[ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.94' (ECDSA) to the list of known hosts. syzkaller login: [ 78.652202][ T28] audit: type=1400 audit(1596834730.965:8): avc: denied { execmem } for pid=6872 comm="syz-executor052" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 78.665482][ T6873] IPVS: ftp: loaded support on port[0] = 21 executing program [ 79.809449][ T6873] ================================================================== [ 79.817673][ T6873] BUG: KASAN: use-after-free in hci_chan_del+0x14f/0x190 [ 79.824698][ T6873] Read of size 8 at addr ffff8880a77b2618 by task syz-executor052/6873 [ 79.832929][ T6873] [ 79.835260][ T6873] CPU: 0 PID: 6873 Comm: syz-executor052 Not tainted 5.8.0-syzkaller #0 [ 79.843574][ T6873] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 79.853632][ T6873] Call Trace: [ 79.856922][ T6873] dump_stack+0x18f/0x20d [ 79.861348][ T6873] ? hci_chan_del+0x14f/0x190 [ 79.866027][ T6873] ? hci_chan_del+0x14f/0x190 [ 79.870714][ T6873] print_address_description.constprop.0.cold+0xae/0x436 [ 79.877741][ T6873] ? mutex_lock_io_nested+0xf60/0xf60 [ 79.883117][ T6873] ? vprintk_func+0x97/0x1a6 [ 79.887702][ T6873] ? hci_chan_del+0x14f/0x190 [ 79.892357][ T6873] kasan_report.cold+0x1f/0x37 [ 79.897096][ T6873] ? hci_chan_del+0x14f/0x190 [ 79.901747][ T6873] hci_chan_del+0x14f/0x190 [ 79.906228][ T6873] l2cap_conn_del+0x61b/0x9e0 [ 79.910886][ T6873] ? l2cap_conn_del+0x9e0/0x9e0 [ 79.915711][ T6873] l2cap_disconn_cfm+0x85/0xa0 [ 79.920453][ T6873] hci_conn_hash_flush+0x114/0x220 [ 79.925694][ T6873] ? vhci_close_dev+0x50/0x50 [ 79.930357][ T6873] hci_dev_do_close+0x5c6/0x1080 [ 79.935283][ T6873] ? hci_dev_open+0x350/0x350 [ 79.939947][ T6873] ? do_raw_read_unlock+0x70/0x70 [ 79.944950][ T6873] ? try_to_grab_pending.part.0+0x7d0/0x7d0 [ 79.950823][ T6873] ? vhci_close_dev+0x50/0x50 [ 79.955475][ T6873] hci_unregister_dev+0x1bd/0xe30 [ 79.960477][ T6873] ? fcntl_setlk+0xf60/0xf60 [ 79.965046][ T6873] ? lock_is_held_type+0xbb/0xf0 [ 79.969960][ T6873] ? vhci_close_dev+0x50/0x50 [ 79.974610][ T6873] vhci_release+0x70/0xe0 [ 79.978916][ T6873] __fput+0x33c/0x880 [ 79.982919][ T6873] task_work_run+0xdd/0x190 [ 79.987401][ T6873] do_exit+0xb7d/0x29f0 [ 79.991534][ T6873] ? __schedule+0x8ed/0x21e0 [ 79.996101][ T6873] ? mm_update_next_owner+0x7a0/0x7a0 [ 80.001455][ T6873] ? lock_is_held_type+0xbb/0xf0 [ 80.006369][ T6873] ? lock_is_held_type+0xbb/0xf0 [ 80.011284][ T6873] do_group_exit+0x125/0x310 [ 80.015850][ T6873] __x64_sys_exit_group+0x3a/0x50 [ 80.020848][ T6873] do_syscall_64+0x2d/0x70 [ 80.025241][ T6873] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 80.031108][ T6873] RIP: 0033:0x4453d8 [ 80.034971][ T6873] Code: Bad RIP value. [ 80.039011][ T6873] RSP: 002b:00007ffef35220e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 80.047396][ T6873] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00000000004453d8 [ 80.055389][ T6873] RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001 [ 80.063336][ T6873] RBP: 00000000004cd1b0 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 80.071283][ T6873] R10: 00000000000000ff R11: 0000000000000246 R12: 0000000000000001 [ 80.079232][ T6873] R13: 00000000006e0260 R14: 0000000000000000 R15: 0000000000000000 [ 80.087185][ T6873] [ 80.089490][ T6873] Allocated by task 6897: [ 80.093795][ T6873] save_stack+0x1b/0x40 [ 80.097925][ T6873] __kasan_kmalloc.constprop.0+0xc2/0xd0 [ 80.103561][ T6873] kmem_cache_alloc_trace+0x14f/0x2d0 [ 80.108909][ T6873] hci_chan_create+0x9b/0x330 [ 80.113562][ T6873] l2cap_conn_add.part.0+0x1e/0xe10 [ 80.118735][ T6873] l2cap_connect_cfm+0x23b/0x1090 [ 80.123734][ T6873] le_conn_complete_evt+0x1153/0x1740 [ 80.129078][ T6873] hci_le_meta_evt+0x745/0x3ff0 [ 80.133902][ T6873] hci_event_packet+0x2e25/0x87a8 [ 80.138897][ T6873] hci_rx_work+0x22e/0xb50 [ 80.143297][ T6873] process_one_work+0x94c/0x1670 [ 80.148221][ T6873] worker_thread+0x64c/0x1120 [ 80.152870][ T6873] kthread+0x3b5/0x4a0 [ 80.156927][ T6873] ret_from_fork+0x1f/0x30 [ 80.161311][ T6873] [ 80.163614][ T6873] Freed by task 1540: [ 80.167569][ T6873] save_stack+0x1b/0x40 [ 80.171750][ T6873] __kasan_slab_free+0xf5/0x140 [ 80.176572][ T6873] kfree+0x103/0x2c0 [ 80.180441][ T6873] hci_event_packet+0x3e33/0x87a8 [ 80.185436][ T6873] hci_rx_work+0x22e/0xb50 [ 80.189825][ T6873] process_one_work+0x94c/0x1670 [ 80.194735][ T6873] worker_thread+0x64c/0x1120 [ 80.199383][ T6873] kthread+0x3b5/0x4a0 [ 80.203426][ T6873] ret_from_fork+0x1f/0x30 [ 80.207811][ T6873] [ 80.210113][ T6873] The buggy address belongs to the object at ffff8880a77b2600 [ 80.210113][ T6873] which belongs to the cache kmalloc-128 of size 128 [ 80.224137][ T6873] The buggy address is located 24 bytes inside of [ 80.224137][ T6873] 128-byte region [ffff8880a77b2600, ffff8880a77b2680) [ 80.237294][ T6873] The buggy address belongs to the page: [ 80.242909][ T6873] page:ffffea00029dec80 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880a77b2200 [ 80.253291][ T6873] flags: 0xfffe0000000200(slab) [ 80.258128][ T6873] raw: 00fffe0000000200 ffffea0002a3cd88 ffff8880aa001540 ffff8880aa000700 [ 80.266686][ T6873] raw: ffff8880a77b2200 ffff8880a77b2000 000000010000000c 0000000000000000 [ 80.275255][ T6873] page dumped because: kasan: bad access detected [ 80.281663][ T6873] [ 80.283965][ T6873] Memory state around the buggy address: [ 80.289572][ T6873] ffff8880a77b2500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 80.297608][ T6873] ffff8880a77b2580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 80.305653][ T6873] >ffff8880a77b2600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 80.313686][ T6873] ^ [ 80.318522][ T6873] ffff8880a77b2680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 80.326586][ T6873] ffff8880a77b2700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 80.334636][ T6873] ================================================================== [ 80.342690][ T6873] Disabling