Warning: Permanently added '10.128.0.225' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 50.555701][ T3604] ================================================================== [ 50.563852][ T3604] BUG: KASAN: slab-out-of-bounds in decrypt_internal+0x1471/0x1d90 [ 50.571752][ T3604] Read of size 16 at addr ffff88801be2a360 by task syz-executor159/3604 [ 50.580058][ T3604] [ 50.582371][ T3604] CPU: 0 PID: 3604 Comm: syz-executor159 Not tainted 5.16.0-rc8-syzkaller #0 [ 50.591112][ T3604] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 50.601153][ T3604] Call Trace: [ 50.604416][ T3604] [ 50.607328][ T3604] dump_stack_lvl+0xcd/0x134 [ 50.611907][ T3604] print_address_description.constprop.0.cold+0x8d/0x320 [ 50.619351][ T3604] ? decrypt_internal+0x1471/0x1d90 [ 50.624538][ T3604] ? decrypt_internal+0x1471/0x1d90 [ 50.629718][ T3604] kasan_report.cold+0x83/0xdf [ 50.634471][ T3604] ? decrypt_internal+0x1471/0x1d90 [ 50.639654][ T3604] kasan_check_range+0x13d/0x180 [ 50.644585][ T3604] memcpy+0x20/0x60 [ 50.648477][ T3604] decrypt_internal+0x1471/0x1d90 [ 50.653513][ T3604] ? tls_get_rec+0x5a0/0x5a0 [ 50.658100][ T3604] ? padding_length.part.0+0x270/0x270 [ 50.663559][ T3604] decrypt_skb_update+0x141/0xbc0 [ 50.668584][ T3604] tls_sw_recvmsg+0x5f2/0x1570 [ 50.673358][ T3604] ? decrypt_skb+0xc0/0xc0 [ 50.677773][ T3604] ? aa_sk_perm+0x30f/0xaa0 [ 50.682280][ T3604] inet6_recvmsg+0x11b/0x5e0 [ 50.686867][ T3604] ? lock_downgrade+0x6e0/0x6e0 [ 50.691712][ T3604] ? inet6_sk_rebuild_header+0xcf0/0xcf0 [ 50.697432][ T3604] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 50.703672][ T3604] ? security_socket_recvmsg+0x8f/0xc0 [ 50.709126][ T3604] ? inet6_sk_rebuild_header+0xcf0/0xcf0 [ 50.714770][ T3604] ____sys_recvmsg+0x2c4/0x600 [ 50.719562][ T3604] ? kernel_recvmsg+0x160/0x160 [ 50.724426][ T3604] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 50.730677][ T3604] ? __import_iovec+0x293/0x590 [ 50.735543][ T3604] ? import_iovec+0x10c/0x150 [ 50.740397][ T3604] ___sys_recvmsg+0x127/0x200 [ 50.745075][ T3604] ? __copy_msghdr_from_user+0x4b0/0x4b0 [ 50.750707][ T3604] ? mark_lock+0xef/0x17b0 [ 50.755139][ T3604] ? slab_free_freelist_hook+0x8b/0x1c0 [ 50.760684][ T3604] ? lock_chain_count+0x20/0x20 [ 50.765538][ T3604] ? ___sys_sendmsg+0x105/0x170 [ 50.770515][ T3604] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 50.776765][ T3604] ? __fget_light+0x215/0x280 [ 50.781458][ T3604] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 50.787721][ T3604] do_recvmmsg+0x24d/0x6d0 [ 50.792143][ T3604] ? ___sys_recvmsg+0x200/0x200 [ 50.796987][ T3604] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 50.802972][ T3604] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 50.808962][ T3604] ? __context_tracking_exit+0xb8/0xe0 [ 50.814421][ T3604] ? lock_downgrade+0x6e0/0x6e0 [ 50.819268][ T3604] ? lock_downgrade+0x6e0/0x6e0 [ 50.824120][ T3604] __x64_sys_recvmmsg+0x20b/0x260 [ 50.829143][ T3604] ? __do_sys_socketcall+0x590/0x590 [ 50.834424][ T3604] ? syscall_enter_from_user_mode+0x21/0x70 [ 50.840318][ T3604] do_syscall_64+0x35/0xb0 [ 50.844835][ T3604] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 50.850738][ T3604] RIP: 0033:0x7fb06e8ab3f9 [ 50.855145][ T3604] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 50.874747][ T3604] RSP: 002b:00007ffe8af05658 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 50.883161][ T3604] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb06e8ab3f9 [ 50.891129][ T3604] RDX: 0000000000000001 RSI: 0000000020002900 RDI: 0000000000000003 [ 50.899092][ T3604] RBP: 00007fb06e86f3e0 R08: 0000000000000000 R09: 0000000000000000 [ 50.907052][ T3604] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb06e86f470 [ 50.915011][ T3604] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 50.922984][ T3604] [ 50.925991][ T3604] [ 50.928301][ T3604] Allocated by task 3604: [ 50.932625][ T3604] kasan_save_stack+0x1e/0x50 [ 50.937296][ T3604] __kasan_kmalloc+0xa9/0xd0 [ 50.941877][ T3604] tls_set_sw_offload+0x800/0x1430 [ 50.946982][ T3604] tls_setsockopt+0xb39/0xe70 [ 50.951651][ T3604] __sys_setsockopt+0x2db/0x610 [ 50.956493][ T3604] __x64_sys_setsockopt+0xba/0x150 [ 50.961593][ T3604] do_syscall_64+0x35/0xb0 [ 50.966000][ T3604] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 50.971886][ T3604] [ 50.974198][ T3604] The buggy address belongs to the object at ffff88801be2a360 [ 50.974198][ T3604] which belongs to the cache kmalloc-16 of size 16 [ 50.988239][ T3604] The buggy address is located 0 bytes inside of [ 50.988239][ T3604] 16-byte region [ffff88801be2a360, ffff88801be2a370) [ 51.001239][ T3604] The buggy address belongs to the page: [ 51.006850][ T3604] page:ffffea00006f8a80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1be2a [ 51.016988][ T3604] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 51.024529][ T3604] raw: 00fff00000000200 ffffea0000517380 dead000000000002 ffff888010c413c0 [ 51.033106][ T3604] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 51.041677][ T3604] page dumped because: kasan: bad access detected [ 51.048084][ T3604] page_owner tracks the page as allocated [ 51.053782][ T3604] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 8, ts 8089498734, free_ts 8088137532 [ 51.069395][ T3604] get_page_from_freelist+0xa72/0x2f50 [ 51.074846][ T3604] __alloc_pages+0x1b2/0x500 [ 51.079512][ T3604] alloc_pages+0x1a7/0x300 [ 51.083921][ T3604] new_slab+0x32d/0x4a0 [ 51.088082][ T3604] ___slab_alloc+0x918/0xfe0 [ 51.092660][ T3604] __slab_alloc.constprop.0+0x4d/0xa0 [ 51.098027][ T3604] __kmalloc_track_caller+0x2e7/0x320 [ 51.103394][ T3604] kvasprintf+0xb5/0x150 [ 51.107629][ T3604] kvasprintf_const+0x60/0x190 [ 51.112383][ T3604] kobject_set_name_vargs+0x56/0x150 [ 51.117664][ T3604] dev_set_name+0xbb/0xf0 [ 51.121984][ T3604] scsi_sysfs_device_initialize+0x398/0xa30 [ 51.127870][ T3604] scsi_alloc_sdev+0xa30/0xd60 [ 51.132624][ T3604] scsi_probe_and_add_lun+0x200b/0x3590 [ 51.138164][ T3604] __scsi_scan_target+0x21f/0xdb0 [ 51.143184][ T3604] scsi_scan_channel+0x148/0x1e0 [ 51.148123][ T3604] page last free stack trace: [ 51.152820][ T3604] free_pcp_prepare+0x374/0x870 [ 51.157661][ T3604] free_unref_page_list+0x1a9/0xfa0 [ 51.162852][ T3604] release_pages+0x3f4/0x1480 [ 51.167520][ T3604] tlb_finish_mmu+0x165/0x8c0 [ 51.172188][ T3604] exit_mmap+0x1ea/0x630 [ 51.176419][ T3604] __mmput+0x122/0x4b0 [ 51.180489][ T3604] mmput+0x56/0x60 [ 51.184203][ T3604] free_bprm+0x65/0x2e0 [ 51.188350][ T3604] kernel_execve+0x380/0x460 [ 51.193017][ T3604] call_usermodehelper_exec_async+0x2e3/0x580 [ 51.199077][ T3604] ret_from_fork+0x1f/0x30 [ 51.203488][ T3604] [ 51.205796][ T3604] Memory state around the buggy address: [ 51.211412][ T3604] ffff88801be2a200: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 51.219461][ T3604] ffff88801be2a280: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 51.227509][ T3604] >ffff88801be2a300: fb fb fc fc fb fb fc fc fa fb fc fc 00 04 fc fc [ 51.235550][ T3604] ^ [ 51.242990][ T3604] ffff88801be2a380: fa fb fc fc fa fb fc fc fb fb fc fc fa fb fc fc [ 51.251039][ T3604] ffff88801be2a400: 00 00 fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 51.259081][ T3604] ================================================================== [ 51.267122][ T3604] Disabling lock debugging due to kernel taint [ 51.273891][ T3604] Kernel panic - not syncing: panic_on_warn set ... [ 51.280570][ T3604] CPU: 0 PID: 3604 Comm: syz-executor159 Tainted: G B 5.16.0-rc8-syzkaller #0 [ 