INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added 'ci-upstream-kasan-gce-386-0,10.128.0.7' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 38.095182] ================================================================== [ 38.102577] BUG: KASAN: slab-out-of-bounds in tipc_nametbl_lookup_dst_nodes+0x4a3/0x4b0 [ 38.110689] Read of size 4 at addr ffff8801d2898690 by task syzkaller258649/2988 [ 38.118188] [ 38.119791] CPU: 1 PID: 2988 Comm: syzkaller258649 Not tainted 4.14.0-rc2+ #13 [ 38.127118] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 38.136441] Call Trace: [ 38.139001] dump_stack+0x194/0x257 [ 38.142600] ? arch_local_irq_restore+0x53/0x53 [ 38.147240] ? show_regs_print_info+0x65/0x65 [ 38.151712] ? lock_release+0xd70/0xd70 [ 38.155661] ? tipc_nametbl_lookup_dst_nodes+0x4a3/0x4b0 [ 38.161085] print_address_description+0x73/0x250 [ 38.165898] ? tipc_nametbl_lookup_dst_nodes+0x4a3/0x4b0 [ 38.171318] kasan_report+0x25b/0x340 [ 38.175091] __asan_report_load4_noabort+0x14/0x20 [ 38.179989] tipc_nametbl_lookup_dst_nodes+0x4a3/0x4b0 [ 38.185245] tipc_sendmcast+0x70b/0xe20 [ 38.189201] ? tipc_release+0xfd0/0xfd0 [ 38.193145] ? __kernel_text_address+0xd/0x40 [ 38.197609] ? __is_insn_slot_addr+0x1fc/0x330 [ 38.202164] ? lock_downgrade+0x990/0x990 [ 38.206288] ? __save_stack_trace+0x61/0xd0 [ 38.210587] ? compat_SyS_sendmsg+0x2a/0x40 [ 38.214884] ? lock_release+0xd70/0xd70 [ 38.218829] ? is_bpf_text_address+0x7b/0x120 [ 38.223294] ? lock_downgrade+0x990/0x990 [ 38.227413] ? show_initstate+0xb0/0xb0 [ 38.231359] ? bpf_prog_alloc+0x310/0x310 [ 38.235478] ? __bfs+0xaa/0x750 [ 38.238734] ? noop_count+0x40/0x40 [ 38.242336] __tipc_sendmsg+0xf49/0x1590 [ 38.246367] ? __tipc_sendmsg+0xf49/0x1590 [ 38.250574] ? rcutorture_record_progress+0x10/0x10 [ 38.255573] ? tipc_sendmcast+0xe20/0xe20 [ 38.259694] ? check_usage_backwards+0x20a/0x420 [ 38.264425] ? print_shortest_lock_dependencies+0x350/0x350 [ 38.270116] ? save_stack_trace+0x16/0x20 [ 38.274233] ? save_trace+0x11f/0x350 [ 38.278008] ? mark_held_locks+0xb2/0x100 [ 38.282129] ? __raw_spin_lock_init+0x1c/0x100 [ 38.286690] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 38.291674] ? __lockdep_init_map+0xe4/0x650 [ 38.296057] ? lockdep_init_map+0x3d/0x70 [ 38.300181] __tipc_sendstream+0x8eb/0xc00 [ 38.304389] ? find_held_lock+0x39/0x1d0 [ 38.308426] ? tipc_connect+0x6d0/0x6d0 [ 38.312369] ? lock_downgrade+0x990/0x990 [ 38.316486] ? __check_object_size+0x25d/0x4f0 [ 38.321046] ? lock_acquire+0x1d5/0x580 [ 38.324989] ? tipc_sendstream+0x42/0x70 [ 38.329034] ? mark_held_locks+0xb2/0x100 [ 38.333164] ? __local_bh_enable_ip+0x9d/0x160 [ 38.337725] tipc_sendstream+0x50/0x70 [ 38.341580] ? __tipc_sendstream+0xc00/0xc00 [ 38.345959] sock_sendmsg+0xca/0x110 [ 38.349644] ___sys_sendmsg+0x75b/0x8a0 [ 38.353596] ? copy_msghdr_from_user+0x590/0x590 [ 38.358324] ? get_unused_fd_flags+0x190/0x190 [ 38.362881] ? check_noncircular+0x20/0x20 [ 38.367090] ? __handle_mm_fault+0x587/0x39c0 [ 38.371558] ? __fget_light+0x29d/0x390 [ 38.375504] ? fget_raw+0x20/0x20 [ 38.378952] ? __fdget+0x18/0x20 [ 38.382291] __sys_sendmsg+0xe5/0x210 [ 38.386062] ? __sys_sendmsg+0xe5/0x210 [ 38.390007] ? SyS_shutdown+0x290/0x290 [ 38.393974] ? handle_mm_fault+0x410/0x8d0 [ 38.398177] ? down_read_trylock+0xdb/0x170 [ 38.402475] ? __do_page_fault+0x2b8/0xb60 [ 38.406699] compat_SyS_sendmsg+0x2a/0x40 [ 38.410818] ? compat_SyS_getsockopt+0x420/0x420 [ 38.415543] do_fast_syscall_32+0x3f2/0xf05 [ 