Warning: Permanently added '10.128.10.34' (ECDSA) to the list of known hosts. executing program [ 29.512860] ================================================================== [ 29.520271] BUG: KASAN: stack-out-of-bounds in iov_iter_advance+0x4b3/0x4f0 [ 29.527365] Read of size 8 at addr ffff8801c63a7d38 by task syz-executor828/3842 [ 29.534883] [ 29.536505] CPU: 1 PID: 3842 Comm: syz-executor828 Not tainted 4.4.138-g07c0138 #62 [ 29.544293] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.553634] 0000000000000000 3dbf2ccfac6754f7 ffff8801c63a79f0 ffffffff81e0ed0d [ 29.561658] ffffea000718e9c0 ffff8801c63a7d38 0000000000000000 ffff8801c63a7d38 [ 29.569727] ffff8801c63a7d30 ffff8801c63a7a28 ffffffff81515a16 ffff8801c63a7d38 [ 29.577750] Call Trace: [ 29.580328] [] dump_stack+0xc1/0x124 [ 29.585676] [] print_address_description+0x6c/0x216 [ 29.592332] [] kasan_report.cold.7+0x175/0x2f7 [ 29.598557] [] ? iov_iter_advance+0x4b3/0x4f0 [ 29.604692] [] __asan_report_load8_noabort+0x14/0x20 [ 29.611440] [] iov_iter_advance+0x4b3/0x4f0 [ 29.617397] [] tun_get_user+0x2cd/0x2410 [ 29.623168] [] ? debug_check_no_locks_freed+0x210/0x210 [ 29.630173] [] ? tun_net_xmit+0xe60/0xe60 [ 29.635965] [] ? rtnl_unlock+0xe/0x10 [ 29.641409] [] ? __tun_get+0x126/0x230 [ 29.646934] [] tun_chr_write_iter+0xd5/0x190 [ 29.652966] [] __vfs_write+0x30d/0x3f0 [ 29.658484] [] ? __vfs_read+0x3e0/0x3e0 [ 29.664081] [] ? avc_policy_seqno+0x9/0x20 [ 29.669940] [] ? selinux_file_permission+0x2f2/0x450 [ 29.676666] [] ? rw_verify_area+0x100/0x300 [ 29.682616] [] vfs_write+0x191/0x4e0 [ 29.687951] [] SyS_write+0xd9/0x1c0 [ 29.693197] [] ? SyS_read+0x1c0/0x1c0 [ 29.698625] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 29.705094] [] entry_SYSCALL_64_fastpath+0x22/0x9e [ 29.711651] [ 29.713249] The buggy address belongs to the page: [ 29.718157] page:ffffea000718e9c0 count:0 mapcount:0 mapping: (null) index:0x0 [ 29.726267] flags: 0x8000000000000000() [ 29.730334] page dumped because: kasan: bad access detected [ 29.736011] [ 29.737607] Memory state around the buggy address: [ 29.742516] ffff8801c63a7c00: f2 f2 f2 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 [ 29.749856] ffff8801c63a7c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 29.757275] >ffff8801c63a7d00: f1 f1 f1 f1 00 00 f2 f2 f2 f2 f2 f2 00 00 00 00 [ 29.764606] ^ [ 29.769853] ffff8801c63a7d80: 00 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 f2 f2 f2 [ 29.777184] ffff8801c63a7e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 29.784510] ================================================================== [ 29.791848] Disabling lock debugging due to kernel taint [ 29.797360] Kernel panic - not syncing: panic_on_warn set ... [ 29.797360] [ 29.804715] CPU: 1 PID: 3842 Comm: syz-executor828 Tainted: G B 4.4.138-g07c0138 #62 [ 29.813705] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.823037] 0000000000000000 3dbf2ccfac6754f7 ffff8801c63a7950 ffffffff81e0ed0d [ 29.831025] ffffffff841ed4ef 0000000000000008 0000000000000000 ffff8801c63a7d38 [ 29.839000] ffff8801c63a7d30 ffff8801c63a7a10 ffffffff8140a184 0000000041b58ab3 [ 29.846984] Call Trace: [ 29.849543] [] dump_stack+0xc1/0x124 [ 29.854877] [] panic+0x19e/0x38d [ 29.859871] [] ? add_taint.cold.4+0x16/0x16 [ 29.865834] [] ? preempt_schedule_common+0x22/0x60 [ 29.872389] [] ? preempt_schedule+0x25/0x30 [ 29.878343] [] ? ___preempt_schedule+0x12/0x14 [ 29.884553] [] kasan_end_report+0x47/0x4f [ 29.890329] [] kasan_report.cold.7+0x192/0x2f7 [ 29.896534] [] ? iov_iter_advance+0x4b3/0x4f0 [ 29.902654] [] __asan_report_load8_noabort+0x14/0x20 [ 29.909388] [] iov_iter_advance+0x4b3/0x4f0 [ 29.915339] [] tun_get_user+0x2cd/0x2410 [ 29.921023] [] ? debug_check_no_locks_freed+0x210/0x210 [ 29.928009] [] ? tun_net_xmit+0xe60/0xe60 [ 29.933781] [] ? rtnl_unlock+0xe/0x10 [ 29.939203] [] ? __tun_get+0x126/0x230 [ 29.944713] [] tun_chr_write_iter+0xd5/0x190 [ 29.950756] [] __vfs_write+0x30d/0x3f0 [ 29.956265] [] ? __vfs_read+0x3e0/0x3e0 [ 29.961864] [] ? avc_policy_seqno+0x9/0x20 [ 29.967722] [] ? selinux_file_permission+0x2f2/0x450 [ 29.974455] [] ? rw_verify_area+0x100/0x300 [ 29.980398] [] vfs_write+0x191/0x4e0 [ 29.985735] [] SyS_write+0xd9/0x1c0 [ 29.990992] [] ? SyS_read+0x1c0/0x1c0 [ 29.996414] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 30.002881] [] entry_SYSCALL_64_fastpath+0x22/0x9e [ 30.009988] Dumping ftrace buffer: [ 30.013510] (ftrace buffer empty) [ 30.017193] Kernel Offset: disabled [ 30.020791] Rebooting in 86400 seconds..