[ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Serial Getty on ttyS0. [ OK ] Started Getty on tty1. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.54' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 69.816736][ T8509] ================================================================== [ 69.824970][ T8509] BUG: KASAN: global-out-of-bounds in string+0x39c/0x3d0 [ 69.831988][ T8509] Read of size 1 at addr ffffffff8faea960 by task syz-executor646/8509 [ 69.840212][ T8509] [ 69.842541][ T8509] CPU: 0 PID: 8509 Comm: syz-executor646 Not tainted 5.10.0-syzkaller #0 [ 69.850944][ T8509] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 69.861010][ T8509] Call Trace: [ 69.864322][ T8509] dump_stack+0x107/0x163 [ 69.868723][ T8509] ? string+0x39c/0x3d0 [ 69.872969][ T8509] ? string+0x39c/0x3d0 [ 69.877129][ T8509] print_address_description.constprop.0.cold+0x5/0x4c8 [ 69.884656][ T8509] ? _raw_spin_lock_irqsave+0x4e/0x50 [ 69.890036][ T8509] ? vprintk_func+0x95/0x1e0 [ 69.894632][ T8509] ? string+0x39c/0x3d0 [ 69.898805][ T8509] ? string+0x39c/0x3d0 [ 69.902983][ T8509] kasan_report.cold+0x1f/0x37 [ 69.907762][ T8509] ? string+0x39c/0x3d0 [ 69.911930][ T8509] string+0x39c/0x3d0 [ 69.916059][ T8509] ? format_decode+0x230/0xad0 [ 69.923459][ T8509] ? ip6_addr_string_sa+0x830/0x830 [ 69.928681][ T8509] ? lockdep_unlock+0x11c/0x290 [ 69.933552][ T8509] ? __lock_acquire+0x2510/0x5500 [ 69.938592][ T8509] vsnprintf+0x71b/0x14f0 [ 69.942948][ T8509] ? pointer+0x930/0x930 [ 69.947244][ T8509] snprintf+0xbb/0xf0 [ 69.951244][ T8509] ? vsprintf+0x30/0x30 [ 69.955553][ T8509] ? __nla_reserve+0x9a/0xc0 [ 69.960500][ T8509] ? memcpy+0x39/0x60 [ 69.964515][ T8509] smc_nl_get_sys_info+0x493/0x880 [ 69.969640][ T8509] ? smc_nl_fill_lgr_list.constprop.0+0x980/0x980 [ 69.976068][ T8509] ? genl_lock_dumpit+0x3c/0x90 [ 69.980948][ T8509] ? mark_held_locks+0x9f/0xe0 [ 69.985943][ T8509] ? mutex_lock_io_nested+0xf60/0xf60 [ 69.991519][ T8509] ? rcu_read_lock_sched_held+0x3a/0x70 [ 69.997412][ T8509] ? trace_kmalloc_node+0xc1/0xf0 [ 70.002516][ T8509] ? __kmalloc_node_track_caller+0x21a/0x3e0 [ 70.008518][ T8509] ? netlink_dump+0x680/0xb70 [ 70.013215][ T8509] ? __phys_addr+0x9a/0x110 [ 70.017824][ T8509] ? memset+0x20/0x40 [ 70.021824][ T8509] genl_lock_dumpit+0x60/0x90 [ 70.026609][ T8509] netlink_dump+0x4b9/0xb70 [ 70.031129][ T8509] ? netlink_insert+0x1670/0x1670 [ 70.036239][ T8509] ? __mutex_unlock_slowpath+0xe2/0x610 [ 70.041807][ T8509] ? kasan_unpoison_shadow+0x33/0x40 [ 70.047096][ T8509] ? genl_start+0x44a/0x670 [ 70.051609][ T8509] __netlink_dump_start+0x642/0x900 [ 70.056825][ T8509] ? genl_family_rcv_msg_doit+0x320/0x320 [ 70.062565][ T8509] ? smc_nl_fill_lgr_list.constprop.0+0x980/0x980 [ 70.069782][ T8509] genl_family_rcv_msg_dumpit+0x2af/0x310 [ 70.075622][ T8509] ? genl_rcv+0x40/0x40 [ 70.079797][ T8509] ? mutex_lock_io_nested+0xf60/0xf60 [ 70.085176][ T8509] ? __lock_acquire+0x2510/0x5500 [ 70.090213][ T8509] ? genl_family_rcv_msg_doit+0x320/0x320 [ 70.095937][ T8509] ? genl_unlock+0x20/0x20 [ 70.100369][ T8509] ? genl_parallel_done+0xc0/0xc0 [ 70.105396][ T8509] ? __radix_tree_lookup+0x1f3/0x290 [ 70.110696][ T8509] ? genl_get_cmd+0x3cf/0x480 [ 70.115464][ T8509] genl_rcv_msg+0x434/0x580 [ 70.119969][ T8509] ? genl_get_cmd+0x480/0x480 [ 70.124641][ T8509] ? smc_nl_fill_lgr_list.constprop.0+0x980/0x980 [ 70.131079][ T8509] ? lock_release+0x710/0x710 [ 70.135775][ T8509] netlink_rcv_skb+0x153/0x420 [ 70.140553][ T8509] ? genl_get_cmd+0x480/0x480 [ 70.145580][ T8509] ? netlink_ack+0xaa0/0xaa0 [ 70.150197][ T8509] genl_rcv+0x24/0x40 [ 70.154187][ T8509] netlink_unicast+0x533/0x7d0 [ 70.159089][ T8509] ? netlink_attachskb+0x870/0x870 [ 70.164224][ T8509] ? __phys_addr_symbol+0x2c/0x70 [ 70.169688][ T8509] ? __check_object_size+0x171/0x3f0 [ 70.174982][ T8509] netlink_sendmsg+0x856/0xd90 [ 70.179754][ T8509] ? netlink_unicast+0x7d0/0x7d0 [ 70.184706][ T8509] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 70.189995][ T8509] ? netlink_unicast+0x7d0/0x7d0 [ 70.194958][ T8509] sock_sendmsg+0xcf/0x120 [ 70.199391][ T8509] ____sys_sendmsg+0x6e8/0x810 [ 70.204158][ T8509] ? kernel_sendmsg+0x50/0x50 [ 70.208840][ T8509] ? do_recvmmsg+0x6c0/0x6c0 [ 70.213465][ T8509] ? find_held_lock+0x2d/0x110 [ 70.218510][ T8509] ___sys_sendmsg+0xf3/0x170 [ 70.223167][ T8509] ? sendmsg_copy_msghdr+0x160/0x160 [ 70.228490][ T8509] ? do_huge_pmd_anonymous_page+0x8f1/0x2390 [ 70.234591][ T8509] ? find_held_lock+0x2d/0x110 [ 70.239557][ T8509] ? __fget_light+0x215/0x280 [ 70.244701][ T8509] __sys_sendmsg+0xe5/0x1b0 [ 70.249232][ T8509] ? __sys_sendmsg_sock+0xb0/0xb0 [ 70.254313][ T8509] ? syscall_enter_from_user_mode+0x1d/0x50 [ 70.260241][ T8509] do_syscall_64+0x2d/0x70 [ 70.264863][ T8509] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 70.270782][ T8509] RIP: 0033:0x440299 [ 70.274716][ T8509] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 70.294516][ T8509] RSP: 002b:00007fff4b943e58 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 70.302963][ T8509] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440299 [ 70.310965][ T8509] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000003 [ 70.319141][ T8509] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 70.327137][ T8509] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401aa0 [ 70.335140][ T8509] R13: 0000000000401b30 R14: 0000000000000000 R15: 0000000000000000 [ 70.343129][ T8509] [ 70.345470][ T8509] The buggy address belongs to the variable: [ 70.351451][ T8509] smc_hostname+0x20/0x40 [ 70.355765][ T8509] [ 70.358078][ T8509] Memory state around the buggy address: [ 70.363727][ T8509] ffffffff8faea800: 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 [ 70.371805][ T8509] ffffffff8faea880: 