[ 79.974376][ T27] audit: type=1800 audit(1582738791.095:26): pid=9817 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 81.189315][ T27] kauditd_printk_skb: 2 callbacks suppressed [ 81.189328][ T27] audit: type=1800 audit(1582738792.345:29): pid=9817 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 81.216425][ T27] audit: type=1800 audit(1582738792.345:30): pid=9817 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.203' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 91.092596][ T9970] sp0: Synchronizing with TNC [ 91.099417][ T586] ================================================================== [ 91.107772][ T586] BUG: KASAN: slab-out-of-bounds in decode_data.part.0+0x23b/0x270 [ 91.115670][ T586] Write of size 1 at addr ffff88809f3f944e by task kworker/u4:8/586 [ 91.124604][ T586] [ 91.126965][ T586] CPU: 0 PID: 586 Comm: kworker/u4:8 Not tainted 5.6.0-rc3-syzkaller #0 [ 91.135389][ T586] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 91.145583][ T586] Workqueue: events_unbound flush_to_ldisc [ 91.151387][ T586] Call Trace: [ 91.154710][ T586] dump_stack+0x197/0x210 [ 91.159168][ T586] ? decode_data.part.0+0x23b/0x270 [ 91.164396][ T586] print_address_description.constprop.0.cold+0xd4/0x30b [ 91.171434][ T586] ? decode_data.part.0+0x23b/0x270 [ 91.176912][ T586] ? decode_data.part.0+0x23b/0x270 [ 91.182133][ T586] __kasan_report.cold+0x1b/0x32 [ 91.187455][ T586] ? decode_data.part.0+0x23b/0x270 [ 91.192677][ T586] kasan_report+0x12/0x20 [ 91.197037][ T586] __asan_report_store1_noabort+0x17/0x20 [ 91.202775][ T586] decode_data.part.0+0x23b/0x270 [ 91.208347][ T586] sixpack_receive_buf+0xde4/0x1420 [ 91.213674][ T586] ? sixpack_close+0x250/0x250 [ 91.218481][ T586] tty_ldisc_receive_buf+0x15f/0x1c0 [ 91.223785][ T586] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 91.230332][ T586] tty_port_default_receive_buf+0x7d/0xb0 [ 91.236943][ T586] flush_to_ldisc+0x222/0x390 [ 91.241746][ T586] process_one_work+0xa05/0x17a0 [ 91.246867][ T586] ? mark_held_locks+0xf0/0xf0 [ 91.251681][ T586] ? pwq_dec_nr_in_flight+0x320/0x320 [ 91.257160][ T586] ? lock_acquire+0x190/0x410 [ 91.261898][ T586] worker_thread+0x98/0xe40 [ 91.266430][ T586] ? trace_hardirqs_on+0x67/0x240 [ 91.271496][ T586] kthread+0x361/0x430 [ 91.275579][ T586] ? process_one_work+0x17a0/0x17a0 [ 91.282339][ T586] ? kthread_mod_delayed_work+0x1f0/0x1f0 [ 91.288175][ T586] ret_from_fork+0x24/0x30 [ 91.292628][ T586] [ 91.294963][ T586] Allocated by task 9970: [ 91.299436][ T586] save_stack+0x23/0x90 [ 91.303603][ T586] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 91.309250][ T586] kasan_kmalloc+0x9/0x10 [ 91.313595][ T586] __kmalloc_node+0x4e/0x70 [ 91.318112][ T586] kvmalloc_node+0x68/0x100 [ 91.322627][ T586] alloc_netdev_mqs+0x98/0xe40 [ 91.327403][ T586] sixpack_open+0x104/0xaaf [ 91.331924][ T586] tty_ldisc_open.isra.0+0xa3/0x110 [ 91.337220][ T586] tty_set_ldisc+0x30e/0x6b0 [ 91.341942][ T586] tty_ioctl+0xe8d/0x14f0 [ 91.346380][ T586] ksys_ioctl+0x123/0x180 [ 91.350721][ T586] __x64_sys_ioctl+0x73/0xb0 [ 91.355340][ T586] do_syscall_64+0xfa/0x790 [ 91.359894][ T586] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 91.365820][ T586] [ 91.368151][ T586] Freed by task 9713: [ 91.372142][ T586] save_stack+0x23/0x90 [ 91.376427][ T586] __kasan_slab_free+0x102/0x150 [ 91.381379][ T586] kasan_slab_free+0xe/0x10 [ 91.385992][ T586] kfree+0x10a/0x2c0 [ 91.390033][ T586] tomoyo_realpath_from_path+0x1a7/0x660 [ 91.395677][ T586] tomoyo_init_log+0xc5a/0x2070 [ 91.400544][ T586] tomoyo_supervisor+0x32c/0xee0 [ 91.405493][ T586] tomoyo_env_perm+0x18e/0x210 [ 91.410272][ T586] tomoyo_find_next_domain+0x1354/0x1f6c [ 91.416015][ T586] tomoyo_bprm_check_security+0x124/0x1a0 [ 91.421750][ T586] security_bprm_check+0x63/0xb0 [ 91.426807][ T586] search_binary_handler+0x71/0x570 [ 91.432034][ T586] __do_execve_file.isra.0+0x12fc/0x2270 [ 91.437743][ T586] __x64_sys_execve+0x8f/0xc0 [ 91.442424][ T586] do_syscall_64+0xfa/0x790 [ 91.446923][ T586] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 91.452801][ T586] [ 91.455119][ T586] The buggy address belongs to the object at ffff88809f3f8000 [ 91.455119][ T586] which belongs to the cache kmalloc-4k of size 4096 [ 91.469548][ T586] The buggy address is located 1102 bytes to the right of [ 91.469548][ T586] 4096-byte region [ffff88809f3f8000, ffff88809f3f9000) [ 91.484019][ T586] The buggy address belongs to the page: [ 91.489816][ T586] page:ffffea00027cfe00 refcount:1 mapcount:0 mapping:ffff8880aa402000 index:0x0 compound_mapcount: 0 [ 91.500999][ T586] flags: 0xfffe0000010200(slab|head) [ 91.506287][ T586] raw: 00fffe0000010200 ffffea0002266188 ffffea00027f3708 ffff8880aa402000 [ 91.515167][ T586] raw: 0000000000000000 ffff88809f3f8000 0000000100000001 0000000000000000 [ 91.524067][ T586] page dumped because: kasan: bad access detected [ 91.530652][ T586] [ 91.532991][ T586] Memory state around the buggy address: [ 91.539534][ T586] ffff88809f3f9300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 91.547770][ T586] ffff88809f3f9380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 91.555932][ T586] >ffff88809f3f9400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 91.564083][ T586] ^ [ 91.570496][ T586] ffff88809f3f9480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 91.578592][ T586] ffff88809f3f9500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 91.586637][ T586] ================================================================== [ 91.594686][ T586] Disabling lock debugging due to kernel taint [ 91.601679][ T586] Kernel panic - not syncing: panic_on_warn set ... [ 91.608359][ T586] CPU: 0 PID: 586 Comm: kworker/u4:8 Tainted: G B 5.6.0-rc3-syzkaller #0 [ 91.618202][ T586] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 91.628308][ T586] Workqueue: events_unbound flush_to_ldisc [ 91.634093][ T586] Call Trace: [ 91.637379][ T586] dump_stack+0x197/0x210 [ 91.641771][ T586] panic+0x2e3/0x75c [ 91.645681][ T586] ? add_taint.cold+0x16/0x16 [ 91.650359][ T586] ? decode_data.part.0+0x23b/0x270 [ 91.655568][ T586] ? preempt_schedule+0x4b/0x60 [ 91.660407][ T586] ? ___preempt_schedule+0x16/0x18 [ 91.665511][ T586] ? trace_hardirqs_on+0x5e/0x240 [ 91.671081][ T586] ? decode_data.part.0+0x23b/0x270 [ 91.676277][ T586] end_report+0x47/0x4f [ 91.680438][ T586] ? decode_data.part.0+0x23b/0x270 [ 91.685706][ T586] __kasan_report.cold+0xe/0x32 [ 91.690748][ T586] ? decode_data.part.0+0x23b/0x270 [ 91.696063][ T586] kasan_report+0x12/0x20 [ 91.700395][ T586] __asan_report_store1_noabort+0x17/0x20 [ 91.706115][ T586] decode_data.part.0+0x23b/0x270 [ 91.711153][ T586] sixpack_receive_buf+0xde4/0x1420 [ 91.716495][ T586] ? sixpack_close+0x250/0x250 [ 91.721250][ T586] tty_ldisc_receive_buf+0x15f/0x1c0 [ 91.726542][ T586] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 91.732830][ T586] tty_port_default_receive_buf+0x7d/0xb0 [ 91.738547][ T586] flush_to_ldisc+0x222/0x390 [ 91.743215][ T586] process_one_work+0xa05/0x17a0 [ 91.748308][ T586] ? mark_held_locks+0xf0/0xf0 [ 91.753081][ T586] ? pwq_dec_nr_in_flight+0x320/0x320 [ 91.758447][ T586] ? lock_acquire+0x190/0x410 [ 91.763117][ T586] worker_thread+0x98/0xe40 [ 91.767625][ T586] ? trace_hardirqs_on+0x67/0x240 [ 91.772717][ T586] kthread+0x361/0x430 [ 91.777100][ T586] ? process_one_work+0x17a0/0x17a0 [ 91.782293][ T586] ? kthread_mod_delayed_work+0x1f0/0x1f0 [ 91.788250][ T586] ret_from_fork+0x24/0x30 [ 91.794427][ T586] Kernel Offset: disabled [ 91.798964][ T586] Rebooting in 86400 seconds..