[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 27.608785] kauditd_printk_skb: 8 callbacks suppressed [ 27.608798] audit: type=1800 audit(1541035868.403:29): pid=5568 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 27.642686] audit: type=1800 audit(1541035868.403:30): pid=5568 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.113' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 38.704433] netlink: 'syz-executor224': attribute type 3 has an invalid length. [ 38.712112] netlink: 'syz-executor224': attribute type 2 has an invalid length. [ 38.720430] kasan: CONFIG_KASAN_INLINE enabled [ 38.725159] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 38.732537] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 38.738772] CPU: 1 PID: 5723 Comm: syz-executor224 Not tainted 4.19.0+ #280 [ 38.745860] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 38.755217] RIP: 0010:icmp_timeout_obj_to_nlattr+0x77/0x170 [ 38.760924] Code: b5 41 c7 00 f1 f1 f1 f1 c7 40 04 04 f2 f2 f2 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 e8 40 33 26 fb 4c 89 e8 48 c1 e8 03 <42> 0f b6 14 38 4c 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 [ 38.779824] RSP: 0018:ffff8801d44cf220 EFLAGS: 00010246 [ 38.785223] RAX: 0000000000000000 RBX: 1ffff1003a899e45 RCX: ffffffff865c2854 [ 38.792510] RDX: 0000000000000000 RSI: ffffffff865930c0 RDI: ffff8801d3a48b40 [ 38.799770] RBP: ffff8801d44cf2b0 R08: ffff8801d3aba180 R09: ffff8801d440c5a8 [ 38.807026] R10: ffffed003a8818b4 R11: ffff8801d440c5a0 R12: ffff8801d3a48b40 [ 38.814287] R13: 0000000000000000 R14: ffff8801d44cf288 R15: dffffc0000000000 [ 38.821558] FS: 0000000001a5f880(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000 [ 38.829839] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.835757] CR2: 00000000208a7000 CR3: 00000001d7ab4000 CR4: 00000000001406e0 [ 38.843020] Call Trace: [ 38.845596] ? memcpy+0x45/0x50 [ 38.848866] ? icmp_timeout_nlattr_to_obj+0x180/0x180 [ 38.854047] ? __nla_put+0x37/0x40 [ 38.857577] ? nla_put+0x117/0x150 [ 38.861111] cttimeout_default_get+0x644/0x9e0 [ 38.865687] ? cttimeout_new_timeout+0x8c0/0x8c0 [ 38.870540] ? __lock_is_held+0xb5/0x140 [ 38.874679] ? cttimeout_new_timeout+0x8c0/0x8c0 [ 38.879430] nfnetlink_rcv_msg+0xdd3/0x10c0 [ 38.883744] ? nfnetlink_bind+0x3b0/0x3b0 [ 38.887935] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 38.893464] ? refcount_sub_and_test_checked+0x203/0x310 [ 38.898901] ? refcount_inc_not_zero_checked+0x2f0/0x2f0 [ 38.904400] ? netlink_deliver_tap+0x32e/0xf80 [ 38.908984] ? lock_downgrade+0x900/0x900 [ 38.913120] ? check_preemption_disabled+0x48/0x280 [ 38.918129] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 38.923656] ? apparmor_capable+0x355/0x6c0 [ 38.927974] ? rcu_softirq_qs+0x20/0x20 [ 38.931937] ? apparmor_cred_prepare+0x5a0/0x5a0 [ 38.936685] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 38.942219] netlink_rcv_skb+0x172/0x440 [ 38.946269] ? nfnetlink_bind+0x3b0/0x3b0 [ 38.950408] ? netlink_ack+0xb80/0xb80 [ 38.954281] ? __netlink_ns_capable+0x100/0x130 [ 38.958941] nfnetlink_rcv+0x1c0/0x4d0 [ 38.962816] ? nfnetlink_rcv_batch+0x19b0/0x19b0 [ 38.967563] ? kasan_check_write+0x14/0x20 [ 38.971844] netlink_unicast+0x5a5/0x760 [ 38.975949] ? netlink_attachskb+0x9a0/0x9a0 [ 38.980362] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 38.985885] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 38.990896] netlink_sendmsg+0xa18/0xfc0 [ 38.995007] ? netlink_unicast+0x760/0x760 [ 38.999233] ? aa_sock_msg_perm.isra.12+0xba/0x160 [ 