[ 39.833420] audit: type=1800 audit(1575337445.131:32): pid=7517 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2450 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 46.032707] kauditd_printk_skb: 2 callbacks suppressed [ 46.032721] audit: type=1400 audit(1575337451.411:35): avc: denied { map } for pid=7691 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.97' (ECDSA) to the list of known hosts. executing program [ 52.732058] audit: type=1400 audit(1575337458.111:36): avc: denied { map } for pid=7703 comm="syz-executor492" path="/root/syz-executor492736077" dev="sda1" ino=16483 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 52.810048] ================================================================== [ 52.810077] BUG: KASAN: global-out-of-bounds in vga16fb_imageblit+0x1c8b/0x2200 [ 52.810084] Read of size 2 at addr ffffffff87ef13d8 by task syz-executor492/7703 [ 52.810087] [ 52.810096] CPU: 1 PID: 7703 Comm: syz-executor492 Not tainted 4.19.87-syzkaller #0 [ 52.810101] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 52.810105] Call Trace: [ 52.810117] dump_stack+0x197/0x210 [ 52.810127] ? vga16fb_imageblit+0x1c8b/0x2200 [ 52.810138] print_address_description.cold+0x5/0x20d [ 52.810146] ? vga16fb_imageblit+0x1c8b/0x2200 [ 52.810154] kasan_report.cold+0x8c/0x2ba [ 52.810165] __asan_report_load2_noabort+0x14/0x20 [ 52.810172] vga16fb_imageblit+0x1c8b/0x2200 [ 52.810188] soft_cursor+0x4fb/0xa30 [ 52.810202] bit_cursor+0x12fc/0x1a60 [ 52.810214] ? bit_clear+0x530/0x530 [ 52.810229] ? tty_do_resize+0x5e/0x170 [ 52.810245] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 52.810252] ? get_color+0x225/0x430 [ 52.810262] fbcon_cursor+0x58a/0x7b0 [ 52.810268] ? bit_clear+0x530/0x530 [ 52.810280] hide_cursor+0x9e/0x300 [ 52.810290] redraw_screen+0x2ee/0x8e0 [ 52.810300] ? con_flush_chars+0xa0/0xa0 [ 52.810311] ? mutex_unlock+0xd/0x10 [ 52.810320] vc_do_resize+0x118e/0x14a0 [ 52.810328] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 52.810344] ? vc_uniscr_alloc+0xd0/0xd0 [ 52.810356] ? mark_held_locks+0x100/0x100 [ 52.810367] vc_resize+0x4d/0x60 [ 52.810375] fbcon_modechanged+0x397/0x900 [ 52.810386] fbcon_event_notify+0x1bd/0x1dba [ 52.810396] ? lock_acquire+0x16f/0x3f0 [ 52.810407] notifier_call_chain+0xc2/0x230 [ 52.810420] blocking_notifier_call_chain+0x94/0xb0 [ 52.810432] fb_notifier_call_chain+0x25/0x30 [ 52.810440] fb_set_var+0xc8f/0xe80 [ 52.810450] ? fb_set_suspend+0x130/0x130 [ 52.810458] ? lock_acquire+0x16f/0x3f0 [ 52.810465] ? lock_fb_info+0x1f/0x80 [ 52.810478] ? __mutex_lock+0x3cd/0x1300 [ 52.810485] ? mark_held_locks+0x100/0x100 [ 52.810492] ? lock_acquire+0x16f/0x3f0 [ 52.810500] ? lock_fb_info+0x1f/0x80 [ 52.810511] ? mutex_trylock+0x1e0/0x1e0 [ 52.810517] ? down+0x70/0x90 [ 52.810533] ? do_fb_ioctl+0x3e1/0xab0 [ 52.810544] ? mutex_lock_nested+0x16/0x20 [ 52.810553] do_fb_ioctl+0x450/0xab0 [ 52.810562] ? fb_read+0x580/0x580 [ 52.810571] ? kasan_check_read+0x11/0x20 [ 52.810580] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 52.810590] ? avc_has_extended_perms+0xa78/0x10f0 [ 52.810603] ? avc_ss_reset+0x190/0x190 [ 52.810611] ? __kasan_slab_free+0x102/0x150 [ 