[ OK ] Started Getty on tty1. [ OK ] Started Serial Getty on ttyS0. [ OK ] Started Getty on tty2. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.223' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 39.127057] audit: type=1400 audit(1602834722.601:8): avc: denied { execmem } for pid=6492 comm="syz-executor966" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 39.142466] ================================================================== [ 39.154409] BUG: KASAN: slab-out-of-bounds in squashfs_get_id+0x1bc/0x1f0 [ 39.161339] Read of size 8 at addr ffff8880a7449660 by task syz-executor966/6492 [ 39.168862] [ 39.170486] CPU: 0 PID: 6492 Comm: syz-executor966 Not tainted 4.19.150-syzkaller #0 [ 39.178344] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 39.187674] Call Trace: [ 39.190262] dump_stack+0x22c/0x33e [ 39.194023] print_address_description.cold+0x56/0x25c [ 39.199538] kasan_report_error.cold+0x66/0xb9 [ 39.204121] ? squashfs_get_id+0x1bc/0x1f0 [ 39.208336] __asan_report_load8_noabort+0x88/0x90 [ 39.213246] ? squashfs_get_id+0x1bc/0x1f0 [ 39.217468] squashfs_get_id+0x1bc/0x1f0 [ 39.221514] ? squashfs_read_fragment_index_table+0xf0/0xf0 [ 39.227221] ? squashfs_read_metadata+0x2e5/0x3b0 [ 39.232048] squashfs_read_inode+0x197/0x1940 [ 39.236528] ? squashfs_read_id_index_table+0xf0/0xf0 [ 39.241715] ? find_held_lock+0x2d/0x110 [ 39.245756] ? new_inode+0xc7/0xf0 [ 39.249382] ? do_raw_spin_lock+0xcb/0x220 [ 39.253597] ? do_raw_spin_unlock+0x171/0x240 [ 39.258074] squashfs_fill_super+0x1277/0x190a [ 39.262644] mount_bdev+0x2fc/0x3b0 [ 39.266263] ? squashfs_remount+0x50/0x50 [ 39.270405] mount_fs+0xa3/0x318 [ 39.273768] vfs_kern_mount.part.0+0x68/0x470 [ 39.278242] do_mount+0x51c/0x2f10 [ 39.281766] ? check_preemption_disabled+0x41/0x2b0 [ 39.286763] ? copy_mount_string+0x40/0x40 [ 39.290981] ? kmem_cache_alloc_trace+0x379/0x4b0 [ 39.295803] ? _copy_from_user+0xd2/0x130 [ 39.299932] ? copy_mount_options+0x261/0x370 [ 39.304410] ksys_mount+0xcf/0x130 [ 39.307944] __x64_sys_mount+0xba/0x150 [ 39.311914] ? lockdep_hardirqs_on+0x3c1/0x5e0 [ 39.316477] do_syscall_64+0xf9/0x670 [ 39.320276] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 39.325445] RIP: 0033:0x446d2a [ 39.328632] Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd ad fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 da ad fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 39.347528] RSP: 002b:00007ffe7ae90c98 EFLAGS: 00000293 ORIG_RAX: 00000000000000a5 [ 39.355234] RAX: ffffffffffffffda RBX: 00007ffe7ae90cf0 RCX: 0000000000446d2a [ 39.362482] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffe7ae90cb0 [ 39.369730] RBP: 00007ffe7ae90cb0 R08: 00007ffe7ae90cf0 R09: 00007ffe00000015 [ 39.376979] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 39.384224] R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000003 [ 39.391479] [ 39.393084] Allocated by task 4583: [ 39.396804] kmem_cache_alloc_trace+0x12f/0x4b0 [ 39.401453] proc_thread_self_get_link+0x185/0x1e0 [ 39.406362] link_path_walk.part.0+0xdaf/0x1230 [ 39.411020] path_openat+0x21d/0x2e90 [ 39.414800] do_filp_open+0x18c/0x3f0 [ 39.418611] do_sys_open+0x3b3/0x520 [ 39.422309] do_syscall_64+0xf9/0x670 [ 39.426093] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 39.431256] [ 39.432861] Freed by task 4583: [ 39.436134] kfree+0xcc/0x250 [ 39.439227] walk_component+0x204/0xda0 [ 39.443265] link_path_walk.part.0+0x541/0x1230 [ 39.447914] path_openat+0x21d/0x2e90 [ 39.451694] do_filp_open+0x18c/0x3f0 [ 39.455486] do_sys_open+0x3b3/0x520 [ 39.459182] do_syscall_64+0xf9/0x670 [ 39.462962] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 39.468124] [ 39.469732] The buggy address belongs to the object at ffff8880a7449640 [ 39.469732] which belongs to the cache kmalloc-32 of