[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 77.018827][ T27] kauditd_printk_skb: 4 callbacks suppressed [ 77.018840][ T27] audit: type=1800 audit(1579871033.900:29): pid=10142 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 77.047841][ T27] audit: type=1800 audit(1579871033.900:30): pid=10142 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.63' (ECDSA) to the list of known hosts. executing program executing program syzkaller login: [ 87.782330][T10297] ================================================================== [ 87.790702][T10297] BUG: KASAN: slab-out-of-bounds in bitmap_ipmac_ext_cleanup+0xd8/0x290 [ 87.799057][T10297] Read of size 8 at addr ffff88809aa25e00 by task syz-executor677/10297 [ 87.807504][T10297] [ 87.809825][T10297] CPU: 0 PID: 10297 Comm: syz-executor677 Not tainted 5.5.0-rc6-syzkaller #0 [ 87.819262][T10297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 87.829808][T10297] Call Trace: [ 87.833226][T10297] dump_stack+0x197/0x210 [ 87.837651][T10297] ? bitmap_ipmac_ext_cleanup+0xd8/0x290 [ 87.843413][T10297] print_address_description.constprop.0.cold+0xd4/0x30b [ 87.852259][T10297] ? bitmap_ipmac_ext_cleanup+0xd8/0x290 [ 87.858368][T10297] ? bitmap_ipmac_ext_cleanup+0xd8/0x290 [ 87.864501][T10297] __kasan_report.cold+0x1b/0x41 [ 87.869579][T10297] ? bitmap_ipmac_ext_cleanup+0xd8/0x290 [ 87.875259][T10297] kasan_report+0x12/0x20 [ 87.879594][T10297] check_memory_region+0x134/0x1a0 [ 87.884713][T10297] __kasan_check_read+0x11/0x20 [ 87.889646][T10297] bitmap_ipmac_ext_cleanup+0xd8/0x290 [ 87.895681][T10297] bitmap_ipmac_destroy+0x180/0x1d0 [ 87.900888][T10297] ip_set_create+0xe47/0x1500 [ 87.905764][T10297] ? ip_set_destroy+0xb70/0xb70 [ 87.910645][T10297] ? ip_set_destroy+0xb70/0xb70 [ 87.915496][T10297] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 87.920442][T10297] ? nfnetlink_bind+0x2c0/0x2c0 [ 87.925294][T10297] ? __kasan_check_read+0x11/0x20 [ 87.930311][T10297] ? __lock_acquire+0x8a0/0x4a00 [ 87.936709][T10297] ? save_stack+0x5c/0x90 [ 87.941085][T10297] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 87.948002][T10297] ? apparmor_capable+0x497/0x900 [ 87.953244][T10297] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 87.959912][T10297] ? __kasan_check_read+0x11/0x20 [ 87.965051][T10297] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 87.970865][T10297] netlink_rcv_skb+0x177/0x450 [ 87.975711][T10297] ? nfnetlink_bind+0x2c0/0x2c0 [ 87.980659][T10297] ? netlink_ack+0xb50/0xb50 [ 87.986526][T10297] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 87.993476][T10297] ? ns_capable_common+0x93/0x100 [ 87.998766][T10297] ? ns_capable+0x20/0x30 [ 88.003082][T10297] ? __netlink_ns_capable+0x104/0x140 [ 88.008941][T10297] nfnetlink_rcv+0x1ba/0x460 [ 88.013547][T10297] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 88.019093][T10297] ? netlink_deliver_tap+0x24a/0xbf0 [ 88.024390][T10297] ? __kasan_check_write+0x14/0x20 [ 88.029681][T10297] netlink_unicast+0x59e/0x7e0 [ 88.034435][T10297] ? netlink_attachskb+0x870/0x870 [ 88.039699][T10297] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 88.045687][T10297] ? __check_object_size+0x3d/0x437 [ 88.050879][T10297] netlink_sendmsg+0x91c/0xea0 [ 88.055649][T10297] ? netlink_unicast+0x7e0/0x7e0 [ 88.060590][T10297] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 88.066486][T10297] ? apparmor_socket_sendmsg+0x2a/0x30 [ 88.072724][T10297] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 88.079359][T10297] ? security_socket_sendmsg+0x8d/0xc0 [ 88.085475][T10297] ? netlink_unicast+0x7e0/0x7e0 [ 88.090720][T10297] sock_sendmsg+0xd7/0x130 [ 88.095227][T10297] ____sys_sendmsg+0x753/0x880 [ 88.100041][T10297] ? kernel_sendmsg+0x50/0x50 [ 88.104964][T10297] ? mark_held_locks+0xa4/0xf0 [ 88.109929][T10297] ? do_huge_pmd_anonymous_page+0x1463/0x1a50 [ 88.116227][T10297] ? __handle_mm_fault+0x3145/0x3cc0 [ 88.121531][T10297] ? do_huge_pmd_anonymous_page+0x1463/0x1a50 [ 88.127596][T10297] ___sys_sendmsg+0x100/0x170 [ 88.132459][T10297] ? do_huge_pmd_anonymous_page+0xceb/0x1a50 [ 88.138758][T10297] ? sendmsg_copy_msghdr+0x70/0x70 [ 88.143972][T10297] ? __do_page_fault+0x56a/0xd80 [ 88.148915][T10297] ? find_held_lock+0x35/0x130 [ 88.153678][T10297] ? __do_page_fault+0x56a/0xd80 [ 88.158706][T10297] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 88.165039][T10297] ? __fget_light+0x1a9/0x230 [ 88.169714][T10297] ? __fdget+0x1b/0x20 [ 88.174037][T10297] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 88.180482][T10297] __sys_sendmsg+0x105/0x1d0 [ 88.185220][T10297] ? __sys_sendmsg_sock+0xc0/0xc0 [ 88.190270][T10297] ? down_read_non_owner+0x490/0x490 [ 88.195637][T10297] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 88.201082][T10297] ? do_syscall_64+0x26/0x790 [ 88.205754][T10297] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 88.211856][T10297] ? do_syscall_64+0x26/0x790 [ 88.216638][T10297] __x64_sys_sendmsg+0x78/0xb0 [ 88.221408][T10297] do_syscall_64+0xfa/0x790 [ 88.226086][T10297] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 88.231981][T10297] RIP: 0033:0x4413f9 [ 88.235865][T10297] Code: e8 fc ab 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 9b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 88.256688][T10297] RSP: 002b:00007ffc84e271e8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 88.265182][T10297] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004413f9 [ 88.273242][T10297] RDX: 0000000000000000 RSI: 0000000020000300 RDI: 0000000000000003 [ 88.284172][T10297] RBP: 00000000000156ad R08: 00000000004002c8 R09: 00000000004002c8 [ 88.292410][T10297] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000402220 [ 88.300785][T10297] R13: 00000000004022b0 R14: 0000000000000000 R15: 0000000000000000 [ 88.308928][T10297] [ 88.311251][T10297] Allocated by task 10297: [ 88.315659][T10297] save_stack+0x23/0x90 [ 88.320658][T10297] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 88.326658][T10297] kasan_kmalloc+0x9/0x10 [ 88.332373][T10297] __kmalloc+0x163/0x770 [ 88.336935][T10297] ip_set_alloc+0x38/0x5e [ 88.341797][T10297] bitmap_ipmac_create+0x4e8/0xa00 [ 88.347346][T10297] ip_set_create+0x6f1/0x1500 [ 88.352207][T10297] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 88.357139][T10297] netlink_rcv_skb+0x177/0x450 [ 88.362092][T10297] nfnetlink_rcv+0x1ba/0x460 [ 88.367214][T10297] netlink_unicast+0x59e/0x7e0 [ 88.372000][T10297] netlink_sendmsg+0x91c/0xea0 [ 88.376964][T10297] sock_sendmsg+0xd7/0x130 [ 88.381576][T10297] ____sys_sendmsg+0x753/0x880 [ 88.386772][T10297] ___sys_sendmsg+0x100/0x170 [ 88.391793][T10297] __sys_sendmsg+0x105/0x1d0 [ 88.396974][T10297] __x64_sys_sendmsg+0x78/0xb0 [ 88.403481][T10297] do_syscall_64+0xfa/0x790 [ 88.408615][T10297] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 88.415083][T10297] [ 88.417592][T10297] Freed by task 10036: [ 88.422154][T10297] save_stack+0x23/0x90 [ 88.427131][T10297] __kasan_slab_free+0x102/0x150 [ 88.432381][T10297] kasan_slab_free+0xe/0x10 [ 88.437320][T10297] kfree+0x10a/0x2c0 [ 88.441227][T10297] tomoyo_init_log+0x15b5/0x2070 [ 88.446364][T10297] tomoyo_supervisor+0x33f/0xef0 [ 88.451336][T10297] tomoyo_env_perm+0x18e/0x210 [ 88.456106][T10297] tomoyo_find_next_domain+0x1354/0x1f6c [ 88.461738][T10297] tomoyo_bprm_check_security+0x124/0x1a0 [ 88.468056][T10297] security_bprm_check+0x63/0xb0 [ 88.473158][T10297] search_binary_handler+0x71/0x570 [ 88.478492][T10297] __do_execve_file.isra.0+0x1329/0x22b0 [ 88.485029][T10297] __x64_sys_execve+0x8f/0xc0 [ 88.490110][T10297] do_syscall_64+0xfa/0x790 [ 88.494849][T10297] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 88.500853][T10297] [ 88.503458][T10297] The buggy address belongs to the object at ffff88809aa24000 [ 88.503458][T10297] which belongs to the cache kmalloc-8k of size 8192 [ 88.518212][T10297] The buggy address is located 7680 bytes inside of [ 88.518212][T10297] 8192-byte region [ffff88809aa24000, ffff88809aa26000) [ 88.532690][T10297] The buggy address belongs to the page: [ 88.538315][T10297] page:ffffea00026a8900 refcount:1 mapcount:0 mapping:ffff8880aa4021c0 index:0x0 compound_mapcount: 0 [ 88.549268][T10297] raw: 00fffe0000010200 ffffea00026d8e08 ffffea00026b7708 ffff8880aa4021c0 [ 88.557948][T10297] raw: 0000000000000000 ffff88809aa24000 0000000100000001 0000000000000000 [ 88.567579][T10297] page dumped because: kasan: bad access detected [ 88.574113][T10297] [ 88.576696][T10297] Memory state around the buggy address: [ 88.582386][T10297] ffff88809aa25d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 88.590920][T10297] ffff88809aa25d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 88.598984][T10297] >ffff88809aa25e00: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 88.607109][T10297] ^ [ 88.611566][T10297] ffff88809aa25e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 88.619858][T10297] ffff88809aa25f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 88.627931][T10297] ================================================================== [ 88.636001][T10297] Disabling lock debugging due to kernel taint [ 88.644572][T10297] Kernel panic - not syncing: panic_on_warn set ... [ 88.651172][T10297] CPU: 0 PID: 10297 Comm: syz-executor677 Tainted: G B 5.5.0-rc6-syzkaller #0 [ 88.661308][T10297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 88.671621][T10297] Call Trace: [ 88.674925][T10297] dump_stack+0x197/0x210 [ 88.679379][T10297] panic+0x2e3/0x75c [ 88.683269][T10297] ? add_taint.cold+0x16/0x16 [ 88.688028][T10297] ? bitmap_ipmac_ext_cleanup+0xd8/0x290 [ 88.693676][T10297] ? preempt_schedule+0x4b/0x60 [ 88.698560][T10297] ? ___preempt_schedule+0x16/0x18 [ 88.705159][T10297] ? trace_hardirqs_on+0x5e/0x240 [ 88.710190][T10297] ? bitmap_ipmac_ext_cleanup+0xd8/0x290 [ 88.715812][T10297] end_report+0x47/0x4f [ 88.719966][T10297] ? bitmap_ipmac_ext_cleanup+0xd8/0x290 [ 88.725859][T10297] __kasan_report.cold+0xe/0x41 [ 88.731067][T10297] ? bitmap_ipmac_ext_cleanup+0xd8/0x290 [ 88.736698][T10297] kasan_report+0x12/0x20 [ 88.741013][T10297] check_memory_region+0x134/0x1a0 [ 88.746129][T10297] __kasan_check_read+0x11/0x20 [ 88.751416][T10297] bitmap_ipmac_ext_cleanup+0xd8/0x290 [ 88.756860][T10297] bitmap_ipmac_destroy+0x180/0x1d0 [ 88.762065][T10297] ip_set_create+0xe47/0x1500 [ 88.767254][T10297] ? ip_set_destroy+0xb70/0xb70 [ 88.772105][T10297] ? ip_set_destroy+0xb70/0xb70 [ 88.776961][T10297] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 88.781888][T10297] ? nfnetlink_bind+0x2c0/0x2c0 [ 88.786724][T10297] ? __kasan_check_read+0x11/0x20 [ 88.791741][T10297] ? __lock_acquire+0x8a0/0x4a00 [ 88.796659][T10297] ? save_stack+0x5c/0x90 [ 88.800970][T10297] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 88.807378][T10297] ? apparmor_capable+0x497/0x900 [ 88.812381][T10297] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 