[ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Getty on tty1. [ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.12' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 61.611928][ T6832] ------------[ cut here ]------------ [ 61.617540][ T6832] WARNING: CPU: 0 PID: 6832 at lib/nlattr.c:117 nla_get_range_unsigned+0x157/0x530 [ 61.627204][ T6832] Modules linked in: [ 61.631177][ T6832] CPU: 0 PID: 6832 Comm: syz-executor578 Not tainted 5.9.0-rc2-next-20200828-syzkaller #0 [ 61.641164][ T6832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 61.651296][ T6832] RIP: 0010:nla_get_range_unsigned+0x157/0x530 [ 61.657718][ T6832] Code: 2a 03 00 00 44 0f b6 3b 48 c7 c6 40 e9 96 88 4c 89 ff e8 6c 93 c2 fd 41 80 ff 0b 77 11 42 ff 24 fd 60 e3 96 88 e8 99 96 c2 fd <0f> 0b eb 8f e8 90 96 c2 fd 0f 0b 5b 41 5c 41 5d 41 5e 41 5f 5d e9 [ 61.677411][ T6832] RSP: 0018:ffffc90005327190 EFLAGS: 00010293 [ 61.683560][ T6832] RAX: 0000000000000000 RBX: ffffffff8918a7a0 RCX: ffffffff83b1e584 [ 61.691548][ T6832] RDX: ffff8880a8254500 RSI: ffffffff83b1e5f7 RDI: 0000000000000003 [ 61.699582][ T6832] RBP: ffffc900053271b8 R08: 0000000000000000 R09: ffff888094396370 [ 61.707632][ T6832] R10: 0000000000000000 R11: 0000000000000000 R12: ffffc90005327278 [ 61.715685][ T6832] R13: ffffffff8918a7a1 R14: 000000000000877c R15: ffffffff8918a7a0 [ 61.723771][ T6832] FS: 0000000001b5f880(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000 [ 61.732900][ T6832] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 61.739485][ T6832] CR2: 0000000020000000 CR3: 00000000a2703000 CR4: 00000000001506f0 [ 61.747548][ T6832] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 61.755616][ T6832] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 61.763657][ T6832] Call Trace: [ 61.767016][ T6832] netlink_policy_dump_write+0x2ae/0xea0 [ 61.772633][ T6832] ? netlink_policy_dump_loop+0x170/0x170 [ 61.778431][ T6832] ? skb_put+0x134/0x180 [ 61.782682][ T6832] ? memset+0x20/0x40 [ 61.786708][ T6832] ? __nla_reserve+0x9a/0xc0 [ 61.791309][ T6832] ? __nla_put+0x23/0x40 [ 61.795625][ T6832] ? memcpy+0x39/0x60 [ 61.799617][ T6832] ctrl_dumppolicy+0x4a8/0x900 [ 61.804446][ T6832] ? genl_start+0x5d0/0x5d0 [ 61.808964][ T6832] ? __kmalloc_node_track_caller+0x38/0x60 [ 61.814845][ T6832] ? rcu_read_lock_sched_held+0x3a/0xb0 [ 61.820408][ T6832] ? __phys_addr+0x9a/0x110 [ 61.824975][ T6832] ? memset+0x20/0x40 [ 61.828983][ T6832] genl_lock_dumpit+0x7f/0xb0 [ 61.833734][ T6832] netlink_dump+0x4cd/0xf60 [ 61.838255][ T6832] ? netlink_insert+0x1670/0x1670 [ 61.843345][ T6832] ? __mutex_unlock_slowpath+0xe2/0x610 [ 61.848890][ T6832] ? kmem_cache_alloc_trace+0x188/0x2c0 [ 61.854512][ T6832] ? genl_start+0x3bb/0x5d0 [ 61.859025][ T6832] __netlink_dump_start+0x643/0x900 [ 61.864271][ T6832] ? genl_rcv_msg+0x980/0x980 [ 61.868986][ T6832] ? genl_start+0x5d0/0x5d0 [ 61.873566][ T6832] genl_family_rcv_msg_dumpit+0x2ac/0x310 [ 61.879288][ T6832] ? genl_rcv+0x40/0x40 [ 61.884223][ T6832] ? mutex_lock_io_nested+0xf60/0xf60 [ 61.889601][ T6832] ? mark_lock+0xbc/0x1710 [ 61.894086][ T6832] ? genl_rcv_msg+0x980/0x980 [ 61.898767][ T6832] ? genl_unlock+0x20/0x20 [ 61.903231][ T6832] ? genl_parallel_done+0xf0/0xf0 [ 61.908266][ T6832] ? __radix_tree_lookup+0x1f3/0x290 [ 61.913630][ T6832] genl_rcv_msg+0x75f/0x980 [ 61.918142][ T6832] ? genl_family_rcv_msg_attrs_parse.isra.0+0x250/0x250 [ 61.925146][ T6832] ? lock_acquire+0x1f1/0xad0 [ 61.929831][ T6832] ? genl_rcv+0x15/0x40 [ 61.934083][ T6832] ? lock_release+0x8e0/0x8e0 [ 61.938763][ T6832] netlink_rcv_skb+0x15a/0x430 [ 61.943596][ T6832] ? genl_family_rcv_msg_attrs_parse.isra.0+0x250/0x250 [ 61.950546][ T6832] ? netlink_ack+0xa10/0xa10 [ 61.955237][ T6832] ? lock_is_held_type+0xbb/0xf0 [ 61.960191][ T6832] genl_rcv+0x24/0x40 [ 61.964221][ T6832] netlink_unicast+0x533/0x7d0 [ 61.968996][ T6832] ? netlink_attachskb+0x810/0x810 [ 61.974189][ T6832] ? _copy_from_iter_full+0x247/0x890 [ 61.979565][ T6832] ? __phys_addr+0x9a/0x110 [ 61.984130][ T6832] ? __phys_addr_symbol+0x2c/0x70 [ 61.989168][ T6832] ? __check_object_size+0x171/0x3e4 [ 61.994526][ T6832] netlink_sendmsg+0x856/0xd90 [ 61.999307][ T6832] ? netlink_unicast+0x7d0/0x7d0 [ 62.004305][ T6832] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 62.009612][ T6832] ? netlink_unicast+0x7d0/0x7d0 [ 62.014630][ T6832] sock_sendmsg+0xcf/0x120 [ 62.019052][ T6832] ____sys_sendmsg+0x6e8/0x810 [ 62.023904][ T6832] ? kernel_sendmsg+0x50/0x50 [ 62.028606][ T6832] ? do_recvmmsg+0x6d0/0x6d0 [ 62.033278][ T6832] ? lock_acquire+0x1f1/0xad0 [ 62.037958][ T6832] ? do_huge_pmd_anonymous_page+0x120d/0x2230 [ 62.044157][ T6832] ? find_held_lock+0x2d/0x110 [ 62.048937][ T6832] ___sys_sendmsg+0xf3/0x170 [ 62.053602][ T6832] ? sendmsg_copy_msghdr+0x160/0x160 [ 62.058947][ T6832] ? do_huge_pmd_anonymous_page+0x1b94/0x2230 [ 62.065079][ T6832] ? do_huge_pmd_anonymous_page+0x8ef/0x2230 [ 62.071075][ T6832] ? handle_mm_fault+0xb78/0x4530 [ 62.076169][ T6832] ? find_held_lock+0x2d/0x110 [ 62.080942][ T6832] ? __fget_light+0x215/0x280 [ 62.085671][ T6832] __sys_sendmsg+0xe5/0x1b0 [ 62.090184][ T6832] ? __sys_sendmsg_sock+0xb0/0xb0 [ 62.095292][ T6832] ? trace_hardirqs_on+0x5f/0x220 [ 62.100339][ T6832] ? lockdep_hardirqs_on+0x76/0xf0 [ 62.105563][ T6832] do_syscall_64+0x2d/0x70 [ 62.109989][ T6832] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 62.115963][ T6832] RIP: 0033:0x4402a9 [ 62.119885][ T6832] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 62.139666][ T6832] RSP: 002b:00007ffd8599b938 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 62.148169][ T6832] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004402a9 [ 62.156237][ T6832] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003 [ 62.164268][ T6832] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 62.172249][ T6832] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401ab0 [ 62.180312][ T6832] R13: 0000000000401b40 R14: 0000000000000000 R15: 0000000000000000 [ 62.188373][ T6832] Kernel panic - not syncing: