[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 91.888084][ T27] audit: type=1800 audit(1579811435.103:25): pid=9335 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 91.908025][ T27] audit: type=1800 audit(1579811435.103:26): pid=9335 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 91.964708][ T27] audit: type=1800 audit(1579811435.103:27): pid=9335 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.51' (ECDSA) to the list of known hosts. executing program executing program syzkaller login: [ 104.327876][ T9492] ================================================================== [ 104.336130][ T9492] BUG: KASAN: slab-out-of-bounds in bitmap_port_ext_cleanup+0xe6/0x2a0 [ 104.344345][ T9492] Read of size 8 at addr ffff8880a9504040 by task syz-executor558/9492 [ 104.352587][ T9492] [ 104.354936][ T9492] CPU: 0 PID: 9492 Comm: syz-executor558 Not tainted 5.5.0-rc6-syzkaller #0 [ 104.363586][ T9492] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 104.373631][ T9492] Call Trace: [ 104.376904][ T9492] dump_stack+0x197/0x210 [ 104.381212][ T9492] ? bitmap_port_ext_cleanup+0xe6/0x2a0 [ 104.386744][ T9492] print_address_description.constprop.0.cold+0xd4/0x30b [ 104.393782][ T9492] ? bitmap_port_ext_cleanup+0xe6/0x2a0 [ 104.399306][ T9492] ? bitmap_port_ext_cleanup+0xe6/0x2a0 [ 104.404953][ T9492] __kasan_report.cold+0x1b/0x41 [ 104.409867][ T9492] ? bitmap_port_ext_cleanup+0xe6/0x2a0 [ 104.415389][ T9492] kasan_report+0x12/0x20 [ 104.419696][ T9492] check_memory_region+0x134/0x1a0 [ 104.424785][ T9492] __kasan_check_read+0x11/0x20 [ 104.429619][ T9492] bitmap_port_ext_cleanup+0xe6/0x2a0 [ 104.434975][ T9492] bitmap_port_destroy+0x180/0x1d0 [ 104.440064][ T9492] ip_set_create+0xe47/0x1500 [ 104.444723][ T9492] ? ip_set_destroy+0xb70/0xb70 [ 104.449569][ T9492] ? ip_set_destroy+0xb70/0xb70 [ 104.454400][ T9492] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 104.459341][ T9492] ? nfnetlink_bind+0x2c0/0x2c0 [ 104.464175][ T9492] ? __kasan_check_read+0x11/0x20 [ 104.469177][ T9492] ? __lock_acquire+0x8a0/0x4a00 [ 104.474098][ T9492] ? save_stack+0x5c/0x90 [ 104.478460][ T9492] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 104.484682][ T9492] ? apparmor_capable+0x497/0x900 [ 104.489694][ T9492] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 104.495912][ T9492] ? __kasan_check_read+0x11/0x20 [ 104.500916][ T9492] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 104.506356][ T9492] netlink_rcv_skb+0x177/0x450 [ 104.511101][ T9492] ? nfnetlink_bind+0x2c0/0x2c0 [ 104.515930][ T9492] ? netlink_ack+0xb50/0xb50 [ 104.520552][ T9492] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 104.526781][ T9492] ? ns_capable_common+0x93/0x100 [ 104.531790][ T9492] ? ns_capable+0x20/0x30 [ 104.536099][ T9492] ? __netlink_ns_capable+0x104/0x140 [ 104.541463][ T9492] nfnetlink_rcv+0x1ba/0x460 [ 104.546040][ T9492] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 104.551475][ T9492] ? netlink_deliver_tap+0x24a/0xbe0 [ 104.556740][ T9492] ? __kasan_check_write+0x14/0x20 [ 104.561834][ T9492] netlink_unicast+0x58c/0x7d0 [ 104.566616][ T9492] ? netlink_attachskb+0x870/0x870 [ 104.571710][ T9492] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 104.577409][ T9492] ? __check_object_size+0x3d/0x437 [ 104.582600][ T9492] netlink_sendmsg+0x91c/0xea0 [ 104.587346][ T9492] ? netlink_unicast+0x7d0/0x7d0 [ 104.592265][ T9492] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 104.597791][ T9492] ? apparmor_socket_sendmsg+0x2a/0x30 [ 104.603225][ T9492] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 104.609443][ T9492] ? security_socket_sendmsg+0x8d/0xc0 [ 104.614882][ T9492] ? netlink_unicast+0x7d0/0x7d0 [ 104.619805][ T9492] sock_sendmsg+0xd7/0x130 [ 104.624224][ T9492] ____sys_sendmsg+0x753/0x880 [ 104.628976][ T9492] ? kernel_sendmsg+0x50/0x50 [ 104.633632][ T9492] ? mark_held_locks+0xa4/0xf0 [ 104.638405][ T9492] ? do_huge_pmd_anonymous_page+0x1463/0x1a50 [ 104.644463][ T9492] ? __handle_mm_fault+0x3145/0x3cc0 [ 104.649726][ T9492] ? do_huge_pmd_anonymous_page+0x1463/0x1a50 [ 104.655774][ T9492] ___sys_sendmsg+0x100/0x170 [ 104.660429][ T9492] ? do_huge_pmd_anonymous_page+0xceb/0x1a50 [ 104.666389][ T9492] ? sendmsg_copy_msghdr+0x70/0x70 [ 104.671495][ T9492] ? __do_page_fault+0x56a/0xd80 [ 104.676422][ T9492] ? find_held_lock+0x35/0x130 [ 104.681171][ T9492] ? __do_page_fault+0x56a/0xd80 [ 104.686098][ T9492] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 104.692318][ T9492] ? __fget_light+0x1a9/0x230 [ 104.696988][ T9492] ? __fdget+0x1b/0x20 [ 104.701037][ T9492] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 104.707258][ T9492] __sys_sendmsg+0x105/0x1d0 [ 104.711828][ T9492] ? __sys_sendmsg_sock+0xc0/0xc0 [ 104.716834][ T9492] ? down_read_non_owner+0x490/0x490 [ 104.722104][ T9492] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 104.727567][ T9492] ? do_syscall_64+0x26/0x790 [ 104.732233][ T9492] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 104.738277][ T9492] ? do_syscall_64+0x26/0x790 [ 104.742945][ T9492] __x64_sys_sendmsg+0x78/0xb0 [ 104.747689][ T9492] do_syscall_64+0xfa/0x790 [ 104.752176][ T9492] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 104.758047][ T9492] RIP: 0033:0x441399 [ 104.761934][ T9492] Code: e8 fc ab 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 9b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 104.781525][ T9492] RSP: 002b:00007ffcce517868 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 104.789923][ T9492] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441399 [ 104.797877][ T9492] RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000003 [ 104.805826][ T9492] RBP: 000000000001975c R08: 00000000004002c8 R09: 00000000004002c8 [ 104.813796][ T9492] R10: 0000000000000004 R11: 0000000000000246 R12: 00000000004021c0 [ 104.821747][ T9492] R13: 0000000000402250 R14: 0000000000000000 R15: 0000000000000000 [ 104.829706][ T9492] [ 104.832013][ T9492] Allocated by task 9492: [ 104.836325][ T9492] save_stack+0x23/0x90 [ 104.840461][ T9492] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 104.846069][ T9492] kasan_kmalloc+0x9/0x10 [ 104.850378][ T9492] __kmalloc+0x163/0x770 [ 104.854608][ T9492] ip_set_alloc+0x38/0x5e [ 104.858962][ T9492] bitmap_port_create+0x3dc/0x7c0 [ 104.863964][ T9492] ip_set_create+0x6f1/0x1500 [ 104.868617][ T9492] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 104.873541][ T9492] netlink_rcv_skb+0x177/0x450 [ 104.878284][ T9492] nfnetlink_rcv+0x1ba/0x460 [ 104.882851][ T9492] netlink_unicast+0x58c/0x7d0 [ 104.887594][ T9492] netlink_sendmsg+0x91c/0xea0 [ 104.892358][ T9492] sock_sendmsg+0xd7/0x130 [ 104.896761][ T9492] ____sys_sendmsg+0x753/0x880 [ 104.901514][ T9492] ___sys_sendmsg+0x100/0x170 [ 104.906173][ T9492] __sys_sendmsg+0x105/0x1d0 [ 104.910744][ T9492] __x64_sys_sendmsg+0x78/0xb0 [ 104.915493][ T9492] do_syscall_64+0xfa/0x790 [ 104.920022][ T9492] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 104.925886][ T9492] [ 104.928195][ T9492] Freed by task 9243: [ 104.932193][ T9492] save_stack+0x23/0x90 [ 104.936327][ T9492] __kasan_slab_free+0x102/0x150 [ 104.941251][ T9492] kasan_slab_free+0xe/0x10 [ 104.945740][ T9492] kfree+0x10a/0x2c0 [ 104.949623][ T9492] security_cred_free+0xa9/0x110 [ 104.954545][ T9492] put_cred_rcu+0x129/0x4b0 [ 104.959028][ T9492] __put_cred+0x1ef/0x270 [ 104.963375][ T9492] do_faccessat+0x693/0x7f0 [ 104.967858][ T9492] __x64_sys_access+0x59/0x80 [ 104.972518][ T9492] do_syscall_64+0xfa/0x790 [ 104.977003][ T9492] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 104.982876][ T9492] [ 104.985193][ T9492] The buggy address belongs to the object at ffff8880a9504040 [ 104.985193][ T9492] which belongs to the cache kmalloc-32 of size 32 [ 104.999057][ T9492] The buggy address is located 0 bytes inside of [ 104.999057][ T9492] 32-byte region [ffff8880a9504040, ffff8880a9504060) [ 105.012050][ T9492] The buggy address belongs to the page: [ 105.017719][ T9492] page:ffffea0002a54100 refcount:1 mapcount:0 mapping:ffff8880aa4001c0 index:0xffff8880a9504fc1 [ 105.028111][ T9492] raw: 00fffe0000000200 ffffea00028c1d48 ffffea0002797c88 ffff8880aa4001c0 [ 105.036677][ T9492] raw: ffff8880a9504fc1 ffff8880a9504000 0000000100000030 0000000000000000 [ 105.045233][ T9492] page dumped because: kasan: bad access detected [ 105.051626][ T9492] [ 105.053955][ T9492] Memory state around the buggy address: [ 105.059562][ T9492] ffff8880a9503f00: fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 105.067612][ T9492] ffff8880a9503f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 105.075679][ T9492] >ffff8880a9504000: fb fb fb fb fc fc fc fc 04 fc fc fc fc fc fc fc [ 105.083719][ T9492] ^ [ 105.089849][ T9492] ffff8880a9504080: 00 00 03 fc fc fc fc fc fb fb fb fb fc fc fc fc [ 105.097887][ T9492] ffff8880a9504100: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 105.105922][ T9492] ================================================================== [ 105.114090][ T9492] Disabling lock debugging due to kernel taint [ 105.120556][ T9492] Kernel panic - not syncing: panic_on_warn set ... [ 105.127142][ T9492] CPU: 0 PID: 9492 Comm: syz-executor558 Tainted: G B 5.5.0-rc6-syzkaller #0 [ 105.137178][ T9492] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 105.147213][ T9492] Call Trace: [ 105.150490][ T9492] dump_stack+0x197/0x210 [ 105.154809][ T9492] panic+0x2e3/0x75c [ 105.158788][ T9492] ? add_taint.cold+0x16/0x16 [ 105.163443][ T9492] ? bitmap_port_ext_cleanup+0xe6/0x2a0 [ 105.168975][ T9492] ? preempt_schedule+0x4b/0x60 [ 105.173818][ T9492] ? ___preempt_schedule+0x16/0x18 [ 105.178909][ T9492] ? trace_hardirqs_on+0x5e/0x240 [ 105.183917][ T9492] ? bitmap_port_ext_cleanup+0xe6/0x2a0 [ 105.189446][ T9492] end_report+0x47/0x4f [ 105.193585][ T9492] ? bitmap_port_ext_cleanup+0xe6/0x2a0 [ 105.199114][ T9492] __kasan_report.cold+0xe/0x41 [ 105.203951][ T9492] ? bitmap_port_ext_cleanup+0xe6/0x2a0 [ 105.209481][ T9492] kasan_report+0x12/0x20 [ 105.213788][ T9492] check_memory_region+0x134/0x1a0 [ 105.218883][ T9492] __kasan_check_read+0x11/0x20 [ 105.223718][ T9492] bitmap_port_ext_cleanup+0xe6/0x2a0 [ 105.229074][ T9492] bitmap_port_destroy+0x180/0x1d0 [ 105.234162][ T9492] ip_set_create+0xe47/0x1500 [ 105.238825][ T9492] ? ip_set_destroy+0xb70/0xb70 [ 105.243699][ T9492] ? ip_set_destroy+0xb70/0xb70 [ 105.248564][ T9492] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 105.253490][ T9492] ? nfnetlink_bind+0x2c0/0x2c0 [ 105.258321][ T9492] ? __kasan_check_read+0x11/0x20 [ 105.263321][ T9492] ? __lock_acquire+0x8a0/0x4a00 [ 105.268238][ T9492] ? save_stack+0x5c/0x90 [ 105.272552][ T9492] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 105.278774][ T9492] ? apparmor_capable+0x497/0x900 [ 105.283784][ T9492] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 105.290004][ T9492] ? __kasan_check_read+0x11/0x20 [ 105.295003][ T9492] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 105.300438][ T9492] netlink_rcv_skb+0x177/0x450 [ 105.305177][ T9492] ? nfnetlink_bind+0x2c0/0x2c0 [ 105.310002][ T9492] ? netlink_ack+0xb50/0xb50 [ 105.314569][ T9492] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 105.320788][ T9492] ? ns_capable_common+0x93/0x100 [ 105.325787][ T9492] ? ns_capable+0x20/0x30 [ 105.330094][ T9492] ? __netlink_ns_capable+0x104/0x140 [ 105.335443][ T9492] nfnetlink_rcv+0x1ba/0x460 [ 105.340100][ T9492] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 105.345539][ T9492] ? netlink_deliver_tap+0x24a/0xbe0 [ 105.350840][ T9492] ? __kasan_check_write+0x14/0x20 [ 105.355958][ T9492] netlink_unicast+0x58c/0x7d0 [ 105.360701][ T9492] ? netlink_attachskb+0x870/0x870 [ 105.365789][ T9492] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 105.371485][ T9492] ? __check_object_size+0x3d/0x437 [ 105.376663][ T9492] netlink_sendmsg+0x91c/0xea0 [ 105.381417][ T9492] ? netlink_unicast+0x7d0/0x7d0 [ 105.386363][ T9492] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 105.391889][ T9492] ? apparmor_socket_sendmsg+0x2a/0x30 [ 105.397322][ T9492] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 105.403548][ T9492] ? security_socket_sendmsg+0x8d/0xc0 [ 105.408997][ T9492] ? netlink_unicast+0x7d0/0x7d0 [ 105.413911][ T9492] sock_sendmsg+0xd7/0x130 [ 105.418340][ T9492] ____sys_sendmsg+0x753/0x880 [ 105.423079][ T9492] ? kernel_sendmsg+0x50/0x50 [ 105.427735][ T9492] ? mark_held_locks+0xa4/0xf0 [ 105.432472][ T9492] ? do_huge_pmd_anonymous_page+0x1463/0x1a50 [ 105.438517][ T9492] ? __handle_mm_fault+0x3145/0x3cc0 [ 105.443799][ T9492] ? do_huge_pmd_anonymous_page+0x1463/0x1a50 [ 105.449864][ T9492] ___sys_sendmsg+0x100/0x170 [ 105.454514][ T9492] ? do_huge_pmd_anonymous_page+0xceb/0x1a50 [ 105.460469][ T9492] ? sendmsg_copy_msghdr+0x70/0x70 [ 105.465565][ T9492] ? __do_page_fault+0x56a/0xd80 [ 105.470477][ T9492] ? find_held_lock+0x35/0x130 [ 105.475221][ T9492] ? __do_page_fault+0x56a/0xd80 [ 105.480145][ T9492] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 105.486382][ T9492] ? __fget_light+0x1a9/0x230 [ 105.491032][ T9492] ? __fdget+0x1b/0x20 [ 105.495075][ T9492] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 105.501292][ T9492] __sys_sendmsg+0x105/0x1d0 [ 105.505860][ T9492] ? __sys_sendmsg_sock+0xc0/0xc0 [ 105.510866][ T9492] ? down_read_non_owner+0x490/0x490 [ 105.516238][ T9492] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 105.521672][ T9492] ? do_syscall_64+0x26/0x790 [ 105.526325][ T9492] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 105.532371][ T9492] ? do_syscall_64+0x26/0x790 [ 105.537025][ T9492] __x64_sys_sendmsg+0x78/0xb0 [ 105.541775][ T9492] do_syscall_64+0xfa/0x790 [ 105.546274][ T9492] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 105.552140][ T9492] RIP: 0033:0x441399 [ 105.556021][ T9492] Code: e8 fc ab 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 9b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 105.575597][ T9492] RSP: 002b:00007ffcce517868 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 105.583982][ T9492] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441399 [ 105.591932][ T9492] RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000003 [ 105.599879][ T9492] RBP: 000000000001975c R08: 00000000004002c8 R09: 00000000004002c8 [ 105.607823][ T9492] R10: 0000000000000004 R11: 0000000000000246 R12: 00000000004021c0 [ 105.615768][ T9492] R13: 0000000000402250 R14: 0000000000000000 R15: 0000000000000000 [ 105.624899][ T9492] Kernel Offset: disabled [ 105.629218][ T9492] Rebooting in 86400 seconds..