[[0;32m OK [0m] Started Getty on tty4.
[[0;32m OK [0m] Started Getty on tty3.
[[0;32m OK [0m] Started Getty on tty2.
[[0;32m OK [0m] Started Serial Getty on ttyS0.
[[0;32m OK [0m] Started Getty on tty1.
[[0;32m OK [0m] Reached target Login Prompts.
[[0;32m OK [0m] Reached target Multi-User System.
[[0;32m OK [0m] Reached target Graphical Interface.
Starting Update UTMP about System Runlevel Changes...
[[0;32m OK [0m] Started Update UTMP about System Runlevel Changes.
Starting Load/Save RF Kill Switch Status...
[[0;32m OK [0m] Started Load/Save RF Kill Switch Status.
Debian GNU/Linux 9 syzkaller ttyS0
Warning: Permanently added '10.128.0.161' (ECDSA) to the list of known hosts.
2021/05/02 11:23:57 fuzzer started
2021/05/02 11:23:58 dialing manager at 10.128.0.169:44661
2021/05/02 11:23:58 syscalls: 3571
2021/05/02 11:23:58 code coverage: enabled
2021/05/02 11:23:58 comparison tracing: enabled
2021/05/02 11:23:58 extra coverage: enabled
2021/05/02 11:23:58 setuid sandbox: enabled
2021/05/02 11:23:58 namespace sandbox: enabled
2021/05/02 11:23:58 Android sandbox: /sys/fs/selinux/policy does not exist
2021/05/02 11:23:58 fault injection: enabled
2021/05/02 11:23:58 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled
2021/05/02 11:23:58 net packet injection: enabled
2021/05/02 11:23:58 net device setup: enabled
2021/05/02 11:23:58 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist
2021/05/02 11:23:58 devlink PCI setup: PCI device 0000:00:10.0 is not available
2021/05/02 11:23:58 USB emulation: enabled
2021/05/02 11:23:58 hci packet injection: enabled
2021/05/02 11:23:58 wifi device emulation: enabled
2021/05/02 11:23:58 802.15.4 emulation: enabled
2021/05/02 11:23:58 fetching corpus: 0, signal 0/2000 (executing program)
2021/05/02 11:23:58 fetching corpus: 50, signal 39482/43283 (executing program)
2021/05/02 11:23:58 fetching corpus: 100, signal 77023/82423 (executing program)
2021/05/02 11:23:58 fetching corpus: 150, signal 102571/109529 (executing program)
2021/05/02 11:23:59 fetching corpus: 200, signal 126213/134661 (executing program)
2021/05/02 11:23:59 fetching corpus: 250, signal 140296/150198 (executing program)
syzkaller login: [ 70.890963][ T8440] ==================================================================
[ 70.899219][ T8440] BUG: KASAN: use-after-free in __skb_datagram_iter+0x6b8/0x770
[ 70.906858][ T8440] Read of size 4 at addr ffff888032f90004 by task syz-fuzzer/8440
[ 70.914664][ T8440]
[ 70.916976][ T8440] CPU: 0 PID: 8440 Comm: syz-fuzzer Not tainted 5.12.0-rc8-next-20210423-syzkaller #0
[ 70.926498][ T8440] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 70.936569][ T8440] Call Trace:
[ 70.939834][ T8440] dump_stack+0x141/0x1d7
[ 70.944181][ T8440] ? __skb_datagram_iter+0x6b8/0x770
[ 70.949453][ T8440] print_address_description.constprop.0.cold+0x5b/0x2f8
[ 70.956465][ T8440] ? __skb_datagram_iter+0x6b8/0x770
[ 70.961748][ T8440] ? __skb_datagram_iter+0x6b8/0x770
