[ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Debian GNU/Linux 9 syzkaller ttyS0 syzkaller login: [ 32.597198][ T6957] sshd (6957) used greatest stack depth: 24456 bytes left Warning: Permanently added '10.128.0.253' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program executing program executing program [ 41.808784][ T7167] ================================================================== [ 41.808826][ T7167] BUG: KASAN: use-after-free in con_shutdown+0x61/0x80 [ 41.808834][ T7167] Write of size 8 at addr ffff888097055108 by task syz-executor653/7167 [ 41.808837][ T7167] [ 41.808847][ T7167] CPU: 1 PID: 7167 Comm: syz-executor653 Not tainted 5.6.0-syzkaller #0 [ 41.808853][ T7167] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 41.808856][ T7167] Call Trace: [ 41.808869][ T7167] dump_stack+0x1e9/0x30e [ 41.808888][ T7167] print_address_description+0x74/0x5c0 [ 41.808903][ T7167] ? printk+0x62/0x83 [ 41.808915][ T7167] ? vprintk_emit+0x2e6/0x3b0 [ 41.808933][ T7167] __kasan_report+0x14b/0x1c0 [ 41.808945][ T7167] ? con_shutdown+0x61/0x80 [ 41.808960][ T7167] kasan_report+0x25/0x50 [ 41.808973][ T7167] con_shutdown+0x61/0x80 [ 41.808980][ T7167] ? con_close+0x10/0x10 [ 41.808991][ T7167] release_tty+0xb9/0x530 [ 41.809008][ T7167] tty_release_struct+0xb8/0xd0 [ 41.809023][ T7167] tty_release+0xe23/0x1100 [ 41.809052][ T7167] ? tty_release_struct+0xd0/0xd0 [ 41.809061][ T7167] __fput+0x2d8/0x730 [ 41.809088][ T7167] task_work_run+0x176/0x1b0 [ 41.809105][ T7167] do_exit+0x5ef/0x1f80 [ 41.809140][ T7167] do_group_exit+0x15e/0x2c0 [ 41.809149][ T7167] ? trace_irq_disable_rcuidle+0x1f/0x1d0 [ 41.809166][ T7167] __do_sys_exit_group+0x13/0x20 [ 41.809176][ T7167] __se_sys_exit_group+0x10/0x10 [ 41.809186][ T7167] __x64_sys_exit_group+0x37/0x40 [ 41.809198][ T7167] do_syscall_64+0xf3/0x1b0 [ 41.809214][ T7167] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 41.809223][ T7167] RIP: 0033:0x43ff58 [ 41.809232][ T7167] Code: 00 00 be 3c 00 00 00 eb 19 66 0f 1f 84 00 00 00 00 00 48 89 d7 89 f0 0f 05 48 3d 00 f0 ff ff 77 21 f4 48 89 d7 44 89 c0 0f 05 <48> 3d 00 f0 ff ff 76 e0 f7 d8 64 41 89 01 eb d8 0f 1f 84 00 00 00 [ 41.809237][ T7167] RSP: 002b:00007ffd9da660f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 41.809247][ T7167] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043ff58 [ 41.809252][ T7167] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 41.809258][ T7167] RBP: 00000000004bf970 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 41.809263][ T7167] R10: 000000000000000e R11: 0000000000000246 R12: 0000000000000001 [ 41.809269][ T7167] R13: 00000000006d2180 R14: 0000000000000000 R15: 0000000000000000 [ 41.809295][ T7167] [ 41.809300][ T7167] Allocated by task 7167: [ 41.809309][ T7167] __kasan_kmalloc+0x118/0x1c0 [ 41.809323][ T7167] kmem_cache_alloc_trace+0x234/0x300 [ 41.809331][ T7167] vc_allocate+0x148/0x5b0 [ 41.809338][ T7167] con_install+0x48/0x460 [ 41.809346][ T7167] tty_init_dev+0xc6/0x4c0 [ 41.809354][ T7167] tty_open+0x7cd/0xca0 [ 41.809360][ T7167] chrdev_open+0x498/0x580 [ 41.809367][ T7167] do_dentry_open+0x828/0x10a0 [ 41.809376][ T7167] path_openat+0x13b5/0x40d0 [ 41.809384][ T7167] do_filp_open+0x191/0x3a0 [ 41.809392][ T7167] do_sys_openat2+0x448/0x6c0 [ 41.809399][ T7167] __x64_sys_open+0x1af/0x1e0 [ 41.809407][ T7167] do_syscall_64+0xf3/0x1b0 [ 41.809415][ T7167] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 41.809418][ T7167] [ 41.809422][ T7167] Freed by task 7159: [ 41.809430][ T7167] __kasan_slab_free+0x12e/0x1e0 [ 41.809437][ T7167] kfree+0x10a/0x220 [ 41.809446][ T7167] vt_ioctl+0x229d/0x3a30 [ 41.809453][ T7167] tty_ioctl+0xee6/0x15c0 [ 41.809461][ T7167] __se_sys_ioctl+0xf9/0x160 [ 41.809469][ T7167] do_syscall_64+0xf3/0x1b0 [ 