Warning: Permanently added '10.128.0.203' (ECDSA) to the list of known hosts. executing program [ 86.188795][ T8758] ================================================================== [ 86.188832][ T8758] BUG: KASAN: slab-out-of-bounds in vcs_scr_readw+0xc2/0xd0 [ 86.188839][ T8758] Read of size 2 at addr ffff8880a3f212c0 by task syz-executor716/8758 [ 86.188842][ T8758] [ 86.188851][ T8758] CPU: 1 PID: 8758 Comm: syz-executor716 Not tainted 5.4.0-syzkaller #0 [ 86.188856][ T8758] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 86.188859][ T8758] Call Trace: [ 86.188871][ T8758] dump_stack+0x197/0x210 [ 86.188878][ T8758] ? vcs_scr_readw+0xc2/0xd0 [ 86.188890][ T8758] print_address_description.constprop.0.cold+0xd4/0x30b [ 86.188897][ T8758] ? vcs_scr_readw+0xc2/0xd0 [ 86.188903][ T8758] ? vcs_scr_readw+0xc2/0xd0 [ 86.188911][ T8758] __kasan_report.cold+0x1b/0x41 [ 86.188920][ T8758] ? vcs_write+0x440/0xcf0 [ 86.188927][ T8758] ? vcs_scr_readw+0xc2/0xd0 [ 86.188935][ T8758] kasan_report+0x12/0x20 [ 86.188944][ T8758] __asan_report_load2_noabort+0x14/0x20 [ 86.188951][ T8758] vcs_scr_readw+0xc2/0xd0 [ 86.188959][ T8758] vcs_write+0x646/0xcf0 [ 86.188974][ T8758] ? vcs_size+0x250/0x250 [ 86.188988][ T8758] ? apparmor_file_permission+0x25/0x30 [ 86.189000][ T8758] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 86.189009][ T8758] ? security_file_permission+0x8f/0x380 [ 86.189018][ T8758] ? trace_hardirqs_on+0x67/0x240 [ 86.189028][ T8758] __vfs_write+0x8a/0x110 [ 86.189035][ T8758] ? vcs_size+0x250/0x250 [ 86.189043][ T8758] vfs_write+0x268/0x5d0 [ 86.189054][ T8758] ksys_write+0x14f/0x290 [ 86.189062][ T8758] ? __ia32_sys_read+0xb0/0xb0 [ 86.189073][ T8758] ? do_syscall_64+0x26/0x790 [ 86.189084][ T8758] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 86.189091][ T8758] ? do_syscall_64+0x26/0x790 [ 86.189102][ T8758] __x64_sys_write+0x73/0xb0 [ 86.189111][ T8758] do_syscall_64+0xfa/0x790 [ 86.189121][ T8758] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 86.189127][ T8758] RIP: 0033:0x444399 [ 86.189135][ T8758] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b d8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 86.189140][ T8758] RSP: 002b:00007fff38a38838 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 86.189148][ T8758] RAX: ffffffffffffffda RBX: 00007fff38a38840 RCX: 0000000000444399 [ 86.189152][ T8758] RDX: 00000000fffffecb RSI: 0000000020000300 RDI: 0000000000000003 [ 86.189157][ T8758] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000400c60 [ 86.189162][ T8758] R10: 00007fff38a38380 R11: 0000000000000246 R12: 00000000004020a0 [ 86.189166][ T8758] R13: 0000000000402130 R14: 0000000000000000 R15: 0000000000000000 [ 86.189177][ T8758] [ 86.189181][ T8758] Allocated by task 1: [ 86.189188][ T8758] save_stack+0x23/0x90 [ 86.189195][ T8758] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 86.189200][ T8758] kasan_kmalloc+0x9/0x10 [ 86.189209][ T8758] __kmalloc+0x163/0x770 [ 86.189215][ T8758] vc_do_resize+0x262/0x1460 [ 86.189221][ T8758] vc_resize+0x4d/0x60 [ 86.189229][ T8758] fbcon_init+0x122d/0x1a90 [ 86.189237][ T8758] visual_init+0x30a/0x5e0 [ 86.189243][ T8758] do_bind_con_driver+0x54c/0x8b0 [ 86.189249][ T8758] do_take_over_console+0x449/0x5a0 [ 86.189255][ T8758] do_fbcon_takeover+0x116/0x220 [ 86.189263][ T8758] fbcon_fb_registered+0x275/0x340 [ 86.189269][ T8758] register_framebuffer+0x5c3/0xa10 [ 86.189278][ T8758] vga16fb_probe+0x711/0x825 [ 86.189287][ T8758] platform_drv_probe+0x8d/0x140 [ 86.189293][ T8758] really_probe+0x291/0x710 [ 86.189300][ T8758] driver_probe_device+0x110/0x220 [ 86.189306][ T8758] __device_attach_driver+0x1c9/0x230 [ 86.189313][ T8758] bus_for_each_drv+0x172/0x1f0 [ 86.189319][ T8758] __device_attach+0x237/0x390 [ 86.189325][ T8758] device_initial_probe+0x1b/0x20 [ 86.189332][ T8758] bus_probe_device+0x1f1/0x2a0 [ 86.189339][ T8758] device_add+0x14fe/0x1d00 [ 86.189346][ T8758] platform_device_add+0x34d/0x6c0 [ 86.189355][ T8758] vga16fb_init+0x15f/0x1d6 [ 86.189363][ T8758] do_one_initcall+0x120/0x81a [ 86.189372][ T8758] kernel_init_freeable+0x4ca/0x5b9 [ 86.189379][ T8758] kernel_init+0x12/0x1bf [ 86.189386][ T8758] ret_from_fork+0x24/0x30 [ 86.189388][ T8758] [ 86.189392][ T8758] Freed by task 0: [ 86.189394][ T8758] (stack is not available) [ 86.189396][ T8758] [ 86.189402][ T8758] The buggy address belongs to the object at ffff8880a3f20000 [ 86.189402][ T8758] which belongs to the cache kmalloc-8k of size 8192 [ 86.189408][ T8758] The buggy address is located 4800 bytes inside of [ 86.189408][ T8758] 8192-byte region [ffff8880a3f20000, ffff8880a3f22000) [ 86.189411][ T8758] The buggy address belongs to the page: [ 86.189419][ T8758] page:ffffea00028fc800 refcount:1 mapcount:0 mapping:ffff8880aa4021c0 index:0x0 compound_mapcount: 0 [ 86.189429][ T8758] raw: 00fffe0000010200 ffffea000294c808 ffffea000282cc08 ffff8880aa4021c0 [ 86.189438][ T8758] raw: 0000000000000000 ffff8880a3f20000 0000000100000001 0000000000000000 [ 86.189442][ T8758] page dumped because: kasan: bad access detected [ 86.189444][ T8758] [ 86.189447][ T8758] Memory state around the buggy address: [ 86.189453][ T8758] ffff8880a3f21180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 86.189459][ T8758] ffff8880a3f21200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 86.189465][ T8758] >ffff8880a3f21280: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 86.189468][ T8758] ^ [ 86.189474][ T8758] ffff8880a3f21300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 86.189479][ T8758] ffff8880a3f21380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 86.189482][ T8758] ================================================================== [ 86.189485][ T8758] Disabling lock debugging due to kernel taint [ 86.189489][ T8758] Kernel panic - not syncing: panic_on_warn set ... [ 86.189497][ T8758] CPU: 1 PID: 8758 Comm: syz-executor716 Tainted: G B 5.4.0-syzkaller #0 [ 86.189501][ T8758] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 86.189503][ T8758] Call Trace: [ 86.189517][ T8758] dump_stack+0x197/0x210 [ 86.189526][ T8758] panic+0x2e3/0x75c [ 86.189533][ T8758] ? add_taint.cold+0x16/0x16 [ 86.189542][ T8758] ? trace_hardirqs_on+0x67/0x240 [ 86.189549][ T8758] ? trace_hardirqs_on+0x5e/0x240 [ 86.189556][ T8758] ? vcs_scr_readw+0xc2/0xd0 [ 86.189565][ T8758] end_report+0x47/0x4f [ 86.189571][ T8758] ? vcs_scr_readw+0xc2/0xd0 [ 86.189577][ T8758] __kasan_report.cold+0xe/0x41 [ 86.189584][ T8758] ? vcs_write+0x440/0xcf0 [ 86.189590][ T8758] ? vcs_scr_readw+0xc2/0xd0 [ 86.189597][ T8758] kasan_report+0x12/0x20 [ 86.189605][ T8758] __asan_report_load2_noabort+0x14/0x20 [ 86.189612][ T8758] vcs_scr_readw+0xc2/0xd0 [ 86.189619][ T8758] vcs_write+0x646/0xcf0 [ 86.189629][ T8758] ? vcs_size+0x250/0x250 [ 86.189637][ T8758] ? apparmor_file_permission+0x25/0x30 [ 86.189644][ T8758] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 86.189652][ T8758] ? security_file_permission+0x8f/0x380 [ 86.189659][ T8758] ? trace_hardirqs_on+0x67/0x240 [ 86.189666][ T8758] __vfs_write+0x8a/0x110 [ 86.189672][ T8758] ? vcs_size+0x250/0x250 [ 86.189679][ T8758] vfs_write+0x268/0x5d0 [ 86.189687][ T8758] ksys_write+0x14f/0x290 [ 86.189694][ T8758] ? __ia32_sys_read+0xb0/0xb0 [ 86.189702][ T8758] ? do_syscall_64+0x26/0x790 [ 86.189709][ T8758] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 86.189716][ T8758] ? do_syscall_64+0x26/0x790 [ 86.189724][ T8758] __x64_sys_write+0x73/0xb0 [ 86.189732][ T8758] do_syscall_64+0xfa/0x790 [ 86.189741][ T8758] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 86.189745][ T8758] RIP: 0033:0x444399 [ 86.189752][ T8758] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b d8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 86.189756][ T8758] RSP: 002b:00007fff38a38838 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 86.189762][ T8758] RAX: ffffffffffffffda RBX: 00007fff38a38840 RCX: 0000000000444399 [ 86.189766][ T8758] RDX: 00000000fffffecb RSI: 0000000020000300 RDI: 0000000000000003 [ 86.189770][ T8758] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000400c60 [ 86.189775][ T8758] R10: 00007fff38a38380 R11: 0000000000000246 R12: 00000000004020a0 [ 86.189778][ T8758] R13: 0000000000402130 R14: 0000000000000000 R15: 0000000000000000 [ 86.191199][ T8758] Kernel Offset: disabled [ 86.996055][ T8758] Rebooting in 86400 seconds..