sock: process `syz-executor.0' is using obsolete setsockopt SO_BSDCOMPAT ================================================================================ UBSAN: Undefined behaviour in arch/x86/kernel/uprobes.c:276:56 index 4 is out of range for type 'insn_byte_t [4]' CPU: 0 PID: 8871 Comm: syz-executor.2 Not tainted 4.19.149-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x22c/0x33e lib/dump_stack.c:118 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161 __ubsan_handle_out_of_bounds.cold+0x63/0x6f lib/ubsan.c:383 is_prefix_bad arch/x86/kernel/uprobes.c:276 [inline] uprobe_init_insn arch/x86/kernel/uprobes.c:299 [inline] arch_uprobe_analyze_insn+0x9d8/0xaa0 arch/x86/kernel/uprobes.c:868 prepare_uprobe kernel/events/uprobes.c:611 [inline] install_breakpoint kernel/events/uprobes.c:654 [inline] uprobe_mmap+0x8c2/0xa70 kernel/events/uprobes.c:1096 mmap_region+0x552/0x1510 mm/mmap.c:1803 do_mmap+0x8e8/0x1080 mm/mmap.c:1530 do_mmap_pgoff include/linux/mm.h:2326 [inline] vm_mmap_pgoff+0x197/0x200 mm/util.c:357 ksys_mmap_pgoff+0x2d1/0x660 mm/mmap.c:1580 do_syscall_64+0xf9/0x670 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45de89 Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f5d8d08ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 RAX: ffffffffffffffda RBX: 0000000000021400 RCX: 000000000045de89 IPVS: ftp: loaded support on port[0] = 21 RDX: 0000000000000000 RSI: 0000000000003000 RDI: 0000000020007000 RBP: 000000000118bf78 R08: 0000000000000003 R09: 0000000000000000 R10: 0000000000000412 R11: 0000000000000246 R12: 000000000118bf2c R13: 00007ffd780f31ff R14: 00007f5d8d08f9c0 R15: 000000000118bf2c ================================================================================ EXT4-fs (loop5): Unsupported blocksize for fs encryption EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue kauditd_printk_skb: 1 callbacks suppressed audit: type=1400 audit(1601758484.618:21): avc: denied { name_bind } for pid=8995 comm="syz-executor.0" src=20000 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=dccp_socket permissive=1 audit: type=1400 audit(1601758484.688:22): avc: denied { node_bind } for pid=8995 comm="syz-executor.0" src=20000 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:node_t:s0 tclass=dccp_socket permissive=1 audit: type=1400 audit(1601758484.808:23): avc: denied { name_connect } for pid=8995 comm="syz-executor.0" dest=20000 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=dccp_socket permissive=1 EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue netlink: 28 bytes leftover after parsing attributes in process `syz-executor.1'. netlink: 28 bytes leftover after parsing attributes in process `syz-executor.1'. mmap: syz-executor.0 (9111) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue netlink: 'syz-executor.5': attribute type 2 has an invalid length. netlink: 'syz-executor.5': attribute type 2 has an invalid length. L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue attempt to access beyond end of device loop5: rw=2049, want=54, limit=32 Buffer I/O error on dev loop5, logical block 26, lost async page write attempt to access beyond end of device loop5: rw=2049, want=56, limit=32 Buffer I/O error on dev loop5, logical block 27, lost async page write attempt to access beyond end of device loop5: rw=2049, want=58, limit=32 Buffer I/O error on dev loop5, logical block 28, lost async page write attempt to access beyond end of device loop5: rw=2049, want=60, limit=32 Buffer I/O error on dev loop5, logical block 29, lost async page write attempt to access beyond end of device loop5: rw=1, want=52, limit=32 Buffer I/O error on dev loop5, logical block 25, lost async page write attempt to access beyond end of device loop5: rw=2049, want=54, limit=32 Buffer I/O error on dev loop5, logical block 26, lost async page write EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue attempt to access beyond end of device loop5: rw=2049, want=56, limit=32 Buffer I/O error on dev loop5, logical block 27, lost async page write attempt to access beyond end of device loop5: rw=2049, want=58, limit=32 attempt to access beyond end of device loop0: rw=2049, want=54, limit=32 Buffer I/O error on dev loop5, logical block 28, lost async page write Buffer I/O error on dev loop0, logical block 26, lost async page write attempt to access beyond end of device loop0: rw=2049, want=56, limit=32 Buffer I/O error on dev loop0, logical block 27, lost async page write attempt to access beyond end of device attempt to access beyond end of device loop0: rw=2049, want=58, limit=32 attempt to access beyond end of device loop0: rw=2049, want=60, limit=32 loop5: rw=2049, want=60, limit=32 attempt to access beyond end of device loop0: rw=1, want=52, limit=32 attempt to access beyond end of device loop5: rw=1, want=52, limit=32 attempt to access beyond end of device loop5: rw=2049, want=54, limit=32 attempt to access beyond end of device attempt to access beyond end of device loop0: rw=2049, want=54, limit=32 attempt to access beyond end of device loop5: rw=2049, want=56, limit=32 loop0: rw=2049, want=56, limit=32 attempt to access beyond end of device EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue loop5: rw=2049, want=58, limit=32 attempt to access beyond end of device attempt to access beyond end of device loop5: rw=2049, want=60, limit=32 loop0: rw=2049, want=58, limit=32 attempt to access beyond end of device loop0: rw=2049, want=60, limit=32 attempt to access beyond end of device loop5: rw=1, want=52, limit=32 attempt to access beyond end of device loop0: rw=1, want=52, limit=32 attempt to access beyond end of device loop0: rw=2049, want=54, limit=32 attempt to access beyond end of device loop0: rw=2049, want=56, limit=32 attempt to access beyond end of device loop0: rw=2049, want=58, limit=32 attempt to access beyond end of device loop5: rw=2049, want=54, limit=32 attempt to access beyond end of device loop0: rw=2049, want=60, limit=32 EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue attempt to access beyond end of device loop5: rw=2049, want=56, limit=32 attempt to access beyond end of device loop5: rw=2049, want=58, limit=32 attempt to access beyond end of device attempt to access beyond end of device loop0: rw=1, want=52, limit=32 loop5: rw=2049, want=60, limit=32 attempt to access beyond end of device loop5: rw=1, want=52, limit=32 attempt to access beyond end of device loop0: rw=2049, want=54, limit=32 attempt to access beyond end of device loop0: rw=2049, want=56, limit=32 attempt to access beyond end of device loop0: rw=2049, want=58, limit=32 attempt to access beyond end of device loop0: rw=2049, want=60, limit=32 attempt to access beyond end of device attempt to access beyond end of device loop0: rw=1, want=52, limit=32 loop5: rw=1, want=52, limit=32 EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue attempt to access beyond end of device loop5: rw=1, want=52, limit=32