Starting OpenBSD Secure Shell server... Starting System Logging Service... [ OK ] Started Daily apt download activities. [ OK ] Started Daily apt upgrade and clean activities. [ OK ] Reached target Timers. [ OK ] Started Permit User Sessions. [ OK ] Found device /dev/ttyS0. [ OK ] Started System Logging Service. [ OK ] Started OpenBSD Secure Shell server. [ OK ] Started getty on tty2-tty6 if dbus and logind are not available. [ OK ] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch. [ OK ] Started Getty on tty6. [ OK ] Started Getty on tty5. [ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Serial Getty on ttyS0. [ OK ] Started Getty on tty1. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.192' (ECDSA) to the list of known hosts. syzkaller login: [ 66.290633][ T27] audit: type=1400 audit(1593180867.665:8): avc: denied { execmem } for pid=6817 comm="syz-executor902" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 66.326007][ T6826] IPVS: ftp: loaded support on port[0] = 21 [ 66.326898][ T6824] IPVS: ftp: loaded support on port[0] = 21 [ 66.333603][ T6825] IPVS: ftp: loaded support on port[0] = 21 [ 66.348701][ T6827] IPVS: ftp: loaded support on port[0] = 21 [ 66.349591][ T6828] IPVS: ftp: loaded support on port[0] = 21 [ 66.360005][ T6829] IPVS: ftp: loaded support on port[0] = 21 executing program executing program executing program [ 66.525739][ T6922] netlink: 'syz-executor902': attribute type 3 has an invalid length. [ 66.543564][ T6923] netlink: 'syz-executor902': attribute type 3 has an invalid length. [ 66.549091][ T6924] netlink: 'syz-executor902': attribute type 3 has an invalid length. executing program executing program [ 66.571275][ T6922] netlink: 'syz-executor902': attribute type 8 has an invalid length. [ 66.571552][ T6923] netlink: 'syz-executor902': attribute type 8 has an invalid length. [ 66.586034][ T6924] netlink: 'syz-executor902': attribute type 8 has an invalid length. [ 66.594876][ T6949] netlink: 'syz-executor902': attribute type 3 has an invalid length. [ 66.600964][ T6922] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor902'. [ 66.605477][ T6952] netlink: 'syz-executor902': attribute type 3 has an invalid length. executing program executing program executing program [ 66.615935][ T6924] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor902'. [ 66.626165][ T6955] netlink: 'syz-executor902': attribute type 3 has an invalid length. [ 66.635943][ T6923] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor902'. [ 66.640934][ T6949] netlink: 'syz-executor902': attribute type 8 has an invalid length. [ 66.658618][ T6955] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor902'. executing program executing program executing program [ 66.661141][ T6952] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor902'. [ 66.675645][ T6956] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor902'. [ 66.679700][ T6949] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor902'. [ 66.691773][ T6958] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor902'. [ 66.699169][ T6957] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor902'. executing program executing program executing program executing program executing program executing program executing program executing program [ 66.719927][ T6959] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor902'. executing