Warning: Permanently added '10.128.10.13' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program executing program syzkaller login: [ 40.347387][ T7176] ================================================================== [ 40.347428][ T7176] BUG: KASAN: use-after-free in con_shutdown+0x61/0x80 [ 40.347436][ T7176] Write of size 8 at addr ffff88809f303108 by task syz-executor395/7176 [ 40.347439][ T7176] [ 40.347450][ T7176] CPU: 0 PID: 7176 Comm: syz-executor395 Not tainted 5.6.0-rc7-syzkaller #0 [ 40.347455][ T7176] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 40.347459][ T7176] Call Trace: [ 40.347472][ T7176] dump_stack+0x1e9/0x30e [ 40.347490][ T7176] print_address_description+0x74/0x5c0 [ 40.347506][ T7176] ? printk+0x62/0x83 [ 40.347518][ T7176] ? vprintk_emit+0x2e6/0x3b0 [ 40.347536][ T7176] __kasan_report+0x14b/0x1c0 [ 40.347547][ T7176] ? con_shutdown+0x61/0x80 [ 40.347563][ T7176] kasan_report+0x25/0x50 [ 40.347575][ T7176] con_shutdown+0x61/0x80 [ 40.347583][ T7176] ? con_close+0x10/0x10 [ 40.347594][ T7176] release_tty+0xb9/0x530 [ 40.347610][ T7176] tty_release_struct+0xb8/0xd0 [ 40.347624][ T7176] tty_release+0xe23/0x1100 [ 40.347655][ T7176] ? tty_release_struct+0xd0/0xd0 [ 40.347665][ T7176] __fput+0x2d8/0x730 [ 40.347698][ T7176] task_work_run+0x176/0x1b0 [ 40.347716][ T7176] do_exit+0x5ef/0x1f80 [ 40.347739][ T7176] ? __up_read+0x1f1/0x6e0 [ 40.347759][ T7176] do_group_exit+0x15e/0x2c0 [ 40.347768][ T7176] ? trace_irq_disable_rcuidle+0x1f/0x1d0 [ 40.347785][ T7176] __do_sys_exit_group+0x13/0x20 [ 40.347793][ T7176] __se_sys_exit_group+0x10/0x10 [ 40.347803][ T7176] __x64_sys_exit_group+0x37/0x40 [ 40.347814][ T7176] do_syscall_64+0xf3/0x1b0 [ 40.347831][ T7176] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 40.347839][ T7176] RIP: 0033:0x43ff38 [ 40.347849][ T7176] Code: Bad RIP value. [ 40.347854][ T7176] RSP: 002b:00007ffc3c79eaa8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 40.347863][ T7176] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043ff38 [ 40.347868][ T7176] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 40.347873][ T7176] RBP: 00000000004bf950 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 40.347879][ T7176] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 40.347883][ T7176] R13: 00000000006d2180 R14: 0000000000000000 R15: 0000000000000000 [ 40.347908][ T7176] [ 40.347913][ T7176] Allocated by task 7176: [ 40.347921][ T7176] __kasan_kmalloc+0x118/0x1c0 [ 40.347928][ T7176] kmem_cache_alloc_trace+0x234/0x300 [ 40.347933][ T7176] vc_allocate+0x148/0x5b0 [ 40.347939][ T7176] con_install+0x48/0x460 [ 40.347945][ T7176] tty_init_dev+0xc6/0x4c0 [ 40.347951][ T7176] tty_open+0x7cd/0xca0 [ 40.347956][ T7176] chrdev_open+0x498/0x580 [ 40.347962][ T7176] do_dentry_open+0x828/0x10a0 [ 40.347969][ T7176] path_openat+0x13b5/0x40d0 [ 40.347975][ T7176] do_filp_open+0x191/0x3a0 [ 40.347980][ T7176] do_sys_openat2+0x448/0x6c0 [ 40.347986][ T7176] __x64_sys_open+0x1af/0x1e0 [ 40.347992][ T7176] do_syscall_64+0xf3/0x1b0 [ 40.347999][ T7176] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 40.348001][ T7176] [ 40.348004][ T7176] Freed by task 7178: [ 40.348010][ T7176] __kasan_slab_free+0x12e/0x1e0 [ 40.348015][ T7176] kfree+0x10a/0x220 [ 40.348022][ T7176] vt_ioctl+0x229d/0x3a30 [ 40.348028][ T7176] tty_ioctl+0xee6/0x15c0 [ 40.348033][ T7176] __se_sys_ioctl+0xf9/0x160 [ 40.348045][ T7176] do_syscall_64+0xf3/0x1b0 [ 40.348052][ T7176] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 40.348054][ T7176] [ 40.348060][ T7176] The buggy address belongs to the