[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 50.602621][ T27] audit: type=1800 audit(1584976814.419:25): pid=8476 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 50.622606][ T27] audit: type=1800 audit(1584976814.419:26): pid=8476 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 50.672582][ T27] audit: type=1800 audit(1584976814.419:27): pid=8476 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.15.196' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program executing program syzkaller login: [ 60.957718][ T8637] ================================================================== [ 60.957761][ T8637] BUG: KASAN: use-after-free in con_shutdown+0x61/0x80 [ 60.957769][ T8637] Write of size 8 at addr ffff8880a84c9108 by task syz-executor376/8637 [ 60.957772][ T8637] [ 60.957782][ T8637] CPU: 0 PID: 8637 Comm: syz-executor376 Not tainted 5.6.0-rc6-syzkaller #0 [ 60.957787][ T8637] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 60.957791][ T8637] Call Trace: [ 60.957804][ T8637] dump_stack+0x1e9/0x30e [ 60.957821][ T8637] print_address_description+0x74/0x5c0 [ 60.957837][ T8637] ? printk+0x62/0x83 [ 60.957848][ T8637] ? vprintk_emit+0x2e6/0x3b0 [ 60.957865][ T8637] __kasan_report+0x14b/0x1c0 [ 60.957877][ T8637] ? con_shutdown+0x61/0x80 [ 60.957893][ T8637] kasan_report+0x25/0x50 [ 60.957910][ T8637] con_shutdown+0x61/0x80 [ 60.957918][ T8637] ? con_close+0x10/0x10 [ 60.957928][ T8637] release_tty+0xb9/0x530 [ 60.957943][ T8637] tty_release_struct+0xb8/0xd0 [ 60.957957][ T8637] tty_release+0xe23/0x1100 [ 60.957993][ T8637] ? tty_release_struct+0xd0/0xd0 [ 60.958002][ T8637] __fput+0x2d8/0x730 [ 60.958027][ T8637] task_work_run+0x176/0x1b0 [ 60.958048][ T8637] do_exit+0x5ef/0x1f80 [ 60.958070][ T8637] ? __up_read+0x1f1/0x6e0 [ 60.958088][ T8637] do_group_exit+0x15e/0x2c0 [ 60.958097][ T8637] ? trace_irq_disable_rcuidle+0x1f/0x1d0 [ 60.958114][ T8637] __do_sys_exit_group+0x13/0x20 [ 60.958123][ T8637] __se_sys_exit_group+0x10/0x10 [ 60.958132][ T8637] __x64_sys_exit_group+0x37/0x40 [ 60.958160][ T8637] do_syscall_64+0xf3/0x1b0 [ 60.958177][ T8637] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 60.958185][ T8637] RIP: 0033:0x43ff38 [ 60.958195][ T8637] Code: Bad RIP value. [ 60.958201][ T8637] RSP: 002b:00007ffd27a372a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 60.958210][ T8637] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043ff38 [ 60.958216][ T8637] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 60.958222][ T8637] RBP: 00000000004bf950 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 60.958227][ T8637] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 60.958233][ T8637] R13: 00000000006d2180 R14: 0000000000000000 R15: 0000000000000000 [ 60.958258][ T8637] [ 60.958263][ T8637] Allocated by task 8637: [ 60.958273][ T8637] __kasan_kmalloc+0x118/0x1c0 [ 60.958281][ T8637] kmem_cache_alloc_trace+0x234/0x300 [ 60.958288][ T8637] vc_allocate+0x148/0x5b0 [ 60.958295][ T8637] con_install+0x48/0x460 [ 60.958303][ T8637] tty_init_dev+0xc6/0x4c0 [ 60.958311][ T8637] tty_open+0x7cd/0xca0 [ 60.958318][ T8637] chrdev_open+0x498/0x580 [ 60.958326][ T8637] do_dentry_open+0x828/0x10a0 [ 60.958334][ T8637] path_openat+0x13b5/0x40d0 [ 60.958342][ T8637] do_filp_open+0x191/0x3a0 [ 60.958348][ T8637] do_sys_openat2+0x448/0x6c0 [ 60.958354][ T8637] __x64_sys_open+0x1af/0x1e0 [ 60.958361][ T8637] do_syscall_64+0xf3/0x1b0 [ 60.958369][ T8637] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 60.958371][ T8637] [ 60.958376][ T8637] Freed by task 8635: [ 60.958383][ T8637] __kasan_slab_free+0x12e/0x1e0 [ 60.958390][ T8637] kfree+0x10a/0x220 [ 60.958398][ T8637] vt_ioctl+0x229d/0x3a30 [ 60.958405][ T8637] tty_ioctl+0xee6/0x15c0 [ 60.958412][ T8637] __se_sys_ioctl+0xf9/0x160 [ 60.958420][ T8637] do_syscall_64+0xf3/0x1b0 [ 60.958429][ T8637] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 60.958432][ T8637] [ 60.958439][ T8637] The buggy address belongs to the object at ffff8880a84c9000 [ 60.958439][ T8637] which belongs to the cache kmalloc-2k of size 2048 [ 60.958447][ T8637] The buggy address is located 264 bytes inside of [ 60.958447][ T8637] 2048-byte region [ffff8880a84c9000, ffff8880a84c9800) [ 60.958450][ T8637] The buggy address belongs to the page: [ 60.958460][ T8637] page:ffffea0002a13240 refcount:1 mapcount:0 mapping:ffff8880aa400e00 index:0x0 [ 60.958467][ T8637] flags: 0xfffe0000000200(slab) [ 60.958478][ T8637] raw: 00fffe0000000200 ffffea00029a6188 ffffea00029ee448 ffff8880aa400e00 [ 60.958487][ T8637] raw: 0000000000000000 ffff8880a84c9000 0000000100000001 0000000000000000 [ 60.958491][ T8637] page dumped because: kasan: bad access detected [ 60.958494][ T8637] [ 60.958497][ T8637] Memory state around the buggy address: [ 60.958504][ T8637] ffff8880a84c9000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.958510][ T8637] ffff8880a84c9080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.958516][ T8637] >ffff8880a84c9100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.958520][ T8637] ^ [ 60.958527][ T8637] ffff8880a84c9180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.958533][ T8637] ffff8880a84c9200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.958537][ T8637] ================================================================== [ 60.958541][ T8637] Disabling lock debugging due to kernel taint [ 60.958634][ T8637] Kernel panic - not syncing: panic_on_warn set ... [ 60.958643][ T8637] CPU: 0 PID: 8637 Comm: syz-executor376 Tainted: G B 5.6.0-rc6-syzkaller #0 [ 60.958647][ T8637] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 60.958650][ T8637] Call Trace: [ 60.958659][ T8637] dump_stack+0x1e9/0x30e [ 60.958670][ T8637] panic+0x264/0x7a0 [ 60.958680][ T8637] ? trace_hardirqs_on+0x30/0x70 [ 60.958694][ T8637] __kasan_report+0x1bc/0x1c0 [ 60.958703][ T8637] ? con_shutdown+0x61/0x80 [ 60.958714][ T8637] kasan_report+0x25/0x50 [ 60.958723][ T8637] con_shutdown+0x61/0x80 [ 60.958730][ T8637] ? con_close+0x10/0x10 [ 60.958739][ T8637] release_tty+0xb9/0x530 [ 60.958751][ T8637] tty_release_struct+0xb8/0xd0 [ 60.958760][ T8637] tty_release+0xe23/0x1100 [ 60.958777][ T8637] ? tty_release_struct+0xd0/0xd0 [ 60.958785][ T8637] __fput+0x2d8/0x730 [ 60.958801][ T8637] task_work_run+0x176/0x1b0 [ 60.958813][ T8637] do_exit+0x5ef/0x1f80 [ 60.958828][ T8637] ? __up_read+0x1f1/0x6e0 [ 60.958840][ T8637] do_group_exit+0x15e/0x2c0 [ 60.958848][ T8637] ? trace_irq_disable_rcuidle+0x1f/0x1d0 [ 60.958860][ T8637] __do_sys_exit_group+0x13/0x20 [ 60.958868][ T8637] __se_sys_exit_group+0x10/0x10 [ 60.958877][ T8637] __x64_sys_exit_group+0x37/0x40 [ 60.958886][ T8637] do_syscall_64+0xf3/0x1b0 [ 60.958897][ T8637] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 60.958910][ T8637] RIP: 0033:0x43ff38 [ 60.958918][ T8637] Code: 00 00 be 3c 00 00 00 eb 19 66 0f 1f 84 00 00 00 00 00 48 89 d7 89 f0 0f 05 48 3d 00 f0 ff ff 77 21 f4 48 89 d7 44 89 c0 0f 05 <48> 3d 00 f0 ff ff 76 e0 f7 d8 64 41 89 01 eb d8 0f 1f 84 00 00 00 [ 60.958922][ T8637] RSP: 002b:00007ffd27a372a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 60.958928][ T8637] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043ff38 [ 60.958933][ T8637] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 60.958938][ T8637] RBP: 00000000004bf950 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 60.958943][ T8637] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 60.958947][ T8637] R13: 00000000006d2180 R14: 0000000000000000 R15: 0000000000000000 [ 60.960158][ T8637] Kernel Offset: disabled