Warning: Permanently added '10.128.0.200' (ECDSA) to the list of known hosts.
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
syzkaller login: [  104.426178][    C1] ==================================================================
[  104.435047][    C1] BUG: KASAN: slab-out-of-bounds in bitmap_ipmac_gc+0x119/0x590
[  104.443341][    C1] Read of size 8 at addr ffff8880a6b3f0c0 by task syz-executor695/10149
[  104.452485][    C1] 
[  104.455014][    C1] CPU: 1 PID: 10149 Comm: syz-executor695 Not tainted 5.5.0-rc6-next-20200116-syzkaller #0
[  104.465707][    C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  104.475858][    C1] Call Trace:
[  104.479586][    C1]  <IRQ>
[  104.482792][    C1]  dump_stack+0x197/0x210
[  104.488233][    C1]  ? bitmap_ipmac_gc+0x119/0x590
[  104.493564][    C1]  print_address_description.constprop.0.cold+0xd4/0x30b
[  104.500984][    C1]  ? bitmap_ipmac_gc+0x119/0x590
[  104.505979][    C1]  ? bitmap_ipmac_gc+0x119/0x590
[  104.510918][    C1]  __kasan_report.cold+0x1b/0x32
[  104.516262][    C1]  ? bitmap_ipmac_gc+0x119/0x590
[  104.521322][    C1]  kasan_report+0x12/0x20
[  104.525998][    C1]  check_memory_region+0x134/0x1a0
[  104.531493][    C1]  __kasan_check_read+0x11/0x20
[  104.537074][    C1]  bitmap_ipmac_gc+0x119/0x590
[  104.542101][    C1]  call_timer_fn+0x1ac/0x780
[  104.546687][    C1]  ? bitmap_ipmac_list+0x1080/0x1080
[  104.552000][    C1]  ? msleep_interruptible+0x150/0x150
[  104.557487][    C1]  ? run_timer_softirq+0x6b1/0x1790
[  104.564003][    C1]  ? trace_hardirqs_on+0x67/0x240
[  104.569955][    C1]  ? bitmap_ipmac_list+0x1080/0x1080
[  104.575252][    C1]  ? bitmap_ipmac_list+0x1080/0x1080
[  104.580888][    C1]  run_timer_softirq+0x6c3/0x1790
[  104.586151][    C1]  ? add_timer+0x930/0x930
[  104.590851][    C1]  ? rcu_lockdep_current_cpu_online+0xe3/0x130
[  104.597323][    C1]  ? rcu_read_lock_sched_held+0x9c/0xd0
[  104.603176][    C1]  ? rcu_read_lock_any_held.part.0+0x50/0x50
[  104.609171][    C1]  ? trace_hardirqs_on+0x67/0x240
[  104.614787][    C1]  __do_softirq+0x262/0x98c
[  104.619467][    C1]  ? sched_clock_cpu+0x1b/0x1b0
[  104.624738][    C1]  irq_exit+0x19b/0x1e0
[  104.629170][    C1]  smp_apic_timer_interrupt+0x1a3/0x610
[  104.635322][    C1]  apic_timer_interrupt+0xf/0x20
[  104.640440][    C1]  </IRQ>
[  104.643385][    C1] RIP: 0010:_raw_spin_unlock_irqrestore+0x90/0xe0
[  104.650073][    C1] Code: 48 c7 c0 78 ba b3 89 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 39 48 83 3d 3f ae c5 01 00 74 24 48 89 df 57 9d <0f> 1f 44 00 00 bf 01 00 00 00 e8 61 d4 62 f9 65 8b 05 32 12 14 78
[  104.670068][    C1] RSP: 0018:ffffc900033f78c8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
[  104.678815][    C1] RAX: 1ffffffff136774f RBX: 0000000000000286 RCX: 0000000000000000
[  104.687183][    C1] RDX: dffffc0000000000 RSI: 0000000000000006 RDI: 0000000000000286
[  104.695155][    C1] RBP: ffffc900033f78d8 R08: ffff888094d9e4c0 R09: 0000000000000000
[  104.703338][    C1] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff8baec008
[  104.711649][    C1] R13: ffffffff8baec008 R14: ffff88808a295000 R15: 0000000000000000
[  104.719816][    C1]  debug_check_no_obj_freed+0x20a/0x43f
[  104.725700][    C1]  ? rcu_read_lock_sched_held+0x9c/0xd0
[  104.731254][    C1]  __free_pages_ok+0x266/0xea0
[  104.736152][    C1]  free_compound_page+0x97/0xd0
[  104.741343][    C1]  free_transhuge_page+0x2a7/0x3b0
