Warning: Permanently added '10.128.0.214' (ECDSA) to the list of known hosts. executing program executing program syzkaller login: [ 73.520639][ T8828] ================================================================== [ 73.528992][ T8828] BUG: KASAN: slab-out-of-bounds in bitmap_port_destroy+0x1d2/0x3c0 [ 73.536959][ T8828] Read of size 8 at addr ffff88809e7c2080 by task syz-executor377/8828 [ 73.545221][ T8828] [ 73.547538][ T8828] CPU: 1 PID: 8828 Comm: syz-executor377 Not tainted 5.5.0-rc7-syzkaller #0 [ 73.556187][ T8828] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 73.566232][ T8828] Call Trace: [ 73.569516][ T8828] dump_stack+0x1fb/0x318 [ 73.573900][ T8828] print_address_description+0x74/0x5c0 [ 73.579446][ T8828] ? vprintk_default+0x28/0x30 [ 73.584203][ T8828] ? vprintk_func+0x158/0x170 [ 73.589023][ T8828] ? printk+0x62/0x8d [ 73.593013][ T8828] __kasan_report+0x149/0x1c0 [ 73.597785][ T8828] ? ip_set_type_unregister+0x3c0/0x3e0 [ 73.603366][ T8828] ? bitmap_port_destroy+0x1d2/0x3c0 [ 73.608779][ T8828] kasan_report+0x26/0x50 [ 73.613113][ T8828] check_memory_region+0x2b6/0x2f0 [ 73.618269][ T8828] __kasan_check_read+0x11/0x20 [ 73.623108][ T8828] bitmap_port_destroy+0x1d2/0x3c0 [ 73.628215][ T8828] ip_set_create+0xae0/0xfd0 [ 73.632821][ T8828] ? ip_set_protocol+0x5b0/0x5b0 [ 73.637759][ T8828] nfnetlink_rcv_msg+0x9ae/0xcd0 [ 73.642727][ T8828] ? cap_capable+0x25b/0x290 [ 73.647384][ T8828] ? cap_capable+0x25b/0x290 [ 73.652141][ T8828] netlink_rcv_skb+0x19e/0x3e0 [ 73.656898][ T8828] ? nfnetlink_bind+0x250/0x250 [ 73.661761][ T8828] nfnetlink_rcv+0x1e0/0x1e50 [ 73.666521][ T8828] ? rcu_lock_release+0x9/0x30 [ 73.671280][ T8828] ? rcu_lock_release+0x21/0x30 [ 73.676120][ T8828] ? netlink_deliver_tap+0x142/0x880 [ 73.681395][ T8828] netlink_unicast+0x767/0x920 [ 73.686147][ T8828] netlink_sendmsg+0xa2c/0xd50 [ 73.690893][ T8828] ? netlink_getsockopt+0x9f0/0x9f0 [ 73.696125][ T8828] ____sys_sendmsg+0x4f7/0x7f0 [ 73.700878][ T8828] __sys_sendmsg+0x1ed/0x290 [ 73.705508][ T8828] ? up_read+0x1d/0x20 [ 73.709556][ T8828] ? do_user_addr_fault+0x654/0xaf0 [ 73.714743][ T8828] ? check_preemption_disabled+0xb4/0x260 [ 73.720459][ T8828] ? debug_smp_processor_id+0x9/0x20 [ 73.725772][ T8828] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 73.731218][ T8828] ? trace_irq_disable_rcuidle+0x23/0x1e0 [ 73.736974][ T8828] ? do_syscall_64+0x1d/0x1c0 [ 73.741743][ T8828] __x64_sys_sendmsg+0x7f/0x90 [ 73.746509][ T8828] do_syscall_64+0xf7/0x1c0 [ 73.750998][ T8828] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 73.756875][ T8828] RIP: 0033:0x441399 [ 73.760755][ T8828] Code: e8 fc ab 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 9b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 73.780345][ T8828] RSP: 002b:00007ffc59587e48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 73.788747][ T8828] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441399 [ 73.796830][ T8828] RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000003 [ 73.804790][ T8828] RBP: 0000000000011f0f R08: 00000000004002c8 R09: 