Warning: Permanently added '10.128.0.10' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 47.574884] kauditd_printk_skb: 3 callbacks suppressed [ 47.574899] audit: type=1400 audit(1575756543.617:36): avc: denied { map } for pid=7604 comm="syz-executor052" path="/root/syz-executor052727936" dev="sda1" ino=16483 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 47.611124] ================================================================== [ 47.611151] BUG: KASAN: global-out-of-bounds in fb_pad_aligned_buffer+0x138/0x160 [ 47.611158] Read of size 1 at addr ffffffff87ecb836 by task syz-executor052/7604 [ 47.611160] [ 47.611169] CPU: 1 PID: 7604 Comm: syz-executor052 Not tainted 4.19.88-syzkaller #0 [ 47.611175] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 47.611178] Call Trace: [ 47.611190] dump_stack+0x197/0x210 [ 47.611214] ? fb_pad_aligned_buffer+0x138/0x160 [ 47.611226] print_address_description.cold+0x5/0x20d [ 47.611235] ? fb_pad_aligned_buffer+0x138/0x160 [ 47.611243] kasan_report.cold+0x8c/0x2ba [ 47.611254] __asan_report_load1_noabort+0x14/0x20 [ 47.611262] fb_pad_aligned_buffer+0x138/0x160 [ 47.611274] bit_putcs+0xd14/0xf10 [ 47.611291] ? bit_cursor+0x1a60/0x1a60 [ 47.611302] ? __sanitizer_cov_trace_cmp1+0x1/0x20 [ 47.611311] ? fb_get_color_depth.part.0+0xcf/0x200 [ 47.611321] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 47.611331] fbcon_putcs+0x42b/0x4f0 [ 47.611340] ? bit_cursor+0x1a60/0x1a60 [ 47.611350] do_update_region+0x42b/0x6f0 [ 47.611361] ? con_get_trans_old+0x2a0/0x2a0 [ 47.611370] ? fbcon_set_palette+0x227/0x610 [ 47.611377] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 47.611385] ? fbcon_redraw.isra.0+0x490/0x490 [ 47.611395] redraw_screen+0x602/0x8e0 [ 47.611403] ? down+0x50/0x90 [ 47.611411] ? con_flush_chars+0xa0/0xa0 [ 47.611424] fbcon_do_set_font+0x73a/0xa40 [ 47.611431] ? lock_acquire+0x16f/0x3f0 [ 47.611442] fbcon_copy_font+0x12c/0x190 [ 47.611449] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 47.611456] ? fbcon_do_set_font+0xa40/0xa40 [ 47.611465] con_font_op+0x69a/0x1250 [ 47.611475] ? con_write+0xd0/0xd0 [ 47.611489] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 47.611499] ? _copy_from_user+0xdd/0x150 [ 47.611510] vt_ioctl+0x1784/0x2530 [ 47.611519] ? complete_change_console+0x3a0/0x3a0 [ 47.611529] ? avc_has_extended_perms+0xa78/0x10f0 [ 47.611542] ? save_stack+0xa9/0xd0 [ 47.611549] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 47.611559] ? tty_jobctrl_ioctl+0x50/0xcd0 [ 47.611567] ? complete_change_console+0x3a0/0x3a0 [ 47.611575] tty_ioctl+0x7f3/0x1510 [ 47.611583] ? tty_vhangup+0x30/0x30 [ 47.611595] ? find_held_lock+0x35/0x130 [ 47.611605] ? debug_check_no_obj_freed+0x200/0x464 [ 47.611621] ? __might_sleep+0x95/0x190 [ 47.611630] ? trace_hardirqs_off+0x62/0x220 [ 47.611636] ? tty_vhangup+0x30/0x30 [ 47.611646] do_vfs_ioctl+0xd5f/0x1380 [ 47.611654] ? selinux_file_ioctl+0x46f/0x5e0 [ 47.611661] ? selinux_file_ioctl+0x125/0x5e0 [ 47.611670] ? ioctl_preallocate+0x210/0x210 [ 47.611677] ? selinux_file_mprotect+0x620/0x620 [ 47.611683] ? putname+0xef/0x130 [ 47.611691] ? kmem_cache_free+0x222/0x260 [ 47.611699] ? putname+0xf4/0x130 [ 47.611709] ? do_sys_open+0x31d/0x550 [ 47.611720] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 47.611728] ? security_file_ioctl+0x8d/0xc0 [ 47.611737] ksys_ioctl+0xab/0xd0 [ 47.611746] __x64_sys_ioctl+0x73/0xb0 [ 47.611757] do_syscall_64+0xfd/0x620 [ 47.611768] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 47.611774] RIP: 0033:0x440269 [ 47.611782] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b 14 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 47.611787] RSP: 002b:00007ffc34d461a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 47.611795] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440269 [ 47.611799] RDX: 0000000020000000 RSI: 0000000000004b72 RDI: 0000000000000004 [ 47.611804] RBP: 00000000006cb018 R08: 000000000000000d R09: 00000000004002c8 [ 47.611808] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401b50 [ 47.611813] R13: 0000000000401be0 R14: 0000000000000000 R15: 0000000000000000 [ 47.611823] [ 47.611826] The buggy address belongs to the variable: [ 47.611834] oid_index+0x76/0xa60 [ 47.611835] [ 47.611838] Memory state around the buggy address: [ 47.611846] ffffffff87ecb700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 