Warning: Permanently added '10.128.0.220' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 91.033220][T10125] ================================================================== [ 91.041615][T10125] BUG: KASAN: slab-out-of-bounds in bitmap_ipmac_list+0x635/0x1080 [ 91.049731][T10125] Read of size 8 at addr ffff88809e6bdec0 by task syz-executor508/10125 [ 91.059117][T10125] [ 91.061451][T10125] CPU: 0 PID: 10125 Comm: syz-executor508 Not tainted 5.5.0-rc6-syzkaller #0 [ 91.070324][T10125] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 91.080501][T10125] Call Trace: [ 91.083940][T10125] dump_stack+0x197/0x210 [ 91.088292][T10125] ? bitmap_ipmac_list+0x635/0x1080 [ 91.093740][T10125] print_address_description.constprop.0.cold+0xd4/0x30b [ 91.100882][T10125] ? bitmap_ipmac_list+0x635/0x1080 [ 91.106129][T10125] ? bitmap_ipmac_list+0x635/0x1080 [ 91.111457][T10125] __kasan_report.cold+0x1b/0x41 [ 91.116527][T10125] ? bitmap_ipmac_list+0x635/0x1080 [ 91.121723][T10125] kasan_report+0x12/0x20 [ 91.126071][T10125] check_memory_region+0x134/0x1a0 [ 91.131266][T10125] __kasan_check_read+0x11/0x20 [ 91.136279][T10125] bitmap_ipmac_list+0x635/0x1080 [ 91.141349][T10125] ? bitmap_ipmac_head+0x8a0/0x8a0 [ 91.146454][T10125] ? nla_put+0x110/0x150 [ 91.150772][T10125] ip_set_dump_start+0x96c/0x1ca0 [ 91.156129][T10125] ? ip_set_rename+0x720/0x720 [ 91.160902][T10125] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 91.166439][T10125] ? perf_trace_lock_acquire+0x4c0/0x530 [ 91.172233][T10125] ? __kasan_check_write+0x14/0x20 [ 91.177371][T10125] netlink_dump+0x558/0xfb0 [ 91.181908][T10125] ? __netlink_sendskb+0xc0/0xc0 [ 91.187093][T10125] __netlink_dump_start+0x66a/0x930 [ 91.192355][T10125] ip_set_dump+0x15a/0x1d0 [ 91.196793][T10125] ? call_ad+0x5a0/0x5a0 [ 91.201271][T10125] ? ip_set_rename+0x720/0x720 [ 91.206264][T10125] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 91.212692][T10125] ? call_ad+0x5a0/0x5a0 [ 91.216957][T10125] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 91.222008][T10125] ? nfnetlink_bind+0x2c0/0x2c0 [ 91.226886][T10125] ? __kasan_check_read+0x11/0x20 [ 91.231996][T10125] ? __lock_acquire+0x8a0/0x4a00 [ 91.236945][T10125] ? save_stack+0x5c/0x90 [ 91.241285][T10125] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 91.247545][T10125] ? apparmor_capable+0x497/0x900 [ 91.252673][T10125] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 91.258925][T10125] ? __kasan_check_read+0x11/0x20 [ 91.263956][T10125] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 91.269519][T10125] netlink_rcv_skb+0x177/0x450 [ 91.274390][T10125] ? nfnetlink_bind+0x2c0/0x2c0 [ 91.281807][T10125] ? netlink_ack+0xb50/0xb50 [ 91.288129][T10125] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 91.294820][T10125] ? ns_capable_common+0x93/0x100 [ 91.299945][T10125] ? ns_capable+0x20/0x30 [ 91.304627][T10125] ? __netlink_ns_capable+0x104/0x140 [ 91.310087][T10125] nfnetlink_rcv+0x1ba/0x460 [ 91.315033][T10125] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 91.320491][T10125] ? netlink_deliver_tap+0x24a/0xbe0 [ 91.325787][T10125] ? __kasan_check_write+0x14/0x20 [ 91.330921][T10125] netlink_unicast+0x58c/0x7d0 [ 91.335701][T10125] ? netlink_attachskb+0x870/0x870 [ 91.340823][T10125] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 91.346676][T10125] ? __check_object_size+0x3d/0x437 [ 91.352053][T10125] netlink_sendmsg+0x91c/0xea0 [ 91.356841][T10125] ? netlink_unicast+0x7d0/0x7d0 [ 91.361808][T10125] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 91.368491][T10125] ? apparmor_socket_sendmsg+0x2a/0x30 [ 91.373976][T10125] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 91.380257][T10125] ? security_socket_sendmsg+0x8d/0xc0 [ 91.386268][T10125] ? netlink_unicast+0x7d0/0x7d0 [ 91.391463][T10125] sock_sendmsg+0xd7/0x130 [ 91.396723][T10125] ____sys_sendmsg+0x753/0x880 [ 91.401586][T10125] ? kernel_sendmsg+0x50/0x50 [ 91.406284][T10125] ? lockdep_init_map+0x1be/0x6d0 [ 91.411380][T10125] ___sys_sendmsg+0x100/0x170 [ 91.416099][T10125] ? sendmsg_copy_msghdr+0x70/0x70 [ 91.421695][T10125] ? __kasan_check_read+0x11/0x20 [ 91.426744][T10125] ? __lock_acquire+0x8a0/0x4a00 [ 91.431686][T10125] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 91.437928][T10125] ? __this_cpu_preempt_check+0x35/0x190 [ 91.443579][T10125] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 91.449888][T10125] ? percpu_counter_add_batch+0x13c/0x190 [ 91.455604][T10125] ? __fd_install+0x1bc/0x640 [ 91.460366][T10125] ? find_held_lock+0x35/0x130 [ 91.465303][T10125] ? __fd_install+0x1bc/0x640 [ 91.469981][T10125] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 91.476428][T10125] ? __fget_light+0x1a9/0x230 [ 91.481129][T10125] ? __fdget+0x1b/0x20 [ 91.485300][T10125] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 91.491659][T10125] __sys_sendmsg+0x105/0x1d0 [ 91.496367][T10125] ? __sys_sendmsg_sock+0xc0/0xc0 [ 91.501675][T10125] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 91.507302][T10125] ? do_syscall_64+0x26/0x790 [ 91.512237][T10125] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 91.518414][T10125] ? do_syscall_64+0x26/0x790 [ 91.523322][T10125] __x64_sys_sendmsg+0x78/0xb0 [ 91.528189][T10125] do_syscall_64+0xfa/0x790 [ 91.532707][T10125] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 91.538592][T10125] RIP: 0033:0x440529 [ 91.542966][T10125] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 91.562768][T10125] RSP: 002b:00007fff0e9ba6b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 91.571405][T10125] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440529 [ 91.579797][T10125] RDX: 0000000000000000 RSI: 0000000020000380 RDI: 0000000000000004 [ 91.587999][T10125] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 91.595975][T10125] R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000401db0 [ 91.603950][T10125] R13: 0000000000401e40 R14: 0000000000000000 R15: 0000000000000000 [ 91.611976][T10125] [ 91.614478][T10125] Allocated by task 10125: [ 91.618905][T10125] save_stack+0x23/0x90 [ 91.623070][T10125] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 91.628874][T10125] kasan_kmalloc+0x9/0x10 [ 91.633201][T10125] __kmalloc+0x163/0x770 [ 91.637613][T10125] ip_set_alloc+0x38/0x5e [ 91.642131][T10125] bitmap_ipmac_create+0x4e8/0xa00 [ 91.647245][T10125] ip_set_create+0x6f1/0x1500 [ 91.651938][T10125] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 91.656883][T10125] netlink_rcv_skb+0x177/0x450 [ 91.661827][T10125] nfnetlink_rcv+0x1ba/0x460 [ 91.666464][T10125] netlink_unicast+0x58c/0x7d0 [ 91.671668][T10125] netlink_sendmsg+0x91c/0xea0 [ 91.676470][T10125] sock_sendmsg+0xd7/0x130 [ 91.680979][T10125] ____sys_sendmsg+0x753/0x880 [ 91.687347][T10125] ___sys_sendmsg+0x100/0x170 [ 91.692317][T10125] __sys_sendmsg+0x105/0x1d0 [ 91.697026][T10125] __x64_sys_sendmsg+0x78/0xb0 [ 91.703447][T10125] do_syscall_64+0xfa/0x790 [ 91.707947][T10125] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 91.714033][T10125] [ 91.716490][T10125] Freed by task 9856: [ 91.720488][T10125] save_stack+0x23/0x90 [ 91.724643][T10125] __kasan_slab_free+0x102/0x150 [ 91.729623][T10125] kasan_slab_free+0xe/0x10 [ 91.734264][T10125] kfree+0x10a/0x2c0 [ 91.738310][T10125] tomoyo_path_perm+0x24e/0x430 [ 91.743236][T10125] tomoyo_inode_getattr+0x1d/0x30 [ 91.749439][T10125] security_inode_getattr+0xf2/0x150 [ 91.754723][T10125] vfs_getattr+0x25/0x70 [ 91.758957][T10125] vfs_statx+0x157/0x200 [ 91.763317][T10125] __do_sys_newstat+0xa4/0x130 [ 91.768072][T10125] __x64_sys_newstat+0x54/0x80 [ 91.772974][T10125] do_syscall_64+0xfa/0x790 [ 91.777470][T10125] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 91.783536][T10125] [ 91.785928][T10125] The buggy address belongs to the object at ffff88809e6bdec0 [ 91.785928][T10125] which belongs to the cache kmalloc-32 of size 32 [ 91.800611][T10125] The buggy address is located 0 bytes inside of [ 91.800611][T10125] 32-byte region [ffff88809e6bdec0, ffff88809e6bdee0) [ 91.813878][T10125] The buggy address belongs to the page: [ 91.819509][T10125] page:ffffea000279af40 refcount:1 mapcount:0 mapping:ffff8880aa4001c0 index:0xffff88809e6bdfc1 [ 91.829914][T10125] raw: 00fffe0000000200 ffffea0002a2f9c8 ffffea0002a00908 ffff8880aa4001c0 [ 91.838738][T10125] raw: ffff88809e6bdfc1 ffff88809e6bd000 000000010000003f 0000000000000000 [ 91.847313][T10125] page dumped because: kasan: bad access detected [ 91.853847][T10125] [ 91.856243][T10125] Memory state around the buggy address: [ 91.862297][T10125] ffff88809e6bdd80: 00 01 fc fc fc fc fc fc 06 fc fc fc fc fc fc fc [ 91.870740][T10125] ffff88809e6bde00: 00 00 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 91.878896][T10125] >ffff88809e6bde80: 00 00 fc fc fc fc fc fc 04 fc fc fc fc fc fc fc [ 91.887032][T10125] ^ [ 91.893590][T10125] ffff88809e6bdf00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 91.901652][T10125] ffff88809e6bdf80: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc [ 91.909707][T10125] ================================================================== [ 91.917960][T10125] Disabling lock debugging due to kernel taint [ 91.925503][T10125] Kernel panic - not syncing: panic_on_warn set ... [ 91.932243][T10125] CPU: 0 PID: 10125 Comm: syz-executor508 Tainted: G B 5.5.0-rc6-syzkaller #0 [ 91.942378][T10125] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 91.952567][T10125] Call Trace: [ 91.955964][T10125] dump_stack+0x197/0x210 [ 91.960323][T10125] panic+0x2e3/0x75c [ 91.964228][T10125] ? add_taint.cold+0x16/0x16 [ 91.968910][T10125] ? bitmap_ipmac_list+0x635/0x1080 [ 91.974489][T10125] ? preempt_schedule+0x4b/0x60 [ 91.979348][T10125] ? ___preempt_schedule+0x16/0x18 [ 91.985395][T10125] ? trace_hardirqs_on+0x5e/0x240 [ 91.990522][T10125] ? bitmap_ipmac_list+0x635/0x1080 [ 91.995718][T10125] end_report+0x47/0x4f [ 91.999977][T10125] ? bitmap_ipmac_list+0x635/0x1080 [ 92.005179][T10125] __kasan_report.cold+0xe/0x41 [ 92.010023][T10125] ? bitmap_ipmac_list+0x635/0x1080 [ 92.015580][T10125] kasan_report+0x12/0x20 [ 92.020033][T10125] check_memory_region+0x134/0x1a0 [ 92.025144][T10125] __kasan_check_read+0x11/0x20 [ 92.029990][T10125] bitmap_ipmac_list+0x635/0x1080 [ 92.035047][T10125] ? bitmap_ipmac_head+0x8a0/0x8a0 [ 92.040154][T10125] ? nla_put+0x110/0x150 [ 92.044392][T10125] ip_set_dump_start+0x96c/0x1ca0 [ 92.049519][T10125] ? ip_set_rename+0x720/0x720 [ 92.054289][T10125] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 92.060024][T10125] ? perf_trace_lock_acquire+0x4c0/0x530 [ 92.065757][T10125] ? __kasan_check_write+0x14/0x20 [ 92.071130][T10125] netlink_dump+0x558/0xfb0 [ 92.075746][T10125] ? __netlink_sendskb+0xc0/0xc0 [ 92.080715][T10125] __netlink_dump_start+0x66a/0x930 [ 92.086166][T10125] ip_set_dump+0x15a/0x1d0 [ 92.090715][T10125] ? call_ad+0x5a0/0x5a0 [ 92.094962][T10125] ? ip_set_rename+0x720/0x720 [ 92.099853][T10125] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 92.106015][T10125] ? call_ad+0x5a0/0x5a0 [ 92.110367][T10125] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 92.115311][T10125] ? nfnetlink_bind+0x2c0/0x2c0 [ 92.120231][T10125] ? __kasan_check_read+0x11/0x20 [ 92.125437][T10125] ? __lock_acquire+0x8a0/0x4a00 [ 92.130906][T10125] ? save_stack+0x5c/0x90 [ 92.135260][T10125] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 