Warning: Permanently added '10.128.0.144' (ECDSA) to the list of known hosts. executing program [ 45.129277][ T6828] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 45.170766][ T6828] ================================================================== [ 45.178903][ T6828] BUG: KASAN: use-after-free in paging32_walk_addr_generic+0xdda/0x1480 [ 45.187203][ T6828] Write of size 4 at addr ffff888000105000 by task syz-executor832/6828 [ 45.195497][ T6828] [ 45.197815][ T6828] CPU: 1 PID: 6828 Comm: syz-executor832 Not tainted 5.8.0-syzkaller #0 [ 45.206131][ T6828] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 45.216162][ T6828] Call Trace: [ 45.219459][ T6828] dump_stack+0x1f0/0x31e [ 45.223766][ T6828] print_address_description+0x66/0x620 [ 45.229290][ T6828] ? vprintk_emit+0x342/0x3c0 [ 45.233947][ T6828] ? printk+0x62/0x83 [ 45.237901][ T6828] ? vprintk_emit+0x339/0x3c0 [ 45.242553][ T6828] kasan_report+0x132/0x1d0 [ 45.247042][ T6828] ? paging32_walk_addr_generic+0xdda/0x1480 [ 45.253016][ T6828] check_memory_region+0x2b5/0x2f0 [ 45.258102][ T6828] paging32_walk_addr_generic+0xdda/0x1480 [ 45.263895][ T6828] paging32_gva_to_gpa+0x6d/0x110 [ 45.268894][ T6828] ? trace_lock_release+0x137/0x1a0 [ 45.274070][ T6828] ? lock_is_held_type+0xb3/0xe0 [ 45.278982][ T6828] emulator_read_write_onepage+0x420/0x900 [ 45.284774][ T6828] emulator_read_write+0x1e7/0x590 [ 45.289865][ T6828] emulator_fix_hypercall+0xf6/0x120 [ 45.295133][ T6828] em_hypercall+0x56/0xf0 [ 45.299495][ T6828] ? em_lgdt_lidt+0x680/0x680 [ 45.304166][ T6828] x86_emulate_insn+0xe9a/0x6890 [ 45.309096][ T6828] ? lock_is_held_type+0xb3/0xe0 [ 45.314051][ T6828] x86_emulate_instruction+0xe98/0x2e20 [ 45.319574][ T6828] handle_ud+0x2fb/0x320 [ 45.323809][ T6828] ? handle_exception_nmi+0x1c5/0x1240 [ 45.329275][ T6828] ? lockdep_hardirqs_on_prepare+0x445/0x6a0 [ 45.335236][ T6828] vcpu_enter_guest+0x6682/0x89f0 [ 45.340254][ T6828] ? __se_sys_ioctl+0x48/0x170 [ 45.345026][ T6828] ? do_syscall_64+0x31/0x70 [ 45.349602][ T6828] ? __lock_acquire+0x1161/0x2ab0 [ 45.354639][ T6828] ? __lock_acquire+0x1161/0x2ab0 [ 45.359650][ T6828] ? lock_acquire+0x160/0x730 [ 45.364317][ T6828] ? rcu_lock_acquire+0x9/0x30 [ 45.369058][ T6828] vcpu_run+0x332/0xc00 [ 45.373221][ T6828] kvm_arch_vcpu_ioctl_run+0x451/0x8f0 [ 45.378665][ T6828] kvm_vcpu_ioctl+0x64f/0xa50 [ 45.383322][ T6828] ? bpf_lsm_file_ioctl+0x5/0x10 [ 45.388233][ T6828] ? kvm_vm_ioctl_get_dirty_log+0x650/0x650 [ 45.394097][ T6828] __se_sys_ioctl+0xfb/0x170 [ 45.398675][ T6828] do_syscall_64+0x31/0x70 [ 45.403071][ T6828] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 45.408933][ T6828] RIP: 0033:0x443639 [ 45.412805][ T6828] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 9b 0b fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 45.432412][ T6828] RSP: 002b:00007fff1eefeb88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 45.440801][ T6828] RAX: ffffffffffffffda RBX: 00007fff1eefeb90 RCX: 0000000000443639 [ 45.448747][ T6828] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 45.456703][ T6828] RBP: 0000000000000000 R08: 0000000000000000 R09: 00000000004011b0 [ 45.464649][ T6828] R10: 0000000000000012 R11: 0000000000000246 R12: 0000000000404660 [ 45.472594][ T6828] R13: 00000000004046f0 R14: 0000000000000000 R15: 0000000000000000 [ 45.480547][ T6828] [ 45.482861][ T6828] The buggy address belongs to the page: [ 45.488475][ T6828] page:00000000d4b4eedb refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105 [ 45.498419][ T6828] flags: 0x7ffe0000000000() [ 45.502895][ T6828] raw: 007ffe0000000000 ffffea0000004148 ffffea0000004148 0000000000000000 [ 45.511450][ T6828] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 