bisecting cause commit starting from 07c4b9e9f71aa4bc74009f710fc5a745e10981bf building syzkaller on eef6e5808d6507716d331b9eff67fdd991be891a testing commit 07c4b9e9f71aa4bc74009f710fc5a745e10981bf with gcc (GCC) 8.1.0 kernel signature: 94a5ac2220a7211ff85f417361e9289760f4ab12 all runs: crashed: KASAN: use-after-free Read in fbcon_cursor testing release v5.4 testing commit 219d54332a09e8d8741c1e1982f5eae56099de85 with gcc (GCC) 8.1.0 kernel signature: daecc84e50ae8f1c2948d6c43215ba6999b89846 all runs: crashed: KASAN: use-after-free Read in fbcon_cursor testing release v5.3 testing commit 4d856f72c10ecb060868ed10ff1b1453943fc6c8 with gcc (GCC) 8.1.0 kernel signature: 8ae738a2301ca47e34ab5cfe0237dc023aa4d418 all runs: crashed: KASAN: use-after-free Read in fbcon_cursor testing release v5.2 testing commit 0ecfebd2b52404ae0c54a878c872bb93363ada36 with gcc (GCC) 8.1.0 kernel signature: a06f81681e221fbaabb3ddb9499d9a35eae19a18 all runs: crashed: KASAN: use-after-free Read in fbcon_cursor testing release v5.1 testing commit e93c9c99a629c61837d5a7fc2120cd2b6c70dbdd with gcc (GCC) 8.1.0 kernel signature: 15ff68e4b0e95f6420d330ebfad71b9a03279c53 all runs: crashed: KASAN: use-after-free Read in fbcon_cursor testing release v5.0 testing commit 1c163f4c7b3f621efff9b28a47abb36f7378d783 with gcc (GCC) 8.1.0 kernel signature: 42373c9a0344008a65ea190605add0b55ee44c98 all runs: crashed: KASAN: use-after-free Read in fbcon_cursor testing release v4.20 testing commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be with gcc (GCC) 8.1.0 kernel signature: c4613ea23687023b2b8df7d81267c6c0085517fd all runs: crashed: KASAN: use-after-free Read in fbcon_cursor testing release v4.19 testing commit 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d with gcc (GCC) 8.1.0 kernel signature: 986ddac8a25a70ac38f77042124261f251ffbbc9 all runs: crashed: KASAN: use-after-free Read in fbcon_cursor testing release v4.18 testing commit 94710cac0ef4ee177a63b5227664b38c95bbf703 with gcc (GCC) 8.1.0 kernel signature: 14c5046b17bf2f56d574c1115eaa72c5bec360d1 all runs: crashed: KASAN: use-after-free Read in fbcon_cursor testing release v4.17 testing commit 29dcea88779c856c7dc92040a0c01233263101d4 with gcc (GCC) 8.1.0 kernel signature: bafa95baa0400c69937b4069adabc7c108e17d1e all runs: crashed: KASAN: use-after-free Read in fbcon_cursor testing release v4.16 testing commit 0adb32858b0bddf4ada5f364a84ed60b196dbcda with gcc (GCC) 8.1.0 kernel signature: 8427b9dd5d251f8a50d5fd8c945d26707d313626 all runs: crashed: KASAN: use-after-free Read in fbcon_cursor testing release v4.15 testing commit d8a5b80568a9cb66810e75b182018e9edb68e8ff with gcc (GCC) 8.1.0 kernel signature: 4336042a2436231d426df8df0712a48df0c1312f all runs: crashed: KASAN: use-after-free Read in fbcon_cursor testing release v4.14 testing commit bebc6082da0a9f5d47a1ea2edc099bf671058bd4 with gcc (GCC) 8.1.0 kernel signature: 2278fb6c19a11e2ebeb310cba402a2492685ce76 all runs: crashed: KASAN: use-after-free Read in fbcon_cursor testing release v4.13 testing commit 569dbb88e80deb68974ef6fdd6a13edb9d686261 with gcc (GCC) 8.1.0 kernel signature: d127613358f9bc5041dce14373f89ccddb08aa73 all runs: crashed: KASAN: use-after-free Read in fbcon_cursor testing release v4.12 testing commit 6f7da290413ba713f0cdd9ff1a2a9bb129ef4f6c with gcc (GCC) 8.1.0 kernel signature: e496d7235e79dd5713428ae7a735e3237474c668 all runs: crashed: KASAN: use-after-free Read in fbcon_cursor testing release v4.11 testing commit a351e9b9fc24e982ec2f0e76379a49826036da12 with gcc (GCC) 7.3.0 kernel signature: c854bb00a51a5fef94ae1f759703d24fdaab2894 all runs: crashed: KASAN: use-after-free Read in fbcon_cursor testing release v4.10 testing commit c470abd4fde40ea6a0846a2beab642a578c0b8cd with gcc (GCC) 5.5.0 kernel signature: 6897f25360174c9f69e5a6712d100a524690750f all runs: crashed: KASAN: use-after-free Read in fbcon_cursor testing release v4.9 testing commit 69973b830859bc6529a7a0468ba0d80ee5117826 with gcc (GCC) 5.5.0 kernel signature: 7562f1b0ddecb732814821e071c0bef54c950aef run #0: crashed: KASAN: use-after-free Read in bit_putcs run #1: crashed: KASAN: use-after-free Read in bit_putcs run #2: crashed: KASAN: use-after-free Read