program executing program executing program executing program [ 66.749618][ T6959] ================================================================== [ 66.757882][ T6959] BUG: KASAN: vmalloc-out-of-bounds in nl802154_dump_wpan_phy+0x98e/0x9c0 [ 66.766384][ T6959] Read of size 4 at addr ffffc9000226b018 by task syz-executor902/6959 [ 66.774607][ T6959] [ 66.776924][ T6959] CPU: 0 PID: 6959 Comm: syz-executor902 Not tainted 5.8.0-rc2-syzkaller #0 [ 66.785563][ T6959] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 66.795590][ T6959] Call Trace: [ 66.798860][ T6959] dump_stack+0x18f/0x20d [ 66.803310][ T6959] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 66.808957][ T6959] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 66.814484][ T6959] print_address_description.constprop.0.cold+0x5/0x436 [ 66.821404][ T6959] ? check_preemption_disabled+0x38/0x220 [ 66.827122][ T6959] ? vprintk_func+0x97/0x1a6 [ 66.831702][ T6959] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 66.837234][ T6959] kasan_report.cold+0x1f/0x37 [ 66.841985][ T6959] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 66.847599][ T6959] nl802154_dump_wpan_phy+0x98e/0x9c0 [ 66.852967][ T6959] ? kmem_cache_alloc_node_trace+0x3b0/0x400 [ 66.858921][ T6959] ? __kmalloc_node_track_caller+0x38/0x60 [ 66.864704][ T6959] ? nl802154_send_wpan_phy.constprop.0+0x21d0/0x21d0 [ 66.871439][ T6959] ? __phys_addr+0x9a/0x110 [ 66.875921][ T6959] ? memset+0x20/0x40 [ 66.879890][ T6959] genl_lock_dumpit+0x7f/0xb0 [ 66.884545][ T6959] netlink_dump+0x4cd/0xf60 [ 66.889028][ T6959] ? netlink_insert+0x1670/0x1670 [ 66.894031][ T6959] ? __mutex_unlock_slowpath+0xe2/0x610 [ 66.899558][ T6959] ? genl_start+0x45a/0x6e0 [ 66.904043][ T6959] __netlink_dump_start+0x643/0x900 [ 66.909216][ T6959] ? genl_rcv_msg+0x9e0/0x9e0 [ 66.913873][ T6959] ? nl802154_send_wpan_phy.constprop.0+0x21d0/0x21d0 [ 66.920623][ T6959] genl_family_rcv_msg_dumpit+0x2ac/0x310 [ 66.926328][ T6959] ? genl_rcv+0x40/0x40 [ 66.930459][ T6959] ? mutex_lock_io_nested+0xf60/0xf60 [ 66.935809][ T6959] ? mark_lock+0xbc/0x1710 [ 66.940217][ T6959] ? genl_rcv_msg+0x9e0/0x9e0 [ 66.944870][ T6959] ? genl_unlock+0x20/0x20 [ 66.949275][ T6959] ? genl_parallel_done+0x170/0x170 [ 66.954451][ T6959] ? __radix_tree_lookup+0x1f3/0x290 [ 66.959765][ T6959] genl_rcv_msg+0x797/0x9e0 [ 66.964253][ T6959] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 66.971164][ T6959] ? lock_acquire+0x1f1/0xad0 [ 66.975819][ T6959] ? genl_rcv+0x15/0x40 [ 66.979956][ T6959] ? lock_release+0x8d0/0x8d0 [ 66.984614][ T6959] netlink_rcv_skb+0x15a/0x430 [ 66.989374][ T6959] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 66.996297][ T6959] ? netlink_ack+0xa10/0xa10 [ 67.000881][ T6959] genl_rcv+0x24/0x40 [ 67.004855][ T6959] netlink_unicast+0x533/0x7d0 [ 67.009619][ T6959] ? netlink_attachskb+0x810/0x810 [ 67.014716][ T6959] ? _copy_from_iter_full+0x247/0x890 [ 67.020070][ T6959] netlink_sendmsg+0x856/0xd90 [ 67.024820][ T6959] ? netlink_unicast+0x7d0/0x7d0 [ 67.029751][ T6959] ? netlink_unicast+0x7d0/0x7d0 [ 67.034681][ T6959] sock_sendmsg+0xcf/0x120 [ 67.039074][ T6959] ____sys_sendmsg+0x6e8/0x810 [ 67.043817][ T6959] ? kernel_sendmsg+0x50/0x50 [ 67.048468][ T6959] ? do_recvmmsg+0x6d0/0x6d0 [ 67.053032][ T6959] ? release_pages+0x641/0x17a0 [ 67.057903][ T6959] ___sys_sendmsg+0xf3/0x170 [ 67.062483][ T6959] ? sendmsg_copy_msghdr+0x160/0x160 [ 67.067765][ T6959] ? do_huge_pmd_anonymous_page+0x1b94/0x2230 [ 67.073810][ T6959] ? check_preemption_disabled+0x38/0x220 [ 67.079508][ T6959] ? do_huge_pmd_anonymous_page+0x8ef/0x2230 [ 67.085470][ T6959] ? handle_mm_fault+0xad9/0x4420 [ 67.090475][ T6959] ? __fget_light+0x215/0x280 [ 67.095135][ T6959] __sys_sendmsg+0xe5/0x1b0 [ 67.099631][ T6959] ? __sys_sendmsg_sock+0xb0/0xb0 [ 67.104634][ T6959] ? check_preemption_disabled+0x38/0x220 [ 67.110368][ T6959] ? do_syscall_64+0x1c/0xe0 [ 67.114943][ T6959] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 67.120905][ T6959] do_syscall_64+0x60/0xe0 [ 67.125301][ T6959] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 67.131168][ T6959] RIP: 0033:0x441409 [ 67.135042][ T6959] Code: Bad RIP value. [ 67.139093][ T6959] RSP: 002b:00007ffe8093f958 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 67.147485][ T6959] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441409 [ 67.155438][ T6959] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003 [ 67.163390][ T6959] RBP: 0000000000010471 R08: 0000000100000000 R09: 0000000100000000 [ 67.171350][ T6959] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000402220 [ 67.179312][ T6959] R13: 00000000004022b0 R14: 0000000000000000 R15: 0000000000000000 [ 67.187286][ T6959] [ 67.189597][ T6959] [ 67.191900][ T6959] Memory state around the buggy address: [ 67.197507][ T6959] ffffc9000226af00: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 67.205566][ T6959] ffffc9000226af80: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 67.213618][ T6959] >ffffc9000226b000: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 67.221658][ T6959] ^ [ 67.226494][ T6959] ffffc9000226b080: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 67.234540][ T6959] ffffc9000226b100: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 67.242573][ T6959] ================================================================== [ 67.250608][ T6959] Disabling lock debugging due to kernel taint [ 67.281670][ T6959] Kernel panic - not syncing: panic_on_warn set ... [ 67.288275][ T6959] CPU: 0 PID: 6959 Comm: syz-executor902 Tainted: G B 5.8.0-rc2-syzkaller #0 [ 67.298393][ T6959] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 67.308419][ T6959] Call Trace: [ 67.311684][ T6959] dump_stack+0x18f/0x20d [ 67.315989][ T6959] ? nl802154_dump_wpan_phy+0x910/0x9c0 [ 67.321507][ T6959] panic+0x2e3/0x75c [ 67.325374][ T6959] ? __warn_printk+0xf3/0xf3 [ 67.329936][ T6959] ? preempt_schedule_common+0x59/0xc0 [ 67.335368][ T6959] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 67.340887][ T6959] ? preempt_schedule_thunk+0x16/0x18 [ 67.346253][ T6959] ? trace_hardirqs_on+0x55/0x220 [ 67.351250][ T6959] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 67.356769][ T6959] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 67.362288][ T6959] end_report+0x4d/0x53 [ 67.366416][ T6959] kasan_report.cold+0xd/0x37 [ 67.371066][ T6959] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 67.376584][ T6959] nl802154_dump_wpan_phy+0x98e/0x9c0 [ 67.381932][ T6959] ? kmem_cache_alloc_node_trace+0x3b0/0x400 [ 67.387885][ T6959] ? __kmalloc_node_track_caller+0x38/0x60 [ 67.393663][ T6959] ? nl802154_send_wpan_phy.constprop.0+0x21d0/0x21d0 [ 67.400396][ T6959] ? __phys_addr+0x9a/0x110 [ 67.404874][ T6959] ? memset+0x20/0x40 [ 67.408834][ T6959] genl_lock_dumpit+0x7f/0xb0 [ 67.413485][ T6959] netlink_dump+0x4cd/0xf60 [ 67.417961][ T6959] ? netlink_insert+0x1670/0x1670 [ 67.422956][ T6959] ? __mutex_unlock_slowpath+0xe2/0x610 [ 67.428474][ T6959] ? genl_start+0x45a/0x6e0 [ 67.432953][ T6959] __netlink_dump_start+0x643/0x900 [ 67.438137][ T6959] ? genl_rcv_msg+0x9e0/0x9e0 [ 67.442911][ T6959] ? nl802154_send_wpan_phy.constprop.0+0x21d0/0x21d0 [ 67.449663][ T6959] genl_family_rcv_msg_dumpit+0x2ac/0x310 [ 67.455357][ T6959] ? genl_rcv+0x40/0x40 [ 67.459497][ T6959] ? mutex_lock_io_nested+0xf60/0xf60 [ 67.464840][ T6959] ? mark_lock+0xbc/0x1710 [ 67.469239][ T6959] ? genl_rcv_msg+0x9e0/0x9e0 [ 67.473890][ T6959] ? genl_unlock+0x20/0x20 [ 67.478280][ T6959] ? genl_parallel_done+0x170/0x170 [ 67.483451][ T6959] ? __radix_tree_lookup+0x1f3/0x290 [ 67.488708][ T6959] genl_rcv_msg+0x797/0x9e0 [ 67.493188][ T6959] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 67.500095][ T6959] ? lock_acquire+0x1f1/0xad0 [ 67.504743][ T6959] ? genl_rcv+0x15/0x40 [ 67.508878][ T6959] ? lock_release+0x8d0/0x8d0 [ 67.513529][ T6959] netlink_rcv_skb+0x15a/0x430 [ 67.518266][ T6959] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 67.525173][ T6959] ? netlink_ack+0xa10/0xa10 [ 67.529738][ T6959] genl_rcv+0x24/0x40 [ 67.533697][ T6959] netlink_unicast+0x533/0x7d0 [ 67.538434][ T6959] ? netlink_attachskb+0x810/0x810 [ 67.543522][ T6959] ? _copy_from_iter_full+0x247/0x890 [ 67.548870][ T6959] netlink_sendmsg+0x856/0xd90 [ 67.553610][ T6959] ? netlink_unicast+0x7d0/0x7d0 [ 67.558523][ T6959] ? netlink_unicast+0x7d0/0x7d0 [ 67.563432][ T6959] sock_sendmsg+0xcf/0x120 [ 67.567822][ T6959] ____sys_sendmsg+0x6e8/0x810 [ 67.572558][ T6959] ? kernel_sendmsg+0x50/0x50 [ 67.577312][ T6959] ? do_recvmmsg+0x6d0/0x6d0 [ 67.581873][ T6959] ? release_pages+0x641/0x17a0 [ 67.586698][ T6959] ___sys_sendmsg+0xf3/0x170 [ 67.591264][ T6959] ? sendmsg_copy_msghdr+0x160/0x160 [ 67.596542][ T6959] ? do_huge_pmd_anonymous_page+0x1b94/0x2230 [ 67.602582][ T6959] ? check_preemption_disabled+0x38/0x220 [ 67.608275][ T6959] ? do_huge_pmd_anonymous_page+0x8ef/0x2230 [ 67.614230][ T6959] ? handle_mm_fault+0xad9/0x4420 [ 67.619229][ T6959] ? __fget_light+0x215/0x280 [ 67.623879][ T6959] __sys_sendmsg+0xe5/0x1b0 [ 67.628355][ T6959] ? __sys_sendmsg_sock+0xb0/0xb0 [ 67.633351][ T6959] ? check_preemption_disabled+0x38/0x220 [ 67.639045][ T6959] ? do_syscall_64+0x1c/0xe0 [ 67.643608][ T6959] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 67.649558][ T6959] do_syscall_64+0x60/0xe0 [ 67.653976][ T6959] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 67.659844][ T6959] RIP: 0033:0x441409 [ 67.663707][ T6959] Code: Bad RIP value. [ 67.667744][ T6959] RSP: 002b:00007ffe8093f958 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 67.676124][ T6959] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441409 [ 67.684081][ T6959] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003 [ 67.692024][ T6959] RBP: 0000000000010471 R08: 0000000100000000 R09: 0000000100000000 [ 67.699967][ T6959] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000402220 [ 67.707908][ T6959] R13: 00000000004022b0 R14: 0000000000000000 R15: 0000000000000000 [ 67.717166][ T6959] Kernel Offset: disabled [ 67.721478][ T6959] Rebooting in 86400 seconds..