[ OK ] Started OpenBSD Secure Shell server. [ OK ] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.154' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program syzkaller login: [ 59.859686][ T6813] netlink: 8 bytes leftover after parsing attributes in process `syz-executor264'. [ 59.864690][ T6818] netlink: 8 bytes leftover after parsing attributes in process `syz-executor264'. [ 59.879728][ T6819] netlink: 8 bytes leftover after parsing attributes in process `syz-executor264'. [ 59.880550][ T6820] netlink: 8 bytes leftover after parsing attributes in process `syz-executor264'. [ 59.891375][ T6821] netlink: 8 bytes leftover after parsing attributes in process `syz-executor264'. [ 59.902750][ T6820] ================================================================== [ 59.916281][ T6820] BUG: KASAN: use-after-free in tipc_nl_publ_dump+0xae0/0xce0 [ 59.923897][ T6820] Read of size 2 at addr ffff88809f220284 by task syz-executor264/6820 [ 59.932298][ T6820] [ 59.934624][ T6820] CPU: 0 PID: 6820 Comm: syz-executor264 Not tainted 5.8.0-rc2-syzkaller #0 [ 59.943284][ T6820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 59.953340][ T6820] Call Trace: [ 59.956630][ T6820] dump_stack+0x18f/0x20d [ 59.960948][ T6820] ? tipc_nl_publ_dump+0xae0/0xce0 [ 59.966040][ T6820] ? tipc_nl_publ_dump+0xae0/0xce0 [ 59.971137][ T6820] print_address_description.constprop.0.cold+0xae/0x436 [ 59.978160][ T6820] ? vprintk_func+0x97/0x1a6 [ 59.982752][ T6820] ? tipc_nl_publ_dump+0xae0/0xce0 [ 59.987847][ T6820] kasan_report.cold+0x1f/0x37 [ 59.992605][ T6820] ? tipc_nl_publ_dump+0xae0/0xce0 [ 59.997707][ T6820] tipc_nl_publ_dump+0xae0/0xce0 [ 60.002627][ T6820] ? __mutex_lock+0x626/0x10d0 [ 60.007391][ T6820] ? tipc_nl_sk_dump+0x30/0x30 [ 60.012150][ T6820] ? check_preemption_disabled+0x38/0x220 [ 60.017870][ T6820] ? rcu_read_lock_sched_held+0x3a/0xb0 [ 60.023419][ T6820] ? kmem_cache_alloc_node_trace+0x3b0/0x400 [ 60.029397][ T6820] ? __kmalloc_node_track_caller+0x38/0x60 [ 60.035188][ T6820] ? kasan_unpoison_shadow+0x33/0x40 [ 60.040454][ T6820] ? __phys_addr+0x9a/0x110 [ 60.044941][ T6820] ? memset+0x20/0x40 [ 60.048912][ T6820] genl_lock_dumpit+0x7f/0xb0 [ 60.053596][ T6820] netlink_dump+0x4cd/0xf60 [ 60.058093][ T6820] ? netlink_insert+0x1670/0x1670 [ 60.063123][ T6820] ? __mutex_unlock_slowpath+0xe2/0x610 [ 60.068676][ T6820] ? genl_start+0x45a/0x6e0 [ 60.073189][ T6820] __netlink_dump_start+0x643/0x900 [ 60.078389][ T6820] ? genl_rcv_msg+0x9e0/0x9e0 [ 60.083194][ T6820] ? tipc_nl_sk_dump+0x30/0x30 [ 60.087944][ T6820] genl_family_rcv_msg_dumpit+0x2ac/0x310 [ 60.093672][ T6820] ? genl_rcv+0x40/0x40 [ 60.097811][ T6820] ? mutex_lock_io_nested+0xf60/0xf60 [ 60.103175][ T6820] ? mark_lock+0xbc/0x1710 [ 60.107615][ T6820] ? genl_rcv_msg+0x9e0/0x9e0 [ 60.112273][ T6820] ? genl_unlock+0x20/0x20 [ 60.116696][ T6820] ? genl_parallel_done+0x170/0x170 [ 60.121882][ T6820] ? __radix_tree_lookup+0x1f3/0x290 [ 60.128121][ T6820] genl_rcv_msg+0x797/0x9e0 [ 60.132664][ T6820] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 60.139599][ T6820] ? lock_acquire+0x1f1/0xad0 [ 60.144288][ T6820] ? genl_rcv+0x15/0x40 [ 60.148428][ T6820] ? lock_release+0x8d0/0x8d0 [ 60.153111][ T6820] netlink_rcv_skb+0x15a/0x430 [ 60.157873][ T6820] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 60.164936][ T6820] ? netlink_ack+0xa10/0xa10 [ 60.169521][ T6820] genl_rcv+0x24/0x40 [ 