[ OK ] Started Getty on tty2. [ OK ] Started Serial Getty on ttyS0. [ OK ] Started Getty on tty1. [ OK ] Reached target Login Prompts. [ OK ] Started OpenBSD Secure Shell server. [ OK ] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.10.59' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 38.869534] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 38.898397] ================================================================== [ 38.906104] BUG: KASAN: slab-out-of-bounds in ext4_write_inline_data+0x300/0x3d0 [ 38.913660] Write of size 70 at addr ffff88809888a4ef by task syz-executor460/8111 [ 38.921393] [ 38.923036] CPU: 1 PID: 8111 Comm: syz-executor460 Not tainted 4.19.172-syzkaller #0 [ 38.930939] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 38.940395] Call Trace: [ 38.943099] dump_stack+0x1fc/0x2ef [ 38.946755] print_address_description.cold+0x54/0x219 [ 38.952132] kasan_report_error.cold+0x8a/0x1b9 [ 38.956811] ? ext4_write_inline_data+0x300/0x3d0 [ 38.961675] kasan_report+0x8f/0xa0 [ 38.965328] ? ext4_write_inline_data+0x300/0x3d0 [ 38.970231] memcpy+0x35/0x50 [ 38.973374] ext4_write_inline_data+0x300/0x3d0 [ 38.978974] ext4_write_inline_data_end+0x220/0x640 [ 38.984270] ? ext4_try_to_write_inline_data+0x1a20/0x1a20 [ 38.989910] ext4_write_end+0x1de/0xec0 [ 38.993894] ext4_da_write_end+0x860/0xa70 [ 38.998144] generic_perform_write+0x2ae/0x4d0 [ 39.002755] ? __mnt_drop_write_file+0x6f/0xa0 [ 39.007341] ? filemap_page_mkwrite+0x2f0/0x2f0 [ 39.012019] ? current_time+0x1c0/0x1c0 [ 39.016000] ? lock_acquire+0x170/0x3c0 [ 39.019997] __generic_file_write_iter+0x24b/0x610 [ 39.024969] ext4_file_write_iter+0x2fe/0xf20 [ 39.029492] ? ext4_file_open+0x600/0x600 [ 39.033747] ? do_futex+0x163/0x18a0 [ 39.037837] ? mark_held_locks+0xf0/0xf0 [ 39.041954] __vfs_write+0x51b/0x770 [ 39.045780] ? common_file_perm+0x4e5/0x850 [ 39.050137] ? kernel_read+0x110/0x110 [ 39.054051] ? check_preemption_disabled+0x41/0x280 [ 39.059093] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 39.064225] vfs_write+0x1f3/0x540 [ 39.067954] ksys_write+0x12b/0x2a0 [ 39.071598] ? __ia32_sys_read+0xb0/0xb0 [ 39.076197] ? trace_hardirqs_off_caller+0x6e/0x210 [ 39.081224] ? do_syscall_64+0x21/0x620 [ 39.085204] do_syscall_64+0xf9/0x620 [ 39.089016] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 39.094203] RIP: 0033:0x449bd9 [ 39.097378] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 39.116287] RSP: 002b:00007fadf66392f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 39.124009] RAX: ffffffffffffffda RBX: 00000000004cc420 RCX: 0000000000449bd9 [ 39.131286] RDX: 0000000000000082 RSI: 0000000020000180 RDI: 0000000000000008 [ 39.138549] RBP: 000000000049be58 R08: 0000000000000000 R09: 0000000000000000 [ 39.145848] R10: 0000000000000000 R11: 0000000000000246 R12: 0030656c69662f2e [ 39.153130] R13: 024645fc87234f45 R14: 26e1d8b70aefbc5b R15: 00000000004cc428 [ 39.160429] [ 39.162048] Allocated by task 1: [ 39.165404] kmem_cache_alloc+0x122/0x370 [ 39.169543] getname_flags+0xce/0x590 [ 39.173328] do_sys_open+0x26c/0x520 [ 39.177129] do_syscall_64+0xf9/0x620 [ 39.180917] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 39.186095] [ 39.187737] Freed by task 1: [ 39.191272] kmem_cache_free+0x7f/0x260 [ 39.195333] putname+0xe1/0x120 [ 39.198609] do_sys_open+0x2ba/0x520 [ 39.202764] do_syscall_64+0xf9/0x620 [ 39.206643] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 39.211827] [ 39.213442] The buggy address belongs to the object at ffff88809888ab80 [ 39.213442] which belongs to the cache names_cache of size 4096 [ 39.226189] The buggy address is located 1681 bytes to the left of [ 39.226189] 4096-byte