Warning: Permanently added '10.128.1.59' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 67.184165][ T6866] ================================================================== [ 67.192466][ T6866] BUG: KASAN: slab-out-of-bounds in qrtr_endpoint_post+0x5c1/0x1050 [ 67.200447][ T6866] Read of size 4294967294 at addr ffff8880a24f8710 by task syz-executor504/6866 [ 67.209487][ T6866] [ 67.211850][ T6866] CPU: 0 PID: 6866 Comm: syz-executor504 Not tainted 5.8.0-syzkaller #0 [ 67.220146][ T6866] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 67.230174][ T6866] Call Trace: [ 67.233446][ T6866] dump_stack+0x18f/0x20d [ 67.237752][ T6866] ? qrtr_endpoint_post+0x5c1/0x1050 [ 67.243014][ T6866] ? qrtr_endpoint_post+0x5c1/0x1050 [ 67.248277][ T6866] print_address_description.constprop.0.cold+0xae/0x497 [ 67.255281][ T6866] ? vprintk_func+0x97/0x1a6 [ 67.259850][ T6866] ? qrtr_endpoint_post+0x5c1/0x1050 [ 67.265108][ T6866] ? qrtr_endpoint_post+0x5c1/0x1050 [ 67.270365][ T6866] kasan_report.cold+0x1f/0x37 [ 67.275103][ T6866] ? qrtr_endpoint_post+0x5c1/0x1050 [ 67.280364][ T6866] check_memory_region+0x13d/0x180 [ 67.285448][ T6866] memcpy+0x20/0x60 [ 67.289253][ T6866] qrtr_endpoint_post+0x5c1/0x1050 [ 67.294343][ T6866] qrtr_tun_write_iter+0xf5/0x180 [ 67.299344][ T6866] new_sync_write+0x422/0x650 [ 67.303998][ T6866] ? new_sync_read+0x6e0/0x6e0 [ 67.308743][ T6866] ? rcu_read_lock_sched_held+0x3a/0xb0 [ 67.314282][ T6866] ? apparmor_file_permission+0x26e/0x4e0 [ 67.319987][ T6866] ? build_open_flags+0x650/0x650 [ 67.325002][ T6866] vfs_write+0x5ad/0x730 [ 67.329233][ T6866] ksys_write+0x12d/0x250 [ 67.333547][ T6866] ? __ia32_sys_read+0xb0/0xb0 [ 67.338293][ T6866] ? trace_hardirqs_on+0x5f/0x220 [ 67.343302][ T6866] ? lockdep_hardirqs_on+0x76/0xf0 [ 67.348390][ T6866] do_syscall_64+0x2d/0x70 [ 67.352785][ T6866] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 67.358653][ T6866] RIP: 0033:0x440259 [ 67.362525][ T6866] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 67.382105][ T6866] RSP: 002b:00007ffebd21e918 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 67.390505][ T6866] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440259 [ 67.398457][ T6866] RDX: 0000000000000010 RSI: 0000000020000040 RDI: 0000000000000003 [ 67.406413][ T6866] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 67.414365][ T6866] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a60 [ 67.422332][ T6866] R13: 0000000000401af0 R14: 0000000000000000 R15: 0000000000000000 [ 67.430301][ T6866] [ 67.432631][ T6866] Allocated by task 6866: [ 67.436942][ T6866] kasan_save_stack+0x1b/0x40 [ 67.441595][ T6866] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 67.447201][ T6866] __kmalloc+0x1a8/0x320 [ 67.451424][ T6866] qrtr_tun_write_iter+0x8a/0x180 [ 67.456424][ T6866] new_sync_write+0x422/0x650 [ 67.461076][ T6866] vfs_write+0x5ad/0x730 [ 67.465295][ T6866] ksys_write+0x12d/0x250 [ 67.469600][ T6866] do_syscall_64+0x2d/0x70 [ 67.474000][ T6866] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 67.479859][ T6866] [ 67.482166][ T6866] The buggy address belongs to the object at ffff8880a24f8700 [ 67.482166][ T6866] which belongs to the cache kmalloc-32 of size 32 [ 67.496019][ T6866] The buggy address is located 16 bytes inside of [ 67.496019][ T6866] 32-byte region [ffff8880a24f8700, ffff8880a24f8720) [ 67.509085][ T6866] The buggy address belongs to the page: [ 67.514714][ T6866] page:000000003f6ed5df refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880a24f8fc1 