[ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty1. [ OK ] Started Serial Getty on ttyS0. [ OK ] Started Getty on tty2. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.167' (ECDSA) to the list of known hosts. 2021/04/29 08:39:54 fuzzer started 2021/04/29 08:39:55 dialing manager at 10.128.0.169:44661 2021/04/29 08:39:55 syscalls: 3571 2021/04/29 08:39:55 code coverage: enabled 2021/04/29 08:39:55 comparison tracing: enabled 2021/04/29 08:39:55 extra coverage: enabled 2021/04/29 08:39:55 setuid sandbox: enabled 2021/04/29 08:39:55 namespace sandbox: enabled 2021/04/29 08:39:55 Android sandbox: /sys/fs/selinux/policy does not exist 2021/04/29 08:39:55 fault injection: enabled 2021/04/29 08:39:55 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2021/04/29 08:39:55 net packet injection: enabled 2021/04/29 08:39:55 net device setup: enabled 2021/04/29 08:39:55 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2021/04/29 08:39:55 devlink PCI setup: PCI device 0000:00:10.0 is not available 2021/04/29 08:39:55 USB emulation: enabled 2021/04/29 08:39:55 hci packet injection: enabled 2021/04/29 08:39:55 wifi device emulation: enabled 2021/04/29 08:39:55 802.15.4 emulation: enabled 2021/04/29 08:39:55 fetching corpus: 0, signal 0/2000 (executing program) 2021/04/29 08:39:55 fetching corpus: 50, signal 50844/54574 (executing program) 2021/04/29 08:39:56 fetching corpus: 100, signal 86353/91618 (executing program) 2021/04/29 08:39:56 fetching corpus: 150, signal 104019/110870 (executing program) 2021/04/29 08:39:56 fetching corpus: 200, signal 121312/129668 (executing program) 2021/04/29 08:39:57 fetching corpus: 250, signal 132769/142558 (executing program) 2021/04/29 08:39:57 fetching corpus: 300, signal 144057/155289 (executing program) 2021/04/29 08:39:57 fetching corpus: 350, signal 158376/170898 (executing program) syzkaller login: [ 73.239475][ T4868] ================================================================== [ 73.247823][ T4868] BUG: KASAN: user-memory-access in tomoyo_domain+0xee/0x150 [ 73.255210][ T4868] Write of size 4 at addr 00000000000010a2 by task systemd-udevd/4868 [ 73.263350][ T4868] [ 73.265664][ T4868] CPU: 0 PID: 4868 Comm: systemd-udevd Not tainted 5.12.0-rc8-next-20210423-syzkaller #0 [ 73.275464][ T4868] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 73.285528][ T4868] Call Trace: [ 73.288819][ T4868] dump_stack+0x141/0x1d7 [ 73.293161][ T4868] ? tomoyo_domain+0xee/0x150 [ 73.297829][ T4868] kasan_report.cold+0x5f/0xd8 [ 73.302602][ T4868] ? tomoyo_domain+0xee/0x150 [ 73.307278][ T4868] kasan_check_range+0x13d/0x180 [ 73.312300][ T4868] tomoyo_domain+0xee/0x150 [ 73.316821][ T4868] tomoyo_init_request_info+0x1e2/0x370 [ 73.322368][ T4868] tomoyo_path_number_perm+0x149/0x590 [ 73.327835][ T4868] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 73.333654][ T4868] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 73.339907][ T4868] ? d_alloc_parallel+0x965/0x1a20 [ 73.345035][ T4868] ? lock_downgrade+0x6e0/0x6e0 [ 73.349883][ T4868] ? find_held_lock+0x2d/0x110 [ 73.354747][ T4868] tomoyo_path_mknod+0x10d/0x190 [ 73.359819][ T4868] ? tomoyo_path_chown+0x1b0/0x1b0 [ 73.364939][ T4868] security_path_mknod+0xf9/0x170 [ 73.369985][ T4868] lookup_open.isra.0+0x475/0x13d0 [ 73.375900][ T4868] ? lookup_fast+0x6d0/0x6d0 [ 73.380496][ T4868] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 73.386735][ T4868] path_openat+0x9af/0x27d0 [ 73.391299][ T4868] ? path_lookupat+0x850/0x850 [ 73.396076][ T4868] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 73.402058][ T4868] do_filp_open+0x190/0x3d0 [ 73.406570][ T4868] ? may_open_dev+0xf0/0xf0 [ 73.411110][ T4868] ? rwlock_bug.part.0+0x90/0x90 [ 73.416043][ T4868] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 73.422285][ T4868] ? _find_next_bit+0x1e3/0x260 [ 73.427133][ T4868] ? _raw_spin_unlock+0x24/0x40 [ 73.432037][ T4868] ? alloc_fd+0x2f0/0x670 [ 73.436374][ T4868] do_sys_openat2+0x16d/0x420 [ 73.441050][ T4868] ? build_open_flags+0x6f0/0x6f0 [ 73.446064][ T4868] ? __context_tracking_exit+0xb8/0xe0 [ 73.451514][ T4868] __x64_sys_open+0x119/0x1c0 [ 73.456188][ T4868] ? do_sys_open+0x140/0x140 [ 73.460766][ T4868] ? __secure_computing+0x104/0x360 [ 73.465954][ T4868] do_syscall_64+0x3a/0xb0 [ 73.470359][ T4868] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 73.476239][ T4868] RIP: 0033:0x7fedf1482840 [ 73.480651][ T4868] Code: 73 01 c3 48 8b 0d 68 77 