[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 55.299562][ T27] audit: type=1800 audit(1584466768.460:25): pid=8533 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 55.318899][ T27] audit: type=1800 audit(1584466768.470:26): pid=8533 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 55.362891][ T27] audit: type=1800 audit(1584466768.470:27): pid=8533 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.1.15' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program executing program executing program executing program syzkaller login: [ 77.001512][ T8694] ================================================================== [ 77.001559][ T8694] BUG: KASAN: use-after-free in con_shutdown+0x61/0x80 [ 77.001568][ T8694] Write of size 8 at addr ffff88809f11f108 by task syz-executor876/8694 [ 77.001571][ T8694] [ 77.001581][ T8694] CPU: 1 PID: 8694 Comm: syz-executor876 Not tainted 5.6.0-rc6-syzkaller #0 [ 77.001586][ T8694] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 77.001590][ T8694] Call Trace: [ 77.001606][ T8694] dump_stack+0x1e9/0x30e [ 77.001628][ T8694] print_address_description+0x74/0x5c0 [ 77.001645][ T8694] ? printk+0x62/0x83 [ 77.001656][ T8694] ? vprintk_emit+0x2e6/0x3b0 [ 77.001674][ T8694] __kasan_report+0x14b/0x1c0 [ 77.001684][ T8694] ? con_shutdown+0x61/0x80 [ 77.001699][ T8694] kasan_report+0x25/0x50 [ 77.001710][ T8694] con_shutdown+0x61/0x80 [ 77.001717][ T8694] ? con_close+0x10/0x10 [ 77.001728][ T8694] release_tty+0xb9/0x530 [ 77.001746][ T8694] tty_release_struct+0xb8/0xd0 [ 77.001760][ T8694] tty_release+0xe23/0x1100 [ 77.001790][ T8694] ? tty_release_struct+0xd0/0xd0 [ 77.001801][ T8694] __fput+0x2d8/0x730 [ 77.001827][ T8694] task_work_run+0x176/0x1b0 [ 77.001845][ T8694] do_exit+0x5ef/0x1f80 [ 77.001883][ T8694] ? __up_read+0x1f1/0x6e0 [ 77.001902][ T8694] do_group_exit+0x15e/0x2c0 [ 77.001912][ T8694] ? trace_irq_disable_rcuidle+0x1f/0x1d0 [ 77.001929][ T8694] __do_sys_exit_group+0x13/0x20 [ 77.001939][ T8694] __se_sys_exit_group+0x10/0x10 [ 77.001949][ T8694] __x64_sys_exit_group+0x37/0x40 [ 77.001962][ T8694] do_syscall_64+0xf3/0x1b0 [ 77.001979][ T8694] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 77.001988][ T8694] RIP: 0033:0x43ff38 [ 77.001997][ T8694] Code: 00 00 be 3c 00 00 00 eb 19 66 0f 1f 84 00 00 00 00 00 48 89 d7 89 f0 0f 05 48 3d 00 f0 ff ff 77 21 f4 48 89 d7 44 89 c0 0f 05 <48> 3d 00 f0 ff ff 76 e0 f7 d8 64 41 89 01 eb d8 0f 1f 84 00 00 00 [ 77.002002][ T8694] RSP: 002b:00007fff6cdd4e98 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 77.002012][ T8694] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043ff38 [ 77.002017][ T8694] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 77.002022][ T8694] RBP: 00000000004bf950 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 77.002028][ T8694] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 77.002033][ T8694] R13: 00000000006d2180 R14: 0000000000000000 R15: 0000000000000000 [ 77.002058][ T8694] [ 77.002078][ T8694] Allocated by task 8694: [ 77.002088][ T8694] __kasan_kmalloc+0x118/0x1c0 [ 77.002096][ T8694] kmem_cache_alloc_trace+0x234/0x300 [ 77.002103][ T8694] vc_allocate+0x148/0x5b0 [ 77.002110][ T8694] con_install+0x48/0x460 [ 77.002118][ T8694] tty_init_dev+0xc6/0x4c0 [ 77.002126][ T8694] tty_open+0x7cd/0xca0 [ 77.002133][ T8694] chrdev_open+0x498/0x580 [ 77.002141][ T8694] do_dentry_open+0x828/0x10a0 [ 77.002150][ T8694] path_openat+0x13b5/0x40d0 [ 77.002284][ T8694] do_filp_open+0x191/0x3a0 [ 77.002297][ T8694] do_sys_openat2+0x448/0x6c0 [ 77.002303][ T8694] __x64_sys_open+0x1af/0x1e0 [ 77.002311][ T8694] do_syscall_64+0xf3/0x1b0 [ 77.002319][ T8694] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 77.002322][ T8694] [ 77.002326][ T8694] Freed by task 8696: [ 77.002340][ T8694] __kasan_slab_free+0x12e/0x1e0 [ 77.002347][ T8694] kfree+0x10a/0x220 [ 77.002355][ T8694] vt_ioctl+0x229d/0x3a30 [ 77.002362][ T8694] tty_ioctl+0xee6/0x15c0 [ 