[ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.134' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program syzkaller login: [ 41.239811][ T7177] ================================================================== [ 41.239855][ T7177] BUG: KASAN: use-after-free in con_shutdown+0x61/0x80 [ 41.239863][ T7177] Write of size 8 at addr ffff8880a6bde108 by task syz-executor427/7177 [ 41.239866][ T7177] [ 41.239876][ T7177] CPU: 1 PID: 7177 Comm: syz-executor427 Not tainted 5.6.0-rc7-syzkaller #0 [ 41.239881][ T7177] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 41.239885][ T7177] Call Trace: [ 41.239898][ T7177] dump_stack+0x1e9/0x30e [ 41.239916][ T7177] print_address_description+0x74/0x5c0 [ 41.239930][ T7177] ? printk+0x62/0x83 [ 41.239942][ T7177] ? vprintk_emit+0x2e6/0x3b0 [ 41.239959][ T7177] __kasan_report+0x14b/0x1c0 [ 41.239971][ T7177] ? con_shutdown+0x61/0x80 [ 41.239986][ T7177] kasan_report+0x25/0x50 [ 41.239998][ T7177] con_shutdown+0x61/0x80 [ 41.240005][ T7177] ? con_close+0x10/0x10 [ 41.240015][ T7177] release_tty+0xb9/0x530 [ 41.240032][ T7177] tty_release_struct+0xb8/0xd0 [ 41.240046][ T7177] tty_release+0xe23/0x1100 [ 41.240077][ T7177] ? tty_release_struct+0xd0/0xd0 [ 41.240086][ T7177] __fput+0x2d8/0x730 [ 41.240112][ T7177] task_work_run+0x176/0x1b0 [ 41.240130][ T7177] do_exit+0x5ef/0x1f80 [ 41.240153][ T7177] ? __up_read+0x1f1/0x6e0 [ 41.240172][ T7177] do_group_exit+0x15e/0x2c0 [ 41.240180][ T7177] ? trace_irq_disable_rcuidle+0x1f/0x1d0 [ 41.240197][ T7177] __do_sys_exit_group+0x13/0x20 [ 41.240206][ T7177] __se_sys_exit_group+0x10/0x10 [ 41.240215][ T7177] __x64_sys_exit_group+0x37/0x40 [ 41.240226][ T7177] do_syscall_64+0xf3/0x1b0 [ 41.240243][ T7177] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 41.240252][ T7177] RIP: 0033:0x43ff38 [ 41.240261][ T7177] Code: 00 00 be 3c 00 00 00 eb 19 66 0f 1f 84 00 00 00 00 00 48 89 d7 89 f0 0f 05 48 3d 00 f0 ff ff 77 21 f4 48 89 d7 44 89 c0 0f 05 <48> 3d 00 f0 ff ff 76 e0 f7 d8 64 41 89 01 eb d8 0f 1f 84 00 00 00 [ 41.240266][ T7177] RSP: 002b:00007ffcddde4fb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 41.240275][ T7177] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043ff38 [ 41.240280][ T7177] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 41.240286][ T7177] RBP: 00000000004bf950 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 41.240291][ T7177] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 41.240296][ T7177] R13: 00000000006d2180 R14: 0000000000000000 R15: 0000000000000000 [ 41.240320][ T7177] [ 41.240325][ T7177] Allocated by task 7177: [ 41.240334][ T7177] __kasan_kmalloc+0x118/0x1c0 [ 41.240349][ T7177] kmem_cache_alloc_trace+0x234/0x300 [ 41.240356][ T7177] vc_allocate+0x148/0x5b0 [ 41.240364][ T7177] con_install+0x48/0x460 [ 41.240371][ T7177] tty_init_dev+0xc6/0x4c0 [ 41.240379][ T7177] tty_open+0x7cd/0xca0 [ 41.240386][ T7177] chrdev_open+0x498/0x580 [ 41.240393][ T7177] do_dentry_open+0x828/0x10a0 [ 41.240401][ T7177] path_openat+0x13b5/0x40d0 [ 41.240408][ T7177] do_filp_open+0x191/0x3a0 [ 41.240415][ T7177] do_sys_openat2+0x448/0x6c0 [ 41.240422][ T7177] __x64_sys_open+0x1af/0x1e0 [ 41.240429][ T7177] do_syscall_64+0xf3/0x1b0 [ 41.240437][ T7177] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 41.240440][ T7177] [ 41.240444][ T7177] Freed by task 7178: [ 41.240452][ T7177] __kasan_slab_free+0x12e/0x1e0 [ 41.240463][ T7177] kfree+0x10a/0x220 [ 41.240471][ T7177] vt_ioctl+0x229d/0x3a30 [ 41.240479][ T7177] tty_ioctl+0xee6/0x15c0 [ 41.240486][ T7177] __se_sys_ioctl+0xf9/0x160 [ 41.240494][ T7177] do_syscall_64+0xf3/0x1b0 [ 41.240503][ T7177] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 41.240505][ T7177] [ 41.240513][ T7177] The