[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.10.28' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 41.883538] audit: type=1400 audit(1600936260.742:8): avc: denied { execmem } for pid=6477 comm="syz-executor100" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 41.902288] ================================================================== [ 41.911018] BUG: KASAN: slab-out-of-bounds in squashfs_get_id+0x1bc/0x1f0 [ 41.917956] Read of size 8 at addr ffff8880a48b7c20 by task syz-executor100/6477 [ 41.925597] [ 41.927236] CPU: 1 PID: 6477 Comm: syz-executor100 Not tainted 4.19.147-syzkaller #0 [ 41.935119] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 41.944487] Call Trace: [ 41.947072] dump_stack+0x22c/0x33e [ 41.950706] print_address_description.cold+0x56/0x25c [ 41.955968] kasan_report_error.cold+0x66/0xb9 [ 41.960547] ? squashfs_get_id+0x1bc/0x1f0 [ 41.964776] __asan_report_load8_noabort+0x88/0x90 [ 41.969694] ? squashfs_get_id+0x1bc/0x1f0 [ 41.973926] squashfs_get_id+0x1bc/0x1f0 [ 41.977987] ? squashfs_read_fragment_index_table+0xf0/0xf0 [ 41.983687] ? squashfs_read_metadata+0x2e5/0x3b0 [ 41.988530] squashfs_read_inode+0x197/0x1940 [ 41.993111] ? squashfs_read_id_index_table+0xf0/0xf0 [ 41.998296] ? find_held_lock+0x2d/0x110 [ 42.002346] ? new_inode+0xc7/0xf0 [ 42.005877] ? do_raw_spin_lock+0xcb/0x220 [ 42.010095] ? do_raw_spin_unlock+0x171/0x240 [ 42.014593] squashfs_fill_super+0x1277/0x190a [ 42.019174] mount_bdev+0x2fc/0x3b0 [ 42.022805] ? squashfs_remount+0x50/0x50 [ 42.026942] mount_fs+0xa3/0x318 [ 42.030300] vfs_kern_mount.part.0+0x68/0x470 [ 42.034782] do_mount+0x51c/0x2f10 [ 42.038309] ? do_raw_spin_unlock+0x171/0x240 [ 42.042804] ? check_preemption_disabled+0x41/0x2b0 [ 42.047813] ? copy_mount_string+0x40/0x40 [ 42.052046] ? kmem_cache_alloc_trace+0x379/0x4b0 [ 42.056885] ? copy_mount_options+0x261/0x370 [ 42.061364] ksys_mount+0xcf/0x130 [ 42.064903] __x64_sys_mount+0xba/0x150 [ 42.068860] ? lockdep_hardirqs_on+0x3c1/0x5e0 [ 42.073425] do_syscall_64+0xf9/0x670 [ 42.077213] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 42.082400] RIP: 0033:0x446d2a [ 42.085589] Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd ad fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 da ad fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 42.104479] RSP: 002b:00007fffa7a6e2c8 EFLAGS: 00000293 ORIG_RAX: 00000000000000a5 [ 42.112232] RAX: ffffffffffffffda RBX: 00007fffa7a6e320 RCX: 0000000000446d2a [ 42.119514] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007fffa7a6e2e0 [ 42.126835] RBP: 00007fffa7a6e2e0 R08: 00007fffa7a6e320 R09: 00007fff00000015 [ 42.134094] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 42.141349] R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000003 [ 42.148617] [ 42.150231] Allocated by task 4679: [ 42.153866] kmem_cache_alloc_trace+0x12f/0x4b0 [ 42.158522] proc_thread_self_get_link+0x185/0x1e0 [ 42.163449] link_path_walk.part.0+0xdaf/0x1230 [ 42.168880] path_openat+0x21d/0x2e90 [ 42.173356] do_filp_open+0x18c/0x3f0 [ 42.177134] do_sys_open+0x3b3/0x520 [ 42.180830] do_syscall_64+0xf9/0x670 [ 42.184629] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 42.189793] [ 42.191400] Freed by task 4679: [ 42.194659] kfree+0xcc/0x250 [ 42.197762] walk_component+0x204/0xda0 [ 42.201720] link_path_walk.part.0+0x541/0x1230 [ 42.206371] path_openat+0x21d/0x2e90 [ 42.210161] do_filp_open+0x18c/0x3f0 [ 42.213957] do_sys_open+0x3b3/0x520 [ 42.217652] do_syscall_64+0xf9/0x670 [ 42.221456] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 42.226632] [ 42.228239] The buggy address belongs to the object at ffff8880a48b7c00 [ 42.228239] which belongs to the cache kmalloc-32 of size 32 [ 42.240718] The buggy address is