38.419853] ? do_int80_syscall_32+0x940/0x940 [ 38.424406] ? kasan_check_read+0x11/0x20 [ 38.428525] ? syscall_return_slowpath+0x510/0x510 [ 38.433424] ? SyS_rt_sigaction+0x94/0x1b0 [ 38.437631] ? lockdep_sys_exit+0x47/0xf0 [ 38.441753] ? retint_user+0x18/0x20 [ 38.445440] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 38.450260] entry_SYSENTER_compat+0x51/0x60 [ 38.454635] RIP: 0023:0xf7facc79 [ 38.457973] RSP: 002b:00000000ffbdd6ac EFLAGS: 00000203 ORIG_RAX: 0000000000000172 [ 38.465656] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000201ff000 [ 38.472895] RDX: 0000000000004000 RSI: 0000000000000167 RDI: 000000000000001e [ 38.480135] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 38.487375] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 38.494615] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 38.501870] [ 38.503470] Allocated by task 1: [ 38.506808] save_stack_trace+0x16/0x20 [ 38.510754] save_stack+0x43/0xd0 [ 38.514178] kasan_kmalloc+0xad/0xe0 [ 38.517863] kmem_cache_alloc_trace+0x136/0x750 [ 38.522502] tipc_nameseq_create+0xe8/0x540 [ 38.526794] tipc_nametbl_insert_publ+0xf77/0x17c0 [ 38.531692] tipc_nametbl_publish+0x2aa/0x4f0 [ 38.536155] tipc_bind+0x33a/0x700 [ 38.539666] kernel_bind+0x62/0x80 [ 38.543172] tipc_server_start+0x3a1/0xb60 [ 38.547376] tipc_topsrv_start+0x64f/0x890 [ 38.551578] tipc_init_net+0x3cc/0x570 [ 38.555433] ops_init+0x10a/0x570 [ 38.558852] register_pernet_operations+0x45e/0x980 [ 38.563839] register_pernet_subsys+0x2a/0x40 [ 38.568302] tipc_init+0x83/0x104 [ 38.571725] do_one_initcall+0x9e/0x330 [ 38.575667] kernel_init_freeable+0x469/0x521 [ 38.580129] kernel_init+0x13/0x172 [ 38.583726] ret_from_fork+0x2a/0x40 [ 38.587402] [ 38.589005] Freed by task 0: [ 38.591991] (stack is not available) [ 38.595671] [ 38.597267] The buggy address belongs to the object at ffff8801d2898680 [ 38.597267] which belongs to the cache kmalloc-32 of size 32 [ 38.609717] The buggy address is located 16 bytes inside of [ 38.609717] 32-byte region [ffff8801d2898680, ffff8801d28986a0) [ 38.621391] The buggy address belongs to the page: [ 38.626292] page:ffffea00074a2600 count:1 mapcount:0 mapping:ffff8801d2898000 index:0xffff8801d2898fc1 [ 38.635707] flags: 0x200000000000100(slab) [ 38.639911] raw: 0200000000000100 ffff8801d2898000 ffff8801d2898fc1 000000010000003c [ 38.647761] raw: ffffea00074b6b60 ffffea00074b8020 ffff8801dac001c0 0000000000000000 [ 38.655608] page dumped because: kasan: bad access detected [ 38.661285] [ 38.662880] Memory state around the buggy address: [ 38.667777] ffff8801d2898580: 04 fc fc fc fc fc fc fc 00 06 fc fc fc fc fc fc [ 38.675105] ffff8801d2898600: 00 00 00 fc fc fc fc fc fb fb fb fb fc fc fc fc [ 38.682431] >ffff8801d2898680: 00 00 fc fc fc fc fc fc 00 00 00 00 fc fc fc fc [ 38.689764] ^ [ 38.693617] ffff8801d2898700: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 38.700948] ffff8801d2898780: 00 00 00 fc fc fc fc fc fb fb fb fb fc fc fc fc [ 38.708270] ================================================================== [ 38.715595] Disabling lock debugging due to kernel taint [ 38.721040] Kernel panic - not syncing: panic_on_warn set ... [ 38.721040] [ 38.728366] CPU: 1 PID: 2988 Comm: syzkaller258649 Tainted: G B 4.14.0-rc2+ #13 [ 38.736901] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 38.746219] Call Trace: [ 38.748774] dump_stack+0x194/0x257 [ 38.752376] ? arch_local_irq_restore+0x53/0x53 [ 38.757011] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 