[ OK ] Started Getty on tty1. [ OK ] Started Serial Getty on ttyS0. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started getty on tty2-tty6 if dbus and logind are not available. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.249' (ECDSA) to the list of known hosts. 2021/12/03 23:55:41 fuzzer started 2021/12/03 23:55:41 connecting to host at 10.128.0.169:36019 2021/12/03 23:55:41 checking machine... 2021/12/03 23:55:41 checking revisions... 2021/12/03 23:55:41 testing simple program... syzkaller login: [ 70.714990][ T6494] cgroup: Unknown subsys name 'net' [ 70.721799][ T6494] [ 70.724151][ T6494] ========================= [ 70.728632][ T6494] WARNING: held lock freed! [ 70.733113][ T6494] 5.16.0-rc3-next-20211203-syzkaller #0 Not tainted [ 70.739679][ T6494] ------------------------- [ 70.744160][ T6494] syz-executor/6494 is freeing memory ffff88801872f800-ffff88801872f9ff, with a lock still held there! [ 70.755959][ T6494] ffff88801872f948 (&root->kernfs_rwsem){++++}-{3:3}, at: kernfs_destroy_root+0x81/0xb0 [ 70.765687][ T6494] 2 locks held by syz-executor/6494: [ 70.770953][ T6494] #0: ffffffff8bbc4e48 (cgroup_mutex){+.+.}-{3:3}, at: cgroup_lock_and_drain_offline+0xa5/0x900 [ 70.781603][ T6494] #1: ffff88801872f948 (&root->kernfs_rwsem){++++}-{3:3}, at: kernfs_destroy_root+0x81/0xb0 [ 70.791794][ T6494] [ 70.791794][ T6494] stack backtrace: [ 70.797664][ T6494] CPU: 1 PID: 6494 Comm: syz-executor Not tainted 5.16.0-rc3-next-20211203-syzkaller #0 [ 70.807453][ T6494] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 70.817634][ T6494] Call Trace: [ 70.820919][ T6494] [ 70.823840][ T6494] dump_stack_lvl+0xcd/0x134 [ 70.828441][ T6494] debug_check_no_locks_freed.cold+0x9d/0xa9 [ 70.834427][ T6494] ? lockdep_hardirqs_on+0x79/0x100 [ 70.839626][ T6494] slab_free_freelist_hook+0x73/0x1c0 [ 70.844993][ T6494] ? kernfs_put.part.0+0x331/0x540 [ 70.850097][ T6494] kfree+0xd0/0x4b0 [ 70.854006][ T6494] ? kmem_cache_free+0xdd/0x580 [ 70.858854][ T6494] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 70.865094][ T6494] kernfs_put.part.0+0x331/0x540 [ 70.870026][ T6494] kernfs_put+0x42/0x50 [ 70.874179][ T6494] __kernfs_remove+0x7a3/0xb20 [ 70.878936][ T6494] ? kernfs_next_descendant_post+0x2f0/0x2f0 [ 70.884993][ T6494] ? down_write+0xde/0x150 [ 70.889498][ T6494] ? down_write_killable_nested+0x180/0x180 [ 70.895395][ T6494] kernfs_destroy_root+0x89/0xb0 [ 70.900505][ T6494] cgroup_setup_root+0x3a6/0xad0 [ 70.905438][ T6494] ? rebind_subsystems+0x10e0/0x10e0 [ 70.910730][ T6494] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 70.917054][ T6494] cgroup1_get_tree+0xd33/0x1390 [ 70.922034][ T6494] vfs_get_tree+0x89/0x2f0 [ 70.926448][ T6494] path_mount+0x1320/0x1fa0 [ 70.930951][ T6494] ? kmem_cache_free+0xdd/0x580 [ 70.935798][ T6494] ? finish_automount+0xaf0/0xaf0 [ 70.940999][ T6494] ? putname+0xfe/0x140 [ 70.945237][ T6494] __x64_sys_mount+0x27f/0x300 [ 70.949996][ T6494] ? copy_mnt_ns+0xae0/0xae0 [ 70.954579][ T6494] ? syscall_enter_from_user_mode+0x21/0x70 [ 70.960556][ T6494] do_syscall_64+0x35/0xb0 [ 