[ 87.421403][ T27] audit: type=1800 audit(1579383384.410:24): pid=9689 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="sudo" dev="sda1" ino=2454 res=0 [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 88.120511][ T27] audit: type=1800 audit(1579383385.200:25): pid=9689 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 88.140469][ T27] audit: type=1800 audit(1579383385.200:26): pid=9689 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.175' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 99.847935][ T9842] ================================================================== [ 99.856176][ T9842] BUG: KASAN: slab-out-of-bounds in bitmap_ipmac_list+0x635/0x1080 [ 99.864146][ T9842] Read of size 8 at addr ffff888095934b80 by task syz-executor208/9842 [ 99.872374][ T9842] [ 99.874696][ T9842] CPU: 1 PID: 9842 Comm: syz-executor208 Not tainted 5.5.0-rc5-syzkaller #0 [ 99.883348][ T9842] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 99.893391][ T9842] Call Trace: [ 99.896681][ T9842] dump_stack+0x197/0x210 [ 99.900997][ T9842] ? bitmap_ipmac_list+0x635/0x1080 [ 99.906184][ T9842] print_address_description.constprop.0.cold+0xd4/0x30b [ 99.913197][ T9842] ? bitmap_ipmac_list+0x635/0x1080 [ 99.918393][ T9842] ? bitmap_ipmac_list+0x635/0x1080 [ 99.923579][ T9842] __kasan_report.cold+0x1b/0x41 [ 99.928523][ T9842] ? bitmap_ipmac_list+0x635/0x1080 [ 99.933710][ T9842] kasan_report+0x12/0x20 [ 99.938040][ T9842] check_memory_region+0x134/0x1a0 [ 99.943139][ T9842] __kasan_check_read+0x11/0x20 [ 99.947975][ T9842] bitmap_ipmac_list+0x635/0x1080 [ 99.952998][ T9842] ? bitmap_ipmac_head+0x8a0/0x8a0 [ 99.958100][ T9842] ? nla_put+0x110/0x150 [ 99.962328][ T9842] ip_set_dump_start+0x96c/0x1ca0 [ 99.967347][ T9842] ? ip_set_rename+0x720/0x720 [ 99.972098][ T9842] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 99.977643][ T9842] ? perf_trace_lock_acquire+0x4b0/0x530 [ 99.983274][ T9842] ? __kasan_check_write+0x14/0x20 [ 99.988380][ T9842] netlink_dump+0x558/0xfb0 [ 99.992882][ T9842] ? __netlink_sendskb+0xc0/0xc0 [ 99.997920][ T9842] __netlink_dump_start+0x66a/0x930 [ 100.003107][ T9842] ip_set_dump+0x15a/0x1d0 [ 100.007686][ T9842] ? call_ad+0x5a0/0x5a0 [ 100.011927][ T9842] ? ip_set_rename+0x720/0x720 [ 100.016677][ T9842] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 100.022479][ T9842] ? call_ad+0x5a0/0x5a0 [ 100.026710][ T9842] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 100.031660][ T9842] ? nfnetlink_bind+0x2c0/0x2c0 [ 100.036504][ T9842] ? __kasan_check_read+0x11/0x20 [ 100.041514][ T9842] ? __lock_acquire+0x8a0/0x4a00 [ 100.046451][ T9842] ? save_stack+0x5c/0x90 [ 100.050771][ T9842] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 100.057011][ T9842] ? apparmor_capable+0x497/0x900 [ 100.062040][ T9842] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 100.068320][ T9842] ? __kasan_check_read+0x11/0x20 [ 100.073348][ T9842] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 100.078846][ T9842] netlink_rcv_skb+0x177/0x450 [ 100.083609][ T9842] ? nfnetlink_bind+0x2c0/0x2c0 [ 100.088565][ T9842] ? netlink_ack+0xb50/0xb50 [ 100.093154][ T9842] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 100.099403][ T9842] ? ns_capable_common+0x93/0x100 [ 100.104419][ T9842] ? ns_capable+0x20/0x30 [ 100.108852][ T9842] ? __netlink_ns_capable+0x104/0x140 [ 100.114225][ T9842] nfnetlink_rcv+0x1ba/0x460 [ 100.118877][ T9842] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 100.124324][ T9842] ? netlink_deliver_tap+0x24a/0xbe0 [ 100.129660][ T9842] ? __kasan_check_write+0x14/0x20 [ 100.134763][ T9842] netlink_unicast+0x58c/0x7d0 [ 100.139535][ T9842] ? netlink_attachskb+0x870/0x870 [ 100.144656][ T9842] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 100.150381][ T9842] ? __check_object_size+0x3d/0x437 [ 100.155648][ T9842] netlink_sendmsg+0x91c/0xea0 [ 100.160503][ T9842] ? netlink_unicast+0x7d0/0x7d0 [ 100.165438][ T9842] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 100.170994][ T9842] ? apparmor_socket_sendmsg+0x2a/0x30 [ 100.176514][ T9842] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 100.182767][ T9842] ? security_socket_sendmsg+0x8d/0xc0 [ 100.188220][ T9842] ? netlink_unicast+0x7d0/0x7d0 [ 100.193157][ T9842] sock_sendmsg+0xd7/0x130 [ 100.197608][ T9842] ____sys_sendmsg+0x753/0x880 [ 100.202376][ T9842] ? kernel_sendmsg+0x50/0x50 [ 100.207057][ T9842] ? lockdep_init_map+0x1be/0x6d0 [ 100.212094][ T9842] ___sys_sendmsg+0x100/0x170 [ 100.216815][ T9842] ? sendmsg_copy_msghdr+0x70/0x70 [ 100.221932][ T9842] ? __kasan_check_read+0x11/0x20 [ 100.226998][ T9842] ? __lock_acquire+0x8a0/0x4a00 [ 100.231937][ T9842] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 100.238182][ T9842] ? __this_cpu_preempt_check+0x35/0x190 [ 100.243806][ T9842] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 100.250048][ T9842] ? percpu_counter_add_batch+0x13c/0x190 [ 100.255774][ T9842] ? __fd_install+0x1bc/0x640 [ 100.260460][ T9842] ? find_held_lock+0x35/0x130 [ 100.266168][ T9842] ? __fd_install+0x1bc/0x640 [ 100.270848][ T9842] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 100.277159][ T9842] ? __fget_light+0x1a9/0x230 [ 100.281870][ T9842] ? __fdget+0x1b/0x20 [ 100.285931][ T9842] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 100.292221][ T9842] __sys_sendmsg+0x105/0x1d0 [ 100.296801][ T9842] ? __sys_sendmsg_sock+0xc0/0xc0 [ 100.301854][ T9842] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 100.307300][ T9842] ? do_syscall_64+0x26/0x790 [ 100.311967][ T9842] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 100.318049][ T9842] ? do_syscall_64+0x26/0x790 [ 100.322750][ T9842] __x64_sys_sendmsg+0x78/0xb0 [ 100.327570][ T9842] do_syscall_64+0xfa/0x790 [ 100.332060][ T9842] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 100.337936][ T9842] RIP: 0033:0x440529 [ 100.341818][ T9842] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 100.361413][ T9842] RSP: 002b:00007ffc3dcaeae8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 100.369812][ T9842] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440529 [ 100.377795][ T9842] RDX: 0000000000000000 RSI: 0000000020000380 RDI: 0000000000000004 [ 100.385770][ T9842] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 100.393729][ T9842] R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000401db0 [ 100.401693][ T9842] R13: 0000000000401e40 R14: 0000000000000000 R15: 0000000000000000 [ 100.409755][ T9842] [ 100.412066][ T9842] Allocated by task 9842: [ 100.416384][ T9842] save_stack+0x23/0x90 [ 100.420540][ T9842] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 100.426172][ T9842] kasan_kmalloc+0x9/0x10 [ 100.430520][ T9842] __kmalloc+0x163/0x770 [ 100.434750][ T9842] ip_set_alloc+0x38/0x5e [ 100.439075][ T9842] bitmap_ipmac_create+0x4e8/0xa00 [ 100.444174][ T9842] ip_set_create+0x6f1/0x1500 [ 100.448836][ T9842] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 100.453759][ T9842] netlink_rcv_skb+0x177/0x450 [ 100.458509][ T9842] nfnetlink_rcv+0x1ba/0x460 [ 100.463083][ T9842] netlink_unicast+0x58c/0x7d0 [ 100.467829][ T9842] netlink_sendmsg+0x91c/0xea0 [ 100.472608][ T9842] sock_sendmsg+0xd7/0x130 [ 100.477012][ T9842] ____sys_sendmsg+0x753/0x880 [ 100.481757][ T9842] ___sys_sendmsg+0x100/0x170 [ 100.486414][ T9842] __sys_sendmsg+0x105/0x1d0 [ 100.491002][ T9842] __x64_sys_sendmsg+0x78/0xb0 [ 100.495768][ T9842] do_syscall_64+0xfa/0x790 [ 100.500257][ T9842] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 100.506129][ T9842] [ 100.508440][ T9842] Freed by task 9564: [ 100.512424][ T9842] save_stack+0x23/0x90 [ 100.516578][ T9842] __kasan_slab_free+0x102/0x150 [ 100.521500][ T9842] kasan_slab_free+0xe/0x10 [ 100.525995][ T9842] kfree+0x10a/0x2c0 [ 100.529880][ T9842] tomoyo_check_open_permission+0x19e/0x3e0 [ 100.535759][ T9842] tomoyo_file_open+0xa9/0xd0 [ 100.540433][ T9842] security_file_open+0x71/0x300 [ 100.545357][ T9842] do_dentry_open+0x37a/0x1380 [ 100.550115][ T9842] vfs_open+0xa0/0xd0 [ 100.554082][ T9842] path_openat+0x10df/0x4500 [ 100.558654][ T9842] do_filp_open+0x1a1/0x280 [ 100.563170][ T9842] do_sys_open+0x3fe/0x5d0 [ 100.567582][ T9842] __x64_sys_open+0x7e/0xc0 [ 100.572069][ T9842] do_syscall_64+0xfa/0x790 [ 100.576556][ T9842] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 100.582425][ T9842] [ 100.584737][ T9842] The buggy address belongs to the object at ffff888095934b80 [ 100.584737][ T9842] which belongs to the cache kmalloc-32 of size 32 [ 100.598617][ T9842] The buggy address is located 0 bytes inside of [ 100.598617][ T9842] 32-byte region [ffff888095934b80, ffff888095934ba0) [ 100.611609][ T9842] The buggy address belongs to the page: [ 100.617233][ T9842] page:ffffea0002564d00 refcount:1 mapcount:0 mapping:ffff8880aa4001c0 index:0xffff888095934fc1 [ 100.627731][ T9842] raw: 00fffe0000000200 ffffea00027b3908 ffffea00028b3a48 ffff8880aa4001c0 [ 100.636303][ T9842] raw: ffff888095934fc1 ffff888095934000 000000010000002d 0000000000000000 [ 100.644888][ T9842] page dumped because: kasan: bad access detected [ 100.651281][ T9842] [ 100.653589][ T9842] Memory state around the buggy address: [ 100.659228][ T9842] ffff888095934a80: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 100.667275][ T9842] ffff888095934b00: 00 01 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 100.675410][ T9842] >ffff888095934b80: 04 fc fc fc fc fc fc fc 00 01 fc fc fc fc fc fc [ 100.683450][ T9842] ^ [ 100.687504][ T9842] ffff888095934c00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 100.695558][ T9842] ffff888095934c80: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 100.703602][ T9842] ================================================================== [ 100.711659][ T9842] Disabling lock debugging due to kernel taint [ 100.718928][ T9842] Kernel panic - not syncing: panic_on_warn set ... [ 100.726796][ T9842] CPU: 1 PID: 9842 Comm: syz-executor208 Tainted: G B 5.5.0-rc5-syzkaller #0 [ 100.736860][ T9842] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 100.746904][ T9842] Call Trace: [ 100.750204][ T9842] dump_stack+0x197/0x210 [ 100.754525][ T9842] panic+0x2e3/0x75c [ 100.758407][ T9842] ? add_taint.cold+0x16/0x16 [ 100.763069][ T9842] ? bitmap_ipmac_list+0x635/0x1080 [ 100.768265][ T9842] ? preempt_schedule+0x4b/0x60 [ 100.773107][ T9842] ? ___preempt_schedule+0x16/0x18 [ 100.778223][ T9842] ? trace_hardirqs_on+0x5e/0x240 [ 100.783263][ T9842] ? bitmap_ipmac_list+0x635/0x1080 [ 100.788486][ T9842] end_report+0x47/0x4f [ 100.792625][ T9842] ? bitmap_ipmac_list+0x635/0x1080 [ 100.797825][ T9842] __kasan_report.cold+0xe/0x41 [ 100.803009][ T9842] ? bitmap_ipmac_list+0x635/0x1080 [ 100.808203][ T9842] kasan_report+0x12/0x20 [ 100.812574][ T9842] check_memory_region+0x134/0x1a0 [ 100.817688][ T9842] __kasan_check_read+0x11/0x20 [ 100.822539][ T9842] bitmap_ipmac_list+0x635/0x1080 [ 100.827563][ T9842] ? bitmap_ipmac_head+0x8a0/0x8a0 [ 100.832665][ T9842] ? nla_put+0x110/0x150 [ 100.837018][ T9842] ip_set_dump_start+0x96c/0x1ca0 [ 100.842045][ T9842] ? ip_set_rename+0x720/0x720 [ 100.846805][ T9842] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 100.852344][ T9842] ? perf_trace_lock_acquire+0x4b0/0x530 [ 100.857963][ T9842] ? __kasan_check_write+0x14/0x20 [ 100.863076][ T9842] netlink_dump+0x558/0xfb0 [ 100.867698][ T9842] ? __netlink_sendskb+0xc0/0xc0 [ 100.872686][ T9842] __netlink_dump_start+0x66a/0x930 [ 100.877871][ T9842] ip_set_dump+0x15a/0x1d0 [ 100.882271][ T9842] ? call_ad+0x5a0/0x5a0 [ 100.886683][ T9842] ? ip_set_rename+0x720/0x720 [ 100.891443][ T9842] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 100.897249][ T9842] ? call_ad+0x5a0/0x5a0 [ 100.901491][ T9842] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 100.906475][ T9842] ? nfnetlink_bind+0x2c0/0x2c0 [ 100.911318][ T9842] ? __kasan_check_read+0x11/0x20 [ 100.916337][ T9842] ? __lock_acquire+0x8a0/0x4a00 [ 100.921447][ T9842] ? save_stack+0x5c/0x90 [ 100.925836][ T9842] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 100.932079][ T9842] ? apparmor_capable+0x497/0x900 [ 100.937091][ T9842] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 100.943353][ T9842] ? __kasan_check_read+0x11/0x20 [ 100.948380][ T9842] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 100.953849][ T9842] netlink_rcv_skb+0x177/0x450 [ 100.958597][ T9842] ? nfnetlink_bind+0x2c0/0x2c0 [ 100.963440][ T9842] ? netlink_ack+0xb50/0xb50 [ 100.968023][ T9842] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 100.974257][ T9842] ? ns_capable_common+0x93/0x100 [ 100.979275][ T9842] ? ns_capable+0x20/0x30 [ 100.983594][ T9842] ? __netlink_ns_capable+0x104/0x140 [ 100.988960][ T9842] nfnetlink_rcv+0x1ba/0x460 [ 100.993580][ T9842] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 100.999022][ T9842] ? netlink_deliver_tap+0x24a/0xbe0 [ 101.004297][ T9842] ? __kasan_check_write+0x14/0x20 [ 101.009391][ T9842] netlink_unicast+0x58c/0x7d0 [ 101.014137][ T9842] ? netlink_attachskb+0x870/0x870 [ 101.019240][ T9842] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 101.024965][ T9842] ? __check_object_size+0x3d/0x437 [ 101.030165][ T9842] netlink_sendmsg+0x91c/0xea0 [ 101.034928][ T9842] ? netlink_unicast+0x7d0/0x7d0 [ 101.039850][ T9842] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 101.045378][ T9842] ? apparmor_socket_sendmsg+0x2a/0x30 [ 101.050820][ T9842] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 101.057060][ T9842] ? security_socket_sendmsg+0x8d/0xc0 [ 101.062504][ T9842] ? netlink_unicast+0x7d0/0x7d0 [ 101.067425][ T9842] sock_sendmsg+0xd7/0x130 [ 101.071821][ T9842] ____sys_sendmsg+0x753/0x880 [ 101.076568][ T9842] ? kernel_sendmsg+0x50/0x50 [ 101.081240][ T9842] ? lockdep_init_map+0x1be/0x6d0 [ 101.086261][ T9842] ___sys_sendmsg+0x100/0x170 [ 101.091002][ T9842] ? sendmsg_copy_msghdr+0x70/0x70 [ 101.096101][ T9842] ? __kasan_check_read+0x11/0x20 [ 101.101275][ T9842] ? __lock_acquire+0x8a0/0x4a00 [ 101.106201][ T9842] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 101.112436][ T9842] ? __this_cpu_preempt_check+0x35/0x190 [ 101.118053][ T9842] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 101.124273][ T9842] ? percpu_counter_add_batch+0x13c/0x190 [ 101.130023][ T9842] ? __fd_install+0x1bc/0x640 [ 101.134733][ T9842] ? find_held_lock+0x35/0x130 [ 101.139482][ T9842] ? __fd_install+0x1bc/0x640 [ 101.144142][ T9842] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 101.150373][ T9842] ? __fget_light+0x1a9/0x230 [ 101.155047][ T9842] ? __fdget+0x1b/0x20 [ 101.159096][ T9842] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 101.165317][ T9842] __sys_sendmsg+0x105/0x1d0 [ 101.169890][ T9842] ? __sys_sendmsg_sock+0xc0/0xc0 [ 101.174912][ T9842] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 101.180353][ T9842] ? do_syscall_64+0x26/0x790 [ 101.185025][ T9842] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 101.191085][ T9842] ? do_syscall_64+0x26/0x790 [ 101.195762][ T9842] __x64_sys_sendmsg+0x78/0xb0 [ 101.200523][ T9842] do_syscall_64+0xfa/0x790 [ 101.205024][ T9842] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 101.210970][ T9842] RIP: 0033:0x440529 [ 101.214907][ T9842] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 101.234499][ T9842] RSP: 002b:00007ffc3dcaeae8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 101.242945][ T9842] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440529 [ 101.251003][ T9842] RDX: 0000000000000000 RSI: 0000000020000380 RDI: 0000000000000004 [ 101.258998][ T9842] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 101.266967][ T9842] R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000401db0 [ 101.275054][ T9842] R13: 0000000000401e40 R14: 0000000000000000 R15: 0000000000000000 [ 101.284548][ T9842] Kernel Offset: disabled [ 101.288882][ T9842] Rebooting in 86400 seconds..