[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.236' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program syzkaller login: [ 61.022902][ T6814] netlink: 8 bytes leftover after parsing attributes in process `syz-executor853'. [ 61.030911][ T6819] netlink: 8 bytes leftover after parsing attributes in process `syz-executor853'. [ 61.042690][ T6821] netlink: 8 bytes leftover after parsing attributes in process `syz-executor853'. [ 61.045434][ T6820] netlink: 8 bytes leftover after parsing attributes in process `syz-executor853'. [ 61.053604][ T6819] ================================================================== [ 61.069590][ T6819] BUG: KASAN: use-after-free in tipc_nl_publ_dump+0xae0/0xce0 [ 61.077089][ T6819] Read of size 2 at addr ffff888097f12284 by task syz-executor853/6819 [ 61.085325][ T6819] [ 61.087638][ T6819] CPU: 0 PID: 6819 Comm: syz-executor853 Not tainted 5.8.0-rc2-syzkaller #0 [ 61.096283][ T6819] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 61.106316][ T6819] Call Trace: [ 61.109587][ T6819] dump_stack+0x18f/0x20d [ 61.113910][ T6819] ? tipc_nl_publ_dump+0xae0/0xce0 [ 61.119021][ T6819] ? tipc_nl_publ_dump+0xae0/0xce0 [ 61.124116][ T6819] print_address_description.constprop.0.cold+0xae/0x436 [ 61.131145][ T6819] ? vprintk_func+0x97/0x1a6 [ 61.136033][ T6819] ? tipc_nl_publ_dump+0xae0/0xce0 [ 61.141122][ T6819] kasan_report.cold+0x1f/0x37 [ 61.145888][ T6819] ? tipc_nl_publ_dump+0xae0/0xce0 [ 61.150997][ T6819] tipc_nl_publ_dump+0xae0/0xce0 [ 61.155927][ T6819] ? __mutex_lock+0x626/0x10d0 [ 61.160674][ T6819] ? tipc_nl_sk_dump+0x30/0x30 [ 61.165431][ T6819] ? check_preemption_disabled+0x38/0x220 [ 61.171162][ T6819] ? rcu_read_lock_sched_held+0x3a/0xb0 [ 61.176721][ T6819] ? kmem_cache_alloc_node_trace+0x3b0/0x400 [ 61.182695][ T6819] ? __kmalloc_node_track_caller+0x38/0x60 [ 61.188491][ T6819] ? kasan_unpoison_shadow+0x33/0x40 [ 61.193785][ T6819] ? __phys_addr+0x9a/0x110 [ 61.198286][ T6819] ? memset+0x20/0x40 [ 61.202253][ T6819] genl_lock_dumpit+0x7f/0xb0 [ 61.206927][ T6819] netlink_dump+0x4cd/0xf60 [ 61.211451][ T6819] ? netlink_insert+0x1670/0x1670 [ 61.216468][ T6819] ? __mutex_unlock_slowpath+0xe2/0x610 [ 61.222010][ T6819] ? genl_start+0x45a/0x6e0 [ 61.226497][ T6819] __netlink_dump_start+0x643/0x900 [ 61.231684][ T6819] ? genl_rcv_msg+0x9e0/0x9e0 [ 61.236802][ T6819] ? tipc_nl_sk_dump+0x30/0x30 [ 61.241544][ T6819] genl_family_rcv_msg_dumpit+0x2ac/0x310 [ 61.247261][ T6819] ? genl_rcv+0x40/0x40 [ 61.251395][ T6819] ? mutex_lock_io_nested+0xf60/0xf60 [ 61.256756][ T6819] ? mark_lock+0xbc/0x1710 [ 61.261170][ T6819] ? genl_rcv_msg+0x9e0/0x9e0 [ 61.265863][ T6819] ? genl_unlock+0x20/0x20 [ 61.270315][ T6819] ? genl_parallel_done+0x170/0x170 [ 61.275524][ T6819] ? __radix_tree_lookup+0x1f3/0x290 [ 61.280795][ T6819] genl_rcv_msg+0x797/0x9e0 [ 61.285288][ T6819] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 61.292206][ T6819] ? lock_acquire+0x1f1/0xad0 [ 61.296864][ T6819] ? genl_rcv+0x15/0x40 [ 61.301000][ T6819] ? lock_release+0x8d0/0x8d0 [ 61.305660][ T6819] netlink_rcv_skb+0x15a/0x430 [ 61.310525][ T6819] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 61.317453][ T6819] ? netlink_ack+0xa10/0xa10 [ 61.322050][ T6819] genl_rcv+0x24/0x40 [ 61.326015][ T6819] netlink_unicast+0x533/0x7d0 [ 61.330784][ T6819] ? netlink_attachskb+0x810/0x810 [ 61.336191][ T6819] ? _copy_from_iter_full+0x247/0x890 [ 61.341567][ T6819] ? __phys_addr+0x9a/0x110 [ 61.346074][ T6819] ? __phys_addr_symbol+0x2c/0x70 [ 61.351124][ T6819] ? __check_object_size+0x171/0x3e4 [ 61.356417][ T6819] netlink_sendmsg+0x856/0xd90 [ 61.361166][ T6819] ? netlink_unicast+0x7d0/0x7d0 [ 61.366105][ T6819] ? netlink_unicast+0x7d0/0x7d0 [ 61.371040][ T6819] sock_sendmsg+0xcf/0x120 [ 61.375450][ T6819] ____sys_sendmsg+0x6e8/0x810 [ 61.380205][ T6819] ? kernel_sendmsg+0x50/0x50 [ 61.384882][ T6819] ? do_recvmmsg+0x6d0/0x6d0 [ 61.389457][ T6819] ? find_held_lock+0x2d/0x110 [ 61.394220][ T6819] ? debug_object_activate+0x287/0x3e0 [ 61.399674][ T6819] ? lockdep_hardirqs_on_prepare+0x590/0x590 [ 61.405676][ T6819] ? lock_downgrade+0x820/0x820 [ 61.410547][ T6819] ___sys_sendmsg+0xf3/0x170 [ 61.415121][ T6819] ? sendmsg_copy_msghdr+0x160/0x160 [ 61.420427][ T6819] ? lock_downgrade+0x820/0x820 [ 61.425279][ T6819] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 61.431094][ T6819] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 61.437118][ T6819] ? _raw_spin_unlock_irqrestore+0x9b/0xe0 [ 61.442922][ T6819] ? debug_object_active_state+0x260/0x350 [ 61.448713][ T6819] ? __fget_light+0x215/0x280 [ 61.453374][ T6819] __sys_sendmsg+0xe5/0x1b0 [ 61.457875][ T6819] ? __sys_sendmsg_sock+0xb0/0xb0 [ 61.462887][ T6819] ? do_fast_syscall_32+0x40/0x120 [ 61.467986][ T6819] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 61.473971][ T6819] do_syscall_32_irqs_on+0x3f/0x60 [ 61.479058][ T6819] do_fast_syscall_32+0x7f/0x120 [ 61.484047][ T6819] entry_SYSENTER_compat+0x6d/0x7c [ 61.489168][ T6819] RIP: 0023:0xf7fb3569 [ 61.493214][ T6819] Code: Bad RIP value. [ 61.497273][ T6819] RSP: 002b:00000000ffee534c EFLAGS: 00000246 ORIG_RAX: 0000000000000172 [ 61.505683][ T6819] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000020000500 [ 61.513668][ T6819] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00000000ffee5464 [ 61.521652][ T6819] RBP: 00000000ffee546c R08: 0000000000000000 R09: 0000000000000000 [ 61.529629][ T6819] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 61.537593][ T6819] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 61.545548][ T6819] [ 61.547873][ T6819] Allocated by task 6821: [ 61.552181][ T6819] save_stack+0x1b/0x40 [ 61.556314][ T6819] __kasan_kmalloc.constprop.0+0xc2/0xd0 [ 61.561941][ T6819] __alloc_skb+0xae/0x550 [ 61.566251][ T6819] netlink_sendmsg+0x94f/0xd90 [ 61.570996][ T6819] sock_sendmsg+0xcf/0x120 [ 61.575397][ T6819] ____sys_sendmsg+0x6e8/0x810 [ 61.580142][ T6819] ___sys_sendmsg+0xf3/0x170 [ 61.584710][ T6819] __sys_sendmsg+0xe5/0x1b0 [ 61.589209][ T6819] do_syscall_32_irqs_on+0x3f/0x60 [ 61.594296][ T6819] do_fast_syscall_32+0x7f/0x120 [ 61.599241][ T6819] entry_SYSENTER_compat+0x6d/0x7c [ 61.604353][ T6819] [ 61.606682][ T6819] Freed by task 6821: [ 61.610656][ T6819] save_stack+0x1b/0x40 [ 61.614828][ T6819] __kasan_slab_free+0xf5/0x140 [ 61.619763][ T6819] kfree+0x103/0x2c0 [ 61.623645][ T6819] skb_release_data+0x6d9/0x910 [ 61.628517][ T6819] consume_skb+0xc2/0x160 [ 61.632834][ T6819] netlink_unicast+0x53b/0x7d0 [ 61.637579][ T6819] netlink_sendmsg+0x856/0xd90 [ 61.642319][ T6819] sock_sendmsg+0xcf/0x120 [ 61.646710][ T6819] ____sys_sendmsg+0x6e8/0x810 [ 61.651451][ T6819] ___sys_sendmsg+0xf3/0x170 [ 61.656037][ T6819] __sys_sendmsg+0xe5/0x1b0 [ 61.660529][ T6819] do_syscall_32_irqs_on+0x3f/0x60 [ 61.665639][ T6819] do_fast_syscall_32+0x7f/0x120 [ 61.670564][ T6819] entry_SYSENTER_compat+0x6d/0x7c [ 61.675642][ T6819] [ 61.677950][ T6819] The buggy address belongs to the object at ffff888097f12000 [ 61.677950][ T6819] which belongs to the cache kmalloc-1k of size 1024 [ 61.691981][ T6819] The buggy address is located 644 bytes inside of [ 61.691981][ T6819] 1024-byte region [ffff888097f12000, ffff888097f12400) [ 61.705310][ T6819] The buggy address belongs to the page: [ 61.710939][ T6819] page:ffffea00025fc480 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 [ 61.720018][ T6819] flags: 0xfffe0000000200(slab) [ 61.724852][ T6819] raw: 00fffe0000000200 ffffea00029dbd48 ffffea0002991dc8 ffff8880aa000c40 [ 61.733413][ T6819] raw: 0000000000000000 ffff888097f12000 0000000100000002 0000000000000000 [ 61.741991][ T6819] page dumped because: kasan: bad access detected [ 61.748426][ T6819] [ 61.750728][ T6819] Memory state around the buggy address: [ 61.756352][ T6819] ffff888097f12180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.764390][ T6819] ffff888097f12200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb executing program [ 61.772453][ T6819] >ffff888097f12280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.780499][ T6819] ^ [ 61.784543][ T6819] ffff888097f12300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.792580][ T6819] ffff888097f12380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.800647][ T6819] ================================================================== [ 61.808709][ T6819] Disabling lock debugging due to kernel taint [ 61.851107][ T6819] Kernel panic - not syncing: panic_on_warn set ... [ 61.857708][ T6819] CPU: 0 PID: 6819 Comm: syz-executor853 Tainted: G B 5.8.0-rc2-syzkaller #0 [ 61.867744][ T6819] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 61.877790][ T6819] Call Trace: [ 61.881076][ T6819] dump_stack+0x18f/0x20d [ 61.885397][ T6819] ? tipc_nl_publ_dump+0xa60/0xce0 [ 61.890491][ T6819] panic+0x2e3/0x75c [ 61.894371][ T6819] ? __warn_printk+0xf3/0xf3 [ 61.898959][ T6819] ? preempt_schedule_common+0x59/0xc0 [ 61.904412][ T6819] ? tipc_nl_publ_dump+0xae0/0xce0 [ 61.909566][ T6819] ? preempt_schedule_thunk+0x16/0x18 [ 61.914918][ T6819] ? trace_hardirqs_on+0x55/0x220 [ 61.919928][ T6819] ? tipc_nl_publ_dump+0xae0/0xce0 [ 61.925023][ T6819] ? tipc_nl_publ_dump+0xae0/0xce0 [ 61.930109][ T6819] end_report+0x4d/0x53 [ 61.934273][ T6819] kasan_report.cold+0xd/0x37 [ 61.938956][ T6819] ? tipc_nl_publ_dump+0xae0/0xce0 [ 61.944043][ T6819] tipc_nl_publ_dump+0xae0/0xce0 [ 61.948956][ T6819] ? __mutex_lock+0x626/0x10d0 [ 61.953712][ T6819] ? tipc_nl_sk_dump+0x30/0x30 [ 61.958497][ T6819] ? check_preemption_disabled+0x38/0x220 [ 61.964217][ T6819] ? rcu_read_lock_sched_held+0x3a/0xb0 [ 61.969757][ T6819] ? kmem_cache_alloc_node_trace+0x3b0/0x400 [ 61.975723][ T6819] ? __kmalloc_node_track_caller+0x38/0x60 [ 61.981519][ T6819] ? kasan_unpoison_shadow+0x33/0x40 [ 61.986797][ T6819] ? __phys_addr+0x9a/0x110 [ 61.991285][ T6819] ? memset+0x20/0x40 [ 61.995269][ T6819] genl_lock_dumpit+0x7f/0xb0 [ 61.999932][ T6819] netlink_dump+0x4cd/0xf60 [ 62.004435][ T6819] ? netlink_insert+0x1670/0x1670 [ 62.009446][ T6819] ? __mutex_unlock_slowpath+0xe2/0x610 [ 62.014966][ T6819] ? genl_start+0x45a/0x6e0 [ 62.019453][ T6819] __netlink_dump_start+0x643/0x900 [ 62.024646][ T6819] ? genl_rcv_msg+0x9e0/0x9e0 [ 62.029324][ T6819] ? tipc_nl_sk_dump+0x30/0x30 [ 62.034064][ T6819] genl_family_rcv_msg_dumpit+0x2ac/0x310 [ 62.039763][ T6819] ? genl_rcv+0x40/0x40 [ 62.043904][ T6819] ? mutex_lock_io_nested+0xf60/0xf60 [ 62.049261][ T6819] ? mark_lock+0xbc/0x1710 [ 62.053674][ T6819] ? genl_rcv_msg+0x9e0/0x9e0 [ 62.058337][ T6819] ? genl_unlock+0x20/0x20 [ 62.062728][ T6819] ? genl_parallel_done+0x170/0x170 [ 62.067916][ T6819] ? __radix_tree_lookup+0x1f3/0x290 [ 62.073192][ T6819] genl_rcv_msg+0x797/0x9e0 [ 62.077708][ T6819] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 62.084642][ T6819] ? lock_acquire+0x1f1/0xad0 [ 62.089296][ T6819] ? genl_rcv+0x15/0x40 [ 62.093440][ T6819] ? lock_release+0x8d0/0x8d0 [ 62.098108][ T6819] netlink_rcv_skb+0x15a/0x430 [ 62.102861][ T6819] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 62.109774][ T6819] ? netlink_ack+0xa10/0xa10 [ 62.114344][ T6819] genl_rcv+0x24/0x40 [ 62.118317][ T6819] netlink_unicast+0x533/0x7d0 [ 62.123069][ T6819] ? netlink_attachskb+0x810/0x810 [ 62.128180][ T6819] ? _copy_from_iter_full+0x247/0x890 [ 62.133533][ T6819] ? __phys_addr+0x9a/0x110 [ 62.138018][ T6819] ? __phys_addr_symbol+0x2c/0x70 [ 62.143034][ T6819] ? __check_object_size+0x171/0x3e4 [ 62.148312][ T6819] netlink_sendmsg+0x856/0xd90 [ 62.153052][ T6819] ? netlink_unicast+0x7d0/0x7d0 [ 62.158012][ T6819] ? netlink_unicast+0x7d0/0x7d0 [ 62.162972][ T6819] sock_sendmsg+0xcf/0x120 [ 62.167365][ T6819] ____sys_sendmsg+0x6e8/0x810 [ 62.172104][ T6819] ? kernel_sendmsg+0x50/0x50 [ 62.176764][ T6819] ? do_recvmmsg+0x6d0/0x6d0 [ 62.181338][ T6819] ? find_held_lock+0x2d/0x110 [ 62.186078][ T6819] ? debug_object_activate+0x287/0x3e0 [ 62.191546][ T6819] ? lockdep_hardirqs_on_prepare+0x590/0x590 [ 62.197519][ T6819] ? lock_downgrade+0x820/0x820 [ 62.202362][ T6819] ___sys_sendmsg+0xf3/0x170 [ 62.206953][ T6819] ? sendmsg_copy_msghdr+0x160/0x160 [ 62.212243][ T6819] ? lock_downgrade+0x820/0x820 [ 62.217087][ T6819] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 62.222870][ T6819] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 62.228827][ T6819] ? _raw_spin_unlock_irqrestore+0x9b/0xe0 [ 62.234615][ T6819] ? debug_object_active_state+0x260/0x350 [ 62.240448][ T6819] ? __fget_light+0x215/0x280 [ 62.245223][ T6819] __sys_sendmsg+0xe5/0x1b0 [ 62.249713][ T6819] ? __sys_sendmsg_sock+0xb0/0xb0 [ 62.254728][ T6819] ? do_fast_syscall_32+0x40/0x120 [ 62.259869][ T6819] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 62.265828][ T6819] do_syscall_32_irqs_on+0x3f/0x60 [ 62.270937][ T6819] do_fast_syscall_32+0x7f/0x120 [ 62.275865][ T6819] entry_SYSENTER_compat+0x6d/0x7c [ 62.280950][ T6819] RIP: 0023:0xf7fb3569 [ 62.284992][ T6819] Code: Bad RIP value. [ 62.289040][ T6819] RSP: 002b:00000000ffee534c EFLAGS: 00000246 ORIG_RAX: 0000000000000172 [ 62.297429][ T6819] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000020000500 [ 62.305394][ T6819] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00000000ffee5464 [ 62.313479][ T6819] RBP: 00000000ffee546c R08: 0000000000000000 R09: 0000000000000000 [ 62.321474][ T6819] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 62.329463][ T6819] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 62.338719][ T6819] Kernel Offset: disabled [ 62.343052][ T6819] Rebooting in 86400 seconds..