pfn:0xa24f8 [ 67.526135][ T6866] flags: 0xfffe0000000200(slab) [ 67.530962][ T6866] raw: 00fffe0000000200 ffffea0002857fc8 ffff8880aa041250 ffff8880aa040100 [ 67.539519][ T6866] raw: ffff8880a24f8fc1 ffff8880a24f8000 000000010000003f 0000000000000000 [ 67.548082][ T6866] page dumped because: kasan: bad access detected [ 67.554481][ T6866] [ 67.556790][ T6866] Memory state around the buggy address: [ 67.562514][ T6866] ffff8880a24f8600: fb fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 67.570614][ T6866] ffff8880a24f8680: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 67.578661][ T6866] >ffff8880a24f8700: 00 00 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 67.586697][ T6866] ^ [ 67.591261][ T6866] ffff8880a24f8780: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 67.599299][ T6866] ffff8880a24f8800: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 67.607330][ T6866] ================================================================== [ 67.615361][ T6866] Disabling lock debugging due to kernel taint [ 67.622460][ T6866] Kernel panic - not syncing: panic_on_warn set ... [ 67.629578][ T6866] CPU: 0 PID: 6866 Comm: syz-executor504 Tainted: G B 5.8.0-syzkaller #0 [ 67.639281][ T6866] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 67.649319][ T6866] Call Trace: [ 67.652586][ T6866] dump_stack+0x18f/0x20d [ 67.656890][ T6866] ? qrtr_endpoint_post+0x530/0x1050 [ 67.662152][ T6866] panic+0x2e3/0x75c [ 67.666019][ T6866] ? __warn_printk+0xf3/0xf3 [ 67.670749][ T6866] ? preempt_schedule_common+0x59/0xc0 [ 67.676197][ T6866] ? qrtr_endpoint_post+0x5c1/0x1050 [ 67.681463][ T6866] ? preempt_schedule_thunk+0x16/0x18 [ 67.686810][ T6866] ? trace_hardirqs_on+0x55/0x220 [ 67.691808][ T6866] ? qrtr_endpoint_post+0x5c1/0x1050 [ 67.697064][ T6866] ? qrtr_endpoint_post+0x5c1/0x1050 [ 67.702322][ T6866] end_report+0x4d/0x53 [ 67.706452][ T6866] kasan_report.cold+0xd/0x37 [ 67.711101][ T6866] ? qrtr_endpoint_post+0x5c1/0x1050 [ 67.716358][ T6866] check_memory_region+0x13d/0x180 [ 67.721442][ T6866] memcpy+0x20/0x60 [ 67.725224][ T6866] qrtr_endpoint_post+0x5c1/0x1050 [ 67.730310][ T6866] qrtr_tun_write_iter+0xf5/0x180 [ 67.735311][ T6866] new_sync_write+0x422/0x650 [ 67.739960][ T6866] ? new_sync_read+0x6e0/0x6e0 [ 67.744698][ T6866] ? rcu_read_lock_sched_held+0x3a/0xb0 [ 67.750218][ T6866] ? apparmor_file_permission+0x26e/0x4e0 [ 67.755911][ T6866] ? build_open_flags+0x650/0x650 [ 67.760909][ T6866] vfs_write+0x5ad/0x730 [ 67.765129][ T6866] ksys_write+0x12d/0x250 [ 67.769467][ T6866] ? __ia32_sys_read+0xb0/0xb0 [ 67.774204][ T6866] ? trace_hardirqs_on+0x5f/0x220 [ 67.779203][ T6866] ? lockdep_hardirqs_on+0x76/0xf0 [ 67.784287][ T6866] do_syscall_64+0x2d/0x70 [ 67.788676][ T6866] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 67.794539][ T6866] RIP: 0033:0x440259 [ 67.798410][ T6866] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 67.817998][ T6866] RSP: 002b:00007ffebd21e918 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 67.826380][ T6866] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440259 [ 67.834325][ T6866] RDX: 0000000000000010 RSI: 0000000020000040 RDI: 0000000000000003 [ 67.842270][ T6866] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 67.850215][ T6866] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a60 [ 67.858158][ T6866] R13: 0000000000401af0 R14: 0000000000000000 R15: 0000000000000000 [ 67.867526][ T6866] Kernel Offset: disabled [ 67.871839][ T6866] Rebooting in 86400 seconds..