[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.178' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 32.402886] audit: type=1400 audit(1601796150.287:8): avc: denied { execmem } for pid=6369 comm="syz-executor978" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 32.414890] ================================================================== [ 32.430199] BUG: KASAN: slab-out-of-bounds in squashfs_get_id+0x181/0x1a0 [ 32.440506] Read of size 8 at addr ffff88809fa928a0 by task syz-executor978/6369 [ 32.448028] [ 32.449650] CPU: 0 PID: 6369 Comm: syz-executor978 Not tainted 4.14.198-syzkaller #0 [ 32.457552] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 32.466911] Call Trace: [ 32.469493] dump_stack+0x1b2/0x283 [ 32.473113] print_address_description.cold+0x54/0x1d3 [ 32.478367] kasan_report_error.cold+0x8a/0x194 [ 32.483013] ? squashfs_get_id+0x181/0x1a0 [ 32.487222] __asan_report_load8_noabort+0x68/0x70 [ 32.492138] ? squashfs_get_id+0x181/0x1a0 [ 32.496349] squashfs_get_id+0x181/0x1a0 [ 32.500413] ? squashfs_read_fragment_index_table+0xc0/0xc0 [ 32.506099] ? squashfs_read_metadata+0x2a6/0x370 [ 32.510920] squashfs_read_inode+0x171/0x1840 [ 32.515394] ? squashfs_read_id_index_table+0xc0/0xc0 [ 32.520560] ? new_inode+0xc7/0xf0 [ 32.524091] ? lock_acquire+0x170/0x3f0 [ 32.528043] ? do_raw_spin_unlock+0x164/0x220 [ 32.532515] squashfs_fill_super+0x1138/0x1640 [ 32.538042] mount_bdev+0x2b3/0x360 [ 32.541643] ? squashfs_alloc_inode+0x40/0x40 [ 32.546114] mount_fs+0x92/0x2a0 [ 32.549458] vfs_kern_mount.part.0+0x5b/0x470 [ 32.553929] do_mount+0xe53/0x2a00 [ 32.557445] ? do_raw_spin_unlock+0x164/0x220 [ 32.561920] ? copy_mount_string+0x40/0x40 [ 32.566145] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 32.571137] ? copy_mnt_ns+0xa30/0xa30 [ 32.574997] ? copy_mount_options+0x1fa/0x2f0 [ 32.579466] ? copy_mnt_ns+0xa30/0xa30 [ 32.583328] SyS_mount+0xa8/0x120 [ 32.586760] ? copy_mnt_ns+0xa30/0xa30 [ 32.590722] do_syscall_64+0x1d5/0x640 [ 32.594596] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 32.599761] RIP: 0033:0x446d2a [ 32.602923] RSP: 002b:00007fff04f65f38 EFLAGS: 00000293 ORIG_RAX: 00000000000000a5 [ 32.610617] RAX: ffffffffffffffda RBX: 00007fff04f65f90 RCX: 0000000000446d2a [ 32.617873] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007fff04f65f50 [ 32.625118] RBP: 00007fff04f65f50 R08: 00007fff04f65f90 R09: 00007fff00000015 [ 32.632362] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 32.639621] R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000003 [ 32.646884] [ 32.648487] Allocated by task 6369: [ 32.652105] kasan_kmalloc+0xeb/0x160 [ 32.655893] __kmalloc+0x15a/0x400 [ 32.659419] squashfs_read_data+0x153/0x1140 [ 32.663800] squashfs_read_table+0x11c/0x18d [ 32.668181] squashfs_read_id_index_table+0x6f/0xc0 [ 32.673172] squashfs_fill_super+0xd7a/0x1640 [ 32.677653] mount_bdev+0x2b3/0x360 [ 32.681255] mount_fs+0x92/0x2a0 [ 32.684603] vfs_kern_mount.part.0+0x5b/0x470 [ 32.689097] do_mount+0xe53/0x2a00 [ 32.692609] SyS_mount+0xa8/0x120 [ 32.696050] do_syscall_64+0x1d5/0x640 [ 32.699915] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 32.705080] [ 32.706686] Freed by task 6369: [ 32.709971] kasan_slab_free+0xc3/0x1a0 [ 32.713927] kfree+0xc9/0x250 [ 32.717007] squashfs_read_data+0x931/0x1140 [ 32.721387] squashfs_read_table+0x11c/0x18d [ 32.725770] squashfs_read_id_index_table+0x6f/0xc0 [ 32.730759] squashfs_fill_super+0xd7a/0x1640 [ 32.735228] mount_bdev+0x2b3/0x360 [ 32.738841] mount_fs+0x92/0x2a0 [ 32.742179] vfs_kern_mount.part.0+0x5b/0x470 [ 32.746654] do_mount+0xe53/0x2a00 [ 32.750187] SyS_mount+0xa8/0x120 [ 32.753624] do_syscall_64+0x1d5/0x640 [ 32.757485] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 32.763190] [ 32.764795] The buggy address belongs to the object at ffff88809fa92880 [ 32.764795] which belongs to the cache kmalloc-32 of size 32 [ 32.777251] The buggy address is located 0 bytes to the right of [ 32.777251] 32-byte region [ffff88809fa92880, ffff88809fa928a0) [ 32.789367] The buggy address belongs to the page: [ 32.794287] page:ffffea00027ea480 count:1 mapcount:0 mapping:ffff88809fa92000 index:0xffff88809fa92fc1 [ 32.803705] flags: 0xfffe0000000100(slab) [ 32.807843] raw: 00fffe0000000100 ffff88809fa92000 ffff88809fa92fc1 000000010000003d [ 32.815697] raw: ffffea00027d6360 ffffea00027d1ce0 ffff88812fe501c0 0000000000000000 [ 32.823549] page dumped because: kasan: bad access detected [ 32.829239] [ 32.830837] Memory state around the buggy address: [ 32.835760] ffff88809fa92780: fb fb fb fb fc fc fc fc 00 00 01 fc fc fc fc fc [ 32.843105] ffff88809fa92800: fb fb fb fb fc fc fc fc 00 fc fc fc fc fc fc fc [ 32.850451] >ffff88809fa92880: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 32.857802] ^ [ 32.862182] ffff88809fa92900: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 32.869520] ffff88809fa92980: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 32.876850] ================================================================== [ 32.884178] Disabling lock debugging due to kernel taint [ 32.890664] Kernel panic - not syncing: panic_on_warn set ... [ 32.890664] [ 32.899159] CPU: 0 PID: 6369 Comm: syz-executor978 Tainted: G B 4.14.198-syzkaller #0 [ 32.908240] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 32.917581] Call Trace: [ 32.920160] dump_stack+0x1b2/0x283 [ 32.923773] panic+0x1f9/0x42d [ 32.926983] ? add_taint.cold+0x16/0x16 [ 32.930943] ? ___preempt_schedule+0x16/0x18 [ 32.935326] kasan_end_report+0x43/0x49 [ 32.939275] kasan_report_error.cold+0xa7/0x194 [ 32.943920] ? squashfs_get_id+0x181/0x1a0 [ 32.948127] __asan_report_load8_noabort+0x68/0x70 [ 32.953030] ? squashfs_get_id+0x181/0x1a0 [ 32.957249] squashfs_get_id+0x181/0x1a0 [ 32.961293] ? squashfs_read_fragment_index_table+0xc0/0xc0 [ 32.966978] ? squashfs_read_metadata+0x2a6/0x370 [ 32.971808] squashfs_read_inode+0x171/0x1840 [ 32.976297] ? squashfs_read_id_index_table+0xc0/0xc0 [ 32.981473] ? new_inode+0xc7/0xf0 [ 32.984986] ? lock_acquire+0x170/0x3f0 [ 32.988936] ? do_raw_spin_unlock+0x164/0x220 [ 32.993419] squashfs_fill_super+0x1138/0x1640 [ 32.997976] mount_bdev+0x2b3/0x360 [ 33.001575] ? squashfs_alloc_inode+0x40/0x40 [ 33.006043] mount_fs+0x92/0x2a0 [ 33.009384] vfs_kern_mount.part.0+0x5b/0x470 [ 33.013931] do_mount+0xe53/0x2a00 [ 33.017510] ? do_raw_spin_unlock+0x164/0x220 [ 33.021994] ? copy_mount_string+0x40/0x40 [ 33.026215] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 33.031215] ? copy_mnt_ns+0xa30/0xa30 [ 33.035083] ? copy_mount_options+0x1fa/0x2f0 [ 33.039555] ? copy_mnt_ns+0xa30/0xa30 [ 33.043418] SyS_mount+0xa8/0x120 [ 33.046846] ? copy_mnt_ns+0xa30/0xa30 [ 33.050720] do_syscall_64+0x1d5/0x640 [ 33.054584] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 33.059755] RIP: 0033:0x446d2a [ 33.062921] RSP: 002b:00007fff04f65f38 EFLAGS: 00000293 ORIG_RAX: 00000000000000a5 [ 33.071555] RAX: ffffffffffffffda RBX: 00007fff04f65f90 RCX: 0000000000446d2a [ 33.078802] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007fff04f65f50 [ 33.086049] RBP: 00007fff04f65f50 R08: 00007fff04f65f90 R09: 00007fff00000015 [ 33.093301] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 33.100547] R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000003 [ 33.108827] Kernel Offset: disabled [ 33.112448] Rebooting in 86400 seconds..