[ 41.657355] audit: type=1800 audit(1576562615.836:32): pid=7139 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op="collect_data" cause="failed(directio)" comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 41.683173] audit: type=1800 audit(1576562615.866:33): pid=7139 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op="collect_data" cause="failed(directio)" comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 49.832821] IPVS: Creating netns size=2712 id=1 [ 49.837713] IPVS: ftp: loaded support on port[0] = 21 [ 50.432135] audit: type=1400 audit(1576562624.616:34): avc: denied { create } for pid=7320 comm="syz-fuzzer" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_crypto_socket permissive=1 [ 50.456295] audit: type=1400 audit(1576562624.646:35): avc: denied { create } for pid=7320 comm="syz-fuzzer" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 50.481273] audit: type=1400 audit(1576562624.666:36): avc: denied { create } for pid=7320 comm="syz-fuzzer" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 Warning: Permanently added '10.128.10.38' (ECDSA) to the list of known hosts. 2019/12/17 06:03:51 parsed 1 programs 2019/12/17 06:03:51 executed programs: 0 [ 57.710636] IPv6: ADDRCONF(NETDEV_CHANGE): nr0: link becomes ready [ 57.721259] IPv6: ADDRCONF(NETDEV_CHANGE): nr3: link becomes ready [ 57.734033] IPv6: ADDRCONF(NETDEV_CHANGE): nr1: link becomes ready [ 57.743025] IPv6: ADDRCONF(NETDEV_CHANGE): nr4: link becomes ready [ 57.751090] IPv6: ADDRCONF(NETDEV_CHANGE): nr2: link becomes ready [ 57.758950] IPv6: ADDRCONF(NETDEV_CHANGE): nr5: link becomes ready [ 57.776304] IPVS: Creating netns size=2712 id=2 [ 57.781258] IPVS: ftp: loaded support on port[0] = 21 [ 57.847237] IPVS: Creating netns size=2712 id=3 [ 57.852395] IPVS: ftp: loaded support on port[0] = 21 [ 57.986642] chnl_net:caif_netlink_parms(): no params data found [ 58.026129] IPVS: Creating netns size=2712 id=4 [ 58.031819] IPVS: ftp: loaded support on port[0] = 21 [ 58.211713] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.218258] bridge0: port 1(bridge_slave_0) entered disabled state [ 58.227196] device bridge_slave_0 entered promiscuous mode [ 58.249595] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.255990] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.264988] device bridge_slave_1 entered promiscuous mode [ 58.338215] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 58.351060] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 58.361980] IPVS: Creating netns size=2712 id=5 [ 58.366816] IPVS: ftp: loaded support on port[0] = 21 [ 58.382937] chnl_net:caif_netlink_parms(): no params data found [ 58.563995] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 58.597716] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 58.684823] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.691299] bridge0: port 1(bridge_slave_0) entered disabled state [ 58.700567] device bridge_slave_0 entered promiscuous mode [ 58.713850] chnl_net:caif_netlink_parms(): no params data found [ 58.727473] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.734203] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.743214] device bridge_slave_1 entered promiscuous mode [ 58.756124] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 58.801168] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 58.821192] IPVS: Creating netns size=2712 id=6 [ 58.826017] IPVS: ftp: loaded support on port[0] = 21 [ 58.855769] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 58.867314] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 58.920388] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.926849] bridge0: port 1(bridge_slave_0) entered disabled state [ 58.935991] device bridge_slave_0 entered promiscuous mode [ 58.944324] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.951141] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.960435] device bridge_slave_1 entered promiscuous mode [ 59.082065] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 59.117144] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 59.148538] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 59.183422] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 59.321647] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 59.342671] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 59.356114] IPVS: Creating netns size=2712 id=7 [ 59.366601] IPVS: ftp: loaded support on port[0] = 21 [ 59.381361] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 59.388618] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 59.422006] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 59.466988] chnl_net:caif_netlink_parms(): no params data found [ 59.653998] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 59.662690] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 59.685489] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 59.764661] chnl_net:caif_netlink_parms(): no params data found [ 59.814040] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.821537] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.830889] device bridge_slave_0 entered promiscuous mode [ 59.860161] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.866605] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.875920] device bridge_slave_1 entered promiscuous mode [ 59.910771] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 59.990927] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 60.046062] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 60.198471] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.205394] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.214458] device bridge_slave_0 entered promiscuous mode [ 60.250893] 8021q: adding VLAN 0 to HW filter on device bond0 [ 60.270372] chnl_net:caif_netlink_parms(): no params data found [ 60.285030] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.291803] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.301098] device bridge_slave_1 entered promiscuous mode [ 60.339830] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 60.371513] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 60.383500] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 60.397275] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 60.406907] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 60.595414] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 60.611581] 8021q: adding VLAN 0 to HW filter on device bond0 [ 60.619677] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 60.626891] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.633717] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.643568] device bridge_slave_0 entered promiscuous mode [ 60.651182] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 60.659464] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 60.670099] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 60.699517] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.705907] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.715487] device bridge_slave_1 entered promiscuous mode [ 60.801804] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 60.817268] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 60.841037] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 60.855928] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 60.864994] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 60.902095] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 60.966034] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 60.975850] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.982295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.990070] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 60.997805] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.004187] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.018659] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 61.043992] 8021q: adding VLAN 0 to HW filter on device bond0 [ 61.053185] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 61.072938] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 61.087451] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 61.102799] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 61.112314] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 61.136070] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 61.144026] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 61.156328] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 61.164949] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.171367] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.178344] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 61.240336] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 61.272521] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 61.281074] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 61.292293] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 61.300390] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.306726] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.314190] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 61.347729] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 61.380000] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 61.387791] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.394169] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.420629] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 61.428045] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 61.436528] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.442917] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.471062] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 61.485094] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 61.536246] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 61.545197] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 61.564949] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 61.592795] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 61.602898] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 61.632280] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 61.664698] 8021q: adding VLAN 0 to HW filter on device bond0 [ 61.679880] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 61.696061] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 61.750429] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 61.764947] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 61.784916] 8021q: adding VLAN 0 to HW filter on device bond0 [ 61.816570] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 61.875264] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 61.905279] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 61.922638] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.929048] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.957731] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 61.966399] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 61.983816] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.990234] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.998926] audit: type=1400 audit(1576562636.176:37): avc: denied { associate } for pid=7422 comm="syz-executor.0" name="syz0" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1 [ 62.017972] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 62.031673] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 62.051543] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 62.088219] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 62.101406] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 62.111177] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.117543] bridge0: port 1(bridge_slave_0) entered forwarding state [ 62.138993] 8021q: adding VLAN 0 to HW filter on device bond0 [ 62.160831] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 