[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 80.063151][ T23] kauditd_printk_skb: 7 callbacks suppressed [ 80.063162][ T23] audit: type=1800 audit(1575335080.029:39): pid=9491 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 80.091461][ T23] audit: type=1800 audit(1575335080.029:40): pid=9491 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 82.871913][ T23] audit: type=1400 audit(1575335082.839:41): avc: denied { map } for pid=9667 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.10.50' (ECDSA) to the list of known hosts. executing program [ 89.482968][ T23] audit: type=1400 audit(1575335089.449:42): avc: denied { map } for pid=9679 comm="syz-executor391" path="/root/syz-executor391510458" dev="sda1" ino=16483 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 89.510713][ T9679] ================================================================== [ 89.510774][ T9679] BUG: KASAN: slab-out-of-bounds in vcs_scr_readw+0xc2/0xd0 [ 89.510786][ T9679] Read of size 2 at addr ffff8882192c52c0 by task syz-executor391/9679 [ 89.510790][ T9679] [ 89.510805][ T9679] CPU: 0 PID: 9679 Comm: syz-executor391 Not tainted 5.4.0-syzkaller #0 [ 89.510814][ T9679] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 89.510819][ T9679] Call Trace: [ 89.510836][ T9679] dump_stack+0x197/0x210 [ 89.510851][ T9679] ? vcs_scr_readw+0xc2/0xd0 [ 89.510871][ T9679] print_address_description.constprop.0.cold+0xd4/0x30b [ 89.510885][ T9679] ? vcs_scr_readw+0xc2/0xd0 [ 89.510913][ T9679] ? vcs_scr_readw+0xc2/0xd0 [ 89.510927][ T9679] __kasan_report.cold+0x1b/0x41 [ 89.510944][ T9679] ? vcs_write+0x400/0xcf0 [ 89.510955][ T9679] ? vcs_scr_readw+0xc2/0xd0 [ 89.510971][ T9679] kasan_report+0x12/0x20 [ 89.510986][ T9679] __asan_report_load2_noabort+0x14/0x20 [ 89.511000][ T9679] vcs_scr_readw+0xc2/0xd0 [ 89.511017][ T9679] vcs_write+0x646/0xcf0 [ 89.511031][ T9679] ? ___might_sleep+0x163/0x2c0 [ 89.511059][ T9679] ? vcs_size+0x250/0x250 [ 89.511072][ T9679] ? selinux_file_permission+0x9b/0x580 [ 89.511089][ T9679] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 89.511104][ T9679] ? security_file_permission+0x8f/0x380 [ 89.511117][ T9679] ? trace_hardirqs_on+0x67/0x240 [ 89.511135][ T9679] __vfs_write+0x8a/0x110 [ 89.511148][ T9679] ? vcs_size+0x250/0x250 [ 89.511164][ T9679] vfs_write+0x268/0x5d0 [ 89.511182][ T9679] ksys_write+0x14f/0x290 [ 89.511197][ T9679] ? __ia32_sys_read+0xb0/0xb0 [ 89.511214][ T9679] ? do_syscall_64+0x26/0x790 [ 89.511227][ T9679] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 89.511238][ T9679] ? do_syscall_64+0x26/0x790 [ 89.511253][ T9679] __x64_sys_write+0x73/0xb0 [ 89.511268][ T9679] do_syscall_64+0xfa/0x790 [ 89.511285][ T9679] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 89.511294][ T9679] RIP: 0033:0x444399 [ 89.511306][ T9679] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b d8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 89.511313][ T9679] RSP: 002b:00007ffe50ca6938 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 89.511324][ T9679] RAX: ffffffffffffffda RBX: 00007ffe50ca6940 