[ 88.856300][ T27] audit: type=1800 audit(1579369588.202:25): pid=9605 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 89.714873][ T27] kauditd_printk_skb: 3 callbacks suppressed [ 89.714884][ T27] audit: type=1800 audit(1579369589.062:29): pid=9605 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 89.742423][ T27] audit: type=1800 audit(1579369589.062:30): pid=9605 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.1.26' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 115.708045][ T9755] ================================================================== [ 115.716438][ T9755] BUG: KASAN: slab-out-of-bounds in bitmap_ipmac_list+0x635/0x1080 [ 115.724319][ T9755] Read of size 8 at addr ffff8880a7f31980 by task syz-executor411/9755 [ 115.732536][ T9755] [ 115.734911][ T9755] CPU: 1 PID: 9755 Comm: syz-executor411 Not tainted 5.5.0-rc6-syzkaller #0 [ 115.743576][ T9755] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 115.753646][ T9755] Call Trace: [ 115.756935][ T9755] dump_stack+0x197/0x210 [ 115.761254][ T9755] ? bitmap_ipmac_list+0x635/0x1080 [ 115.766459][ T9755] print_address_description.constprop.0.cold+0xd4/0x30b [ 115.773470][ T9755] ? bitmap_ipmac_list+0x635/0x1080 [ 115.778660][ T9755] ? bitmap_ipmac_list+0x635/0x1080 [ 115.783838][ T9755] __kasan_report.cold+0x1b/0x41 [ 115.788791][ T9755] ? bitmap_ipmac_list+0x635/0x1080 [ 115.793976][ T9755] kasan_report+0x12/0x20 [ 115.802071][ T9755] check_memory_region+0x134/0x1a0 [ 115.807290][ T9755] __kasan_check_read+0x11/0x20 [ 115.812138][ T9755] bitmap_ipmac_list+0x635/0x1080 [ 115.817214][ T9755] ? bitmap_ipmac_head+0x8a0/0x8a0 [ 115.822325][ T9755] ? nla_put+0x110/0x150 [ 115.826581][ T9755] ip_set_dump_start+0x96c/0x1ca0 [ 115.831605][ T9755] ? ip_set_rename+0x720/0x720 [ 115.836372][ T9755] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 115.841958][ T9755] ? perf_trace_lock_acquire+0x4c0/0x530 [ 115.847592][ T9755] ? __kasan_check_write+0x14/0x20 [ 115.852734][ T9755] netlink_dump+0x558/0xfb0 [ 115.857220][ T9755] ? __netlink_sendskb+0xc0/0xc0 [ 115.862199][ T9755] __netlink_dump_start+0x66a/0x930 [ 115.867405][ T9755] ip_set_dump+0x15a/0x1d0 [ 115.871821][ T9755] ? call_ad+0x5a0/0x5a0 [ 115.876052][ T9755] ? ip_set_rename+0x720/0x720 [ 115.880920][ T9755] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 115.886733][ T9755] ? call_ad+0x5a0/0x5a0 [ 115.890977][ T9755] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 115.895912][ T9755] ? nfnetlink_bind+0x2c0/0x2c0 [ 115.900861][ T9755] ? __kasan_check_read+0x11/0x20 [ 115.905885][ T9755] ? __lock_acquire+0x8a0/0x4a00 [ 115.910851][ T9755] ? save_stack+0x5c/0x90 [ 115.915178][ T9755] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 115.921469][ T9755] ? apparmor_capable+0x497/0x900 [ 115.926538][ T9755] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 115.932772][ T9755] ? __kasan_check_read+0x11/0x20 [ 115.937780][ T9755] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 115.943342][ T9755] netlink_rcv_skb+0x177/0x450 [ 115.948131][ T9755] ? nfnetlink_bind+0x2c0/0x2c0 [ 115.953079][ T9755] ? netlink_ack+0xb50/0xb50 [ 115.957651][ T9755] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 115.963884][ T9755] ? ns_capable_common+0x93/0x100 [ 115.969154][ T9755] ? ns_capable+0x20/0x30 [ 115.973483][ T9755] ? __netlink_ns_capable+0x104/0x140 [ 115.978854][ T9755] nfnetlink_rcv+0x1ba/0x460 [ 115.983443][ T9755] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 115.988897][ T9755] ? netlink_deliver_tap+0x24a/0xbe0 [ 115.994315][ T9755] ? __kasan_check_write+0x14/0x20 [ 115.999536][ T9755] netlink_unicast+0x58c/0x7d0 [ 116.004330][ T9755] ? netlink_attachskb+0x870/0x870 [ 116.009442][ T9755] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 116.015159][ T9755] ? __check_object_size+0x3d/0x437 [ 116.020396][ T9755] netlink_sendmsg+0x91c/0xea0 [ 116.025220][ T9755] ? netlink_unicast+0x7d0/0x7d0 [ 116.030156][ T9755] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 116.035718][ T9755] ? apparmor_socket_sendmsg+0x2a/0x30 [ 116.041198][ T9755] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 116.047441][ T9755] ? security_socket_sendmsg+0x8d/0xc0 [ 116.052897][ T9755] ? netlink_unicast+0x7d0/0x7d0 [ 116.057833][ T9755] sock_sendmsg+0xd7/0x130 [ 116.062252][ T9755] ____sys_sendmsg+0x753/0x880 [ 116.067011][ T9755] ? kernel_sendmsg+0x50/0x50 [ 116.071702][ T9755] ? lockdep_init_map+0x1be/0x6d0 [ 116.076727][ T9755] ___sys_sendmsg+0x100/0x170 [ 116.081398][ T9755] ? sendmsg_copy_msghdr+0x70/0x70 [ 116.086493][ T9755] ? __kasan_check_read+0x11/0x20 [ 116.091514][ T9755] ? __lock_acquire+0x8a0/0x4a00 [ 116.096453][ T9755] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 116.102678][ T9755] ? __this_cpu_preempt_check+0x35/0x190 [ 116.108307][ T9755] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 116.114533][ T9755] ? percpu_counter_add_batch+0x13c/0x190 [ 116.120273][ T9755] ? __fd_install+0x1bc/0x640 [ 116.124935][ T9755] ? find_held_lock+0x35/0x130 [ 116.129844][ T9755] ? __fd_install+0x1bc/0x640 [ 116.134520][ T9755] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 116.140746][ T9755] ? __fget_light+0x1a9/0x230 [ 116.145467][ T9755] ? __fdget+0x1b/0x20 [ 116.149643][ T9755] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 116.155876][ T9755] __sys_sendmsg+0x105/0x1d0 [ 116.160462][ T9755] ? __sys_sendmsg_sock+0xc0/0xc0 [ 116.165487][ T9755] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 116.170980][ T9755] ? do_syscall_64+0x26/0x790 [ 116.175650][ T9755] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 116.181714][ T9755] ? do_syscall_64+0x26/0x790 [ 116.186444][ T9755] __x64_sys_sendmsg+0x78/0xb0 [ 116.191200][ T9755] do_syscall_64+0xfa/0x790 [ 116.195747][ T9755] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 116.201640][ T9755] RIP: 0033:0x440529 [ 116.205524][ T9755] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 116.225118][ T9755] RSP: 002b:00007ffdd68e27c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 116.233524][ T9755] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440529 [ 116.241533][ T9755] RDX: 0000000000000000 RSI: 0000000020000380 RDI: 0000000000000004 [ 116.249547][ T9755] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 116.257516][ T9755] R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000401db0 [ 116.265479][ T9755] R13: 0000000000401e40 R14: 0000000000000000 R15: 0000000000000000 [ 116.273505][ T9755] [ 116.275860][ T9755] Allocated by task 9755: [ 116.280187][ T9755] save_stack+0x23/0x90 [ 116.284334][ T9755] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 116.289957][ T9755] kasan_kmalloc+0x9/0x10 [ 116.294271][ T9755] __kmalloc+0x163/0x770 [ 116.298501][ T9755] ip_set_alloc+0x38/0x5e [ 116.302829][ T9755] bitmap_ipmac_create+0x4e8/0xa00 [ 116.307932][ T9755] ip_set_create+0x6f1/0x1500 [ 116.312599][ T9755] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 116.317661][ T9755] netlink_rcv_skb+0x177/0x450 [ 116.322420][ T9755] nfnetlink_rcv+0x1ba/0x460 [ 116.326997][ T9755] netlink_unicast+0x58c/0x7d0 [ 116.331778][ T9755] netlink_sendmsg+0x91c/0xea0 [ 116.336521][ T9755] sock_sendmsg+0xd7/0x130 [ 116.340928][ T9755] ____sys_sendmsg+0x753/0x880 [ 116.345675][ T9755] ___sys_sendmsg+0x100/0x170 [ 116.350424][ T9755] __sys_sendmsg+0x105/0x1d0 [ 116.355170][ T9755] __x64_sys_sendmsg+0x78/0xb0 [ 116.359923][ T9755] do_syscall_64+0xfa/0x790 [ 116.364408][ T9755] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 116.370279][ T9755] [ 116.372589][ T9755] Freed by task 9489: [ 116.376560][ T9755] save_stack+0x23/0x90 [ 116.380771][ T9755] __kasan_slab_free+0x102/0x150 [ 116.385704][ T9755] kasan_slab_free+0xe/0x10 [ 116.390216][ T9755] kfree+0x10a/0x2c0 [ 116.394202][ T9755] tomoyo_check_open_permission+0x19e/0x3e0 [ 116.400195][ T9755] tomoyo_file_open+0xa9/0xd0 [ 116.404861][ T9755] security_file_open+0x71/0x300 [ 116.409791][ T9755] do_dentry_open+0x37a/0x1380 [ 116.414647][ T9755] vfs_open+0xa0/0xd0 [ 116.418620][ T9755] path_openat+0x118b/0x3180 [ 116.423196][ T9755] do_filp_open+0x1a1/0x280 [ 116.427783][ T9755] do_sys_open+0x3fe/0x5d0 [ 116.432182][ T9755] __x64_sys_open+0x7e/0xc0 [ 116.436676][ T9755] do_syscall_64+0xfa/0x790 [ 116.441199][ T9755] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 116.447175][ T9755] [ 116.449500][ T9755] The buggy address belongs to the object at ffff8880a7f31980 [ 116.449500][ T9755] which belongs to the cache kmalloc-32 of size 32 [ 116.463454][ T9755] The buggy address is located 0 bytes inside of [ 116.463454][ T9755] 32-byte region [ffff8880a7f31980, ffff8880a7f319a0) [ 116.476511][ T9755] The buggy address belongs to the page: [ 116.482156][ T9755] page:ffffea00029fcc40 refcount:1 mapcount:0 mapping:ffff8880aa4001c0 index:0xffff8880a7f31fc1 [ 116.492563][ T9755] raw: 00fffe0000000200 ffffea0002926e08 ffffea00027c0848 ffff8880aa4001c0 [ 116.501154][ T9755] raw: ffff8880a7f31fc1 ffff8880a7f31000 000000010000003f 0000000000000000 [ 116.509728][ T9755] page dumped because: kasan: bad access detected [ 116.516185][ T9755] [ 116.518509][ T9755] Memory state around the buggy address: [ 116.524255][ T9755] ffff8880a7f31880: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 116.532411][ T9755] ffff8880a7f31900: fb fb fb fb fc fc fc fc 00 00 fc fc fc fc fc fc [ 116.540598][ T9755] >ffff8880a7f31980: 04 fc fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 116.548669][ T9755] ^ [ 116.552735][ T9755] ffff8880a7f31a00: 00 00 