[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 84.028075][ T23] audit: type=1800 audit(1579414969.828:25): pid=9456 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 84.065151][ T23] audit: type=1800 audit(1579414969.828:26): pid=9456 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 84.108739][ T23] audit: type=1800 audit(1579414969.828:27): pid=9456 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.1.12' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 92.495377][ T9610] ================================================================== [ 92.503544][ T9610] BUG: KASAN: slab-out-of-bounds in bitmap_ip_list+0x40f/0xf20 [ 92.511084][ T9610] Read of size 8 at addr ffff888095b96740 by task syz-executor681/9610 [ 92.519295][ T9610] [ 92.521610][ T9610] CPU: 1 PID: 9610 Comm: syz-executor681 Not tainted 5.5.0-rc6-syzkaller #0 [ 92.530263][ T9610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 92.540389][ T9610] Call Trace: [ 92.543664][ T9610] dump_stack+0x197/0x210 [ 92.547976][ T9610] ? bitmap_ip_list+0x40f/0xf20 [ 92.552815][ T9610] print_address_description.constprop.0.cold+0xd4/0x30b [ 92.559820][ T9610] ? bitmap_ip_list+0x40f/0xf20 [ 92.564704][ T9610] ? bitmap_ip_list+0x40f/0xf20 [ 92.569537][ T9610] __kasan_report.cold+0x1b/0x41 [ 92.574452][ T9610] ? bitmap_ip_list+0x40f/0xf20 [ 92.579298][ T9610] kasan_report+0x12/0x20 [ 92.583680][ T9610] check_memory_region+0x134/0x1a0 [ 92.588794][ T9610] __kasan_check_read+0x11/0x20 [ 92.593631][ T9610] bitmap_ip_list+0x40f/0xf20 [ 92.598319][ T9610] ? bitmap_ip_add+0xe60/0xe60 [ 92.603101][ T9610] ? nla_put+0x110/0x150 [ 92.607353][ T9610] ip_set_dump_start+0x96c/0x1ca0 [ 92.612449][ T9610] ? ip_set_rename+0x720/0x720 [ 92.617210][ T9610] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 92.622778][ T9610] ? perf_trace_lock_acquire+0x4a0/0x530 [ 92.628400][ T9610] ? __kasan_check_write+0x14/0x20 [ 92.633495][ T9610] netlink_dump+0x558/0xfb0 [ 92.637993][ T9610] ? __netlink_sendskb+0xc0/0xc0 [ 92.646665][ T9610] __netlink_dump_start+0x66a/0x930 [ 92.651864][ T9610] ip_set_dump+0x15a/0x1d0 [ 92.656278][ T9610] ? call_ad+0x5a0/0x5a0 [ 92.660552][ T9610] ? ip_set_rename+0x720/0x720 [ 92.665446][ T9610] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 92.671242][ T9610] ? call_ad+0x5a0/0x5a0 [ 92.675528][ T9610] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 92.680456][ T9610] ? nfnetlink_bind+0x2c0/0x2c0 [ 92.685296][ T9610] ? __kasan_check_read+0x11/0x20 [ 92.690320][ T9610] ? __lock_acquire+0x8a0/0x4a00 [ 92.695257][ T9610] ? save_stack+0x5c/0x90 [ 92.699570][ T9610] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 92.705795][ T9610] ? apparmor_capable+0x497/0x900 [ 92.711161][ T9610] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 92.717477][ T9610] ? __kasan_check_read+0x11/0x20 [ 92.722494][ T9610] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 92.727947][ T9610] netlink_rcv_skb+0x177/0x450 [ 92.732785][ T9610] ? nfnetlink_bind+0x2c0/0x2c0 [ 92.737633][ T9610] ? netlink_ack+0xb50/0xb50 [ 92.742305][ T9610] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 92.748536][ T9610] ? ns_capable_common+0x93/0x100 [ 92.753552][ T9610] ? ns_capable+0x20/0x30 [ 92.757868][ T9610] ? __netlink_ns_capable+0x104/0x140 [ 92.763242][ T9610] nfnetlink_rcv+0x1ba/0x460 [ 92.767844][ T9610] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 92.773303][ T9610] ? netlink_deliver_tap+0x24a/0xbe0 [ 92.778762][ T9610] ? __kasan_check_write+0x14/0x20 [ 92.784390][ T9610] netlink_unicast+0x58c/0x7d0 [ 92.789195][ T9610] ? netlink_attachskb+0x870/0x870 [ 92.794645][ T9610] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 92.800359][ T9610] ? __check_object_size+0x3d/0x437 [ 92.805551][ T9610] netlink_sendmsg+0x91c/0xea0 [ 92.810489][ T9610] ? netlink_unicast+0x7d0/0x7d0 [ 92.815430][ T9610] ? security_socket_sendmsg+0x79/0xc0 [ 92.820902][ T9610] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 92.827915][ T9610] ? security_socket_sendmsg+0x8d/0xc0 [ 92.833364][ T9610] ? netlink_unicast+0x7d0/0x7d0 [ 92.838293][ T9610] sock_sendmsg+0xd7/0x130 [ 92.842696][ T9610] ____sys_sendmsg+0x753/0x880 [ 92.847449][ T9610] ? kernel_sendmsg+0x50/0x50 [ 92.852294][ T9610] ? lockdep_init_map+0x1be/0x6d0 [ 92.857318][ T9610] ___sys_sendmsg+0x100/0x170 [ 92.862005][ T9610] ? sendmsg_copy_msghdr+0x70/0x70 [ 92.867230][ T9610] ? __kasan_check_read+0x11/0x20 [ 92.872245][ T9610] ? __lock_acquire+0x8a0/0x4a00 [ 92.877185][ T9610] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 92.883464][ T9610] ? __this_cpu_preempt_check+0x35/0x190 [ 92.889082][ T9610] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 92.895310][ T9610] ? percpu_counter_add_batch+0x13c/0x190 [ 92.901030][ T9610] ? __fd_install+0x1bc/0x640 [ 92.905703][ T9610] ? find_held_lock+0x35/0x130 [ 92.910606][ T9610] ? __fd_install+0x1bc/0x640 [ 92.915281][ T9610] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 92.921500][ T9610] ? __fget_light+0x1a9/0x230 [ 92.926164][ T9610] ? __fdget+0x1b/0x20 [ 92.930389][ T9610] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 92.936628][ T9610] __sys_sendmsg+0x105/0x1d0 [ 92.941216][ T9610] ? __sys_sendmsg_sock+0xc0/0xc0 [ 92.946423][ T9610] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 92.951883][ T9610] ? do_syscall_64+0x26/0x790 [ 92.956558][ T9610] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 92.962618][ T9610] ? do_syscall_64+0x26/0x790 [ 92.967306][ T9610] __x64_sys_sendmsg+0x78/0xb0 [ 92.972048][ T9610] do_syscall_64+0xfa/0x790 [ 92.976547][ T9610] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 92.982416][ T9610] RIP: 0033:0x440559 [ 92.986291][ T9610] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 93.005886][ T9610] RSP: 002b:00007fffe58915d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 93.014277][ T9610] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440559 [ 93.022225][ T9610] RDX: 0000000000000080 RSI: 00000000200000c0 RDI: 0000000000000004 [ 93.030176][ T9610] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 93.038127][ T9610] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000401de0 [ 93.046094][ T9610] R13: 0000000000401e70 R14: 0000000000000000 R15: 0000000000000000 [ 93.054051][ T9610] [ 93.056375][ T9610] Allocated by task 9610: [ 93.060698][ T9610] save_stack+0x23/0x90 [ 93.064850][ T9610] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 93.070457][ T9610] kasan_kmalloc+0x9/0x10 [ 93.074778][ T9610] __kmalloc+0x163/0x770 [ 93.079000][ T9610] ip_set_alloc+0x38/0x5e [ 93.083321][ T9610] bitmap_ip_create+0x6ec/0xc20 [ 93.088162][ T9610] ip_set_create+0x6f1/0x1500 [ 93.092841][ T9610] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 93.097763][ T9610] netlink_rcv_skb+0x177/0x450 [ 93.102536][ T9610] nfnetlink_rcv+0x1ba/0x460 [ 93.107123][ T9610] netlink_unicast+0x58c/0x7d0 [ 93.111913][ T9610] netlink_sendmsg+0x91c/0xea0 [ 93.116697][ T9610] sock_sendmsg+0xd7/0x130 [ 93.121106][ T9610] ____sys_sendmsg+0x753/0x880 [ 93.125851][ T9610] ___sys_sendmsg+0x100/0x170 [ 93.130517][ T9610] __sys_sendmsg+0x105/0x1d0 [ 93.135099][ T9610] __x64_sys_sendmsg+0x78/0xb0 [ 93.139900][ T9610] do_syscall_64+0xfa/0x790 [ 93.144387][ T9610] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 93.150658][ T9610] [ 93.152979][ T9610] Freed by task 9352: [ 93.156993][ T9610] save_stack+0x23/0x90 [ 93.161145][ T9610] __kasan_slab_free+0x102/0x150 [ 93.166065][ T9610] kasan_slab_free+0xe/0x10 [ 93.170600][ T9610] kfree+0x10a/0x2c0 [ 93.174489][ T9610] tomoyo_supervisor+0xc2c/0xef0 [ 93.179414][ T9610] tomoyo_path_permission+0x263/0x360 [ 93.184765][ T9610] tomoyo_path_perm+0x318/0x430 [ 93.189600][ T9610] tomoyo_inode_getattr+0x1d/0x30 [ 93.194667][ T9610] security_inode_getattr+0xf2/0x150 [ 93.199947][ T9610] vfs_getattr+0x25/0x70 [ 93.204180][ T9610] vfs_statx_fd+0x71/0xc0 [ 93.208494][ T9610] __do_sys_newfstat+0x9b/0x120 [ 93.213483][ T9610] __x64_sys_newfstat+0x54/0x80 [ 93.218411][ T9610] do_syscall_64+0xfa/0x790 [ 93.222900][ T9610] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 93.228769][ T9610] [ 93.231078][ T9610] The buggy address belongs to the object at ffff888095b96740 [ 93.231078][ T9610] which belongs to the cache kmalloc-32 of size 32 [ 93.245054][ T9610] The buggy address is located 0 bytes inside of [ 93.245054][ T9610] 32-byte region [ffff888095b96740, ffff888095b96760) [ 93.258056][ T9610] The buggy address belongs to the page: [ 93.263703][ T9610] page:ffffea000256e580 refcount:1 mapcount:0 mapping:ffff8880aa4001c0 index:0xffff888095b96fc1 [ 93.274105][ T9610] raw: 00fffe0000000200 ffffea000280cb48 ffffea000255ca48 ffff8880aa4001c0 [ 93.282714][ T9610] raw: ffff888095b96fc1 ffff888095b96000 000000010000002a 0000000000000000 [ 93.291309][ T9610] page dumped because: kasan: bad access detected [ 93.297700][ T9610] [ 93.300010][ T9610] Memory state around the buggy address: [ 93.305632][ T9610] ffff888095b96600: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 93.313674][ T9610] ffff888095b96680: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 93.321717][ T9610] >ffff888095b96700: fb fb fb fb fc fc fc fc 04 fc fc fc fc fc fc fc [ 93.329755][ T9610] ^ [ 93.335893][ T9610] ffff888095b96780: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 93.344053][ T9610] ffff888095b96800: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 93.353437][ T9610] ================================================================== [ 93.361479][ T9610] Disabling lock debugging due to kernel taint [ 93.369317][ T9610] Kernel panic - not syncing: panic_on_warn set ... [ 93.375914][ T9610] CPU: 0 PID: 9610 Comm: syz-executor681 Tainted: G B 5.5.0-rc6-syzkaller #0 [ 93.386098][ T9610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 93.396145][ T9610] Call Trace: [ 93.399418][ T9610] dump_stack+0x197/0x210 [ 93.403777][ T9610] panic+0x2e3/0x75c [ 93.407680][ T9610] ? add_taint.cold+0x16/0x16 [ 93.412337][ T9610] ? bitmap_ip_list+0x40f/0xf20 [ 93.417172][ T9610] ? preempt_schedule+0x4b/0x60 [ 93.422003][ T9610] ? ___preempt_schedule+0x16/0x18 [ 93.427093][ T9610] ? trace_hardirqs_on+0x5e/0x240 [ 93.432095][ T9610] ? bitmap_ip_list+0x40f/0xf20 [ 93.436928][ T9610] end_report+0x47/0x4f [ 93.441056][ T9610] ? bitmap_ip_list+0x40f/0xf20 [ 93.445884][ T9610] __kasan_report.cold+0xe/0x41 [ 93.450728][ T9610] ? bitmap_ip_list+0x40f/0xf20 [ 93.455577][ T9610] kasan_report+0x12/0x20 [ 93.459889][ T9610] check_memory_region+0x134/0x1a0 [ 93.464980][ T9610] __kasan_check_read+0x11/0x20 [ 93.469817][ T9610] bitmap_ip_list+0x40f/0xf20 [ 93.474476][ T9610] ? bitmap_ip_add+0xe60/0xe60 [ 93.479217][ T9610] ? nla_put+0x110/0x150 [ 93.483450][ T9610] ip_set_dump_start+0x96c/0x1ca0 [ 93.488453][ T9610] ? ip_set_rename+0x720/0x720 [ 93.493210][ T9610] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 93.498749][ T9610] ? perf_trace_lock_acquire+0x4a0/0x530 [ 93.504357][ T9610] ? __kasan_check_write+0x14/0x20 [ 93.509447][ T9610] netlink_dump+0x558/0xfb0 [ 93.513926][ T9610] ? __netlink_sendskb+0xc0/0xc0 [ 93.518867][ T9610] __netlink_dump_start+0x66a/0x930 [ 93.524053][ T9610] ip_set_dump+0x15a/0x1d0 [ 93.528458][ T9610] ? call_ad+0x5a0/0x5a0 [ 93.532683][ T9610] ? ip_set_rename+0x720/0x720 [ 93.537438][ T9610] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 93.543222][ T9610] ? call_ad+0x5a0/0x5a0 [ 93.547443][ T9610] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 93.552357][ T9610] ? nfnetlink_bind+0x2c0/0x2c0 [ 93.557361][ T9610] ? __kasan_check_read+0x11/0x20 [ 93.562374][ T9610] ? __lock_acquire+0x8a0/0x4a00 [ 93.567286][ T9610] ? save_stack+0x5c/0x90 [ 93.571607][ T9610] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 93.577849][ T9610] ? apparmor_capable+0x497/0x900 [ 93.582850][ T9610] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 93.589078][ T9610] ? __kasan_check_read+0x11/0x20 [ 93.594097][ T9610] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 93.599550][ T9610] netlink_rcv_skb+0x177/0x450 [ 93.604298][ T9610] ? nfnetlink_bind+0x2c0/0x2c0 [ 93.609136][ T9610] ? netlink_ack+0xb50/0xb50 [ 93.613759][ T9610] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 93.619980][ T9610] ? ns_capable_common+0x93/0x100 [ 93.624980][ T9610] ? ns_capable+0x20/0x30 [ 93.629291][ T9610] ? __netlink_ns_capable+0x104/0x140 [ 93.634641][ T9610] nfnetlink_rcv+0x1ba/0x460 [ 93.639225][ T9610] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 93.644668][ T9610] ? netlink_deliver_tap+0x24a/0xbe0 [ 93.649937][ T9610] ? __kasan_check_write+0x14/0x20 [ 93.655043][ T9610] netlink_unicast+0x58c/0x7d0 [ 93.659797][ T9610] ? netlink_attachskb+0x870/0x870 [ 93.664886][ T9610] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 93.670589][ T9610] ? __check_object_size+0x3d/0x437 [ 93.675767][ T9610] netlink_sendmsg+0x91c/0xea0 [ 93.680506][ T9610] ? netlink_unicast+0x7d0/0x7d0 [ 93.685423][ T9610] ? security_socket_sendmsg+0x79/0xc0 [ 93.690858][ T9610] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 93.697085][ T9610] ? security_socket_sendmsg+0x8d/0xc0 [ 93.702526][ T9610] ? netlink_unicast+0x7d0/0x7d0 [ 93.707442][ T9610] sock_sendmsg+0xd7/0x130 [ 93.711839][ T9610] ____sys_sendmsg+0x753/0x880 [ 93.716586][ T9610] ? kernel_sendmsg+0x50/0x50 [ 93.721256][ T9610] ? lockdep_init_map+0x1be/0x6d0 [ 93.726290][ T9610] ___sys_sendmsg+0x100/0x170 [ 93.731012][ T9610] ? sendmsg_copy_msghdr+0x70/0x70 [ 93.736137][ T9610] ? __kasan_check_read+0x11/0x20 [ 93.741138][ T9610] ? __lock_acquire+0x8a0/0x4a00 [ 93.746057][ T9610] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 93.752293][ T9610] ? __this_cpu_preempt_check+0x35/0x190 [ 93.757921][ T9610] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 93.764140][ T9610] ? percpu_counter_add_batch+0x13c/0x190 [ 93.769840][ T9610] ? __fd_install+0x1bc/0x640 [ 93.774509][ T9610] ? find_held_lock+0x35/0x130 [ 93.779282][ T9610] ? __fd_install+0x1bc/0x640 [ 93.783956][ T9610] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 93.790191][ T9610] ? __fget_light+0x1a9/0x230 [ 93.794850][ T9610] ? __fdget+0x1b/0x20 [ 93.798950][ T9610] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 93.805234][ T9610] __sys_sendmsg+0x105/0x1d0 [ 93.809807][ T9610] ? __sys_sendmsg_sock+0xc0/0xc0 [ 93.814842][ T9610] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 93.820307][ T9610] ? do_syscall_64+0x26/0x790 [ 93.824961][ T9610] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 93.831006][ T9610] ? do_syscall_64+0x26/0x790 [ 93.835673][ T9610] __x64_sys_sendmsg+0x78/0xb0 [ 93.840416][ T9610] do_syscall_64+0xfa/0x790 [ 93.844898][ T9610] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 93.850785][ T9610] RIP: 0033:0x440559 [ 93.854663][ T9610] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 93.874240][ T9610] RSP: 002b:00007fffe58915d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 93.882627][ T9610] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440559 [ 93.890587][ T9610] RDX: 0000000000000080 RSI: 00000000200000c0 RDI: 0000000000000004 [ 93.898534][ T9610] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 93.906494][ T9610] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000401de0 [ 93.914439][ T9610] R13: 0000000000401e70 R14: 0000000000000000 R15: 0000000000000000 [ 93.923788][ T9610] Kernel Offset: disabled [ 93.928111][ T9610] Rebooting in 86400 seconds..