Warning: Permanently added '10.128.10.45' (ECDSA) to the list of known hosts. 2019/12/17 10:18:59 parsed 1 programs 2019/12/17 10:18:59 executed programs: 0 [ 55.615377] IPv6: ADDRCONF(NETDEV_CHANGE): nr0: link becomes ready [ 55.623718] IPv6: ADDRCONF(NETDEV_CHANGE): nr1: link becomes ready [ 55.632941] IPv6: ADDRCONF(NETDEV_CHANGE): nr4: link becomes ready [ 55.641431] IPv6: ADDRCONF(NETDEV_CHANGE): nr2: link becomes ready [ 55.649696] IPv6: ADDRCONF(NETDEV_CHANGE): nr5: link becomes ready [ 55.660070] IPv6: ADDRCONF(NETDEV_CHANGE): nr3: link becomes ready [ 55.675713] IPVS: Creating netns size=2712 id=2 [ 55.680494] IPVS: ftp: loaded support on port[0] = 21 [ 55.748663] IPVS: Creating netns size=2712 id=3 [ 55.753568] IPVS: ftp: loaded support on port[0] = 21 [ 55.889831] IPVS: Creating netns size=2712 id=4 [ 55.895693] IPVS: ftp: loaded support on port[0] = 21 [ 55.912174] chnl_net:caif_netlink_parms(): no params data found [ 56.121838] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.128602] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.137974] device bridge_slave_0 entered promiscuous mode [ 56.153730] chnl_net:caif_netlink_parms(): no params data found [ 56.167521] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.173969] bridge0: port 2(bridge_slave_1) entered disabled state [ 56.183087] device bridge_slave_1 entered promiscuous mode [ 56.213578] IPVS: Creating netns size=2712 id=5 [ 56.218417] IPVS: ftp: loaded support on port[0] = 21 [ 56.294905] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 56.351441] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 56.492582] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.499117] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.509379] device bridge_slave_0 entered promiscuous mode [ 56.533774] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.540861] bridge0: port 2(bridge_slave_1) entered disabled state [ 56.549877] device bridge_slave_1 entered promiscuous mode [ 56.573284] IPVS: Creating netns size=2712 id=6 [ 56.578164] IPVS: ftp: loaded support on port[0] = 21 [ 56.588103] chnl_net:caif_netlink_parms(): no params data found [ 56.665637] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 56.696874] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 56.711482] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 56.804745] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 56.879167] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 56.909756] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 56.919165] IPVS: Creating netns size=2712 id=7 [ 56.924927] IPVS: ftp: loaded support on port[0] = 21 [ 56.969964] chnl_net:caif_netlink_parms(): no params data found [ 57.014158] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 57.044235] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.050788] bridge0: port 1(bridge_slave_0) entered disabled state [ 57.059824] device bridge_slave_0 entered promiscuous mode [ 57.087187] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 57.128568] bridge0: port 2(bridge_slave_1) entered blocking state [ 57.135515] bridge0: port 2(bridge_slave_1) entered disabled state [ 57.144497] device bridge_slave_1 entered promiscuous mode [ 57.244170] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 57.363444] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 57.374207] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 57.412578] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 57.422820] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 57.483127] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.489730] bridge0: port 1(bridge_slave_0) entered disabled state [ 57.498594] device bridge_slave_0 entered promiscuous mode [ 57.515798] chnl_net:caif_netlink_parms(): no params data found [ 57.550296] bridge0: port 2(bridge_slave_1) entered blocking state [ 57.556722] bridge0: port 2(bridge_slave_1) entered disabled state [ 57.567233] device bridge_slave_1 entered promiscuous mode [ 57.657147] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 57.724772] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 57.734009] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 57.742118] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 57.752969] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 57.945267] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 57.953715] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 57.961843] chnl_net:caif_netlink_parms(): no params data found [ 57.977028] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.983974] bridge0: port 1(bridge_slave_0) entered disabled state [ 57.993352] device bridge_slave_0 entered promiscuous mode [ 58.013344] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 58.022311] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.028821] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.038205] device bridge_slave_1 entered promiscuous mode [ 58.045964] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 58.159629] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 58.182313] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 58.251936] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 58.279821] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 58.332167] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 58.339183] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.350368] bridge0: port 1(bridge_slave_0) entered disabled state [ 58.359258] device bridge_slave_0 entered promiscuous mode [ 58.367376] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.373986] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.392544] device bridge_slave_1 entered promiscuous mode [ 58.412711] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 58.480754] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 58.522202] 8021q: adding VLAN 0 to HW filter on device bond0 [ 58.533234] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 58.582898] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 58.595953] 8021q: adding VLAN 0 to HW filter on device bond0 [ 58.615353] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 58.648399] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 58.657897] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 58.687902] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 58.701745] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 58.748052] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 58.759178] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 58.767256] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 58.783830] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 58.805521] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 58.934251] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 58.942588] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.948941] bridge0: port 1(bridge_slave_0) entered forwarding state [ 58.956431] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 58.964535] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.970924] bridge0: port 2(bridge_slave_1) entered forwarding state [ 58.978052] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 58.985898] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.992361] bridge0: port 1(bridge_slave_0) entered forwarding state [ 59.006984] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 59.019299] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 59.027315] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 59.035798] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.042303] bridge0: port 2(bridge_slave_1) entered forwarding state [ 59.071414] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 59.084734] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 59.098506] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 59.111825] 8021q: adding VLAN 0 to HW filter on device bond0 [ 59.123321] 8021q: adding VLAN 0 to HW filter on device bond0 [ 59.138812] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 59.156434] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 59.166501] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 59.177806] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 59.212558] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 59.219767] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 59.227262] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 59.245149] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 59.257482] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 59.274419] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 59.309797] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 59.335933] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 59.360612] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 59.368498] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.375148] bridge0: port 1(bridge_slave_0) entered forwarding state [ 59.405952] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 59.419913] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 59.428635] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.435073] bridge0: port 2(bridge_slave_1) entered forwarding state [ 59.471171] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 59.479212] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.485694] bridge0: port 1(bridge_slave_0) entered forwarding state [ 59.514144] 8021q: adding VLAN 0 to HW filter on device bond0 [ 59.531452] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 59.538795] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 59.549176] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.555583] bridge0: port 2(bridge_slave_1) entered forwarding state [ 59.571099] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 59.603217] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 59.613723] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 59.645654] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 59.659109] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 59.696663] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 59.719161] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 59.733768] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 59.753147] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 59.791288] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 59.799309] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.805714] bridge0: port 1(bridge_slave_0) entered forwarding state [ 59.829772] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 59.838019] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 59.845849] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 59.857205] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 59.866401] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.872803] bridge0: port 2(bridge_slave_1) entered forwarding state [ 59.891304] 8021q: adding VLAN 0 to HW filter on device bond0 [ 59.920161] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 59.941584] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 59.969484] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 59.992829] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 60.015250] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 60.047249] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 60.183553] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 60.193443] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.193496] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.204802] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 60.222460] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 60.223141] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.223198] bridge0: port 2(bridge_slave_1) entered forwarding state [ 60.302529] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 60.351419] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 60.392884] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 60.429318] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready 2019/12/17 10:19:04 executed programs: 9 ** 56901 printk messages dropped ** [ 64.122193] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122195] [] fbcon_do_set_font+0x85d/0x1120 [ 64.122196] [] ? con_font_op+0xe5/0xfa0 [ 64.122198] [] ? fbcon_do_set_font+0x1120/0x1120 [ 