00000000004002c8 [ 73.812745][ T8828] R10: 0000000000000004 R11: 0000000000000246 R12: 00000000004021c0 [ 73.821568][ T8828] R13: 0000000000402250 R14: 0000000000000000 R15: 0000000000000000 [ 73.829583][ T8828] [ 73.831901][ T8828] Allocated by task 8828: [ 73.836317][ T8828] __kasan_kmalloc+0x118/0x1c0 [ 73.841063][ T8828] kasan_kmalloc+0x9/0x10 [ 73.845983][ T8828] __kmalloc+0x254/0x340 [ 73.850207][ T8828] kzalloc+0x21/0x40 [ 73.854078][ T8828] ip_set_alloc+0x32/0x60 [ 73.858391][ T8828] bitmap_port_create+0x32c/0x790 [ 73.863404][ T8828] ip_set_create+0x421/0xfd0 [ 73.867981][ T8828] nfnetlink_rcv_msg+0x9ae/0xcd0 [ 73.872909][ T8828] netlink_rcv_skb+0x19e/0x3e0 [ 73.877656][ T8828] nfnetlink_rcv+0x1e0/0x1e50 [ 73.882319][ T8828] netlink_unicast+0x767/0x920 [ 73.887079][ T8828] netlink_sendmsg+0xa2c/0xd50 [ 73.891934][ T8828] ____sys_sendmsg+0x4f7/0x7f0 [ 73.896731][ T8828] __sys_sendmsg+0x1ed/0x290 [ 73.901350][ T8828] __x64_sys_sendmsg+0x7f/0x90 [ 73.906134][ T8828] do_syscall_64+0xf7/0x1c0 [ 73.910631][ T8828] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 73.916498][ T8828] [ 73.918812][ T8828] Freed by task 8498: [ 73.922814][ T8828] __kasan_slab_free+0x12e/0x1e0 [ 73.927795][ T8828] kasan_slab_free+0xe/0x10 [ 73.932281][ T8828] kfree+0x10d/0x220 [ 73.936203][ T8828] single_release+0x91/0xa0 [ 73.940815][ T8828] __fput+0x2e4/0x740 [ 73.944778][ T8828] ____fput+0x15/0x20 [ 73.949312][ T8828] task_work_run+0x176/0x1b0 [ 73.953885][ T8828] prepare_exit_to_usermode+0x480/0x5b0 [ 73.959419][ T8828] syscall_return_slowpath+0x113/0x4a0 [ 73.964862][ T8828] do_syscall_64+0x11f/0x1c0 [ 73.969562][ T8828] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 73.975441][ T8828] [ 73.977751][ T8828] The buggy address belongs to the object at ffff88809e7c2080 [ 73.977751][ T8828] which belongs to the cache kmalloc-32 of size 32 [ 73.991616][ T8828] The buggy address is located 0 bytes inside of [ 73.991616][ T8828] 32-byte region [ffff88809e7c2080, ffff88809e7c20a0) [ 74.004609][ T8828] The buggy address belongs to the page: [ 74.010227][ T8828] page:ffffea000279f080 refcount:1 mapcount:0 mapping:ffff8880aa8001c0 index:0xffff88809e7c2fc1 [ 74.020689][ T8828] raw: 00fffe0000000200 ffffea00028b5b08 ffffea0002a03b48 ffff8880aa8001c0 [ 74.029302][ T8828] raw: ffff88809e7c2fc1 ffff88809e7c2000 000000010000003d 0000000000000000 [ 74.037866][ T8828] page dumped because: kasan: bad access detected [ 74.044324][ T8828] [ 74.046629][ T8828] Memory state around the buggy address: [ 74.052241][ T8828] ffff88809e7c1f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 74.060290][ T8828] ffff88809e7c2000: fb fb fb fb fc fc fc fc 00 00 01 fc fc fc fc fc [ 74.068560][ T8828] >ffff88809e7c2080: 04 fc fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 74.076614][ T8828] ^ [ 74.080684][ T8828] ffff88809e7c2100: 05 fc fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 74.088734][ T8828] ffff88809e7c2180: 00 00 01 fc fc fc fc fc 00 03 fc fc fc fc fc fc [ 74.096786][ T8828] ================================================================== [ 