lock debugging due to kernel taint [ 80.349410][ T6873] Kernel panic - not syncing: panic_on_warn set ... [ 80.356004][ T6873] CPU: 0 PID: 6873 Comm: syz-executor052 Tainted: G B 5.8.0-syzkaller #0 [ 80.365708][ T6873] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 80.375758][ T6873] Call Trace: [ 80.379053][ T6873] dump_stack+0x18f/0x20d [ 80.383379][ T6873] ? hci_chan_del+0x110/0x190 [ 80.388050][ T6873] panic+0x2e3/0x75c [ 80.391940][ T6873] ? __warn_printk+0xf3/0xf3 [ 80.396532][ T6873] ? preempt_schedule_common+0x59/0xc0 [ 80.401984][ T6873] ? hci_chan_del+0x14f/0x190 [ 80.406657][ T6873] ? preempt_schedule_thunk+0x16/0x18 [ 80.412022][ T6873] ? trace_hardirqs_on+0x55/0x220 [ 80.417037][ T6873] ? hci_chan_del+0x14f/0x190 [ 80.421689][ T6873] ? hci_chan_del+0x14f/0x190 [ 80.426489][ T6873] end_report+0x4d/0x53 [ 80.430631][ T6873] kasan_report.cold+0xd/0x37 [ 80.435294][ T6873] ? hci_chan_del+0x14f/0x190 [ 80.439947][ T6873] hci_chan_del+0x14f/0x190 [ 80.444430][ T6873] l2cap_conn_del+0x61b/0x9e0 [ 80.449085][ T6873] ? l2cap_conn_del+0x9e0/0x9e0 [ 80.453907][ T6873] l2cap_disconn_cfm+0x85/0xa0 [ 80.458643][ T6873] hci_conn_hash_flush+0x114/0x220 [ 80.463768][ T6873] ? vhci_close_dev+0x50/0x50 [ 80.468417][ T6873] hci_dev_do_close+0x5c6/0x1080 [ 80.473326][ T6873] ? hci_dev_open+0x350/0x350 [ 80.477977][ T6873] ? do_raw_read_unlock+0x70/0x70 [ 80.482983][ T6873] ? try_to_grab_pending.part.0+0x7d0/0x7d0 [ 80.488849][ T6873] ? vhci_close_dev+0x50/0x50 [ 80.493497][ T6873] hci_unregister_dev+0x1bd/0xe30 [ 80.498493][ T6873] ? fcntl_setlk+0xf60/0xf60 [ 80.503057][ T6873] ? lock_is_held_type+0xbb/0xf0 [ 80.508009][ T6873] ? vhci_close_dev+0x50/0x50 [ 80.512656][ T6873] vhci_release+0x70/0xe0 [ 80.516956][ T6873] __fput+0x33c/0x880 [ 80.520912][ T6873] task_work_run+0xdd/0x190 [ 80.525389][ T6873] do_exit+0xb7d/0x29f0 [ 80.529607][ T6873] ? __schedule+0x8ed/0x21e0 [ 80.534165][ T6873] ? mm_update_next_owner+0x7a0/0x7a0 [ 80.539512][ T6873] ? lock_is_held_type+0xbb/0xf0 [ 80.544421][ T6873] ? lock_is_held_type+0xbb/0xf0 [ 80.549349][ T6873] do_group_exit+0x125/0x310 [ 80.553923][ T6873] __x64_sys_exit_group+0x3a/0x50 [ 80.558932][ T6873] do_syscall_64+0x2d/0x70 [ 80.563339][ T6873] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 80.569253][ T6873] RIP: 0033:0x4453d8 [ 80.573120][ T6873] Code: Bad RIP value. [ 80.577160][ T6873] RSP: 002b:00007ffef35220e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 80.585551][ T6873] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00000000004453d8 [ 80.593505][ T6873] RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001 [ 80.601450][ T6873] RBP: 00000000004cd1b0 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 80.609394][ T6873] R10: 00000000000000ff R11: 0000000000000246 R12: 0000000000000001 [ 80.617339][ T6873] R13: 00000000006e0260 R14: 0000000000000000 R15: 0000000000000000 [ 80.626412][ T6873] Kernel Offset: disabled [ 80.630727][ T6873] Rebooting in 86400 seconds..