64.122200] [] fbcon_copy_font+0x117/0x190 [ 64.122201] [] con_font_op+0x208/0xfa0 [ 64.122203] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122204] [] ? con_write+0x90/0x90 [ 64.122207] [] ? __might_fault+0xf1/0x1b0 [ 64.122209] [] vt_ioctl+0x625/0x24e0 [ 64.122211] [] ? futex_wait+0x4b4/0x570 [ 64.122213] [] ? complete_change_console+0x300/0x300 [ 64.122215] [] ? futex_wait_setup+0x2c0/0x2c0 [ 64.122217] [] ? plist_del+0xe9/0x1d0 [ 64.122219] [] ? wake_up_q+0x82/0xe0 [ 64.122221] [] ? futex_wake+0x110/0x500 [ 64.122223] [] tty_ioctl+0x5d4/0x20f0 [ 64.122225] [] ? no_tty+0x90/0x90 [ 64.122227] [] ? __lock_acquire+0xca1/0x5560 [ 64.122229] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122231] [] ? __lock_acquire+0x1985/0x5560 [ 64.122234] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.122236] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.122238] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122240] [] do_vfs_ioctl+0x17f/0xe70 [ 64.122242] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 64.122243] [] ? __fget+0x1c2/0x320 [ 64.122245] [] ? __fget+0x1df/0x320 [ 64.122246] [] ? __fget+0x42/0x320 [ 64.122248] [] ? __fget_light+0x79/0x200 [ 64.122249] [] SyS_ioctl+0x74/0x80 [ 64.122252] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 64.122253] Memory state around the buggy address: [ 64.122254] ffffffff85fdcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.122255] ffffffff85fdd000: fa fa fa fa 06 fa fa fa fa fa fa fa 05 fa fa fa [ 64.122256] >ffffffff85fdd080: fa fa fa fa 00 00 03 fa fa fa fa fa 00 00 00 00 [ 64.122257] ^ [ 64.122258] ffffffff85fdd100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.122259] ffffffff85fdd180: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa [ 64.122259] ================================================================== [ 64.122260] ================================================================== [ 64.122262] BUG: KASAN: global-out-of-bounds in bit_putcs+0xc43/0xd20 at addr ffffffff85fdd0c3 [ 64.122263] Read of size 1 by task syz-executor.0/7588 [ 64.122264] Address belongs to variable fontdata_8x16+0x10c3/0x10e0 [ 64.122265] CPU: 1 PID: 7588 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 [ 64.122266] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.122269] 1ffffffff0d9577e ffff8800af6c7348 ffffffff82c4c1e6 ffff8801dc884067 [ 64.122271] ffff8800af6c73d8 ffffffff85fdd0c3 dffffc0000000000 ffff8800af6c73c8 [ 64.122273] ffffffff8173ea4a 0000000000000010 ffff880000000000 0000000000000286 [ 64.122274] Call Trace: [ 64.122275] [] dump_stack+0xe6/0x120 [ 64.122277] [] kasan_report_error+0x59a/0x5c0 [ 64.122280] [] __asan_report_load1_noabort+0x3e/0x40 [ 64.122281] [] ? bit_putcs+0xc43/0xd20 [ 64.122283] [] bit_putcs+0xc43/0xd20 [ 64.122285] [] ? bit_clear+0x6e0/0x6e0 [ 64.122287] [] ? get_color+0x30/0x380 [ 64.122290] [] fbcon_putcs+0x374/0x5a0 [ 64.122291] [] ? bit_clear+0x6e0/0x6e0 [ 64.122294] [] do_update_region+0x3f7/0x7c0 [ 64.122296] [] ? con_get_trans_old+0x180/0x180 [ 64.122299] [] ? fbcon_set_palette+0x387/0x580 [ 64.122301] [] redraw_screen+0x531/0x7d0 [ 64.122303] [] ? bit_bmove+0x200/0x200 [ 64.122305] [] ? respond_string+0x3a0/0x3a0 [ 64.122307] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122308] [] fbcon_do_set_font+0x85d/0x1120 [ 64.122310] [] ? con_font_op+0xe5/0xfa0 [ 64.122312] [] ? fbcon_do_set_font+0x1120/0x1120 [ 64.122313] [] fbcon_copy_font+0x117/0x190 [ 64.122315] [] con_font_op+0x208/0xfa0 [ 64.122316] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122318] [] ? con_write+0x90/0x90 [ 64.122320] [] ? __might_fault+0xf1/0x1b0 [ 64.122322] [] vt_ioctl+0x625/0x24e0 [ 64.122324] [] ? futex_wait+0x4b4/0x570 [ 64.122326] [] ? complete_change_console+0x300/0x300 [ 64.122328] [] ? futex_wait_setup+0x2c0/0x2c0 [ 64.122330] [] ? plist_del+0xe9/0x1d0 [ 64.122333] [] ? wake_up_q+0x82/0xe0 [ 64.122335] [] ? futex_wake+0x110/0x500 [ 64.122337] [] tty_ioctl+0x5d4/0x20f0 [ 64.122339] [] ? no_tty+0x90/0x90 [ 64.122341] [] ? __lock_acquire+0xca1/0x5560 [ 64.122343] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122345] [] ? __lock_acquire+0x1985/0x5560 [ 64.122348] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.122350] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.122352] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122353] [] do_vfs_ioctl+0x17f/0xe70 [ 64.122355] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 64.122357] [] ? __fget+0x1c2/0x320 [ 64.122358] [] ? __fget+0x1df/0x320 [ 64.122360] [] ? __fget+0x42/0x320 [ 64.122361] [] ? __fget_light+0x79/0x200 [ 64.122363] [] SyS_ioctl+0x74/0x80 [ 64.122365] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 64.122366] Memory state around the buggy address: [ 64.122367] ffffffff85fdcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.122368] ffffffff85fdd000: fa fa fa fa 06 fa fa fa fa fa fa fa 05 fa fa fa [ 64.122370] >ffffffff85fdd080: fa fa fa fa 00 00 03 fa fa fa fa fa 00 00 00 00 [ 64.122370] ^ [ 64.122371] ffffffff85fdd100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.122372] ffffffff85fdd180: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa [ 64.122373] ================================================================== [ 64.122374] ================================================================== [ 64.122375] BUG: KASAN: global-out-of-bounds in bit_putcs+0xc43/0xd20 at addr ffffffff85fdd0c4 [ 64.122376] Read of size 1 by task syz-executor.0/7588 [ 64.122378] Address belongs to variable fontdata_8x16+0x10c4/0x10e0 [ 64.122379] CPU: 1 PID: 7588 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 [ 64.122380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.122382] 1ffffffff0d9577e ffff8800af6c7348 ffffffff82c4c1e6 ffff8801dc884067 [ 64.122384] ffff8800af6c73d8 ffffffff85fdd0c4 dffffc0000000000 ffff8800af6c73c8 [ 64.122387] ffffffff8173ea4a 0000000000000010 ffff880000000000 0000000000000286 [ 64.122387] Call Trace: [ 64.122389] [] dump_stack+0xe6/0x120 [ 64.122391] [] kasan_report_error+0x59a/0x5c0 [ 64.122393] [] __asan_report_load1_noabort+0x3e/0x40 [ 64.122395] [] ? bit_putcs+0xc43/0xd20 [ 64.122396] [] bit_putcs+0xc43/0xd20 [ 64.122398] [] ? bit_clear+0x6e0/0x6e0 [ 64.122401] [] ? get_color+0x30/0x380 [ 64.122403] [] fbcon_putcs+0x374/0x5a0 [ 64.122405] [] ? bit_clear+0x6e0/0x6e0 [ 64.122407] [] do_update_region+0x3f7/0x7c0 [ 64.122409] [] ? con_get_trans_old+0x180/0x180 [ 64.122412] [] ? fbcon_set_palette+0x387/0x580 [ 64.122414] [] redraw_screen+0x531/0x7d0 [ 64.122416] [] ? bit_bmove+0x200/0x200 [ 64.122418] [] ? respond_string+0x3a0/0x3a0 [ 64.122420] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122422] [] fbcon_do_set_font+0x85d/0x1120 [ 64.122423] [] ? con_font_op+0xe5/0xfa0 [ 64.122425] [] ? fbcon_do_set_font+0x1120/0x1120 [ 64.122426] [] fbcon_copy_font+0x117/0x190 [ 64.122428] [] con_font_op+0x208/0xfa0 [ 64.122430] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122431] [] ? con_write+0x90/0x90 [ 64.122433] [] ? __might_fault+0xf1/0x1b0 [ 64.122435] [] vt_ioctl+0x625/0x24e0 [ 64.122438] [] ? futex_wait+0x4b4/0x570 [ 64.122440] [] ? complete_change_console+0x300/0x300 [ 64.122442] [] ? futex_wait_setup+0x2c0/0x2c0 [ 64.122444] [] ? plist_del+0xe9/0x1d0 [ 64.122446] [] ? wake_up_q+0x82/0xe0 [ 64.122448] [] ? futex_wake+0x110/0x500 [ 64.122450] [] tty_ioctl+0x5d4/0x20f0 [ 64.122452] [] ? no_tty+0x90/0x90 [ 64.122454] [] ? __lock_acquire+0xca1/0x5560 [ 64.122456] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122458] [] ? __lock_acquire+0x1985/0x5560 [ 64.122461] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.122463] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.122465] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122467] [] do_vfs_ioctl+0x17f/0xe70 [ 64.122468] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 64.122470] [] ? __fget+0x1c2/0x320 [ 64.122471] [] ? __fget+0x1df/0x320 [ 64.122473] [] ? __fget+0x42/0x320 [ 64.122474] [] ? __fget_light+0x79/0x200 [ 64.122476] [] SyS_ioctl+0x74/0x80 [ 64.122478] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 64.122479] Memory state around the buggy address: [ 64.122481] ffffffff85fdcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.122482] ffffffff85fdd000: fa fa fa fa 06 fa fa fa fa fa fa fa 05 fa fa fa [ 64.122483] >ffffffff85fdd080: fa fa fa fa 00 00 03 fa fa fa fa fa 00 00 00 00 [ 64.122483] ^ [ 64.122485] ffffffff85fdd100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.122486] ffffffff85fdd180: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa [ 64.122486] ================================================================== [ 64.122487] ================================================================== [ 64.122489] BUG: KASAN: global-out-of-bounds in bit_putcs+0xc43/0xd20 at addr ffffffff85fdd0c5 [ 64.122489] Read of size 1 by task syz-executor.0/7588 [ 64.122491] Address belongs to variable fontdata_8x16+0x10c5/0x10e0 [ 64.122492] CPU: 1 PID: 7588 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 [ 64.122493] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.122495] 1ffffffff0d9577e ffff8800af6c7348 ffffffff82c4c1e6 ffff8801dc884067 [ 64.122498] ffff8800af6c73d8 ffffffff85fdd0c5 dffffc0000000000 ffff8800af6c73c8 [ 64.122500] ffffffff8173ea4a 0000000000000010 ffff880000000000 0000000000000286 [ 64.122500] Call Trace: [ 64.122502] [] dump_stack+0xe6/0x120 [ 64.122504] [] kasan_report_error+0x59a/0x5c0 [ 64.122506] [] __asan_report_load1_noabort+0x3e/0x40 [ 64.122508] [] ? bit_putcs+0xc43/0xd20 [ 64.122509] [] bit_putcs+0xc43/0xd20 [ 64.122512] [] ? bit_clear+0x6e0/0x6e0 [ 64.122514] [] ? get_color+0x30/0x380 [ 64.122516] [] fbcon_putcs+0x374/0x5a0 [ 64.122518] [] ? bit_clear+0x6e0/0x6e0 [ 64.122520] [] do_update_region+0x3f7/0x7c0 [ 64.122523] [] ? con_get_trans_old+0x180/0x180 [ 64.122525] [] ? fbcon_set_palette+0x387/0x580 [ 64.122528] [] redraw_screen+0x531/0x7d0 [ 64.122529] [] ? bit_bmove+0x200/0x200 [ 64.122531] [] ? respond_string+0x3a0/0x3a0 [ 64.122533] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122535] [] fbcon_do_set_font+0x85d/0x1120 [ 64.122537] [] ? con_font_op+0xe5/0xfa0 [ 64.122538] [] ? fbcon_do_set_font+0x1120/0x1120 [ 64.122540] [] fbcon_copy_font+0x117/0x190 [ 64.122541] [] con_font_op+0x208/0xfa0 [ 64.122543] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122545] [] ? con_write+0x90/0x90 [ 64.122547] [] ? __might_fault+0xf1/0x1b0 [ 64.122549] [] vt_ioctl+0x625/0x24e0 [ 64.122551] [] ? futex_wait+0x4b4/0x570 [ 64.122553] [] ? complete_change_console+0x300/0x300 [ 64.122555] [] ? futex_wait_setup+0x2c0/0x2c0 [ 64.122557] [] ? plist_del+0xe9/0x1d0 [ 64.122559] [] ? wake_up_q+0x82/0xe0 [ 64.122561] [] ? futex_wake+0x110/0x500 [ 64.122563] [] tty_ioctl+0x5d4/0x20f0 [ 64.122565] [] ? no_tty+0x90/0x90 [ 64.122568] [] ? __lock_acquire+0xca1/0x5560 [ 64.122569] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122571] [] ? __lock_acquire+0x1985/0x5560 [ 64.122574] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.122576] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.122578] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122580] [] do_vfs_ioctl+0x17f/0xe70 [ 64.122582] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 64.122583] [] ? __fget+0x1c2/0x320 [ 64.122585] [] ? __fget+0x1df/0x320 [ 64.122586] [] ? __fget+0x42/0x320 [ 64.122588] [] ? __fget_light+0x79/0x200 [ 64.122589] [] SyS_ioctl+0x74/0x80 [ 64.122592] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 64.122593] Memory state around the buggy address: [ 64.122594] ffffffff85fdcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.122595] ffffffff85fdd000: fa fa fa fa 06 fa fa fa fa fa fa fa 05 fa fa fa [ 64.122596] >ffffffff85fdd080: fa fa fa fa 00 00 03 fa fa fa fa fa 00 00 00 00 [ 64.122597] ^ [ 64.122598] ffffffff85fdd100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.122599] ffffffff85fdd180: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa [ 64.122600] ================================================================== [ 64.122600] ================================================================== [ 64.122602] BUG: KASAN: global-out-of-bounds in bit_putcs+0xc43/0xd20 at addr ffffffff85fdd0c6 [ 64.122603] Read of size 1 by task syz-executor.0/7588 [ 64.122604] Address belongs to variable fontdata_8x16+0x10c6/0x10e0 [ 64.122606] CPU: 1 PID: 7588 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 [ 64.122606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.122609] 1ffffffff0d9577e ffff8800af6c7348 ffffffff82c4c1e6 ffff8801dc884067 [ 64.122611] ffff8800af6c73d8 ffffffff85fdd0c6 dffffc0000000000 ffff8800af6c73c8 [ 64.122613] ffffffff8173ea4a 0000000000000010 ffff880000000000 0000000000000286 [ 64.122614] Call Trace: [ 64.122615] [] dump_stack+0xe6/0x120 [ 64.122617] [] kasan_report_error+0x59a/0x5c0 [ 64.122620] [] __asan_report_load1_noabort+0x3e/0x40 [ 64.122621] [] ? bit_putcs+0xc43/0xd20 [ 64.122623] [] bit_putcs+0xc43/0xd20 [ 64.122625] [] ? bit_clear+0x6e0/0x6e0 [ 64.122633] [] ? get_color+0x30/0x380 [ 64.122636] [] fbcon_putcs+0x374/0x5a0 [ 64.122637] [] ? bit_clear+0x6e0/0x6e0 [ 64.122639] [] do_update_region+0x3f7/0x7c0 [ 64.122642] [] ? con_get_trans_old+0x180/0x180 [ 64.122644] [] ? fbcon_set_palette+0x387/0x580 [ 64.122647] [] redraw_screen+0x531/0x7d0 [ 64.122648] [] ? bit_bmove+0x200/0x200 [ 64.122651] [] ? respond_string+0x3a0/0x3a0 [ 64.122652] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122654] [] fbcon_do_set_font+0x85d/0x1120 [ 64.122656] [] ? con_font_op+0xe5/0xfa0 [ 64.122657] [] ? fbcon_do_set_font+0x1120/0x1120 [ 64.122659] [] fbcon_copy_font+0x117/0x190 [ 64.122660] [] con_font_op+0x208/0xfa0 [ 64.122662] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122664] [] ? con_write+0x90/0x90 [ 64.122666] [] ? __might_fault+0xf1/0x1b0 [ 64.122668] [] vt_ioctl+0x625/0x24e0 [ 64.122670] [] ? futex_wait+0x4b4/0x570 [ 64.122672] [] ? complete_change_console+0x300/0x300 [ 64.122674] [] ? futex_wait_setup+0x2c0/0x2c0 [ 64.122676] [] ? plist_del+0xe9/0x1d0 [ 64.122678] [] ? wake_up_q+0x82/0xe0 [ 64.122681] [] ? futex_wake+0x110/0x500 [ 64.122683] [] tty_ioctl+0x5d4/0x20f0 [ 64.122684] [] ? no_tty+0x90/0x90 [ 64.122687] [] ? __lock_acquire+0xca1/0x5560 [ 64.122688] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122691] [] ? __lock_acquire+0x1985/0x5560 [ 64.122694] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.122696] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.122698] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122700] [] do_vfs_ioctl+0x17f/0xe70 [ 64.122701] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 64.122703] [] ? __fget+0x1c2/0x320 [ 64.122704] [] ? __fget+0x1df/0x320 [ 64.122706] [] ? __fget+0x42/0x320 [ 64.122707] [] ? __fget_light+0x79/0x200 [ 64.122709] [] SyS_ioctl+0x74/0x80 [ 64.122711] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 64.122712] Memory state around the buggy address: [ 64.122713] ffffffff85fdcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.122715] ffffffff85fdd000: fa fa fa fa 06 fa fa fa fa fa fa fa 05 fa fa fa [ 64.122716] >ffffffff85fdd080: fa fa fa fa 00 00 03 fa fa fa fa fa 00 00 00 00 [ 64.122716] ^ [ 64.122717] ffffffff85fdd100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.122718] ffffffff85fdd180: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa [ 64.122719] ================================================================== [ 64.122720] ================================================================== [ 64.122721] BUG: KASAN: global-out-of-bounds in bit_putcs+0xc43/0xd20 at addr ffffffff85fdd0c7 [ 64.122722] Read of size 1 by task syz-executor.0/7588 [ 64.122724] Address belongs to variable fontdata_8x16+0x10c7/0x10e0 [ 64.122725] CPU: 1 PID: 7588 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 [ 64.122726] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.122728] 1ffffffff0d9577e ffff8800af6c7348 ffffffff82c4c1e6 ffff8801dc884067 [ 64.122730] ffff8800af6c73d8 ffffffff85fdd0c7 dffffc0000000000 ffff8800af6c73c8 [ 64.122733] ffffffff8173ea4a 0000000000000010 ffff880000000000 0000000000000286 [ 64.122733] Call Trace: [ 64.122735] [] dump_stack+0xe6/0x120 [ 64.122737] [] kasan_report_error+0x59a/0x5c0 [ 64.122739] [] __asan_report_load1_noabort+0x3e/0x40 [ 64.122741] [] ? bit_putcs+0xc43/0xd20 [ 64.122742] [] bit_putcs+0xc43/0xd20 [ 64.122744] [] ? bit_clear+0x6e0/0x6e0 [ 64.122747] [] ? get_color+0x30/0x380 [ 64.122749] [] fbcon_putcs+0x374/0x5a0 [ 64.122751] [] ? bit_clear+0x6e0/0x6e0 [ 64.122753] [] do_update_region+0x3f7/0x7c0 [ 64.122755] [] ? con_get_trans_old+0x180/0x180 [ 64.122758] [] ? fbcon_set_palette+0x387/0x580 [ 64.122760] [] redraw_screen+0x531/0x7d0 [ 64.122762] [] ? bit_bmove+0x200/0x200 [ 64.122764] [] ? respond_string+0x3a0/0x3a0 [ 64.122766] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122768] [] fbcon_do_set_font+0x85d/0x1120 [ 64.122769] [] ? con_font_op+0xe5/0xfa0 [ 64.122771] [] ? fbcon_do_set_font+0x1120/0x1120 [ 64.122772] [] fbcon_copy_font+0x117/0x190 [ 64.122774] [] con_font_op+0x208/0xfa0 [ 64.122776] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122777] [] ? con_write+0x90/0x90 [ 64.122780] [] ? __might_fault+0xf1/0x1b0 [ 64.122782] [] vt_ioctl+0x625/0x24e0 [ 64.122784] [] ? futex_wait+0x4b4/0x570 [ 64.122786] [] ? complete_change_console+0x300/0x300 [ 64.122788] [] ? futex_wait_setup+0x2c0/0x2c0 [ 64.122790] [] ? plist_del+0xe9/0x1d0 [ 64.122792] [] ? wake_up_q+0x82/0xe0 [ 64.122794] [] ? futex_wake+0x110/0x500 [ 64.122796] [] tty_ioctl+0x5d4/0x20f0 [ 64.122798] [] ? no_tty+0x90/0x90 [ 64.122800] [] ? __lock_acquire+0xca1/0x5560 [ 64.122802] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122804] [] ? __lock_acquire+0x1985/0x5560 [ 64.122807] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.122809] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.122811] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122813] [] do_vfs_ioctl+0x17f/0xe70 [ 64.122815] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 64.122816] [] ? __fget+0x1c2/0x320 [ 64.122818] [] ? __fget+0x1df/0x320 [ 64.122819] [] ? __fget+0x42/0x320 [ 64.122821] [] ? __fget_light+0x79/0x200 [ 64.122822] [] SyS_ioctl+0x74/0x80 [ 64.122825] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 64.122826] Memory state around the buggy address: [ 64.122827] ffffffff85fdcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.122828] ffffffff85fdd000: fa fa fa fa 06 fa fa fa fa fa fa fa 05 fa fa fa [ 64.122829] >ffffffff85fdd080: fa fa fa fa 00 00 03 fa fa fa fa fa 00 00 00 00 [ 64.122830] ^ [ 64.122831] ffffffff85fdd100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.122832] ffffffff85fdd180: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa [ 64.122832] ================================================================== [ 64.122833] ================================================================== [ 64.122835] BUG: KASAN: global-out-of-bounds in bit_putcs+0xc43/0xd20 at addr ffffffff85fdd0c8 [ 64.122835] Read of size 1 by task syz-executor.0/7588 [ 64.122837] Address belongs to variable fontdata_8x16+0x10c8/0x10e0 [ 64.122838] CPU: 1 PID: 7588 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 [ 64.122839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.122841] 1ffffffff0d9577e ffff8800af6c7348 ffffffff82c4c1e6 ffff8801dc884067 [ 64.122844] ffff8800af6c73d8 ffffffff85fdd0c8 dffffc0000000000 ffff8800af6c73c8 [ 64.122846] ffffffff8173ea4a 0000000000000010 ffff880000000000 0000000000000286 [ 64.122846] Call Trace: [ 64.122848] [] dump_stack+0xe6/0x120 [ 64.122850] [] kasan_report_error+0x59a/0x5c0 [ 64.122852] [] __asan_report_load1_noabort+0x3e/0x40 [ 64.122854] [] ? bit_putcs+0xc43/0xd20 [ 64.122855] [] bit_putcs+0xc43/0xd20 [ 64.122858] [] ? bit_clear+0x6e0/0x6e0 [ 64.122860] [] ? get_color+0x30/0x380 [ 64.122862] [] fbcon_putcs+0x374/0x5a0 [ 64.122864] [] ? bit_clear+0x6e0/0x6e0 [ 64.122866] [] do_update_region+0x3f7/0x7c0 [ 64.122869] [] ? con_get_trans_old+0x180/0x180 [ 64.122871] [] ? fbcon_set_palette+0x387/0x580 [ 64.122874] [] redraw_screen+0x531/0x7d0 [ 64.122875] [] ? bit_bmove+0x200/0x200 [ 64.122877] [] ? respond_string+0x3a0/0x3a0 [ 64.122879] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122881] [] fbcon_do_set_font+0x85d/0x1120 [ 64.122883] [] ? con_font_op+0xe5/0xfa0 [ 64.122884] [] ? fbcon_do_set_font+0x1120/0x1120 [ 64.122886] [] fbcon_copy_font+0x117/0x190 [ 64.122887] [] con_font_op+0x208/0xfa0 [ 64.122889] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122891] [] ? con_write+0x90/0x90 [ 64.122893] [] ? __might_fault+0xf1/0x1b0 [ 64.122895] [] vt_ioctl+0x625/0x24e0 [ 64.122897] [] ? futex_wait+0x4b4/0x570 [ 64.122899] [] ? complete_change_console+0x300/0x300 [ 64.122901] [] ? futex_wait_setup+0x2c0/0x2c0 [ 64.122903] [] ? plist_del+0xe9/0x1d0 [ 64.122905] [] ? wake_up_q+0x82/0xe0 [ 64.122907] [] ? futex_wake+0x110/0x500 [ 64.122909] [] tty_ioctl+0x5d4/0x20f0 [ 64.122911] [] ? no_tty+0x90/0x90 [ 64.122914] [] ? __lock_acquire+0xca1/0x5560 [ 64.122915] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122917] [] ? __lock_acquire+0x1985/0x5560 [ 64.122920] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.122922] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.122924] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122926] [] do_vfs_ioctl+0x17f/0xe70 [ 64.122928] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 64.122929] [] ? __fget+0x1c2/0x320 [ 64.122931] [] ? __fget+0x1df/0x320 [ 64.122932] [] ? __fget+0x42/0x320 [ 64.122934] [] ? __fget_light+0x79/0x200 [ 64.122935] [] SyS_ioctl+0x74/0x80 [ 64.122938] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 64.122939] Memory state around the buggy address: [ 64.122940] ffffffff85fdcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.122941] ffffffff85fdd000: fa fa fa fa 06 fa fa fa fa fa fa fa 05 fa fa fa [ 64.122942] >ffffffff85fdd080: fa fa fa fa 00 00 03 fa fa fa fa fa 00 00 00 00 [ 64.122943] ^ [ 64.122944] ffffffff85fdd100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.122945] ffffffff85fdd180: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa [ 64.122945] ================================================================== [ 64.122946] ================================================================== [ 64.122948] BUG: KASAN: global-out-of-bounds in bit_putcs+0xc43/0xd20 at addr ffffffff85fdd0c9 [ 64.122949] Read of size 1 by task syz-executor.0/7588 [ 64.122950] Address belongs to variable fontdata_8x16+0x10c9/0x10e0 [ 64.122951] CPU: 1 PID: 7588 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 [ 64.122952] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.122954] 1ffffffff0d9577e ffff8800af6c7348 ffffffff82c4c1e6 ffff8801dc884067 [ 64.122957] ffff8800af6c73d8 ffffffff85fdd0c9 dffffc0000000000 ffff8800af6c73c8 [ 64.122959] ffffffff8173ea4a 0000000000000010 ffff880000000000 0000000000000286 [ 64.122959] Call Trace: [ 64.122961] [] dump_stack+0xe6/0x120 [ 64.122963] [] kasan_report_error+0x59a/0x5c0 [ 64.122965] [] __asan_report_load1_noabort+0x3e/0x40 [ 64.122967] [] ? bit_putcs+0xc43/0xd20 [ 64.122969] [] bit_putcs+0xc43/0xd20 [ 64.122971] [] ? bit_clear+0x6e0/0x6e0 [ 64.122973] [] ? get_color+0x30/0x380 [ 64.122976] [] fbcon_putcs+0x374/0x5a0 [ 64.122977] [] ? bit_clear+0x6e0/0x6e0 [ 64.122979] [] do_update_region+0x3f7/0x7c0 [ 64.122982] [] ? con_get_trans_old+0x180/0x180 [ 64.122984] [] ? fbcon_set_palette+0x387/0x580 [ 64.122987] [] redraw_screen+0x531/0x7d0 [ 64.122988] [] ? bit_bmove+0x200/0x200 [ 64.122990] [] ? respond_string+0x3a0/0x3a0 [ 64.122992] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.122994] [] fbcon_do_set_font+0x85d/0x1120 [ 64.122996] [] ? con_font_op+0xe5/0xfa0 [ 64.122997] [] ? fbcon_do_set_font+0x1120/0x1120 [ 64.122999] [] fbcon_copy_font+0x117/0x190 [ 64.123000] [] con_font_op+0x208/0xfa0 [ 64.123002] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123004] [] ? con_write+0x90/0x90 [ 64.123006] [] ? __might_fault+0xf1/0x1b0 [ 64.123008] [] vt_ioctl+0x625/0x24e0 [ 64.123010] [] ? futex_wait+0x4b4/0x570 [ 64.123013] [] ? complete_change_console+0x300/0x300 [ 64.123017] [] ? futex_wait_setup+0x2c0/0x2c0 [ 64.123020] [] ? plist_del+0xe9/0x1d0 [ 64.123023] [] ? wake_up_q+0x82/0xe0 [ 64.123026] [] ? futex_wake+0x110/0x500 [ 64.123030] [] tty_ioctl+0x5d4/0x20f0 [ 64.123032] [] ? no_tty+0x90/0x90 [ 64.123036] [] ? __lock_acquire+0xca1/0x5560 [ 64.123039] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123042] [] ? __lock_acquire+0x1985/0x5560 [ 