[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.1.26' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 44.038598] audit: type=1400 audit(1588640030.007:8): avc: denied { execmem } for pid=6453 comm="syz-executor560" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 44.066755] audit: type=1800 audit(1588640030.037:9): pid=6457 uid=0 auid=0 ses=5 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor560" name="file0" dev="sda1" ino=15706 res=0 executing program [ 44.074776] MINIX-fs: mounting unchecked file system, running fsck is recommended [ 44.109323] Process accounting resumed [ 44.116009] Process accounting resumed executing program executing program [ 44.140837] Process accounting resumed [ 44.145751] Process accounting resumed [ 44.173104] Process accounting resumed [ 44.185630] Process accounting resumed executing program [ 44.204713] Process accounting resumed [ 44.218990] Process accounting resumed executing program executing program [ 44.249763] Process accounting resumed [ 44.256751] Process accounting resumed [ 44.285082] Process accounting resumed [ 44.291327] Process accounting resumed executing program [ 44.335196] Process accounting resumed [ 44.342041] Process accounting resumed [ 44.354074] ================================================================== [ 44.361635] BUG: KASAN: use-after-free in get_block+0x1047/0x1300 [ 44.368501] Read of size 2 at addr ffff888080b347b8 by task syz-executor560/6493 [ 44.376210] [ 44.377854] CPU: 1 PID: 6493 Comm: syz-executor560 Not tainted 4.19.120-syzkaller #0 [ 44.385740] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 44.387820] Process accounting resumed [ 44.396413] Call Trace: [ 44.396439] dump_stack+0x188/0x20d [ 44.396455] ? get_block+0x1047/0x1300 [ 44.396471] print_address_description.cold+0x7c/0x212 [ 44.396489] ? get_block+0x1047/0x1300 [ 44.419853] kasan_report.cold+0x88/0x2b9 [ 44.424097] get_block+0x1047/0x1300 [ 44.428089] ? block_to_path.isra.0+0x300/0x300 [ 44.432783] ? find_get_entry+0x370/0x900 [ 44.436925] ? lock_downgrade+0x740/0x740 [ 44.441091] minix_get_block+0xe5/0x110 [ 44.445080] __block_write_begin_int+0x480/0x17a0 [ 44.450970] ? minix_rename+0x8c0/0x8c0 [ 44.454943] ? __breadahead_gfp+0xf0/0xf0 [ 44.459100] ? pagecache_get_page+0x1b3/0xb20 [ 44.463959] ? wait_for_stable_page+0x124/0x3b0 [ 44.468636] ? minix_rename+0x8c0/0x8c0 [ 44.472631] block_write_begin+0x58/0x2e0 [ 44.477129] minix_write_begin+0x35/0xe0 [ 44.481325] generic_perform_write+0x1f8/0x4d0 [ 44.486206] ? page_endio+0x950/0x950 [ 44.489997] ? current_time+0x140/0x140 [ 44.494428] ? lock_acquire+0x170/0x400 [ 44.498512] __generic_file_write_iter+0x24c/0x610 [ 44.503551] generic_file_write_iter+0x37f/0x729 [ 44.508362] ? mark_held_locks+0xf0/0xf0 [ 44.513339] __vfs_write+0x512/0x760 [ 44.517044] ? kernel_read+0x110/0x110 [ 44.520978] ? lock_acquire+0x170/0x400 [ 44.525298] ? do_acct_process+0xebd/0x10e0 [ 44.530236] __kernel_write+0x109/0x370 [ 44.534198] do_acct_process+0xcd8/0x10e0 [ 44.538546] ? acct_on+0x760/0x760 [ 44.542277] ? find_held_lock+0x2d/0x110 [ 44.546749] ? lock_downgrade+0x740/0x740 [ 44.550982] acct_pin_kill+0x29/0xf0 [ 44.555069] pin_kill+0x17a/0x7e0 [ 44.563172] ? find_held_lock+0x2d/0x110 [ 44.567392] ? pin_insert+0x50/0x50 [ 44.571048] ? __mutex_unlock_slowpath+0xea/0x670 [ 44.575940] ? finish_wait+0x260/0x260 [ 44.579837] ? check_preemption_disabled+0x41/0x280 [ 44.584946] acct_on+0x54b/0x760 [ 44.588308] __x64_sys_acct+0xab/0x1f0 [ 44.594998] do_syscall_64+0xf9/0x620 [ 44.598790] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 44.603962] RIP: 0033:0x44ad79 [ 44.607136] Code: fd cb fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb cb fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 44.626084] RSP: 002b:00007ff49b132ce8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a3 [ 44.633795] RAX: ffffffffffffffda RBX: 00000000006dcc28 RCX: 000000000044ad79 [ 44.641054] RDX: 000000000044ad79 RSI: 89f6f3d9b5241138 RDI: 0000000020000480 [ 44.648307] RBP: 00000000006dcc20 R08: 0000000000000000 R09: 0000000000000000 [ 44.655558] R10: 000000000000000a R11: 