INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added 'ci-upstream-kasan-gce-3,10.128.0.47' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 26.816714] ================================================================== [ 26.817837] BUG: KASAN: global-out-of-bounds in show_timer+0x278/0x2b0 [ 26.818713] Read of size 8 at addr ffffffff85352a20 by task syzkaller068222/3087 [ 26.819697] [ 26.819956] CPU: 1 PID: 3087 Comm: syzkaller068222 Not tainted 4.15.0-rc2+ #208 [ 26.820946] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 26.822164] Call Trace: [ 26.822523] dump_stack+0x194/0x257 [ 26.823017] ? arch_local_irq_restore+0x53/0x53 [ 26.823639] ? show_regs_print_info+0x65/0x65 [ 26.824242] ? seq_printf+0xb3/0xe0 [ 26.824732] ? show_timer+0x278/0x2b0 [ 26.825243] print_address_description+0x178/0x250 [ 26.825901] ? show_timer+0x278/0x2b0 [ 26.826412] kasan_report+0x25b/0x340 [ 26.826926] __asan_report_load8_noabort+0x14/0x20 [ 26.827579] show_timer+0x278/0x2b0 [ 26.828065] ? timers_start+0x14c/0x1c0 [ 26.828599] traverse+0x248/0xa00 [ 26.829075] ? seq_hlist_next+0xc0/0xc0 [ 26.829620] seq_read+0x96a/0x13d0 [ 26.830114] ? seq_lseek+0x3c0/0x3c0 [ 26.830613] ? selinux_file_permission+0x82/0x460 [ 26.831262] ? security_file_permission+0x89/0x1f0 [ 26.831937] ? rw_verify_area+0xe5/0x2b0 [ 26.832484] do_iter_read+0x3db/0x5b0 [ 26.832995] ? dup_iter+0x260/0x260 [ 26.833510] vfs_readv+0x121/0x1c0 [ 26.833985] ? may_open_dev+0xe0/0xe0 [ 26.834501] ? compat_rw_copy_check_uvector+0x2e0/0x2e0 [ 26.835216] ? mm_fault_error+0x2c0/0x2c0 [ 26.835779] ? fget_raw+0x20/0x20 [ 26.836248] ? do_page_fault+0xee/0x720 [ 26.836804] ? putname+0xf3/0x130 [ 26.837273] ? do_sys_open+0x320/0x6d0 [ 26.841135] do_preadv+0x11b/0x1a0 [ 26.844641] ? do_preadv+0x11b/0x1a0 [ 26.848325] SyS_preadv+0x30/0x40 [ 26.851749] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 26.856470] RIP: 0033:0x440159 [ 26.859626] RSP: 002b:00007ffd8c0876b8 EFLAGS: 00000213 ORIG_RAX: 0000000000000127 [ 26.867302] RAX: ffffffffffffffda RBX: 00007ffd8c0876c0 RCX: 0000000000440159 [ 26.874541] RDX: 0000000000000001 RSI: 00000000205e2ff0 RDI: 0000000000000003 [ 26.881778] RBP: 0000000000000000 R08: 0000000000000011 R09: 65732f636f72702f [ 26.889012] R10: 0000000000000003 R11: 0000000000000213 R12: 0000000000401a20 [ 26.896260] R13: 0000000000401ab0 R14: 0000000000000000 R15: 0000000000000000 [ 26.903514] [ 26.905110] The buggy address belongs to the variable: [ 26.910362] tokens+0xb40/0xda0 [ 26.913611] [ 26.915205] Memory state around the buggy address: [ 26.920104] ffffffff85352900: fa fa fa fa 00 00 06 fa fa fa fa fa 00 00 00 00 [ 26.927432] ffffffff85352980: fa fa fa fa 00 07 fa fa fa fa fa fa 00 00 00 00 [ 