[ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.85' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 38.542150] audit: type=1400 audit(1602424934.152:8): avc: denied { execmem } for pid=6370 comm="syz-executor321" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 38.576653] ================================================================== [ 38.584155] BUG: KASAN: slab-out-of-bounds in squashfs_export_iget+0x193/0x1b0 [ 38.591511] Read of size 8 at addr ffff888090e6b238 by task syz-executor321/6370 [ 38.599036] [ 38.600670] CPU: 1 PID: 6370 Comm: syz-executor321 Not tainted 4.14.198-syzkaller #0 [ 38.608540] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 38.617899] Call Trace: [ 38.620467] dump_stack+0x1b2/0x283 [ 38.624088] print_address_description.cold+0x54/0x1d3 [ 38.629344] kasan_report_error.cold+0x8a/0x194 [ 38.633988] ? squashfs_export_iget+0x193/0x1b0 [ 38.638655] __asan_report_load8_noabort+0x68/0x70 [ 38.643560] ? squashfs_export_iget+0x193/0x1b0 [ 38.648202] squashfs_export_iget+0x193/0x1b0 [ 38.652671] ? squashfs_readdir.cold+0x46/0x46 [ 38.657229] squashfs_fh_to_dentry+0x5f/0x90 [ 38.661614] exportfs_decode_fh+0x113/0x6bc [ 38.665909] ? squashfs_get_parent+0xa0/0xa0 [ 38.670293] ? drop_caches_sysctl_handler.cold+0x76/0x76 [ 38.675719] ? reconnect_path+0x730/0x730 [ 38.679843] ? trace_hardirqs_on+0x10/0x10 [ 38.684053] ? locks_remove_posix+0x242/0x4b0 [ 38.688525] ? cred_has_capability.isra.0+0xf5/0x1f0 [ 38.693601] ? check_nnp_nosuid.isra.0+0x270/0x270 [ 38.698505] ? __might_fault+0x104/0x1b0 [ 38.702542] ? lock_acquire+0x170/0x3f0 [ 38.706491] ? lock_downgrade+0x740/0x740 [ 38.710630] ? __might_fault+0x177/0x1b0 [ 38.714667] do_handle_open+0x248/0x570 [ 38.718617] ? fput+0xb/0x140 [ 38.721695] ? SyS_name_to_handle_at+0x3f0/0x3f0 [ 38.726427] ? __close_fd+0x159/0x230 [ 38.730202] ? do_syscall_64+0x4c/0x640 [ 38.734251] ? do_handle_open+0x570/0x570 [ 38.738387] do_syscall_64+0x1d5/0x640 [ 38.742265] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 38.747444] RIP: 0033:0x4443d9 [ 38.750609] RSP: 002b:00007ffcf4f70698 EFLAGS: 00000246 ORIG_RAX: 0000000000000130 [ 38.758308] RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 00000000004443d9 [ 38.765552] RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000005 [ 38.772821] RBP: 00000000006cf018 R08: 00007ffc00000015 R09: 00000000004002e0 [ 38.780080] R10: 00007ffcf4f70540 R11: 0000000000000246 R12: 0000000000401fc0 [ 38.787324] R13: 0000000000402050 R14: 0000000000000000 R15: 0000000000000000 [ 38.794575] [ 38.796177] Allocated by task 4757: [ 38.799799] kasan_kmalloc+0xeb/0x160 [ 38.803574] __kmalloc+0x15a/0x400 [ 38.807102] shmem_initxattrs+0x14d/0x220 [ 38.811225] security_inode_init_security+0x253/0x320 [ 38.816388] shmem_mknod+0xbf/0x1d0 [ 38.819996] lookup_open+0x77a/0x1750 [ 38.823783] path_openat+0xe08/0x2970 [ 38.827558] do_filp_open+0x179/0x3c0 [ 38.831417] do_sys_open+0x296/0x410 [ 38.835118] do_syscall_64+0x1d5/0x640 [ 38.838987] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 38.844146] [ 38.845762] Freed by task 3652: [ 38.849017] kasan_slab_free+0xc3/0x1a0 [ 38.852962] kfree+0xc9/0x250 [ 38.856050] security_context_to_sid_core+0x28a/0x3d0 [ 38.861230] selinux_inode_setsecurity+0x155/0x350 [ 38.866143] selinux_inode_notifysecctx+0x2b/0x50 [ 38.870959] security_inode_notifysecctx+0x76/0xb0 [ 38.875868] kernfs_refresh_inode+0x328/0x4a0 [ 38.880338] kernfs_iop_permission+0x59/0x90 [ 38.884721] __inode_permission+0x1f1/0x2f0 [ 38.889017] link_path_walk+0x86a/0x10a0 [ 38.893075] path_lookupat+0xcb/0x780 [ 38.896863] filename_lookup+0x18a/0x510 [ 38.900895] vfs_statx+0xd1/0x180 [ 38.904320] SyS_newlstat+0x83/0xe0 [ 