[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 27.291978] kauditd_printk_skb: 7 callbacks suppressed [ 27.291991] audit: type=1800 audit(1541157229.181:29): pid=5558 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 27.320356] audit: type=1800 audit(1541157229.181:30): pid=5558 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 47.044759] sshd (5700) used greatest stack depth: 15744 bytes left Warning: Permanently added '10.128.0.101' (ECDSA) to the list of known hosts. executing program [ 53.536139] netlink: 'syz-executor955': attribute type 3 has an invalid length. [ 53.543881] netlink: 'syz-executor955': attribute type 2 has an invalid length. [ 53.551532] kasan: CONFIG_KASAN_INLINE enabled [ 53.556405] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 53.564190] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 53.570428] CPU: 0 PID: 5714 Comm: syz-executor955 Not tainted 4.19.0+ #218 [ 53.577639] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 53.587124] RIP: 0010:icmp_timeout_obj_to_nlattr+0x77/0x170 [ 53.592857] Code: b5 41 c7 00 f1 f1 f1 f1 c7 40 04 04 f2 f2 f2 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 e8 30 79 24 fb 4c 89 e8 48 c1 e8 03 <42> 0f b6 14 38 4c 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 [ 53.611966] RSP: 0018:ffff8801ba0af1d0 EFLAGS: 00010246 [ 53.617424] RAX: 0000000000000000 RBX: 1ffff10037415e3b RCX: ffffffff865df764 [ 53.624679] RDX: 0000000000000000 RSI: ffffffff865affd0 RDI: ffff8801d89f5680 [ 53.631933] RBP: ffff8801ba0af260 R08: ffff8801c1020140 R09: ffff8801ba7fa1a8 [ 53.639262] R10: ffffed00374ff434 R11: ffff8801ba7fa1a0 R12: ffff8801d89f5680 [ 53.646621] R13: 0000000000000000 R14: ffff8801ba0af238 R15: dffffc0000000000 [ 53.653957] FS: 0000000000000000(0000) GS:ffff8801dae00000(0063) knlGS:0000000008127840 [ 53.662175] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 53.668057] CR2: 00000000208a7000 CR3: 00000001d5499000 CR4: 00000000001406f0 [ 53.675331] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 53.682585] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 53.689835] Call Trace: [ 53.692410] ? memcpy+0x45/0x50 [ 53.695684] ? icmp_timeout_nlattr_to_obj+0x180/0x180 [ 53.700863] ? __nla_put+0x37/0x40 [ 53.704394] ? nla_put+0x117/0x150 [ 53.707928] cttimeout_default_get+0x644/0x9e0 [ 53.712500] ? cttimeout_new_timeout+0x8c0/0x8c0 [ 53.717369] ? __lock_is_held+0xb5/0x140 [ 53.721428] ? cttimeout_new_timeout+0x8c0/0x8c0 [ 53.726200] nfnetlink_rcv_msg+0xdd3/0x10c0 [ 53.730525] ? nfnetlink_bind+0x3b0/0x3b0 [ 53.734657] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 53.740180] ? refcount_sub_and_test_checked+0x203/0x310 [ 53.745615] ? refcount_inc_not_zero_checked+0x2f0/0x2f0 [ 53.751063] ? netlink_deliver_tap+0x32e/0xf80 [ 53.755631] ? lock_downgrade+0x900/0x900 [ 53.759764] ? check_preemption_disabled+0x48/0x280 [ 53.764782] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 53.770309] ? apparmor_capable+0x355/0x6c0 [ 53.774730] ? rcu_softirq_qs+0x20/0x20 [ 53.778691] ? apparmor_cred_prepare+0x5a0/0x5a0 [ 53.783447] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 53.789056] netlink_rcv_skb+0x172/0x440 [ 53.793110] ? nfnetlink_bind+0x3b0/0x3b0 [ 53.797242] ? netlink_ack+0xb80/0xb80 [ 53.801204] ? __netlink_ns_capable+0x100/0x130 [ 53.805980] nfnetlink_rcv+0x1c0/0x4d0 [ 53.809934] ? nfnetlink_rcv_batch+0x19b0/0x19b0 [ 53.814681] ? kasan_check_write+0x14/0x20 [ 53.818917] netlink_unicast+0x5a5/0x760 [ 53.822991] ? netlink_attachskb+0x9a0/0x9a0 [ 53.827394] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 53.832966] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 53.837980] netlink_sendmsg+0xa18/0xfc0 [ 53.842149] ? move_addr_to_kernel.part.18+0xc6/0x100 [ 53.847435] ? netlink_unicast+0x760/0x760 [ 53.851709] ? aa_sock_msg_perm.isra.12+0xba/0x160 [ 