64.123046] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.123050] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.123053] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123055] [] do_vfs_ioctl+0x17f/0xe70 [ 64.123058] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 64.123061] [] ? __fget+0x1c2/0x320 [ 64.123063] [] ? __fget+0x1df/0x320 [ 64.123066] [] ? __fget+0x42/0x320 [ 64.123069] [] ? __fget_light+0x79/0x200 [ 64.123071] [] SyS_ioctl+0x74/0x80 [ 64.123075] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 64.123077] Memory state around the buggy address: [ 64.123079] ffffffff85fdcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.123081] ffffffff85fdd000: fa fa fa fa 06 fa fa fa fa fa fa fa 05 fa fa fa [ 64.123083] >ffffffff85fdd080: fa fa fa fa 00 00 03 fa fa fa fa fa 00 00 00 00 [ 64.123084] ^ [ 64.123086] ffffffff85fdd100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.123088] ffffffff85fdd180: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa [ 64.123089] ================================================================== [ 64.123090] ================================================================== [ 64.123093] BUG: KASAN: global-out-of-bounds in bit_putcs+0xc43/0xd20 at addr ffffffff85fdd0ca [ 64.123094] Read of size 1 by task syz-executor.0/7588 [ 64.123097] Address belongs to variable fontdata_8x16+0x10ca/0x10e0 [ 64.123099] CPU: 1 PID: 7588 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 [ 64.123100] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.123109] 1ffffffff0d9577e ffff8800af6c7348 ffffffff82c4c1e6 ffff8801dc884067 [ 64.123113] ffff8800af6c73d8 ffffffff85fdd0ca dffffc0000000000 ffff8800af6c73c8 [ 64.123117] ffffffff8173ea4a 0000000000000010 ffff880000000000 0000000000000286 [ 64.123118] Call Trace: [ 64.123121] [] dump_stack+0xe6/0x120 [ 64.123124] [] kasan_report_error+0x59a/0x5c0 [ 64.123128] [] __asan_report_load1_noabort+0x3e/0x40 [ 64.123130] [] ? bit_putcs+0xc43/0xd20 [ 64.123133] [] bit_putcs+0xc43/0xd20 [ 64.123136] [] ? bit_clear+0x6e0/0x6e0 [ 64.123140] [] ? get_color+0x30/0x380 [ 64.123144] [] fbcon_putcs+0x374/0x5a0 [ 64.123146] [] ? bit_clear+0x6e0/0x6e0 [ 64.123150] [] do_update_region+0x3f7/0x7c0 [ 64.123153] [] ? con_get_trans_old+0x180/0x180 [ 64.123157] [] ? fbcon_set_palette+0x387/0x580 [ 64.123161] [] redraw_screen+0x531/0x7d0 [ 64.123163] [] ? bit_bmove+0x200/0x200 [ 64.123167] [] ? respond_string+0x3a0/0x3a0 [ 64.123169] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123172] [] fbcon_do_set_font+0x85d/0x1120 [ 64.123175] [] ? con_font_op+0xe5/0xfa0 [ 64.123178] [] ? fbcon_do_set_font+0x1120/0x1120 [ 64.123181] [] fbcon_copy_font+0x117/0x190 [ 64.123183] [] con_font_op+0x208/0xfa0 [ 64.123186] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123189] [] ? con_write+0x90/0x90 [ 64.123192] [] ? __might_fault+0xf1/0x1b0 [ 64.123195] [] vt_ioctl+0x625/0x24e0 [ 64.123198] [] ? futex_wait+0x4b4/0x570 [ 64.123201] [] ? complete_change_console+0x300/0x300 [ 64.123205] [] ? futex_wait_setup+0x2c0/0x2c0 [ 64.123208] [] ? plist_del+0xe9/0x1d0 [ 64.123212] [] ? wake_up_q+0x82/0xe0 [ 64.123215] [] ? futex_wake+0x110/0x500 [ 64.123217] [] tty_ioctl+0x5d4/0x20f0 [ 64.123220] [] ? no_tty+0x90/0x90 [ 64.123223] [] ? __lock_acquire+0xca1/0x5560 [ 64.123226] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123229] [] ? __lock_acquire+0x1985/0x5560 [ 64.123234] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.123237] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.123240] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123243] [] do_vfs_ioctl+0x17f/0xe70 [ 64.123246] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 64.123249] [] ? __fget+0x1c2/0x320 [ 64.123252] [] ? __fget+0x1df/0x320 [ 64.123254] [] ? __fget+0x42/0x320 [ 64.123257] [] ? __fget_light+0x79/0x200 [ 64.123260] [] SyS_ioctl+0x74/0x80 [ 64.123264] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 64.123265] Memory state around the buggy address: [ 64.123267] ffffffff85fdcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.123269] ffffffff85fdd000: fa fa fa fa 06 fa fa fa fa fa fa fa 05 fa fa fa [ 64.123272] >ffffffff85fdd080: fa fa fa fa 00 00 03 fa fa fa fa fa 00 00 00 00 [ 64.123273] ^ [ 64.123275] ffffffff85fdd100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.123277] ffffffff85fdd180: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa [ 64.123278] ================================================================== [ 64.123279] ================================================================== [ 64.123281] BUG: KASAN: global-out-of-bounds in bit_putcs+0xc43/0xd20 at addr ffffffff85fdd0cb [ 64.123283] Read of size 1 by task syz-executor.0/7588 [ 64.123285] Address belongs to variable fontdata_8x16+0x10cb/0x10e0 [ 64.123287] CPU: 1 PID: 7588 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 [ 64.123288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.123291] 1ffffffff0d9577e ffff8800af6c7348 ffffffff82c4c1e6 ffff8801dc884067 [ 64.123293] ffff8800af6c73d8 ffffffff85fdd0cb dffffc0000000000 ffff8800af6c73c8 [ 64.123295] ffffffff8173ea4a 0000000000000010 ffff880000000000 0000000000000286 [ 64.123296] Call Trace: [ 64.123297] [] dump_stack+0xe6/0x120 [ 64.123299] [] kasan_report_error+0x59a/0x5c0 [ 64.123302] [] __asan_report_load1_noabort+0x3e/0x40 [ 64.123303] [] ? bit_putcs+0xc43/0xd20 [ 64.123305] [] bit_putcs+0xc43/0xd20 [ 64.123307] [] ? bit_clear+0x6e0/0x6e0 [ 64.123310] [] ? get_color+0x30/0x380 [ 64.123312] [] fbcon_putcs+0x374/0x5a0 [ 64.123314] [] ? bit_clear+0x6e0/0x6e0 [ 64.123316] [] do_update_region+0x3f7/0x7c0 [ 64.123318] [] ? con_get_trans_old+0x180/0x180 [ 64.123321] [] ? fbcon_set_palette+0x387/0x580 [ 64.123323] [] redraw_screen+0x531/0x7d0 [ 64.123325] [] ? bit_bmove+0x200/0x200 [ 64.123327] [] ? respond_string+0x3a0/0x3a0 [ 64.123329] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123330] [] fbcon_do_set_font+0x85d/0x1120 [ 64.123332] [] ? con_font_op+0xe5/0xfa0 [ 64.123334] [] ? fbcon_do_set_font+0x1120/0x1120 [ 64.123335] [] fbcon_copy_font+0x117/0x190 [ 64.123337] [] con_font_op+0x208/0xfa0 [ 64.123339] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123340] [] ? con_write+0x90/0x90 [ 64.123342] [] ? __might_fault+0xf1/0x1b0 [ 64.123344] [] vt_ioctl+0x625/0x24e0 [ 64.123347] [] ? futex_wait+0x4b4/0x570 [ 64.123348] [] ? complete_change_console+0x300/0x300 [ 64.123351] [] ? futex_wait_setup+0x2c0/0x2c0 [ 64.123352] [] ? plist_del+0xe9/0x1d0 [ 64.123355] [] ? wake_up_q+0x82/0xe0 [ 64.123357] [] ? futex_wake+0x110/0x500 [ 64.123359] [] tty_ioctl+0x5d4/0x20f0 [ 64.123361] [] ? no_tty+0x90/0x90 [ 64.123363] [] ? __lock_acquire+0xca1/0x5560 [ 64.123365] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123367] [] ? __lock_acquire+0x1985/0x5560 [ 64.123370] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.123372] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.123374] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123376] [] do_vfs_ioctl+0x17f/0xe70 [ 64.123377] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 64.123379] [] ? __fget+0x1c2/0x320 [ 64.123380] [] ? __fget+0x1df/0x320 [ 64.123382] [] ? __fget+0x42/0x320 [ 64.123383] [] ? __fget_light+0x79/0x200 [ 64.123385] [] SyS_ioctl+0x74/0x80 [ 64.123387] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 64.123388] Memory state around the buggy address: [ 64.123389] ffffffff85fdcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.123390] ffffffff85fdd000: fa fa fa fa 06 fa fa fa fa fa fa fa 05 fa fa fa [ 64.123392] >ffffffff85fdd080: fa fa fa fa 00 00 03 fa fa fa fa fa 00 00 00 00 [ 64.123392] ^ [ 64.123393] ffffffff85fdd100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.123394] ffffffff85fdd180: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa [ 64.123395] ================================================================== [ 64.123396] ================================================================== [ 64.123397] BUG: KASAN: global-out-of-bounds in bit_putcs+0xc43/0xd20 at addr ffffffff85fdd0cc [ 64.123398] Read of size 1 by task syz-executor.0/7588 [ 64.123400] Address belongs to variable fontdata_8x16+0x10cc/0x10e0 [ 64.123401] CPU: 1 PID: 7588 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 [ 64.123402] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.123404] 1ffffffff0d9577e ffff8800af6c7348 ffffffff82c4c1e6 ffff8801dc884067 [ 64.123406] ffff8800af6c73d8 ffffffff85fdd0cc dffffc0000000000 ffff8800af6c73c8 [ 64.123409] ffffffff8173ea4a 0000000000000010 ffff880000000000 0000000000000286 [ 64.123409] Call Trace: [ 64.123411] [] dump_stack+0xe6/0x120 [ 64.123413] [] kasan_report_error+0x59a/0x5c0 [ 64.123415] [] __asan_report_load1_noabort+0x3e/0x40 [ 64.123417] [] ? bit_putcs+0xc43/0xd20 [ 64.123418] [] bit_putcs+0xc43/0xd20 [ 64.123420] [] ? bit_clear+0x6e0/0x6e0 [ 64.123423] [] ? get_color+0x30/0x380 [ 64.123425] [] fbcon_putcs+0x374/0x5a0 [ 64.123427] [] ? bit_clear+0x6e0/0x6e0 [ 64.123429] [] do_update_region+0x3f7/0x7c0 [ 64.123432] [] ? con_get_trans_old+0x180/0x180 [ 64.123434] [] ? fbcon_set_palette+0x387/0x580 [ 64.123437] [] redraw_screen+0x531/0x7d0 [ 64.123438] [] ? bit_bmove+0x200/0x200 [ 64.123440] [] ? respond_string+0x3a0/0x3a0 [ 64.123442] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123444] [] fbcon_do_set_font+0x85d/0x1120 [ 64.123445] [] ? con_font_op+0xe5/0xfa0 [ 64.123447] [] ? fbcon_do_set_font+0x1120/0x1120 [ 64.123449] [] fbcon_copy_font+0x117/0x190 [ 64.123450] [] con_font_op+0x208/0xfa0 [ 64.123452] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123454] [] ? con_write+0x90/0x90 [ 64.123456] [] ? __might_fault+0xf1/0x1b0 [ 64.123458] [] vt_ioctl+0x625/0x24e0 [ 64.123460] [] ? futex_wait+0x4b4/0x570 [ 64.123462] [] ? complete_change_console+0x300/0x300 [ 64.123464] [] ? futex_wait_setup+0x2c0/0x2c0 [ 64.123466] [] ? plist_del+0xe9/0x1d0 [ 64.123468] [] ? wake_up_q+0x82/0xe0 [ 64.123470] [] ? futex_wake+0x110/0x500 [ 64.123472] [] tty_ioctl+0x5d4/0x20f0 [ 64.123474] [] ? no_tty+0x90/0x90 [ 64.123477] [] ? __lock_acquire+0xca1/0x5560 [ 64.123478] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123480] [] ? __lock_acquire+0x1985/0x5560 [ 64.123483] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.123485] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.123487] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123489] [] do_vfs_ioctl+0x17f/0xe70 [ 64.123491] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 64.123492] [] ? __fget+0x1c2/0x320 [ 64.123494] [] ? __fget+0x1df/0x320 [ 64.123495] [] ? __fget+0x42/0x320 [ 64.123497] [] ? __fget_light+0x79/0x200 [ 64.123498] [] SyS_ioctl+0x74/0x80 [ 64.123501] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 64.123502] Memory state around the buggy address: [ 64.123503] ffffffff85fdcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.123504] ffffffff85fdd000: fa fa fa fa 06 fa fa fa fa fa fa fa 05 fa fa fa [ 64.123505] >ffffffff85fdd080: fa fa fa fa 00 00 03 fa fa fa fa fa 00 00 00 00 [ 64.123506] ^ [ 64.123507] ffffffff85fdd100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.123508] ffffffff85fdd180: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa [ 64.123508] ================================================================== [ 64.123509] ================================================================== [ 64.123511] BUG: KASAN: global-out-of-bounds in bit_putcs+0xc43/0xd20 at addr ffffffff85fdd0cd [ 64.123512] Read of size 1 by task syz-executor.0/7588 [ 64.123513] Address belongs to variable fontdata_8x16+0x10cd/0x10e0 [ 64.123514] CPU: 1 PID: 7588 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 [ 64.123515] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.123517] 1ffffffff0d9577e ffff8800af6c7348 ffffffff82c4c1e6 ffff8801dc884067 [ 64.123520] ffff8800af6c73d8 ffffffff85fdd0cd dffffc0000000000 ffff8800af6c73c8 [ 64.123522] ffffffff8173ea4a 0000000000000010 ffff880000000000 0000000000000286 [ 64.123522] Call Trace: [ 64.123524] [] dump_stack+0xe6/0x120 [ 64.123526] [] kasan_report_error+0x59a/0x5c0 [ 64.123529] [] __asan_report_load1_noabort+0x3e/0x40 [ 64.123530] [] ? bit_putcs+0xc43/0xd20 [ 64.123532] [] bit_putcs+0xc43/0xd20 [ 64.123534] [] ? bit_clear+0x6e0/0x6e0 [ 64.123536] [] ? get_color+0x30/0x380 [ 64.123539] [] fbcon_putcs+0x374/0x5a0 [ 64.123540] [] ? bit_clear+0x6e0/0x6e0 [ 64.123543] [] do_update_region+0x3f7/0x7c0 [ 64.123545] [] ? con_get_trans_old+0x180/0x180 [ 64.123547] [] ? fbcon_set_palette+0x387/0x580 [ 64.123550] [] redraw_screen+0x531/0x7d0 [ 64.123551] [] ? bit_bmove+0x200/0x200 [ 64.123554] [] ? respond_string+0x3a0/0x3a0 [ 64.123555] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123557] [] fbcon_do_set_font+0x85d/0x1120 [ 64.123559] [] ? con_font_op+0xe5/0xfa0 [ 64.123560] [] ? fbcon_do_set_font+0x1120/0x1120 [ 64.123562] [] fbcon_copy_font+0x117/0x190 [ 64.123564] [] con_font_op+0x208/0xfa0 [ 64.123565] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123567] [] ? con_write+0x90/0x90 [ 64.123569] [] ? __might_fault+0xf1/0x1b0 [ 64.123571] [] vt_ioctl+0x625/0x24e0 [ 64.123573] [] ? futex_wait+0x4b4/0x570 [ 64.123575] [] ? complete_change_console+0x300/0x300 [ 64.123577] [] ? futex_wait_setup+0x2c0/0x2c0 [ 64.123579] [] ? plist_del+0xe9/0x1d0 [ 64.123582] [] ? wake_up_q+0x82/0xe0 [ 64.123584] [] ? futex_wake+0x110/0x500 [ 64.123586] [] tty_ioctl+0x5d4/0x20f0 [ 64.123587] [] ? no_tty+0x90/0x90 [ 64.123590] [] ? __lock_acquire+0xca1/0x5560 [ 64.123591] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123594] [] ? __lock_acquire+0x1985/0x5560 [ 64.123596] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.123599] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.123600] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123602] [] do_vfs_ioctl+0x17f/0xe70 [ 64.123604] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 64.123605] [] ? __fget+0x1c2/0x320 [ 64.123607] [] ? __fget+0x1df/0x320 [ 64.123608] [] ? __fget+0x42/0x320 [ 64.123610] [] ? __fget_light+0x79/0x200 [ 64.123612] [] SyS_ioctl+0x74/0x80 [ 64.123614] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 64.123615] Memory state around the buggy address: [ 64.123616] ffffffff85fdcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.123617] ffffffff85fdd000: fa fa fa fa 06 fa fa fa fa fa fa fa 05 fa fa fa [ 64.123618] >ffffffff85fdd080: fa fa fa fa 00 00 03 fa fa fa fa fa 00 00 00 00 [ 64.123619] ^ [ 64.123620] ffffffff85fdd100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.123621] ffffffff85fdd180: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa [ 64.123622] ================================================================== [ 64.123622] ================================================================== [ 64.123624] BUG: KASAN: global-out-of-bounds in bit_putcs+0xc43/0xd20 at addr ffffffff85fdd0ce [ 64.123625] Read of size 1 by task syz-executor.0/7588 [ 64.123626] Address belongs to variable fontdata_8x16+0x10ce/0x10e0 [ 64.123628] CPU: 1 PID: 7588 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 [ 64.123628] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.123631] 1ffffffff0d9577e ffff8800af6c7348 ffffffff82c4c1e6 ffff8801dc884067 [ 64.123633] ffff8800af6c73d8 ffffffff85fdd0ce dffffc0000000000 ffff8800af6c73c8 [ 64.123635] ffffffff8173ea4a 0000000000000010 ffff880000000000 0000000000000286 [ 64.123636] Call Trace: [ 64.123637] [] dump_stack+0xe6/0x120 [ 64.123640] [] kasan_report_error+0x59a/0x5c0 [ 64.123642] [] __asan_report_load1_noabort+0x3e/0x40 [ 64.123643] [] ? bit_putcs+0xc43/0xd20 [ 64.123645] [] bit_putcs+0xc43/0xd20 [ 64.123647] [] ? bit_clear+0x6e0/0x6e0 [ 64.123650] [] ? get_color+0x30/0x380 [ 64.123652] [] fbcon_putcs+0x374/0x5a0 [ 64.123653] [] ? bit_clear+0x6e0/0x6e0 [ 64.123656] [] do_update_region+0x3f7/0x7c0 [ 64.123658] [] ? con_get_trans_old+0x180/0x180 [ 64.123661] [] ? fbcon_set_palette+0x387/0x580 [ 64.123663] [] redraw_screen+0x531/0x7d0 [ 64.123665] [] ? bit_bmove+0x200/0x200 [ 64.123667] [] ? respond_string+0x3a0/0x3a0 [ 64.123669] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123670] [] fbcon_do_set_font+0x85d/0x1120 [ 64.123672] [] ? con_font_op+0xe5/0xfa0 [ 64.123674] [] ? fbcon_do_set_font+0x1120/0x1120 [ 64.123675] [] fbcon_copy_font+0x117/0x190 [ 64.123677] [] con_font_op+0x208/0xfa0 [ 64.123679] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123680] [] ? con_write+0x90/0x90 [ 64.123682] [] ? __might_fault+0xf1/0x1b0 [ 64.123684] [] vt_ioctl+0x625/0x24e0 [ 64.123686] [] ? futex_wait+0x4b4/0x570 [ 64.123688] [] ? complete_change_console+0x300/0x300 [ 64.123690] [] ? futex_wait_setup+0x2c0/0x2c0 [ 64.123692] [] ? plist_del+0xe9/0x1d0 [ 64.123695] [] ? wake_up_q+0x82/0xe0 [ 64.123697] [] ? futex_wake+0x110/0x500 [ 64.123699] [] tty_ioctl+0x5d4/0x20f0 [ 64.123701] [] ? no_tty+0x90/0x90 [ 64.123703] [] ? __lock_acquire+0xca1/0x5560 [ 64.123705] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123707] [] ? __lock_acquire+0x1985/0x5560 [ 64.123710] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.123712] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.123714] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123715] [] do_vfs_ioctl+0x17f/0xe70 [ 64.123717] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 64.123719] [] ? __fget+0x1c2/0x320 [ 64.123720] [] ? __fget+0x1df/0x320 [ 64.123722] [] ? __fget+0x42/0x320 [ 64.123723] [] ? __fget_light+0x79/0x200 [ 64.123725] [] SyS_ioctl+0x74/0x80 [ 64.123727] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 64.123728] Memory state around the buggy address: [ 64.123729] ffffffff85fdcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.123730] ffffffff85fdd000: fa fa fa fa 06 fa fa fa fa fa fa fa 05 fa fa fa [ 64.123732] >ffffffff85fdd080: fa fa fa fa 00 00 03 fa fa fa fa fa 00 00 00 00 [ 64.123732] ^ [ 64.123733] ffffffff85fdd100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.123734] ffffffff85fdd180: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa [ 64.123735] ================================================================== [ 64.123736] ================================================================== [ 64.123737] BUG: KASAN: global-out-of-bounds in bit_putcs+0xc43/0xd20 at addr ffffffff85fdd0cf [ 64.123738] Read of size 1 by task syz-executor.0/7588 [ 64.123740] Address belongs to variable fontdata_8x16+0x10cf/0x10e0 [ 64.123741] CPU: 1 PID: 7588 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 [ 64.123742] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.123744] 1ffffffff0d9577e ffff8800af6c7348 ffffffff82c4c1e6 ffff8801dc884067 [ 64.123746] ffff8800af6c73d8 ffffffff85fdd0cf dffffc0000000000 ffff8800af6c73c8 [ 64.123748] ffffffff8173ea4a 0000000000000010 ffff880000000000 0000000000000286 [ 64.123749] Call Trace: [ 64.123751] [] dump_stack+0xe6/0x120 [ 64.123753] [] kasan_report_error+0x59a/0x5c0 [ 64.123755] [] __asan_report_load1_noabort+0x3e/0x40 [ 64.123757] [] ? bit_putcs+0xc43/0xd20 [ 64.123758] [] bit_putcs+0xc43/0xd20 [ 64.123760] [] ? bit_clear+0x6e0/0x6e0 [ 64.123763] [] ? get_color+0x30/0x380 [ 64.123765] [] fbcon_putcs+0x374/0x5a0 [ 64.123767] [] ? bit_clear+0x6e0/0x6e0 [ 64.123769] [] do_update_region+0x3f7/0x7c0 [ 64.123771] [] ? con_get_trans_old+0x180/0x180 [ 64.123774] [] ? fbcon_set_palette+0x387/0x580 [ 64.123776] [] redraw_screen+0x531/0x7d0 [ 64.123778] [] ? bit_bmove+0x200/0x200 [ 64.123780] [] ? respond_string+0x3a0/0x3a0 [ 64.123782] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123783] [] fbcon_do_set_font+0x85d/0x1120 [ 64.123785] [] ? con_font_op+0xe5/0xfa0 [ 64.123787] [] ? fbcon_do_set_font+0x1120/0x1120 [ 64.123788] [] fbcon_copy_font+0x117/0x190 [ 64.123790] [] con_font_op+0x208/0xfa0 [ 64.123792] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123793] [] ? con_write+0x90/0x90 [ 64.123795] [] ? __might_fault+0xf1/0x1b0 [ 64.123797] [] vt_ioctl+0x625/0x24e0 [ 64.123800] [] ? futex_wait+0x4b4/0x570 [ 64.123801] [] ? complete_change_console+0x300/0x300 [ 64.123804] [] ? futex_wait_setup+0x2c0/0x2c0 [ 64.123806] [] ? plist_del+0xe9/0x1d0 [ 64.123808] [] ? wake_up_q+0x82/0xe0 [ 64.123810] [] ? futex_wake+0x110/0x500 [ 64.123812] [] tty_ioctl+0x5d4/0x20f0 [ 64.123814] [] ? no_tty+0x90/0x90 [ 64.123816] [] ? __lock_acquire+0xca1/0x5560 [ 64.123818] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123820] [] ? __lock_acquire+0x1985/0x5560 [ 64.123823] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.123825] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.123827] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123829] [] do_vfs_ioctl+0x17f/0xe70 [ 64.123830] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 64.123832] [] ? __fget+0x1c2/0x320 [ 64.123833] [] ? __fget+0x1df/0x320 [ 64.123835] [] ? __fget+0x42/0x320 [ 64.123836] [] ? __fget_light+0x79/0x200 [ 64.123838] [] SyS_ioctl+0x74/0x80 [ 64.123840] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 64.123841] Memory state around the buggy address: [ 64.123842] ffffffff85fdcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.123844] ffffffff85fdd000: fa fa fa fa 06 fa fa fa fa fa fa fa 05 fa fa fa [ 64.123845] >ffffffff85fdd080: fa fa fa fa 00 00 03 fa fa fa fa fa 00 00 00 00 [ 64.123845] ^ [ 64.123846] ffffffff85fdd100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.123848] ffffffff85fdd180: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa [ 64.123848] ================================================================== [ 64.123849] ================================================================== [ 64.123850] BUG: KASAN: global-out-of-bounds in bit_putcs+0xc43/0xd20 at addr ffffffff85fdd0d0 [ 64.123856] Read of size 1 by task syz-executor.0/7588 [ 64.123858] Address belongs to variable fontdata_8x16+0x10d0/0x10e0 [ 64.123859] CPU: 1 PID: 7588 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 [ 64.123860] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.123862] 1ffffffff0d9577e ffff8800af6c7348 ffffffff82c4c1e6 ffff8801dc884067 [ 64.123864] ffff8800af6c73d8 ffffffff85fdd0d0 dffffc0000000000 ffff8800af6c73c8 [ 64.123867] ffffffff8173ea4a 0000000000000010 ffff880000000000 0000000000000286 [ 64.123867] Call Trace: [ 64.123869] [] dump_stack+0xe6/0x120 [ 64.123871] [] kasan_report_error+0x59a/0x5c0 [ 64.123873] [] __asan_report_load1_noabort+0x3e/0x40 [ 64.123875] [] ? bit_putcs+0xc43/0xd20 [ 64.123876] [] bit_putcs+0xc43/0xd20 [ 64.123878] [] ? bit_clear+0x6e0/0x6e0 [ 64.123881] [] ? get_color+0x30/0x380 [ 64.123883] [] fbcon_putcs+0x374/0x5a0 [ 64.123885] [] ? bit_clear+0x6e0/0x6e0 [ 64.123887] [] do_update_region+0x3f7/0x7c0 [ 64.123889] [] ? con_get_trans_old+0x180/0x180 [ 64.123892] [] ? fbcon_set_palette+0x387/0x580 [ 64.123894] [] redraw_screen+0x531/0x7d0 [ 64.123896] [] ? bit_bmove+0x200/0x200 [ 64.123898] [] ? respond_string+0x3a0/0x3a0 [ 64.123900] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123902] [] fbcon_do_set_font+0x85d/0x1120 [ 64.123903] [] ? con_font_op+0xe5/0xfa0 [ 64.123905] [] ? fbcon_do_set_font+0x1120/0x1120 [ 64.123907] [] fbcon_copy_font+0x117/0x190 [ 64.123908] [] con_font_op+0x208/0xfa0 [ 64.123910] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123911] [] ? con_write+0x90/0x90 [ 64.123914] [] ? __might_fault+0xf1/0x1b0 [ 64.123916] [] vt_ioctl+0x625/0x24e0 [ 64.123918] [] ? futex_wait+0x4b4/0x570 [ 64.123920] [] ? complete_change_console+0x300/0x300 [ 64.123922] [] ? futex_wait_setup+0x2c0/0x2c0 [ 64.123924] [] ? plist_del+0xe9/0x1d0 [ 64.123926] [] ? wake_up_q+0x82/0xe0 [ 64.123928] [] ? futex_wake+0x110/0x500 [ 64.123930] [] tty_ioctl+0x5d4/0x20f0 [ 64.123932] [] ? no_tty+0x90/0x90 [ 64.123934] [] ? __lock_acquire+0xca1/0x5560 [ 64.123936] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123938] [] ? __lock_acquire+0x1985/0x5560 [ 64.123941] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.123943] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.123945] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.123947] [] do_vfs_ioctl+0x17f/0xe70 [ 64.123949] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 64.123950] [] ? __fget+0x1c2/0x320 [ 64.123952] [] ? __fget+0x1df/0x320 [ 64.123953] [] ? __fget+0x42/0x320 [ 64.123955] [] ? __fget_light+0x79/0x200 [ 64.123956] [] SyS_ioctl+0x74/0x80 [ 64.123959] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 64.123960] Memory state around the buggy address: [ 64.123961] ffffffff85fdcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.123962] ffffffff85fdd000: fa fa fa fa 06 fa fa fa fa fa fa fa 05 fa fa fa [ 64.123963] >ffffffff85fdd080: fa fa fa fa 00 00 03 fa fa fa fa fa 00 00 00 00 [ 64.123964] ^ [ 64.123965] ffffffff85fdd100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.123966] ffffffff85fdd180: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa [ 64.123966] ================================================================== [ 64.123967] ================================================================== [ 64.123969] BUG: KASAN: global-out-of-bounds in bit_putcs+0xc43/0xd20 at addr ffffffff85fdd0d1 [ 64.123970] Read of size 1 by task syz-executor.0/7588 [ 64.123971] Address belongs to variable fontdata_8x16+0x10d1/0x10e0 [ 64.123972] CPU: 1 PID: 7588 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 [ 64.123973] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.123976] 1ffffffff0d9577e ffff8800af6c7348 ffffffff82c4c1e6 ffff8801dc884067 [ 64.123978] ffff8800af6c73d8 ffffffff85fdd0d1 dffffc0000000000 ffff8800af6c73c8 [ 64.123980] ffffffff8173ea4a 0000000000000010 ffff880000000000 0000000000000286 [ 64.123981] Call Trace: [ 64.123982] [] dump_stack+0xe6/0x120 [ 64.123984] [] kasan_report_error+0x59a/0x5c0 [ 64.123987] [] __asan_report_load1_noabort+0x3e/0x40 [ 64.123988] [] ? bit_putcs+0xc43/0xd20 [ 64.123990] [] bit_putcs+0xc43/0xd20 [ 64.123992] [] ? bit_clear+0x6e0/0x6e0 [ 64.123994] [] ? get_color+0x30/0x380 [ 64.123997] [] fbcon_putcs+0x374/0x5a0 [ 64.123998] [] ? bit_clear+0x6e0/0x6e0 [ 64.124001] [] do_update_region+0x3f7/0x7c0 [ 64.124003] [] ? con_get_trans_old+0x180/0x180 [ 64.124005] [] ? fbcon_set_palette+0x387/0x580 [ 64.124008] [] redraw_screen+0x531/0x7d0 [ 64.124009] [] ? bit_bmove+0x200/0x200 [ 64.124012] [] ? respond_string+0x3a0/0x3a0 [ 64.124013] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124015] [] fbcon_do_set_font+0x85d/0x1120 [ 64.124017] [] ? con_font_op+0xe5/0xfa0 [ 64.124019] [] ? fbcon_do_set_font+0x1120/0x1120 [ 64.124020] [] fbcon_copy_font+0x117/0x190 [ 64.124022] [] con_font_op+0x208/0xfa0 [ 64.124023] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124025] [] ? con_write+0x90/0x90 [ 64.124027] [] ? __might_fault+0xf1/0x1b0 [ 64.124029] [] vt_ioctl+0x625/0x24e0 [ 64.124031] [] ? futex_wait+0x4b4/0x570 [ 64.124033] [] ? complete_change_console+0x300/0x300 [ 64.124035] [] ? futex_wait_setup+0x2c0/0x2c0 [ 64.124037] [] ? plist_del+0xe9/0x1d0 [ 64.124040] [] ? wake_up_q+0x82/0xe0 [ 64.124042] [] ? futex_wake+0x110/0x500 [ 64.124044] [] tty_ioctl+0x5d4/0x20f0 [ 64.124046] [] ? no_tty+0x90/0x90 [ 64.124048] [] ? __lock_acquire+0xca1/0x5560 [ 64.124050] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124052] [] ? __lock_acquire+0x1985/0x5560 [ 64.124055] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.124057] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.124059] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124060] [] do_vfs_ioctl+0x17f/0xe70 [ 64.124062] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 64.124064] [] ? __fget+0x1c2/0x320 [ 64.124065] [] ? __fget+0x1df/0x320 [ 64.124066] [] ? __fget+0x42/0x320 [ 64.124068] [] ? __fget_light+0x79/0x200 [ 64.124070] [] SyS_ioctl+0x74/0x80 [ 64.124072] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 64.124073] Memory state around the buggy address: [ 64.124074] ffffffff85fdcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.124075] ffffffff85fdd000: fa fa fa fa 06 fa fa fa fa fa fa fa 05 fa fa fa [ 64.124077] >ffffffff85fdd080: fa fa fa fa 00 00 03 fa fa fa fa fa 00 00 00 00 [ 64.124077] ^ [ 64.124078] ffffffff85fdd100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.124079] ffffffff85fdd180: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa [ 64.124080] ================================================================== [ 64.124081] ================================================================== [ 64.124082] BUG: KASAN: global-out-of-bounds in bit_putcs+0xc43/0xd20 at addr ffffffff85fdd0d2 [ 64.124083] Read of size 1 by task syz-executor.0/7588 [ 64.124084] Address belongs to variable fontdata_8x16+0x10d2/0x10e0 [ 64.124086] CPU: 1 PID: 7588 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 [ 64.124087] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.124089] 1ffffffff0d9577e ffff8800af6c7348 ffffffff82c4c1e6 ffff8801dc884067 [ 64.124091] ffff8800af6c73d8 ffffffff85fdd0d2 dffffc0000000000 ffff8800af6c73c8 [ 64.124093] ffffffff8173ea4a 0000000000000010 ffff880000000000 0000000000000286 [ 64.124094] Call Trace: [ 64.124096] [] dump_stack+0xe6/0x120 [ 64.124098] [] kasan_report_error+0x59a/0x5c0 [ 64.124100] [] __asan_report_load1_noabort+0x3e/0x40 [ 64.124106] [] ? bit_putcs+0xc43/0xd20 [ 64.124107] [] bit_putcs+0xc43/0xd20 [ 64.124109] [] ? bit_clear+0x6e0/0x6e0 [ 64.124112] [] ? get_color+0x30/0x380 [ 64.124114] [] fbcon_putcs+0x374/0x5a0 [ 64.124116] [] ? bit_clear+0x6e0/0x6e0 [ 64.124118] [] do_update_region+0x3f7/0x7c0 [ 64.124120] [] ? con_get_trans_old+0x180/0x180 [ 64.124123] [] ? fbcon_set_palette+0x387/0x580 [ 64.124125] [] redraw_screen+0x531/0x7d0 [ 64.124127] [] ? bit_bmove+0x200/0x200 [ 64.124129] [] ? respond_string+0x3a0/0x3a0 [ 64.124131] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124133] [] fbcon_do_set_font+0x85d/0x1120 [ 64.124134] [] ? con_font_op+0xe5/0xfa0 [ 64.124136] [] ? fbcon_do_set_font+0x1120/0x1120 [ 64.124137] [] fbcon_copy_font+0x117/0x190 [ 64.124139] [] con_font_op+0x208/0xfa0 [ 64.124141] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124142] [] ? con_write+0x90/0x90 [ 64.124144] [] ? __might_fault+0xf1/0x1b0 [ 64.124146] [] vt_ioctl+0x625/0x24e0 [ 64.124149] [] ? futex_wait+0x4b4/0x570 [ 64.124151] [] ? complete_change_console+0x300/0x300 [ 64.124153] [] ? futex_wait_setup+0x2c0/0x2c0 [ 64.124155] [] ? plist_del+0xe9/0x1d0 [ 64.124157] [] ? wake_up_q+0x82/0xe0 [ 64.124159] [] ? futex_wake+0x110/0x500 [ 64.124161] [] tty_ioctl+0x5d4/0x20f0 [ 64.124163] [] ? no_tty+0x90/0x90 [ 64.124165] [] ? __lock_acquire+0xca1/0x5560 [ 64.124167] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124169] [] ? __lock_acquire+0x1985/0x5560 [ 64.124172] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.124174] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.124176] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124178] [] do_vfs_ioctl+0x17f/0xe70 [ 64.124179] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 64.124181] [] ? __fget+0x1c2/0x320 [ 64.124182] [] ? __fget+0x1df/0x320 [ 64.124184] [] ? __fget+0x42/0x320 [ 64.124185] [] ? __fget_light+0x79/0x200 [ 64.124187] [] SyS_ioctl+0x74/0x80 [ 64.124189] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 64.124190] Memory state around the buggy address: [ 64.124192] ffffffff85fdcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.124193] ffffffff85fdd000: fa fa fa fa 06 fa fa fa fa fa fa fa 05 fa fa fa [ 64.124194] >ffffffff85fdd080: fa fa fa fa 00 00 03 fa fa fa fa fa 00 00 00 00 [ 64.124194] ^ [ 64.124196] ffffffff85fdd100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.124197] ffffffff85fdd180: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa [ 64.124197] ================================================================== [ 64.124198] ================================================================== [ 64.124199] BUG: KASAN: global-out-of-bounds in bit_putcs+0xc43/0xd20 at addr ffffffff85fdd0d3 [ 64.124200] Read of size 1 by task syz-executor.0/7588 [ 64.124202] Address belongs to variable fontdata_8x16+0x10d3/0x10e0 [ 64.124203] CPU: 1 PID: 7588 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 [ 64.124204] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.124206] 1ffffffff0d9577e ffff8800af6c7348 ffffffff82c4c1e6 ffff8801dc884067 [ 64.124208] ffff8800af6c73d8 ffffffff85fdd0d3 dffffc0000000000 ffff8800af6c73c8 [ 64.124211] ffffffff8173ea4a 0000000000000010 ffff880000000000 0000000000000286 [ 64.124211] Call Trace: [ 64.124213] [] dump_stack+0xe6/0x120 [ 64.124215] [] kasan_report_error+0x59a/0x5c0 [ 64.124217] [] __asan_report_load1_noabort+0x3e/0x40 [ 64.124219] [] ? bit_putcs+0xc43/0xd20 [ 64.124220] [] bit_putcs+0xc43/0xd20 [ 64.124222] [] ? bit_clear+0x6e0/0x6e0 [ 64.124225] [] ? get_color+0x30/0x380 [ 64.124227] [] fbcon_putcs+0x374/0x5a0 [ 64.124229] [] ? bit_clear+0x6e0/0x6e0 [ 64.124231] [] do_update_region+0x3f7/0x7c0 [ 64.124234] [] ? con_get_trans_old+0x180/0x180 [ 64.124236] [] ? fbcon_set_palette+0x387/0x580 [ 64.124238] [] redraw_screen+0x531/0x7d0 [ 64.124240] [] ? bit_bmove+0x200/0x200 [ 64.124242] [] ? respond_string+0x3a0/0x3a0 [ 64.124244] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124246] [] fbcon_do_set_font+0x85d/0x1120 [ 64.124247] [] ? con_font_op+0xe5/0xfa0 [ 64.124249] [] ? fbcon_do_set_font+0x1120/0x1120 [ 64.124251] [] fbcon_copy_font+0x117/0x190 [ 64.124252] [] con_font_op+0x208/0xfa0 [ 64.124254] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124255] [] ? con_write+0x90/0x90 [ 64.124258] [] ? __might_fault+0xf1/0x1b0 [ 64.124260] [] vt_ioctl+0x625/0x24e0 [ 64.124262] [] ? futex_wait+0x4b4/0x570 [ 64.124264] [] ? complete_change_console+0x300/0x300 [ 64.124266] [] ? futex_wait_setup+0x2c0/0x2c0 [ 64.124268] [] ? plist_del+0xe9/0x1d0 [ 64.124270] [] ? wake_up_q+0x82/0xe0 [ 64.124272] [] ? futex_wake+0x110/0x500 [ 64.124274] [] tty_ioctl+0x5d4/0x20f0 [ 64.124276] [] ? no_tty+0x90/0x90 [ 64.124279] [] ? __lock_acquire+0xca1/0x5560 [ 64.124281] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124284] [] ? __lock_acquire+0x1985/0x5560 [ 64.124288] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.124292] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.124295] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124298] [] do_vfs_ioctl+0x17f/0xe70 [ 64.124301] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 64.124304] [] ? __fget+0x1c2/0x320 [ 64.124307] [] ? __fget+0x1df/0x320 [ 64.124310] [] ? __fget+0x42/0x320 [ 64.124312] [] ? __fget_light+0x79/0x200 [ 64.124315] [] SyS_ioctl+0x74/0x80 [ 64.124319] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 64.124320] Memory state around the buggy address: [ 64.124322] ffffffff85fdcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.124324] ffffffff85fdd000: fa fa fa fa 06 fa fa fa fa fa fa fa 05 fa fa fa [ 64.124326] >ffffffff85fdd080: fa fa fa fa 00 00 03 fa fa fa fa fa 00 00 00 00 [ 64.124327] ^ [ 64.124329] ffffffff85fdd100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.124331] ffffffff85fdd180: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa [ 64.124332] ================================================================== [ 64.124334] ================================================================== [ 64.124336] BUG: KASAN: global-out-of-bounds in bit_putcs+0xc43/0xd20 at addr ffffffff85fdd0d4 [ 64.124338] Read of size 1 by task syz-executor.0/7588 [ 64.124340] Address belongs to variable fontdata_8x16+0x10d4/0x10e0 [ 64.124343] CPU: 1 PID: 7588 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 [ 64.124344] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.124349] 1ffffffff0d9577e ffff8800af6c7348 ffffffff82c4c1e6 ffff8801dc884067 [ 64.124353] ffff8800af6c73d8 ffffffff85fdd0d4 dffffc0000000000 ffff8800af6c73c8 [ 64.124357] ffffffff8173ea4a 0000000000000010 ffff880000000000 0000000000000286 [ 64.124357] Call Trace: [ 64.124360] [] dump_stack+0xe6/0x120 [ 64.124364] [] kasan_report_error+0x59a/0x5c0 [ 64.124367] [] __asan_report_load1_noabort+0x3e/0x40 [ 64.124370] [] ? bit_putcs+0xc43/0xd20 [ 64.124372] [] bit_putcs+0xc43/0xd20 [ 64.124375] [] ? bit_clear+0x6e0/0x6e0 [ 64.124379] [] ? get_color+0x30/0x380 [ 64.124382] [] fbcon_putcs+0x374/0x5a0 [ 64.124384] [] ? bit_clear+0x6e0/0x6e0 [ 64.124386] [] do_update_region+0x3f7/0x7c0 [ 64.124388] [] ? con_get_trans_old+0x180/0x180 [ 64.124391] [] ? fbcon_set_palette+0x387/0x580 [ 64.124393] [] redraw_screen+0x531/0x7d0 [ 64.124395] [] ? bit_bmove+0x200/0x200 [ 64.124397] [] ? respond_string+0x3a0/0x3a0 [ 64.124399] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124400] [] fbcon_do_set_font+0x85d/0x1120 [ 64.124402] [] ? con_font_op+0xe5/0xfa0 [ 64.124404] [] ? fbcon_do_set_font+0x1120/0x1120 [ 64.124405] [] fbcon_copy_font+0x117/0x190 [ 64.124407] [] con_font_op+0x208/0xfa0 [ 64.124408] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124410] [] ? con_write+0x90/0x90 [ 64.124412] [] ? __might_fault+0xf1/0x1b0 [ 64.124414] [] vt_ioctl+0x625/0x24e0 [ 64.124416] [] ? futex_wait+0x4b4/0x570 [ 64.124418] [] ? complete_change_console+0x300/0x300 [ 64.124421] [] ? futex_wait_setup+0x2c0/0x2c0 [ 64.124422] [] ? plist_del+0xe9/0x1d0 [ 64.124425] [] ? wake_up_q+0x82/0xe0 [ 64.124427] [] ? futex_wake+0x110/0x500 [ 64.124429] [] tty_ioctl+0x5d4/0x20f0 [ 64.124431] [] ? no_tty+0x90/0x90 [ 64.124433] [] ? __lock_acquire+0xca1/0x5560 [ 64.124435] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124437] [] ? __lock_acquire+0x1985/0x5560 [ 64.124440] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.124442] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.124444] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124446] [] do_vfs_ioctl+0x17f/0xe70 [ 64.124447] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 64.124449] [] ? __fget+0x1c2/0x320 [ 64.124450] [] ? __fget+0x1df/0x320 [ 64.124452] [] ? __fget+0x42/0x320 [ 64.124453] [] ? __fget_light+0x79/0x200 [ 64.124455] [] SyS_ioctl+0x74/0x80 [ 64.124457] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 64.124458] Memory state around the buggy address: [ 64.124459] ffffffff85fdcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.124461] ffffffff85fdd000: fa fa fa fa 06 fa fa fa fa fa fa fa 05 fa fa fa [ 64.124462] >ffffffff85fdd080: fa fa fa fa 00 00 03 fa fa fa fa fa 00 00 00 00 [ 64.124462] ^ [ 64.124463] ffffffff85fdd100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.124465] ffffffff85fdd180: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa [ 64.124465] ================================================================== [ 64.124466] ================================================================== [ 64.124467] BUG: KASAN: global-out-of-bounds in bit_putcs+0xc43/0xd20 at addr ffffffff85fdd0d5 [ 64.124468] Read of size 1 by task syz-executor.0/7588 [ 64.124470] Address belongs to variable fontdata_8x16+0x10d5/0x10e0 [ 64.124471] CPU: 1 PID: 7588 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 [ 64.124472] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.124474] 1ffffffff0d9577e ffff8800af6c7348 ffffffff82c4c1e6 ffff8801dc884067 [ 64.124477] ffff8800af6c73d8 ffffffff85fdd0d5 dffffc0000000000 ffff8800af6c73c8 [ 64.124479] ffffffff8173ea4a 0000000000000010 ffff880000000000 0000000000000286 [ 64.124479] Call Trace: [ 64.124481] [] dump_stack+0xe6/0x120 [ 64.124483] [] kasan_report_error+0x59a/0x5c0 [ 64.124485] [] __asan_report_load1_noabort+0x3e/0x40 [ 64.124487] [] ? bit_putcs+0xc43/0xd20 [ 64.124488] [] bit_putcs+0xc43/0xd20 [ 64.124491] [] ? bit_clear+0x6e0/0x6e0 [ 64.124493] [] ? get_color+0x30/0x380 [ 64.124495] [] fbcon_putcs+0x374/0x5a0 [ 64.124497] [] ? bit_clear+0x6e0/0x6e0 [ 64.124499] [] do_update_region+0x3f7/0x7c0 [ 64.124502] [] ? con_get_trans_old+0x180/0x180 [ 64.124504] [] ? fbcon_set_palette+0x387/0x580 [ 64.124507] [] redraw_screen+0x531/0x7d0 [ 64.124508] [] ? bit_bmove+0x200/0x200 [ 64.124511] [] ? respond_string+0x3a0/0x3a0 [ 64.124512] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124514] [] fbcon_do_set_font+0x85d/0x1120 [ 64.124516] [] ? con_font_op+0xe5/0xfa0 [ 64.124517] [] ? fbcon_do_set_font+0x1120/0x1120 [ 64.124519] [] fbcon_copy_font+0x117/0x190 [ 64.124520] [] con_font_op+0x208/0xfa0 [ 64.124522] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124524] [] ? con_write+0x90/0x90 [ 64.124526] [] ? __might_fault+0xf1/0x1b0 [ 64.124528] [] vt_ioctl+0x625/0x24e0 [ 64.124530] [] ? futex_wait+0x4b4/0x570 [ 64.124532] [] ? complete_change_console+0x300/0x300 [ 64.124534] [] ? futex_wait_setup+0x2c0/0x2c0 [ 64.124536] [] ? plist_del+0xe9/0x1d0 [ 64.124539] [] ? wake_up_q+0x82/0xe0 [ 64.124541] [] ? futex_wake+0x110/0x500 [ 64.124543] [] tty_ioctl+0x5d4/0x20f0 [ 64.124544] [] ? no_tty+0x90/0x90 [ 64.124547] [] ? __lock_acquire+0xca1/0x5560 [ 64.124548] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124551] [] ? __lock_acquire+0x1985/0x5560 [ 64.124553] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.124556] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.124557] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124559] [] do_vfs_ioctl+0x17f/0xe70 [ 64.124561] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 64.124562] [] ? __fget+0x1c2/0x320 [ 64.124564] [] ? __fget+0x1df/0x320 [ 64.124565] [] ? __fget+0x42/0x320 [ 64.124567] [] ? __fget_light+0x79/0x200 [ 64.124569] [] SyS_ioctl+0x74/0x80 [ 64.124571] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 64.124572] Memory state around the buggy address: [ 64.124573] ffffffff85fdcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.124574] ffffffff85fdd000: fa fa fa fa 06 fa fa fa fa fa fa fa 05 fa fa fa [ 64.124575] >ffffffff85fdd080: fa fa fa fa 00 00 03 fa fa fa fa fa 00 00 00 00 [ 64.124576] ^ [ 64.124577] ffffffff85fdd100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.124578] ffffffff85fdd180: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa [ 64.124579] ================================================================== [ 64.124580] ================================================================== [ 64.124581] BUG: KASAN: global-out-of-bounds in bit_putcs+0xc43/0xd20 at addr ffffffff85fdd0d6 [ 64.124582] Read of size 1 by task syz-executor.0/7588 [ 64.124583] Address belongs to variable fontdata_8x16+0x10d6/0x10e0 [ 64.124585] CPU: 1 PID: 7588 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 [ 64.124585] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.124588] 1ffffffff0d9577e ffff8800af6c7348 ffffffff82c4c1e6 ffff8801dc884067 [ 64.124590] ffff8800af6c73d8 ffffffff85fdd0d6 dffffc0000000000 ffff8800af6c73c8 [ 64.124592] ffffffff8173ea4a 0000000000000010 ffff880000000000 0000000000000286 [ 64.124593] Call Trace: [ 64.124595] [] dump_stack+0xe6/0x120 [ 64.124597] [] kasan_report_error+0x59a/0x5c0 [ 64.124599] [] __asan_report_load1_noabort+0x3e/0x40 [ 64.124600] [] ? bit_putcs+0xc43/0xd20 [ 64.124602] [] bit_putcs+0xc43/0xd20 [ 64.124604] [] ? bit_clear+0x6e0/0x6e0 [ 64.124607] [] ? get_color+0x30/0x380 [ 64.124609] [] fbcon_putcs+0x374/0x5a0 [ 64.124611] [] ? bit_clear+0x6e0/0x6e0 [ 64.124613] [] do_update_region+0x3f7/0x7c0 [ 64.124615] [] ? con_get_trans_old+0x180/0x180 [ 64.124618] [] ? fbcon_set_palette+0x387/0x580 [ 64.124620] [] redraw_screen+0x531/0x7d0 [ 64.124622] [] ? bit_bmove+0x200/0x200 [ 64.124624] [] ? respond_string+0x3a0/0x3a0 [ 64.124626] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124627] [] fbcon_do_set_font+0x85d/0x1120 [ 64.124629] [] ? con_font_op+0xe5/0xfa0 [ 64.124631] [] ? fbcon_do_set_font+0x1120/0x1120 [ 64.124632] [] fbcon_copy_font+0x117/0x190 [ 64.124634] [] con_font_op+0x208/0xfa0 [ 64.124635] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124637] [] ? con_write+0x90/0x90 [ 64.124639] [] ? __might_fault+0xf1/0x1b0 [ 64.124641] [] vt_ioctl+0x625/0x24e0 [ 64.124643] [] ? futex_wait+0x4b4/0x570 [ 64.124645] [] ? complete_change_console+0x300/0x300 [ 64.124647] [] ? futex_wait_setup+0x2c0/0x2c0 [ 64.124649] [] ? plist_del+0xe9/0x1d0 [ 64.124652] [] ? wake_up_q+0x82/0xe0 [ 64.124654] [] ? futex_wake+0x110/0x500 [ 64.124656] [] tty_ioctl+0x5d4/0x20f0 [ 64.124658] [] ? no_tty+0x90/0x90 [ 64.124660] [] ? __lock_acquire+0xca1/0x5560 [ 64.124662] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124664] [] ? __lock_acquire+0x1985/0x5560 [ 64.124667] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.124669] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.124671] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124673] [] do_vfs_ioctl+0x17f/0xe70 [ 64.124674] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 64.124676] [] ? __fget+0x1c2/0x320 [ 64.124677] [] ? __fget+0x1df/0x320 [ 64.124679] [] ? __fget+0x42/0x320 [ 64.124680] [] ? __fget_light+0x79/0x200 [ 64.124682] [] SyS_ioctl+0x74/0x80 [ 64.124684] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 64.124685] Memory state around the buggy address: [ 64.124686] ffffffff85fdcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.124687] ffffffff85fdd000: fa fa fa fa 06 fa fa fa fa fa fa fa 05 fa fa fa [ 64.124689] >ffffffff85fdd080: fa fa fa fa 00 00 03 fa fa fa fa fa 00 00 00 00 [ 64.124689] ^ [ 64.124690] ffffffff85fdd100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.124692] ffffffff85fdd180: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa [ 64.124692] ================================================================== [ 64.124693] ================================================================== [ 64.124694] BUG: KASAN: global-out-of-bounds in bit_putcs+0xc43/0xd20 at addr ffffffff85fdd0d7 [ 64.124695] Read of size 1 by task syz-executor.0/7588 [ 64.124697] Address belongs to variable fontdata_8x16+0x10d7/0x10e0 [ 64.124698] CPU: 1 PID: 7588 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 [ 64.124699] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.124701] 1ffffffff0d9577e ffff8800af6c7348 ffffffff82c4c1e6 ffff8801dc884067 [ 64.124703] ffff8800af6c73d8 ffffffff85fdd0d7 dffffc0000000000 ffff8800af6c73c8 [ 64.124706] ffffffff8173ea4a 0000000000000010 ffff880000000000 0000000000000286 [ 64.124706] Call Trace: [ 64.124708] [] dump_stack+0xe6/0x120 [ 64.124710] [] kasan_report_error+0x59a/0x5c0 [ 64.124712] [] __asan_report_load1_noabort+0x3e/0x40 [ 64.124714] [] ? bit_putcs+0xc43/0xd20 [ 64.124715] [] bit_putcs+0xc43/0xd20 [ 64.124717] [] ? bit_clear+0x6e0/0x6e0 [ 64.124720] [] ? get_color+0x30/0x380 [ 64.124722] [] fbcon_putcs+0x374/0x5a0 [ 64.124724] [] ? bit_clear+0x6e0/0x6e0 [ 64.124726] [] do_update_region+0x3f7/0x7c0 [ 64.124728] [] ? con_get_trans_old+0x180/0x180 [ 64.124731] [] ? fbcon_set_palette+0x387/0x580 [ 64.124733] [] redraw_screen+0x531/0x7d0 [ 64.124735] [] ? bit_bmove+0x200/0x200 [ 64.124737] [] ? respond_string+0x3a0/0x3a0 [ 64.124739] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124741] [] fbcon_do_set_font+0x85d/0x1120 [ 64.124742] [] ? con_font_op+0xe5/0xfa0 [ 64.124744] [] ? fbcon_do_set_font+0x1120/0x1120 [ 64.124745] [] fbcon_copy_font+0x117/0x190 [ 64.124747] [] con_font_op+0x208/0xfa0 [ 64.124749] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124750] [] ? con_write+0x90/0x90 [ 64.124752] [] ? __might_fault+0xf1/0x1b0 [ 64.124754] [] vt_ioctl+0x625/0x24e0 [ 64.124757] [] ? futex_wait+0x4b4/0x570 [ 64.124758] [] ? complete_change_console+0x300/0x300 [ 64.124761] [] ? futex_wait_setup+0x2c0/0x2c0 [ 64.124762] [] ? plist_del+0xe9/0x1d0 [ 64.124765] [] ? wake_up_q+0x82/0xe0 [ 64.124767] [] ? futex_wake+0x110/0x500 [ 64.124769] [] tty_ioctl+0x5d4/0x20f0 [ 64.124771] [] ? no_tty+0x90/0x90 [ 64.124773] [] ? __lock_acquire+0xca1/0x5560 [ 64.124775] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124777] [] ? __lock_acquire+0x1985/0x5560 [ 64.124780] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.124782] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.124784] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124786] [] do_vfs_ioctl+0x17f/0xe70 [ 64.124787] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 64.124789] [] ? __fget+0x1c2/0x320 [ 64.124790] [] ? __fget+0x1df/0x320 [ 64.124792] [] ? __fget+0x42/0x320 [ 64.124793] [] ? __fget_light+0x79/0x200 [ 64.124795] [] SyS_ioctl+0x74/0x80 [ 64.124797] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 64.124798] Memory state around the buggy address: [ 64.124799] ffffffff85fdcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.124800] ffffffff85fdd000: fa fa fa fa 06 fa fa fa fa fa fa fa 05 fa fa fa [ 64.124802] >ffffffff85fdd080: fa fa fa fa 00 00 03 fa fa fa fa fa 00 00 00 00 [ 64.124802] ^ [ 64.124803] ffffffff85fdd100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.124805] ffffffff85fdd180: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa [ 64.124805] ================================================================== [ 64.124806] ================================================================== [ 64.124807] BUG: KASAN: global-out-of-bounds in bit_putcs+0xc43/0xd20 at addr ffffffff85fdd0d8 [ 64.124808] Read of size 1 by task syz-executor.0/7588 [ 64.124810] Address belongs to variable fontdata_8x16+0x10d8/0x10e0 [ 64.124811] CPU: 1 PID: 7588 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 [ 64.124812] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.124814] 1ffffffff0d9577e ffff8800af6c7348 ffffffff82c4c1e6 ffff8801dc884067 [ 64.124816] ffff8800af6c73d8 ffffffff85fdd0d8 dffffc0000000000 ffff8800af6c73c8 [ 64.124819] ffffffff8173ea4a 0000000000000010 ffff880000000000 