[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 61.622262][ T26] audit: type=1800 audit(1575480769.088:25): pid=9095 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 61.648956][ T26] audit: type=1800 audit(1575480769.088:26): pid=9095 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 61.694719][ T26] audit: type=1800 audit(1575480769.088:27): pid=9095 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.55' (ECDSA) to the list of known hosts. 2019/12/04 17:33:00 parsed 1 programs 2019/12/04 17:33:03 executed programs: 0 syzkaller login: [ 75.862054][ T9262] IPVS: ftp: loaded support on port[0] = 21 [ 75.927032][ T9262] chnl_net:caif_netlink_parms(): no params data found [ 75.958425][ T9262] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.966163][ T9262] bridge0: port 1(bridge_slave_0) entered disabled state [ 75.974761][ T9262] device bridge_slave_0 entered promiscuous mode [ 75.983318][ T9262] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.991299][ T9262] bridge0: port 2(bridge_slave_1) entered disabled state [ 75.999124][ T9262] device bridge_slave_1 entered promiscuous mode [ 76.016995][ T9262] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 76.028339][ T9262] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 76.049782][ T9262] team0: Port device team_slave_0 added [ 76.057494][ T9262] team0: Port device team_slave_1 added [ 76.121752][ T9262] device hsr_slave_0 entered promiscuous mode [ 76.169306][ T9262] device hsr_slave_1 entered promiscuous mode [ 76.252578][ T9262] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 76.311440][ T9262] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 76.351230][ T9262] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 76.401665][ T9262] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 76.471508][ T9262] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.478784][ T9262] bridge0: port 2(bridge_slave_1) entered forwarding state [ 76.488833][ T9262] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.495996][ T9262] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.537266][ T9262] 8021q: adding VLAN 0 to HW filter on device bond0 [ 76.551248][ T3700] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 76.573913][ T3700] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.594112][ T3700] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.602460][ T3700] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 76.616263][ T9262] 8021q: adding VLAN 0 to HW filter on device team0 [ 76.627853][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 76.636848][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.644076][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.655839][ T3700] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 76.665046][ T3700] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.673360][ T3700] bridge0: port 2(bridge_slave_1) entered forwarding state [ 76.699490][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 76.708499][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 76.717763][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 76.730350][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 76.738332][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 76.750177][ T9262] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 76.767516][ T3700] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 76.775401][ T3700] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 76.788106][ T9262] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.832573][ T9319] ================================================================== [ 77.840939][ T9319] BUG: KASAN: stack-out-of-bounds in ax25_getname+0x58/0x7a0 [ 77.848415][ T9319] Write of size 72 at addr ffffc90002337c78 by task syz-executor.0/9319 [ 77.856712][ T9319] [ 77.859028][ T9319] CPU: 0 PID: 9319 Comm: syz-executor.0 Not tainted 5.4.0-next-20191204-syzkaller #0 [ 77.869007][ T9319] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 77.879267][ T9319] Call Trace: [ 77.882813][ T9319] dump_stack+0x197/0x210 [ 77.887158][ T9319] ? ax25_getname+0x58/0x7a0 [ 77.891758][ T9319] print_address_description.constprop.0.cold+0x5/0x30b [ 77.898688][ T9319] ? ax25_getname+0x58/0x7a0 [ 77.903289][ T9319] ? ax25_getname+0x58/0x7a0 [ 77.907872][ T9319] __kasan_report.cold+0x1b/0x41 [ 77.913016][ T9319] ? ax25_getname+0x58/0x7a0 [ 77.917842][ T9319] kasan_report+0x12/0x20 [ 77.922375][ T9319] check_memory_region+0x134/0x1a0 [ 77.927471][ T9319] memset+0x24/0x40 [ 77.931269][ T9319] ax25_getname+0x58/0x7a0 [ 77.935669][ T9319] ? fget+0x20/0x30 [ 77.939462][ T9319] vhost_net_ioctl+0x120a/0x1960 [ 77.944384][ T9319] ? vhost_zerocopy_callback+0x2f0/0x2f0 [ 77.950256][ T9319] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 77.956182][ T9319] ? vhost_zerocopy_callback+0x2f0/0x2f0 [ 77.961827][ T9319] do_vfs_ioctl+0x977/0x14e0 [ 77.966406][ T9319] ? compat_ioctl_preallocate+0x220/0x220 [ 77.972148][ T9319] ? __fget+0x37f/0x550 [ 77.976295][ T9319] ? ksys_dup3+0x3e0/0x3e0 [ 77.980710][ T9319] ? ns_to_kernel_old_timeval+0x100/0x100 [ 77.986441][ T9319] ? tomoyo_file_ioctl+0x23/0x30 [ 77.991531][ T9319] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 77.997796][ T9319] ? security_file_ioctl+0x8d/0xc0 [ 78.002900][ T9319] ksys_ioctl+0xab/0xd0 [ 78.007043][ T9319] __x64_sys_ioctl+0x73/0xb0 [ 78.011757][ T9319] do_syscall_64+0xfa/0x790 [ 78.016251][ T9319] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 78.022124][ T9319] RIP: 0033:0x45a679 [ 78.026019][ T9319] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 78.045727][ T9319] RSP: 002b:00007fa37e85bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 78.054300][ T9319] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a679 [ 78.063833][ T9319] RDX: 0000000020d7c000 RSI: 000000004008af30 RDI: 0000000000000003 [ 78.071802][ T9319] RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000 [ 78.079757][ T9319] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa37e85c6d4 [ 78.088080][ T9319] R13: 00000000004c62d7 R14: 00000000004dc718 R15: 00000000ffffffff [ 78.096238][ T9319] [ 78.098563][ T9319] [ 78.100880][ T9319] addr ffffc90002337c78 is located in stack of task syz-executor.0/9319 at offset 128 in frame: [ 78.111289][ T9319] vhost_net_ioctl+0x0/0x1960 [ 78.115946][ T9319] [ 78.118255][ T9319] this frame has 4 objects: [ 78.122750][ T9319] [48, 52) 'r' [ 78.122755][ T9319] [64, 72) 'features' [ 78.126195][ T9319] [96, 104) 'backend' [ 78.130244][ T9319] [128, 180) 'uaddr' [ 78.134304][ T9319] [ 78.140565][ T9319] Memory state around the buggy address: [ 78.146180][ T9319] ffffc90002337b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 [ 78.154240][ T9319] ffffc90002337c00: f1 f1 f1 f1 f1 04 f2 00 f2 f2 f2 00 f2 f2 f2 00 [ 78.162289][ T9319] >ffffc90002337c80: 00 00 00 00 00 04 f3 f3 f3 f3 f3 00 00 00 00 00 [ 78.171312][ T9319] ^ [ 78.176777][ T9319] ffffc90002337d00: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 [ 78.184849][ T9319] ffffc90002337d80: 00 f2 f2 f2 00 00 00 f2 f2 f2 f2 f2 00 00 00 00 [ 78.192911][ T9319] ================================================================== [ 78.200966][ T9319] Disabling lock debugging due to kernel taint [ 78.210844][ T9319] Kernel panic - not syncing: panic_on_warn set ... [ 78.210863][ T9319] CPU: 0 PID: 9319 Comm: syz-executor.0 Tainted: G B 5.4.0-next-20191204-syzkaller #0 [ 78.210869][ T9319] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 78.210873][ T9319] Call Trace: [ 78.210894][ T9319] dump_stack+0x197/0x210 [ 78.210910][ T9319] panic+0x2e3/0x75c [ 78.210922][ T9319] ? add_taint.cold+0x16/0x16 [ 78.210936][ T9319] ? ax25_getname+0x58/0x7a0 [ 78.210953][ T9319] ? preempt_schedule+0x4b/0x60 [ 78.264410][ T9319] ? ___preempt_schedule+0x16/0x18 [ 78.269626][ T9319] ? trace_hardirqs_on+0x5e/0x240 [ 78.274758][ T9319] ? ax25_getname+0x58/0x7a0 [ 78.279350][ T9319] end_report+0x47/0x4f [ 78.283763][ T9319] ? ax25_getname+0x58/0x7a0 [ 78.288340][ T9319] __kasan_report.cold+0xe/0x41 [ 78.293274][ T9319] ? ax25_getname+0x58/0x7a0 [ 78.297850][ T9319] kasan_report+0x12/0x20 [ 78.302174][ T9319] check_memory_region+0x134/0x1a0 [ 78.307281][ T9319] memset+0x24/0x40 [ 78.311182][ T9319] ax25_getname+0x58/0x7a0 [ 78.315593][ T9319] ? fget+0x20/0x30 [ 78.319406][ T9319] vhost_net_ioctl+0x120a/0x1960 [ 78.324352][ T9319] ? vhost_zerocopy_callback+0x2f0/0x2f0 [ 78.329963][ T9319] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 78.336413][ T9319] ? vhost_zerocopy_callback+0x2f0/0x2f0 [ 78.344095][ T9319] do_vfs_ioctl+0x977/0x14e0 [ 78.348932][ T9319] ? compat_ioctl_preallocate+0x220/0x220 [ 78.354738][ T9319] ? __fget+0x37f/0x550 [ 78.358908][ T9319] ? ksys_dup3+0x3e0/0x3e0 [ 78.363433][ T9319] ? ns_to_kernel_old_timeval+0x100/0x100 [ 78.369242][ T9319] ? tomoyo_file_ioctl+0x23/0x30 [ 78.374254][ T9319] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 78.380494][ T9319] ? security_file_ioctl+0x8d/0xc0 [ 78.385809][ T9319] ksys_ioctl+0xab/0xd0 [ 78.390191][ T9319] __x64_sys_ioctl+0x73/0xb0 [ 78.394813][ T9319] do_syscall_64+0xfa/0x790 [ 78.399318][ T9319] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 78.405201][ T9319] RIP: 0033:0x45a679 [ 78.409162][ T9319] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 78.429438][ T9319] RSP: 002b:00007fa37e85bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 78.437979][ T9319] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a679 [ 78.445946][ T9319] RDX: 0000000020d7c000 RSI: 000000004008af30 RDI: 0000000000000003 [ 78.454027][ T9319] RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000 [ 78.462150][ T9319] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa37e85c6d4 [ 78.470226][ T9319] R13: 00000000004c62d7 R14: 00000000004dc718 R15: 00000000ffffffff [ 78.480007][ T9319] Kernel Offset: disabled [ 78.484381][ T9319] Rebooting in 86400 seconds..