[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 43.118359] audit: type=1800 audit(1546854881.057:25): pid=7965 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 43.157167] audit: type=1800 audit(1546854881.067:26): pid=7965 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 43.205862] audit: type=1800 audit(1546854881.067:27): pid=7965 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.4' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 52.124920] ================================================================== [ 52.132399] BUG: KASAN: slab-out-of-bounds in bacpy+0x23/0x30 [ 52.138289] Read of size 6 at addr ffff88808dac697b by task kworker/u5:1/8117 [ 52.145548] [ 52.147164] CPU: 1 PID: 8117 Comm: kworker/u5:1 Not tainted 4.20.0+ #13 [ 52.153895] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 52.163257] Workqueue: hci0 hci_rx_work [ 52.167216] Call Trace: [ 52.169800] dump_stack+0x1db/0x2d0 [ 52.173417] ? dump_stack_print_info.cold+0x20/0x20 [ 52.178422] ? bacpy+0x23/0x30 [ 52.181606] print_address_description.cold+0x7c/0x20d [ 52.186890] ? bacpy+0x23/0x30 [ 52.190071] ? bacpy+0x23/0x30 [ 52.193273] kasan_report.cold+0x1b/0x40 [ 52.197358] ? bacpy+0x23/0x30 [ 52.200543] check_memory_region+0x123/0x190 [ 52.204938] memcpy+0x24/0x50 [ 52.208034] bacpy+0x23/0x30 [ 52.211060] hci_event_packet+0x3afc/0xc22e [ 52.215385] ? hci_cmd_complete_evt+0xbe60/0xbe60 [ 52.220219] ? up_write+0x1c0/0x230 [ 52.223868] ? unwind_next_frame+0x3b/0x50 [ 52.228096] ? graph_lock+0x280/0x280 [ 52.231905] ? save_stack_trace+0x1a/0x20 [ 52.236045] ? save_trace+0xe0/0x290 [ 52.239757] ? add_lock_to_list.isra.0+0x450/0x450 [ 52.244698] ? kasan_check_read+0x11/0x20 [ 52.248848] ? __lock_acquire+0x2514/0x4a30 [ 52.253157] ? lockdep_hardirqs_on+0x415/0x5d0 [ 52.257743] ? print_usage_bug+0xd0/0xd0 [ 52.261818] ? skb_dequeue+0x12e/0x180 [ 52.265697] ? mark_held_locks+0xb1/0x100 [ 52.269831] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 52.274963] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 52.280053] ? trace_hardirqs_on+0xbd/0x310 [ 52.284373] ? kasan_check_read+0x11/0x20 [ 52.288524] ? skb_dequeue+0x12e/0x180 [ 52.292413] ? trace_hardirqs_off_caller+0x300/0x300 [ 52.297504] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 52.303026] ? hci_send_to_monitor+0x306/0x470 [ 52.307595] ? hci_sock_release+0x3c0/0x3c0 [ 52.311919] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 52.317020] hci_rx_work+0x578/0xcd0 [ 52.320732] ? hci_rx_work+0x578/0xcd0 [ 52.324604] ? find_held_lock+0x35/0x120 [ 52.328652] ? add_lock_to_list.isra.0+0x450/0x450 [ 52.333573] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 52.339103] ? hci_alloc_dev+0x21a0/0x21a0 [ 52.343333] ? __lock_is_held+0xb6/0x140 [ 52.347388] process_one_work+0xd0c/0x1ce0 [ 52.351637] ? __wake_up_common_lock+0x1db/0x390 [ 52.356394] ? pwq_dec_nr_in_flight+0x4a0/0x4a0 [ 52.361072] ? trace_hardirqs_off+0xb8/0x310 [ 52.365477] ? kasan_check_read+0x11/0x20 [ 52.369617] ? do_raw_spin_unlock+0xa0/0x330 [ 52.374013] ? do_raw_spin_trylock+0x270/0x270 [ 52.378612] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 52.384140] ? get_work_pool_id+0x1a0/0x1a0 [ 52.388454] ? trace_hardirqs_on_caller+0x310/0x310 [ 52.393482] worker_thread+0x143/0x14a0 [ 52.397455] ? process_one_work+0x1ce0/0x1ce0 [ 52.401942] ? __kthread_parkme+0xc3/0x1b0 [ 52.406168] ? lock_acquire+0x1db/0x570 [ 52.410130] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 52.415223] ? lockdep_hardirqs_on+0x415/0x5d0 [ 52.419790] ? trace_hardirqs_on+0xbd/0x310 [ 52.424127] ? __kthread_parkme+0xc3/0x1b0 [ 52.428350] ? trace_hardirqs_off_caller+0x300/0x300 [ 52.433449] ? do_raw_spin_trylock+0x270/0x270 [ 52.438030] ? schedule+0x108/0x350 [ 52.441681] ? do_raw_spin_trylock+0x270/0x270 [ 52.446280] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 52.451377] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 52.456901] ? __kthread_parkme+0xfb/0x1b0 [ 52.461140] kthread+0x357/0x430 [ 52.464493] ? process_one_work+0x1ce0/0x1ce0 [ 52.468990] ? kthread_stop+0x920/0x920 [ 52.472952] ret_from_fork+0x3a/0x50 [ 52.476654] [ 52.478266] Allocated by task 8116: [ 52.481881] save_stack+0x45/0xd0 [ 52.485340] kasan_kmalloc+0xcf/0xe0 [ 52.489054] __kmalloc_node_track_caller+0x4e/0x70 [ 52.493972] __kmalloc_reserve.isra.0+0x40/0xe0 [ 52.498625] __alloc_skb+0x12d/0x730 [ 52.502352] vhci_write+0xc4/0x470 [ 52.505878] __vfs_write+0x764/0xb40 [ 52.509577] vfs_write+0x20c/0x580 [ 52.513102] ksys_write+0x105/0x260 [ 52.516716] __x64_sys_write+0x73/0xb0 [ 52.520594] do_syscall_64+0x1a3/0x800 [ 52.524483] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 52.529650] [ 52.531263] Freed by task 6116: [ 52.534546] save_stack+0x45/0xd0 [ 52.537986] __kasan_slab_free+0x102/0x150 [ 52.542206] kasan_slab_free+0xe/0x10 [ 52.546006] kfree+0xcf/0x230 [ 52.549098] load_elf_binary+0x25d1/0x5580 [ 52.553324] search_binary_handler+0x17f/0x570 [ 52.557901] __do_execve_file.isra.0+0x14f3/0x2700 [ 52.562830] __x64_sys_execve+0x8f/0xc0 [ 52.566788] do_syscall_64+0x1a3/0x800 [ 52.570667] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 52.575846] [ 52.577458] The buggy address belongs to the object at ffff88808dac6780 [ 52.577458] which belongs to the cache kmalloc-512 of size 512 [ 52.590104] The buggy address is located 507 bytes inside of [ 52.590104] 512-byte region [ffff88808dac6780, ffff88808dac6980) [ 52.601987] The buggy address belongs to the page: [ 52.606898] page:ffffea000236b180 count:1 mapcount:0 mapping:ffff88812c3f0940 index:0x0 [ 52.615019] flags: 0x1fffc0000000200(slab) [ 52.619253] raw: 01fffc0000000200 ffffea0002a4de48 ffffea0002a15848 ffff88812c3f0940 [ 52.627119] raw: 0000000000000000 ffff88808dac6000 0000000100000006 0000000000000000 [ 52.634979] page dumped because: kasan: bad access detected [ 52.640665] [ 52.642289] Memory state around the buggy address: [ 52.647211] ffff88808dac6880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 52.654552] ffff88808dac6900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 52.661911] >ffff88808dac6980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 52.669247] ^ [ 52.672610] ffff88808dac6a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 52.679960] ffff88808dac6a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 52.687299] ================================================================== [ 52.694646] Disabling lock debugging due to kernel taint [ 52.701199] Kernel panic - not syncing: panic_on_warn set ... [ 52.707100] CPU: 1 PID: 8117 Comm: kworker/u5:1 Tainted: G B 4.20.0+ #13 [ 52.715239] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 52.724584] Workqueue: hci0 hci_rx_work [ 52.728541] Call Trace: [ 52.731114] dump_stack+0x1db/0x2d0 [ 52.734743] ? dump_stack_print_info.cold+0x20/0x20 [ 52.739762] panic+0x2cb/0x65c [ 52.742955] ? add_taint.cold+0x16/0x16 [ 52.746924] ? bacpy+0x23/0x30 [ 52.750104] ? preempt_schedule+0x4b/0x60 [ 52.754241] ? ___preempt_schedule+0x16/0x18 [ 52.758650] ? trace_hardirqs_on+0xb4/0x310 [ 52.762974] ? bacpy+0x23/0x30 [ 52.766173] end_report+0x47/0x4f [ 52.769609] ? bacpy+0x23/0x30 [ 52.772816] kasan_report.cold+0xe/0x40 [ 52.776777] ? bacpy+0x23/0x30 [ 52.779957] check_memory_region+0x123/0x190 [ 52.784353] memcpy+0x24/0x50 [ 52.787467] bacpy+0x23/0x30 [ 52.790485] hci_event_packet+0x3afc/0xc22e [ 52.794814] ? hci_cmd_complete_evt+0xbe60/0xbe60 [ 52.799647] ? up_write+0x1c0/0x230 [ 52.803260] ? unwind_next_frame+0x3b/0x50 [ 52.807481] ? graph_lock+0x280/0x280 [ 52.811265] ? save_stack_trace+0x1a/0x20 [ 52.815392] ? save_trace+0xe0/0x290 [ 52.819094] ? add_lock_to_list.isra.0+0x450/0x450 [ 52.824002] ? kasan_check_read+0x11/0x20 [ 52.828131] ? __lock_acquire+0x2514/0x4a30 [ 52.832450] ? lockdep_hardirqs_on+0x415/0x5d0 [ 52.837014] ? print_usage_bug+0xd0/0xd0 [ 52.841101] ? skb_dequeue+0x12e/0x180 [ 52.844973] ? mark_held_locks+0xb1/0x100 [ 52.849105] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 52.854191] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 52.859282] ? trace_hardirqs_on+0xbd/0x310 [ 52.863587] ? kasan_check_read+0x11/0x20 [ 52.867720] ? skb_dequeue+0x12e/0x180 [ 52.871608] ? trace_hardirqs_off_caller+0x300/0x300 [ 52.876705] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 52.882227] ? hci_send_to_monitor+0x306/0x470 [ 52.886796] ? hci_sock_release+0x3c0/0x3c0 [ 52.891106] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 52.896197] hci_rx_work+0x578/0xcd0 [ 52.899895] ? hci_rx_work+0x578/0xcd0 [ 52.903819] ? find_held_lock+0x35/0x120 [ 52.907869] ? add_lock_to_list.isra.0+0x450/0x450 [ 52.912786] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 52.918308] ? hci_alloc_dev+0x21a0/0x21a0 [ 52.922543] ? __lock_is_held+0xb6/0x140 [ 52.926613] process_one_work+0xd0c/0x1ce0 [ 52.930834] ? __wake_up_common_lock+0x1db/0x390 [ 52.935588] ? pwq_dec_nr_in_flight+0x4a0/0x4a0 [ 52.940245] ? trace_hardirqs_off+0xb8/0x310 [ 52.944637] ? kasan_check_read+0x11/0x20 [ 52.948787] ? do_raw_spin_unlock+0xa0/0x330 [ 52.953181] ? do_raw_spin_trylock+0x270/0x270 [ 52.957754] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 52.963275] ? get_work_pool_id+0x1a0/0x1a0 [ 52.967587] ? trace_hardirqs_on_caller+0x310/0x310 [ 52.972618] worker_thread+0x143/0x14a0 [ 52.976579] ? process_one_work+0x1ce0/0x1ce0 [ 52.981071] ? __kthread_parkme+0xc3/0x1b0 [ 52.985297] ? lock_acquire+0x1db/0x570 [ 52.989260] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 52.994343] ? lockdep_hardirqs_on+0x415/0x5d0 [ 52.998908] ? trace_hardirqs_on+0xbd/0x310 [ 53.003212] ? __kthread_parkme+0xc3/0x1b0 [ 53.007432] ? trace_hardirqs_off_caller+0x300/0x300 [ 53.012521] ? do_raw_spin_trylock+0x270/0x270 [ 53.017090] ? schedule+0x108/0x350 [ 53.020723] ? do_raw_spin_trylock+0x270/0x270 [ 53.025309] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 53.030407] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 53.035925] ? __kthread_parkme+0xfb/0x1b0 [ 53.040143] kthread+0x357/0x430 [ 53.043492] ? process_one_work+0x1ce0/0x1ce0 [ 53.047988] ? kthread_stop+0x920/0x920 [ 53.051989] ret_from_fork+0x3a/0x50 [ 53.056693] Kernel Offset: disabled [ 53.060323] Rebooting in 86400 seconds..