:00007ffe32aa67f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 96.376714][ T9665] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004404f9 [ 96.376723][ T9665] RDX: 0000000000000078 RSI: 0000000020000140 RDI: 0000000000000004 [ 96.376732][ T9665] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 96.376740][ T9665] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401de0 [ 96.376749][ T9665] R13: 0000000000401e70 R14: 0000000000000000 R15: 0000000000000000 [ 96.376785][ T9665] ================================================================== [ 96.376790][ T9665] Disabling lock debugging due to kernel taint [ 96.388544][ T9665] Kernel panic - not syncing: panic_on_warn set ... [ 96.388561][ T9665] CPU: 0 PID: 9665 Comm: syz-executor381 Tainted: G B 5.6.0-rc1-next-20200213-syzkaller #0 [ 96.388569][ T9665] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 96.388573][ T9665] Call Trace: [ 96.388592][ T9665] dump_stack+0x197/0x210 [ 96.388610][ T9665] panic+0x2e3/0x75c [ 96.388624][ T9665] ? add_taint.cold+0x16/0x16 [ 96.388641][ T9665] ? do_con_trol+0x3b9/0x61b0 [ 96.388655][ T9665] ? preempt_schedule+0x4b/0x60 [ 96.388670][ T9665] ? ___preempt_schedule+0x16/0x18 [ 96.388684][ T9665] ? trace_hardirqs_on+0x5e/0x240 [ 96.388699][ T9665] ? do_con_trol+0x3b9/0x61b0 [ 96.388714][ T9665] end_report+0x47/0x4f [ 96.388728][ T9665] ? do_con_trol+0x3b9/0x61b0 [ 96.388742][ T9665] __kasan_report.cold+0xe/0x32 [ 96.388757][ T9665] ? __lock_acquire+0x1a40/0x6320 [ 96.388770][ T9665] ? do_con_trol+0x3b9/0x61b0 [ 96.388786][ T9665] kasan_report+0x12/0x20 [ 96.388799][ T9665] check_memory_region+0x134/0x1a0 [ 96.388815][ T9665] memcpy+0x24/0x50 [ 96.388836][ T9665] do_con_trol+0x3b9/0x61b0 [ 96.388855][ T9665] ? reset_palette+0x190/0x190 [ 96.388870][ T9665] ? notifier_call_chain+0x1e0/0x230 [ 96.388891][ T9665] ? __atomic_notifier_call_chain+0xf8/0x1a0 [ 96.388913][ T9665] do_con_write.part.0+0xfd9/0x1ef0 [ 96.388942][ T9665] ? do_con_trol+0x61b0/0x61b0 [ 96.388955][ T9665] ? _raw_spin_unlock_irqrestore+0x66/0xe0 [ 96.388966][ T9665] ? add_wait_queue+0x112/0x170 [ 96.388979][ T9665] ? _raw_spin_unlock_irqrestore+0x66/0xe0 [ 96.388993][ T9665] ? trace_hardirqs_on+0x67/0x240 [ 96.389013][ T9665] con_write+0x46/0xd0 [ 96.389030][ T9665] n_tty_write+0x40e/0x1080 [ 96.389058][ T9665] ? n_tty_read+0x1bf0/0x1bf0 [ 96.389074][ T9665] ? prepare_to_wait_exclusive+0x320/0x320 [ 96.389092][ T9665] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 96.389107][ T9665] ? _copy_from_user+0x12c/0x1a0 [ 96.389122][ T9665] tty_write+0x496/0x7f0 [ 96.389139][ T9665] ? n_tty_read+0x1bf0/0x1bf0 [ 96.389158][ T9665] __vfs_write+0x8a/0x110 [ 96.389170][ T9665] ? hung_up_tty_compat_ioctl+0x40/0x40 [ 96.389183][ T9665] vfs_write+0x268/0x5d0 [ 96.389194][ T9665] ksys_write+0x14f/0x290 [ 96.389201][ T9665] ? __ia32_sys_read+0xb0/0xb0 [ 96.389211][ T9665] ? do_syscall_64+0x26/0x790 [ 96.389218][ T9665] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 96.389226][ T9665] ? do_syscall_64+0x26/0x790 [ 96.389245][ T9665] __x64_sys_write+0x73/0xb0 [ 96.389260][ T9665] do_syscall_64+0xfa/0x790 [ 96.389277][ T9665] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 96.389287][ T9665] RIP: 0033:0x4404f9 [ 96.389301][ T9665] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b 14 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 96.389306][ T9665] RSP: 002b:00007ffe32aa67f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 96.389314][ T9665] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004404f9 [ 96.389318][ T9665] RDX: 0000000000000078 RSI: 0000000020000140 RDI: 0000000000000004 [ 96.389322][ T9665] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 96.389326][ T9665] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401de0 [ 96.389330][ T9665] R13: 0000000000401e70 R14: 0000000000000000 R15: 0000000000000000 [ 96.390468][ T9665] Kernel Offset: disabled [ 97.035384][ T9665] Rebooting in 86400 seconds..