[ OK ] Found device /dev/ttyS0. [ OK ] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch. [ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.1.80' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program executing program syzkaller login: [ 27.572223] ================================================================== [ 27.579897] BUG: KASAN: use-after-free in __vb2_perform_fileio+0xce9/0xda0 [ 27.586921] Read of size 4 at addr ffff8880b35a999c by task syz-executor719/7954 [ 27.594434] [ 27.596047] CPU: 1 PID: 7954 Comm: syz-executor719 Not tainted 4.14.249-syzkaller #0 [ 27.603902] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.613244] Call Trace: [ 27.615814] dump_stack+0x1b2/0x281 [ 27.619465] print_address_description.cold+0x54/0x1d3 [ 27.624731] kasan_report_error.cold+0x8a/0x191 [ 27.629379] ? __vb2_perform_fileio+0xce9/0xda0 [ 27.634026] __asan_report_load4_noabort+0x68/0x70 [ 27.638939] ? __vb2_perform_fileio+0xce9/0xda0 [ 27.643587] __vb2_perform_fileio+0xce9/0xda0 [ 27.648063] ? __vb2_init_fileio+0xa90/0xa90 [ 27.652461] ? common_file_perm+0x3ee/0x580 [ 27.656762] vb2_fop_read+0x1ef/0x3d0 [ 27.661150] ? vb2_fop_write+0x3d0/0x3d0 [ 27.665189] v4l2_read+0x19a/0x200 [ 27.668711] do_iter_read+0x3eb/0x5b0 [ 27.672494] ? finish_mkwrite_fault+0x5e0/0x5e0 [ 27.677316] vfs_readv+0xc8/0x120 [ 27.680750] ? compat_rw_copy_check_uvector+0x320/0x320 [ 27.686108] ? __do_page_fault+0x571/0xad0 [ 27.690331] ? lock_downgrade+0x740/0x740 [ 27.694480] SyS_preadv+0x15a/0x200 [ 27.698087] ? SyS_writev+0x30/0x30 [ 27.701712] ? __do_page_fault+0x159/0xad0 [ 27.705936] ? do_syscall_64+0x4c/0x640 [ 27.709912] ? SyS_writev+0x30/0x30 [ 27.713520] do_syscall_64+0x1d5/0x640 [ 27.717661] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 27.722915] RIP: 0033:0x7f3a91150469 [ 27.726605] RSP: 002b:00007fff3d807548 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 27.734287] RAX: ffffffffffffffda RBX: 00000000000f4240 RCX: 00007f3a91150469 [ 27.741537] RDX: 0000000000000003 RSI: 0000000020000100 RDI: 0000000000000003 [ 27.748784] RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000001 [ 27.756032] R10: 0000000000000008 R11: 0000000000000246 R12: 00007f3a9110f6d0 [ 27.763398] R13: 0000000000000000 R14: 00007fff3d807570 R15: 00007fff3d807560 [ 27.770651] [ 27.772257] Allocated by task 7954: [ 27.775864] kasan_kmalloc+0xeb/0x160 [ 27.779643] kmem_cache_alloc_trace+0x131/0x3d0 [ 27.784295] __vb2_init_fileio+0x17f/0xa90 [ 27.788514] __vb2_perform_fileio+0x993/0xda0 [ 27.792984] vb2_fop_read+0x1ef/0x3d0 [ 27.796759] v4l2_read+0x19a/0x200 [ 27.800276] do_iter_read+0x3eb/0x5b0 [ 27.804233] vfs_readv+0xc8/0x120 [ 27.807670] SyS_preadv+0x15a/0x200 [ 27.811273] do_syscall_64+0x1d5/0x640 [ 27.815135] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 27.820468] [ 27.822073] Freed by task 7959: [ 27.825333] kasan_slab_free+0xc3/0x1a0 [ 27.829288] kfree+0xc9/0x250 [ 27.832370] __vb2_cleanup_fileio+0xf5/0x150 [ 27.836754] vb2_core_queue_release+0x17/0x70 [ 27.841233] _vb2_fop_release+0x1c1/0x280 [ 27.845359] vivid_fop_release+0x17d/0x6c0 [ 27.849570] v4l2_release+0xf4/0x190 [ 27.853346] __fput+0x25f/0x7a0 [ 27.856600] task_work_run+0x11f/0x190 [ 27.860463] do_exit+0xa44/0x2850 [ 27.863903] do_group_exit+0x100/0x2e0 [ 27.867773] SyS_exit_group+0x19/0x20 [ 27.871576] do_syscall_64+0x1d5/0x640 [ 27.875450] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 