[  104.746598][    C1]  __put_compound_page+0x90/0xd0
[  104.751835][    C1]  release_pages+0x679/0x1ac0
[  104.756802][    C1]  ? __activate_page+0x1460/0x1460
[  104.761920][    C1]  ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[  104.768668][    C1]  ? lru_add_drain_cpu+0x212/0x5c0
[  104.774304][    C1]  free_pages_and_swap_cache+0x2c3/0x3f0
[  104.780334][    C1]  tlb_flush_mmu+0x89/0x630
[  104.785229][    C1]  tlb_finish_mmu+0x98/0x3b0
[  104.789819][    C1]  exit_mmap+0x2da/0x530
[  104.794889][    C1]  ? __ia32_sys_munmap+0x80/0x80
[  104.799966][    C1]  ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[  104.806311][    C1]  ? __khugepaged_exit+0xcf/0x410
[  104.811969][    C1]  mmput+0x179/0x4d0
[  104.815973][    C1]  do_exit+0xae4/0x2f80
[  104.820509][    C1]  ? mm_update_next_owner+0x7c0/0x7c0
[  104.826645][    C1]  ? up_read+0x1cd/0x810
[  104.831393][    C1]  ? down_read_non_owner+0x490/0x490
[  104.837014][    C1]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[  104.842655][    C1]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[  104.848898][    C1]  do_group_exit+0x135/0x360
[  104.853800][    C1]  __x64_sys_exit_group+0x44/0x50
[  104.859057][    C1]  do_syscall_64+0xfa/0x790
[  104.863814][    C1]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  104.870235][    C1] RIP: 0033:0x440068
[  104.874676][    C1] Code: Bad RIP value.
[  104.879020][    C1] RSP: 002b:00007ffd4e02aa58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[  104.887996][    C1] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000440068
[  104.896779][    C1] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[  104.905509][    C1] RBP: 00000000004bf8f0 R08: 00000000000000e7 R09: ffffffffffffffd0
[  104.915593][    C1] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000001
[  104.924517][    C1] R13: 00000000006d1180 R14: 0000000000000000 R15: 0000000000000000
[  104.936220][    C1] 
[  104.938661][    C1] Allocated by task 9821:
[  104.943175][    C1]  save_stack+0x23/0x90
[  104.947919][    C1]  __kasan_kmalloc.constprop.0+0xcf/0xe0
[  104.953855][    C1]  kasan_kmalloc+0x9/0x10
[  104.958197][    C1]  __kmalloc+0x163/0x770
[  104.963468][    C1]  ip_set_alloc+0x38/0x5e
[  104.968533][    C1]  bitmap_ipmac_create+0x4e8/0xa00
[  104.974174][    C1]  ip_set_create+0x6f1/0x1500
[  104.979489][    C1]  nfnetlink_rcv_msg+0xcf2/0xfb0
[  104.984852][    C1]  netlink_rcv_skb+0x177/0x450
[  104.990088][    C1]  nfnetlink_rcv+0x1ba/0x460
[  104.995645][    C1]  netlink_unicast+0x59e/0x7e0
[  105.000802][    C1]  netlink_sendmsg+0x91c/0xea0
[  105.006542][    C1]  sock_sendmsg+0xd7/0x130
[  105.011495][    C1]  ____sys_sendmsg+0x753/0x880
[  105.016509][    C1]  ___sys_sendmsg+0x100/0x170
[  105.021503][    C1]  __sys_sendmsg+0x105/0x1d0
[  105.026541][    C1]  __x64_sys_sendmsg+0x78/0xb0
[  105.031511][    C1]  do_syscall_64+0xfa/0x790
[  105.036623][    C1]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  105.043726][    C1] 
[  105.046068][    C1] Freed by task 4182:
[  105.050203][    C1]  save_stack+0x23/0x90
[  105.054598][    C1]  __kasan_slab_free+0x102/0x150
[  105.060782][    C1]  kasan_slab_free+0xe/0x10
[  105.065504][    C1]  kfree+0x10a/0x2c0
[  105.069733][    C1]  tomoyo_path_number_perm+0x454/0x520
[  105.075598][    C1]  tomoyo_file_ioctl+0x23/0x30
[  105.080737][    C1]  security_file_ioctl+0x77/0xc0
[  105.085956][    C1]  ksys_ioctl+0x56/0x180
[  105.090205][    C1]  __x64_sys_ioctl+0x73/0xb0
