[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 71.915284][ T26] audit: type=1800 audit(1560617526.733:25): pid=8741 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 71.958023][ T26] audit: type=1800 audit(1560617526.743:26): pid=8741 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 71.997750][ T26] audit: type=1800 audit(1560617526.743:27): pid=8741 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.64' (ECDSA) to the list of known hosts. 2019/06/15 17:07:26 parsed 1 programs 2019/06/15 17:07:28 executed programs: 0 syzkaller login: [ 993.445563][ T8909] IPVS: ftp: loaded support on port[0] = 21 [ 993.529376][ T8909] chnl_net:caif_netlink_parms(): no params data found [ 993.566517][ T8909] bridge0: port 1(bridge_slave_0) entered blocking state [ 993.574702][ T8909] bridge0: port 1(bridge_slave_0) entered disabled state [ 993.583339][ T8909] device bridge_slave_0 entered promiscuous mode [ 993.592480][ T8909] bridge0: port 2(bridge_slave_1) entered blocking state [ 993.599817][ T8909] bridge0: port 2(bridge_slave_1) entered disabled state [ 993.607872][ T8909] device bridge_slave_1 entered promiscuous mode [ 993.628338][ T8909] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 993.639081][ T8909] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 993.660309][ T8909] team0: Port device team_slave_0 added [ 993.668172][ T8909] team0: Port device team_slave_1 added [ 993.730575][ T8909] device hsr_slave_0 entered promiscuous mode [ 993.800652][ T8909] device hsr_slave_1 entered promiscuous mode [ 993.898542][ T8909] bridge0: port 2(bridge_slave_1) entered blocking state [ 993.905690][ T8909] bridge0: port 2(bridge_slave_1) entered forwarding state [ 993.913520][ T8909] bridge0: port 1(bridge_slave_0) entered blocking state [ 993.920616][ T8909] bridge0: port 1(bridge_slave_0) entered forwarding state [ 993.962483][ T8909] 8021q: adding VLAN 0 to HW filter on device bond0 [ 993.978023][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 993.998710][ T22] bridge0: port 1(bridge_slave_0) entered disabled state [ 994.006977][ T22] bridge0: port 2(bridge_slave_1) entered disabled state [ 994.016462][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 994.029039][ T8909] 8021q: adding VLAN 0 to HW filter on device team0 [ 994.040049][ T8911] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 994.049573][ T8911] bridge0: port 1(bridge_slave_0) entered blocking state [ 994.056857][ T8911] bridge0: port 1(bridge_slave_0) entered forwarding state [ 994.080153][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 994.088976][ T22] bridge0: port 2(bridge_slave_1) entered blocking state [ 994.096007][ T22] bridge0: port 2(bridge_slave_1) entered forwarding state [ 994.104549][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 994.113263][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 994.121870][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 994.130748][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 994.141896][ T3130] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 994.153327][ T8909] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 994.174147][ T8909] 8021q: adding VLAN 0 to HW filter on device batadv0 2019/06/15 17:07:33 