[ 99.157543][ T27] audit: type=1800 audit(1579460396.326:26): pid=9634 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 99.882377][ T27] kauditd_printk_skb: 2 callbacks suppressed [ 99.882389][ T27] audit: type=1800 audit(1579460397.066:29): pid=9634 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 99.908943][ T27] audit: type=1800 audit(1579460397.066:30): pid=9634 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.89' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 123.922325][ T9787] ================================================================== [ 123.930553][ T9787] BUG: KASAN: slab-out-of-bounds in bitmap_ip_list+0x40f/0xf20 [ 123.938116][ T9787] Read of size 8 at addr ffff8880a3fc4100 by task syz-executor911/9787 [ 123.946342][ T9787] [ 123.948944][ T9787] CPU: 1 PID: 9787 Comm: syz-executor911 Not tainted 5.5.0-rc6-syzkaller #0 [ 123.957816][ T9787] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 123.968335][ T9787] Call Trace: [ 123.971689][ T9787] dump_stack+0x197/0x210 [ 123.976117][ T9787] ? bitmap_ip_list+0x40f/0xf20 [ 123.980976][ T9787] print_address_description.constprop.0.cold+0xd4/0x30b [ 123.987999][ T9787] ? bitmap_ip_list+0x40f/0xf20 [ 123.993028][ T9787] ? bitmap_ip_list+0x40f/0xf20 [ 123.997879][ T9787] __kasan_report.cold+0x1b/0x41 [ 124.002832][ T9787] ? bitmap_ip_list+0x40f/0xf20 [ 124.007680][ T9787] kasan_report+0x12/0x20 [ 124.012039][ T9787] check_memory_region+0x134/0x1a0 [ 124.017158][ T9787] __kasan_check_read+0x11/0x20 [ 124.022019][ T9787] bitmap_ip_list+0x40f/0xf20 [ 124.026714][ T9787] ? bitmap_ip_add+0xe60/0xe60 [ 124.031505][ T9787] ? nla_put+0x110/0x150 [ 124.035753][ T9787] ip_set_dump_start+0x96c/0x1ca0 [ 124.040862][ T9787] ? ip_set_rename+0x720/0x720 [ 124.046618][ T9787] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 124.052232][ T9787] ? perf_trace_lock_acquire+0x4a0/0x530 [ 124.057886][ T9787] ? __kasan_check_write+0x14/0x20 [ 124.063162][ T9787] netlink_dump+0x558/0xfb0 [ 124.067831][ T9787] ? __netlink_sendskb+0xc0/0xc0 [ 124.072798][ T9787] __netlink_dump_start+0x66a/0x930 [ 124.078006][ T9787] ip_set_dump+0x15a/0x1d0 [ 124.082433][ T9787] ? call_ad+0x5a0/0x5a0 [ 124.086694][ T9787] ? ip_set_rename+0x720/0x720 [ 124.091463][ T9787] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 124.097368][ T9787] ? call_ad+0x5a0/0x5a0 [ 124.101684][ T9787] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 124.106645][ T9787] ? nfnetlink_bind+0x2c0/0x2c0 [ 124.111637][ T9787] ? __kasan_check_read+0x11/0x20 [ 124.116735][ T9787] ? __lock_acquire+0x8a0/0x4a00 [ 124.121675][ T9787] ? save_stack+0x5c/0x90 [ 124.126037][ T9787] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 124.133517][ T9787] ? apparmor_capable+0x497/0x900 [ 124.138563][ T9787] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 124.144951][ T9787] ? __kasan_check_read+0x11/0x20 [ 124.150176][ T9787] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 124.155635][ T9787] netlink_rcv_skb+0x177/0x450 [ 124.160510][ T9787] ? nfnetlink_bind+0x2c0/0x2c0 [ 124.165349][ T9787] ? netlink_ack+0xb50/0xb50 [ 124.170042][ T9787] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 124.176285][ T9787] ? ns_capable_common+0x93/0x100 [ 124.181314][ T9787] ? ns_capable+0x20/0x30 [ 124.185830][ T9787] ? __netlink_ns_capable+0x104/0x140 [ 124.191330][ T9787] nfnetlink_rcv+0x1ba/0x460 [ 124.196075][ T9787] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 124.201588][ T9787] ? netlink_deliver_tap+0x24a/0xbe0 [ 124.206881][ T9787] ? __kasan_check_write+0x14/0x20 [ 124.211996][ T9787] netlink_unicast+0x58c/0x7d0 [ 124.216781][ T9787] ? netlink_attachskb+0x870/0x870 [ 124.221893][ T9787] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 124.227678][ T9787] ? __check_object_size+0x3d/0x437 [ 124.232891][ T9787] netlink_sendmsg+0x91c/0xea0 [ 124.237868][ T9787] ? netlink_unicast+0x7d0/0x7d0 [ 124.242851][ T9787] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 124.248554][ T9787] ? apparmor_socket_sendmsg+0x2a/0x30 [ 124.254016][ T9787] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 124.260257][ T9787] ? security_socket_sendmsg+0x8d/0xc0 [ 124.266112][ T9787] ? netlink_unicast+0x7d0/0x7d0 [ 124.271342][ T9787] sock_sendmsg+0xd7/0x130 [ 124.275763][ T9787] ____sys_sendmsg+0x753/0x880 [ 124.280640][ T9787] ? kernel_sendmsg+0x50/0x50 [ 124.285433][ T9787] ? lockdep_init_map+0x1be/0x6d0 [ 124.290526][ T9787] ___sys_sendmsg+0x100/0x170 [ 124.295445][ T9787] ? sendmsg_copy_msghdr+0x70/0x70 [ 124.300547][ T9787] ? __kasan_check_read+0x11/0x20 [ 124.305573][ T9787] ? __lock_acquire+0x8a0/0x4a00 [ 124.310499][ T9787] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 124.316738][ T9787] ? __this_cpu_preempt_check+0x35/0x190 [ 124.322484][ T9787] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 124.328772][ T9787] ? percpu_counter_add_batch+0x13c/0x190 [ 124.334527][ T9787] ? __fd_install+0x1bc/0x640 [ 124.339633][ T9787] ? find_held_lock+0x35/0x130 [ 124.344395][ T9787] ? __fd_install+0x1bc/0x640 [ 124.349182][ T9787] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 124.355760][ T9787] ? __fget_light+0x1a9/0x230 [ 124.360449][ T9787] ? __fdget+0x1b/0x20 [ 124.364600][ T9787] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 124.370855][ T9787] __sys_sendmsg+0x105/0x1d0 [ 124.375554][ T9787] ? __sys_sendmsg_sock+0xc0/0xc0 [ 124.380618][ T9787] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 124.386214][ T9787] ? do_syscall_64+0x26/0x790 [ 124.390999][ T9787] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 124.397203][ T9787] ? do_syscall_64+0x26/0x790 [ 124.401990][ T9787] __x64_sys_sendmsg+0x78/0xb0 [ 124.406746][ T9787] do_syscall_64+0xfa/0x790 [ 124.411340][ T9787] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 124.417374][ T9787] RIP: 0033:0x440569 [ 124.421430][ T9787] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 124.441302][ T9787] RSP: 002b:00007ffe2fa93b58 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 124.450583][ T9787] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440569 [ 124.458662][ T9787] RDX: 0000000000000010 RSI: 00000000200003c0 RDI: 0000000000000004 [ 124.466740][ T9787] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 