[ 91.453012][ T26] audit: type=1800 audit(1579406541.052:26): pid=9626 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 92.511609][ T26] kauditd_printk_skb: 2 callbacks suppressed [ 92.511621][ T26] audit: type=1800 audit(1579406542.122:29): pid=9626 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 92.538111][ T26] audit: type=1800 audit(1579406542.132:30): pid=9626 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.1.44' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 103.655376][ T9778] ================================================================== [ 103.663878][ T9778] BUG: KASAN: slab-out-of-bounds in bitmap_ipmac_list+0x635/0x1080 [ 103.672283][ T9778] Read of size 8 at addr ffff8880a90e2b00 by task syz-executor330/9778 [ 103.682641][ T9778] [ 103.685141][ T9778] CPU: 0 PID: 9778 Comm: syz-executor330 Not tainted 5.5.0-rc6-syzkaller #0 [ 103.694113][ T9778] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 103.704342][ T9778] Call Trace: [ 103.707750][ T9778] dump_stack+0x197/0x210 [ 103.712203][ T9778] ? bitmap_ipmac_list+0x635/0x1080 [ 103.717449][ T9778] print_address_description.constprop.0.cold+0xd4/0x30b [ 103.724679][ T9778] ? bitmap_ipmac_list+0x635/0x1080 [ 103.729896][ T9778] ? bitmap_ipmac_list+0x635/0x1080 [ 103.735097][ T9778] __kasan_report.cold+0x1b/0x41 [ 103.740394][ T9778] ? bitmap_ipmac_list+0x635/0x1080 [ 103.745609][ T9778] kasan_report+0x12/0x20 [ 103.749970][ T9778] check_memory_region+0x134/0x1a0 [ 103.755092][ T9778] __kasan_check_read+0x11/0x20 [ 103.760546][ T9778] bitmap_ipmac_list+0x635/0x1080 [ 103.766498][ T9778] ? bitmap_ipmac_head+0x8a0/0x8a0 [ 103.771620][ T9778] ? nla_put+0x110/0x150 [ 103.775874][ T9778] ip_set_dump_start+0x96c/0x1ca0 [ 103.780918][ T9778] ? ip_set_rename+0x720/0x720 [ 103.785696][ T9778] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 103.791252][ T9778] ? perf_trace_lock_acquire+0x4a0/0x530 [ 103.796890][ T9778] ? __kasan_check_write+0x14/0x20 [ 103.802061][ T9778] netlink_dump+0x558/0xfb0 [ 103.806760][ T9778] ? __netlink_sendskb+0xc0/0xc0 [ 103.811708][ T9778] __netlink_dump_start+0x66a/0x930 [ 103.817087][ T9778] ip_set_dump+0x15a/0x1d0 [ 103.821506][ T9778] ? call_ad+0x5a0/0x5a0 [ 103.826006][ T9778] ? ip_set_rename+0x720/0x720 [ 103.831323][ T9778] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 103.837356][ T9778] ? call_ad+0x5a0/0x5a0 [ 103.841902][ T9778] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 103.847009][ T9778] ? nfnetlink_bind+0x2c0/0x2c0 [ 103.851960][ T9778] ? __kasan_check_read+0x11/0x20 [ 103.856980][ T9778] ? __lock_acquire+0x8a0/0x4a00 [ 103.861918][ T9778] ? save_stack+0x5c/0x90 [ 103.866412][ T9778] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 103.872859][ T9778] ? apparmor_capable+0x497/0x900 [ 103.878026][ T9778] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 103.884271][ T9778] ? __kasan_check_read+0x11/0x20 [ 103.889411][ T9778] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 103.895106][ T9778] netlink_rcv_skb+0x177/0x450 [ 103.899883][ T9778] ? nfnetlink_bind+0x2c0/0x2c0 [ 103.904856][ T9778] ? netlink_ack+0xb50/0xb50 [ 103.909491][ T9778] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 103.916045][ T9778] ? ns_capable_common+0x93/0x100 [ 103.921206][ T9778] ? ns_capable+0x20/0x30 [ 103.925846][ T9778] ? __netlink_ns_capable+0x104/0x140 [ 103.931436][ T9778] nfnetlink_rcv+0x1ba/0x460 [ 103.936097][ T9778] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 103.941559][ T9778] ? netlink_deliver_tap+0x24a/0xbe0 [ 103.946982][ T9778] ? __kasan_check_write+0x14/0x20 [ 103.952094][ T9778] netlink_unicast+0x58c/0x7d0 [ 103.957179][ T9778] ? netlink_attachskb+0x870/0x870 [ 103.962552][ T9778] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 103.968343][ T9778] ? __check_object_size+0x3d/0x437 [ 103.973683][ T9778] netlink_sendmsg+0x91c/0xea0 [ 103.979533][ T9778] ? netlink_unicast+0x7d0/0x7d0 [ 103.985114][ T9778] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 103.990869][ T9778] ? apparmor_socket_sendmsg+0x2a/0x30 [ 103.997579][ T9778] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 104.003812][ T9778] ? security_socket_sendmsg+0x8d/0xc0 [ 104.009328][ T9778] ? netlink_unicast+0x7d0/0x7d0 [ 104.014384][ T9778] sock_sendmsg+0xd7/0x130 [ 104.019310][ T9778] ____sys_sendmsg+0x753/0x880 [ 104.025628][ T9778] ? kernel_sendmsg+0x50/0x50 [ 104.030417][ T9778] ? lockdep_init_map+0x1be/0x6d0 [ 104.035531][ T9778] ___sys_sendmsg+0x100/0x170 [ 104.040925][ T9778] ? sendmsg_copy_msghdr+0x70/0x70 [ 104.046033][ T9778] ? __kasan_check_read+0x11/0x20 [ 104.051262][ T9778] ? __lock_acquire+0x8a0/0x4a00 [ 104.056212][ T9778] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 104.062460][ T9778] ? __this_cpu_preempt_check+0x35/0x190 [ 104.068143][ T9778] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 104.074457][ T9778] ? percpu_counter_add_batch+0x13c/0x190 [ 104.081720][ T9778] ? __fd_install+0x1bc/0x640 [ 104.086407][ T9778] ? find_held_lock+0x35/0x130 [ 104.091359][ T9778] ? __fd_install+0x1bc/0x640 [ 104.096036][ T9778] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 104.102549][ T9778] ? __fget_light+0x1a9/0x230 [ 104.107285][ T9778] ? __fdget+0x1b/0x20 [ 104.111395][ T9778] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 104.117638][ T9778] __sys_sendmsg+0x105/0x1d0 [ 104.122476][ T9778] ? __sys_sendmsg_sock+0xc0/0xc0 [ 104.127532][ T9778] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 104.133009][ T9778] ? do_syscall_64+0x26/0x790 [ 104.137688][ T9778] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 104.143760][ T9778] ? do_syscall_64+0x26/0x790 [ 104.148719][ T9778] __x64_sys_sendmsg+0x78/0xb0 [ 104.153558][ T9778] do_syscall_64+0xfa/0x790 [ 104.158259][ T9778] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 104.165033][ T9778] RIP: 0033:0x440529 [ 104.169017][ T9778] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 104.188826][ T9778] RSP: 002b:00007ffe1d37f988 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 104.197451][ T9778] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440529 [ 104.205533][ T9778] RDX: 0000000000000000 RSI: 0000000020000440 RDI: 0000000000000004 [ 104.213749][ T9778] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 104.222996][ T9778] R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000401db0 [ 104.231009][ T9778] R13: 0000000000401e40 R14: 0000000000000000 R15: 0000000000000000 [ 104.239003][ T9778] [ 104.241351][ T9778] Allocated by task 9778: [ 104.245695][ T9778] save_stack+0x23/0x90 [ 104.249880][ T9778] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 104.255526][ T9778] kasan_kmalloc+0x9/0x10 [ 104.260016][ T9778] __kmalloc+0x163/0x770 [ 104.264329][ T9778] ip_set_alloc+0x38/0x5e [ 104.268666][ T9778] bitmap_ipmac_create+0x4e8/0xa00 [ 104.273952][ T9778] ip_set_create+0x6f1/0x1500 [ 104.278686][ T9778] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 104.284228][ T9778] netlink_rcv_skb+0x177/0x450 [ 104.289504][ T9778] nfnetlink_rcv+0x1ba/0x460 [ 104.294129][ T9778] netlink_unicast+0x58c/0x7d0 [ 104.298905][ T9778] netlink_sendmsg+0x91c/0xea0 [ 104.303670][ T9778] sock_sendmsg+0xd7/0x130 [ 104.308135][ T9778] ____sys_sendmsg+0x753/0x880 [ 104.312983][ T9778] ___sys_sendmsg+0x100/0x170 [ 104.318315][ T9778] __sys_sendmsg+0x105/0x1d0 [ 104.322928][ T9778] __x64_sys_sendmsg+0x78/0xb0 [ 104.327858][ T9778] do_syscall_64+0xfa/0x790 [ 104.332537][ T9778] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 104.338459][ T9778] [ 104.340794][ T9778] Freed by task 9510: [ 104.344869][ T9778] save_stack+0x23/0x90 [ 104.349108][ T9778] __kasan_slab_free+0x102/0x150 [ 104.354046][ T9778] kasan_slab_free+0xe/0x10 [ 104.358651][ T9778] kfree+0x10a/0x2c0 [ 104.362559][ T9778] tomoyo_check_open_permission+0x19e/0x3e0 [ 104.368575][ T9778] tomoyo_file_open+0xa9/0xd0 [ 104.373357][ T9778] security_file_open+0x71/0x300 [ 104.378343][ T9778] do_dentry_open+0x37a/0x1380 [ 104.383214][ T9778] vfs_open+0xa0/0xd0 [ 104.387199][ T9778] path_openat+0x118b/0x3180 [ 104.391823][ T9778] do_filp_open+0x1a1/0x280 [ 104.396544][ T9778] do_sys_open+0x3fe/0x5d0 [ 104.400967][ T9778] __x64_sys_open+0x7e/0xc0 [ 104.405788][ T9778] do_syscall_64+0xfa/0x790 [ 104.410912][ T9778] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 104.416915][ T9778] [ 104.419236][ T9778] The buggy address belongs to the object at ffff8880a90e2b00 [ 104.419236][ T9778] which belongs to the cache kmalloc-32 of size 32 [ 104.433153][ T9778] The buggy address is located 0 bytes inside of [ 104.433153][ T9778] 32-byte region [ffff8880a90e2b00, ffff8880a90e2b20) [ 104.446375][ T9778] The buggy address belongs to the page: [ 104.452122][ T9778] page:ffffea0002a43880 refcount:1 mapcount:0 mapping:ffff8880aa4001c0 index:0xffff8880a90e2fc1 [ 104.463204][ T9778] raw: 00fffe0000000200 ffffea0002523748 ffffea0002697148 ffff8880aa4001c0 [ 104.472174][ T9778] raw: ffff8880a90e2fc1 ffff8880a90e2000 0000000100000027 0000000000000000 [ 104.480866][ T9778] page dumped because: kasan: bad access detected [ 104.487348][ T9778] [ 104.490127][ T9778] Memory state around the buggy address: [ 104.495777][ T9778] ffff8880a90e2a00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 104.503994][ T9778] ffff8880a90e2a80: fb fb fb fb fc fc fc fc 00 01 fc fc fc fc fc fc [ 104.512312][ T9778] >ffff8880a90e2b00: 04 fc fc fc fc fc fc fc 00 00 00 00 fc fc fc fc [ 104.520370][ T9778] ^ [ 104.524567][ T9778] ffff8880a90e2b80: 00 00 