[[0;32m OK [0m] Started Getty on tty2. [[0;32m OK [0m] Started Getty on tty1. [[0;32m OK [0m] Started Serial Getty on ttyS0. [[0;32m OK [0m] Started getty on tty2-tty6 if dbus and logind are not available. [[0;32m OK [0m] Started OpenBSD Secure Shell server. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.227' (ECDSA) to the list of known hosts. syzkaller login: [ 58.544219][ T6865] IPVS: ftp: loaded support on port[0] = 21 executing program [ 59.721207][ T6865] ================================================================== [ 59.729465][ T6865] BUG: KASAN: use-after-free in hci_chan_del+0x14f/0x190 [ 59.736488][ T6865] Read of size 8 at addr ffff8880a1828718 by task syz-executor302/6865 [ 59.744716][ T6865] [ 59.747051][ T6865] CPU: 0 PID: 6865 Comm: syz-executor302 Not tainted 5.8.0-next-20200812-syzkaller #0 [ 59.756580][ T6865] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 59.766634][ T6865] Call Trace: [ 59.769948][ T6865] dump_stack+0x18f/0x20d [ 59.774282][ T6865] ? hci_chan_del+0x14f/0x190 [ 59.778963][ T6865] ? hci_chan_del+0x14f/0x190 [ 59.783646][ T6865] print_address_description.constprop.0.cold+0xae/0x497 [ 59.790672][ T6865] ? mutex_lock_io_nested+0xf60/0xf60 [ 59.796054][ T6865] ? vprintk_func+0x97/0x1a6 [ 59.800650][ T6865] ? hci_chan_del+0x14f/0x190 [ 59.805329][ T6865] ? hci_chan_del+0x14f/0x190 [ 59.810011][ T6865] kasan_report.cold+0x1f/0x37 [ 59.814792][ T6865] ? hci_chan_del+0x14f/0x190 [ 59.819477][ T6865] hci_chan_del+0x14f/0x190 [ 59.823977][ T6865] l2cap_conn_del+0x61b/0x9e0 [ 59.828632][ T6865] ? l2cap_conn_del+0x9e0/0x9e0 [ 59.833645][ T6865] l2cap_disconn_cfm+0x85/0xa0 [ 59.838396][ T6865] hci_conn_hash_flush+0x114/0x220 [ 59.843492][ T6865] hci_dev_do_close+0x5c6/0x1080 [ 59.848414][ T6865] ? hci_dev_open+0x350/0x350 [ 59.853072][ T6865] ? do_raw_read_unlock+0x70/0x70 [ 59.858071][ T6865] ? try_to_grab_pending.part.0+0x7d0/0x7d0 [ 59.863948][ T6865] hci_unregister_dev+0x1bd/0xe30 [ 59.868947][ T6865] ? fcntl_setlk+0xf60/0xf60 [ 59.873512][ T6865] ? lock_is_held_type+0xbb/0xf0 [ 59.878435][ T6865] vhci_release+0x70/0xe0 [ 59.882743][ T6865] __fput+0x285/0x920 [ 59.886710][ T6865] ? vhci_close_dev+0x50/0x50 [ 59.891397][ T6865] task_work_run+0xdd/0x190 [ 59.895881][ T6865] do_exit+0xb7d/0x29f0 [ 59.900016][ T6865] ? blkcg_maybe_throttle_current+0x617/0xf00 [ 59.906057][ T6865] ? mm_update_next_owner+0x7a0/0x7a0 [ 59.911402][ T6865] ? lock_is_held_type+0xbb/0xf0 [ 59.916314][ T6865] ? __blkcg_punt_bio_submit+0x1d0/0x1d0 [ 59.921920][ T6865] ? mem_cgroup_move_account+0xc80/0xc80 [ 59.927525][ T6865] ? lock_is_held_type+0xbb/0xf0 [ 59.932466][ T6865] do_group_exit+0x125/0x310 [ 59.937060][ T6865] __x64_sys_exit_group+0x3a/0x50 [ 59.942063][ T6865] do_syscall_64+0x2d/0x70 [ 59.946461][ T6865] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 59.952329][ T6865] RIP: 0033:0x4450b8 [ 59.956193][ T6865] Code: Bad RIP value. [ 59.960235][ T6865] RSP: 002b:00007fff9f5a2738 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 59.968710][ T6865] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00000000004450b8 [ 59.976658][ T6865] RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001 [ 59.984608][ T6865] RBP: 00000000004cce90 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 59.992572][ T6865] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 60.000521][ T6865] R13: 00000000006e0200 R14: 0000000000000000 R15: 0000000000000000 [ 60.008473][ T6865] [ 60.010775][ T6865] Allocated by task 1545: [ 60.015084][ T6865] kasan_save_stack+0x1b/0x40 [ 60.019732][ T6865] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 60.025336][ T6865] kmem_cache_alloc_trace+0x16e/0x2c0 [ 60.030684][ T6865] hci_chan_create+0x9b/0x330 [ 60.035335][ T6865] l2cap_conn_add.part.0+0x1e/0xe10 [ 60.040504][ T6865] l2cap_connect_cfm+0x23b/0x1090 [ 60.045502][ T6865] le_conn_complete_evt+0x1153/0x1740 [ 60.050849][ T6865] hci_le_meta_evt+0x745/0x3ff0 [ 60.055677][ T6865] hci_event_packet+0x2e25/0x87a8 [ 60.060675][ T6865] hci_rx_work+0x22e/0xb50 [ 60.065066][ T6865] process_one_work+0x94c/0x1670 [ 60.070103][ T6865] worker_thread+0x64c/0x1120 [ 60.074752][ T6865] kthread+0x3b5/0x4a0 [ 60.078795][ T6865] ret_from_fork+0x1f/0x30 [ 60.083179][ T6865] [ 60.085483][ T6865] Freed by task 6889: [ 60.089437][ T6865] kasan_save_stack+0x1b/0x40 [ 60.094099][ T6865] kasan_set_track+0x1c/0x30 [ 60.098666][ T6865] kasan_set_free_info+0x1b/0x30 [ 60.103578][ T6865] __kasan_slab_free+0xd8/0x120 [ 60.108402][ T6865] kfree+0x103/0x2c0 [ 60.112289][ T6865] hci_event_packet+0x3e33/0x87a8 [ 60.117304][ T6865] hci_rx_work+0x22e/0xb50 [ 60.121721][ T6865] process_one_work+0x94c/0x1670 [ 60.126642][ T6865] worker_thread+0x64c/0x1120 [ 60.131298][ T6865] kthread+0x3b5/0x4a0 [ 60.135391][ T6865] ret_from_fork+0x1f/0x30 [ 60.139790][ T6865] [ 60.142095][ T6865] The buggy address belongs to the object at ffff8880a1828700 [ 60.142095][ T6865] which belongs to the cache kmalloc-128 of size 128 [ 60.156124][ T6865] The buggy address is located 24 bytes inside of [ 60.156124][ T6865] 128-byte region [ffff8880a1828700, ffff8880a1828780) [ 60.169278][ T6865] The buggy address belongs to the page: [ 60.174896][ T6865] page:000000009f5817db refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880a1828900 pfn:0xa1828 [ 60.186348][ T6865] flags: 0xfffe0000000200(slab) [ 60.191174][ T6865] raw: 00fffe0000000200 ffffea000287f9c8 ffffea0002971c08 ffff8880aa040400 [ 60.199735][ T6865] raw: ffff8880a1828900 ffff8880a1828000 0000000100000007 0000000000000000 [ 60.208290][ T6865] page dumped because: kasan: bad access detected [ 60.214675][ T6865] [ 60.216977][ T6865] Memory state around the buggy address: [ 60.222584][ T6865] ffff8880a1828600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.230616][ T6865] ffff8880a1828680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 60.238684][ T6865] >ffff8880a1828700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.246714][ T6865] ^ [ 60.251622][ T6865] ffff8880a1828780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 60.259656][ T6865] ffff8880a1828800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.267932][ T6865] ================================================================== [ 