[info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 62.040699] IPVS: Creating netns size=2712 id=1 [ 62.045475] IPVS: ftp: loaded support on port[0] = 21 Warning: Permanently added '10.128.10.60' (ECDSA) to the list of known hosts. 2020/01/14 00:05:45 parsed 1 programs 2020/01/14 00:05:45 executed programs: 0 [ 69.458085] IPv6: ADDRCONF(NETDEV_CHANGE): nr1: link becomes ready [ 69.467488] IPv6: ADDRCONF(NETDEV_CHANGE): nr3: link becomes ready [ 69.477373] IPv6: ADDRCONF(NETDEV_CHANGE): nr2: link becomes ready [ 69.485158] IPv6: ADDRCONF(NETDEV_CHANGE): nr0: link becomes ready [ 69.494243] IPv6: ADDRCONF(NETDEV_CHANGE): nr4: link becomes ready [ 69.502135] IPv6: ADDRCONF(NETDEV_CHANGE): nr5: link becomes ready [ 69.519936] IPVS: Creating netns size=2712 id=2 [ 69.524683] IPVS: ftp: loaded support on port[0] = 21 [ 69.598521] IPVS: Creating netns size=2712 id=3 [ 69.603348] IPVS: ftp: loaded support on port[0] = 21 [ 69.735288] chnl_net:caif_netlink_parms(): no params data found [ 69.761939] IPVS: Creating netns size=2712 id=4 [ 69.767007] IPVS: ftp: loaded support on port[0] = 21 [ 69.928509] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.934890] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.943962] device bridge_slave_0 entered promiscuous mode [ 69.994334] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.000956] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.009855] device bridge_slave_1 entered promiscuous mode [ 70.041696] IPVS: Creating netns size=2712 id=5 [ 70.048680] IPVS: ftp: loaded support on port[0] = 21 [ 70.155595] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 70.227379] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 70.259448] chnl_net:caif_netlink_parms(): no params data found [ 70.349633] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 70.358145] chnl_net:caif_netlink_parms(): no params data found [ 70.359059] IPVS: Creating netns size=2712 id=6 [ 70.359180] IPVS: ftp: loaded support on port[0] = 21 [ 70.391272] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 70.548408] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.554788] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.564011] device bridge_slave_0 entered promiscuous mode [ 70.571936] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.578714] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.588590] device bridge_slave_1 entered promiscuous mode [ 70.698258] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 70.707984] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 70.754220] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 70.764673] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 70.772901] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.779413] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.788724] device bridge_slave_0 entered promiscuous mode [ 70.837968] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.844420] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.853474] device bridge_slave_1 entered promiscuous mode [ 70.881072] IPVS: Creating netns size=2712 id=7 [ 70.885928] IPVS: ftp: loaded support on port[0] = 21 [ 71.061171] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 71.072023] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 71.107608] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 71.117601] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 71.198414] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 71.205151] chnl_net:caif_netlink_parms(): no params data found [ 71.444645] chnl_net:caif_netlink_parms(): no params data found [ 71.462790] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 71.491606] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 71.499658] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 71.508765] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 71.515569] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.522116] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.531124] device bridge_slave_0 entered promiscuous mode [ 71.538911] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.545264] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.554588] device bridge_slave_1 entered promiscuous mode [ 71.701110] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 71.763579] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 71.836609] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 