52.810618] ? kasan_slab_free+0xe/0x10 [ 52.810624] ? kmem_cache_free+0x86/0x260 [ 52.810632] ? putname+0xef/0x130 [ 52.810639] ? do_sys_open+0x318/0x550 [ 52.810646] ? __x64_sys_openat+0x9d/0x100 [ 52.810654] ? do_syscall_64+0xfd/0x620 [ 52.810662] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 52.810685] fb_ioctl+0xe6/0x130 [ 52.810692] ? do_fb_ioctl+0xab0/0xab0 [ 52.810700] do_vfs_ioctl+0xd5f/0x1380 [ 52.810708] ? selinux_file_ioctl+0x46f/0x5e0 [ 52.810715] ? selinux_file_ioctl+0x125/0x5e0 [ 52.810724] ? ioctl_preallocate+0x210/0x210 [ 52.810731] ? selinux_file_mprotect+0x620/0x620 [ 52.810739] ? kmem_cache_free+0x222/0x260 [ 52.810750] ? do_sys_open+0x31d/0x550 [ 52.810761] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 52.810768] ? security_file_ioctl+0x8d/0xc0 [ 52.810777] ksys_ioctl+0xab/0xd0 [ 52.810787] __x64_sys_ioctl+0x73/0xb0 [ 52.810796] do_syscall_64+0xfd/0x620 [ 52.810805] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 52.810812] RIP: 0033:0x440309 [ 52.810820] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 52.810825] RSP: 002b:00007ffd9dac5c08 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 52.810833] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440309 [ 52.810838] RDX: 0000000020000100 RSI: 0000000000004601 RDI: 0000000000000003 [ 52.810842] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 52.810847] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401b90 [ 52.810851] R13: 0000000000401c20 R14: 0000000000000000 R15: 0000000000000000 [ 52.810861] [ 52.810864] The buggy address belongs to the variable: [ 52.810873] transl_h+0x38/0x40 [ 52.810875] [ 52.810877] Memory state around the buggy address: [ 52.810885] ffffffff87ef1280: 00 00 00 00 fa fa fa fa 00 00 00 00 fa fa fa fa [ 52.810891] ffffffff87ef1300: 00 00 00 00 00 fa fa fa fa fa fa fa 04 fa fa fa [ 52.810897] >ffffffff87ef1380: fa fa fa fa 00 00 00 00 fa fa fa fa 00 00 00 00 [ 52.810900] ^ [ 52.810906] ffffffff87ef1400: fa fa fa fa 00 01 fa fa fa fa fa fa 00 00 00 04 [ 52.810912] ffffffff87ef1480: fa fa fa fa 00 00 04 fa fa fa fa fa 00 00 00 00 [ 52.810915] ================================================================== [ 52.810917] Disabling lock debugging due to kernel taint [ 52.810922] Kernel panic - not syncing: panic_on_warn set ... [ 52.810922] [ 52.810929] CPU: 1 PID: 7703 Comm: syz-executor492 Tainted: G B 4.19.87-syzkaller #0 [ 52.810933] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 52.810935] Call Trace: [ 52.810942] dump_stack+0x197/0x210 [ 52.810950] ? vga16fb_imageblit+0x1c8b/0x2200 [ 52.810956] panic+0x26a/0x50e [ 52.810962] ? __warn_printk+0xf3/0xf3 [ 52.810970] ? lock_downgrade+0x880/0x880 [ 52.810979] ? trace_hardirqs_on+0x67/0x220 [ 52.810986] ? trace_hardirqs_on+0x5e/0x220 [ 52.810994] ? vga16fb_imageblit+0x1c8b/0x2200 [ 52.811001] kasan_end_report+0x47/0x4f [ 52.811008] kasan_report.cold+0xa9/0x2ba [ 52.811017] __asan_report_load2_noabort+0x14/0x20 [ 52.811023] vga16fb_imageblit+0x1c8b/0x2200 [ 52.811034] soft_cursor+0x4fb/0xa30 [ 52.811043] bit_cursor+0x12fc/0x1a60 [ 52.811052] ? bit_clear+0x530/0x530 [ 52.811059] ? tty_do_resize+0x5e/0x170 [ 