92.141517][T10125] ? apparmor_capable+0x497/0x900 [ 92.146544][T10125] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 92.152787][T10125] ? __kasan_check_read+0x11/0x20 [ 92.157817][T10125] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 92.163410][T10125] netlink_rcv_skb+0x177/0x450 [ 92.168200][T10125] ? nfnetlink_bind+0x2c0/0x2c0 [ 92.173167][T10125] ? netlink_ack+0xb50/0xb50 [ 92.177757][T10125] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 92.184084][T10125] ? ns_capable_common+0x93/0x100 [ 92.189400][T10125] ? ns_capable+0x20/0x30 [ 92.194182][T10125] ? __netlink_ns_capable+0x104/0x140 [ 92.199554][T10125] nfnetlink_rcv+0x1ba/0x460 [ 92.204648][T10125] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 92.210199][T10125] ? netlink_deliver_tap+0x24a/0xbe0 [ 92.216311][T10125] ? __kasan_check_write+0x14/0x20 [ 92.221525][T10125] netlink_unicast+0x58c/0x7d0 [ 92.226377][T10125] ? netlink_attachskb+0x870/0x870 [ 92.231549][T10125] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 92.237416][T10125] ? __check_object_size+0x3d/0x437 [ 92.242753][T10125] netlink_sendmsg+0x91c/0xea0 [ 92.247526][T10125] ? netlink_unicast+0x7d0/0x7d0 [ 92.252462][T10125] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 92.258007][T10125] ? apparmor_socket_sendmsg+0x2a/0x30 [ 92.263463][T10125] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 92.269787][T10125] ? security_socket_sendmsg+0x8d/0xc0 [ 92.275248][T10125] ? netlink_unicast+0x7d0/0x7d0 [ 92.280181][T10125] sock_sendmsg+0xd7/0x130 [ 92.284663][T10125] ____sys_sendmsg+0x753/0x880 [ 92.289422][T10125] ? kernel_sendmsg+0x50/0x50 [ 92.294140][T10125] ? lockdep_init_map+0x1be/0x6d0 [ 92.299157][T10125] ___sys_sendmsg+0x100/0x170 [ 92.303818][T10125] ? sendmsg_copy_msghdr+0x70/0x70 [ 92.308977][T10125] ? __kasan_check_read+0x11/0x20 [ 92.314000][T10125] ? __lock_acquire+0x8a0/0x4a00 [ 92.318993][T10125] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 92.325233][T10125] ? __this_cpu_preempt_check+0x35/0x190 [ 92.330866][T10125] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 92.337105][T10125] ? percpu_counter_add_batch+0x13c/0x190 [ 92.342916][T10125] ? __fd_install+0x1bc/0x640 [ 92.347593][T10125] ? find_held_lock+0x35/0x130 [ 92.352344][T10125] ? __fd_install+0x1bc/0x640 [ 92.357027][T10125] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 92.363257][T10125] ? __fget_light+0x1a9/0x230 [ 92.367981][T10125] ? __fdget+0x1b/0x20 [ 92.372049][T10125] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 92.378287][T10125] __sys_sendmsg+0x105/0x1d0 [ 92.382885][T10125] ? __sys_sendmsg_sock+0xc0/0xc0 [ 92.388648][T10125] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 92.394150][T10125] ? do_syscall_64+0x26/0x790 [ 92.398829][T10125] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 92.404890][T10125] ? do_syscall_64+0x26/0x790 [ 92.409632][T10125] __x64_sys_sendmsg+0x78/0xb0 [ 92.414760][T10125] do_syscall_64+0xfa/0x790 [ 92.419253][T10125] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 92.425146][T10125] RIP: 0033:0x440529 [ 92.429049][T10125] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 92.448969][T10125] RSP: 002b:00007fff0e9ba6b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 92.457507][T10125] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440529 [ 92.465628][T10125] RDX: 0000000000000000 RSI: 0000000020000380 RDI: 0000000000000004 [ 92.473772][T10125] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 92.481926][T10125] R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000401db0 [ 92.489891][T10125] R13: 0000000000401e40 R14: 0000000000000000 R15: 0000000000000000 [ 92.499693][T10125] Kernel Offset: disabled [ 92.504034][T10125] Rebooting in 86400 seconds..