71.869206] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 71.876427] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.889076] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.900525] device bridge_slave_0 entered promiscuous mode [ 71.908874] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 71.920977] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.983370] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.990545] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.002087] device bridge_slave_1 entered promiscuous mode [ 72.024855] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 72.064846] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 72.104211] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 72.119795] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 72.130084] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 72.136768] chnl_net:caif_netlink_parms(): no params data found [ 72.180367] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 72.190088] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 72.310351] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 72.359329] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 72.411277] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 72.419553] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.425889] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.432897] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 72.440706] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.447137] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.454073] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 72.466175] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 72.473955] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.480735] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.490088] device bridge_slave_0 entered promiscuous mode [ 72.501898] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 72.509952] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.516321] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.525580] device bridge_slave_1 entered promiscuous mode [ 72.648860] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 72.660332] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 72.669662] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 72.690856] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 72.700815] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 72.737444] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 72.755861] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 72.818435] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 72.846025] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 72.871597] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 72.890527] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 72.910522] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 72.922785] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.999036] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.023333] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 73.041131] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 73.052855] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 73.072829] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 73.087147] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 73.140297] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 73.194648] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 73.229765] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.238541] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 73.246318] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.252696] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.260079] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 73.268109] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.274490] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.286486] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 73.301273] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 73.324356] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.374201] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 73.398893] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 73.409240] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.415598] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.423440] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 73.450709] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 