[ OK ] Started Getty on tty6. [ OK ] Started Serial Getty on ttyS0. [ OK ] Started Getty on tty5. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.1.91' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program executing program executing program syzkaller login: [ 28.272125] ================================================================== [ 28.279861] BUG: KASAN: use-after-free in __lock_acquire+0x2c57/0x3f20 [ 28.286497] Read of size 8 at addr ffff8880b502fe20 by task kworker/u4:4/2967 [ 28.293774] [ 28.295375] CPU: 0 PID: 2967 Comm: kworker/u4:4 Not tainted 4.14.301-syzkaller #0 [ 28.302962] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 28.312300] Workqueue: tipc_rcv tipc_recv_work [ 28.316854] Call Trace: [ 28.319419] dump_stack+0x1b2/0x281 [ 28.323020] print_address_description.cold+0x54/0x1d3 [ 28.328268] kasan_report_error.cold+0x8a/0x191 [ 28.332911] ? __lock_acquire+0x2c57/0x3f20 [ 28.337205] __asan_report_load8_noabort+0x68/0x70 [ 28.342103] ? tipc_subscrb_rcv_cb+0x2c0/0xa40 [ 28.346743] ? __lock_acquire+0x2c57/0x3f20 [ 28.351123] __lock_acquire+0x2c57/0x3f20 [ 28.355245] ? io_schedule_timeout+0x140/0x140 [ 28.359797] ? __wake_up_common_lock+0xcd/0x140 [ 28.364437] ? trace_hardirqs_on+0x10/0x10 [ 28.368642] ? trace_hardirqs_on+0x10/0x10 [ 28.372844] ? preempt_schedule_common+0x45/0xc0 [ 28.377628] ? ___preempt_schedule+0x16/0x18 [ 28.382025] ? tipc_recvmsg+0x43e/0x9e0 [ 28.385975] ? __local_bh_enable_ip+0x132/0x170 [ 28.390627] lock_acquire+0x170/0x3f0 [ 28.394404] ? tipc_subscrb_rcv_cb+0x4d4/0xa40 [ 28.398959] _raw_spin_lock_bh+0x2f/0x40 [ 28.402993] ? tipc_subscrb_rcv_cb+0x4d4/0xa40 [ 28.407546] tipc_subscrb_rcv_cb+0x4d4/0xa40 [ 28.411928] tipc_receive_from_sock+0x25c/0x450 [ 28.416570] ? trace_hardirqs_on+0x10/0x10 [ 28.420788] ? lock_acquire+0x170/0x3f0 [ 28.424750] ? tipc_close_conn+0x200/0x200 [ 28.428962] tipc_recv_work+0x75/0xd0 [ 28.432740] process_one_work+0x793/0x14a0 [ 28.436946] ? work_busy+0x320/0x320 [ 28.440631] ? worker_thread+0x158/0xff0 [ 28.444662] ? _raw_spin_unlock_irq+0x24/0x80 [ 28.449129] worker_thread+0x5cc/0xff0 [ 28.452990] ? rescuer_thread+0xc80/0xc80 [ 28.457109] kthread+0x30d/0x420 [ 28.460448] ? kthread_create_on_node+0xd0/0xd0 [ 28.465108] ret_from_fork+0x24/0x30 [ 28.468827] [ 28.470428] Allocated by task 2967: [ 28.474028] kasan_kmalloc+0xeb/0x160 [ 28.477802] kmem_cache_alloc_trace+0x131/0x3d0 [ 28.482443] tipc_subscrb_connect_cb+0x40/0x150 [ 28.487084] tipc_accept_from_sock+0x25b/0x400 [ 28.491641] tipc_recv_work+0x75/0xd0 [ 28.495410] process_one_work+0x793/0x14a0 [ 28.499617] worker_thread+0x5cc/0xff0 [ 28.503474] kthread+0x30d/0x420 [ 28.506814] ret_from_fork+0x24/0x30 [ 28.510494] [ 28.512092] Freed by task 164: [ 28.515257] kasan_slab_free+0xc3/0x1a0 [ 28.519202] kfree+0xc9/0x250 [ 28.522280] tipc_subscrb_put+0x22/0x30 [ 28.526224] tipc_close_conn+0x16a/0x200 [ 28.530254] tipc_send_work+0x41e/0x520 [ 28.534201] process_one_work+0x793/0x14a0 [ 28.538418] worker_thread+0x5cc/0xff0 [ 28.542278] kthread+0x30d/0x420 [ 28.545615] ret_from_fork+0x24/0x30 [ 28.549298] [ 28.550897] The buggy address belongs to the object at ffff8880b502fe00 [ 28.550897] which belongs to the cache