Warning: Permanently added '10.128.15.203' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 34.982535] audit: type=1400 audit(1598585983.094:8): avc: denied { execmem } for pid=6349 comm="syz-executor149" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 36.191380] ================================================================== [ 36.198797] BUG: KASAN: stack-out-of-bounds in unwind_next_frame+0x1360/0x17d0 [ 36.206155] Read of size 8 at addr ffff88809422fa98 by task syz-executor149/6729 [ 36.213686] [ 36.215307] CPU: 0 PID: 6729 Comm: syz-executor149 Not tainted 4.14.195-syzkaller #0 [ 36.223175] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 36.232521] Call Trace: [ 36.235105] dump_stack+0x1b2/0x283 executing program [ 36.238731] print_address_description.cold+0x54/0x1d3 [ 36.244004] kasan_report_error.cold+0x8a/0x194 [ 36.248692] ? unwind_next_frame+0x1360/0x17d0 [ 36.253290] __asan_report_load8_noabort+0x68/0x70 [ 36.258213] ? unwind_next_frame+0x1360/0x17d0 [ 36.262796] unwind_next_frame+0x1360/0x17d0 [ 36.267199] ? retint_kernel+0x2d/0x2d [ 36.271094] ? deref_stack_reg+0x1a0/0x1a0 [ 36.275325] ? check_preemption_disabled+0x35/0x240 [ 36.280336] ? retint_kernel+0x2d/0x2d [ 36.284223] perf_callchain_kernel+0x38c/0x520 executing program [ 36.288802] ? arch_perf_update_userpage+0x300/0x300 [ 36.293905] ? check_preemption_disabled+0x35/0x240 [ 36.298938] get_perf_callchain+0x2df/0x740 [ 36.303255] ? put_callchain_buffers+0x60/0x60 [ 36.307843] ? bad_gs+0x22/0x7f [ 36.311150] ? startup_64+0x1/0x30 [ 36.314682] ? perf_callchain_user+0x2a9/0xc60 [ 36.319277] perf_callchain+0x147/0x190 [ 36.323276] perf_prepare_sample+0xd77/0x1380 [ 36.327769] ? get_perf_callchain+0x56f/0x740 [ 36.333043] ? perf_output_sample+0x16f0/0x16f0 executing program executing program executing program executing program executing program [ 36.337715] perf_event_output_forward+0xc9/0x1f0 [ 36.342550] ? perf_prepare_sample+0x1380/0x1380 [ 36.347294] ? perf_callchain+0x147/0x190 [ 36.351425] ? perf_callchain+0x150/0x190 [ 36.355564] ? check_preemption_disabled+0x35/0x240 [ 36.360577] __perf_event_overflow+0x113/0x310 [ 36.365159] perf_swevent_event+0x299/0x460 [ 36.369478] perf_tp_event+0x540/0x6e0 [ 36.373360] ? perf_swevent_event+0x460/0x460 [ 36.377859] ? __perf_event_overflow+0x1b6/0x310 [ 36.382616] ? check_preemption_disabled+0x35/0x240 [ 36.387629] ? perf_tp_event+0x3e0/0x6e0 executing program executing program executing program executing program executing program [ 36.391687] ? check_preemption_disabled+0x35/0x240 [ 36.396700] ? perf_swevent_event+0x460/0x460 [ 36.401195] ? perf_trace_run_bpf_submit+0x119/0x200 [ 36.406306] ? check_preemption_disabled+0x35/0x240 [ 36.411318] perf_trace_run_bpf_submit+0x119/0x200 [ 36.416253] perf_trace_lock_acquire+0x332/0x510 [ 36.421010] ? HARDIRQ_verbose+0x10/0x10 [ 36.425064] ? __lock_acquire+0x5fc/0x3f20 [ 36.429296] ? perf_trace_run_bpf_submit+0x119/0x200 [ 36.434391] lock_acquire+0x2b8/0x3f0 [ 36.438278] ? futex_exit_release+0x26/0x220 executing program executing program executing program executing program [ 36.442683] ? futex_exit_release+0x26/0x220 [ 36.447172] __mutex_lock+0xc4/0x1310 [ 36.450969] ? futex_exit_release+0x26/0x220 [ 36.455377] ? perf_trace_lock_acquire+0x332/0x510 [ 36.460302] ? retint_kernel+0x2d/0x2d [ 36.464187] ? futex_exit_release+0x26/0x220 [ 36.468603] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 36.474133] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 36.478882] ? retint_kernel+0x2d/0x2d [ 36.482764] ? taskstats_exit+0x6e/0xb50 [ 36.486852] futex_exit_release+0x26/0x220 executing program executing program executing program [ 36.491080] exit_mm_release+0x16/0x30 [ 36.494960] do_exit+0x56f/0x27f0 [ 36.498409] ? mm_update_next_owner+0x5b0/0x5b0 [ 36.503075] do_group_exit+0x100/0x2e0 [ 36.506960] get_signal+0x38d/0x1ca0 [ 36.510695] do_signal+0x7c/0x1550 [ 