53.856621] ? apparmor_socket_sendmsg+0x29/0x30 [ 53.861363] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 53.867001] ? security_socket_sendmsg+0x94/0xc0 [ 53.871742] ? netlink_unicast+0x760/0x760 [ 53.875970] sock_sendmsg+0xd5/0x120 [ 53.879676] ___sys_sendmsg+0x7fd/0x930 [ 53.883636] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 53.888469] ? copy_msghdr_from_user+0x580/0x580 [ 53.893216] ? __fd_install+0x2b5/0x8f0 [ 53.897191] ? lock_downgrade+0x900/0x900 [ 53.901323] ? zap_class+0x640/0x640 [ 53.905115] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 53.910657] ? __fget_light+0x2e9/0x430 [ 53.914689] ? fget_raw+0x20/0x20 [ 53.918142] ? __do_page_fault+0x620/0xe60 [ 53.922361] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 53.927894] ? sockfd_lookup_light+0xc5/0x160 [ 53.932402] __sys_sendmsg+0x11d/0x280 [ 53.936275] ? __ia32_sys_shutdown+0x80/0x80 [ 53.940670] ? up_read+0x225/0x2c0 [ 53.944195] ? do_fast_syscall_32+0x150/0xfb2 [ 53.948673] ? do_fast_syscall_32+0x150/0xfb2 [ 53.953155] ? trace_hardirqs_off_caller+0x310/0x310 [ 53.958241] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 53.963907] ? __do_page_fault+0x491/0xe60 [ 53.968132] __ia32_compat_sys_sendmsg+0x7a/0xb0 [ 53.972879] do_fast_syscall_32+0x34d/0xfb2 [ 53.977265] ? do_int80_syscall_32+0x890/0x890 [ 53.981857] ? entry_SYSENTER_compat+0x68/0x7f [ 53.986451] ? trace_hardirqs_off_caller+0xbb/0x310 [ 53.991518] ? syscall_return_slowpath+0x5e0/0x5e0 [ 53.996434] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 54.001261] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 54.006092] ? trace_hardirqs_on_caller+0x310/0x310 [ 54.011222] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 54.016230] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 54.021773] ? prepare_exit_to_usermode+0x291/0x3b0 [ 54.026775] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 54.031603] entry_SYSENTER_compat+0x70/0x7f [ 54.036106] RIP: 0023:0xf7f4ea29 [ 54.039531] Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 14 24 c3 8b 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 54.058424] RSP: 002b:00000000fffdb9ec EFLAGS: 00000213 ORIG_RAX: 0000000000000172 [ 54.066114] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020dddfc8 [ 54.073379] RDX: 0000000000000000 RSI: 00000000080ea078 RDI: 00000000fffdba40 [ 54.080648] RBP: 0000000000001000 R08: 0000000000000000 R09: 0000000000000000 [ 54.088002] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 54.095321] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 54.102650] Modules linked in: [ 54.106006] ---[ end trace 288c1ada9fd963a4 ]--- [ 54.110839] RIP: 0010:icmp_timeout_obj_to_nlattr+0x77/0x170 [ 54.116543] Code: b5 41 c7 00 f1 f1 f1 f1 c7 40 04 04 f2 f2 f2 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 e8 30 79 24 fb 4c 89 e8 48 c1 e8 03 <42> 0f b6 14 38 4c 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 [ 54.135481] RSP: 0018:ffff8801ba0af1d0 EFLAGS: 00010246 [ 54.140862] RAX: 0000000000000000 RBX: 1ffff10037415e3b RCX: ffffffff865df764 [ 54.148168] RDX: 0000000000000000 RSI: ffffffff865affd0 RDI: ffff8801d89f5680 [ 54.155484] RBP: ffff8801ba0af260 R08: ffff8801c1020140 R09: ffff8801ba7fa1a8 [ 54.162912] R10: ffffed00374ff434 R11: ffff8801ba7fa1a0 R12: ffff8801d89f5680 [ 54.170216] R13: 0000000000000000 R14: ffff8801ba0af238 R15: dffffc0000000000 [ 54.177561] FS: 0000000000000000(0000) GS:ffff8801dae00000(0063) knlGS:0000000008127840 [ 54.185820] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 54.191720] CR2: 00000000208a7000 CR3: 00000001d5499000 CR4: 00000000001406f0 [ 54.199015] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 54.206418] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 54.213736] Kernel panic - not syncing: Fatal exception [ 54.220330] Kernel Offset: disabled [ 54.223956] Rebooting in 86400 seconds..