[ 38.538710][ T26] audit: type=1800 audit(1553091606.409:27): pid=7650 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [ 38.565259][ T26] audit: type=1800 audit(1553091606.409:28): pid=7650 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2417 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 39.204099][ T26] audit: type=1800 audit(1553091607.129:29): pid=7650 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 39.224235][ T26] audit: type=1800 audit(1553091607.129:30): pid=7650 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.15.227' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 49.514687][ T7] ================================================================== [ 49.522925][ T7] BUG: KASAN: use-after-free in tipc_sk_filter_rcv+0x2166/0x34f0 [ 49.531023][ T7] Read of size 4 at addr ffff8880a89edbb4 by task kworker/u4:0/7 [ 49.538726][ T7] [ 49.541062][ T7] CPU: 1 PID: 7 Comm: kworker/u4:0 Not tainted 5.1.0-rc1-next-20190320 #7 [ 49.549546][ T7] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 49.559611][ T7] Workqueue: tipc_send tipc_conn_send_work [ 49.565407][ T7] Call Trace: [ 49.568701][ T7] dump_stack+0x172/0x1f0 [ 49.573029][ T7] ? tipc_sk_filter_rcv+0x2166/0x34f0 [ 49.578744][ T7] print_address_description.cold+0x7c/0x20d [ 49.584724][ T7] ? tipc_sk_filter_rcv+0x2166/0x34f0 [ 49.590093][ T7] ? tipc_sk_filter_rcv+0x2166/0x34f0 [ 49.595464][ T7] kasan_report.cold+0x1b/0x40 [ 49.600233][ T7] ? tipc_sk_filter_rcv+0x2166/0x34f0 [ 49.605603][ T7] __asan_report_load4_noabort+0x14/0x20 [ 49.611232][ T7] tipc_sk_filter_rcv+0x2166/0x34f0 [ 49.616550][ T7] ? tipc_sk_overlimit2+0xa0/0xa0 [ 49.621690][ T7] ? __local_bh_enable_ip+0x15a/0x270 [ 49.627061][ T7] ? lockdep_hardirqs_on+0x19e/0x5d0 [ 49.632338][ T7] ? tipc_sk_rcv+0x562/0x25a0 [ 49.637019][ T7] ? __local_bh_enable_ip+0x15a/0x270 [ 49.642390][ T7] tipc_sk_rcv+0xc45/0x25a0 [ 49.646902][ T7] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 49.653141][ T7] ? tipc_sk_filter_rcv+0x34f0/0x34f0 [ 49.658511][ T7] ? __alloc_skb+0x3cd/0x5e0 [ 49.663097][ T7] ? skb_trim+0x190/0x190 [ 49.667429][ T7] ? memset+0x32/0x40 [ 49.671426][ T7] ? tipc_msg_init+0x190/0x1d0 [ 49.676191][ T7] ? lockdep_init_map+0x1be/0x6d0 [ 49.681219][ T7] tipc_topsrv_kern_evt+0x3b7/0x580 [ 49.686415][ T7] ? tipc_conn_recv_work+0x100/0x100 [ 49.691703][ T7] ? __local_bh_enable_ip+0x15a/0x270 [ 49.697078][ T7] ? tipc_conn_send_to_sock+0x389/0x5f0 [ 49.702631][ T7] tipc_conn_send_to_sock+0x43e/0x5f0 [ 49.708016][ T7] ? tipc_topsrv_kern_evt+0x580/0x580 [ 49.713402][ T7] tipc_conn_send_work+0x65/0x80 [ 49.718336][ T7] process_one_work+0x98e/0x1790 [ 49.723284][ T7] ? pwq_dec_nr_in_flight+0x320/0x320 [ 49.728655][ T7] ? lock_acquire+0x16f/0x3f0 [ 49.733340][ T7] worker_thread+0x98/0xe40 [ 49.737851][ T7] kthread+0x357/0x430 [ 49.741911][ T7] ? process_one_work+0x1790/0x1790 [ 49.747102][ T7] ? kthread_cancel_delayed_work_sync+0x20/0x20 [ 49.753429][ T7] ret_from_fork+0x3a/0x50 [ 49.757849][ T7] [ 49.760186][ T7] Allocated by task 7: [ 49.764250][ T7] save_stack+0x45/0xd0 [ 49.768402][ T7] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 49.774026][ T7] kasan_kmalloc+0x9/0x10 [ 49.778347][ T7] __kmalloc_node_track_caller+0x4e/0x70 [ 49.783970][ T7] __kmalloc_reserve.isra.0+0x40/0xf0 [ 49.789423][ T7] __alloc_skb+0x10b/0x5e0 [ 49.793871][ T7] tipc_buf_acquire+0x2f/0x100 [ 49.798626][ T7] tipc_msg_create+0x38/0x270 [ 49.803300][ T7] tipc_topsrv_kern_evt+0x2a7/0x580 [ 49.808489][ T7] tipc_conn_send_to_sock+0x43e/0x5f0 [ 49.813850][ T7] tipc_conn_send_work+0x65/0x80 [ 49.819201][ T7] process_one_work+0x98e/0x1790 [ 49.824130][ T7] worker_thread+0x98/0xe40 [ 49.828625][ T7] kthread+0x357/0x430 [ 49.832690][ T7] ret_from_fork+0x3a/0x50 [ 49.837092][ T7] [ 49.839408][ T7] Freed by task 7: [ 49.843161][ T7] save_stack+0x45/0xd0 [ 49.847316][ T7] __kasan_slab_free+0x102/0x150 [ 49.852245][ T7] kasan_slab_free+0xe/0x10 [ 49.856755][ T7] kfree+0xcf/0x230 [ 49.860564][ T7] skb_free_head+0x93/0xb0 [ 49.864972][ T7] skb_release_data+0x576/0x7a0 [ 49.869814][ T7] skb_release_all+0x4d/0x60 [ 49.874392][ T7] kfree_skb+0xe8/0x390 [ 49.878548][ T7] tipc_sk_filter_rcv+0x1e6a/0x34f0 [ 49.883737][ T7] tipc_sk_rcv+0xc45/0x25a0 [ 49.888234][ T7] tipc_topsrv_kern_evt+0x3b7/0x580 [ 49.893429][ T7] tipc_conn_send_to_sock+0x43e/0x5f0 [ 49.898794][ T7] tipc_conn_send_work+0x65/0x80 [ 49.903727][ T7] process_one_work+0x98e/0x1790 [ 49.908660][ T7] worker_thread+0x98/0xe40 [ 49.913156][ T7] kthread+0x357/0x430 [ 49.917223][ T7] ret_from_fork+0x3a/0x50 [ 49.921620][ T7] [ 49.923942][ T7] The buggy address belongs to the object at ffff8880a89edb00 [ 49.923942][ T7] which belongs to the cache kmalloc-1k of size 1024 [ 49.937987][ T7] The buggy address is located 180 bytes inside of [ 49.937987][ T7] 1024-byte region [ffff8880a89edb00, ffff8880a89edf00) [ 49.951330][ T7] The buggy address belongs to the page: [ 49.956956][ T7] page:ffffea0002a27b00 count:1 mapcount:0 mapping:ffff88812c3f0ac0 index:0x0 compound_mapcount: 0 [ 49.967617][ T7] flags: 0x1fffc0000010200(slab|head) [ 49.972989][ T7] raw: 01fffc0000010200 ffffea0002319708 ffff88812c3f1848 ffff88812c3f0ac0 [ 49.981567][ T7] raw: 0000000000000000 ffff8880a89ec000 0000000100000007 0000000000000000 [ 49.990138][ T7] page dumped because: kasan: bad access detected [ 49.996535][ T7] [ 49.998853][ T7] Memory state around the buggy address: [ 50.004475][ T7] ffff8880a89eda80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 50.012526][ T7] ffff8880a89edb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.020586][ T7] >ffff8880a89edb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.028632][ T7] ^ [ 50.034254][ T7] ffff8880a89edc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.042312][ T7] ffff8880a89edc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.050369][ T7] ================================================================== [ 50.058414][ T7] Disabling lock debugging due to kernel taint [ 50.064610][ T7] Kernel panic - not syncing: panic_on_warn set ... [ 50.071193][ T7] CPU: 1 PID: 7 Comm: kworker/u4:0 Tainted: G B 5.1.0-rc1-next-20190320 #7 [ 50.081068][ T7] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 50.091126][ T7] Workqueue: tipc_send tipc_conn_send_work [ 50.096914][ T7] Call Trace: [ 50.100198][ T7] dump_stack+0x172/0x1f0 [ 50.104523][ T7] panic+0x2cb/0x65c [ 50.108414][ T7] ? __warn_printk+0xf3/0xf3 [ 50.112999][ T7] ? trace_hardirqs_on+0x5e/0x230 [ 50.118030][ T7] ? trace_hardirqs_on+0x5e/0x230 [ 50.123050][ T7] ? tipc_sk_filter_rcv+0x2166/0x34f0 [ 50.128414][ T7] end_report+0x47/0x4f [ 50.132563][ T7] ? tipc_sk_filter_rcv+0x2166/0x34f0 [ 50.137923][ T7] kasan_report.cold+0xe/0x40 [ 50.142594][ T7] ? tipc_sk_filter_rcv+0x2166/0x34f0 [ 50.147961][ T7] __asan_report_load4_noabort+0x14/0x20 [ 50.153581][ T7] tipc_sk_filter_rcv+0x2166/0x34f0 [ 50.158776][ T7] ? tipc_sk_overlimit2+0xa0/0xa0 [ 50.163798][ T7] ? __local_bh_enable_ip+0x15a/0x270 [ 50.169161][ T7] ? lockdep_hardirqs_on+0x19e/0x5d0 [ 50.174438][ T7] ? tipc_sk_rcv+0x562/0x25a0 [ 50.179107][ T7] ? __local_bh_enable_ip+0x15a/0x270 [ 50.184488][ T7] tipc_sk_rcv+0xc45/0x25a0 [ 50.188992][ T7] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 50.195228][ T7] ? tipc_sk_filter_rcv+0x34f0/0x34f0 [ 50.200593][ T7] ? __alloc_skb+0x3cd/0x5e0 [ 50.205175][ T7] ? skb_trim+0x190/0x190 [ 50.209504][ T7] ? memset+0x32/0x40 [ 50.213487][ T7] ? tipc_msg_init+0x190/0x1d0 [ 50.218246][ T7] ? lockdep_init_map+0x1be/0x6d0 [ 50.223268][ T7] tipc_topsrv_kern_evt+0x3b7/0x580 [ 50.228465][ T7] ? tipc_conn_recv_work+0x100/0x100 [ 50.233744][ T7] ? __local_bh_enable_ip+0x15a/0x270 [ 50.239113][ T7] ? tipc_conn_send_to_sock+0x389/0x5f0 [ 50.244655][ T7] tipc_conn_send_to_sock+0x43e/0x5f0 [ 50.250021][ T7] ? tipc_topsrv_kern_evt+0x580/0x580 [ 50.255394][ T7] tipc_conn_send_work+0x65/0x80 [ 50.260328][ T7] process_one_work+0x98e/0x1790 [ 50.265261][ T7] ? pwq_dec_nr_in_flight+0x320/0x320 [ 50.270627][ T7] ? lock_acquire+0x16f/0x3f0 [ 50.275302][ T7] worker_thread+0x98/0xe40 [ 50.279804][ T7] kthread+0x357/0x430 [ 50.283885][ T7] ? process_one_work+0x1790/0x1790 [ 50.289076][ T7] ? kthread_cancel_delayed_work_sync+0x20/0x20 [ 50.295316][ T7] ret_from_fork+0x3a/0x50 [ 50.300404][ T7] Kernel Offset: disabled [ 50.304722][ T7] Rebooting in 86400 seconds..