Enabling of bearer rejected, failed to enable media Enabling of bearer rejected, failed to enable media Enabling of bearer rejected, failed to enable media Enabling of bearer rejected, failed to enable media ================================================================== BUG: KASAN: use-after-free in con_shutdown+0x85/0x90 drivers/tty/vt/vt.c:3253 Write of size 8 at addr ffff888085370748 by task syz-executor.2/4957 CPU: 1 PID: 4957 Comm: syz-executor.2 Not tainted 4.19.89-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report mm/kasan/report.c:412 [inline] kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:396 __asan_report_store8_noabort+0x17/0x20 mm/kasan/report.c:438 con_shutdown+0x85/0x90 drivers/tty/vt/vt.c:3253 release_tty+0xe4/0x4d0 drivers/tty/tty_io.c:1509 tty_release_struct+0x3c/0x50 drivers/tty/tty_io.c:1624 tty_release+0xbcb/0xe90 drivers/tty/tty_io.c:1784 __fput+0x2dd/0x8b0 fs/file_table.c:278 ____fput+0x16/0x20 fs/file_table.c:309 task_work_run+0x145/0x1c0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:193 [inline] exit_to_usermode_loop+0x273/0x2c0 arch/x86/entry/common.c:167 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x53d/0x620 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4144a1 Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 RSP: 002b:00007ffd097b3650 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00000000004144a1 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 RBP: 0000000000000001 R08: 00000000c60c86c1 R09: 00000000c60c86c5 R10: 00007ffd097b3730 R11: 0000000000000293 R12: 000000000075c9a0 R13: 000000000075c9a0 R14: 00000000007601e8 R15: 000000000075bfd4 Allocated by task 4960: save_stack+0x45/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc mm/kasan/kasan.c:553 [inline] kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531 kmem_cache_alloc_trace+0x152/0x760 mm/slab.c:3625 kmalloc include/linux/slab.h:515 [inline] kzalloc include/linux/slab.h:709 [inline] vc_allocate drivers/tty/vt/vt.c:1088 [inline] vc_allocate+0x1f5/0x760 drivers/tty/vt/vt.c:1069 con_install+0x52/0x410 drivers/tty/vt/vt.c:3204 tty_driver_install_tty drivers/tty/tty_io.c:1226 [inline] tty_init_dev drivers/tty/tty_io.c:1339 [inline] tty_init_dev+0xf7/0x460 drivers/tty/tty_io.c:1316 tty_open_by_driver drivers/tty/tty_io.c:1981 [inline] tty_open+0x4bf/0xb70 drivers/tty/tty_io.c:2029 chrdev_open+0x245/0x6b0 fs/char_dev.c:423 do_dentry_open+0x4c3/0x1210 fs/open.c:796 vfs_open+0xa0/0xd0 fs/open.c:905 do_last fs/namei.c:3418 [inline] path_openat+0x10d7/0x45e0 fs/namei.c:3534 do_filp_open+0x1a1/0x280 fs/namei.c:3564 do_sys_open+0x3fe/0x550 fs/open.c:1088 __do_sys_open fs/open.c:1106 [inline] __se_sys_open fs/open.c:1101 [inline] __x64_sys_open+0x7e/0xc0 fs/open.c:1101 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 4969: save_stack+0x45/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528 __cache_free mm/slab.c:3503 [inline] kfree+0xcf/0x220 mm/slab.c:3822 vt_disallocate_all+0x2bd/0x3e0 drivers/tty/vt/vt_ioctl.c:323 vt_ioctl+0xc38/0x2530 drivers/tty/vt/vt_ioctl.c:816 tty_ioctl+0x7f3/0x1510 drivers/tty/tty_io.c:2669 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0xd5f/0x1380 fs/ioctl.c:688 ksys_ioctl+0xab/0xd0 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:710 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff888085370640 which belongs to the cache kmalloc-2048 of size 2048 The buggy address is located 264 bytes inside of 2048-byte region [ffff888085370640, ffff888085370e40) The buggy address belongs to the page: page:ffffea000214dc00 count:1 mapcount:0 mapping:ffff88812c31cc40 index:0x0 compound_mapcount: 0 flags: 0xfffe0000008100(slab|head) raw: 00fffe0000008100 ffffea0001736f88 ffffea0001664c88 ffff88812c31cc40 raw: 0000000000000000 ffff888085370640 0000000100000003 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888085370600: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ffff888085370680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888085370700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888085370780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888085370800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================