[ 26.949112] audit: type=1800 audit(1541009998.679:27): pid=5557 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [ 26.970462] audit: type=1800 audit(1541009998.689:28): pid=5557 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2417 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 27.783122] audit: type=1800 audit(1541009999.589:29): pid=5557 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 27.803724] audit: type=1800 audit(1541009999.589:30): pid=5557 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.22' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 39.109449] netlink: 'syz-executor073': attribute type 3 has an invalid length. [ 39.116966] netlink: 'syz-executor073': attribute type 2 has an invalid length. [ 39.124563] kasan: CONFIG_KASAN_INLINE enabled [ 39.129257] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 39.136609] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 39.142826] CPU: 0 PID: 5712 Comm: syz-executor073 Not tainted 4.19.0+ #163 [ 39.149908] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 39.159259] RIP: 0010:icmp_timeout_obj_to_nlattr+0x77/0x170 [ 39.164956] Code: b5 41 c7 00 f1 f1 f1 f1 c7 40 04 04 f2 f2 f2 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 e8 d0 31 26 fb 4c 89 e8 48 c1 e8 03 <42> 0f b6 14 38 4c 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 [ 39.183841] RSP: 0018:ffff8801d5ab7220 EFLAGS: 00010246 [ 39.189195] RAX: 0000000000000000 RBX: 1ffff1003ab56e45 RCX: ffffffff865c29c4 [ 39.196465] RDX: 0000000000000000 RSI: ffffffff86593230 RDI: ffff8801c1dab140 [ 39.203719] RBP: ffff8801d5ab72b0 R08: ffff8801d75262c0 R09: ffff8801ba010668 [ 39.210973] R10: ffffed00374020cc R11: ffff8801ba010660 R12: ffff8801c1dab140 [ 39.218235] R13: 0000000000000000 R14: ffff8801d5ab7288 R15: dffffc0000000000 [ 39.225494] FS: 0000000000fac880(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000 [ 39.233703] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 39.239570] CR2: 00000000208a7000 CR3: 00000001be640000 CR4: 00000000001406f0 [ 39.246825] Call Trace: [ 39.249411] ? memcpy+0x45/0x50 [ 39.252689] ? icmp_timeout_nlattr_to_obj+0x180/0x180 [ 39.257879] ? __nla_put+0x37/0x40 [ 39.261405] ? nla_put+0x117/0x150 [ 39.264955] cttimeout_default_get+0x644/0x9e0 [ 39.269528] ? cttimeout_new_timeout+0x8c0/0x8c0 [ 39.274272] ? __lock_is_held+0xb5/0x140 [ 39.278320] ? cttimeout_new_timeout+0x8c0/0x8c0 [ 39.283065] nfnetlink_rcv_msg+0xdd3/0x10c0 [ 39.287376] ? nfnetlink_bind+0x3b0/0x3b0 [ 39.291515] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 39.297042] ? refcount_sub_and_test_checked+0x203/0x310 [ 39.302481] ? refcount_inc_not_zero_checked+0x2f0/0x2f0 [ 39.307919] ? netlink_deliver_tap+0x32e/0xf80 [ 39.312489] ? lock_downgrade+0x900/0x900 [ 39.316623] ? check_preemption_disabled+0x48/0x280 [ 39.321633] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 39.327158] ? apparmor_capable+0x355/0x6c0 [ 39.331467] ? rcu_softirq_qs+0x20/0x20 [ 39.335432] ? apparmor_cred_prepare+0x5a0/0x5a0 [ 39.340175] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 39.345702] netlink_rcv_skb+0x172/0x440 [ 39.349749] ? nfnetlink_bind+0x3b0/0x3b0 [ 39.353885] ? netlink_ack+0xb80/0xb80 [ 39.357771] ? __netlink_ns_capable+0x100/0x130 [ 39.362431] nfnetlink_rcv+0x1c0/0x4d0 [ 39.366324] ? nfnetlink_rcv_batch+0x19b0/0x19b0 [ 39.371074] ? kasan_check_write+0x14/0x20 [ 39.375293] netlink_unicast+0x5a5/0x760 [ 39.379348] ? netlink_attachskb+0x9a0/0x9a0 [ 39.383743] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 39.389576] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 39.394581] netlink_sendmsg+0xa18/0xfc0 [ 