51.290722][ T3604] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 51.300753][ T3604] Call Trace: [ 51.304021][ T3604] [ 51.306943][ T3604] dump_stack_lvl+0xcd/0x134 [ 51.311522][ T3604] panic+0x2b0/0x6dd [ 51.315428][ T3604] ? __warn_printk+0xf3/0xf3 [ 51.320018][ T3604] ? preempt_schedule_common+0x59/0xc0 [ 51.325466][ T3604] ? decrypt_internal+0x1471/0x1d90 [ 51.330652][ T3604] ? preempt_schedule_thunk+0x16/0x18 [ 51.336016][ T3604] ? trace_hardirqs_on+0x38/0x1c0 [ 51.341031][ T3604] ? trace_hardirqs_on+0x51/0x1c0 [ 51.346045][ T3604] ? decrypt_internal+0x1471/0x1d90 [ 51.351278][ T3604] ? decrypt_internal+0x1471/0x1d90 [ 51.356463][ T3604] end_report.cold+0x63/0x6f [ 51.361047][ T3604] kasan_report.cold+0x71/0xdf [ 51.365805][ T3604] ? decrypt_internal+0x1471/0x1d90 [ 51.370989][ T3604] kasan_check_range+0x13d/0x180 [ 51.375912][ T3604] memcpy+0x20/0x60 [ 51.379704][ T3604] decrypt_internal+0x1471/0x1d90 [ 51.384729][ T3604] ? tls_get_rec+0x5a0/0x5a0 [ 51.389319][ T3604] ? padding_length.part.0+0x270/0x270 [ 51.394782][ T3604] decrypt_skb_update+0x141/0xbc0 [ 51.399801][ T3604] tls_sw_recvmsg+0x5f2/0x1570 [ 51.404565][ T3604] ? decrypt_skb+0xc0/0xc0 [ 51.409064][ T3604] ? aa_sk_perm+0x30f/0xaa0 [ 51.413560][ T3604] inet6_recvmsg+0x11b/0x5e0 [ 51.418140][ T3604] ? lock_downgrade+0x6e0/0x6e0 [ 51.422982][ T3604] ? inet6_sk_rebuild_header+0xcf0/0xcf0 [ 51.428605][ T3604] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 51.434839][ T3604] ? security_socket_recvmsg+0x8f/0xc0 [ 51.440286][ T3604] ? inet6_sk_rebuild_header+0xcf0/0xcf0 [ 51.445919][ T3604] ____sys_recvmsg+0x2c4/0x600 [ 51.450681][ T3604] ? kernel_recvmsg+0x160/0x160 [ 51.455524][ T3604] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 51.461763][ T3604] ? __import_iovec+0x293/0x590 [ 51.466609][ T3604] ? import_iovec+0x10c/0x150 [ 51.471369][ T3604] ___sys_recvmsg+0x127/0x200 [ 51.476221][ T3604] ? __copy_msghdr_from_user+0x4b0/0x4b0 [ 51.481844][ T3604] ? mark_lock+0xef/0x17b0 [ 51.486259][ T3604] ? slab_free_freelist_hook+0x8b/0x1c0 [ 51.491802][ T3604] ? lock_chain_count+0x20/0x20 [ 51.496644][ T3604] ? ___sys_sendmsg+0x105/0x170 [ 51.501482][ T3604] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 51.507803][ T3604] ? __fget_light+0x215/0x280 [ 51.512473][ T3604] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 51.518709][ T3604] do_recvmmsg+0x24d/0x6d0 [ 51.523118][ T3604] ? ___sys_recvmsg+0x200/0x200 [ 51.527960][ T3604] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 51.533929][ T3604] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 51.539908][ T3604] ? __context_tracking_exit+0xb8/0xe0 [ 51.545357][ T3604] ? lock_downgrade+0x6e0/0x6e0 [ 51.550209][ T3604] ? lock_downgrade+0x6e0/0x6e0 [ 51.555063][ T3604] __x64_sys_recvmmsg+0x20b/0x260 [ 51.560080][ T3604] ? __do_sys_socketcall+0x590/0x590 [ 51.565356][ T3604] ? syscall_enter_from_user_mode+0x21/0x70 [ 51.571245][ T3604] do_syscall_64+0x35/0xb0 [ 51.575651][ T3604] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 51.581731][ T3604] RIP: 0033:0x7fb06e8ab3f9 [ 51.586142][ T3604] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 51.605735][ T3604] RSP: 002b:00007ffe8af05658 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 51.614137][ T3604] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb06e8ab3f9 [ 51.622094][ T3604] RDX: 0000000000000001 RSI: 0000000020002900 RDI: 0000000000000003 [ 51.630049][ T3604] RBP: 00007fb06e86f3e0 R08: 0000000000000000 R09: 0000000000000000 [ 51.638005][ T3604] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb06e86f470 [ 51.645959][ T3604] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 51.654007][ T3604] [ 51.657246][ T3604] Kernel Offset: disabled [ 51.661555][ T3604] Rebooting in 86400 seconds..