[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 87.580742][ T27] audit: type=1800 audit(1579415410.732:25): pid=9519 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 87.600722][ T27] audit: type=1800 audit(1579415410.732:26): pid=9519 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 87.627701][ T27] audit: type=1800 audit(1579415410.732:27): pid=9519 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.16' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 97.374844][ T9675] ================================================================== [ 97.383184][ T9675] BUG: KASAN: slab-out-of-bounds in bitmap_ipmac_list+0x635/0x1080 [ 97.391056][ T9675] Read of size 8 at addr ffff8880953715c0 by task syz-executor828/9675 [ 97.399264][ T9675] [ 97.401579][ T9675] CPU: 1 PID: 9675 Comm: syz-executor828 Not tainted 5.5.0-rc6-syzkaller #0 [ 97.410222][ T9675] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 97.420307][ T9675] Call Trace: [ 97.423584][ T9675] dump_stack+0x197/0x210 [ 97.427893][ T9675] ? bitmap_ipmac_list+0x635/0x1080 [ 97.433076][ T9675] print_address_description.constprop.0.cold+0xd4/0x30b [ 97.440088][ T9675] ? bitmap_ipmac_list+0x635/0x1080 [ 97.445278][ T9675] ? bitmap_ipmac_list+0x635/0x1080 [ 97.450459][ T9675] __kasan_report.cold+0x1b/0x41 [ 97.455379][ T9675] ? bitmap_ipmac_list+0x635/0x1080 [ 97.460565][ T9675] kasan_report+0x12/0x20 [ 97.464954][ T9675] check_memory_region+0x134/0x1a0 [ 97.470048][ T9675] __kasan_check_read+0x11/0x20 [ 97.474878][ T9675] bitmap_ipmac_list+0x635/0x1080 [ 97.479924][ T9675] ? bitmap_ipmac_head+0x8a0/0x8a0 [ 97.485119][ T9675] ? nla_put+0x110/0x150 [ 97.489364][ T9675] ip_set_dump_start+0x96c/0x1ca0 [ 97.494448][ T9675] ? ip_set_rename+0x720/0x720 [ 97.499222][ T9675] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 97.504751][ T9675] ? perf_trace_lock_acquire+0x4a0/0x530 [ 97.510366][ T9675] ? __kasan_check_write+0x14/0x20 [ 97.515551][ T9675] netlink_dump+0x558/0xfb0 [ 97.520131][ T9675] ? __netlink_sendskb+0xc0/0xc0 [ 97.525057][ T9675] __netlink_dump_start+0x66a/0x930 [ 97.530251][ T9675] ip_set_dump+0x15a/0x1d0 [ 97.534649][ T9675] ? call_ad+0x5a0/0x5a0 [ 97.538889][ T9675] ? ip_set_rename+0x720/0x720 [ 97.543630][ T9675] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 97.549418][ T9675] ? call_ad+0x5a0/0x5a0 [ 97.553754][ T9675] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 97.558678][ T9675] ? nfnetlink_bind+0x2c0/0x2c0 [ 97.563514][ T9675] ? __kasan_check_read+0x11/0x20 [ 97.568517][ T9675] ? __lock_acquire+0x8a0/0x4a00 [ 97.573434][ T9675] ? save_stack+0x5c/0x90 [ 97.577853][ T9675] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 97.584086][ T9675] ? apparmor_capable+0x497/0x900 [ 97.589091][ T9675] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 97.595311][ T9675] ? __kasan_check_read+0x11/0x20 [ 97.600324][ T9675] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 97.605778][ T9675] netlink_rcv_skb+0x177/0x450 [ 97.610533][ T9675] ? nfnetlink_bind+0x2c0/0x2c0 [ 97.615363][ T9675] ? netlink_ack+0xb50/0xb50 [ 97.619929][ T9675] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 97.626152][ T9675] ? ns_capable_common+0x93/0x100 [ 97.631154][ T9675] ? ns_capable+0x20/0x30 [ 97.635462][ T9675] ? __netlink_ns_capable+0x104/0x140 [ 97.640814][ T9675] nfnetlink_rcv+0x1ba/0x460 [ 97.645384][ T9675] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 97.650820][ T9675] ? netlink_deliver_tap+0x24a/0xbe0 [ 97.656082][ T9675] ? __kasan_check_write+0x14/0x20 [ 97.661181][ T9675] netlink_unicast+0x58c/0x7d0 [ 97.665928][ T9675] ? netlink_attachskb+0x870/0x870 [ 97.671026][ T9675] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 97.676722][ T9675] ? __check_object_size+0x3d/0x437 [ 97.681925][ T9675] netlink_sendmsg+0x91c/0xea0 [ 97.686673][ T9675] ? netlink_unicast+0x7d0/0x7d0 [ 97.691605][ T9675] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 97.697152][ T9675] ? apparmor_socket_sendmsg+0x2a/0x30 [ 97.702599][ T9675] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 97.708862][ T9675] ? security_socket_sendmsg+0x8d/0xc0 [ 97.714415][ T9675] ? netlink_unicast+0x7d0/0x7d0 [ 97.719353][ T9675] sock_sendmsg+0xd7/0x130 [ 97.723778][ T9675] ____sys_sendmsg+0x753/0x880 [ 97.728531][ T9675] ? kernel_sendmsg+0x50/0x50 [ 97.733248][ T9675] ? lockdep_init_map+0x1be/0x6d0 [ 97.738263][ T9675] ___sys_sendmsg+0x100/0x170 [ 97.742928][ T9675] ? sendmsg_copy_msghdr+0x70/0x70 [ 97.748018][ T9675] ? __kasan_check_read+0x11/0x20 [ 97.753397][ T9675] ? __lock_acquire+0x8a0/0x4a00 [ 97.758314][ T9675] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 97.764544][ T9675] ? __this_cpu_preempt_check+0x35/0x190 [ 97.770169][ T9675] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 97.776389][ T9675] ? percpu_counter_add_batch+0x13c/0x190 [ 97.782107][ T9675] ? __fd_install+0x1bc/0x640 [ 97.786776][ T9675] ? find_held_lock+0x35/0x130 [ 97.791520][ T9675] ? __fd_install+0x1bc/0x640 [ 97.796197][ T9675] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 97.802772][ T9675] ? __fget_light+0x1a9/0x230 [ 97.807430][ T9675] ? __fdget+0x1b/0x20 [ 97.811493][ T9675] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 97.817714][ T9675] __sys_sendmsg+0x105/0x1d0 [ 97.822298][ T9675] ? __sys_sendmsg_sock+0xc0/0xc0 [ 97.827308][ T9675] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 97.832758][ T9675] ? do_syscall_64+0x26/0x790 [ 97.837415][ T9675] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 97.843545][ T9675] ? do_syscall_64+0x26/0x790 [ 97.848203][ T9675] __x64_sys_sendmsg+0x78/0xb0 [ 97.852968][ T9675] do_syscall_64+0xfa/0x790 [ 97.857464][ T9675] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 97.863333][ T9675] RIP: 0033:0x440529 [ 97.867214][ T9675] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 97.886857][ T9675] RSP: 002b:00007ffcadd83088 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 97.895534][ T9675] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440529 [ 97.903615][ T9675] RDX: 0000000000000000 RSI: 0000000020000440 RDI: 0000000000000004 [ 97.912024][ T9675] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 97.919993][ T9675] R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000401db0 [ 97.928031][ T9675] R13: 0000000000401e40 R14: 0000000000000000 R15: 0000000000000000 [ 97.935991][ T9675] [ 97.938301][ T9675] Allocated by task 9675: [ 97.942616][ T9675] save_stack+0x23/0x90 [ 97.949542][ T9675] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 97.955163][ T9675] kasan_kmalloc+0x9/0x10 [ 97.959488][ T9675] __kmalloc+0x163/0x770 [ 97.963708][ T9675] ip_set_alloc+0x38/0x5e [ 97.968017][ T9675] bitmap_ipmac_create+0x4e8/0xa00 [ 97.973103][ T9675] ip_set_create+0x6f1/0x1500 [ 97.977759][ T9675] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 97.982686][ T9675] netlink_rcv_skb+0x177/0x450 [ 97.987440][ T9675] nfnetlink_rcv+0x1ba/0x460 [ 97.992024][ T9675] netlink_unicast+0x58c/0x7d0 [ 97.997065][ T9675] netlink_sendmsg+0x91c/0xea0 [ 98.001824][ T9675] sock_sendmsg+0xd7/0x130 [ 98.006231][ T9675] ____sys_sendmsg+0x753/0x880 [ 98.011035][ T9675] ___sys_sendmsg+0x100/0x170 [ 98.015701][ T9675] __sys_sendmsg+0x105/0x1d0 [ 98.020330][ T9675] __x64_sys_sendmsg+0x78/0xb0 [ 98.025092][ T9675] do_syscall_64+0xfa/0x790 [ 98.029891][ T9675] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 98.035807][ T9675] [ 98.038177][ T9675] Freed by task 9403: [ 98.042161][ T9675] save_stack+0x23/0x90 [ 98.046411][ T9675] __kasan_slab_free+0x102/0x150 [ 98.051364][ T9675] kasan_slab_free+0xe/0x10 [ 98.055856][ T9675] kfree+0x10a/0x2c0 [ 98.059770][ T9675] tomoyo_check_open_permission+0x19e/0x3e0 [ 98.065687][ T9675] tomoyo_file_open+0xa9/0xd0 [ 98.070358][ T9675] security_file_open+0x71/0x300 [ 98.075297][ T9675] do_dentry_open+0x37a/0x1380 [ 98.080055][ T9675] vfs_open+0xa0/0xd0 [ 98.084026][ T9675] path_openat+0x118b/0x3180 [ 98.088611][ T9675] do_filp_open+0x1a1/0x280 [ 98.093127][ T9675] do_sys_open+0x3fe/0x5d0 [ 98.097525][ T9675] __x64_sys_open+0x7e/0xc0 [ 98.102025][ T9675] do_syscall_64+0xfa/0x790 [ 98.106615][ T9675] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 98.112690][ T9675] [ 98.115013][ T9675] The buggy address belongs to the object at ffff8880953715c0 [ 98.115013][ T9675] which belongs to the cache kmalloc-32 of size 32 [ 98.129154][ T9675] The buggy address is located 0 bytes inside of [ 98.129154][ T9675] 32-byte region [ffff8880953715c0, ffff8880953715e0) [ 98.142439][ T9675] The buggy address belongs to the page: [ 98.148069][ T9675] page:ffffea000254dc40 refcount:1 mapcount:0 mapping:ffff8880aa4001c0 index:0xffff888095371fc1 [ 98.158689][ T9675] raw: 00fffe0000000200 ffffea0002a28148 ffffea00029f5048 ffff8880aa4001c0 [ 98.167270][ T9675] raw: ffff888095371fc1 ffff888095371000 000000010000003e 0000000000000000 [ 98.176609][ T9675] page dumped because: kasan: bad access detected [ 98.183069][ T9675] [ 98.185401][ T9675] Memory state around the buggy address: [ 98.191420][ T9675] ffff888095371480: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 98.199545][ T9675] ffff888095371500: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 98.207823][ T9675] >ffff888095371580: fb fb fb fb fc fc fc fc 04 fc fc fc fc fc fc fc [ 98.215875][ T9675] ^ [ 98.222138][ T9675] ffff888095371600: fb fb fb fb fc fc