41.809477][ T7167] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 41.809480][ T7167] [ 41.809486][ T7167] The buggy address belongs to the object at ffff888097055000 [ 41.809486][ T7167] which belongs to the cache kmalloc-2k of size 2048 [ 41.809493][ T7167] The buggy address is located 264 bytes inside of [ 41.809493][ T7167] 2048-byte region [ffff888097055000, ffff888097055800) [ 41.809497][ T7167] The buggy address belongs to the page: [ 41.809505][ T7167] page:ffffea00025c1540 refcount:1 mapcount:0 mapping:ffff8880aa400e00 index:0x0 [ 41.809512][ T7167] flags: 0xfffe0000000200(slab) [ 41.809523][ T7167] raw: 00fffe0000000200 ffffea00029947c8 ffffea00025c3708 ffff8880aa400e00 [ 41.809532][ T7167] raw: 0000000000000000 ffff888097055000 0000000100000001 0000000000000000 [ 41.809535][ T7167] page dumped because: kasan: bad access detected [ 41.809538][ T7167] [ 41.809548][ T7167] Memory state around the buggy address: [ 41.809554][ T7167] ffff888097055000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 41.809561][ T7167] ffff888097055080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 41.809567][ T7167] >ffff888097055100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 41.809570][ T7167] ^ [ 41.809576][ T7167] ffff888097055180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 41.809582][ T7167] ffff888097055200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 41.809586][ T7167] ================================================================== [ 41.809589][ T7167] Disabling lock debugging due to kernel taint [ 41.809624][ T7167] Kernel panic - not syncing: panic_on_warn set ... [ 41.809633][ T7167] CPU: 1 PID: 7167 Comm: syz-executor653 Tainted: G B 5.6.0-syzkaller #0 [ 41.809636][ T7167] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 41.809638][ T7167] Call Trace: [ 41.809648][ T7167] dump_stack+0x1e9/0x30e [ 41.809658][ T7167] panic+0x264/0x7a0 [ 41.809667][ T7167] ? trace_hardirqs_on+0x30/0x70 [ 41.809677][ T7167] ? _raw_spin_unlock_irqrestore+0xa5/0xd0 [ 41.809686][ T7167] __kasan_report+0x1bc/0x1c0 [ 41.809695][ T7167] ? con_shutdown+0x61/0x80 [ 41.809705][ T7167] kasan_report+0x25/0x50 [ 41.809714][ T7167] con_shutdown+0x61/0x80 [ 41.809721][ T7167] ? con_close+0x10/0x10 [ 41.809729][ T7167] release_tty+0xb9/0x530 [ 41.809739][ T7167] tty_release_struct+0xb8/0xd0 [ 41.809749][ T7167] tty_release+0xe23/0x1100 [ 41.809766][ T7167] ? tty_release_struct+0xd0/0xd0 [ 41.809772][ T7167] __fput+0x2d8/0x730 [ 41.809789][ T7167] task_work_run+0x176/0x1b0 [ 41.809800][ T7167] do_exit+0x5ef/0x1f80 [ 41.809819][ T7167] do_group_exit+0x15e/0x2c0 [ 41.809828][ T7167] ? trace_irq_disable_rcuidle+0x1f/0x1d0 [ 41.809839][ T7167] __do_sys_exit_group+0x13/0x20 [ 41.809846][ T7167] __se_sys_exit_group+0x10/0x10 [ 41.809853][ T7167] __x64_sys_exit_group+0x37/0x40 [ 41.809862][ T7167] do_syscall_64+0xf3/0x1b0 [ 41.809873][ T7167] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 41.809879][ T7167] RIP: 0033:0x43ff58 [ 41.809886][ T7167] Code: 00 00 be 3c 00 00 00 eb 19 66 0f 1f 84 00 00 00 00 00 48 89 d7 89 f0 0f 05 48 3d 00 f0 ff ff 77 21 f4 48 89 d7 44 89 c0 0f 05 <48> 3d 00 f0 ff ff 76 e0 f7 d8 64 41 89 01 eb d8 0f 1f 84 00 00 00 [ 41.809890][ T7167] RSP: 002b:00007ffd9da660f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 41.809897][ T7167] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043ff58 [ 41.809902][ T7167] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 41.809906][ T7167] RBP: 00000000004bf970 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 41.809911][ T7167] R10: 000000000000000e R11: 0000000000000246 R12: 0000000000000001 [ 41.809915][ T7167] R13: 00000000006d2180 R14: 0000000000000000 R15: 0000000000000000 [ 41.811404][ T7167] Kernel Offset: disabled