[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.10.31' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 28.236878] ================================================================== [ 28.244324] BUG: KASAN: slab-out-of-bounds in tipc_nametbl_lookup_dst_nodes+0x4ad/0x4c0 [ 28.252446] Read of size 4 at addr ffff8880a4a07190 by task syz-executor799/7971 [ 28.259954] [ 28.261593] CPU: 1 PID: 7971 Comm: syz-executor799 Not tainted 4.14.290-syzkaller #0 [ 28.269472] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 [ 28.278802] Call Trace: [ 28.281369] dump_stack+0x1b2/0x281 [ 28.284978] print_address_description.cold+0x54/0x1d3 [ 28.290231] kasan_report_error.cold+0x8a/0x191 [ 28.294895] ? tipc_nametbl_lookup_dst_nodes+0x4ad/0x4c0 [ 28.300321] __asan_report_load4_noabort+0x68/0x70 [ 28.305230] ? tipc_nametbl_lookup_dst_nodes+0x4ad/0x4c0 [ 28.310661] tipc_nametbl_lookup_dst_nodes+0x4ad/0x4c0 [ 28.315930] tipc_sendmcast+0x51a/0xac0 [ 28.319904] ? tipc_shutdown+0x2f0/0x2f0 [ 28.323969] ? __read_once_size_nocheck.constprop.0+0x10/0x10 [ 28.329831] ? lock_downgrade+0x740/0x740 [ 28.333954] ? unwind_next_frame+0xe54/0x17d0 [ 28.338425] ? entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 28.343884] ? is_bpf_text_address+0xb8/0x150 [ 28.348354] ? kernel_text_address+0xbd/0xf0 [ 28.352736] ? __kernel_text_address+0x9/0x30 [ 28.357223] ? __kernel_text_address+0x9/0x30 [ 28.361693] ? unwind_get_return_address+0x51/0x90 [ 28.366599] ? entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 28.371935] ? __save_stack_trace+0xa0/0x160 [ 28.376337] __tipc_sendmsg+0xbab/0xf90 [ 28.380290] ? tipc_sendmcast+0xac0/0xac0 [ 28.384412] ? unwind_next_frame+0xe54/0x17d0 [ 28.388882] ? __save_stack_trace+0x63/0x160 [ 28.393263] ? deref_stack_reg+0x124/0x1a0 [ 28.397472] ? __read_once_size_nocheck.constprop.0+0x10/0x10 [ 28.403333] ? lock_downgrade+0x740/0x740 [ 28.407453] ? unwind_next_frame+0xe54/0x17d0 [ 28.411926] ? entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 28.417269] ? __lockdep_init_map+0x100/0x560 [ 28.421743] __tipc_sendstream+0x695/0x8c0 [ 28.425955] ? tipc_sendmsg+0x70/0x70 [ 28.429733] ? save_trace+0xd6/0x290 [ 28.433424] ? mark_lock+0x64e/0x1050 [ 28.437202] ? check_usage_forwards+0x2d0/0x2d0 [ 28.441854] tipc_send_packet+0x5a/0x90 [ 28.445803] ? tipc_wait_for_rcvmsg.isra.0+0x430/0x430 [ 28.451053] sock_sendmsg+0xb5/0x100 [ 28.454743] ___sys_sendmsg+0x6c8/0x800 [ 28.458693] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 28.463446] ? lock_downgrade+0x740/0x740 [ 28.467587] ? __lru_cache_add+0x178/0x250 [ 28.471795] ? do_raw_spin_unlock+0x164/0x220 [ 28.476264] ? _raw_spin_unlock+0x29/0x40 [ 28.480385] ? do_huge_pmd_anonymous_page+0x72e/0x1700 [ 28.485655] ? prep_transhuge_page+0xa0/0xa0 [ 28.490041] ? _raw_spin_unlock+0x29/0x40 [ 28.494162] ? __pmd_alloc+0x27f/0x3f0 [ 28.498026] ? lock_downgrade+0x740/0x740 [ 28.502148] ? vm_insert_page+0x7c0/0x7c0 [ 28.506282] ? __fdget+0x167/0x1f0 [ 28.509801] ? sockfd_lookup_light+0xb2/0x160 [ 28.514275] __sys_sendmsg+0xa3/0x120 [ 28.518049] ? SyS_shutdown+0x160/0x160 [ 28.522018] ? up_read+0x17/0x30 [ 28.525361] ? __do_page_fault+0x159/0xad0 [ 28.529568] SyS_sendmsg+0x27/0x40 [ 