[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 84.447708][ T26] kauditd_printk_skb: 4 callbacks suppressed [ 84.447721][ T26] audit: type=1800 audit(1579432442.456:29): pid=9837 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 84.474576][ T26] audit: type=1800 audit(1579432442.456:30): pid=9837 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.237' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 96.261461][ T9993] ================================================================== [ 96.269816][ T9993] BUG: KASAN: slab-out-of-bounds in bitmap_ip_list+0x40f/0xf20 [ 96.277596][ T9993] Read of size 8 at addr ffff8880a92b8200 by task syz-executor109/9993 [ 96.286104][ T9993] [ 96.288435][ T9993] CPU: 0 PID: 9993 Comm: syz-executor109 Not tainted 5.5.0-rc6-syzkaller #0 [ 96.297100][ T9993] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 96.307176][ T9993] Call Trace: [ 96.310657][ T9993] dump_stack+0x197/0x210 [ 96.315160][ T9993] ? bitmap_ip_list+0x40f/0xf20 [ 96.320068][ T9993] print_address_description.constprop.0.cold+0xd4/0x30b [ 96.327193][ T9993] ? bitmap_ip_list+0x40f/0xf20 [ 96.332264][ T9993] ? bitmap_ip_list+0x40f/0xf20 [ 96.337121][ T9993] __kasan_report.cold+0x1b/0x41 [ 96.342054][ T9993] ? bitmap_ip_list+0x40f/0xf20 [ 96.346919][ T9993] kasan_report+0x12/0x20 [ 96.351366][ T9993] check_memory_region+0x134/0x1a0 [ 96.356475][ T9993] __kasan_check_read+0x11/0x20 [ 96.361324][ T9993] bitmap_ip_list+0x40f/0xf20 [ 96.366013][ T9993] ? bitmap_ip_add+0xe60/0xe60 [ 96.370788][ T9993] ? nla_put+0x110/0x150 [ 96.375040][ T9993] ip_set_dump_start+0x96c/0x1ca0 [ 96.380074][ T9993] ? ip_set_rename+0x720/0x720 [ 96.385236][ T9993] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 96.390772][ T9993] ? perf_trace_lock_acquire+0x4a0/0x530 [ 96.396405][ T9993] ? __kasan_check_write+0x14/0x20 [ 96.401631][ T9993] netlink_dump+0x558/0xfb0 [ 96.406239][ T9993] ? __netlink_sendskb+0xc0/0xc0 [ 96.411187][ T9993] __netlink_dump_start+0x66a/0x930 [ 96.416450][ T9993] ip_set_dump+0x15a/0x1d0 [ 96.420863][ T9993] ? call_ad+0x5a0/0x5a0 [ 96.425094][ T9993] ? ip_set_rename+0x720/0x720 [ 96.429842][ T9993] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 96.435646][ T9993] ? call_ad+0x5a0/0x5a0 [ 96.439895][ T9993] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 96.444850][ T9993] ? nfnetlink_bind+0x2c0/0x2c0 [ 96.449974][ T9993] ? __kasan_check_read+0x11/0x20 [ 96.455002][ T9993] ? __lock_acquire+0x8a0/0x4a00 [ 96.459944][ T9993] ? save_stack+0x5c/0x90 [ 96.464627][ T9993] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 96.470923][ T9993] ? apparmor_capable+0x497/0x900 [ 96.475972][ T9993] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 96.482286][ T9993] ? __kasan_check_read+0x11/0x20 [ 96.487418][ T9993] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 96.492874][ T9993] netlink_rcv_skb+0x177/0x450 [ 96.497633][ T9993] ? nfnetlink_bind+0x2c0/0x2c0 [ 96.502499][ T9993] ? netlink_ack+0xb50/0xb50 [ 96.507090][ T9993] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 96.513482][ T9993] ? ns_capable_common+0x93/0x100 [ 96.518830][ T9993] ? ns_capable+0x20/0x30 [ 96.523232][ T9993] ? __netlink_ns_capable+0x104/0x140 [ 96.528609][ T9993] nfnetlink_rcv+0x1ba/0x460 [ 96.533203][ T9993] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 96.538702][ T9993] ? netlink_deliver_tap+0x24a/0xbe0 [ 96.543984][ T9993] ? __kasan_check_write+0x14/0x20 [ 96.549182][ T9993] netlink_unicast+0x58c/0x7d0 [ 96.554014][ T9993] ? netlink_attachskb+0x870/0x870 [ 96.559183][ T9993] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 96.564903][ T9993] ? __check_object_size+0x3d/0x437 [ 96.570107][ T9993] netlink_sendmsg+0x91c/0xea0 [ 96.574983][ T9993] ? netlink_unicast+0x7d0/0x7d0 [ 96.580047][ T9993] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 