74.105013][ T8828] Disabling lock debugging due to kernel taint [ 74.112812][ T8828] Kernel panic - not syncing: panic_on_warn set ... [ 74.119406][ T8828] CPU: 1 PID: 8828 Comm: syz-executor377 Tainted: G B 5.5.0-rc7-syzkaller #0 [ 74.129447][ T8828] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 74.139484][ T8828] Call Trace: [ 74.142781][ T8828] dump_stack+0x1fb/0x318 [ 74.147140][ T8828] panic+0x264/0x7a9 [ 74.151090][ T8828] ? __kasan_report+0x193/0x1c0 [ 74.155922][ T8828] ? trace_hardirqs_on+0x34/0x80 [ 74.160980][ T8828] ? __kasan_report+0x193/0x1c0 [ 74.165848][ T8828] __kasan_report+0x1b9/0x1c0 [ 74.170520][ T8828] ? ip_set_type_unregister+0x3c0/0x3e0 [ 74.176581][ T8828] ? bitmap_port_destroy+0x1d2/0x3c0 [ 74.181910][ T8828] kasan_report+0x26/0x50 [ 74.186230][ T8828] check_memory_region+0x2b6/0x2f0 [ 74.191329][ T8828] __kasan_check_read+0x11/0x20 [ 74.196170][ T8828] bitmap_port_destroy+0x1d2/0x3c0 [ 74.201272][ T8828] ip_set_create+0xae0/0xfd0 [ 74.205845][ T8828] ? ip_set_protocol+0x5b0/0x5b0 [ 74.210827][ T8828] nfnetlink_rcv_msg+0x9ae/0xcd0 [ 74.215773][ T8828] ? cap_capable+0x25b/0x290 [ 74.220447][ T8828] ? cap_capable+0x25b/0x290 [ 74.225104][ T8828] netlink_rcv_skb+0x19e/0x3e0 [ 74.229939][ T8828] ? nfnetlink_bind+0x250/0x250 [ 74.234924][ T8828] nfnetlink_rcv+0x1e0/0x1e50 [ 74.239875][ T8828] ? rcu_lock_release+0x9/0x30 [ 74.244646][ T8828] ? rcu_lock_release+0x21/0x30 [ 74.249481][ T8828] ? netlink_deliver_tap+0x142/0x880 [ 74.254763][ T8828] netlink_unicast+0x767/0x920 [ 74.259664][ T8828] netlink_sendmsg+0xa2c/0xd50 [ 74.264484][ T8828] ? netlink_getsockopt+0x9f0/0x9f0 [ 74.269688][ T8828] ____sys_sendmsg+0x4f7/0x7f0 [ 74.274495][ T8828] __sys_sendmsg+0x1ed/0x290 [ 74.279079][ T8828] ? up_read+0x1d/0x20 [ 74.283129][ T8828] ? do_user_addr_fault+0x654/0xaf0 [ 74.288308][ T8828] ? check_preemption_disabled+0xb4/0x260 [ 74.294015][ T8828] ? debug_smp_processor_id+0x9/0x20 [ 74.299570][ T8828] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 74.305023][ T8828] ? trace_irq_disable_rcuidle+0x23/0x1e0 [ 74.310729][ T8828] ? do_syscall_64+0x1d/0x1c0 [ 74.315391][ T8828] __x64_sys_sendmsg+0x7f/0x90 [ 74.320189][ T8828] do_syscall_64+0xf7/0x1c0 [ 74.324678][ T8828] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 74.330596][ T8828] RIP: 0033:0x441399 [ 74.334715][ T8828] Code: e8 fc ab 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 9b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 74.354305][ T8828] RSP: 002b:00007ffc59587e48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 74.362827][ T8828] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441399 [ 74.371042][ T8828] RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000003 [ 74.379098][ T8828] RBP: 0000000000011f0f R08: 00000000004002c8 R09: 00000000004002c8 [ 74.387060][ T8828] R10: 0000000000000004 R11: 0000000000000246 R12: 00000000004021c0 [ 74.395143][ T8828] R13: 0000000000402250 R14: 0000000000000000 R15: 0000000000000000 [ 74.404592][ T8828] Kernel Offset: disabled [ 74.408974][ T8828] Rebooting in 86400 seconds..