124.475274][ T9787] R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000401df0 [ 124.483362][ T9787] R13: 0000000000401e80 R14: 0000000000000000 R15: 0000000000000000 [ 124.491462][ T9787] [ 124.493800][ T9787] Allocated by task 9787: [ 124.498139][ T9787] save_stack+0x23/0x90 [ 124.502287][ T9787] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 124.508207][ T9787] kasan_kmalloc+0x9/0x10 [ 124.512684][ T9787] __kmalloc+0x163/0x770 [ 124.516926][ T9787] ip_set_alloc+0x38/0x5e [ 124.521255][ T9787] bitmap_ip_create+0x6ec/0xc20 [ 124.526092][ T9787] ip_set_create+0x6f1/0x1500 [ 124.530753][ T9787] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 124.535670][ T9787] netlink_rcv_skb+0x177/0x450 [ 124.540433][ T9787] nfnetlink_rcv+0x1ba/0x460 [ 124.545014][ T9787] netlink_unicast+0x58c/0x7d0 [ 124.549772][ T9787] netlink_sendmsg+0x91c/0xea0 [ 124.554534][ T9787] sock_sendmsg+0xd7/0x130 [ 124.558943][ T9787] ____sys_sendmsg+0x753/0x880 [ 124.563708][ T9787] ___sys_sendmsg+0x100/0x170 [ 124.568408][ T9787] __sys_sendmsg+0x105/0x1d0 [ 124.572979][ T9787] __x64_sys_sendmsg+0x78/0xb0 [ 124.577752][ T9787] do_syscall_64+0xfa/0x790 [ 124.582261][ T9787] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 124.588303][ T9787] [ 124.590615][ T9787] Freed by task 9518: [ 124.594581][ T9787] save_stack+0x23/0x90 [ 124.598760][ T9787] __kasan_slab_free+0x102/0x150 [ 124.603713][ T9787] kasan_slab_free+0xe/0x10 [ 124.608301][ T9787] kfree+0x10a/0x2c0 [ 124.612198][ T9787] single_release+0x95/0xc0 [ 124.616739][ T9787] __fput+0x2ff/0x890 [ 124.620741][ T9787] ____fput+0x16/0x20 [ 124.624831][ T9787] task_work_run+0x145/0x1c0 [ 124.629570][ T9787] exit_to_usermode_loop+0x316/0x380 [ 124.635125][ T9787] do_syscall_64+0x676/0x790 [ 124.639835][ T9787] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 124.645844][ T9787] [ 124.648219][ T9787] The buggy address belongs to the object at ffff8880a3fc4100 [ 124.648219][ T9787] which belongs to the cache kmalloc-32 of size 32 [ 124.662096][ T9787] The buggy address is located 0 bytes inside of [ 124.662096][ T9787] 32-byte region [ffff8880a3fc4100, ffff8880a3fc4120) [ 124.675300][ T9787] The buggy address belongs to the page: [ 124.681040][ T9787] page:ffffea00028ff100 refcount:1 mapcount:0 mapping:ffff8880aa4001c0 index:0xffff8880a3fc4fc1 [ 124.691516][ T9787] raw: 00fffe0000000200 ffffea00029b57c8 ffffea0002818208 ffff8880aa4001c0 [ 124.700269][ T9787] raw: ffff8880a3fc4fc1 ffff8880a3fc4000 000000010000003e 0000000000000000 [ 124.708894][ T9787] page dumped because: kasan: bad access detected [ 124.715307][ T9787] [ 124.717641][ T9787] Memory state around the buggy address: [ 124.723283][ T9787] ffff8880a3fc4000: 06 fc fc fc fc fc fc fc 06 fc fc fc fc fc fc fc [ 124.731350][ T9787] ffff8880a3fc4080: 06 fc fc fc fc fc fc fc 05 fc fc fc fc fc fc fc [ 124.739731][ T9787] >ffff8880a3fc4100: 04 fc fc fc fc fc fc fc 06 fc fc fc fc fc fc fc [ 124.747902][ T9787] ^ [ 124.752037][ T9787] ffff8880a3fc4180: 06 fc fc fc fc fc fc fc 06 fc fc fc fc fc fc fc [ 124.760120][ T9787] ffff8880a3fc4200: 05 fc fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 124.768173][ T9787] ================================================================== [ 124.776331][ T9787] Disabling lock debugging due to kernel taint [ 124.783515][ T9787] Kernel panic - not syncing: panic_on_warn set ... [ 124.790107][ T9787] CPU: 1 PID: 9787 Comm: syz-executor911 Tainted: G B 5.5.0-rc6-syzkaller #0 [ 124.800273][ T9787] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 124.810425][ T9787] Call Trace: [ 124.813730][ T9787] dump_stack+0x197/0x210 [ 124.818170][ T9787] panic+0x2e3/0x75c [ 124.822070][ T9787] ? add_taint.cold+0x16/0x16 [ 124.826743][ T9787] ? bitmap_ip_list+0x40f/0xf20 [ 124.831579][ T9787] ? preempt_schedule+0x4b/0x60 [ 124.836628][ T9787] ? ___preempt_schedule+0x16/0x18 [ 124.841736][ T9787] ? trace_hardirqs_on+0x5e/0x240 [ 124.846756][ T9787] ? bitmap_ip_list+0x40f/0xf20 [ 124.851824][ T9787] end_report+0x47/0x4f [ 124.855965][ T9787] ? bitmap_ip_list+0x40f/0xf20 [ 124.860815][ T9787] __kasan_report.cold+0xe/0x41 [ 124.865682][ T9787] ? bitmap_ip_list+0x40f/0xf20 [ 124.870753][ T9787] kasan_report+0x12/0x20 [ 124.875131][ T9787] check_memory_region+0x134/0x1a0 [ 124.880287][ T9787] __kasan_check_read+0x11/0x20 [ 124.885128][ T9787] bitmap_ip_list+0x40f/0xf20 [ 124.889798][ T9787] ? bitmap_ip_add+0xe60/0xe60 [ 124.894776][ T9787] ? nla_put+0x110/0x150 [ 124.899130][ T9787] ip_set_dump_start+0x96c/0x1ca0 [ 124.904169][ T9787] ? ip_set_rename+0x720/0x720 [ 124.908933][ T9787] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 124.914677][ T9787] ? perf_trace_lock_acquire+0x4a0/0x530 [ 124.920443][ T9787] ? __kasan_check_write+0x14/0x20 [ 124.925546][ T9787] netlink_dump+0x558/0xfb0 [ 124.930048][ T9787] ? __netlink_sendskb+0xc0/0xc0 [ 124.935043][ T9787] __netlink_dump_start+0x66a/0x930 [ 124.940283][ T9787] ip_set_dump+0x15a/0x1d0 [ 124.944706][ T9787] ? call_ad+0x5a0/0x5a0 [ 124.948957][ T9787] ? ip_set_rename+0x720/0x720 [ 124.953714][ T9787] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 124.959626][ T9787] ? call_ad+0x5a0/0x5a0 [ 124.963864][ T9787] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 124.968805][ T9787] ? nfnetlink_bind+0x2c0/0x2c0 [ 124.973744][ T9787] ? __kasan_check_read+0x11/0x20 [ 124.978907][ T9787] ? __lock_acquire+0x8a0/0x4a00 [ 124.983891][ T9787] ? save_stack+0x5c/0x90 [ 124.988219][ T9787] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 124.994712][ T9787] ? apparmor_capable+0x497/0x900 [ 124.999779][ T9787] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 125.006115][ T9787] ? __kasan_check_read+0x11/0x20 [ 125.011345][ T9787] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 125.016850][ T9787] netlink_rcv_skb+0x177/0x450 [ 125.021610][ T9787] ? nfnetlink_bind+0x2c0/0x2c0 [ 125.026715][ T9787] ? netlink_ack+0xb50/0xb50 [ 125.031512][ T9787] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 125.038446][ T9787] ? ns_capable_common+0x93/0x100 [ 125.043729][ T9787] ? ns_capable+0x20/0x30 [ 125.048057][ T9787] ? __netlink_ns_capable+0x104/0x140 [ 125.053432][ T9787] nfnetlink_rcv+0x1ba/0x460 [ 125.058026][ T9787] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 125.063478][ T9787] ? netlink_deliver_tap+0x24a/0xbe0 [ 125.068758][ T9787] ? __kasan_check_write+0x14/0x20 [ 125.073868][ T9787] netlink_unicast+0x58c/0x7d0 [ 125.078633][ T9787] ? netlink_attachskb+0x870/0x870 [ 125.083780][ T9787] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 125.089492][ T9787] ? __check_object_size+0x3d/0x437 [ 125.094682][ T9787] netlink_sendmsg+0x91c/0xea0 [ 125.099441][ T9787] ? netlink_unicast+0x7d0/0x7d0 [ 125.104380][ T9787] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 125.109957][ T9787] ? apparmor_socket_sendmsg+0x2a/0x30 [ 125.118221][ T9787] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 125.124451][ T9787] ? security_socket_sendmsg+0x8d/0xc0 [ 125.129904][ T9787] ? netlink_unicast+0x7d0/0x7d0 [ 125.134826][ T9787] sock_sendmsg+0xd7/0x130 [ 125.139246][ T9787] ____sys_sendmsg+0x753/0x880 [ 125.144165][ T9787] ? kernel_sendmsg+0x50/0x50 [ 125.148903][ T9787] ? lockdep_init_map+0x1be/0x6d0 [ 125.153924][ T9787] ___sys_sendmsg+0x100/0x170 [ 125.158614][ T9787] ? sendmsg_copy_msghdr+0x70/0x70 [ 125.163776][ T9787] ? __kasan_check_read+0x11/0x20 [ 125.168800][ T9787] ? __lock_acquire+0x8a0/0x4a00 [ 125.173742][ T9787] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 125.180250][ T9787] ? __this_cpu_preempt_check+0x35/0x190 [ 125.185888][ T9787] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 125.192117][ T9787] ? percpu_counter_add_batch+0x13c/0x190 [ 125.197835][ T9787] ? __fd_install+0x1bc/0x640 [ 125.202498][ T9787] ? find_held_lock+0x35/0x130 [ 125.207561][ T9787] ? __fd_install+0x1bc/0x640 [ 125.212224][ T9787] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 125.218456][ T9787] ? __fget_light+0x1a9/0x230 [ 125.223117][ T9787] ? __fdget+0x1b/0x20 [ 125.227181][ T9787] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 125.233424][ T9787] __sys_sendmsg+0x105/0x1d0 [ 125.238044][ T9787] ? __sys_sendmsg_sock+0xc0/0xc0 [ 125.243068][ T9787] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 125.248516][ T9787] ? do_syscall_64+0x26/0x790 [ 125.253193][ T9787] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 125.259501][ T9787] ? do_syscall_64+0x26/0x790 [ 125.264175][ T9787] __x64_sys_sendmsg+0x78/0xb0 [ 125.269035][ T9787] do_syscall_64+0xfa/0x790 [ 125.273592][ T9787] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 125.279479][ T9787] RIP: 0033:0x440569 [ 125.283404][ T9787] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 125.303117][ T9787] RSP: 002b:00007ffe2fa93b58 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 125.311607][ T9787] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440569 [ 125.319598][ T9787] RDX: 0000000000000010 RSI: 00000000200003c0 RDI: 0000000000000004 [ 125.327609][ T9787] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 125.335571][ T9787] R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000401df0 [ 125.343767][ T9787] R13: 0000000000401e80 R14: 0000000000000000 R15: 0000000000000000 [ 125.353375][ T9787] Kernel Offset: disabled [ 125.357710][ T9787] Rebooting in 86400 seconds..