[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [ 39.918468] audit: type=1800 audit(1576001574.784:33): pid=7529 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2465 res=0 Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 44.229866] kauditd_printk_skb: 1 callbacks suppressed [ 44.229880] audit: type=1400 audit(1576001579.094:35): avc: denied { map } for pid=7704 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.22' (ECDSA) to the list of known hosts. executing program [ 50.846466] audit: type=1400 audit(1576001585.714:36): avc: denied { map } for pid=7716 comm="syz-executor108" path="/root/syz-executor108131634" dev="sda1" ino=16483 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 50.934794] ================================================================== [ 50.934828] BUG: KASAN: user-memory-access in insert_char+0x206/0x450 [ 50.934839] Read of size 212 at addr 00000000ffffff3a by task syz-executor108/7716 [ 50.934843] [ 50.934857] CPU: 1 PID: 7716 Comm: syz-executor108 Not tainted 4.19.88-syzkaller #0 [ 50.934864] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 50.934869] Call Trace: [ 50.934887] dump_stack+0x197/0x210 [ 50.934903] ? insert_char+0x206/0x450 [ 50.934919] kasan_report.cold+0x199/0x2ba [ 50.934938] check_memory_region+0x123/0x190 [ 50.934952] memmove+0x24/0x50 [ 50.934974] insert_char+0x206/0x450 [ 50.934994] do_con_trol+0x3ca8/0x6070 [ 50.935012] ? reset_palette+0x190/0x190 [ 50.935028] ? kasan_check_read+0x11/0x20 [ 50.935049] ? __atomic_notifier_call_chain+0xfd/0x1a0 [ 50.935068] do_con_write.part.0+0xfd5/0x1eb0 [ 50.935101] ? do_con_trol+0x6070/0x6070 [ 50.935115] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 50.935129] ? add_wait_queue+0x112/0x170 [ 50.935140] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 50.935157] ? trace_hardirqs_on+0x67/0x220 [ 50.935178] con_write+0x46/0xd0 [ 50.935192] n_tty_write+0x3f9/0x10f0 [ 50.935218] ? process_echoes+0x170/0x170 [ 50.935235] ? do_wait_intr_irq+0x2b0/0x2b0 [ 50.935252] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 50.935266] ? _copy_from_user+0xdd/0x150 [ 50.935285] tty_write+0x458/0x7a0 [ 50.935301] ? process_echoes+0x170/0x170 [ 50.935319] __vfs_write+0x114/0x810 [ 50.935334] ? tty_read+0x2a0/0x2a0 [ 50.935347] ? kernel_read+0x120/0x120 [ 50.935361] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 50.935375] ? __inode_security_revalidate+0xda/0x120 [ 50.935391] ? avc_policy_seqno+0xd/0x70 [ 50.935402] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 50.935415] ? selinux_file_permission+0x92/0x550 [ 50.935431] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 50.935445] ? security_file_permission+0x89/0x230 [ 50.935462] ? rw_verify_area+0x118/0x360 [ 50.935479] vfs_write+0x20c/0x560 [ 50.935497] ksys_write+0x14f/0x2d0 [ 50.935513] ? __ia32_sys_read+0xb0/0xb0 [ 50.935530] ? do_syscall_64+0x26/0x620 [ 50.935542] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 50.935555] ? do_syscall_64+0x26/0x620 [ 50.935573] __x64_sys_write+0x73/0xb0 [ 50.935588] do_syscall_64+0xfd/0x620 [ 50.935605] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 50.935621] RIP: 0033:0x4404f9 [ 50.935633] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b 14 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 50.935639] RSP: 002b:00007ffdbdee1938 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 50.935652] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004404f9 [ 50.935659] RDX: 0000000000000078 RSI: 0000000020000000 RDI: 0000000000000004 [ 50.935666] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 