[ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.251' (ECDSA) to the list of known hosts. 2021/04/30 22:53:01 fuzzer started 2021/04/30 22:53:01 dialing manager at 10.128.0.169:44661 2021/04/30 22:53:02 syscalls: 3571 2021/04/30 22:53:02 code coverage: enabled 2021/04/30 22:53:02 comparison tracing: enabled 2021/04/30 22:53:02 extra coverage: enabled 2021/04/30 22:53:02 setuid sandbox: enabled 2021/04/30 22:53:02 namespace sandbox: enabled 2021/04/30 22:53:02 Android sandbox: /sys/fs/selinux/policy does not exist 2021/04/30 22:53:02 fault injection: enabled 2021/04/30 22:53:02 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2021/04/30 22:53:02 net packet injection: enabled 2021/04/30 22:53:02 net device setup: enabled 2021/04/30 22:53:02 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2021/04/30 22:53:02 devlink PCI setup: PCI device 0000:00:10.0 is not available 2021/04/30 22:53:02 USB emulation: enabled 2021/04/30 22:53:02 hci packet injection: enabled 2021/04/30 22:53:02 wifi device emulation: enabled 2021/04/30 22:53:02 802.15.4 emulation: enabled 2021/04/30 22:53:02 fetching corpus: 0, signal 0/2000 (executing program) 2021/04/30 22:53:02 fetching corpus: 50, signal 54651/58379 (executing program) 2021/04/30 22:53:02 fetching corpus: 100, signal 86593/91916 (executing program) 2021/04/30 22:53:02 fetching corpus: 150, signal 111656/118517 (executing program) 2021/04/30 22:53:02 fetching corpus: 200, signal 127699/136019 (executing program) 2021/04/30 22:53:02 fetching corpus: 250, signal 149299/158934 (executing program) syzkaller login: [ 72.183453][ T8415] ================================================================== [ 72.191886][ T8415] BUG: KASAN: out-of-bounds in __skb_datagram_iter+0x6b8/0x770 [ 72.199589][ T8415] Read of size 4 at addr ffff888032950004 by task syz-fuzzer/8415 [ 72.207389][ T8415] [ 72.209705][ T8415] CPU: 0 PID: 8415 Comm: syz-fuzzer Not tainted 5.12.0-rc8-next-20210423-syzkaller #0 [ 72.219250][ T8415] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 72.229304][ T8415] Call Trace: [ 72.232596][ T8415] dump_stack+0x141/0x1d7 [ 72.236948][ T8415] ? __skb_datagram_iter+0x6b8/0x770 [ 72.242227][ T8415] print_address_description.constprop.0.cold+0x5b/0x2f8 [ 72.249265][ T8415] ? __skb_datagram_iter+0x6b8/0x770 [ 72.254547][ T8415] ? __skb_datagram_iter+0x6b8/0x770 [ 72.259827][ T8415] kasan_report.cold+0x7c/0xd8 [ 72.264593][ T8415] ? __skb_datagram_iter+0x6b8/0x770 [ 72.269876][ T8415] __skb_datagram_iter+0x6b8/0x770 [ 72.275005][ T8415] ? zerocopy_sg_from_iter+0x110/0x110 [ 72.280513][ T8415] skb_copy_datagram_iter+0x40/0x50 [ 72.285727][ T8415] tcp_recvmsg_locked+0x1048/0x22f0 [ 72.290940][ T8415] ? tcp_splice_read+0x8b0/0x8b0 [ 72.295898][ T8415] ? mark_held_locks+0x9f/0xe0 [ 72.300674][ T8415] ? __local_bh_enable_ip+0xa0/0x120 [ 72.305973][ T8415] tcp_recvmsg+0x134/0x550 [ 72.310406][ T8415] ? tcp_recvmsg_locked+0x22f0/0x22f0 [ 72.315779][ T8415] ? aa_sk_perm+0x311/0xab0 [ 72.320297][ T8415] inet_recvmsg+0x11b/0x5e0 [ 72.324817][ T8415] ? inet_sendpage+0x140/0x140 [ 