[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.1.60' (ECDSA) to the list of known hosts. 2020/07/30 17:25:51 parsed 1 programs 2020/07/30 17:25:52 executed programs: 0 syzkaller login: [ 1045.305074][ T27] audit: type=1400 audit(1596129952.062:8): avc: denied { execmem } for pid=6844 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 1045.363127][ T6845] IPVS: ftp: loaded support on port[0] = 21 [ 1045.482688][ T6845] chnl_net:caif_netlink_parms(): no params data found [ 1045.541545][ T6845] bridge0: port 1(bridge_slave_0) entered blocking state [ 1045.549702][ T6845] bridge0: port 1(bridge_slave_0) entered disabled state [ 1045.559053][ T6845] device bridge_slave_0 entered promiscuous mode [ 1045.569035][ T6845] bridge0: port 2(bridge_slave_1) entered blocking state [ 1045.577720][ T6845] bridge0: port 2(bridge_slave_1) entered disabled state [ 1045.586398][ T6845] device bridge_slave_1 entered promiscuous mode [ 1045.611090][ T6845] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1045.623985][ T6845] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1045.648986][ T6845] team0: Port device team_slave_0 added [ 1045.656890][ T6845] team0: Port device team_slave_1 added [ 1045.682037][ T6845] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1045.689023][ T6845] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1045.715822][ T6845] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1045.729322][ T6845] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1045.737899][ T6845] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1045.769220][ T6845] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1045.834141][ T6845] device hsr_slave_0 entered promiscuous mode [ 1045.881006][ T6845] device hsr_slave_1 entered promiscuous mode [ 1046.028846][ T6845] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1046.074714][ T6845] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1046.153617][ T6845] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1046.213697][ T6845] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1046.288011][ T6845] bridge0: port 2(bridge_slave_1) entered blocking state [ 1046.295218][ T6845] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1046.303126][ T6845] bridge0: port 1(bridge_slave_0) entered blocking state [ 1046.310188][ T6845] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1046.355909][ T6845] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1046.369830][ T6815] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1046.380248][ T6815] bridge0: port 1(bridge_slave_0) entered disabled state [ 1046.388966][ T6815] bridge0: port 2(bridge_slave_1) entered disabled state [ 1046.397610][ T6815] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 1046.411254][ T6845] 8021q: adding VLAN 0 to HW filter on device team0 [ 1046.422895][ T2495] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1046.431710][ T2495] bridge0: port 1(bridge_slave_0) entered blocking state [ 1046.438740][ T2495] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1046.461324][ T2495] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1046.469664][ T2495] bridge0: port 2(bridge_slave_1) entered blocking state [ 1046.476771][ T2495] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1046.485231][ T2495] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1046.498661][ T36] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1046.507198][ T36] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1046.516296][ T36] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1046.528482][ T6815] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1046.538554][ T6815] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1046.550176][ T36] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1046.560937][ T36] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1046.573222][ T6845] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1046.594951][ T6815] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1046.602878][ T6815] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1046.616513][ T6845] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1046.634651][ T36] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1046.644044][ T36] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1046.662980][ T2495] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1046.672817][ T2495] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1046.682060][ T2495] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1046.689878][ T2495] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1046.702289][ T6845] device veth0_vlan entered promiscuous mode [ 1046.714276][ T6845] device veth1_vlan entered promiscuous mode [ 1046.734547][ T6815] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 1046.744326][ T6815] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 1046.752986][ T6815] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1046.761702][ T6815] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1046.772623][ T6845] device veth0_macvtap entered promiscuous mode [ 1046.783161][ T6845] device veth1_macvtap entered promiscuous mode [ 1046.800923][ T6845] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1046.808656][ T36] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1046.818140][ T36] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1046.826586][ T36] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1046.837613][ T36] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1046.849233][ T6845] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1046.857145][ T2495] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1046.866058][ T2495] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2020/07/30 17:25:57 executed programs: 20 [ 1050.814844][ T7190] ================================================================== [ 1050.815020][ T7190] BUG: KASAN: slab-out-of-bounds in vc_do_resize+0x9d6/0x13f0 [ 1050.815033][ T7190] Read of size 4 at addr ffff8880a871daa0 by task syz-executor.0/7190 [ 1050.815037][ T7190] [ 1050.815052][ T7190] CPU: 1 PID: 7190 Comm: syz-executor.0 Not tainted 5.8.0-rc7-syzkaller #0 [ 1050.815058][ T7190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1050.815101][ T7190] Call Trace: [ 1050.815185][ T7190] dump_stack+0x18f/0x20d [ 1050.815197][ T7190] ? vc_do_resize+0x9d6/0x13f0 [ 1050.815205][ T7190] ? vc_do_resize+0x9d6/0x13f0 [ 1050.815271][ T7190] print_address_description.constprop.0.cold+0xae/0x436 [ 1050.815370][ T7190] ? lockdep_hardirqs_off+0x66/0xa0 [ 1050.815406][ T7190] ? vprintk_func+0x97/0x1a6 [ 1050.815417][ T7190] ? vc_do_resize+0x9d6/0x13f0 [ 1050.815424][ T7190] kasan_report.cold+0x1f/0x37 [ 1050.815435][ T7190] ? vc_do_resize+0x9d6/0x13f0 [ 1050.815445][ T7190] check_memory_region+0x13d/0x180 [ 1050.815454][ T7190] memcpy+0x20/0x60 [ 1050.815464][ T7190] vc_do_resize+0x9d6/0x13f0 [ 1050.815483][ T7190] ? store_bind+0x6a0/0x6a0 [ 1050.815490][ T7190] ? memcpy+0x39/0x60 [ 1050.815535][ T7190] fbcon_modechanged+0x36c/0x710 [ 1050.815547][ T7190] fbcon_update_vcs+0x3a/0x50 [ 1050.815570][ T7190] fb_set_var+0xae8/0xd60 [ 1050.815581][ T7190] ? fb_blank+0x190/0x190 [ 1050.815602][ T7190] ? lock_release+0x8d0/0x8d0 [ 1050.815613][ T7190] ? lock_is_held_type+0xb0/0xe0 [ 1050.815629][ T7190] ? do_fb_ioctl+0x2f2/0x6c0 [ 