[ 70.967016][ T8440] kasan_report.cold+0x7c/0xd8
[ 70.971772][ T8440] ? __skb_datagram_iter+0x6b8/0x770
[ 70.977044][ T8440] __skb_datagram_iter+0x6b8/0x770
[ 70.982158][ T8440] ? zerocopy_sg_from_iter+0x110/0x110
[ 70.987605][ T8440] skb_copy_datagram_iter+0x40/0x50
[ 70.992791][ T8440] tcp_recvmsg_locked+0x1048/0x22f0
[ 70.998000][ T8440] ? tcp_splice_read+0x8b0/0x8b0
[ 71.002940][ T8440] ? mark_held_locks+0x9f/0xe0
[ 71.007696][ T8440] ? __local_bh_enable_ip+0xa0/0x120
[ 71.012988][ T8440] tcp_recvmsg+0x134/0x550
[ 71.017414][ T8440] ? tcp_recvmsg_locked+0x22f0/0x22f0
[ 71.022791][ T8440] ? aa_sk_perm+0x311/0xab0
[ 71.027282][ T8440] inet_recvmsg+0x11b/0x5e0
[ 71.031786][ T8440] ? inet_sendpage+0x140/0x140
[ 71.036539][ T8440] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70
[ 71.042792][ T8440] ? security_socket_recvmsg+0x8f/0xc0
[ 71.048265][ T8440] sock_read_iter+0x33c/0x470
[ 71.052931][ T8440] ? ____sys_recvmsg+0x600/0x600
[ 71.057858][ T8440] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70
[ 71.064105][ T8440] ? fsnotify+0xa58/0x1060
[ 71.068508][ T8440] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70
[ 71.074752][ T8440] new_sync_read+0x5b7/0x6e0
[ 71.079329][ T8440] ? ksys_lseek+0x1b0/0x1b0
[ 71.083814][ T8440] ? lockdep_hardirqs_on_prepare+0x400/0x400
[ 71.089796][ T8440] vfs_read+0x35c/0x570
[ 71.094047][ T8440] ksys_read+0x1ee/0x250
[ 71.098274][ T8440] ? vfs_write+0xa40/0xa40
[ 71.102672][ T8440] ? syscall_enter_from_user_mode+0x27/0x70
[ 71.108616][ T8440] do_syscall_64+0x3a/0xb0
[ 71.118332][ T8440] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 71.124213][ T8440] RIP: 0033:0x4af19b
[ 71.128190][ T8440] Code: fb ff eb bd e8 a6 b6 fb ff e9 61 ff ff ff cc e8 9b 82 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30
[ 71.147798][ T8440] RSP: 002b:000000c00064b828 EFLAGS: 00000212 ORIG_RAX: 0000000000000000
[ 71.156256][ T8440] RAX: ffffffffffffffda RBX: 000000c00001c000 RCX: 00000000004af19b
[ 71.164227][ T8440] RDX: 0000000000001000 RSI: 000000c0004a5000 RDI: 0000000000000006
[ 71.172194][ T8440] RBP: 000000c00064b878 R08: 0000000000000001 R09: 0000000000000002
[ 71.180147][ T8440] R10: 000000000000001d R11: 0000000000000212 R12: 0000000000b97a20
[ 71.188101][ T8440] R13: ffffffffffffffff R14: 0000000000000020 R15: 0000000000000020
[ 71.196066][ T8440]
[ 71.198371][ T8440] Allocated by task 0:
[ 71.202414][ T8440] (stack is not available)
[ 71.206803][ T8440]
[ 71.209115][ T8440] Freed by task 8440:
[ 71.213071][ T8440] kasan_save_stack+0x1b/0x40
[ 71.217752][ T8440] kasan_set_track+0x1c/0x30
[ 71.222332][ T8440] kasan_set_free_info+0x20/0x30
[ 71.227250][ T8440] __kasan_slab_free+0xfb/0x130
[ 71.232086][ T8440] slab_free_freelist_hook+0xdf/0x240
[ 71.237446][ T8440] kfree+0xe5/0x7f0
[ 71.241237][ T8440] skb_release_data+0x622/0x750
[ 71.246073][ T8440] consume_skb+0xc2/0x160
[ 71.250388][ T8440] __dev_kfree_skb_any+0x6b/0x80
[ 71.255307][ T8440] napi_consume_skb+0x27b/0x340