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 [ 70.379892][ T8509] >ffffffff8faea900: 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 f9 f9 f9 f9 [ 70.388142][ T8509] ^ [ 70.395369][ T8509] ffffffff8faea980: 04 f9 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 [ 70.403734][ T8509] ffffffff8faeaa00: 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 [ 70.412508][ T8509] ================================================================== [ 70.421504][ T8509] Disabling lock debugging due to kernel taint [ 70.428399][ T8509] Kernel panic - not syncing: panic_on_warn set ... [ 70.435015][ T8509] CPU: 0 PID: 8509 Comm: syz-executor646 Tainted: G B 5.10.0-syzkaller #0 [ 70.444824][ T8509] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 70.454887][ T8509] Call Trace: [ 70.458223][ T8509] dump_stack+0x107/0x163 [ 70.462650][ T8509] ? string+0x2c0/0x3d0 [ 70.466856][ T8509] panic+0x306/0x73d [ 70.470742][ T8509] ? __warn_printk+0xf3/0xf3 [ 70.475354][ T8509] ? preempt_schedule_common+0x59/0xc0 [ 70.480818][ T8509] ? string+0x39c/0x3d0 [ 70.485311][ T8509] ? preempt_schedule_thunk+0x16/0x18 [ 70.490674][ T8509] ? trace_hardirqs_on+0x51/0x1c0 [ 70.495705][ T8509] ? string+0x39c/0x3d0 [ 70.499943][ T8509] ? string+0x39c/0x3d0 [ 70.504131][ T8509] end_report+0x58/0x5e [ 70.508860][ T8509] kasan_report.cold+0xd/0x37 [ 70.514056][ T8509] ? string+0x39c/0x3d0 [ 70.518339][ T8509] string+0x39c/0x3d0 [ 70.522321][ T8509] ? format_decode+0x230/0xad0 [ 70.527440][ T8509] ? ip6_addr_string_sa+0x830/0x830 [ 70.532645][ T8509] ? lockdep_unlock+0x11c/0x290 [ 70.537487][ T8509] ? __lock_acquire+0x2510/0x5500 [ 70.542498][ T8509] vsnprintf+0x71b/0x14f0 [ 70.546838][ T8509] ? pointer+0x930/0x930 [ 70.551070][ T8509] snprintf+0xbb/0xf0 [ 70.555096][ T8509] ? vsprintf+0x30/0x30 [ 70.559239][ T8509] ? __nla_reserve+0x9a/0xc0 [ 70.563838][ T8509] ? memcpy+0x39/0x60 [ 70.567814][ T8509] smc_nl_get_sys_info+0x493/0x880 [ 70.572917][ T8509] ? smc_nl_fill_lgr_list.constprop.0+0x980/0x980 [ 70.579466][ T8509] ? genl_lock_dumpit+0x3c/0x90 [ 70.584327][ T8509] ? mark_held_locks+0x9f/0xe0 [ 70.589099][ T8509] ? mutex_lock_io_nested+0xf60/0xf60 [ 70.594469][ T8509] ? rcu_read_lock_sched_held+0x3a/0x70 [ 70.600018][ T8509] ? trace_kmalloc_node+0xc1/0xf0 [ 70.605051][ T8509] ? __kmalloc_node_track_caller+0x21a/0x3e0 [ 70.611029][ T8509] ? netlink_dump+0x680/0xb70 [ 70.615697][ T8509] ? __phys_addr+0x9a/0x110 [ 70.620203][ T8509] ? memset+0x20/0x40 [ 70.624183][ T8509] genl_lock_dumpit+0x60/0x90 [ 70.629220][ T8509] netlink_dump+0x4b9/0xb70 [ 70.633722][ T8509] ? netlink_insert+0x1670/0x1670 [ 70.638935][ T8509] ? __mutex_unlock_slowpath+0xe2/0x610 [ 70.644498][ T8509] ? kasan_unpoison_shadow+0x33/0x40 [ 70.649784][ T8509] ? genl_start+0x44a/0x670 [ 70.654307][ T8509] __netlink_dump_start+0x642/0x900 [ 70.660140][ T8509] ? genl_family_rcv_msg_doit+0x320/0x320 [ 70.665907][ T8509] ? smc_nl_fill_lgr_list.constprop.0+0x980/0x980 [ 70.672333][ T8509] genl_family_rcv_msg_dumpit+0x2af/0x310 [ 70.678085][ T8509] ? genl_rcv+0x40/0x40 [ 70.682236][ T8509] ? mutex_lock_io_nested+0xf60/0xf60 [ 70.687600][ T8509] ? __lock_acquire+0x2510/0x5500 [ 70.692712][ T8509] ? genl_family_rcv_msg_doit+0x320/0x320 [ 70.698451][ T8509] ? genl_unlock+0x20/0x20 [ 70.702859][ T8509] ? genl_parallel_done+0xc0/0xc0 [ 70.707875][ T8509] ? __radix_tree_lookup+0x1f3/0x290 [ 70.713171][ T8509] ? genl_get_cmd+0x3cf/0x480 [ 70.717866][ T8509] genl_rcv_msg+0x434/0x580 [ 70.722360][ T8509] ? genl_get_cmd+0x480/0x480 [ 70.727043][ T8509] ? smc_nl_fill_lgr_list.constprop.0+0x980/0x980 [ 70.733567][ T8509] ? lock_release+0x710/0x710 [ 70.738258][ T8509] netlink_rcv_skb+0x153/0x420 [ 70.743042][ T8509] ? genl_get_cmd+0x480/0x480 [ 70.747726][ T8509] ? netlink_ack+0xaa0/0xaa0 [ 70.752313][ T8509] genl_rcv+0x24/0x40 [ 70.756289][ T8509] netlink_unicast+0x533/0x7d0 [ 70.761052][ T8509] ? netlink_attachskb+0x870/0x870 [ 70.766155][ T8509] ? __phys_addr_symbol+0x2c/0x70 [ 70.771174][ T8509] ? __check_object_size+0x171/0x3f0 [ 70.776452][ T8509] netlink_sendmsg+0x856/0xd90 [ 70.781227][ T8509] ? netlink_unicast+0x7d0/0x7d0 [ 70.786791][ T8509] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 70.792109][ T8509] ? netlink_unicast+0x7d0/0x7d0 [ 70.797052][ T8509] sock_sendmsg+0xcf/0x120 [ 70.801492][ T8509] ____sys_sendmsg+0x6e8/0x810 [ 70.806317][ T8509] ? kernel_sendmsg+0x50/0x50 [ 70.811083][ T8509] ? do_recvmmsg+0x6c0/0x6c0 [ 70.815681][ T8509] ? find_held_lock+0x2d/0x110 [ 70.820897][ T8509] ___sys_sendmsg+0xf3/0x170 [ 70.825487][ T8509] ? sendmsg_copy_msghdr+0x160/0x160 [ 70.830865][ T8509] ? do_huge_pmd_anonymous_page+0x8f1/0x2390 [ 70.836880][ T8509] ? find_held_lock+0x2d/0x110 [ 70.842355][ T8509] ? __fget_light+0x215/0x280 [ 70.850959][ T8509] __sys_sendmsg+0xe5/0x1b0 [ 70.855488][ T8509] ? __sys_sendmsg_sock+0xb0/0xb0 [ 70.860528][ T8509] ? syscall_enter_from_user_mode+0x1d/0x50 [ 70.866532][ T8509] do_syscall_64+0x2d/0x70 [ 70.870979][ T8509] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 70.877215][ T8509] RIP: 0033:0x440299 [ 70.881128][ T8509] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 70.900728][ T8509] RSP: 002b:00007fff4b943e58 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 70.909234][ T8509] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440299 [ 70.917301][ T8509] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000003 [ 70.925462][ T8509] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 70.933665][ T8509] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401aa0 [ 70.941734][ T8509] R13: 0000000000401b30 R14: 0000000000000000 R15: 0000000000000000 [ 70.950311][ T8509] Kernel Offset: disabled [ 70.954647][ T8509] Rebooting in 86400 seconds..