kmalloc-96 of size 96 [ 28.563347] The buggy address is located 32 bytes inside of [ 28.563347] 96-byte region [ffff8880b502fe00, ffff8880b502fe60) [ 28.576400] The buggy address belongs to the page: [ 28.581299] page:ffffea0002d40bc0 count:1 mapcount:0 mapping:ffff8880b502f000 index:0xffff8880b502ff00 [ 28.590710] flags: 0xfff00000000100(slab) [ 28.594833] raw: 00fff00000000100 ffff8880b502f000 ffff8880b502ff00 000000010000001f [ 28.602683] raw: ffffea000281c7e0 ffffea00028ce620 ffff88813fe744c0 0000000000000000 [ 28.610528] page dumped because: kasan: bad access detected [ 28.616204] [ 28.617803] Memory state around the buggy address: [ 28.622701] ffff8880b502fd00: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 28.630034] ffff8880b502fd80: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 28.637460] >ffff8880b502fe00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 28.644803] ^ [ 28.649180] ffff8880b502fe80: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 28.656508] ffff8880b502ff00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 28.663835] ================================================================== [ 28.671165] Disabling lock debugging due to kernel taint [ 28.677798] Kernel panic - not syncing: panic_on_warn set ... [ 28.677798] [ 28.685132] CPU: 0 PID: 2967 Comm: kworker/u4:4 Tainted: G B 4.14.301-syzkaller #0 [ 28.693936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 28.703278] Workqueue: tipc_rcv tipc_recv_work [ 28.707828] Call Trace: [ 28.710429] dump_stack+0x1b2/0x281 [ 28.714036] panic+0x1f9/0x42d [ 28.717206] ? add_taint.cold+0x16/0x16 [ 28.721155] ? lock_downgrade+0x740/0x740 [ 28.725281] kasan_end_report+0x43/0x49 [ 28.729226] kasan_report_error.cold+0xa7/0x191 [ 28.733884] ? __lock_acquire+0x2c57/0x3f20 [ 28.738176] __asan_report_load8_noabort+0x68/0x70 [ 28.743077] ? tipc_subscrb_rcv_cb+0x2c0/0xa40 [ 28.747630] ? __lock_acquire+0x2c57/0x3f20 [ 28.751922] __lock_acquire+0x2c57/0x3f20 [ 28.756043] ? io_schedule_timeout+0x140/0x140 [ 28.760599] ? __wake_up_common_lock+0xcd/0x140 [ 28.765247] ? trace_hardirqs_on+0x10/0x10 [ 28.769455] ? trace_hardirqs_on+0x10/0x10 [ 28.773661] ? preempt_schedule_common+0x45/0xc0 [ 28.778391] ? ___preempt_schedule+0x16/0x18 [ 28.782773] ? tipc_recvmsg+0x43e/0x9e0 [ 28.786809] ? __local_bh_enable_ip+0x132/0x170 [ 28.791451] lock_acquire+0x170/0x3f0 [ 28.795224] ? tipc_subscrb_rcv_cb+0x4d4/0xa40 [ 28.799776] _raw_spin_lock_bh+0x2f/0x40 [ 28.803808] ? tipc_subscrb_rcv_cb+0x4d4/0xa40 [ 28.808361] tipc_subscrb_rcv_cb+0x4d4/0xa40 [ 28.812742] tipc_receive_from_sock+0x25c/0x450 [ 28.817381] ? trace_hardirqs_on+0x10/0x10 [ 28.821613] ? lock_acquire+0x170/0x3f0 [ 28.825557] ? tipc_close_conn+0x200/0x200 [ 28.829767] tipc_recv_work+0x75/0xd0 [ 28.833542] process_one_work+0x793/0x14a0 [ 28.837749] ? work_busy+0x320/0x320 [ 28.842564] ? worker_thread+0x158/0xff0 [ 28.846600] ? _raw_spin_unlock_irq+0x24/0x80 [ 28.851070] worker_thread+0x5cc/0xff0 [ 28.854932] ? rescuer_thread+0xc80/0xc80 [ 28.859049] kthread+0x30d/0x420 [ 28.862385] ? kthread_create_on_node+0xd0/0xd0 [ 28.867027] ret_from_fork+0x24/0x30 [ 28.870881] Kernel Offset: disabled [ 28.874497] Rebooting in 86400 seconds..