[ 71.260153][ T8440] free_old_xmit_skbs+0xe4/0x270
[ 71.265092][ T8440] start_xmit+0x144/0x16c0
[ 71.269492][ T8440] dev_hard_start_xmit+0x1eb/0x920
[ 71.274587][ T8440] sch_direct_xmit+0x2e1/0xbd0
[ 71.279338][ T8440] __qdisc_run+0x4ba/0x15f0
[ 71.283824][ T8440] __dev_queue_xmit+0x1390/0x2e50
[ 71.288833][ T8440] ip_finish_output2+0xef0/0x2220
[ 71.293846][ T8440] __ip_finish_output+0x396/0x640
[ 71.299155][ T8440] ip_finish_output+0x35/0x200
[ 71.303906][ T8440] ip_output+0x196/0x310
[ 71.308130][ T8440] __ip_queue_xmit+0x8d3/0x1a30
[ 71.312979][ T8440] __tcp_transmit_skb+0x1889/0x38f0
[ 71.318180][ T8440] __tcp_send_ack.part.0+0x3d6/0x7a0
[ 71.323449][ T8440] tcp_send_ack+0x7d/0xa0
[ 71.327761][ T8440] tcp_cleanup_rbuf+0x46c/0x5b0
[ 71.332608][ T8440] tcp_recvmsg_locked+0x7aa/0x22f0
[ 71.337703][ T8440] tcp_recvmsg+0x134/0x550
[ 71.342104][ T8440] inet_recvmsg+0x11b/0x5e0
[ 71.346593][ T8440] sock_read_iter+0x33c/0x470
[ 71.351260][ T8440] new_sync_read+0x5b7/0x6e0
[ 71.355849][ T8440] vfs_read+0x35c/0x570
[ 71.359987][ T8440] ksys_read+0x1ee/0x250
[ 71.364209][ T8440] do_syscall_64+0x3a/0xb0
[ 71.368612][ T8440] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 71.374488][ T8440]
[ 71.376791][ T8440] The buggy address belongs to the object at ffff888032f90000
[ 71.376791][ T8440] which belongs to the cache kmalloc-1k of size 1024
[ 71.390822][ T8440] The buggy address is located 4 bytes inside of
[ 71.390822][ T8440] 1024-byte region [ffff888032f90000, ffff888032f90400)
[ 71.404030][ T8440] The buggy address belongs to the page:
[ 71.409643][ T8440] page:ffffea0000cbe400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x32f90
[ 71.419773][ T8440] head:ffffea0000cbe400 order:3 compound_mapcount:0 compound_pincount:0
[ 71.428079][ T8440] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 71.436188][ T8440] raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888011041dc0
[ 71.444759][ T8440] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[ 71.453352][ T8440] page dumped because: kasan: bad access detected
[ 71.459739][ T8440]
[ 71.462041][ T8440] Memory state around the buggy address:
[ 71.467755][ T8440] ffff888032f8ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 71.475798][ T8440] ffff888032f8ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 71.483889][ T8440] >ffff888032f90000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 71.491926][ T8440] ^
[ 71.496015][ T8440] ffff888032f90080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 71.504086][ T8440] ffff888032f90100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 71.512153][ T8440] ==================================================================
[ 71.520192][ T8440] Disabling lock debugging due to kernel taint
[ 71.527299][ T3259] ieee802154 phy0 wpan0: encryption failed: -22
[ 71.533684][ T3259] ieee802154 phy1 wpan1: encryption failed: -22
[ 71.533997][ T8440] Kernel panic - not syncing: panic_on_warn set ...