0000000000000286 [ 64.124819] Call Trace: [ 64.124821] [] dump_stack+0xe6/0x120 [ 64.124823] [] kasan_report_error+0x59a/0x5c0 [ 64.124825] [] __asan_report_load1_noabort+0x3e/0x40 [ 64.124827] [] ? bit_putcs+0xc43/0xd20 [ 64.124828] [] bit_putcs+0xc43/0xd20 [ 64.124830] [] ? bit_clear+0x6e0/0x6e0 [ 64.124833] [] ? get_color+0x30/0x380 [ 64.124835] [] fbcon_putcs+0x374/0x5a0 [ 64.124837] [] ? bit_clear+0x6e0/0x6e0 [ 64.124839] [] do_update_region+0x3f7/0x7c0 [ 64.124841] [] ? con_get_trans_old+0x180/0x180 [ 64.124844] [] ? fbcon_set_palette+0x387/0x580 [ 64.124846] [] redraw_screen+0x531/0x7d0 [ 64.124848] [] ? bit_bmove+0x200/0x200 [ 64.124850] [] ? respond_string+0x3a0/0x3a0 [ 64.124852] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124854] [] fbcon_do_set_font+0x85d/0x1120 [ 64.124855] [] ? con_font_op+0xe5/0xfa0 [ 64.124857] [] ? fbcon_do_set_font+0x1120/0x1120 [ 64.124858] [] fbcon_copy_font+0x117/0x190 [ 64.124860] [] con_font_op+0x208/0xfa0 [ 64.124862] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124863] [] ? con_write+0x90/0x90 [ 64.124865] [] ? __might_fault+0xf1/0x1b0 [ 64.124867] [] vt_ioctl+0x625/0x24e0 [ 64.124870] [] ? futex_wait+0x4b4/0x570 [ 64.124872] [] ? complete_change_console+0x300/0x300 [ 64.124874] [] ? futex_wait_setup+0x2c0/0x2c0 [ 64.124876] [] ? plist_del+0xe9/0x1d0 [ 64.124878] [] ? wake_up_q+0x82/0xe0 [ 64.124880] [] ? futex_wake+0x110/0x500 [ 64.124882] [] tty_ioctl+0x5d4/0x20f0 [ 64.124884] [] ? no_tty+0x90/0x90 [ 64.124886] [] ? __lock_acquire+0xca1/0x5560 [ 64.124888] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124890] [] ? __lock_acquire+0x1985/0x5560 [ 64.124893] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.124895] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.124897] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124899] [] do_vfs_ioctl+0x17f/0xe70 [ 64.124900] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 64.124902] [] ? __fget+0x1c2/0x320 [ 64.124903] [] ? __fget+0x1df/0x320 [ 64.124905] [] ? __fget+0x42/0x320 [ 64.124906] [] ? __fget_light+0x79/0x200 [ 64.124908] [] SyS_ioctl+0x74/0x80 [ 64.124910] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 64.124911] Memory state around the buggy address: [ 64.124913] ffffffff85fdcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.124914] ffffffff85fdd000: fa fa fa fa 06 fa fa fa fa fa fa fa 05 fa fa fa [ 64.124915] >ffffffff85fdd080: fa fa fa fa 00 00 03 fa fa fa fa fa 00 00 00 00 [ 64.124916] ^ [ 64.124917] ffffffff85fdd100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.124918] ffffffff85fdd180: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa [ 64.124918] ================================================================== [ 64.124919] ================================================================== [ 64.124921] BUG: KASAN: global-out-of-bounds in bit_putcs+0xc43/0xd20 at addr ffffffff85fdd0d9 [ 64.124921] Read of size 1 by task syz-executor.0/7588 [ 64.124923] Address belongs to variable fontdata_8x16+0x10d9/0x10e0 [ 64.124924] CPU: 1 PID: 7588 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 [ 64.124925] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.124927] 1ffffffff0d9577e ffff8800af6c7348 ffffffff82c4c1e6 ffff8801dc884067 [ 64.124929] ffff8800af6c73d8 ffffffff85fdd0d9 dffffc0000000000 ffff8800af6c73c8 [ 64.124932] ffffffff8173ea4a 0000000000000010 ffff880000000000 0000000000000286 [ 64.124932] Call Trace: [ 64.124934] [] dump_stack+0xe6/0x120 [ 64.124936] [] kasan_report_error+0x59a/0x5c0 [ 64.124938] [] __asan_report_load1_noabort+0x3e/0x40 [ 64.124940] [] ? bit_putcs+0xc43/0xd20 [ 64.124941] [] bit_putcs+0xc43/0xd20 [ 64.124943] [] ? bit_clear+0x6e0/0x6e0 [ 64.124946] [] ? get_color+0x30/0x380 [ 64.124948] [] fbcon_putcs+0x374/0x5a0 [ 64.124950] [] ? bit_clear+0x6e0/0x6e0 [ 64.124952] [] do_update_region+0x3f7/0x7c0 [ 64.124954] [] ? con_get_trans_old+0x180/0x180 [ 64.124957] [] ? fbcon_set_palette+0x387/0x580 [ 64.124959] [] redraw_screen+0x531/0x7d0 [ 64.124961] [] ? bit_bmove+0x200/0x200 [ 64.124963] [] ? respond_string+0x3a0/0x3a0 [ 64.124965] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124967] [] fbcon_do_set_font+0x85d/0x1120 [ 64.124968] [] ? con_font_op+0xe5/0xfa0 [ 64.124970] [] ? fbcon_do_set_font+0x1120/0x1120 [ 64.124972] [] fbcon_copy_font+0x117/0x190 [ 64.124973] [] con_font_op+0x208/0xfa0 [ 64.124975] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.124976] [] ? con_write+0x90/0x90 [ 64.124979] [] ? __might_fault+0xf1/0x1b0 [ 64.124981] [] vt_ioctl+0x625/0x24e0 [ 64.124983] [] ? futex_wait+0x4b4/0x570 [ 64.124985] [] ? complete_change_console+0x300/0x300 [ 64.124987] [] ? futex_wait_setup+0x2c0/0x2c0 [ 64.124989] [] ? plist_del+0xe9/0x1d0 [ 64.124991] [] ? wake_up_q+0x82/0xe0 [ 64.124993] [] ? futex_wake+0x110/0x500 [ 64.124995] [] tty_ioctl+0x5d4/0x20f0 [ 64.124997] [] ? no_tty+0x90/0x90 [ 64.124999] [] ? __lock_acquire+0xca1/0x5560 [ 64.125001] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.125003] [] ? __lock_acquire+0x1985/0x5560 [ 64.125006] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.125008] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.125010] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.125012] [] do_vfs_ioctl+0x17f/0xe70 [ 64.125014] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 64.125015] [] ? __fget+0x1c2/0x320 [ 64.125017] [] ? __fget+0x1df/0x320 [ 64.125018] [] ? __fget+0x42/0x320 [ 64.125020] [] ? __fget_light+0x79/0x200 [ 64.125021] [] SyS_ioctl+0x74/0x80 [ 64.125024] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 64.125024] Memory state around the buggy address: [ 64.125026] ffffffff85fdcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.125027] ffffffff85fdd000: fa fa fa fa 06 fa fa fa fa fa fa fa 05 fa fa fa [ 64.125028] >ffffffff85fdd080: fa fa fa fa 00 00 03 fa fa fa fa fa 00 00 00 00 [ 64.125029] ^ [ 64.125030] ffffffff85fdd100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.125031] ffffffff85fdd180: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa [ 64.125031] ================================================================== [ 64.125032] ================================================================== [ 64.125034] BUG: KASAN: global-out-of-bounds in bit_putcs+0xc43/0xd20 at addr ffffffff85fdd0da [ 64.125034] Read of size 1 by task syz-executor.0/7588 [ 64.125036] Address belongs to variable fontdata_8x16+0x10da/0x10e0 [ 64.125037] CPU: 1 PID: 7588 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 [ 64.125038] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.125040] 1ffffffff0d9577e ffff8800af6c7348 ffffffff82c4c1e6 ffff8801dc884067 [ 64.125042] ffff8800af6c73d8 ffffffff85fdd0da dffffc0000000000 ffff8800af6c73c8 [ 64.125045] ffffffff8173ea4a 0000000000000010 ffff880000000000 0000000000000286 [ 64.125045] Call Trace: [ 64.125047] [] dump_stack+0xe6/0x120 [ 64.125049] [] kasan_report_error+0x59a/0x5c0 [ 64.125051] [] __asan_report_load1_noabort+0x3e/0x40 [ 64.125053] [] ? bit_putcs+0xc43/0xd20 [ 64.125054] [] bit_putcs+0xc43/0xd20 [ 64.125056] [] ? bit_clear+0x6e0/0x6e0 [ 64.125059] [] ? get_color+0x30/0x380 [ 64.125061] [] fbcon_putcs+0x374/0x5a0 [ 64.125063] [] ? bit_clear+0x6e0/0x6e0 [ 64.125065] [] do_update_region+0x3f7/0x7c0 [ 64.125068] [] ? con_get_trans_old+0x180/0x180 [ 64.125070] [] ? fbcon_set_palette+0x387/0x580 [ 64.125072] [] redraw_screen+0x531/0x7d0 [ 64.125074] [] ? bit_bmove+0x200/0x200 [ 64.125076] [] ? respond_string+0x3a0/0x3a0 [ 64.125078] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.125080] [] fbcon_do_set_font+0x85d/0x1120 [ 64.125081] [] ? con_font_op+0xe5/0xfa0 [ 64.125083] [] ? fbcon_do_set_font+0x1120/0x1120 [ 64.125085] [] fbcon_copy_font+0x117/0x190 [ 64.125086] [] con_font_op+0x208/0xfa0 [ 64.125088] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.125089] [] ? con_write+0x90/0x90 [ 64.125092] [] ? __might_fault+0xf1/0x1b0 [ 64.125094] [] vt_ioctl+0x625/0x24e0 [ 64.125096] [] ? futex_wait+0x4b4/0x570 [ 64.125098] [] ? complete_change_console+0x300/0x300 [ 64.125100] [] ? futex_wait_setup+0x2c0/0x2c0 [ 64.125105] [] ? plist_del+0xe9/0x1d0 [ 64.125108] [] ? wake_up_q+0x82/0xe0 [ 64.125110] [] ? futex_wake+0x110/0x500 [ 64.125112] [] tty_ioctl+0x5d4/0x20f0 [ 64.125114] [] ? no_tty+0x90/0x90 [ 64.125116] [] ? __lock_acquire+0xca1/0x5560 [ 64.125118] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.125120] [] ? __lock_acquire+0x1985/0x5560 [ 64.125123] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.125125] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.125127] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.125129] [] do_vfs_ioctl+0x17f/0xe70 [ 64.125130] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 64.125132] [] ? __fget+0x1c2/0x320 [ 64.125133] [] ? __fget+0x1df/0x320 [ 64.125135] [] ? __fget+0x42/0x320 [ 64.125136] [] ? __fget_light+0x79/0x200 [ 64.125138] [] SyS_ioctl+0x74/0x80 [ 64.125140] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 64.125141] Memory state around the buggy address: [ 64.125142] ffffffff85fdcf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.125144] ffffffff85fdd000: fa fa fa fa 06 fa fa fa fa fa fa fa 05 fa fa fa [ 64.125145] >ffffffff85fdd080: fa fa fa fa 00 00 03 fa fa fa fa fa 00 00 00 00 [ 64.125145] ^ [ 64.125146] ffffffff85fdd100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.125148] ffffffff85fdd180: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa [ 64.125148] ================================================================== [ 64.125149] ================================================================== [ 64.125150] BUG: KASAN: global-out-of-bounds in bit_putcs+0xc43/0xd20 at addr ffffffff85fdd0db [ 64.125151] Read of size 1 by task syz-executor.0/7588 [ 64.125153] Address belongs to variable fontdata_8x16+0x10db/0x10e0 [ 64.125154] CPU: 1 PID: 7588 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 [ 64.125155] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.125157] 1ffffffff0d9577e ffff8800af6c7348 ffffffff82c4c1e6 ffff8801dc884067 [ 64.125159] ffff8800af6c73d8 ffffffff85fdd0db dffffc0000000000 ffff8800af6c73c8 [ 64.125162] ffffffff8173ea4a 0000000000000010 ffff880000000000 0000000000000286 [ 64.125162] Call Trace: [ 64.125164] [] dump_stack+0xe6/0x120 [ 64.125166] [] kasan_report_error+0x59a/0x5c0 [ 64.125168] [] __asan_report_load1_noabort+0x3e/0x40 [ 64.125170] [] ? bit_putcs+0xc43/0xd20 [ 64.125171] [] bit_putcs+0xc43/0xd20 [ 64.125173] [] ? bit_clear+0x6e0/0x6e0 [ 64.125176] [] ? get_color+0x30/0x380 [ 64.125178] [] fbcon_putcs+0x374/0x5a0 [ 64.125180] [] ? bit_clear+0x6e0/0x6e0 [ 64.125182] [] do_update_region+0x3f7/0x7c0 [ 64.125184] [] ? con_get_trans_old+0x180/0x180 [ 64.125187] [] ? fbcon_set_palette+0x387/0x580 [ 64.125189] [] redraw_screen+0x531/0x7d0 [ 64.125191] [] ? bit_bmove+0x200/0x200 [ 64.125193] [] ? respond_string+0x3a0/0x3a0 [ 64.125195] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.125197] [] fbcon_do_set_font+0x85d/0x1120 [ 64.125198] [] ? con_font_op+0xe5/0xfa0 [ 64.125200] [] ? fbcon_do_set_font+0x1120/0x1120 [ 64.125201] [] fbcon_copy_font+0x117/0x190 [ 64.125203] [] con_font_op+0x208/0xfa0 [ 64.125205] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.125206] [] ? con_write+0x90/0x90 [ 64.125208] [] ? __might_fault+0xf1/0x1b0 [ 64.125210] [] vt_ioctl+0x625/0x24e0 [ 64.125213] [] ? futex_wait+0x4b4/0x570 [ 64.125215] [] ? complete_change_console+0x300/0x300 [ 64.125217] [] ? futex_wait_setup+0x2c0/0x2c0 [ 64.125219] [] ? plist_del+0xe9/0x1d0 [ 64.125221] [] ? wake_up_q+0x82/0xe0 [ 64.125223] [] ? futex_wake+0x110/0x500 [ 64.125225] [] tty_ioctl+0x5d4/0x20f0 [ 64.125227] [] ? no_tty+0x90/0x90 [ 64.125229] [] ? __lock_acquire+0xca1/0x5560 [ 64.125231] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.125233] [] ? __lock_acquire+0x1985/0x5560 [ 64.125236] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.125238] [] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 64.125240] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 64.125242] [] do_vfs_ioctl+0x17f/0xe70 [ 64.125243] [] ? ioctl_preallocate+0x1a0/0x1a0 [ 64.125245] [] ? __fget+0x1c2/0x320 [ 64.125246] [] ? __fget+0x1df/0x320 [ 64.125248] [] ? __fget+0x42/0x320 [ 64.125249] [] ? __fget_light+0x79/0x200 [ 64.125251] [] SyS_ioctl+0x74/0x80