[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.10.33' (ECDSA) to the list of known hosts. 2020/08/31 23:45:22 parsed 1 programs 2020/08/31 23:45:23 executed programs: 0 syzkaller login: [ 1047.540849] audit: type=1400 audit(1598917523.082:8): avc: denied { execmem } for pid=6354 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 1048.675446] IPVS: ftp: loaded support on port[0] = 21 [ 1048.786052] chnl_net:caif_netlink_parms(): no params data found [ 1048.877493] bridge0: port 1(bridge_slave_0) entered blocking state [ 1048.884205] bridge0: port 1(bridge_slave_0) entered disabled state [ 1048.892950] device bridge_slave_0 entered promiscuous mode [ 1048.900859] bridge0: port 2(bridge_slave_1) entered blocking state [ 1048.907584] bridge0: port 2(bridge_slave_1) entered disabled state [ 1048.914622] device bridge_slave_1 entered promiscuous mode [ 1048.932326] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 1048.941288] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 1048.959605] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 1048.966905] team0: Port device team_slave_0 added [ 1048.972411] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 1048.979924] team0: Port device team_slave_1 added [ 1048.996023] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1049.002430] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1049.033067] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1049.044652] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1049.052034] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1049.077627] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1049.088213] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 1049.096933] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 1049.115106] device hsr_slave_0 entered promiscuous mode [ 1049.120734] device hsr_slave_1 entered promiscuous mode [ 1049.126990] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 1049.134160] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 1049.197402] bridge0: port 2(bridge_slave_1) entered blocking state [ 1049.203822] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1049.210795] bridge0: port 1(bridge_slave_0) entered blocking state [ 1049.217211] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1049.246780] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 1049.252868] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1049.262102] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 1049.271487] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1049.290001] bridge0: port 1(bridge_slave_0) entered disabled state [ 1049.297536] bridge0: port 2(bridge_slave_1) entered disabled state [ 1049.309728] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 1049.316110] 8021q: adding VLAN 0 to HW filter on device team0 [ 1049.324435] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1049.332364] bridge0: port 1(bridge_slave_0) entered blocking state [ 1049.338782] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1049.356373] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1049.364292] bridge0: port 2(bridge_slave_1) entered blocking state [ 1049.372748] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1049.381135] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1049.389685] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1049.399212] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1049.408123] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1049.419185] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1049.430047] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 1049.436560] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1049.443550] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1049.457740] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 1049.465635] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1049.472334] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1049.482837] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1049.535079] IPv6: ADDRCONF(NETDEV_UP): veth0_virt_wifi: link is not ready [ 1049.544756] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1049.573019] IPv6: ADDRCONF(NETDEV_UP): veth0_vlan: link is not ready [ 1049.581112] IPv6: ADDRCONF(NETDEV_UP): vlan0: link is not ready [ 1049.588588] IPv6: ADDRCONF(NETDEV_UP): vlan1: link is not ready [ 