[info] Using makefile-style concurrent boot in runlevel 2.
[   25.861517] audit: type=1800 audit(1544601050.761:21): pid=5857 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="bootlogs" dev="sda1" ino=2419 res=0
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added '10.128.0.108' (ECDSA) to the list of known hosts.
executing program
executing program
executing program
executing program
syzkaller login: [   38.569082] ==================================================================
[   38.576686] BUG: KASAN: use-after-free in tipc_group_bc_cong+0x327/0x3f0
[   38.583524] Read of size 2 at addr ffff8881d5c9f674 by task syz-executor350/6030
[   38.591032] 
[   38.592660] CPU: 1 PID: 6030 Comm: syz-executor350 Not tainted 4.20.0-rc6+ #339
[   38.600099] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   38.609439] Call Trace:
[   38.612107]  dump_stack+0x244/0x39d
[   38.615745]  ? dump_stack_print_info.cold.1+0x20/0x20
[   38.620938]  ? printk+0xa7/0xcf
[   38.624201]  ? kmsg_dump_rewind_nolock+0xe4/0xe4
[   38.628939]  ? _raw_spin_unlock_irqrestore+0x82/0xd0
[   38.634029]  print_address_description.cold.7+0x9/0x1ff
[   38.639394]  kasan_report.cold.8+0x242/0x309
[   38.643935]  ? tipc_group_bc_cong+0x327/0x3f0
[   38.648416]  __asan_report_load2_noabort+0x14/0x20
[   38.653330]  tipc_group_bc_cong+0x327/0x3f0
[   38.657725]  ? _raw_spin_unlock_irqrestore+0x6d/0xd0
[   38.662818]  ? tipc_group_cong+0x5d0/0x5d0
[   38.667039]  ? remove_wait_queue+0x1a6/0x360
[   38.671452]  ? add_wait_queue+0x2b0/0x2b0
[   38.675592]  ? __local_bh_enable_ip+0x160/0x260
[   38.680250]  tipc_send_group_bcast+0x50a/0xd90
[   38.684854]  ? tipc_sk_sock_err.isra.61+0x2f0/0x2f0
[   38.689860]  ? __init_waitqueue_head+0x150/0x150
[   38.694604]  ? refill_pi_state_cache.part.8+0x310/0x310
[   38.699956]  ? mark_held_locks+0x130/0x130
[   38.704201]  ? futex_wait_setup+0x266/0x3e0
[   38.708511]  ? futex_wake+0x760/0x760
[   38.712299]  ? __sanitizer_cov_trace_switch+0x53/0x90
[   38.717499]  __tipc_sendmsg+0xeec/0x1d40
[   38.721565]  ? futex_wait+0x5ec/0xa50
[   38.725357]  ? tipc_sendmcast+0xf50/0xf50
[   38.729499]  ? __sanitizer_cov_trace_switch+0x53/0x90
[   38.734678]  ? zap_class+0x640/0x640
[   38.738380]  ? print_usage_bug+0xc0/0xc0
[   38.742446]  ? find_held_lock+0x36/0x1c0
[   38.746502]  ? mark_held_locks+0xc7/0x130
[   38.750635]  ? __local_bh_enable_ip+0x160/0x260
[   38.755315]  ? __local_bh_enable_ip+0x160/0x260
[   38.759973]  ? lockdep_hardirqs_on+0x3bb/0x5b0
[   38.764543]  ? trace_hardirqs_on+0xbd/0x310
[   38.768847]  ? lock_release+0xa00/0xa00
[   38.772806]  ? lock_sock_nested+0xe2/0x120
[   38.777025]  ? trace_hardirqs_off_caller+0x310/0x310
[   38.782237]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   38.787760]  ? check_preemption_disabled+0x48/0x280
[   38.792760]  ? lock_sock_nested+0x9a/0x120
[   38.796990]  ? lock_sock_nested+0x9a/0x120
[   38.801211]  ? __local_bh_enable_ip+0x160/0x260
[   38.805870]  tipc_sendmsg+0x50/0x70
[   38.809482]  ? __tipc_sendmsg+0x1d40/0x1d40
[   38.813788]  sock_sendmsg+0xd5/0x120
[   38.817500]  ___sys_sendmsg+0x7fd/0x930
[   38.821465]  ? __local_bh_enable_ip+0x160/0x260
[   38.826130]  ? copy_msghdr_from_user+0x580/0x580
