Warning: Permanently added '10.128.0.207' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 32.127143] audit: type=1400 audit(1599198211.325:8): avc: denied { execmem } for pid=6364 comm="syz-executor689" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 32.233311] ================================================================== [ 32.233333] BUG: KASAN: global-out-of-bounds in fbcon_resize+0x705/0x7b0 [ 32.233337] Read of size 4 at addr ffffffff86e69218 by task syz-executor689/6364 [ 32.233338] [ 32.233344] CPU: 1 PID: 6364 Comm: syz-executor689 Not tainted 4.14.196-syzkaller #0 [ 32.233347] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 32.233349] Call Trace: [ 32.233356] dump_stack+0x1b2/0x283 [ 32.233366] print_address_description.cold+0x5/0x1d3 [ 32.233373] kasan_report_error.cold+0x8a/0x194 [ 32.233376] ? fbcon_resize+0x705/0x7b0 [ 32.233381] __asan_report_load4_noabort+0x68/0x70 [ 32.233386] ? kasan_unpoison_stack_above_sp_to+0x20/0x20 [ 32.233389] ? fbcon_resize+0x705/0x7b0 [ 32.233393] fbcon_resize+0x705/0x7b0 [ 32.233399] ? display_to_var+0x7b0/0x7b0 [ 32.233411] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 32.233415] ? __kmalloc+0x3a4/0x400 [ 32.233421] ? vc_do_resize+0x252/0xe00 [ 32.233425] ? display_to_var+0x7b0/0x7b0 [ 32.233433] vc_do_resize+0x38b/0xe00 [ 32.233442] ? vc_init+0x430/0x430 [ 32.233449] vt_ioctl+0x76f/0x1f50 [ 32.233455] ? security_secid_to_secctx+0xa0/0xb0 [ 32.233460] ? vt_waitactive+0x2f0/0x2f0 [ 32.233466] ? avc_ss_reset+0x100/0x100 [ 32.233469] ? kasan_slab_free+0x12d/0x1a0 [ 32.233474] ? kasan_slab_free+0xc3/0x1a0 [ 32.233478] ? kmem_cache_free+0x7c/0x2b0 [ 32.233482] ? putname+0xcd/0x110 [ 32.233486] ? do_sys_open+0x203/0x410 [ 32.233491] ? do_syscall_64+0x1d5/0x640 [ 32.233497] ? entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 32.233502] ? tty_jobctrl_ioctl+0x3f/0xe60 [ 32.233505] ? vt_waitactive+0x2f0/0x2f0 [ 32.233512] tty_ioctl+0x50f/0x13c0 [ 32.233516] ? tty_fasync+0x2c0/0x2c0 [ 32.233522] ? lock_acquire+0x170/0x3f0 [ 32.233527] ? lock_downgrade+0x740/0x740 [ 32.233534] ? _raw_spin_unlock_irqrestore+0x66/0xe0 [ 32.233541] ? tty_fasync+0x2c0/0x2c0 [ 32.233546] do_vfs_ioctl+0x75a/0xff0 [ 32.233551] ? selinux_inode_setxattr+0x730/0x730 [ 32.233556] ? ioctl_preallocate+0x1a0/0x1a0 [ 32.233560] ? kmem_cache_free+0x23a/0x2b0 [ 32.233565] ? putname+0xcd/0x110 [ 32.233569] ? do_sys_open+0x208/0x410 [ 32.233575] ? security_file_ioctl+0x83/0xb0 [ 32.233581] SyS_ioctl+0x7f/0xb0 [ 32.233585] ? do_vfs_ioctl+0xff0/0xff0 [ 32.233589] do_syscall_64+0x1d5/0x640 [ 32.233597] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 32.233601] RIP: 0033:0x4402a9 [ 32.233604] RSP: 002b:00007ffe6b515638 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 32.233609] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004402a9 [ 32.233611] RDX: 0000000020000000 RSI: 0000000000005609 RDI: 0000000000000004 [ 32.233614] RBP: 00000000006ca018 R08: 000000000000000d R09: 00000000004002c8 [ 32.233616] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401b10 [ 32.233619] R13: 0000000000401ba0 R14: 0000000000000000 R15: 0000000000000000 [ 32.233625] [ 32.233627] The buggy address belongs to the variable: [ 32.233631] font_vga_8x16+0x58/0x60 [ 32.233632] [ 32.233634] Memory state around the buggy address: [ 32.233638] ffffffff86e69100: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa [ 32.233642] ffffffff86e69180: 00 fa fa fa fa fa fa fa 00 00 00 00 00 fa fa fa [ 32.233645] >ffffffff86e69200: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.233647] ^ [ 32.233650] ffffffff86e69280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.233653] ffffffff86e69300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.233654] ================================================================== [ 32.233656] Disabling lock debugging due to kernel taint [ 32.233658] Kernel panic - not syncing: panic_on_warn set ... [ 32.233658] [ 32.233662] CPU: 1 PID: 6364 Comm: syz-executor689 Tainted: G B 4.14.196-syzkaller #0 [ 32.233664] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 32.233665] Call Trace: [ 32.233669] dump_stack+0x1b2/0x283 [ 32.233674] panic+0x1f9/0x42d [ 32.233678] ? add_taint.cold+0x16/0x16 [ 32.233683] ? lock_downgrade+0x740/0x740 [ 32.233688] kasan_end_report+0x43/0x49 [ 32.233692] kasan_report_error.cold+0xa7/0x194 [ 32.233695] ? fbcon_resize+0x705/0x7b0 [ 32.233699] __asan_report_load4_noabort+0x68/0x70 [ 32.233704] ? kasan_unpoison_stack_above_sp_to+0x20/0x20 [ 32.233707] ? fbcon_resize+0x705/0x7b0 [ 32.233710] fbcon_resize+0x705/0x7b0 [ 32.233714] ? display_to_var+0x7b0/0x7b0 [ 32.233721] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 32.233724] ? __kmalloc+0x3a4/0x400 [ 32.233728] ? vc_do_resize+0x252/0xe00 [ 32.233732] ? display_to_var+0x7b0/0x7b0 [ 32.233735] vc_do_resize+0x38b/0xe00 [ 32.233741] ? vc_init+0x430/0x430 [ 32.233746] vt_ioctl+0x76f/0x1f50 [ 32.233749] ? security_secid_to_secctx+0xa0/0xb0 [ 32.233753] ? vt_waitactive+0x2f0/0x2f0 [ 32.233757] ? avc_ss_reset+0x100/0x100 [ 32.233760] ? kasan_slab_free+0x12d/0x1a0 [ 32.233764] ? kasan_slab_free+0xc3/0x1a0 [ 32.233767] ? kmem_cache_free+0x7c/0x2b0 [ 32.233770] ? putname+0xcd/0x110 [ 32.233773] ? do_sys_open+0x203/0x410 [ 32.233776] ? do_syscall_64+0x1d5/0x640 [ 32.233780] ? entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 32.233784] ? tty_jobctrl_ioctl+0x3f/0xe60 [ 32.233787] ? vt_waitactive+0x2f0/0x2f0 [ 32.233791] tty_ioctl+0x50f/0x13c0 [ 32.233795] ? tty_fasync+0x2c0/0x2c0 [ 32.233799] ? lock_acquire+0x170/0x3f0 [ 32.233803] ? lock_downgrade+0x740/0x740 [ 32.233808] ? _raw_spin_unlock_irqrestore+0x66/0xe0 [ 32.233813] ? tty_fasync+0x2c0/0x2c0 [ 32.233818] do_vfs_ioctl+0x75a/0xff0 [ 32.233821] ? selinux_inode_setxattr+0x730/0x730 [ 32.233825] ? ioctl_preallocate+0x1a0/0x1a0 [ 32.233829] ? kmem_cache_free+0x23a/0x2b0 [ 32.233832] ? putname+0xcd/0x110 [ 32.233836] ? do_sys_open+0x208/0x410 [ 32.233840] ? security_file_ioctl+0x83/0xb0 [ 32.233844] SyS_ioctl+0x7f/0xb0 [ 32.233848] ? do_vfs_ioctl+0xff0/0xff0 [ 32.233852] do_syscall_64+0x1d5/0x640 [ 32.233858] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 32.233860] RIP: 0033:0x4402a9 [ 32.233862] RSP: 002b:00007ffe6b515638 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 32.233866] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004402a9 [ 32.233868] RDX: 0000000020000000 RSI: 0000000000005609 RDI: 0000000000000004 [ 32.233870] RBP: 00000000006ca018 R08: 000000000000000d R09: 00000000004002c8 [ 32.233872] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401b10 [ 32.233874] R13: 0000000000401ba0 R14: 0000000000000000 R15: 0000000000000000 [ 32.235086] Kernel Offset: disabled [ 32.858013] Rebooting in 86400 seconds..