ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in fbcon_putcs+0x486/0x5a0 drivers/video/console/fbcon.c:1284 at addr ffff880126af7248 Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f688 ffffffff82c4dd46 ffff8800ba6f4e40 ffff8800a868f718 ffff880126af7240 ffff88012bc00100 ffff8800a868f708 ffffffff81740207 0000000000000010 0000000100000000 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] fbcon_putcs+0x486/0x5a0 drivers/video/console/fbcon.c:1284 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1622 [inline] [] fbcon_scrolldelta+0xc59/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Object at ffff880126af7240, in cache kmalloc-32 Object freed, allocated with size 14 bytes Allocation: PID = 11675 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532 [] __do_kmalloc mm/slab.c:3545 [inline] [] __kmalloc+0x169/0x6d0 mm/slab.c:3554 [] kmalloc include/linux/slab.h:483 [inline] [] vc_do_resize+0x1e9/0x1350 drivers/tty/vt/vt.c:874 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Deallocation: PID = 11658 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501 [] __cache_free mm/slab.c:3332 [inline] [] kfree+0xe2/0x460 mm/slab.c:3640 [] vc_do_resize+0x710/0x1350 drivers/tty/vt/vt.c:930 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in bit_putcs+0xce9/0xd20 drivers/video/console/bitblit.c:154 at addr ffff880126af7248 Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f4c8 ffffffff82c4dd46 ffff880126af7248 ffff8800a868f558 ffff880126af7240 ffff88012bc00100 ffff8800a868f548 ffffffff81740207 ffff8800a868f4e8 0000000000000086 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] bit_putcs+0xce9/0xd20 drivers/video/console/bitblit.c:154 [] fbcon_putcs+0x374/0x5a0 drivers/video/console/fbcon.c:1283 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1622 [inline] [] fbcon_scrolldelta+0xc59/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Object at ffff880126af7240, in cache kmalloc-32 Object freed, allocated with size 14 bytes Allocation: PID = 11675 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532 [] __do_kmalloc mm/slab.c:3545 [inline] [] __kmalloc+0x169/0x6d0 mm/slab.c:3554 [] kmalloc include/linux/slab.h:483 [inline] [] vc_do_resize+0x1e9/0x1350 drivers/tty/vt/vt.c:874 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Deallocation: PID = 11658 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501 [] __cache_free mm/slab.c:3332 [inline] [] kfree+0xe2/0x460 mm/slab.c:3640 [] vc_do_resize+0x710/0x1350 drivers/tty/vt/vt.c:930 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in bit_putcs_aligned drivers/video/console/bitblit.c:87 [inline] at addr ffff880126af7248 BUG: KASAN: use-after-free in bit_putcs+0xc73/0xd20 drivers/video/console/bitblit.c:185 at addr ffff880126af7248 Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f4c8 ffffffff82c4dd46 ffff8800ba5cdf70 ffff8800a868f558 ffff880126af7240 ffff88012bc00100 ffff8800a868f548 ffffffff81740207 0000000000000010 0000000000000000 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] bit_putcs_aligned drivers/video/console/bitblit.c:87 [inline] [] bit_putcs+0xc73/0xd20 drivers/video/console/bitblit.c:185 [] fbcon_putcs+0x374/0x5a0 drivers/video/console/fbcon.c:1283 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1622 [inline] [] fbcon_scrolldelta+0xc59/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Object at ffff880126af7240, in cache kmalloc-32 Object freed, allocated with size 14 bytes Allocation: PID = 11675 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532 [] __do_kmalloc mm/slab.c:3545 [inline] [] __kmalloc+0x169/0x6d0 mm/slab.c:3554 [] kmalloc include/linux/slab.h:483 [inline] [] vc_do_resize+0x1e9/0x1350 drivers/tty/vt/vt.c:874 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Deallocation: PID = 11658 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501 [] __cache_free mm/slab.c:3332 [inline] [] kfree+0xe2/0x460 mm/slab.c:3640 [] vc_do_resize+0x710/0x1350 drivers/tty/vt/vt.c:930 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in fbcon_redraw_softback drivers/video/console/fbcon.c:1597 [inline] at addr ffff880126af724a BUG: KASAN: use-after-free in fbcon_scrolldelta+0xfff/0x10a0 drivers/video/console/fbcon.c:2810 at addr ffff880126af724a Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f700 ffffffff82c4dd46 ffff880126af724c ffff8800a868f790 ffff880126af7240 ffff88012bc00100 ffff8800a868f780 ffffffff81740207 ffffffff8174065e ffff8800ba6f4e40 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1597 [inline] [] fbcon_scrolldelta+0xfff/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Object at ffff880126af7240, in cache kmalloc-32 Object freed, allocated with size 14 bytes Allocation: PID = 11675 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532 [] __do_kmalloc mm/slab.c:3545 [inline] [] __kmalloc+0x169/0x6d0 mm/slab.c:3554 [] kmalloc include/linux/slab.h:483 [inline] [] vc_do_resize+0x1e9/0x1350 drivers/tty/vt/vt.c:874 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Deallocation: PID = 11658 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501 [] __cache_free