[   38.830881]  ? _raw_spin_unlock_bh+0x30/0x40
[   38.835312]  ? trace_hardirqs_off_caller+0x310/0x310
[   38.840404]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   38.845931]  ? check_preemption_disabled+0x48/0x280
[   38.850935]  ? release_sock+0x1ec/0x2c0
[   38.854898]  ? __fget_light+0x2e9/0x430
[   38.858859]  ? fget_raw+0x20/0x20
[   38.862294]  ? release_sock+0x1ec/0x2c0
[   38.866255]  ? __release_sock+0x3a0/0x3a0
[   38.870394]  ? tipc_nametbl_build_group+0x273/0x360
[   38.875429]  ? tipc_setsockopt+0x726/0xd70
[   38.879861]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[   38.885386]  ? sockfd_lookup_light+0xc5/0x160
[   38.889869]  __sys_sendmsg+0x11d/0x280
[   38.893749]  ? __ia32_sys_shutdown+0x80/0x80
[   38.898144]  ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[   38.903753]  ? fput+0x130/0x1a0
[   38.907023]  ? __x64_sys_futex+0x47f/0x6a0
[   38.911245]  ? do_syscall_64+0x9a/0x820
[   38.915203]  ? do_syscall_64+0x9a/0x820
[   38.919173]  ? trace_hardirqs_off_caller+0x310/0x310
[   38.924267]  __x64_sys_sendmsg+0x78/0xb0
[   38.928313]  do_syscall_64+0x1b9/0x820
[   38.932201]  ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[   38.937563]  ? syscall_return_slowpath+0x5e0/0x5e0
[   38.942519]  ? trace_hardirqs_on_caller+0x310/0x310
[   38.947538]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[   38.952540]  ? post_copy_siginfo_from_user.isra.25.part.26+0x250/0x250
[   38.959198]  ? __switch_to_asm+0x40/0x70
[   38.963264]  ? __switch_to_asm+0x34/0x70
[   38.967312]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   38.972142]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   38.977315] RIP: 0033:0x446389
[   38.980497] Code: e8 2c b3 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00
[   38.999472] RSP: 002b:00007f6772584db8 EFLAGS: 00000297 ORIG_RAX: 000000000000002e
[   39.007161] RAX: ffffffffffffffda RBX: 00000000006dac38 RCX: 0000000000446389
[   39.014508] RDX: 0000000000000000 RSI: 00000000200006c0 RDI: 0000000000000005
[   39.021768] RBP: 00000000006dac30 R08: 0000000000000000 R09: 0000000000000000
[   39.029162] R10: 0000000000000000 R11: 0000000000000297 R12: 00000000006dac3c
[   39.036420] R13: 00007ffebcdf11ff R14: 00007f67725859c0 R15: 00000000006dad2c
[   39.043697] 
[   39.045310] Allocated by task 6031:
[   39.048932]  save_stack+0x43/0xd0
[   39.052390]  kasan_kmalloc+0xc7/0xe0
[   39.056111]  kmem_cache_alloc_trace+0x152/0x750
[   39.060799]  tipc_group_create+0x152/0xa70
[   39.065021]  tipc_setsockopt+0x2d1/0xd70
[   39.069068]  __sys_setsockopt+0x1ba/0x3c0
[   39.073205]  __x64_sys_setsockopt+0xbe/0x150
[   39.077600]  do_syscall_64+0x1b9/0x820
[   39.081930]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   39.087106] 
[   39.088716] Freed by task 6031:
[   39.092074]  save_stack+0x43/0xd0
[   39.095521]  __kasan_slab_free+0x102/0x150
[   39.099757]  kasan_slab_free+0xe/0x10
[   39.103541]  kfree+0xcf/0x230
[   39.106640]  tipc_group_delete+0x2e4/0x3f0
[   39.110864]  tipc_sk_leave+0x113/0x220
[   39.114752]  tipc_setsockopt+0x97d/0xd70
[   39.118886]  __sys_setsockopt+0x1ba/0x3c0
[   39.123020]  __x64_sys_setsockopt+0xbe/0x150
[   39.127413]  do_syscall_64+0x1b9/0x820
[   39.131297]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   39.136494] 