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 116.560988][ T9755] ffff8880a7f31a80: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 116.569198][ T9755] ================================================================== [ 116.577249][ T9755] Disabling lock debugging due to kernel taint [ 116.584112][ T9755] Kernel panic - not syncing: panic_on_warn set ... [ 116.590826][ T9755] CPU: 1 PID: 9755 Comm: syz-executor411 Tainted: G B 5.5.0-rc6-syzkaller #0 [ 116.600877][ T9755] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 116.611080][ T9755] Call Trace: [ 116.614367][ T9755] dump_stack+0x197/0x210 [ 116.618682][ T9755] panic+0x2e3/0x75c [ 116.622575][ T9755] ? add_taint.cold+0x16/0x16 [ 116.627245][ T9755] ? bitmap_ipmac_list+0x635/0x1080 [ 116.632462][ T9755] ? preempt_schedule+0x4b/0x60 [ 116.637425][ T9755] ? ___preempt_schedule+0x16/0x18 [ 116.642525][ T9755] ? trace_hardirqs_on+0x5e/0x240 [ 116.647545][ T9755] ? bitmap_ipmac_list+0x635/0x1080 [ 116.652773][ T9755] end_report+0x47/0x4f [ 116.656945][ T9755] ? bitmap_ipmac_list+0x635/0x1080 [ 116.662137][ T9755] __kasan_report.cold+0xe/0x41 [ 116.667015][ T9755] ? bitmap_ipmac_list+0x635/0x1080 [ 116.672361][ T9755] kasan_report+0x12/0x20 [ 116.676743][ T9755] check_memory_region+0x134/0x1a0 [ 116.681847][ T9755] __kasan_check_read+0x11/0x20 [ 116.686689][ T9755] bitmap_ipmac_list+0x635/0x1080 [ 116.691838][ T9755] ? bitmap_ipmac_head+0x8a0/0x8a0 [ 116.696939][ T9755] ? nla_put+0x110/0x150 [ 116.701175][ T9755] ip_set_dump_start+0x96c/0x1ca0 [ 116.706196][ T9755] ? ip_set_rename+0x720/0x720 [ 116.710958][ T9755] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 116.716590][ T9755] ? perf_trace_lock_acquire+0x4c0/0x530 [ 116.722335][ T9755] ? __kasan_check_write+0x14/0x20 [ 116.727463][ T9755] netlink_dump+0x558/0xfb0 [ 116.732043][ T9755] ? __netlink_sendskb+0xc0/0xc0 [ 116.737713][ T9755] __netlink_dump_start+0x66a/0x930 [ 116.743029][ T9755] ip_set_dump+0x15a/0x1d0 [ 116.747436][ T9755] ? call_ad+0x5a0/0x5a0 [ 116.751772][ T9755] ? ip_set_rename+0x720/0x720 [ 116.756521][ T9755] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 116.762323][ T9755] ? call_ad+0x5a0/0x5a0 [ 116.766682][ T9755] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 116.771611][ T9755] ? nfnetlink_bind+0x2c0/0x2c0 [ 116.776474][ T9755] ? __kasan_check_read+0x11/0x20 [ 116.781918][ T9755] ? __lock_acquire+0x8a0/0x4a00 [ 116.786886][ T9755] ? save_stack+0x5c/0x90 [ 116.791371][ T9755] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 116.797698][ T9755] ? apparmor_capable+0x497/0x900 [ 116.802723][ T9755] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 116.809056][ T9755] ? __kasan_check_read+0x11/0x20 [ 116.814946][ T9755] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 116.821051][ T9755] netlink_rcv_skb+0x177/0x450 [ 116.825986][ T9755] ? nfnetlink_bind+0x2c0/0x2c0 [ 116.831101][ T9755] ? netlink_ack+0xb50/0xb50 [ 116.836211][ T9755] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 116.842940][ T9755] ? ns_capable_common+0x93/0x100 [ 116.848321][ T9755] ? ns_capable+0x20/0x30 [ 116.852819][ T9755] ? __netlink_ns_capable+0x104/0x140 [ 116.858469][ T9755] nfnetlink_rcv+0x1ba/0x460 [ 116.863228][ T9755] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 116.868728][ T9755] ? netlink_deliver_tap+0x24a/0xbe0 [ 116.875201][ T9755] ? __kasan_check_write+0x14/0x20 [ 116.880574][ T9755] netlink_unicast+0x58c/0x7d0 [ 116.885981][ T9755] ? netlink_attachskb+0x870/0x870 [ 116.891179][ T9755] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 116.897218][ T9755] ? __check_object_size+0x3d/0x437 [ 116.902416][ T9755] netlink_sendmsg+0x91c/0xea0 [ 116.907888][ T9755] ? netlink_unicast+0x7d0/0x7d0 [ 116.913310][ T9755] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 116.919464][ T9755] ? apparmor_socket_sendmsg+0x2a/0x30 [ 116.925177][ T9755] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 116.932808][ T9755] ? security_socket_sendmsg+0x8d/0xc0 [ 116.938740][ T9755] ? netlink_unicast+0x7d0/0x7d0 [ 116.944395][ T9755] sock_sendmsg+0xd7/0x130 [ 116.949366][ T9755] ____sys_sendmsg+0x753/0x880 [ 116.954120][ T9755] ? kernel_sendmsg+0x50/0x50 [ 116.958806][ T9755] ? lockdep_init_map+0x1be/0x6d0 [ 116.963983][ T9755] ___sys_sendmsg+0x100/0x170 [ 116.969193][ T9755] ? sendmsg_copy_msghdr+0x70/0x70 [ 116.974546][ T9755] ? __kasan_check_read+0x11/0x20 [ 116.979691][ T9755] ? __lock_acquire+0x8a0/0x4a00 [ 116.984620][ T9755] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 116.991089][ T9755] ? __this_cpu_preempt_check+0x35/0x190 [ 116.996943][ T9755] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 117.003447][ T9755] ? percpu_counter_add_batch+0x13c/0x190 [ 117.009533][ T9755] ? __fd_install+0x1bc/0x640 [ 117.014887][ T9755] ? find_held_lock+0x35/0x130 [ 117.020627][ T9755] ? __fd_install+0x1bc/0x640 [ 117.026048][ T9755] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 117.033064][ T9755] ? __fget_light+0x1a9/0x230 [ 117.038049][ T9755] ? __fdget+0x1b/0x20 [ 117.042472][ T9755] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 117.048812][ T9755] __sys_sendmsg+0x105/0x1d0 [ 117.053751][ T9755] ? __sys_sendmsg_sock+0xc0/0xc0 [ 117.058783][ T9755] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 117.065143][ T9755] ? do_syscall_64+0x26/0x790 [ 117.070088][ T9755] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 117.076363][ T9755] ? do_syscall_64+0x26/0x790 [ 117.081219][ T9755] __x64_sys_sendmsg+0x78/0xb0 [ 117.086723][ T9755] do_syscall_64+0xfa/0x790 [ 117.091244][ T9755] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 117.097513][ T9755] RIP: 0033:0x440529 [ 117.101401][ T9755] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 117.125637][ T9755] RSP: 002b:00007ffdd68e27c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 117.135062][ T9755] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440529 [ 117.143373][ T9755] RDX: 0000000000000000 RSI: 0000000020000380 RDI: 0000000000000004 [ 117.151368][ T9755] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 117.160135][ T9755] R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000401db0 [ 117.168213][ T9755] R13: 0000000000401e40 R14: 0000000000000000 R15: 0000000000000000 [ 117.177983][ T9755] Kernel Offset: disabled [ 117.182318][ T9755] Rebooting in 86400 seconds..