1050.815663][ T7190] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 1050.815673][ T7190] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 1050.815728][ T7190] ? trace_hardirqs_on+0x5f/0x220 [ 1050.815740][ T7190] do_fb_ioctl+0x33f/0x6c0 [ 1050.815750][ T7190] ? fb_set_suspend+0x1a0/0x1a0 [ 1050.815788][ T7190] ? tomoyo_execute_permission+0x470/0x470 [ 1050.815798][ T7190] ? asm_sysvec_reschedule_ipi+0x12/0x20 [ 1050.815811][ T7190] ? lock_is_held_type+0xb0/0xe0 [ 1050.815869][ T7190] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 1050.815914][ T7190] ? do_vfs_ioctl+0x27d/0x1090 [ 1050.815961][ T7190] ? __fget_files+0x294/0x400 [ 1050.815975][ T7190] fb_ioctl+0xdd/0x130 [ 1050.815984][ T7190] ? do_fb_ioctl+0x6c0/0x6c0 [ 1050.815992][ T7190] ksys_ioctl+0x11a/0x180 [ 1050.816002][ T7190] __x64_sys_ioctl+0x6f/0xb0 [ 1050.816009][ T7190] ? lockdep_hardirqs_on+0x6a/0xe0 [ 1050.816019][ T7190] do_syscall_64+0x60/0xe0 [ 1050.816028][ T7190] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1050.816036][ T7190] RIP: 0033:0x45c429 [ 1050.816048][ T7190] Code: 8d b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1050.816053][ T7190] RSP: 002b:00007f73c4db1c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1050.816062][ T7190] RAX: ffffffffffffffda RBX: 000000000000d540 RCX: 000000000045c429 [ 1050.816067][ T7190] RDX: 0000000020000000 RSI: 0000000000004601 RDI: 0000000000000005 [ 1050.816073][ T7190] RBP: 000000000078bf40 R08: 0000000000000000 R09: 0000000000000000 [ 1050.816081][ T7190] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000078bf0c [ 1050.816089][ T7190] R13: 00007ffdce76309f R14: 00007f73c4db29c0 R15: 000000000078bf0c [ 1050.816107][ T7190] [ 1050.816182][ T7190] Allocated by task 6740: [ 1050.816215][ T7190] save_stack+0x1b/0x40 [ 1050.816223][ T7190] __kasan_kmalloc.constprop.0+0xc2/0xd0 [ 1050.816235][ T7190] __kmalloc+0x17a/0x340 [ 1050.816283][ T7190] kernfs_fop_write+0x345/0x490 [ 1050.816312][ T7190] vfs_write+0x2b0/0x6b0 [ 1050.816319][ T7190] ksys_write+0x12d/0x250 [ 1050.816327][ T7190] do_syscall_64+0x60/0xe0 [ 1050.816335][ T7190] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1050.816337][ T7190] [ 1050.816341][ T7190] Freed by task 6740: [ 1050.816349][ T7190] save_stack+0x1b/0x40 [ 1050.816355][ T7190] __kasan_slab_free+0xf5/0x140 [ 1050.816363][ T7190] kfree+0x103/0x2c0 [ 1050.816370][ T7190] kernfs_fop_write+0x300/0x490 [ 1050.816377][ T7190] vfs_write+0x2b0/0x6b0 [ 1050.816384][ T7190] ksys_write+0x12d/0x250 [ 1050.816392][ T7190] do_syscall_64+0x60/0xe0 [ 1050.816400][ T7190] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1050.816402][ T7190] [ 1050.816409][ T7190] The buggy address belongs to the object at ffff8880a871da80 [ 1050.816409][ T7190] which belongs to the cache kmalloc-32 of size 32 [ 1050.816416][ T7190] The buggy address is located 0 bytes to the right of [ 1050.816416][ T7190] 32-byte region [ffff8880a871da80, ffff8880a871daa0) [ 1050.816419][ T7190] The buggy address belongs to the page: [ 1050.816429][ T7190] page:ffffea0002a1c740 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880a871dfc1 [ 1050.816437][ T7190] flags: 0xfffe0000000200(slab) [ 1050.816450][ T7190] raw: 00fffe0000000200 ffffea0002a1f3c8 ffff8880aa001240 ffff8880aa0001c0 [ 1050.816459][ T7190] raw: ffff8880a871dfc1 ffff8880a871d000 0000000100000038 0000000000000000 [ 1050.816463][ T7190] page dumped because: kasan: bad access detected [ 1050.816466][ T7190] [ 1050.816469][ T7190] Memory state around the buggy address: [ 1050.816475][ T7190] ffff8880a871d980: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 1050.816482][ T7190] ffff8880a871da00: 