38.761733] ? tipc_nametbl_lookup_dst_nodes+0x3f0/0x4b0 [ 38.767148] panic+0x1e4/0x417 [ 38.770306] ? __warn+0x1d9/0x1d9 [ 38.773734] ? tipc_nametbl_lookup_dst_nodes+0x4a3/0x4b0 [ 38.779149] kasan_end_report+0x50/0x50 [ 38.783093] kasan_report+0x144/0x340 [ 38.786860] __asan_report_load4_noabort+0x14/0x20 [ 38.791753] tipc_nametbl_lookup_dst_nodes+0x4a3/0x4b0 [ 38.796996] tipc_sendmcast+0x70b/0xe20 [ 38.800941] ? tipc_release+0xfd0/0xfd0 [ 38.804880] ? __kernel_text_address+0xd/0x40 [ 38.809339] ? __is_insn_slot_addr+0x1fc/0x330 [ 38.813886] ? lock_downgrade+0x990/0x990 [ 38.817996] ? __save_stack_trace+0x61/0xd0 [ 38.822286] ? compat_SyS_sendmsg+0x2a/0x40 [ 38.826573] ? lock_release+0xd70/0xd70 [ 38.830511] ? is_bpf_text_address+0x7b/0x120 [ 38.834969] ? lock_downgrade+0x990/0x990 [ 38.839088] ? show_initstate+0xb0/0xb0 [ 38.843025] ? bpf_prog_alloc+0x310/0x310 [ 38.847149] ? __bfs+0xaa/0x750 [ 38.850394] ? noop_count+0x40/0x40 [ 38.853988] __tipc_sendmsg+0xf49/0x1590 [ 38.858013] ? __tipc_sendmsg+0xf49/0x1590 [ 38.862212] ? rcutorture_record_progress+0x10/0x10 [ 38.867196] ? tipc_sendmcast+0xe20/0xe20 [ 38.871308] ? check_usage_backwards+0x20a/0x420 [ 38.876029] ? print_shortest_lock_dependencies+0x350/0x350 [ 38.881710] ? save_stack_trace+0x16/0x20 [ 38.885819] ? save_trace+0x11f/0x350 [ 38.889592] ? mark_held_locks+0xb2/0x100 [ 38.893708] ? __raw_spin_lock_init+0x1c/0x100 [ 38.898253] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 38.903230] ? __lockdep_init_map+0xe4/0x650 [ 38.907602] ? lockdep_init_map+0x3d/0x70 [ 38.911721] __tipc_sendstream+0x8eb/0xc00 [ 38.915920] ? find_held_lock+0x39/0x1d0 [ 38.919947] ? tipc_connect+0x6d0/0x6d0 [ 38.923884] ? lock_downgrade+0x990/0x990 [ 38.927996] ? __check_object_size+0x25d/0x4f0 [ 38.932546] ? lock_acquire+0x1d5/0x580 [ 38.936483] ? tipc_sendstream+0x42/0x70 [ 38.940513] ? mark_held_locks+0xb2/0x100 [ 38.944632] ? __local_bh_enable_ip+0x9d/0x160 [ 38.949198] tipc_sendstream+0x50/0x70 [ 38.953052] ? __tipc_sendstream+0xc00/0xc00 [ 38.957424] sock_sendmsg+0xca/0x110 [ 38.961103] ___sys_sendmsg+0x75b/0x8a0 [ 38.965042] ? copy_msghdr_from_user+0x590/0x590 [ 38.969762] ? get_unused_fd_flags+0x190/0x190 [ 38.974311] ? check_noncircular+0x20/0x20 [ 38.978512] ? __handle_mm_fault+0x587/0x39c0 [ 38.982970] ? __fget_light+0x29d/0x390 [ 38.986910] ? fget_raw+0x20/0x20 [ 38.990339] ? __fdget+0x18/0x20 [ 38.993672] __sys_sendmsg+0xe5/0x210 [ 38.997434] ? __sys_sendmsg+0xe5/0x210 [ 39.001375] ? SyS_shutdown+0x290/0x290 [ 39.005318] ? handle_mm_fault+0x410/0x8d0 [ 39.009514] ? down_read_trylock+0xdb/0x170 [ 39.013797] ? __do_page_fault+0x2b8/0xb60 [ 39.018006] compat_SyS_sendmsg+0x2a/0x40 [ 39.022117] ? compat_SyS_getsockopt+0x420/0x420 [ 39.026845] do_fast_syscall_32+0x3f2/0xf05 [ 39.031135] ? do_int80_syscall_32+0x940/0x940 [ 39.035684] ? kasan_check_read+0x11/0x20 [ 39.039798] ? syscall_return_slowpath+0x510/0x510 [ 39.044692] ? SyS_rt_sigaction+0x94/0x1b0 [ 39.048891] ? lockdep_sys_exit+0x47/0xf0 [ 39.053003] ? retint_user+0x18/0x20 [ 39.056684] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 39.061495] entry_SYSENTER_compat+0x51/0x60 [ 39.066128] RIP: 0023:0xf7facc79 [ 39.069462] RSP: 002b:00000000ffbdd6ac EFLAGS: 00000203 ORIG_RAX: 0000000000000172 [ 39.077133] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000201ff000 [ 39.084367] RDX: 0000000000004000 RSI: 0000000000000167 RDI: 000000000000001e [ 39.091599] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000