[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.245' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 60.371417][ T6837] ================================================================== [ 60.371459][ T6837] BUG: KASAN: slab-out-of-bounds in vcs_read+0xaa7/0xb40 [ 60.371466][ T6837] Write of size 2 at addr ffff8880a83de000 by task syz-executor717/6837 [ 60.371469][ T6837] [ 60.371480][ T6837] CPU: 0 PID: 6837 Comm: syz-executor717 Not tainted 5.9.0-rc1-next-20200821-syzkaller #0 [ 60.371485][ T6837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 60.371489][ T6837] Call Trace: [ 60.371503][ T6837] dump_stack+0x18f/0x20d [ 60.371512][ T6837] ? vcs_read+0xaa7/0xb40 [ 60.371519][ T6837] ? vcs_read+0xaa7/0xb40 [ 60.371532][ T6837] print_address_description.constprop.0.cold+0xae/0x497 [ 60.371543][ T6837] ? lock_release+0x8e0/0x8e0 [ 60.371551][ T6837] ? lock_downgrade+0x830/0x830 [ 60.371562][ T6837] ? vprintk_func+0x97/0x1a6 [ 60.371570][ T6837] ? vcs_read+0xaa7/0xb40 [ 60.371577][ T6837] ? vcs_read+0xaa7/0xb40 [ 60.371585][ T6837] kasan_report.cold+0x1f/0x37 [ 60.371602][ T6837] ? vcs_read+0xaa7/0xb40 [ 60.371610][ T6837] vcs_read+0xaa7/0xb40 [ 60.371624][ T6837] ? vcs_write+0xb50/0xb50 [ 60.371636][ T6837] ? security_file_permission+0x248/0x560 [ 60.371652][ T6837] do_iter_read+0x48e/0x6e0 [ 60.371666][ T6837] vfs_readv+0xe5/0x150 [ 60.371675][ T6837] ? compat_rw_copy_check_uvector+0x4c0/0x4c0 [ 60.371688][ T6837] ? rcu_read_lock_sched_held+0x3a/0xb0 [ 60.371699][ T6837] ? putname+0xe1/0x120 [ 60.371719][ T6837] __x64_sys_preadv+0x231/0x310 [ 60.371728][ T6837] ? __ia32_sys_writev+0xb0/0xb0 [ 60.371739][ T6837] ? trace_hardirqs_on+0x5f/0x220 [ 60.371749][ T6837] ? lockdep_hardirqs_on+0x76/0xf0 [ 60.371760][ T6837] do_syscall_64+0x2d/0x70 [ 60.371770][ T6837] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 60.371778][ T6837] RIP: 0033:0x440679 [ 60.371787][ T6837] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 60.371792][ T6837] RSP: 002b:00007ffe191489a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 60.371802][ T6837] RAX: ffffffffffffffda RBX: 00007ffe191489b0 RCX: 0000000000440679 [ 60.371808][ T6837] RDX: 0000000000000006 RSI: 0000000020001b00 RDI: 0000000000000003 [ 60.371813][ T6837] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000400c40 [ 60.371818][ T6837] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000401e80 [ 60.371823][ T6837] R13: 0000000000401f10 R14: 0000000000000000 R15: 0000000000000000 [ 60.371833][ T6837] [ 60.371837][ T6837] Allocated by task 4880: [ 60.371846][ T6837] kasan_save_stack+0x1b/0x40 [ 60.371853][ T6837] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 60.371861][ T6837] kmem_cache_alloc+0x138/0x3a0 [ 60.371869][ T6837] shmem_alloc_inode+0x18/0x40 [ 60.371878][ T6837] alloc_inode+0x61/0x230 [ 60.371884][ T6837] new_inode+0x27/0x2f0 [ 60.371891][ T6837] shmem_get_inode+0x18b/0xbb0 [ 60.371898][ T6837] shmem_mknod+0x5a/0x1f0 [ 60.371905][ T6837] lookup_open.isra.0+0xf85/0x1350 [ 60.371911][ T6837] path_openat+0x96d/0x2730 [ 60.371918][ T6837] do_filp_open+0x17e/0x3c0 [ 60.371925][ T6837] do_sys_openat2+0x16d/0x420 [ 60.371932][ T6837] __x64_sys_open+0x119/0x1c0 [ 60.371939][ T6837] do_syscall_64+0x2d/0x70 [ 60.371947][ T6837] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 60.371949][ T6837] [ 60.371955][ T6837] The buggy address belongs to the object at ffff8880a83de200 [ 60.371955][ T6837] which belongs to the cache shmem_inode_cache of size 1312 [ 60.371962][ T6837] The buggy address is located 512 