28.533167] ? __sys_sendmsg+0x120/0x120 [ 28.537211] do_syscall_64+0x1d5/0x640 [ 28.541077] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 28.546243] RIP: 0033:0x7fda5bb76049 [ 28.549935] RSP: 002b:00007ffeb29ba788 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 28.557617] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fda5bb76049 [ 28.564862] RDX: 0000000000000011 RSI: 00000000200001c0 RDI: 0000000000000003 [ 28.572122] RBP: 00007fda5bb3a030 R08: 0000000000000000 R09: 0000000000000000 [ 28.579382] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fda5bb3a0c0 [ 28.586628] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 28.593879] [ 28.595484] Allocated by task 1: [ 28.598836] kasan_kmalloc+0xeb/0x160 [ 28.602614] __kmalloc+0x15a/0x400 [ 28.606130] tipc_nameseq_create+0x53/0x290 [ 28.610429] tipc_nametbl_insert_publ+0xb37/0x14e0 [ 28.615333] tipc_nametbl_publish+0x211/0x3f0 [ 28.619803] tipc_bind+0x2c4/0x600 [ 28.623330] tipc_server_start+0x31f/0x880 [ 28.627544] tipc_topsrv_init_net+0x53b/0x730 [ 28.632013] ops_init+0xaa/0x3e0 [ 28.635357] register_pernet_operations+0x32f/0x750 [ 28.640346] register_pernet_device+0x28/0x70 [ 28.644819] tipc_init+0x7d/0x137 [ 28.648245] do_one_initcall+0x88/0x210 [ 28.652195] kernel_init_freeable+0x565/0x626 [ 28.656664] kernel_init+0xd/0x15e [ 28.660184] ret_from_fork+0x24/0x30 [ 28.663979] [ 28.665597] Freed by task 0: [ 28.668587] (stack is not available) [ 28.672272] [ 28.673878] The buggy address belongs to the object at ffff8880a4a07180 [ 28.673878] which belongs to the cache kmalloc-32 of size 32 [ 28.686335] The buggy address is located 16 bytes inside of [ 28.686335] 32-byte region [ffff8880a4a07180, ffff8880a4a071a0) [ 28.698011] The buggy address belongs to the page: [ 28.702930] page:ffffea00029281c0 count:1 mapcount:0 mapping:ffff8880a4a07000 index:0xffff8880a4a07fc1 [ 28.712347] flags: 0xfff00000000100(slab) [ 28.716470] raw: 00fff00000000100 ffff8880a4a07000 ffff8880a4a07fc1 0000000100000036 [ 28.724328] raw: ffffea0002a82760 ffffea00029402a0 ffff88813fe741c0 0000000000000000 [ 28.732183] page dumped because: kasan: bad access detected [ 28.737945] [ 28.739544] Memory state around the buggy address: [ 28.744460] ffff8880a4a07080: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 28.751793] ffff8880a4a07100: 00 00 fc fc fc fc fc fc 04 fc fc fc fc fc fc fc [ 28.759124] >ffff8880a4a07180: 00 00 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 28.766454] ^ [ 28.770316] ffff8880a4a07200: 00 00 00 fc fc fc fc fc fb fb fb fb fc fc fc fc [ 28.777647] ffff8880a4a07280: 00 00 fc fc fc fc fc fc 00 00 fc fc fc fc fc fc [ 28.784997] ================================================================== [ 28.792332] Disabling lock debugging due to kernel taint [ 28.797827] Kernel panic - not syncing: panic_on_warn set ... [ 28.797827] [ 28.805177] CPU: 1 PID: 7971 Comm: syz-executor799 Tainted: G B 4.14.290-syzkaller #0 [ 28.814260] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 [ 28.823619] Call Trace: [ 28.826200] dump_stack+0x1b2/0x281 [ 28.829818] panic+0x1f9/0x42d [ 28.832995] ? add_taint.cold+0x16/0x16 [ 28.836946] kasan_end_report+0x43/0x49 [ 28.840894] kasan_report_error.cold+0xa7/0x191 [ 