[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 26.726979] kauditd_printk_skb: 7 callbacks suppressed [ 26.726991] audit: type=1800 audit(1541172435.904:29): pid=5511 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 26.755777] audit: type=1800 audit(1541172435.904:30): pid=5511 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.33' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 35.790481] netlink: 'syz-executor317': attribute type 3 has an invalid length. [ 35.798041] netlink: 'syz-executor317': attribute type 2 has an invalid length. [ 35.805677] kasan: CONFIG_KASAN_INLINE enabled [ 35.810422] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 35.817862] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 35.824079] CPU: 0 PID: 5665 Comm: syz-executor317 Not tainted 4.19.0+ #315 [ 35.831159] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 35.840519] RIP: 0010:icmp_timeout_obj_to_nlattr+0x77/0x170 [ 35.846236] Code: b5 41 c7 00 f1 f1 f1 f1 c7 40 04 04 f2 f2 f2 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 e8 30 79 24 fb 4c 89 e8 48 c1 e8 03 <42> 0f b6 14 38 4c 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 [ 35.865144] RSP: 0018:ffff8801d70a7220 EFLAGS: 00010246 [ 35.870544] RAX: 0000000000000000 RBX: 1ffff1003ae14e45 RCX: ffffffff865df764 [ 35.877795] RDX: 0000000000000000 RSI: ffffffff865affd0 RDI: ffff8801d858d340 [ 35.885049] RBP: ffff8801d70a72b0 R08: ffff8801d8f40700 R09: ffff8801ba5e80a8 [ 35.892304] R10: ffffed00374bd014 R11: ffff8801ba5e80a0 R12: ffff8801d858d340 [ 35.899561] R13: 0000000000000000 R14: ffff8801d70a7288 R15: dffffc0000000000 [ 35.906816] FS: 0000000001d51880(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000 [ 35.915042] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 35.920909] CR2: 00000000208a7000 CR3: 00000001d7057000 CR4: 00000000001406f0 [ 35.928165] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 35.935421] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 35.942674] Call Trace: [ 35.945261] ? memcpy+0x45/0x50 [ 35.948534] ? icmp_timeout_nlattr_to_obj+0x180/0x180 [ 35.953716] ? __nla_put+0x37/0x40 [ 35.957242] ? nla_put+0x117/0x150 [ 35.960769] cttimeout_default_get+0x644/0x9e0 [ 35.965335] ? cttimeout_new_timeout+0x8c0/0x8c0 [ 35.970080] ? __lock_is_held+0xb5/0x140 [ 35.974147] ? cttimeout_new_timeout+0x8c0/0x8c0 [ 35.978907] nfnetlink_rcv_msg+0xdd3/0x10c0 [ 35.983221] ? nfnetlink_bind+0x3b0/0x3b0 [ 35.987369] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 35.992895] ? refcount_sub_and_test_checked+0x203/0x310 [ 35.998332] ? refcount_inc_not_zero_checked+0x2f0/0x2f0 [ 36.003771] ? netlink_deliver_tap+0x32e/0xf80 [ 36.008341] ? lock_downgrade+0x900/0x900 [ 36.012476] ? check_preemption_disabled+0x48/0x280 [ 36.017512] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 36.023054] ? apparmor_capable+0x355/0x6c0 [ 36.027362] ? rcu_softirq_qs+0x20/0x20 [ 36.031330] ? apparmor_cred_prepare+0x5a0/0x5a0 [ 36.036076] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 36.041606] netlink_rcv_skb+0x172/0x440 [ 36.045655] ? nfnetlink_bind+0x3b0/0x3b0 [ 36.049792] ? netlink_ack+0xb80/0xb80 [ 36.053664] ? __netlink_ns_capable+0x100/0x130 [ 36.058328] nfnetlink_rcv+0x1c0/0x4d0 [ 36.062203] ? nfnetlink_rcv_batch+0x19b0/0x19b0 [ 36.066949] ? kasan_check_write+0x14/0x20 [ 36.071172] netlink_unicast+0x5a5/0x760 [ 36.075223] ? netlink_attachskb+0x9a0/0x9a0 [ 36.079621] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 36.085144] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 36.090149] netlink_sendmsg+0xa18/0xfc0 [ 36.094200] ? netlink_unicast+0x760/0x760 [ 36.098421] ? aa_sock_msg_perm.isra.12+0xba/0x160 [ 