88.819044][T10297] ? __kasan_check_read+0x11/0x20 [ 88.824050][T10297] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 88.829497][T10297] netlink_rcv_skb+0x177/0x450 [ 88.834255][T10297] ? nfnetlink_bind+0x2c0/0x2c0 [ 88.839179][T10297] ? netlink_ack+0xb50/0xb50 [ 88.843753][T10297] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 88.849980][T10297] ? ns_capable_common+0x93/0x100 [ 88.854989][T10297] ? ns_capable+0x20/0x30 [ 88.859405][T10297] ? __netlink_ns_capable+0x104/0x140 [ 88.864785][T10297] nfnetlink_rcv+0x1ba/0x460 [ 88.869389][T10297] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 88.874857][T10297] ? netlink_deliver_tap+0x24a/0xbf0 [ 88.880249][T10297] ? __kasan_check_write+0x14/0x20 [ 88.886403][T10297] netlink_unicast+0x59e/0x7e0 [ 88.894300][T10297] ? netlink_attachskb+0x870/0x870 [ 88.901136][T10297] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 88.907599][T10297] ? __check_object_size+0x3d/0x437 [ 88.912943][T10297] netlink_sendmsg+0x91c/0xea0 [ 88.917710][T10297] ? netlink_unicast+0x7e0/0x7e0 [ 88.922646][T10297] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 88.928177][T10297] ? apparmor_socket_sendmsg+0x2a/0x30 [ 88.933633][T10297] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 88.939861][T10297] ? security_socket_sendmsg+0x8d/0xc0 [ 88.945482][T10297] ? netlink_unicast+0x7e0/0x7e0 [ 88.950571][T10297] sock_sendmsg+0xd7/0x130 [ 88.955003][T10297] ____sys_sendmsg+0x753/0x880 [ 88.959853][T10297] ? kernel_sendmsg+0x50/0x50 [ 88.964522][T10297] ? mark_held_locks+0xa4/0xf0 [ 88.969307][T10297] ? do_huge_pmd_anonymous_page+0x1463/0x1a50 [ 88.975368][T10297] ? __handle_mm_fault+0x3145/0x3cc0 [ 88.980742][T10297] ? do_huge_pmd_anonymous_page+0x1463/0x1a50 [ 88.986793][T10297] ___sys_sendmsg+0x100/0x170 [ 88.991469][T10297] ? do_huge_pmd_anonymous_page+0xceb/0x1a50 [ 88.997791][T10297] ? sendmsg_copy_msghdr+0x70/0x70 [ 89.003634][T10297] ? __do_page_fault+0x56a/0xd80 [ 89.008959][T10297] ? find_held_lock+0x35/0x130 [ 89.013836][T10297] ? __do_page_fault+0x56a/0xd80 [ 89.018774][T10297] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 89.025106][T10297] ? __fget_light+0x1a9/0x230 [ 89.029859][T10297] ? __fdget+0x1b/0x20 [ 89.034012][T10297] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 89.040247][T10297] __sys_sendmsg+0x105/0x1d0 [ 89.044892][T10297] ? __sys_sendmsg_sock+0xc0/0xc0 [ 89.050113][T10297] ? down_read_non_owner+0x490/0x490 [ 89.056547][T10297] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 89.061989][T10297] ? do_syscall_64+0x26/0x790 [ 89.066716][T10297] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 89.072782][T10297] ? do_syscall_64+0x26/0x790 [ 89.077463][T10297] __x64_sys_sendmsg+0x78/0xb0 [ 89.082225][T10297] do_syscall_64+0xfa/0x790 [ 89.086729][T10297] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 89.092633][T10297] RIP: 0033:0x4413f9 [ 89.096522][T10297] Code: e8 fc ab 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 9b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 89.116403][T10297] RSP: 002b:00007ffc84e271e8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 89.124798][T10297] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004413f9 [ 89.132761][T10297] RDX: 0000000000000000 RSI: 0000000020000300 RDI: 0000000000000003 [ 89.141155][T10297] RBP: 00000000000156ad R08: 00000000004002c8 R09: 00000000004002c8 [ 89.149292][T10297] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000402220 [ 89.157258][T10297] R13: 00000000004022b0 R14: 0000000000000000 R15: 0000000000000000 [ 89.166590][T10297] Kernel Offset: disabled [ 89.171005][T10297] Rebooting in 86400 seconds..