1049.599306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1049.606770] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1049.613623] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1049.623738] device veth0_vlan entered promiscuous mode [ 1049.632925] device veth1_vlan entered promiscuous mode [ 1049.639132] IPv6: ADDRCONF(NETDEV_UP): macvlan0: link is not ready [ 1049.648765] IPv6: ADDRCONF(NETDEV_UP): macvlan1: link is not ready [ 1049.660793] IPv6: ADDRCONF(NETDEV_UP): veth0_macvtap: link is not ready [ 1049.670324] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 1049.677948] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 1049.685636] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1049.695917] device veth0_macvtap entered promiscuous mode [ 1049.702057] IPv6: ADDRCONF(NETDEV_UP): macvtap0: link is not ready [ 1049.710781] device veth1_macvtap entered promiscuous mode [ 1049.719769] IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready [ 1049.729794] IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready [ 1049.740362] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1049.748409] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1049.756740] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1049.767165] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1049.775475] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 1049.782890] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1050.695938] Bluetooth: hci0 command 0x0409 tx timeout [ 1051.023776] ================================================================== [ 1051.031523] BUG: KASAN: use-after-free in ex_handler_refcount+0x164/0x1a0 [ 1051.038444] Write of size 4 at addr ffff888096c4ae00 by task syz-executor.0/6848 [ 1051.045953] [ 1051.047562] CPU: 1 PID: 6848 Comm: syz-executor.0 Not tainted 4.14.195-syzkaller #0 [ 1051.055329] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1051.064677] Call Trace: [ 1051.067371] dump_stack+0x1b2/0x283 [ 1051.071038] print_address_description.cold+0x54/0x1d3 [ 1051.076312] kasan_report_error.cold+0x8a/0x194 [ 1051.080965] ? ex_handler_refcount+0x164/0x1a0 [ 1051.085524] __asan_report_store4_noabort+0x68/0x70 [ 1051.090517] ? ex_handler_refcount+0x164/0x1a0 [ 1051.095075] ex_handler_refcount+0x164/0x1a0 [ 1051.099458] ? ex_handler_clear_fs+0xb0/0xb0 [ 1051.103880] fixup_exception+0x8a/0xc3 [ 1051.107748] do_trap+0x61/0x250 [ 1051.111005] do_error_trap+0x132/0x2d0 [ 1051.114873] ? math_error+0x2d0/0x2d0 [ 1051.118667] ? inat_get_avx_attribute+0x3f2/0x6aaf [ 1051.123610] ? lock_acquire+0x170/0x3f0 [ 1051.127606] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1051.132458] invalid_op+0x1b/0x40 [ 1051.135909] RIP: 0010:inat_get_avx_attribute+0x3f2/0x6aaf [ 1051.141435] RSP: 0018:ffff88808d997dd8 EFLAGS: 00010297 [ 1051.146776] RAX: ffff888082d72400 RBX: ffff88809628bcc0 RCX: ffff888096c4ae00 [ 1051.154026] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888096c4ae00 [ 1051.161275] RBP: ffff888096c4ae00 R08: ffff888096c4ae28 R09: 0000000000000000 [ 1051.168539] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88809628bce8 [ 1051.175788] R13: ffff88809628bd3c R14: ffffffff819d75d0 R15: ffff88809628bcd0 [ 1051.183128] ? eventfd_show_fdinfo+0x90/0x90 [ 1051.187522] ? eventfd_ctx_put+0x9/0x30 [ 1051.191473] eventfd_release+0x4f/0x60 [ 1051.195405] __fput+0x25f/0x7a0 [ 1051.198728] task_work_run+0x11f/0x190 [ 1051.202604] exit_to_usermode_loop+0x1ad/0x200 [ 1051.207188] do_syscall_64+0x4a3/0x640 [ 1051.211081] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 1051.216258] RIP: 0033:0x45d5b9 [ 1051.219460] RSP: 002b:00007f49a15c6c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9 [ 1051.227289] RAX: 0000000000000000 RBX: 0000000000002ac0 RCX: 000000000045d5b9 [ 1051.234677] RDX: 0000000000000004 RSI: 0000000000000001 RDI: 0000000000000005 [ 1051.241940] RBP: 000000000118cf88 R08: 0000000000000000 R09: 0000000000000000 [ 1051.249288] R10: 0000000020fe0ff4 R11: 0000000000000246 R12: 000000000118cf4c [ 1051.256544] R13: 00007ffe0cbbbd4f R14: 00007f49a15c79c0 R15: 000000000118cf4c [ 1051.263927] [ 1051.265539] Allocated by task 6848: [ 1051.269148] kasan_kmalloc+0xeb/0x160 [ 1051.272924] kmem_cache_alloc_trace+0x131/0x3d0 [ 1051.277569] eventfd_file_create.part.0+0x43/0x160 [ 1051.282486] SyS_eventfd2+0x55/0xb0 [ 1051.286095] do_syscall_64+0x1d5/0x640 [ 1051.289959] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 