in fbcon_putcs run #3: crashed: KASAN: use-after-free Read in fbcon_scrolldelta run #4: crashed: KASAN: use-after-free Read in fbcon_putcs run #5: crashed: KASAN: use-after-free Read in fbcon_putcs run #6: crashed: KASAN: use-after-free Read in fbcon_scrolldelta run #7: crashed: KASAN: use-after-free Read in fbcon_putcs run #8: crashed: KASAN: use-after-free Read in bit_putcs run #9: crashed: KASAN: use-after-free Read in fbcon_putcs testing release v4.8 testing commit c8d2bc9bc39ebea8437fd974fdbc21847bb897a3 with gcc (GCC) 5.5.0 kernel signature: 7ebae22f304cc9ab4508842cfbcde3ebb831b528 run #0: crashed: KASAN: use-after-free Read in fbcon_putcs run #1: crashed: KASAN: use-after-free Read in fbcon_putcs run #2: crashed: KASAN: use-after-free Read in fbcon_putcs run #3: crashed: KASAN: use-after-free Read in fbcon_putcs run #4: crashed: KASAN: use-after-free Read in bit_putcs run #5: crashed: KASAN: use-after-free Read in fbcon_putcs run #6: crashed: KASAN: use-after-free Read in fbcon_putcs run #7: crashed: KASAN: use-after-free Read in fbcon_putcs run #8: crashed: KASAN: use-after-free Read in fbcon_putcs run #9: crashed: KASAN: use-after-free Read in fbcon_putcs testing release v4.7 testing commit 523d939ef98fd712632d93a5a2b588e477a7565e with gcc (GCC) 5.5.0 kernel signature: c9eb1fdee2093a4dbe25c5a5181964e0880dce37 run #0: crashed: KASAN: use-after-free Read in bit_putcs run #1: crashed: KASAN: use-after-free Read in bit_putcs run #2: crashed: KASAN: use-after-free Read in bit_putcs run #3: crashed: KASAN: use-after-free Read in bit_putcs run #4: crashed: KASAN: use-after-free Read in fbcon_scrolldelta run #5: crashed: KASAN: use-after-free Read in bit_putcs run #6: crashed: KASAN: use-after-free Read in bit_putcs run #7: crashed: KASAN: use-after-free Read in fbcon_putcs run #8: crashed: KASAN: use-after-free Read in bit_putcs run #9: crashed: KASAN: use-after-free Read in bit_putcs testing release v4.6 testing commit 2dcd0af568b0cf583645c8a317dd12e344b1c72a with gcc (GCC) 5.5.0 kernel signature: 2885914e0ea292001317a4806b424b27ee06e06d run #0: crashed: KASAN: use-after-free Read in fbcon_cursor run #1: crashed: KASAN: use-after-free Read in fbcon_scrolldelta run #2: crashed: KASAN: use-after-free Read in fbcon_scrolldelta run #3: crashed: KASAN: use-after-free Read in fbcon_putcs run #4: crashed: KASAN: use-after-free Read in fbcon_putcs run #5: crashed: KASAN: use-after-free Read in fbcon_putcs run #6: crashed: KASAN: use-after-free Read in fbcon_putcs run #7: crashed: KASAN: use-after-free Read in fbcon_putcs run #8: crashed: KASAN: use-after-free Read in fbcon_cursor run #9: crashed: KASAN: use-after-free Read in fbcon_putcs revisions tested: 21, total time: 3h6m16.529202573s (build: 1h48m10.538828568s, test: 1h15m2.661157722s) the crash already happened on the oldest tested release commit msg: Linux 4.6 crash: KASAN: use-after-free Read in fbcon_putcs ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in fbcon_putcs+0x486/0x5a0 drivers/video/console/fbcon.c:1284 at addr ffff880126af7248 Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f688 ffffffff82c4dd46 ffff8800ba6f4e40 ffff8800a868f718 ffff880126af7240 ffff88012bc00100 ffff8800a868f708 ffffffff81740207 0000000000000010 0000000100000000 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] fbcon_putcs+0x486/0x5a0 drivers/video/console/fbcon.c:1284 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1622 [inline] [] fbcon_scrolldelta+0xc59/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Object at ffff880126af7240, in cache kmalloc-32 Object freed, allocated with size 14 bytes Allocation: PID = 11675 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532 [] __do_kmalloc mm/slab.c:3545 [inline] [] __kmalloc+0x169/0x6d0 mm/slab.c:3554 [] kmalloc include/linux/slab.h:483 [inline] [] vc_do_resize+0x1e9/0x1350 drivers/tty/vt/vt.c:874 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Deallocation: PID = 11658 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501 [] __cache_free mm/slab.c:3332 [inline] [] kfree+0xe2/0x460 mm/slab.c:3640 [] vc_do_resize+0x710/0x1350 drivers/tty/vt/vt.c:930 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in