36.514247] ? is_prefetch.part.0+0x2f0/0x2f0 [ 36.518738] ? setup_sigcontext+0x820/0x820 [ 36.523054] ? HARDIRQ_verbose+0x10/0x10 [ 36.527107] ? pgtable_bad+0x110/0x110 [ 36.530988] ? is_prefetch.part.0+0x1ab/0x2f0 [ 36.535482] ? __bad_area_nosemaphore+0x1d6/0x2c0 executing program executing program executing program executing program executing program executing program [ 36.540347] ? up_read+0x17/0x30 [ 36.543711] ? __do_page_fault+0x19a/0xb50 [ 36.547938] ? exit_to_usermode_loop+0x41/0x200 [ 36.552602] exit_to_usermode_loop+0x160/0x200 [ 36.557175] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 36.562014] prepare_exit_to_usermode+0x1af/0x210 [ 36.567026] ? page_fault+0x2f/0x50 [ 36.570645] retint_user+0x8/0x18 [ 36.574087] RIP: 0033:0x43f31f [ 36.577289] RSP: 002b:00007ffe04b8f328 EFLAGS: 00010283 [ 36.582639] RAX: 00007ffe04b8f370 RBX: 00007ffe04b8f370 RCX: 0000000000000000 executing program executing program executing program executing program executing program [ 36.590507] RDX: 00000000000000e0 RSI: 0000000000000000 RDI: 00007ffe04b8f370 [ 36.597770] RBP: 0000000000000000 R08: 00000000000000e0 R09: 00000000000000c2 [ 36.605031] R10: 00000000ffffffff R11: 0000000000000246 R12: 0000000000001001 [ 36.612293] R13: 0000000000402420 R14: 0000000000000000 R15: 0000000000000000 [ 36.619555] [ 36.621169] The buggy address belongs to the page: [ 36.626087] page:ffffea0002508bc0 count:0 mapcount:0 mapping: (null) index:0x0 [ 36.634225] flags: 0xfffe0000000000() executing program executing program executing program executing program executing program executing program executing program [ 36.638024] raw: 00fffe0000000000 0000000000000000 0000000000000000 00000000ffffffff [ 36.645895] raw: 0000000000000000 0000000100000001 0000000000000000 0000000000000000 [ 36.653794] page dumped because: kasan: bad access detected [ 36.659576] [ 36.661191] Memory state around the buggy address: [ 36.666118] ffff88809422f980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 36.673472] ffff88809422fa00: f1 f1 f1 f1 00 00 00 f2 00 00 00 f2 f2 f2 00 00 [ 36.680824] >ffff88809422fa80: 00 00 00 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 [ 36.688174] ^ executing program executing program executing program executing program executing program executing program executing program [ 36.692314] ffff88809422fb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 36.699672] ffff88809422fb80: 00 f1 f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2 00 00 f3 [ 36.707042] ================================================================== [ 36.714390] Disabling lock debugging due to kernel taint [ 36.719855] Kernel panic - not syncing: panic_on_warn set ... [ 36.719855] [ 36.727219] CPU: 0 PID: 6729 Comm: syz-executor149 Tainted: G B 4.14.195-syzkaller #0 executing program executing program executing program executing program executing program executing program executing program [ 36.736312] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 36.746353] Call Trace: [ 36.748958] dump_stack+0x1b2/0x283 [ 36.752580] panic+0x1f9/0x42d [ 36.755767] ? add_taint.cold+0x16/0x16 [ 36.759760] ? lock_downgrade+0x740/0x740 [ 36.763905] kasan_end_report+0x43/0x49 [ 36.767872] kasan_report_error.cold+0xa7/0x194 [ 36.772536] ? unwind_next_frame+0x1360/0x17d0 [ 36.777111] __asan_report_load8_noabort+0x68/0x70 [ 36.782038] ? unwind_next_frame+0x1360/0x17d0 [ 36.786610] unwind_next_frame+0x1360/0x17d0 executing program executing program executing program executing program executing program executing program executing program [ 36.791014] ? retint_kernel+0x2d/0x2d [ 36.794907] ? deref_stack_reg+0x1a0/0x1a0 [ 36.799169] ? check_preemption_disabled+0x35/0x240 [ 36.804221] ? retint_kernel+0x2d/0x2d [ 36.808103] perf_callchain_kernel+0x38c/0x520 [ 36.812683] ? arch_perf_update_userpage+0x300/0x300 [ 36.817785] ? check_preemption_disabled+0x35/0x240 [ 