executed programs: 35 2019/06/15 17:07:38 executed programs: 78 2019/06/15 17:07:43 executed programs: 121 2019/06/15 17:07:48 executed programs: 163 2019/06/15 17:07:53 executed programs: 206 [ 1020.914109][ T9825] ================================================================== [ 1020.922607][ T9825] BUG: KASAN: use-after-free in pneigh_get_next.isra.0+0x24b/0x280 [ 1020.930536][ T9825] Read of size 8 at addr ffff888097f2a700 by task syz-executor.0/9825 [ 1020.938724][ T9825] [ 1020.941081][ T9825] CPU: 1 PID: 9825 Comm: syz-executor.0 Not tainted 5.2.0-rc4+ #32 [ 1020.948966][ T9825] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1020.959030][ T9825] Call Trace: [ 1020.962380][ T9825] dump_stack+0x172/0x1f0 [ 1020.966712][ T9825] ? pneigh_get_next.isra.0+0x24b/0x280 [ 1020.972283][ T9825] print_address_description.cold+0x7c/0x20d [ 1020.978258][ T9825] ? pneigh_get_next.isra.0+0x24b/0x280 [ 1020.983799][ T9825] ? pneigh_get_next.isra.0+0x24b/0x280 [ 1020.989336][ T9825] __kasan_report.cold+0x1b/0x40 [ 1020.994310][ T9825] ? pneigh_get_next.isra.0+0x24b/0x280 [ 1020.999948][ T9825] kasan_report+0x12/0x20 [ 1021.004278][ T9825] __asan_report_load8_noabort+0x14/0x20 [ 1021.010342][ T9825] pneigh_get_next.isra.0+0x24b/0x280 [ 1021.015725][ T9825] neigh_seq_next+0xdb/0x210 [ 1021.020335][ T9825] seq_read+0x9cf/0x1110 [ 1021.024660][ T9825] ? seq_dentry+0x2d0/0x2d0 [ 1021.029158][ T9825] proc_reg_read+0x1fc/0x2c0 [ 1021.033782][ T9825] ? proc_reg_compat_ioctl+0x2a0/0x2a0 [ 1021.039249][ T9825] ? rw_verify_area+0x126/0x360 [ 1021.044093][ T9825] do_iter_read+0x4a4/0x660 [ 1021.048608][ T9825] ? dup_iter+0x260/0x260 [ 1021.052930][ T9825] vfs_readv+0xf0/0x160 [ 1021.057077][ T9825] ? alloc_pages_current+0x10f/0x210 [ 1021.062355][ T9825] ? compat_rw_copy_check_uvector+0x3f0/0x3f0 [ 1021.068425][ T9825] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1021.074650][ T9825] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1021.080875][ T9825] ? iov_iter_get_pages_alloc+0x3ae/0x12f0 [ 1021.086665][ T9825] ? iov_iter_revert+0xaa0/0xaa0 [ 1021.091603][ T9825] ? lockdep_hardirqs_on+0x418/0x5d0 [ 1021.096874][ T9825] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 1021.102574][ T9825] ? iov_iter_pipe+0xba/0x2f0 [ 1021.107249][ T9825] default_file_splice_read+0x475/0x890 [ 1021.112804][ T9825] ? free_unref_page+0x474/0x600 [ 1021.117747][ T9825] ? __put_page+0x8d/0xd0 [ 1021.122070][ T9825] ? iter_file_splice_write+0xbd0/0xbd0 [ 1021.127628][ T9825] ? __put_page+0x92/0xd0 [ 1021.131961][ T9825] ? generic_pipe_buf_release+0x105/0x160 [ 1021.137717][ T9825] ? do_splice_direct+0x2a0/0x2a0 [ 1021.142736][ T9825] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1021.149196][ T9825] ? security_file_permission+0x8f/0x380 [ 1021.154826][ T9825] ? default_file_splice_write+0x72/0x90 [ 1021.160446][ T9825] ? iter_file_splice_write+0xbd0/0xbd0 [ 1021.165983][ T9825] do_splice_to+0x127/0x180 [ 1021.170639][ T9825] splice_direct_to_actor+0x2d2/0x970 [ 1021.176004][ T9825] ? generic_pipe_buf_nosteal+0x10/0x10 [ 1021.181546][ T9825] ? do_splice_to+0x180/0x180 [ 1021.186217][ T9825] ? rw_verify_area+0x126/0x360 [ 1021.191101][ T9825] do_splice_direct+0x1da/0x2a0 [ 1021.195944][ T9825] ? splice_direct_to_actor+0x970/0x970 [ 1021.201575][ T9825] ? rcu_read_lock_sched_held+0x110/0x130 [ 1021.207438][ T9825] ? rcu_sync_lockdep_assert+0x6d/0xb0 [ 1021.212945][ T9825] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1021.219180][ T9825] ? __sb_start_write+0x1ac/0x360 [ 1021.224188][ T9825] do_sendfile+0x597/0xd00 [ 1021.228660][ T9825] ? do_compat_pwritev64+0x1c0/0x1c0 [ 1021.233933][ T9825] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1021.240153][ T9825] ? put_timespec64+0xda/0x140 [ 1021.244916][ T9825] __x64_sys_sendfile64+0x1dd/0x220 [ 1021.250112][ T9825] ? __ia32_sys_sendfile+0x230/0x230 [ 1021.255403][ T9825] ? do_syscall_64+0x26/0x680 [ 1021.260068][ T9825] ? lockdep_hardirqs_on+0x418/0x5d0 [ 1021.265335][ T9825] ? trace_hardirqs_on+0x67/0x220 [ 1021.270348][ T9825] do_syscall_64+0xfd/0x680 [ 1021.274844][ T9825] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1021.280965][ T9825] RIP: 0033:0x4592c9 [ 1021.284853][ T9825] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1021.304442][ T9825] RSP: 002b:00007f4aab51dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 1021.312849][ T9825] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000004592c9 [ 1021.320805][ T9825] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000005 [ 1021.328763][ T9825] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 1021.336719][ T9825] R10: 0000000080000000 R11: 0000000000000246 R12: 00007f4aab51e6d4 [ 1021.344675][ T9825] R13: 00000000004c689d R14: 00000000004db828 R15: 00000000ffffffff [ 1021.352647][ T9825] [ 1021.354977][ T9825] Allocated by task 9827: [ 1021.359300][ T9825] save_stack+0x23/0x90 [ 1021.363440][ T9825] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 1021.369055][ T9825] kasan_kmalloc+0x9/0x10 [ 1021.373370][ T9825] __kmalloc+0x15c/0x740 [ 1021.377611][ T9825] pneigh_lookup+0x19c/0x4a0 [ 1021.382213][ T9825] arp_req_set+0x613/0x720 [ 1021.386610][ T9825] arp_ioctl+0x652/0x7f0 [ 1021.390839][ T9825] inet_ioctl+0x2a0/0x340 [ 1021.395162][ T9825] sock_do_ioctl+0xd8/0x2f0 [ 1021.399696][ T9825] sock_ioctl+0x3ed/0x780 [ 1021.404060][ T9825] do_vfs_ioctl+0xd5f/0x1380 [ 1021.408643][ T9825] ksys_ioctl+0xab/0xd0 [ 1021.412780][ T9825] __x64_sys_ioctl+0x73/0xb0 [ 1021.417531][ T9825] do_syscall_64+0xfd/0x680 [ 1021.422033][ T9825] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1021.427916][ T9825] [ 1021.430225][ T9825] Freed by task 9824: [ 1021.434186][ T9825] save_stack+0x23/0x90 [ 1021.438322][ T9825] __kasan_slab_free+0x102/0x150 [ 1021.443238][ T9825] kasan_slab_free+0xe/0x10 [ 1021.447718][ T9825] kfree+0xcf/0x220 [ 1021.451518][ T9825] __neigh_ifdown+0x236/0x2f0 [ 1021.456178][ T9825] neigh_ifdown+0x20/0x30 [ 1021.460491][ T9825] arp_ifdown+0x1d/0x21 [ 1021.464627][ T9825] inetdev_event+0xa14/0x11f0 [ 1021.469292][ T9825] notifier_call_chain+0xc2/0x230 [ 1021.474307][ T9825] raw_notifier_call_chain+0x2e/0x40 [ 1021.479586][ T9825] call_netdevice_notifiers_info+0x3f/0x90 [ 1021.485383][ T9825] rollback_registered_many+0x9b9/0xfc0 [ 1021.490913][ T9825] rollback_registered+0x109/0x1d0 [ 1021.496177][ T9825] unregister_netdevice_queue+0x1ee/0x2c0 [ 1021.501948][ T9825] __tun_detach+0xd8a/0x1040 [ 1021.506534][ T9825] tun_chr_close+0xe0/0x180 [ 1021.511026][ T9825] __fput+0x2ff/0x890 [ 1021.514985][ T9825] ____fput+0x16/0x20 [ 1021.518957][ T9825] task_work_run+0x145/0x1c0 [ 1021.523534][ T9825] exit_to_usermode_loop+0x273/0x2c0 [ 1021.528799][ T9825] do_syscall_64+0x58e/0x680 [ 1021.533370][ T9825] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1021.539235][ T9825] [ 1021.541547][ T9825] The buggy address belongs to the object at ffff888097f2a700 [ 1021.541547][ T9825] which belongs to the cache kmalloc-64 of size 64 [ 1021.555420][ T9825] The buggy address is located 0 bytes inside of [ 1021.555420][ T9825] 64-byte region [ffff888097f2a700, ffff888097f2a740) [ 1021.568425][ T9825] The buggy address belongs to the page: [ 1021.574105][ T9825] page:ffffea00025fca80 refcount:1 mapcount:0 mapping:ffff8880aa400340 index:0x0 [ 1021.583266][ T9825] flags: 0x1fffc0000000200(slab) [ 1021.588206][ T9825] raw: 01fffc0000000200 ffffea000250d548 ffffea00025726c8 ffff8880aa400340 [ 1021.596782][ T9825] raw: 0000000000000000 ffff888097f2a000 0000000100000020 0000000000000000 [ 1021.605359][ T9825] page dumped because: kasan: bad access detected [ 1021.611836][ T9825] [ 1021.614140][ T9825] Memory state around the buggy address: [ 1021.619749][ T9825] ffff888097f2a600: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 1021.627936][ T9825] ffff888097f2a680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 1021.635999][ T9825] >ffff888097f2a700: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 1021.644044][ T9825] ^ [ 1021.648107][ T9825] ffff888097f2a780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 1021.656155][ T9825] ffff888097f2a800: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 1021.664194][ T9825] ================================================================== [ 1021.672345][ T9825] Disabling lock debugging due to kernel taint [ 1021.678633][ T9825] Kernel panic - not syncing: panic_on_warn set ... [ 1021.685306][ T9825] CPU: 1 PID: 9825 Comm: syz-executor.0 Tainted: G B 5.2.0-rc4+ #32 [ 1021.694572][ T9825] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1021.704666][ T9825] Call Trace: [ 1021.707955][ T9825] dump_stack+0x172/0x1f0 [ 1021.712292][ T9825] panic+0x2cb/0x744 [ 1021.716176][ T9825] ? __warn_printk+0xf3/0xf3 [ 1021.720746][ T9825] ? retint_kernel+0x2b/0x2b [ 1021.725323][ T9825] ? trace_hardirqs_on+0x5e/0x220 [ 1021.730498][ T9825] ? pneigh_get_next.isra.0+0x24b/0x280 [ 1021.744530][ T9825] end_report+0x47/0x4f [ 1021.748782][ T9825] ? pneigh_get_next.isra.0+0x24b/0x280 [ 1021.754319][ T9825] __kasan_report.cold+0xe/0x40 [ 1021.759164][ T9825] ? pneigh_get_next.isra.0+0x24b/0x280 [ 1021.764708][ T9825] kasan_report+0x12/0x20 [ 1021.769126][ T9825] __asan_report_load8_noabort+0x14/0x20 [ 1021.774755][ T9825] pneigh_get_next.isra.0+0x24b/0x280 [ 1021.780116][ T9825] neigh_seq_next+0xdb/0x210 [ 1021.784700][ T9825] seq_read+0x9cf/0x1110 [ 1021.788955][ T9825] ? seq_dentry+0x2d0/0x2d0 [ 1021.793443][ T9825] proc_reg_read+0x1fc/0x2c0 [ 1021.798025][ T9825] ? proc_reg_compat_ioctl+0x2a0/0x2a0 [ 1021.803473][ T9825] ? rw_verify_area+0x126/0x360 [ 1021.808322][ T9825] do_iter_read+0x4a4/0x660 [ 1021.812817][ T9825] ? dup_iter+0x260/0x260 [ 