[ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Getty on tty1. [ OK ] Started Serial Getty on ttyS0. [ OK ] Started getty on tty2-tty6 if dbus and logind are not available. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.243' (ECDSA) to the list of known hosts. syzkaller login: [ 59.833767][ T6808] IPVS: ftp: loaded support on port[0] = 21 [ 59.834038][ T6807] IPVS: ftp: loaded support on port[0] = 21 [ 59.845324][ T6810] IPVS: ftp: loaded support on port[0] = 21 [ 59.862370][ T6809] IPVS: ftp: loaded support on port[0] = 21 [ 59.870213][ T6805] IPVS: ftp: loaded support on port[0] = 21 [ 59.878928][ T6802] IPVS: ftp: loaded support on port[0] = 21 executing program executing program executing program [ 59.997632][ T6881] netlink: 'syz-executor184': attribute type 3 has an invalid length. [ 60.007781][ T6881] netlink: 'syz-executor184': attribute type 8 has an invalid length. [ 60.039433][ T6902] netlink: 'syz-executor184': attribute type 3 has an invalid length. [ 60.044071][ T6894] netlink: 'syz-executor184': attribute type 3 has an invalid length. [ 60.049344][ T6902] netlink: 'syz-executor184': attribute type 8 has an invalid length. [ 60.063277][ T6881] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor184'. [ 60.069283][ T6902] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor184'. [ 60.078369][ T6894] netlink: 'syz-executor184': attribute type 8 has an invalid length. executing program executing program executing program executing program executing program [ 60.121805][ T6894] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor184'. [ 60.132011][ T6930] netlink: 'syz-executor184': attribute type 3 has an invalid length. [ 60.136725][ T6937] netlink: 'syz-executor184': attribute type 3 has an invalid length. [ 60.147898][ T6931] netlink: 'syz-executor184': attribute type 3 has an invalid length. [ 60.149283][ T6937] netlink: 'syz-executor184': attribute type 8 has an invalid length. executing program executing program [ 60.159230][ T6932] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor184'. [ 60.168631][ T6937] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor184'. [ 60.176357][ T6938] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor184'. [ 60.194943][ T6930] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor184'. [ 60.197224][ T6939] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor184'. executing program executing program executing program executing program [ 60.209295][ T6931] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor184'. [ 60.226241][ T6942] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor184'. [ 60.238538][ T6938] ================================================================== [ 60.246802][ T6938] BUG: KASAN: vmalloc-out-of-bounds in nl802154_dump_wpan_phy+0x98e/0x9c0 [ 60.255304][ T6938] Read of size 4 at addr ffffc90002057018 by task syz-executor184/6938 [ 60.263621][ T6938] executing program [ 60.265947][ T6938] CPU: 0 PID: 6938 Comm: syz-executor184 Not tainted 5.8.0-rc2-syzkaller #0 [ 60.274609][ T6938] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 60.284648][ T6938] Call Trace: [ 60.287927][ T6938] dump_stack+0x18f/0x20d [ 60.292247][ T6938] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 60.297805][ T6938] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 60.304307][ T6938] print_address_description.constprop.0.cold+0x5/0x436 [ 60.311242][ T6938] ? check_preemption_disabled+0x38/0x220 [ 60.316968][ T6938] ? vprintk_func+0x97/0x1a6 [ 60.321557][ T6938] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 60.327140][ T6938] kasan_report.cold+0x1f/0x37 [ 60.331932][ T6938] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 60.337473][ T6938] nl802154_dump_wpan_phy+0x98e/0x9c0 [ 60.342833][ T6938] ? kmem_cache_alloc_node_trace+0x3b0/0x400 [ 60.348812][ T6938] ? __kmalloc_node_track_caller+0x38/0x60 [ 60.354615][ T6938] ? nl802154_send_wpan_phy.constprop.0+0x21d0/0x21d0 [ 60.361380][ T6938] ? __phys_addr+0x9a/0x110 [ 60.365913][ T6938] ? memset+0x20/0x40 [ 60.369888][ T6938] genl_lock_dumpit+0x7f/0xb0 [ 60.374568][ T6938] netlink_dump+0x4cd/0xf60 [ 60.379081][ T6938] ? netlink_insert+0x1670/0x1670 [ 60.384105][ T6938] ? __mutex_unlock_slowpath+0xe2/0x610 [ 60.389661][ T6938] ? genl_start+0x45a/0x6e0 [ 60.394177][ T6938] __netlink_dump_start+0x643/0x900 [ 60.399363][ T6938] ? genl_rcv_msg+0x9e0/0x9e0 [ 60.404027][ T6938] ? nl802154_send_wpan_phy.constprop.0+0x21d0/0x21d0 [ 60.410785][ T6938] genl_family_rcv_msg_dumpit+0x2ac/0x310 [ 60.416485][ T6938] ? genl_rcv+0x40/0x40 [ 60.420620][ T6938] ? mutex_lock_io_nested+0xf60/0xf60 [ 60.425995][ T6938] ? mark_lock+0xbc/0x1710 [ 60.430409][ T6938] ? genl_rcv_msg+0x9e0/0x9e0 [ 60.435088][ T6938] ? genl_unlock+0x20/0x20 [ 60.439495][ T6938] ? genl_parallel_done+0x170/0x170 [ 60.444715][ T6938] ? __radix_tree_lookup+0x1f3/0x290 [ 60.449993][ T6938] genl_rcv_msg+0x797/0x9e0 [ 60.454493][ T6938] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 60.461417][ T6938] ? lock_acquire+0x1f1/0xad0 [ 60.466077][ T6938] ? genl_rcv+0x15/0x40 [ 60.470218][ T6938] ? lock_release+0x8d0/0x8d0 [ 60.474888][ T6938] netlink_rcv_skb+0x15a/0x430 [ 60.479645][ T6938] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 60.486582][ T6938] ? netlink_ack+0xa10/0xa10 [ 60.491170][ T6938] genl_rcv+0x24/0x40 [ 60.495170][ T6938] netlink_unicast+0x533/0x7d0 [ 60.499981][ T6938] ? netlink_attachskb+0x810/0x810 [ 60.505098][ T6938] ? _copy_from_iter_full+0x247/0x890 [ 60.510502][ T6938] ? __phys_addr_symbol+0x2c/0x70 [ 60.515532][ T6938] ? __check_object_size+0x171/0x3e4 [ 60.520947][ T6938] netlink_sendmsg+0x856/0xd90 [ 60.525714][ T6938] ? netlink_unicast+0x7d0/0x7d0 [ 60.530651][ T6938] ? netlink_unicast+0x7d0/0x7d0 [ 60.535571][ T6938] sock_sendmsg+0xcf/0x120 [ 60.539982][ T6938] ____sys_sendmsg+0x6e8/0x810 [ 60.544746][ T6938] ? kernel_sendmsg+0x50/0x50 [ 60.549413][ T6938] ? do_recvmmsg+0x6d0/0x6d0 [ 60.553983][ T6938] ? release_pages+0x641/0x17a0 [ 60.558830][ T6938] ___sys_sendmsg+0xf3/0x170 [ 60.563407][ T6938] ? sendmsg_copy_msghdr+0x160/0x160 [ 60.568717][ T6938] ? do_huge_pmd_anonymous_page+0x1b94/0x2230 [ 60.574785][ T6938] ? check_preemption_disabled+0x38/0x220 [ 60.580507][ T6938] ? do_huge_pmd_anonymous_page+0x8ef/0x2230 [ 60.586495][ T6938] ? handle_mm_fault+0xad9/0x4420 [ 60.591538][ T6938] ? __fget_light+0x215/0x280 [ 60.596226][ T6938] __sys_sendmsg+0xe5/0x1b0 [ 60.600746][ T6938] ? __sys_sendmsg_sock+0xb0/0xb0 [ 60.605772][ T6938] ? check_preemption_disabled+0x38/0x220 [ 60.611483][ T6938] ? do_syscall_64+0x1c/0xe0 [ 60.616072][ T6938] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 60.622067][ T6938] do_syscall_64+0x60/0xe0 [ 60.626471][ T6938] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 60.632343][ T6938] RIP: 0033:0x441409 [ 60.636217][ T6938] Code: Bad RIP value. [ 60.640274][ T6938] RSP: 002b:00007ffee48f55c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 60.648683][ T6938] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441409 [ 60.656634][ T6938] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003 [ 60.664589][ T6938] RBP: 00000000006cc018 R08: 0000000120080522 R09: 0000000120080522 [ 60.672559][ T6938] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000402220 [ 60.680533][ T6938] R13: 00000000004022b0 R14: 0000000000000000 R15: 0000000000000000 [ 60.688528][ T6938] [ 60.690852][ T6938] [ 60.693173][ T6938] Memory state around the buggy address: [ 60.698804][ T6938] ffffc90002056f00: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 60.706874][ T6938] ffffc90002056f80: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 60.714940][ T6938] >ffffc90002057000: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 60.722991][ T6938] ^ [ 60.727823][ T6938] ffffc90002057080: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 60.735873][ T6938] ffffc90002057100: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 60.743943][ T6938] ================================================================== [ 60.751990][ T6938] Disabling lock debugging due to kernel taint [ 60.762880][ T6938] Kernel panic - not syncing: panic_on_warn set ... [ 60.769486][ T6938] CPU: 0 PID: 6938 Comm: syz-executor184 Tainted: G B 5.8.0-rc2-syzkaller #0 [ 60.779538][ T6938] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 60.789588][ T6938] Call Trace: [ 60.792886][ T6938] dump_stack+0x18f/0x20d [ 60.797241][ T6938] ? nl802154_dump_wpan_phy+0x900/0x9c0 [ 60.802811][ T6938] panic+0x2e3/0x75c [ 60.806704][ T6938] ? __warn_printk+0xf3/0xf3 [ 60.811314][ T6938] ? preempt_schedule_common+0x59/0xc0 [ 60.816781][ T6938] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 60.822310][ T6938] ? preempt_schedule_thunk+0x16/0x18 [ 60.827680][ T6938] ? trace_hardirqs_on+0x55/0x220 [ 60.832697][ T6938] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 60.838224][ T6938] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 60.843760][ T6938] end_report+0x4d/0x53 [ 60.847914][ T6938] kasan_report.cold+0xd/0x37 [ 60.852593][ T6938] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 60.858141][ T6938] nl802154_dump_wpan_phy+0x98e/0x9c0 [ 60.863518][ T6938] ? kmem_cache_alloc_node_trace+0x3b0/0x400 [ 60.869492][ T6938] ? __kmalloc_node_track_caller+0x38/0x60 [ 60.875294][ T6938] ? nl802154_send_wpan_phy.constprop.0+0x21d0/0x21d0 [ 60.882082][ T6938] ? __phys_addr+0x9a/0x110 [ 60.886612][ T6938] ? memset+0x20/0x40 [ 60.890586][ T6938] genl_lock_dumpit+0x7f/0xb0 [ 60.895289][ T6938] netlink_dump+0x4cd/0xf60 [ 60.899809][ T6938] ? netlink_insert+0x1670/0x1670 [ 60.904851][ T6938] ? __mutex_unlock_slowpath+0xe2/0x610 [ 