mm/slab.c:3332 [inline] [] kfree+0xe2/0x460 mm/slab.c:3640 [] vc_do_resize+0x710/0x1350 drivers/tty/vt/vt.c:930 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in fbcon_putcs+0x471/0x5a0 drivers/video/console/fbcon.c:1285 at addr ffff880126af724a Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f688 ffffffff82c4dd46 ffff8800ba6f4e40 ffff8800a868f718 ffff880126af7240 ffff88012bc00100 ffff8800a868f708 ffffffff81740207 ffffffff8174048d 000000010000000d 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] fbcon_putcs+0x471/0x5a0 drivers/video/console/fbcon.c:1285 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1622 [inline] [] fbcon_scrolldelta+0xc59/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Object at ffff880126af7240, in cache kmalloc-32 Object freed, allocated with size 14 bytes Allocation: PID = 11675 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532 [] __do_kmalloc mm/slab.c:3545 [inline] [] __kmalloc+0x169/0x6d0 mm/slab.c:3554 [] kmalloc include/linux/slab.h:483 [inline] [] vc_do_resize+0x1e9/0x1350 drivers/tty/vt/vt.c:874 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Deallocation: PID = 11658 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501 [] __cache_free mm/slab.c:3332 [inline] [] kfree+0xe2/0x460 mm/slab.c:3640 [] vc_do_resize+0x710/0x1350 drivers/tty/vt/vt.c:930 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in fbcon_putcs+0x486/0x5a0 drivers/video/console/fbcon.c:1284 at addr ffff880126af724a Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f688 ffffffff82c4dd46 ffff8800ba6f4e40 ffff8800a868f718 ffff880126af7240 ffff88012bc00100 ffff8800a868f708 ffffffff81740207 0000000000000010 0000000100000000 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] fbcon_putcs+0x486/0x5a0 drivers/video/console/fbcon.c:1284 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1622 [inline] [] fbcon_scrolldelta+0xc59/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Object at ffff880126af7240, in cache kmalloc-32 Object freed, allocated with size 14 bytes Allocation: PID = 11675 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532 [] __do_kmalloc mm/slab.c:3545 [inline] [] __kmalloc+0x169/0x6d0 mm/slab.c:3554 [] kmalloc include/linux/slab.h:483 [inline] [] vc_do_resize+0x1e9/0x1350 drivers/tty/vt/vt.c:874 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Deallocation: PID = 11658 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501 [] __cache_free mm/slab.c:3332 [inline] [] kfree+0xe2/0x460 mm/slab.c:3640 [] vc_do_resize+0x710/0x1350 drivers/tty/vt/vt.c:930 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in bit_putcs+0xce9/0xd20 drivers/video/console/bitblit.c:154 at addr ffff880126af724a Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f4c8 ffffffff82c4dd46 ffff880126af724a ffff8800a868f558 ffff880126af7240 ffff88012bc00100 ffff8800a868f548 ffffffff81740207 ffff8800a868f4e8 0000000000000086 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] bit_putcs+0xce9/0xd20 drivers/video/console/bitblit.c:154 [] fbcon_putcs+0x374/0x5a0 drivers/video/console/fbcon.c:1283 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1622 [inline] [] fbcon_scrolldelta+0xc59/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Object at ffff880126af7240, in cache kmalloc-32 Object freed, allocated with size 14 bytes Allocation: PID = 11675 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532 [] __do_kmalloc mm/slab.c:3545 [inline] [] __kmalloc+0x169/0x6d0 mm/slab.c:3554 [] kmalloc include/linux/slab.h:483 [inline] [] vc_do_resize+0x1e9/0x1350 drivers/tty/vt/vt.c:874 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Deallocation: PID = 11658 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501 [] __cache_free mm/slab.c:3332 [inline] [] kfree+0xe2/0x460 mm/slab.c:3640 [] vc_do_resize+0x710/0x1350 drivers/tty/vt/vt.c:930 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in bit_putcs_aligned drivers/video/console/bitblit.c:87 [inline] at addr ffff880126af724a BUG: KASAN: use-after-free in bit_putcs+0xc73/0xd20 drivers/video/console/bitblit.c:185 at addr ffff880126af724a Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f4c8 ffffffff82c4dd46 ffff8800ba5cdf80 ffff8800a868f558 ffff880126af7240 ffff88012bc00100 ffff8800a868f548 ffffffff81740207 0000000000000010 0000000000000000 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] bit_putcs_aligned drivers/video/console/bitblit.c:87 [inline] [] bit_putcs+0xc73/0xd20 drivers/video/console/bitblit.c:185 [] fbcon_putcs+0x374/0x5a0 drivers/video/console/fbcon.c:1283 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1622 [inline] [] fbcon_scrolldelta+0xc59/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Object at ffff880126af7240, in cache kmalloc-32 Object freed, allocated with size 14 bytes Allocation: PID = 11675 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532 [] __do_kmalloc mm/slab.c:3545 [inline] [] __kmalloc+0x169/0x6d0 mm/slab.c:3554 [] kmalloc include/linux/slab.h:483 [inline] [] vc_do_resize+0x1e9/0x1350 drivers/tty/vt/vt.c:874 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [