[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[   63.571185][   T28] audit: type=1800 audit(1580515668.379:25): pid=8887 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0
[   63.590753][   T28] audit: type=1800 audit(1580515668.379:26): pid=8887 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0
[   63.621267][   T28] audit: type=1800 audit(1580515668.379:27): pid=8887 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added '10.128.1.0' (ECDSA) to the list of known hosts.
2020/02/01 00:22:48 parsed 1 programs
2020/02/01 00:22:49 executed programs: 0
syzkaller login: [  964.793178][ T9059] IPVS: ftp: loaded support on port[0] = 21
[  964.862845][ T9059] chnl_net:caif_netlink_parms(): no params data found
[  964.898833][ T9059] bridge0: port 1(bridge_slave_0) entered blocking state
[  964.906712][ T9059] bridge0: port 1(bridge_slave_0) entered disabled state
[  964.915015][ T9059] device bridge_slave_0 entered promiscuous mode
[  964.924055][ T9059] bridge0: port 2(bridge_slave_1) entered blocking state
[  964.931350][ T9059] bridge0: port 2(bridge_slave_1) entered disabled state
[  964.939110][ T9059] device bridge_slave_1 entered promiscuous mode
[  964.955883][ T9059] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  964.966923][ T9059] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  964.987217][ T9059] team0: Port device team_slave_0 added
[  964.994984][ T9059] team0: Port device team_slave_1 added
[  965.009112][ T9059] batman_adv: batadv0: Adding interface: batadv_slave_0
[  965.016271][ T9059] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  965.042634][ T9059] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  965.055299][ T9059] batman_adv: batadv0: Adding interface: batadv_slave_1
[  965.062722][ T9059] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  965.088949][ T9059] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  965.171482][ T9059] device hsr_slave_0 entered promiscuous mode
[  965.239946][ T9059] device hsr_slave_1 entered promiscuous mode
[  965.344915][ T9059] netdevsim netdevsim0 netdevsim0: renamed from eth0
[  965.402525][ T9059] netdevsim netdevsim0 netdevsim1: renamed from eth1
[  965.451541][ T9059] netdevsim netdevsim0 netdevsim2: renamed from eth2
[  965.542542][ T9059] netdevsim netdevsim0 netdevsim3: renamed from eth3
[  965.612468][ T9059] bridge0: port 2(bridge_slave_1) entered blocking state
[  965.619766][ T9059] bridge0: port 2(bridge_slave_1) entered forwarding state
[  965.627578][ T9059] bridge0: port 1(bridge_slave_0) entered blocking state
[  965.634826][ T9059] bridge0: port 1(bridge_slave_0) entered forwarding state
[  965.675757][ T9059] 8021q: adding VLAN 0 to HW filter on device bond0
[  965.688790][ T2817] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  965.710924][ T2817] bridge0: port 1(bridge_slave_0) entered disabled state
[  965.731581][ T2817] bridge0: port 2(bridge_slave_1) entered disabled state
[  965.740806][ T2817] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[  965.754220][ T9059] 8021q: adding VLAN 0 to HW filter on device team0
[  965.764641][ T2817] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  965.773180][ T2817] bridge0: port 1(bridge_slave_0) entered blocking state
[  965.780416][ T2817] bridge0: port 1(bridge_slave_0) entered forwarding state
[  965.793382][ T9063] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  965.801896][ T9063] bridge0: port 2(bridge_slave_1) entered blocking state
[  965.809273][ T9063] bridge0: port 2(bridge_slave_1) entered forwarding state
[  965.831624][ T2817] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  965.840341][ T2817] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  965.849021][ T2817] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  965.862004][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  965.873368][ T2685] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  965.882861][ T2685] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  965.893881][ T9059] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  965.912689][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  965.920948][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  965.934545][ T9059] 8021q: adding VLAN 0 to HW filter on device batadv0
[  965.952312][ T2685] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[  965.961390][ T2685] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[  965.982360][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[  965.991619][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[  966.000972][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[  966.009042][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[  966.018727][ T9059] device veth0_vlan entered promiscuous mode