[   39.138107] The buggy address belongs to the object at ffff8881d5c9f600
[   39.138107]  which belongs to the cache kmalloc-192 of size 192
[   39.150753] The buggy address is located 116 bytes inside of
[   39.150753]  192-byte region [ffff8881d5c9f600, ffff8881d5c9f6c0)
[   39.162611] The buggy address belongs to the page:
[   39.167530] page:ffffea00075727c0 count:1 mapcount:0 mapping:ffff8881da800040 index:0xffff8881d5c9ff00
[   39.176960] flags: 0x2fffc0000000200(slab)
[   39.181187] raw: 02fffc0000000200 ffffea00075dd608 ffff8881da801138 ffff8881da800040
[   39.189146] raw: ffff8881d5c9ff00 ffff8881d5c9f000 0000000100000007 0000000000000000
[   39.197006] page dumped because: kasan: bad access detected
[   39.202696] 
[   39.204305] Memory state around the buggy address:
[   39.209219]  ffff8881d5c9f500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   39.216560]  ffff8881d5c9f580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   39.223901] >ffff8881d5c9f600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   39.231240]                                                              ^
[   39.238235]  ffff8881d5c9f680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   39.245577]  ffff8881d5c9f700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   39.253002] ==================================================================
[   39.260363] Disabling lock debugging due to kernel taint
[   39.266333] Kernel panic - not syncing: panic_on_warn set ...
[   39.272342] CPU: 1 PID: 6030 Comm: syz-executor350 Tainted: G    B             4.20.0-rc6+ #339
[   39.281175] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   39.290512] Call Trace:
[   39.293208]  dump_stack+0x244/0x39d
[   39.296822]  ? dump_stack_print_info.cold.1+0x20/0x20
[   39.302003]  panic+0x2ad/0x55c
[   39.305283]  ? add_taint.cold.5+0x16/0x16
[   39.309425]  ? preempt_schedule+0x4d/0x60
[   39.313560]  ? ___preempt_schedule+0x16/0x18
[   39.317954]  ? trace_hardirqs_on+0xb4/0x310
[   39.322261]  kasan_end_report+0x47/0x4f
[   39.326222]  kasan_report.cold.8+0x76/0x309
[   39.330539]  ? tipc_group_bc_cong+0x327/0x3f0
[   39.335019]  __asan_report_load2_noabort+0x14/0x20
[   39.339935]  tipc_group_bc_cong+0x327/0x3f0
[   39.344243]  ? _raw_spin_unlock_irqrestore+0x6d/0xd0
[   39.349336]  ? tipc_group_cong+0x5d0/0x5d0
[   39.353564]  ? remove_wait_queue+0x1a6/0x360
[   39.357964]  ? add_wait_queue+0x2b0/0x2b0
[   39.362094]  ? __local_bh_enable_ip+0x160/0x260
[   39.366753]  tipc_send_group_bcast+0x50a/0xd90
[   39.371335]  ? tipc_sk_sock_err.isra.61+0x2f0/0x2f0
[   39.376346]  ? __init_waitqueue_head+0x150/0x150
[   39.381089]  ? refill_pi_state_cache.part.8+0x310/0x310
[   39.386452]  ? mark_held_locks+0x130/0x130
[   39.390685]  ? futex_wait_setup+0x266/0x3e0
[   39.394990]  ? futex_wake+0x760/0x760
[   39.398778]  ? __sanitizer_cov_trace_switch+0x53/0x90
[   39.403955]  __tipc_sendmsg+0xeec/0x1d40
[   39.407999]  ? futex_wait+0x5ec/0xa50
[   39.411800]  ? tipc_sendmcast+0xf50/0xf50
[   39.416044]  ? __sanitizer_cov_trace_switch+0x53/0x90
[   39.421227]  ? zap_class+0x640/0x640
[   39.424927]  ? print_usage_bug+0xc0/0xc0
[   39.428979]  ? find_held_lock+0x36/0x1c0
