[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 89.135010][ T27] audit: type=1800 audit(1579350393.407:25): pid=9523 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 89.160870][ T27] audit: type=1800 audit(1579350393.407:26): pid=9523 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 89.215976][ T27] audit: type=1800 audit(1579350393.417:27): pid=9523 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.162' (ECDSA) to the list of known hosts. executing program executing program syzkaller login: [ 99.758204][ T9676] ================================================================== [ 99.766418][ T9676] BUG: KASAN: slab-out-of-bounds in bitmap_port_list+0x3cf/0xdb0 [ 99.774223][ T9676] Read of size 8 at addr ffff8880a947c040 by task syz-executor092/9676 [ 99.782470][ T9676] [ 99.784861][ T9676] CPU: 1 PID: 9676 Comm: syz-executor092 Not tainted 5.5.0-rc6-syzkaller #0 [ 99.793696][ T9676] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 99.803780][ T9676] Call Trace: [ 99.807067][ T9676] dump_stack+0x197/0x210 [ 99.811392][ T9676] ? bitmap_port_list+0x3cf/0xdb0 [ 99.816418][ T9676] print_address_description.constprop.0.cold+0xd4/0x30b [ 99.823439][ T9676] ? bitmap_port_list+0x3cf/0xdb0 [ 99.828807][ T9676] ? bitmap_port_list+0x3cf/0xdb0 [ 99.833842][ T9676] __kasan_report.cold+0x1b/0x41 [ 99.838776][ T9676] ? bitmap_port_list+0x3cf/0xdb0 [ 99.843822][ T9676] kasan_report+0x12/0x20 [ 99.848151][ T9676] check_memory_region+0x134/0x1a0 [ 99.853261][ T9676] __kasan_check_read+0x11/0x20 [ 99.858106][ T9676] bitmap_port_list+0x3cf/0xdb0 [ 99.862953][ T9676] ? bitmap_port_head+0x296/0x600 [ 99.867991][ T9676] ? bitmap_port_del+0x380/0x380 [ 99.872935][ T9676] ? nla_put+0x110/0x150 [ 99.877176][ T9676] ip_set_dump_start+0x96c/0x1ca0 [ 99.882301][ T9676] ? ip_set_rename+0x720/0x720 [ 99.887073][ T9676] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 99.892650][ T9676] ? perf_trace_lock_acquire+0x4c0/0x530 [ 99.898275][ T9676] ? __kasan_check_write+0x14/0x20 [ 99.903380][ T9676] netlink_dump+0x558/0xfb0 [ 99.907969][ T9676] ? __netlink_sendskb+0xc0/0xc0 [ 99.912920][ T9676] __netlink_dump_start+0x66a/0x930 [ 99.918246][ T9676] ip_set_dump+0x15a/0x1d0 [ 99.922683][ T9676] ? call_ad+0x5a0/0x5a0 [ 99.926928][ T9676] ? ip_set_rename+0x720/0x720 [ 99.931888][ T9676] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 99.937699][ T9676] ? call_ad+0x5a0/0x5a0 [ 99.941938][ T9676] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 99.946887][ T9676] ? nfnetlink_bind+0x2c0/0x2c0 [ 99.951866][ T9676] ? __kasan_check_read+0x11/0x20 [ 99.957111][ T9676] ? __lock_acquire+0x8a0/0x4a00 [ 99.962043][ T9676] ? save_stack+0x5c/0x90 [ 99.966371][ T9676] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 99.972949][ T9676] ? apparmor_capable+0x497/0x900 [ 99.978006][ T9676] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 99.984248][ T9676] ? __kasan_check_read+0x11/0x20 [ 99.989269][ T9676] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 99.994792][ T9676] netlink_rcv_skb+0x177/0x450 [ 99.999569][ T9676] ? nfnetlink_bind+0x2c0/0x2c0 [ 100.004439][ T9676] ? netlink_ack+0xb50/0xb50 [ 100.009018][ T9676] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 100.015273][ T9676] ? ns_capable_common+0x93/0x100 [ 100.020306][ T9676] ? ns_capable+0x20/0x30 [ 100.024685][ T9676] ? __netlink_ns_capable+0x104/0x140 [ 100.030119][ T9676] nfnetlink_rcv+0x1ba/0x460 [ 100.034762][ T9676] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 100.040249][ T9676] ? netlink_deliver_tap+0x24a/0xbe0 [ 100.045620][ T9676] ? __kasan_check_write+0x14/0x20 [ 100.050729][ T9676] netlink_unicast+0x58c/0x7d0 [ 100.055836][ T9676] ? netlink_attachskb+0x870/0x870 [ 100.060962][ T9676] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 100.066677][ T9676] ? __check_object_size+0x3d/0x437 [ 100.071989][ T9676] netlink_sendmsg+0x91c/0xea0 [ 100.076763][ T9676] ? netlink_unicast+0x7d0/0x7d0 [ 100.081705][ T9676] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 100.087239][ T9676] ? apparmor_socket_sendmsg+0x2a/0x30 [ 100.092696][ T9676] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 100.098931][ T9676] ? security_socket_sendmsg+0x8d/0xc0 [ 100.104384][ T9676] ? netlink_unicast+0x7d0/0x7d0 [ 100.109540][ T9676] sock_sendmsg+0xd7/0x130 [ 100.113957][ T9676] ____sys_sendmsg+0x753/0x880 [ 100.119050][ T9676] ? kernel_sendmsg+0x50/0x50 [ 100.123719][ T9676] ? mark_held_locks+0xa4/0xf0 [ 100.128499][ T9676] ? do_huge_pmd_anonymous_page+0x1463/0x1a50 [ 100.134558][ T9676] ? __handle_mm_fault+0x3145/0x3cc0 [ 100.139833][ T9676] ? do_huge_pmd_anonymous_page+0x1463/0x1a50 [ 100.146773][ T9676] ___sys_sendmsg+0x100/0x170 [ 100.151546][ T9676] ? do_huge_pmd_anonymous_page+0xceb/0x1a50 [ 100.157658][ T9676] ? sendmsg_copy_msghdr+0x70/0x70 [ 100.162902][ T9676] ? __do_page_fault+0x56a/0xd80 [ 100.167830][ T9676] ? find_held_lock+0x35/0x130 [ 100.172596][ T9676] ? __do_page_fault+0x56a/0xd80 [ 100.177535][ T9676] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 100.184239][ T9676] ? __fget_light+0x1a9/0x230 [ 100.188919][ T9676] ? __fdget+0x1b/0x20 [ 100.192989][ T9676] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 100.199226][ T9676] __sys_sendmsg+0x105/0x1d0 [ 100.204014][ T9676] ? __sys_sendmsg_sock+0xc0/0xc0 [ 100.209077][ T9676] ? down_read_non_owner+0x490/0x490 [ 100.214483][ T9676] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 100.220209][ T9676] ? do_syscall_64+0x26/0x790 [ 100.224972][ T9676] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 100.231118][ T9676] ? do_syscall_64+0x26/0x790 [ 100.235806][ T9676] __x64_sys_sendmsg+0x78/0xb0 [ 100.240578][ T9676] do_syscall_64+0xfa/0x790 [ 100.245081][ T9676] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 100.250994][ T9676] RIP: 0033:0x441499 [ 100.254892][ T9676] Code: e8 fc ab 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 9b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 100.274921][ T9676] RSP: 002b:00007ffdbe6f6368 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 100.283328][ T9676] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441499 [ 100.291306][ T9676] RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003 [ 100.299291][ T9676] RBP: 000000000001857e R08: 00000000004002c8 R09: 00000000004002c8 [ 100.307268][ T9676] R10: 0000000000000004 R11: 0000000000000246 