[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.48' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 40.527339] audit: type=1400 audit(1602132269.868:8): avc: denied { execmem } for pid=6474 comm="syz-executor247" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 40.535567] ================================================================== [ 40.554808] BUG: KASAN: slab-out-of-bounds in squashfs_get_id+0x1bc/0x1f0 [ 40.561761] Read of size 8 at addr ffff8880a776e8f8 by task syz-executor247/6474 [ 40.569299] [ 40.570942] CPU: 0 PID: 6474 Comm: syz-executor247 Not tainted 4.19.150-syzkaller #0 [ 40.578823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 40.588232] Call Trace: [ 40.590817] dump_stack+0x22c/0x33e [ 40.594437] print_address_description.cold+0x56/0x25c [ 40.599738] kasan_report_error.cold+0x66/0xb9 [ 40.604322] ? squashfs_get_id+0x1bc/0x1f0 [ 40.608567] __asan_report_load8_noabort+0x88/0x90 [ 40.613506] ? squashfs_get_id+0x1bc/0x1f0 [ 40.617756] squashfs_get_id+0x1bc/0x1f0 [ 40.622252] ? squashfs_read_fragment_index_table+0xf0/0xf0 [ 40.627986] ? squashfs_read_metadata+0x2e5/0x3b0 [ 40.632831] squashfs_read_inode+0x197/0x1940 [ 40.637317] ? squashfs_read_id_index_table+0xf0/0xf0 [ 40.642509] ? find_held_lock+0x2d/0x110 [ 40.646638] ? new_inode+0xc7/0xf0 [ 40.650181] ? do_raw_spin_lock+0xcb/0x220 [ 40.654407] ? do_raw_spin_unlock+0x171/0x240 [ 40.658930] squashfs_fill_super+0x1277/0x190a [ 40.663513] mount_bdev+0x2fc/0x3b0 [ 40.667140] ? squashfs_remount+0x50/0x50 [ 40.671274] mount_fs+0xa3/0x318 [ 40.674627] vfs_kern_mount.part.0+0x68/0x470 [ 40.679109] do_mount+0x51c/0x2f10 [ 40.682649] ? do_raw_spin_unlock+0x171/0x240 [ 40.687133] ? check_preemption_disabled+0x41/0x2b0 [ 40.692138] ? copy_mount_string+0x40/0x40 [ 40.696367] ? kmem_cache_alloc_trace+0x379/0x4b0 [ 40.701216] ? copy_mount_options+0x261/0x370 [ 40.705707] ksys_mount+0xcf/0x130 [ 40.709249] __x64_sys_mount+0xba/0x150 [ 40.714079] ? lockdep_hardirqs_on+0x3c1/0x5e0 [ 40.718661] do_syscall_64+0xf9/0x670 [ 40.722606] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 40.727801] RIP: 0033:0x446d1a [ 40.730975] Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd ad fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 da ad fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 40.749901] RSP: 002b:00007ffc225fe9f8 EFLAGS: 00000293 ORIG_RAX: 00000000000000a5 [ 40.757604] RAX: ffffffffffffffda RBX: 00007ffc225fea50 RCX: 0000000000446d1a [ 40.764860] RDX: 0000000020000040 RSI: 0000000020000100 RDI: 00007ffc225fea10 [ 40.772129] RBP: 00007ffc225fea10 R08: 00007ffc225fea50 R09: 00007ffc00000015 [ 40.779404] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 40.786660] R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000003 [ 40.793935] [ 40.795555] Allocated by task 6474: [ 40.799176] __kmalloc+0x15a/0x4f0 [ 40.802696] squashfs_read_data+0x1e5/0x12e9 [ 40.807102] squashfs_read_table+0x184/0x1e3 [ 40.811497] squashfs_read_xattr_id_table+0x198/0x1f0 [ 40.816693] squashfs_fill_super+0xd8a/0x190a [ 40.821188] mount_bdev+0x2fc/0x3b0 [ 40.824807] mount_fs+0xa3/0x318 [ 40.828154] vfs_kern_mount.part.0+0x68/0x470 [ 40.832726] do_mount+0x51c/0x2f10 [ 40.836245] ksys_mount+0xcf/0x130 [ 40.839784] __x64_sys_mount+0xba/0x150 [ 40.843743] do_syscall_64+0xf9/0x670 [ 40.847530] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 40.852698] [ 40.854313] Freed by task 6474: [ 40.857586] kfree+0xcc/0x250 [ 40.860689] squashfs_read_data+0xab1/0x12e9 [ 40.865118] squashfs_read_table+0x184/0x1e3 [ 40.869556] squashfs_read_xattr_id_table+0x198/0x1f0 [ 40.874786] squashfs_fill_super+0xd8a/0x190a [ 40.879269] mount_bdev+0x2fc/0x3b0 [ 40.882905] mount_fs+0xa3/0x318 [ 40.886269] vfs_kern_mount.part.0+0x68/0x470 [ 40.890761] do_mount+0x51c/0x2f10 [ 40.894284] ksys_mount+0xcf/0x130 [ 40.897812] __x64_sys_mount+0xba/0x150 [ 40.901789] do_syscall_64+0xf9/0x670 [ 40.905573] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 