36.103337] ? apparmor_socket_sendmsg+0x29/0x30 [ 36.108078] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 36.113612] ? security_socket_sendmsg+0x94/0xc0 [ 36.118360] ? netlink_unicast+0x760/0x760 [ 36.122588] sock_sendmsg+0xd5/0x120 [ 36.126293] ___sys_sendmsg+0x7fd/0x930 [ 36.130258] ? find_held_lock+0x36/0x1c0 [ 36.134325] ? copy_msghdr_from_user+0x580/0x580 [ 36.139068] ? zap_class+0x640/0x640 [ 36.142780] ? zap_class+0x640/0x640 [ 36.146476] ? zap_class+0x640/0x640 [ 36.150179] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 36.155712] ? __fget_light+0x2e9/0x430 [ 36.159670] ? fget_raw+0x20/0x20 [ 36.163125] ? __do_page_fault+0x620/0xe60 [ 36.167344] ? lock_downgrade+0x900/0x900 [ 36.171479] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 36.176394] ? kasan_check_read+0x11/0x20 [ 36.180528] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 36.186053] ? sockfd_lookup_light+0xc5/0x160 [ 36.190534] __sys_sendmsg+0x11d/0x280 [ 36.194407] ? __ia32_sys_shutdown+0x80/0x80 [ 36.198803] ? up_read_non_owner+0x100/0x100 [ 36.203201] ? do_syscall_64+0x9a/0x820 [ 36.207161] ? do_syscall_64+0x9a/0x820 [ 36.211124] ? trace_hardirqs_off_caller+0x310/0x310 [ 36.216214] __x64_sys_sendmsg+0x78/0xb0 [ 36.220267] do_syscall_64+0x1b9/0x820 [ 36.224157] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 36.229507] ? syscall_return_slowpath+0x5e0/0x5e0 [ 36.234425] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 36.239255] ? trace_hardirqs_on_caller+0x310/0x310 [ 36.244288] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 36.249301] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 36.254834] ? prepare_exit_to_usermode+0x291/0x3b0 [ 36.259856] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 36.264709] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 36.269887] RIP: 0033:0x4400d9 [ 36.273065] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 36.291951] RSP: 002b:00007ffdb918bd08 EFLAGS: 00000213 ORIG_RAX: 000000000000002e [ 36.299649] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004400d9 [ 36.306909] RDX: 0000000000000000 RSI: 0000000020dddfc8 RDI: 0000000000000003 [ 36.314159] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 36.321410] R10: 0000000000000000 R11: 0000000000000213 R12: 0000000000401960 [ 36.328659] R13: 00000000004019f0 R14: 0000000000000000 R15: 0000000000000000 [ 36.335918] Modules linked in: [ 36.339189] ---[ end trace 56755c4d36310351 ]--- [ 36.344147] RIP: 0010:icmp_timeout_obj_to_nlattr+0x77/0x170 [ 36.349883] Code: b5 41 c7 00 f1 f1 f1 f1 c7 40 04 04 f2 f2 f2 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 e8 30 79 24 fb 4c 89 e8 48 c1 e8 03 <42> 0f b6 14 38 4c 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 [ 36.368822] RSP: 0018:ffff8801d70a7220 EFLAGS: 00010246 [ 36.374212] RAX: 0000000000000000 RBX: 1ffff1003ae14e45 RCX: ffffffff865df764 [ 36.381498] RDX: 0000000000000000 RSI: ffffffff865affd0 RDI: ffff8801d858d340 [ 36.388757] RBP: ffff8801d70a72b0 R08: ffff8801d8f40700 R09: ffff8801ba5e80a8 [ 36.396046] R10: ffffed00374bd014 R11: ffff8801ba5e80a0 R12: ffff8801d858d340 [ 36.403333] R13: 0000000000000000 R14: ffff8801d70a7288 R15: dffffc0000000000 [ 36.410628] FS: 0000000001d51880(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000 [ 36.418853] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.424758] CR2: 00000000208a7000 CR3: 00000001d7057000 CR4: 00000000001406f0 [ 36.432048] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 36.439336] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 36.446606] Kernel panic - not syncing: Fatal exception [ 36.452957] Kernel Offset: disabled [ 36.456609] Rebooting in 86400 seconds..