27.880625] [ 27.882233] The buggy address belongs to the object at ffff8880b35a9680 [ 27.882233] which belongs to the cache kmalloc-1024 of size 1024 [ 27.895036] The buggy address is located 796 bytes inside of [ 27.895036] 1024-byte region [ffff8880b35a9680, ffff8880b35a9a80) [ 27.907603] The buggy address belongs to the page: [ 27.912527] page:ffffea0002cd6a00 count:1 mapcount:0 mapping:ffff8880b35a8000 index:0xffff8880b35a9200 compound_mapcount: 0 [ 27.923771] flags: 0xfff00000008100(slab|head) [ 27.928333] raw: 00fff00000008100 ffff8880b35a8000 ffff8880b35a9200 0000000100000002 [ 27.936191] raw: ffffea0002d84c20 ffffea000258f4a0 ffff88813fe80ac0 0000000000000000 [ 27.944059] page dumped because: kasan: bad access detected [ 27.949744] [ 27.951349] Memory state around the buggy address: [ 27.956253] ffff8880b35a9880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.963590] ffff8880b35a9900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.970940] >ffff8880b35a9980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.978299] ^ [ 27.982451] ffff8880b35a9a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.989790] ffff8880b35a9a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.997128] ================================================================== [ 28.004568] Disabling lock debugging due to kernel taint [ 28.010284] Kernel panic - not syncing: panic_on_warn set ... [ 28.010284] [ 28.017910] CPU: 1 PID: 7954 Comm: syz-executor719 Tainted: G B 4.14.249-syzkaller #0 [ 28.026994] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 28.036345] Call Trace: [ 28.038920] dump_stack+0x1b2/0x281 [ 28.042531] panic+0x1f9/0x42d [ 28.045705] ? add_taint.cold+0x16/0x16 [ 28.049662] ? ___preempt_schedule+0x16/0x18 [ 28.054046] kasan_end_report+0x43/0x49 [ 28.057997] kasan_report_error.cold+0xa7/0x191 [ 28.062641] ? __vb2_perform_fileio+0xce9/0xda0 [ 28.067299] __asan_report_load4_noabort+0x68/0x70 [ 28.072222] ? __vb2_perform_fileio+0xce9/0xda0 [ 28.076864] __vb2_perform_fileio+0xce9/0xda0 [ 28.081341] ? __vb2_init_fileio+0xa90/0xa90 [ 28.085724] ? common_file_perm+0x3ee/0x580 [ 28.090023] vb2_fop_read+0x1ef/0x3d0 [ 28.093887] ? vb2_fop_write+0x3d0/0x3d0 [ 28.097923] v4l2_read+0x19a/0x200 [ 28.101441] do_iter_read+0x3eb/0x5b0 [ 28.105234] ? finish_mkwrite_fault+0x5e0/0x5e0 [ 28.109878] vfs_readv+0xc8/0x120 [ 28.113316] ? compat_rw_copy_check_uvector+0x320/0x320 [ 28.118666] ? __do_page_fault+0x571/0xad0 [ 28.122891] ? lock_downgrade+0x740/0x740 [ 28.127014] SyS_preadv+0x15a/0x200 [ 28.130614] ? SyS_writev+0x30/0x30 [ 28.134216] ? __do_page_fault+0x159/0xad0 [ 28.138431] ? do_syscall_64+0x4c/0x640 [ 28.142385] ? SyS_writev+0x30/0x30 [ 28.145986] do_syscall_64+0x1d5/0x640 [ 28.149850] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 28.155015] RIP: 0033:0x7f3a91150469 [ 28.158717] RSP: 002b:00007fff3d807548 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 28.166398] RAX: ffffffffffffffda RBX: 00000000000f4240 RCX: 00007f3a91150469 [ 28.173819] RDX: 0000000000000003 RSI: 0000000020000100 RDI: 0000000000000003 [ 28.181082] RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000001 [ 28.188325] R10: 0000000000000008 R11: 0000000000000246 R12: 00007f3a9110f6d0 [ 28.195568] R13: 0000000000000000 R14: 00007fff3d807570 R15: 00007fff3d807560 [ 28.203106] Kernel Offset: disabled [ 28.206726] Rebooting in 86400 seconds..