[ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.61' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 34.001626] audit: type=1400 audit(1600905631.380:8): avc: denied { execmem } for pid=6352 comm="syz-executor041" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 34.014543] BFS-fs: bfs_fill_super(): loop0 is unclean, continuing [ 34.050894] ================================================================== [ 34.058362] BUG: KASAN: slab-out-of-bounds in find_first_zero_bit+0x84/0x90 [ 34.065850] Read of size 8 at addr ffff8880946f9140 by task syz-executor041/6352 [ 34.073457] [ 34.075082] CPU: 0 PID: 6352 Comm: syz-executor041 Not tainted 4.14.198-syzkaller #0 [ 34.082968] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 34.092308] Call Trace: [ 34.094873] dump_stack+0x1b2/0x283 [ 34.098477] print_address_description.cold+0x54/0x1d3 [ 34.103770] kasan_report_error.cold+0x8a/0x194 [ 34.108439] ? find_first_zero_bit+0x84/0x90 [ 34.112843] __asan_report_load8_noabort+0x68/0x70 [ 34.117751] ? do_raw_spin_unlock+0x160/0x220 [ 34.122244] ? find_first_zero_bit+0x84/0x90 [ 34.126657] find_first_zero_bit+0x84/0x90 [ 34.130871] bfs_create+0xfb/0x620 [ 34.134384] ? bfs_find_entry.part.0.constprop.0+0x370/0x370 [ 34.140174] ? bfs_link+0x220/0x220 [ 34.143798] lookup_open+0x77a/0x1750 [ 34.147593] ? vfs_mkdir+0x6e0/0x6e0 [ 34.151304] path_openat+0xe08/0x2970 [ 34.155084] ? path_lookupat+0x780/0x780 [ 34.159123] ? trace_hardirqs_on+0x10/0x10 [ 34.163350] do_filp_open+0x179/0x3c0 [ 34.167134] ? may_open_dev+0xe0/0xe0 [ 34.170921] ? lock_downgrade+0x740/0x740 [ 34.175155] ? do_raw_spin_unlock+0x164/0x220 [ 34.179632] ? _raw_spin_unlock+0x29/0x40 [ 34.183762] ? __alloc_fd+0x1be/0x490 [ 34.188142] do_sys_open+0x296/0x410 [ 34.191850] ? filp_open+0x60/0x60 [ 34.195383] ? __close_fd+0x159/0x230 [ 34.199161] ? do_syscall_64+0x4c/0x640 [ 34.203111] ? SyS_open+0x30/0x30 [ 34.206540] do_syscall_64+0x1d5/0x640 [ 34.210453] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 34.215735] RIP: 0033:0x444439 [ 34.218996] RSP: 002b:00007fffa43d6d88 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 34.226800] RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 0000000000444439 [ 34.234048] RDX: 00000000001015c2 RSI: 0000000020000440 RDI: ffffffffffffff9c [ 34.241302] RBP: 00000000006cf018 R08: 00007fff00000015 R09: 0000000000000000 [ 34.248564] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402020 [ 34.255898] R13: 00000000004020b0 R14: 0000000000000000 R15: 0000000000000000 [ 34.263149] [ 34.264750] Allocated by task 6352: [ 34.268369] kasan_kmalloc+0xeb/0x160 [ 34.272159] __kmalloc+0x15a/0x400 [ 34.275687] bfs_fill_super+0x3d5/0xd80 [ 34.279653] mount_bdev+0x2b3/0x360 [ 34.283265] mount_fs+0x92/0x2a0 [ 34.286627] vfs_kern_mount.part.0+0x5b/0x470 [ 34.291121] do_mount+0xe53/0x2a00 [ 34.294648] SyS_mount+0xa8/0x120 [ 34.298088] do_syscall_64+0x1d5/0x640 [ 34.302048] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 34.307221] [ 34.308830] Freed by task 4788: [ 34.312101] kasan_slab_free+0xc3/0x1a0 [ 34.316293] kfree+0xc9/0x250 [ 34.319383] security_context_to_sid_core+0x28a/0x3d0 [ 34.324556] selinux_inode_setsecurity+0x155/0x350 [ 34.329472] selinux_inode_notifysecctx+0x2b/0x50 [ 34.334304] security_inode_notifysecctx+0x76/0xb0 [ 34.339219] kernfs_refresh_inode+0x328/0x4a0 [ 34.343710] kernfs_iop_permission+0x59/0x90 [ 34.349416] __inode_permission+0x1f1/0x2f0 [ 34.353717] link_path_walk+0x86a/0x10a0 [ 34.357767] path_lookupat+0xcb/0x780 [ 34.361559] filename_lookup+0x18a/0x510 [ 34.365609] vfs_statx+0xd1/0x180 [ 34.369036] SyS_newlstat+0x83/0xe0 [ 