bit_putcs+0xce9/0xd20 drivers/video/console/bitblit.c:154 at addr ffff880126af7248 Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f4c8 ffffffff82c4dd46 ffff880126af7248 ffff8800a868f558 ffff880126af7240 ffff88012bc00100 ffff8800a868f548 ffffffff81740207 ffff8800a868f4e8 0000000000000086 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] bit_putcs+0xce9/0xd20 drivers/video/console/bitblit.c:154 [] fbcon_putcs+0x374/0x5a0 drivers/video/console/fbcon.c:1283 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1622 [inline] [] fbcon_scrolldelta+0xc59/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Object at ffff880126af7240, in cache kmalloc-32 Object freed, allocated with size 14 bytes Allocation: PID = 11675 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532 [] __do_kmalloc mm/slab.c:3545 [inline] [] __kmalloc+0x169/0x6d0 mm/slab.c:3554 [] kmalloc include/linux/slab.h:483 [inline] [] vc_do_resize+0x1e9/0x1350 drivers/tty/vt/vt.c:874 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Deallocation: PID = 11658 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501 [] __cache_free mm/slab.c:3332 [inline] [] kfree+0xe2/0x460 mm/slab.c:3640 [] vc_do_resize+0x710/0x1350 drivers/tty/vt/vt.c:930 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in bit_putcs_aligned drivers/video/console/bitblit.c:87 [inline] at addr ffff880126af7248 BUG: KASAN: use-after-free in bit_putcs+0xc73/0xd20 drivers/video/console/bitblit.c:185 at addr ffff880126af7248 Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f4c8 ffffffff82c4dd46 ffff8800ba5cdf70 ffff8800a868f558 ffff880126af7240 ffff88012bc00100 ffff8800a868f548 ffffffff81740207 0000000000000010 0000000000000000 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] bit_putcs_aligned drivers/video/console/bitblit.c:87 [inline] [] bit_putcs+0xc73/0xd20 drivers/video/console/bitblit.c:185 [] fbcon_putcs+0x374/0x5a0 drivers/video/console/fbcon.c:1283 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1622 [inline] [] fbcon_scrolldelta+0xc59/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Object at ffff880126af7240, in cache kmalloc-32 Object freed, allocated with size 14 bytes Allocation: PID = 11675 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532 [] __do_kmalloc mm/slab.c:3545 [inline] [] __kmalloc+0x169/0x6d0 mm/slab.c:3554 [] kmalloc include/linux/slab.h:483 [inline] [] vc_do_resize+0x1e9/0x1350 drivers/tty/vt/vt.c:874 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Deallocation: PID = 11658 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501 [] __cache_free mm/slab.c:3332 [inline] [] kfree+0xe2/0x460 mm/slab.c:3640 [] vc_do_resize+0x710/0x1350 drivers/tty/vt/vt.c:930 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in fbcon_redraw_softback drivers/video/console/fbcon.c:1597 [inline] at addr ffff880126af724a BUG: KASAN: use-after-free in fbcon_scrolldelta+0xfff/0x10a0 drivers/video/console/fbcon.c:2810 at addr ffff880126af724a Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f700 ffffffff82c4dd46 ffff880126af724c ffff8800a868f790 ffff880126af7240 ffff88012bc00100 ffff8800a868f780 ffffffff81740207 ffffffff8174065e ffff8800ba6f4e40 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1597 [inline] [] fbcon_scrolldelta+0xfff/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Object at ffff880126af7240, in cache kmalloc-32 Object freed, allocated with size 14 bytes Allocation: PID = 11675 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532 [] __do_kmalloc mm/slab.c:3545 [inline] [] __kmalloc+0x169/0x6d0 mm/slab.c:3554 [] kmalloc include/linux/slab.h:483 [inline] [] vc_do_resize+0x1e9/0x1350 drivers/tty/vt/vt.c:874 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Deallocation: PID = 11658 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501 [] __cache_free mm/slab.c:3332 [inline] [] kfree+0xe2/0x460 mm/slab.c:3640 [] vc_do_resize+0x710/0x1350 drivers/tty/vt/vt.c:930 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in fbcon_putcs+0x471/0x5a0 drivers/video/console/fbcon.c:1285 at addr ffff880126af724a Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f688 ffffffff82c4dd46 ffff8800ba6f4e40 ffff8800a868f718 