[ 82.314433][ T27] audit: type=1800 audit(1579360063.693:26): pid=9490 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 83.345947][ T27] kauditd_printk_skb: 2 callbacks suppressed [ 83.345959][ T27] audit: type=1800 audit(1579360064.733:29): pid=9490 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 83.372574][ T27] audit: type=1800 audit(1579360064.743:30): pid=9490 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.228' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 93.091641][ T9641] ================================================================== [ 93.099838][ T9641] BUG: KASAN: slab-out-of-bounds in bitmap_ip_list+0x40f/0xf20 [ 93.107363][ T9641] Read of size 8 at addr ffff8880a2bdca80 by task syz-executor846/9641 [ 93.115596][ T9641] [ 93.117916][ T9641] CPU: 0 PID: 9641 Comm: syz-executor846 Not tainted 5.5.0-rc5-syzkaller #0 [ 93.126567][ T9641] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 93.136652][ T9641] Call Trace: [ 93.139935][ T9641] dump_stack+0x197/0x210 [ 93.144248][ T9641] ? bitmap_ip_list+0x40f/0xf20 [ 93.149085][ T9641] print_address_description.constprop.0.cold+0xd4/0x30b [ 93.156146][ T9641] ? bitmap_ip_list+0x40f/0xf20 [ 93.160985][ T9641] ? bitmap_ip_list+0x40f/0xf20 [ 93.165847][ T9641] __kasan_report.cold+0x1b/0x41 [ 93.170821][ T9641] ? bitmap_ip_list+0x40f/0xf20 [ 93.175661][ T9641] kasan_report+0x12/0x20 [ 93.180025][ T9641] check_memory_region+0x134/0x1a0 [ 93.185131][ T9641] __kasan_check_read+0x11/0x20 [ 93.190041][ T9641] bitmap_ip_list+0x40f/0xf20 [ 93.194758][ T9641] ? bitmap_ip_add+0xe60/0xe60 [ 93.199524][ T9641] ? nla_put+0x110/0x150 [ 93.203779][ T9641] ip_set_dump_start+0x96c/0x1ca0 [ 93.208821][ T9641] ? ip_set_rename+0x720/0x720 [ 93.213582][ T9641] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 93.219114][ T9641] ? zap_class+0xe40/0xe60 [ 93.223536][ T9641] ? __kasan_check_write+0x14/0x20 [ 93.228663][ T9641] netlink_dump+0x558/0xfb0 [ 93.233232][ T9641] ? __netlink_sendskb+0xc0/0xc0 [ 93.238201][ T9641] __netlink_dump_start+0x673/0x930 [ 93.243389][ T9641] ip_set_dump+0x15a/0x1d0 [ 93.247794][ T9641] ? call_ad+0x5a0/0x5a0 [ 93.252022][ T9641] ? ip_set_rename+0x720/0x720 [ 93.256771][ T9641] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 93.262569][ T9641] ? call_ad+0x5a0/0x5a0 [ 93.266834][ T9641] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 93.271764][ T9641] ? nfnetlink_bind+0x2c0/0x2c0 [ 93.276621][ T9641] ? __kasan_check_read+0x11/0x20 [ 93.281630][ T9641] ? __lock_acquire+0x8a0/0x4a00 [ 93.286566][ T9641] ? save_stack+0x5c/0x90 [ 93.290888][ T9641] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 93.297129][ T9641] ? apparmor_capable+0x497/0x900 [ 93.302154][ T9641] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 93.308397][ T9641] ? __kasan_check_read+0x11/0x20 [ 93.313464][ T9641] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 93.318919][ T9641] netlink_rcv_skb+0x177/0x450 [ 93.323675][ T9641] ? nfnetlink_bind+0x2c0/0x2c0 [ 93.328557][ T9641] ? netlink_ack+0xb50/0xb50 [ 93.333136][ T9641] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 