[ 86.505562][ T27] audit: type=1800 audit(1579349907.348:26): pid=9484 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 87.387017][ T27] kauditd_printk_skb: 2 callbacks suppressed [ 87.387029][ T27] audit: type=1800 audit(1579349908.268:29): pid=9484 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 87.413619][ T27] audit: type=1800 audit(1579349908.268:30): pid=9484 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.57' (ECDSA) to the list of known hosts. executing program executing program syzkaller login: [ 96.647110][ T9639] ================================================================== [ 96.655469][ T9639] BUG: KASAN: slab-out-of-bounds in bitmap_port_list+0x3cf/0xdb0 [ 96.664231][ T9639] Read of size 8 at addr ffff8880960acbc0 by task syz-executor656/9639 [ 96.672487][ T9639] [ 96.674812][ T9639] CPU: 1 PID: 9639 Comm: syz-executor656 Not tainted 5.5.0-rc6-syzkaller #0 [ 96.683495][ T9639] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 96.693628][ T9639] Call Trace: [ 96.696909][ T9639] dump_stack+0x197/0x210 [ 96.701321][ T9639] ? bitmap_port_list+0x3cf/0xdb0 [ 96.706342][ T9639] print_address_description.constprop.0.cold+0xd4/0x30b [ 96.713367][ T9639] ? bitmap_port_list+0x3cf/0xdb0 [ 96.718553][ T9639] ? bitmap_port_list+0x3cf/0xdb0 [ 96.723566][ T9639] __kasan_report.cold+0x1b/0x41 [ 96.728494][ T9639] ? bitmap_port_list+0x3cf/0xdb0 [ 96.733506][ T9639] kasan_report+0x12/0x20 [ 96.737819][ T9639] check_memory_region+0x134/0x1a0 [ 96.742915][ T9639] __kasan_check_read+0x11/0x20 [ 96.747859][ T9639] bitmap_port_list+0x3cf/0xdb0 [ 96.752704][ T9639] ? bitmap_port_head+0x296/0x600 [ 96.757727][ T9639] ? bitmap_port_del+0x380/0x380 [ 96.762677][ T9639] ? nla_put+0x110/0x150 [ 96.766923][ T9639] ip_set_dump_start+0x96c/0x1ca0 [ 96.771948][ T9639] ? ip_set_rename+0x720/0x720 [ 96.776760][ T9639] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 96.782349][ T9639] ? perf_trace_lock_acquire+0x4c0/0x530 [ 96.788033][ T9639] ? __kasan_check_write+0x14/0x20 [ 96.793152][ T9639] netlink_dump+0x558/0xfb0 [ 96.797725][ T9639] ? __netlink_sendskb+0xc0/0xc0 [ 96.802797][ T9639] __netlink_dump_start+0x66a/0x930 [ 96.808009][ T9639] ip_set_dump+0x15a/0x1d0 [ 96.812425][ T9639] ? call_ad+0x5a0/0x5a0 [ 96.816679][ T9639] ? ip_set_rename+0x720/0x720 [ 96.821434][ T9639] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 96.827261][ T9639] ? call_ad+0x5a0/0x5a0 [ 96.831504][ T9639] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 96.836446][ T9639] ? nfnetlink_bind+0x2c0/0x2c0 [ 96.841301][ T9639] ? __kasan_check_read+0x11/0x20 [ 96.846869][ T9639] ? __lock_acquire+0x8a0/0x4a00 [ 96.851821][ T9639] ? save_stack+0x5c/0x90 [ 96.856238][ T9639] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 96.862755][ T9639] ? apparmor_capable+0x497/0x900 [ 96.867791][ T9639] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 96.874035][ T9639] ? __kasan_check_read+0x11/0x20 [ 96.879174][ T9639] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 96.884725][ T9639] netlink_rcv_skb+0x177/0x450 [ 96.889490][ T9639] ? nfnetlink_bind+0x2c0/0x2c0 [ 96.894481][ T9639] ? netlink_ack+0xb50/0xb50 [ 96.899069][ T9639] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 96.905373][ T9639] ? ns_capable_common+0x93/0x100 [ 96.910660][ T9639] ? ns_capable+0x20/0x30 [ 96.915040][ T9639] ? __netlink_ns_capable+0x104/0x140 [ 96.920430][ T9639] nfnetlink_rcv+0x1ba/0x460 [ 96.925068][ T9639] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 96.930541][ T9639] ? netlink_deliver_tap+0x24a/0xbe0 [ 96.935914][ T9639] ? __kasan_check_write+0x14/0x20 [ 96.941133][ T9639] netlink_unicast+0x58c/0x7d0 [ 96.946131][ T9639] ? netlink_attachskb+0x870/0x870 [ 96.951240][ T9639] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 96.956971][ T9639] ? __check_object_size+0x3d/0x437 [ 96.962177][ T9639] netlink_sendmsg+0x91c/0xea0 [ 96.967148][ T9639] ? netlink_unicast+0x7d0/0x7d0 [ 96.972086][ T9639] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 96.977630][ T9639] ? apparmor_socket_sendmsg+0x2a/0x30 [ 96.983125][ T9639] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 96.989372][ T9639] ? security_socket_sendmsg+0x8d/0xc0 [ 96.995155][ T9639] ? netlink_unicast+0x7d0/0x7d0 [ 97.000090][ T9639] sock_sendmsg+0xd7/0x130 [ 97.004506][ T9639] ____sys_sendmsg+0x753/0x880 [ 97.009471][ T9639] ? kernel_sendmsg+0x50/0x50 [ 97.014292][ T9639] ? mark_held_locks+0xa4/0xf0 [ 97.019358][ T9639] ? do_huge_pmd_anonymous_page+0x1463/0x1a50 [ 97.025415][ T9639] ? __handle_mm_fault+0x3145/0x3cc0 [ 97.030783][ T9639] ? do_huge_pmd_anonymous_page+0x1463/0x1a50 [ 97.036854][ T9639] ___sys_sendmsg+0x100/0x170 [ 97.041762][ T9639] ? do_huge_pmd_anonymous_page+0xceb/0x1a50 [ 97.047779][ T9639] ? sendmsg_copy_msghdr+0x70/0x70 [ 97.053124][ T9639] ? __do_page_fault+0x56a/0xd80 [ 97.058098][ T9639] ? find_held_lock+0x35/0x130 [ 97.063039][ T9639] ? __do_page_fault+0x56a/0xd80 [ 97.067993][ T9639] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 97.074418][ T9639] ? __fget_light+0x1a9/0x230 [ 97.079093][ T9639] ? __fdget+0x1b/0x20 [ 97.083255][ T9639] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 97.089694][ T9639] __sys_sendmsg+0x105/0x1d0 [ 97.094367][ T9639] ? __sys_sendmsg_sock+0xc0/0xc0 [ 97.099517][ T9639] ? down_read_non_owner+0x490/0x490 [ 97.104923][ T9639] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 97.110475][ T9639] ? do_syscall_64+0x26/0x790 [ 97.115315][ T9639] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 97.121485][ T9639] ? do_syscall_64+0x26/0x790 [ 97.126271][ T9639] __x64_sys_sendmsg+0x78/0xb0 [ 97.131091][ T9639] do_syscall_64+0xfa/0x790 [ 97.135589][ T9639] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 97.141517][ T9639] RIP: 0033:0x441479 [ 97.146119][ T9639] Code: e8 fc ab 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 9b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 97.166041][ T9639] RSP: 002b:00007ffde3d4fdc8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 97.174458][ T9639] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441479 [ 97.183242][ T9639] RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003 [ 97.192611][ T9639] RBP: 