[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.116' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 39.905147] audit: type=1400 audit(1591600222.446:8): avc: denied { execmem } for pid=6445 comm="syz-executor477" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 39.920089] MINIX-fs: mounting unchecked file system, running fsck is recommended [ 39.933077] audit: type=1800 audit(1591600222.446:9): pid=6445 uid=0 auid=0 ses=5 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor477" name="file0" dev="sda1" ino=15703 res=0 [ 39.942652] ================================================================== [ 39.960824] BUG: KASAN: null-ptr-deref in drm_dp_aux_dev_get_by_minor+0x92/0x1f0 [ 39.968357] Read of size 4 at addr 0000000000000018 by task syz-executor477/6445 [ 39.976024] [ 39.977681] CPU: 0 PID: 6445 Comm: syz-executor477 Not tainted 4.19.127-syzkaller #0 [ 39.985557] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 39.994912] Call Trace: [ 39.997489] dump_stack+0x1fc/0x2fe [ 40.001113] ? drm_dp_aux_dev_get_by_minor+0x92/0x1f0 [ 40.006286] kasan_report.cold+0x194/0x2b9 [ 40.010507] drm_dp_aux_dev_get_by_minor+0x92/0x1f0 [ 40.015508] ? auxdev_release+0x70/0x70 [ 40.019551] ? lock_downgrade+0x740/0x740 [ 40.023703] ? lock_acquire+0x170/0x3c0 [ 40.027678] ? chrdev_open+0x308/0x5c0 [ 40.031658] ? drm_dp_aux_dev_get_by_minor+0x1f0/0x1f0 [ 40.037010] auxdev_open+0x47/0xa0 [ 40.040820] chrdev_open+0x219/0x5c0 [ 40.045574] ? cdev_put.part.0+0x50/0x50 [ 40.049622] do_dentry_open+0x4a8/0x1160 [ 40.053674] ? cdev_put.part.0+0x50/0x50 [ 40.057718] ? security_inode_permission+0xc4/0xf0 [ 40.062634] ? chown_common+0x550/0x550 [ 40.066598] ? inode_permission+0x10c/0x540 [ 40.071182] path_openat+0xe06/0x2eb0 [ 40.074987] ? path_mountpoint+0xa90/0xa90 [ 40.079321] ? mark_held_locks+0xa6/0xf0 [ 40.083473] ? _raw_spin_unlock_irqrestore+0x66/0xe0 [ 40.088775] do_filp_open+0x1a1/0x280 [ 40.092590] ? kasan_kmalloc.part.0+0xa6/0xd0 [ 40.097086] ? may_open_dev+0xf0/0xf0 [ 40.100878] ? __se_sys_acct+0xd2/0x930 [ 40.104861] ? mark_held_locks+0xf0/0xf0 [ 40.108993] ? __se_sys_acct+0x8c/0x930 [ 40.113224] ? lock_downgrade+0x740/0x740 [ 40.117381] ? fs_reclaim_release+0xa/0x30 [ 40.121617] file_open_name+0x291/0x370 [ 40.125585] ? vfs_open+0xd0/0xd0 [ 40.129023] ? rcu_read_lock_sched_held+0x10a/0x130 [ 40.134025] ? kmem_cache_alloc_trace+0x356/0x3a0 [ 40.138848] __se_sys_acct+0xf2/0x930 [ 40.142645] do_syscall_64+0xf9/0x620 [ 40.146448] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 40.151704] RIP: 0033:0x444ac9 [ 40.154875] Code: 0d d8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db d7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 40.174111] RSP: 002b:00007ffd7380f348 EFLAGS: 00000246 ORIG_RAX: 00000000000000a3 [ 40.181796] RAX: ffffffffffffffda RBX: 00007ffd7380f350 RCX: 0000000000444ac9 [ 40.189046] RDX: 0000000000401470 RSI: 44eadf382f7582d4 RDI: 0000000020000480 [ 40.196310] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000400eb0 [ 40.203651] R10: 00007ffd7380f220 R11: 0000000000000246 