Warning: Permanently added '[localhost]:30974' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 99.003433][ T8537] ================================================================== [ 99.009338][ T8537] BUG: KASAN: stack-out-of-bounds in acpi_nfit_ctl+0x47f/0x1840 [ 99.009338][ T8537] Read of size 8 at addr ffffc90003267bd0 by task syz-executor077/8537 [ 99.009338][ T8537] [ 99.009338][ T8537] CPU: 2 PID: 8537 Comm: syz-executor077 Not tainted 5.5.0-rc1-syzkaller #0 [ 99.009338][ T8537] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 99.009338][ T8537] Call Trace: [ 99.009338][ T8537] dump_stack+0x197/0x210 [ 99.009338][ T8537] ? acpi_nfit_ctl+0x47f/0x1840 [ 99.009338][ T8537] print_address_description.constprop.0.cold+0x5/0x30b [ 99.009338][ T8537] ? acpi_nfit_ctl+0x47f/0x1840 [ 99.009338][ T8537] ? acpi_nfit_ctl+0x47f/0x1840 [ 99.009338][ T8537] __kasan_report.cold+0x1b/0x41 [ 99.009338][ T8537] ? acpi_nfit_ctl+0x47f/0x1840 [ 99.009338][ T8537] kasan_report+0x12/0x20 [ 99.009338][ T8537] check_memory_region+0x134/0x1a0 [ 99.009338][ T8537] __kasan_check_read+0x11/0x20 [ 99.009338][ T8537] acpi_nfit_ctl+0x47f/0x1840 [ 99.009338][ T8537] ? acpi_label_write+0x460/0x460 [ 99.009338][ T8537] ? mutex_trylock+0x2f0/0x2f0 [ 99.009338][ T8537] ? lock_downgrade+0x920/0x920 [ 99.009338][ T8537] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 99.009338][ T8537] nd_ioctl.isra.0+0xfe2/0x1580 [ 99.009338][ T8537] ? wait_nvdimm_bus_probe_idle+0x6d0/0x6d0 [ 99.009338][ T8537] ? kmem_cache_free+0x26b/0x320 [ 99.009338][ T8537] ? do_sys_open+0x31d/0x5d0 [ 99.009338][ T8537] ? dimm_ioctl+0x70/0x70 [ 99.009338][ T8537] bus_ioctl+0x59/0x70 [ 99.009338][ T8537] compat_ptr_ioctl+0x6e/0xa0 [ 99.009338][ T8537] __ia32_compat_sys_ioctl+0x233/0x610 [ 99.009338][ T8537] ? fiemap_check_flags+0x70/0x70 [ 99.009338][ T8537] do_fast_syscall_32+0x27b/0xe16 [ 99.009338][ T8537] entry_SYSENTER_compat+0x70/0x7f [ 99.009338][ T8537] RIP: 0023:0xf7f12a39 [ 99.009338][ T8537] Code: 00 00 00 89 d3 5b 5e 5f 5d c3 b8 80 96 98 00 eb c4 8b 04 24 c3 8b 1c 24 c3 8b 34 24 c3 8b 3c 24 c3 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 99.009338][ T8537] RSP: 002b:00000000ff8ed9cc EFLAGS: 00000213 ORIG_RAX: 0000000000000036 [ 99.009338][ T8537] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000004018920a [ 99.009338][ T8537] RDX: 00000000200001c0 RSI: 00000000ff8eda20 RDI: 00000000080481b0 [ 99.009338][ T8537] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 99.009338][ T8537] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 99.009338][ T8537] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 99.009338][ T8537] [ 99.009338][ T8537] [ 99.009338][ T8537] addr ffffc90003267bd0 is located in stack of task syz-executor077/8537 at offset 88 in frame: [ 99.009338][ T8537] acpi_nfit_ctl+0x0/0x1840 [ 99.009338][ T8537] [ 99.009338][ T8537] this frame has 5 objects: [ 99.009338][ T8537] [32, 40) 'cmd_mask' [ 99.009338][ T8537] [64, 72) 'dsm_mask' [ 99.009338][ T8537] [96, 112) 'buf' [ 99.009338][ T8537] [128, 152) 'in_obj' [ 99.009338][ T8537] [192, 216) 'in_buf' [ 99.009338][ T8537] [ 99.009338][ T8537] Memory state around the buggy address: [ 99.009338][ T8537] ffffc90003267a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 99.009338][ T8537] ffffc90003267b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 [ 99.009338][ T8537] >ffffc90003267b80: f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2 00 00 f2 f2 00 [ 99.009338][ T8537] ^ [ 99.009338][ T8537] ffffc90003267c00: 00 00 f2 f2 f2 f2 f2 00 00 00 f3 f3 f3 f3 f3 00 [ 99.009338][ T8537] ffffc90003267c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 99.009338][ T8537] ================================================================== [ 99.009338][ T8537] Disabling lock debugging due to kernel taint [ 99.486867][ T8537] Kernel panic - not syncing: panic_on_warn set ... [ 99.492001][ T8537] CPU: 2 PID: 8537 Comm: syz-executor077 Tainted: G B 5.5.0-rc1-syzkaller #0 [ 99.499587][ T8537] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 99.499587][ T8537] Call Trace: [ 99.499587][ T8537] dump_stack+0x197/0x210 [ 99.499587][ T8537] panic+0x2e3/0x75c [ 99.499587][ T8537] ? add_taint.cold+0x16/0x16 [ 99.499587][ T8537] ? acpi_nfit_ctl+0x47f/0x1840 [ 99.499587][ T8537] ? preempt_schedule+0x4b/0x60 [ 99.499587][ T8537] ? ___preempt_schedule+0x16/0x18 [ 99.499587][ T8537] ? trace_hardirqs_on+0x5e/0x240 [ 99.499587][ T8537] ? acpi_nfit_ctl+0x47f/0x1840 [ 99.499587][ T8537] end_report+0x47/0x4f [ 99.499587][ T8537] ? acpi_nfit_ctl+0x47f/0x1840 [ 99.499587][ T8537] __kasan_report.cold+0xe/0x41 [ 99.499587][ T8537] ? acpi_nfit_ctl+0x47f/0x1840 [ 99.499587][ T8537] kasan_report+0x12/0x20 [ 99.499587][ T8537] check_memory_region+0x134/0x1a0 [ 99.499587][ T8537] __kasan_check_read+0x11/0x20 [ 99.499587][ T8537] acpi_nfit_ctl+0x47f/0x1840 [ 99.499587][ T8537] ? acpi_label_write+0x460/0x460 [ 99.499587][ T8537] ? mutex_trylock+0x2f0/0x2f0 [ 99.499587][ T8537] ? lock_downgrade+0x920/0x920 [ 99.499587][ T8537] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 99.499587][ T8537] nd_ioctl.isra.0+0xfe2/0x1580 [ 99.499587][ T8537] ? wait_nvdimm_bus_probe_idle+0x6d0/0x6d0 [ 99.499587][ T8537] ? kmem_cache_free+0x26b/0x320 [ 99.499587][ T8537] ? do_sys_open+0x31d/0x5d0 [ 99.499587][ T8537] ? dimm_ioctl+0x70/0x70 [ 99.499587][ T8537] bus_ioctl+0x59/0x70 [ 99.499587][ T8537] compat_ptr_ioctl+0x6e/0xa0 [ 99.499587][ T8537] __ia32_compat_sys_ioctl+0x233/0x610 [ 99.499587][ T8537] ? fiemap_check_flags+0x70/0x70 [ 99.499587][ T8537] do_fast_syscall_32+0x27b/0xe16 [ 99.499587][ T8537] entry_SYSENTER_compat+0x70/0x7f [ 99.499587][ T8537] RIP: 0023:0xf7f12a39 [ 99.499587][ T8537] Code: 00 00 00 89 d3 5b 5e 5f 5d c3 b8 80 96 98 00 eb c4 8b 04 24 c3 8b 1c 24 c3 8b 34 24 c3 8b 3c 24 c3 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 99.499587][ T8537] RSP: 002b:00000000ff8ed9cc EFLAGS: 00000213 ORIG_RAX: 0000000000000036 [ 99.499587][ T8537] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000004018920a [ 99.499587][ T8537] RDX: 00000000200001c0 RSI: 00000000ff8eda20 RDI: 00000000080481b0 [ 99.499587][ T8537] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 99.499587][ T8537] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 99.499587][ T8537] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 99.499587][ T8537] Kernel Offset: disabled [ 99.499587][ T8537] Rebooting in 86400 seconds..