RCX: 0000000000444399 [ 89.511330][ T9679] RDX: 00000000fffffecb RSI: 0000000020000300 RDI: 0000000000000003 [ 89.511338][ T9679] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000400c60 [ 89.511344][ T9679] R10: 00007ffe50ca6480 R11: 0000000000000246 R12: 00000000004020a0 [ 89.511350][ T9679] R13: 0000000000402130 R14: 0000000000000000 R15: 0000000000000000 [ 89.511366][ T9679] [ 89.511372][ T9679] Allocated by task 1: [ 89.511382][ T9679] save_stack+0x23/0x90 [ 89.511392][ T9679] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 89.511400][ T9679] kasan_kmalloc+0x9/0x10 [ 89.511410][ T9679] __kmalloc+0x163/0x770 [ 89.511421][ T9679] vc_do_resize+0x262/0x1460 [ 89.511433][ T9679] vc_resize+0x4d/0x60 [ 89.511454][ T9679] fbcon_init+0x122d/0x1a90 [ 89.511465][ T9679] visual_init+0x30a/0x5e0 [ 89.511478][ T9679] do_bind_con_driver+0x54c/0x8b0 [ 89.511487][ T9679] do_take_over_console+0x449/0x5a0 [ 89.511497][ T9679] do_fbcon_takeover+0x116/0x220 [ 89.511507][ T9679] fbcon_fb_registered+0x275/0x340 [ 89.511516][ T9679] register_framebuffer+0x5c3/0xa10 [ 89.511526][ T9679] vga16fb_probe+0x711/0x825 [ 89.511536][ T9679] platform_drv_probe+0x8d/0x140 [ 89.511549][ T9679] really_probe+0x291/0x710 [ 89.511560][ T9679] driver_probe_device+0x110/0x220 [ 89.511570][ T9679] __device_attach_driver+0x1c9/0x230 [ 89.511582][ T9679] bus_for_each_drv+0x172/0x1f0 [ 89.511592][ T9679] __device_attach+0x237/0x390 [ 89.511603][ T9679] device_initial_probe+0x1b/0x20 [ 89.511613][ T9679] bus_probe_device+0x1f1/0x2a0 [ 89.511623][ T9679] device_add+0x14fe/0x1d00 [ 89.511632][ T9679] platform_device_add+0x34d/0x6c0 [ 89.511644][ T9679] vga16fb_init+0x15f/0x1d6 [ 89.511655][ T9679] do_one_initcall+0x120/0x81a [ 89.511669][ T9679] kernel_init_freeable+0x4ca/0x5b9 [ 89.511683][ T9679] kernel_init+0x12/0x1bf [ 89.511692][ T9679] ret_from_fork+0x24/0x30 [ 89.511695][ T9679] [ 89.511701][ T9679] Freed by task 0: [ 89.511704][ T9679] (stack is not available) [ 89.511707][ T9679] [ 89.511717][ T9679] The buggy address belongs to the object at ffff8882192c4000 [ 89.511717][ T9679] which belongs to the cache kmalloc-8k of size 8192 [ 89.511727][ T9679] The buggy address is located 4800 bytes inside of [ 89.511727][ T9679] 8192-byte region [ffff8882192c4000, ffff8882192c6000) [ 89.511731][ T9679] The buggy address belongs to the page: [ 89.511745][ T9679] page:ffffea000864b100 refcount:1 mapcount:0 mapping:ffff8880aa4021c0 index:0x0 compound_mapcount: 0 [ 89.511761][ T9679] raw: 057ffe0000010200 ffffea000864ae08 ffffea000863fe08 ffff8880aa4021c0 [ 89.511775][ T9679] raw: 0000000000000000 ffff8882192c4000 0000000100000001 0000000000000000 [ 89.511781][ T9679] page dumped because: kasan: bad access detected [ 89.511785][ T9679] [ 89.511789][ T9679] Memory state around the buggy address: [ 89.511798][ T9679] ffff8882192c5180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 89.511807][ T9679] ffff8882192c5200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 89.511815][ T9679] >ffff8882192c5280: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 89.511819][ T9679] ^ [ 89.511825][ T9679] ffff8882192c5300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 89.511831][ T9679] ffff8882192c5380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 89.511834][ T9679] ================================================================== [ 89.511837][ T9679] Disabling lock debugging due to kernel taint [ 89.511848][ T9679] Kernel panic - not syncing: panic_on_warn set ... [ 89.511857][ T9679] CPU: 0 PID: 9679 Comm: syz-executor391 Tainted: G B 5.4.0-syzkaller #0 [ 89.511861][ T9679] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 89.511864][ T9679] Call Trace: [ 89.511873][ T9679] dump_stack+0x197/0x210 [ 89.511883][ T9679] panic+0x2e3/0x75c [ 89.511889][ T9679] ? add_taint.cold+0x16/0x16 [ 89.511898][ T9679] ? vcs_scr_readw+0xc2/0xd0 [ 89.511905][ T9679] ? preempt_schedule+0x4b/0x60 [ 89.511913][ T9679] ? ___preempt_schedule+0x16/0x18 [ 89.511922][ T9679] ? trace_hardirqs_on+0x5e/0x240 [ 89.511930][ T9679] ? vcs_scr_readw+0xc2/0xd0 [ 89.511937][ T9679] end_report+0x47/0x4f [ 89.511944][ T9679] ? vcs_scr_readw+0xc2/0xd0 [ 89.511951][ T9679] __kasan_report.cold+0xe/0x41 [ 89.511959][ T9679] ? vcs_write+0x400/0xcf0 [ 89.511966][ T9679] ? vcs_scr_readw+0xc2/0xd0 [ 89.511973][ T9679] kasan_report+0x12/0x20 [ 89.511981][ T9679] __asan_report_load2_noabort+0x14/0x20 [ 89.511988][ T9679] vcs_scr_readw+0xc2/0xd0 [ 89.511995][ T9679] vcs_write+0x646/0xcf0 [ 89.512003][ T9679] ? ___might_sleep+0x163/0x2c0 [ 89.512014][ T9679] ? vcs_size+0x250/0x250 [ 89.512022][ T9679] ? selinux_file_permission+0x9b/0x580 [ 89.512032][ T9679] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 89.512043][ T9679] ? security_file_permission+0x8f/0x380 [ 89.512052][ T9679] ? trace_hardirqs_on+0x67/0x240 [ 89.512061][ T9679] __vfs_write+0x8a/0x110 [ 89.512068][ T9679] ? vcs_size+0x250/0x250 [ 89.512075][ T9679] vfs_write+0x268/0x5d0 [ 89.512083][ T9679] ksys_write+0x14f/0x290 [ 89.512090][ T9679] ? __ia32_sys_read+0xb0/0xb0 [ 89.512098][ T9679] ? do_syscall_64+0x26/0x790 [ 89.512104][ T9679] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 89.512111][ T9679] ? do_syscall_64+0x26/0x790 [ 89.512119][ T9679] __x64_sys_write+0x73/0xb0 [ 89.512127][ T9679] do_syscall_64+0xfa/0x790 [ 89.512135][ T9679] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 89.512140][ T9679] RIP: 0033:0x444399 [ 89.512147][ T9679] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b d8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 89.512151][ T9679] RSP: 002b:00007ffe50ca6938 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 89.512158][ T9679] RAX: ffffffffffffffda RBX: 00007ffe50ca6940 RCX: 0000000000444399 [ 89.512162][ T9679] RDX: 00000000fffffecb RSI: 0000000020000300 RDI: 0000000000000003 [ 89.512167][ T9679] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000400c60 [ 89.512171][ T9679] R10: 00007ffe50ca6480 R11: 0000000000000246 R12: 00000000004020a0 [ 89.512175][ T9679] R13: 0000000000402130 R14: 0000000000000000 R15: 0000000000000000 [ 89.513707][ T9679] Kernel Offset: disabled [ 90.342017][ T9679] Rebooting in 86400 seconds..