Warning: Permanently added '10.128.1.54' (ECDSA) to the list of known hosts. 2020/08/29 04:09:52 parsed 1 programs 2020/08/29 04:09:52 executed programs: 0 [* ] A start job is running for dev-ttyS0.device (8s / 1min 30s) [** ] A start job is running for dev-ttyS0.device (9s / 1min 30s) [*** ] A start job is running for dev-ttyS0.device (10s / 1min 30s) [ *** ] A start job is running for dev-ttyS0.device (10s / 1min 30s) [ *** ] A start job is running for dev-ttyS0.device (11s / 1min 30s) [ ***] A start job is running for dev-ttyS0.device (12s / 1min 30s) [ **] A start job is running for dev-ttyS0.device (12s / 1min 30s) [ *] A start job is running for dev-ttyS0.device (13s / 1min 30s)[ 19.585365][ T22] audit: type=1400 audit(1598674192.159:8): avc: denied { execmem } for pid=343 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 19.603220][ T344] cgroup1: Unknown subsys name 'perf_event' [ *[0;[ 19.615864][ T344] cgroup1: Unknown subsys name 'net_cls' 1;31m*] A start job is running for dev-ttyS0.device (13s / 1min 30s) [ ***] A start job is running for dev-ttyS0.device (14s / 1min 30s) [ *** ] A start job is running for dev-ttyS0.device (15s / 1min 30s) [ *** ] A start job is running for dev-ttyS0.device (15s / 1min 30s) [*** ] A start job is running for dev-ttyS0.device (16s / 1min 30s) [** ] A start job is running for dev-ttyS0.device (16s / 1min 30s) [* ] A start job is running for dev-ttyS0.device (17s / 1min 30s)[ 23.834725][ T2306] ================================================================== [ 23.834757][ T2307] ------------[ cut here ]------------ [ 23.842911][ T2306] BUG: KASAN: use-after-free in mutex_lock+0x99/0x110 [ 23.848334][ T2307] kernel BUG at ./include/linux/fs.h:3039! [ 23.855068][ T2306] Write of size 8 at addr ffff8881c53c7100 by task syz-executor.0/2306 [ 23.861489][ T2307] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 23.869037][ T2306] [ 23.875082][ T2307] CPU: 0 PID: 2307 Comm: syz-executor.0 Not tainted 5.4.61-syzkaller-00823-g34364883b1f7 #0 [ 23.877379][ T2306] CPU: 1 PID: 2306 Comm: syz-executor.0 Not tainted 5.4.61-syzkaller-00823-g34364883b1f7 #0 [ 23.887410][ T2307] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 23.897448][ T2306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 23.907512][ T2307] RIP: 0010:__fput+0x6b8/0x6c0 [ 23.917546][ T2306] Call Trace: [ 23.922283][ T2307] Code: 2d fb ff e9 4e fe ff ff 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 2e fd ff ff 48 89 ef e8 42 2d fb ff e9 21 fd ff ff e8 c8 f4 cc ff <0f> 0b 66 0f 1f 44 00 00 55 41 56 53 49 89 fe e8 b4 f4 cc ff 49 8d [ 23.925540][ T2306] dump_stack+0x14a/0x1ce [ 23.945130][ T2307] RSP: 0018:ffff8881d1d4fe60 EFLAGS: 00010293 [ 23.949443][ T2306] ? kmem_cache_free+0xac/0x600 [ 23.955493][ T2307] RAX: ffffffff81751468 RBX: 0000000000000000 RCX: ffff8881cf0a0f80 [ 23.962059][ T2306] ? __fput+0x4a2/0x6c0 [ 23.970004][ T2307] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 23.974138][ T2306] ? show_regs_print_info+0x12/0x12 [ 23.982073][ T2307] RBP: ffff8881d3d0aed4 R08: ffffffff81751190 R09: ffffed103a7a15db [ 23.987242][ T2306] ? printk+0xd2/0x114 [ 23.995179][ T2307] R10: ffffed103a7a15db R11: 0000000000000000 R12: ffff8881c4f5f640 [ 23.999230][ T2306] print_address_description+0x93/0x620 [ 24.007189][ T2307] R13: dffffc0000000000 R14: 00000000000a0001 R15: ffff8881c4f5f668 [ 24.012722][ T2306] ? devkmsg_release+0x11c/0x11c [ 24.020664][ T2307] FS: 00007f848b3d2700(0000) GS:ffff8881db800000(0000) knlGS:0000000000000000 [ 24.025576][ T2306] __kasan_report+0x16d/0x1e0 [ 24.034468][ T2307] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.039131][ T2306] ? mutex_lock+0x99/0x110 [ 24.045679][ T2307] CR2: 0000000000000000 CR3: 00000001cacfa002 CR4: 00000000001606f0 [ 24.050077][ T2306] kasan_report+0x36/0x60 [ 24.058015][ T2307] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 24.062313][ T2306] check_memory_region+0x2b5/0x2f0 [ 24.070352][ T2307] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 24.075460][ T2306] mutex_lock+0x99/0x110 [ 24.083401][ T2307] Call Trace: [ 24.087617][ T2306] ? mutex_trylock+0xb0/0xb0 [ 24.090872][ T2307] task_work_run+0x176/0x1a0 [ 24.095436][ T2306] ? __fsnotify_parent+0x310/0x310 [ 24.100002][ T2307] prepare_exit_to_usermode+0x286/0x2e0 [ 24.105583][ T2306] pipe_release+0x47/0x300 [ 24.111212][ T2307] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 24.115597][ T2306] ? fifo_open+0xb80/0xb80 [ 24.121458][ T2307] RIP: 0033:0x45d5b9 [ 24.125855][ T2306] __fput+0x27d/0x6c0 [ 24.129723][ T2307] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 24.133673][ T2306] task_work_run+0x176/0x1a0 [ 24.153251][ T2307] RSP: 002b:00007f848b3d1c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9 [ 24.157822][ T2306] prepare_exit_to_usermode+0x286/0x2e0 [ 24.166203][ T2307] RAX: 0000000000000000 RBX: 0000000000002ac0 RCX: 000000000045d5b9 [ 24.171729][ T2306] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 24.179676][ T2307] RDX: 0000000000000005 RSI: 0000000000000001 RDI: 0000000000000006 [ 24.185546][ T2306] RIP: 0033:0x416f01 [ 24.193488][ T2307] RBP: 000000000118cf88 R08: 0000000000000000 R09: 0000000000000000 [ 24.197367][ T2306] Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 24.205308][ T2307] R10: 0000000020000180 R11: 0000000000000246 R12: 000000000118cf4c [ 24.224894][ T2306] RSP: 002b:00007ffe566e09a0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 24.232863][ T2307] R13: 00007ffe566e092f R14: 00007f848b3d29c0 R15: 000000000118cf4c [ 24.241250][ T2306] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 0000000000416f01 [ 24.249214][ T2307] Modules linked in: [ 24.257182][ T2306] RDX: 0000000000000000 RSI: 0000000000000081 RDI: 0000000000000004 [ 24.262238][ T2307] ---[ end trace 369f0535f8b3c6b9 ]--- [ 24.268989][ T2306] RBP: 0000000000000000 R08: 0000000001190408 R09: 0000000000000000 [ 24.268994][ T2306] R10: 00007ffe566e0a80 R11: 0000000000000293 R12: 0000000001190410 [ 24.268998][ T2306] R13: 0000000000000000 R14: ffffffffffffffff R15: 000000000118cf4c [ 24.269003][ T2306] [ 24.269008][ T2306] Allocated by task 2307: [ 24.269026][ T2306] __kasan_kmalloc+0x12c/0x1c0 [ 24.274473][ T2307] RIP: 0010:__fput+0x6b8/0x6c0 [ 24.282395][ T2306] kmem_cache_alloc_trace+0xc3/0x280 [ 24.282403][ T2306] alloc_pipe_info+0xa1/0x3a0 [ 24.282410][ T2306] create_pipe_files+0x85/0x620 [ 24.282417][ T2306] __do_pipe_flags+0x46/0x200 [ 24.282429][ T2306] do_pipe2+0xee/0x350 [ 24.290799][ T2307] Code: 2d fb ff e9 4e fe ff ff 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 2e fd ff ff 