[ 36.884278][ T26] audit: type=1800 audit(1556740827.872:26): pid=7578 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 36.906789][ T26] audit: type=1800 audit(1556740827.872:27): pid=7578 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [ 36.927631][ T26] audit: type=1800 audit(1556740827.882:28): pid=7578 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2417 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 37.787519][ T26] audit: type=1800 audit(1556740828.812:29): pid=7578 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.96' (ECDSA) to the list of known hosts. executing program executing program syzkaller login: [ 47.806267][ T7730] IPVS: ftp: loaded support on port[0] = 21 [ 47.842751][ T7732] ================================================================== [ 47.850961][ T7732] BUG: KASAN: slab-out-of-bounds in skb_gro_receive+0xf5f/0x10e0 [ 47.858676][ T7732] Read of size 16 at addr ffff888099a37ff0 by task syz-executor085/7732 [ 47.867001][ T7732] [ 47.869324][ T7732] CPU: 1 PID: 7732 Comm: syz-executor085 Not tainted 5.1.0-rc6+ #163 [ 47.877436][ T7732] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 47.887499][ T7732] Call Trace: [ 47.890785][ T7732] dump_stack+0x172/0x1f0 [ 47.895115][ T7732] ? skb_gro_receive+0xf5f/0x10e0 [ 47.900123][ T7732] print_address_description.cold+0x7c/0x20d [ 47.906088][ T7732] ? skb_gro_receive+0xf5f/0x10e0 [ 47.911094][ T7732] ? skb_gro_receive+0xf5f/0x10e0 [ 47.916099][ T7732] kasan_report.cold+0x1b/0x40 [ 47.920846][ T7732] ? skb_gro_receive+0xf5f/0x10e0 [ 47.925852][ T7732] __asan_report_load16_noabort+0x14/0x20 [ 47.931553][ T7732] skb_gro_receive+0xf5f/0x10e0 [ 47.936394][ T7732] udp_gro_receive+0xb61/0xfd0 [ 47.941145][ T7732] udp4_gro_receive+0x763/0xeb0 [ 47.945993][ T7732] ? udp_gro_receive+0xfd0/0xfd0 [ 47.950916][ T7732] inet_gro_receive+0xe72/0x1110 [ 47.955839][ T7732] ? inet_sk_rebuild_header+0x1c50/0x1c50 [ 47.961540][ T7732] dev_gro_receive+0x1cd0/0x23c0 [ 47.966471][ T7732] napi_gro_frags+0x36b/0xd10 [ 47.971140][ T7732] tun_get_user+0x2f3f/0x3ff0 [ 47.975806][ T7732] ? tun_build_skb.isra.0+0x1300/0x1300 [ 47.981334][ T7732] ? tun_get+0x171/0x290 [ 47.985584][ T7732] ? lock_downgrade+0x880/0x880 [ 47.990416][ T7732] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 47.996635][ T7732] ? kasan_check_read+0x11/0x20 [ 48.001474][ T7732] tun_chr_write_iter+0xbd/0x156 [ 48.006402][ T7732] do_iter_readv_writev+0x5e1/0x8e0 [ 48.011593][ T7732] ? vfs_dedupe_file_range+0x780/0x780 [ 48.017054][ T7732] ? apparmor_file_permission+0x25/0x30 [ 48.022585][ T7732] ? rw_verify_area+0x118/0x360 [ 48.027418][ T7732] do_iter_write+0x184/0x610 [ 48.031998][ T7732] ? dup_iter+0x260/0x260 [ 48.036313][ T7732] vfs_writev+0x1b3/0x2f0 [ 48.040625][ T7732] ? vfs_iter_write+0xb0/0xb0 [ 48.045300][ T7732] ? release_sock+0x158/0x1c0 [ 48.049962][ T7732] ? __local_bh_enable_ip+0x15a/0x270 [ 48.055328][ T7732] ? release_sock+0x158/0x1c0 [ 48.059997][ T7732] ? udp_lib_setsockopt+0x494/0x9c0 [ 48.065180][ T7732] ? udp_setsockopt+0x70/0xb0 [ 48.069843][ T7732] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 48.076064][ T7732] ? __fget_light+0x1a9/0x230 [ 48.080725][ T7732] do_writev+0x15e/0x370 [ 48.084953][ T7732] ? vfs_writev+0x2f0/0x2f0 [ 48.089449][ T7732] ? do_syscall_64+0x26/0x610 [ 48.094124][ T7732] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 48.100171][ T7732] ? do_syscall_64+0x26/0x610 [ 48.104831][ T7732] __x64_sys_writev+0x75/0xb0 [ 48.109495][ T7732] do_syscall_64+0x103/0x610 [ 48.114072][ T7732] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 