R12: 00000000004022c0 [ 100.315249][ T9676] R13: 0000000000402350 R14: 0000000000000000 R15: 0000000000000000 [ 100.323221][ T9676] [ 100.325537][ T9676] Allocated by task 9675: [ 100.329856][ T9676] save_stack+0x23/0x90 [ 100.334025][ T9676] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 100.339669][ T9676] kasan_kmalloc+0x9/0x10 [ 100.344004][ T9676] __kmalloc+0x163/0x770 [ 100.348257][ T9676] ip_set_alloc+0x38/0x5e [ 100.352597][ T9676] bitmap_port_create+0x3dc/0x7c0 [ 100.357640][ T9676] ip_set_create+0x6f1/0x1500 [ 100.362337][ T9676] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 100.367266][ T9676] netlink_rcv_skb+0x177/0x450 [ 100.372036][ T9676] nfnetlink_rcv+0x1ba/0x460 [ 100.376628][ T9676] netlink_unicast+0x58c/0x7d0 [ 100.381404][ T9676] netlink_sendmsg+0x91c/0xea0 [ 100.386170][ T9676] sock_sendmsg+0xd7/0x130 [ 100.390604][ T9676] ____sys_sendmsg+0x753/0x880 [ 100.395678][ T9676] ___sys_sendmsg+0x100/0x170 [ 100.400379][ T9676] __sys_sendmsg+0x105/0x1d0 [ 100.404964][ T9676] __x64_sys_sendmsg+0x78/0xb0 [ 100.409805][ T9676] do_syscall_64+0xfa/0x790 [ 100.414343][ T9676] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 100.420215][ T9676] [ 100.422535][ T9676] Freed by task 9407: [ 100.426612][ T9676] save_stack+0x23/0x90 [ 100.431282][ T9676] __kasan_slab_free+0x102/0x150 [ 100.436224][ T9676] kasan_slab_free+0xe/0x10 [ 100.440713][ T9676] kfree+0x10a/0x2c0 [ 100.444702][ T9676] tomoyo_check_open_permission+0x19e/0x3e0 [ 100.450735][ T9676] tomoyo_file_open+0xa9/0xd0 [ 100.455453][ T9676] security_file_open+0x71/0x300 [ 100.460482][ T9676] do_dentry_open+0x37a/0x1380 [ 100.465244][ T9676] vfs_open+0xa0/0xd0 [ 100.469277][ T9676] path_openat+0x118b/0x3180 [ 100.473860][ T9676] do_filp_open+0x1a1/0x280 [ 100.478502][ T9676] do_sys_open+0x3fe/0x5d0 [ 100.483042][ T9676] __x64_sys_open+0x7e/0xc0 [ 100.487577][ T9676] do_syscall_64+0xfa/0x790 [ 100.492132][ T9676] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 100.498153][ T9676] [ 100.500487][ T9676] The buggy address belongs to the object at ffff8880a947c040 [ 100.500487][ T9676] which belongs to the cache kmalloc-32 of size 32 [ 100.515720][ T9676] The buggy address is located 0 bytes inside of [ 100.515720][ T9676] 32-byte region [ffff8880a947c040, ffff8880a947c060) [ 100.529056][ T9676] The buggy address belongs to the page: [ 100.535034][ T9676] page:ffffea0002a51f00 refcount:1 mapcount:0 mapping:ffff8880aa4001c0 index:0xffff8880a947cfc1 [ 100.545725][ T9676] raw: 00fffe0000000200 ffffea0002786a88 ffffea00025e24c8 ffff8880aa4001c0 [ 100.554395][ T9676] raw: ffff8880a947cfc1 ffff8880a947c000 000000010000003d 0000000000000000 [ 100.563075][ T9676] page dumped because: kasan: bad access detected [ 100.569489][ T9676] [ 100.572052][ T9676] Memory state around the buggy address: [ 100.577705][ T9676] ffff8880a947bf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 100.586038][ T9676] ffff8880a947bf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 100.594330][ T9676] >ffff8880a947c000: fb fb fb fb fc fc fc fc 04 fc fc fc fc fc fc fc [ 100.602453][ T9676] ^ [ 100.608910][ T9676] ffff8880a947c080: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 