1021.817134][ T9825] vfs_readv+0xf0/0x160 [ 1021.821277][ T9825] ? alloc_pages_current+0x10f/0x210 [ 1021.826550][ T9825] ? compat_rw_copy_check_uvector+0x3f0/0x3f0 [ 1021.832618][ T9825] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1021.838954][ T9825] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1021.845197][ T9825] ? iov_iter_get_pages_alloc+0x3ae/0x12f0 [ 1021.850993][ T9825] ? iov_iter_revert+0xaa0/0xaa0 [ 1021.856009][ T9825] ? lockdep_hardirqs_on+0x418/0x5d0 [ 1021.861300][ T9825] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 1021.867463][ T9825] ? iov_iter_pipe+0xba/0x2f0 [ 1021.872359][ T9825] default_file_splice_read+0x475/0x890 [ 1021.877901][ T9825] ? free_unref_page+0x474/0x600 [ 1021.882843][ T9825] ? __put_page+0x8d/0xd0 [ 1021.887166][ T9825] ? iter_file_splice_write+0xbd0/0xbd0 [ 1021.892704][ T9825] ? __put_page+0x92/0xd0 [ 1021.897027][ T9825] ? generic_pipe_buf_release+0x105/0x160 [ 1021.902741][ T9825] ? do_splice_direct+0x2a0/0x2a0 [ 1021.907754][ T9825] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1021.914007][ T9825] ? security_file_permission+0x8f/0x380 [ 1021.919628][ T9825] ? default_file_splice_write+0x72/0x90 [ 1021.925307][ T9825] ? iter_file_splice_write+0xbd0/0xbd0 [ 1021.930851][ T9825] do_splice_to+0x127/0x180 [ 1021.935344][ T9825] splice_direct_to_actor+0x2d2/0x970 [ 1021.940709][ T9825] ? generic_pipe_buf_nosteal+0x10/0x10 [ 1021.946251][ T9825] ? do_splice_to+0x180/0x180 [ 1021.951019][ T9825] ? rw_verify_area+0x126/0x360 [ 1021.955859][ T9825] do_splice_direct+0x1da/0x2a0 [ 1021.960693][ T9825] ? splice_direct_to_actor+0x970/0x970 [ 1021.966224][ T9825] ? rcu_read_lock_sched_held+0x110/0x130 [ 1021.971990][ T9825] ? rcu_sync_lockdep_assert+0x6d/0xb0 [ 1021.977457][ T9825] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1021.983794][ T9825] ? __sb_start_write+0x1ac/0x360 [ 1021.988930][ T9825] do_sendfile+0x597/0xd00 [ 1021.993360][ T9825] ? do_compat_pwritev64+0x1c0/0x1c0 [ 1021.998635][ T9825] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1022.004867][ T9825] ? put_timespec64+0xda/0x140 [ 1022.009623][ T9825] __x64_sys_sendfile64+0x1dd/0x220 [ 1022.014812][ T9825] ? __ia32_sys_sendfile+0x230/0x230 [ 1022.020080][ T9825] ? do_syscall_64+0x26/0x680 [ 1022.024798][ T9825] ? lockdep_hardirqs_on+0x418/0x5d0 [ 1022.030536][ T9825] ? trace_hardirqs_on+0x67/0x220 [ 1022.035550][ T9825] do_syscall_64+0xfd/0x680 [ 1022.040236][ T9825] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1022.046122][ T9825] RIP: 0033:0x4592c9 [ 1022.050018][ T9825] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1022.069664][ T9825] RSP: 002b:00007f4aab51dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 1022.078069][ T9825] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000004592c9 [ 1022.086079][ T9825] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000005 [ 1022.094133][ T9825] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 1022.102187][ T9825] R10: 0000000080000000 R11: 0000000000000246 R12: 00007f4aab51e6d4 [ 1022.110328][ T9825] R13: 00000000004c689d R14: 00000000004db828 R15: 00000000ffffffff [ 1022.119623][ T9825] Kernel Offset: disabled [ 1022.124043][ T9825] Rebooting in 86400 seconds..