[ 71.546523][ T8440] CPU: 0 PID: 8440 Comm: syz-fuzzer Tainted: G B 5.12.0-rc8-next-20210423-syzkaller #0
[ 71.557461][ T8440] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 71.567518][ T8440] Call Trace:
[ 71.570800][ T8440] dump_stack+0x141/0x1d7
[ 71.575153][ T8440] panic+0x306/0x73d
[ 71.579069][ T8440] ? __warn_printk+0xf3/0xf3
[ 71.583670][ T8440] ? preempt_schedule_common+0x59/0xc0
[ 71.589150][ T8440] ? __skb_datagram_iter+0x6b8/0x770
[ 71.594447][ T8440] ? preempt_schedule_thunk+0x16/0x18
[ 71.599805][ T8440] ? trace_hardirqs_on+0x38/0x1c0
[ 71.604811][ T8440] ? trace_hardirqs_on+0x51/0x1c0
[ 71.609828][ T8440] ? __skb_datagram_iter+0x6b8/0x770
[ 71.615093][ T8440] ? __skb_datagram_iter+0x6b8/0x770
[ 71.620372][ T8440] end_report.cold+0x5a/0x5a
[ 71.624949][ T8440] kasan_report.cold+0x6a/0xd8
[ 71.629694][ T8440] ? __skb_datagram_iter+0x6b8/0x770
[ 71.634960][ T8440] __skb_datagram_iter+0x6b8/0x770
[ 71.640053][ T8440] ? zerocopy_sg_from_iter+0x110/0x110
[ 71.645523][ T8440] skb_copy_datagram_iter+0x40/0x50
[ 71.650712][ T8440] tcp_recvmsg_locked+0x1048/0x22f0
[ 71.655899][ T8440] ? tcp_splice_read+0x8b0/0x8b0
[ 71.660819][ T8440] ? mark_held_locks+0x9f/0xe0
[ 71.665569][ T8440] ? __local_bh_enable_ip+0xa0/0x120
[ 71.670879][ T8440] tcp_recvmsg+0x134/0x550
[ 71.675290][ T8440] ? tcp_recvmsg_locked+0x22f0/0x22f0
[ 71.680646][ T8440] ? aa_sk_perm+0x311/0xab0
[ 71.685174][ T8440] inet_recvmsg+0x11b/0x5e0
[ 71.689661][ T8440] ? inet_sendpage+0x140/0x140
[ 71.694407][ T8440] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70
[ 71.700634][ T8440] ? security_socket_recvmsg+0x8f/0xc0
[ 71.706105][ T8440] sock_read_iter+0x33c/0x470
[ 71.710776][ T8440] ? ____sys_recvmsg+0x600/0x600
[ 71.715717][ T8440] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70
[ 71.721953][ T8440] ? fsnotify+0xa58/0x1060
[ 71.726353][ T8440] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70
[ 71.732580][ T8440] new_sync_read+0x5b7/0x6e0
[ 71.737160][ T8440] ? ksys_lseek+0x1b0/0x1b0
[ 71.741644][ T8440] ? lockdep_hardirqs_on_prepare+0x400/0x400
[ 71.747612][ T8440] vfs_read+0x35c/0x570
[ 71.751749][ T8440] ksys_read+0x1ee/0x250
[ 71.755971][ T8440] ? vfs_write+0xa40/0xa40
[ 71.760370][ T8440] ? syscall_enter_from_user_mode+0x27/0x70
[ 71.766258][ T8440] do_syscall_64+0x3a/0xb0
[ 71.770662][ T8440] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 71.776548][ T8440] RIP: 0033:0x4af19b
[ 71.780424][ T8440] Code: fb ff eb bd e8 a6 b6 fb ff e9 61 ff ff ff cc e8 9b 82 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30
[ 71.800012][ T8440] RSP: 002b:000000c00064b828 EFLAGS: 00000212 ORIG_RAX: 0000000000000000
[ 71.808422][ T8440] RAX: ffffffffffffffda RBX: 000000c00001c000 RCX: 00000000004af19b
[ 71.816382][ T8440] RDX: 0000000000001000 RSI: 000000c0004a5000 RDI: 0000000000000006
[ 71.824345][ T8440] RBP: 000000c00064b878 R08: 0000000000000001 R09: 0000000000000002
[ 71.832295][ T8440] R10: 000000000000001d R11: 0000000000000212 R12: 0000000000b97a20
[ 71.840245][ T8440] R13: ffffffffffffffff R14: 0000000000000020 R15: 0000000000000020
[ 71.848601][ T8440] Kernel Offset: disabled
[ 71.852917][ T8440] Rebooting in 86400 seconds..