located 0 bytes to the right of [ 42.240718] 32-byte region [ffff8880a48b7c00, ffff8880a48b7c20) [ 42.252851] The buggy address belongs to the page: [ 42.257784] page:ffffea0002922dc0 count:1 mapcount:0 mapping:ffff88812c3f61c0 index:0xffff8880a48b7fc1 [ 42.267218] flags: 0xfffe0000000100(slab) [ 42.271380] raw: 00fffe0000000100 ffffea0002935148 ffffea000293bc08 ffff88812c3f61c0 [ 42.279253] raw: ffff8880a48b7fc1 ffff8880a48b7000 000000010000003e 0000000000000000 [ 42.287226] page dumped because: kasan: bad access detected [ 42.292923] [ 42.294534] Memory state around the buggy address: [ 42.299452] ffff8880a48b7b00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 42.306802] ffff8880a48b7b80: fb fb fb fb fc fc fc fc 00 fc fc fc fc fc fc fc [ 42.314163] >ffff8880a48b7c00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 42.321522] ^ [ 42.325926] ffff8880a48b7c80: fb fb fb fb fc fc fc fc 00 00 01 fc fc fc fc fc [ 42.333279] ffff8880a48b7d00: 00 00 01 fc fc fc fc fc fb fb fb fb fc fc fc fc [ 42.340745] ================================================================== [ 42.348093] Disabling lock debugging due to kernel taint [ 42.357926] Kernel panic - not syncing: panic_on_warn set ... [ 42.357926] [ 42.365337] CPU: 0 PID: 6477 Comm: syz-executor100 Tainted: G B 4.19.147-syzkaller #0 [ 42.374618] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 42.383977] Call Trace: [ 42.386567] dump_stack+0x22c/0x33e [ 42.390199] panic+0x2ac/0x565 [ 42.393390] ? __warn_printk+0xf3/0xf3 [ 42.397280] ? preempt_schedule_common+0x45/0xc0 [ 42.402026] ? ___preempt_schedule+0x16/0x18 [ 42.406435] ? trace_hardirqs_on+0x55/0x210 [ 42.410743] kasan_end_report+0x43/0x49 [ 42.414712] kasan_report_error.cold+0x83/0xb9 [ 42.419313] ? squashfs_get_id+0x1bc/0x1f0 [ 42.423535] __asan_report_load8_noabort+0x88/0x90 [ 42.428447] ? squashfs_get_id+0x1bc/0x1f0 [ 42.432679] squashfs_get_id+0x1bc/0x1f0 [ 42.436759] ? squashfs_read_fragment_index_table+0xf0/0xf0 [ 42.442555] ? squashfs_read_metadata+0x2e5/0x3b0 [ 42.447434] squashfs_read_inode+0x197/0x1940 [ 42.452097] ? squashfs_read_id_index_table+0xf0/0xf0 [ 42.457278] ? find_held_lock+0x2d/0x110 [ 42.461398] ? new_inode+0xc7/0xf0 [ 42.464989] ? do_raw_spin_lock+0xcb/0x220 [ 42.469222] ? do_raw_spin_unlock+0x171/0x240 [ 42.473715] squashfs_fill_super+0x1277/0x190a [ 42.478282] mount_bdev+0x2fc/0x3b0 [ 42.481894] ? squashfs_remount+0x50/0x50 [ 42.486024] mount_fs+0xa3/0x318 [ 42.489384] vfs_kern_mount.part.0+0x68/0x470 [ 42.493876] do_mount+0x51c/0x2f10 [ 42.497406] ? do_raw_spin_unlock+0x171/0x240 [ 42.501894] ? check_preemption_disabled+0x41/0x2b0 [ 42.506911] ? copy_mount_string+0x40/0x40 [ 42.511139] ? kmem_cache_alloc_trace+0x379/0x4b0 [ 42.516050] ? copy_mount_options+0x261/0x370 [ 42.520539] ksys_mount+0xcf/0x130 [ 42.524062] __x64_sys_mount+0xba/0x150 [ 42.528044] ? lockdep_hardirqs_on+0x3c1/0x5e0 [ 42.532622] do_syscall_64+0xf9/0x670 [ 42.536412] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 42.541597] RIP: 0033:0x446d2a [ 42.544787] Code: b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd ad fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 da ad fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 42.563767] RSP: 002b:00007fffa7a6e2c8 EFLAGS: 00000293 ORIG_RAX: 00000000000000a5 [ 42.571464] RAX: ffffffffffffffda RBX: 00007fffa7a6e320 RCX: 0000000000446d2a [ 42.578733] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007fffa7a6e2e0 [ 42.585990] RBP: 00007fffa7a6e2e0 R08: 00007fffa7a6e320 R09: 00007fff00000015 [ 42.593259] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 42.600512] R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000003 [ 42.608804] Kernel Offset: disabled [ 42.612439] Rebooting in 86400 seconds..