Starting System Logging Service... [ OK ] Started Daily Cleanup of Temporary Directories. [ OK ] Reached target Timers. [ OK ] Started Permit User Sessions. [ OK ] Started System Logging Service. [ OK ] Started OpenBSD Secure Shell server. [ OK ] Started getty on tty2-tty6 if dbus and logind are not available. [ OK ] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch. [ OK ] Started Getty on tty6. [ OK ] Started Getty on tty5. [ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Getty on tty1. [ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.1.41' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 60.959248][ T7167] ================================================================== [ 60.959292][ T7167] BUG: KASAN: slab-out-of-bounds in bit_putcs+0xc74/0xe10 [ 60.959300][ T7167] Read of size 1 at addr ffff8880a684953f by task syz-executor035/7167 [ 60.959302][ T7167] [ 60.959311][ T7167] CPU: 1 PID: 7167 Comm: syz-executor035 Not tainted 5.7.0-rc3-syzkaller #0 [ 60.959315][ T7167] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 60.959319][ T7167] Call Trace: [ 60.959331][ T7167] dump_stack+0x188/0x20d [ 60.959344][ T7167] print_address_description.constprop.0.cold+0xd3/0x315 [ 60.959352][ T7167] ? bit_putcs+0xc74/0xe10 [ 60.959359][ T7167] __kasan_report.cold+0x35/0x4d [ 60.959369][ T7167] ? bit_putcs+0xc74/0xe10 [ 60.959377][ T7167] ? bit_putcs+0xc74/0xe10 [ 60.959384][ T7167] kasan_report+0x33/0x50 [ 60.959393][ T7167] bit_putcs+0xc74/0xe10 [ 60.959411][ T7167] ? bit_cursor+0x1900/0x1900 [ 60.959420][ T7167] ? vesafb_probe.cold+0x1162/0x1162 [ 60.959430][ T7167] ? fb_get_color_depth.part.0+0xc6/0x1f0 [ 60.959440][ T7167] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 60.959450][ T7167] fbcon_putcs+0x345/0x3f0 [ 60.959459][ T7167] ? bit_cursor+0x1900/0x1900 [ 60.959469][ T7167] do_update_region+0x398/0x630 [ 60.959480][ T7167] ? con_get_trans_old+0x280/0x280 [ 60.959491][ T7167] ? fbcon_set_palette+0x3b1/0x4a0 [ 60.959498][ T7167] ? var_to_display+0x7f0/0x7f0 [ 60.959508][ T7167] redraw_screen+0x64c/0x770 [ 60.959516][ T7167] ? respond_string+0x290/0x290 [ 60.959529][ T7167] vc_do_resize+0xfe6/0x1340 [ 60.959546][ T7167] ? lock_downgrade+0x840/0x840 [ 60.959552][ T7167] ? rwlock_bug.part.0+0x90/0x90 [ 60.959559][ T7167] ? vt_console_print+0xdc0/0xdc0 [ 60.959572][ T7167] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 60.959583][ T7167] vt_ioctl+0x2062/0x26b0 [ 60.959591][ T7167] ? tomoyo_find_next_domain+0x730/0x1f6c [ 60.959598][ T7167] ? lockdep_hardirqs_on+0x463/0x620 [ 60.959606][ T7167] ? complete_change_console+0x3a0/0x3a0 [ 60.959615][ T7167] ? tomoyo_path_number_perm+0x238/0x4d0 [ 60.959623][ T7167] ? tomoyo_execute_permission+0x470/0x470 [ 60.959633][ T7167] ? trace_hardirqs_off+0x50/0x220 [ 60.959641][ T7167] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 60.959650][ T7167] ? complete_change_console+0x3a0/0x3a0 [ 60.959659][ T7167] tty_ioctl+0xedc/0x1440 [ 60.959667][ T7167] ? tty_vhangup+0x30/0x30 [ 60.959675][ T7167] ? do_vfs_ioctl+0x50c/0x1360 [ 60.959685][ T7167] ? ioctl_file_clone+0x180/0x180 [ 60.959694][ T7167] ? file_open_root+0x400/0x400 [ 60.959704][ T7167] ? up_read+0x1ab/0x750 [ 60.959717][ T7167] ? tty_vhangup+0x30/0x30 [ 60.959724][ T7167] ksys_ioctl+0x11a/0x180 [ 60.959740][ T7167] __x64_sys_ioctl+0x6f/0xb0 [ 60.959748][ T7167] ? lockdep_hardirqs_on+0x463/0x620 [ 60.959758][ T7167] do_syscall_64+0xf6/0x7d0 [ 60.959767][ T7167] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 60.959774][ T7167] RIP: 0033:0x440269 [ 