[   80.822752][   T27] audit: type=1800 audit(1580418580.784:26): pid=9374 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.
[   81.682374][   T27] kauditd_printk_skb: 2 callbacks suppressed
[   81.682387][   T27] audit: type=1800 audit(1580418581.664:29): pid=9374 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0
[   81.709651][   T27] audit: type=1800 audit(1580418581.674:30): pid=9374 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added '10.128.0.207' (ECDSA) to the list of known hosts.
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
syzkaller login: [  103.002738][    C0] ==================================================================
[  103.011171][    C0] BUG: KASAN: slab-out-of-bounds in bitmap_port_gc+0x112/0x4f0
[  103.018736][    C0] Read of size 8 at addr ffff8880940b12c0 by task syz-executor771/9851
[  103.027194][    C0] 
[  103.029515][    C0] CPU: 0 PID: 9851 Comm: syz-executor771 Not tainted 5.5.0-rc6-next-20200116-syzkaller #0
[  103.040133][    C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  103.050196][    C0] Call Trace:
[  103.053625][    C0]  <IRQ>
[  103.056488][    C0]  dump_stack+0x197/0x210
[  103.060822][    C0]  ? bitmap_port_gc+0x112/0x4f0
[  103.065719][    C0]  print_address_description.constprop.0.cold+0xd4/0x30b
[  103.072864][    C0]  ? bitmap_port_gc+0x112/0x4f0
[  103.077713][    C0]  ? bitmap_port_gc+0x112/0x4f0
[  103.082670][    C0]  __kasan_report.cold+0x1b/0x32
[  103.087643][    C0]  ? bitmap_port_gc+0x112/0x4f0
[  103.092616][    C0]  kasan_report+0x12/0x20
[  103.096954][    C0]  check_memory_region+0x134/0x1a0
[  103.102176][    C0]  __kasan_check_read+0x11/0x20
[  103.107206][    C0]  bitmap_port_gc+0x112/0x4f0
[  103.111960][    C0]  call_timer_fn+0x1ac/0x780
[  103.116556][    C0]  ? bitmap_port_test+0x170/0x170
[  103.121773][    C0]  ? msleep_interruptible+0x150/0x150
[  103.127438][    C0]  ? run_timer_softirq+0x6b1/0x1790
[  103.132770][    C0]  ? trace_hardirqs_on+0x67/0x240
[  103.137804][    C0]  ? bitmap_port_test+0x170/0x170
[  103.142888][    C0]  ? bitmap_port_test+0x170/0x170
[  103.148044][    C0]  run_timer_softirq+0x6c3/0x1790
[  103.153273][    C0]  ? add_timer+0x930/0x930
[  103.157773][    C0]  ? rcu_lockdep_current_cpu_online+0xe3/0x130
[  103.164067][    C0]  ? rcu_read_lock_sched_held+0x9c/0xd0
[  103.169686][    C0]  ? rcu_read_lock_any_held.part.0+0x50/0x50
[  103.176800][    C0]  ? trace_hardirqs_on+0x67/0x240
[  103.181913][    C0]  __do_softirq+0x262/0x98c
[  103.186414][    C0]  ? sched_clock_cpu+0x1b/0x1b0
[  103.191267][    C0]  irq_exit+0x19b/0x1e0
[  103.195938][    C0]  smp_apic_timer_interrupt+0x1a3/0x610
[  103.201827][    C0]  apic_timer_interrupt+0xf/0x20
[  103.207040][    C0]  </IRQ>
[  103.210259][    C0] RIP: 0010:__d_lookup+0x0/0x750
[  103.216056][    C0] Code: df e8 84 8d ee ff e9 e1 ec ff ff 48 8b bd 10 ff ff ff e8 d3 8c ee ff e9 72 ed ff ff e8 69 8d ee ff e9 15 ed ff ff 0f 1f 40 00 <55> 48 89 e5 41 57 41 56 41 55 41 54 53 48 89 f3 48 83 ec 50 48 89
[  103.236606][    C0] RSP: 0018:ffffc900034c7958 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13
[  103.245078][    C0] RAX: ffff88809508e140 RBX: ffffc900034c7a08 RCX: ffffffff81c272a7
[  103.253484][    C0] RDX: 0000000000000000 RSI: ffffc900034c7be0 RDI: ffff8880912be040
[  103.262460][    C0] RBP: ffffc900034c7a30 R08: ffff88809508e140 R09: ffffed1012a11c2d
[  103.270624][    C0] R10: ffffed1012a11c2c R11: ffff88809508e163 R12: ffffc900034c7bd0
