Warning: Permanently added '10.128.0.240' (ECDSA) to the list of known hosts. executing program [ 64.113926][ T6865] ================================================================== [ 64.122096][ T6865] BUG: KASAN: slab-out-of-bounds in qrtr_endpoint_post+0x5c1/0x1050 [ 64.130072][ T6865] Read of size 4294967294 at addr ffff88809bc15b50 by task syz-executor259/6865 [ 64.139061][ T6865] [ 64.141404][ T6865] CPU: 0 PID: 6865 Comm: syz-executor259 Not tainted 5.8.0-syzkaller #0 [ 64.149830][ T6865] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.159863][ T6865] Call Trace: [ 64.163138][ T6865] dump_stack+0x18f/0x20d [ 64.167446][ T6865] ? qrtr_endpoint_post+0x5c1/0x1050 [ 64.172702][ T6865] ? qrtr_endpoint_post+0x5c1/0x1050 [ 64.177967][ T6865] print_address_description.constprop.0.cold+0xae/0x497 [ 64.184969][ T6865] ? vprintk_func+0x97/0x1a6 [ 64.189536][ T6865] ? qrtr_endpoint_post+0x5c1/0x1050 [ 64.194793][ T6865] ? qrtr_endpoint_post+0x5c1/0x1050 [ 64.200053][ T6865] kasan_report.cold+0x1f/0x37 [ 64.204796][ T6865] ? qrtr_endpoint_post+0x5c1/0x1050 [ 64.210058][ T6865] check_memory_region+0x13d/0x180 [ 64.215145][ T6865] memcpy+0x20/0x60 [ 64.218927][ T6865] qrtr_endpoint_post+0x5c1/0x1050 [ 64.224019][ T6865] qrtr_tun_write_iter+0xf5/0x180 [ 64.229021][ T6865] new_sync_write+0x422/0x650 [ 64.233688][ T6865] ? new_sync_read+0x6e0/0x6e0 [ 64.238440][ T6865] ? rcu_read_lock_sched_held+0x3a/0xb0 [ 64.243967][ T6865] ? apparmor_file_permission+0x26e/0x4e0 [ 64.249675][ T6865] ? build_open_flags+0x650/0x650 [ 64.254766][ T6865] vfs_write+0x5ad/0x730 [ 64.258986][ T6865] ksys_write+0x12d/0x250 [ 64.263290][ T6865] ? __ia32_sys_read+0xb0/0xb0 [ 64.268032][ T6865] ? trace_hardirqs_on+0x5f/0x220 [ 64.273030][ T6865] ? lockdep_hardirqs_on+0x76/0xf0 [ 64.278129][ T6865] do_syscall_64+0x2d/0x70 [ 64.282533][ T6865] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 64.288400][ T6865] RIP: 0033:0x440259 [ 64.292269][ T6865] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 64.311864][ T6865] RSP: 002b:00007fffe46fe458 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 64.321476][ T6865] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440259 [ 64.329450][ T6865] RDX: 0000000000000010 RSI: 0000000020000040 RDI: 0000000000000003 [ 64.337412][ T6865] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 64.345371][ T6865] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a60 [ 64.353316][ T6865] R13: 0000000000401af0 R14: 0000000000000000 R15: 0000000000000000 [ 64.361267][ T6865] [ 64.363570][ T6865] Allocated by task 6865: [ 64.367876][ T6865] kasan_save_stack+0x1b/0x40 [ 64.372524][ T6865] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 64.378129][ T6865] __kmalloc+0x1a8/0x320 [ 64.382344][ T6865] qrtr_tun_write_iter+0x8a/0x180 [ 64.387343][ T6865] new_sync_write+0x422/0x650 [ 64.391990][ T6865] vfs_write+0x5ad/0x730 [ 64.396204][ T6865] ksys_write+0x12d/0x250 [ 64.400507][ T6865] do_syscall_64+0x2d/0x70 [ 64.405001][ T6865] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 64.410962][ T6865] [ 64.413266][ T6865] The buggy address belongs to the object at ffff88809bc15b40 [ 64.413266][ T6865] which belongs to the cache kmalloc-32 of size 32 [ 64.427122][ T6865] The buggy address is located 16 bytes inside of [ 64.427122][ T6865] 32-byte region [ffff88809bc15b40, ffff88809bc15b60) [ 64.440199][ T6865] The buggy address belongs to the page: [ 64.445822][ T6865] page:000000006ea67038 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88809bc15fc1 