93.339362][ T9641] ? ns_capable_common+0x93/0x100 [ 93.344371][ T9641] ? ns_capable+0x20/0x30 [ 93.348696][ T9641] ? __netlink_ns_capable+0x104/0x140 [ 93.354071][ T9641] nfnetlink_rcv+0x1ba/0x460 [ 93.358660][ T9641] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 93.364152][ T9641] ? netlink_deliver_tap+0x24a/0xbf0 [ 93.369441][ T9641] ? __kasan_check_write+0x14/0x20 [ 93.374657][ T9641] netlink_unicast+0x59e/0x7e0 [ 93.379431][ T9641] ? netlink_attachskb+0x870/0x870 [ 93.384531][ T9641] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 93.390237][ T9641] ? __check_object_size+0x3d/0x437 [ 93.395423][ T9641] netlink_sendmsg+0x91c/0xea0 [ 93.400205][ T9641] ? netlink_unicast+0x7e0/0x7e0 [ 93.405150][ T9641] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 93.410683][ T9641] ? apparmor_socket_sendmsg+0x2a/0x30 [ 93.416134][ T9641] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 93.422377][ T9641] ? security_socket_sendmsg+0x8d/0xc0 [ 93.427823][ T9641] ? netlink_unicast+0x7e0/0x7e0 [ 93.432762][ T9641] sock_sendmsg+0xd7/0x130 [ 93.437166][ T9641] ____sys_sendmsg+0x753/0x880 [ 93.441919][ T9641] ? kernel_sendmsg+0x50/0x50 [ 93.446597][ T9641] ? lockdep_init_map+0x1be/0x6d0 [ 93.451617][ T9641] ___sys_sendmsg+0x100/0x170 [ 93.456283][ T9641] ? sendmsg_copy_msghdr+0x70/0x70 [ 93.461467][ T9641] ? __kasan_check_read+0x11/0x20 [ 93.466542][ T9641] ? __lock_acquire+0x8a0/0x4a00 [ 93.471485][ T9641] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 93.477731][ T9641] ? __this_cpu_preempt_check+0x35/0x190 [ 93.483368][ T9641] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 93.489611][ T9641] ? percpu_counter_add_batch+0x13c/0x190 [ 93.495336][ T9641] ? __fd_install+0x1bc/0x640 [ 93.500056][ T9641] ? find_held_lock+0x35/0x130 [ 93.504812][ T9641] ? __fd_install+0x1bc/0x640 [ 93.509524][ T9641] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 93.515786][ T9641] ? __fget_light+0x1a9/0x230 [ 93.520447][ T9641] ? __fdget+0x1b/0x20 [ 93.524498][ T9641] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 93.530769][ T9641] __sys_sendmsg+0x105/0x1d0 [ 93.535364][ T9641] ? __sys_sendmsg_sock+0xc0/0xc0 [ 93.540382][ T9641] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 93.545995][ T9641] ? do_syscall_64+0x26/0x790 [ 93.550695][ T9641] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 93.556763][ T9641] ? do_syscall_64+0x26/0x790 [ 93.561448][ T9641] __x64_sys_sendmsg+0x78/0xb0 [ 93.566216][ T9641] do_syscall_64+0xfa/0x790 [ 93.570741][ T9641] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 93.576634][ T9641] RIP: 0033:0x440559 [ 93.580515][ T9641] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 93.600117][ T9641] RSP: 002b:00007ffdf1d08328 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 93.608533][ T9641] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440559 [ 93.616506][ T9641] RDX: 0000000000000080 RSI: 00000000200000c0 RDI: 0000000000000004 [ 93.624461][ T9641] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 93.632427][ T9641] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000401de0 [ 93.640404][ T9641] R13: 0000000000401e70 R14: 0000000000000000 R15: 0000000000000000 [ 93.648371][ T9641] [ 93.650699][ T9641] Allocated by task 9641: [ 93.655018][ T9641] save_stack+0x23/0x90 [ 93.659176][ T9641] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 93.664800][ T9641] kasan_kmalloc+0x9/0x10 [ 93.669128][ T9641] __kmalloc+0x163/0x770 [ 93.673374][ T9641] ip_set_alloc+0x38/0x5e [ 93.677703][ T9641] bitmap_ip_create+0x6ec/0xc20 [ 93.682593][ T9641] ip_set_create+0x6f1/0x1500 [ 93.687263][ T9641] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 93.692190][ T9641] netlink_rcv_skb+0x177/0x450 [ 93.696936][ T9641] nfnetlink_rcv+0x1ba/0x460 [ 93.701508][ T9641] netlink_unicast+0x59e/0x7e0 [ 93.706253][ T9641] netlink_sendmsg+0x91c/0xea0 [ 93.711008][ T9641] sock_sendmsg+0xd7/0x130 [ 93.715438][ T9641] ____sys_sendmsg+0x753/0x880 [ 93.720206][ T9641] ___sys_sendmsg+0x100/0x170 [ 93.724879][ T9641] __sys_sendmsg+0x105/0x1d0 [ 93.729563][ T9641] __x64_sys_sendmsg+0x78/0xb0 [ 93.734397][ T9641] do_syscall_64+0xfa/0x790 [ 93.738932][ T9641] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 93.744798][ T9641] [ 93.747107][ T9641] Freed by task 9332: [ 93.751120][ T9641] save_stack+0x23/0x90 [ 93.755259][ T9641] __kasan_slab_free+0x102/0x150 [ 93.760175][ T9641] kasan_slab_free+0xe/0x10 [ 93.764657][ T9641] kfree+0x10a/0x2c0 [ 93.768535][ T9641] tomoyo_check_open_permission+0x19e/0x3e0 [ 93.774462][ T9641] tomoyo_file_open+0xa9/0xd0 [ 93.779122][ T9641] security_file_open+0x71/0x300 [ 93.784045][ T9641] do_dentry_open+0x37a/0x1380 [ 93.788795][ T9641] vfs_open+0xa0/0xd0 [ 93.792762][ T9641] path_openat+0x10df/0x4500 [ 93.797339][ T9641] do_filp_open+0x1a1/0x280 [ 93.801828][ T9641] do_sys_open+0x3fe/0x5d0 [ 93.806227][ T9641] __x64_sys_open+0x7e/0xc0 [ 93.810733][ T9641] do_syscall_64+0xfa/0x790 [ 93.815245][ T9641] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 93.821165][ T9641] [ 93.823483][ T9641] The buggy address belongs to the object at ffff8880a2bdca80 [ 93.823483][ T9641] which belongs to the cache kmalloc-32 of size 32 [ 93.837347][ T9641] The buggy address is located 0 bytes inside of [ 93.837347][ T9641] 32-byte region [ffff8880a2bdca80, ffff8880a2bdcaa0) [ 93.850341][ T9641] The buggy address belongs to the page: [ 93.855985][ T9641] page:ffffea00028af700 refcount:1 mapcount:0 mapping:ffff8880aa4001c0 index:0xffff8880a2bdcfc1 [ 93.866389][ T9641] raw: 00fffe0000000200 ffffea0002560048 ffffea0002768108 ffff8880aa4001c0 [ 93.874978][ T9641] raw: ffff8880a2bdcfc1 ffff8880a2bdc000 0000000100000035 0000000000000000 [ 93.883596][ T9641] page dumped because: kasan: bad access detected [ 93.889995][ T9641] [ 93.892306][ T9641] Memory state around the buggy address: [ 93.897921][ T9641] ffff8880a2bdc980: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 93.906022][ T9641] ffff8880a2bdca00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 93.914222][ T9641] >ffff8880a2bdca80: 04 fc fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 93.922280][ T9641] ^ [ 93.926341][ T9641] ffff8880a2bdcb00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 93.934402][ T9641] ffff8880a2bdcb80: fb fb fb fb fc fc fc fc 00 01 fc fc fc fc fc fc [ 93.942442][ T9641] ================================================================== [ 93.950499][ T9641] Disabling lock debugging due to kernel taint [ 93.956842][ T9641] Kernel panic - not syncing: panic_on_warn set ... [ 93.963447][ T9641] CPU: 0 PID: 9641 Comm: syz-executor846 Tainted: G B 5.5.0-rc5-syzkaller #0 [ 93.973536][ T9641] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 93.983620][ T9641] Call Trace: [ 93.986899][ T9641] dump_stack+0x197/0x210 [ 93.991219][ T9641] panic+0x2e3/0x75c [ 93.995175][ T9641] ? add_taint.cold+0x16/0x16 [ 93.999852][ T9641] ? bitmap_ip_list+0x40f/0xf20 [ 94.004684][ T9641] ? preempt_schedule+0x4b/0x60 [ 94.009517][ T9641] ? ___preempt_schedule+0x16/0x18 [ 94.014610][ T9641] ? trace_hardirqs_on+0x5e/0x240 [ 94.019631][ T9641] ? bitmap_ip_list+0x40f/0xf20 [ 94.024465][ T9641] end_report+0x47/0x4f [ 94.028602][ T9641] ? bitmap_ip_list+0x40f/0xf20 [ 94.033474][ T9641] __kasan_report.cold+0xe/0x41 [ 94.038308][ T9641] ? bitmap_ip_list+0x40f/0xf20 [ 94.043141][ T9641] kasan_report+0x12/0x20 [ 94.047450][ T9641] check_memory_region+0x134/0x1a0 [ 94.052544][ T9641] __kasan_check_read+0x11/0x20 [ 94.057374][ T9641] bitmap_ip_list+0x40f/0xf20 [ 94.062035][ T9641] ? bitmap_ip_add+0xe60/0xe60 [ 94.066838][ T9641] ? nla_put+0x110/0x150 [ 94.071104][ T9641] ip_set_dump_start+0x96c/0x1ca0 [ 94.076159][ T9641] ? ip_set_rename+0x720/0x720 [ 94.080929][ T9641] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 94.086479][ T9641] ? zap_class+0xe40/0xe60 [ 94.090879][ T9641] ? __kasan_check_write+0x14/0x20 [ 94.096086][ T9641] netlink_dump+0x558/0xfb0 [ 94.100590][ T9641] ? __netlink_sendskb+0xc0/0xc0 [ 94.105513][ T9641] __netlink_dump_start+0x673/0x930 [ 94.110694][ T9641] ip_set_dump+0x15a/0x1d0 [ 94.115113][ T9641] ? call_ad+0x5a0/0x5a0 [ 94.119334][ T9641] ? ip_set_rename+0x720/0x720 [ 94.124096][ T9641] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 94.129909][ T9641] ? call_ad+0x5a0/0x5a0 [ 94.134163][ T9641] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 94.139109][ T9641] ? nfnetlink_bind+0x2c0/0x2c0 [ 94.143953][ T9641] ? __kasan_check_read+0x11/0x20 [ 94.148965][ T9641] ? __lock_acquire+0x8a0/0x4a00 [ 94.153899][ T9641] ? save_stack+0x5c/0x90 [ 94.158212][ T9641] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 94.164451][ T9641] ? apparmor_capable+0x497/0x900 [ 94.169544][ T9641] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 94.175779][ T9641] ? __kasan_check_read+0x11/0x20 [ 94.180799][ T9641] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 94.186241][ T9641] netlink_rcv_skb+0x177/0x450 [ 94.190993][ T9641] ? nfnetlink_bind+0x2c0/0x2c0 [ 94.195860][ T9641] ? netlink_ack+0xb50/0xb50 [ 94.200432][ T9641] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 94.206673][ T9641] ? ns_capable_common+0x93/0x100 [ 94.211695][ T9641] ? ns_capable+0x20/0x30 [ 94.216026][ T9641] ? __netlink_ns_capable+0x104/0x140 [ 94.221384][ T9641] nfnetlink_rcv+0x1ba/0x460 [ 94.226018][ T9641] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 94.231516][ T9641] ? netlink_deliver_tap+0x24a/0xbf0 [ 94.236787][ T9641] ? __kasan_check_write+0x14/0x20 [ 94.241944][ T9641] netlink_unicast+0x59e/0x7e0 [ 94.246693][ T9641] ? netlink_attachskb+0x870/0x870 [ 94.251804][ T9641] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 94.257505][ T9641] ? __check_object_size+0x3d/0x437 [ 94.262725][ T9641] netlink_sendmsg+0x91c/0xea0 [ 94.267474][ T9641] ? netlink_unicast+0x7e0/0x7e0 [ 94.272437][ T9641] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 94.278009][ T9641] ? apparmor_socket_sendmsg+0x2a/0x30 [ 94.283469][ T9641] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 94.289740][ T9641] ? security_socket_sendmsg+0x8d/0xc0 [ 94.295250][ T9641] ? netlink_unicast+0x7e0/0x7e0 [ 94.300207][ T9641] sock_sendmsg+0xd7/0x130 [ 94.304608][ T9641] ____sys_sendmsg+0x753/0x880 [ 94.309354][ T9641] ? kernel_sendmsg+0x50/0x50 [ 94.314013][ T9641] ? lockdep_init_map+0x1be/0x6d0 [ 94.319022][ T9641] ___sys_sendmsg+0x100/0x170 [ 94.323728][ T9641] ? sendmsg_copy_msghdr+0x70/0x70 [ 94.328869][ T9641] ? __kasan_check_read+0x11/0x20 [ 94.333923][ T9641] ? __lock_acquire+0x8a0/0x4a00 [ 94.338845][ T9641] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 94.345185][ T9641] ? __this_cpu_preempt_check+0x35/0x190 [ 94.350825][ T9641] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 94.357063][ T9641] ? percpu_counter_add_batch+0x13c/0x190 [ 94.362774][ T9641] ? __fd_install+0x1bc/0x640 [ 94.367434][ T9641] ? find_held_lock+0x35/0x130 [ 94.372178][ T9641] ? __fd_install+0x1bc/0x640 [ 94.376839][ T9641] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 94.383060][ T9641] ? __fget_light+0x1a9/0x230 [ 94.387726][ T9641] ? __fdget+0x1b/0x20 [ 94.391778][ T9641] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 94.398000][ T9641] __sys_sendmsg+0x105/0x1d0 [ 94.402575][ T9641] ? __sys_sendmsg_sock+0xc0/0xc0 [ 94.407585][ T9641] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 94.413025][ T9641] ? do_syscall_64+0x26/0x790 [ 94.417684][ T9641] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 94.423750][ T9641] ? do_syscall_64+0x26/0x790 [ 94.428409][ T9641] __x64_sys_sendmsg+0x78/0xb0 [ 94.433156][ T9641] do_syscall_64+0xfa/0x790 [ 94.437643][ T9641] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 94.443515][ T9641] RIP: 0033:0x440559 [ 94.447392][ T9641] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 94.467000][ T9641] RSP: 002b:00007ffdf1d08328 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 94.475392][ T9641] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440559 [ 94.483360][ T9641] RDX: 0000000000000080 RSI: 00000000200000c0 RDI: 0000000000000004 [ 94.491326][ T9641] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 94.499278][ T9641] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000401de0 [ 94.507244][ T9641] R13: 0000000000401e70 R14: 0000000000000000 R15: 0000000000000000 [ 94.516496][ T9641] Kernel Offset: disabled [ 94.520824][ T9641] Rebooting in 86400 seconds..