[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 59.279936][ T26] audit: type=1800 audit(1574440552.891:25): pid=8871 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 59.322327][ T26] audit: type=1800 audit(1574440552.891:26): pid=8871 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 59.367988][ T26] audit: type=1800 audit(1574440552.891:27): pid=8871 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.1.62' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 69.852014][ T9028] ------------[ cut here ]------------ [ 69.857852][ T9028] refcount_t: underflow; use-after-free. [ 69.864693][ T9028] WARNING: CPU: 1 PID: 9028 at lib/refcount.c:190 refcount_sub_and_test_checked+0x1d0/0x200 [ 69.874759][ T9028] Kernel panic - not syncing: panic_on_warn set ... [ 69.881343][ T9028] CPU: 1 PID: 9028 Comm: syz-executor436 Not tainted 5.4.0-rc8-syzkaller #0 [ 69.890052][ T9028] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 69.900290][ T9028] Call Trace: [ 69.903584][ T9028] dump_stack+0x197/0x210 [ 69.907904][ T9028] ? refcount_sub_and_test_checked+0x100/0x200 [ 69.914242][ T9028] panic+0x2e3/0x75c [ 69.918131][ T9028] ? add_taint.cold+0x16/0x16 [ 69.922838][ T9028] ? __kasan_check_write+0x14/0x20 [ 69.927971][ T9028] ? __warn.cold+0x14/0x35 [ 69.932392][ T9028] ? __warn+0xd9/0x1d0 [ 69.936446][ T9028] ? refcount_sub_and_test_checked+0x1d0/0x200 [ 69.942580][ T9028] __warn.cold+0x2f/0x35 [ 69.946804][ T9028] ? refcount_sub_and_test_checked+0x1d0/0x200 [ 69.952947][ T9028] report_bug+0x289/0x300 [ 69.957258][ T9028] do_error_trap+0x11b/0x200 [ 69.961831][ T9028] do_invalid_op+0x37/0x50 [ 69.966232][ T9028] ? refcount_sub_and_test_checked+0x1d0/0x200 [ 69.972380][ T9028] invalid_op+0x23/0x30 [ 69.976541][ T9028] RIP: 0010:refcount_sub_and_test_checked+0x1d0/0x200 [ 69.983297][ T9028] Code: 1d 30 da 7d 06 31 ff 89 de e8 3c 9b 2e fe 84 db 75 94 e8 f3 99 2e fe 48 c7 c7 40 b9 e6 87 c6 05 10 da 7d 06 01 e8 08 cd ff fd <0f> 0b e9 75 ff ff ff e8 d4 99 2e fe e9 6e ff ff ff 48 89 df e8 17 [ 70.003229][ T9028] RSP: 0018:ffff8880a7157540 EFLAGS: 00010282 [ 70.009276][ T9028] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 70.017252][ T9028] RDX: 0000000000000000 RSI: ffffffff815cf766 RDI: ffffed1014e2ae9a [ 70.025218][ T9028] RBP: ffff8880a71575d8 R08: ffff88809a9161c0 R09: ffffed1015d26159 [ 70.033189][ T9028] R10: ffffed1015d26158 R11: ffff8880ae930ac7 R12: 00000000ffffff01 [ 70.041143][ T9028] R13: 0000000000000001 R14: ffff8880a71575b0 R15: 0000000000008001 [ 70.049143][ T9028] ? vprintk_func+0x86/0x189 [ 70.053743][ T9028] ? refcount_dec_not_one+0x1f0/0x1f0 [ 70.059878][ T9028] ? refcount_sub_and_test_checked+0x154/0x200 [ 70.066030][ T9028] ? refcount_dec_not_one+0x1f0/0x1f0 [ 70.071404][ T9028] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 70.077995][ T9028] sock_wfree+0xc3/0x190 [ 70.082230][ T9028] sctp_wfree+0x336/0x920 [ 70.086541][ T9028] ? __sctp_write_space+0x5e0/0x5e0 [ 70.091723][ T9028] skb_release_head_state+0xeb/0x260 [ 70.097018][ T9028] skb_release_all+0x16/0x60 [ 70.101591][ T9028] consume_skb+0xfb/0x3b0 [ 70.105902][ T9028] sctp_chunk_put+0x192/0x280 [ 70.110561][ T9028] sctp_chunk_free+0x56/0x70 [ 70.116093][ T9028] __sctp_outq_teardown+0x1d0/0xc60 [ 70.121280][ T9028] sctp_outq_free+0x16/0x20 [ 70.125771][ T9028] sctp_association_free+0x208/0x79a [ 70.131138][ T9028] sctp_do_sm+0x3a75/0x5170 [ 70.135682][ T9028] ? __kmalloc_node_track_caller+0x3d/0x70 [ 70.141503][ T9028] ? sctp_do_8_2_transport_strike.isra.0+0x940/0x940 [ 70.148175][ T9028] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 70.154415][ T9028] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 70.160573][ T9028] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 70.166193][ T9028] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 70.172161][ T9028] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 70.177957][ T9028] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 70.183678][ T9028] ? sctp_init_cause+0x1ae/0x230 [ 70.188614][ T9028] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 70.194462][ T9028] ? skb_put+0x177/0x1d0 [ 70.198701][ T9028] ? memcpy+0x46/0x50 [ 70.202701][ T9028] sctp_primitive_ABORT+0xa0/0xd0 [ 70.207721][ T9028] sctp_close+0x259/0x880 [ 70.213153][ T9028] ? sctp_accept+0x710/0x710 [ 70.217759][ T9028] ? __kasan_check_write+0x14/0x20 [ 70.222893][ T9028] ? down_write+0xdf/0x150 [ 70.227298][ T9028] ? ip_mc_drop_socket+0x211/0x270 [ 70.232425][ T9028] inet_release+0xed/0x200 [ 70.236842][ T9028] __sock_release+0xce/0x280 [ 70.241414][ T9028] sock_close+0x1e/0x30 [ 70.246210][ T9028] __fput+0x2ff/0x890 [ 70.250785][ T9028] ? __sock_release+0x280/0x280 [ 70.255637][ T9028] ____fput+0x16/0x20 [ 70.259616][ T9028] task_work_run+0x145/0x1c0 [ 70.264228][ T9028] do_exit+0x904/0x2e60 [ 70.268428][ T9028] ? mm_update_next_owner+0x640/0x640 [ 70.273943][ T9028] ? __sys_getsockopt+0x1b2/0x310 [ 70.279097][ T9028] ? kernel_accept+0x310/0x310 [ 70.283972][ T9028] ? handle_mm_fault+0x4b0/0xaa0 [ 70.288930][ T9028] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 70.294393][ T9028] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 70.299935][ T9028] do_group_exit+0x135/0x360 [ 70.304517][ T9028] __x64_sys_exit_group+0x44/0x50 [ 70.309532][ T9028] do_syscall_64+0xfa/0x760 [ 70.314070][ T9028] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 70.319943][ T9028] RIP: 0033:0x43f268 [ 70.323828][ T9028] Code: Bad RIP value. [ 70.327902][ T9028] RSP: 002b:00007ffee4490a98 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 70.336541][ T9028] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043f268 [ 70.344518][ T9028] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 70.352495][ T9028] RBP: 00000000004bea68 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 70.360451][ T9028] R10: 000000002059aff8 R11: 0000000000000246 R12: 0000000000000001 [ 70.368417][ T9028] R13: 00000000006d01a0 R14: 0000000000000000 R15: 0000000000000000 [ 70.377773][ T9028] Kernel Offset: disabled [ 70.382195][ T9028] Rebooting in 86400 seconds..