bytes to the left of [ 60.371962][ T6837] 1312-byte region [ffff8880a83de200, ffff8880a83de720) [ 60.371965][ T6837] The buggy address belongs to the page: [ 60.371975][ T6837] page:000000005ede4b9b refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880a83dfffb pfn:0xa83de [ 60.371981][ T6837] head:000000005ede4b9b order:1 compound_mapcount:0 [ 60.371988][ T6837] flags: 0xfffe0000010200(slab|head) [ 60.371999][ T6837] raw: 00fffe0000010200 ffffea0002a0eb88 ffffea0002a2f488 ffff8880aa241a00 [ 60.372009][ T6837] raw: ffff8880a83dfffb ffff8880a83de200 0000000100000005 0000000000000000 [ 60.372012][ T6837] page dumped because: kasan: bad access detected [ 60.372015][ T6837] [ 60.372017][ T6837] Memory state around the buggy address: [ 60.372024][ T6837] ffff8880a83ddf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 60.372030][ T6837] ffff8880a83ddf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 60.372037][ T6837] >ffff8880a83de000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 60.372040][ T6837] ^ [ 60.372046][ T6837] ffff8880a83de080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 60.372052][ T6837] ffff8880a83de100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 60.372056][ T6837] ================================================================== [ 60.372059][ T6837] Disabling lock debugging due to kernel taint [ 60.372063][ T6837] Kernel panic - not syncing: panic_on_warn set ... [ 60.372071][ T6837] CPU: 0 PID: 6837 Comm: syz-executor717 Tainted: G B 5.9.0-rc1-next-20200821-syzkaller #0 [ 60.372076][ T6837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 60.372078][ T6837] Call Trace: [ 60.372086][ T6837] dump_stack+0x18f/0x20d [ 60.372110][ T6837] ? vcs_read+0xa40/0xb40 [ 60.372121][ T6837] panic+0x2e3/0x75c [ 60.372128][ T6837] ? __warn_printk+0xf3/0xf3 [ 60.372137][ T6837] ? trace_hardirqs_on+0x55/0x220 [ 60.372145][ T6837] ? vcs_read+0xaa7/0xb40 [ 60.372151][ T6837] ? vcs_read+0xaa7/0xb40 [ 60.372158][ T6837] end_report+0x4d/0x53 [ 60.372165][ T6837] kasan_report.cold+0xd/0x37 [ 60.372172][ T6837] ? vcs_read+0xaa7/0xb40 [ 60.372179][ T6837] vcs_read+0xaa7/0xb40 [ 60.372189][ T6837] ? vcs_write+0xb50/0xb50 [ 60.372196][ T6837] ? security_file_permission+0x248/0x560 [ 60.372205][ T6837] do_iter_read+0x48e/0x6e0 [ 60.372215][ T6837] vfs_readv+0xe5/0x150 [ 60.372223][ T6837] ? compat_rw_copy_check_uvector+0x4c0/0x4c0 [ 60.372232][ T6837] ? rcu_read_lock_sched_held+0x3a/0xb0 [ 60.372239][ T6837] ? putname+0xe1/0x120 [ 60.372251][ T6837] __x64_sys_preadv+0x231/0x310 [ 60.372259][ T6837] ? __ia32_sys_writev+0xb0/0xb0 [ 60.372266][ T6837] ? trace_hardirqs_on+0x5f/0x220 [ 60.372273][ T6837] ? lockdep_hardirqs_on+0x76/0xf0 [ 60.372281][ T6837] do_syscall_64+0x2d/0x70 [ 60.372288][ T6837] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 60.372293][ T6837] RIP: 0033:0x440679 [ 60.372301][ T6837] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 60.372305][ T6837] RSP: 002b:00007ffe191489a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 60.372313][ T6837] RAX: ffffffffffffffda RBX: 00007ffe191489b0 RCX: 0000000000440679 [ 60.372317][ T6837] RDX: 0000000000000006 RSI: 0000000020001b00 RDI: 0000000000000003 [ 60.372321][ T6837] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000400c40 [ 60.372326][ T6837] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000401e80 [ 60.372330][ T6837] R13: 0000000000401f10 R14: 0000000000000000 R15: 0000000000000000 [ 60.373355][ T6837] Kernel Offset: disabled [ 61.072278][ T6837] Rebooting in 86400 seconds..