[ OK ] Started Getty on tty2. [ OK ] Started Getty on tty1. [ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.54' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 61.471367][ T6854] ================================================================== [ 61.471409][ T6854] BUG: KASAN: global-out-of-bounds in vga16fb_imageblit+0x1c36/0x2210 [ 61.471417][ T6854] Read of size 2 at addr ffffffff8899f6be by task syz-executor912/6854 [ 61.471419][ T6854] [ 61.471428][ T6854] CPU: 0 PID: 6854 Comm: syz-executor912 Not tainted 5.9.0-rc3-syzkaller #0 [ 61.471433][ T6854] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 61.471436][ T6854] Call Trace: [ 61.471449][ T6854] dump_stack+0x198/0x1fd [ 61.471458][ T6854] ? vga16fb_imageblit+0x1c36/0x2210 [ 61.471466][ T6854] ? vga16fb_imageblit+0x1c36/0x2210 [ 61.471476][ T6854] print_address_description.constprop.0.cold+0x5/0x497 [ 61.471486][ T6854] ? vga16fb_imageblit+0x1c36/0x2210 [ 61.471495][ T6854] ? lockdep_hardirqs_off+0x96/0xd0 [ 61.471505][ T6854] ? vprintk_func+0x97/0x1a6 [ 61.471515][ T6854] ? vga16fb_imageblit+0x1c36/0x2210 [ 61.471522][ T6854] ? vga16fb_imageblit+0x1c36/0x2210 [ 61.471529][ T6854] kasan_report.cold+0x1f/0x37 [ 61.471539][ T6854] ? lock_downgrade+0x830/0x830 [ 61.471546][ T6854] ? vga16fb_imageblit+0x1c36/0x2210 [ 61.471556][ T6854] vga16fb_imageblit+0x1c36/0x2210 [ 61.471570][ T6854] ? fb_pad_unaligned_buffer+0x3f/0x320 [ 61.471582][ T6854] soft_cursor+0x514/0xa30 [ 61.471597][ T6854] bit_cursor+0x1166/0x17d0 [ 61.471611][ T6854] ? kmalloc_array.constprop.0+0x20/0x20 [ 61.471625][ T6854] ? do_update_region+0x47c/0x630 [ 61.471635][ T6854] ? fb_get_color_depth+0x11a/0x240 [ 61.471644][ T6854] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 61.471652][ T6854] ? get_color+0x20e/0x410 [ 61.471662][ T6854] fbcon_cursor+0x537/0x660 [ 61.471669][ T6854] ? kmalloc_array.constprop.0+0x20/0x20 [ 61.471677][ T6854] ? fbcon_set_palette+0x3a8/0x490 [ 61.471687][ T6854] set_cursor+0x1d2/0x240 [ 61.471696][ T6854] redraw_screen+0x4b9/0x770 [ 61.471704][ T6854] ? vga16fb_update_fix+0x4a0/0x4a0 [ 61.471713][ T6854] ? vc_init+0x430/0x430 [ 61.471723][ T6854] ? fbcon_set_palette+0x3a8/0x490 [ 61.471733][ T6854] fbcon_modechanged+0x575/0x710 [ 61.471744][ T6854] fbcon_update_vcs+0x3a/0x50 [ 61.471753][ T6854] do_fb_ioctl+0x62e/0x690 [ 61.471762][ T6854] ? fb_set_suspend+0x1a0/0x1a0 [ 61.471771][ T6854] ? tomoyo_execute_permission+0x470/0x470 [ 61.471786][ T6854] ? lock_is_held_type+0xbb/0xf0 [ 61.471799][ T6854] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 61.471808][ T6854] ? do_vfs_ioctl+0x27d/0x1090 [ 61.471828][ T6854] ? __x64_sys_openat+0x13f/0x1f0 [ 61.471840][ T6854] fb_ioctl+0xdd/0x130 [ 61.471847][ T6854] ? do_fb_ioctl+0x690/0x690 [ 61.471856][ T6854] __x64_sys_ioctl+0x193/0x200 [ 61.471866][ T6854] do_syscall_64+0x2d/0x70 [ 61.471875][ T6854] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 61.471882][ T6854] RIP: 0033:0x4403d9 [ 61.471892][ T6854] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 61.471897][ T6854] RSP: 002b:00007ffc3d071758 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 61.471905][ T6854] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004403d9 [ 61.471910][ T6854] RDX: 00000000200001c0 RSI: 0000000000004601 RDI: 0000000000000003 [ 61.471915][ T6854] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 61.471920][ T6854] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401be0 [ 61.471925][ T6854] R13: 0000000000401c70 R14: 0000000000000000 R15: 0000000000000000 [ 61.471937][ T6854] [ 61.471940][ T6854] The buggy address belongs to the variable: [ 61.471948][ T6854] transl_h+0x3e/0x40 [ 61.471950][ T6854] [ 61.471953][ T6854] Memory state around the buggy address: [ 61.471961][ T6854] ffffffff8899f580: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 [ 61.471967][ T6854] ffffffff8899f600: 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 [ 61.471972][ T6854] >ffffffff8899f680: 00 00 00 00 f9 f9 f9 f9 00 00 00 00 f9 f9 f9 f9 [ 61.471976][ T6854] ^ [ 61.471982][ T6854] ffffffff8899f700: 00 01 f9 f9 f9 f9 f9 f9 00 00 00 04 f9 f9 f9 f9 [ 61.471987][ T6854] ffffffff8899f780: 00 00 04 f9 f9 f9 f9 f9 00 00 00 00 00 00 02 f9 [ 61.471990][ T6854] ================================================================== [ 61.471993][ T6854] Disabling lock debugging due to kernel taint [ 61.471997][ T6854] Kernel panic - not syncing: panic_on_warn set ... [ 61.472004][ T6854] CPU: 0 PID: 6854 Comm: syz-executor912 Tainted: G B 5.9.0-rc3-syzkaller #0 [ 61.472008][ T6854] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 61.472009][ T6854] Call Trace: [ 61.472016][ T6854] dump_stack+0x198/0x1fd [ 61.472024][ T6854] ? vga16fb_imageblit+0x1bd0/0x2210 [ 61.472031][ T6854] panic+0x347/0x7c0 [ 61.472039][ T6854] ? __warn_printk+0xf3/0xf3 [ 61.472048][ T6854] ? trace_hardirqs_on+0x55/0x220 [ 61.472055][ T6854] ? vga16fb_imageblit+0x1c36/0x2210 [ 61.472061][ T6854] ? vga16fb_imageblit+0x1c36/0x2210 [ 61.472067][ T6854] end_report+0x4d/0x53 [ 61.472074][ T6854] kasan_report.cold+0xd/0x37 [ 61.472081][ T6854] ? lock_downgrade+0x830/0x830 [ 61.472087][ T6854] ? vga16fb_imageblit+0x1c36/0x2210 [ 61.472094][ T6854] vga16fb_imageblit+0x1c36/0x2210 [ 61.472103][ T6854] ? fb_pad_unaligned_buffer+0x3f/0x320 [ 61.472111][ T6854] soft_cursor+0x514/0xa30 [ 61.472119][ T6854] bit_cursor+0x1166/0x17d0 [ 61.472128][ T6854] ? kmalloc_array.constprop.0+0x20/0x20 [ 61.472137][ T6854] ? do_update_region+0x47c/0x630 [ 61.472144][ T6854] ? fb_get_color_depth+0x11a/0x240 [ 61.472150][ T6854] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 61.472156][ T6854] ? get_color+0x20e/0x410 [ 61.472163][ T6854] fbcon_cursor+0x537/0x660 [ 61.472170][ T6854] ? kmalloc_array.constprop.0+0x20/0x20 [ 61.472176][ T6854] ? fbcon_set_palette+0x3a8/0x490 [ 61.472184][ T6854] set_cursor+0x1d2/0x240 [ 61.472191][ T6854] redraw_screen+0x4b9/0x770 [ 61.472198][ T6854] ? vga16fb_update_fix+0x4a0/0x4a0 [ 61.472205][ T6854] ? vc_init+0x430/0x430 [ 61.472212][ T6854] ? fbcon_set_palette+0x3a8/0x490 [ 61.472219][ T6854] fbcon_modechanged+0x575/0x710 [ 61.472226][ T6854] fbcon_update_vcs+0x3a/0x50 [ 61.472233][ T6854] do_fb_ioctl+0x62e/0x690 [ 61.472240][ T6854] ? fb_set_suspend+0x1a0/0x1a0 [ 61.472247][ T6854] ? tomoyo_execute_permission+0x470/0x470 [ 61.472256][ T6854] ? lock_is_held_type+0xbb/0xf0 [ 61.472264][ T6854] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 61.472271][ T6854] ? do_vfs_ioctl+0x27d/0x1090 [ 61.472281][ T6854] ? __x64_sys_openat+0x13f/0x1f0 [ 61.472289][ T6854] fb_ioctl+0xdd/0x130 [ 61.472296][ T6854] ? do_fb_ioctl+0x690/0x690 [ 61.472302][ T6854] __x64_sys_ioctl+0x193/0x200 [ 61.472309][ T6854] do_syscall_64+0x2d/0x70 [ 61.472316][ T6854] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 61.472320][ T6854] RIP: 0033:0x4403d9 [ 61.472327][ T6854] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 61.472330][ T6854] RSP: 002b:00007ffc3d071758 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 61.472337][ T6854] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004403d9 [ 61.472341][ T6854] RDX: 00000000200001c0 RSI: 0000000000004601 RDI: 0000000000000003 [ 61.472345][ T6854] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 61.472349][ T6854] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401be0 [ 61.472353][ T6854] R13: 0000000000401c70 R14: 0000000000000000 R15: 0000000000000000 [ 61.473430][ T6854] Kernel Offset: disabled [ 62.201440][ T6854] Rebooting in 86400 seconds..