0000000000000246 R12: 00000000006dcc2c [ 44.663000] R13: 00007ffd885b612f R14: 00007ff49b1339c0 R15: 20c49ba5e353f7cf [ 44.670475] [ 44.672090] The buggy address belongs to the page: [ 44.677017] page:ffffea000202cd00 count:0 mapcount:0 mapping:0000000000000000 index:0x1 [ 44.685161] flags: 0xfffe0000000000() [ 44.688989] raw: 00fffe0000000000 ffffea00022ffac8 ffffea0002414b48 0000000000000000 [ 44.696887] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 44.704930] page dumped because: kasan: bad access detected [ 44.710627] [ 44.712245] Memory state around the buggy address: [ 44.717192] ffff888080b34680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 44.724654] ffff888080b34700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 44.732316] >ffff888080b34780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 44.740481] ^ [ 44.746409] ffff888080b34800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 44.753761] ffff888080b34880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 44.761212] ================================================================== [ 44.768567] Disabling lock debugging due to kernel taint [ 44.774271] Kernel panic - not syncing: panic_on_warn set ... [ 44.774271] [ 44.781915] CPU: 1 PID: 6493 Comm: syz-executor560 Tainted: G B 4.19.120-syzkaller #0 [ 44.791456] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 44.800813] Call Trace: [ 44.803476] dump_stack+0x188/0x20d [ 44.807131] panic+0x26a/0x50e [ 44.810307] ? __warn_printk+0xf3/0xf3 [ 44.814190] ? get_block+0x1047/0x1300 [ 44.818078] ? trace_hardirqs_on+0x55/0x210 [ 44.822396] ? get_block+0x1047/0x1300 [ 44.826280] kasan_end_report+0x43/0x49 [ 44.830252] kasan_report.cold+0xa4/0x2b9 [ 44.834391] get_block+0x1047/0x1300 [ 44.838090] ? block_to_path.isra.0+0x300/0x300 [ 44.842794] ? find_get_entry+0x370/0x900 [ 44.846934] ? lock_downgrade+0x740/0x740 [ 44.851069] minix_get_block+0xe5/0x110 [ 44.855050] __block_write_begin_int+0x480/0x17a0 [ 44.859889] ? minix_rename+0x8c0/0x8c0 [ 44.864281] ? __breadahead_gfp+0xf0/0xf0 [ 44.868412] ? pagecache_get_page+0x1b3/0xb20 [ 44.872902] ? wait_for_stable_page+0x124/0x3b0 [ 44.877562] ? minix_rename+0x8c0/0x8c0 [ 44.881537] block_write_begin+0x58/0x2e0 [ 44.885697] minix_write_begin+0x35/0xe0 [ 44.889846] generic_perform_write+0x1f8/0x4d0 [ 44.894420] ? page_endio+0x950/0x950 [ 44.898223] ? current_time+0x140/0x140 [ 44.902292] ? lock_acquire+0x170/0x400 [ 44.906256] __generic_file_write_iter+0x24c/0x610 [ 44.911180] generic_file_write_iter+0x37f/0x729 [ 44.915950] ? mark_held_locks+0xf0/0xf0 [ 44.920016] __vfs_write+0x512/0x760 [ 44.923829] ? kernel_read+0x110/0x110 [ 44.927736] ? lock_acquire+0x170/0x400 [ 44.931724] ? do_acct_process+0xebd/0x10e0 [ 44.936076] __kernel_write+0x109/0x370 [ 44.940091] do_acct_process+0xcd8/0x10e0 [ 44.944325] ? acct_on+0x760/0x760 [ 44.947862] ? find_held_lock+0x2d/0x110 [ 44.951984] ? lock_downgrade+0x740/0x740 [ 44.956167] acct_pin_kill+0x29/0xf0 [ 44.959869] pin_kill+0x17a/0x7e0 [ 44.963310] ? find_held_lock+0x2d/0x110 [ 44.967360] ? pin_insert+0x50/0x50 [ 44.970975] ? __mutex_unlock_slowpath+0xea/0x670 [ 44.975799] ? finish_wait+0x260/0x260 [ 44.979688] ? check_preemption_disabled+0x41/0x280 [ 44.984701] acct_on+0x54b/0x760 [ 44.988061] __x64_sys_acct+0xab/0x1f0 [ 44.991930] do_syscall_64+0xf9/0x620 [ 44.995729] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 45.001156] RIP: 0033:0x44ad79 [ 45.004413] Code: fd cb fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb cb fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 45.023485] RSP: 002b:00007ff49b132ce8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a3 [ 45.031187] RAX: ffffffffffffffda RBX: 00000000006dcc28 RCX: 000000000044ad79 [ 45.038565] RDX: 000000000044ad79 RSI: 89f6f3d9b5241138 RDI: 0000000020000480 [ 45.046510] RBP: 00000000006dcc20 R08: 0000000000000000 R09: 0000000000000000 [ 45.053766] R10: 000000000000000a R11: 0000000000000246 R12: 00000000006dcc2c [ 45.061026] R13: 00007ffd885b612f R14: 00007ff49b1339c0 R15: 20c49ba5e353f7cf [ 45.069614] Kernel Offset: disabled [ 45.073235] Rebooting in 86400 seconds..