[ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.181' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program syzkaller login: [ 66.423120][ T6795] netlink: 'syz-executor220': attribute type 3 has an invalid length. [ 66.430424][ T6800] netlink: 'syz-executor220': attribute type 3 has an invalid length. [ 66.441164][ T6802] netlink: 'syz-executor220': attribute type 3 has an invalid length. [ 66.441658][ T6801] netlink: 'syz-executor220': attribute type 3 has an invalid length. [ 66.449544][ T6800] netlink: 'syz-executor220': attribute type 8 has an invalid length. [ 66.458504][ T6803] netlink: 'syz-executor220': attribute type 3 has an invalid length. [ 66.469525][ T6802] netlink: 'syz-executor220': attribute type 8 has an invalid length. [ 66.475923][ T6804] netlink: 'syz-executor220': attribute type 3 has an invalid length. [ 66.484362][ T6802] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor220'. [ 66.491404][ T6795] netlink: 'syz-executor220': attribute type 8 has an invalid length. [ 66.502093][ T6800] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor220'. executing program executing program [ 66.510307][ T6804] netlink: 'syz-executor220': attribute type 8 has an invalid length. [ 66.510325][ T6804] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor220'. [ 66.533227][ T6805] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor220'. [ 66.539944][ T6801] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor220'. [ 66.552530][ T6806] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor220'. executing program executing program executing program executing program executing program [ 66.557980][ T6795] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor220'. [ 66.568536][ T6803] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor220'. [ 66.592248][ T6807] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor220'. [ 66.593240][ T6810] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor220'. [ 66.612066][ T6807] ================================================================== executing program [ 66.620258][ T6807] BUG: KASAN: vmalloc-out-of-bounds in nl802154_dump_wpan_phy+0x98e/0x9c0 [ 66.628778][ T6807] Read of size 4 at addr ffffc90001dd9018 by task syz-executor220/6807 [ 66.636986][ T6807] [ 66.639297][ T6807] CPU: 0 PID: 6807 Comm: syz-executor220 Not tainted 5.8.0-rc1-syzkaller #0 [ 66.647979][ T6807] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 66.658042][ T6807] Call Trace: [ 66.661316][ T6807] dump_stack+0x18f/0x20d [ 66.665631][ T6807] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 66.671168][ T6807] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 66.676696][ T6807] print_address_description.constprop.0.cold+0x5/0x436 [ 66.683609][ T6807] ? check_preemption_disabled+0x38/0x220 [ 66.689309][ T6807] ? vprintk_func+0x97/0x1a6 [ 66.693896][ T6807] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 66.699432][ T6807] kasan_report.cold+0x1f/0x37 [ 66.704175][ T6807] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 66.709715][ T6807] nl802154_dump_wpan_phy+0x98e/0x9c0 [ 66.715072][ T6807] ? kmem_cache_alloc_node_trace+0x3b0/0x400 [ 66.721028][ T6807] ? __kmalloc_node_track_caller+0x38/0x60 [ 66.726812][ T6807] ? nl802154_send_wpan_phy.constprop.0+0x21d0/0x21d0 [ 66.733550][ T6807] ? __phys_addr+0x9a/0x110 [ 66.738033][ T6807] ? memset+0x20/0x40 [ 66.742011][ T6807] genl_lock_dumpit+0x7f/0xb0 [ 66.746678][ T6807] netlink_dump+0x4cd/0xf60 [ 66.751177][ T6807] ? netlink_insert+0x1670/0x1670 [ 66.756178][ T6807] ? __mutex_unlock_slowpath+0xe2/0x610 [ 66.761721][ T6807] ? genl_start+0x45a/0x6e0 [ 66.766206][ T6807] __netlink_dump_start+0x643/0x900 [ 66.771404][ T6807] ? genl_rcv_msg+0x9e0/0x9e0 [ 66.776063][ T6807] ? nl802154_send_wpan_phy.constprop.0+0x21d0/0x21d0 [ 66.782819][ T6807] genl_family_rcv_msg_dumpit+0x2ac/0x310 [ 66.788540][ T6807] ? genl_rcv+0x40/0x40 [ 66.792676][ T6807] ? mutex_lock_io_nested+0xf60/0xf60 [ 66.798030][ T6807] ? mark_lock+0xbc/0x1710 [ 66.802454][ T6807] ? genl_rcv_msg+0x9e0/0x9e0 [ 66.807110][ T6807] ? genl_unlock+0x20/0x20 [ 66.811503][ T6807] ? genl_parallel_done+0x170/0x170 [ 66.816685][ T6807] ? __radix_tree_lookup+0x1f3/0x290 [ 66.821953][ T6807] genl_rcv_msg+0x797/0x9e0 [ 66.826467][ T6807] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 66.833385][ T6807] ? lock_acquire+0x1f1/0xad0 [ 66.838050][ T6807] ? genl_rcv+0x15/0x40 [ 66.842216][ T6807] ? lock_release+0x8d0/0x8d0 [ 66.846883][ T6807] netlink_rcv_skb+0x15a/0x430 [ 66.851643][ T6807] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 66.858594][ T6807] ? netlink_ack+0xa10/0xa10 [ 66.863212][ T6807] genl_rcv+0x24/0x40 [ 66.867175][ T6807] netlink_unicast+0x533/0x7d0 [ 66.871922][ T6807] ? netlink_attachskb+0x810/0x810 [ 66.877016][ T6807] ? _copy_from_iter_full+0x247/0x890 [ 66.882379][ T6807] ? __phys_addr_symbol+0x2c/0x70 [ 66.887395][ T6807] ? __check_object_size+0x171/0x3e4 [ 66.892662][ T6807] netlink_sendmsg+0x856/0xd90 [ 66.897411][ T6807] ? netlink_unicast+0x7d0/0x7d0 [ 66.902332][ T6807] ? netlink_unicast+0x7d0/0x7d0 [ 66.907260][ T6807] sock_sendmsg+0xcf/0x120 [ 66.911672][ T6807] ____sys_sendmsg+0x6e8/0x810 [ 66.916438][ T6807] ? kernel_sendmsg+0x50/0x50 [ 66.921136][ T6807] ? do_recvmmsg+0x6d0/0x6d0 [ 66.925724][ T6807] ? release_pages+0x641/0x17a0 [ 66.930565][ T6807] ___sys_sendmsg+0xf3/0x170 [ 66.935153][ T6807] ? sendmsg_copy_msghdr+0x160/0x160 [ 66.940423][ T6807] ? do_huge_pmd_anonymous_page+0x1b94/0x2230 [ 66.946487][ T6807] ? check_preemption_disabled+0x38/0x220 [ 66.952205][ T6807] ? do_huge_pmd_anonymous_page+0x8ef/0x2230 [ 66.958170][ T6807] ? handle_mm_fault+0xad9/0x4420 [ 66.963192][ T6807] ? __fget_light+0x215/0x280 [ 66.967854][ T6807] __sys_sendmsg+0xe5/0x1b0 [ 66.972364][ T6807] ? __sys_sendmsg_sock+0xb0/0xb0 [ 66.977382][ T6807] ? check_preemption_disabled+0x38/0x220 [ 66.983086][ T6807] ? do_syscall_64+0x1c/0xe0 [ 66.987662][ T6807] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 66.993621][ T6807] do_syscall_64+0x60/0xe0 [ 66.998027][ T6807] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 67.003901][ T6807] RIP: 0033:0x441319 [ 67.007783][ T6807] Code: Bad RIP value. [ 67.011823][ T6807] RSP: 002b:00007fffb8a0a7b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 67.020209][ T6807] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441319 [ 67.028159][ T6807] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003 [ 67.036108][ T6807] RBP: 0000000000010393 R08: 00000000004002c8 R09: 00000000004002c8 [ 67.044057][ T6807] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000402090 [ 67.052005][ T6807] R13: 0000000000402120 R14: 0000000000000000 R15: 0000000000000000 [ 67.059989][ T6807] [ 67.062330][ T6807] [ 67.064646][ T6807] Memory state around the buggy address: [ 67.070270][ T6807] ffffc90001dd8f00: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 67.078360][ T6807] ffffc90001dd8f80: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 67.086398][ T6807] >ffffc90001dd9000: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 67.094471][ T6807] ^ [ 67.099298][ T6807] ffffc90001dd9080: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 67.107338][ T6807] ffffc90001dd9100: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 67.115377][ T6807] ================================================================== [ 67.123423][ T6807] Disabling lock debugging due to kernel taint [ 67.130592][ T6807] Kernel panic - not syncing: panic_on_warn set ... [ 67.137192][ T6807] CPU: 0 PID: 6807 Comm: syz-executor220 Tainted: G B 5.8.0-rc1-syzkaller #0 [ 67.147239][ T6807] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 67.157284][ T6807] Call Trace: [ 67.160573][ T6807] dump_stack+0x18f/0x20d [ 67.164903][ T6807] ? nl802154_dump_wpan_phy+0x940/0x9c0 [ 67.170438][ T6807] panic+0x2e3/0x75c [ 67.174324][ T6807] ? __warn_printk+0xf3/0xf3 [ 67.178901][ T6807] ? preempt_schedule_common+0x59/0xc0 [ 67.184345][ T6807] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 67.189888][ T6807] ? preempt_schedule_thunk+0x16/0x18 [ 67.195267][ T6807] ? trace_hardirqs_on+0x55/0x220 [ 67.200274][ T6807] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 67.205795][ T6807] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 67.211318][ T6807] end_report+0x4d/0x53 [ 67.215452][ T6807] kasan_report.cold+0xd/0x37 [ 67.220143][ T6807] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 67.225665][ T6807] nl802154_dump_wpan_phy+0x98e/0x9c0 [ 67.231014][ T6807] ? kmem_cache_alloc_node_trace+0x3b0/0x400 [ 67.236970][ T6807] ? __kmalloc_node_track_caller+0x38/0x60 [ 67.242753][ T6807] ? nl802154_send_wpan_phy.constprop.0+0x21d0/0x21d0 [ 67.249579][ T6807] ? __phys_addr+0x9a/0x110 [ 67.254058][ T6807] ? memset+0x20/0x40 [ 67.258016][ T6807] genl_lock_dumpit+0x7f/0xb0 [ 67.262684][ T6807] netlink_dump+0x4cd/0xf60 [ 67.267162][ T6807] ? netlink_insert+0x1670/0x1670 [ 67.272173][ T6807] ? __mutex_unlock_slowpath+0xe2/0x610 [ 67.277725][ T6807] ? genl_start+0x45a/0x6e0 [ 67.282228][ T6807] __netlink_dump_start+0x643/0x900 [ 67.287413][ T6807] ? genl_rcv_msg+0x9e0/0x9e0 [ 67.292066][ T6807] ? nl802154_send_wpan_phy.constprop.0+0x21d0/0x21d0 [ 67.298799][ T6807] genl_family_rcv_msg_dumpit+0x2ac/0x310 [ 67.304502][ T6807] ? genl_rcv+0x40/0x40 [ 67.308658][ T6807] ? mutex_lock_io_nested+0xf60/0xf60 [ 67.314024][ T6807] ? mark_lock+0xbc/0x1710 [ 67.318415][ T6807] ? genl_rcv_msg+0x9e0/0x9e0 [ 67.323063][ T6807] ? genl_unlock+0x20/0x20 [ 67.327454][ T6807] ? genl_parallel_done+0x170/0x170 [ 67.332635][ T6807] ? __radix_tree_lookup+0x1f3/0x290 [ 67.337904][ T6807] genl_rcv_msg+0x797/0x9e0 [ 67.342396][ T6807] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 67.349305][ T6807] ? lock_acquire+0x1f1/0xad0 [ 67.353956][ T6807] ? genl_rcv+0x15/0x40 [ 67.358084][ T6807] ? lock_release+0x8d0/0x8d0 [ 67.362749][ T6807] netlink_rcv_skb+0x15a/0x430 [ 67.367517][ T6807] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 67.374427][ T6807] ? netlink_ack+0xa10/0xa10 [ 67.378993][ T6807] genl_rcv+0x24/0x40 [ 67.382963][ T6807] netlink_unicast+0x533/0x7d0 [ 67.387712][ T6807] ? netlink_attachskb+0x810/0x810 [ 67.392805][ T6807] ? _copy_from_iter_full+0x247/0x890 [ 67.398154][ T6807] ? __phys_addr_symbol+0x2c/0x70 [ 67.403179][ T6807] ? __check_object_size+0x171/0x3e4 [ 67.408454][ T6807] netlink_sendmsg+0x856/0xd90 [ 67.413207][ T6807] ? netlink_unicast+0x7d0/0x7d0 [ 67.418134][ T6807] ? netlink_unicast+0x7d0/0x7d0 [ 67.423057][ T6807] sock_sendmsg+0xcf/0x120 [ 67.427449][ T6807] ____sys_sendmsg+0x6e8/0x810 [ 67.432191][ T6807] ? kernel_sendmsg+0x50/0x50 [ 67.436843][ T6807] ? do_recvmmsg+0x6d0/0x6d0 [ 67.441421][ T6807] ? release_pages+0x641/0x17a0 [ 67.446249][ T6807] ___sys_sendmsg+0xf3/0x170 [ 67.450829][ T6807] ? sendmsg_copy_msghdr+0x160/0x160 [ 67.456103][ T6807] ? do_huge_pmd_anonymous_page+0x1b94/0x2230 [ 67.462163][ T6807] ? check_preemption_disabled+0x38/0x220 [ 67.467867][ T6807] ? do_huge_pmd_anonymous_page+0x8ef/0x2230 [ 67.473828][ T6807] ? handle_mm_fault+0xad9/0x4420 [ 67.478831][ T6807] ? __fget_light+0x215/0x280 [ 67.483492][ T6807] __sys_sendmsg+0xe5/0x1b0 [ 67.487973][ T6807] ? __sys_sendmsg_sock+0xb0/0xb0 [ 67.492986][ T6807] ? check_preemption_disabled+0x38/0x220 [ 67.498693][ T6807] ? do_syscall_64+0x1c/0xe0 [ 67.503285][ T6807] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 67.509239][ T6807] do_syscall_64+0x60/0xe0 [ 67.513632][ T6807] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 67.519512][ T6807] RIP: 0033:0x441319 [ 67.523373][ T6807] Code: Bad RIP value. [ 67.527410][ T6807] RSP: 002b:00007fffb8a0a7b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 67.535791][ T6807] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441319 [ 67.543757][ T6807] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003 [ 67.551730][ T6807] RBP: 0000000000010393 R08: 00000000004002c8 R09: 00000000004002c8 [ 67.559683][ T6807] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000402090 [ 67.567639][ T6807] R13: 0000000000402120 R14: 0000000000000000 R15: 0000000000000000 [ 67.576688][ T6807] Kernel Offset: disabled [ 67.581003][ T6807] Rebooting in 86400 seconds..