60.275965][ T6865] Disabling lock debugging due to kernel taint [ 60.283388][ T208] tipc: TX() has been purged, node left! [ 60.289198][ T6865] Kernel panic - not syncing: panic_on_warn set ... [ 60.295784][ T6865] CPU: 0 PID: 6865 Comm: syz-executor302 Tainted: G B 5.8.0-next-20200812-syzkaller #0 [ 60.306694][ T6865] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 60.316832][ T6865] Call Trace: [ 60.320097][ T6865] dump_stack+0x18f/0x20d [ 60.324405][ T6865] ? hci_chan_del+0xa0/0x190 [ 60.328981][ T6865] panic+0x2e3/0x75c [ 60.332850][ T6865] ? __warn_printk+0xf3/0xf3 [ 60.337424][ T6865] ? preempt_schedule_common+0x59/0xc0 [ 60.342975][ T6865] ? hci_chan_del+0x14f/0x190 [ 60.347629][ T6865] ? preempt_schedule_thunk+0x16/0x18 [ 60.352977][ T6865] ? trace_hardirqs_on+0x55/0x220 [ 60.357972][ T6865] ? hci_chan_del+0x14f/0x190 [ 60.362635][ T6865] ? hci_chan_del+0x14f/0x190 [ 60.367376][ T6865] end_report+0x4d/0x53 [ 60.371515][ T6865] kasan_report.cold+0xd/0x37 [ 60.376167][ T6865] ? hci_chan_del+0x14f/0x190 [ 60.380813][ T6865] hci_chan_del+0x14f/0x190 [ 60.385289][ T6865] l2cap_conn_del+0x61b/0x9e0 [ 60.389936][ T6865] ? l2cap_conn_del+0x9e0/0x9e0 [ 60.394758][ T6865] l2cap_disconn_cfm+0x85/0xa0 [ 60.399491][ T6865] hci_conn_hash_flush+0x114/0x220 [ 60.404573][ T6865] hci_dev_do_close+0x5c6/0x1080 [ 60.409480][ T6865] ? hci_dev_open+0x350/0x350 [ 60.414127][ T6865] ? do_raw_read_unlock+0x70/0x70 [ 60.419122][ T6865] ? try_to_grab_pending.part.0+0x7d0/0x7d0 [ 60.424987][ T6865] hci_unregister_dev+0x1bd/0xe30 [ 60.429981][ T6865] ? fcntl_setlk+0xf60/0xf60 [ 60.434543][ T6865] ? lock_is_held_type+0xbb/0xf0 [ 60.439452][ T6865] vhci_release+0x70/0xe0 [ 60.443770][ T6865] __fput+0x285/0x920 [ 60.447720][ T6865] ? vhci_close_dev+0x50/0x50 [ 60.452376][ T6865] task_work_run+0xdd/0x190 [ 60.456866][ T6865] do_exit+0xb7d/0x29f0 [ 60.461008][ T6865] ? blkcg_maybe_throttle_current+0x617/0xf00 [ 60.467044][ T6865] ? mm_update_next_owner+0x7a0/0x7a0 [ 60.472388][ T6865] ? lock_is_held_type+0xbb/0xf0 [ 60.477311][ T6865] ? __blkcg_punt_bio_submit+0x1d0/0x1d0 [ 60.482928][ T6865] ? mem_cgroup_move_account+0xc80/0xc80 [ 60.488528][ T6865] ? lock_is_held_type+0xbb/0xf0 [ 60.493435][ T6865] do_group_exit+0x125/0x310 [ 60.497998][ T6865] __x64_sys_exit_group+0x3a/0x50 [ 60.502995][ T6865] do_syscall_64+0x2d/0x70 [ 60.507386][ T6865] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 60.513249][ T6865] RIP: 0033:0x4450b8 [ 60.517110][ T6865] Code: Bad RIP value. [ 60.521159][ T6865] RSP: 002b:00007fff9f5a2738 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 60.529549][ T6865] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00000000004450b8 [ 60.537494][ T6865] RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001 [ 60.545439][ T6865] RBP: 00000000004cce90 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 60.553384][ T6865] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 60.561325][ T6865] R13: 00000000006e0200 R14: 0000000000000000 R15: 0000000000000000 [ 60.570493][ T6865] Kernel Offset: disabled [ 60.574807][ T6865] Rebooting in 86400 seconds..