62.168393] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 62.177529] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.183934] bridge0: port 2(bridge_slave_1) entered forwarding state [ 62.241687] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 62.267609] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 62.300645] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 62.320160] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 62.350344] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 62.371711] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 62.448271] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 62.458293] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.458347] bridge0: port 1(bridge_slave_0) entered forwarding state [ 62.483124] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 62.483890] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 62.484532] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.484588] bridge0: port 2(bridge_slave_1) entered forwarding state [ 62.565702] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 62.590581] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 62.620001] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready 2019/12/17 06:03:56 executed programs: 8 [ 62.671136] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready 2019/12/17 06:04:01 executed programs: 178 2019/12/17 06:04:06 executed programs: 379 2019/12/17 06:04:11 executed programs: 583 2019/12/17 06:04:16 executed programs: 760 ** 1992 printk messages dropped ** [ 85.854453] >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 85.854454] ^ [ 85.854455] ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc [ 85.854456] ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 85.854457] ================================================================== [ 85.854458] ================================================================== [ 85.854460] BUG: KASAN: use-after-free in fbcon_putcs+0x486/0x5a0 at addr ffff880126af7248 [ 85.854461] Read of size 2 by task syz-executor.1/11658 [ 85.854462] CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 [ 85.854463] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 85.854465] 1ffffffff0d9577e ffff8800a868f688 ffffffff82c4dd46 ffff8800ba6f4e40 [ 85.854468] ffff8800a868f718 ffff880126af7240 ffff88012bc00100 ffff8800a868f708 [ 85.854470] ffffffff81740207 0000000000000010 0000000100000000 0000000000000286 [ 85.854470] Call Trace: [ 85.854472] [] dump_stack+0xe6/0x120 [ 85.854474] [] kasan_report_error+0x1e7/0x5c0 [ 85.854477] [] __asan_report_load2_noabort+0x3e/0x40 [ 85.854479] [] ? fbcon_putcs+0x486/0x5a0 [ 85.854481] [] fbcon_putcs+0x486/0x5a0 [ 85.854483] [] ? bit_clear+0x6e0/0x6e0 [ 85.854484] [] fbcon_scrolldelta+0xc59/0x10a0 [ 85.854486] [] fbcon_set_origin+0x16/0x20 [ 85.854488] [] set_origin+0x2c7/0x390 [ 85.854491] [] vc_do_resize+0x781/0x1350 [ 85.854493] [] ? selinux_ipv4_output+0x120/0x120 [ 85.854495] [] ? vc_init+0x490/0x490 [ 85.854497] [] ? vt_ioctl+0x15c9/0x24e0 [ 85.854499] [] vc_resize+0x3d/0x60 [ 85.854502] [] ? console_lock+0x4a/0x70 [ 85.854504] [] vt_ioctl+0x162b/0x24e0 [ 85.854506] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 85.854508] [] ? complete_change_console+0x300/0x300 [ 85.854510] [] ? plist_del+0xe9/0x1d0 [ 85.854512] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.854514] [] ? avc_has_extended_perms+0x27b/0x10f0 [ 85.854516] [] ? avc_has_extended_perms+0x298/0x10f0 [ 85.854517] [] ? avc_has_extended_perms+0xa4/0x10f0 [ 85.854520] [] ? depot_save_stack+0x12f/0x480 [ 85.854522] [] tty_ioctl+0x5d4/0x20f0 [ 85.854523] [] ? no_tty+0x90/0x90 [ 85.854525] [] ? __lock_acquire+0xca1/0x5560 [ 85.854527] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.854529] [] ? __lock_acquire+0x1985/0x5560 [ 85.854531] [] ? ___might_sleep+0x331/0x440 [ 85.854533] [] ? __might_sleep+0x90/0x1a0 [ 85.854535] [] do_vfs_ioctl+0x17f/0xe70 [ 85.854537] [] ? selinux_file_ioctl+0x324/0x510 [ 85.854539] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 85.854541] [] ? __fget+0x1df/0x320 [ 85.854542] [] ? __fget+0x42/0x320 [ 85.854545] [] ? security_file_ioctl+0x6a/0xa0 [ 85.854546] [] SyS_ioctl+0x74/0x80 [ 85.854549] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.854550] Object at ffff880126af7240, in cache kmalloc-32 [ 85.854551] Object freed, allocated with size 14 bytes [ 85.854551] Allocation: [ 85.854552] PID = 11675 [ 85.854554] [] save_stack_trace+0x26/0x50 [ 85.854556] [] save_stack+0x46/0xd0 [ 85.854558] [] kasan_kmalloc+0xc9/0xe0 [ 85.854560] [] __kmalloc+0x169/0x6d0 [ 85.854562] [] vc_do_resize+0x1e9/0x1350 [ 85.854565] [] vc_resize+0x3d/0x60 [ 85.854567] [] vt_ioctl+0x162b/0x24e0 [ 85.854568] [] tty_ioctl+0x5d4/0x20f0 [ 85.854570] [] do_vfs_ioctl+0x17f/0xe70 [ 85.854572] [] SyS_ioctl+0x74/0x80 [ 85.854574] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.854575] Deallocation: [ 85.854575] PID = 11658 [ 85.854578] [] save_stack_trace+0x26/0x50 [ 85.854580] [] save_stack+0x46/0xd0 [ 85.854582] [] kasan_slab_free+0x9b/0xb0 [ 85.854584] [] kfree+0xe2/0x460 [ 85.854586] [] vc_do_resize+0x710/0x1350 [ 85.854588] [] vc_resize+0x3d/0x60 [ 85.854590] [] vt_ioctl+0x162b/0x24e0 [ 85.854592] [] tty_ioctl+0x5d4/0x20f0 [ 85.854594] [] do_vfs_ioctl+0x17f/0xe70 [ 85.854596] [] SyS_ioctl+0x74/0x80 [ 85.854598] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.854599] Memory state around the buggy address: [ 85.854600] ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc [ 85.854601] ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc [ 85.854602] >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 85.854603] ^ [ 85.854604] ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc [ 85.854605] ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 85.854605] ================================================================== [ 85.854606] ================================================================== [ 85.854608] BUG: KASAN: use-after-free in bit_putcs+0xce9/0xd20 at addr ffff880126af7248 [ 85.854609] Read of size 2 by task syz-executor.1/11658 [ 85.854610] CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 [ 85.854611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 85.854613] 1ffffffff0d9577e ffff8800a868f4c8 ffffffff82c4dd46 ffff880126af7248 [ 85.854615] ffff8800a868f558 ffff880126af7240 ffff88012bc00100 ffff8800a868f548 [ 85.854618] ffffffff81740207 ffff8800a868f4e8 0000000000000086 0000000000000286 [ 85.854618] Call Trace: [ 85.854620] [] dump_stack+0xe6/0x120 [ 85.854622] [] kasan_report_error+0x1e7/0x5c0 [ 85.854624] [] ? _raw_spin_unlock_irqrestore+0xa6/0xd0 [ 85.854626] [] ? down_trylock+0x50/0x70 [ 85.854629] [] __asan_report_load2_noabort+0x3e/0x40 [ 85.854630] [] ? bit_putcs+0xce9/0xd20 [ 85.854632] [] bit_putcs+0xce9/0xd20 [ 85.854633] [] ? vprintk_default+0x1a/0x20 [ 85.854635] [] ? vsprintf+0x20/0x20 [ 85.854637] [] ? bit_clear+0x6e0/0x6e0 [ 85.854639] [] ? kasan_report_error+0x46d/0x5c0 [ 85.854641] [] ? get_color+0x30/0x380 [ 85.854643] [] ? __asan_report_load2_noabort+0x3e/0x40 [ 85.854646] [] fbcon_putcs+0x374/0x5a0 [ 85.854647] [] ? bit_clear+0x6e0/0x6e0 [ 85.854649] [] fbcon_scrolldelta+0xc59/0x10a0 [ 85.854651] [] fbcon_set_origin+0x16/0x20 [ 85.854653] [] set_origin+0x2c7/0x390 [ 85.854656] [] vc_do_resize+0x781/0x1350 [ 85.854658] [] ? selinux_ipv4_output+0x120/0x120 [ 85.854661] [] ? vc_init+0x490/0x490 [ 85.854662] [] ? vt_ioctl+0x15c9/0x24e0 [ 85.854665] [] vc_resize+0x3d/0x60 [ 85.854667] [] ? console_lock+0x4a/0x70 [ 85.854669] [] vt_ioctl+0x162b/0x24e0 [ 85.854671] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 85.854673] [] ? complete_change_console+0x300/0x300 [ 85.854675] [] ? plist_del+0xe9/0x1d0 [ 85.854677] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.854679] [] ? avc_has_extended_perms+0x27b/0x10f0 [ 85.854681] [] ? avc_has_extended_perms+0x298/0x10f0 [ 85.854683] [] ? avc_has_extended_perms+0xa4/0x10f0 [ 85.854685] [] ? depot_save_stack+0x12f/0x480 [ 85.854687] [] tty_ioctl+0x5d4/0x20f0 [ 85.854688] [] ? no_tty+0x90/0x90 [ 85.854690] [] ? __lock_acquire+0xca1/0x5560 [ 85.854691] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.854693] [] ? __lock_acquire+0x1985/0x5560 [ 85.854695] [] ? ___might_sleep+0x331/0x440 [ 85.854698] [] ? __might_sleep+0x90/0x1a0 [ 85.854699] [] do_vfs_ioctl+0x17f/0xe70 [ 85.854702] [] ? selinux_file_ioctl+0x324/0x510 [ 85.854704] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 85.854705] [] ? __fget+0x1df/0x320 [ 85.854707] [] ? __fget+0x42/0x320 [ 85.854709] [] ? security_file_ioctl+0x6a/0xa0 [ 85.854711] [] SyS_ioctl+0x74/0x80 [ 85.854713] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.854714] Object at ffff880126af7240, in cache kmalloc-32 [ 85.854715] Object freed, allocated with size 14 bytes [ 85.854715] Allocation: [ 85.854716] PID = 11675 [ 85.854718] [] save_stack_trace+0x26/0x50 [ 85.854720] [] save_stack+0x46/0xd0 [ 85.854722] [] kasan_kmalloc+0xc9/0xe0 [ 85.854724] [] __kmalloc+0x169/0x6d0 [ 85.854727] [] vc_do_resize+0x1e9/0x1350 [ 85.854729] [] vc_resize+0x3d/0x60 [ 85.854731] [] vt_ioctl+0x162b/0x24e0 [ 85.854733] [] tty_ioctl+0x5d4/0x20f0 [ 85.854735] [] do_vfs_ioctl+0x17f/0xe70 [ 85.854736] [] SyS_ioctl+0x74/0x80 [ 85.854739] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.854739] Deallocation: [ 85.854740] PID = 11658 [ 85.854742] [] save_stack_trace+0x26/0x50 [ 85.854744] [] save_stack+0x46/0xd0 [ 85.854746] [] kasan_slab_free+0x9b/0xb0 [ 85.854748] [] kfree+0xe2/0x460 [ 85.854750] [] vc_do_resize+0x710/0x1350 [ 85.854753] [] vc_resize+0x3d/0x60 [ 85.854755] [] vt_ioctl+0x162b/0x24e0 [ 85.854756] [] tty_ioctl+0x5d4/0x20f0 [ 85.854758] [] do_vfs_ioctl+0x17f/0xe70 [ 85.854760] [] SyS_ioctl+0x74/0x80 [ 85.854763] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.854763] Memory state around the buggy address: [ 85.854764] ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc [ 85.854765] ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc [ 85.854767] >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 85.854767] ^ [ 85.854768] ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc [ 85.854770] ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 85.854770] ================================================================== [ 85.854771] ================================================================== [ 85.854772] BUG: KASAN: use-after-free in bit_putcs+0xc73/0xd20 at addr ffff880126af7248 [ 85.854773] Read of size 2 by task syz-executor.1/11658 [ 85.854775] CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 [ 85.854776] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 85.854778] 1ffffffff0d9577e ffff8800a868f4c8 ffffffff82c4dd46 ffff8800ba5cdf70 [ 85.854780] ffff8800a868f558 ffff880126af7240 ffff88012bc00100 ffff8800a868f548 [ 85.854783] ffffffff81740207 0000000000000010 0000000000000000 0000000000000286 [ 85.854783] Call Trace: [ 85.854785] [] dump_stack+0xe6/0x120 [ 85.854787] [] kasan_report_error+0x1e7/0x5c0 [ 85.854789] [] __asan_report_load2_noabort+0x3e/0x40 [ 85.854791] [] ? bit_putcs+0xc73/0xd20 [ 85.854792] [] bit_putcs+0xc73/0xd20 [ 85.854794] [] ? bit_clear+0x6e0/0x6e0 [ 85.854796] [] ? kasan_report_error+0x46d/0x5c0 [ 85.854799] [] ? get_color+0x30/0x380 [ 85.854801] [] ? __asan_report_load2_noabort+0x3e/0x40 [ 85.854803] [] fbcon_putcs+0x374/0x5a0 [ 85.854805] [] ? bit_clear+0x6e0/0x6e0 [ 85.854806] [] fbcon_scrolldelta+0xc59/0x10a0 [ 85.854808] [] fbcon_set_origin+0x16/0x20 [ 85.854811] [] set_origin+0x2c7/0x390 [ 85.854813] [] vc_do_resize+0x781/0x1350 [ 85.854816] [] ? selinux_ipv4_output+0x120/0x120 [ 85.854819] [] ? vc_init+0x490/0x490 [ 85.854821] [] ? vt_ioctl+0x15c9/0x24e0 [ 85.854824] [] vc_resize+0x3d/0x60 [ 85.854826] [] ? console_lock+0x4a/0x70 [ 85.854828] [] vt_ioctl+0x162b/0x24e0 [ 85.854830] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 