[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 29.116814] kauditd_printk_skb: 7 callbacks suppressed [ 29.116826] audit: type=1800 audit(1543148444.172:29): pid=5899 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 29.143200] audit: type=1800 audit(1543148444.182:30): pid=5899 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 33.912025] sshd (6037) used greatest stack depth: 15744 bytes left Warning: Permanently added '10.128.0.55' (ECDSA) to the list of known hosts. executing program [ 40.584673] ================================================================== [ 40.592142] BUG: KASAN: slab-out-of-bounds in queue_stack_map_push_elem+0x185/0x290 [ 40.600025] Write of size 262146 at addr ffff8881c1282148 by task syz-executor702/6053 [ 40.608063] [ 40.609702] CPU: 1 PID: 6053 Comm: syz-executor702 Not tainted 4.20.0-rc3+ #251 [ 40.617128] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 40.626483] Call Trace: [ 40.629058] dump_stack+0x244/0x39d [ 40.632684] ? dump_stack_print_info.cold.1+0x20/0x20 [ 40.637857] ? printk+0xa7/0xcf [ 40.641122] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 40.645866] print_address_description.cold.7+0x9/0x1ff [ 40.651217] kasan_report.cold.8+0x242/0x309 [ 40.655614] ? queue_stack_map_push_elem+0x185/0x290 [ 40.660722] check_memory_region+0x13e/0x1b0 [ 40.665118] memcpy+0x37/0x50 [ 40.668212] queue_stack_map_push_elem+0x185/0x290 [ 40.673155] ? queue_map_pop_elem+0x30/0x30 [ 40.677464] map_update_elem+0x605/0xf60 [ 40.681520] __ia32_sys_bpf+0x32d/0x520 [ 40.685495] ? __x64_sys_bpf+0x520/0x520 [ 40.689563] ? __do_page_fault+0x491/0xe60 [ 40.693794] do_fast_syscall_32+0x34d/0xfb2 [ 40.698118] ? do_int80_syscall_32+0x890/0x890 [ 40.702701] ? entry_SYSENTER_compat+0x68/0x7f [ 40.707270] ? trace_hardirqs_off_caller+0xbb/0x310 [ 40.712291] ? syscall_return_slowpath+0x5e0/0x5e0 [ 40.717206] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 40.722033] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 40.726863] ? trace_hardirqs_on_caller+0x310/0x310 [ 40.731865] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 40.736868] ? prepare_exit_to_usermode+0x291/0x3b0 [ 40.741877] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 40.746721] entry_SYSENTER_compat+0x70/0x7f [ 40.751115] RIP: 0023:0xf7f37a29 [ 40.754466] Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 14 24 c3 8b 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 40.773368] RSP: 002b:00000000ff7febdc EFLAGS: 00000213 ORIG_RAX: 0000000000000165 [ 40.781094] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 0000000020000040 [ 40.788363] RDX: 0000000000000020 RSI: 00000000080ea078 RDI: 00000000ff7fec30 [ 40.795615] RBP: 0000000000001000 R08: 0000000000000000 R09: 0000000000000000 [ 40.802868] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 40.810121] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 40.817395] [ 40.819023] Allocated by task 6053: [ 40.822653] save_stack+0x43/0xd0 [ 40.826097] kasan_kmalloc+0xc7/0xe0 [ 40.829797] __kmalloc_node+0x50/0x70 [ 40.833600] bpf_map_area_alloc+0x3f/0x90 [ 40.837741] queue_stack_map_alloc+0x192/0x290 [ 40.842319] map_create+0x3bd/0x1110 [ 40.846014] __ia32_sys_bpf+0x303/0x520 [ 40.849969] do_fast_syscall_32+0x34d/0xfb2 [ 40.854308] entry_SYSENTER_compat+0x70/0x7f [ 40.858698] [ 40.860322] Freed by task 3751: [ 40.863586] save_stack+0x43/0xd0 [ 40.867022] __kasan_slab_free+0x102/0x150 [ 40.871237] kasan_slab_free+0xe/0x10 [ 40.875050] kfree+0xcf/0x230 [ 40.878151] kernfs_fop_release+0x12b/0x1a0 [ 40.882472] __fput+0x385/0xa30 [ 40.885748] ____fput+0x15/0x20 [ 40.889010] task_work_run+0x1e8/0x2a0 [ 40.892879] exit_to_usermode_loop+0x318/0x380 [ 