INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added 'ci-upstream-kasan-gce-386-3,10.128.0.57' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 26.250963] ================================================================== [ 26.252069] BUG: KASAN: global-out-of-bounds in show_timer+0x278/0x2b0 [ 26.252978] Read of size 8 at addr ffffffff85342a38 by task syzkaller180438/3078 [ 26.253963] [ 26.254196] CPU: 0 PID: 3078 Comm: syzkaller180438 Not tainted 4.15.0-rc1+ #114 [ 26.255171] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 26.256390] Call Trace: [ 26.256748] dump_stack+0x194/0x257 [ 26.257241] ? arch_local_irq_restore+0x53/0x53 [ 26.257865] ? show_regs_print_info+0x65/0x65 [ 26.258482] ? seq_printf+0xb3/0xe0 [ 26.259012] ? show_timer+0x278/0x2b0 [ 26.259526] print_address_description+0x178/0x250 [ 26.260187] ? show_timer+0x278/0x2b0 [ 26.260700] kasan_report+0x25b/0x340 [ 26.261215] __asan_report_load8_noabort+0x14/0x20 [ 26.261871] show_timer+0x278/0x2b0 [ 26.262381] ? timers_start+0x14c/0x1c0 [ 26.262918] traverse+0x248/0xa00 [ 26.263397] ? seq_hlist_next+0xc0/0xc0 [ 26.263961] seq_read+0x96a/0x13d0 [ 26.264501] ? seq_lseek+0x3c0/0x3c0 [ 26.265001] ? selinux_file_permission+0x82/0x460 [ 26.265652] ? security_file_permission+0x89/0x1f0 [ 26.266313] ? rw_verify_area+0xe5/0x2b0 [ 26.266881] do_iter_read+0x3db/0x5b0 [ 26.267429] ? iov_iter_get_pages+0x1150/0x1150 [ 26.268062] compat_readv+0x1bf/0x270 [ 26.268665] ? vfs_iter_read+0xb0/0xb0 [ 26.269214] ? fget_raw+0x20/0x20 [ 26.269686] ? down_read_trylock+0xdb/0x170 [ 26.270295] ? __do_page_fault+0x32d/0xc90 [ 26.270876] ? __handle_mm_fault+0x3e20/0x3e20 [ 26.271486] ? vmacache_find+0x5f/0x280 [ 26.275442] do_compat_preadv64+0xdc/0x100 [ 26.279645] ? do_compat_preadv64+0xdc/0x100 [ 26.284026] compat_SyS_preadv+0x3b/0x50 [ 26.288056] ? compat_SyS_preadv64+0x40/0x40 [ 26.292434] do_fast_syscall_32+0x3ee/0xf9d [ 26.296733] ? do_int80_syscall_32+0x9d0/0x9d0 [ 26.301283] ? kasan_check_read+0x11/0x20 [ 26.305402] ? syscall_return_slowpath+0x550/0x550 [ 26.310303] ? SyS_rt_sigaction+0x94/0x1b0 [ 26.314506] ? lockdep_sys_exit+0x47/0xf0 [ 26.318624] ? retint_user+0x18/0x18 [ 26.322311] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 26.327128] entry_SYSENTER_compat+0x51/0x60 [ 26.331502] RIP: 0023:0xf7f28c79 [ 26.334834] RSP: 002b:00000000fffb966c EFLAGS: 00000292 ORIG_RAX: 000000000000014d [ 26.342511] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000205e2ff0 [ 26.349751] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000010000 [ 26.356987] RBP: 0000000020d71fa0 R08: 0000000000000000 R09: 0000000000000000 [ 26.364222] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 26.371459] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 26.378716] [ 26.380311] The buggy address belongs to the variable: [ 26.385555] nstr.44443+0x18/0x40 [ 26.388970] [ 26.390563] Memory state around the buggy address: [ 26.395459] ffffffff85342900: fa fa fa fa 00 06 fa fa fa fa fa fa 07 fa fa fa [ 26.402786] ffffffff85342980: fa fa fa fa 05 fa fa fa fa fa fa fa 07 fa fa fa [ 