96.586033][ T9993] ? apparmor_socket_sendmsg+0x2a/0x30 [ 96.591499][ T9993] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 96.597751][ T9993] ? security_socket_sendmsg+0x8d/0xc0 [ 96.603222][ T9993] ? netlink_unicast+0x7d0/0x7d0 [ 96.608240][ T9993] sock_sendmsg+0xd7/0x130 [ 96.612650][ T9993] ____sys_sendmsg+0x753/0x880 [ 96.617460][ T9993] ? kernel_sendmsg+0x50/0x50 [ 96.622130][ T9993] ? lockdep_init_map+0x1be/0x6d0 [ 96.627158][ T9993] ___sys_sendmsg+0x100/0x170 [ 96.631837][ T9993] ? sendmsg_copy_msghdr+0x70/0x70 [ 96.636946][ T9993] ? __kasan_check_read+0x11/0x20 [ 96.642663][ T9993] ? __lock_acquire+0x8a0/0x4a00 [ 96.647596][ T9993] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 96.654018][ T9993] ? __this_cpu_preempt_check+0x35/0x190 [ 96.659644][ T9993] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 96.665921][ T9993] ? percpu_counter_add_batch+0x13c/0x190 [ 96.671750][ T9993] ? __fd_install+0x1bc/0x640 [ 96.676423][ T9993] ? find_held_lock+0x35/0x130 [ 96.681185][ T9993] ? __fd_install+0x1bc/0x640 [ 96.685856][ T9993] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 96.692086][ T9993] ? __fget_light+0x1a9/0x230 [ 96.696827][ T9993] ? __fdget+0x1b/0x20 [ 96.700887][ T9993] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 96.707119][ T9993] __sys_sendmsg+0x105/0x1d0 [ 96.711705][ T9993] ? __sys_sendmsg_sock+0xc0/0xc0 [ 96.716726][ T9993] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 96.722938][ T9993] ? do_syscall_64+0x26/0x790 [ 96.727686][ T9993] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 96.733748][ T9993] ? do_syscall_64+0x26/0x790 [ 96.739350][ T9993] __x64_sys_sendmsg+0x78/0xb0 [ 96.744123][ T9993] do_syscall_64+0xfa/0x790 [ 96.748626][ T9993] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 96.754647][ T9993] RIP: 0033:0x440569 [ 96.758660][ T9993] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 96.778301][ T9993] RSP: 002b:00007ffdeb529488 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 96.786712][ T9993] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440569 [ 96.794883][ T9993] RDX: 0000000000000010 RSI: 00000000200003c0 RDI: 0000000000000004 [ 96.802961][ T9993] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 96.811042][ T9993] R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000401df0 [ 96.819009][ T9993] R13: 0000000000401e80 R14: 0000000000000000 R15: 0000000000000000 [ 96.827145][ T9993] [ 96.829467][ T9993] Allocated by task 9993: [ 96.833788][ T9993] save_stack+0x23/0x90 [ 96.837969][ T9993] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 96.843593][ T9993] kasan_kmalloc+0x9/0x10 [ 96.847908][ T9993] __kmalloc+0x163/0x770 [ 96.852147][ T9993] ip_set_alloc+0x38/0x5e [ 96.856470][ T9993] bitmap_ip_create+0x6ec/0xc20 [ 96.861318][ T9993] ip_set_create+0x6f1/0x1500 [ 96.866110][ T9993] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 96.871070][ T9993] netlink_rcv_skb+0x177/0x450 [ 96.875885][ T9993] nfnetlink_rcv+0x1ba/0x460 [ 96.880611][ T9993] netlink_unicast+0x58c/0x7d0 [ 96.885363][ T9993] netlink_sendmsg+0x91c/0xea0 [ 96.890131][ T9993] sock_sendmsg+0xd7/0x130 [ 96.894541][ T9993] ____sys_sendmsg+0x753/0x880 [ 96.899377][ T9993] ___sys_sendmsg+0x100/0x170 [ 96.904049][ T9993] __sys_sendmsg+0x105/0x1d0 [ 96.908631][ T9993] __x64_sys_sendmsg+0x78/0xb0 [ 96.913388][ T9993] do_syscall_64+0xfa/0x790 [ 96.918011][ T9993] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 96.923887][ T9993] [ 96.926195][ T9993] Freed by task 9718: [ 96.930190][ T9993] save_stack+0x23/0x90 [ 96.934373][ T9993] __kasan_slab_free+0x102/0x150 [ 96.939312][ T9993] kasan_slab_free+0xe/0x10 [ 96.943922][ T9993] kfree+0x10a/0x2c0 [ 96.947810][ T9993] single_release+0x95/0xc0 [ 96.952300][ T9993] __fput+0x2ff/0x890 [ 96.956467][ T9993] ____fput+0x16/0x20 [ 96.960440][ T9993] task_work_run+0x145/0x1c0 [ 96.965019][ T9993] exit_to_usermode_loop+0x316/0x380 [ 96.970430][ T9993] do_syscall_64+0x676/0x790 [ 96.975264][ T9993] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 96.981164][ T9993] [ 96.983490][ T9993] The buggy address belongs to the object at ffff8880a92b8200 [ 96.983490][ T9993] which belongs to the cache kmalloc-32 of size 32 [ 96.997703][ T9993] The buggy address is located 0 bytes inside of [ 96.997703][ T9993] 32-byte region [ffff8880a92b8200, ffff8880a92b8220) [ 97.010704][ T9993] The buggy address belongs to the page: [ 97.016377][ T9993] page:ffffea0002a4ae00 refcount:1 mapcount:0 mapping:ffff8880aa4001c0 index:0xffff8880a92b8fc1 [ 97.026801][ T9993] raw: 00fffe0000000200 ffffea0002743588 ffffea000253e388 ffff8880aa4001c0 [ 97.035389][ T9993] raw: ffff8880a92b8fc1 ffff8880a92b8000 0000000100000032 0000000000000000 [ 97.044125][ T9993] page dumped because: kasan: bad access detected [ 97.050641][ T9993] [ 97.053141][ T9993] Memory state around the buggy address: [ 97.058774][ T9993] ffff8880a92b8100: 00 02 fc fc fc fc fc fc 00 00 fc fc fc fc fc fc [ 97.066885][ T9993] ffff8880a92b8180: 06 fc fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 97.075118][ T9993] >ffff8880a92b8200: 04 fc fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 97.083226][ T9993] ^ [ 97.087289][ T9993] ffff8880a92b8280: fb fb fb fb fc fc fc fc 00 fc fc fc fc fc fc fc [ 97.095341][ T9993] ffff8880a92b8300: fb fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 97.103391][ T9993] ================================================================== [ 97.111443][ T9993] Disabling lock debugging due to kernel taint [ 97.118290][ T9993] Kernel panic - not syncing: panic_on_warn set ... [ 97.124883][ T9993] CPU: 0 PID: 9993 Comm: syz-executor109 Tainted: G B 5.5.0-rc6-syzkaller #0 [ 97.134931][ T9993] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 97.144981][ T9993] Call Trace: [ 97.148317][ T9993] dump_stack+0x197/0x210 [ 97.152644][ T9993] panic+0x2e3/0x75c [ 97.156559][ T9993] ? add_taint.cold+0x16/0x16 [ 97.161301][ T9993] ? bitmap_ip_list+0x40f/0xf20 [ 97.166144][ T9993] ? preempt_schedule+0x4b/0x60 [ 97.170986][ T9993] ? ___preempt_schedule+0x16/0x18 [ 97.176082][ T9993] ? trace_hardirqs_on+0x5e/0x240 [ 97.181100][ T9993] ? bitmap_ip_list+0x40f/0xf20 [ 97.185941][ T9993] end_report+0x47/0x4f [ 97.190082][ T9993] ? bitmap_ip_list+0x40f/0xf20 [ 97.194931][ T9993] __kasan_report.cold+0xe/0x41 [ 97.199774][ T9993] ? bitmap_ip_list+0x40f/0xf20 [ 97.204634][ T9993] kasan_report+0x12/0x20 [ 97.208971][ T9993] check_memory_region+0x134/0x1a0 [ 97.214170][ T9993] __kasan_check_read+0x11/0x20 [ 97.219055][ T9993] bitmap_ip_list+0x40f/0xf20 [ 97.223723][ T9993] ? bitmap_ip_add+0xe60/0xe60 [ 97.229257][ T9993] ? nla_put+0x110/0x150 [ 97.233592][ T9993] ip_set_dump_start+0x96c/0x1ca0 [ 97.238702][ T9993] ? ip_set_rename+0x720/0x720 [ 97.243467][ T9993] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 97.249084][ T9993] ? perf_trace_lock_acquire+0x4a0/0x530 [ 97.254835][ T9993] ? __kasan_check_write+0x14/0x20 [ 97.260107][ T9993] netlink_dump+0x558/0xfb0 [ 97.264849][ T9993] ? __netlink_sendskb+0xc0/0xc0 [ 97.269811][ T9993] __netlink_dump_start+0x66a/0x930 [ 97.275006][ T9993] ip_set_dump+0x15a/0x1d0 [ 97.279416][ T9993] ? call_ad+0x5a0/0x5a0 [ 97.283657][ T9993] ? ip_set_rename+0x720/0x720 [ 97.288414][ T9993] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 97.294216][ T9993] ? call_ad+0x5a0/0x5a0 [ 97.298464][ T9993] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 97.303413][ T9993] ? nfnetlink_bind+0x2c0/0x2c0 [ 97.308246][ T9993] ? __kasan_check_read+0x11/0x20 [ 97.313386][ T9993] ? __lock_acquire+0x8a0/0x4a00 [ 97.318750][ T9993] ? save_stack+0x5c/0x90 [ 