50.935673] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401de0 [ 50.935679] R13: 0000000000401e70 R14: 0000000000000000 R15: 0000000000000000 [ 50.935697] ================================================================== [ 50.935701] Disabling lock debugging due to kernel taint [ 50.938332] Kernel panic - not syncing: panic_on_warn set ... [ 50.938332] [ 50.938348] CPU: 1 PID: 7716 Comm: syz-executor108 Tainted: G B 4.19.88-syzkaller #0 [ 50.938355] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 50.938358] Call Trace: [ 50.938376] dump_stack+0x197/0x210 [ 50.938390] ? insert_char+0x206/0x450 [ 50.938402] panic+0x26a/0x50e [ 50.938413] ? __warn_printk+0xf3/0xf3 [ 50.938426] ? insert_char+0x206/0x450 [ 50.938439] ? preempt_schedule+0x4b/0x60 [ 50.938453] ? ___preempt_schedule+0x16/0x18 [ 50.938467] ? trace_hardirqs_on+0x5e/0x220 [ 50.938480] ? insert_char+0x206/0x450 [ 50.938493] kasan_end_report+0x47/0x4f [ 50.938506] kasan_report.cold+0xa9/0x2ba [ 50.938520] check_memory_region+0x123/0x190 [ 50.938532] memmove+0x24/0x50 [ 50.938543] insert_char+0x206/0x450 [ 50.938558] do_con_trol+0x3ca8/0x6070 [ 50.938572] ? reset_palette+0x190/0x190 [ 50.938585] ? kasan_check_read+0x11/0x20 [ 50.938601] ? __atomic_notifier_call_chain+0xfd/0x1a0 [ 50.938617] do_con_write.part.0+0xfd5/0x1eb0 [ 50.938637] ? do_con_trol+0x6070/0x6070 [ 50.938648] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 50.938662] ? add_wait_queue+0x112/0x170 [ 50.938673] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 50.938686] ? trace_hardirqs_on+0x67/0x220 [ 50.938701] con_write+0x46/0xd0 [ 50.938715] n_tty_write+0x3f9/0x10f0 [ 50.938733] ? process_echoes+0x170/0x170 [ 50.938747] ? do_wait_intr_irq+0x2b0/0x2b0 [ 50.938762] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 50.938776] ? _copy_from_user+0xdd/0x150 [ 50.938791] tty_write+0x458/0x7a0 [ 50.938804] ? process_echoes+0x170/0x170 [ 50.938819] __vfs_write+0x114/0x810 [ 50.938832] ? tty_read+0x2a0/0x2a0 [ 50.938844] ? kernel_read+0x120/0x120 [ 50.938856] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 50.938869] ? __inode_security_revalidate+0xda/0x120 [ 50.938882] ? avc_policy_seqno+0xd/0x70 [ 50.938893] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 50.938904] ? selinux_file_permission+0x92/0x550 [ 50.938918] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 50.938929] ? security_file_permission+0x89/0x230 [ 50.938942] ? rw_verify_area+0x118/0x360 [ 50.938956] vfs_write+0x20c/0x560 [ 50.938976] ksys_write+0x14f/0x2d0 [ 50.938990] ? __ia32_sys_read+0xb0/0xb0 [ 50.939003] ? do_syscall_64+0x26/0x620 [ 50.939015] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 50.939027] ? do_syscall_64+0x26/0x620 [ 50.939042] __x64_sys_write+0x73/0xb0 [ 50.939056] do_syscall_64+0xfd/0x620 [ 50.939070] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 50.939079] RIP: 0033:0x4404f9 [ 50.939091] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b 14 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 50.939098] RSP: 002b:00007ffdbdee1938 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 50.939109] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004404f9 [ 50.939116] RDX: 0000000000000078 RSI: 0000000020000000 RDI: 0000000000000004 [ 50.939123] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 50.939130] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401de0 [ 50.939137] R13: 0000000000401e70 R14: 0000000000000000 R15: 0000000000000000 [ 50.940534] Kernel Offset: disabled [ 51.573410] Rebooting in 86400 seconds..