[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.2' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 41.865303] audit: type=1400 audit(1587282470.211:8): avc: denied { execmem } for pid=6437 comm="syz-executor559" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 executing program [ 41.929301] ================================================================== [ 41.938188] BUG: KASAN: null-ptr-deref in choke_reset+0x208/0x340 [ 41.944423] Write of size 8 at addr 0000000000000000 by task syz-executor559/6439 [ 41.952058] [ 41.953675] CPU: 0 PID: 6439 Comm: syz-executor559 Not tainted 4.19.116-syzkaller #0 [ 41.961926] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 41.971413] Call Trace: [ 41.974008] dump_stack+0x188/0x20d [ 41.978581] ? choke_reset+0x208/0x340 [ 41.982462] kasan_report.cold+0x194/0x2b9 [ 41.986683] memset+0x20/0x40 [ 41.989791] choke_reset+0x208/0x340 [ 41.993495] ? choke_destroy+0x40/0x40 [ 41.997380] qdisc_reset+0x6b/0x4c0 [ 42.000995] dev_deactivate_queue.constprop.0+0x138/0x220 [ 42.006523] dev_deactivate_many+0xe2/0xb30 [ 42.010852] dev_deactivate+0xfe/0x1d0 [ 42.014802] ? dev_deactivate_many+0xb30/0xb30 [ 42.019389] qdisc_graft+0xbf3/0xf90 [ 42.023151] ? qdisc_create+0x845/0x1170 [ 42.027231] ? tc_dump_tclass+0x480/0x480 [ 42.031375] ? nla_parse+0x1f3/0x2f0 [ 42.035080] tc_modify_qdisc+0xb9c/0x1929 [ 42.039265] ? qdisc_create+0x1170/0x1170 [ 42.043405] ? mutex_trylock+0x1a0/0x1a0 [ 42.047461] ? qdisc_create+0x1170/0x1170 [ 42.051772] rtnetlink_rcv_msg+0x453/0xaf0 [ 42.056027] ? rtnetlink_put_metrics+0x520/0x520 [ 42.060793] ? find_held_lock+0x2d/0x110 [ 42.065211] netlink_rcv_skb+0x160/0x410 [ 42.069799] ? rtnetlink_put_metrics+0x520/0x520 [ 42.074554] ? netlink_ack+0xa60/0xa60 [ 42.078436] netlink_unicast+0x4d7/0x6a0 [ 42.082496] ? netlink_attachskb+0x710/0x710 [ 42.087257] netlink_sendmsg+0x80b/0xcd0 [ 42.091333] ? netlink_unicast+0x6a0/0x6a0 [ 42.095556] ? move_addr_to_kernel.part.0+0x110/0x110 [ 42.100750] ? netlink_unicast+0x6a0/0x6a0 [ 42.105059] sock_sendmsg+0xcf/0x120 [ 42.108776] ___sys_sendmsg+0x803/0x920 [ 42.112747] ? copy_msghdr_from_user+0x410/0x410 [ 42.117512] ? rcu_read_lock_sched_held+0x10a/0x130 [ 42.122529] ? kmem_cache_alloc+0x31b/0x710 [ 42.126858] ? mark_held_locks+0xf0/0xf0 [ 42.130949] ? percpu_counter_add_batch+0x123/0x180 [ 42.135971] ? alloc_empty_file+0xd7/0x170 [ 42.140224] ? find_held_lock+0x2d/0x110 [ 42.144276] ? __fd_install+0x1b4/0x610 [ 42.148362] ? __fget_light+0x1a2/0x230 [ 42.152335] __sys_sendmsg+0xec/0x1b0 [ 42.157115] ? __ia32_sys_shutdown+0x70/0x70 [ 42.161544] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 42.166580] ? trace_hardirqs_off_caller+0x55/0x210 [ 42.172132] ? do_syscall_64+0x21/0x620 [ 42.176097] do_syscall_64+0xf9/0x620 [ 42.179907] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 42.185177] RIP: 0033:0x441409 [ 42.188355] Code: e8 fc ab 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 9b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 42.208045] RSP: 002b:00007ffe21ca4e78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 42.215865] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441409 [ 42.223560] RDX: 0000000000000000 RSI: 00000000200007c0 RDI: 0000000000000004 [ 42.230838] RBP: 000000000000a394 R08: 00000000004002c8 R09: 00000000004002c8 [ 42.238110] R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000402230 [ 42.245391] R13: 00000000004022c0 R14: 0000000000000000 