97.323085][ T9993] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 97.329387][ T9993] ? apparmor_capable+0x497/0x900 [ 97.334493][ T9993] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 97.340762][ T9993] ? __kasan_check_read+0x11/0x20 [ 97.346007][ T9993] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 97.351458][ T9993] netlink_rcv_skb+0x177/0x450 [ 97.356424][ T9993] ? nfnetlink_bind+0x2c0/0x2c0 [ 97.361341][ T9993] ? netlink_ack+0xb50/0xb50 [ 97.366097][ T9993] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 97.372569][ T9993] ? ns_capable_common+0x93/0x100 [ 97.377585][ T9993] ? ns_capable+0x20/0x30 [ 97.382001][ T9993] ? __netlink_ns_capable+0x104/0x140 [ 97.387371][ T9993] nfnetlink_rcv+0x1ba/0x460 [ 97.392119][ T9993] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 97.398165][ T9993] ? netlink_deliver_tap+0x24a/0xbe0 [ 97.403441][ T9993] ? __kasan_check_write+0x14/0x20 [ 97.408815][ T9993] netlink_unicast+0x58c/0x7d0 [ 97.413653][ T9993] ? netlink_attachskb+0x870/0x870 [ 97.419058][ T9993] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 97.425137][ T9993] ? __check_object_size+0x3d/0x437 [ 97.430363][ T9993] netlink_sendmsg+0x91c/0xea0 [ 97.436286][ T9993] ? netlink_unicast+0x7d0/0x7d0 [ 97.441321][ T9993] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 97.446914][ T9993] ? apparmor_socket_sendmsg+0x2a/0x30 [ 97.452548][ T9993] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 97.458788][ T9993] ? security_socket_sendmsg+0x8d/0xc0 [ 97.464240][ T9993] ? netlink_unicast+0x7d0/0x7d0 [ 97.470851][ T9993] sock_sendmsg+0xd7/0x130 [ 97.475270][ T9993] ____sys_sendmsg+0x753/0x880 [ 97.480135][ T9993] ? kernel_sendmsg+0x50/0x50 [ 97.484814][ T9993] ? lockdep_init_map+0x1be/0x6d0 [ 97.490053][ T9993] ___sys_sendmsg+0x100/0x170 [ 97.494801][ T9993] ? sendmsg_copy_msghdr+0x70/0x70 [ 97.500165][ T9993] ? __kasan_check_read+0x11/0x20 [ 97.505401][ T9993] ? __lock_acquire+0x8a0/0x4a00 [ 97.510356][ T9993] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 97.516604][ T9993] ? __this_cpu_preempt_check+0x35/0x190 [ 97.522540][ T9993] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 97.529167][ T9993] ? percpu_counter_add_batch+0x13c/0x190 [ 97.535104][ T9993] ? __fd_install+0x1bc/0x640 [ 97.539776][ T9993] ? find_held_lock+0x35/0x130 [ 97.544644][ T9993] ? __fd_install+0x1bc/0x640 [ 97.549309][ T9993] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 97.556063][ T9993] ? __fget_light+0x1a9/0x230 [ 97.560895][ T9993] ? __fdget+0x1b/0x20 [ 97.565042][ T9993] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 97.571402][ T9993] __sys_sendmsg+0x105/0x1d0 [ 97.576028][ T9993] ? __sys_sendmsg_sock+0xc0/0xc0 [ 97.581094][ T9993] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 97.586845][ T9993] ? do_syscall_64+0x26/0x790 [ 97.591515][ T9993] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 97.597829][ T9993] ? do_syscall_64+0x26/0x790 [ 97.602516][ T9993] __x64_sys_sendmsg+0x78/0xb0 [ 97.607276][ T9993] do_syscall_64+0xfa/0x790 [ 97.612000][ T9993] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 97.617887][ T9993] RIP: 0033:0x440569 [ 97.621774][ T9993] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 97.642890][ T9993] RSP: 002b:00007ffdeb529488 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 97.651543][ T9993] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440569 [ 97.660117][ T9993] RDX: 0000000000000010 RSI: 00000000200003c0 RDI: 0000000000000004 [ 97.668174][ T9993] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 97.676144][ T9993] R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000401df0 [ 97.684162][ T9993] R13: 0000000000401e80 R14: 0000000000000000 R15: 0000000000000000 [ 97.694102][ T9993] Kernel Offset: disabled [ 97.703000][ T9993] Rebooting in 86400 seconds..