85.854832] [] ? complete_change_console+0x300/0x300 [ 85.854834] [] ? plist_del+0xe9/0x1d0 [ 85.854836] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.854838] [] ? avc_has_extended_perms+0x27b/0x10f0 [ 85.854840] [] ? avc_has_extended_perms+0x298/0x10f0 [ 85.854841] [] ? avc_has_extended_perms+0xa4/0x10f0 [ 85.854844] [] ? depot_save_stack+0x12f/0x480 [ 85.854852] [] tty_ioctl+0x5d4/0x20f0 [ 85.854854] [] ? no_tty+0x90/0x90 [ 85.854855] [] ? __lock_acquire+0xca1/0x5560 [ 85.854857] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.854858] [] ? __lock_acquire+0x1985/0x5560 [ 85.854861] [] ? ___might_sleep+0x331/0x440 [ 85.854863] [] ? __might_sleep+0x90/0x1a0 [ 85.854865] [] do_vfs_ioctl+0x17f/0xe70 [ 85.854867] [] ? selinux_file_ioctl+0x324/0x510 [ 85.854869] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 85.854871] [] ? __fget+0x1df/0x320 [ 85.854872] [] ? __fget+0x42/0x320 [ 85.854875] [] ? security_file_ioctl+0x6a/0xa0 [ 85.854876] [] SyS_ioctl+0x74/0x80 [ 85.854879] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.854880] Object at ffff880126af7240, in cache kmalloc-32 [ 85.854881] Object freed, allocated with size 14 bytes [ 85.854881] Allocation: [ 85.854882] PID = 11675 [ 85.854884] [] save_stack_trace+0x26/0x50 [ 85.854886] [] save_stack+0x46/0xd0 [ 85.854888] [] kasan_kmalloc+0xc9/0xe0 [ 85.854890] [] __kmalloc+0x169/0x6d0 [ 85.854892] [] vc_do_resize+0x1e9/0x1350 [ 85.854895] [] vc_resize+0x3d/0x60 [ 85.854897] [] vt_ioctl+0x162b/0x24e0 [ 85.854898] [] tty_ioctl+0x5d4/0x20f0 [ 85.854900] [] do_vfs_ioctl+0x17f/0xe70 [ 85.854902] [] SyS_ioctl+0x74/0x80 [ 85.854904] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.854905] Deallocation: [ 85.854905] PID = 11658 [ 85.854907] [] save_stack_trace+0x26/0x50 [ 85.854909] [] save_stack+0x46/0xd0 [ 85.854912] [] kasan_slab_free+0x9b/0xb0 [ 85.854913] [] kfree+0xe2/0x460 [ 85.854916] [] vc_do_resize+0x710/0x1350 [ 85.854918] [] vc_resize+0x3d/0x60 [ 85.854920] [] vt_ioctl+0x162b/0x24e0 [ 85.854922] [] tty_ioctl+0x5d4/0x20f0 [ 85.854923] [] do_vfs_ioctl+0x17f/0xe70 [ 85.854925] [] SyS_ioctl+0x74/0x80 [ 85.854928] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.854928] Memory state around the buggy address: [ 85.854929] ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc [ 85.854930] ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc [ 85.854931] >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 85.854932] ^ [ 85.854933] ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc [ 85.854934] ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 85.854935] ================================================================== [ 85.855009] ================================================================== [ 85.855010] BUG: KASAN: use-after-free in fbcon_scrolldelta+0xfff/0x10a0 at addr ffff880126af724a [ 85.855011] Read of size 2 by task syz-executor.1/11658 [ 85.855013] CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 [ 85.855014] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 85.855016] 1ffffffff0d9577e ffff8800a868f700 ffffffff82c4dd46 ffff880126af724c [ 85.855018] ffff8800a868f790 ffff880126af7240 ffff88012bc00100 ffff8800a868f780 [ 85.855021] ffffffff81740207 ffffffff8174065e ffff8800ba6f4e40 0000000000000286 [ 85.855021] Call Trace: [ 85.855023] [] dump_stack+0xe6/0x120 [ 85.855025] [] kasan_report_error+0x1e7/0x5c0 [ 85.855027] [] ? __asan_report_load2_noabort+0x3e/0x40 [ 85.855034] [] ? fbcon_putcs+0x374/0x5a0 [ 85.855036] [] __asan_report_load2_noabort+0x3e/0x40 [ 85.855038] [] ? fbcon_scrolldelta+0xfff/0x10a0 [ 85.855039] [] fbcon_scrolldelta+0xfff/0x10a0 [ 85.855041] [] fbcon_set_origin+0x16/0x20 [ 85.855043] [] set_origin+0x2c7/0x390 [ 85.855045] [] vc_do_resize+0x781/0x1350 [ 85.855048] [] ? selinux_ipv4_output+0x120/0x120 [ 85.855050] [] ? vc_init+0x490/0x490 [ 85.855052] [] ? vt_ioctl+0x15c9/0x24e0 [ 85.855054] [] vc_resize+0x3d/0x60 [ 85.855057] [] ? console_lock+0x4a/0x70 [ 85.855058] [] vt_ioctl+0x162b/0x24e0 [ 85.855061] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 85.855063] [] ? complete_change_console+0x300/0x300 [ 85.855065] [] ? plist_del+0xe9/0x1d0 [ 85.855067] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.855069] [] ? avc_has_extended_perms+0x27b/0x10f0 [ 85.855071] [] ? avc_has_extended_perms+0x298/0x10f0 [ 85.855073] [] ? avc_has_extended_perms+0xa4/0x10f0 [ 85.855075] [] ? depot_save_stack+0x12f/0x480 [ 85.855077] [] tty_ioctl+0x5d4/0x20f0 [ 85.855079] [] ? no_tty+0x90/0x90 [ 85.855080] [] ? __lock_acquire+0xca1/0x5560 [ 85.855082] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.855083] [] ? __lock_acquire+0x1985/0x5560 [ 85.855086] [] ? ___might_sleep+0x331/0x440 [ 85.855088] [] ? __might_sleep+0x90/0x1a0 [ 85.855090] [] do_vfs_ioctl+0x17f/0xe70 [ 85.855092] [] ? selinux_file_ioctl+0x324/0x510 [ 85.855094] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 85.855095] [] ? __fget+0x1df/0x320 [ 85.855097] [] ? __fget+0x42/0x320 [ 85.855099] [] ? security_file_ioctl+0x6a/0xa0 [ 85.855101] [] SyS_ioctl+0x74/0x80 [ 85.855103] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.855105] Object at ffff880126af7240, in cache kmalloc-32 [ 85.855105] Object freed, allocated with size 14 bytes [ 85.855106] Allocation: [ 85.855106] PID = 11675 [ 85.855109] [] save_stack_trace+0x26/0x50 [ 85.855111] [] save_stack+0x46/0xd0 [ 85.855113] [] kasan_kmalloc+0xc9/0xe0 [ 85.855114] [] __kmalloc+0x169/0x6d0 [ 85.855117] [] vc_do_resize+0x1e9/0x1350 [ 85.855119] [] vc_resize+0x3d/0x60 [ 85.855121] [] vt_ioctl+0x162b/0x24e0 [ 85.855123] [] tty_ioctl+0x5d4/0x20f0 [ 85.855125] [] do_vfs_ioctl+0x17f/0xe70 [ 85.855127] [] SyS_ioctl+0x74/0x80 [ 85.855129] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.855129] Deallocation: [ 85.855130] PID = 11658 [ 85.855132] [] save_stack_trace+0x26/0x50 [ 85.855134] [] save_stack+0x46/0xd0 [ 85.855136] [] kasan_slab_free+0x9b/0xb0 [ 85.855138] [] kfree+0xe2/0x460 [ 85.855140] [] vc_do_resize+0x710/0x1350 [ 85.855143] [] vc_resize+0x3d/0x60 [ 85.855144] [] vt_ioctl+0x162b/0x24e0 [ 85.855146] [] tty_ioctl+0x5d4/0x20f0 [ 85.855148] [] do_vfs_ioctl+0x17f/0xe70 [ 85.855150] [] SyS_ioctl+0x74/0x80 [ 85.855152] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.855153] Memory state around the buggy address: [ 85.855154] ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc [ 85.855155] ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc [ 85.855156] >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 85.855157] ^ [ 85.855158] ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc [ 85.855159] ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 85.855159] ================================================================== [ 85.855160] ================================================================== [ 85.855163] BUG: KASAN: use-after-free in fbcon_putcs+0x471/0x5a0 at addr ffff880126af724a [ 85.855164] Read of size 2 by task syz-executor.1/11658 [ 85.855165] CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 [ 85.855166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 85.855168] 1ffffffff0d9577e ffff8800a868f688 ffffffff82c4dd46 ffff8800ba6f4e40 [ 85.855170] ffff8800a868f718 ffff880126af7240 ffff88012bc00100 ffff8800a868f708 [ 85.855173] ffffffff81740207 ffffffff8174048d 000000010000000d 0000000000000286 [ 85.855173] Call Trace: [ 85.855175] [] dump_stack+0xe6/0x120 [ 85.855177] [] kasan_report_error+0x1e7/0x5c0 [ 85.855180] [] ? kasan_report_error+0x46d/0x5c0 [ 85.855184] [] __asan_report_load2_noabort+0x3e/0x40 [ 85.855187] [] ? fbcon_putcs+0x471/0x5a0 [ 85.855190] [] fbcon_putcs+0x471/0x5a0 [ 85.855194] [] ? bit_clear+0x6e0/0x6e0 [ 85.855196] [] fbcon_scrolldelta+0xc59/0x10a0 [ 85.855199] [] fbcon_set_origin+0x16/0x20 [ 85.855203] [] set_origin+0x2c7/0x390 [ 85.855206] [] vc_do_resize+0x781/0x1350 [ 85.855210] [] ? selinux_ipv4_output+0x120/0x120 [ 85.855214] [] ? vc_init+0x490/0x490 [ 85.855217] [] ? vt_ioctl+0x15c9/0x24e0 [ 85.855220] [] vc_resize+0x3d/0x60 [ 85.855223] [] ? console_lock+0x4a/0x70 [ 85.855226] [] vt_ioctl+0x162b/0x24e0 [ 85.855230] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 85.855233] [] ? complete_change_console+0x300/0x300 [ 85.855236] [] ? plist_del+0xe9/0x1d0 [ 85.855239] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.855242] [] ? avc_has_extended_perms+0x27b/0x10f0 [ 85.855246] [] ? avc_has_extended_perms+0x298/0x10f0 [ 85.855248] [] ? avc_has_extended_perms+0xa4/0x10f0 [ 85.855252] [] ? depot_save_stack+0x12f/0x480 [ 85.855255] [] tty_ioctl+0x5d4/0x20f0 [ 85.855258] [] ? no_tty+0x90/0x90 [ 85.855261] [] ? __lock_acquire+0xca1/0x5560 [ 85.855264] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.855266] [] ? __lock_acquire+0x1985/0x5560 [ 85.855270] [] ? ___might_sleep+0x331/0x440 [ 85.855274] [] ? __might_sleep+0x90/0x1a0 [ 85.855277] [] do_vfs_ioctl+0x17f/0xe70 [ 85.855280] [] ? selinux_file_ioctl+0x324/0x510 [ 85.855283] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 85.855285] [] ? __fget+0x1df/0x320 [ 85.855287] [] ? __fget+0x42/0x320 [ 85.855289] [] ? security_file_ioctl+0x6a/0xa0 [ 85.855291] [] SyS_ioctl+0x74/0x80 [ 85.855293] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.855294] Object at ffff880126af7240, in cache kmalloc-32 [ 85.855295] Object freed, allocated with size 14 bytes [ 85.855296] Allocation: [ 85.855296] PID = 11675 [ 85.855299] [] save_stack_trace+0x26/0x50 [ 85.855301] [] save_stack+0x46/0xd0 [ 85.855303] [] kasan_kmalloc+0xc9/0xe0 [ 85.855305] [] __kmalloc+0x169/0x6d0 [ 85.855307] [] vc_do_resize+0x1e9/0x1350 [ 85.855309] [] vc_resize+0x3d/0x60 [ 85.855311] [] vt_ioctl+0x162b/0x24e0 [ 85.855313] [] tty_ioctl+0x5d4/0x20f0 [ 85.855315] [] do_vfs_ioctl+0x17f/0xe70 [ 85.855317] [] SyS_ioctl+0x74/0x80 [ 85.855319] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.855320] Deallocation: [ 85.855320] PID = 11658 [ 85.855323] [] save_stack_trace+0x26/0x50 [ 85.855325] [] save_stack+0x46/0xd0 [ 85.855327] [] kasan_slab_free+0x9b/0xb0 [ 85.855328] [] kfree+0xe2/0x460 [ 85.855331] [] vc_do_resize+0x710/0x1350 [ 85.855333] [] vc_resize+0x3d/0x60 [ 85.855335] [] vt_ioctl+0x162b/0x24e0 [ 85.855337] [] tty_ioctl+0x5d4/0x20f0 [ 85.855339] [] do_vfs_ioctl+0x17f/0xe70 [ 85.855340] [] SyS_ioctl+0x74/0x80 [ 85.855343] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.855343] Memory state around the buggy address: [ 85.855344] ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc [ 85.855346] ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc [ 85.855347] >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 85.855347] ^ [ 85.855348] ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc [ 85.855350] ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 85.855350] ================================================================== [ 85.855351] ================================================================== [ 85.855353] BUG: KASAN: use-after-free in fbcon_putcs+0x486/0x5a0 at addr ffff880126af724a [ 85.855354] Read of size 2 by task syz-executor.1/11658 [ 85.855356] CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 [ 85.855357] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 85.855359] 1ffffffff0d9577e ffff8800a868f688 ffffffff82c4dd46 ffff8800ba6f4e40 [ 85.855361] ffff8800a868f718 ffff880126af7240 ffff88012bc00100 ffff8800a868f708 [ 85.855364] ffffffff81740207 0000000000000010 0000000100000000 0000000000000286 [ 85.855364] Call Trace: [ 85.855366] [] dump_stack+0xe6/0x120 [ 85.855368] [] kasan_report_error+0x1e7/0x5c0 [ 85.855370] [] __asan_report_load2_noabort+0x3e/0x40 [ 85.855373] [] ? fbcon_putcs+0x486/0x5a0 [ 85.855375] [] fbcon_putcs+0x486/0x5a0 [ 85.855376] [] ? bit_clear+0x6e0/0x6e0 [ 85.855378] [] fbcon_scrolldelta+0xc59/0x10a0 [ 85.855380] [] fbcon_set_origin+0x16/0x20 [ 85.855382] [] set_origin+0x2c7/0x390 [ 85.855384] [] vc_do_resize+0x781/0x1350 [ 