size 32 [ 39.482297] The buggy address is located 0 bytes to the right of [ 39.482297] 32-byte region [ffff8880a7449640, ffff8880a7449660) [ 39.494435] The buggy address belongs to the page: [ 39.499348] page:ffffea00029d1240 count:1 mapcount:0 mapping:ffff88812c3f61c0 index:0xffff8880a7449fc1 [ 39.508779] flags: 0xfffe0000000100(slab) [ 39.512929] raw: 00fffe0000000100 ffffea0002570cc8 ffffea00029d2548 ffff88812c3f61c0 [ 39.520808] raw: ffff8880a7449fc1 ffff8880a7449000 000000010000003f 0000000000000000 [ 39.528680] page dumped because: kasan: bad access detected [ 39.534378] [ 39.535998] Memory state around the buggy address: [ 39.540907] ffff8880a7449500: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 39.548244] ffff8880a7449580: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 39.555583] >ffff8880a7449600: 00 fc fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 39.562918] ^ [ 39.569386] ffff8880a7449680: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 39.576722] ffff8880a7449700: fb fb fb fb fc fc fc fc 00 00 01 fc fc fc fc fc [ 39.584155] ================================================================== [ 39.591490] Disabling lock debugging due to kernel taint [ 39.597262] Kernel panic - not syncing: panic_on_warn set ... [ 39.597262] [ 39.604629] CPU: 0 PID: 6492 Comm: syz-executor966 Tainted: G B 4.19.150-syzkaller #0 [ 39.613895] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 39.623240] Call Trace: [ 39.625834] dump_stack+0x22c/0x33e [ 39.629469] panic+0x2ac/0x565 [ 39.632707] ? __warn_printk+0xf3/0xf3 [ 39.636576] ? preempt_schedule_common+0x45/0xc0 [ 39.641312] ? ___preempt_schedule+0x16/0x18 [ 39.645703] ? trace_hardirqs_on+0x55/0x210 [ 39.650007] kasan_end_report+0x43/0x49 [ 39.653958] kasan_report_error.cold+0x83/0xb9 [ 39.658520] ? squashfs_get_id+0x1bc/0x1f0 [ 39.662732] __asan_report_load8_noabort+0x88/0x90 [ 39.667640] ? squashfs_get_id+0x1bc/0x1f0 [ 39.671855] squashfs_get_id+0x1bc/0x1f0 [ 39.675896] ? squashfs_read_fragment_index_table+0xf0/0xf0 [ 39.681587] ? squashfs_read_metadata+0x2e5/0x3b0 [ 39.686410] squashfs_read_inode+0x197/0x1940 [ 39.690884] ? squashfs_read_id_index_table+0xf0/0xf0 [ 39.696164] ? find_held_lock+0x2d/0x110 [ 39.700205] ? new_inode+0xc7/0xf0 [ 39.703739] ? do_raw_spin_lock+0xcb/0x220 [ 39.707966] ? do_raw_spin_unlock+0x171/0x240 [ 39.712447] squashfs_fill_super+0x1277/0x190a [ 39.717099] mount_bdev+0x2fc/0x3b0 [ 39.720704] ? squashfs_remount+0x50/0x50 [ 39.724830] mount_fs+0xa3/0x318 [ 39.728179] vfs_kern_mount.part.0+0x68/0x470 [ 39.732652] do_mount+0x51c/0x2f10 [ 39.736173] ? check_preemption_disabled+0x41/0x2b0 [ 39.741165] ? copy_mount_string+0x40/0x40 [ 39.745382] ? kmem_cache_alloc_trace+0x379/0x4b0 [ 39.750202] ? _copy_from_user+0xd2/0x130 [ 39.754339] ? copy_mount_options+0x261/0x370 [ 39.758812] ksys_mount+0xcf/0x130 [ 39.762330] __x64_sys_mount+0xba/0x150 [ 39.766281] ? lockdep_hardirqs_on+0x3c1/0x5e0 [ 39.770843] do_syscall_64+0xf9/0x670 [ 39.774647] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 39.779814] RIP: 0033:0x446d2a [ 39.782983] Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd ad fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 da ad fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 39.801862] RSP: 002b:00007ffe7ae90c98 EFLAGS: 00000293 ORIG_RAX: 00000000000000a5 [ 39.809573] RAX: ffffffffffffffda RBX: 00007ffe7ae90cf0 RCX: 0000000000446d2a [ 39.816817] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffe7ae90cb0 [ 39.824077] RBP: 00007ffe7ae90cb0 R08: 00007ffe7ae90cf0 R09: 00007ffe00000015 [ 39.831322] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 39.838672] R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000003 [ 39.847322] Kernel Offset: disabled [ 39.850938] Rebooting in 86400 seconds..