[  105.095000][    C1]  do_syscall_64+0xfa/0x790
[  105.100325][    C1]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  105.106769][    C1] 
[  105.109981][    C1] The buggy address belongs to the object at ffff8880a6b3f0c0
[  105.109981][    C1]  which belongs to the cache kmalloc-32 of size 32
[  105.124801][    C1] The buggy address is located 0 bytes inside of
[  105.124801][    C1]  32-byte region [ffff8880a6b3f0c0, ffff8880a6b3f0e0)
[  105.139175][    C1] The buggy address belongs to the page:
[  105.145210][    C1] page:ffffea00029acfc0 refcount:1 mapcount:0 mapping:ffff8880aa4001c0 index:0xffff8880a6b3ffc1
[  105.155760][    C1] flags: 0xfffe0000000200(slab)
[  105.160921][    C1] raw: 00fffe0000000200 ffffea00025462c8 ffffea000277ca48 ffff8880aa4001c0
[  105.171190][    C1] raw: ffff8880a6b3ffc1 ffff8880a6b3f000 000000010000003f 0000000000000000
[  105.180030][    C1] page dumped because: kasan: bad access detected
[  105.187145][    C1] 
[  105.189640][    C1] Memory state around the buggy address:
[  105.195952][    C1]  ffff8880a6b3ef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  105.204489][    C1]  ffff8880a6b3f000: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
[  105.213436][    C1] >ffff8880a6b3f080: fb fb fb fb fc fc fc fc 04 fc fc fc fc fc fc fc
[  105.222232][    C1]                                            ^
[  105.228642][    C1]  ffff8880a6b3f100: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
[  105.237022][    C1]  ffff8880a6b3f180: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
[  105.245901][    C1] ==================================================================
[  105.254344][    C1] Disabling lock debugging due to kernel taint
[  105.261955][    C1] Kernel panic - not syncing: panic_on_warn set ...
[  105.269134][    C1] CPU: 1 PID: 10149 Comm: syz-executor695 Tainted: G    B             5.5.0-rc6-next-20200116-syzkaller #0
[  105.281559][    C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  105.292176][    C1] Call Trace:
[  105.295763][    C1]  <IRQ>
[  105.298715][    C1]  dump_stack+0x197/0x210
[  105.303365][    C1]  panic+0x2e3/0x75c
[  105.307694][    C1]  ? add_taint.cold+0x16/0x16
[  105.313017][    C1]  ? retint_kernel+0x2b/0x2b
[  105.318245][    C1]  ? trace_hardirqs_on+0x5e/0x240
[  105.324217][    C1]  ? bitmap_ipmac_gc+0x119/0x590
[  105.329400][    C1]  end_report+0x47/0x4f
[  105.333720][    C1]  ? bitmap_ipmac_gc+0x119/0x590
[  105.339058][    C1]  __kasan_report.cold+0xe/0x32
[  105.344137][    C1]  ? bitmap_ipmac_gc+0x119/0x590
[  105.349182][    C1]  kasan_report+0x12/0x20
[  105.354231][    C1]  check_memory_region+0x134/0x1a0
[  105.359353][    C1]  __kasan_check_read+0x11/0x20
[  105.364695][    C1]  bitmap_ipmac_gc+0x119/0x590
[  105.370006][    C1]  call_timer_fn+0x1ac/0x780
[  105.374954][    C1]  ? bitmap_ipmac_list+0x1080/0x1080
[  105.381672][    C1]  ? msleep_interruptible+0x150/0x150
[  105.387398][    C1]  ? run_timer_softirq+0x6b1/0x1790
[  105.393165][    C1]  ? trace_hardirqs_on+0x67/0x240
[  105.398661][    C1]  ? bitmap_ipmac_list+0x1080/0x1080
[  105.404808][    C1]  ? bitmap_ipmac_list+0x1080/0x1080
[  105.410206][    C1]  run_timer_softirq+0x6c3/0x1790
[  105.416316][    C1]  ? add_timer+0x930/0x930
[  105.420870][    C1]  ? rcu_lockdep_current_cpu_online+0xe3/0x130
[  105.427199][    C1]  ? rcu_read_lock_sched_held+0x9c/0xd0
[  105.434237][    C1]  ? rcu_read_lock_any_held.part.0+0x50/0x50