pfn:0x9bc15 [ 64.457328][ T6865] flags: 0xfffe0000000200(slab) [ 64.462241][ T6865] raw: 00fffe0000000200 ffffea00027558c8 ffff8880aa041240 ffff8880aa040100 [ 64.470806][ T6865] raw: ffff88809bc15fc1 ffff88809bc15000 000000010000003a 0000000000000000 [ 64.479359][ T6865] page dumped because: kasan: bad access detected [ 64.485754][ T6865] [ 64.488055][ T6865] Memory state around the buggy address: [ 64.493699][ T6865] ffff88809bc15a00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 64.501734][ T6865] ffff88809bc15a80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 64.509768][ T6865] >ffff88809bc15b00: fa fb fb fb fc fc fc fc 00 00 fc fc fc fc fc fc [ 64.517798][ T6865] ^ [ 64.524446][ T6865] ffff88809bc15b80: fb fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 64.532498][ T6865] ffff88809bc15c00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 64.540538][ T6865] ================================================================== [ 64.548577][ T6865] Disabling lock debugging due to kernel taint [ 64.563528][ T6865] Kernel panic - not syncing: panic_on_warn set ... [ 64.570138][ T6865] CPU: 0 PID: 6865 Comm: syz-executor259 Tainted: G B 5.8.0-syzkaller #0 [ 64.579835][ T6865] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.589863][ T6865] Call Trace: [ 64.593141][ T6865] dump_stack+0x18f/0x20d [ 64.597459][ T6865] ? qrtr_endpoint_post+0x530/0x1050 [ 64.602724][ T6865] panic+0x2e3/0x75c [ 64.606599][ T6865] ? __warn_printk+0xf3/0xf3 [ 64.611163][ T6865] ? preempt_schedule_common+0x59/0xc0 [ 64.616593][ T6865] ? qrtr_endpoint_post+0x5c1/0x1050 [ 64.621850][ T6865] ? preempt_schedule_thunk+0x16/0x18 [ 64.627199][ T6865] ? trace_hardirqs_on+0x55/0x220 [ 64.632197][ T6865] ? qrtr_endpoint_post+0x5c1/0x1050 [ 64.637453][ T6865] ? qrtr_endpoint_post+0x5c1/0x1050 [ 64.642709][ T6865] end_report+0x4d/0x53 [ 64.646839][ T6865] kasan_report.cold+0xd/0x37 [ 64.651488][ T6865] ? qrtr_endpoint_post+0x5c1/0x1050 [ 64.656744][ T6865] check_memory_region+0x13d/0x180 [ 64.661827][ T6865] memcpy+0x20/0x60 [ 64.665785][ T6865] qrtr_endpoint_post+0x5c1/0x1050 [ 64.670869][ T6865] qrtr_tun_write_iter+0xf5/0x180 [ 64.675956][ T6865] new_sync_write+0x422/0x650 [ 64.680605][ T6865] ? new_sync_read+0x6e0/0x6e0 [ 64.685357][ T6865] ? rcu_read_lock_sched_held+0x3a/0xb0 [ 64.690876][ T6865] ? apparmor_file_permission+0x26e/0x4e0 [ 64.696569][ T6865] ? build_open_flags+0x650/0x650 [ 64.701567][ T6865] vfs_write+0x5ad/0x730 [ 64.705787][ T6865] ksys_write+0x12d/0x250 [ 64.710092][ T6865] ? __ia32_sys_read+0xb0/0xb0 [ 64.714850][ T6865] ? trace_hardirqs_on+0x5f/0x220 [ 64.719862][ T6865] ? lockdep_hardirqs_on+0x76/0xf0 [ 64.724950][ T6865] do_syscall_64+0x2d/0x70 [ 64.729343][ T6865] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 64.735212][ T6865] RIP: 0033:0x440259 [ 64.739082][ T6865] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 64.758659][ T6865] RSP: 002b:00007fffe46fe458 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 64.767044][ T6865] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440259 [ 64.775051][ T6865] RDX: 0000000000000010 RSI: 0000000020000040 RDI: 0000000000000003 [ 64.782998][ T6865] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 64.790941][ T6865] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a60 [ 64.798888][ T6865] R13: 0000000000401af0 R14: 0000000000000000 R15: 0000000000000000 [ 64.808059][ T6865] Kernel Offset: disabled [ 64.812463][ T6865] Rebooting in 86400 seconds..