85.855387] [] ? selinux_ipv4_output+0x120/0x120 [ 85.855389] [] ? vc_init+0x490/0x490 [ 85.855391] [] ? vt_ioctl+0x15c9/0x24e0 [ 85.855393] [] vc_resize+0x3d/0x60 [ 85.855396] [] ? console_lock+0x4a/0x70 [ 85.855397] [] vt_ioctl+0x162b/0x24e0 [ 85.855400] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 85.855402] [] ? complete_change_console+0x300/0x300 [ 85.855404] [] ? plist_del+0xe9/0x1d0 [ 85.855406] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.855408] [] ? avc_has_extended_perms+0x27b/0x10f0 [ 85.855410] [] ? avc_has_extended_perms+0x298/0x10f0 [ 85.855411] [] ? avc_has_extended_perms+0xa4/0x10f0 [ 85.855414] [] ? depot_save_stack+0x12f/0x480 [ 85.855415] [] tty_ioctl+0x5d4/0x20f0 [ 85.855417] [] ? no_tty+0x90/0x90 [ 85.855419] [] ? __lock_acquire+0xca1/0x5560 [ 85.855420] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.855422] [] ? __lock_acquire+0x1985/0x5560 [ 85.855424] [] ? ___might_sleep+0x331/0x440 [ 85.855427] [] ? __might_sleep+0x90/0x1a0 [ 85.855428] [] do_vfs_ioctl+0x17f/0xe70 [ 85.855431] [] ? selinux_file_ioctl+0x324/0x510 [ 85.855432] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 85.855434] [] ? __fget+0x1df/0x320 [ 85.855435] [] ? __fget+0x42/0x320 [ 85.855438] [] ? security_file_ioctl+0x6a/0xa0 [ 85.855440] [] SyS_ioctl+0x74/0x80 [ 85.855442] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.855443] Object at ffff880126af7240, in cache kmalloc-32 [ 85.855444] Object freed, allocated with size 14 bytes [ 85.855444] Allocation: [ 85.855445] PID = 11675 [ 85.855447] [] save_stack_trace+0x26/0x50 [ 85.855449] [] save_stack+0x46/0xd0 [ 85.855451] [] kasan_kmalloc+0xc9/0xe0 [ 85.855453] [] __kmalloc+0x169/0x6d0 [ 85.855456] [] vc_do_resize+0x1e9/0x1350 [ 85.855458] [] vc_resize+0x3d/0x60 [ 85.855460] [] vt_ioctl+0x162b/0x24e0 [ 85.855462] [] tty_ioctl+0x5d4/0x20f0 [ 85.855464] [] do_vfs_ioctl+0x17f/0xe70 [ 85.855465] [] SyS_ioctl+0x74/0x80 [ 85.855468] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.855468] Deallocation: [ 85.855469] PID = 11658 [ 85.855471] [] save_stack_trace+0x26/0x50 [ 85.855473] [] save_stack+0x46/0xd0 [ 85.855475] [] kasan_slab_free+0x9b/0xb0 [ 85.855477] [] kfree+0xe2/0x460 [ 85.855479] [] vc_do_resize+0x710/0x1350 [ 85.855482] [] vc_resize+0x3d/0x60 [ 85.855484] [] vt_ioctl+0x162b/0x24e0 [ 85.855485] [] tty_ioctl+0x5d4/0x20f0 [ 85.855487] [] do_vfs_ioctl+0x17f/0xe70 [ 85.855489] [] SyS_ioctl+0x74/0x80 [ 85.855491] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.855492] Memory state around the buggy address: [ 85.855493] ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc [ 85.855494] ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc [ 85.855495] >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 85.855496] ^ [ 85.855497] ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc [ 85.855498] ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 85.855499] ================================================================== [ 85.855499] ================================================================== [ 85.855501] BUG: KASAN: use-after-free in bit_putcs+0xce9/0xd20 at addr ffff880126af724a [ 85.855502] Read of size 2 by task syz-executor.1/11658 [ 85.855503] CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 [ 85.855504] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 85.855507] 1ffffffff0d9577e ffff8800a868f4c8 ffffffff82c4dd46 ffff880126af724a [ 85.855509] ffff8800a868f558 ffff880126af7240 ffff88012bc00100 ffff8800a868f548 [ 85.855511] ffffffff81740207 ffff8800a868f4e8 0000000000000086 0000000000000286 [ 85.855512] Call Trace: [ 85.855513] [] dump_stack+0xe6/0x120 [ 85.855516] [] kasan_report_error+0x1e7/0x5c0 [ 85.855518] [] ? _raw_spin_unlock_irqrestore+0xa6/0xd0 [ 85.855520] [] ? down_trylock+0x50/0x70 [ 85.855522] [] __asan_report_load2_noabort+0x3e/0x40 [ 85.855524] [] ? bit_putcs+0xce9/0xd20 [ 85.855525] [] bit_putcs+0xce9/0xd20 [ 85.855527] [] ? vprintk_default+0x1a/0x20 [ 85.855529] [] ? vsprintf+0x20/0x20 [ 85.855531] [] ? bit_clear+0x6e0/0x6e0 [ 85.855533] [] ? kasan_report_error+0x46d/0x5c0 [ 85.855535] [] ? get_color+0x30/0x380 [ 85.855537] [] ? __asan_report_load2_noabort+0x3e/0x40 [ 85.855540] [] fbcon_putcs+0x374/0x5a0 [ 85.855541] [] ? bit_clear+0x6e0/0x6e0 [ 85.855543] [] fbcon_scrolldelta+0xc59/0x10a0 [ 85.855545] [] fbcon_set_origin+0x16/0x20 [ 85.855547] [] set_origin+0x2c7/0x390 [ 85.855549] [] vc_do_resize+0x781/0x1350 [ 85.855551] [] ? selinux_ipv4_output+0x120/0x120 [ 85.855554] [] ? vc_init+0x490/0x490 [ 85.855556] [] ? vt_ioctl+0x15c9/0x24e0 [ 85.855558] [] vc_resize+0x3d/0x60 [ 85.855560] [] ? console_lock+0x4a/0x70 [ 85.855562] [] vt_ioctl+0x162b/0x24e0 [ 85.855565] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 85.855567] [] ? complete_change_console+0x300/0x300 [ 85.855569] [] ? plist_del+0xe9/0x1d0 [ 85.855570] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.855572] [] ? avc_has_extended_perms+0x27b/0x10f0 [ 85.855574] [] ? avc_has_extended_perms+0x298/0x10f0 [ 85.855576] [] ? avc_has_extended_perms+0xa4/0x10f0 [ 85.855578] [] ? depot_save_stack+0x12f/0x480 [ 85.855580] [] tty_ioctl+0x5d4/0x20f0 [ 85.855582] [] ? no_tty+0x90/0x90 [ 85.855583] [] ? __lock_acquire+0xca1/0x5560 [ 85.855585] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.855586] [] ? __lock_acquire+0x1985/0x5560 [ 85.855589] [] ? ___might_sleep+0x331/0x440 [ 85.855591] [] ? __might_sleep+0x90/0x1a0 [ 85.855593] [] do_vfs_ioctl+0x17f/0xe70 [ 85.855595] [] ? selinux_file_ioctl+0x324/0x510 [ 85.855597] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 85.855598] [] ? __fget+0x1df/0x320 [ 85.855600] [] ? __fget+0x42/0x320 [ 85.855602] [] ? security_file_ioctl+0x6a/0xa0 [ 85.855604] [] SyS_ioctl+0x74/0x80 [ 85.855606] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.855608] Object at ffff880126af7240, in cache kmalloc-32 [ 85.855608] Object freed, allocated with size 14 bytes [ 85.855609] Allocation: [ 85.855609] PID = 11675 [ 85.855611] [] save_stack_trace+0x26/0x50 [ 85.855613] [] save_stack+0x46/0xd0 [ 85.855615] [] kasan_kmalloc+0xc9/0xe0 [ 85.855617] [] __kmalloc+0x169/0x6d0 [ 85.855620] [] vc_do_resize+0x1e9/0x1350 [ 85.855622] [] vc_resize+0x3d/0x60 [ 85.855624] [] vt_ioctl+0x162b/0x24e0 [ 85.855626] [] tty_ioctl+0x5d4/0x20f0 [ 85.855628] [] do_vfs_ioctl+0x17f/0xe70 [ 85.855630] [] SyS_ioctl+0x74/0x80 [ 85.855632] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.855633] Deallocation: [ 85.855633] PID = 11658 [ 85.855635] [] save_stack_trace+0x26/0x50 [ 85.855637] [] save_stack+0x46/0xd0 [ 85.855639] [] kasan_slab_free+0x9b/0xb0 [ 85.855641] [] kfree+0xe2/0x460 [ 85.855644] [] vc_do_resize+0x710/0x1350 [ 85.855646] [] vc_resize+0x3d/0x60 [ 85.855648] [] vt_ioctl+0x162b/0x24e0 [ 85.855650] [] tty_ioctl+0x5d4/0x20f0 [ 85.855652] [] do_vfs_ioctl+0x17f/0xe70 [ 85.855654] [] SyS_ioctl+0x74/0x80 [ 85.855656] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.855656] Memory state around the buggy address: [ 85.855658] ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc [ 85.855659] ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc [ 85.855660] >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 85.855661] ^ [ 85.855662] ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc [ 85.855663] ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 85.855663] ================================================================== [ 85.855664] ================================================================== [ 85.855666] BUG: KASAN: use-after-free in bit_putcs+0xc73/0xd20 at addr ffff880126af724a [ 85.855667] Read of size 2 by task syz-executor.1/11658 [ 85.855668] CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 [ 85.855669] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 85.855671] 1ffffffff0d9577e ffff8800a868f4c8 ffffffff82c4dd46 ffff8800ba5cdf80 [ 85.855674] ffff8800a868f558 ffff880126af7240 ffff88012bc00100 ffff8800a868f548 [ 85.855676] ffffffff81740207 0000000000000010 0000000000000000 0000000000000286 [ 85.855676] Call Trace: [ 85.855678] [] dump_stack+0xe6/0x120 [ 85.855680] [] kasan_report_error+0x1e7/0x5c0 [ 85.855682] [] __asan_report_load2_noabort+0x3e/0x40 [ 85.855684] [] ? bit_putcs+0xc73/0xd20 [ 85.855685] [] bit_putcs+0xc73/0xd20 [ 85.855687] [] ? bit_clear+0x6e0/0x6e0 [ 85.855689] [] ? kasan_report_error+0x46d/0x5c0 [ 85.855692] [] ? get_color+0x30/0x380 [ 85.855694] [] ? __asan_report_load2_noabort+0x3e/0x40 [ 85.855696] [] fbcon_putcs+0x374/0x5a0 [ 85.855698] [] ? bit_clear+0x6e0/0x6e0 [ 85.855699] [] fbcon_scrolldelta+0xc59/0x10a0 [ 85.855701] [] fbcon_set_origin+0x16/0x20 [ 85.855703] [] set_origin+0x2c7/0x390 [ 85.855706] [] vc_do_resize+0x781/0x1350 [ 85.855708] [] ? selinux_ipv4_output+0x120/0x120 [ 85.855711] [] ? vc_init+0x490/0x490 [ 85.855712] [] ? vt_ioctl+0x15c9/0x24e0 [ 85.855715] [] vc_resize+0x3d/0x60 [ 85.855717] [] ? console_lock+0x4a/0x70 [ 85.855719] [] vt_ioctl+0x162b/0x24e0 [ 85.855721] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 85.855723] [] ? complete_change_console+0x300/0x300 [ 85.855725] [] ? plist_del+0xe9/0x1d0 [ 85.855727] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.855729] [] ? avc_has_extended_perms+0x27b/0x10f0 [ 85.855731] [] ? avc_has_extended_perms+0x298/0x10f0 [ 85.855733] [] ? avc_has_extended_perms+0xa4/0x10f0 [ 85.855735] [] ? depot_save_stack+0x12f/0x480 [ 85.855737] [] tty_ioctl+0x5d4/0x20f0 [ 85.855738] [] ? no_tty+0x90/0x90 [ 85.855740] [] ? __lock_acquire+0xca1/0x5560 [ 85.855742] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.855743] [] ? __lock_acquire+0x1985/0x5560 [ 85.855746] [] ? ___might_sleep+0x331/0x440 [ 85.855748] [] ? __might_sleep+0x90/0x1a0 [ 85.855750] [] do_vfs_ioctl+0x17f/0xe70 [ 85.855752] [] ? selinux_file_ioctl+0x324/0x510 [ 85.855754] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 85.855755] [] ? __fget+0x1df/0x320 [ 85.855757] [] ? __fget+0x42/0x320 [ 85.855759] [] ? security_file_ioctl+0x6a/0xa0 [ 85.855761] [] SyS_ioctl+0x74/0x80 [ 85.855764] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.855765] Object at ffff880126af7240, in cache kmalloc-32 [ 85.855765] Object freed, allocated with size 14 bytes [ 85.855766] Allocation: [ 85.855766] PID = 11675 [ 85.855769] [] save_stack_trace+0x26/0x50 [ 85.855771] [] save_stack+0x46/0xd0 [ 85.855773] [] kasan_kmalloc+0xc9/0xe0 [ 85.855775] [] __kmalloc+0x169/0x6d0 [ 85.855777] [] vc_do_resize+0x1e9/0x1350 [ 85.855780] [] vc_resize+0x3d/0x60 [ 85.855782] [] vt_ioctl+0x162b/0x24e0 [ 85.855783] [] tty_ioctl+0x5d4/0x20f0 [ 85.855785] [] do_vfs_ioctl+0x17f/0xe70 [ 85.855787] [] SyS_ioctl+0x74/0x80 [ 85.855789] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.855790] Deallocation: [ 85.855790] PID = 11658 [ 85.855793] [] save_stack_trace+0x26/0x50 [ 85.855795] [] save_stack+0x46/0xd0 [ 85.855797] [] kasan_slab_free+0x9b/0xb0 [ 85.855798] [] kfree+0xe2/0x460 [ 85.855801] [] vc_do_resize+0x710/0x1350 [ 85.855803] [] vc_resize+0x3d/0x60 [ 85.855805] [] vt_ioctl+0x162b/0x24e0 [ 85.855807] [] tty_ioctl+0x5d4/0x20f0 [ 85.855809] [] do_vfs_ioctl+0x17f/0xe70 [ 85.855811] [] SyS_ioctl+0x74/0x80 [ 85.855813] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.855814] Memory state around the buggy address: [ 85.855815] ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc [ 85.855816] ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc [ 85.855817] >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 85.855818] ^ [ 85.855819] ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc [ 85.855820] ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 85.855820] ================================================================== [ 85.855894] ================================================================== [ 85.855895] BUG: KASAN: use-after-free in fbcon_scrolldelta+0xfff/0x10a0 at addr ffff880126af724c [ 85.855896] Read of size 2 by task syz-executor.1/11658 [ 