60.910377][ T6938] ? genl_start+0x45a/0x6e0 [ 60.914860][ T6938] __netlink_dump_start+0x643/0x900 [ 60.920044][ T6938] ? genl_rcv_msg+0x9e0/0x9e0 [ 60.924701][ T6938] ? nl802154_send_wpan_phy.constprop.0+0x21d0/0x21d0 [ 60.931455][ T6938] genl_family_rcv_msg_dumpit+0x2ac/0x310 [ 60.937176][ T6938] ? genl_rcv+0x40/0x40 [ 60.941320][ T6938] ? mutex_lock_io_nested+0xf60/0xf60 [ 60.946788][ T6938] ? mark_lock+0xbc/0x1710 [ 60.951180][ T6938] ? genl_rcv_msg+0x9e0/0x9e0 [ 60.955832][ T6938] ? genl_unlock+0x20/0x20 [ 60.960239][ T6938] ? genl_parallel_done+0x170/0x170 [ 60.965429][ T6938] ? __radix_tree_lookup+0x1f3/0x290 [ 60.970706][ T6938] genl_rcv_msg+0x797/0x9e0 [ 60.975206][ T6938] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 60.982130][ T6938] ? lock_acquire+0x1f1/0xad0 [ 60.986795][ T6938] ? genl_rcv+0x15/0x40 [ 60.990942][ T6938] ? lock_release+0x8d0/0x8d0 [ 60.995610][ T6938] netlink_rcv_skb+0x15a/0x430 [ 61.000352][ T6938] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 61.007277][ T6938] ? netlink_ack+0xa10/0xa10 [ 61.011847][ T6938] genl_rcv+0x24/0x40 [ 61.015803][ T6938] netlink_unicast+0x533/0x7d0 [ 61.020546][ T6938] ? netlink_attachskb+0x810/0x810 [ 61.025635][ T6938] ? _copy_from_iter_full+0x247/0x890 [ 61.031008][ T6938] ? __phys_addr_symbol+0x2c/0x70 [ 61.036035][ T6938] ? __check_object_size+0x171/0x3e4 [ 61.041298][ T6938] netlink_sendmsg+0x856/0xd90 [ 61.046040][ T6938] ? netlink_unicast+0x7d0/0x7d0 [ 61.050957][ T6938] ? netlink_unicast+0x7d0/0x7d0 [ 61.055893][ T6938] sock_sendmsg+0xcf/0x120 [ 61.060285][ T6938] ____sys_sendmsg+0x6e8/0x810 [ 61.065038][ T6938] ? kernel_sendmsg+0x50/0x50 [ 61.069690][ T6938] ? do_recvmmsg+0x6d0/0x6d0 [ 61.074266][ T6938] ? release_pages+0x641/0x17a0 [ 61.079113][ T6938] ___sys_sendmsg+0xf3/0x170 [ 61.083731][ T6938] ? sendmsg_copy_msghdr+0x160/0x160 [ 61.089029][ T6938] ? do_huge_pmd_anonymous_page+0x1b94/0x2230 [ 61.095087][ T6938] ? check_preemption_disabled+0x38/0x220 [ 61.100788][ T6938] ? do_huge_pmd_anonymous_page+0x8ef/0x2230 [ 61.106761][ T6938] ? handle_mm_fault+0xad9/0x4420 [ 61.111803][ T6938] ? __fget_light+0x215/0x280 [ 61.116478][ T6938] __sys_sendmsg+0xe5/0x1b0 [ 61.120959][ T6938] ? __sys_sendmsg_sock+0xb0/0xb0 [ 61.125980][ T6938] ? check_preemption_disabled+0x38/0x220 [ 61.131699][ T6938] ? do_syscall_64+0x1c/0xe0 [ 61.136269][ T6938] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 61.142231][ T6938] do_syscall_64+0x60/0xe0 [ 61.146630][ T6938] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 61.152506][ T6938] RIP: 0033:0x441409 [ 61.156378][ T6938] Code: Bad RIP value. [ 61.160436][ T6938] RSP: 002b:00007ffee48f55c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 61.168834][ T6938] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441409 [ 61.176790][ T6938] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003 [ 61.184736][ T6938] RBP: 00000000006cc018 R08: 0000000120080522 R09: 0000000120080522 [ 61.192758][ T6938] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000402220 [ 61.200733][ T6938] R13: 00000000004022b0 R14: 0000000000000000 R15: 0000000000000000 [ 61.209754][ T6938] Kernel Offset: disabled [ 61.214068][ T6938] Rebooting in 86400 seconds..