[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 88.863023][ T23] audit: type=1800 audit(1583309268.675:25): pid=9572 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 88.883008][ T23] audit: type=1800 audit(1583309268.675:26): pid=9572 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 88.953924][ T23] audit: type=1800 audit(1583309268.675:27): pid=9572 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.43' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 98.679638][ T9728] ================================================================== [ 98.679698][ T9728] BUG: KASAN: slab-out-of-bounds in soft_cursor+0x439/0xa30 [ 98.679712][ T9728] Read of size 64 at addr ffff8880a2c25950 by task syz-executor556/9728 [ 98.679715][ T9728] [ 98.679731][ T9728] CPU: 1 PID: 9728 Comm: syz-executor556 Not tainted 5.6.0-rc3-syzkaller #0 [ 98.679740][ T9728] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 98.679745][ T9728] Call Trace: [ 98.679764][ T9728] dump_stack+0x197/0x210 [ 98.679777][ T9728] ? soft_cursor+0x439/0xa30 [ 98.679803][ T9728] print_address_description.constprop.0.cold+0xd4/0x30b [ 98.679816][ T9728] ? soft_cursor+0x439/0xa30 [ 98.679830][ T9728] ? soft_cursor+0x439/0xa30 [ 98.679848][ T9728] __kasan_report.cold+0x1b/0x32 [ 98.679868][ T9728] ? soft_cursor+0x439/0xa30 [ 98.679888][ T9728] kasan_report+0x12/0x20 [ 98.679907][ T9728] check_memory_region+0x134/0x1a0 [ 98.679927][ T9728] memcpy+0x24/0x50 [ 98.679945][ T9728] soft_cursor+0x439/0xa30 [ 98.679961][ T9728] ? lockdep_hardirqs_on+0x421/0x5e0 [ 98.679999][ T9728] bit_cursor+0x12fc/0x1a60 [ 98.680033][ T9728] ? bit_clear+0x530/0x530 [ 98.680049][ T9728] ? find_held_lock+0x35/0x130 [ 98.680088][ T9728] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 98.680109][ T9728] ? get_color+0x225/0x430 [ 98.680135][ T9728] fbcon_cursor+0x487/0x660 [ 98.680148][ T9728] ? bit_clear+0x530/0x530 [ 98.680173][ T9728] hide_cursor+0x9d/0x2b0 [ 98.680195][ T9728] redraw_screen+0x60b/0x7d0 [ 98.680218][ T9728] ? respond_string+0x2c0/0x2c0 [ 98.680254][ T9728] vc_do_resize+0x10c9/0x1460 [ 98.680270][ T9728] ? down+0x50/0x90 [ 98.680321][ T9728] ? vc_uniscr_alloc+0xd0/0xd0 [ 98.680342][ T9728] ? lock_acquire+0x190/0x410 [ 98.680358][ T9728] ? vt_ioctl+0x1f56/0x26c0 [ 98.680393][ T9728] vc_resize+0x4d/0x60 [ 98.680413][ T9728] vt_ioctl+0x207b/0x26c0 [ 98.680437][ T9728] ? complete_change_console+0x3a0/0x3a0 [ 98.680479][ T9728] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 98.680498][ T9728] ? tty_jobctrl_ioctl+0x50/0xd40 [ 98.680515][ T9728] ? complete_change_console+0x3a0/0x3a0 [ 98.680536][ T9728] tty_ioctl+0xa37/0x14f0 [ 98.680558][ T9728] ? tty_vhangup+0x30/0x30 [ 98.680575][ T9728] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 98.680592][ T9728] ? do_vfs_ioctl+0x568/0x13b0 [ 98.680618][ T9728] ? ioctl_file_clone+0x180/0x180 [ 98.680636][ T9728] ? file_open_root+0x430/0x430 [ 98.680683][ T9728] ? tomoyo_file_ioctl+0x23/0x30 [ 98.680698][ T9728] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 98.680714][ T9728] ? security_file_ioctl+0x8d/0xc0 [ 98.680725][ T9728] ? tty_vhangup+0x30/0x30 [ 98.680740][ T9728] ksys_ioctl+0x123/0x180 [ 98.680757][ T9728] __x64_sys_ioctl+0x73/0xb0 [ 98.680769][ T9728] do_syscall_64+0xfa/0x790 [ 98.680783][ T9728] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 98.680791][ T9728] RIP: 0033:0x440269 [ 98.680801][ T9728] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b 14 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 98.680805][ T9728] RSP: 002b:00007ffe157a26c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 98.680813][ T9728] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440269 [ 98.680818][ T9728] RDX: 0000000020000080 RSI: 000000000000560a RDI: 0000000000000004 [ 98.680823][ T9728] RBP: 00000000006cb018 R08: 0000000000000001 R09: 00000000004002c8 [ 98.680827][ T9728] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000401b50 [ 98.680832][ T9728] R13: 0000000000401be0 R14: 0000000000000000 R15: 0000000000000000 [ 98.680850][ T9728] [ 98.680854][ T9728] Allocated by task 9728: [ 98.680863][ T9728] save_stack+0x23/0x90 [ 98.680871][ T9728] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 98.680879][ T9728] kasan_kmalloc+0x9/0x10 [ 98.680886][ T9728] __kmalloc+0x163/0x770 [ 98.680894][ T9728] fbcon_set_font+0x32d/0x860 [ 98.680901][ T9728] con_font_op+0xe30/0x1270 [ 98.680908][ T9728] vt_ioctl+0x181a/0x26c0 [ 98.680914][ T9728] tty_ioctl+0xa37/0x14f0 [ 98.680921][ T9728] ksys_ioctl+0x123/0x180 [ 98.680928][ T9728] __x64_sys_ioctl+0x73/0xb0 [ 98.680936][ T9728] do_syscall_64+0xfa/0x790 [ 98.680943][ T9728] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 98.680946][ T9728] [ 98.680949][ T9728] Freed by task 0: [ 98.680951][ T9728] (stack is not available) [ 98.680953][ T9728] [ 98.680959][ T9728] The buggy address belongs to the object at ffff8880a2c24000 [ 98.680959][ T9728] which belongs to the cache kmalloc-8k of size 8192 [ 98.680967][ T9728] The buggy address is located 6480 bytes inside of [ 98.680967][ T9728] 8192-byte region [ffff8880a2c24000, ffff8880a2c26000) [ 98.680969][ T9728] The buggy address belongs to the page: [ 98.680978][ T9728] page:ffffea00028b0900 refcount:1 mapcount:0 mapping:ffff8880aa4021c0 index:0x0 compound_mapcount: 0 [ 98.680985][ T9728] flags: 0xfffe0000010200(slab|head) [ 98.680999][ T9728] raw: 00fffe0000010200 ffffea00024cb308 ffffea00025fa408 ffff8880aa4021c0 [ 98.681008][ T9728] raw: 0000000000000000 ffff8880a2c24000 0000000100000001 0000000000000000 [ 98.681012][ T9728] page dumped because: kasan: bad access detected [ 98.681014][ T9728] [ 98.681017][ T9728] Memory state around the buggy address: [ 98.681023][ T9728] ffff8880a2c25800: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 98.681029][ T9728] ffff8880a2c25880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 98.681035][ T9728] >ffff8880a2c25900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 98.681039][ T9728] ^ [ 98.681045][ T9728] ffff8880a2c25980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 98.681051][ T9728] ffff8880a2c25a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 98.681054][ T9728] ================================================================== [ 98.681056][ T9728] Disabling lock debugging due to kernel taint [ 98.681061][ T9728] Kernel panic - not syncing: panic_on_warn set ... [ 98.681069][ T9728] CPU: 1 PID: 9728 Comm: syz-executor556 Tainted: G B 5.6.0-rc3-syzkaller #0 [ 98.681073][ T9728] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 98.681075][ T9728] Call