60.959783][ T7167] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b 14 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 60.959788][ T7167] RSP: 002b:00007ffdbddc39a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 60.959795][ T7167] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440269 [ 60.959800][ T7167] RDX: 0000000020000040 RSI: 000000000000560a RDI: 0000000000000004 [ 60.959804][ T7167] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 60.959808][ T7167] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401b50 [ 60.959812][ T7167] R13: 0000000000401be0 R14: 0000000000000000 R15: 0000000000000000 [ 60.959823][ T7167] [ 60.959827][ T7167] Allocated by task 7167: [ 60.959835][ T7167] save_stack+0x1b/0x40 [ 60.959841][ T7167] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 60.959846][ T7167] __kmalloc+0x161/0x7a0 [ 60.959853][ T7167] fbcon_set_font+0x331/0x870 [ 60.959860][ T7167] con_font_op+0xd65/0x1160 [ 60.959866][ T7167] vt_ioctl+0xce5/0x26b0 [ 60.959871][ T7167] tty_ioctl+0xedc/0x1440 [ 60.959877][ T7167] ksys_ioctl+0x11a/0x180 [ 60.959883][ T7167] __x64_sys_ioctl+0x6f/0xb0 [ 60.959890][ T7167] do_syscall_64+0xf6/0x7d0 [ 60.959897][ T7167] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 60.959899][ T7167] [ 60.959902][ T7167] Freed by task 7084: [ 60.959908][ T7167] save_stack+0x1b/0x40 [ 60.959913][ T7167] __kasan_slab_free+0xf7/0x140 [ 60.959919][ T7167] kfree+0x109/0x2b0 [ 60.959927][ T7167] skb_free_head+0x8b/0xa0 [ 60.959934][ T7167] skb_release_data+0x42e/0x8b0 [ 60.959940][ T7167] skb_release_all+0x46/0x60 [ 60.959947][ T7167] consume_skb+0xf3/0x400 [ 60.959954][ T7167] netlink_unicast+0x53f/0x740 [ 60.959959][ T7167] netlink_sendmsg+0x882/0xe10 [ 60.959966][ T7167] sock_sendmsg+0xcf/0x120 [ 60.959973][ T7167] __sys_sendto+0x220/0x330 [ 60.959980][ T7167] __x64_sys_sendto+0xdd/0x1b0 [ 60.959986][ T7167] do_syscall_64+0xf6/0x7d0 [ 60.959993][ T7167] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 60.959995][ T7167] [ 60.960000][ T7167] The buggy address belongs to the object at ffff8880a6849400 [ 60.960000][ T7167] which belongs to the cache kmalloc-512 of size 512 [ 60.960006][ T7167] The buggy address is located 319 bytes inside of [ 60.960006][ T7167] 512-byte region [ffff8880a6849400, ffff8880a6849600) [ 60.960009][ T7167] The buggy address belongs to the page: [ 60.960018][ T7167] page:ffffea00029a1240 refcount:1 mapcount:0 mapping:0000000016f18d73 index:0xffff8880a6849c00 [ 60.960024][ T7167] flags: 0xfffe0000000200(slab) [ 60.960035][ T7167] raw: 00fffe0000000200 ffffea00028ab088 ffffea00029fbac8 ffff8880aa000a80 [ 60.960043][ T7167] raw: ffff8880a6849c00 ffff8880a6849000 0000000100000001 0000000000000000 [ 60.960046][ T7167] page dumped because: kasan: bad access detected [ 60.960048][ T7167] [ 60.960051][ T7167] Memory state around the buggy address: [ 60.960056][ T7167] ffff8880a6849400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 60.960062][ T7167] ffff8880a6849480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 60.960067][ T7167] >ffff8880a6849500: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 60.960070][ T7167] ^ [ 60.960076][ T7167] ffff8880a6849580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 60.960081][ T7167] ffff8880a6849600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 60.960084][ T7167] ================================================================== [ 60.960086][ T7167] Disabling lock debugging due to kernel taint [ 60.960090][ T7167] Kernel panic - not syncing: panic_on_warn set ... [ 60.960097][ T7167] CPU: 1 PID: 7167 Comm: syz-executor035 Tainted: G B 5.7.0-rc3-syzkaller #0 [ 60.960101][ T7167] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 60.960103][ T7167] Call Trace: [ 60.960110][ T7167] dump_stack+0x188/0x20d [ 60.960119][ T7167] panic+0x2e3/0x75c [ 60.960126][ T7167] ? add_taint.cold+0x16/0x16 [ 60.960134][ T7167] ? print_shadow_for_address+0xb8/0x114 [ 60.960140][ T7167] ? trace_hardirqs_on+0x55/0x220 [ 60.960147][ T7167] ? bit_putcs+0xc74/0xe10 [ 60.960154][ T7167] end_report+0x4d/0x53 [ 60.960160][ T7167] __kasan_report.cold+0xd/0x4d [ 60.960167][ T7167] ? bit_putcs+0xc74/0xe10 [ 60.960175][ T7167] ? bit_putcs+0xc74/0xe10 [ 60.960180][ T7167] kasan_report+0x33/0x50 [ 60.960187][ T7167] bit_putcs+0xc74/0xe10 [ 60.960199][ T7167] ? bit_cursor+0x1900/0x1900 [ 60.960206][ T7167] ? vesafb_probe.cold+0x1162/0x1162 [ 60.960213][ T7167] ? fb_get_color_depth.part.0+0xc6/0x1f0 [ 60.960220][ T7167] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 60.960228][ T7167] fbcon_putcs+0x345/0x3f0 [ 60.960235][ T7167] ? bit_cursor+0x1900/0x1900 [ 60.960242][ T7167] do_update_region+0x398/0x630 [ 60.960249][ T7167] ? con_get_trans_old+0x280/0x280 [ 60.960257][ T7167] ? fbcon_set_palette+0x3b1/0x4a0 [ 60.960263][ T7167] ? var_to_display+0x7f0/0x7f0 [ 60.960270][ T7167] redraw_screen+0x64c/0x770 [ 60.960277][ T7167] ? respond_string+0x290/0x290 [ 60.960285][ T7167] vc_do_resize+0xfe6/0x1340 [ 60.960295][ T7167] ? lock_downgrade+0x840/0x840 [ 60.960300][ T7167] ? rwlock_bug.part.0+0x90/0x90 [ 60.960307][ T7167] ? vt_console_print+0xdc0/0xdc0 [ 60.960314][ T7167] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 60.960322][ T7167] vt_ioctl+0x2062/0x26b0 [ 60.960328][ T7167] ? tomoyo_find_next_domain+0x730/0x1f6c [ 60.960334][ T7167] ? lockdep_hardirqs_on+0x463/0x620 [ 60.960341][ T7167] ? complete_change_console+0x3a0/0x3a0 [ 60.960348][ T7167] ? tomoyo_path_number_perm+0x238/0x4d0 [ 60.960355][ T7167] ? tomoyo_execute_permission+0x470/0x470 [ 60.960361][ T7167] ? trace_hardirqs_off+0x50/0x220 [ 60.960368][ T7167] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 60.960375][ T7167] ? complete_change_console+0x3a0/0x3a0 [ 60.960381][ T7167] tty_ioctl+0xedc/0x1440 [ 60.960387][ T7167] ? tty_vhangup+0x30/0x30 [ 60.960394][ T7167] ? do_vfs_ioctl+0x50c/0x1360 [ 60.960401][ T7167] ? ioctl_file_clone+0x180/0x180 [ 60.960407][ T7167] ? file_open_root+0x400/0x400 [ 60.960414][ T7167] ? up_read+0x1ab/0x750 [ 60.960422][ T7167] ? tty_vhangup+0x30/0x30 [ 60.960429][ T7167] ksys_ioctl+0x11a/0x180 [ 60.960436][ T7167] __x64_sys_ioctl+0x6f/0xb0 [ 60.960442][ T7167] ? lockdep_hardirqs_on+0x463/0x620 [ 60.960449][ T7167] do_syscall_64+0xf6/0x7d0 [ 60.960457][ T7167] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 60.960461][ T7167] RIP: 0033:0x440269 [ 60.960467][ T7167] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b 14 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 60.960470][ T7167] RSP: 002b:00007ffdbddc39a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 60.960476][ T7167] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440269 [ 60.960480][ T7167] RDX: 0000000020000040 RSI: 000000000000560a RDI: 0000000000000004 [ 60.960483][ T7167] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 60.960487][ T7167] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401b50 [ 60.960490][ T7167] R13: 0000000000401be0 R14: 0000000000000000 R15: 0000000000000000 [ 60.961658][ T7167] Kernel Offset: disabled [ 61.936406][ T7167] Rebooting in 86400 seconds..