85.855898] CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 [ 85.855899] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 85.855901] 1ffffffff0d9577e ffff8800a868f700 ffffffff82c4dd46 ffff880126af724e [ 85.855903] ffff8800a868f790 ffff880126af7240 ffff88012bc00100 ffff8800a868f780 [ 85.855906] ffffffff81740207 ffffffff8174065e ffff8800ba6f4e40 0000000000000286 [ 85.855906] Call Trace: [ 85.855908] [] dump_stack+0xe6/0x120 [ 85.855916] [] kasan_report_error+0x1e7/0x5c0 [ 85.855919] [] ? __asan_report_load2_noabort+0x3e/0x40 [ 85.855921] [] ? fbcon_putcs+0x374/0x5a0 [ 85.855923] [] __asan_report_load2_noabort+0x3e/0x40 [ 85.855925] [] ? fbcon_scrolldelta+0xfff/0x10a0 [ 85.855926] [] fbcon_scrolldelta+0xfff/0x10a0 [ 85.855928] [] fbcon_set_origin+0x16/0x20 [ 85.855930] [] set_origin+0x2c7/0x390 [ 85.855933] [] vc_do_resize+0x781/0x1350 [ 85.855935] [] ? selinux_ipv4_output+0x120/0x120 [ 85.855938] [] ? vc_init+0x490/0x490 [ 85.855939] [] ? vt_ioctl+0x15c9/0x24e0 [ 85.855942] [] vc_resize+0x3d/0x60 [ 85.855944] [] ? console_lock+0x4a/0x70 [ 85.855946] [] vt_ioctl+0x162b/0x24e0 [ 85.855948] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 85.855950] [] ? complete_change_console+0x300/0x300 [ 85.855952] [] ? plist_del+0xe9/0x1d0 [ 85.855954] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.855956] [] ? avc_has_extended_perms+0x27b/0x10f0 [ 85.855958] [] ? avc_has_extended_perms+0x298/0x10f0 [ 85.855960] [] ? avc_has_extended_perms+0xa4/0x10f0 [ 85.855962] [] ? depot_save_stack+0x12f/0x480 [ 85.855964] [] tty_ioctl+0x5d4/0x20f0 [ 85.855965] [] ? no_tty+0x90/0x90 [ 85.855967] [] ? __lock_acquire+0xca1/0x5560 [ 85.855969] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.855970] [] ? __lock_acquire+0x1985/0x5560 [ 85.855973] [] ? ___might_sleep+0x331/0x440 [ 85.855975] [] ? __might_sleep+0x90/0x1a0 [ 85.855977] [] do_vfs_ioctl+0x17f/0xe70 [ 85.855979] [] ? selinux_file_ioctl+0x324/0x510 [ 85.855981] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 85.855982] [] ? __fget+0x1df/0x320 [ 85.855984] [] ? __fget+0x42/0x320 [ 85.855986] [] ? security_file_ioctl+0x6a/0xa0 [ 85.855988] [] SyS_ioctl+0x74/0x80 [ 85.855990] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.855991] Object at ffff880126af7240, in cache kmalloc-32 [ 85.855992] Object freed, allocated with size 14 bytes [ 85.855992] Allocation: [ 85.855993] PID = 11675 [ 85.855995] [] save_stack_trace+0x26/0x50 [ 85.855997] [] save_stack+0x46/0xd0 [ 85.855999] [] kasan_kmalloc+0xc9/0xe0 [ 85.856001] [] __kmalloc+0x169/0x6d0 [ 85.856004] [] vc_do_resize+0x1e9/0x1350 [ 85.856006] [] vc_resize+0x3d/0x60 [ 85.856008] [] vt_ioctl+0x162b/0x24e0 [ 85.856010] [] tty_ioctl+0x5d4/0x20f0 [ 85.856012] [] do_vfs_ioctl+0x17f/0xe70 [ 85.856013] [] SyS_ioctl+0x74/0x80 [ 85.856016] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.856016] Deallocation: [ 85.856017] PID = 11658 [ 85.856019] [] save_stack_trace+0x26/0x50 [ 85.856021] [] save_stack+0x46/0xd0 [ 85.856023] [] kasan_slab_free+0x9b/0xb0 [ 85.856025] [] kfree+0xe2/0x460 [ 85.856027] [] vc_do_resize+0x710/0x1350 [ 85.856034] [] vc_resize+0x3d/0x60 [ 85.856036] [] vt_ioctl+0x162b/0x24e0 [ 85.856037] [] tty_ioctl+0x5d4/0x20f0 [ 85.856039] [] do_vfs_ioctl+0x17f/0xe70 [ 85.856041] [] SyS_ioctl+0x74/0x80 [ 85.856043] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.856044] Memory state around the buggy address: [ 85.856045] ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc [ 85.856046] ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc [ 85.856047] >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 85.856048] ^ [ 85.856049] ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc [ 85.856050] ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 85.856051] ================================================================== [ 85.856052] ================================================================== [ 85.856054] BUG: KASAN: use-after-free in fbcon_putcs+0x471/0x5a0 at addr ffff880126af724c [ 85.856055] Read of size 2 by task syz-executor.1/11658 [ 85.856057] CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 [ 85.856057] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 85.856060] 1ffffffff0d9577e ffff8800a868f688 ffffffff82c4dd46 ffff8800ba6f4e40 [ 85.856062] ffff8800a868f718 ffff880126af7240 ffff88012bc00100 ffff8800a868f708 [ 85.856064] ffffffff81740207 ffffffff8174048d 000000010000000d 0000000000000286 [ 85.856065] Call Trace: [ 85.856067] [] dump_stack+0xe6/0x120 [ 85.856069] [] kasan_report_error+0x1e7/0x5c0 [ 85.856071] [] ? kasan_report_error+0x46d/0x5c0 [ 85.856073] [] __asan_report_load2_noabort+0x3e/0x40 [ 85.856075] [] ? fbcon_putcs+0x471/0x5a0 [ 85.856077] [] fbcon_putcs+0x471/0x5a0 [ 85.856079] [] ? bit_clear+0x6e0/0x6e0 [ 85.856081] [] fbcon_scrolldelta+0xc59/0x10a0 [ 85.856082] [] fbcon_set_origin+0x16/0x20 [ 85.856085] [] set_origin+0x2c7/0x390 [ 85.856087] [] vc_do_resize+0x781/0x1350 [ 85.856089] [] ? selinux_ipv4_output+0x120/0x120 [ 85.856092] [] ? vc_init+0x490/0x490 [ 85.856093] [] ? vt_ioctl+0x15c9/0x24e0 [ 85.856096] [] vc_resize+0x3d/0x60 [ 85.856098] [] ? console_lock+0x4a/0x70 [ 85.856100] [] vt_ioctl+0x162b/0x24e0 [ 85.856102] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 85.856104] [] ? complete_change_console+0x300/0x300 [ 85.856106] [] ? plist_del+0xe9/0x1d0 [ 85.856108] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.856110] [] ? avc_has_extended_perms+0x27b/0x10f0 [ 85.856112] [] ? avc_has_extended_perms+0x298/0x10f0 [ 85.856114] [] ? avc_has_extended_perms+0xa4/0x10f0 [ 85.856116] [] ? depot_save_stack+0x12f/0x480 [ 85.856118] [] tty_ioctl+0x5d4/0x20f0 [ 85.856119] [] ? no_tty+0x90/0x90 [ 85.856121] [] ? __lock_acquire+0xca1/0x5560 [ 85.856123] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.856124] [] ? __lock_acquire+0x1985/0x5560 [ 85.856127] [] ? ___might_sleep+0x331/0x440 [ 85.856129] [] ? __might_sleep+0x90/0x1a0 [ 85.856131] [] do_vfs_ioctl+0x17f/0xe70 [ 85.856133] [] ? selinux_file_ioctl+0x324/0x510 [ 85.856135] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 85.856136] [] ? __fget+0x1df/0x320 [ 85.856138] [] ? __fget+0x42/0x320 [ 85.856140] [] ? security_file_ioctl+0x6a/0xa0 [ 85.856142] [] SyS_ioctl+0x74/0x80 [ 85.856144] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.856145] Object at ffff880126af7240, in cache kmalloc-32 [ 85.856146] Object freed, allocated with size 14 bytes [ 85.856147] Allocation: [ 85.856147] PID = 11675 [ 85.856149] [] save_stack_trace+0x26/0x50 [ 85.856151] [] save_stack+0x46/0xd0 [ 85.856153] [] kasan_kmalloc+0xc9/0xe0 [ 85.856155] [] __kmalloc+0x169/0x6d0 [ 85.856158] [] vc_do_resize+0x1e9/0x1350 [ 85.856160] [] vc_resize+0x3d/0x60 [ 85.856162] [] vt_ioctl+0x162b/0x24e0 [ 85.856164] [] tty_ioctl+0x5d4/0x20f0 [ 85.856166] [] do_vfs_ioctl+0x17f/0xe70 [ 85.856168] [] SyS_ioctl+0x74/0x80 [ 85.856170] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.856171] Deallocation: [ 85.856171] PID = 11658 [ 85.856173] [] save_stack_trace+0x26/0x50 [ 85.856176] [] save_stack+0x46/0xd0 [ 85.856178] [] kasan_slab_free+0x9b/0xb0 [ 85.856179] [] kfree+0xe2/0x460 [ 85.856182] [] vc_do_resize+0x710/0x1350 [ 85.856184] [] vc_resize+0x3d/0x60 [ 85.856186] [] vt_ioctl+0x162b/0x24e0 [ 85.856188] [] tty_ioctl+0x5d4/0x20f0 [ 85.856190] [] do_vfs_ioctl+0x17f/0xe70 [ 85.856192] [] SyS_ioctl+0x74/0x80 [ 85.856194] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.856195] Memory state around the buggy address: [ 85.856196] ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc [ 85.856197] ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc [ 85.856198] >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 85.856199] ^ [ 85.856200] ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc [ 85.856201] ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 85.856201] ================================================================== [ 85.856202] ================================================================== [ 85.856204] BUG: KASAN: use-after-free in fbcon_putcs+0x486/0x5a0 at addr ffff880126af724c [ 85.856205] Read of size 2 by task syz-executor.1/11658 [ 85.856207] CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 [ 85.856207] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 85.856210] 1ffffffff0d9577e ffff8800a868f688 ffffffff82c4dd46 ffff8800ba6f4e40 [ 85.856212] ffff8800a868f718 ffff880126af7240 ffff88012bc00100 ffff8800a868f708 [ 85.856214] ffffffff81740207 0000000000000010 0000000100000000 0000000000000286 [ 85.856215] Call Trace: [ 85.856217] [] dump_stack+0xe6/0x120 [ 85.856219] [] kasan_report_error+0x1e7/0x5c0 [ 85.856221] [] __asan_report_load2_noabort+0x3e/0x40 [ 85.856223] [] ? fbcon_putcs+0x486/0x5a0 [ 85.856225] [] fbcon_putcs+0x486/0x5a0 [ 85.856227] [] ? bit_clear+0x6e0/0x6e0 [ 85.856229] [] fbcon_scrolldelta+0xc59/0x10a0 [ 85.856231] [] fbcon_set_origin+0x16/0x20 [ 85.856233] [] set_origin+0x2c7/0x390 [ 85.856235] [] vc_do_resize+0x781/0x1350 [ 85.856237] [] ? selinux_ipv4_output+0x120/0x120 [ 85.856240] [] ? vc_init+0x490/0x490 [ 85.856242] [] ? vt_ioctl+0x15c9/0x24e0 [ 85.856244] [] vc_resize+0x3d/0x60 [ 85.856246] [] ? console_lock+0x4a/0x70 [ 85.856248] [] vt_ioctl+0x162b/0x24e0 [ 85.856250] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 85.856252] [] ? complete_change_console+0x300/0x300 [ 85.856254] [] ? plist_del+0xe9/0x1d0 [ 85.856256] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.856258] [] ? avc_has_extended_perms+0x27b/0x10f0 [ 85.856260] [] ? avc_has_extended_perms+0x298/0x10f0 [ 85.856262] [] ? avc_has_extended_perms+0xa4/0x10f0 [ 85.856264] [] ? depot_save_stack+0x12f/0x480 [ 85.856266] [] tty_ioctl+0x5d4/0x20f0 [ 85.856268] [] ? no_tty+0x90/0x90 [ 85.856269] [] ? __lock_acquire+0xca1/0x5560 [ 85.856271] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.856273] [] ? __lock_acquire+0x1985/0x5560 [ 85.856277] [] ? ___might_sleep+0x331/0x440 [ 85.856280] [] ? __might_sleep+0x90/0x1a0 [ 85.856283] [] do_vfs_ioctl+0x17f/0xe70 [ 85.856286] [] ? selinux_file_ioctl+0x324/0x510 [ 85.856290] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 85.856292] [] ? __fget+0x1df/0x320 [ 85.856295] [] ? __fget+0x42/0x320 [ 85.856299] [] ? security_file_ioctl+0x6a/0xa0 [ 85.856302] [] SyS_ioctl+0x74/0x80 [ 85.856306] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.856308] Object at ffff880126af7240, in cache kmalloc-32 [ 85.856309] Object freed, allocated with size 14 bytes [ 85.856310] Allocation: [ 85.856311] PID = 11675 [ 85.856314] [] save_stack_trace+0x26/0x50 [ 85.856317] [] save_stack+0x46/0xd0 [ 85.856320] [] kasan_kmalloc+0xc9/0xe0 [ 85.856323] [] __kmalloc+0x169/0x6d0 [ 85.856327] [] vc_do_resize+0x1e9/0x1350 [ 85.856331] [] vc_resize+0x3d/0x60 [ 85.856334] [] vt_ioctl+0x162b/0x24e0 [ 85.856337] [] tty_ioctl+0x5d4/0x20f0 [ 85.856340] [] do_vfs_ioctl+0x17f/0xe70 [ 85.856343] [] SyS_ioctl+0x74/0x80 [ 85.856347] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.856348] Deallocation: [ 85.856349] PID = 11658 [ 85.856352] [] save_stack_trace+0x26/0x50 [ 85.856356] [] save_stack+0x46/0xd0 [ 85.856359] [] kasan_slab_free+0x9b/0xb0 [ 85.856362] [] kfree+0xe2/0x460 [ 85.856366] [] vc_do_resize+0x710/0x1350 [ 85.856369] [] vc_resize+0x3d/0x60 [ 85.856373] [] vt_ioctl+0x162b/0x24e0 [ 85.856375] [] tty_ioctl+0x5d4/0x20f0 [ 85.856378] [] do_vfs_ioctl+0x17f/0xe70 [ 85.856380] [] SyS_ioctl+0x74/0x80 [ 85.856383] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.856383] Memory state around the buggy address: [ 85.856385] ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc [ 85.856386] ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc [ 85.856387] >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 85.856388] ^ [ 85.856389] ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc [ 85.856390] ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 