60.173488][ T6820] netlink_unicast+0x533/0x7d0 [ 60.178236][ T6820] ? netlink_attachskb+0x810/0x810 [ 60.183335][ T6820] ? _copy_from_iter_full+0x247/0x890 [ 60.188816][ T6820] ? __phys_addr+0x9a/0x110 [ 60.193306][ T6820] ? __phys_addr_symbol+0x2c/0x70 [ 60.198416][ T6820] ? __check_object_size+0x171/0x3e4 [ 60.203706][ T6820] netlink_sendmsg+0x856/0xd90 [ 60.208456][ T6820] ? netlink_unicast+0x7d0/0x7d0 [ 60.213395][ T6820] ? netlink_unicast+0x7d0/0x7d0 [ 60.218329][ T6820] sock_sendmsg+0xcf/0x120 [ 60.222753][ T6820] ____sys_sendmsg+0x6e8/0x810 [ 60.227512][ T6820] ? kernel_sendmsg+0x50/0x50 [ 60.232187][ T6820] ? do_recvmmsg+0x6d0/0x6d0 [ 60.236758][ T6820] ? find_held_lock+0x2d/0x110 [ 60.241518][ T6820] ? lockdep_hardirqs_on_prepare+0x590/0x590 [ 60.247675][ T6820] ? lock_downgrade+0x820/0x820 [ 60.252645][ T6820] ___sys_sendmsg+0xf3/0x170 [ 60.257292][ T6820] ? sendmsg_copy_msghdr+0x160/0x160 [ 60.262580][ T6820] ? debug_object_active_state+0x260/0x350 [ 60.268392][ T6820] ? lock_downgrade+0x820/0x820 [ 60.273234][ T6820] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 60.279025][ T6820] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 60.285000][ T6820] ? _raw_spin_unlock_irqrestore+0x9b/0xe0 [ 60.290795][ T6820] ? debug_object_active_state+0x260/0x350 [ 60.296585][ T6820] ? trace_hardirqs_off+0x27/0x210 [ 60.301689][ T6820] ? __fget_light+0x215/0x280 [ 60.306367][ T6820] __sys_sendmsg+0xe5/0x1b0 [ 60.310867][ T6820] ? __sys_sendmsg_sock+0xb0/0xb0 [ 60.315882][ T6820] ? do_syscall_64+0x1c/0xe0 [ 60.320470][ T6820] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 60.326446][ T6820] do_syscall_64+0x60/0xe0 [ 60.330860][ T6820] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 60.336752][ T6820] RIP: 0033:0x445f09 [ 60.340630][ T6820] Code: Bad RIP value. [ 60.344775][ T6820] RSP: 002b:00007ffe66556c18 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 60.354058][ T6820] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000445f09 [ 60.362609][ T6820] RDX: 0000000000000000 RSI: 0000000020000500 RDI: 0000000000000004 [ 60.370674][ T6820] RBP: 00000000006d0018 R08: 0000000000000000 R09: 00000000004002e0 [ 60.378642][ T6820] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004030a0 [ 60.386621][ T6820] R13: 0000000000403130 R14: 0000000000000000 R15: 0000000000000000 [ 60.394588][ T6820] [ 60.396919][ T6820] Allocated by task 6818: [ 60.401260][ T6820] save_stack+0x1b/0x40 [ 60.405405][ T6820] __kasan_kmalloc.constprop.0+0xc2/0xd0 [ 60.411019][ T6820] __alloc_skb+0xae/0x550 [ 60.415386][ T6820] netlink_sendmsg+0x94f/0xd90 [ 60.420143][ T6820] sock_sendmsg+0xcf/0x120 [ 60.424561][ T6820] ____sys_sendmsg+0x6e8/0x810 [ 60.429335][ T6820] ___sys_sendmsg+0xf3/0x170 [ 60.433909][ T6820] __sys_sendmsg+0xe5/0x1b0 [ 60.438410][ T6820] do_syscall_64+0x60/0xe0 [ 60.442808][ T6820] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 60.448676][ T6820] [ 60.450999][ T6820] Freed by task 6818: [ 60.454995][ T6820] save_stack+0x1b/0x40 [ 60.459167][ T6820] __kasan_slab_free+0xf5/0x140 [ 60.463998][ T6820] kfree+0x103/0x2c0 [ 60.467876][ T6820] skb_release_data+0x6d9/0x910 [ 60.472707][ T6820] consume_skb+0xc2/0x160 [ 60.477018][ T6820] netlink_unicast+0x53b/0x7d0 [ 60.481763][ T6820] netlink_sendmsg+0x856/0xd90 [ 60.486524][ T6820] sock_sendmsg+0xcf/0x120 [ 60.490931][ T6820] ____sys_sendmsg+0x6e8/0x810 [ 60.495680][ T6820] ___sys_sendmsg+0xf3/0x170 [ 60.500271][ T6820] __sys_sendmsg+0xe5/0x1b0 [ 60.504769][ T6820] do_syscall_64+0x60/0xe0 [ 60.509185][ T6820] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 60.515060][ T6820] [ 60.517371][ T6820] The buggy address belongs to the object at ffff88809f220000 [ 60.517371][ T6820] which belongs to the cache kmalloc-1k of size 1024 [ 60.531425][ T6820] The buggy address is located 644 bytes inside of [ 60.531425][ T6820] 1024-byte region [ffff88809f220000, ffff88809f220400) [ 60.544762][ T6820] The buggy address belongs to the page: [ 60.550376][ T6820] page:ffffea00027c8800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 [ 60.559461][ T6820] flags: 0xfffe0000000200(slab) [ 60.564297][ T6820] raw: 00fffe0000000200 ffffea0002890548 ffffea0002870588 ffff8880aa000c40 [ 60.572974][ T6820] raw: 0000000000000000 ffff88809f220000 0000000100000002 0000000000000000 [ 60.581559][ T6820] page dumped because: kasan: bad access detected [ 60.587987][ T6820] [ 60.590296][ T6820] Memory state around the buggy address: [ 60.595925][ T6820] ffff88809f220180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.603969][ T6820] ffff88809f220200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.612028][ T6820] >ffff88809f220280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.620064][ T6820] ^ [ 60.624135][ T6820] ffff88809f220300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.632176][ T6820] ffff88809f220380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.640226][ T6820] ================================================================== [ 60.648286][ T6820] Disabling lock debugging due to kernel taint [ 60.655297][ T6820] Kernel panic - not syncing: panic_on_warn set ... executing program [ 60.661895][ T6820] CPU: 0 PID: 6820 Comm: syz-executor264 Tainted: G B 5.8.0-rc2-syzkaller #0 [ 60.671942][ T6820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 60.681993][ T6820] Call Trace: [ 60.685285][ T6820] dump_stack+0x18f/0x20d [ 60.689620][ T6820] ? tipc_nl_publ_dump+0xa60/0xce0 [ 60.694728][ T6820] panic+0x2e3/0x75c [ 60.698628][ T6820] ? __warn_printk+0xf3/0xf3 [ 60.703208][ T6820] ? preempt_schedule_common+0x59/0xc0 [ 60.708667][ T6820] ? tipc_nl_publ_dump+0xae0/0xce0 [ 60.713757][ T6820] ? preempt_schedule_thunk+0x16/0x18 [ 60.719132][ T6820] ? trace_hardirqs_on+0x55/0x220 [ 60.724133][ T6820] ? tipc_nl_publ_dump+0xae0/0xce0 [ 60.729242][ T6820] ? tipc_nl_publ_dump+0xae0/0xce0 [ 60.734330][ T6820] end_report+0x4d/0x53 [ 60.738461][ T6820] kasan_report.cold+0xd/0x37 [ 60.743116][ T6820] ? tipc_nl_publ_dump+0xae0/0xce0 [ 60.748202][ T6820] tipc_nl_publ_dump+0xae0/0xce0 [ 60.753118][ T6820] ? __mutex_lock+0x626/0x10d0 [ 60.758576][ T6820] ? tipc_nl_sk_dump+0x30/0x30 [ 60.763337][ T6820] ? check_preemption_disabled+0x38/0x220 [ 60.769040][ T6820] ? rcu_read_lock_sched_held+0x3a/0xb0 [ 60.774570][ T6820] ? kmem_cache_alloc_node_trace+0x3b0/0x400 [ 60.780603][ T6820] ? __kmalloc_node_track_caller+0x38/0x60 [ 60.786486][ T6820] ? kasan_unpoison_shadow+0x33/0x40 [ 60.791783][ T6820] ? __phys_addr+0x9a/0x110 [ 60.796285][ T6820] ? memset+0x20/0x40 [ 60.800275][ T6820] genl_lock_dumpit+0x7f/0xb0 [ 60.804931][ T6820] netlink_dump+0x4cd/0xf60 [ 60.809415][ T6820] ? netlink_insert+0x1670/0x1670 [ 60.814417][ T6820] ? __mutex_unlock_slowpath+0xe2/0x610 [ 60.819941][ T6820] ? genl_start+0x45a/0x6e0 [ 60.824425][ T6820] __netlink_dump_start+0x643/0x900 [ 60.831265][ T6820] ? genl_rcv_msg+0x9e0/0x9e0 [ 60.835927][ T6820] ? tipc_nl_sk_dump+0x30/0x30 [ 60.840669][ T6820] genl_family_rcv_msg_dumpit+0x2ac/0x310 [ 60.847156][ T6820] ? genl_rcv+0x40/0x40 [ 60.851307][ T6820] ? mutex_lock_io_nested+0xf60/0xf60 [ 60.856739][ T6820] ? mark_lock+0xbc/0x1710 [ 60.861140][ T6820] ? genl_rcv_msg+0x9e0/0x9e0 [ 60.865796][ T6820] ? genl_unlock+0x20/0x20 [ 60.870190][ T6820] ? genl_parallel_done+0x170/0x170 [ 60.875371][ T6820] ? __radix_tree_lookup+0x1f3/0x290 [ 60.880667][ T6820] genl_rcv_msg+0x797/0x9e0 [ 60.885175][ T6820] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 60.892094][ T6820] ? lock_acquire+0x1f1/0xad0 [ 60.896868][ T6820] ? genl_rcv+0x15/0x40 [ 60.901006][ T6820] ? lock_release+0x8d0/0x8d0 [ 60.905669][ T6820] netlink_rcv_skb+0x15a/0x430 [ 60.910415][ T6820] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 60.917354][ T6820] ? netlink_ack+0xa10/0xa10 [ 60.921941][ T6820] genl_rcv+0x24/0x40 [ 60.925938][ T6820] netlink_unicast+0x533/0x7d0 [ 60.930697][ T6820] ? netlink_attachskb+0x810/0x810 [ 60.935791][ T6820] ? _copy_from_iter_full+0x247/0x890 [ 60.941138][ T6820] ? __phys_addr+0x9a/0x110 [ 60.945705][ T6820] ? __phys_addr_symbol+0x2c/0x70 [ 60.950710][ T6820] ? __check_object_size+0x171/0x3e4 [ 60.955991][ T6820] netlink_sendmsg+0x856/0xd90 [ 60.960756][ T6820] ? netlink_unicast+0x7d0/0x7d0 [ 60.965671][ T6820] ? netlink_unicast+0x7d0/0x7d0 [ 60.970583][ T6820] sock_sendmsg+0xcf/0x120 [ 60.974977][ T6820] ____sys_sendmsg+0x6e8/0x810 [ 60.979734][ T6820] ? kernel_sendmsg+0x50/0x50 [ 60.984384][ T6820] ? do_recvmmsg+0x6d0/0x6d0 [ 60.988955][ T6820] ? find_held_lock+0x2d/0x110 [ 60.993704][ T6820] ? lockdep_hardirqs_on_prepare+0x590/0x590 [ 60.999746][ T6820] ? lock_downgrade+0x820/0x820 [ 61.004591][ T6820] ___sys_sendmsg+0xf3/0x170 [ 61.009157][ T6820] ? sendmsg_copy_msghdr+0x160/0x160 [ 61.014420][ T6820] ? debug_object_active_state+0x260/0x350 [ 61.020202][ T6820] ? lock_downgrade+0x820/0x820 [ 61.025031][ T6820] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 61.030832][ T6820] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 61.036810][ T6820] ? _raw_spin_unlock_irqrestore+0x9b/0xe0 [ 61.042615][ T6820] ? debug_object_active_state+0x260/0x350 [ 61.048418][ T6820] ? trace_hardirqs_off+0x27/0x210 [ 61.053521][ T6820] ? __fget_light+0x215/0x280 [ 61.058176][ T6820] __sys_sendmsg+0xe5/0x1b0 [ 61.062672][ T6820] ? __sys_sendmsg_sock+0xb0/0xb0 [ 61.067700][ T6820] ? do_syscall_64+0x1c/0xe0 [ 61.072270][ T6820] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 61.078233][ T6820] do_syscall_64+0x60/0xe0 [ 61.082647][ T6820] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 61.088518][ T6820] RIP: 0033:0x445f09 [ 61.092389][ T6820] Code: Bad RIP value. [ 61.096432][ T6820] RSP: 002b:00007ffe66556c18 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 61.104818][ T6820] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000445f09 [ 61.112782][ T6820] RDX: 0000000000000000 RSI: 0000000020000500 RDI: 0000000000000004 [ 61.120746][ T6820] RBP: 00000000006d0018 R08: 0000000000000000 R09: 00000000004002e0 [ 61.129133][ T6820] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004030a0 [ 61.137175][ T6820] R13: 0000000000403130 R14: 0000000000000000 R15: 0000000000000000 [ 61.146434][ T6820] Kernel Offset: disabled [ 61.150844][ T6820] Rebooting in 86400 seconds..