38.907922] do_syscall_64+0x1d5/0x640 [ 38.911785] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 38.916960] [ 38.918571] The buggy address belongs to the object at ffff888090e6b200 [ 38.918571] which belongs to the cache kmalloc-32 of size 32 [ 38.931042] The buggy address is located 24 bytes to the right of [ 38.931042] 32-byte region [ffff888090e6b200, ffff888090e6b220) [ 38.943235] The buggy address belongs to the page: [ 38.948141] page:ffffea0002439ac0 count:1 mapcount:0 mapping:ffff888090e6b000 index:0xffff888090e6bfc1 [ 38.957558] flags: 0xfffe0000000100(slab) [ 38.961682] raw: 00fffe0000000100 ffff888090e6b000 ffff888090e6bfc1 000000010000002a [ 38.969534] raw: ffffea00027aff20 ffffea00027a42a0 ffff88812fe501c0 0000000000000000 [ 38.977495] page dumped because: kasan: bad access detected [ 38.983176] [ 38.984797] Memory state around the buggy address: [ 38.989700] ffff888090e6b100: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 38.997034] ffff888090e6b180: 00 00 01 fc fc fc fc fc 00 01 fc fc fc fc fc fc [ 39.004475] >ffff888090e6b200: 00 00 01 fc fc fc fc fc 00 fc fc fc fc fc fc fc [ 39.011805] ^ [ 39.016996] ffff888090e6b280: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 39.024328] ffff888090e6b300: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 39.031658] ================================================================== [ 39.039002] Disabling lock debugging due to kernel taint [ 39.045061] Kernel panic - not syncing: panic_on_warn set ... [ 39.045061] [ 39.052424] CPU: 1 PID: 6370 Comm: syz-executor321 Tainted: G B 4.14.198-syzkaller #0 [ 39.061507] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 39.070850] Call Trace: [ 39.073608] dump_stack+0x1b2/0x283 [ 39.077224] panic+0x1f9/0x42d [ 39.080394] ? add_taint.cold+0x16/0x16 [ 39.084362] ? ___preempt_schedule+0x16/0x18 [ 39.088750] kasan_end_report+0x43/0x49 [ 39.092699] kasan_report_error.cold+0xa7/0x194 [ 39.097346] ? squashfs_export_iget+0x193/0x1b0 [ 39.101998] __asan_report_load8_noabort+0x68/0x70 [ 39.106908] ? squashfs_export_iget+0x193/0x1b0 [ 39.111564] squashfs_export_iget+0x193/0x1b0 [ 39.116031] ? squashfs_readdir.cold+0x46/0x46 [ 39.120603] squashfs_fh_to_dentry+0x5f/0x90 [ 39.124986] exportfs_decode_fh+0x113/0x6bc [ 39.129298] ? squashfs_get_parent+0xa0/0xa0 [ 39.133695] ? drop_caches_sysctl_handler.cold+0x76/0x76 [ 39.139118] ? reconnect_path+0x730/0x730 [ 39.143255] ? trace_hardirqs_on+0x10/0x10 [ 39.147585] ? locks_remove_posix+0x242/0x4b0 [ 39.152071] ? cred_has_capability.isra.0+0xf5/0x1f0 [ 39.157146] ? check_nnp_nosuid.isra.0+0x270/0x270 [ 39.162051] ? __might_fault+0x104/0x1b0 [ 39.166104] ? lock_acquire+0x170/0x3f0 [ 39.170052] ? lock_downgrade+0x740/0x740 [ 39.174275] ? __might_fault+0x177/0x1b0 [ 39.178311] do_handle_open+0x248/0x570 [ 39.182256] ? fput+0xb/0x140 [ 39.185473] ? SyS_name_to_handle_at+0x3f0/0x3f0 [ 39.190203] ? __close_fd+0x159/0x230 [ 39.193979] ? do_syscall_64+0x4c/0x640 [ 39.197925] ? do_handle_open+0x570/0x570 [ 39.202048] do_syscall_64+0x1d5/0x640 [ 39.205910] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 39.211085] RIP: 0033:0x4443d9 [ 39.214248] RSP: 002b:00007ffcf4f70698 EFLAGS: 00000246 ORIG_RAX: 0000000000000130 [ 39.221928] RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 00000000004443d9 [ 39.229174] RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000005 [ 39.236421] RBP: 00000000006cf018 R08: 00007ffc00000015 R09: 00000000004002e0 [ 39.243664] R10: 00007ffcf4f70540 R11: 0000000000000246 R12: 0000000000401fc0 [ 39.250907] R13: 0000000000402050 R14: 0000000000000000 R15: 0000000000000000 [ 39.259470] Kernel Offset: disabled [ 39.263109] Rebooting in 86400 seconds..