[ 82.246339][ T27] audit: type=1800 audit(1579476996.404:26): pid=9498 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 83.137366][ T27] kauditd_printk_skb: 2 callbacks suppressed [ 83.137414][ T27] audit: type=1800 audit(1579476997.324:29): pid=9498 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 83.165327][ T27] audit: type=1800 audit(1579476997.324:30): pid=9498 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.212' (ECDSA) to the list of known hosts. executing program executing program syzkaller login: [ 93.960118][ T9651] ================================================================== [ 93.968566][ T9651] BUG: KASAN: use-after-free in bitmap_ipmac_ext_cleanup+0xd8/0x290 [ 93.976655][ T9651] Read of size 8 at addr ffff8880a2ac3a40 by task syz-executor324/9651 [ 93.984933][ T9651] [ 93.987343][ T9651] CPU: 0 PID: 9651 Comm: syz-executor324 Not tainted 5.5.0-rc5-syzkaller #0 [ 93.996145][ T9651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 94.006206][ T9651] Call Trace: [ 94.009577][ T9651] dump_stack+0x197/0x210 [ 94.013903][ T9651] ? bitmap_ipmac_ext_cleanup+0xd8/0x290 [ 94.019544][ T9651] print_address_description.constprop.0.cold+0xd4/0x30b [ 94.026838][ T9651] ? bitmap_ipmac_ext_cleanup+0xd8/0x290 [ 94.032482][ T9651] ? bitmap_ipmac_ext_cleanup+0xd8/0x290 [ 94.038159][ T9651] __kasan_report.cold+0x1b/0x41 [ 94.043088][ T9651] ? kfree+0x190/0x2c0 [ 94.047151][ T9651] ? bitmap_ipmac_ext_cleanup+0xd8/0x290 [ 94.052798][ T9651] kasan_report+0x12/0x20 [ 94.057223][ T9651] check_memory_region+0x134/0x1a0 [ 94.062441][ T9651] __kasan_check_read+0x11/0x20 [ 94.067310][ T9651] bitmap_ipmac_ext_cleanup+0xd8/0x290 [ 94.072778][ T9651] bitmap_ipmac_destroy+0x17c/0x1d0 [ 94.078069][ T9651] ip_set_create+0xe47/0x1500 [ 94.082746][ T9651] ? ip_set_destroy+0xb70/0xb70 [ 94.087623][ T9651] ? ip_set_destroy+0xb70/0xb70 [ 94.092468][ T9651] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 94.097471][ T9651] ? nfnetlink_bind+0x2c0/0x2c0 [ 94.102553][ T9651] ? __kasan_check_read+0x11/0x20 [ 94.107565][ T9651] ? __lock_acquire+0x8a0/0x4a00 [ 94.112644][ T9651] ? save_stack+0x5c/0x90 [ 94.116972][ T9651] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 94.123207][ T9651] ? apparmor_capable+0x497/0x900 [ 94.128228][ T9651] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 94.134482][ T9651] ? __kasan_check_read+0x11/0x20 [ 94.139501][ T9651] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 94.145898][ T9651] netlink_rcv_skb+0x177/0x450 [ 94.150738][ T9651] ? nfnetlink_bind+0x2c0/0x2c0 [ 94.155592][ T9651] ? netlink_ack+0xb50/0xb50 [ 94.160178][ T9651] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 94.166433][ T9651] ? ns_capable_common+0x93/0x100 [ 94.171552][ T9651] ? ns_capable+0x20/0x30 [ 94.175900][ T9651] ? __netlink_ns_capable+0x104/0x140 [ 94.181389][ T9651] nfnetlink_rcv+0x1ba/0x460 [ 94.186072][ T9651] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 94.191542][ T9651] ? netlink_deliver_tap+0x24a/0xbf0 [ 94.196913][ T9651] ? __kasan_check_write+0x14/0x20 [ 94.202025][ T9651] netlink_unicast+0x59e/0x7e0 [ 94.206954][ T9651] ? netlink_attachskb+0x870/0x870 [ 94.212152][ T9651] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 94.217873][ T9651] ? __check_object_size+0x3d/0x437 [ 94.223328][ T9651] netlink_sendmsg+0x91c/0xea0 [ 94.228103][ T9651] ? netlink_unicast+0x7e0/0x7e0 [ 94.233166][ T9651] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 94.238764][ T9651] ? apparmor_socket_sendmsg+0x2a/0x30 [ 94.244339][ T9651] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 94.250664][ T9651] ? security_socket_sendmsg+0x8d/0xc0 [ 94.256121][ T9651] ? netlink_unicast+0x7e0/0x7e0 [ 94.261059][ T9651] sock_sendmsg+0xd7/0x130 [ 94.265477][ T9651] ____sys_sendmsg+0x753/0x880 [ 94.270248][ T9651] ? kernel_sendmsg+0x50/0x50 [ 94.275110][ T9651] ? mark_held_locks+0xa4/0xf0 [ 94.279929][ T9651] ? do_huge_pmd_anonymous_page+0x1463/0x1a50 [ 94.286049][ T9651] ? __handle_mm_fault+0x3145/0x3cc0 [ 94.291465][ T9651] ? do_huge_pmd_anonymous_page+0x1463/0x1a50 [ 94.297886][ T9651] ___sys_sendmsg+0x100/0x170 [ 94.302624][ T9651] ? do_huge_pmd_anonymous_page+0xceb/0x1a50 [ 94.308704][ T9651] ? sendmsg_copy_msghdr+0x70/0x70 [ 94.313819][ T9651] ? __do_page_fault+0x56a/0xd80 [ 94.318754][ T9651] ? find_held_lock+0x35/0x130 [ 94.323541][ T9651] ? __do_page_fault+0x56a/0xd80 [ 94.328586][ T9651] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 94.334891][ T9651] ? __fget_light+0x1a9/0x230 [ 94.339570][ T9651] ? __fdget+0x1b/0x20 [ 94.343638][ T9651] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 94.349986][ T9651] __sys_sendmsg+0x105/0x1d0 [ 94.354633][ T9651] ? __sys_sendmsg_sock+0xc0/0xc0 [ 94.359753][ T9651] ? down_read_non_owner+0x490/0x490 [ 94.365046][ T9651] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 94.370758][ T9651] ? do_syscall_64+0x26/0x790 [ 94.375438][ T9651] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 94.381523][ T9651] ? do_syscall_64+0x26/0x790 [ 94.386682][ T9651] __x64_sys_sendmsg+0x78/0xb0 [ 94.392644][ T9651] do_syscall_64+0xfa/0x790 [ 94.397145][ T9651] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 94.403144][ T9651] RIP: 0033:0x442239 [ 94.407161][ T9651] Code: e8 6c aa 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 9b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 94.427005][ T9651] RSP: 002b:00007ffc7958b8c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 94.435411][ T9651] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000442239 [ 94.443384][ T9651] RDX: 0000000000000000 RSI: 0000000020000300 RDI: 0000000000000003 [ 94.451438][ T9651] RBP: 0000000000016edc R08: 00000000004030f0 R09: 00000000004030f0 [ 94.459433][ T9651] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000403060 [ 94.467662][ T9651] R13: 00000000004030f0 R14: 0000000000000000 R15: 0000000000000000 [ 94.475634][ T9651] [ 94.477972][ T9651] Allocated by task 9651: [ 94.482296][ T9651] save_stack+0x23/0x90 [ 94.486447][ T9651] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 94.492079][ T9651] kasan_kmalloc+0x9/0x10 [ 94.496396][ T9651] __kmalloc+0x163/0x770 [ 94.500855][ T9651] ip_set_alloc+0x38/0x5e [ 94.505319][ T9651] bitmap_ipmac_create+0x4e8/0xa00 [ 94.510474][ T9651] ip_set_create+0x6f1/0x1500 [ 94.515193][ T9651] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 94.520478][ T9651] netlink_rcv_skb+0x177/0x450 [ 94.525240][ T9651] nfnetlink_rcv+0x1ba/0x460 [ 94.530165][ T9651] netlink_unicast+0x59e/0x7e0 [ 94.535496][ T9651] netlink_sendmsg+0x91c/0xea0 [ 94.540250][ T9651] sock_sendmsg+0xd7/0x130 [ 94.544672][ T9651] ____sys_sendmsg+0x753/0x880 [ 94.549956][ T9651] ___sys_sendmsg+0x100/0x170 [ 94.554627][ T9651] __sys_sendmsg+0x105/0x1d0 [ 94.559235][ T9651] __x64_sys_sendmsg+0x78/0xb0 [ 94.564333][ T9651] do_syscall_64+0xfa/0x790 [ 94.569293][ T9651] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 94.575343][ T9651] [ 94.578190][ T9651] Freed by task 9651: [ 94.582165][ T9651] save_stack+0x23/0x90 [ 94.586310][ T9651] __kasan_slab_free+0x102/0x150 [ 94.591580][ T9651] kasan_slab_free+0xe/0x10 [ 94.596175][ T9651] kfree+0x10a/0x2c0 [ 94.600065][ T9651] kvfree+0x61/0x70 [ 94.603859][ T9651] ip_set_free+0x16/0x20 [ 94.608092][ T9651] bitmap_ipmac_destroy+0xae/0x1d0 [ 94.613224][ T9651] ip_set_create+0xe47/0x1500 [ 94.617903][ T9651] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 94.622933][ T9651] netlink_rcv_skb+0x177/0x450 [ 94.627685][ T9651] nfnetlink_rcv+0x1ba/0x460 [ 94.632653][ T9651] netlink_unicast+0x59e/0x7e0 [ 94.637406][ T9651] netlink_sendmsg+0x91c/0xea0 [ 94.642162][ T9651] sock_sendmsg+0xd7/0x130 [ 94.646571][ T9651] ____sys_sendmsg+0x753/0x880 [ 94.651353][ T9651] ___sys_sendmsg+0x100/0x170 [ 94.656323][ T9651] __sys_sendmsg+0x105/0x1d0 [ 94.661087][ T9651] __x64_sys_sendmsg+0x78/0xb0 [ 94.665858][ T9651] do_syscall_64+0xfa/0x790 [ 94.670365][ T9651] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 94.676380][ T9651] [ 94.678717][ T9651] The buggy address belongs to the object at ffff8880a2ac3a40 [ 94.678717][ T9651] which belongs to the cache kmalloc-32 of size 32 [ 94.692591][ T9651] The buggy address is located 0 bytes inside of [ 94.692591][ T9651] 32-byte region [ffff8880a2ac3a40, ffff8880a2ac3a60) [ 94.706784][ T9651] The buggy address belongs to the page: [ 94.712519][ T9651] page:ffffea00028ab0c0 refcount:1 mapcount:0 mapping:ffff8880aa4001c0 index:0xffff8880a2ac3fc1 [ 94.723703][ T9651] raw: 00fffe0000000200 ffffea000293f948 ffffea00025764c8 ffff8880aa4001c0 [ 94.732300][ T9651] raw: ffff8880a2ac3fc1 ffff8880a2ac3000 000000010000003f 0000000000000000 [ 94.740900][ T9651] page dumped because: kasan: bad access detected [ 94.747311][ T9651] [ 94.749679][ T9651] Memory state around the buggy address: [ 94.755377][ T9651] ffff8880a2ac3900: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 94.763436][ T9651] ffff8880a2ac3980: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 94.771603][ T9651] >ffff8880a2ac3a00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 94.782389][ T9651] ^ [ 94.788529][ T9651] ffff8880a2ac3a80: fb fb fb fb fc fc fc fc 00 00 fc fc fc fc fc fc [ 94.796661][ T9651] ffff8880a2ac3b00: fb fb fb fb fc fc fc fc 00 03 fc fc fc fc fc fc [ 94.804989][ T9651] ================================================================== [ 94.813045][ T9651] Disabling lock debugging due to kernel taint [ 94.821779][ T9651] Kernel panic - not syncing: panic_on_warn set ... [ 94.828391][ T9651] CPU: 0 PID: 9651 Comm: syz-executor324 Tainted: G B 5.5.0-rc5-syzkaller #0 [ 94.838546][ T9651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 94.849476][ T9651] Call Trace: [ 94.852896][ T9651] dump_stack+0x197/0x210 [ 94.857246][ T9651] panic+0x2e3/0x75c [ 94.861342][ T9651] ? add_taint.cold+0x16/0x16 [ 94.866327][ T9651] ? bitmap_ipmac_ext_cleanup+0xd8/0x290 [ 94.872003][ T9651] ? preempt_schedule+0x4b/0x60 [ 94.876859][ T9651] ? ___preempt_schedule+0x16/0x18 [ 94.881962][ T9651] ? trace_hardirqs_on+0x5e/0x240 [ 94.886979][ T9651] ? bitmap_ipmac_ext_cleanup+0xd8/0x290 [ 94.892604][ T9651] end_report+0x47/0x4f [ 94.896866][ T9651] ? bitmap_ipmac_ext_cleanup+0xd8/0x290 [ 94.902512][ T9651] __kasan_report.cold+0xe/0x41 [ 94.907363][ T9651] ? kfree+0x190/0x2c0 [ 94.913077][ T9651] ? bitmap_ipmac_ext_cleanup+0xd8/0x290 [ 94.918811][ T9651] kasan_report+0x12/0x20 [ 94.923146][ T9651] check_memory_region+0x134/0x1a0 [ 94.928264][ T9651] __kasan_check_read+0x11/0x20 [ 94.933104][ T9651] bitmap_ipmac_ext_cleanup+0xd8/0x290 [ 94.938567][ T9651] bitmap_ipmac_destroy+0x17c/0x1d0 [ 94.943784][ T9651] ip_set_create+0xe47/0x1500 [ 94.948458][ T9651] ? ip_set_destroy+0xb70/0xb70 [ 94.953328][ T9651] ? ip_set_destroy+0xb70/0xb70 [ 94.958310][ T9651] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 94.963491][ T9651] ? nfnetlink_bind+0x2c0/0x2c0 [ 94.968348][ T9651] ? __kasan_check_read+0x11/0x20 [ 94.973372][ T9651] ? __lock_acquire+0x8a0/0x4a00 [ 94.978309][ T9651] ? save_stack+0x5c/0x90 [ 94.982752][ T9651] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 94.988986][ T9651] ? apparmor_capable+0x497/0x900 [ 