Warning: Permanently added '10.128.1.70' (ECDSA) to the list of known hosts. executing program [* ] A start job is running for dev-ttyS0.device (8s / 1min 30s)[** ] A start job is running for dev-ttyS0.device (9s / 1min 30s)[*** ] A start job is running for dev-ttyS0.device (9s / 1min 30s)[ *** ] A start job is running for dev-ttyS0.device (10s / 1min 30s)[ *** ] A start job is running for dev-ttyS0.device (11s / 1min 30s)[ 18.370563][ T22] audit: type=1400 audit(1618063336.749:8): avc: denied { execmem } for pid=340 comm="syz-executor421" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 18.424573][ T342] ================================================================== [ 18.432668][ T342] BUG: KASAN: use-after-free in eth_header_parse_protocol+0xad/0xd0 [ 18.440660][ T342] Read of size 2 at addr ffff8881e95ef00b by task syz-executor421/342 [ 18.448820][ T342] [ 18.451122][ T342] CPU: 1 PID: 342 Comm: syz-executor421 Not tainted 5.4.110-syzkaller-00108-g2c6775a89bc1 #0 [ 18.461230][ T342] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 18.471263][ T342] Call Trace: [ 18.474531][ T342] dump_stack+0x1d8/0x24e [ 18.478843][ T342] ? gfp_pfmemalloc_allowed+0x120/0x120 [ 18.484484][ T342] ? show_regs_print_info+0x12/0x12 [ 18.489664][ T342] ? printk+0xcf/0x114 [ 18.493712][ T342] print_address_description+0x9b/0x650 [ 18.499246][ T342] ? devkmsg_release+0x11c/0x11c [ 18.504181][ T342] ? _copy_from_iter+0x84d/0xa80 [ 18.509101][ T342] ? memcpy+0x38/0x50 [ 18.513053][ T342] __kasan_report+0x182/0x260 [ 18.517701][ T342] ? eth_header_parse_protocol+0xad/0xd0 [ 18.523299][ T342] kasan_report+0x30/0x60 [ 18.527686][ T342] eth_header_parse_protocol+0xad/0xd0 [ 18.533113][ T342] ? eth_header_cache_update+0x30/0x30 [ 18.538546][ T342] virtio_net_hdr_to_skb+0x6de/0xd70 [ 18.543800][ T342] ? fanout_demux_bpf+0x230/0x230 [ 18.548878][ T342] ? skb_copy_datagram_from_iter+0x604/0x6b0 [ 18.554915][ T342] packet_sendmsg+0x483a/0x6780 [ 18.559740][ T342] ? memset+0x1f/0x40 [ 18.563691][ T342] ? selinux_socket_sendmsg+0x11f/0x340 [ 18.569218][ T342] ? selinux_socket_accept+0x5b0/0x5b0 [ 18.574661][ T342] ? compat_packet_setsockopt+0x160/0x160 [ 18.580356][ T342] ? security_socket_sendmsg+0x9d/0xb0 [ 18.585903][ T342] ? compat_packet_setsockopt+0x160/0x160 [ 18.591634][ T342] kernel_sendmsg+0xf5/0x130 [ 18.596201][ T342] sock_no_sendpage+0x143/0x1b0 [ 18.601063][ T342] ? __receive_sock+0xe0/0xe0 [ 18.605723][ T342] ? avc_has_perm_noaudit+0x37d/0x400 [ 18.611061][ T342] ? avc_has_perm_noaudit+0x30c/0x400 [ 18.616398][ T342] ? __receive_sock+0xe0/0xe0 [ 18.621056][ T342] sock_sendpage+0xd0/0x120 [ 18.625527][ T342] pipe_to_sendpage+0x23b/0x300 [ 18.630343][ T342] ? sock_fasync+0xf0/0xf0 [ 18.634727][ T342] ? generic_splice_sendpage+0x210/0x210 [ 18.640340][ T342] ? avc_has_perm+0xd2/0x270 [ 18.644912][ T342] ? avc_has_perm+0x173/0x270 [ 18.649566][ T342] __splice_from_pipe+0x2d3/0x870 [ 18.654588][ T342] ? generic_splice_sendpage+0x210/0x210 [ 18.660233][ T342] generic_splice_sendpage+0x181/0x210 [ 18.665749][ T342] ? iter_file_splice_write+0xf20/0xf20 [ 18.671266][ T342] ? security_file_permission+0x128/0x300 [ 18.676967][ T342] ? iter_file_splice_write+0xf20/0xf20 [ 18.682580][ T342] __se_sys_splice+0x7a8/0x1b00 [ 18.687405][ T342] ? check_preemption_disabled+0x154/0x330 [ 18.693179][ T342] ? debug_smp_processor_id+0x20/0x20 [ 18.698518][ T342] ? __fpregs_load_activate+0x1d7/0x3c0 [ 18.704040][ T342] ? __x64_sys_splice+0xf0/0xf0 [ 18.708856][ T342] ? finish_task_switch+0x1b9/0x550 [ 18.714030][ T342] ? __x64_sys_splice+0x1d/0xf0 [ 18.718844][ T342] do_syscall_64+0xcb/0x1e0 [ 18.723317][ T342] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 18.729175][ T342] RIP: 0033:0x444d19 [ 18.733037][ T342] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 18.752620][ T342] RSP: 002b:00007efdc30ba2f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 18.761009][ T342] RAX: ffffffffffffffda RBX: 00000000004ca458 RCX: 0000000000444d19 [ 18.768946][ T342] RDX: 0000000000000007 RSI: 0000000000000000 RDI: 0000000000000003 [ 18.776885][ T342] RBP: 00000000004ca450 R08: 0000000004f44115 R09: 0000000000000000 [ 18.784839][ T342] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004ca45c [ 18.792792][ T342] R13: 000000000049a004 R14: 6d32cc5e8ead0600 R15: 0000000000022000 [ 18.792798][ T342] [ 18.792801][ T342] The buggy address belongs to the page: [ 18.792810][ T342] page:ffffea0007a57bc0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 [ 18.792815][ T342] flags: 0x8000000000000000() [ 18.792825][ T342] raw: 8000000000000000 0000000000000000 ffffea0007a57bc8 0000000000000000 [ 18.831031][ T342] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 18.839632][ T342] page dumped because: kasan: bad access detected [ 18.846050][ T342] [ 18.848364][ T342] Memory state around the buggy address: [ 18.853979][ T342] ffff8881e95eef00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.862023][ T342] ffff8881e95eef80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.870059][ T342] >ffff8881e95ef000: ff ff ff ff ff ff ff ff ff ff ff ff