[ OK ] Started Getty on tty1. [ OK ] Started Getty on tty2. [ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.15.198' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 37.824207] audit: type=1400 audit(1601957039.971:8): avc: denied { execmem } for pid=6501 comm="syz-executor504" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 37.875106] ================================================================================ [ 37.883740] UBSAN: Undefined behaviour in net/netfilter/ipset/ip_set_hash_gen.h:125:6 [ 37.891683] shift exponent 32 is too large for 32-bit type 'unsigned int' [ 37.898588] CPU: 0 PID: 6503 Comm: syz-executor504 Not tainted 4.19.149-syzkaller #0 [ 37.906444] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 37.915772] Call Trace: [ 37.918383] dump_stack+0x22c/0x33e [ 37.921994] ubsan_epilogue+0xe/0x3a [ 37.925690] __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 [ 37.931860] ? hash_ipportip_create+0x366/0xa4d [ 37.936511] ? rcu_read_lock_sched_held+0x174/0x1e0 [ 37.941514] ? kmem_cache_alloc_trace+0x379/0x4b0 [ 37.946343] hash_ipportip_create.cold+0x1a/0x21 [ 37.951077] ? hash_ipportip4_add+0x2050/0x2050 [ 37.955724] ip_set_create+0x70e/0x1380 [ 37.959691] ? __find_set_type_get+0x450/0x450 [ 37.964273] ? lock_downgrade+0x750/0x750 [ 37.968412] ? __find_set_type_get+0x450/0x450 [ 37.973077] nfnetlink_rcv_msg+0xeff/0x1210 [ 37.977400] ? nfnetlink_net_init+0x170/0x170 [ 37.981898] ? avc_has_extended_perms+0x1020/0x1020 [ 37.986890] ? avc_has_extended_perms+0x1020/0x1020 [ 37.991884] ? __lock_acquire+0x6ec/0x3ff0 [ 37.996097] ? mark_held_locks+0xf0/0xf0 [ 38.000141] ? cred_has_capability+0x162/0x2e0 [ 38.004700] ? cred_has_capability+0x1d9/0x2e0 [ 38.009260] ? selinux_inode_copy_up+0x180/0x180 [ 38.013994] ? selinux_inode_copy_up+0x180/0x180 [ 38.018733] netlink_rcv_skb+0x160/0x440 [ 38.022776] ? nfnetlink_net_init+0x170/0x170 [ 38.027252] ? netlink_ack+0xae0/0xae0 [ 38.031132] ? ns_capable_common+0x117/0x140 [ 38.035529] nfnetlink_rcv+0x1b2/0x41b [ 38.039402] ? nfnetlink_rcv_batch+0x1710/0x1710 [ 38.044152] netlink_unicast+0x4d5/0x690 [ 38.048202] ? netlink_sendskb+0x110/0x110 [ 38.052430] netlink_sendmsg+0x717/0xcc0 [ 38.056479] ? nlmsg_notify+0x1a0/0x1a0 [ 38.060452] ? nlmsg_notify+0x1a0/0x1a0 [ 38.064420] sock_sendmsg+0xc7/0x130 [ 38.068120] sock_no_sendpage+0xf5/0x140 [ 38.072166] ? sk_page_frag_refill+0x1d0/0x1d0 [ 38.076741] ? pipe_lock+0x63/0x80 [ 38.080266] ? pipe_lock+0x63/0x80 [ 38.083801] ? sk_page_frag_refill+0x1d0/0x1d0 [ 38.088368] sock_sendpage+0xdf/0x140 [ 38.092157] pipe_to_sendpage+0x268/0x330 [ 38.096289] ? move_addr_to_kernel.part.0+0x110/0x110 [ 38.101475] ? direct_splice_actor+0x160/0x160 [ 38.106041] ? splice_from_pipe_next.part.0+0x2d5/0x390 [ 38.111392] __splice_from_pipe+0x3af/0x820 [ 38.115699] ? direct_splice_actor+0x160/0x160 [ 38.120281] generic_splice_sendpage+0xd4/0x140 [ 38.124937] ? __splice_from_pipe+0x820/0x820 [ 38.129424] ? security_file_permission+0x1c0/0x230 [ 38.134436] ? __splice_from_pipe+0x820/0x820 [ 38.138917] __se_sys_splice+0xf31/0x15f0 [ 38.143056] ? find_held_lock+0x2d/0x110 [ 38.147100] ? ret_from_fork+0x8/0x30 [ 38.150884] ? __se_sys_tee+0xa10/0xa10 [ 38.154844] ? trace_hardirqs_off_caller+0x6e/0x210 [ 38.159845] ? do_syscall_64+0x21/0x670 [ 38.163807] do_syscall_64+0xf9/0x670 [ 38.167594] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 38.172778] RIP: 0033:0x445b49 [ 38.175954] Code: e8 bc b7 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 ab 11 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 38.194837] RSP: 002b:00007fb5437d8da8 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 38.202527] RAX: ffffffffffffffda RBX: 00000000006dac58 RCX: 0000000000445b49 [ 38.209780] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 38.217032] RBP: 00000000006dac50 R08: 000000000004ffe0 R09: 0000000000000000 [ 38.224385] R10: 00000000