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 104.532726][ T9778] ffff8880a90e2c00: 00 00 03 fc fc fc fc fc fb fb fb fb fc fc fc fc [ 104.540989][ T9778] ================================================================== [ 104.549045][ T9778] Disabling lock debugging due to kernel taint [ 104.556467][ T9778] Kernel panic - not syncing: panic_on_warn set ... [ 104.563352][ T9778] CPU: 0 PID: 9778 Comm: syz-executor330 Tainted: G B 5.5.0-rc6-syzkaller #0 [ 104.573669][ T9778] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 104.583944][ T9778] Call Trace: [ 104.587264][ T9778] dump_stack+0x197/0x210 [ 104.591889][ T9778] panic+0x2e3/0x75c [ 104.595948][ T9778] ? add_taint.cold+0x16/0x16 [ 104.600760][ T9778] ? bitmap_ipmac_list+0x635/0x1080 [ 104.606283][ T9778] ? preempt_schedule+0x4b/0x60 [ 104.611193][ T9778] ? ___preempt_schedule+0x16/0x18 [ 104.616304][ T9778] ? trace_hardirqs_on+0x5e/0x240 [ 104.622134][ T9778] ? bitmap_ipmac_list+0x635/0x1080 [ 104.627330][ T9778] end_report+0x47/0x4f [ 104.631497][ T9778] ? bitmap_ipmac_list+0x635/0x1080 [ 104.636682][ T9778] __kasan_report.cold+0xe/0x41 [ 104.641530][ T9778] ? bitmap_ipmac_list+0x635/0x1080 [ 104.646742][ T9778] kasan_report+0x12/0x20 [ 104.651073][ T9778] check_memory_region+0x134/0x1a0 [ 104.656173][ T9778] __kasan_check_read+0x11/0x20 [ 104.661023][ T9778] bitmap_ipmac_list+0x635/0x1080 [ 104.666045][ T9778] ? bitmap_ipmac_head+0x8a0/0x8a0 [ 104.671136][ T9778] ? nla_put+0x110/0x150 [ 104.675357][ T9778] ip_set_dump_start+0x96c/0x1ca0 [ 104.680572][ T9778] ? ip_set_rename+0x720/0x720 [ 104.685811][ T9778] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 104.692344][ T9778] ? perf_trace_lock_acquire+0x4a0/0x530 [ 104.698167][ T9778] ? __kasan_check_write+0x14/0x20 [ 104.703371][ T9778] netlink_dump+0x558/0xfb0 [ 104.707874][ T9778] ? __netlink_sendskb+0xc0/0xc0 [ 104.713076][ T9778] __netlink_dump_start+0x66a/0x930 [ 104.718289][ T9778] ip_set_dump+0x15a/0x1d0 [ 104.722729][ T9778] ? call_ad+0x5a0/0x5a0 [ 104.726990][ T9778] ? ip_set_rename+0x720/0x720 [ 104.731899][ T9778] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 104.738089][ T9778] ? call_ad+0x5a0/0x5a0 [ 104.742445][ T9778] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 104.747456][ T9778] ? nfnetlink_bind+0x2c0/0x2c0 [ 104.752489][ T9778] ? __kasan_check_read+0x11/0x20 [ 104.757688][ T9778] ? __lock_acquire+0x8a0/0x4a00 [ 104.762818][ T9778] ? save_stack+0x5c/0x90 [ 104.767772][ T9778] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 104.775130][ T9778] ? apparmor_capable+0x497/0x900 [ 104.780243][ T9778] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 104.787334][ T9778] ? __kasan_check_read+0x11/0x20 [ 104.792354][ T9778] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 104.797958][ T9778] netlink_rcv_skb+0x177/0x450 [ 104.802741][ T9778] ? nfnetlink_bind+0x2c0/0x2c0 [ 104.807591][ T9778] ? netlink_ack+0xb50/0xb50 [ 104.812897][ T9778] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 104.820357][ T9778] ? ns_capable_common+0x93/0x100 [ 104.825384][ T9778] ? ns_capable+0x20/0x30 [ 104.829855][ T9778] ? __netlink_ns_capable+0x104/0x140 [ 104.835223][ T9778] nfnetlink_rcv+0x1ba/0x460 [ 104.839819][ T9778] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 104.845664][ T9778] ? netlink_deliver_tap+0x24a/0xbe0 [ 104.851087][ T9778] ? __kasan_check_write+0x14/0x20 [ 104.856496][ T9778] netlink_unicast+0x58c/0x7d0 [ 104.861287][ T9778] ? netlink_attachskb+0x870/0x870 [ 104.866848][ T9778] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 104.872582][ T9778] ? __check_object_size+0x3d/0x437 [ 104.877830][ T9778] netlink_sendmsg+0x91c/0xea0 [ 104.883027][ T9778] ? netlink_unicast+0x7d0/0x7d0 [ 104.887966][ T9778] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 104.893536][ T9778] ? apparmor_socket_sendmsg+0x2a/0x30 [ 104.899012][ T9778] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 104.906346][ T9778] ? security_socket_sendmsg+0x8d/0xc0 [ 104.911807][ T9778] ? netlink_unicast+0x7d0/0x7d0 [ 104.917248][ T9778] sock_sendmsg+0xd7/0x130 [ 104.921660][ T9778] ____sys_sendmsg+0x753/0x880 [ 104.926421][ T9778] ? kernel_sendmsg+0x50/0x50 [ 104.931794][ T9778] ? lockdep_init_map+0x1be/0x6d0 [ 104.936893][ T9778] ___sys_sendmsg+0x100/0x170 [ 104.941594][ T9778] ? sendmsg_copy_msghdr+0x70/0x70 [ 104.946971][ T9778] ? __kasan_check_read+0x11/0x20 [ 104.951997][ T9778] ? __lock_acquire+0x8a0/0x4a00 [ 104.956965][ T9778] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 104.963509][ T9778] ? __this_cpu_preempt_check+0x35/0x190 [ 104.969127][ T9778] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 104.975347][ T9778] ? percpu_counter_add_batch+0x13c/0x190 [ 104.981053][ T9778] ? __fd_install+0x1bc/0x640 [ 104.985716][ T9778] ? find_held_lock+0x35/0x130 [ 104.990464][ T9778] ? __fd_install+0x1bc/0x640 [ 104.995293][ T9778] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 105.001574][ T9778] ? __fget_light+0x1a9/0x230 [ 105.006794][ T9778] ? __fdget+0x1b/0x20 [ 105.011919][ T9778] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 105.018871][ T9778] __sys_sendmsg+0x105/0x1d0 [ 105.023465][ T9778] ? __sys_sendmsg_sock+0xc0/0xc0 [ 105.028538][ T9778] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 105.034479][ T9778] ? do_syscall_64+0x26/0x790 [ 105.039163][ T9778] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 105.045225][ T9778] ? do_syscall_64+0x26/0x790 [ 105.049902][ T9778] __x64_sys_sendmsg+0x78/0xb0 [ 105.054709][ T9778] do_syscall_64+0xfa/0x790 [ 105.059214][ T9778] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 105.065093][ T9778] RIP: 0033:0x440529 [ 105.069062][ T9778] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 105.089253][ T9778] RSP: 002b:00007ffe1d37f988 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 105.098413][ T9778] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440529 [ 105.106377][ T9778] RDX: 0000000000000000 RSI: 0000000020000440 RDI: 0000000000000004 [ 105.114706][ T9778] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 105.122793][ T9778] R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000401db0 [ 105.130758][ T9778] R13: 0000000000401e40 R14: 0000000000000000 R15: 0000000000000000 [ 105.140572][ T9778] Kernel Offset: disabled [ 105.144924][ T9778] Rebooting in 86400 seconds..