R15: 0000000000000000 [ 42.253717] ================================================================== [ 42.261490] Disabling lock debugging due to kernel taint [ 42.266967] Kernel panic - not syncing: panic_on_warn set ... [ 42.266967] [ 42.274336] CPU: 0 PID: 6439 Comm: syz-executor559 Tainted: G B 4.19.116-syzkaller #0 [ 42.283608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 42.292956] Call Trace: [ 42.295544] dump_stack+0x188/0x20d [ 42.299159] panic+0x26a/0x50e [ 42.302333] ? __warn_printk+0xf3/0xf3 [ 42.306292] ? choke_reset+0x208/0x340 [ 42.310256] ? trace_hardirqs_on+0x55/0x210 [ 42.314649] ? choke_reset+0x208/0x340 [ 42.318529] kasan_end_report+0x43/0x49 [ 42.322497] kasan_report.cold+0xa4/0x2b9 [ 42.326811] memset+0x20/0x40 [ 42.329900] choke_reset+0x208/0x340 [ 42.333620] ? choke_destroy+0x40/0x40 [ 42.337499] qdisc_reset+0x6b/0x4c0 [ 42.341116] dev_deactivate_queue.constprop.0+0x138/0x220 [ 42.346643] dev_deactivate_many+0xe2/0xb30 [ 42.350952] dev_deactivate+0xfe/0x1d0 [ 42.354830] ? dev_deactivate_many+0xb30/0xb30 [ 42.359402] qdisc_graft+0xbf3/0xf90 [ 42.363157] ? qdisc_create+0x845/0x1170 [ 42.367250] ? tc_dump_tclass+0x480/0x480 [ 42.371893] ? nla_parse+0x1f3/0x2f0 [ 42.375610] tc_modify_qdisc+0xb9c/0x1929 [ 42.379748] ? qdisc_create+0x1170/0x1170 [ 42.383902] ? mutex_trylock+0x1a0/0x1a0 [ 42.387955] ? qdisc_create+0x1170/0x1170 [ 42.392103] rtnetlink_rcv_msg+0x453/0xaf0 [ 42.396327] ? rtnetlink_put_metrics+0x520/0x520 [ 42.401104] ? find_held_lock+0x2d/0x110 [ 42.405158] netlink_rcv_skb+0x160/0x410 [ 42.409200] ? rtnetlink_put_metrics+0x520/0x520 [ 42.414052] ? netlink_ack+0xa60/0xa60 [ 42.417944] netlink_unicast+0x4d7/0x6a0 [ 42.422002] ? netlink_attachskb+0x710/0x710 [ 42.426403] netlink_sendmsg+0x80b/0xcd0 [ 42.430469] ? netlink_unicast+0x6a0/0x6a0 [ 42.434689] ? move_addr_to_kernel.part.0+0x110/0x110 [ 42.439881] ? netlink_unicast+0x6a0/0x6a0 [ 42.444103] sock_sendmsg+0xcf/0x120 [ 42.447814] ___sys_sendmsg+0x803/0x920 [ 42.452293] ? copy_msghdr_from_user+0x410/0x410 [ 42.457030] ? rcu_read_lock_sched_held+0x10a/0x130 [ 42.462046] ? kmem_cache_alloc+0x31b/0x710 [ 42.466354] ? mark_held_locks+0xf0/0xf0 [ 42.470411] ? percpu_counter_add_batch+0x123/0x180 [ 42.475413] ? alloc_empty_file+0xd7/0x170 [ 42.479632] ? find_held_lock+0x2d/0x110 [ 42.483687] ? __fd_install+0x1b4/0x610 [ 42.487653] ? __fget_light+0x1a2/0x230 [ 42.491677] __sys_sendmsg+0xec/0x1b0 [ 42.495467] ? __ia32_sys_shutdown+0x70/0x70 [ 42.499929] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 42.504677] ? trace_hardirqs_off_caller+0x55/0x210 [ 42.509723] ? do_syscall_64+0x21/0x620 [ 42.513719] do_syscall_64+0xf9/0x620 [ 42.517509] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 42.522722] RIP: 0033:0x441409 [ 42.525899] Code: e8 fc ab 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 9b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 42.544796] RSP: 002b:00007ffe21ca4e78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 42.552489] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441409 [ 42.559747] RDX: 0000000000000000 RSI: 00000000200007c0 RDI: 0000000000000004 [ 42.567091] RBP: 000000000000a394 R08: 00000000004002c8 R09: 00000000004002c8 [ 42.574446] R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000402230 [ 42.581699] R13: 00000000004022c0 R14: 0000000000000000 R15: 0000000000000000 [ 42.590297] Kernel Offset: disabled [ 42.593925] Rebooting in 86400 seconds..