[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [ 40.488169] audit: type=1800 audit(1575348623.433:33): pid=7476 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2465 res=0 [ 40.514270] audit: type=1800 audit(1575348623.433:34): pid=7476 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2456 res=0 Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 45.151596] audit: type=1400 audit(1575348628.103:35): avc: denied { map } for pid=7648 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.10.0' (ECDSA) to the list of known hosts. executing program [ 68.083853] audit: type=1400 audit(1575348651.033:36): avc: denied { map } for pid=7660 comm="syz-executor554" path="/root/syz-executor554918623" dev="sda1" ino=16484 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 68.161760] ================================================================== [ 68.161789] BUG: KASAN: global-out-of-bounds in vga16fb_imageblit+0x1c8b/0x2200 [ 68.161796] Read of size 2 at addr ffffffff87ef13d8 by task syz-executor554/7660 [ 68.161798] [ 68.161808] CPU: 1 PID: 7660 Comm: syz-executor554 Not tainted 4.19.87-syzkaller #0 [ 68.161814] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 68.161817] Call Trace: [ 68.161828] dump_stack+0x197/0x210 [ 68.161838] ? vga16fb_imageblit+0x1c8b/0x2200 [ 68.161849] print_address_description.cold+0x5/0x20d [ 68.161857] ? vga16fb_imageblit+0x1c8b/0x2200 [ 68.161865] kasan_report.cold+0x8c/0x2ba [ 68.161876] __asan_report_load2_noabort+0x14/0x20 [ 68.161883] vga16fb_imageblit+0x1c8b/0x2200 [ 68.161899] soft_cursor+0x4fb/0xa30 [ 68.161913] bit_cursor+0x12fc/0x1a60 [ 68.161925] ? bit_clear+0x530/0x530 [ 68.161936] ? tty_do_resize+0x5e/0x170 [ 68.161951] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 68.161958] ? get_color+0x225/0x430 [ 68.161968] fbcon_cursor+0x58a/0x7b0 [ 68.161974] ? bit_clear+0x530/0x530 [ 68.161987] hide_cursor+0x9e/0x300 [ 68.161997] redraw_screen+0x2ee/0x8e0 [ 68.162007] ? con_flush_chars+0xa0/0xa0 [ 68.162018] ? mutex_unlock+0xd/0x10 [ 68.162028] vc_do_resize+0x118e/0x14a0 [ 68.162035] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 68.162051] ? vc_uniscr_alloc+0xd0/0xd0 [ 68.162062] ? mark_held_locks+0x100/0x100 [ 68.162073] vc_resize+0x4d/0x60 [ 68.162081] fbcon_modechanged+0x397/0x900 [ 68.162093] fbcon_event_notify+0x1bd/0x1dba [ 68.162102] ? lock_acquire+0x16f/0x3f0 [ 68.162113] notifier_call_chain+0xc2/0x230 [ 68.162126] blocking_notifier_call_chain+0x94/0xb0 [ 68.162138] fb_notifier_call_chain+0x25/0x30 [ 68.162146] fb_set_var+0xc8f/0xe80 [ 68.162156] ? fb_set_suspend+0x130/0x130 [ 68.162164] ? lock_acquire+0x16f/0x3f0 [ 68.162171] ? lock_fb_info+0x1f/0x80 [ 68.162184] ? __mutex_lock+0x3cd/0x1300 [ 68.162191] ? mark_held_locks+0x100/0x100 [ 68.162199] ? lock_acquire+0x16f/0x3f0 [ 68.162206] ? lock_fb_info+0x1f/0x80 [ 68.162216] ? mutex_trylock+0x1e0/0x1e0 [ 68.162223] ? down+0x70/0x90 [ 68.162239] ? do_fb_ioctl+0x3e1/0xab0 [ 68.162249] ? mutex_lock_nested+0x16/0x20 [ 68.162259] do_fb_ioctl+0x450/0xab0 [ 68.162267] ? fb_read+0x580/0x580 [ 68.162276] ? kasan_check_read+0x11/0x20 [ 68.162286] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 68.162295] ? avc_has_extended_perms+0xa78/0x10f0 [ 