[  103.278820][    C0] R13: ffffc900034c7be0 R14: ffff8880912be040 R15: ffffc900034c7ae8
[  103.287019][    C0]  ? lookup_fast+0x117/0xe60
[  103.291642][    C0]  ? lookup_fast+0x411/0xe60
[  103.296510][    C0]  ? lookup_open+0x1a90/0x1a90
[  103.301295][    C0]  path_openat+0x457/0x34d0
[  103.305868][    C0]  ? path_mountpoint.isra.0+0x370/0x370
[  103.311419][    C0]  ? __alloc_fd+0x487/0x620
[  103.315947][    C0]  do_filp_open+0x192/0x260
[  103.320456][    C0]  ? may_open_dev+0x100/0x100
[  103.325160][    C0]  ? simple_attr_release+0x50/0x50
[  103.330288][    C0]  ? _raw_spin_unlock+0x28/0x40
[  103.335215][    C0]  do_sys_openat2+0x633/0x840
[  103.339956][    C0]  ? file_open_root+0x5f0/0x5f0
[  103.345788][    C0]  do_sys_open+0xfc/0x190
[  103.351112][    C0]  ? filp_open+0x80/0x80
[  103.355464][    C0]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[  103.361346][    C0]  ? do_syscall_64+0x26/0x790
[  103.366287][    C0]  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  103.372528][    C0]  ? do_syscall_64+0x26/0x790
[  103.377217][    C0]  __x64_sys_open+0x7e/0xc0
[  103.381759][    C0]  do_syscall_64+0xfa/0x790
[  103.386277][    C0]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  103.392221][    C0] RIP: 0033:0x4011a0
[  103.396109][    C0] Code: 01 f0 ff ff 0f 83 c0 0b 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 83 3d 2d 15 2d 00 00 75 14 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 94 0b 00 00 c3 48 83 ec 08 e8 fa 00 00 00
[  103.415794][    C0] RSP: 002b:00007ffdad8ab188 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
[  103.424329][    C0] RAX: ffffffffffffffda RBX: 00007ffdad8ab1b4 RCX: 00000000004011a0
[  103.432301][    C0] RDX: 00007ffdad8ab1ba RSI: 0000000000080001 RDI: 00000000004a23c2
[  103.440276][    C0] RBP: 00007ffdad8ab1b0 R08: 0000000000000000 R09: 0000000000000004
[  103.448315][    C0] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004021c0
[  103.456512][    C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[  103.464792][    C0] 
[  103.467113][    C0] Allocated by task 9527:
[  103.471453][    C0]  save_stack+0x23/0x90
[  103.475601][    C0]  __kasan_kmalloc.constprop.0+0xcf/0xe0
[  103.481926][    C0]  kasan_kmalloc+0x9/0x10
[  103.486336][    C0]  __kmalloc+0x163/0x770
[  103.490729][    C0]  ip_set_alloc+0x38/0x5e
[  103.495322][    C0]  bitmap_port_create+0x3dc/0x7c0
[  103.500584][    C0]  ip_set_create+0x6f1/0x1500
[  103.505264][    C0]  nfnetlink_rcv_msg+0xcf2/0xfb0
[  103.510247][    C0]  netlink_rcv_skb+0x177/0x450
[  103.515073][    C0]  nfnetlink_rcv+0x1ba/0x460
[  103.519832][    C0]  netlink_unicast+0x59e/0x7e0
[  103.524691][    C0]  netlink_sendmsg+0x91c/0xea0
[  103.529464][    C0]  sock_sendmsg+0xd7/0x130
[  103.533901][    C0]  ____sys_sendmsg+0x753/0x880
[  103.538775][    C0]  ___sys_sendmsg+0x100/0x170
[  103.543794][    C0]  __sys_sendmsg+0x105/0x1d0
[  103.548545][    C0]  __x64_sys_sendmsg+0x78/0xb0
[  103.553328][    C0]  do_syscall_64+0xfa/0x790
[  103.557869][    C0]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  103.564056][    C0] 
[  103.566490][    C0] Freed by task 9258:
[  103.570484][    C0]  save_stack+0x23/0x90
[  103.575018][    C0]  __kasan_slab_free+0x102/0x150
[  103.580110][    C0]  kasan_slab_free+0xe/0x10
[  103.584628][    C0]  kfree+0x10a/0x2c0
[  103.588536][    C0]  tomoyo_check_open_permission+0x19e/0x3e0
[  103.594527][    C0]  tomoyo_file_open+0xa9/0xd0
[  103.599206][    C0]  security_file_open+0x71/0x300