73.458474] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 73.466057] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 73.474962] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.481354] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.516151] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.539545] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 73.547554] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.553894] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.561096] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 73.568835] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.575167] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.589667] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 73.611434] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 73.624524] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 73.633008] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 73.665826] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 73.683386] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 73.705230] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 73.726981] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 73.746314] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.772522] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 73.792133] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 73.800826] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 73.809463] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.815825] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.851225] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 73.859842] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 73.867645] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 73.875378] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.881763] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.889770] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 73.928436] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 73.937256] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 73.968689] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 73.996247] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 74.041003] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 74.068406] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 74.093416] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 74.162541] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 74.173539] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.179965] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.218615] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 74.226319] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 74.235796] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.242206] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.273033] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 74.305918] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 74.340404] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 74.367178] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready 2020/01/14 00:05:50 executed programs: 12 [ 75.824360] ================================================================== [ 75.831761] BUG: KASAN: stack-out-of-bounds in memset+0x1a/0x30 at addr ffff8800ae457d38 [ 75.839978] Write of size 72 by task syz-executor.3/9350 [ 75.845471] page:ffffea0002b915c0 count:0 mapcount:0 mapping: (null) index:0x0 [ 75.853769] flags: 0x1fffc0000000000() [ 75.857634] page dumped because: kasan: bad access detected [ 75.863328] CPU: 1 PID: 9350 Comm: syz-executor.3 Not tainted 4.6.0-syzkaller #0 [ 75.870836] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 75.880176] 1ffffffff0d55786 ffff8800ae457ac0 ffffffff8299bd56 ffff8800ae457d38 [ 75.888285] ffff8800ae457b50 ffff8800ae457d38 0000000000000000 ffff8800ae457b40 [ 75.896322] ffffffff8173ab9a ffff8800aeef6200 ffff8800ae457cb8 0000000000000286 [ 75.904328] Call Trace: [ 75.906895] [] dump_stack+0xe6/0x120 [ 75.912235] [] kasan_report_error+0x59a/0x5c0 [ 75.918374] [] ? __fget+0x42/0x320 [ 75.923547] [] kasan_report+0x34/0x40 [ 75.928983] [] ? memset+0x1a/0x30 [ 75.934061] [] __asan_storeN+0x12d/0x180 [ 75.939745] [] memset+0x1a/0x30 [ 75.944662] [] ax25_getname+0x54/0x880 [ 75.950171] [] vhost_net_ioctl+0xd8b/0x12c0 [ 75.956118] [] ? vhost_net_flush+0x1b0/0x1b0 [ 75.962158] [] ? debug_object_active_state+0x320/0x320 [ 