Warning: Permanently added '10.128.15.196' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 59.397912] audit: type=1400 audit(1582760460.970:36): avc: denied { map } for pid=8204 comm="syz-executor190" path="/root/syz-executor190209486" dev="sda1" ino=16484 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 59.458907] ================================================================== [ 59.458947] BUG: KASAN: use-after-free in con_shutdown+0x7f/0x90 [ 59.458957] Write of size 8 at addr ffff888090a942c8 by task syz-executor190/8214 [ 59.458960] [ 59.458973] CPU: 1 PID: 8214 Comm: syz-executor190 Not tainted 4.19.106-syzkaller #0 [ 59.458981] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 59.458985] Call Trace: [ 59.459001] dump_stack+0x188/0x20d [ 59.459015] ? con_shutdown+0x7f/0x90 [ 59.459031] print_address_description.cold+0x7c/0x212 [ 59.459044] ? con_shutdown+0x7f/0x90 [ 59.459057] kasan_report.cold+0x88/0x2b9 [ 59.459069] ? set_palette+0x1b0/0x1b0 [ 59.459083] con_shutdown+0x7f/0x90 [ 59.459095] release_tty+0xda/0x4c0 [ 59.459110] tty_release_struct+0x37/0x50 [ 59.459123] tty_release+0xbc7/0xe90 [ 59.459142] ? tty_release_struct+0x50/0x50 [ 59.459155] __fput+0x2cd/0x890 [ 59.459174] task_work_run+0x13f/0x1b0 [ 59.459191] do_exit+0xbcd/0x2f30 [ 59.459210] ? mm_update_next_owner+0x650/0x650 [ 59.459225] ? up_read+0x17/0x110 [ 59.459237] ? __do_page_fault+0x44e/0xdd0 [ 59.459254] do_group_exit+0x125/0x350 [ 59.459267] __x64_sys_exit_group+0x3a/0x50 [ 59.459279] do_syscall_64+0xf9/0x620 [ 59.459297] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 59.459307] RIP: 0033:0x43ff38 [ 59.459318] Code: 00 00 be 3c 00 00 00 eb 19 66 0f 1f 84 00 00 00 00 00 48 89 d7 89 f0 0f 05 48 3d 00 f0 ff ff 77 21 f4 48 89 d7 44 89 c0 0f 05 <48> 3d 00 f0 ff ff 76 e0 f7 d8 64 41 89 01 eb d8 0f 1f 84 00 00 00 [ 59.459325] RSP: 002b:00007ffc85653948 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 59.459338] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043ff38 [ 59.459345] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 59.459351] RBP: 00000000004bf950 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 59.459357] R10: 0000000000000064 R11: 0000000000000246 R12: 0000000000000001 [ 59.459364] R13: 00000000006d2180 R14: 0000000000000000 R15: 0000000000000000 [ 59.459380] [ 59.459385] Allocated by task 8214: [ 59.459396] kasan_kmalloc+0xbf/0xe0 [ 59.459405] kmem_cache_alloc_trace+0x14d/0x7a0 [ 59.459415] vc_allocate+0x1db/0x6d0 [ 59.459426] con_install+0x4f/0x400 [ 59.459435] tty_init_dev+0xee/0x450 [ 59.459444] tty_open+0x4b0/0xb00 [ 59.459453] chrdev_open+0x219/0x5c0 [ 59.459463] do_dentry_open+0x4a8/0x1160 [ 59.459475] path_openat+0x1031/0x4200 [ 59.459485] do_filp_open+0x1a1/0x280 [ 59.459495] do_sys_open+0x3c0/0x500 [ 59.459505] do_syscall_64+0xf9/0x620 [ 59.459516] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 59.459519] [ 59.459524] Freed by task 8213: [ 59.459534] __kasan_slab_free+0xf7/0x140 [ 59.459543] kfree+0xce/0x220 [ 59.459556] vt_disallocate_all+0x293/0x3b0 [ 59.459566] vt_ioctl+0xb79/0x2320 [ 59.459576] tty_ioctl+0x7a1/0x1420 [ 59.459587] do_vfs_ioctl+0xcda/0x12e0 [ 59.459597] ksys_ioctl+0x9b/0xc0 [ 59.459606] __x64_sys_ioctl+0x6f/0xb0 [ 59.459618] do_syscall_64+0xf9/0x620 [ 59.459629] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 59.459631] [ 59.459640] The buggy address belongs to the