48.119942][ T7732] RIP: 0033:0x441cc0 [ 48.123824][ T7732] Code: 05 48 3d 01 f0 ff ff 0f 83 9d 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 3d 51 93 29 00 00 75 14 b8 14 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 74 09 fc ff c3 48 83 ec 08 e8 ba 2b 00 00 [ 48.143405][ T7732] RSP: 002b:00007ffe1dcd75f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 48.151800][ T7732] RAX: ffffffffffffffda RBX: 00007ffe1dcd7630 RCX: 0000000000441cc0 [ 48.159748][ T7732] RDX: 0000000000000001 RSI: 00007ffe1dcd7650 RDI: 00000000000000f0 [ 48.167698][ T7732] RBP: 0000000000000000 R08: 000000000000ffff R09: 0000000000ff3668 [ 48.175649][ T7732] R10: 0000000020000040 R11: 0000000000000246 R12: 000000000000bad4 [ 48.183617][ T7732] R13: 0000000000402b50 R14: 0000000000000000 R15: 0000000000000000 [ 48.191576][ T7732] [ 48.193886][ T7732] Allocated by task 6848: [ 48.198215][ T7732] save_stack+0x45/0xd0 [ 48.202359][ T7732] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 48.207999][ T7732] kasan_slab_alloc+0xf/0x20 [ 48.212573][ T7732] kmem_cache_alloc+0x11a/0x6f0 [ 48.217403][ T7732] dup_fd+0x85/0xb30 [ 48.221290][ T7732] copy_process.part.0+0x1e92/0x7980 [ 48.226560][ T7732] _do_fork+0x257/0xfd0 [ 48.230693][ T7732] __x64_sys_clone+0xbf/0x150 [ 48.235357][ T7732] do_syscall_64+0x103/0x610 [ 48.239929][ T7732] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 48.245800][ T7732] [ 48.248110][ T7732] Freed by task 6855: [ 48.252088][ T7732] save_stack+0x45/0xd0 [ 48.256221][ T7732] __kasan_slab_free+0x102/0x150 [ 48.261158][ T7732] kasan_slab_free+0xe/0x10 [ 48.265643][ T7732] kmem_cache_free+0x86/0x260 [ 48.270300][ T7732] put_files_struct+0x282/0x2f0 [ 48.275129][ T7732] exit_files+0x83/0xb0 [ 48.279271][ T7732] do_exit+0x8d8/0x2fa0 [ 48.283404][ T7732] do_group_exit+0x135/0x370 [ 48.288000][ T7732] __x64_sys_exit_group+0x44/0x50 [ 48.293009][ T7732] do_syscall_64+0x103/0x610 [ 48.297582][ T7732] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 48.303450][ T7732] [ 48.305789][ T7732] The buggy address belongs to the object at ffff888099a37c00 [ 48.305789][ T7732] which belongs to the cache files_cache of size 832 [ 48.319827][ T7732] The buggy address is located 176 bytes to the right of [ 48.319827][ T7732] 832-byte region [ffff888099a37c00, ffff888099a37f40) [ 48.333597][ T7732] The buggy address belongs to the page: [ 48.339233][ T7732] page:ffffea0002668dc0 count:1 mapcount:0 mapping:ffff88821bc40940 index:0x0 [ 48.348065][ T7732] flags: 0x1fffc0000000200(slab) [ 48.353006][ T7732] raw: 01fffc0000000200 ffffea0002616848 ffffea000222a708 ffff88821bc40940 [ 48.361576][ T7732] raw: 0000000000000000 ffff888099a370c0 0000000100000004 0000000000000000 [ 48.370136][ T7732] page dumped because: kasan: bad access detected [ 48.376530][ T7732] [ 48.378837][ T7732] Memory state around the buggy address: [ 48.384448][ T7732] ffff888099a37e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 48.392496][ T7732] ffff888099a37f00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 48.400539][ T7732] >ffff888099a37f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.408577][ T7732] ^ [ 48.416272][ T7732] ffff888099a38000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 48.424333][ T7732] ffff888099a38080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 48.432370][ T7732] ================================================================== [ 48.440409][ T7732] Disabling lock debugging due to kernel taint [ 48.446593][ T7732] Kernel panic - not syncing: panic_on_warn set ... [ 48.453178][ T7732] CPU: 1 PID: 