75.969059] [] ? smk_access_entry+0x1d0/0x1d0 [ 75.975185] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 75.982172] [] ? smk_tskacc+0x230/0x3c0 [ 75.987782] [] do_vfs_ioctl+0x17f/0xe70 [ 75.993396] [] ? smack_file_ioctl+0x1ed/0x270 [ 75.999548] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 76.005754] [] ? smack_file_lock+0x1b0/0x1b0 [ 76.011786] [] ? __fget+0x1c2/0x320 [ 76.017042] [] ? __fget+0x1df/0x320 [ 76.022305] [] ? __fget+0x42/0x320 [ 76.027467] [] ? security_file_ioctl+0x6a/0xa0 [ 76.033673] [] SyS_ioctl+0x74/0x80 [ 76.038838] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 76.045398] Memory state around the buggy address: [ 76.050330] ffff8800ae457c00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 [ 76.057712] ffff8800ae457c80: f4 f4 f4 f2 f2 f2 f2 04 f4 f4 f4 f2 f2 f2 f2 00 [ 76.065051] >ffff8800ae457d00: f4 f4 f4 f2 f2 f2 f2 00 00 00 00 00 00 04 f4 f3 [ 76.072426] ^ [ 76.079154] ffff8800ae457d80: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 76.086546] ffff8800ae457e00: f1 f1 f1 f1 00 f4 f4 f4 f2 f2 f2 f2 00 00 00 f4 [ 76.093919] ================================================================== [ 78.775065] ================================================================== [ 78.782467] BUG: KASAN: stack-out-of-bounds in memset+0x1a/0x30 at addr ffff8800ae657d38 [ 78.790688] Write of size 72 by task syz-executor.3/10163 [ 78.796206] page:ffffea0002b995c0 count:0 mapcount:0 mapping: (null) index:0x0 [ 78.804453] flags: 0x1fffc0000000000() [ 78.808328] page dumped because: kasan: bad access detected [ 78.814016] CPU: 0 PID: 10163 Comm: syz-executor.3 Tainted: G B 4.6.0-syzkaller #0 [ 78.822839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 78.832169] 1ffffffff0d55786 ffff8800ae657ac0 ffffffff8299bd56 ffff8800ae657d38 [ 78.840205] ffff8800ae657b50 ffff8800ae657d38 0000000000000000 ffff8800ae657b40 [ 78.848205] ffffffff8173ab9a ffff8800ae4f0140 ffff8800ae657cb8 0000000000000286 [ 78.856207] Call Trace: [ 78.858774] [] dump_stack+0xe6/0x120 [ 78.864112] [] kasan_report_error+0x59a/0x5c0 [ 78.870233] [] ? __fget+0x42/0x320 [ 78.875399] [] kasan_report+0x34/0x40 [ 78.880820] [] ? memset+0x1a/0x30 [ 78.885913] [] __asan_storeN+0x12d/0x180 [ 78.891597] [] memset+0x1a/0x30 [ 78.896512] [] ax25_getname+0x54/0x880 [ 78.902038] [] vhost_net_ioctl+0xd8b/0x12c0 [ 78.907985] [] ? vhost_net_flush+0x1b0/0x1b0 [ 78.914021] [] ? smk_access_entry+0x1d0/0x1d0 [ 78.920143] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 78.927147] [] ? smk_tskacc+0x230/0x3c0 [ 78.932755] [] do_vfs_ioctl+0x17f/0xe70 [ 78.938491] [] ? smack_file_ioctl+0x1ed/0x270 [ 78.944613] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 78.950826] [] ? smack_file_lock+0x1b0/0x1b0 [ 78.956863] [] ? __fget+0x1c2/0x320 [ 78.962115] [] ? __fget+0x1df/0x320 [ 78.967375] [] ? __fget+0x42/0x320 [ 78.972548] [] ? security_file_ioctl+0x6a/0xa0 [ 78.978751] [] SyS_ioctl+0x74/0x80 [ 78.983928] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 78.990481] Memory state around the buggy address: [ 78.995387] ffff8800ae657c00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 [ 79.002717] ffff8800ae657c80: f4 f4 f4 f2 f2 f2 f2 04 f4 f4 f4 f2 f2 f2 f2 00 [ 79.010058] >ffff8800ae657d00: f4 f4 f4 f2 f2 f2 f2 00 00 00 00 00 00 04 f4 f3 [ 79.017398] ^ [ 79.024125] ffff8800ae657d80: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 79.031464] ffff8800ae657e00: f1 f1 f1 f1 00 f4 f4 f4 f2 f2 f2 f2 00 00 00 f4 [ 79.038813] ================================================================== 2020/01/14 00:05:55 executed programs: 195 [ 79.752296] ================================================================== [ 79.759690] BUG: KASAN: stack-out-of-bounds in memset+0x1a/0x30 at addr ffff8800aea77d38 [ 79.767908] Write of size 72 by task syz-executor.5/10381 [ 79.773432] page:ffffea0002ba9dc0 count:0 mapcount:0 mapping: (null) index:0x0 [ 79.781688] flags: 0x1fffc0000000000() [ 79.785557] page dumped because: kasan: bad access detected [ 79.791242] CPU: 1 PID: 10381 Comm: syz-executor.5 Tainted: G B 4.6.0-syzkaller #0 [ 79.800064] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 79.809406] 1ffffffff0d55786 ffff8800aea77ac0 ffffffff8299bd56 ffff8800aea77d38 [ 79.817427] ffff8800aea77b50 ffff8800aea77d38 0000000000000000 ffff8800aea77b40 [ 79.825463] ffffffff8173ab9a ffff8800aebe2640 ffff8800aea77cb8 0000000000000286 [ 79.833474] Call Trace: [ 79.836047] [] dump_stack+0xe6/0x120 [ 