72.329605][ T8415] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 72.335865][ T8415] ? security_socket_recvmsg+0x8f/0xc0 [ 72.341336][ T8415] sock_read_iter+0x33c/0x470 [ 72.346013][ T8415] ? ____sys_recvmsg+0x600/0x600 [ 72.350966][ T8415] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 72.357212][ T8415] ? fsnotify+0xa58/0x1060 [ 72.361621][ T8415] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 72.367866][ T8415] new_sync_read+0x5b7/0x6e0 [ 72.372457][ T8415] ? ksys_lseek+0x1b0/0x1b0 [ 72.377105][ T8415] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 72.383118][ T8415] vfs_read+0x35c/0x570 [ 72.387312][ T8415] ksys_read+0x1ee/0x250 [ 72.391544][ T8415] ? vfs_write+0xa40/0xa40 [ 72.395959][ T8415] ? syscall_enter_from_user_mode+0x27/0x70 [ 72.401856][ T8415] do_syscall_64+0x3a/0xb0 [ 72.406274][ T8415] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 72.412166][ T8415] RIP: 0033:0x4af19b [ 72.416067][ T8415] Code: fb ff eb bd e8 a6 b6 fb ff e9 61 ff ff ff cc e8 9b 82 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30 [ 72.435675][ T8415] RSP: 002b:000000c0004a7850 EFLAGS: 00000206 ORIG_RAX: 0000000000000000 [ 72.444090][ T8415] RAX: ffffffffffffffda RBX: 000000c00001c000 RCX: 00000000004af19b [ 72.452060][ T8415] RDX: 0000000000001000 RSI: 000000c000288000 RDI: 0000000000000006 [ 72.460030][ T8415] RBP: 000000c0004a78a0 R08: 0000000000000001 R09: 0000000000000002 [ 72.468000][ T8415] R10: 0000000000002b6e R11: 0000000000000206 R12: ffffffffffffffff [ 72.475970][ T8415] R13: 0000000000002000 R14: 0000000000000004 R15: 0000000000000004 [ 72.484001][ T8415] [ 72.486317][ T8415] The buggy address belongs to the page: [ 72.491937][ T8415] page:ffffea0000ca5400 refcount:12 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x32950 [ 72.502194][ T8415] head:ffffea0000ca5400 order:3 compound_mapcount:0 compound_pincount:0 [ 72.510860][ T8415] flags: 0xfff00000010000(head|node=0|zone=1|lastcpupid=0x7ff) [ 72.518418][ T8415] raw: 00fff00000010000 0000000000000000 dead000000000122 0000000000000000 [ 72.527008][ T8415] raw: 0000000000000000 0000000000000000 0000000cffffffff 0000000000000000 [ 72.535627][ T8415] page dumped because: kasan: bad access detected [ 72.542038][ T8415] [ 72.544363][ T8415] Memory state around the buggy address: [ 72.550014][ T8415] ffff88803294ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 72.558071][ T8415] ffff88803294ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 72.566141][ T8415] >ffff888032950000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 72.574191][ T8415] ^ [ 72.578259][ T8415] ffff888032950080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 72.586313][ T8415] ffff888032950100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 72.594407][ T8415] ================================================================== [ 72.602479][ T8415] Disabling lock debugging due to kernel taint [ 72.610368][ T8415] Kernel panic - not syncing: panic_on_warn set ... [ 72.617004][ T8415] CPU: 1 PID: 8415 Comm: syz-fuzzer Tainted: G B 5.12.0-rc8-next-20210423-syzkaller #0 [ 72.627947][ T8415] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 72.638015][ T8415] Call Trace: [ 72.641318][ T8415] dump_stack+0x141/0x1d7 [ 72.645668][ T8415] panic+0x306/0x73d [ 72.649576][ T8415] ? __warn_printk+0xf3/0xf3 [ 72.654179][ T8415] ? preempt_schedule_common+0x59/0xc0 [ 72.659653][ T8415] ? __skb_datagram_iter+0x6b8/0x770 [ 72.664964][ T8415] ? preempt_schedule_thunk+0x16/0x18 [ 72.670366][ T8415] ? trace_hardirqs_on+0x38/0x1c0 [ 72.675414][ T8415] ? trace_hardirqs_on+0x51/0x1c0 [ 72.680463][ T8415] ? __skb_datagram_iter+0x6b8/0x770 [ 72.685784][ T8415] ? __skb_datagram_iter+0x6b8/0x770 [ 72.691086][ T8415] end_report.cold+0x5a/0x5a [ 72.695700][ T8415] kasan_report.cold+0x6a/0xd8 [ 72.700501][ T8415] ? __skb_datagram_iter+0x6b8/0x770 [ 72.705825][ T8415] __skb_datagram_iter+0x6b8/0x770 [ 72.710955][ T8415] ? zerocopy_sg_from_iter+0x110/0x110 [ 72.716492][ T8415] skb_copy_datagram_iter+0x40/0x50 [ 72.721732][ T8415] tcp_recvmsg_locked+0x1048/0x22f0 [ 72.726956][ T8415] ? tcp_splice_read+0x8b0/0x8b0 [ 72.731909][ T8415] ? mark_held_locks+0x9f/0xe0 [ 72.736699][ T8415] ? __local_bh_enable_ip+0xa0/0x120 [ 72.742012][ T8415] tcp_recvmsg+0x134/0x550 [ 72.746463][ T8415] ? tcp_recvmsg_locked+0x22f0/0x22f0 [ 72.751874][ T8415] ? aa_sk_perm+0x311/0xab0 [ 72.756390][ T8415] inet_recvmsg+0x11b/0x5e0 [ 72.760925][ T8415] ? inet_sendpage+0x140/0x140 [ 72.765709][ T8415] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 72.771984][ T8415] ? security_socket_recvmsg+0x8f/0xc0 [ 72.778598][ T8415] sock_read_iter+0x33c/0x470 [ 72.783409][ T8415] ? ____sys_recvmsg+0x600/0x600 [ 72.788370][ T8415] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 72.794627][ T8415] ? fsnotify+0xa58/0x1060 [ 72.799075][ T8415] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 72.805334][ T8415] new_sync_read+0x5b7/0x6e0 [ 72.809954][ T8415] ? ksys_lseek+0x1b0/0x1b0 [ 72.814472][ T8415] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 72.820841][ T8415] vfs_read+0x35c/0x570 [ 72.825021][ T8415] ksys_read+0x1ee/0x250 [ 72.829279][ T8415] ? vfs_write+0xa40/0xa40 [ 72.833711][ T8415] ? syscall_enter_from_user_mode+0x27/0x70 [ 72.839628][ T8415] do_syscall_64+0x3a/0xb0 [ 72.844074][ T8415] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 72.849983][ T8415] RIP: 0033:0x4af19b [ 72.853884][ T8415] Code: fb ff eb bd e8 a6 b6 fb ff e9 61 ff ff ff cc e8 9b 82 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30 [ 72.873593][ T8415] RSP: 002b:000000c0004a7850 EFLAGS: 00000206 ORIG_RAX: 0000000000000000 [ 72.882032][ T8415] RAX: ffffffffffffffda RBX: 000000c00001c000 RCX: 00000000004af19b [ 72.890026][ T8415] RDX: 0000000000001000 RSI: 000000c000288000 RDI: 0000000000000006 [ 72.898012][ T8415] RBP: 000000c0004a78a0 R08: 0000000000000001 R09: 0000000000000002 [ 72.906001][ T8415] R10: 0000000000002b6e R11: 0000000000000206 R12: ffffffffffffffff [ 72.913981][ T8415] R13: 0000000000002000 R14: 0000000000000004 R15: 0000000000000004 [ 72.922514][ T8415] Kernel Offset: disabled [ 72.926837][ T8415] Rebooting in 86400 seconds..