object at ffff88809f303000 [ 40.348060][ T7176] which belongs to the cache kmalloc-2k of size 2048 [ 40.348066][ T7176] The buggy address is located 264 bytes inside of [ 40.348066][ T7176] 2048-byte region [ffff88809f303000, ffff88809f303800) [ 40.348068][ T7176] The buggy address belongs to the page: [ 40.348076][ T7176] page:ffffea00027cc0c0 refcount:1 mapcount:0 mapping:ffff8880aa400e00 index:0x0 [ 40.348081][ T7176] flags: 0xfffe0000000200(slab) [ 40.348090][ T7176] raw: 00fffe0000000200 ffffea00027ff5c8 ffffea00027b4d88 ffff8880aa400e00 [ 40.348098][ T7176] raw: 0000000000000000 ffff88809f303000 0000000100000001 0000000000000000 [ 40.348101][ T7176] page dumped because: kasan: bad access detected [ 40.348103][ T7176] [ 40.348105][ T7176] Memory state around the buggy address: [ 40.348110][ T7176] ffff88809f303000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.348115][ T7176] ffff88809f303080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.348120][ T7176] >ffff88809f303100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.348123][ T7176] ^ [ 40.348128][ T7176] ffff88809f303180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.348133][ T7176] ffff88809f303200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.348136][ T7176] ================================================================== [ 40.348139][ T7176] Disabling lock debugging due to kernel taint [ 40.348199][ T7176] Kernel panic - not syncing: panic_on_warn set ... [ 40.348207][ T7176] CPU: 0 PID: 7176 Comm: syz-executor395 Tainted: G B 5.6.0-rc7-syzkaller #0 [ 40.348211][ T7176] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 40.348214][ T7176] Call Trace: [ 40.348222][ T7176] dump_stack+0x1e9/0x30e [ 40.348232][ T7176] panic+0x264/0x7a0 [ 40.348242][ T7176] ? trace_hardirqs_on+0x30/0x70 [ 40.348255][ T7176] __kasan_report+0x1bc/0x1c0 [ 40.348264][ T7176] ? con_shutdown+0x61/0x80 [ 40.348275][ T7176] kasan_report+0x25/0x50 [ 40.348284][ T7176] con_shutdown+0x61/0x80 [ 40.348291][ T7176] ? con_close+0x10/0x10 [ 40.348299][ T7176] release_tty+0xb9/0x530 [ 40.348311][ T7176] tty_release_struct+0xb8/0xd0 [ 40.348322][ T7176] tty_release+0xe23/0x1100 [ 40.348341][ T7176] ? tty_release_struct+0xd0/0xd0 [ 40.348348][ T7176] __fput+0x2d8/0x730 [ 40.348364][ T7176] task_work_run+0x176/0x1b0 [ 40.348376][ T7176] do_exit+0x5ef/0x1f80 [ 40.348390][ T7176] ? __up_read+0x1f1/0x6e0 [ 40.348402][ T7176] do_group_exit+0x15e/0x2c0 [ 40.348411][ T7176] ? trace_irq_disable_rcuidle+0x1f/0x1d0 [ 40.348423][ T7176] __do_sys_exit_group+0x13/0x20 [ 40.348432][ T7176] __se_sys_exit_group+0x10/0x10 [ 40.348441][ T7176] __x64_sys_exit_group+0x37/0x40 [ 40.348448][ T7176] do_syscall_64+0xf3/0x1b0 [ 40.348459][ T7176] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 40.348465][ T7176] RIP: 0033:0x43ff38 [ 40.348473][ T7176] Code: 00 00 be 3c 00 00 00 eb 19 66 0f 1f 84 00 00 00 00 00 48 89 d7 89 f0 0f 05 48 3d 00 f0 ff ff 77 21 f4 48 89 d7 44 89 c0 0f 05 <48> 3d 00 f0 ff ff 76 e0 f7 d8 64 41 89 01 eb d8 0f 1f 84 00 00 00 [ 40.348477][ T7176] RSP: 002b:00007ffc3c79eaa8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 40.348484][ T7176] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043ff38 [ 40.348488][ T7176] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 40.348492][ T7176] RBP: 00000000004bf950 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 40.348496][ T7176] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 40.348499][ T7176] R13: 00000000006d2180 R14: 0000000000000000 R15: 0000000000000000 [ 40.350148][ T7176] Kernel Offset: disabled