[   39.433040]  ? mark_held_locks+0xc7/0x130
[   39.437177]  ? __local_bh_enable_ip+0x160/0x260
[   39.441829]  ? __local_bh_enable_ip+0x160/0x260
[   39.446481]  ? lockdep_hardirqs_on+0x3bb/0x5b0
[   39.451046]  ? trace_hardirqs_on+0xbd/0x310
[   39.455370]  ? lock_release+0xa00/0xa00
[   39.459338]  ? lock_sock_nested+0xe2/0x120
[   39.463670]  ? trace_hardirqs_off_caller+0x310/0x310
[   39.468757]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   39.474283]  ? check_preemption_disabled+0x48/0x280
[   39.479293]  ? lock_sock_nested+0x9a/0x120
[   39.483519]  ? lock_sock_nested+0x9a/0x120
[   39.487740]  ? __local_bh_enable_ip+0x160/0x260
[   39.492413]  tipc_sendmsg+0x50/0x70
[   39.496028]  ? __tipc_sendmsg+0x1d40/0x1d40
[   39.500346]  sock_sendmsg+0xd5/0x120
[   39.504049]  ___sys_sendmsg+0x7fd/0x930
[   39.508123]  ? __local_bh_enable_ip+0x160/0x260
[   39.512775]  ? copy_msghdr_from_user+0x580/0x580
[   39.517517]  ? _raw_spin_unlock_bh+0x30/0x40
[   39.521914]  ? trace_hardirqs_off_caller+0x310/0x310
[   39.527116]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   39.532635]  ? check_preemption_disabled+0x48/0x280
[   39.537773]  ? release_sock+0x1ec/0x2c0
[   39.541732]  ? __fget_light+0x2e9/0x430
[   39.545690]  ? fget_raw+0x20/0x20
[   39.549126]  ? release_sock+0x1ec/0x2c0
[   39.553171]  ? __release_sock+0x3a0/0x3a0
[   39.557322]  ? tipc_nametbl_build_group+0x273/0x360
[   39.562326]  ? tipc_setsockopt+0x726/0xd70
[   39.566549]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[   39.572100]  ? sockfd_lookup_light+0xc5/0x160
[   39.576580]  __sys_sendmsg+0x11d/0x280
[   39.580580]  ? __ia32_sys_shutdown+0x80/0x80
[   39.584971]  ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[   39.590488]  ? fput+0x130/0x1a0
[   39.593751]  ? __x64_sys_futex+0x47f/0x6a0
[   39.597982]  ? do_syscall_64+0x9a/0x820
[   39.601940]  ? do_syscall_64+0x9a/0x820
[   39.605903]  ? trace_hardirqs_off_caller+0x310/0x310
[   39.610993]  __x64_sys_sendmsg+0x78/0xb0
[   39.615040]  do_syscall_64+0x1b9/0x820
[   39.618917]  ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[   39.624269]  ? syscall_return_slowpath+0x5e0/0x5e0
[   39.629185]  ? trace_hardirqs_on_caller+0x310/0x310
[   39.634200]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[   39.639204]  ? post_copy_siginfo_from_user.isra.25.part.26+0x250/0x250
[   39.645866]  ? __switch_to_asm+0x40/0x70
[   39.649947]  ? __switch_to_asm+0x34/0x70
[   39.654007]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   39.658833]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   39.664013] RIP: 0033:0x446389
[   39.667193] Code: e8 2c b3 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00
[   39.686073] RSP: 002b:00007f6772584db8 EFLAGS: 00000297 ORIG_RAX: 000000000000002e
[   39.693761] RAX: ffffffffffffffda RBX: 00000000006dac38 RCX: 0000000000446389
[   39.701013] RDX: 0000000000000000 RSI: 00000000200006c0 RDI: 0000000000000005
[   39.708273] RBP: 00000000006dac30 R08: 0000000000000000 R09: 0000000000000000
[   39.715524] R10: 0000000000000000 R11: 0000000000000297 R12: 00000000006dac3c
[   39.722778] R13: 00007ffebcdf11ff R14: 00007f67725859c0 R15: 00000000006dad2c
[   39.732715] Kernel Offset: disabled
[   39.736461] Rebooting in 86400 seconds..