94.994060][ T9651] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 95.000368][ T9651] ? __kasan_check_read+0x11/0x20 [ 95.005385][ T9651] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 95.010846][ T9651] netlink_rcv_skb+0x177/0x450 [ 95.015609][ T9651] ? nfnetlink_bind+0x2c0/0x2c0 [ 95.020550][ T9651] ? netlink_ack+0xb50/0xb50 [ 95.025125][ T9651] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 95.031356][ T9651] ? ns_capable_common+0x93/0x100 [ 95.036368][ T9651] ? ns_capable+0x20/0x30 [ 95.040792][ T9651] ? __netlink_ns_capable+0x104/0x140 [ 95.046170][ T9651] nfnetlink_rcv+0x1ba/0x460 [ 95.050768][ T9651] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 95.056516][ T9651] ? netlink_deliver_tap+0x24a/0xbf0 [ 95.061919][ T9651] ? __kasan_check_write+0x14/0x20 [ 95.067298][ T9651] netlink_unicast+0x59e/0x7e0 [ 95.072331][ T9651] ? netlink_attachskb+0x870/0x870 [ 95.077756][ T9651] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 95.083516][ T9651] ? __check_object_size+0x3d/0x437 [ 95.088779][ T9651] netlink_sendmsg+0x91c/0xea0 [ 95.093702][ T9651] ? netlink_unicast+0x7e0/0x7e0 [ 95.098635][ T9651] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 95.104179][ T9651] ? apparmor_socket_sendmsg+0x2a/0x30 [ 95.113623][ T9651] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 95.119979][ T9651] ? security_socket_sendmsg+0x8d/0xc0 [ 95.125674][ T9651] ? netlink_unicast+0x7e0/0x7e0 [ 95.130712][ T9651] sock_sendmsg+0xd7/0x130 [ 95.135118][ T9651] ____sys_sendmsg+0x753/0x880 [ 95.140021][ T9651] ? kernel_sendmsg+0x50/0x50 [ 95.144816][ T9651] ? mark_held_locks+0xa4/0xf0 [ 95.149686][ T9651] ? do_huge_pmd_anonymous_page+0x1463/0x1a50 [ 95.155861][ T9651] ? __handle_mm_fault+0x3145/0x3cc0 [ 95.161867][ T9651] ? do_huge_pmd_anonymous_page+0x1463/0x1a50 [ 95.167944][ T9651] ___sys_sendmsg+0x100/0x170 [ 95.172733][ T9651] ? do_huge_pmd_anonymous_page+0xceb/0x1a50 [ 95.178761][ T9651] ? sendmsg_copy_msghdr+0x70/0x70 [ 95.183870][ T9651] ? __do_page_fault+0x56a/0xd80 [ 95.188803][ T9651] ? find_held_lock+0x35/0x130 [ 95.193593][ T9651] ? __do_page_fault+0x56a/0xd80 [ 95.198548][ T9651] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 95.204780][ T9651] ? __fget_light+0x1a9/0x230 [ 95.209534][ T9651] ? __fdget+0x1b/0x20 [ 95.213775][ T9651] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 95.220168][ T9651] __sys_sendmsg+0x105/0x1d0 [ 95.224858][ T9651] ? __sys_sendmsg_sock+0xc0/0xc0 [ 95.229886][ T9651] ? down_read_non_owner+0x490/0x490 [ 95.235170][ T9651] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 95.240752][ T9651] ? do_syscall_64+0x26/0x790 [ 95.245524][ T9651] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 95.251721][ T9651] ? do_syscall_64+0x26/0x790 [ 95.256837][ T9651] __x64_sys_sendmsg+0x78/0xb0 [ 95.261600][ T9651] do_syscall_64+0xfa/0x790 [ 95.266367][ T9651] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 95.272258][ T9651] RIP: 0033:0x442239 [ 95.276146][ T9651] Code: e8 6c aa 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 9b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 95.297265][ T9651] RSP: 002b:00007ffc7958b8c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 95.305858][ T9651] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000442239 [ 95.314161][ T9651] RDX: 0000000000000000 RSI: 0000000020000300 RDI: 0000000000000003 [ 95.322253][ T9651] RBP: 0000000000016edc R08: 00000000004030f0 R09: 00000000004030f0 [ 95.330216][ T9651] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000403060 [ 95.338466][ T9651] R13: 00000000004030f0 R14: 0000000000000000 R15: 0000000000000000 [ 95.348273][ T9651] Kernel Offset: disabled [ 95.352613][ T9651] Rebooting in 86400 seconds..