ffff880126af7240 ffff88012bc00100 ffff8800a868f708 ffffffff81740207 ffffffff8174048d 000000010000000d 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] fbcon_putcs+0x471/0x5a0 drivers/video/console/fbcon.c:1285 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1622 [inline] [] fbcon_scrolldelta+0xc59/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Object at ffff880126af7240, in cache kmalloc-32 Object freed, allocated with size 14 bytes Allocation: PID = 11675 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532 [] __do_kmalloc mm/slab.c:3545 [inline] [] __kmalloc+0x169/0x6d0 mm/slab.c:3554 [] kmalloc include/linux/slab.h:483 [inline] [] vc_do_resize+0x1e9/0x1350 drivers/tty/vt/vt.c:874 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Deallocation: PID = 11658 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501 [] __cache_free mm/slab.c:3332 [inline] [] kfree+0xe2/0x460 mm/slab.c:3640 [] vc_do_resize+0x710/0x1350 drivers/tty/vt/vt.c:930 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in fbcon_putcs+0x486/0x5a0 drivers/video/console/fbcon.c:1284 at addr ffff880126af724a Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f688 ffffffff82c4dd46 ffff8800ba6f4e40 ffff8800a868f718 ffff880126af7240 ffff88012bc00100 ffff8800a868f708 ffffffff81740207 0000000000000010 0000000100000000 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] fbcon_putcs+0x486/0x5a0 drivers/video/console/fbcon.c:1284 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1622 [inline] [] fbcon_scrolldelta+0xc59/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Object at ffff880126af7240, in cache kmalloc-32 Object freed, allocated with size 14 bytes Allocation: PID = 11675 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532 [] __do_kmalloc mm/slab.c:3545 [inline] [] __kmalloc+0x169/0x6d0 mm/slab.c:3554 [] kmalloc include/linux/slab.h:483 [inline] [] vc_do_resize+0x1e9/0x1350 drivers/tty/vt/vt.c:874 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Deallocation: PID = 11658 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501 [] __cache_free mm/slab.c:3332 [inline] [] kfree+0xe2/0x460 mm/slab.c:3640 [] vc_do_resize+0x710/0x1350 drivers/tty/vt/vt.c:930 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in bit_putcs+0xce9/0xd20 drivers/video/console/bitblit.c:154 at addr ffff880126af724a Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f4c8 ffffffff82c4dd46 ffff880126af724a ffff8800a868f558 ffff880126af7240 ffff88012bc00100 ffff8800a868f548 ffffffff81740207 ffff8800a868f4e8 0000000000000086 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] bit_putcs+0xce9/0xd20 drivers/video/console/bitblit.c:154 [] fbcon_putcs+0x374/0x5a0 drivers/video/console/fbcon.c:1283 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1622 [inline] [] fbcon_scrolldelta+0xc59/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Object at ffff880126af7240, in cache kmalloc-32 Object freed, allocated with size 14 bytes Allocation: PID = 11675 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532 [] __do_kmalloc mm/slab.c:3545 [inline] [] __kmalloc+0x169/0x6d0 mm/slab.c:3554 [] kmalloc include/linux/slab.h:483 [inline] [] vc_do_resize+0x1e9/0x1350 drivers/tty/vt/vt.c:874 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Deallocation: PID = 11658 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501 [] __cache_free mm/slab.c:3332 [inline] [] kfree+0xe2/0x460 mm/slab.c:3640 [] vc_do_resize+0x710/0x1350 drivers/tty/vt/vt.c:930 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in bit_putcs_aligned drivers/video/console/bitblit.c:87 [inline] at addr ffff880126af724a BUG: KASAN: use-after-free in bit_putcs+0xc73/0xd20 drivers/video/console/bitblit.c:185 at addr ffff880126af724a Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f4c8 ffffffff82c4dd46 ffff8800ba5cdf80 ffff8800a868f558 ffff880126af7240 ffff88012bc00100 ffff8800a868f548 ffffffff81740207 0000000000000010 0000000000000000 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] bit_putcs_aligned drivers/video/console/bitblit.c:87 [inline] [] bit_putcs+0xc73/0xd20 drivers/video/console/bitblit.c:185 [] fbcon_putcs+0x374/0x5a0 drivers/video/console/fbcon.c:1283 