79.841404] [] kasan_report_error+0x59a/0x5c0 [ 79.847522] [] ? __fget+0x42/0x320 [ 79.852683] [] kasan_report+0x34/0x40 [ 79.858106] [] ? memset+0x1a/0x30 [ 79.863181] [] __asan_storeN+0x12d/0x180 [ 79.868863] [] memset+0x1a/0x30 [ 79.873778] [] ax25_getname+0x54/0x880 [ 79.879288] [] vhost_net_ioctl+0xd8b/0x12c0 [ 79.885234] [] ? vhost_net_flush+0x1b0/0x1b0 [ 79.891267] [] ? debug_object_active_state+0x320/0x320 [ 79.898166] [] ? smk_access_entry+0x1d0/0x1d0 [ 79.904287] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 79.911276] [] ? smk_tskacc+0x230/0x3c0 [ 79.916874] [] do_vfs_ioctl+0x17f/0xe70 [ 79.922473] [] ? smack_file_ioctl+0x1ed/0x270 [ 79.928594] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 79.934812] [] ? smack_file_lock+0x1b0/0x1b0 [ 79.940852] [] ? __fget+0x1c2/0x320 [ 79.946103] [] ? __fget+0x1df/0x320 [ 79.951352] [] ? __fget+0x42/0x320 [ 79.956515] [] ? security_file_ioctl+0x6a/0xa0 [ 79.962726] [] SyS_ioctl+0x74/0x80 [ 79.967887] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 79.974437] Memory state around the buggy address: [ 79.979343] ffff8800aea77c00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 [ 79.986680] ffff8800aea77c80: f4 f4 f4 f2 f2 f2 f2 04 f4 f4 f4 f2 f2 f2 f2 00 [ 79.994023] >ffff8800aea77d00: f4 f4 f4 f2 f2 f2 f2 00 00 00 00 00 00 04 f4 f3 [ 80.001363] ^ [ 80.008090] ffff8800aea77d80: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 80.015423] ffff8800aea77e00: f1 f1 f1 f1 00 f4 f4 f4 f2 f2 f2 f2 00 00 00 f4 [ 80.022754] ================================================================== [ 83.359678] ================================================================== [ 83.367091] BUG: KASAN: stack-out-of-bounds in memset+0x1a/0x30 at addr ffff8800ae657d38 [ 83.375316] Write of size 72 by task syz-executor.5/11366 [ 83.380922] page:ffffea0002b995c0 count:0 mapcount:0 mapping: (null) index:0x0 [ 83.389175] flags: 0x1fffc0000000000() [ 83.393032] page dumped because: kasan: bad access detected [ 83.398715] CPU: 1 PID: 11366 Comm: syz-executor.5 Tainted: G B 4.6.0-syzkaller #0 [ 83.407527] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 83.416892] 1ffffffff0d55786 ffff8800ae657ac0 ffffffff8299bd56 ffff8800ae657d38 [ 83.424916] ffff8800ae657b50 ffff8800ae657d38 0000000000000000 ffff8800ae657b40 [ 83.432907] ffffffff8173ab9a ffff8800ae6de180 ffff8800ae657cb8 0000000000000286 [ 83.440908] Call Trace: [ 83.443471] [] dump_stack+0xe6/0x120 [ 83.448811] [] kasan_report_error+0x59a/0x5c0 [ 83.454933] [] ? __fget+0x42/0x320 [ 83.460096] [] kasan_report+0x34/0x40 [ 83.465529] [] ? memset+0x1a/0x30 [ 83.470604] [] __asan_storeN+0x12d/0x180 [ 83.476288] [] memset+0x1a/0x30 [ 83.481202] [] ax25_getname+0x54/0x880 [ 83.486714] [] vhost_net_ioctl+0xd8b/0x12c0 [ 83.492657] [] ? vhost_net_flush+0x1b0/0x1b0 [ 83.498689] [] ? debug_object_active_state+0x320/0x320 [ 83.505596] [] ? smk_access_entry+0x1d0/0x1d0 [ 83.511753] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 83.518751] [] ? smk_tskacc+0x230/0x3c0 [ 83.524352] [] do_vfs_ioctl+0x17f/0xe70 [ 83.529952] [] ? smack_file_ioctl+0x1ed/0x270 [ 83.536082] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 83.542290] [] ? smack_file_lock+0x1b0/0x1b0 [ 83.548325] [] ? __fget+0x1c2/0x320 [ 83.553619] [] ? __fget+0x1df/0x320 [ 83.558869] [] ? __fget+0x42/0x320 [ 83.564060] [] ? security_file_ioctl+0x6a/0xa0 [ 83.570265] [] SyS_ioctl+0x74/0x80 [ 83.575431] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 83.581985] Memory state around the buggy address: [ 83.587026] ffff8800ae657c00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 [ 83.594358] ffff8800ae657c80: f4 f4 f4 f2 f2 f2 f2 04 f4 f4 f4 f2 f2 f2 f2 00 [ 83.604516] >ffff8800ae657d00: f4 f4 f4 f2 f2 f2 f2 00 00 00 00 00 00 04 f4 f3 [ 83.611849] ^ [ 83.618574] ffff8800ae657d80: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 83.625940] ffff8800ae657e00: f1 f1 f1 f1 00 f4 f4 f4 f2 f2 f2 f2 00 00 00 f4 [ 83.633447] ================================================================== [ 84.165608] ================================================================== [ 84.173010] BUG: KASAN: stack-out-of-bounds in memset+0x1a/0x30 at addr ffff880127f2fd38 [ 84.181229] Write of size 72 by task syz-executor.0/11536 [ 84.186752] page:ffffea00049fcbc0 count:0 mapcount:0 mapping: (null) index:0x0 [ 84.195033] flags: 0x2fffc0000000000() [ 84.198938] page dumped because: kasan: bad access detected [ 84.204641] CPU: 1 