region [ffff88809888ab80, ffff88809888bb80) [ 39.238668] The buggy address belongs to the page: [ 39.243592] page:ffffea0002622280 count:1 mapcount:0 mapping:ffff88813be83e40 index:0x0 compound_mapcount: 0 [ 39.253571] flags: 0xfff00000008100(slab|head) [ 39.258323] raw: 00fff00000008100 ffffea0002622208 ffffea00027a8108 ffff88813be83e40 [ 39.266201] raw: 0000000000000000 ffff88809888ab80 0000000100000001 0000000000000000 [ 39.274169] page dumped because: kasan: bad access detected [ 39.280051] [ 39.281670] Memory state around the buggy address: [ 39.286591] ffff88809888a380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.293981] ffff88809888a400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.301430] >ffff88809888a480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.308793] ^ [ 39.315537] ffff88809888a500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.322890] ffff88809888a580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.330249] ================================================================== [ 39.337598] Disabling lock debugging due to kernel taint [ 39.343360] Kernel panic - not syncing: panic_on_warn set ... [ 39.343360] [ 39.350925] CPU: 1 PID: 8111 Comm: syz-executor460 Tainted: G B 4.19.172-syzkaller #0 [ 39.360216] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 39.369593] Call Trace: [ 39.372192] dump_stack+0x1fc/0x2ef [ 39.375825] panic+0x26a/0x50e [ 39.379013] ? __warn_printk+0xf3/0xf3 [ 39.383955] ? retint_kernel+0x2d/0x2d [ 39.387873] ? trace_hardirqs_on+0x55/0x210 [ 39.392198] kasan_end_report+0x43/0x49 [ 39.396179] kasan_report_error.cold+0xa7/0x1b9 [ 39.400925] ? ext4_write_inline_data+0x300/0x3d0 [ 39.405858] kasan_report+0x8f/0xa0 [ 39.409477] ? ext4_write_inline_data+0x300/0x3d0 [ 39.414324] memcpy+0x35/0x50 [ 39.417441] ext4_write_inline_data+0x300/0x3d0 [ 39.422112] ext4_write_inline_data_end+0x220/0x640 [ 39.427119] ? ext4_try_to_write_inline_data+0x1a20/0x1a20 [ 39.432750] ext4_write_end+0x1de/0xec0 [ 39.436714] ext4_da_write_end+0x860/0xa70 [ 39.441031] generic_perform_write+0x2ae/0x4d0 [ 39.445661] ? __mnt_drop_write_file+0x6f/0xa0 [ 39.450326] ? filemap_page_mkwrite+0x2f0/0x2f0 [ 39.454984] ? current_time+0x1c0/0x1c0 [ 39.458944] ? lock_acquire+0x170/0x3c0 [ 39.462905] __generic_file_write_iter+0x24b/0x610 [ 39.467833] ext4_file_write_iter+0x2fe/0xf20 [ 39.472321] ? ext4_file_open+0x600/0x600 [ 39.476458] ? do_futex+0x163/0x18a0 [ 39.480179] ? mark_held_locks+0xf0/0xf0 [ 39.484759] __vfs_write+0x51b/0x770 [ 39.488570] ? common_file_perm+0x4e5/0x850 [ 39.492898] ? kernel_read+0x110/0x110 [ 39.497289] ? check_preemption_disabled+0x41/0x280 [ 39.502327] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 39.507350] vfs_write+0x1f3/0x540 [ 39.510903] ksys_write+0x12b/0x2a0 [ 39.514540] ? __ia32_sys_read+0xb0/0xb0 [ 39.518639] ? trace_hardirqs_off_caller+0x6e/0x210 [ 39.523641] ? do_syscall_64+0x21/0x620 [ 39.527609] do_syscall_64+0xf9/0x620 [ 39.531414] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 39.536594] RIP: 0033:0x449bd9 [ 39.539831] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 39.558948] RSP: 002b:00007fadf66392f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 39.566669] RAX: ffffffffffffffda RBX: 00000000004cc420 RCX: 0000000000449bd9 [ 39.573929] RDX: 0000000000000082 RSI: 0000000020000180 RDI: 0000000000000008 [ 39.581199] RBP: 000000000049be58 R08: 0000000000000000 R09: 0000000000000000 [ 39.588781] R10: 0000000000000000 R11: 0000000000000246 R12: 0030656c69662f2e [ 39.596187] R13: 024645fc87234f45 R14: 26e1d8b70aefbc5b R15: 00000000004cc428 [ 39.605732] Kernel Offset: disabled [ 39.609373] Rebooting in 86400 seconds..