[  103.604391][    C0]  do_dentry_open+0x365/0x1350
[  103.609147][    C0]  vfs_open+0xa0/0xd0
[  103.613128][    C0]  path_openat+0x12fd/0x34d0
[  103.617719][    C0]  do_filp_open+0x192/0x260
[  103.622223][    C0]  do_sys_openat2+0x633/0x840
[  103.627030][    C0]  do_sys_open+0xfc/0x190
[  103.631358][    C0]  __x64_sys_open+0x7e/0xc0
[  103.636054][    C0]  do_syscall_64+0xfa/0x790
[  103.640596][    C0]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  103.646496][    C0] 
[  103.648828][    C0] The buggy address belongs to the object at ffff8880940b12c0
[  103.648828][    C0]  which belongs to the cache kmalloc-32 of size 32
[  103.663455][    C0] The buggy address is located 0 bytes inside of
[  103.663455][    C0]  32-byte region [ffff8880940b12c0, ffff8880940b12e0)
[  103.677775][    C0] The buggy address belongs to the page:
[  103.683532][    C0] page:ffffea0002502c40 refcount:1 mapcount:0 mapping:ffff8880aa4001c0 index:0xffff8880940b1fc1
[  103.694584][    C0] flags: 0xfffe0000000200(slab)
[  103.699498][    C0] raw: 00fffe0000000200 ffffea00024fd048 ffffea00028c8388 ffff8880aa4001c0
[  103.708364][    C0] raw: ffff8880940b1fc1 ffff8880940b1000 000000010000002e 0000000000000000
[  103.717831][    C0] page dumped because: kasan: bad access detected
[  103.724779][    C0] 
[  103.727285][    C0] Memory state around the buggy address:
[  103.733051][    C0]  ffff8880940b1180: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
[  103.741224][    C0]  ffff8880940b1200: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
[  103.749487][    C0] >ffff8880940b1280: 00 07 fc fc fc fc fc fc 04 fc fc fc fc fc fc fc
[  103.757744][    C0]                                            ^
[  103.764080][    C0]  ffff8880940b1300: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
[  103.772717][    C0]  ffff8880940b1380: fb fb fb fb fc fc fc fc 00 01 fc fc fc fc fc fc
[  103.781493][    C0] ==================================================================
[  103.789889][    C0] Disabling lock debugging due to kernel taint
[  103.796060][    C0] Kernel panic - not syncing: panic_on_warn set ...
[  103.802650][    C0] CPU: 0 PID: 9851 Comm: syz-executor771 Tainted: G    B             5.5.0-rc6-next-20200116-syzkaller #0
[  103.814314][    C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  103.824630][    C0] Call Trace:
[  103.828053][    C0]  <IRQ>
[  103.830918][    C0]  dump_stack+0x197/0x210
[  103.835264][    C0]  panic+0x2e3/0x75c
[  103.839192][    C0]  ? add_taint.cold+0x16/0x16
[  103.843977][    C0]  ? retint_kernel+0x2b/0x2b
[  103.848571][    C0]  ? trace_hardirqs_on+0x5e/0x240
[  103.853579][    C0]  ? bitmap_port_gc+0x112/0x4f0
[  103.858622][    C0]  end_report+0x47/0x4f
[  103.862775][    C0]  ? bitmap_port_gc+0x112/0x4f0
[  103.867639][    C0]  __kasan_report.cold+0xe/0x32
[  103.872526][    C0]  ? bitmap_port_gc+0x112/0x4f0
[  103.877481][    C0]  kasan_report+0x12/0x20
[  103.881808][    C0]  check_memory_region+0x134/0x1a0
[  103.886915][    C0]  __kasan_check_read+0x11/0x20
[  103.891816][    C0]  bitmap_port_gc+0x112/0x4f0
[  103.896499][    C0]  call_timer_fn+0x1ac/0x780
[  103.901209][    C0]  ? bitmap_port_test+0x170/0x170
[  103.906302][    C0]  ? msleep_interruptible+0x150/0x150
[  103.911681][    C0]  ? run_timer_softirq+0x6b1/0x1790
[  103.916876][    C0]  ? trace_hardirqs_on+0x67/0x240
[  103.921897][    C0]  ? bitmap_port_test+0x170/0x170
[  103.927012][    C0]  ? bitmap_port_test+0x170/0x170