52.811069] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 52.811076] ? get_color+0x225/0x430 [ 52.811083] fbcon_cursor+0x58a/0x7b0 [ 52.811089] ? bit_clear+0x530/0x530 [ 52.811097] hide_cursor+0x9e/0x300 [ 52.811105] redraw_screen+0x2ee/0x8e0 [ 52.811114] ? con_flush_chars+0xa0/0xa0 [ 52.811121] ? mutex_unlock+0xd/0x10 [ 52.811129] vc_do_resize+0x118e/0x14a0 [ 52.811136] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 52.811146] ? vc_uniscr_alloc+0xd0/0xd0 [ 52.811154] ? mark_held_locks+0x100/0x100 [ 52.811162] vc_resize+0x4d/0x60 [ 52.811169] fbcon_modechanged+0x397/0x900 [ 52.811178] fbcon_event_notify+0x1bd/0x1dba [ 52.811185] ? lock_acquire+0x16f/0x3f0 [ 52.811194] notifier_call_chain+0xc2/0x230 [ 52.811204] blocking_notifier_call_chain+0x94/0xb0 [ 52.811212] fb_notifier_call_chain+0x25/0x30 [ 52.811219] fb_set_var+0xc8f/0xe80 [ 52.811233] ? fb_set_suspend+0x130/0x130 [ 52.811240] ? lock_acquire+0x16f/0x3f0 [ 52.811246] ? lock_fb_info+0x1f/0x80 [ 52.811256] ? __mutex_lock+0x3cd/0x1300 [ 52.811262] ? mark_held_locks+0x100/0x100 [ 52.811269] ? lock_acquire+0x16f/0x3f0 [ 52.811276] ? lock_fb_info+0x1f/0x80 [ 52.811284] ? mutex_trylock+0x1e0/0x1e0 [ 52.811290] ? down+0x70/0x90 [ 52.811301] ? do_fb_ioctl+0x3e1/0xab0 [ 52.811309] ? mutex_lock_nested+0x16/0x20 [ 52.811317] do_fb_ioctl+0x450/0xab0 [ 52.811324] ? fb_read+0x580/0x580 [ 52.811331] ? kasan_check_read+0x11/0x20 [ 52.811339] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 52.811347] ? avc_has_extended_perms+0xa78/0x10f0 [ 52.811356] ? avc_ss_reset+0x190/0x190 [ 52.811363] ? __kasan_slab_free+0x102/0x150 [ 52.811370] ? kasan_slab_free+0xe/0x10 [ 52.811376] ? kmem_cache_free+0x86/0x260 [ 52.811383] ? putname+0xef/0x130 [ 52.811389] ? do_sys_open+0x318/0x550 [ 52.811395] ? __x64_sys_openat+0x9d/0x100 [ 52.811401] ? do_syscall_64+0xfd/0x620 [ 52.811408] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 52.811423] fb_ioctl+0xe6/0x130 [ 52.811430] ? do_fb_ioctl+0xab0/0xab0 [ 52.811436] do_vfs_ioctl+0xd5f/0x1380 [ 52.811443] ? selinux_file_ioctl+0x46f/0x5e0 [ 52.811450] ? selinux_file_ioctl+0x125/0x5e0 [ 52.811457] ? ioctl_preallocate+0x210/0x210 [ 52.811464] ? selinux_file_mprotect+0x620/0x620 [ 52.811470] ? kmem_cache_free+0x222/0x260 [ 52.811479] ? do_sys_open+0x31d/0x550 [ 52.811487] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 52.811494] ? security_file_ioctl+0x8d/0xc0 [ 52.811501] ksys_ioctl+0xab/0xd0 [ 52.811509] __x64_sys_ioctl+0x73/0xb0 [ 52.811516] do_syscall_64+0xfd/0x620 [ 52.811524] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 52.811529] RIP: 0033:0x440309 [ 52.811535] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 52.811539] RSP: 002b:00007ffd9dac5c08 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 52.811545] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440309 [ 52.811549] RDX: 0000000020000100 RSI: 0000000000004601 RDI: 0000000000000003 [ 52.811553] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 52.811557] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401b90 [ 52.811561] R13: 0000000000401c20 R14: 0000000000000000 R15: 0000000000000000 [ 52.813041] Kernel Offset: disabled [ 53.700237] Rebooting in 86400 seconds..