[ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Serial Getty on ttyS0. [ OK ] Started Getty on tty1. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.161' (ECDSA) to the list of known hosts. 2021/05/02 11:23:57 fuzzer started 2021/05/02 11:23:58 dialing manager at 10.128.0.169:44661 2021/05/02 11:23:58 syscalls: 3571 2021/05/02 11:23:58 code coverage: enabled 2021/05/02 11:23:58 comparison tracing: enabled 2021/05/02 11:23:58 extra coverage: enabled 2021/05/02 11:23:58 setuid sandbox: enabled 2021/05/02 11:23:58 namespace sandbox: enabled 2021/05/02 11:23:58 Android sandbox: /sys/fs/selinux/policy does not exist 2021/05/02 11:23:58 fault injection: enabled 2021/05/02 11:23:58 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2021/05/02 11:23:58 net packet injection: enabled 2021/05/02 11:23:58 net device setup: enabled 2021/05/02 11:23:58 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2021/05/02 11:23:58 devlink PCI setup: PCI device 0000:00:10.0 is not available 2021/05/02 11:23:58 USB emulation: enabled 2021/05/02 11:23:58 hci packet injection: enabled 2021/05/02 11:23:58 wifi device emulation: enabled 2021/05/02 11:23:58 802.15.4 emulation: enabled 2021/05/02 11:23:58 fetching corpus: 0, signal 0/2000 (executing program) 2021/05/02 11:23:58 fetching corpus: 50, signal 39482/43283 (executing program) 2021/05/02 11:23:58 fetching corpus: 100, signal 77023/82423 (executing program) 2021/05/02 11:23:58 fetching corpus: 150, signal 102571/109529 (executing program) 2021/05/02 11:23:59 fetching corpus: 200, signal 126213/134661 (executing program) 2021/05/02 11:23:59 fetching corpus: 250, signal 140296/150198 (executing program) syzkaller login: [ 70.890963][ T8440] ================================================================== [ 70.899219][ T8440] BUG: KASAN: use-after-free in __skb_datagram_iter+0x6b8/0x770 [ 70.906858][ T8440] Read of size 4 at addr ffff888032f90004 by task syz-fuzzer/8440 [ 70.914664][ T8440] [ 70.916976][ T8440] CPU: 0 PID: 8440 Comm: syz-fuzzer Not tainted 5.12.0-rc8-next-20210423-syzkaller #0 [ 70.926498][ T8440] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 70.936569][ T8440] Call Trace: [ 70.939834][ T8440] dump_stack+0x141/0x1d7 [ 70.944181][ T8440] ? __skb_datagram_iter+0x6b8/0x770 [ 70.949453][ T8440] print_address_description.constprop.0.cold+0x5b/0x2f8 [ 70.956465][ T8440] ? __skb_datagram_iter+0x6b8/0x770 [ 70.961748][ T8440] ? __skb_datagram_iter+0x6b8/0x770 [ 70.967016][ T8440] kasan_report.cold+0x7c/0xd8 [ 70.971772][ T8440] ? __skb_datagram_iter+0x6b8/0x770 [ 70.977044][ T8440] __skb_datagram_iter+0x6b8/0x770 [ 70.982158][ T8440] ? zerocopy_sg_from_iter+0x110/0x110 [ 70.987605][ T8440] skb_copy_datagram_iter+0x40/0x50 [ 70.992791][ T8440] tcp_recvmsg_locked+0x1048/0x22f0 [ 70.998000][ T8440] ? tcp_splice_read+0x8b0/0x8b0 [ 71.002940][ T8440] ? mark_held_locks+0x9f/0xe0 [ 71.007696][ T8440] ? __local_bh_enable_ip+0xa0/0x120 [ 71.012988][ T8440] tcp_recvmsg+0x134/0x550 [ 71.017414][ T8440] ? tcp_recvmsg_locked+0x22f0/0x22f0 [ 71.022791][ T8440] ? aa_sk_perm+0x311/0xab0 [ 71.027282][ T8440] inet_recvmsg+0x11b/0x5e0 [ 71.031786][ T8440] ? inet_sendpage+0x140/0x140 [ 71.036539][ T8440] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 71.042792][ T8440] ? security_socket_recvmsg+0x8f/0xc0 [ 71.048265][ T8440] sock_read_iter+0x33c/0x470 [ 71.052931][ T8440] ? ____sys_recvmsg+0x600/0x600 [ 71.057858][ T8440] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 71.064105][ T8440] ? fsnotify+0xa58/0x1060 [ 71.068508][ T8440] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 71.074752][ T8440] new_sync_read+0x5b7/0x6e0 [ 71.079329][ T8440] ? ksys_lseek+0x1b0/0x1b0 [ 71.083814][ T8440] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 71.089796][ T8440] vfs_read+0x35c/0x570 [ 71.094047][ T8440] ksys_read+0x1ee/0x250 [ 71.098274][ T8440] ? vfs_write+0xa40/0xa40 [ 71.102672][ T8440] ? syscall_enter_from_user_mode+0x27/0x70 [ 71.108616][ T8440] do_syscall_64+0x3a/0xb0 [ 71.118332][ T8440] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 71.124213][ T8440] RIP: 0033:0x4af19b [ 71.128190][ T8440] Code: fb ff eb bd e8 a6 b6 fb ff e9 61 ff ff ff cc e8 9b 82 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30 [ 71.147798][ T8440] RSP: 002b:000000c00064b828 EFLAGS: 00000212 ORIG_RAX: 0000000000000000 [ 71.156256][ T8440] RAX: ffffffffffffffda RBX: 000000c00001c000 RCX: 00000000004af19b [ 71.164227][ T8440] RDX: 0000000000001000 RSI: 000000c0004a5000 RDI: 0000000000000006 [ 71.172194][ T8440] RBP: 000000c00064b878 R08: 0000000000000001 R09: 0000000000000002 [ 71.180147][ T8440] R10: 000000000000001d R11: 0000000000000212 R12: 0000000000b97a20 [ 71.188101][ T8440] R13: ffffffffffffffff R14: 0000000000000020 R15: 0000000000000020 [ 71.196066][ T8440] [ 71.198371][ T8440] Allocated by task 0: [ 71.202414][ T8440] (stack is not available) [ 71.206803][ T8440] [ 71.209115][ T8440] Freed by task 8440: [ 71.213071][ T8440] kasan_save_stack+0x1b/0x40 [ 71.217752][ T8440] kasan_set_track+0x1c/0x30 [ 71.222332][ T8440] kasan_set_free_info+0x20/0x30 [ 71.227250][ T8440] __kasan_slab_free+0xfb/0x130 [ 71.232086][ T8440] slab_free_freelist_hook+0xdf/0x240 [ 71.237446][ T8440] kfree+0xe5/0x7f0 [ 71.241237][ T8440] skb_release_data+0x622/0x750 [ 71.246073][ T8440] consume_skb+0xc2/0x160 [ 71.250388][ T8440] __dev_kfree_skb_any+0x6b/0x80 [ 71.255307][ T8440] napi_consume_skb+0x27b/0x340 [ 71.260153][ T8440] free_old_xmit_skbs+0xe4/0x270 [ 71.265092][ T8440] start_xmit+0x144/0x16c0 [ 71.269492][ T8440] dev_hard_start_xmit+0x1eb/0x920 [ 71.274587][ T8440] sch_direct_xmit+0x2e1/0xbd0 [ 71.279338][ T8440] __qdisc_run+0x4ba/0x15f0 [ 71.283824][ T8440] __dev_queue_xmit+0x1390/0x2e50 [ 71.288833][ T8440] ip_finish_output2+0xef0/0x2220 [ 71.293846][ T8440] __ip_finish_output+0x396/0x640 [ 71.299155][ T8440] ip_finish_output+0x35/0x200 [ 71.303906][ T8440] ip_output+0x196/0x310 [ 71.308130][ T8440] __ip_queue_xmit+0x8d3/0x1a30 [ 71.312979][ T8440] __tcp_transmit_skb+0x1889/0x38f0 [ 71.318180][ T8440] __tcp_send_ack.part.0+0x3d6/0x7a0 [ 71.323449][ T8440] tcp_send_ack+0x7d/0xa0 [ 71.327761][ T8440] tcp_cleanup_rbuf+0x46c/0x5b0 [ 71.332608][ T8440] tcp_recvmsg_locked+0x7aa/0x22f0 [ 71.337703][ T8440] tcp_recvmsg+0x134/0x550 [ 71.342104][ T8440] inet_recvmsg+0x11b/0x5e0 [ 71.346593][ T8440] sock_read_iter+0x33c/0x470 [ 71.351260][ T8440] new_sync_read+0x5b7/0x6e0 [ 71.355849][ T8440] vfs_read+0x35c/0x570 [ 71.359987][ T8440] ksys_read+0x1ee/0x250 [ 71.364209][ T8440] do_syscall_64+0x3a/0xb0 [ 71.368612][ T8440] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 71.374488][ T8440] [ 71.376791][ T8440] The buggy address belongs to the object at ffff888032f90000 [ 71.376791][ T8440] which belongs to the cache kmalloc-1k of size 1024 [ 71.390822][ T8440] The buggy address is located 4 bytes inside of [ 71.390822][ T8440] 1024-byte region [ffff888032f90000, ffff888032f90400) [ 71.404030][ T8440] The buggy address belongs to the page: [ 71.409643][ T8440] page:ffffea0000cbe400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x32f90 [ 71.419773][ T8440] head:ffffea0000cbe400 order:3 compound_mapcount:0 compound_pincount:0 [ 71.428079][ T8440] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 71.436188][ T8440] raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888011041dc0 [ 71.444759][ T8440] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 71.453352][ T8440] page dumped because: kasan: bad access detected [ 71.459739][ T8440] [ 71.462041][ T8440] Memory state around the buggy address: [ 71.467755][ T8440] ffff888032f8ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 71.475798][ T8440] ffff888032f8ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 