68.162308] ? avc_ss_reset+0x190/0x190 [ 68.162316] ? __kasan_slab_free+0x102/0x150 [ 68.162323] ? kasan_slab_free+0xe/0x10 [ 68.162330] ? kmem_cache_free+0x86/0x260 [ 68.162338] ? putname+0xef/0x130 [ 68.162344] ? do_sys_open+0x318/0x550 [ 68.162351] ? __x64_sys_openat+0x9d/0x100 [ 68.162359] ? do_syscall_64+0xfd/0x620 [ 68.162366] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 68.162390] fb_ioctl+0xe6/0x130 [ 68.162397] ? do_fb_ioctl+0xab0/0xab0 [ 68.162405] do_vfs_ioctl+0xd5f/0x1380 [ 68.162412] ? selinux_file_ioctl+0x46f/0x5e0 [ 68.162420] ? selinux_file_ioctl+0x125/0x5e0 [ 68.162433] ? ioctl_preallocate+0x210/0x210 [ 68.162441] ? selinux_file_mprotect+0x620/0x620 [ 68.162449] ? kmem_cache_free+0x222/0x260 [ 68.162459] ? do_sys_open+0x31d/0x550 [ 68.162470] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 68.162477] ? security_file_ioctl+0x8d/0xc0 [ 68.162486] ksys_ioctl+0xab/0xd0 [ 68.162496] __x64_sys_ioctl+0x73/0xb0 [ 68.162505] do_syscall_64+0xfd/0x620 [ 68.162514] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 68.162521] RIP: 0033:0x440309 [ 68.162530] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 68.162535] RSP: 002b:00007ffd64f93438 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 68.162543] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440309 [ 68.162547] RDX: 0000000020000340 RSI: 0000000000004601 RDI: 0000000000000003 [ 68.162552] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 68.162557] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401b90 [ 68.162561] R13: 0000000000401c20 R14: 0000000000000000 R15: 0000000000000000 [ 68.162571] [ 68.162574] The buggy address belongs to the variable: [ 68.162583] transl_h+0x38/0x40 [ 68.162585] [ 68.162587] Memory state around the buggy address: [ 68.162594] ffffffff87ef1280: 00 00 00 00 fa fa fa fa 00 00 00 00 fa fa fa fa [ 68.162600] ffffffff87ef1300: 00 00 00 00 00 fa fa fa fa fa fa fa 04 fa fa fa [ 68.162606] >ffffffff87ef1380: fa fa fa fa 00 00 00 00 fa fa fa fa 00 00 00 00 [ 68.162610] ^ [ 68.162615] ffffffff87ef1400: fa fa fa fa 00 01 fa fa fa fa fa fa 00 00 00 04 [ 68.162621] ffffffff87ef1480: fa fa fa fa 00 00 04 fa fa fa fa fa 00 00 00 00 [ 68.162624] ================================================================== [ 68.162627] Disabling lock debugging due to kernel taint [ 68.162631] Kernel panic - not syncing: panic_on_warn set ... [ 68.162631] [ 68.162639] CPU: 1 PID: 7660 Comm: syz-executor554 Tainted: G B 4.19.87-syzkaller #0 [ 68.162643] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 68.162645] Call Trace: [ 68.162652] dump_stack+0x197/0x210 [ 68.162659] ? vga16fb_imageblit+0x1c8b/0x2200 [ 68.162666] panic+0x26a/0x50e [ 68.162672] ? __warn_printk+0xf3/0xf3 [ 68.162680] ? lock_downgrade+0x880/0x880 [ 68.162689] ? trace_hardirqs_on+0x67/0x220 [ 68.162695] ? trace_hardirqs_on+0x5e/0x220 [ 68.162703] ? vga16fb_imageblit+0x1c8b/0x2200 [ 68.162710] kasan_end_report+0x47/0x4f [ 68.162718] kasan_report.cold+0xa9/0x2ba [ 68.162727] __asan_report_load2_noabort+0x14/0x20 [ 68.162733] vga16fb_imageblit+0x1c8b/0x2200 [ 68.162743] soft_cursor+0x4fb/0xa30 [ 68.162753] bit_cursor+0x12fc/0x1a60 [ 68.162762] ? bit_clear+0x530/0x530 [ 68.162769] ? tty_do_resize+0x5e/0x170 [ 68.162779] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 68.162785] ? get_color+0x225/0x430 [ 68.162793] fbcon_cursor+0x58a/0x7b0 [ 68.162799] ? bit_clear+0x530/0x530 [ 68.162807] hide_cursor+0x9e/0x300 [ 68.162815] redraw_screen+0x2ee/0x8e0 [ 68.162823] ? con_flush_chars+0xa0/0xa0 [ 68.162831] ? mutex_unlock+0xd/0x10 [ 68.162838] vc_do_resize+0x118e/0x14a0 [ 68.162846] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 68.162856] ? vc_uniscr_alloc+0xd0/0xd0 [ 68.162864] ? mark_held_locks+0x100/0x100 [ 68.162872] vc_resize+0x4d/0x60 [ 68.162879] fbcon_modechanged+0x397/0x900 [ 68.162887] fbcon_event_notify+0x1bd/0x1dba [ 68.162895] ? lock_acquire+0x16f/0x3f0 [ 68.162904] notifier_call_chain+0xc2/0x230 [ 68.162913] blocking_notifier_call_chain+0x94/0xb0 [ 68.162922] fb_notifier_call_chain+0x25/0x30 [ 68.162929] fb_set_var+0xc8f/0xe80 [ 68.162937] ? fb_set_suspend+0x130/0x130 [ 68.162944] ? lock_acquire+0x16f/0x3f0 [ 68.162951] ? lock_fb_info+0x1f/0x80 [ 68.162960] ? __mutex_lock+0x3cd/0x1300 [ 68.162967] ? mark_held_locks+0x100/0x100 [ 68.162974] ? lock_acquire+0x16f/0x3f0 [ 68.162980] ? lock_fb_info+0x1f/0x80 [ 68.162989] ? mutex_trylock+0x1e0/0x1e0 [ 68.162994] ? down+0x70/0x90 [ 68.163005] ? do_fb_ioctl+0x3e1/0xab0 [ 68.163014] ? mutex_lock_nested+0x16/0x20 [ 68.163021] do_fb_ioctl+0x450/0xab0 [ 68.163029] ? fb_read+0x580/0x580 [ 68.163036] ? kasan_check_read+0x11/0x20 [ 68.163044] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 68.163051] ? avc_has_extended_perms+0xa78/0x10f0 [ 68.163061] ? avc_ss_reset+0x190/0x190 [ 68.163068] ? __kasan_slab_free+0x102/0x150 [ 68.163074] ? kasan_slab_free+0xe/0x10 [ 68.163080] ? kmem_cache_free+0x86/0x260 [ 68.163087] ? putname+0xef/0x130 [ 68.163093] ? do_sys_open+0x318/0x550 [ 68.163099] ? __x64_sys_openat+0x9d/0x100 [ 68.163106] ? do_syscall_64+0xfd/0x620 [ 68.163112] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 68.163127] fb_ioctl+0xe6/0x130 [ 68.163134] ? do_fb_ioctl+0xab0/0xab0 [ 68.163140] do_vfs_ioctl+0xd5f/0x1380 [ 68.163147] ? selinux_file_ioctl+0x46f/0x5e0 [ 68.163154] ? selinux_file_ioctl+0x125/0x5e0 [ 68.163161] ? ioctl_preallocate+0x210/0x210 [ 68.163168] ? selinux_file_mprotect+0x620/0x620 [ 68.163175] ? kmem_cache_free+0x222/0x260 [ 68.163183] ? do_sys_open+0x31d/0x550 [ 68.163191] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 68.163198] ? security_file_ioctl+0x8d/0xc0 [ 68.163205] ksys_ioctl+0xab/0xd0 [ 68.163213] __x64_sys_ioctl+0x73/0xb0 [ 68.163220] do_syscall_64+0xfd/0x620 [ 68.163228] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 68.163233] RIP: 0033:0x440309 [ 68.163239] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 68.163243] RSP: 002b:00007ffd64f93438 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 68.163249] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440309 [ 68.163253] RDX: 0000000020000340 RSI: 0000000000004601 RDI: 0000000000000003 [ 68.163257] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 68.163261] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401b90 [ 68.163265] R13: 0000000000401c20 R14: 0000000000000000 R15: 0000000000000000 [ 68.164656] Kernel Offset: disabled [ 69.052291] Rebooting in 86400 seconds..