[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 70.529682][ T27] audit: type=1800 audit(1578571219.412:25): pid=9409 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 70.550585][ T27] audit: type=1800 audit(1578571219.432:26): pid=9409 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 70.596667][ T27] audit: type=1800 audit(1578571219.432:27): pid=9409 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.34' (ECDSA) to the list of known hosts. executing program executing program syzkaller login: [ 80.925566][ T9563] ================================================================== [ 80.933767][ T9563] BUG: KASAN: use-after-free in bitmap_port_ext_cleanup+0xe6/0x2a0 [ 80.941640][ T9563] Read of size 8 at addr ffff8880a87a47c0 by task syz-executor559/9563 [ 80.949851][ T9563] [ 80.952167][ T9563] CPU: 0 PID: 9563 Comm: syz-executor559 Not tainted 5.5.0-rc5-syzkaller #0 [ 80.960933][ T9563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 80.971064][ T9563] Call Trace: [ 80.974356][ T9563] dump_stack+0x197/0x210 [ 80.978687][ T9563] ? bitmap_port_ext_cleanup+0xe6/0x2a0 [ 80.984227][ T9563] print_address_description.constprop.0.cold+0xd4/0x30b [ 80.991285][ T9563] ? bitmap_port_ext_cleanup+0xe6/0x2a0 [ 80.996832][ T9563] ? bitmap_port_ext_cleanup+0xe6/0x2a0 [ 81.002382][ T9563] __kasan_report.cold+0x1b/0x41 [ 81.007307][ T9563] ? kfree+0x150/0x2c0 [ 81.011361][ T9563] ? bitmap_port_ext_cleanup+0xe6/0x2a0 [ 81.016902][ T9563] kasan_report+0x12/0x20 [ 81.021226][ T9563] check_memory_region+0x134/0x1a0 [ 81.026338][ T9563] __kasan_check_read+0x11/0x20 [ 81.031179][ T9563] bitmap_port_ext_cleanup+0xe6/0x2a0 [ 81.036553][ T9563] bitmap_port_destroy+0x17c/0x1d0 [ 81.041650][ T9563] ip_set_create+0xe47/0x1500 [ 81.046311][ T9563] ? ip_set_destroy+0xb70/0xb70 [ 81.051171][ T9563] ? ip_set_destroy+0xb70/0xb70 [ 81.056059][ T9563] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 81.060995][ T9563] ? nfnetlink_bind+0x2c0/0x2c0 [ 81.065838][ T9563] ? __kasan_check_read+0x11/0x20 [ 81.070846][ T9563] ? __lock_acquire+0x8a0/0x4a00 [ 81.075805][ T9563] ? save_stack+0x5c/0x90 [ 81.080125][ T9563] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 81.086346][ T9563] ? apparmor_capable+0x497/0x900 [ 81.091358][ T9563] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 81.097693][ T9563] ? __kasan_check_read+0x11/0x20 [ 81.102699][ T9563] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 81.108148][ T9563] netlink_rcv_skb+0x177/0x450 [ 81.112942][ T9563] ? nfnetlink_bind+0x2c0/0x2c0 [ 81.117796][ T9563] ? netlink_ack+0xb50/0xb50 [ 81.122380][ T9563] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 81.128611][ T9563] ? ns_capable_common+0x93/0x100 [ 81.133697][ T9563] ? ns_capable+0x20/0x30 [ 81.138189][ T9563] ? __netlink_ns_capable+0x104/0x140 [ 81.143694][ T9563] nfnetlink_rcv+0x1ba/0x460 [ 81.148281][ T9563] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 81.153722][ T9563] ? netlink_deliver_tap+0x24a/0xbe0 [ 81.159002][ T9563] ? __kasan_check_write+0x14/0x20 [ 81.164125][ T9563] netlink_unicast+0x58c/0x7d0 [ 81.168886][ T9563] ? netlink_attachskb+0x870/0x870 [ 81.173990][ T9563] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 81.179733][ T9563] ? __check_object_size+0x3d/0x437 [ 81.184936][ T9563] netlink_sendmsg+0x91c/0xea0 [ 81.189687][ T9563] ? netlink_unicast+0x7d0/0x7d0 [ 81.194606][ T9563] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 81.200133][ T9563] ? apparmor_socket_sendmsg+0x2a/0x30 [ 81.205576][ T9563] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 81.211812][ T9563] ? security_socket_sendmsg+0x8d/0xc0 [ 81.217254][ T9563] ? netlink_unicast+0x7d0/0x7d0 [ 81.222179][ T9563] sock_sendmsg+0xd7/0x130 [ 81.226584][ T9563] ____sys_sendmsg+0x753/0x880 [ 81.231353][ T9563] ? kernel_sendmsg+0x50/0x50 [ 81.236016][ T9563] ? mark_held_locks+0xa4/0xf0 [ 81.240765][ T9563] ? do_huge_pmd_anonymous_page+0x1463/0x1a50 [ 81.246821][ T9563] ___sys_sendmsg+0x100/0x170 [ 81.251486][ T9563] ? sendmsg_copy_msghdr+0x70/0x70 [ 81.256580][ T9563] ? prep_transhuge_page+0xa0/0xa0 [ 81.261675][ T9563] ? __do_page_fault+0x56a/0xd80 [ 81.266597][ T9563] ? find_held_lock+0x35/0x130 [ 81.271346][ T9563] ? __do_page_fault+0x56a/0xd80 [ 81.276282][ T9563] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 81.282530][ T9563] ? __fget_light+0x1a9/0x230 [ 81.287247][ T9563] ? __fdget+0x1b/0x20 [ 81.291303][ T9563] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 81.297635][ T9563] __sys_sendmsg+0x105/0x1d0 [ 81.302211][ T9563] ? __sys_sendmsg_sock+0xc0/0xc0 [ 81.307237][ T9563] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 81.312693][ T9563] ? do_fast_syscall_32+0xd1/0xe16 [ 81.317798][ T9563] ? entry_SYSENTER_compat+0x70/0x7f [ 81.323067][ T9563] ? do_fast_syscall_32+0xd1/0xe16 [ 81.328163][ T9563] __ia32_compat_sys_sendmsg+0x7a/0xb0 [ 81.333623][ T9563] do_fast_syscall_32+0x27b/0xe16 [ 81.338641][ T9563] entry_SYSENTER_compat+0x70/0x7f [ 81.343752][ T9563] RIP: 0023:0xf7f8ea39 [ 81.347809][ T9563] Code: 00 00 00 89 d3 5b 5e 5f 5d c3 b8 80 96 98 00 eb c4 8b 04 24 c3 8b 1c 24 c3 8b 34 24 c3 8b 3c 24 c3 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 81.367410][ T9563] RSP: 002b:00000000ffc15a2c EFLAGS: 00000202 ORIG_RAX: 0000000000000172 [ 81.375824][ T9563] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020001080 [ 81.383799][ T9563] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00000000ffc15b44 [ 81.391811][ T9563] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 81.399767][ T9563] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 81.407737][ T9563] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 81.415791][ T9563] [ 81.418106][ T9563] Allocated by task 9563: [ 81.422504][ T9563] save_stack+0x23/0x90 [ 81.426763][ T9563] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 81.432379][ T9563] kasan_kmalloc+0x9/0x10 [ 81.436720][ T9563] __kmalloc+0x163/0x770 [ 81.440955][ T9563] ip_set_alloc+0x38/0x5e [ 81.445272][ T9563] bitmap_port_create+0x3dc/0x7c0 [ 81.450283][ T9563] ip_set_create+0x6f1/0x1500 [ 81.454940][ T9563] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 81.460005][ T9563] netlink_rcv_skb+0x177/0x450 [ 81.464805][ T9563] nfnetlink_rcv+0x1ba/0x460 [ 81.470424][ T9563] netlink_unicast+0x58c/0x7d0 [ 81.475184][ T9563] netlink_sendmsg+0x91c/0xea0 [ 81.479930][ T9563] sock_sendmsg+0xd7/0x130 [ 81.484326][ T9563] ____sys_sendmsg+0x753/0x880 [ 81.489072][ T9563] ___sys_sendmsg+0x100/0x170 [ 81.493743][ T9563] __sys_sendmsg+0x105/0x1d0 [ 81.498323][ T9563] __ia32_compat_sys_sendmsg+0x7a/0xb0 [ 81.503765][ T9563] do_fast_syscall_32+0x27b/0xe16 [ 81.508773][ T9563] entry_SYSENTER_compat+0x70/0x7f [ 81.513858][ T9563] [ 81.516170][ T9563] Freed by task 9563: [ 81.520143][ T9563] save_stack+0x23/0x90 [ 81.524302][ T9563] __kasan_slab_free+0x102/0x150 [ 81.529238][ T9563] kasan_slab_free+0xe/0x10 [ 81.533727][ T9563] kfree+0x10a/0x2c0 [ 81.537627][ T9563] kvfree+0x61/0x70 [ 81.541426][ T9563] ip_set_free+0x16/0x20 [ 81.545654][ T9563] bitmap_port_destroy+0xae/0x1d0 [ 81.550716][ T9563] ip_set_create+0xe47/0x1500 [ 81.555426][ T9563] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 81.560347][ T9563] netlink_rcv_skb+0x177/0x450 [ 81.565093][ T9563] nfnetlink_rcv+0x1ba/0x460 [ 81.569709][ T9563] netlink_unicast+0x58c/0x7d0 [ 81.574497][ T9563] netlink_sendmsg+0x91c/0xea0 [ 81.579290][ T9563] sock_sendmsg+0xd7/0x130 [ 81.583689][ T9563] ____sys_sendmsg+0x753/0x880 [ 81.588439][ T9563] ___sys_sendmsg+0x100/0x170 [ 81.593187][ T9563] __sys_sendmsg+0x105/0x1d0 [ 81.597757][ T9563] __ia32_compat_sys_sendmsg+0x7a/0xb0 [ 81.603199][ T9563] do_fast_syscall_32+0x27b/0xe16 [ 81.608205][ T9563] entry_SYSENTER_compat+0x70/0x7f [ 81.613354][ T9563] [ 81.615666][ T9563] The buggy address belongs to the object at ffff8880a87a47c0 [ 81.615666][ T9563] which belongs to the cache kmalloc-32 of size 32 [ 81.629544][ T9563] The buggy address is located 0 bytes inside of [ 81.629544][ T9563] 32-byte region [ffff8880a87a47c0, ffff8880a87a47e0) [ 81.642532][ T9563] The buggy address belongs to the page: [ 81.648160][ T9563] page:ffffea0002a1e900 refcount:1 mapcount:0 mapping:ffff8880aa4001c0 index:0xffff8880a87a4fc1 [ 81.658559][ T9563] raw: 00fffe0000000200 ffffea0002a25108 ffffea00027a3188 ffff8880aa4001c0 [ 81.667125][ T9563] raw: ffff8880a87a4fc1 ffff8880a87a4000 000000010000002e 0000000000000000 [ 81.675710][ T9563] page dumped because: kasan: bad access detected [ 81.682099][ T9563] [ 81.684413][ T9563] Memory state around the buggy address: [ 81.690047][ T9563] ffff8880a87a4680: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 81.698088][ T9563] ffff8880a87a4700: fb fb fb fb fc fc fc fc 00 05 fc fc fc fc fc fc [ 81.706129][ T9563] >ffff8880a87a4780: 00 05 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 81.714168][ T9563] ^ [ 81.720307][ T9563] ffff8880a87a4800: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 81.728355][ T9563] ffff8880a87a4880: 06 fc fc fc fc fc fc fc 00 00 fc fc fc fc fc fc [ 81.736413][ T9563] ================================================================== [ 81.744453][ T9563] Disabling lock debugging due to kernel taint [ 81.752782][ T9563] Kernel panic - not syncing: panic_on_warn set ... [ 81.759385][ T9563] CPU: 0 PID: 9563 Comm: syz-executor559 Tainted: G B 5.5.0-rc5-syzkaller #0 [ 81.769435][ T9563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 81.779492][ T9563] Call Trace: [ 81.782766][ T9563] dump_stack+0x197/0x210 [ 81.787077][ T9563] panic+0x2e3/0x75c [ 81.790953][ T9563] ? add_taint.cold+0x16/0x16 [ 81.795629][ T9563] ? bitmap_port_ext_cleanup+0xe6/0x2a0 [ 81.801163][ T9563] ? preempt_schedule+0x4b/0x60 [ 81.806010][ T9563] ? ___preempt_schedule+0x16/0x18 [ 81.811111][ T9563] ? trace_hardirqs_on+0x5e/0x240 [ 81.816117][ T9563] ? bitmap_port_ext_cleanup+0xe6/0x2a0 [ 81.821644][ T9563] end_report+0x47/0x4f [ 81.825781][ T9563] ? bitmap_port_ext_cleanup+0xe6/0x2a0 [ 81.831307][ T9563] __kasan_report.cold+0xe/0x41 [ 81.836136][ T9563] ? kfree+0x150/0x2c0 [ 81.840188][ T9563] ? bitmap_port_ext_cleanup+0xe6/0x2a0 [ 81.845713][ T9563] kasan_report+0x12/0x20 [ 81.850026][ T9563] check_memory_region+0x134/0x1a0 [ 81.855114][ T9563] __kasan_check_read+0x11/0x20 [ 81.859943][ T9563] bitmap_port_ext_cleanup+0xe6/0x2a0 [ 81.865297][ T9563] bitmap_port_destroy+0x17c/0x1d0 [ 81.870386][ T9563] ip_set_create+0xe47/0x1500 [ 81.875043][ T9563] ? ip_set_destroy+0xb70/0xb70 [ 81.879893][ T9563] ? ip_set_destroy+0xb70/0xb70 [ 81.884723][ T9563] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 81.889656][ T9563] ? nfnetlink_bind+0x2c0/0x2c0 [ 81.894496][ T9563] ? __kasan_check_read+0x11/0x20 [ 81.899502][ T9563] ? __lock_acquire+0x8a0/0x4a00 [ 81.904416][ T9563] ? save_stack+0x5c/0x90 [ 81.908740][ T9563] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 81.915177][ T9563] ? apparmor_capable+0x497/0x900 [ 81.920193][ T9563] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 81.926477][ T9563] ? __kasan_check_read+0x11/0x20 [ 81.931489][ T9563] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 81.936940][ T9563] netlink_rcv_skb+0x177/0x450 [ 81.941738][ T9563] ? nfnetlink_bind+0x2c0/0x2c0 [ 81.946586][ T9563] ? netlink_ack+0xb50/0xb50 [ 81.951162][ T9563] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 81.957386][ T9563] ? ns_capable_common+0x93/0x100 [ 81.962390][ T9563] ? ns_capable+0x20/0x30 [ 81.966702][ T9563] ? __netlink_ns_capable+0x104/0x140 [ 81.972067][ T9563] nfnetlink_rcv+0x1ba/0x460 [ 81.976652][ T9563] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 81.982139][ T9563] ? netlink_deliver_tap+0x24a/0xbe0 [ 81.987408][ T9563] ? __kasan_check_write+0x14/0x20 [ 81.992512][ T9563] netlink_unicast+0x58c/0x7d0 [ 81.998304][ T9563] ? netlink_attachskb+0x870/0x870 [ 82.003418][ T9563] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 82.009131][ T9563] ? __check_object_size+0x3d/0x437 [ 82.014318][ T9563] netlink_sendmsg+0x91c/0xea0 [ 82.019080][ T9563] ? netlink_unicast+0x7d0/0x7d0 [ 82.024066][ T9563] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 82.029595][ T9563] ? apparmor_socket_sendmsg+0x2a/0x30 [ 82.035055][ T9563] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 82.041288][ T9563] ? security_socket_sendmsg+0x8d/0xc0 [ 82.046733][ T9563] ? netlink_unicast+0x7d0/0x7d0 [ 82.051659][ T9563] sock_sendmsg+0xd7/0x130 [ 82.056059][ T9563] ____sys_sendmsg+0x753/0x880 [ 82.060802][ T9563] ? kernel_sendmsg+0x50/0x50 [ 82.065459][ T9563] ? mark_held_locks+0xa4/0xf0 [ 82.070208][ T9563] ? do_huge_pmd_anonymous_page+0x1463/0x1a50 [ 82.076296][ T9563] ___sys_sendmsg+0x100/0x170 [ 82.080964][ T9563] ? sendmsg_copy_msghdr+0x70/0x70 [ 82.086065][ T9563] ? prep_transhuge_page+0xa0/0xa0 [ 82.091159][ T9563] ? __do_page_fault+0x56a/0xd80 [ 82.096118][ T9563] ? find_held_lock+0x35/0x130 [ 82.100863][ T9563] ? __do_page_fault+0x56a/0xd80 [ 82.105798][ T9563] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 82.112018][ T9563] ? __fget_light+0x1a9/0x230 [ 82.116685][ T9563] ? __fdget+0x1b/0x20 [ 82.120735][ T9563] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 82.126973][ T9563] __sys_sendmsg+0x105/0x1d0 [ 82.131559][ T9563] ? __sys_sendmsg_sock+0xc0/0xc0 [ 82.136611][ T9563] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 82.142144][ T9563] ? do_fast_syscall_32+0xd1/0xe16 [ 82.147361][ T9563] ? entry_SYSENTER_compat+0x70/0x7f [ 82.152637][ T9563] ? do_fast_syscall_32+0xd1/0xe16 [ 82.157740][ T9563] __ia32_compat_sys_sendmsg+0x7a/0xb0 [ 82.163222][ T9563] do_fast_syscall_32+0x27b/0xe16 [ 82.168232][ T9563] entry_SYSENTER_compat+0x70/0x7f [ 82.173343][ T9563] RIP: 0023:0xf7f8ea39 [ 82.177393][ T9563] Code: 00 00 00 89 d3 5b 5e 5f 5d c3 b8 80 96 98 00 eb c4 8b 04 24 c3 8b 1c 24 c3 8b 34 24 c3 8b 3c 24 c3 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 82.196983][ T9563] RSP: 002b:00000000ffc15a2c EFLAGS: 00000202 ORIG_RAX: 0000000000000172 [ 82.205379][ T9563] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020001080 [ 82.213331][ T9563] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00000000ffc15b44 [ 82.221286][ T9563] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 82.230322][ T9563] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 82.238288][ T9563] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 82.247537][ T9563] Kernel Offset: disabled [ 82.251862][ T9563] Rebooting in 86400 seconds..