PID: 11536 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 [ 84.213464] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 84.222794] 1ffffffff0d55786 ffff880127f2fac0 ffffffff8299bd56 ffff880127f2fd38 [ 84.230896] ffff880127f2fb50 ffff880127f2fd38 0000000000000000 ffff880127f2fb40 [ 84.238966] ffffffff8173ab9a ffff8800ae7fa500 ffff880127f2fcb8 0000000000000286 [ 84.247769] Call Trace: [ 84.250333] [] dump_stack+0xe6/0x120 [ 84.255672] [] kasan_report_error+0x59a/0x5c0 [ 84.261791] [] ? __fget+0x42/0x320 [ 84.266967] [] kasan_report+0x34/0x40 [ 84.272405] [] ? memset+0x1a/0x30 [ 84.277541] [] __asan_storeN+0x12d/0x180 [ 84.283230] [] memset+0x1a/0x30 [ 84.288183] [] ax25_getname+0x54/0x880 [ 84.293825] [] vhost_net_ioctl+0xd8b/0x12c0 [ 84.299774] [] ? vhost_net_flush+0x1b0/0x1b0 [ 84.305825] [] ? debug_object_active_state+0x320/0x320 [ 84.312745] [] ? smk_access_entry+0x1d0/0x1d0 [ 84.318881] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 84.325873] [] ? smk_tskacc+0x230/0x3c0 [ 84.331473] [] do_vfs_ioctl+0x17f/0xe70 [ 84.337074] [] ? smack_file_ioctl+0x1ed/0x270 [ 84.343193] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 84.349408] [] ? smack_file_lock+0x1b0/0x1b0 [ 84.355442] [] ? __fget+0x1c2/0x320 [ 84.360706] [] ? __fget+0x1df/0x320 [ 84.365958] [] ? __fget+0x42/0x320 [ 84.371122] [] ? security_file_ioctl+0x6a/0xa0 [ 84.377329] [] SyS_ioctl+0x74/0x80 [ 84.382491] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 84.389056] Memory state around the buggy address: [ 84.394032] ffff880127f2fc00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 [ 84.401372] ffff880127f2fc80: f4 f4 f4 f2 f2 f2 f2 04 f4 f4 f4 f2 f2 f2 f2 00 [ 84.408710] >ffff880127f2fd00: f4 f4 f4 f2 f2 f2 f2 00 00 00 00 00 00 04 f4 f3 [ 84.416043] ^ [ 84.422772] ffff880127f2fd80: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 84.430105] ffff880127f2fe00: f1 f1 f1 f1 00 f4 f4 f4 f2 f2 f2 f2 00 00 00 f4 [ 84.437441] ================================================================== 2020/01/14 00:06:00 executed programs: 386 [ 84.565980] ================================================================== [ 84.573486] BUG: KASAN: stack-out-of-bounds in memset+0x1a/0x30 at addr ffff8800ae7efd38 [ 84.581704] Write of size 72 by task syz-executor.0/11584 [ 84.587234] page:ffffea0002b9fbc0 count:0 mapcount:0 mapping: (null) index:0x0 [ 84.595487] flags: 0x1fffc0000000000() [ 84.599353] page dumped because: kasan: bad access detected [ 84.605040] CPU: 0 PID: 11584 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 [ 84.613856] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 84.623188] 1ffffffff0d55786 ffff8800ae7efac0 ffffffff8299bd56 ffff8800ae7efd38 [ 84.631198] ffff8800ae7efb50 ffff8800ae7efd38 0000000000000000 ffff8800ae7efb40 [ 84.639209] ffffffff8173ab9a ffff8800ae89a500 ffff8800ae7efcb8 0000000000000286 [ 84.647236] Call Trace: [ 84.649830] [] dump_stack+0xe6/0x120 [ 84.655254] [] kasan_report_error+0x59a/0x5c0 [ 84.661391] [] ? __fget+0x42/0x320 [ 84.666594] [] kasan_report+0x34/0x40 [ 84.672031] [] ? memset+0x1a/0x30 [ 84.677114] [] __asan_storeN+0x12d/0x180 [ 84.682810] [] memset+0x1a/0x30 [ 84.687717] [] ax25_getname+0x54/0x880 [ 84.693239] [] vhost_net_ioctl+0xd8b/0x12c0 [ 84.699185] [] ? vhost_net_flush+0x1b0/0x1b0 [ 84.705227] [] ? smk_access_entry+0x1d0/0x1d0 [ 84.711443] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 84.718434] [] ? smk_tskacc+0x230/0x3c0 [ 84.724071] [] do_vfs_ioctl+0x17f/0xe70 [ 84.729672] [] ? smack_file_ioctl+0x1ed/0x270 [ 84.735791] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 84.742000] [] ? smack_file_lock+0x1b0/0x1b0 [ 84.748050] [] ? __fget+0x1c2/0x320 [ 84.753314] [] ? __fget+0x1df/0x320 [ 84.758577] [] ? __fget+0x42/0x320 [ 84.763748] [] ? security_file_ioctl+0x6a/0xa0 [ 84.770214] [] SyS_ioctl+0x74/0x80 [ 84.775394] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 84.781944] Memory state around the buggy address: [ 84.786847] ffff8800ae7efc00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 [ 84.794527] ffff8800ae7efc80: f4 f4 f4 f2 f2 f2 f2 04 f4 f4 f4 f2 f2 f2 f2 00 [ 84.801861] >ffff8800ae7efd00: f4 f4 f4 f2 f2 f2 f2 00 00 00 00 00 00 04 f4 f3 [ 84.809207] ^ [ 84.815933] ffff8800ae7efd80: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 84.823269] ffff8800ae7efe00: f1 f1 f1 f1 00 f4 f4 f4 f2 f2 f2 f2 00 00 00 f4 [ 84.830617] ==================================================================