85.856391] ================================================================== [ 85.856391] ================================================================== [ 85.856393] BUG: KASAN: use-after-free in bit_putcs+0xce9/0xd20 at addr ffff880126af724c [ 85.856394] Read of size 2 by task syz-executor.1/11658 [ 85.856396] CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 [ 85.856396] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 85.856399] 1ffffffff0d9577e ffff8800a868f4c8 ffffffff82c4dd46 ffff880126af724c [ 85.856401] ffff8800a868f558 ffff880126af7240 ffff88012bc00100 ffff8800a868f548 [ 85.856403] ffffffff81740207 ffff8800a868f4e8 0000000000000086 0000000000000286 [ 85.856404] Call Trace: [ 85.856406] [] dump_stack+0xe6/0x120 [ 85.856408] [] kasan_report_error+0x1e7/0x5c0 [ 85.856410] [] ? _raw_spin_unlock_irqrestore+0xa6/0xd0 [ 85.856412] [] ? down_trylock+0x50/0x70 [ 85.856414] [] __asan_report_load2_noabort+0x3e/0x40 [ 85.856416] [] ? bit_putcs+0xce9/0xd20 [ 85.856418] [] bit_putcs+0xce9/0xd20 [ 85.856419] [] ? vprintk_default+0x1a/0x20 [ 85.856421] [] ? vsprintf+0x20/0x20 [ 85.856423] [] ? bit_clear+0x6e0/0x6e0 [ 85.856425] [] ? kasan_report_error+0x46d/0x5c0 [ 85.856427] [] ? get_color+0x30/0x380 [ 85.856429] [] ? __asan_report_load2_noabort+0x3e/0x40 [ 85.856431] [] fbcon_putcs+0x374/0x5a0 [ 85.856433] [] ? bit_clear+0x6e0/0x6e0 [ 85.856435] [] fbcon_scrolldelta+0xc59/0x10a0 [ 85.856436] [] fbcon_set_origin+0x16/0x20 [ 85.856439] [] set_origin+0x2c7/0x390 [ 85.856441] [] vc_do_resize+0x781/0x1350 [ 85.856443] [] ? selinux_ipv4_output+0x120/0x120 [ 85.856446] [] ? vc_init+0x490/0x490 [ 85.856448] [] ? vt_ioctl+0x15c9/0x24e0 [ 85.856450] [] vc_resize+0x3d/0x60 [ 85.856452] [] ? console_lock+0x4a/0x70 [ 85.856454] [] vt_ioctl+0x162b/0x24e0 [ 85.856456] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 85.856458] [] ? complete_change_console+0x300/0x300 [ 85.856460] [] ? plist_del+0xe9/0x1d0 [ 85.856462] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.856464] [] ? avc_has_extended_perms+0x27b/0x10f0 [ 85.856466] [] ? avc_has_extended_perms+0x298/0x10f0 [ 85.856468] [] ? avc_has_extended_perms+0xa4/0x10f0 [ 85.856470] [] ? depot_save_stack+0x12f/0x480 [ 85.856472] [] tty_ioctl+0x5d4/0x20f0 [ 85.856474] [] ? no_tty+0x90/0x90 [ 85.856475] [] ? __lock_acquire+0xca1/0x5560 [ 85.856477] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.856478] [] ? __lock_acquire+0x1985/0x5560 [ 85.856481] [] ? ___might_sleep+0x331/0x440 [ 85.856483] [] ? __might_sleep+0x90/0x1a0 [ 85.856485] [] do_vfs_ioctl+0x17f/0xe70 [ 85.856487] [] ? selinux_file_ioctl+0x324/0x510 [ 85.856489] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 85.856490] [] ? __fget+0x1df/0x320 [ 85.856492] [] ? __fget+0x42/0x320 [ 85.856494] [] ? security_file_ioctl+0x6a/0xa0 [ 85.856496] [] SyS_ioctl+0x74/0x80 [ 85.856498] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.856499] Object at ffff880126af7240, in cache kmalloc-32 [ 85.856500] Object freed, allocated with size 14 bytes [ 85.856500] Allocation: [ 85.856501] PID = 11675 [ 85.856503] [] save_stack_trace+0x26/0x50 [ 85.856505] [] save_stack+0x46/0xd0 [ 85.856507] [] kasan_kmalloc+0xc9/0xe0 [ 85.856509] [] __kmalloc+0x169/0x6d0 [ 85.856512] [] vc_do_resize+0x1e9/0x1350 [ 85.856514] [] vc_resize+0x3d/0x60 [ 85.856516] [] vt_ioctl+0x162b/0x24e0 [ 85.856518] [] tty_ioctl+0x5d4/0x20f0 [ 85.856520] [] do_vfs_ioctl+0x17f/0xe70 [ 85.856522] [] SyS_ioctl+0x74/0x80 [ 85.856524] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.856525] Deallocation: [ 85.856525] PID = 11658 [ 85.856527] [] save_stack_trace+0x26/0x50 [ 85.856529] [] save_stack+0x46/0xd0 [ 85.856531] [] kasan_slab_free+0x9b/0xb0 [ 85.856533] [] kfree+0xe2/0x460 [ 85.856536] [] vc_do_resize+0x710/0x1350 [ 85.856538] [] vc_resize+0x3d/0x60 [ 85.856540] [] vt_ioctl+0x162b/0x24e0 [ 85.856542] [] tty_ioctl+0x5d4/0x20f0 [ 85.856544] [] do_vfs_ioctl+0x17f/0xe70 [ 85.856546] [] SyS_ioctl+0x74/0x80 [ 85.856548] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.856549] Memory state around the buggy address: [ 85.856550] ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc [ 85.856551] ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc [ 85.856552] >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 85.856553] ^ [ 85.856554] ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc [ 85.856555] ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 85.856556] ================================================================== [ 85.856556] ================================================================== [ 85.856558] BUG: KASAN: use-after-free in bit_putcs+0xc73/0xd20 at addr ffff880126af724c [ 85.856559] Read of size 2 by task syz-executor.1/11658 [ 85.856560] CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 [ 85.856561] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 85.856564] 1ffffffff0d9577e ffff8800a868f4c8 ffffffff82c4dd46 ffff8800ba5cdf90 [ 85.856566] ffff8800a868f558 ffff880126af7240 ffff88012bc00100 ffff8800a868f548 [ 85.856568] ffffffff81740207 0000000000000010 0000000000000000 0000000000000286 [ 85.856569] Call Trace: [ 85.856570] [] dump_stack+0xe6/0x120 [ 85.856572] [] kasan_report_error+0x1e7/0x5c0 [ 85.856575] [] __asan_report_load2_noabort+0x3e/0x40 [ 85.856576] [] ? bit_putcs+0xc73/0xd20 [ 85.856578] [] bit_putcs+0xc73/0xd20 [ 85.856580] [] ? bit_clear+0x6e0/0x6e0 [ 85.856582] [] ? kasan_report_error+0x46d/0x5c0 [ 85.856584] [] ? get_color+0x30/0x380 [ 85.856586] [] ? __asan_report_load2_noabort+0x3e/0x40 [ 85.856589] [] fbcon_putcs+0x374/0x5a0 [ 85.856590] [] ? bit_clear+0x6e0/0x6e0 [ 85.856592] [] fbcon_scrolldelta+0xc59/0x10a0 [ 85.856594] [] fbcon_set_origin+0x16/0x20 [ 85.856596] [] set_origin+0x2c7/0x390 [ 85.856598] [] vc_do_resize+0x781/0x1350 [ 85.856600] [] ? selinux_ipv4_output+0x120/0x120 [ 85.856603] [] ? vc_init+0x490/0x490 [ 85.856605] [] ? vt_ioctl+0x15c9/0x24e0 [ 85.856607] [] vc_resize+0x3d/0x60 [ 85.856609] [] ? console_lock+0x4a/0x70 [ 85.856611] [] vt_ioctl+0x162b/0x24e0 [ 85.856614] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 85.856616] [] ? complete_change_console+0x300/0x300 [ 85.856618] [] ? plist_del+0xe9/0x1d0 [ 85.856619] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.856621] [] ? avc_has_extended_perms+0x27b/0x10f0 [ 85.856623] [] ? avc_has_extended_perms+0x298/0x10f0 [ 85.856625] [] ? avc_has_extended_perms+0xa4/0x10f0 [ 85.856627] [] ? depot_save_stack+0x12f/0x480 [ 85.856629] [] tty_ioctl+0x5d4/0x20f0 [ 85.856631] [] ? no_tty+0x90/0x90 [ 85.856632] [] ? __lock_acquire+0xca1/0x5560 [ 85.856634] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.856636] [] ? __lock_acquire+0x1985/0x5560 [ 85.856638] [] ? ___might_sleep+0x331/0x440 [ 85.856640] [] ? __might_sleep+0x90/0x1a0 [ 85.856642] [] do_vfs_ioctl+0x17f/0xe70 [ 85.856644] [] ? selinux_file_ioctl+0x324/0x510 [ 85.856646] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 85.856648] [] ? __fget+0x1df/0x320 [ 85.856649] [] ? __fget+0x42/0x320 [ 85.856652] [] ? security_file_ioctl+0x6a/0xa0 [ 85.856653] [] SyS_ioctl+0x74/0x80 [ 85.856656] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.856657] Object at ffff880126af7240, in cache kmalloc-32 [ 85.856658] Object freed, allocated with size 14 bytes [ 85.856658] Allocation: [ 85.856659] PID = 11675 [ 85.856661] [] save_stack_trace+0x26/0x50 [ 85.856663] [] save_stack+0x46/0xd0 [ 85.856665] [] kasan_kmalloc+0xc9/0xe0 [ 85.856667] [] __kmalloc+0x169/0x6d0 [ 85.856669] [] vc_do_resize+0x1e9/0x1350 [ 85.856672] [] vc_resize+0x3d/0x60 [ 85.856674] [] vt_ioctl+0x162b/0x24e0 [ 85.856676] [] tty_ioctl+0x5d4/0x20f0 [ 85.856677] [] do_vfs_ioctl+0x17f/0xe70 [ 85.856679] [] SyS_ioctl+0x74/0x80 [ 85.856682] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.856682] Deallocation: [ 85.856683] PID = 11658 [ 85.856685] [] save_stack_trace+0x26/0x50 [ 85.856687] [] save_stack+0x46/0xd0 [ 85.856689] [] kasan_slab_free+0x9b/0xb0 [ 85.856691] [] kfree+0xe2/0x460 [ 85.856693] [] vc_do_resize+0x710/0x1350 [ 85.856696] [] vc_resize+0x3d/0x60 [ 85.856697] [] vt_ioctl+0x162b/0x24e0 [ 85.856699] [] tty_ioctl+0x5d4/0x20f0 [ 85.856701] [] do_vfs_ioctl+0x17f/0xe70 [ 85.856703] [] SyS_ioctl+0x74/0x80 [ 85.856705] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.856706] Memory state around the buggy address: [ 85.856707] ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc [ 85.856708] ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc [ 85.856709] >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 85.856710] ^ [ 85.856711] ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc [ 85.856712] ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 85.856713] ================================================================== [ 85.856788] ================================================================== [ 85.856790] BUG: KASAN: use-after-free in fbcon_scrolldelta+0xfff/0x10a0 at addr ffff880126af724e [ 85.856791] Read of size 2 by task syz-executor.1/11658 [ 85.856792] CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 [ 85.856793] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 85.856795] 1ffffffff0d9577e ffff8800a868f700 ffffffff82c4dd46 ffff880126af7250 [ 85.856797] ffff8800a868f790 ffff880126af7240 ffff88012bc00100 ffff8800a868f780 [ 85.856800] ffffffff81740207 ffffffff8174065e ffff8800ba6f4e40 0000000000000286 [ 85.856800] Call Trace: [ 85.856802] [] dump_stack+0xe6/0x120 [ 85.856804] [] kasan_report_error+0x1e7/0x5c0 [ 85.856806] [] ? __asan_report_load2_noabort+0x3e/0x40 [ 85.856808] [] ? fbcon_putcs+0x374/0x5a0 [ 85.856811] [] __asan_report_load2_noabort+0x3e/0x40 [ 85.856812] [] ? fbcon_scrolldelta+0xfff/0x10a0 [ 85.856814] [] fbcon_scrolldelta+0xfff/0x10a0 [ 85.856816] [] fbcon_set_origin+0x16/0x20 [ 85.856818] [] set_origin+0x2c7/0x390 [ 85.856820] [] vc_do_resize+0x781/0x1350 [ 85.856822] [] ? selinux_ipv4_output+0x120/0x120 [ 85.856825] [] ? vc_init+0x490/0x490 [ 85.856827] [] ? vt_ioctl+0x15c9/0x24e0 [ 85.856829] [] vc_resize+0x3d/0x60 [ 85.856831] [] ? console_lock+0x4a/0x70 [ 85.856833] [] vt_ioctl+0x162b/0x24e0 [ 85.856836] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 85.856838] [] ? complete_change_console+0x300/0x300 [ 85.856840] [] ? plist_del+0xe9/0x1d0 [ 85.856841] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.856843] [] ? avc_has_extended_perms+0x27b/0x10f0 [ 85.856845] [] ? avc_has_extended_perms+0x298/0x10f0 [ 85.856847] [] ? avc_has_extended_perms+0xa4/0x10f0 [ 85.856849] [] ? depot_save_stack+0x12f/0x480 [ 85.856851] [] tty_ioctl+0x5d4/0x20f0 [ 85.856853] [] ? no_tty+0x90/0x90 [ 85.856854] [] ? __lock_acquire+0xca1/0x5560 [ 85.856856] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.856858] [] ? __lock_acquire+0x1985/0x5560 [ 85.856860] [] ? ___might_sleep+0x331/0x440 [ 85.856862] [] ? __might_sleep+0x90/0x1a0 [ 85.856864] [] do_vfs_ioctl+0x17f/0xe70 [ 85.856866] [] ? selinux_file_ioctl+0x324/0x510 [ 85.856868] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 85.856870] [] ? __fget+0x1df/0x320 [ 85.856871] [] ? __fget+0x42/0x320 [ 85.856874] [] ? security_file_ioctl+0x6a/0xa0 [ 85.856875] [] SyS_ioctl+0x74/0x80 [ 85.856878] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.856879] Object at ffff880126af7240, in cache kmalloc-32 [ 85.856879] Object freed, allocated with size 14 bytes [ 85.856880] Allocation: [ 85.856880] PID = 11675 [ 85.856883] [] save_stack_trace+0x26/0x50 [ 85.856885] [] save_stack+0x46/0xd0 [ 85.856887] [] kasan_kmalloc+0xc9/0xe0 [ 85.856889] [] __kmalloc+0x169/0x6d0 [ 85.856891] [] vc_do_resize+0x1e9/0x1350 [ 85.856894] [] vc_resize+0x3d/0x60 [ 85.856896] [] vt_ioctl+0x162b/0x24e0 [ 85.856897] [] tty_ioctl+0x5d4/0x20f0 [ 85.856899] [] do_vfs_ioctl+0x17f/0xe70 [ 85.856901] [] SyS_ioctl+0x74/0x80 [ 85.856903] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.856904] Deallocation: [ 85.856904] PID = 11658 [ 