70.965054][ T6494] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 70.970943][ T6494] RIP: 0033:0x7f22e12cb01a [ 70.975367][ T6494] Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 70.995325][ T6494] RSP: 002b:00007fff087bfc18 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 71.003727][ T6494] RAX: ffffffffffffffda RBX: 00007fff087bfda8 RCX: 00007f22e12cb01a [ 71.011863][ T6494] RDX: 00007f22e132e051 RSI: 00007f22e1324324 RDI: 00007f22e1322dc9 [ 71.019827][ T6494] RBP: 00007f22e1324324 R08: 00007f22e1324481 R09: 0000000000000026 [ 71.027874][ T6494] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff087bfc20 [ 71.035830][ T6494] R13: 00007fff087bfdc8 R14: 00007fff087bfcf0 R15: 00007f22e132447b [ 71.043794][ T6494] [ 71.051958][ T6494] ================================================================== [ 71.060149][ T6494] BUG: KASAN: use-after-free in up_write+0x3ac/0x470 [ 71.066833][ T6494] Read of size 8 at addr ffff88801872f940 by task syz-executor/6494 [ 71.075858][ T6494] [ 71.078220][ T6494] CPU: 0 PID: 6494 Comm: syz-executor Not tainted 5.16.0-rc3-next-20211203-syzkaller #0 [ 71.088723][ T6494] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 71.099057][ T6494] Call Trace: [ 71.102327][ T6494] [ 71.105313][ T6494] dump_stack_lvl+0xcd/0x134 [ 71.110186][ T6494] print_address_description.constprop.0.cold+0xa5/0x3ed [ 71.117206][ T6494] ? up_write+0x3ac/0x470 [ 71.121622][ T6494] ? up_write+0x3ac/0x470 [ 71.125964][ T6494] kasan_report.cold+0x83/0xdf [ 71.130722][ T6494] ? up_write+0x3ac/0x470 [ 71.135052][ T6494] up_write+0x3ac/0x470 [ 71.139203][ T6494] cgroup_setup_root+0x3a6/0xad0 [ 71.144137][ T6494] ? rebind_subsystems+0x10e0/0x10e0 [ 71.149417][ T6494] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 71.155671][ T6494] cgroup1_get_tree+0xd33/0x1390 [ 71.160689][ T6494] vfs_get_tree+0x89/0x2f0 [ 71.165100][ T6494] path_mount+0x1320/0x1fa0 [ 71.169630][ T6494] ? kmem_cache_free+0xdd/0x580 [ 71.174476][ T6494] ? finish_automount+0xaf0/0xaf0 [ 71.179681][ T6494] ? putname+0xfe/0x140 [ 71.184112][ T6494] __x64_sys_mount+0x27f/0x300 [ 71.188882][ T6494] ? copy_mnt_ns+0xae0/0xae0 [ 71.193465][ T6494] ? syscall_enter_from_user_mode+0x21/0x70 [ 71.199354][ T6494] do_syscall_64+0x35/0xb0 [ 71.203760][ T6494] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 71.209644][ T6494] RIP: 0033:0x7f22e12cb01a [ 71.214223][ T6494] Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 71.233909][ T6494] RSP: 002b:00007fff087bfc18 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 71.242306][ T6494] RAX: ffffffffffffffda RBX: 00007fff087bfda8 RCX: 00007f22e12cb01a [ 71.250436][ T6494] RDX: 00007f22e132e051 RSI: 00007f22e1324324 RDI: 00007f22e1322dc9 [ 71.258390][ T6494] RBP: 00007f22e1324324 R08: 00007f22e1324481 R09: 0000000000000026 [ 71.266398][ T6494] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff087bfc20 [ 71.274384][ T6494] R13: 00007fff087bfdc8 R14: 00007fff087bfcf0 R15: 00007f22e132447b [ 71.282344][ T6494] [ 71.285607][ T6494] [ 71.287929][ T6494] Allocated by task 6494: [ 71.292320][ T6494] kasan_save_stack+0x1e/0x40 [ 71.296998][ T6494] __kasan_kmalloc+0xa9/0xd0 [ 71.301686][ T6494] kernfs_create_root+0x4c/0x410 [ 71.306632][ T6494] cgroup_setup_root+0x243/0xad0 [ 71.311566][ T6494] cgroup1_get_tree+0xd33/0x1390 [ 71.316489][ T6494] vfs_get_tree+0x89/0x2f0 [ 71.320901][ T6494] path_mount+0x1320/0x1fa0 [ 71.325404][ T6494] __x64_sys_mount+0x27f/0x300 [ 71.330159][ T6494] do_syscall_64+0x35/0xb0 [ 71.334578][ T6494] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 71.340461][ T6494] [ 71.342796][ T6494] Freed by task 6494: [ 71.346756][ T6494] kasan_save_stack+0x1e/0x40 [ 71.351606][ T6494] kasan_set_track+0x21/0x30 [ 71.356369][ T6494] kasan_set_free_info+0x20/0x30 [ 71.361293][ T6494] ____kasan_slab_free+0x166/0x1a0 [ 71.366406][ T6494] slab_free_freelist_hook+0x8b/0x1c0 [ 71.371771][ T6494] kfree+0xd0/0x4b0 [ 71.375573][ T6494] kernfs_put.part.0+0x331/0x540 [ 71.380525][ T6494] kernfs_put+0x42/0x50 [ 71.384666][ T6494] __kernfs_remove+0x7a3/0xb20 [ 71.389418][ T6494] kernfs_destroy_root+0x89/0xb0 [ 71.394440][ T6494] cgroup_setup_root+0x3a6/0xad0 [ 71.399375][ T6494] cgroup1_get_tree+0xd33/0x1390 [ 71.404311][ T6494] vfs_get_tree+0x89/0x2f0 [ 71.408716][ T6494] path_mount+0x1320/0x1fa0 [ 71.413208][ T6494] __x64_sys_mount+0x27f/0x300 [ 71.417959][ T6494] do_syscall_64+0x35/0xb0 [ 71.422452][ T6494] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 71.428332][ T6494] [ 71.430646][ T6494] The buggy address belongs to the object at ffff88801872f800 [ 71.430646][ T6494] which belongs to the cache kmalloc-512 of size 512 [ 71.445211][ T6494] The buggy address is located 320 bytes inside of [ 71.445211][ T6494] 512-byte region [ffff88801872f800, ffff88801872fa00) [ 71.458472][ T6494] The buggy address belongs to the page: [ 71.464079][ T6494] page:ffffea000061cb00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1872c [ 71.474481][ T6494] head:ffffea000061cb00 order:2 compound_mapcount:0 compound_pincount:0 [ 71.482786][ T6494] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 71.490947][ T6494] raw: 00fff00000010200 ffffea00008af700 dead000000000002 ffff888010c41c80 [ 71.499516][ T6494] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 71.508187][ T6494] page dumped because: kasan: bad access detected [ 71.514697][ T6494] page_owner tracks the page as allocated [ 71.520408][ T6494] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 243, ts 7525668115, free_ts 0 [ 71.538542][ T6494] get_page_from_freelist+0xa72/0x2f40 [ 71.543994][ T6494] __alloc_pages+0x1b2/0x500 [ 71.548744][ T6494] alloc_pages+0x1aa/0x310 [ 71.553238][ T6494] new_slab+0x28d/0x3a0 [ 71.558207][ T6494] ___slab_alloc+0x6be/0xd60 [ 71.562798][ T6494] __slab_alloc.constprop.0+0x4d/0xa0 [ 71.568161][ T6494] kmem_cache_alloc_trace+0x289/0x2c0 [ 71.573711][ T6494] alloc_bprm+0x51/0x8f0 [ 71.578049][ T6494] kernel_execve+0x55/0x460 [ 71.582550][ T6494] call_usermodehelper_exec_async+0x2e3/0x580 [ 71.588694][ T6494] ret_from_fork+0x1f/0x30 [ 71.593103][ T6494] page_owner free stack trace missing [ 71.598629][ T6494] [ 71.600944][ T6494] Memory state around the buggy address: [ 71.606554][ T6494] ffff88801872f800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 71.614694][ T6494] ffff88801872f880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 71.623434][ T6494] >ffff88801872f900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 71.631473][ T6494] ^ [ 71.637790][ T6494] ffff88801872f980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 71.645835][ T6494] ffff88801872fa00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 71.653965][ T6494] ================================================================== [ 71.663572][ T6494] Kernel panic - not syncing: panic_on_warn set ... [ 71.670256][ T6494] CPU: 0 PID: 6494 Comm: syz-executor Tainted: G B 5.16.0-rc3-next-20211203-syzkaller #0 [ 71.681397][ T6494] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 71.691458][ T6494] Call Trace: [ 71.694733][ T6494] [ 71.697654][ T6494] dump_stack_lvl+0xcd/0x134 [ 71.702349][ T6494] panic+0x2b0/0x6dd [ 71.706858][ T6494] ? __warn_printk+0xf3/0xf3 [ 71.711450][ T6494] ? preempt_schedule_common+0x59/0xc0 [ 71.716918][ T6494] ? up_write+0x3ac/0x470 [ 71.721247][ T6494] ? preempt_schedule_thunk+0x16/0x18 [ 71.726615][ T6494] ? trace_hardirqs_on+0x38/0x1c0 [ 71.731626][ T6494] ? trace_hardirqs_on+0x51/0x1c0 [ 71.736644][ T6494] ? up_write+0x3ac/0x470 [ 71.740963][ T6494] ? up_write+0x3ac/0x470 [ 71.745280][ T6494] end_report.cold+0x63/0x6f [ 71.749880][ T6494] kasan_report.cold+0x71/0xdf [ 71.754720][ T6494] ? up_write+0x3ac/0x470 [ 71.759476][ T6494] up_write+0x3ac/0x470 [ 71.763646][ T6494] cgroup_setup_root+0x3a6/0xad0 [ 71.768589][ T6494] ? rebind_subsystems+0x10e0/0x10e0 [ 71.773869][ T6494] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 71.780104][ T6494] cgroup1_get_tree+0xd33/0x1390 [ 71.785041][ T6494] vfs_get_tree+0x89/0x2f0 [ 71.789548][ T6494] path_mount+0x1320/0x1fa0 [ 71.794043][ T6494] ? kmem_cache_free+0xdd/0x580 [ 71.798973][ T6494] ? finish_automount+0xaf0/0xaf0 [ 71.803988][ T6494] ? putname+0xfe/0x140 [ 71.808151][ T6494] __x64_sys_mount+0x27f/0x300 [ 71.812907][ T6494] ? copy_mnt_ns+0xae0/0xae0 [ 71.817488][ T6494] ? syscall_enter_from_user_mode+0x21/0x70 [ 71.823465][ T6494] do_syscall_64+0x35/0xb0 [ 71.827879][ T6494] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 71.833773][ T6494] RIP: 0033:0x7f22e12cb01a [ 71.838187][ T6494] Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 71.857979][ T6494] RSP: 002b:00007fff087bfc18 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 71.866484][ T6494] RAX: ffffffffffffffda RBX: 00007fff087bfda8 RCX: 00007f22e12cb01a [ 71.874540][ T6494] RDX: 00007f22e132e051 RSI: 00007f22e1324324 RDI: 00007f22e1322dc9 [ 71.882584][ T6494] RBP: 00007f22e1324324 R08: 00007f22e1324481 R09: 0000000000000026 [ 71.890671][ T6494] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff087bfc20 [ 71.898629][ T6494] R13: 00007fff087bfdc8 R14: 00007fff087bfcf0 R15: 00007f22e132447b [ 71.906852][ T6494] [ 71.909908][ T6494] Kernel Offset: disabled [ 71.914230][ T6494] Rebooting in 86400 seconds..