[  966.031179][ T9059] device veth1_vlan entered promiscuous mode
[  966.050704][ T2685] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[  966.058958][ T2685] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[  966.067653][ T2685] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[  966.076584][ T2685] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[  966.087729][ T9059] device veth0_macvtap entered promiscuous mode
[  966.097942][ T9059] device veth1_macvtap entered promiscuous mode
[  966.114575][ T9059] batman_adv: batadv0: Interface activated: batadv_slave_0
[  966.123014][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[  966.133143][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[  966.141785][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[  966.150416][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[  966.162430][ T9059] batman_adv: batadv0: Interface activated: batadv_slave_1
[  966.170523][ T9068] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[  966.179123][ T9068] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
2020/02/01 00:22:54 executed programs: 132
2020/02/01 00:22:59 executed programs: 334
2020/02/01 00:23:04 executed programs: 539
2020/02/01 00:23:09 executed programs: 749
2020/02/01 00:23:14 executed programs: 954
2020/02/01 00:23:19 executed programs: 1158
2020/02/01 00:23:24 executed programs: 1364
2020/02/01 00:23:29 executed programs: 1562
2020/02/01 00:23:34 executed programs: 1766
2020/02/01 00:23:39 executed programs: 1969
[ 1015.794983][T21515] ==================================================================
[ 1015.803483][T21515] BUG: KASAN: use-after-free in vgem_gem_dumb_create+0x178/0x320
[ 1015.811286][T21515] Read of size 8 at addr ffff88809f175908 by task syz-executor.0/21515
[ 1015.819509][T21515] 
[ 1015.821857][T21515] CPU: 0 PID: 21515 Comm: syz-executor.0 Not tainted 5.5.0-syzkaller #0
[ 1015.830260][T21515] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1015.840444][T21515] Call Trace:
[ 1015.843911][T21515]  dump_stack+0x1fb/0x318
[ 1015.848322][T21515]  print_address_description+0x74/0x5c0
[ 1015.854078][T21515]  ? vprintk_default+0x28/0x30
[ 1015.858915][T21515]  ? vprintk_func+0x158/0x170
[ 1015.863588][T21515]  ? printk+0x62/0x8d
[ 1015.867920][T21515]  __kasan_report+0x149/0x1c0
[ 1015.872705][T21515]  ? vgem_gem_dumb_create+0x178/0x320
[ 1015.878087][T21515]  kasan_report+0x26/0x50
[ 1015.882504][T21515]  __asan_report_load8_noabort+0x14/0x20
[ 1015.888218][T21515]  vgem_gem_dumb_create+0x178/0x320
[ 1015.893685][T21515]  drm_mode_create_dumb_ioctl+0x22e/0x2a0
[ 1015.899600][T21515]  drm_ioctl_kernel+0x2cf/0x410
[ 1015.904444][T21515]  ? drm_mode_create_dumb+0x2a0/0x2a0
[ 1015.909963][T21515]  drm_ioctl+0x52f/0x890
[ 1015.914355][T21515]  ? drm_mode_create_dumb+0x2a0/0x2a0
[ 1015.919804][T21515]  ? do_vfs_ioctl+0x68f/0x18f0
[ 1015.924676][T21515]  ? tomoyo_file_ioctl+0x23/0x30
[ 1015.929620][T21515]  ? drm_ioctl_kernel+0x410/0x410
[ 1015.934641][T21515]  __se_sys_ioctl+0x113/0x190
[ 1015.939330][T21515]  __x64_sys_ioctl+0x7b/0x90
[ 1015.943964][T21515]  do_syscall_64+0xf7/0x1c0
[ 1015.948505][T21515]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 1015.954417][T21515] RIP: 0033:0x45b399
[ 1015.958323][T21515] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 1015.977933][T21515] RSP: 002b:00007f3d69456c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 1015.986344][T21515] RAX: ffffffffffffffda RBX: 00007f3d694576d4 RCX: 000000000045b399
[ 1015.994323][T21515] RDX: 0000000020000000 RSI: 00000000c02064b2 RDI: 0000000000000003
[ 1016.002399][T21515] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000
[ 1016.010489][T21515] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
[ 1016.018460][T21515] R13: 0000000000000285 R14: 00000000004d1568 R15: 000000000075bfd4
[ 1016.026505][T21515] 
[ 1016.028822][T21515] Allocated by task 21515:
[ 1016.033275][T21515]  __kasan_kmalloc+0x118/0x1c0
[ 1016.038204][T21515]  kasan_kmalloc+0x9/0x10
[ 1016.040558][    T0] NOHZ: local_softirq_pending 08
[ 1016.042542][T21515]  kmem_cache_alloc_trace+0x221/0x2f0
[ 1016.052982][T21515]  vgem_gem_dumb_create+0xd8/0x320
[ 1016.058097][T21515]  drm_mode_create_dumb_ioctl+0x22e/0x2a0
[ 1016.064064][T21515]  drm_ioctl_kernel+0x2cf/0x410
[ 1016.068922][T21515]  drm_ioctl+0x52f/0x890
[ 1016.073152][T21515]  __se_sys_ioctl+0x113/0x190
[ 1016.077930][T21515]  __x64_sys_ioctl+0x7b/0x90