20 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 89 bb 20 00 00 75 10 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 1e f6 ff ff 48 89 04 24 [ 73.500615][ T4868] RSP: 002b:00007ffebb20d468 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 73.509064][ T4868] RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007fedf1482840 [ 73.517034][ T4868] RDX: 00000000000001a4 RSI: 0000000000080141 RDI: 00005588139d3369 [ 73.525007][ T4868] RBP: 00005588139d3369 R08: 80c0fefc00000000 R09: 0000000000000004 [ 73.532975][ T4868] R10: 8a619fd8edb7aa85 R11: 0000000000000246 R12: 00005588147b5010 [ 73.540949][ T4868] R13: 00000000fffffffe R14: 0000000000000000 R15: 0000000000000001 [ 73.548938][ T4868] ================================================================== [ 73.556990][ T4868] Disabling lock debugging due to kernel taint [ 73.586144][ T4868] Kernel panic - not syncing: panic_on_warn set ... [ 73.592778][ T4868] CPU: 0 PID: 4868 Comm: systemd-udevd Tainted: G B 5.12.0-rc8-next-20210423-syzkaller #0 [ 73.603976][ T4868] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 73.614024][ T4868] Call Trace: [ 73.617318][ T4868] dump_stack+0x141/0x1d7 [ 73.621643][ T4868] panic+0x306/0x73d [ 73.625529][ T4868] ? __warn_printk+0xf3/0xf3 [ 73.630127][ T4868] ? preempt_schedule_common+0x59/0xc0 [ 73.635585][ T4868] ? tomoyo_domain+0xee/0x150 [ 73.640249][ T4868] ? preempt_schedule_thunk+0x16/0x18 [ 73.645956][ T4868] ? trace_hardirqs_on+0x38/0x1c0 [ 73.650975][ T4868] ? trace_hardirqs_on+0x51/0x1c0 [ 73.655997][ T4868] ? tomoyo_domain+0xee/0x150 [ 73.660661][ T4868] ? tomoyo_domain+0xee/0x150 [ 73.665342][ T4868] end_report.cold+0x5a/0x5a [ 73.669921][ T4868] kasan_report.cold+0x6a/0xd8 [ 73.674682][ T4868] ? tomoyo_domain+0xee/0x150 [ 73.679360][ T4868] kasan_check_range+0x13d/0x180 [ 73.684280][ T4868] tomoyo_domain+0xee/0x150 [ 73.688767][ T4868] tomoyo_init_request_info+0x1e2/0x370 [ 73.694303][ T4868] tomoyo_path_number_perm+0x149/0x590 [ 73.699743][ T4868] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 73.705548][ T4868] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 73.711777][ T4868] ? d_alloc_parallel+0x965/0x1a20 [ 73.716897][ T4868] ? lock_downgrade+0x6e0/0x6e0 [ 73.721744][ T4868] ? find_held_lock+0x2d/0x110 [ 73.726494][ T4868] tomoyo_path_mknod+0x10d/0x190 [ 73.731602][ T4868] ? tomoyo_path_chown+0x1b0/0x1b0 [ 73.736697][ T4868] security_path_mknod+0xf9/0x170 [ 73.741708][ T4868] lookup_open.isra.0+0x475/0x13d0 [ 73.746805][ T4868] ? lookup_fast+0x6d0/0x6d0 [ 73.751394][ T4868] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 73.757623][ T4868] path_openat+0x9af/0x27d0 [ 73.762112][ T4868] ? path_lookupat+0x850/0x850 [ 73.766884][ T4868] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 73.772864][ T4868] do_filp_open+0x190/0x3d0 [ 73.777378][ T4868] ? may_open_dev+0xf0/0xf0 [ 73.781883][ T4868] ? rwlock_bug.part.0+0x90/0x90 [ 73.786816][ T4868] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 73.793044][ T4868] ? _find_next_bit+0x1e3/0x260 [ 73.797893][ T4868] ? _raw_spin_unlock+0x24/0x40 [ 73.802726][ T4868] ? alloc_fd+0x2f0/0x670 [ 73.807049][ T4868] do_sys_openat2+0x16d/0x420 [ 73.811712][ T4868] ? build_open_flags+0x6f0/0x6f0 [ 73.816732][ T4868] ? __context_tracking_exit+0xb8/0xe0 [ 73.822182][ T4868] __x64_sys_open+0x119/0x1c0 [ 73.826843][ T4868] ? do_sys_open+0x140/0x140 [ 73.831421][ T4868] ? __secure_computing+0x104/0x360 [ 73.836603][ T4868] do_syscall_64+0x3a/0xb0 [ 73.841008][ T4868] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 73.846896][ T4868] RIP: 0033:0x7fedf1482840 [ 73.851294][ T4868] Code: 73 01 c3 48 8b 0d 68 77 20 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 89 bb 20 00 00 75 10 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 1e f6 ff ff 48 89 04 24 [ 73.870912][ T4868] RSP: 002b:00007ffebb20d468 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 73.879330][ T4868] RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007fedf1482840 [ 73.888162][ T4868] RDX: 00000000000001a4 RSI: 0000000000080141 RDI: 00005588139d3369 [ 73.896124][ T4868] RBP: 00005588139d3369 R08: 80c0fefc00000000 R09: 0000000000000004 [ 73.904079][ T4868] R10: 8a619fd8edb7aa85 R11: 0000000000000246 R12: 00005588147b5010 [ 73.912049][ T4868] R13: 00000000fffffffe R14: 0000000000000000 R15: 0000000000000001 [ 73.920594][ T4868] Kernel Offset: disabled [ 73.924916][ T4868] Rebooting in 86400 seconds..