panic_on_warn set ... [ 62.194959][ T6832] CPU: 0 PID: 6832 Comm: syz-executor578 Not tainted 5.9.0-rc2-next-20200828-syzkaller #0 [ 62.204822][ T6832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 62.214867][ T6832] Call Trace: [ 62.218151][ T6832] dump_stack+0x18f/0x20d [ 62.222463][ T6832] panic+0x2e3/0x75c [ 62.226348][ T6832] ? __warn_printk+0xf3/0xf3 [ 62.230933][ T6832] ? __warn.cold+0x1d/0xc1 [ 62.235340][ T6832] ? __warn.cold+0x14/0xc1 [ 62.239747][ T6832] ? nla_get_range_unsigned+0x157/0x530 [ 62.245277][ T6832] __warn.cold+0x38/0xc1 [ 62.249559][ T6832] ? nla_get_range_unsigned+0x157/0x530 [ 62.255109][ T6832] report_bug+0x1bd/0x210 [ 62.259424][ T6832] handle_bug+0x38/0x90 [ 62.263574][ T6832] ? mark_lock+0xbc/0x1710 [ 62.267968][ T6832] exc_invalid_op+0x14/0x40 [ 62.272464][ T6832] asm_exc_invalid_op+0x12/0x20 [ 62.277295][ T6832] RIP: 0010:nla_get_range_unsigned+0x157/0x530 [ 62.283427][ T6832] Code: 2a 03 00 00 44 0f b6 3b 48 c7 c6 40 e9 96 88 4c 89 ff e8 6c 93 c2 fd 41 80 ff 0b 77 11 42 ff 24 fd 60 e3 96 88 e8 99 96 c2 fd <0f> 0b eb 8f e8 90 96 c2 fd 0f 0b 5b 41 5c 41 5d 41 5e 41 5f 5d e9 [ 62.303025][ T6832] RSP: 0018:ffffc90005327190 EFLAGS: 00010293 [ 62.309070][ T6832] RAX: 0000000000000000 RBX: ffffffff8918a7a0 RCX: ffffffff83b1e584 [ 62.317020][ T6832] RDX: ffff8880a8254500 RSI: ffffffff83b1e5f7 RDI: 0000000000000003 [ 62.324985][ T6832] RBP: ffffc900053271b8 R08: 0000000000000000 R09: ffff888094396370 [ 62.332956][ T6832] R10: 0000000000000000 R11: 0000000000000000 R12: ffffc90005327278 [ 62.340905][ T6832] R13: ffffffff8918a7a1 R14: 000000000000877c R15: ffffffff8918a7a0 [ 62.348871][ T6832] ? nla_get_range_unsigned+0xe4/0x530 [ 62.354322][ T6832] ? nla_get_range_unsigned+0x157/0x530 [ 62.359852][ T6832] netlink_policy_dump_write+0x2ae/0xea0 [ 62.365468][ T6832] ? netlink_policy_dump_loop+0x170/0x170 [ 62.371165][ T6832] ? skb_put+0x134/0x180 [ 62.375400][ T6832] ? memset+0x20/0x40 [ 62.379392][ T6832] ? __nla_reserve+0x9a/0xc0 [ 62.383964][ T6832] ? __nla_put+0x23/0x40 [ 62.388185][ T6832] ? memcpy+0x39/0x60 [ 62.392148][ T6832] ctrl_dumppolicy+0x4a8/0x900 [ 62.396910][ T6832] ? genl_start+0x5d0/0x5d0 [ 62.401413][ T6832] ? __kmalloc_node_track_caller+0x38/0x60 [ 62.407198][ T6832] ? rcu_read_lock_sched_held+0x3a/0xb0 [ 62.412727][ T6832] ? __phys_addr+0x9a/0x110 [ 62.417741][ T6832] ? memset+0x20/0x40 [ 62.421700][ T6832] genl_lock_dumpit+0x7f/0xb0 [ 62.426372][ T6832] netlink_dump+0x4cd/0xf60 [ 62.430868][ T6832] ? netlink_insert+0x1670/0x1670 [ 62.435870][ T6832] ? __mutex_unlock_slowpath+0xe2/0x610 [ 62.441407][ T6832] ? kmem_cache_alloc_trace+0x188/0x2c0 [ 62.446940][ T6832] ? genl_start+0x3bb/0x5d0 [ 62.451424][ T6832] __netlink_dump_start+0x643/0x900 [ 62.456615][ T6832] ? genl_rcv_msg+0x980/0x980 [ 62.461317][ T6832] ? genl_start+0x5d0/0x5d0 [ 62.465817][ T6832] genl_family_rcv_msg_dumpit+0x2ac/0x310 [ 62.471514][ T6832] ? genl_rcv+0x40/0x40 [ 62.475648][ T6832] ? mutex_lock_io_nested+0xf60/0xf60 [ 62.480998][ T6832] ? mark_lock+0xbc/0x1710 [ 62.485394][ T6832] ? genl_rcv_msg+0x980/0x980 [ 62.490059][ T6832] ? genl_unlock+0x20/0x20 [ 62.494464][ T6832] ? genl_parallel_done+0xf0/0xf0 [ 62.499467][ T6832] ? __radix_tree_lookup+0x1f3/0x290 [ 62.504748][ T6832] genl_rcv_msg+0x75f/0x980 [ 62.509235][ T6832] ? genl_family_rcv_msg_attrs_parse.isra.0+0x250/0x250 [ 62.516163][ T6832] ? lock_acquire+0x1f1/0xad0 [ 62.520832][ T6832] ? genl_rcv+0x15/0x40 [ 62.524984][ T6832] ? lock_release+0x8e0/0x8e0 [ 62.529652][ T6832] netlink_rcv_skb+0x15a/0x430 [ 62.534398][ T6832] ? genl_family_rcv_msg_attrs_parse.isra.0+0x250/0x250 [ 62.541323][ T6832] ? netlink_ack+0xa10/0xa10 [ 62.545956][ T6832] ? lock_is_held_type+0xbb/0xf0 [ 62.550874][ T6832] genl_rcv+0x24/0x40 [ 62.554848][ T6832] netlink_unicast+0x533/0x7d0 [ 62.559591][ T6832] ? netlink_attachskb+0x810/0x810 [ 62.564680][ T6832] ? _copy_from_iter_full+0x247/0x890 [ 62.570031][ T6832] ? __phys_addr+0x9a/0x110 [ 62.574527][ T6832] ? __phys_addr_symbol+0x2c/0x70 [ 62.579544][ T6832] ? __check_object_size+0x171/0x3e4 [ 62.584811][ T6832] netlink_sendmsg+0x856/0xd90 [ 62.589556][ T6832] ? netlink_unicast+0x7d0/0x7d0 [ 62.594476][ T6832] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 62.599739][ T6832] ? netlink_unicast+0x7d0/0x7d0 [ 62.604657][ T6832] sock_sendmsg+0xcf/0x120 [ 62.609054][ T6832] ____sys_sendmsg+0x6e8/0x810 [ 62.613802][ T6832] ? kernel_sendmsg+0x50/0x50 [ 62.618454][ T6832] ? do_recvmmsg+0x6d0/0x6d0 [ 62.623027][ T6832] ? lock_acquire+0x1f1/0xad0 [ 62.627683][ T6832] ? do_huge_pmd_anonymous_page+0x120d/0x2230 [ 62.633738][ T6832] ? find_held_lock+0x2d/0x110 [ 62.638482][ T6832] ___sys_sendmsg+0xf3/0x170 [ 62.643050][ T6832] ? sendmsg_copy_msghdr+0x160/0x160 [ 62.648313][ T6832] ? do_huge_pmd_anonymous_page+0x1b94/0x2230 [ 62.654362][ T6832] ? do_huge_pmd_anonymous_page+0x8ef/0x2230 [ 62.660339][ T6832] ? handle_mm_fault+0xb78/0x4530 [ 62.665347][ T6832] ? find_held_lock+0x2d/0x110 [ 62.670090][ T6832] ? __fget_light+0x215/0x280 [ 62.674747][ T6832] __sys_sendmsg+0xe5/0x1b0 [ 62.679228][ T6832] ? __sys_sendmsg_sock+0xb0/0xb0 [ 62.684237][ T6832] ? trace_hardirqs_on+0x5f/0x220 [ 62.689239][ T6832] ? lockdep_hardirqs_on+0x76/0xf0 [ 62.694330][ T6832] do_syscall_64+0x2d/0x70 [ 62.698725][ T6832] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 62.704595][ T6832] RIP: 0033:0x4402a9 [ 62.708470][ T6832] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 62.728050][ T6832] RSP: 002b:00007ffd8599b938 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 62.736441][ T6832] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004402a9 [ 62.744391][ T6832] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003 [ 62.752340][ T6832] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 62.760290][ T6832] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401ab0 [ 62.768239][ T6832] R13: 0000000000401b40 R14: 0000000000000000 R15: 0000000000000000 [ 62.777305][ T6832] Kernel Offset: disabled [ 62.781677][ T6832] Rebooting in 86400 seconds..