[ 1016.082519][T21515]  do_syscall_64+0xf7/0x1c0
[ 1016.087020][T21515]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 1016.092890][T21515] 
[ 1016.095211][T21515] Freed by task 21515:
[ 1016.099296][T21515]  __kasan_slab_free+0x12e/0x1e0
[ 1016.104227][T21515]  kasan_slab_free+0xe/0x10
[ 1016.108824][T21515]  kfree+0x10d/0x220
[ 1016.112708][T21515]  vgem_gem_free_object+0xb5/0xc0
[ 1016.117729][T21515]  drm_gem_object_put_unlocked+0x33a/0x4b0
[ 1016.123595][T21515]  vgem_gem_dumb_create+0x265/0x320
[ 1016.129022][T21515]  drm_mode_create_dumb_ioctl+0x22e/0x2a0
[ 1016.134741][T21515]  drm_ioctl_kernel+0x2cf/0x410
[ 1016.139690][T21515]  drm_ioctl+0x52f/0x890
[ 1016.143914][T21515]  __se_sys_ioctl+0x113/0x190
[ 1016.148572][T21515]  __x64_sys_ioctl+0x7b/0x90
[ 1016.153246][T21515]  do_syscall_64+0xf7/0x1c0
[ 1016.157842][T21515]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 1016.163820][T21515] 
[ 1016.166134][T21515] The buggy address belongs to the object at ffff88809f175800
[ 1016.166134][T21515]  which belongs to the cache kmalloc-1k of size 1024
[ 1016.180343][T21515] The buggy address is located 264 bytes inside of
[ 1016.180343][T21515]  1024-byte region [ffff88809f175800, ffff88809f175c00)
[ 1016.193790][T21515] The buggy address belongs to the page:
[ 1016.199519][T21515] page:ffffea00027c5d40 refcount:1 mapcount:0 mapping:ffff8880aa400c40 index:0x0
[ 1016.208768][T21515] raw: 00fffe0000000200 ffffea0002613508 ffffea00027c0f88 ffff8880aa400c40
[ 1016.217570][T21515] raw: 0000000000000000 ffff88809f175000 0000000100000002 0000000000000000
[ 1016.226198][T21515] page dumped because: kasan: bad access detected
[ 1016.232599][T21515] 
[ 1016.234933][T21515] Memory state around the buggy address:
[ 1016.240616][T21515]  ffff88809f175800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1016.248678][T21515]  ffff88809f175880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1016.256729][T21515] >ffff88809f175900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1016.265019][T21515]                       ^
[ 1016.269343][T21515]  ffff88809f175980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1016.277574][T21515]  ffff88809f175a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1016.285617][T21515] ==================================================================
[ 1016.293871][T21515] Disabling lock debugging due to kernel taint
[ 1016.303157][T21515] Kernel panic - not syncing: panic_on_warn set ...
[ 1016.309890][T21515] CPU: 0 PID: 21515 Comm: syz-executor.0 Tainted: G    B             5.5.0-syzkaller #0
[ 1016.319649][T21515] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1016.330787][T21515] Call Trace:
[ 1016.334173][T21515]  dump_stack+0x1fb/0x318
[ 1016.339060][T21515]  panic+0x264/0x7a9
[ 1016.342962][T21515]  ? __kasan_report+0x193/0x1c0
[ 1016.347837][T21515]  ? trace_hardirqs_on+0x34/0x80
[ 1016.352783][T21515]  ? __kasan_report+0x193/0x1c0
[ 1016.357627][T21515]  __kasan_report+0x1b9/0x1c0
[ 1016.362301][T21515]  ? vgem_gem_dumb_create+0x178/0x320
[ 1016.367705][T21515]  kasan_report+0x26/0x50
[ 1016.372150][T21515]  __asan_report_load8_noabort+0x14/0x20
[ 1016.377910][T21515]  vgem_gem_dumb_create+0x178/0x320
[ 1016.383158][T21515]  drm_mode_create_dumb_ioctl+0x22e/0x2a0
[ 1016.389018][T21515]  drm_ioctl_kernel+0x2cf/0x410
[ 1016.393913][T21515]  ? drm_mode_create_dumb+0x2a0/0x2a0
[ 1016.399295][T21515]  drm_ioctl+0x52f/0x890
[ 1016.403529][T21515]  ? drm_mode_create_dumb+0x2a0/0x2a0
[ 1016.408930][T21515]  ? do_vfs_ioctl+0x68f/0x18f0
[ 1016.413928][T21515]  ? tomoyo_file_ioctl+0x23/0x30
[ 1016.418885][T21515]  ? drm_ioctl_kernel+0x410/0x410
[ 1016.424049][T21515]  __se_sys_ioctl+0x113/0x190
[ 1016.428828][T21515]  __x64_sys_ioctl+0x7b/0x90
[ 1016.433514][T21515]  do_syscall_64+0xf7/0x1c0
[ 1016.438006][T21515]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 1016.443900][T21515] RIP: 0033:0x45b399
[ 1016.447907][T21515] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 1016.467667][T21515] RSP: 002b:00007f3d69456c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 1016.476161][T21515] RAX: ffffffffffffffda RBX: 00007f3d694576d4 RCX: 000000000045b399
[ 1016.484180][T21515] RDX: 0000000020000000 RSI: 00000000c02064b2 RDI: 0000000000000003
[ 1016.492251][T21515] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000
[ 1016.501665][T21515] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
[ 1016.509847][T21515] R13: 0000000000000285 R14: 00000000004d1568 R15: 000000000075bfd4
[ 1016.520018][T21515] Kernel Offset: disabled
[ 1016.524456][T21515] Rebooting in 86400 seconds..