26.934761] >ffffffff85352a00: 03 fa fa fa fa fa fa fa 00 00 02 fa fa fa fa fa [ 26.942082] ^ [ 26.946456] ffffffff85352a80: 00 00 00 00 00 fa fa fa fa fa fa fa 00 00 03 fa [ 26.953778] ffffffff85352b00: fa fa fa fa 00 00 00 00 00 05 fa fa fa fa fa fa [ 26.961097] ================================================================== [ 26.968420] Disabling lock debugging due to kernel taint [ 26.973831] Kernel panic - not syncing: panic_on_warn set ... [ 26.973831] [ 26.981155] CPU: 1 PID: 3087 Comm: syzkaller068222 Tainted: G B 4.15.0-rc2+ #208 [ 26.989867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 26.999184] Call Trace: [ 27.001738] dump_stack+0x194/0x257 [ 27.005332] ? arch_local_irq_restore+0x53/0x53 [ 27.009966] ? vprintk_default+0x28/0x30 [ 27.013989] ? vsnprintf+0x1ed/0x1900 [ 27.017753] ? show_timer+0x270/0x2b0 [ 27.021517] panic+0x1e4/0x41c [ 27.024671] ? refcount_error_report+0x214/0x214 [ 27.029392] ? add_taint+0x40/0x50 [ 27.032897] ? add_taint+0x1c/0x50 [ 27.036403] ? show_timer+0x278/0x2b0 [ 27.040168] kasan_end_report+0x50/0x50 [ 27.044106] kasan_report+0x144/0x340 [ 27.047874] __asan_report_load8_noabort+0x14/0x20 [ 27.052769] show_timer+0x278/0x2b0 [ 27.056370] ? timers_start+0x14c/0x1c0 [ 27.060311] traverse+0x248/0xa00 [ 27.063730] ? seq_hlist_next+0xc0/0xc0 [ 27.067672] seq_read+0x96a/0x13d0 [ 27.071183] ? seq_lseek+0x3c0/0x3c0 [ 27.074861] ? selinux_file_permission+0x82/0x460 [ 27.079670] ? security_file_permission+0x89/0x1f0 [ 27.084564] ? rw_verify_area+0xe5/0x2b0 [ 27.088590] do_iter_read+0x3db/0x5b0 [ 27.092356] ? dup_iter+0x260/0x260 [ 27.095949] vfs_readv+0x121/0x1c0 [ 27.099455] ? may_open_dev+0xe0/0xe0 [ 27.103220] ? compat_rw_copy_check_uvector+0x2e0/0x2e0 [ 27.108550] ? mm_fault_error+0x2c0/0x2c0 [ 27.112665] ? fget_raw+0x20/0x20 [ 27.116081] ? do_page_fault+0xee/0x720 [ 27.120021] ? putname+0xf3/0x130 [ 27.123437] ? do_sys_open+0x320/0x6d0 [ 27.127289] do_preadv+0x11b/0x1a0 [ 27.130792] ? do_preadv+0x11b/0x1a0 [ 27.134470] SyS_preadv+0x30/0x40 [ 27.137889] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 27.142607] RIP: 0033:0x440159 [ 27.145760] RSP: 002b:00007ffd8c0876b8 EFLAGS: 00000213 ORIG_RAX: 0000000000000127 [ 27.153433] RAX: ffffffffffffffda RBX: 00007ffd8c0876c0 RCX: 0000000000440159 [ 27.160665] RDX: 0000000000000001 RSI: 00000000205e2ff0 RDI: 0000000000000003 [ 27.167899] RBP: 0000000000000000 R08: 0000000000000011 R09: 65732f636f72702f [ 27.175131] R10: 0000000000000003 R11: 0000000000000213 R12: 0000000000401a20 [ 27.182365] R13: 0000000000401ab0 R14: 0000000000000000 R15: 0000000000000000 [ 27.189638] Dumping ftrace buffer: [ 27.193142] (ftrace buffer empty) [ 27.196816] Kernel Offset: disabled [ 27.200407] Rebooting in 86400 seconds..