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1622 [inline] [] fbcon_scrolldelta+0xc59/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Object at ffff880126af7240, in cache kmalloc-32 Object freed, allocated with size 14 bytes Allocation: PID = 11675 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532 [] __do_kmalloc mm/slab.c:3545 [inline] [] __kmalloc+0x169/0x6d0 mm/slab.c:3554 [] kmalloc include/linux/slab.h:483 [inline] [] vc_do_resize+0x1e9/0x1350 drivers/tty/vt/vt.c:874 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Deallocation: PID = 11658 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501 [] __cache_free mm/slab.c:3332 [inline] [] kfree+0xe2/0x460 mm/slab.c:3640 [] vc_do_resize+0x710/0x1350 drivers/tty/vt/vt.c:930 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in fbcon_redraw_softback drivers/video/console/fbcon.c:1597 [inline] at addr ffff880126af724c BUG: KASAN: use-after-free in fbcon_scrolldelta+0xfff/0x10a0 drivers/video/console/fbcon.c:2810 at addr ffff880126af724c Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f700 ffffffff82c4dd46 ffff880126af724e ffff8800a868f790 ffff880126af7240 ffff88012bc00100 ffff8800a868f780 ffffffff81740207 ffffffff8174065e ffff8800ba6f4e40 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1597 [inline] [] fbcon_scrolldelta+0xfff/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Object at ffff880126af7240, in cache kmalloc-32 Object freed, allocated with size 14 bytes Allocation: PID = 11675 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532 [] __do_kmalloc mm/slab.c:3545 [inline] [] __kmalloc+0x169/0x6d0 mm/slab.c:3554 [] kmalloc include/linux/slab.h:483 [inline] [] vc_do_resize+0x1e9/0x1350 drivers/tty/vt/vt.c:874 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Deallocation: PID = 11658 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501 [] __cache_free mm/slab.c:3332 [inline] [] kfree+0xe2/0x460 mm/slab.c:3640 [] vc_do_resize+0x710/0x1350 drivers/tty/vt/vt.c:930 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in fbcon_putcs+0x471/0x5a0 drivers/video/console/fbcon.c:1285 at addr ffff880126af724c Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f688 ffffffff82c4dd46 ffff8800ba6f4e40 ffff8800a868f718 ffff880126af7240 ffff88012bc00100 ffff8800a868f708 ffffffff81740207 ffffffff8174048d 000000010000000d 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] fbcon_putcs+0x471/0x5a0 drivers/video/console/fbcon.c:1285 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1622 [inline] [] fbcon_scrolldelta+0xc59/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Object at ffff880126af7240, in cache kmalloc-32 Object freed, allocated with size 14 bytes Allocation: PID = 11675 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532 [] __do_kmalloc mm/slab.c:3545 [inline] [] __kmalloc+0x169/0x6d0 mm/slab.c:3554 [] kmalloc include/linux/slab.h:483 [inline] [] vc_do_resize+0x1e9/0x1350 drivers/tty/vt/vt.c:874 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Deallocation: PID = 11658 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501 [] __cache_free mm/slab.c:3332 [inline] [] kfree+0xe2/0x460 mm/slab.c:3640 [] vc_do_resize+0x710/0x1350 drivers/tty/vt/vt.c:930 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in fbcon_putcs+0x486/0x5a0 drivers/video/console/fbcon.c:1284 at addr ffff880126af724c Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f688 ffffffff82c4dd46 ffff8800ba6f4e40 ffff8800a868f718 ffff880126af7240 ffff88012bc00100 ffff8800a868f708 ffffffff81740207 0000000000000010 0000000100000000 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] fbcon_putcs+0x486/0x5a0 drivers/video/console/fbcon.c:1284 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1622 [inline] [] fbcon_scrolldelta+0xc59/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Object at ffff880126af7240, in cache kmalloc-32 Object freed, allocated with size 14 bytes Allocation: PID = 11675 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532 [] __do_kmalloc mm/slab.c:3545 [inline] [] __kmalloc+0x169/0x6d0 mm/slab.c:3554 [] kmalloc include/linux/slab.h:483 [inline] [] vc_do_resize+0x1e9/0x1350 drivers/tty/vt/vt.c:874 