71.483889][ T8440] >ffff888032f90000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 71.491926][ T8440] ^ [ 71.496015][ T8440] ffff888032f90080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 71.504086][ T8440] ffff888032f90100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 71.512153][ T8440] ================================================================== [ 71.520192][ T8440] Disabling lock debugging due to kernel taint [ 71.527299][ T3259] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.533684][ T3259] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.533997][ T8440] Kernel panic - not syncing: panic_on_warn set ... [ 71.546523][ T8440] CPU: 0 PID: 8440 Comm: syz-fuzzer Tainted: G B 5.12.0-rc8-next-20210423-syzkaller #0 [ 71.557461][ T8440] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 71.567518][ T8440] Call Trace: [ 71.570800][ T8440] dump_stack+0x141/0x1d7 [ 71.575153][ T8440] panic+0x306/0x73d [ 71.579069][ T8440] ? __warn_printk+0xf3/0xf3 [ 71.583670][ T8440] ? preempt_schedule_common+0x59/0xc0 [ 71.589150][ T8440] ? __skb_datagram_iter+0x6b8/0x770 [ 71.594447][ T8440] ? preempt_schedule_thunk+0x16/0x18 [ 71.599805][ T8440] ? trace_hardirqs_on+0x38/0x1c0 [ 71.604811][ T8440] ? trace_hardirqs_on+0x51/0x1c0 [ 71.609828][ T8440] ? __skb_datagram_iter+0x6b8/0x770 [ 71.615093][ T8440] ? __skb_datagram_iter+0x6b8/0x770 [ 71.620372][ T8440] end_report.cold+0x5a/0x5a [ 71.624949][ T8440] kasan_report.cold+0x6a/0xd8 [ 71.629694][ T8440] ? __skb_datagram_iter+0x6b8/0x770 [ 71.634960][ T8440] __skb_datagram_iter+0x6b8/0x770 [ 71.640053][ T8440] ? zerocopy_sg_from_iter+0x110/0x110 [ 71.645523][ T8440] skb_copy_datagram_iter+0x40/0x50 [ 71.650712][ T8440] tcp_recvmsg_locked+0x1048/0x22f0 [ 71.655899][ T8440] ? tcp_splice_read+0x8b0/0x8b0 [ 71.660819][ T8440] ? mark_held_locks+0x9f/0xe0 [ 71.665569][ T8440] ? __local_bh_enable_ip+0xa0/0x120 [ 71.670879][ T8440] tcp_recvmsg+0x134/0x550 [ 71.675290][ T8440] ? tcp_recvmsg_locked+0x22f0/0x22f0 [ 71.680646][ T8440] ? aa_sk_perm+0x311/0xab0 [ 71.685174][ T8440] inet_recvmsg+0x11b/0x5e0 [ 71.689661][ T8440] ? inet_sendpage+0x140/0x140 [ 71.694407][ T8440] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 71.700634][ T8440] ? security_socket_recvmsg+0x8f/0xc0 [ 71.706105][ T8440] sock_read_iter+0x33c/0x470 [ 71.710776][ T8440] ? ____sys_recvmsg+0x600/0x600 [ 71.715717][ T8440] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 71.721953][ T8440] ? fsnotify+0xa58/0x1060 [ 71.726353][ T8440] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 71.732580][ T8440] new_sync_read+0x5b7/0x6e0 [ 71.737160][ T8440] ? ksys_lseek+0x1b0/0x1b0 [ 71.741644][ T8440] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 71.747612][ T8440] vfs_read+0x35c/0x570 [ 71.751749][ T8440] ksys_read+0x1ee/0x250 [ 71.755971][ T8440] ? vfs_write+0xa40/0xa40 [ 71.760370][ T8440] ? syscall_enter_from_user_mode+0x27/0x70 [ 71.766258][ T8440] do_syscall_64+0x3a/0xb0 [ 71.770662][ T8440] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 71.776548][ T8440] RIP: 0033:0x4af19b [ 71.780424][ T8440] Code: fb ff eb bd e8 a6 b6 fb ff e9 61 ff ff ff cc e8 9b 82 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30 [ 71.800012][ T8440] RSP: 002b:000000c00064b828 EFLAGS: 00000212 ORIG_RAX: 0000000000000000 [ 71.808422][ T8440] RAX: ffffffffffffffda RBX: 000000c00001c000 RCX: 00000000004af19b [ 71.816382][ T8440] RDX: 0000000000001000 RSI: 000000c0004a5000 RDI: 0000000000000006 [ 71.824345][ T8440] RBP: 000000c00064b878 R08: 0000000000000001 R09: 0000000000000002 [ 71.832295][ T8440] R10: 000000000000001d R11: 0000000000000212 R12: 0000000000b97a20 [ 71.840245][ T8440] R13: ffffffffffffffff R14: 0000000000000020 R15: 0000000000000020 [ 71.848601][ T8440] Kernel Offset: disabled [ 71.852917][ T8440] Rebooting in 86400 seconds..