40.910748] [ 40.912375] The buggy address belongs to the object at ffff8880a776e8c0 [ 40.912375] which belongs to the cache kmalloc-32 of size 32 [ 40.924860] The buggy address is located 24 bytes to the right of [ 40.924860] 32-byte region [ffff8880a776e8c0, ffff8880a776e8e0) [ 40.937077] The buggy address belongs to the page: [ 40.941997] page:ffffea00029ddb80 count:1 mapcount:0 mapping:ffff88812c3f61c0 index:0xffff8880a776efc1 [ 40.951435] flags: 0xfffe0000000100(slab) [ 40.955678] raw: 00fffe0000000100 ffffea0002980f08 ffffea0002a31dc8 ffff88812c3f61c0 [ 40.963548] raw: ffff8880a776efc1 ffff8880a776e000 000000010000003b 0000000000000000 [ 40.972367] page dumped because: kasan: bad access detected [ 40.978067] [ 40.979685] Memory state around the buggy address: [ 40.984612] ffff8880a776e780: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 40.991974] ffff8880a776e800: 00 fc fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 40.999343] >ffff8880a776e880: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 41.006685] ^ [ 41.013945] ffff8880a776e900: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 41.021317] ffff8880a776e980: 00 fc fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 41.028778] ================================================================== [ 41.036129] Disabling lock debugging due to kernel taint [ 41.042005] Kernel panic - not syncing: panic_on_warn set ... [ 41.042005] [ 41.049394] CPU: 0 PID: 6474 Comm: syz-executor247 Tainted: G B 4.19.150-syzkaller #0 [ 41.058672] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 41.068034] Call Trace: [ 41.070633] dump_stack+0x22c/0x33e [ 41.074276] panic+0x2ac/0x565 [ 41.077481] ? __warn_printk+0xf3/0xf3 [ 41.081379] ? preempt_schedule_common+0x45/0xc0 [ 41.086140] ? ___preempt_schedule+0x16/0x18 [ 41.090542] ? trace_hardirqs_on+0x55/0x210 [ 41.094854] kasan_end_report+0x43/0x49 [ 41.098819] kasan_report_error.cold+0x83/0xb9 [ 41.103393] ? squashfs_get_id+0x1bc/0x1f0 [ 41.107623] __asan_report_load8_noabort+0x88/0x90 [ 41.112546] ? squashfs_get_id+0x1bc/0x1f0 [ 41.116813] squashfs_get_id+0x1bc/0x1f0 [ 41.120869] ? squashfs_read_fragment_index_table+0xf0/0xf0 [ 41.126577] ? squashfs_read_metadata+0x2e5/0x3b0 [ 41.131415] squashfs_read_inode+0x197/0x1940 [ 41.135908] ? squashfs_read_id_index_table+0xf0/0xf0 [ 41.141112] ? find_held_lock+0x2d/0x110 [ 41.145163] ? new_inode+0xc7/0xf0 [ 41.148715] ? do_raw_spin_lock+0xcb/0x220 [ 41.152938] ? do_raw_spin_unlock+0x171/0x240 [ 41.157434] squashfs_fill_super+0x1277/0x190a [ 41.162024] mount_bdev+0x2fc/0x3b0 [ 41.165654] ? squashfs_remount+0x50/0x50 [ 41.169807] mount_fs+0xa3/0x318 [ 41.173161] vfs_kern_mount.part.0+0x68/0x470 [ 41.177659] do_mount+0x51c/0x2f10 [ 41.181189] ? do_raw_spin_unlock+0x171/0x240 [ 41.185683] ? check_preemption_disabled+0x41/0x2b0 [ 41.190691] ? copy_mount_string+0x40/0x40 [ 41.194918] ? kmem_cache_alloc_trace+0x379/0x4b0 [ 41.199768] ? copy_mount_options+0x261/0x370 [ 41.204279] ksys_mount+0xcf/0x130 [ 41.207834] __x64_sys_mount+0xba/0x150 [ 41.211797] ? lockdep_hardirqs_on+0x3c1/0x5e0 [ 41.216383] do_syscall_64+0xf9/0x670 [ 41.220185] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 41.225379] RIP: 0033:0x446d1a [ 41.228571] Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd ad fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 da ad fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 41.247466] RSP: 002b:00007ffc225fe9f8 EFLAGS: 00000293 ORIG_RAX: 00000000000000a5 [ 41.255170] RAX: ffffffffffffffda RBX: 00007ffc225fea50 RCX: 0000000000446d1a [ 41.262443] RDX: 0000000020000040 RSI: 0000000020000100 RDI: 00007ffc225fea10 [ 41.269722] RBP: 00007ffc225fea10 R08: 00007ffc225fea50 R09: 00007ffc00000015 [ 41.276984] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 41.284241] R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000003 [ 41.292653] Kernel Offset: disabled [ 41.296275] Rebooting in 86400 seconds..