40.897439] do_syscall_64+0x6be/0x820 [ 40.901310] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 40.906478] [ 40.908103] The buggy address belongs to the object at ffff8881c1282000 [ 40.908103] which belongs to the cache kmalloc-512 of size 512 [ 40.920741] The buggy address is located 328 bytes inside of [ 40.920741] 512-byte region [ffff8881c1282000, ffff8881c1282200) [ 40.932621] The buggy address belongs to the page: [ 40.937535] page:ffffea000704a080 count:1 mapcount:0 mapping:ffff8881da800940 index:0x0 [ 40.945705] flags: 0x2fffc0000000200(slab) [ 40.949937] raw: 02fffc0000000200 ffffea0007361888 ffffea00074c99c8 ffff8881da800940 [ 40.957798] raw: 0000000000000000 ffff8881c1282000 0000000100000006 0000000000000000 [ 40.965670] page dumped because: kasan: bad access detected [ 40.971355] [ 40.972963] Memory state around the buggy address: [ 40.977872] ffff8881c1282080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 40.985214] ffff8881c1282100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 40.992556] >ffff8881c1282180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.999986] ^ [ 41.003331] ffff8881c1282200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 41.010672] ffff8881c1282280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 41.018005] ================================================================== [ 41.025345] Disabling lock debugging due to kernel taint [ 41.030789] Kernel panic - not syncing: panic_on_warn set ... [ 41.036653] CPU: 1 PID: 6053 Comm: syz-executor702 Tainted: G B 4.20.0-rc3+ #251 [ 41.045467] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 41.054798] Call Trace: [ 41.057365] dump_stack+0x244/0x39d [ 41.060976] ? dump_stack_print_info.cold.1+0x20/0x20 [ 41.066155] panic+0x2ad/0x55c [ 41.069333] ? add_taint.cold.5+0x16/0x16 [ 41.073466] ? add_taint.cold.5+0x5/0x16 [ 41.077510] ? trace_hardirqs_off+0xaf/0x310 [ 41.081905] kasan_end_report+0x47/0x4f [ 41.085859] kasan_report.cold.8+0x76/0x309 [ 41.090178] ? queue_stack_map_push_elem+0x185/0x290 [ 41.095265] check_memory_region+0x13e/0x1b0 [ 41.099672] memcpy+0x37/0x50 [ 41.102761] queue_stack_map_push_elem+0x185/0x290 [ 41.107683] ? queue_map_pop_elem+0x30/0x30 [ 41.112016] map_update_elem+0x605/0xf60 [ 41.116085] __ia32_sys_bpf+0x32d/0x520 [ 41.120043] ? __x64_sys_bpf+0x520/0x520 [ 41.124092] ? __do_page_fault+0x491/0xe60 [ 41.128356] do_fast_syscall_32+0x34d/0xfb2 [ 41.132679] ? do_int80_syscall_32+0x890/0x890 [ 41.137241] ? entry_SYSENTER_compat+0x68/0x7f [ 41.141818] ? trace_hardirqs_off_caller+0xbb/0x310 [ 41.146827] ? syscall_return_slowpath+0x5e0/0x5e0 [ 41.151739] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 41.156575] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 41.161406] ? trace_hardirqs_on_caller+0x310/0x310 [ 41.166407] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 41.171406] ? prepare_exit_to_usermode+0x291/0x3b0 [ 41.176409] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 41.181240] entry_SYSENTER_compat+0x70/0x7f [ 41.185628] RIP: 0023:0xf7f37a29 [ 41.188991] Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 14 24 c3 8b 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 41.207895] RSP: 002b:00000000ff7febdc EFLAGS: 00000213 ORIG_RAX: 0000000000000165 [ 41.215589] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 0000000020000040 [ 41.222842] RDX: 0000000000000020 RSI: 00000000080ea078 RDI: 00000000ff7fec30 [ 41.230095] RBP: 0000000000001000 R08: 0000000000000000 R09: 0000000000000000 [ 41.237345] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 41.244615] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 41.252842] Kernel Offset: disabled [ 41.256465] Rebooting in 86400 seconds..