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Deallocation: PID = 11658 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501 [] __cache_free mm/slab.c:3332 [inline] [] kfree+0xe2/0x460 mm/slab.c:3640 [] vc_do_resize+0x710/0x1350 drivers/tty/vt/vt.c:930 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in bit_putcs+0xce9/0xd20 drivers/video/console/bitblit.c:154 at addr ffff880126af724c Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f4c8 ffffffff82c4dd46 ffff880126af724c ffff8800a868f558 ffff880126af7240 ffff88012bc00100 ffff8800a868f548 ffffffff81740207 ffff8800a868f4e8 0000000000000086 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] bit_putcs+0xce9/0xd20 drivers/video/console/bitblit.c:154 [] fbcon_putcs+0x374/0x5a0 drivers/video/console/fbcon.c:1283 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1622 [inline] [] fbcon_scrolldelta+0xc59/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Object at ffff880126af7240, in cache kmalloc-32 Object freed, allocated with size 14 bytes Allocation: PID = 11675 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532 [] __do_kmalloc mm/slab.c:3545 [inline] [] __kmalloc+0x169/0x6d0 mm/slab.c:3554 [] kmalloc include/linux/slab.h:483 [inline] [] vc_do_resize+0x1e9/0x1350 drivers/tty/vt/vt.c:874 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Deallocation: PID = 11658 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501 [] __cache_free mm/slab.c:3332 [inline] [] kfree+0xe2/0x460 mm/slab.c:3640 [] vc_do_resize+0x710/0x1350 drivers/tty/vt/vt.c:930 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in bit_putcs_aligned drivers/video/console/bitblit.c:87 [inline] at addr ffff880126af724c BUG: KASAN: use-after-free in bit_putcs+0xc73/0xd20 drivers/video/console/bitblit.c:185 at addr ffff880126af724c Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f4c8 ffffffff82c4dd46 ffff8800ba5cdf90 ffff8800a868f558 ffff880126af7240 ffff88012bc00100 ffff8800a868f548 ffffffff81740207 0000000000000010 0000000000000000 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] bit_putcs_aligned drivers/video/console/bitblit.c:87 [inline] [] bit_putcs+0xc73/0xd20 drivers/video/console/bitblit.c:185 [] fbcon_putcs+0x374/0x5a0 drivers/video/console/fbcon.c:1283 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1622 [inline] [] fbcon_scrolldelta+0xc59/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Object at ffff880126af7240, in cache kmalloc-32 Object freed, allocated with size 14 bytes Allocation: PID = 11675 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532 [] __do_kmalloc mm/slab.c:3545 [inline] [] __kmalloc+0x169/0x6d0 mm/slab.c:3554 [] kmalloc include/linux/slab.h:483 [inline] [] vc_do_resize+0x1e9/0x1350 drivers/tty/vt/vt.c:874 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Deallocation: PID = 11658 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501 [] __cache_free mm/slab.c:3332 [inline] [] kfree+0xe2/0x460 mm/slab.c:3640 [] vc_do_resize+0x710/0x1350 drivers/tty/vt/vt.c:930 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in fbcon_redraw_softback drivers/video/console/fbcon.c:1597 [inline] at addr ffff880126af724e BUG: KASAN: use-after-free in fbcon_scrolldelta+0xfff/0x10a0 drivers/video/console/fbcon.c:2810 at addr ffff880126af724e Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f700 ffffffff82c4dd46 ffff880126af7250 ffff8800a868f790 ffff880126af7240 ffff88012bc00100 ffff8800a868f780 ffffffff81740207 ffffffff8174065e ffff8800ba6f4e40 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1597 [inline] [] fbcon_scrolldelta+0xfff/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Object at ffff880126af7240, in cache kmalloc-32 Object freed, allocated with size 14 bytes Allocation: PID = 11675 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532 [] __do_kmalloc mm/slab.c:3545 [inline] [] __kmalloc+0x169/0x6d0 mm/slab.c:3554 [] kmalloc include/linux/slab.h:483 [inline] [] vc_do_resize+0x1e9/0x1350 drivers/tty/vt/vt.c:874 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Deallocation: PID = 11658 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501 [] __cache_free mm/slab.c:3332 [inline] [] kfree+0xe2/0x460 mm/slab.c:3640 [] vc_do_resize+0x710/0x1350 drivers/tty/vt/vt.c:930 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in fbcon_putcs+0x471/0x5a0 drivers/video/console/fbcon.c:1285 at addr ffff880126af724e Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f688 ffffffff82c4dd46 ffff8800ba6f4e40 ffff8800a868f718 ffff880126af7240 ffff88012bc00100 ffff8800a868f708 ffffffff81740207 ffffffff8174048d 000000010000000d 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] fbcon_putcs+0x471/0x5a0 drivers/video/console/fbcon.c:1285 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1622 [inline] [] fbcon_scrolldelta+0xc59/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Object at ffff880126af7240, in cache kmalloc-32 Object freed, allocated with size 14 bytes Allocation: PID = 11675 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532 [] __do_kmalloc mm/slab.c:3545 [inline] [] __kmalloc+0x169/0x6d0 mm/slab.c:3554 [] kmalloc include/linux/slab.h:483 [inline] [] vc_do_resize+0x1e9/0x1350 drivers/tty/vt/vt.c:874 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Deallocation: PID = 11658 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501 [] __cache_free mm/slab.c:3332 [inline] [] kfree+0xe2/0x460 mm/slab.c:3640 [] vc_do_resize+0x710/0x1350 drivers/tty/vt/vt.c:930 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in fbcon_putcs+0x486/0x5a0 drivers/video/console/fbcon.c:1284 at addr ffff880126af724e Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f688 ffffffff82c4dd46 ffff8800ba6f4e40 ffff8800a868f718 ffff880126af7240 ffff88012bc00100 ffff8800a868f708 ffffffff81740207 0000000000000010 0000000100000000 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] fbcon_putcs+0x486/0x5a0 drivers/video/console/fbcon.c:1284 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1622 [inline] [] fbcon_scrolldelta+0xc59/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Object at ffff880126af7240, in cache kmalloc-32 Object freed, allocated with size 14 bytes Allocation: PID = 11675 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532 [] __do_kmalloc mm/slab.c:3545 [inline] [] __kmalloc+0x169/0x6d0 mm/slab.c:3554 [] kmalloc include/linux/slab.h:483 [inline] [] vc_do_resize+0x1e9/0x1350 drivers/tty/vt/vt.c:874 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Deallocation: PID = 11658 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501 [] __cache_free mm/slab.c:3332 [inline] [] kfree+0xe2/0x460 mm/slab.c:3640 [] vc_do_resize+0x710/0x1350 drivers/tty/vt/vt.c:930 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in bit_putcs+0xce9/0xd20 drivers/video/console/bitblit.c:154 at addr ffff880126af724e Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f4c8 ffffffff82c4dd46 ffff880126af724e ffff8800a868f558 ffff880126af7240 ffff88012bc00100 ffff8800a868f548 ffffffff81740207 ffff8800a868f4e8 0000000000000086 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] bit_putcs+0xce9/0xd20 drivers/video/console/bitblit.c:154 [] fbcon_putcs+0x374/0x5a0 drivers/video/console/fbcon.c:1283 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1622 [inline] [] fbcon_scrolldelta+0xc59/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Object at ffff880126af7240, in cache kmalloc-32 Object freed, allocated with size 14 bytes Allocation: PID = 11675 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532 [] __do_kmalloc mm/slab.c:3545 [inline] [] __kmalloc+0x169/0x6d0 mm/slab.c:3554 [] kmalloc include/linux/slab.h:483 [inline] [] vc_do_resize+0x1e9/0x1350 drivers/tty/vt/vt.c:874 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Deallocation: PID = 11658 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501 [] __cache_free mm/slab.c:3332 [inline] [] kfree+0xe2/0x460 mm/slab.c:3640 [] vc_do_resize+0x710/0x1350 drivers/tty/vt/vt.c:930 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in bit_putcs_aligned drivers/video/console/bitblit.c:87 [inline] at addr ffff880126af724e BUG: KASAN: use-after-free in bit_putcs+0xc73/0xd20 drivers/video/console/bitblit.c:185 at addr ffff880126af724e Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f4c8 ffffffff82c4dd46 ffff8800ba5cdfa0 ffff8800a868f558 ffff880126af7240 ffff88012bc00100 