39.004151] ? apparmor_socket_sendmsg+0x29/0x30 [ 39.008904] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 39.014438] ? security_socket_sendmsg+0x94/0xc0 [ 39.019185] ? netlink_unicast+0x760/0x760 [ 39.023409] sock_sendmsg+0xd5/0x120 [ 39.027109] ___sys_sendmsg+0x7fd/0x930 [ 39.031068] ? find_held_lock+0x36/0x1c0 [ 39.035117] ? copy_msghdr_from_user+0x580/0x580 [ 39.039920] ? zap_class+0x640/0x640 [ 39.043629] ? zap_class+0x640/0x640 [ 39.047329] ? zap_class+0x640/0x640 [ 39.051043] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 39.056569] ? __fget_light+0x2e9/0x430 [ 39.060526] ? fget_raw+0x20/0x20 [ 39.063976] ? __do_page_fault+0x620/0xe60 [ 39.068203] ? lock_downgrade+0x900/0x900 [ 39.072341] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 39.077258] ? kasan_check_read+0x11/0x20 [ 39.081396] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 39.086921] ? sockfd_lookup_light+0xc5/0x160 [ 39.091403] __sys_sendmsg+0x11d/0x280 [ 39.095278] ? __ia32_sys_shutdown+0x80/0x80 [ 39.099670] ? up_read_non_owner+0x100/0x100 [ 39.104061] ? do_syscall_64+0x9a/0x820 [ 39.108022] ? do_syscall_64+0x9a/0x820 [ 39.111985] ? trace_hardirqs_off_caller+0x310/0x310 [ 39.117151] __x64_sys_sendmsg+0x78/0xb0 [ 39.121204] do_syscall_64+0x1b9/0x820 [ 39.125078] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 39.130425] ? syscall_return_slowpath+0x5e0/0x5e0 [ 39.135339] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 39.140166] ? trace_hardirqs_on_caller+0x310/0x310 [ 39.145168] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 39.150167] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 39.155691] ? prepare_exit_to_usermode+0x291/0x3b0 [ 39.160691] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 39.165523] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 39.170702] RIP: 0033:0x4400d9 [ 39.173883] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 39.192774] RSP: 002b:00007ffc10232358 EFLAGS: 00000213 ORIG_RAX: 000000000000002e [ 39.200588] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004400d9 [ 39.207847] RDX: 0000000000000000 RSI: 0000000020dddfc8 RDI: 0000000000000003 [ 39.215143] RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 [ 39.222404] R10: 0000000000000000 R11: 0000000000000213 R12: 0000000000401960 [ 39.229712] R13: 00000000004019f0 R14: 0000000000000000 R15: 0000000000000000 [ 39.236979] Modules linked in: [ 39.240986] ---[ end trace 2ded1daf14e335b6 ]--- [ 39.245809] RIP: 0010:icmp_timeout_obj_to_nlattr+0x77/0x170 [ 39.251537] Code: b5 41 c7 00 f1 f1 f1 f1 c7 40 04 04 f2 f2 f2 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 e8 40 33 26 fb 4c 89 e8 48 c1 e8 03 <42> 0f b6 14 38 4c 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 [ 39.270774] RSP: 0018:ffff8801d44cf220 EFLAGS: 00010246 [ 39.276266] RAX: 0000000000000000 RBX: 1ffff1003a899e45 RCX: ffffffff865c2854 [ 39.283552] RDX: 0000000000000000 RSI: ffffffff865930c0 RDI: ffff8801d3a48b40 [ 39.290870] RBP: ffff8801d44cf2b0 R08: ffff8801d3aba180 R09: ffff8801d440c5a8 [ 39.298174] R10: ffffed003a8818b4 R11: ffff8801d440c5a0 R12: ffff8801d3a48b40 [ 39.305523] R13: 0000000000000000 R14: ffff8801d44cf288 R15: dffffc0000000000 [ 39.312804] FS: 0000000001a5f880(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000 [ 39.321073] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 39.327021] CR2: 00000000208a7000 CR3: 00000001d7ab4000 CR4: 00000000001406e0 [ 39.334425] Kernel panic - not syncing: Fatal exception [ 39.340839] Kernel Offset: disabled [ 39.344477] Rebooting in 86400 seconds..