object at ffff888090a941c0 [ 59.459640] which belongs to the cache kmalloc-2048 of size 2048 [ 59.459649] The buggy address is located 264 bytes inside of [ 59.459649] 2048-byte region [ffff888090a941c0, ffff888090a949c0) [ 59.459652] The buggy address belongs to the page: [ 59.459660] page:ffffea000242a500 count:1 mapcount:0 mapping:ffff88812c3dcc40 index:0x0 compound_mapcount: 0 [ 59.459679] flags: 0xfffe0000008100(slab|head) [ 59.459694] raw: 00fffe0000008100 ffffea0002429e08 ffffea00024a1108 ffff88812c3dcc40 [ 59.459706] raw: 0000000000000000 ffff888090a941c0 0000000100000003 0000000000000000 [ 59.459711] page dumped because: kasan: bad access detected [ 59.459713] [ 59.459717] Memory state around the buggy address: [ 59.459724] ffff888090a94180: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 59.459731] ffff888090a94200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 59.459738] >ffff888090a94280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 59.459742] ^ [ 59.459749] ffff888090a94300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 59.459756] ffff888090a94380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 59.459759] ================================================================== [ 59.459762] Disabling lock debugging due to kernel taint [ 59.459889] Kernel panic - not syncing: panic_on_warn set ... [ 59.459889] [ 59.459902] CPU: 1 PID: 8214 Comm: syz-executor190 Tainted: G B 4.19.106-syzkaller #0 [ 59.459909] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 59.459912] Call Trace: [ 59.459925] dump_stack+0x188/0x20d [ 59.459940] panic+0x26a/0x50e [ 59.459952] ? __warn_printk+0xf3/0xf3 [ 59.459965] ? preempt_schedule_common+0x4a/0xc0 [ 59.459976] ? con_shutdown+0x7f/0x90 [ 59.459988] ? ___preempt_schedule+0x16/0x18 [ 59.460001] ? trace_hardirqs_on+0x55/0x210 [ 59.460013] ? con_shutdown+0x7f/0x90 [ 59.460025] kasan_end_report+0x43/0x49 [ 59.460036] kasan_report.cold+0xa4/0x2b9 [ 59.460048] ? set_palette+0x1b0/0x1b0 [ 59.460058] con_shutdown+0x7f/0x90 [ 59.460070] release_tty+0xda/0x4c0 [ 59.460082] tty_release_struct+0x37/0x50 [ 59.460092] tty_release+0xbc7/0xe90 [ 59.460106] ? tty_release_struct+0x50/0x50 [ 59.460116] __fput+0x2cd/0x890 [ 59.460131] task_work_run+0x13f/0x1b0 [ 59.460143] do_exit+0xbcd/0x2f30 [ 59.460158] ? mm_update_next_owner+0x650/0x650 [ 59.460170] ? up_read+0x17/0x110 [ 59.460181] ? __do_page_fault+0x44e/0xdd0 [ 59.460194] do_group_exit+0x125/0x350 [ 59.460207] __x64_sys_exit_group+0x3a/0x50 [ 59.460218] do_syscall_64+0xf9/0x620 [ 59.460232] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 59.460239] RIP: 0033:0x43ff38 [ 59.460250] Code: 00 00 be 3c 00 00 00 eb 19 66 0f 1f 84 00 00 00 00 00 48 89 d7 89 f0 0f 05 48 3d 00 f0 ff ff 77 21 f4 48 89 d7 44 89 c0 0f 05 <48> 3d 00 f0 ff ff 76 e0 f7 d8 64 41 89 01 eb d8 0f 1f 84 00 00 00 [ 59.460256] RSP: 002b:00007ffc85653948 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 59.460265] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043ff38 [ 59.460270] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 59.460276] RBP: 00000000004bf950 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 59.460282] R10: 0000000000000064 R11: 0000000000000246 R12: 0000000000000001 [ 59.460288] R13: 00000000006d2180 R14: 0000000000000000 R15: 0000000000000000 [ 59.461636] Kernel Offset: disabled [ 60.083791] Rebooting in 86400 seconds..