ffff8800a868f548 ffffffff81740207 0000000000000010 0000000000000000 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] bit_putcs_aligned drivers/video/console/bitblit.c:87 [inline] [] bit_putcs+0xc73/0xd20 drivers/video/console/bitblit.c:185 [] fbcon_putcs+0x374/0x5a0 drivers/video/console/fbcon.c:1283 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1622 [inline] [] fbcon_scrolldelta+0xc59/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Object at ffff880126af7240, in cache kmalloc-32 Object freed, allocated with size 14 bytes Allocation: PID = 11675 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532 [] __do_kmalloc mm/slab.c:3545 [inline] [] __kmalloc+0x169/0x6d0 mm/slab.c:3554 [] kmalloc include/linux/slab.h:483 [inline] [] vc_do_resize+0x1e9/0x1350 drivers/tty/vt/vt.c:874 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Deallocation: PID = 11658 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501 [] __cache_free mm/slab.c:3332 [inline] [] kfree+0xe2/0x460 mm/slab.c:3640 [] vc_do_resize+0x710/0x1350 drivers/tty/vt/vt.c:930 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in fbcon_redraw_softback drivers/video/console/fbcon.c:1597 [inline] at addr ffff880126af7250 BUG: KASAN: use-after-free in fbcon_scrolldelta+0xfff/0x10a0 drivers/video/console/fbcon.c:2810 at addr ffff880126af7250 Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f700 ffffffff82c4dd46 ffff880126af7252 ffff8800a868f790 ffff880126af7240 ffff88012bc00100 ffff8800a868f780 ffffffff81740207 ffffffff8174065e ffff8800ba6f4e40 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1597 [inline] [] fbcon_scrolldelta+0xfff/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Object at ffff880126af7240, in cache kmalloc-32 Object freed, allocated with size 14 bytes Allocation: PID = 11675 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532 [] __do_kmalloc mm/slab.c:3545 [inline] [] __kmalloc+0x169/0x6d0 mm/slab.c:3554 [] kmalloc include/linux/slab.h:483 [inline] [] vc_do_resize+0x1e9/0x1350 drivers/tty/vt/vt.c:874 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Deallocation: PID = 11658 [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67 [] save_stack+0x46/0xd0 mm/kasan/kasan.c:450 [] set_track mm/kasan/kasan.c:462 [inline] [] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501 [] __cache_free mm/slab.c:3332 [inline] [] kfree+0xe2/0x460 mm/slab.c:3640 [] vc_do_resize+0x710/0x1350 drivers/tty/vt/vt.c:930 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff880126af7100: 00 00 fc fc fc fc fc fc 00 00 06 fc fc fc fc fc ffff880126af7180: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc >ffff880126af7200: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff880126af7280: fb fb fb fb fc fc fc fc 00 04 fc fc fc fc fc fc ffff880126af7300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== ================================================================== BUG: KASAN: use-after-free in fbcon_putcs+0x471/0x5a0 drivers/video/console/fbcon.c:1285 at addr ffff880126af7250 Read of size 2 by task syz-executor.1/11658 CPU: 1 PID: 11658 Comm: syz-executor.1 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d9577e ffff8800a868f688 ffffffff82c4dd46 ffff8800ba6f4e40 ffff8800a868f718 ffff880126af7240 ffff88012bc00100 ffff8800a868f708 ffffffff81740207 ffffffff8174048d 000000010000000d 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] object_err mm/kasan/report.c:139 [inline] [] print_address_description mm/kasan/report.c:179 [inline] [] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275 [] kasan_report mm/kasan/report.c:297 [inline] [] __asan_report_load2_noabort+0x3e/0x40 mm/kasan/report.c:316 [] fbcon_putcs+0x471/0x5a0 drivers/video/console/fbcon.c:1285 [] fbcon_redraw_softback drivers/video/console/fbcon.c:1622 [inline] [] fbcon_scrolldelta+0xc59/0x10a0 drivers/video/console/fbcon.c:2810 [] fbcon_set_origin+0x16/0x20 drivers/video/console/fbcon.c:2861 [] set_origin+0x2c7/0x390 drivers/tty/vt/vt.c:630 [] vc_do_resize+0x781/0x1350 drivers/tty/vt/vt.c:933 [] vc_resize+0x3d/0x60 drivers/tty/vt/vt.c:972 [] vt_ioctl+0x162b/0x24e0 drivers/tty/vt/vt_ioctl.c:839 [] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988