48 89 ef e8 42 2d fb ff e9 21 fd ff ff e8 c8 f4 cc ff <0f> 0b 66 0f 1f 44 00 00 55 41 56 53 49 89 fe e8 b4 f4 cc ff 49 8d [ 24.298440][ T2306] __x64_sys_pipe2+0x56/0x60 [ 24.298448][ T2306] do_syscall_64+0xcb/0x150 [ 24.298455][ T2306] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 24.298465][ T2306] [ 24.301141][ T2307] RSP: 0018:ffff8881d1d4fe60 EFLAGS: 00010293 [ 24.305077][ T2306] Freed by task 2307: [ 24.305090][ T2306] __kasan_slab_free+0x181/0x230 [ 24.305104][ T2306] slab_free_freelist_hook+0xd0/0x150 [ 24.310114][ T2307] RAX: ffffffff81751468 RBX: 0000000000000000 RCX: ffff8881cf0a0f80 [ 24.314583][ T2306] kfree+0x12b/0x600 [ 24.314598][ T2306] pipe_release+0x216/0x300 [ 24.320055][ T2307] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 24.324497][ T2306] __fput+0x27d/0x6c0 [ 24.324505][ T2306] task_work_run+0x176/0x1a0 [ 24.324517][ T2306] prepare_exit_to_usermode+0x286/0x2e0 [ 24.329575][ T2307] RBP: ffff8881d3d0aed4 R08: ffffffff81751190 R09: ffffed103a7a15db [ 24.333989][ T2306] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 24.333991][ T2306] [ 24.333999][ T2306] The buggy address belongs to the object at ffff8881c53c7100 [ 24.333999][ T2306] which belongs to the cache kmalloc-192 of size 192 [ 24.334012][ T2306] The buggy address is located 0 bytes inside of [ 24.334012][ T2306] 192-byte region [ffff8881c53c7100, ffff8881c53c71c0) [ 24.338075][ T2307] R10: ffffed103a7a15db R11: 0000000000000000 R12: ffff8881c4f5f640 [ 24.357641][ T2306] The buggy address belongs to the page: [ 24.357654][ T2306] page:ffffea000714f1c0 refcount:1 mapcount:0 mapping:ffff8881da802a00 index:0xffff8881c53c7500 [ 24.357659][ T2306] flags: 0x8000000000000200(slab) [ 24.357670][ T2306] raw: 8000000000000200 ffffea0007130940 0000000c0000000c ffff8881da802a00 [ 24.357678][ T2306] raw: ffff8881c53c7500 000000008010000c 00000001ffffffff 0000000000000000 [ 24.357681][ T2306] page dumped because: kasan: bad access detected [ 24.357682][ T2306] [ 24.357692][ T2306] Memory state around the buggy address: [ 24.362667][ T2307] R13: dffffc0000000000 R14: 00000000000a0001 R15: ffff8881c4f5f668 [ 24.366724][ T2306] ffff8881c53c7000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.366729][ T2306] ffff8881c53c7080: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc [ 24.366739][ T2306] >ffff8881c53c7100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.372768][ T2307] FS: 00007f848b3d2700(0000) GS:ffff8881db800000(0000) knlGS:0000000000000000 [ 24.374899][ T2306] ^ [ 24.374906][ T2306] ffff8881c53c7180: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 24.374916][ T2306] ffff8881c53c7200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.381202][ T2307] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.384933][ T2306] ================================================================== [*[ 24.613372][ T2307] CR2: 00007f9f28037118 CR3: 00000001cacfa002 CR4: 00000000001606f0 [0m* [ 24.623533][ T2307] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [0m] A start job[ 24.631995][ T2307] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 is running for [ 24.641373][ T2307] Kernel panic - not syncing: Fatal exception dev-ttyS0.device[ 24.649306][ T2307] Kernel Offset: disabled [ 24.654907][ T2307] Rebooting in 86400 seconds..