buggy address belongs to the object at ffff8880a6bde000 [ 41.240513][ T7177] which belongs to the cache kmalloc-2k of size 2048 [ 41.240521][ T7177] The buggy address is located 264 bytes inside of [ 41.240521][ T7177] 2048-byte region [ffff8880a6bde000, ffff8880a6bde800) [ 41.240525][ T7177] The buggy address belongs to the page: [ 41.240533][ T7177] page:ffffea00029af780 refcount:1 mapcount:0 mapping:ffff8880aa400e00 index:0x0 [ 41.240540][ T7177] flags: 0xfffe0000000200(slab) [ 41.240552][ T7177] raw: 00fffe0000000200 ffffea00029af748 ffffea00029af808 ffff8880aa400e00 [ 41.240561][ T7177] raw: 0000000000000000 ffff8880a6bde000 0000000100000001 0000000000000000 [ 41.240565][ T7177] page dumped because: kasan: bad access detected [ 41.240567][ T7177] [ 41.240571][ T7177] Memory state around the buggy address: [ 41.240577][ T7177] ffff8880a6bde000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 41.240584][ T7177] ffff8880a6bde080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 41.240590][ T7177] >ffff8880a6bde100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 41.240593][ T7177] ^ [ 41.240600][ T7177] ffff8880a6bde180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 41.240606][ T7177] ffff8880a6bde200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 41.240610][ T7177] ================================================================== [ 41.240614][ T7177] Disabling lock debugging due to kernel taint [ 41.240642][ T7177] Kernel panic - not syncing: panic_on_warn set ... [ 41.240651][ T7177] CPU: 1 PID: 7177 Comm: syz-executor427 Tainted: G B 5.6.0-rc7-syzkaller #0 [ 41.240655][ T7177] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 41.240658][ T7177] Call Trace: [ 41.240668][ T7177] dump_stack+0x1e9/0x30e [ 41.240678][ T7177] panic+0x264/0x7a0 [ 41.240688][ T7177] ? trace_hardirqs_on+0x30/0x70 [ 41.240698][ T7177] ? _raw_spin_unlock_irqrestore+0xa5/0xd0 [ 41.240708][ T7177] __kasan_report+0x1bc/0x1c0 [ 41.240717][ T7177] ? con_shutdown+0x61/0x80 [ 41.240727][ T7177] kasan_report+0x25/0x50 [ 41.240736][ T7177] con_shutdown+0x61/0x80 [ 41.240743][ T7177] ? con_close+0x10/0x10 [ 41.240750][ T7177] release_tty+0xb9/0x530 [ 41.240762][ T7177] tty_release_struct+0xb8/0xd0 [ 41.240772][ T7177] tty_release+0xe23/0x1100 [ 41.240791][ T7177] ? tty_release_struct+0xd0/0xd0 [ 41.240797][ T7177] __fput+0x2d8/0x730 [ 41.240813][ T7177] task_work_run+0x176/0x1b0 [ 41.240825][ T7177] do_exit+0x5ef/0x1f80 [ 41.240838][ T7177] ? __up_read+0x1f1/0x6e0 [ 41.240850][ T7177] do_group_exit+0x15e/0x2c0 [ 41.240858][ T7177] ? trace_irq_disable_rcuidle+0x1f/0x1d0 [ 41.240870][ T7177] __do_sys_exit_group+0x13/0x20 [ 41.240879][ T7177] __se_sys_exit_group+0x10/0x10 [ 41.240887][ T7177] __x64_sys_exit_group+0x37/0x40 [ 41.240896][ T7177] do_syscall_64+0xf3/0x1b0 [ 41.240908][ T7177] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 41.240914][ T7177] RIP: 0033:0x43ff38 [ 41.240921][ T7177] Code: 00 00 be 3c 00 00 00 eb 19 66 0f 1f 84 00 00 00 00 00 48 89 d7 89 f0 0f 05 48 3d 00 f0 ff ff 77 21 f4 48 89 d7 44 89 c0 0f 05 <48> 3d 00 f0 ff ff 76 e0 f7 d8 64 41 89 01 eb d8 0f 1f 84 00 00 00 [ 41.240926][ T7177] RSP: 002b:00007ffcddde4fb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 41.240934][ T7177] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043ff38 [ 41.240939][ T7177] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 41.240943][ T7177] RBP: 00000000004bf950 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 41.240948][ T7177] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 41.240953][ T7177] R13: 00000000006d2180 R14: 0000000000000000 R15: 0000000000000000 [ 41.242307][ T7177] Kernel Offset: disabled [ 41.943377][ T7177] Rebooting in 86400 seconds..