R12: 0000000000402730 [ 40.211000] R13: 00000000004027c0 R14: 0000000000000000 R15: 0000000000000000 [ 40.218272] ================================================================== [ 40.225631] Disabling lock debugging due to kernel taint [ 40.247626] Kernel panic - not syncing: panic_on_warn set ... [ 40.247626] [ 40.255135] CPU: 1 PID: 6445 Comm: syz-executor477 Tainted: G B 4.19.127-syzkaller #0 [ 40.264390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 40.273737] Call Trace: [ 40.276314] dump_stack+0x1fc/0x2fe [ 40.279924] panic+0x26a/0x50e [ 40.283183] ? __warn_printk+0xf3/0xf3 [ 40.287062] ? preempt_schedule_common+0x4a/0xc0 [ 40.291820] ? drm_dp_aux_dev_get_by_minor+0x92/0x1f0 [ 40.297282] ? ___preempt_schedule+0x16/0x18 [ 40.301673] ? trace_hardirqs_on+0x55/0x210 [ 40.306000] ? drm_dp_aux_dev_get_by_minor+0x92/0x1f0 [ 40.311189] kasan_end_report+0x43/0x49 [ 40.315150] kasan_report.cold+0xa4/0x2b9 [ 40.319403] drm_dp_aux_dev_get_by_minor+0x92/0x1f0 [ 40.324402] ? auxdev_release+0x70/0x70 [ 40.328371] ? lock_downgrade+0x740/0x740 [ 40.332750] ? lock_acquire+0x170/0x3c0 [ 40.336813] ? chrdev_open+0x308/0x5c0 [ 40.340707] ? drm_dp_aux_dev_get_by_minor+0x1f0/0x1f0 [ 40.345967] auxdev_open+0x47/0xa0 [ 40.349491] chrdev_open+0x219/0x5c0 [ 40.353187] ? cdev_put.part.0+0x50/0x50 [ 40.357233] do_dentry_open+0x4a8/0x1160 [ 40.361461] ? cdev_put.part.0+0x50/0x50 [ 40.365504] ? security_inode_permission+0xc4/0xf0 [ 40.370423] ? chown_common+0x550/0x550 [ 40.374377] ? inode_permission+0x10c/0x540 [ 40.378708] path_openat+0xe06/0x2eb0 [ 40.382498] ? path_mountpoint+0xa90/0xa90 [ 40.386728] ? mark_held_locks+0xa6/0xf0 [ 40.390832] ? _raw_spin_unlock_irqrestore+0x66/0xe0 [ 40.395922] do_filp_open+0x1a1/0x280 [ 40.399708] ? kasan_kmalloc.part.0+0xa6/0xd0 [ 40.404184] ? may_open_dev+0xf0/0xf0 [ 40.407979] ? __se_sys_acct+0xd2/0x930 [ 40.411936] ? mark_held_locks+0xf0/0xf0 [ 40.415976] ? __se_sys_acct+0x8c/0x930 [ 40.419947] ? lock_downgrade+0x740/0x740 [ 40.424079] ? fs_reclaim_release+0xa/0x30 [ 40.428296] file_open_name+0x291/0x370 [ 40.432252] ? vfs_open+0xd0/0xd0 [ 40.435690] ? rcu_read_lock_sched_held+0x10a/0x130 [ 40.440732] ? kmem_cache_alloc_trace+0x356/0x3a0 [ 40.445930] __se_sys_acct+0xf2/0x930 [ 40.449734] do_syscall_64+0xf9/0x620 [ 40.453519] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 40.458685] RIP: 0033:0x444ac9 [ 40.462051] Code: 0d d8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db d7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 40.480948] RSP: 002b:00007ffd7380f348 EFLAGS: 00000246 ORIG_RAX: 00000000000000a3 [ 40.488631] RAX: ffffffffffffffda RBX: 00007ffd7380f350 RCX: 0000000000444ac9 [ 40.496022] RDX: 0000000000401470 RSI: 44eadf382f7582d4 RDI: 0000000020000480 [ 40.503279] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000400eb0 [ 40.510641] R10: 00007ffd7380f220 R11: 0000000000000246 R12: 0000000000402730 [ 40.517898] R13: 00000000004027c0 R14: 0000000000000000 R15: 0000000000000000 [ 40.526624] Kernel Offset: disabled [ 40.530254] Rebooting in 86400 seconds..