fc fc 00 01 fc fc fc fc fc fc [ 98.230230][ T9675] ffff888095371680: 00 01 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 98.238273][ T9675] ================================================================== [ 98.246316][ T9675] Disabling lock debugging due to kernel taint [ 98.253275][ T9675] Kernel panic - not syncing: panic_on_warn set ... [ 98.259873][ T9675] CPU: 1 PID: 9675 Comm: syz-executor828 Tainted: G B 5.5.0-rc6-syzkaller #0 [ 98.269906][ T9675] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 98.279937][ T9675] Call Trace: [ 98.283227][ T9675] dump_stack+0x197/0x210 [ 98.287573][ T9675] panic+0x2e3/0x75c [ 98.291467][ T9675] ? add_taint.cold+0x16/0x16 [ 98.296123][ T9675] ? bitmap_ipmac_list+0x635/0x1080 [ 98.301298][ T9675] ? preempt_schedule+0x4b/0x60 [ 98.306124][ T9675] ? ___preempt_schedule+0x16/0x18 [ 98.311212][ T9675] ? trace_hardirqs_on+0x5e/0x240 [ 98.316211][ T9675] ? bitmap_ipmac_list+0x635/0x1080 [ 98.321384][ T9675] end_report+0x47/0x4f [ 98.325528][ T9675] ? bitmap_ipmac_list+0x635/0x1080 [ 98.330701][ T9675] __kasan_report.cold+0xe/0x41 [ 98.335524][ T9675] ? bitmap_ipmac_list+0x635/0x1080 [ 98.342431][ T9675] kasan_report+0x12/0x20 [ 98.346750][ T9675] check_memory_region+0x134/0x1a0 [ 98.351924][ T9675] __kasan_check_read+0x11/0x20 [ 98.356750][ T9675] bitmap_ipmac_list+0x635/0x1080 [ 98.361753][ T9675] ? bitmap_ipmac_head+0x8a0/0x8a0 [ 98.366838][ T9675] ? nla_put+0x110/0x150 [ 98.371057][ T9675] ip_set_dump_start+0x96c/0x1ca0 [ 98.376057][ T9675] ? ip_set_rename+0x720/0x720 [ 98.380811][ T9675] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 98.386334][ T9675] ? perf_trace_lock_acquire+0x4a0/0x530 [ 98.391940][ T9675] ? __kasan_check_write+0x14/0x20 [ 98.397025][ T9675] netlink_dump+0x558/0xfb0 [ 98.401517][ T9675] ? __netlink_sendskb+0xc0/0xc0 [ 98.406441][ T9675] __netlink_dump_start+0x66a/0x930 [ 98.411627][ T9675] ip_set_dump+0x15a/0x1d0 [ 98.416025][ T9675] ? call_ad+0x5a0/0x5a0 [ 98.420259][ T9675] ? ip_set_rename+0x720/0x720 [ 98.425006][ T9675] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 98.430790][ T9675] ? call_ad+0x5a0/0x5a0 [ 98.435027][ T9675] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 98.439952][ T9675] ? nfnetlink_bind+0x2c0/0x2c0 [ 98.444783][ T9675] ? __kasan_check_read+0x11/0x20 [ 98.449785][ T9675] ? __lock_acquire+0x8a0/0x4a00 [ 98.454700][ T9675] ? save_stack+0x5c/0x90 [ 98.459068][ T9675] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 98.465299][ T9675] ? apparmor_capable+0x497/0x900 [ 98.470491][ T9675] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 98.476720][ T9675] ? __kasan_check_read+0x11/0x20 [ 98.481737][ T9675] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 98.487180][ T9675] netlink_rcv_skb+0x177/0x450 [ 98.491929][ T9675] ? nfnetlink_bind+0x2c0/0x2c0 [ 98.496772][ T9675] ? netlink_ack+0xb50/0xb50 [ 98.501353][ T9675] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 98.507589][ T9675] ? ns_capable_common+0x93/0x100 [ 98.512595][ T9675] ? ns_capable+0x20/0x30 [ 98.516912][ T9675] ? __netlink_ns_capable+0x104/0x140 [ 98.522271][ T9675] nfnetlink_rcv+0x1ba/0x460 [ 98.526851][ T9675] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 98.532326][ T9675] ? netlink_deliver_tap+0x24a/0xbe0 [ 98.537647][ T9675] ? __kasan_check_write+0x14/0x20 [ 98.542767][ T9675] netlink_unicast+0x58c/0x7d0 [ 98.547655][ T9675] ? netlink_attachskb+0x870/0x870 [ 98.552764][ T9675] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 98.558517][ T9675] ? __check_object_size+0x3d/0x437 [ 98.563713][ T9675] netlink_sendmsg+0x91c/0xea0 [ 98.568516][ T9675] ? netlink_unicast+0x7d0/0x7d0 [ 98.573442][ T9675] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 98.578977][ T9675] ? apparmor_socket_sendmsg+0x2a/0x30 [ 98.584434][ T9675] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 98.590962][ T9675] ? security_socket_sendmsg+0x8d/0xc0 [ 98.596458][ T9675] ? netlink_unicast+0x7d0/0x7d0 [ 98.601471][ T9675] sock_sendmsg+0xd7/0x130 [ 98.606010][ T9675] ____sys_sendmsg+0x753/0x880 [ 98.610867][ T9675] ? kernel_sendmsg+0x50/0x50 [ 98.615533][ T9675] ? lockdep_init_map+0x1be/0x6d0 [ 98.620547][ T9675] ___sys_sendmsg+0x100/0x170 [ 98.625201][ T9675] ? sendmsg_copy_msghdr+0x70/0x70 [ 98.630344][ T9675] ? __kasan_check_read+0x11/0x20 [ 98.635361][ T9675] ? __lock_acquire+0x8a0/0x4a00 [ 98.640279][ T9675] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 98.646501][ T9675] ? __this_cpu_preempt_check+0x35/0x190 [ 98.652124][ T9675] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 98.658411][ T9675] ? percpu_counter_add_batch+0x13c/0x190 [ 98.664112][ T9675] ? __fd_install+0x1bc/0x640 [ 98.668767][ T9675] ? find_held_lock+0x35/0x130 [ 98.673512][ T9675] ? __fd_install+0x1bc/0x640 [ 98.678173][ T9675] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 98.684405][ T9675] ? __fget_light+0x1a9/0x230 [ 98.689071][ T9675] ? __fdget+0x1b/0x20 [ 98.693118][ T9675] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 98.699334][ T9675] __sys_sendmsg+0x105/0x1d0 [ 98.703912][ T9675] ? __sys_sendmsg_sock+0xc0/0xc0 [ 98.708917][ T9675] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 98.714350][ T9675] ? do_syscall_64+0x26/0x790 [ 98.719015][ T9675] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 98.725054][ T9675] ? do_syscall_64+0x26/0x790 [ 98.729721][ T9675] __x64_sys_sendmsg+0x78/0xb0 [ 98.734461][ T9675] do_syscall_64+0xfa/0x790 [ 98.738941][ T9675] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 98.744862][ T9675] RIP: 0033:0x440529 [ 98.748758][ T9675] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 98.768630][ T9675] RSP: 002b:00007ffcadd83088 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 98.777019][ T9675] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440529 [ 98.784976][ T9675] RDX: 0000000000000000 RSI: 0000000020000440 RDI: 0000000000000004 [ 98.792943][ T9675] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 98.800898][ T9675] R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000401db0 [ 98.808849][ T9675] R13: 0000000000401e40 R14: 0000000000000000 R15: 0000000000000000 [ 98.818266][ T9675] Kernel Offset: disabled [ 98.822607][ T9675] Rebooting in 86400 seconds..