85.856906] [] save_stack_trace+0x26/0x50 [ 85.856909] [] save_stack+0x46/0xd0 [ 85.856911] [] kasan_slab_free+0x9b/0xb0 [ 85.856912] [] kfree+0xe2/0x460 [ 85.856915] [] vc_do_resize+0x710/0x1350 [ 85.856917] [] vc_resize+0x3d/0x60 [ 85.856919] [] vt_ioctl+0x162b/0x24e0 [ 85.856921] [] tty_ioctl+0x5d4/0x20f0 [ 85.856923] [] do_vfs_ioctl+0x17f/0xe70 [ 85.856925] [] SyS_ioctl+0x74/0x80 [ 85.856927] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.856928] Memory state around the buggy address: [ 85.856929] ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc [ 85.856930] ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc [ 85.856931] >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 85.856932] ^ [ 85.856933] ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc [ 85.856934] ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 85.856934] ================================================================== [ 85.856935] ================================================================== [ 85.856938] BUG: KASAN: use-after-free in fbcon_putcs+0x471/0x5a0 at addr ffff880126af724e [ 85.856939] Read of size 2 by task syz-executor.1/11658 [ 85.856940] CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 [ 85.856941] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 85.856943] 1ffffffff0d9577e ffff8800a868f688 ffffffff82c4dd46 ffff8800ba6f4e40 [ 85.856946] ffff8800a868f718 ffff880126af7240 ffff88012bc00100 ffff8800a868f708 [ 85.856948] ffffffff81740207 ffffffff8174048d 000000010000000d 0000000000000286 [ 85.856948] Call Trace: [ 85.856950] [] dump_stack+0xe6/0x120 [ 85.856952] [] kasan_report_error+0x1e7/0x5c0 [ 85.856954] [] ? kasan_report_error+0x46d/0x5c0 [ 85.856956] [] __asan_report_load2_noabort+0x3e/0x40 [ 85.856959] [] ? fbcon_putcs+0x471/0x5a0 [ 85.856961] [] fbcon_putcs+0x471/0x5a0 [ 85.856962] [] ? bit_clear+0x6e0/0x6e0 [ 85.856964] [] fbcon_scrolldelta+0xc59/0x10a0 [ 85.856966] [] fbcon_set_origin+0x16/0x20 [ 85.856968] [] set_origin+0x2c7/0x390 [ 85.856970] [] vc_do_resize+0x781/0x1350 [ 85.856973] [] ? selinux_ipv4_output+0x120/0x120 [ 85.856975] [] ? vc_init+0x490/0x490 [ 85.856977] [] ? vt_ioctl+0x15c9/0x24e0 [ 85.856979] [] vc_resize+0x3d/0x60 [ 85.856982] [] ? console_lock+0x4a/0x70 [ 85.856983] [] vt_ioctl+0x162b/0x24e0 [ 85.856986] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 85.856988] [] ? complete_change_console+0x300/0x300 [ 85.856990] [] ? plist_del+0xe9/0x1d0 [ 85.856992] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.856994] [] ? avc_has_extended_perms+0x27b/0x10f0 [ 85.856995] [] ? avc_has_extended_perms+0x298/0x10f0 [ 85.856997] [] ? avc_has_extended_perms+0xa4/0x10f0 [ 85.857000] [] ? depot_save_stack+0x12f/0x480 [ 85.857001] [] tty_ioctl+0x5d4/0x20f0 [ 85.857003] [] ? no_tty+0x90/0x90 [ 85.857005] [] ? __lock_acquire+0xca1/0x5560 [ 85.857006] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.857008] [] ? __lock_acquire+0x1985/0x5560 [ 85.857010] [] ? ___might_sleep+0x331/0x440 [ 85.857012] [] ? __might_sleep+0x90/0x1a0 [ 85.857014] [] do_vfs_ioctl+0x17f/0xe70 [ 85.857016] [] ? selinux_file_ioctl+0x324/0x510 [ 85.857018] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 85.857020] [] ? __fget+0x1df/0x320 [ 85.857021] [] ? __fget+0x42/0x320 [ 85.857024] [] ? security_file_ioctl+0x6a/0xa0 [ 85.857025] [] SyS_ioctl+0x74/0x80 [ 85.857028] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.857033] Object at ffff880126af7240, in cache kmalloc-32 [ 85.857033] Object freed, allocated with size 14 bytes [ 85.857034] Allocation: [ 85.857034] PID = 11675 [ 85.857037] [] save_stack_trace+0x26/0x50 [ 85.857039] [] save_stack+0x46/0xd0 [ 85.857041] [] kasan_kmalloc+0xc9/0xe0 [ 85.857043] [] __kmalloc+0x169/0x6d0 [ 85.857045] [] vc_do_resize+0x1e9/0x1350 [ 85.857048] [] vc_resize+0x3d/0x60 [ 85.857049] [] vt_ioctl+0x162b/0x24e0 [ 85.857051] [] tty_ioctl+0x5d4/0x20f0 [ 85.857053] [] do_vfs_ioctl+0x17f/0xe70 [ 85.857055] [] SyS_ioctl+0x74/0x80 [ 85.857057] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.857058] Deallocation: [ 85.857058] PID = 11658 [ 85.857060] [] save_stack_trace+0x26/0x50 [ 85.857062] [] save_stack+0x46/0xd0 [ 85.857065] [] kasan_slab_free+0x9b/0xb0 [ 85.857066] [] kfree+0xe2/0x460 [ 85.857069] [] vc_do_resize+0x710/0x1350 [ 85.857071] [] vc_resize+0x3d/0x60 [ 85.857073] [] vt_ioctl+0x162b/0x24e0 [ 85.857075] [] tty_ioctl+0x5d4/0x20f0 [ 85.857077] [] do_vfs_ioctl+0x17f/0xe70 [ 85.857078] [] SyS_ioctl+0x74/0x80 [ 85.857081] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.857081] Memory state around the buggy address: [ 85.857082] ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc [ 85.857084] ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc [ 85.857085] >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 85.857085] ^ [ 85.857087] ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc [ 85.857088] ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 85.857088] ================================================================== [ 85.857089] ================================================================== [ 85.857091] BUG: KASAN: use-after-free in fbcon_putcs+0x486/0x5a0 at addr ffff880126af724e [ 85.857092] Read of size 2 by task syz-executor.1/11658 [ 85.857094] CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 [ 85.857094] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 85.857097] 1ffffffff0d9577e ffff8800a868f688 ffffffff82c4dd46 ffff8800ba6f4e40 [ 85.857099] ffff8800a868f718 ffff880126af7240 ffff88012bc00100 ffff8800a868f708 [ 85.857101] ffffffff81740207 0000000000000010 0000000100000000 0000000000000286 [ 85.857102] Call Trace: [ 85.857104] [] dump_stack+0xe6/0x120 [ 85.857106] [] kasan_report_error+0x1e7/0x5c0 [ 85.857108] [] __asan_report_load2_noabort+0x3e/0x40 [ 85.857110] [] ? fbcon_putcs+0x486/0x5a0 [ 85.857112] [] fbcon_putcs+0x486/0x5a0 [ 85.857114] [] ? bit_clear+0x6e0/0x6e0 [ 85.857116] [] fbcon_scrolldelta+0xc59/0x10a0 [ 85.857118] [] fbcon_set_origin+0x16/0x20 [ 85.857120] [] set_origin+0x2c7/0x390 [ 85.857122] [] vc_do_resize+0x781/0x1350 [ 85.857124] [] ? selinux_ipv4_output+0x120/0x120 [ 85.857127] [] ? vc_init+0x490/0x490 [ 85.857129] [] ? vt_ioctl+0x15c9/0x24e0 [ 85.857131] [] vc_resize+0x3d/0x60 [ 85.857133] [] ? console_lock+0x4a/0x70 [ 85.857135] [] vt_ioctl+0x162b/0x24e0 [ 85.857137] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 85.857139] [] ? complete_change_console+0x300/0x300 [ 85.857142] [] ? plist_del+0xe9/0x1d0 [ 85.857143] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.857145] [] ? avc_has_extended_perms+0x27b/0x10f0 [ 85.857147] [] ? avc_has_extended_perms+0x298/0x10f0 [ 85.857149] [] ? avc_has_extended_perms+0xa4/0x10f0 [ 85.857151] [] ? depot_save_stack+0x12f/0x480 [ 85.857153] [] tty_ioctl+0x5d4/0x20f0 [ 85.857155] [] ? no_tty+0x90/0x90 [ 85.857157] [] ? __lock_acquire+0xca1/0x5560 [ 85.857158] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.857160] [] ? __lock_acquire+0x1985/0x5560 [ 85.857162] [] ? ___might_sleep+0x331/0x440 [ 85.857164] [] ? __might_sleep+0x90/0x1a0 [ 85.857166] [] do_vfs_ioctl+0x17f/0xe70 [ 85.857168] [] ? selinux_file_ioctl+0x324/0x510 [ 85.857170] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 85.857172] [] ? __fget+0x1df/0x320 [ 85.857173] [] ? __fget+0x42/0x320 [ 85.857176] [] ? security_file_ioctl+0x6a/0xa0 [ 85.857177] [] SyS_ioctl+0x74/0x80 [ 85.857180] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.857181] Object at ffff880126af7240, in cache kmalloc-32 [ 85.857181] Object freed, allocated with size 14 bytes [ 85.857182] Allocation: [ 85.857182] PID = 11675 [ 85.857185] [] save_stack_trace+0x26/0x50 [ 85.857187] [] save_stack+0x46/0xd0 [ 85.857189] [] kasan_kmalloc+0xc9/0xe0 [ 85.857191] [] __kmalloc+0x169/0x6d0 [ 85.857193] [] vc_do_resize+0x1e9/0x1350 [ 85.857196] [] vc_resize+0x3d/0x60 [ 85.857197] [] vt_ioctl+0x162b/0x24e0 [ 85.857199] [] tty_ioctl+0x5d4/0x20f0 [ 85.857201] [] do_vfs_ioctl+0x17f/0xe70 [ 85.857203] [] SyS_ioctl+0x74/0x80 [ 85.857205] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.857206] Deallocation: [ 85.857206] PID = 11658 [ 85.857208] [] save_stack_trace+0x26/0x50 [ 85.857210] [] save_stack+0x46/0xd0 [ 85.857213] [] kasan_slab_free+0x9b/0xb0 [ 85.857214] [] kfree+0xe2/0x460 [ 85.857217] [] vc_do_resize+0x710/0x1350 [ 85.857219] [] vc_resize+0x3d/0x60 [ 85.857221] [] vt_ioctl+0x162b/0x24e0 [ 85.857223] [] tty_ioctl+0x5d4/0x20f0 [ 85.857225] [] do_vfs_ioctl+0x17f/0xe70 [ 85.857226] [] SyS_ioctl+0x74/0x80 [ 85.857229] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.857229] Memory state around the buggy address: [ 85.857231] ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc [ 85.857232] ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc [ 85.857233] >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 85.857233] ^ [ 85.857235] ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc [ 85.857236] ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 85.857236] ================================================================== [ 85.857237] ================================================================== [ 85.857239] BUG: KASAN: use-after-free in bit_putcs+0xce9/0xd20 at addr ffff880126af724e [ 85.857239] Read of size 2 by task syz-executor.1/11658 [ 85.857241] CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 [ 85.857242] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 85.857244] 1ffffffff0d9577e ffff8800a868f4c8 ffffffff82c4dd46 ffff880126af724e [ 85.857246] ffff8800a868f558 ffff880126af7240 ffff88012bc00100 ffff8800a868f548 [ 85.857249] ffffffff81740207 ffff8800a868f4e8 0000000000000086 0000000000000286 [ 85.857249] Call Trace: [ 85.857251] [] dump_stack+0xe6/0x120 [ 85.857253] [] kasan_report_error+0x1e7/0x5c0 [ 85.857255] [] ? _raw_spin_unlock_irqrestore+0xa6/0xd0 [ 85.857257] [] ? down_trylock+0x50/0x70 [ 85.857260] [] __asan_report_load2_noabort+0x3e/0x40 [ 85.857261] [] ? bit_putcs+0xce9/0xd20 [ 85.857263] [] bit_putcs+0xce9/0xd20 [ 85.857264] [] ? vprintk_default+0x1a/0x20 [ 85.857266] [] ? vsprintf+0x20/0x20 [ 85.857268] [] ? bit_clear+0x6e0/0x6e0 [ 85.857270] [] ? kasan_report_error+0x46d/0x5c0 [ 85.857272] [] ? get_color+0x30/0x380 [ 85.857274] [] ? __asan_report_load2_noabort+0x3e/0x40 [ 85.857277] [] fbcon_putcs+0x374/0x5a0 [ 85.857278] [] ? bit_clear+0x6e0/0x6e0 [ 85.857280] [] fbcon_scrolldelta+0xc59/0x10a0 [ 85.857282] [] fbcon_set_origin+0x16/0x20 [ 85.857284] [] set_origin+0x2c7/0x390 [ 85.857286] [] vc_do_resize+0x781/0x1350 [ 85.857289] [] ? selinux_ipv4_output+0x120/0x120 [ 85.857291] [] ? vc_init+0x490/0x490 [ 85.857293] [] ? vt_ioctl+0x15c9/0x24e0 [ 85.857295] [] vc_resize+0x3d/0x60 [ 85.857297] [] ? console_lock+0x4a/0x70 [ 85.857299] [] vt_ioctl+0x162b/0x24e0 [ 85.857302] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 85.857304] [] ? complete_change_console+0x300/0x300 [ 85.857306] [] ? plist_del+0xe9/0x1d0 [ 85.857307] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.857309] [] ? avc_has_extended_perms+0x27b/0x10f0 [ 85.857311] [] ? avc_has_extended_perms+0x298/0x10f0 [ 85.857313] [] ? avc_has_extended_perms+0xa4/0x10f0 [ 85.857315] [] ? depot_save_stack+0x12f/0x480 [ 85.857317] [] tty_ioctl+0x5d4/0x20f0 [ 85.857319] [] ? no_tty+0x90/0x90 [ 85.857320] [] ? __lock_acquire+0xca1/0x5560 [ 85.857322] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.857323] [] ? __lock_acquire+0x1985/0x5560 [ 85.857326] [] ? ___might_sleep+0x331/0x440 [ 85.857328] [] ? __might_sleep+0x90/0x1a0 [ 85.857330] [] do_vfs_ioctl+0x17f/0xe70 [ 85.857332] [] ? selinux_file_ioctl+0x324/0x510 [ 85.857334] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 85.857335] [] ? __fget+0x1df/0x320 [ 85.857337] [] ? __fget+0x42/0x320 [ 85.857339] [] ? security_file_ioctl+0x6a/0xa0 [ 85.857341] [] SyS_ioctl+0x74/0x80 [ 85.857343] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.857344] Object