100.617909][ T9676] ffff8880a947c100: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 100.626546][ T9676] ================================================================== [ 100.634999][ T9676] Disabling lock debugging due to kernel taint [ 100.641992][ T9676] Kernel panic - not syncing: panic_on_warn set ... [ 100.649006][ T9676] CPU: 1 PID: 9676 Comm: syz-executor092 Tainted: G B 5.5.0-rc6-syzkaller #0 [ 100.659529][ T9676] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 100.672075][ T9676] Call Trace: [ 100.675537][ T9676] dump_stack+0x197/0x210 [ 100.680195][ T9676] panic+0x2e3/0x75c [ 100.684682][ T9676] ? add_taint.cold+0x16/0x16 [ 100.689688][ T9676] ? bitmap_port_list+0x3cf/0xdb0 [ 100.694915][ T9676] ? preempt_schedule+0x4b/0x60 [ 100.700362][ T9676] ? ___preempt_schedule+0x16/0x18 [ 100.705487][ T9676] ? trace_hardirqs_on+0x5e/0x240 [ 100.717474][ T9676] ? bitmap_port_list+0x3cf/0xdb0 [ 100.722604][ T9676] end_report+0x47/0x4f [ 100.726882][ T9676] ? bitmap_port_list+0x3cf/0xdb0 [ 100.732197][ T9676] __kasan_report.cold+0xe/0x41 [ 100.737090][ T9676] ? bitmap_port_list+0x3cf/0xdb0 [ 100.742216][ T9676] kasan_report+0x12/0x20 [ 100.747083][ T9676] check_memory_region+0x134/0x1a0 [ 100.752191][ T9676] __kasan_check_read+0x11/0x20 [ 100.757266][ T9676] bitmap_port_list+0x3cf/0xdb0 [ 100.762531][ T9676] ? bitmap_port_head+0x296/0x600 [ 100.767564][ T9676] ? bitmap_port_del+0x380/0x380 [ 100.772848][ T9676] ? nla_put+0x110/0x150 [ 100.777362][ T9676] ip_set_dump_start+0x96c/0x1ca0 [ 100.786062][ T9676] ? ip_set_rename+0x720/0x720 [ 100.791602][ T9676] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 100.797525][ T9676] ? perf_trace_lock_acquire+0x4c0/0x530 [ 100.803323][ T9676] ? __kasan_check_write+0x14/0x20 [ 100.809145][ T9676] netlink_dump+0x558/0xfb0 [ 100.813778][ T9676] ? __netlink_sendskb+0xc0/0xc0 [ 100.820608][ T9676] __netlink_dump_start+0x66a/0x930 [ 100.825806][ T9676] ip_set_dump+0x15a/0x1d0 [ 100.830304][ T9676] ? call_ad+0x5a0/0x5a0 [ 100.834805][ T9676] ? ip_set_rename+0x720/0x720 [ 100.839643][ T9676] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 100.846326][ T9676] ? call_ad+0x5a0/0x5a0 [ 100.852424][ T9676] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 100.857573][ T9676] ? nfnetlink_bind+0x2c0/0x2c0 [ 100.863245][ T9676] ? __kasan_check_read+0x11/0x20 [ 100.868264][ T9676] ? __lock_acquire+0x8a0/0x4a00 [ 100.873332][ T9676] ? save_stack+0x5c/0x90 [ 100.877746][ T9676] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 100.884053][ T9676] ? apparmor_capable+0x497/0x900 [ 100.890287][ T9676] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 100.896894][ T9676] ? __kasan_check_read+0x11/0x20 [ 100.902007][ T9676] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 100.907489][ T9676] netlink_rcv_skb+0x177/0x450 [ 100.912781][ T9676] ? nfnetlink_bind+0x2c0/0x2c0 [ 100.918629][ T9676] ? netlink_ack+0xb50/0xb50 [ 100.923212][ T9676] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 100.929528][ T9676] ? ns_capable_common+0x93/0x100 [ 100.934678][ T9676] ? ns_capable+0x20/0x30 [ 100.940198][ T9676] ? __netlink_ns_capable+0x104/0x140 [ 100.945690][ T9676] nfnetlink_rcv+0x1ba/0x460 [ 100.950278][ T9676] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 100.955767][ T9676] ? netlink_deliver_tap+0x24a/0xbe0 [ 100.961269][ T9676] ? __kasan_check_write+0x14/0x20 [ 100.967022][ T9676] netlink_unicast+0x58c/0x7d0 [ 100.971869][ T9676] ? netlink_attachskb+0x870/0x870 [ 100.976972][ T9676] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 100.982706][ T9676] ? __check_object_size+0x3d/0x437 [ 100.988028][ T9676] netlink_sendmsg+0x91c/0xea0 [ 100.992900][ T9676] ? netlink_unicast+0x7d0/0x7d0 [ 100.998054][ T9676] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 101.003594][ T9676] ? apparmor_socket_sendmsg+0x2a/0x30 [ 101.009051][ T9676] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 101.015331][ T9676] ? security_socket_sendmsg+0x8d/0xc0 [ 101.020795][ T9676] ? netlink_unicast+0x7d0/0x7d0 [ 101.025738][ T9676] sock_sendmsg+0xd7/0x130 [ 101.030144][ T9676] ____sys_sendmsg+0x753/0x880 [ 101.035044][ T9676] ? kernel_sendmsg+0x50/0x50 [ 101.039883][ T9676] ? mark_held_locks+0xa4/0xf0 [ 101.046291][ T9676] ? do_huge_pmd_anonymous_page+0x1463/0x1a50 [ 101.052559][ T9676] ? __handle_mm_fault+0x3145/0x3cc0 [ 101.057836][ T9676] ? do_huge_pmd_anonymous_page+0x1463/0x1a50 [ 101.063913][ T9676] ___sys_sendmsg+0x100/0x170 [ 101.068701][ T9676] ? do_huge_pmd_anonymous_page+0xceb/0x1a50 [ 101.074762][ T9676] ? sendmsg_copy_msghdr+0x70/0x70 [ 101.079863][ T9676] ? __do_page_fault+0x56a/0xd80 [ 101.084866][ T9676] ? find_held_lock+0x35/0x130 [ 101.089646][ T9676] ? __do_page_fault+0x56a/0xd80 [ 101.094588][ T9676] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 101.100813][ T9676] ? __fget_light+0x1a9/0x230 [ 101.105518][ T9676] ? __fdget+0x1b/0x20 [ 101.109577][ T9676] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 101.115894][ T9676] __sys_sendmsg+0x105/0x1d0 [ 101.120482][ T9676] ? __sys_sendmsg_sock+0xc0/0xc0 [ 101.125620][ T9676] ? down_read_non_owner+0x490/0x490 [ 101.131006][ T9676] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 101.136493][ T9676] ? do_syscall_64+0x26/0x790 [ 101.141159][ T9676] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 101.147218][ T9676] ? do_syscall_64+0x26/0x790 [ 101.151979][ T9676] __x64_sys_sendmsg+0x78/0xb0 [ 101.156766][ T9676] do_syscall_64+0xfa/0x790 [ 101.161261][ T9676] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 101.167138][ T9676] RIP: 0033:0x441499 [ 101.171051][ T9676] Code: e8 fc ab 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 9b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 101.190751][ T9676] RSP: 002b:00007ffdbe6f6368 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 101.199155][ T9676] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441499 [ 101.207577][ T9676] RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003 [ 101.215554][ T9676] RBP: 000000000001857e R08: 00000000004002c8 R09: 00000000004002c8 [ 101.223516][ T9676] R10: 0000000000000004 R11: 0000000000000246 R12: 00000000004022c0 [ 101.231485][ T9676] R13: 0000000000402350 R14: 0000000000000000 R15: 0000000000000000 [ 101.241024][ T9676] Kernel Offset: disabled [ 101.245478][ T9676] Rebooting in 86400 seconds..