Trace: [ 98.681084][ T9728] dump_stack+0x197/0x210 [ 98.681095][ T9728] panic+0x2e3/0x75c [ 98.681102][ T9728] ? add_taint.cold+0x16/0x16 [ 98.681116][ T9728] ? trace_hardirqs_on+0x67/0x240 [ 98.681124][ T9728] ? trace_hardirqs_on+0x5e/0x240 [ 98.681131][ T9728] ? soft_cursor+0x439/0xa30 [ 98.681139][ T9728] end_report+0x47/0x4f [ 98.681145][ T9728] ? soft_cursor+0x439/0xa30 [ 98.681152][ T9728] __kasan_report.cold+0xe/0x32 [ 98.681160][ T9728] ? soft_cursor+0x439/0xa30 [ 98.681168][ T9728] kasan_report+0x12/0x20 [ 98.681177][ T9728] check_memory_region+0x134/0x1a0 [ 98.681185][ T9728] memcpy+0x24/0x50 [ 98.681192][ T9728] soft_cursor+0x439/0xa30 [ 98.681199][ T9728] ? lockdep_hardirqs_on+0x421/0x5e0 [ 98.681210][ T9728] bit_cursor+0x12fc/0x1a60 [ 98.681225][ T9728] ? bit_clear+0x530/0x530 [ 98.681232][ T9728] ? find_held_lock+0x35/0x130 [ 98.681245][ T9728] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 98.681253][ T9728] ? get_color+0x225/0x430 [ 98.681262][ T9728] fbcon_cursor+0x487/0x660 [ 98.681268][ T9728] ? bit_clear+0x530/0x530 [ 98.681276][ T9728] hide_cursor+0x9d/0x2b0 [ 98.681284][ T9728] redraw_screen+0x60b/0x7d0 [ 98.681293][ T9728] ? respond_string+0x2c0/0x2c0 [ 98.681304][ T9728] vc_do_resize+0x10c9/0x1460 [ 98.681312][ T9728] ? down+0x50/0x90 [ 98.681326][ T9728] ? vc_uniscr_alloc+0xd0/0xd0 [ 98.681334][ T9728] ? lock_acquire+0x190/0x410 [ 98.681341][ T9728] ? vt_ioctl+0x1f56/0x26c0 [ 98.681351][ T9728] vc_resize+0x4d/0x60 [ 98.681359][ T9728] vt_ioctl+0x207b/0x26c0 [ 98.681368][ T9728] ? complete_change_console+0x3a0/0x3a0 [ 98.681390][ T9728] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 98.681398][ T9728] ? tty_jobctrl_ioctl+0x50/0xd40 [ 98.681406][ T9728] ? complete_change_console+0x3a0/0x3a0 [ 98.681413][ T9728] tty_ioctl+0xa37/0x14f0 [ 98.681422][ T9728] ? tty_vhangup+0x30/0x30 [ 98.681430][ T9728] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 98.681437][ T9728] ? do_vfs_ioctl+0x568/0x13b0 [ 98.681447][ T9728] ? ioctl_file_clone+0x180/0x180 [ 98.681454][ T9728] ? file_open_root+0x430/0x430 [ 98.681469][ T9728] ? tomoyo_file_ioctl+0x23/0x30 [ 98.681477][ T9728] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 98.681485][ T9728] ? security_file_ioctl+0x8d/0xc0 [ 98.681491][ T9728] ? tty_vhangup+0x30/0x30 [ 98.681499][ T9728] ksys_ioctl+0x123/0x180 [ 98.681509][ T9728] __x64_sys_ioctl+0x73/0xb0 [ 98.681517][ T9728] do_syscall_64+0xfa/0x790 [ 98.681527][ T9728] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 98.681532][ T9728] RIP: 0033:0x440269 [ 98.681539][ T9728] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b 14 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 98.681542][ T9728] RSP: 002b:00007ffe157a26c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 98.681549][ T9728] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440269 [ 98.681553][ T9728] RDX: 0000000020000080 RSI: 000000000000560a RDI: 0000000000000004 [ 98.681557][ T9728] RBP: 00000000006cb018 R08: 0000000000000001 R09: 00000000004002c8 [ 98.681561][ T9728] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000401b50 [ 98.681565][ T9728] R13: 0000000000401be0 R14: 0000000000000000 R15: 0000000000000000 [ 98.683084][ T9728] Kernel Offset: disabled [ 99.595579][ T9728] Rebooting in 86400 seconds..