at ffff880126af7240, in cache kmalloc-32 [ 85.857345] Object freed, allocated with size 14 bytes [ 85.857345] Allocation: [ 85.857346] PID = 11675 [ 85.857348] [] save_stack_trace+0x26/0x50 [ 85.857350] [] save_stack+0x46/0xd0 [ 85.857352] [] kasan_kmalloc+0xc9/0xe0 [ 85.857354] [] __kmalloc+0x169/0x6d0 [ 85.857357] [] vc_do_resize+0x1e9/0x1350 [ 85.857359] [] vc_resize+0x3d/0x60 [ 85.857361] [] vt_ioctl+0x162b/0x24e0 [ 85.857363] [] tty_ioctl+0x5d4/0x20f0 [ 85.857365] [] do_vfs_ioctl+0x17f/0xe70 [ 85.857367] [] SyS_ioctl+0x74/0x80 [ 85.857370] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.857370] Deallocation: [ 85.857371] PID = 11658 [ 85.857374] [] save_stack_trace+0x26/0x50 [ 85.857378] [] save_stack+0x46/0xd0 [ 85.857381] [] kasan_slab_free+0x9b/0xb0 [ 85.857384] [] kfree+0xe2/0x460 [ 85.857388] [] vc_do_resize+0x710/0x1350 [ 85.857392] [] vc_resize+0x3d/0x60 [ 85.857395] [] vt_ioctl+0x162b/0x24e0 [ 85.857398] [] tty_ioctl+0x5d4/0x20f0 [ 85.857401] [] do_vfs_ioctl+0x17f/0xe70 [ 85.857404] [] SyS_ioctl+0x74/0x80 [ 85.857408] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.857409] Memory state around the buggy address: [ 85.857411] ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc [ 85.857413] ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc [ 85.857415] >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 85.857416] ^ [ 85.857418] ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc [ 85.857420] ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 85.857421] ================================================================== [ 85.857422] ================================================================== [ 85.857424] BUG: KASAN: use-after-free in bit_putcs+0xc73/0xd20 at addr ffff880126af724e [ 85.857426] Read of size 2 by task syz-executor.1/11658 [ 85.857429] CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 [ 85.857430] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 85.857435] 1ffffffff0d9577e ffff8800a868f4c8 ffffffff82c4dd46 ffff8800ba5cdfa0 [ 85.857439] ffff8800a868f558 ffff880126af7240 ffff88012bc00100 ffff8800a868f548 [ 85.857443] ffffffff81740207 0000000000000010 0000000000000000 0000000000000286 [ 85.857443] Call Trace: [ 85.857446] [] dump_stack+0xe6/0x120 [ 85.857450] [] kasan_report_error+0x1e7/0x5c0 [ 85.857453] [] __asan_report_load2_noabort+0x3e/0x40 [ 85.857456] [] ? bit_putcs+0xc73/0xd20 [ 85.857459] [] bit_putcs+0xc73/0xd20 [ 85.857463] [] ? bit_clear+0x6e0/0x6e0 [ 85.857466] [] ? kasan_report_error+0x46d/0x5c0 [ 85.857469] [] ? get_color+0x30/0x380 [ 85.857472] [] ? __asan_report_load2_noabort+0x3e/0x40 [ 85.857475] [] fbcon_putcs+0x374/0x5a0 [ 85.857477] [] ? bit_clear+0x6e0/0x6e0 [ 85.857479] [] fbcon_scrolldelta+0xc59/0x10a0 [ 85.857481] [] fbcon_set_origin+0x16/0x20 [ 85.857483] [] set_origin+0x2c7/0x390 [ 85.857485] [] vc_do_resize+0x781/0x1350 [ 85.857488] [] ? selinux_ipv4_output+0x120/0x120 [ 85.857490] [] ? vc_init+0x490/0x490 [ 85.857492] [] ? vt_ioctl+0x15c9/0x24e0 [ 85.857494] [] vc_resize+0x3d/0x60 [ 85.857497] [] ? console_lock+0x4a/0x70 [ 85.857498] [] vt_ioctl+0x162b/0x24e0 [ 85.857501] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 85.857503] [] ? complete_change_console+0x300/0x300 [ 85.857505] [] ? plist_del+0xe9/0x1d0 [ 85.857507] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.857509] [] ? avc_has_extended_perms+0x27b/0x10f0 [ 85.857511] [] ? avc_has_extended_perms+0x298/0x10f0 [ 85.857512] [] ? avc_has_extended_perms+0xa4/0x10f0 [ 85.857515] [] ? depot_save_stack+0x12f/0x480 [ 85.857517] [] tty_ioctl+0x5d4/0x20f0 [ 85.857518] [] ? no_tty+0x90/0x90 [ 85.857520] [] ? __lock_acquire+0xca1/0x5560 [ 85.857521] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.857523] [] ? __lock_acquire+0x1985/0x5560 [ 85.857526] [] ? ___might_sleep+0x331/0x440 [ 85.857528] [] ? __might_sleep+0x90/0x1a0 [ 85.857530] [] do_vfs_ioctl+0x17f/0xe70 [ 85.857532] [] ? selinux_file_ioctl+0x324/0x510 [ 85.857534] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 85.857535] [] ? __fget+0x1df/0x320 [ 85.857537] [] ? __fget+0x42/0x320 [ 85.857539] [] ? security_file_ioctl+0x6a/0xa0 [ 85.857541] [] SyS_ioctl+0x74/0x80 [ 85.857543] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.857544] Object at ffff880126af7240, in cache kmalloc-32 [ 85.857545] Object freed, allocated with size 14 bytes [ 85.857545] Allocation: [ 85.857546] PID = 11675 [ 85.857548] [] save_stack_trace+0x26/0x50 [ 85.857550] [] save_stack+0x46/0xd0 [ 85.857553] [] kasan_kmalloc+0xc9/0xe0 [ 85.857554] [] __kmalloc+0x169/0x6d0 [ 85.857557] [] vc_do_resize+0x1e9/0x1350 [ 85.857559] [] vc_resize+0x3d/0x60 [ 85.857561] [] vt_ioctl+0x162b/0x24e0 [ 85.857563] [] tty_ioctl+0x5d4/0x20f0 [ 85.857565] [] do_vfs_ioctl+0x17f/0xe70 [ 85.857567] [] SyS_ioctl+0x74/0x80 [ 85.857569] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.857570] Deallocation: [ 85.857570] PID = 11658 [ 85.857572] [] save_stack_trace+0x26/0x50 [ 85.857574] [] save_stack+0x46/0xd0 [ 85.857576] [] kasan_slab_free+0x9b/0xb0 [ 85.857578] [] kfree+0xe2/0x460 [ 85.857581] [] vc_do_resize+0x710/0x1350 [ 85.857583] [] vc_resize+0x3d/0x60 [ 85.857585] [] vt_ioctl+0x162b/0x24e0 [ 85.857587] [] tty_ioctl+0x5d4/0x20f0 [ 85.857589] [] do_vfs_ioctl+0x17f/0xe70 [ 85.857590] [] SyS_ioctl+0x74/0x80 [ 85.857593] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.857593] Memory state around the buggy address: [ 85.857594] ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc [ 85.857596] ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc [ 85.857597] >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 85.857597] ^ [ 85.857598] ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc [ 85.857600] ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 85.857600] ================================================================== [ 85.857674] ================================================================== [ 85.857676] BUG: KASAN: use-after-free in fbcon_scrolldelta+0xfff/0x10a0 at addr ffff880126af7250 [ 85.857677] Read of size 2 by task syz-executor.1/11658 [ 85.857678] CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 [ 85.857679] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 85.857681] 1ffffffff0d9577e ffff8800a868f700 ffffffff82c4dd46 ffff880126af7252 [ 85.857684] ffff8800a868f790 ffff880126af7240 ffff88012bc00100 ffff8800a868f780 [ 85.857686] ffffffff81740207 ffffffff8174065e ffff8800ba6f4e40 0000000000000286 [ 85.857686] Call Trace: [ 85.857688] [] dump_stack+0xe6/0x120 [ 85.857690] [] kasan_report_error+0x1e7/0x5c0 [ 85.857693] [] ? __asan_report_load2_noabort+0x3e/0x40 [ 85.857695] [] ? fbcon_putcs+0x374/0x5a0 [ 85.857697] [] __asan_report_load2_noabort+0x3e/0x40 [ 85.857699] [] ? fbcon_scrolldelta+0xfff/0x10a0 [ 85.857701] [] fbcon_scrolldelta+0xfff/0x10a0 [ 85.857702] [] fbcon_set_origin+0x16/0x20 [ 85.857705] [] set_origin+0x2c7/0x390 [ 85.857707] [] vc_do_resize+0x781/0x1350 [ 85.857709] [] ? selinux_ipv4_output+0x120/0x120 [ 85.857712] [] ? vc_init+0x490/0x490 [ 85.857714] [] ? vt_ioctl+0x15c9/0x24e0 [ 85.857716] [] vc_resize+0x3d/0x60 [ 85.857718] [] ? console_lock+0x4a/0x70 [ 85.857720] [] vt_ioctl+0x162b/0x24e0 [ 85.857723] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 85.857725] [] ? complete_change_console+0x300/0x300 [ 85.857727] [] ? plist_del+0xe9/0x1d0 [ 85.857728] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.857730] [] ? avc_has_extended_perms+0x27b/0x10f0 [ 85.857732] [] ? avc_has_extended_perms+0x298/0x10f0 [ 85.857734] [] ? avc_has_extended_perms+0xa4/0x10f0 [ 85.857736] [] ? depot_save_stack+0x12f/0x480 [ 85.857738] [] tty_ioctl+0x5d4/0x20f0 [ 85.857740] [] ? no_tty+0x90/0x90 [ 85.857741] [] ? __lock_acquire+0xca1/0x5560 [ 85.857743] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.857745] [] ? __lock_acquire+0x1985/0x5560 [ 85.857747] [] ? ___might_sleep+0x331/0x440 [ 85.857749] [] ? __might_sleep+0x90/0x1a0 [ 85.857751] [] do_vfs_ioctl+0x17f/0xe70 [ 85.857753] [] ? selinux_file_ioctl+0x324/0x510 [ 85.857755] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 85.857757] [] ? __fget+0x1df/0x320 [ 85.857758] [] ? __fget+0x42/0x320 [ 85.857760] [] ? security_file_ioctl+0x6a/0xa0 [ 85.857762] [] SyS_ioctl+0x74/0x80 [ 85.857765] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.857766] Object at ffff880126af7240, in cache kmalloc-32 [ 85.857766] Object freed, allocated with size 14 bytes [ 85.857767] Allocation: [ 85.857767] PID = 11675 [ 85.857770] [] save_stack_trace+0x26/0x50 [ 85.857772] [] save_stack+0x46/0xd0 [ 85.857774] [] kasan_kmalloc+0xc9/0xe0 [ 85.857776] [] __kmalloc+0x169/0x6d0 [ 85.857778] [] vc_do_resize+0x1e9/0x1350 [ 85.857781] [] vc_resize+0x3d/0x60 [ 85.857782] [] vt_ioctl+0x162b/0x24e0 [ 85.857784] [] tty_ioctl+0x5d4/0x20f0 [ 85.857786] [] do_vfs_ioctl+0x17f/0xe70 [ 85.857788] [] SyS_ioctl+0x74/0x80 [ 85.857790] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.857791] Deallocation: [ 85.857791] PID = 11658 [ 85.857793] [] save_stack_trace+0x26/0x50 [ 85.857795] [] save_stack+0x46/0xd0 [ 85.857798] [] kasan_slab_free+0x9b/0xb0 [ 85.857799] [] kfree+0xe2/0x460 [ 85.857802] [] vc_do_resize+0x710/0x1350 [ 85.857804] [] vc_resize+0x3d/0x60 [ 85.857806] [] vt_ioctl+0x162b/0x24e0 [ 85.857808] [] tty_ioctl+0x5d4/0x20f0 [ 85.857810] [] do_vfs_ioctl+0x17f/0xe70 [ 85.857812] [] SyS_ioctl+0x74/0x80 [ 85.857814] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 85.857815] Memory state around the buggy address: [ 85.857816] ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc [ 85.857817] ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc [ 85.857818] >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 85.857819] ^ [ 85.857820] ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc [ 85.857821] ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 85.857822] ================================================================== [ 85.857822] ================================================================== [ 85.857825] BUG: KASAN: use-after-free in fbcon_putcs+0x471/0x5a0 at addr ffff880126af7250 [ 85.857826] Read of size 2 by task syz-executor.1/11658 [ 85.857827] CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 [ 85.857828] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 85.857830] 1ffffffff0d9577e ffff8800a868f688 ffffffff82c4dd46 ffff8800ba6f4e40 [ 85.857833] ffff8800a868f718 ffff880126af7240 ffff88012bc00100 ffff8800a868f708 [ 85.857835] ffffffff81740207 ffffffff8174048d 000000010000000d 0000000000000286 [ 85.857835] Call Trace: [ 85.857837] [] dump_stack+0xe6/0x120 [ 85.857839] [] kasan_report_error+0x1e7/0x5c0 [ 85.857841] [] ? kasan_report_error+0x46d/0x5c0 [ 85.857843] [] __asan_report_load2_noabort+0x3e/0x40 [ 85.857846] [] ? fbcon_putcs+0x471/0x5a0 [ 85.857848] [] fbcon_putcs+0x471/0x5a0 [ 85.857850] [] ? bit_clear+0x6e0/0x6e0 [ 85.857851] [] fbcon_scrolldelta+0xc59/0x10a0 [ 85.857853] [] fbcon_set_origin+0x16/0x20 [ 85.857855] [] set_origin+0x2c7/0x390 [ 85.857857] [] vc_do_resize+0x781/0x1350 [ 85.857860] [] ? selinux_ipv4_output+0x120/0x120 [ 85.857862] [] ? vc_init+0x490/0x490 [ 85.857864] [] ? vt_ioctl+0x15c9/0x24e0 [ 85.857866] [] vc_resize+0x3d/0x60 [ 85.857869] [] ? console_lock+0x4a/0x70 [ 85.857870] [] vt_ioctl+0x162b/0x24e0 [ 85.857873] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 85.857875] [] ? complete_change_console+0x300/0x300 [ 85.857877] [] ? plist_del+0xe9/0x1d0 [ 85.857879] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 85.857881] [] ? avc_has_extended_perms+0x27b/0x10f0 [ 85.857883] [] ? avc_has_extended_perms+0x298/0x10f0 [ 85.857884] [] ? avc_has_extended_perms+0xa4/0x10f0 [ 85.857887] [] ? depot_save_stack+0x12f/0x480 [ 85.857889] [] tty_ioctl+0x5d4/0x20f0 [ 85.857890] [] ? no_tty+0x90/0x90 [ 85.857892] [] ? __lock_acquire+0xca1/0x5560 [ 85.857893] [] ? debug_lockdep_rcu_enabled+0x77/0x90