34.372641] do_syscall_64+0x1d5/0x640 [ 34.376503] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 34.381662] [ 34.383276] The buggy address belongs to the object at ffff8880946f9140 [ 34.383276] which belongs to the cache kmalloc-32 of size 32 [ 34.396081] The buggy address is located 0 bytes inside of [ 34.396081] 32-byte region [ffff8880946f9140, ffff8880946f9160) [ 34.407718] The buggy address belongs to the page: [ 34.412658] page:ffffea000251be40 count:1 mapcount:0 mapping:ffff8880946f9000 index:0xffff8880946f9fc1 [ 34.422269] flags: 0xfffe0000000100(slab) [ 34.426408] raw: 00fffe0000000100 ffff8880946f9000 ffff8880946f9fc1 000000010000003f [ 34.434280] raw: ffffea000251ff60 ffffea000251d4a0 ffff88812fe501c0 0000000000000000 [ 34.442136] page dumped because: kasan: bad access detected [ 34.447870] [ 34.449482] Memory state around the buggy address: [ 34.454386] ffff8880946f9000: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 34.462154] ffff8880946f9080: fb fb fb fb fc fc fc fc 00 00 fc fc fc fc fc fc [ 34.469492] >ffff8880946f9100: 00 03 fc fc fc fc fc fc 07 fc fc fc fc fc fc fc [ 34.476859] ^ [ 34.482293] ffff8880946f9180: 00 03 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 34.489637] ffff8880946f9200: 00 03 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 34.497002] ================================================================== [ 34.504338] Disabling lock debugging due to kernel taint [ 34.510119] Kernel panic - not syncing: panic_on_warn set ... [ 34.510119] [ 34.517481] CPU: 0 PID: 6352 Comm: syz-executor041 Tainted: G B 4.14.198-syzkaller #0 [ 34.526568] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 34.535940] Call Trace: [ 34.547388] dump_stack+0x1b2/0x283 [ 34.550999] panic+0x1f9/0x42d [ 34.554176] ? add_taint.cold+0x16/0x16 [ 34.558136] ? ___preempt_schedule+0x16/0x18 [ 34.562620] kasan_end_report+0x43/0x49 [ 34.566570] kasan_report_error.cold+0xa7/0x194 [ 34.571218] ? find_first_zero_bit+0x84/0x90 [ 34.575611] __asan_report_load8_noabort+0x68/0x70 [ 34.580623] ? do_raw_spin_unlock+0x160/0x220 [ 34.585365] ? find_first_zero_bit+0x84/0x90 [ 34.590278] find_first_zero_bit+0x84/0x90 [ 34.594502] bfs_create+0xfb/0x620 [ 34.598025] ? bfs_find_entry.part.0.constprop.0+0x370/0x370 [ 34.603811] ? bfs_link+0x220/0x220 [ 34.607417] lookup_open+0x77a/0x1750 [ 34.611207] ? vfs_mkdir+0x6e0/0x6e0 [ 34.614897] path_openat+0xe08/0x2970 [ 34.618705] ? path_lookupat+0x780/0x780 [ 34.622760] ? trace_hardirqs_on+0x10/0x10 [ 34.626973] do_filp_open+0x179/0x3c0 [ 34.630769] ? may_open_dev+0xe0/0xe0 [ 34.634548] ? lock_downgrade+0x740/0x740 [ 34.638703] ? do_raw_spin_unlock+0x164/0x220 [ 34.643178] ? _raw_spin_unlock+0x29/0x40 [ 34.647315] ? __alloc_fd+0x1be/0x490 [ 34.651112] do_sys_open+0x296/0x410 [ 34.654813] ? filp_open+0x60/0x60 [ 34.658348] ? __close_fd+0x159/0x230 [ 34.663516] ? do_syscall_64+0x4c/0x640 [ 34.667464] ? SyS_open+0x30/0x30 [ 34.670911] do_syscall_64+0x1d5/0x640 [ 34.674779] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 34.679942] RIP: 0033:0x444439 [ 34.683106] RSP: 002b:00007fffa43d6d88 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 34.690786] RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 0000000000444439 [ 34.698473] RDX: 00000000001015c2 RSI: 0000000020000440 RDI: ffffffffffffff9c [ 34.705731] RBP: 00000000006cf018 R08: 00007fff00000015 R09: 0000000000000000 [ 34.712974] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402020 [ 34.720216] R13: 00000000004020b0 R14: 0000000000000000 R15: 0000000000000000 [ 34.728533] Kernel Offset: disabled [ 34.732174] Rebooting in 86400 seconds..