[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 26.884669] kauditd_printk_skb: 7 callbacks suppressed [ 26.884682] audit: type=1800 audit(1541382466.943:29): pid=5562 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 26.911200] audit: type=1800 audit(1541382466.953:30): pid=5562 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 34.240739] sshd (5701) used greatest stack depth: 15744 bytes left Warning: Permanently added '10.128.10.4' (ECDSA) to the list of known hosts. executing program [ 40.944024] BUG: pagefault on kernel address 0xffffc9000253f000 in non-whitelisted uaccess [ 40.952523] BUG: unable to handle kernel paging request at ffffc9000253f000 [ 40.959608] PGD 1da948067 P4D 1da948067 PUD 1da949067 PMD 1cb5b8067 PTE 0 [ 40.966527] Oops: 0000 [#1] PREEMPT SMP KASAN [ 40.971006] CPU: 1 PID: 5718 Comm: syz-executor504 Not tainted 4.19.0-next-20181102+ #104 [ 40.979298] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 40.988706] RIP: 0010:copy_user_enhanced_fast_string+0xe/0x20 [ 40.994584] Code: 89 d1 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 31 c0 0f 1f 00 c3 0f 1f 80 00 00 00 00 0f 1f 00 83 fa 40 0f 82 70 ff ff ff 89 d1 a4 31 c0 0f 1f 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 83 [ 41.013466] RSP: 0018:ffff8801d705f680 EFLAGS: 00010202 [ 41.018813] RAX: 0000000000000000 RBX: 000000000000ca80 RCX: 0000000000004a80 [ 41.026181] RDX: 000000000000ca80 RSI: ffffc9000253f000 RDI: 00000000200080c0 [ 41.033438] RBP: ffff8801d705f6b8 R08: 0000000000000000 R09: 000000000000032a [ 41.040696] R10: fffff520004a874f R11: ffffc90002543a7f R12: 000000002000cb40 [ 41.047951] R13: 00000000200000c0 R14: ffffc90002537000 R15: 00007ffffffff000 [ 41.055253] FS: 0000000002237880(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000 [ 41.063470] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.069335] CR2: ffffc9000253f000 CR3: 00000001d4c0d000 CR4: 00000000001406e0 [ 41.076589] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 41.083840] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 41.091088] Call Trace: [ 41.093664] ? _copy_to_user+0xf6/0x110 [ 41.097631] vidioc_g_fmt_vid_overlay+0x392/0x550 [ 41.102462] v4l_g_fmt+0x2ad/0x640 [ 41.105987] __video_do_ioctl+0x8b1/0x1050 [ 41.110210] ? v4l_s_fmt+0x990/0x990 [ 41.113911] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 41.119501] video_usercopy+0x5c1/0x1750 [ 41.123562] ? v4l_s_fmt+0x990/0x990 [ 41.127266] ? v4l_enumstd+0x70/0x70 [ 41.130962] ? rcu_softirq_qs+0x20/0x20 [ 41.134922] ? is_bpf_text_address+0xd3/0x170 [ 41.139522] ? __kernel_text_address+0xd/0x40 [ 41.144004] ? unwind_get_return_address+0x61/0xa0 [ 41.148927] ? __save_stack_trace+0x8d/0xf0 [ 41.153245] ? save_stack+0xa9/0xd0 [ 41.156854] ? save_stack+0x43/0xd0 [ 41.160464] ? __kasan_slab_free+0x102/0x150 [ 41.165024] ? kasan_slab_free+0xe/0x10 [ 41.168980] ? kmem_cache_free+0x83/0x290 [ 41.173109] ? putname+0xf2/0x130 [ 41.176545] ? __x64_sys_open+0x7e/0xc0 [ 41.180592] ? do_syscall_64+0x1b9/0x820 [ 41.184644] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 41.190000] ? trace_hardirqs_off+0xb8/0x310 [ 41.194392] ? kasan_check_read+0x11/0x20 [ 41.198629] ? do_raw_spin_unlock+0xa7/0x330 [ 41.203025] ? trace_hardirqs_on+0x310/0x310 [ 41.207530] ? video_usercopy+0x1750/0x1750 [ 41.211842] video_ioctl2+0x2c/0x33 [ 41.215480] v4l2_ioctl+0x154/0x1b0 [ 41.219103] ? video_devdata+0xa0/0xa0 [ 41.222978] do_vfs_ioctl+0x1de/0x1790 [ 41.226855] ? rcu_lockdep_current_cpu_online+0x1a4/0x210 [ 41.232375] ? ioctl_preallocate+0x300/0x300 [ 41.236769] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 41.242369] ? __fget_light+0x2e9/0x430 [ 41.246334] ? fget_raw+0x20/0x20 [ 41.249825] ? rcu_read_lock_sched_held+0x14f/0x180 [ 41.254830] ? kmem_cache_free+0x24f/0x290 [ 41.259170] ? putname+0xf7/0x130 [ 41.262611] ? do_syscall_64+0x9a/0x820 [ 41.266627] ? do_syscall_64+0x9a/0x820 [ 41.270597] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 41.275163] ? security_file_ioctl+0x94/0xc0 [ 41.279606] ksys_ioctl+0xa9/0xd0 [ 41.283060] __x64_sys_ioctl+0x73/0xb0 [ 41.286930] do_syscall_64+0x1b9/0x820 [ 41.290911] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 41.296261] ? syscall_return_slowpath+0x5e0/0x5e0 [ 41.301173] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 41.306103] ? trace_hardirqs_on_caller+0x310/0x310 [ 41.311145] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 41.316159] ? prepare_exit_to_usermode+0x291/0x3b0 [ 41.321202] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 41.326040] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 41.331212] RIP: 0033:0x443f49 [ 41.334386] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b d8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 41.353271] RSP: 002b:00007ffc9f5a4c28 EFLAGS: 00000217 ORIG_RAX: 0000000000000010 [ 41.360961] RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 0000000000443f49 [ 41.368210] RDX: 00000000200000c0 RSI: 00000000c0d05604 RDI: 0000000000000004 [ 41.375462] RBP: 00000000006ce018 R08: 00000000004002e0 R09: 00000000004002e0 [ 41.382712] R10: 00000000004002e0 R11: 0000000000000217 R12: 0000000000401c50 [ 41.389961] R13: 0000000000401ce0 R14: 0000000000000000 R15: 0000000000000000 [ 41.397213] Modules linked in: [ 41.400427] CR2: ffffc9000253f000 [ 41.403873] ---[ end trace f6cb8be7cd08d273 ]--- [ 41.408615] RIP: 0010:copy_user_enhanced_fast_string+0xe/0x20 [ 41.414480] Code: 89 d1 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 31 c0 0f 1f 00 c3 0f 1f 80 00 00 00 00 0f 1f 00 83 fa 40 0f 82 70 ff ff ff 89 d1 a4 31 c0 0f 1f 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 83 [ 41.433365] RSP: 0018:ffff8801d705f680 EFLAGS: 00010202 [ 41.438714] RAX: 0000000000000000 RBX: 000000000000ca80 RCX: 0000000000004a80 [ 41.445968] RDX: 000000000000ca80 RSI: ffffc9000253f000 RDI: 00000000200080c0 [ 41.453255] RBP: ffff8801d705f6b8 R08: 0000000000000000 R09: 000000000000032a [ 41.460515] R10: fffff520004a874f R11: ffffc90002543a7f R12: 000000002000cb40 [ 41.467767] R13: 00000000200000c0 R14: ffffc90002537000 R15: 00007ffffffff000 [ 41.475023] FS: 0000000002237880(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000 [ 41.483235] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.489097] CR2: ffffc9000253f000 CR3: 00000001d4c0d000 CR4: 00000000001406e0 [ 41.496349] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 41.503604] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 41.510858] Kernel panic - not syncing: Fatal exception [ 41.517075] Kernel Offset: disabled [ 41.520698] Rebooting in 86400 seconds..