47.611851] ffffffff87ecb780: 00 00 00 05 fa fa fa fa 00 00 00 00 00 00 00 00 [ 47.611857] >ffffffff87ecb800: 00 00 00 00 00 00 06 fa fa fa fa fa 00 02 fa fa [ 47.611860] ^ [ 47.611866] ffffffff87ecb880: fa fa fa fa 00 01 fa fa fa fa fa fa 00 00 02 fa [ 47.611872] ffffffff87ecb900: fa fa fa fa 00 03 fa fa fa fa fa fa 00 06 fa fa [ 47.611875] ================================================================== [ 47.611878] Disabling lock debugging due to kernel taint [ 47.611882] Kernel panic - not syncing: panic_on_warn set ... [ 47.611882] [ 47.611889] CPU: 1 PID: 7604 Comm: syz-executor052 Tainted: G B 4.19.88-syzkaller #0 [ 47.611893] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 47.611895] Call Trace: [ 47.611903] dump_stack+0x197/0x210 [ 47.611911] ? fb_pad_aligned_buffer+0x138/0x160 [ 47.611918] panic+0x26a/0x50e [ 47.611924] ? __warn_printk+0xf3/0xf3 [ 47.611932] ? lock_downgrade+0x880/0x880 [ 47.611940] ? trace_hardirqs_on+0x67/0x220 [ 47.611946] ? trace_hardirqs_on+0x5e/0x220 [ 47.611955] ? fb_pad_aligned_buffer+0x138/0x160 [ 47.611961] kasan_end_report+0x47/0x4f [ 47.611969] kasan_report.cold+0xa9/0x2ba [ 47.611978] __asan_report_load1_noabort+0x14/0x20 [ 47.611985] fb_pad_aligned_buffer+0x138/0x160 [ 47.611993] bit_putcs+0xd14/0xf10 [ 47.612005] ? bit_cursor+0x1a60/0x1a60 [ 47.612013] ? __sanitizer_cov_trace_cmp1+0x1/0x20 [ 47.612021] ? fb_get_color_depth.part.0+0xcf/0x200 [ 47.612029] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 47.612036] fbcon_putcs+0x42b/0x4f0 [ 47.612044] ? bit_cursor+0x1a60/0x1a60 [ 47.612051] do_update_region+0x42b/0x6f0 [ 47.612059] ? con_get_trans_old+0x2a0/0x2a0 [ 47.612067] ? fbcon_set_palette+0x227/0x610 [ 47.612074] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 47.612080] ? fbcon_redraw.isra.0+0x490/0x490 [ 47.612088] redraw_screen+0x602/0x8e0 [ 47.612095] ? down+0x50/0x90 [ 47.612101] ? con_flush_chars+0xa0/0xa0 [ 47.612111] fbcon_do_set_font+0x73a/0xa40 [ 47.612117] ? lock_acquire+0x16f/0x3f0 [ 47.612126] fbcon_copy_font+0x12c/0x190 [ 47.612133] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 47.612139] ? fbcon_do_set_font+0xa40/0xa40 [ 47.612146] con_font_op+0x69a/0x1250 [ 47.612154] ? con_write+0xd0/0xd0 [ 47.612164] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 47.612172] ? _copy_from_user+0xdd/0x150 [ 47.612179] vt_ioctl+0x1784/0x2530 [ 47.612188] ? complete_change_console+0x3a0/0x3a0 [ 47.612195] ? avc_has_extended_perms+0xa78/0x10f0 [ 47.612204] ? save_stack+0xa9/0xd0 [ 47.612211] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 47.612219] ? tty_jobctrl_ioctl+0x50/0xcd0 [ 47.612226] ? complete_change_console+0x3a0/0x3a0 [ 47.612233] tty_ioctl+0x7f3/0x1510 [ 47.612239] ? tty_vhangup+0x30/0x30 [ 47.612247] ? find_held_lock+0x35/0x130 [ 47.612254] ? debug_check_no_obj_freed+0x200/0x464 [ 47.612265] ? __might_sleep+0x95/0x190 [ 47.612272] ? trace_hardirqs_off+0x62/0x220 [ 47.612278] ? tty_vhangup+0x30/0x30 [ 47.612285] do_vfs_ioctl+0xd5f/0x1380 [ 47.612292] ? selinux_file_ioctl+0x46f/0x5e0 [ 47.612299] ? selinux_file_ioctl+0x125/0x5e0 [ 47.612306] ? ioctl_preallocate+0x210/0x210 [ 47.612313] ? selinux_file_mprotect+0x620/0x620 [ 47.612318] ? putname+0xef/0x130 [ 47.612325] ? kmem_cache_free+0x222/0x260 [ 47.612331] ? putname+0xf4/0x130 [ 47.612338] ? do_sys_open+0x31d/0x550 [ 47.612347] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 47.612354] ? security_file_ioctl+0x8d/0xc0 [ 47.612361] ksys_ioctl+0xab/0xd0 [ 47.612369] __x64_sys_ioctl+0x73/0xb0 [ 47.612376] do_syscall_64+0xfd/0x620 [ 47.612385] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 47.612389] RIP: 0033:0x440269 [ 47.612396] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b 14 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 47.612399] RSP: 002b:00007ffc34d461a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 47.612406] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440269 [ 47.612410] RDX: 0000000020000000 RSI: 0000000000004b72 RDI: 0000000000000004 [ 47.612414] RBP: 00000000006cb018 R08: 000000000000000d R09: 00000000004002c8 [ 47.612419] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401b50 [ 47.612423] R13: 0000000000401be0 R14: 0000000000000000 R15: 0000000000000000 [ 47.613967] Kernel Offset: disabled [ 48.427913] Rebooting in 86400 seconds..