39.398633] ? netlink_unicast+0x760/0x760 [ 39.402852] ? aa_sock_msg_perm.isra.12+0xba/0x160 [ 39.407766] ? apparmor_socket_sendmsg+0x29/0x30 [ 39.412508] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 39.418043] ? security_socket_sendmsg+0x94/0xc0 [ 39.422823] ? netlink_unicast+0x760/0x760 [ 39.427048] sock_sendmsg+0xd5/0x120 [ 39.430747] ___sys_sendmsg+0x7fd/0x930 [ 39.434708] ? find_held_lock+0x36/0x1c0 [ 39.438758] ? copy_msghdr_from_user+0x580/0x580 [ 39.443498] ? zap_class+0x640/0x640 [ 39.447195] ? zap_class+0x640/0x640 [ 39.450892] ? zap_class+0x640/0x640 [ 39.454591] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 39.460111] ? __fget_light+0x2e9/0x430 [ 39.464088] ? fget_raw+0x20/0x20 [ 39.467532] ? __do_page_fault+0x620/0xe60 [ 39.471755] ? lock_downgrade+0x900/0x900 [ 39.475885] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 39.480800] ? kasan_check_read+0x11/0x20 [ 39.484934] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 39.490458] ? sockfd_lookup_light+0xc5/0x160 [ 39.494940] __sys_sendmsg+0x11d/0x280 [ 39.498813] ? __ia32_sys_shutdown+0x80/0x80 [ 39.503207] ? up_read_non_owner+0x100/0x100 [ 39.507600] ? do_syscall_64+0x9a/0x820 [ 39.511558] ? do_syscall_64+0x9a/0x820 [ 39.515541] ? trace_hardirqs_off_caller+0x310/0x310 [ 39.520635] __x64_sys_sendmsg+0x78/0xb0 [ 39.524685] do_syscall_64+0x1b9/0x820 [ 39.528562] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 39.533933] ? syscall_return_slowpath+0x5e0/0x5e0 [ 39.538850] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 39.543679] ? trace_hardirqs_on_caller+0x310/0x310 [ 39.548680] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 39.553682] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 39.559206] ? prepare_exit_to_usermode+0x291/0x3b0 [ 39.564212] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 39.569045] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 39.574219] RIP: 0033:0x4400d9 [ 39.577397] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 39.596285] RSP: 002b:00007fff8d08ff38 EFLAGS: 00000213 ORIG_RAX: 000000000000002e [ 39.603976] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004400d9 [ 39.611228] RDX: 0000000000000000 RSI: 0000000020dddfc8 RDI: 0000000000000003 [ 39.618482] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 39.625733] R10: 0000000000000000 R11: 0000000000000213 R12: 0000000000401960 [ 39.632987] R13: 00000000004019f0 R14: 0000000000000000 R15: 0000000000000000 [ 39.640247] Modules linked in: [ 39.644305] ---[ end trace c158bb89da3335fa ]--- [ 39.649258] RIP: 0010:icmp_timeout_obj_to_nlattr+0x77/0x170 [ 39.654960] Code: b5 41 c7 00 f1 f1 f1 f1 c7 40 04 04 f2 f2 f2 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 e8 d0 31 26 fb 4c 89 e8 48 c1 e8 03 <42> 0f b6 14 38 4c 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 [ 39.673893] RSP: 0018:ffff8801d5ab7220 EFLAGS: 00010246 [ 39.679307] RAX: 0000000000000000 RBX: 1ffff1003ab56e45 RCX: ffffffff865c29c4 [ 39.686572] RDX: 0000000000000000 RSI: ffffffff86593230 RDI: ffff8801c1dab140 [ 39.693875] RBP: ffff8801d5ab72b0 R08: ffff8801d75262c0 R09: ffff8801ba010668 [ 39.701191] R10: ffffed00374020cc R11: ffff8801ba010660 R12: ffff8801c1dab140 [ 39.708485] R13: 0000000000000000 R14: ffff8801d5ab7288 R15: dffffc0000000000 [ 39.715774] FS: 0000000000fac880(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000 [ 39.724022] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 39.729938] CR2: 00000000208a7000 CR3: 00000001be640000 CR4: 00000000001406f0 [ 39.737209] Kernel panic - not syncing: Fatal exception [ 39.743472] Kernel Offset: disabled [ 39.747100] Rebooting in 86400 seconds..