77.002369][ T8694] __se_sys_ioctl+0xf9/0x160 [ 77.002376][ T8694] do_syscall_64+0xf3/0x1b0 [ 77.002384][ T8694] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 77.002386][ T8694] [ 77.002393][ T8694] The buggy address belongs to the object at ffff88809f11f000 [ 77.002393][ T8694] which belongs to the cache kmalloc-2k of size 2048 [ 77.002402][ T8694] The buggy address is located 264 bytes inside of [ 77.002402][ T8694] 2048-byte region [ffff88809f11f000, ffff88809f11f800) [ 77.002406][ T8694] The buggy address belongs to the page: [ 77.002415][ T8694] page:ffffea00027c47c0 refcount:1 mapcount:0 mapping:ffff8880aa400e00 index:0x0 [ 77.002422][ T8694] flags: 0xfffe0000000200(slab) [ 77.002433][ T8694] raw: 00fffe0000000200 ffffea00027c4748 ffffea00027c48c8 ffff8880aa400e00 [ 77.002442][ T8694] raw: 0000000000000000 ffff88809f11f000 0000000100000001 0000000000000000 [ 77.002446][ T8694] page dumped because: kasan: bad access detected [ 77.002449][ T8694] [ 77.002452][ T8694] Memory state around the buggy address: [ 77.002459][ T8694] ffff88809f11f000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 77.002465][ T8694] ffff88809f11f080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 77.002471][ T8694] >ffff88809f11f100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 77.002475][ T8694] ^ [ 77.002481][ T8694] ffff88809f11f180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 77.002488][ T8694] ffff88809f11f200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 77.002498][ T8694] ================================================================== [ 77.002501][ T8694] Disabling lock debugging due to kernel taint [ 77.002524][ T8694] Kernel panic - not syncing: panic_on_warn set ... [ 77.002533][ T8694] CPU: 1 PID: 8694 Comm: syz-executor876 Tainted: G B 5.6.0-rc6-syzkaller #0 [ 77.002537][ T8694] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 77.002539][ T8694] Call Trace: [ 77.002550][ T8694] dump_stack+0x1e9/0x30e [ 77.002562][ T8694] panic+0x264/0x7a0 [ 77.002573][ T8694] ? trace_hardirqs_on+0x30/0x70 [ 77.002583][ T8694] ? _raw_spin_unlock_irqrestore+0xa5/0xd0 [ 77.002593][ T8694] __kasan_report+0x1bc/0x1c0 [ 77.002609][ T8694] ? con_shutdown+0x61/0x80 [ 77.002619][ T8694] kasan_report+0x25/0x50 [ 77.002629][ T8694] con_shutdown+0x61/0x80 [ 77.002636][ T8694] ? con_close+0x10/0x10 [ 77.002644][ T8694] release_tty+0xb9/0x530 [ 77.002655][ T8694] tty_release_struct+0xb8/0xd0 [ 77.002665][ T8694] tty_release+0xe23/0x1100 [ 77.002683][ T8694] ? tty_release_struct+0xd0/0xd0 [ 77.002690][ T8694] __fput+0x2d8/0x730 [ 77.002706][ T8694] task_work_run+0x176/0x1b0 [ 77.002752][ T8694] do_exit+0x5ef/0x1f80 [ 77.002767][ T8694] ? __up_read+0x1f1/0x6e0 [ 77.002778][ T8694] do_group_exit+0x15e/0x2c0 [ 77.002786][ T8694] ? trace_irq_disable_rcuidle+0x1f/0x1d0 [ 77.002798][ T8694] __do_sys_exit_group+0x13/0x20 [ 77.002806][ T8694] __se_sys_exit_group+0x10/0x10 [ 77.002814][ T8694] __x64_sys_exit_group+0x37/0x40 [ 77.002823][ T8694] do_syscall_64+0xf3/0x1b0 [ 77.002834][ T8694] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 77.002842][ T8694] RIP: 0033:0x43ff38 [ 77.002850][ T8694] Code: 00 00 be 3c 00 00 00 eb 19 66 0f 1f 84 00 00 00 00 00 48 89 d7 89 f0 0f 05 48 3d 00 f0 ff ff 77 21 f4 48 89 d7 44 89 c0 0f 05 <48> 3d 00 f0 ff ff 76 e0 f7 d8 64 41 89 01 eb d8 0f 1f 84 00 00 00 [ 77.002856][ T8694] RSP: 002b:00007fff6cdd4e98 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 77.002864][ T8694] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043ff38 [ 77.002868][ T8694] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 77.002874][ T8694] RBP: 00000000004bf950 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 77.002878][ T8694] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 77.002883][ T8694] R13: 00000000006d2180 R14: 0000000000000000 R15: 0000000000000000 [ 77.004509][ T8694] Kernel Offset: disabled [ 77.717102][ T8694] Rebooting in 86400 seconds..