28.845537] ? tipc_nametbl_lookup_dst_nodes+0x4ad/0x4c0 [ 28.850968] __asan_report_load4_noabort+0x68/0x70 [ 28.855886] ? tipc_nametbl_lookup_dst_nodes+0x4ad/0x4c0 [ 28.861322] tipc_nametbl_lookup_dst_nodes+0x4ad/0x4c0 [ 28.866573] tipc_sendmcast+0x51a/0xac0 [ 28.870526] ? tipc_shutdown+0x2f0/0x2f0 [ 28.874579] ? __read_once_size_nocheck.constprop.0+0x10/0x10 [ 28.880455] ? lock_downgrade+0x740/0x740 [ 28.884575] ? unwind_next_frame+0xe54/0x17d0 [ 28.889045] ? entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 28.894384] ? is_bpf_text_address+0xb8/0x150 [ 28.898855] ? kernel_text_address+0xbd/0xf0 [ 28.903235] ? __kernel_text_address+0x9/0x30 [ 28.907705] ? __kernel_text_address+0x9/0x30 [ 28.912177] ? unwind_get_return_address+0x51/0x90 [ 28.917088] ? entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 28.922423] ? __save_stack_trace+0xa0/0x160 [ 28.926821] __tipc_sendmsg+0xbab/0xf90 [ 28.930770] ? tipc_sendmcast+0xac0/0xac0 [ 28.934891] ? unwind_next_frame+0xe54/0x17d0 [ 28.939363] ? __save_stack_trace+0x63/0x160 [ 28.943747] ? deref_stack_reg+0x124/0x1a0 [ 28.947959] ? __read_once_size_nocheck.constprop.0+0x10/0x10 [ 28.953817] ? lock_downgrade+0x740/0x740 [ 28.957954] ? unwind_next_frame+0xe54/0x17d0 [ 28.962425] ? entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 28.967767] ? __lockdep_init_map+0x100/0x560 [ 28.972252] __tipc_sendstream+0x695/0x8c0 [ 28.976460] ? tipc_sendmsg+0x70/0x70 [ 28.980233] ? save_trace+0xd6/0x290 [ 28.983924] ? mark_lock+0x64e/0x1050 [ 28.987696] ? check_usage_forwards+0x2d0/0x2d0 [ 28.992343] tipc_send_packet+0x5a/0x90 [ 28.996294] ? tipc_wait_for_rcvmsg.isra.0+0x430/0x430 [ 29.001544] sock_sendmsg+0xb5/0x100 [ 29.005250] ___sys_sendmsg+0x6c8/0x800 [ 29.009211] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 29.013942] ? lock_downgrade+0x740/0x740 [ 29.018062] ? __lru_cache_add+0x178/0x250 [ 29.022268] ? do_raw_spin_unlock+0x164/0x220 [ 29.026738] ? _raw_spin_unlock+0x29/0x40 [ 29.030858] ? do_huge_pmd_anonymous_page+0x72e/0x1700 [ 29.036110] ? prep_transhuge_page+0xa0/0xa0 [ 29.040488] ? _raw_spin_unlock+0x29/0x40 [ 29.044608] ? __pmd_alloc+0x27f/0x3f0 [ 29.048472] ? lock_downgrade+0x740/0x740 [ 29.052690] ? vm_insert_page+0x7c0/0x7c0 [ 29.056955] ? __fdget+0x167/0x1f0 [ 29.060472] ? sockfd_lookup_light+0xb2/0x160 [ 29.064950] __sys_sendmsg+0xa3/0x120 [ 29.068726] ? SyS_shutdown+0x160/0x160 [ 29.072676] ? up_read+0x17/0x30 [ 29.076024] ? __do_page_fault+0x159/0xad0 [ 29.080232] SyS_sendmsg+0x27/0x40 [ 29.083745] ? __sys_sendmsg+0x120/0x120 [ 29.087784] do_syscall_64+0x1d5/0x640 [ 29.091665] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 29.096828] RIP: 0033:0x7fda5bb76049 [ 29.100512] RSP: 002b:00007ffeb29ba788 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 29.108198] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fda5bb76049 [ 29.115441] RDX: 0000000000000011 RSI: 00000000200001c0 RDI: 0000000000000003 [ 29.122686] RBP: 00007fda5bb3a030 R08: 0000000000000000 R09: 0000000000000000 [ 29.129930] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fda5bb3a0c0 [ 29.137178] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 29.144614] Kernel Offset: disabled [ 29.148225] Rebooting in 86400 seconds..