26.410110] >ffffffff85342a00: fa fa fa fa 00 00 00 fa fa fa fa fa 00 fa fa fa [ 26.417435] ^ [ 26.422589] ffffffff85342a80: fa fa fa fa 07 fa fa fa fa fa fa fa 00 00 00 00 [ 26.429913] ffffffff85342b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.437237] ================================================================== [ 26.444568] Disabling lock debugging due to kernel taint [ 26.450068] Kernel panic - not syncing: panic_on_warn set ... [ 26.450068] [ 26.457396] CPU: 0 PID: 3078 Comm: syzkaller180438 Tainted: G B 4.15.0-rc1+ #114 [ 26.466107] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 26.475428] Call Trace: [ 26.477979] dump_stack+0x194/0x257 [ 26.481572] ? arch_local_irq_restore+0x53/0x53 [ 26.486208] ? vprintk_default+0x28/0x30 [ 26.490236] ? vsnprintf+0x1ed/0x1900 [ 26.494002] ? show_timer+0x1e0/0x2b0 [ 26.497768] panic+0x1e4/0x41c [ 26.500924] ? refcount_error_report+0x214/0x214 [ 26.505647] ? add_taint+0x40/0x50 [ 26.509151] ? add_taint+0x1c/0x50 [ 26.512656] ? show_timer+0x278/0x2b0 [ 26.516431] kasan_end_report+0x50/0x50 [ 26.520371] kasan_report+0x144/0x340 [ 26.524138] __asan_report_load8_noabort+0x14/0x20 [ 26.529041] show_timer+0x278/0x2b0 [ 26.532632] ? timers_start+0x14c/0x1c0 [ 26.536574] traverse+0x248/0xa00 [ 26.539994] ? seq_hlist_next+0xc0/0xc0 [ 26.543941] seq_read+0x96a/0x13d0 [ 26.547453] ? seq_lseek+0x3c0/0x3c0 [ 26.551132] ? selinux_file_permission+0x82/0x460 [ 26.555942] ? security_file_permission+0x89/0x1f0 [ 26.560839] ? rw_verify_area+0xe5/0x2b0 [ 26.564867] do_iter_read+0x3db/0x5b0 [ 26.568634] ? iov_iter_get_pages+0x1150/0x1150 [ 26.573275] compat_readv+0x1bf/0x270 [ 26.577043] ? vfs_iter_read+0xb0/0xb0 [ 26.580986] ? fget_raw+0x20/0x20 [ 26.584408] ? down_read_trylock+0xdb/0x170 [ 26.588711] ? __do_page_fault+0x32d/0xc90 [ 26.592912] ? __handle_mm_fault+0x3e20/0x3e20 [ 26.597467] ? vmacache_find+0x5f/0x280 [ 26.601412] do_compat_preadv64+0xdc/0x100 [ 26.605611] ? do_compat_preadv64+0xdc/0x100 [ 26.609985] compat_SyS_preadv+0x3b/0x50 [ 26.614010] ? compat_SyS_preadv64+0x40/0x40 [ 26.618385] do_fast_syscall_32+0x3ee/0xf9d [ 26.622678] ? do_int80_syscall_32+0x9d0/0x9d0 [ 26.627227] ? kasan_check_read+0x11/0x20 [ 26.631353] ? syscall_return_slowpath+0x550/0x550 [ 26.636249] ? SyS_rt_sigaction+0x94/0x1b0 [ 26.640452] ? lockdep_sys_exit+0x47/0xf0 [ 26.644564] ? retint_user+0x18/0x18 [ 26.648264] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 26.653075] entry_SYSENTER_compat+0x51/0x60 [ 26.657447] RIP: 0023:0xf7f28c79 [ 26.660777] RSP: 002b:00000000fffb966c EFLAGS: 00000292 ORIG_RAX: 000000000000014d [ 26.668448] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000205e2ff0 [ 26.675682] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000010000 [ 26.682919] RBP: 0000000020d71fa0 R08: 0000000000000000 R09: 0000000000000000 [ 26.690154] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 26.697391] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 26.704669] Dumping ftrace buffer: [ 26.708176] (ftrace buffer empty) [ 26.711871] Kernel Offset: disabled [ 26.715475] Rebooting in 86400 seconds..