1051.295122] [ 1051.296726] Freed by task 6846: [ 1051.299981] kasan_slab_free+0xc3/0x1a0 [ 1051.303929] kfree+0xc9/0x250 [ 1051.307024] eventfd_ctx_put+0x22/0x30 [ 1051.310953] eventfd_release+0x4f/0x60 [ 1051.314828] __fput+0x25f/0x7a0 [ 1051.318087] task_work_run+0x11f/0x190 [ 1051.321973] exit_to_usermode_loop+0x1ad/0x200 [ 1051.326549] do_syscall_64+0x4a3/0x640 [ 1051.330415] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 1051.335577] [ 1051.337181] The buggy address belongs to the object at ffff888096c4ae00 [ 1051.337181] which belongs to the cache kmalloc-96 of size 96 [ 1051.349753] The buggy address is located 0 bytes inside of [ 1051.349753] 96-byte region [ffff888096c4ae00, ffff888096c4ae60) [ 1051.361469] The buggy address belongs to the page: [ 1051.366382] page:ffffea00025b1280 count:1 mapcount:0 mapping:ffff888096c4a000 index:0x0 [ 1051.374517] flags: 0xfffe0000000100(slab) [ 1051.378804] raw: 00fffe0000000100 ffff888096c4a000 0000000000000000 0000000100000020 [ 1051.386703] raw: ffffea0002a95ca0 ffffea00025b0e60 ffff88812fe524c0 0000000000000000 [ 1051.394577] page dumped because: kasan: bad access detected [ 1051.400267] [ 1051.401870] Memory state around the buggy address: [ 1051.406778] ffff888096c4ad00: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc [ 1051.414114] ffff888096c4ad80: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 1051.421460] >ffff888096c4ae00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 1051.428809] ^ [ 1051.432160] ffff888096c4ae80: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 1051.439504] ffff888096c4af00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 1051.446840] ================================================================== [ 1051.454175] Disabling lock debugging due to kernel taint [ 1051.474114] Kernel panic - not syncing: panic_on_warn set ... [ 1051.474114] [ 1051.481511] CPU: 1 PID: 6848 Comm: syz-executor.0 Tainted: G B 4.14.195-syzkaller #0 [ 1051.490511] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1051.499868] Call Trace: [ 1051.502438] dump_stack+0x1b2/0x283 [ 1051.506104] panic+0x1f9/0x42d [ 1051.509379] ? add_taint.cold+0x16/0x16 [ 1051.513340] ? ___preempt_schedule+0x16/0x18 [ 1051.517749] kasan_end_report+0x43/0x49 [ 1051.521801] kasan_report_error.cold+0xa7/0x194 [ 1051.526669] ? ex_handler_refcount+0x164/0x1a0 [ 1051.531235] __asan_report_store4_noabort+0x68/0x70 [ 1051.536235] ? ex_handler_refcount+0x164/0x1a0 [ 1051.540794] ex_handler_refcount+0x164/0x1a0 [ 1051.545180] ? ex_handler_clear_fs+0xb0/0xb0 [ 1051.549563] fixup_exception+0x8a/0xc3 [ 1051.553426] do_trap+0x61/0x250 [ 1051.556692] do_error_trap+0x132/0x2d0 [ 1051.560730] ? math_error+0x2d0/0x2d0 [ 1051.564522] ? inat_get_avx_attribute+0x3f2/0x6aaf [ 1051.569530] ? lock_acquire+0x170/0x3f0 [ 1051.573494] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1051.578313] invalid_op+0x1b/0x40 [ 1051.581769] RIP: 0010:inat_get_avx_attribute+0x3f2/0x6aaf [ 1051.587392] RSP: 0018:ffff88808d997dd8 EFLAGS: 00010297 [ 1051.592745] RAX: ffff888082d72400 RBX: ffff88809628bcc0 RCX: ffff888096c4ae00 [ 1051.600610] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888096c4ae00 [ 1051.607861] RBP: ffff888096c4ae00 R08: ffff888096c4ae28 R09: 0000000000000000 [ 1051.615108] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88809628bce8 [ 1051.622371] R13: ffff88809628bd3c R14: ffffffff819d75d0 R15: ffff88809628bcd0 [ 1051.629631] ? eventfd_show_fdinfo+0x90/0x90 [ 1051.634769] ? eventfd_ctx_put+0x9/0x30 [ 1051.638720] eventfd_release+0x4f/0x60 [ 1051.642584] __fput+0x25f/0x7a0 [ 1051.645843] task_work_run+0x11f/0x190 [ 1051.649723] exit_to_usermode_loop+0x1ad/0x200 [ 1051.655148] do_syscall_64+0x4a3/0x640 [ 1051.659402] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 1051.664578] RIP: 0033:0x45d5b9 [ 1051.667746] RSP: 002b:00007f49a15c6c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9 [ 1051.675427] RAX: 0000000000000000 RBX: 0000000000002ac0 RCX: 000000000045d5b9 [ 1051.682675] RDX: 0000000000000004 RSI: 0000000000000001 RDI: 0000000000000005 [ 1051.689920] RBP: 000000000118cf88 R08: 0000000000000000 R09: 0000000000000000 [ 1051.698287] R10: 0000000020fe0ff4 R11: 0000000000000246 R12: 000000000118cf4c [ 1051.705534] R13: 00007ffe0cbbbd4f R14: 00007f49a15c79c0 R15: 000000000118cf4c [ 1051.714135] Kernel Offset: disabled [ 1051.717754] Rebooting in 86400 seconds..