36.822815] get_perf_callchain+0x2df/0x740 [ 36.827132] ? put_callchain_buffers+0x60/0x60 [ 36.831708] ? bad_gs+0x22/0x7f [ 36.834981] ? startup_64+0x1/0x30 [ 36.838515] ? perf_callchain_user+0x2a9/0xc60 executing program executing program executing program executing program executing program executing program executing program executing program [ 36.843091] perf_callchain+0x147/0x190 [ 36.847057] perf_prepare_sample+0xd77/0x1380 [ 36.851545] ? get_perf_callchain+0x56f/0x740 [ 36.856036] ? perf_output_sample+0x16f0/0x16f0 [ 36.860701] perf_event_output_forward+0xc9/0x1f0 [ 36.865578] ? perf_prepare_sample+0x1380/0x1380 [ 36.870330] ? perf_callchain+0x147/0x190 [ 36.874473] ? perf_callchain+0x150/0x190 [ 36.878619] ? check_preemption_disabled+0x35/0x240 [ 36.883634] __perf_event_overflow+0x113/0x310 [ 36.888227] perf_swevent_event+0x299/0x460 executing program executing program executing program executing program executing program executing program executing program executing program [ 36.892546] perf_tp_event+0x540/0x6e0 [ 36.896431] ? perf_swevent_event+0x460/0x460 [ 36.900926] ? __perf_event_overflow+0x1b6/0x310 [ 36.905689] ? check_preemption_disabled+0x35/0x240 [ 36.910707] ? perf_tp_event+0x3e0/0x6e0 [ 36.914765] ? check_preemption_disabled+0x35/0x240 [ 36.919781] ? perf_swevent_event+0x460/0x460 [ 36.924282] ? perf_trace_run_bpf_submit+0x119/0x200 [ 36.929414] ? check_preemption_disabled+0x35/0x240 [ 36.934434] perf_trace_run_bpf_submit+0x119/0x200 [ 36.939395] perf_trace_lock_acquire+0x332/0x510 executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 36.944156] ? HARDIRQ_verbose+0x10/0x10 [ 36.948220] ? __lock_acquire+0x5fc/0x3f20 [ 36.952458] ? perf_trace_run_bpf_submit+0x119/0x200 [ 36.957558] lock_acquire+0x2b8/0x3f0 [ 36.961363] ? futex_exit_release+0x26/0x220 [ 36.965777] ? futex_exit_release+0x26/0x220 [ 36.970218] __mutex_lock+0xc4/0x1310 [ 36.974015] ? futex_exit_release+0x26/0x220 [ 36.978441] ? perf_trace_lock_acquire+0x332/0x510 [ 36.983365] ? retint_kernel+0x2d/0x2d [ 36.987246] ? futex_exit_release+0x26/0x220 executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 36.991652] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 36.997183] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 37.001943] ? retint_kernel+0x2d/0x2d [ 37.005825] ? taskstats_exit+0x6e/0xb50 [ 37.009885] futex_exit_release+0x26/0x220 [ 37.014114] exit_mm_release+0x16/0x30 [ 37.017995] do_exit+0x56f/0x27f0 [ 37.021443] ? mm_update_next_owner+0x5b0/0x5b0 [ 37.026109] do_group_exit+0x100/0x2e0 [ 37.029992] get_signal+0x38d/0x1ca0 [ 37.033703] do_signal+0x7c/0x1550 [ 37.037236] ? is_prefetch.part.0+0x2f0/0x2f0 executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 37.041727] ? setup_sigcontext+0x820/0x820 [ 37.046042] ? HARDIRQ_verbose+0x10/0x10 [ 37.050098] ? pgtable_bad+0x110/0x110 [ 37.053980] ? is_prefetch.part.0+0x1ab/0x2f0 [ 37.058469] ? __bad_area_nosemaphore+0x1d6/0x2c0 [ 37.063304] ? up_read+0x17/0x30 [ 37.066668] ? __do_page_fault+0x19a/0xb50 [ 37.070992] ? exit_to_usermode_loop+0x41/0x200 [ 37.075655] exit_to_usermode_loop+0x160/0x200 [ 37.080233] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 37.085071] prepare_exit_to_usermode+0x1af/0x210 [ 37.089909] ? page_fault+0x2f/0x50 executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 37.093530] retint_user+0x8/0x18 [ 37.096971] RIP: 0033:0x43f31f [ 37.100148] RSP: 002b:00007ffe04b8f328 EFLAGS: 00010283 [ 37.105501] RAX: 00007ffe04b8f370 RBX: 00007ffe04b8f370 RCX: 0000000000000000 [ 37.112762] RDX: 00000000000000e0 RSI: 0000000000000000 RDI: 00007ffe04b8f370 [ 37.120056] RBP: 0000000000000000 R08: 00000000000000e0 R09: 00000000000000c2 [ 37.127423] R10: 00000000ffffffff R11: 0000000000000246 R12: 0000000000001001 [ 37.134685] R13: 0000000000402420 R14: 0000000000000000 R15: 0000000000000000 [ 37.143121] Kernel Offset: disabled [ 37.146784] Rebooting in 86400 seconds..