7732 Comm: syz-executor085 Tainted: G B 5.1.0-rc6+ #163 [ 48.462604][ T7732] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 48.472637][ T7732] Call Trace: [ 48.475929][ T7732] dump_stack+0x172/0x1f0 [ 48.480259][ T7732] panic+0x2cb/0x65c [ 48.484138][ T7732] ? __warn_printk+0xf3/0xf3 [ 48.488710][ T7732] ? trace_hardirqs_on+0x5e/0x230 [ 48.493712][ T7732] ? trace_hardirqs_on+0x5e/0x230 [ 48.498719][ T7732] ? skb_gro_receive+0xf5f/0x10e0 [ 48.503729][ T7732] end_report+0x47/0x4f [ 48.507878][ T7732] ? skb_gro_receive+0xf5f/0x10e0 [ 48.512880][ T7732] kasan_report.cold+0xe/0x40 [ 48.517537][ T7732] ? skb_gro_receive+0xf5f/0x10e0 [ 48.522543][ T7732] __asan_report_load16_noabort+0x14/0x20 [ 48.528240][ T7732] skb_gro_receive+0xf5f/0x10e0 [ 48.533076][ T7732] udp_gro_receive+0xb61/0xfd0 [ 48.537841][ T7732] udp4_gro_receive+0x763/0xeb0 [ 48.542670][ T7732] ? udp_gro_receive+0xfd0/0xfd0 [ 48.547593][ T7732] inet_gro_receive+0xe72/0x1110 [ 48.552515][ T7732] ? inet_sk_rebuild_header+0x1c50/0x1c50 [ 48.558214][ T7732] dev_gro_receive+0x1cd0/0x23c0 [ 48.563137][ T7732] napi_gro_frags+0x36b/0xd10 [ 48.567795][ T7732] tun_get_user+0x2f3f/0x3ff0 [ 48.572457][ T7732] ? tun_build_skb.isra.0+0x1300/0x1300 [ 48.577994][ T7732] ? tun_get+0x171/0x290 [ 48.582218][ T7732] ? lock_downgrade+0x880/0x880 [ 48.587045][ T7732] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 48.593262][ T7732] ? kasan_check_read+0x11/0x20 [ 48.598096][ T7732] tun_chr_write_iter+0xbd/0x156 [ 48.603014][ T7732] do_iter_readv_writev+0x5e1/0x8e0 [ 48.608599][ T7732] ? vfs_dedupe_file_range+0x780/0x780 [ 48.614040][ T7732] ? apparmor_file_permission+0x25/0x30 [ 48.619566][ T7732] ? rw_verify_area+0x118/0x360 [ 48.624401][ T7732] do_iter_write+0x184/0x610 [ 48.629005][ T7732] ? dup_iter+0x260/0x260 [ 48.633319][ T7732] vfs_writev+0x1b3/0x2f0 [ 48.637632][ T7732] ? vfs_iter_write+0xb0/0xb0 [ 48.642286][ T7732] ? release_sock+0x158/0x1c0 [ 48.646943][ T7732] ? __local_bh_enable_ip+0x15a/0x270 [ 48.652303][ T7732] ? release_sock+0x158/0x1c0 [ 48.656987][ T7732] ? udp_lib_setsockopt+0x494/0x9c0 [ 48.662168][ T7732] ? udp_setsockopt+0x70/0xb0 [ 48.666828][ T7732] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 48.673047][ T7732] ? __fget_light+0x1a9/0x230 [ 48.677704][ T7732] do_writev+0x15e/0x370 [ 48.681928][ T7732] ? vfs_writev+0x2f0/0x2f0 [ 48.686412][ T7732] ? do_syscall_64+0x26/0x610 [ 48.691070][ T7732] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 48.697114][ T7732] ? do_syscall_64+0x26/0x610 [ 48.701769][ T7732] __x64_sys_writev+0x75/0xb0 [ 48.706427][ T7732] do_syscall_64+0x103/0x610 [ 48.711001][ T7732] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 48.716868][ T7732] RIP: 0033:0x441cc0 [ 48.720746][ T7732] Code: 05 48 3d 01 f0 ff ff 0f 83 9d 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 3d 51 93 29 00 00 75 14 b8 14 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 74 09 fc ff c3 48 83 ec 08 e8 ba 2b 00 00 [ 48.740342][ T7732] RSP: 002b:00007ffe1dcd75f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 48.748731][ T7732] RAX: ffffffffffffffda RBX: 00007ffe1dcd7630 RCX: 0000000000441cc0 [ 48.756688][ T7732] RDX: 0000000000000001 RSI: 00007ffe1dcd7650 RDI: 00000000000000f0 [ 48.764649][ T7732] RBP: 0000000000000000 R08: 000000000000ffff R09: 0000000000ff3668 [ 48.773570][ T7732] R10: 0000000020000040 R11: 0000000000000246 R12: 000000000000bad4 [ 48.781539][ T7732] R13: 0000000000402b50 R14: 0000000000000000 R15: 0000000000000000 [ 48.790462][ T7732] Kernel Offset: disabled [ 48.794798][ T7732] Rebooting in 86400 seconds..