[  103.932075][    C0]  run_timer_softirq+0x6c3/0x1790
[  103.937199][    C0]  ? add_timer+0x930/0x930
[  103.941677][    C0]  ? rcu_lockdep_current_cpu_online+0xe3/0x130
[  103.947832][    C0]  ? rcu_read_lock_sched_held+0x9c/0xd0
[  103.953426][    C0]  ? rcu_read_lock_any_held.part.0+0x50/0x50
[  103.959545][    C0]  ? trace_hardirqs_on+0x67/0x240
[  103.964628][    C0]  __do_softirq+0x262/0x98c
[  103.969133][    C0]  ? sched_clock_cpu+0x1b/0x1b0
[  103.973985][    C0]  irq_exit+0x19b/0x1e0
[  103.978498][    C0]  smp_apic_timer_interrupt+0x1a3/0x610
[  103.984063][    C0]  apic_timer_interrupt+0xf/0x20
[  103.988984][    C0]  </IRQ>
[  103.992032][    C0] RIP: 0010:__d_lookup+0x0/0x750
[  103.996962][    C0] Code: df e8 84 8d ee ff e9 e1 ec ff ff 48 8b bd 10 ff ff ff e8 d3 8c ee ff e9 72 ed ff ff e8 69 8d ee ff e9 15 ed ff ff 0f 1f 40 00 <55> 48 89 e5 41 57 41 56 41 55 41 54 53 48 89 f3 48 83 ec 50 48 89
[  104.016774][    C0] RSP: 0018:ffffc900034c7958 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13
[  104.025259][    C0] RAX: ffff88809508e140 RBX: ffffc900034c7a08 RCX: ffffffff81c272a7
[  104.033280][    C0] RDX: 0000000000000000 RSI: ffffc900034c7be0 RDI: ffff8880912be040
[  104.041245][    C0] RBP: ffffc900034c7a30 R08: ffff88809508e140 R09: ffffed1012a11c2d
[  104.049385][    C0] R10: ffffed1012a11c2c R11: ffff88809508e163 R12: ffffc900034c7bd0
[  104.057469][    C0] R13: ffffc900034c7be0 R14: ffff8880912be040 R15: ffffc900034c7ae8
[  104.065456][    C0]  ? lookup_fast+0x117/0xe60
[  104.070046][    C0]  ? lookup_fast+0x411/0xe60
[  104.074636][    C0]  ? lookup_open+0x1a90/0x1a90
[  104.079407][    C0]  path_openat+0x457/0x34d0
[  104.083976][    C0]  ? path_mountpoint.isra.0+0x370/0x370
[  104.089678][    C0]  ? __alloc_fd+0x487/0x620
[  104.094186][    C0]  do_filp_open+0x192/0x260
[  104.098870][    C0]  ? may_open_dev+0x100/0x100
[  104.103673][    C0]  ? simple_attr_release+0x50/0x50
[  104.108981][    C0]  ? _raw_spin_unlock+0x28/0x40
[  104.114064][    C0]  do_sys_openat2+0x633/0x840
[  104.118842][    C0]  ? file_open_root+0x5f0/0x5f0
[  104.123689][    C0]  do_sys_open+0xfc/0x190
[  104.128009][    C0]  ? filp_open+0x80/0x80
[  104.132244][    C0]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[  104.137696][    C0]  ? do_syscall_64+0x26/0x790
[  104.142377][    C0]  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  104.148459][    C0]  ? do_syscall_64+0x26/0x790
[  104.153150][    C0]  __x64_sys_open+0x7e/0xc0
[  104.157764][    C0]  do_syscall_64+0xfa/0x790
[  104.162277][    C0]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  104.168166][    C0] RIP: 0033:0x4011a0
[  104.172058][    C0] Code: 01 f0 ff ff 0f 83 c0 0b 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 83 3d 2d 15 2d 00 00 75 14 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 94 0b 00 00 c3 48 83 ec 08 e8 fa 00 00 00
[  104.191809][    C0] RSP: 002b:00007ffdad8ab188 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
[  104.200834][    C0] RAX: ffffffffffffffda RBX: 00007ffdad8ab1b4 RCX: 00000000004011a0
[  104.208798][    C0] RDX: 00007ffdad8ab1ba RSI: 0000000000080001 RDI: 00000000004a23c2
[  104.216927][    C0] RBP: 00007ffdad8ab1b0 R08: 0000000000000000 R09: 0000000000000004
[  104.224899][    C0] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004021c0
[  104.233085][    C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[  104.242764][    C0] Kernel Offset: disabled
[  104.247135][    C0] Rebooting in 86400 seconds..