[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 85.667846][ T26] audit: type=1800 audit(1579327094.492:25): pid=9392 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 85.688537][ T26] audit: type=1800 audit(1579327094.492:26): pid=9392 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 85.732652][ T26] audit: type=1800 audit(1579327094.502:27): pid=9392 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.15' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 109.586240][ T9545] ================================================================== [ 109.594702][ T9545] BUG: KASAN: slab-out-of-bounds in bitmap_ip_list+0x40f/0xf20 [ 109.602346][ T9545] Read of size 8 at addr ffff88809acff240 by task syz-executor210/9545 [ 109.610572][ T9545] [ 109.612945][ T9545] CPU: 0 PID: 9545 Comm: syz-executor210 Not tainted 5.5.0-rc5-syzkaller #0 [ 109.621652][ T9545] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 109.631835][ T9545] Call Trace: [ 109.635129][ T9545] dump_stack+0x197/0x210 [ 109.639449][ T9545] ? bitmap_ip_list+0x40f/0xf20 [ 109.644301][ T9545] print_address_description.constprop.0.cold+0xd4/0x30b [ 109.651338][ T9545] ? bitmap_ip_list+0x40f/0xf20 [ 109.656328][ T9545] ? bitmap_ip_list+0x40f/0xf20 [ 109.661182][ T9545] __kasan_report.cold+0x1b/0x41 [ 109.666136][ T9545] ? bitmap_ip_list+0x40f/0xf20 [ 109.670994][ T9545] kasan_report+0x12/0x20 [ 109.675312][ T9545] check_memory_region+0x134/0x1a0 [ 109.680428][ T9545] __kasan_check_read+0x11/0x20 [ 109.685285][ T9545] bitmap_ip_list+0x40f/0xf20 [ 109.690015][ T9545] ? bitmap_ip_add+0xe60/0xe60 [ 109.694770][ T9545] ? nla_put+0x110/0x150 [ 109.699012][ T9545] ip_set_dump_start+0x96c/0x1ca0 [ 109.704186][ T9545] ? ip_set_rename+0x720/0x720 [ 109.708974][ T9545] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 109.714549][ T9545] ? perf_trace_lock_acquire+0x4b0/0x530 [ 109.720221][ T9545] ? __kasan_check_write+0x14/0x20 [ 109.725322][ T9545] netlink_dump+0x558/0xfb0 [ 109.729813][ T9545] ? __netlink_sendskb+0xc0/0xc0 [ 109.734758][ T9545] __netlink_dump_start+0x66a/0x930 [ 109.739963][ T9545] ip_set_dump+0x15a/0x1d0 [ 109.744434][ T9545] ? call_ad+0x5a0/0x5a0 [ 109.748673][ T9545] ? ip_set_rename+0x720/0x720 [ 109.753479][ T9545] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 109.759370][ T9545] ? call_ad+0x5a0/0x5a0 [ 109.763644][ T9545] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 109.768633][ T9545] ? nfnetlink_bind+0x2c0/0x2c0 [ 109.773562][ T9545] ? __kasan_check_read+0x11/0x20 [ 109.778583][ T9545] ? __lock_acquire+0x8a0/0x4a00 [ 109.783507][ T9545] ? save_stack+0x5c/0x90 [ 109.787970][ T9545] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 109.794194][ T9545] ? apparmor_capable+0x497/0x900 [ 109.799263][ T9545] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 109.805494][ T9545] ? __kasan_check_read+0x11/0x20 [ 109.810629][ T9545] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 109.816093][ T9545] netlink_rcv_skb+0x177/0x450 [ 109.820881][ T9545] ? nfnetlink_bind+0x2c0/0x2c0 [ 109.825737][ T9545] ? netlink_ack+0xb50/0xb50 [ 109.830317][ T9545] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 109.836553][ T9545] ? ns_capable_common+0x93/0x100 [ 109.841564][ T9545] ? ns_capable+0x20/0x30 [ 109.845883][ T9545] ? __netlink_ns_capable+0x104/0x140 [ 109.851258][ T9545] nfnetlink_rcv+0x1ba/0x460 [ 109.855847][ T9545] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 109.861297][ T9545] ? netlink_deliver_tap+0x24a/0xbe0 [ 109.866582][ T9545] ? __kasan_check_write+0x14/0x20 [ 109.871690][ T9545] netlink_unicast+0x58c/0x7d0 [ 109.876459][ T9545] ? netlink_attachskb+0x870/0x870 [ 109.881829][ T9545] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 109.887537][ T9545] ? __check_object_size+0x3d/0x437 [ 109.892917][ T9545] netlink_sendmsg+0x91c/0xea0 [ 109.897669][ T9545] ? netlink_unicast+0x7d0/0x7d0 [ 109.902596][ T9545] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 109.908188][ T9545] ? apparmor_socket_sendmsg+0x2a/0x30 [ 109.913637][ T9545] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 109.919875][ T9545] ? security_socket_sendmsg+0x8d/0xc0 [ 109.925377][ T9545] ? netlink_unicast+0x7d0/0x7d0 [ 109.930317][ T9545] sock_sendmsg+0xd7/0x130 [ 109.934723][ T9545] ____sys_sendmsg+0x753/0x880 [ 109.939797][ T9545] ? kernel_sendmsg+0x50/0x50 [ 109.944489][ T9545] ? lockdep_init_map+0x1be/0x6d0 [ 109.949516][ T9545] ___sys_sendmsg+0x100/0x170 [ 109.954188][ T9545] ? sendmsg_copy_msghdr+0x70/0x70 [ 109.959338][ T9545] ? __kasan_check_read+0x11/0x20 [ 109.964475][ T9545] ? __lock_acquire+0x8a0/0x4a00 [ 109.969406][ T9545] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 109.975646][ T9545] ? __this_cpu_preempt_check+0x35/0x190 [ 109.981282][ T9545] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 109.987556][ T9545] ? percpu_counter_add_batch+0x13c/0x190 [ 109.993270][ T9545] ? __fd_install+0x1bc/0x640 [ 109.998095][ T9545] ? find_held_lock+0x35/0x130 [ 110.002853][ T9545] ? __fd_install+0x1bc/0x640 [ 110.007695][ T9545] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 110.013929][ T9545] ? __fget_light+0x1a9/0x230 [ 110.018604][ T9545] ? __fdget+0x1b/0x20 [ 110.022677][ T9545] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 110.029054][ T9545] __sys_sendmsg+0x105/0x1d0 [ 110.033634][ T9545] ? __sys_sendmsg_sock+0xc0/0xc0 [ 110.038664][ T9545] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 110.044216][ T9545] ? do_syscall_64+0x26/0x790 [ 110.048928][ T9545] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 110.054984][ T9545] ? do_syscall_64+0x26/0x790 [ 110.059661][ T9545] __x64_sys_sendmsg+0x78/0xb0 [ 110.064772][ T9545] do_syscall_64+0xfa/0x790 [ 110.069265][ T9545] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 110.075191][ T9545] RIP: 0033:0x440529 [ 110.079078][ T9545] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 110.098719][ T9545] RSP: 002b:00007ffc7dffe988 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 110.107127][ T9545] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440529 [ 110.115084][ T9545] RDX: 0000000000000000 RSI: 0000000020000540 RDI: 0000000000000004 [ 110.123044][ T9545] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 110.131161][ T9545] R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000401db0 [ 110.139128][ T9545] R13: 0000000000401e40 R14: 0000000000000000 R15: 0000000000000000 [ 110.147100][ T9545] [ 110.149416][ T9545] Allocated by task 9545: [ 110.153738][ T9545] save_stack+0x23/0x90 [ 110.157898][ T9545] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 110.163609][ T9545] kasan_kmalloc+0x9/0x10 [ 110.167928][ T9545] __kmalloc+0x163/0x770 [ 110.172161][ T9545] ip_set_alloc+0x38/0x5e [ 110.176487][ T9545] bitmap_ip_create+0x6ec/0xc20 [ 110.181360][ T9545] ip_set_create+0x6f1/0x1500 [ 110.186084][ T9545] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 110.191016][ T9545] netlink_rcv_skb+0x177/0x450 [ 110.195782][ T9545] nfnetlink_rcv+0x1ba/0x460 [ 110.200367][ T9545] netlink_unicast+0x58c/0x7d0 [ 110.205118][ T9545] netlink_sendmsg+0x91c/0xea0 [ 110.209880][ T9545] sock_sendmsg+0xd7/0x130 [ 110.214283][ T9545] ____sys_sendmsg+0x753/0x880 [ 110.219646][ T9545] ___sys_sendmsg+0x100/0x170 [ 110.224340][ T9545] __sys_sendmsg+0x105/0x1d0 [ 110.228927][ T9545] __x64_sys_sendmsg+0x78/0xb0 [ 110.233685][ T9545] do_syscall_64+0xfa/0x790 [ 110.238176][ T9545] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 110.244050][ T9545] [ 110.246362][ T9545] Freed by task 9263: [ 110.250345][ T9545] save_stack+0x23/0x90 [ 110.254493][ T9545] __kasan_slab_free+0x102/0x150 [ 110.259433][ T9545] kasan_slab_free+0xe/0x10 [ 110.263930][ T9545] kfree+0x10a/0x2c0 [ 110.267870][ T9545] tomoyo_path_perm+0x24e/0x430 [ 110.272735][ T9545] tomoyo_inode_getattr+0x1d/0x30 [ 110.277949][ T9545] security_inode_getattr+0xf2/0x150 [ 110.283220][ T9545] vfs_getattr+0x25/0x70 [ 110.287455][ T9545] vfs_statx+0x157/0x200 [ 110.291691][ T9545] __do_sys_newstat+0xa4/0x130 [ 110.296442][ T9545] __x64_sys_newstat+0x54/0x80 [ 110.301197][ T9545] do_syscall_64+0xfa/0x790 [ 110.305696][ T9545] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 110.311577][ T9545] [ 110.313892][ T9545] The buggy address belongs to the object at ffff88809acff240 [ 110.313892][ T9545] which belongs to the cache kmalloc-32 of size 32 [ 110.327763][ T9545] The buggy address is located 0 bytes inside of [ 110.327763][ T9545] 32-byte region [ffff88809acff240, ffff88809acff260) [ 110.340851][ T9545] The buggy address belongs to the page: [ 110.346482][ T9545] page:ffffea00026b3fc0 refcount:1 mapcount:0 mapping:ffff8880aa4001c0 index:0xffff88809acfffc1 [ 110.356974][ T9545] raw: 00fffe0000000200 ffffea00028c1388 ffffea00027ba748 ffff8880aa4001c0 [ 110.365607][ T9545] raw: ffff88809acfffc1 ffff88809acff000 000000010000003f 0000000000000000 [ 110.374182][ T9545] page dumped because: kasan: bad access detected [ 110.380591][ T9545] [ 110.382902][ T9545] Memory state around the buggy address: [ 110.388525][ T9545] ffff88809acff100: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 110.396580][ T9545] ffff88809acff180: 00 00 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 110.404828][ T9545] >ffff88809acff200: fb fb fb fb fc fc fc fc 04 fc fc fc fc fc fc fc [ 110.412877][ T9545] ^ [ 110.419018][ T9545] ffff88809acff280: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 110.427079][ T9545] ffff88809acff300: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 110.435127][ T9545] ================================================================== [ 110.443244][ T9545] Disabling lock debugging due to kernel taint [ 110.450308][ T9545] Kernel panic - not syncing: panic_on_warn set ... [ 110.457062][ T9545] CPU: 0 PID: 9545 Comm: syz-executor210 Tainted: G B 5.5.0-rc5-syzkaller #0 [ 110.467428][ T9545] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 110.477478][ T9545] Call Trace: [ 110.480764][ T9545] dump_stack+0x197/0x210 [ 110.485143][ T9545] panic+0x2e3/0x75c [ 110.489041][ T9545] ? add_taint.cold+0x16/0x16 [ 110.493808][ T9545] ? bitmap_ip_list+0x40f/0xf20 [ 110.498656][ T9545] ? preempt_schedule+0x4b/0x60 [ 110.503583][ T9545] ? ___preempt_schedule+0x16/0x18 [ 110.508828][ T9545] ? trace_hardirqs_on+0x5e/0x240 [ 110.513915][ T9545] ? bitmap_ip_list+0x40f/0xf20 [ 110.518768][ T9545] end_report+0x47/0x4f [ 110.522912][ T9545] ? bitmap_ip_list+0x40f/0xf20 [ 110.527760][ T9545] __kasan_report.cold+0xe/0x41 [ 110.532618][ T9545] ? bitmap_ip_list+0x40f/0xf20 [ 110.537576][ T9545] kasan_report+0x12/0x20 [ 110.541893][ T9545] check_memory_region+0x134/0x1a0 [ 110.547004][ T9545] __kasan_check_read+0x11/0x20 [ 110.551960][ T9545] bitmap_ip_list+0x40f/0xf20 [ 110.556637][ T9545] ? bitmap_ip_add+0xe60/0xe60 [ 110.561401][ T9545] ? nla_put+0x110/0x150 [ 110.565780][ T9545] ip_set_dump_start+0x96c/0x1ca0 [ 110.570832][ T9545] ? ip_set_rename+0x720/0x720 [ 110.575589][ T9545] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 110.581119][ T9545] ? perf_trace_lock_acquire+0x4b0/0x530 [ 110.586787][ T9545] ? __kasan_check_write+0x14/0x20 [ 110.592007][ T9545] netlink_dump+0x558/0xfb0 [ 110.596508][ T9545] ? __netlink_sendskb+0xc0/0xc0 [ 110.601448][ T9545] __netlink_dump_start+0x66a/0x930 [ 110.606647][ T9545] ip_set_dump+0x15a/0x1d0 [ 110.611050][ T9545] ? call_ad+0x5a0/0x5a0 [ 110.615374][ T9545] ? ip_set_rename+0x720/0x720 [ 110.620130][ T9545] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 110.625944][ T9545] ? call_ad+0x5a0/0x5a0 [ 110.632624][ T9545] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 110.637723][ T9545] ? nfnetlink_bind+0x2c0/0x2c0 [ 110.642695][ T9545] ? __kasan_check_read+0x11/0x20 [ 110.647714][ T9545] ? __lock_acquire+0x8a0/0x4a00 [ 110.652637][ T9545] ? save_stack+0x5c/0x90 [ 110.657189][ T9545] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 110.663510][ T9545] ? apparmor_capable+0x497/0x900 [ 110.668517][ T9545] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 110.674847][ T9545] ? __kasan_check_read+0x11/0x20 [ 110.679905][ T9545] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 110.685361][ T9545] netlink_rcv_skb+0x177/0x450 [ 110.690113][ T9545] ? nfnetlink_bind+0x2c0/0x2c0 [ 110.694945][ T9545] ? netlink_ack+0xb50/0xb50 [ 110.699532][ T9545] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 110.705859][ T9545] ? ns_capable_common+0x93/0x100 [ 110.710910][ T9545] ? ns_capable+0x20/0x30 [ 110.715360][ T9545] ? __netlink_ns_capable+0x104/0x140 [ 110.720734][ T9545] nfnetlink_rcv+0x1ba/0x460 [ 110.725319][ T9545] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 110.730886][ T9545] ? netlink_deliver_tap+0x24a/0xbe0 [ 110.736157][ T9545] ? __kasan_check_write+0x14/0x20 [ 110.741263][ T9545] netlink_unicast+0x58c/0x7d0 [ 110.746015][ T9545] ? netlink_attachskb+0x870/0x870 [ 110.751124][ T9545] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 110.756841][ T9545] ? __check_object_size+0x3d/0x437 [ 110.762041][ T9545] netlink_sendmsg+0x91c/0xea0 [ 110.766788][ T9545] ? netlink_unicast+0x7d0/0x7d0 [ 110.771720][ T9545] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 110.777252][ T9545] ? apparmor_socket_sendmsg+0x2a/0x30 [ 110.782703][ T9545] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 110.788934][ T9545] ? security_socket_sendmsg+0x8d/0xc0 [ 110.794379][ T9545] ? netlink_unicast+0x7d0/0x7d0 [ 110.799397][ T9545] sock_sendmsg+0xd7/0x130 [ 110.803804][ T9545] ____sys_sendmsg+0x753/0x880 [ 110.808562][ T9545] ? kernel_sendmsg+0x50/0x50 [ 110.813273][ T9545] ? lockdep_init_map+0x1be/0x6d0 [ 110.818293][ T9545] ___sys_sendmsg+0x100/0x170 [ 110.823065][ T9545] ? sendmsg_copy_msghdr+0x70/0x70 [ 110.828218][ T9545] ? __kasan_check_read+0x11/0x20 [ 110.833247][ T9545] ? __lock_acquire+0x8a0/0x4a00 [ 110.838217][ T9545] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 110.844444][ T9545] ? __this_cpu_preempt_check+0x35/0x190 [ 110.850070][ T9545] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 110.856348][ T9545] ? percpu_counter_add_batch+0x13c/0x190 [ 110.862063][ T9545] ? __fd_install+0x1bc/0x640 [ 110.866733][ T9545] ? find_held_lock+0x35/0x130 [ 110.871492][ T9545] ? __fd_install+0x1bc/0x640 [ 110.876155][ T9545] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 110.882389][ T9545] ? __fget_light+0x1a9/0x230 [ 110.887060][ T9545] ? __fdget+0x1b/0x20 [ 110.891109][ T9545] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 110.897333][ T9545] __sys_sendmsg+0x105/0x1d0 [ 110.901918][ T9545] ? __sys_sendmsg_sock+0xc0/0xc0 [ 110.906943][ T9545] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 110.912385][ T9545] ? do_syscall_64+0x26/0x790 [ 110.917046][ T9545] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 110.923149][ T9545] ? do_syscall_64+0x26/0x790 [ 110.927863][ T9545] __x64_sys_sendmsg+0x78/0xb0 [ 110.932628][ T9545] do_syscall_64+0xfa/0x790 [ 110.937139][ T9545] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 110.943009][ T9545] RIP: 0033:0x440529 [ 110.946905][ T9545] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 110.966582][ T9545] RSP: 002b:00007ffc7dffe988 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 110.974981][ T9545] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440529 [ 110.982940][ T9545] RDX: 0000000000000000 RSI: 0000000020000540 RDI: 0000000000000004 [ 110.990929][ T9545] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 110.998888][ T9545] R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000401db0 [ 111.006847][ T9545] R13: 0000000000401e40 R14: 0000000000000000 R15: 0000000000000000 [ 111.016187][ T9545] Kernel Offset: disabled [ 111.020555][ T9545] Rebooting in 86400 seconds..