00 04 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 1050.816488][ T7190] >ffff8880a871da80: fb fb fb fb fc fc fc fc 00 00 01 fc fc fc fc fc [ 1050.816492][ T7190] ^ [ 1050.816498][ T7190] ffff8880a871db00: 00 00 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 1050.816504][ T7190] ffff8880a871db80: 00 00 01 fc fc fc fc fc fb fb fb fb fc fc fc fc [ 1050.816508][ T7190] ================================================================== [ 1050.816511][ T7190] Disabling lock debugging due to kernel taint [ 1050.816516][ T7190] Kernel panic - not syncing: panic_on_warn set ... [ 1050.816525][ T7190] CPU: 1 PID: 7190 Comm: syz-executor.0 Tainted: G B 5.8.0-rc7-syzkaller #0 [ 1050.816529][ T7190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1050.816532][ T7190] Call Trace: [ 1050.816541][ T7190] dump_stack+0x18f/0x20d [ 1050.816551][ T7190] ? vc_do_resize+0x930/0x13f0 [ 1050.816601][ T7190] panic+0x2e3/0x75c [ 1050.816610][ T7190] ? __warn_printk+0xf3/0xf3 [ 1050.816619][ T7190] ? trace_hardirqs_on+0x55/0x220 [ 1050.816628][ T7190] ? vc_do_resize+0x9d6/0x13f0 [ 1050.816636][ T7190] ? vc_do_resize+0x9d6/0x13f0 [ 1050.816643][ T7190] end_report+0x4d/0x53 [ 1050.816650][ T7190] kasan_report.cold+0xd/0x37 [ 1050.816659][ T7190] ? vc_do_resize+0x9d6/0x13f0 [ 1050.816667][ T7190] check_memory_region+0x13d/0x180 [ 1050.816674][ T7190] memcpy+0x20/0x60 [ 1050.816683][ T7190] vc_do_resize+0x9d6/0x13f0 [ 1050.816695][ T7190] ? store_bind+0x6a0/0x6a0 [ 1050.816701][ T7190] ? memcpy+0x39/0x60 [ 1050.816712][ T7190] fbcon_modechanged+0x36c/0x710 [ 1050.816720][ T7190] fbcon_update_vcs+0x3a/0x50 [ 1050.816729][ T7190] fb_set_var+0xae8/0xd60 [ 1050.816737][ T7190] ? fb_blank+0x190/0x190 [ 1050.816745][ T7190] ? lock_release+0x8d0/0x8d0 [ 1050.816753][ T7190] ? lock_is_held_type+0xb0/0xe0 [ 1050.816764][ T7190] ? do_fb_ioctl+0x2f2/0x6c0 [ 1050.816775][ T7190] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 1050.816784][ T7190] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 1050.816791][ T7190] ? trace_hardirqs_on+0x5f/0x220 [ 1050.816800][ T7190] do_fb_ioctl+0x33f/0x6c0 [ 1050.816809][ T7190] ? fb_set_suspend+0x1a0/0x1a0 [ 1050.816818][ T7190] ? tomoyo_execute_permission+0x470/0x470 [ 1050.816827][ T7190] ? asm_sysvec_reschedule_ipi+0x12/0x20 [ 1050.816835][ T7190] ? lock_is_held_type+0xb0/0xe0 [ 1050.816846][ T7190] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 1050.816853][ T7190] ? do_vfs_ioctl+0x27d/0x1090 [ 1050.816864][ T7190] ? __fget_files+0x294/0x400 [ 1050.816874][ T7190] fb_ioctl+0xdd/0x130 [ 1050.816882][ T7190] ? do_fb_ioctl+0x6c0/0x6c0 [ 1050.816888][ T7190] ksys_ioctl+0x11a/0x180 [ 1050.816896][ T7190] __x64_sys_ioctl+0x6f/0xb0 [ 1050.816903][ T7190] ? lockdep_hardirqs_on+0x6a/0xe0 [ 1050.816911][ T7190] do_syscall_64+0x60/0xe0 [ 1050.816919][ T7190] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1050.816924][ T7190] RIP: 0033:0x45c429 [ 1050.816932][ T7190] Code: 8d b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1050.816936][ T7190] RSP: 002b:00007f73c4db1c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1050.816944][ T7190] RAX: ffffffffffffffda RBX: 000000000000d540 RCX: 000000000045c429 [ 1050.816948][ T7190] RDX: 0000000020000000 RSI: 0000000000004601 RDI: 0000000000000005 [ 1050.816952][ T7190] RBP: 000000000078bf40 R08: 0000000000000000 R09: 0000000000000000 [ 1050.816957][ T7190] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000078bf0c [ 1050.816961][ T7190] R13: 00007ffdce76309f R14: 00007f73c4db29c0 R15: 000000000078bf0c [ 1050.817919][ T7190] Kernel Offset: disabled [ 1051.677043][ T7190] Rebooting in 86400 seconds..