000000000001795f R08: 00000000004002c8 R09: 00000000004002c8 [ 97.202319][ T9639] R10: 0000000000000004 R11: 0000000000000246 R12: 00000000004022a0 [ 97.210639][ T9639] R13: 0000000000402330 R14: 0000000000000000 R15: 0000000000000000 [ 97.218630][ T9639] [ 97.220972][ T9639] Allocated by task 9638: [ 97.225384][ T9639] save_stack+0x23/0x90 [ 97.229531][ T9639] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 97.235166][ T9639] kasan_kmalloc+0x9/0x10 [ 97.239703][ T9639] __kmalloc+0x163/0x770 [ 97.243953][ T9639] ip_set_alloc+0x38/0x5e [ 97.248301][ T9639] bitmap_port_create+0x3dc/0x7c0 [ 97.253358][ T9639] ip_set_create+0x6f1/0x1500 [ 97.259200][ T9639] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 97.264247][ T9639] netlink_rcv_skb+0x177/0x450 [ 97.269026][ T9639] nfnetlink_rcv+0x1ba/0x460 [ 97.273890][ T9639] netlink_unicast+0x58c/0x7d0 [ 97.278783][ T9639] netlink_sendmsg+0x91c/0xea0 [ 97.283720][ T9639] sock_sendmsg+0xd7/0x130 [ 97.288148][ T9639] ____sys_sendmsg+0x753/0x880 [ 97.292917][ T9639] ___sys_sendmsg+0x100/0x170 [ 97.297695][ T9639] __sys_sendmsg+0x105/0x1d0 [ 97.302420][ T9639] __x64_sys_sendmsg+0x78/0xb0 [ 97.307388][ T9639] do_syscall_64+0xfa/0x790 [ 97.311880][ T9639] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 97.318177][ T9639] [ 97.320493][ T9639] Freed by task 9367: [ 97.324464][ T9639] save_stack+0x23/0x90 [ 97.328605][ T9639] __kasan_slab_free+0x102/0x150 [ 97.333536][ T9639] kasan_slab_free+0xe/0x10 [ 97.338453][ T9639] kfree+0x10a/0x2c0 [ 97.342352][ T9639] single_release+0x95/0xc0 [ 97.346880][ T9639] __fput+0x2ff/0x890 [ 97.351126][ T9639] ____fput+0x16/0x20 [ 97.355123][ T9639] task_work_run+0x145/0x1c0 [ 97.359913][ T9639] exit_to_usermode_loop+0x316/0x380 [ 97.365198][ T9639] do_syscall_64+0x676/0x790 [ 97.369775][ T9639] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 97.375653][ T9639] [ 97.377967][ T9639] The buggy address belongs to the object at ffff8880960acbc0 [ 97.377967][ T9639] which belongs to the cache kmalloc-32 of size 32 [ 97.391863][ T9639] The buggy address is located 0 bytes inside of [ 97.391863][ T9639] 32-byte region [ffff8880960acbc0, ffff8880960acbe0) [ 97.404960][ T9639] The buggy address belongs to the page: [ 97.410592][ T9639] page:ffffea0002582b00 refcount:1 mapcount:0 mapping:ffff8880aa4001c0 index:0xffff8880960acfc1 [ 97.421136][ T9639] raw: 00fffe0000000200 ffffea00028f90c8 ffff8880aa401238 ffff8880aa4001c0 [ 97.430113][ T9639] raw: ffff8880960acfc1 ffff8880960ac000 0000000100000037 0000000000000000 [ 97.439562][ T9639] page dumped because: kasan: bad access detected [ 97.446150][ T9639] [ 97.448489][ T9639] Memory state around the buggy address: [ 97.454337][ T9639] ffff8880960aca80: fb fb fb fb fc fc fc fc 00 02 fc fc fc fc fc fc [ 97.462615][ T9639] ffff8880960acb00: 00 00 fc fc fc fc fc fc 00 00 fc fc fc fc fc fc [ 97.470774][ T9639] >ffff8880960acb80: fb fb fb fb fc fc fc fc 04 fc fc fc fc fc fc fc [ 97.479381][ T9639] ^ [ 97.487490][ T9639] ffff8880960acc00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 97.495638][ T9639] ffff8880960acc80: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 97.503693][ T9639] ================================================================== [ 97.511915][ T9639] Disabling lock debugging due to kernel taint [ 97.518347][ T9639] Kernel panic - not syncing: panic_on_warn set ... [ 97.524963][ T9639] CPU: 1 PID: 9639 Comm: syz-executor656 Tainted: G B 5.5.0-rc6-syzkaller #0 [ 97.535009][ T9639] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 97.545053][ T9639] Call Trace: [ 97.548334][ T9639] dump_stack+0x197/0x210 [ 97.552649][ T9639] panic+0x2e3/0x75c [ 97.556527][ T9639] ? add_taint.cold+0x16/0x16 [ 97.561188][ T9639] ? bitmap_port_list+0x3cf/0xdb0 [ 97.566193][ T9639] ? preempt_schedule+0x4b/0x60 [ 97.571023][ T9639] ? ___preempt_schedule+0x16/0x18 [ 97.576137][ T9639] ? trace_hardirqs_on+0x5e/0x240 [ 97.581239][ T9639] ? bitmap_port_list+0x3cf/0xdb0 [ 97.586271][ T9639] end_report+0x47/0x4f [ 97.590414][ T9639] ? bitmap_port_list+0x3cf/0xdb0 [ 97.595425][ T9639] __kasan_report.cold+0xe/0x41 [ 97.600276][ T9639] ? bitmap_port_list+0x3cf/0xdb0 [ 97.605307][ T9639] kasan_report+0x12/0x20 [ 97.609619][ T9639] check_memory_region+0x134/0x1a0 [ 97.614706][ T9639] __kasan_check_read+0x11/0x20 [ 97.619568][ T9639] bitmap_port_list+0x3cf/0xdb0 [ 97.624418][ T9639] ? bitmap_port_head+0x296/0x600 [ 97.629451][ T9639] ? bitmap_port_del+0x380/0x380 [ 97.634383][ T9639] ? nla_put+0x110/0x150 [ 97.638636][ T9639] ip_set_dump_start+0x96c/0x1ca0 [ 97.643710][ T9639] ? ip_set_rename+0x720/0x720 [ 97.648604][ T9639] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 97.654278][ T9639] ? perf_trace_lock_acquire+0x4c0/0x530 [ 97.660014][ T9639] ? __kasan_check_write+0x14/0x20 [ 97.665139][ T9639] netlink_dump+0x558/0xfb0 [ 97.669674][ T9639] ? __netlink_sendskb+0xc0/0xc0 [ 97.674619][ T9639] __netlink_dump_start+0x66a/0x930 [ 97.679922][ T9639] ip_set_dump+0x15a/0x1d0 [ 97.684329][ T9639] ? call_ad+0x5a0/0x5a0 [ 97.688567][ T9639] ? ip_set_rename+0x720/0x720 [ 97.693326][ T9639] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 97.699228][ T9639] ? call_ad+0x5a0/0x5a0 [ 97.703480][ T9639] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 97.708418][ T9639] ? nfnetlink_bind+0x2c0/0x2c0 [ 97.714290][ T9639] ? __kasan_check_read+0x11/0x20 [ 97.719298][ T9639] ? __lock_acquire+0x8a0/0x4a00 [ 97.724227][ T9639] ? save_stack+0x5c/0x90 [ 97.728562][ T9639] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 97.734929][ T9639] ? apparmor_capable+0x497/0x900 [ 97.740077][ T9639] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 97.746492][ T9639] ? __kasan_check_read+0x11/0x20 [ 97.751550][ T9639] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 97.757015][ T9639] netlink_rcv_skb+0x177/0x450 [ 97.761785][ T9639] ? nfnetlink_bind+0x2c0/0x2c0 [ 97.766728][ T9639] ? netlink_ack+0xb50/0xb50 [ 97.771305][ T9639] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 97.777538][ T9639] ? ns_capable_common+0x93/0x100 [ 97.782567][ T9639] ? ns_capable+0x20/0x30 [ 97.786904][ T9639] ? __netlink_ns_capable+0x104/0x140 [ 97.792278][ T9639] nfnetlink_rcv+0x1ba/0x460 [ 97.796908][ T9639] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 97.802359][ T9639] ? netlink_deliver_tap+0x24a/0xbe0 [ 97.807637][ T9639] ? __kasan_check_write+0x14/0x20 [ 97.812794][ T9639] netlink_unicast+0x58c/0x7d0 [ 97.817616][ T9639] ? netlink_attachskb+0x870/0x870 [ 97.822755][ T9639] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 97.828706][ T9639] ? __check_object_size+0x3d/0x437 [ 97.833905][ T9639] netlink_sendmsg+0x91c/0xea0 [ 97.838673][ T9639] ? netlink_unicast+0x7d0/0x7d0 [ 97.843634][ T9639] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 97.849168][ T9639] ? apparmor_socket_sendmsg+0x2a/0x30 [ 97.854669][ T9639] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 97.860909][ T9639] ? security_socket_sendmsg+0x8d/0xc0 [ 97.866475][ T9639] ? netlink_unicast+0x7d0/0x7d0 [ 97.871506][ T9639] sock_sendmsg+0xd7/0x130 [ 97.875913][ T9639] ____sys_sendmsg+0x753/0x880 [ 97.880672][ T9639] ? kernel_sendmsg+0x50/0x50 [ 97.885336][ T9639] ? mark_held_locks+0xa4/0xf0 [ 97.890095][ T9639] ? do_huge_pmd_anonymous_page+0x1463/0x1a50 [ 97.896155][ T9639] ? __handle_mm_fault+0x3145/0x3cc0 [ 97.901441][ T9639] ? do_huge_pmd_anonymous_page+0x1463/0x1a50 [ 97.907500][ T9639] ___sys_sendmsg+0x100/0x170 [ 97.912366][ T9639] ? do_huge_pmd_anonymous_page+0xceb/0x1a50 [ 97.918460][ T9639] ? sendmsg_copy_msghdr+0x70/0x70 [ 97.923568][ T9639] ? __do_page_fault+0x56a/0xd80 [ 97.928495][ T9639] ? find_held_lock+0x35/0x130 [ 97.933357][ T9639] ? __do_page_fault+0x56a/0xd80 [ 97.938283][ T9639] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 97.944515][ T9639] ? __fget_light+0x1a9/0x230 [ 97.949242][ T9639] ? __fdget+0x1b/0x20 [ 97.953301][ T9639] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 97.959539][ T9639] __sys_sendmsg+0x105/0x1d0 [ 97.964116][ T9639] ? __sys_sendmsg_sock+0xc0/0xc0 [ 97.969132][ T9639] ? down_read_non_owner+0x490/0x490 [ 97.974411][ T9639] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 97.979864][ T9639] ? do_syscall_64+0x26/0x790 [ 97.984534][ T9639] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 97.990587][ T9639] ? do_syscall_64+0x26/0x790 [ 97.995259][ T9639] __x64_sys_sendmsg+0x78/0xb0 [ 98.000025][ T9639] do_syscall_64+0xfa/0x790 [ 98.004521][ T9639] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 98.010513][ T9639] RIP: 0033:0x441479 [ 98.014398][ T9639] Code: e8 fc ab 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 9b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 98.034106][ T9639] RSP: 002b:00007ffde3d4fdc8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 98.042510][ T9639] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441479 [ 98.050477][ T9639] RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003 [ 98.058444][ T9639] RBP: 000000000001795f R08: 00000000004002c8 R09: 00000000004002c8 [ 98.066410][ T9639] R10: 0000000000000004 R11: 0000000000000246 R12: 00000000004022a0 [ 98.074486][ T9639] R13: 0000000000402330 R14: 0000000000000000 R15: 0000000000000000 [ 98.084195][ T9639] Kernel Offset: disabled [ 98.088530][ T9639] Rebooting in 86400 seconds..