45.520008][ T6828] page dumped because: kasan: bad access detected [ 45.526404][ T6828] [ 45.528714][ T6828] Memory state around the buggy address: [ 45.534321][ T6828] ffff888000104f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 45.542355][ T6828] ffff888000104f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 45.551781][ T6828] >ffff888000105000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 45.559811][ T6828] ^ [ 45.563890][ T6828] ffff888000105080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 45.571920][ T6828] ffff888000105100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 45.579950][ T6828] ================================================================== [ 45.587978][ T6828] Disabling lock debugging due to kernel taint [ 45.594943][ T6828] Kernel panic - not syncing: panic_on_warn set ... [ 45.601536][ T6828] CPU: 0 PID: 6828 Comm: syz-executor832 Tainted: G B 5.8.0-syzkaller #0 [ 45.611232][ T6828] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 45.621270][ T6828] Call Trace: [ 45.624547][ T6828] dump_stack+0x1f0/0x31e [ 45.628858][ T6828] panic+0x264/0x7a0 [ 45.632726][ T6828] ? trace_hardirqs_on+0x30/0x80 [ 45.637631][ T6828] kasan_report+0x1c9/0x1d0 [ 45.642108][ T6828] ? paging32_walk_addr_generic+0xdda/0x1480 [ 45.648056][ T6828] check_memory_region+0x2b5/0x2f0 [ 45.653154][ T6828] paging32_walk_addr_generic+0xdda/0x1480 [ 45.658934][ T6828] paging32_gva_to_gpa+0x6d/0x110 [ 45.663949][ T6828] ? trace_lock_release+0x137/0x1a0 [ 45.669120][ T6828] ? lock_is_held_type+0xb3/0xe0 [ 45.674048][ T6828] emulator_read_write_onepage+0x420/0x900 [ 45.679912][ T6828] emulator_read_write+0x1e7/0x590 [ 45.685024][ T6828] emulator_fix_hypercall+0xf6/0x120 [ 45.690282][ T6828] em_hypercall+0x56/0xf0 [ 45.694595][ T6828] ? em_lgdt_lidt+0x680/0x680 [ 45.699253][ T6828] x86_emulate_insn+0xe9a/0x6890 [ 45.704167][ T6828] ? lock_is_held_type+0xb3/0xe0 [ 45.709079][ T6828] x86_emulate_instruction+0xe98/0x2e20 [ 45.714609][ T6828] handle_ud+0x2fb/0x320 [ 45.718838][ T6828] ? handle_exception_nmi+0x1c5/0x1240 [ 45.724268][ T6828] ? lockdep_hardirqs_on_prepare+0x445/0x6a0 [ 45.730222][ T6828] vcpu_enter_guest+0x6682/0x89f0 [ 45.735246][ T6828] ? __se_sys_ioctl+0x48/0x170 [ 45.739993][ T6828] ? do_syscall_64+0x31/0x70 [ 45.744567][ T6828] ? __lock_acquire+0x1161/0x2ab0 [ 45.749578][ T6828] ? __lock_acquire+0x1161/0x2ab0 [ 45.754585][ T6828] ? lock_acquire+0x160/0x730 [ 45.759242][ T6828] ? rcu_lock_acquire+0x9/0x30 [ 45.763989][ T6828] vcpu_run+0x332/0xc00 [ 45.768116][ T6828] kvm_arch_vcpu_ioctl_run+0x451/0x8f0 [ 45.773545][ T6828] kvm_vcpu_ioctl+0x64f/0xa50 [ 45.778190][ T6828] ? bpf_lsm_file_ioctl+0x5/0x10 [ 45.783111][ T6828] ? kvm_vm_ioctl_get_dirty_log+0x650/0x650 [ 45.788984][ T6828] __se_sys_ioctl+0xfb/0x170 [ 45.793545][ T6828] do_syscall_64+0x31/0x70 [ 45.797953][ T6828] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 45.803828][ T6828] RIP: 0033:0x443639 [ 45.807702][ T6828] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 9b 0b fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 45.827711][ T6828] RSP: 002b:00007fff1eefeb88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 45.836105][ T6828] RAX: ffffffffffffffda RBX: 00007fff1eefeb90 RCX: 0000000000443639 [ 45.844058][ T6828] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 45.852010][ T6828] RBP: 0000000000000000 R08: 0000000000000000 R09: 00000000004011b0 [ 45.859949][ T6828] R10: 0000000000000012 R11: 0000000000000246 R12: 0000000000404660 [ 45.867900][ T6828] R13: 00000000004046f0 R14: 0000000000000000 R15: 0000000000000000 [ 45.876949][ T6828] Kernel Offset: disabled [ 45.881259][ T6828] Rebooting in 86400 seconds..