[  105.440826][    C1]  ? trace_hardirqs_on+0x67/0x240
[  105.446702][    C1]  __do_softirq+0x262/0x98c
[  105.451211][    C1]  ? sched_clock_cpu+0x1b/0x1b0
[  105.457425][    C1]  irq_exit+0x19b/0x1e0
[  105.461849][    C1]  smp_apic_timer_interrupt+0x1a3/0x610
[  105.468273][    C1]  apic_timer_interrupt+0xf/0x20
[  105.473904][    C1]  </IRQ>
[  105.477107][    C1] RIP: 0010:_raw_spin_unlock_irqrestore+0x90/0xe0
[  105.485540][    C1] Code: 48 c7 c0 78 ba b3 89 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 39 48 83 3d 3f ae c5 01 00 74 24 48 89 df 57 9d <0f> 1f 44 00 00 bf 01 00 00 00 e8 61 d4 62 f9 65 8b 05 32 12 14 78
[  105.507216][    C1] RSP: 0018:ffffc900033f78c8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
[  105.516478][    C1] RAX: 1ffffffff136774f RBX: 0000000000000286 RCX: 0000000000000000
[  105.526411][    C1] RDX: dffffc0000000000 RSI: 0000000000000006 RDI: 0000000000000286
[  105.534988][    C1] RBP: ffffc900033f78d8 R08: ffff888094d9e4c0 R09: 0000000000000000
[  105.544672][    C1] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff8baec008
[  105.555066][    C1] R13: ffffffff8baec008 R14: ffff88808a295000 R15: 0000000000000000
[  105.564555][    C1]  debug_check_no_obj_freed+0x20a/0x43f
[  105.570819][    C1]  ? rcu_read_lock_sched_held+0x9c/0xd0
[  105.577150][    C1]  __free_pages_ok+0x266/0xea0
[  105.582619][    C1]  free_compound_page+0x97/0xd0
[  105.588599][    C1]  free_transhuge_page+0x2a7/0x3b0
[  105.594856][    C1]  __put_compound_page+0x90/0xd0
[  105.599898][    C1]  release_pages+0x679/0x1ac0
[  105.604927][    C1]  ? __activate_page+0x1460/0x1460
[  105.610562][    C1]  ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[  105.617505][    C1]  ? lru_add_drain_cpu+0x212/0x5c0
[  105.623100][    C1]  free_pages_and_swap_cache+0x2c3/0x3f0
[  105.629430][    C1]  tlb_flush_mmu+0x89/0x630
[  105.634114][    C1]  tlb_finish_mmu+0x98/0x3b0
[  105.639078][    C1]  exit_mmap+0x2da/0x530
[  105.644309][    C1]  ? __ia32_sys_munmap+0x80/0x80
[  105.650313][    C1]  ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[  105.657243][    C1]  ? __khugepaged_exit+0xcf/0x410
[  105.662760][    C1]  mmput+0x179/0x4d0
[  105.666768][    C1]  do_exit+0xae4/0x2f80
[  105.671422][    C1]  ? mm_update_next_owner+0x7c0/0x7c0
[  105.678118][    C1]  ? up_read+0x1cd/0x810
[  105.683137][    C1]  ? down_read_non_owner+0x490/0x490
[  105.689392][    C1]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[  105.695901][    C1]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[  105.702287][    C1]  do_group_exit+0x135/0x360
[  105.708244][    C1]  __x64_sys_exit_group+0x44/0x50
[  105.714842][    C1]  do_syscall_64+0xfa/0x790
[  105.720120][    C1]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  105.726352][    C1] RIP: 0033:0x440068
[  105.730679][    C1] Code: Bad RIP value.
[  105.735956][    C1] RSP: 002b:00007ffd4e02aa58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[  105.745328][    C1] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000440068
[  105.754511][    C1] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[  105.764902][    C1] RBP: 00000000004bf8f0 R08: 00000000000000e7 R09: ffffffffffffffd0
[  105.773029][    C1] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000001
[  105.781676][    C1] R13: 00000000006d1180 R14: 0000000000000000 R15: 0000000000000000
[  105.794202][    C1] Kernel Offset: disabled
[  105.799071][    C1] Rebooting in 86400 seconds..