[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 56.057742][ T26] audit: type=1800 audit(1574415316.553:25): pid=8374 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 56.101253][ T26] audit: type=1800 audit(1574415316.553:26): pid=8374 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 56.137118][ T26] audit: type=1800 audit(1574415316.553:27): pid=8374 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.126' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 66.607893][ T8526] ------------[ cut here ]------------ [ 66.614144][ T8526] refcount_t: underflow; use-after-free. [ 66.619951][ T8526] WARNING: CPU: 0 PID: 8526 at lib/refcount.c:190 refcount_sub_and_test_checked+0x1d0/0x200 [ 66.629986][ T8526] Kernel panic - not syncing: panic_on_warn set ... [ 66.636563][ T8526] CPU: 0 PID: 8526 Comm: syz-executor152 Not tainted 5.4.0-rc8-syzkaller #0 [ 66.645202][ T8526] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 66.655227][ T8526] Call Trace: [ 66.658491][ T8526] dump_stack+0x197/0x210 [ 66.662922][ T8526] ? refcount_sub_and_test_checked+0x100/0x200 [ 66.669047][ T8526] panic+0x2e3/0x75c [ 66.672917][ T8526] ? add_taint.cold+0x16/0x16 [ 66.677572][ T8526] ? __kasan_check_write+0x14/0x20 [ 66.682682][ T8526] ? __warn.cold+0x14/0x35 [ 66.687096][ T8526] ? __warn+0xd9/0x1d0 [ 66.691137][ T8526] ? refcount_sub_and_test_checked+0x1d0/0x200 [ 66.697291][ T8526] __warn.cold+0x2f/0x35 [ 66.701509][ T8526] ? refcount_sub_and_test_checked+0x1d0/0x200 [ 66.707636][ T8526] report_bug+0x289/0x300 [ 66.711943][ T8526] do_error_trap+0x11b/0x200 [ 66.716507][ T8526] do_invalid_op+0x37/0x50 [ 66.721000][ T8526] ? refcount_sub_and_test_checked+0x1d0/0x200 [ 66.727135][ T8526] invalid_op+0x23/0x30 [ 66.731267][ T8526] RIP: 0010:refcount_sub_and_test_checked+0x1d0/0x200 [ 66.738001][ T8526] Code: 1d 30 da 7d 06 31 ff 89 de e8 3c 9b 2e fe 84 db 75 94 e8 f3 99 2e fe 48 c7 c7 40 b9 e6 87 c6 05 10 da 7d 06 01 e8 08 cd ff fd <0f> 0b e9 75 ff ff ff e8 d4 99 2e fe e9 6e ff ff ff 48 89 df e8 17 [ 66.757616][ T8526] RSP: 0018:ffff8880968ff530 EFLAGS: 00010282 [ 66.763668][ T8526] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 66.771613][ T8526] RDX: 0000000000000000 RSI: ffffffff815cf766 RDI: ffffed1012d1fe98 [ 66.779556][ T8526] RBP: ffff8880968ff5c8 R08: ffff8880994785c0 R09: ffffed1015d04101 [ 66.787498][ T8526] R10: ffffed1015d04100 R11: ffff8880ae820807 R12: 00000000ffffff01 [ 66.795453][ T8526] R13: 0000000000000001 R14: ffff8880968ff5a0 R15: 0000000000008001 [ 66.803409][ T8526] ? vprintk_func+0x86/0x189 [ 66.808010][ T8526] ? refcount_dec_not_one+0x1f0/0x1f0 [ 66.813356][ T8526] ? refcount_sub_and_test_checked+0x154/0x200 [ 66.819484][ T8526] ? refcount_dec_not_one+0x1f0/0x1f0 [ 66.824840][ T8526] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 66.831058][ T8526] sock_wfree+0xc3/0x190 [ 66.835280][ T8526] sctp_wfree+0x336/0x920 [ 66.839585][ T8526] ? __sctp_write_space+0x5e0/0x5e0 [ 66.844755][ T8526] skb_release_head_state+0xeb/0x260 [ 66.850012][ T8526] skb_release_all+0x16/0x60 [ 66.854578][ T8526] consume_skb+0xfb/0x3b0 [ 66.858887][ T8526] sctp_chunk_put+0x192/0x280 [ 66.863541][ T8526] sctp_chunk_free+0x56/0x70 [ 66.868110][ T8526] __sctp_outq_teardown+0x1d0/0xc60 [ 66.873301][ T8526] sctp_outq_free+0x16/0x20 [ 66.877782][ T8526] sctp_association_free+0x208/0x79a [ 66.883044][ T8526] sctp_do_sm+0x3a75/0x5170 [ 66.887525][ T8526] ? __kmalloc_node_track_caller+0x3d/0x70 [ 66.893313][ T8526] ? sctp_do_8_2_transport_strike.isra.0+0x940/0x940 [ 66.899976][ T8526] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 66.906343][ T8526] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 66.912474][ T8526] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 66.917992][ T8526] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 66.923947][ T8526] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 66.929729][ T8526] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 66.935425][ T8526] ? sctp_init_cause+0x1ae/0x230 [ 66.940331][ T8526] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 66.946157][ T8526] ? skb_put+0x177/0x1d0 [ 66.950381][ T8526] ? memcpy+0x46/0x50 [ 66.954341][ T8526] sctp_primitive_ABORT+0xa0/0xd0 [ 66.959342][ T8526] sctp_close+0x259/0x880 [ 66.963649][ T8526] ? sctp_accept+0x710/0x710 [ 66.968322][ T8526] ? __kasan_check_write+0x14/0x20 [ 66.973410][ T8526] ? down_write+0xdf/0x150 [ 66.977809][ T8526] ? ip_mc_drop_socket+0x211/0x270 [ 66.982894][ T8526] inet_release+0xed/0x200 [ 66.987281][ T8526] __sock_release+0xce/0x280 [ 66.991860][ T8526] sock_close+0x1e/0x30 [ 66.995989][ T8526] __fput+0x2ff/0x890 [ 66.999949][ T8526] ? __sock_release+0x280/0x280 [ 67.004861][ T8526] ____fput+0x16/0x20 [ 67.008947][ T8526] task_work_run+0x145/0x1c0 [ 67.013518][ T8526] do_exit+0x904/0x2e60 [ 67.017653][ T8526] ? mm_update_next_owner+0x640/0x640 [ 67.022996][ T8526] ? fput+0x1b/0x20 [ 67.026777][ T8526] ? __compat_sys_getsockopt+0x1ab/0x2c0 [ 67.032378][ T8526] ? sock_common_getsockopt+0xd0/0xd0 [ 67.037724][ T8526] ? get_compat_bpf_fprog+0x140/0x140 [ 67.043075][ T8526] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 67.048615][ T8526] do_group_exit+0x135/0x360 [ 67.053181][ T8526] __ia32_sys_exit_group+0x44/0x50 [ 67.058266][ T8526] do_fast_syscall_32+0x27b/0xdb3 [ 67.063265][ T8526] entry_SYSENTER_compat+0x70/0x7f [ 67.068344][ T8526] RIP: 0023:0xf7f57a39 [ 67.072392][ T8526] Code: Bad RIP value. [ 67.076432][ T8526] RSP: 002b:00000000fff4690c EFLAGS: 00000296 ORIG_RAX: 00000000000000fc [ 67.084812][ T8526] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000080eb2d8 [ 67.092754][ T8526] RDX: 0000000000000000 RSI: 00000000080d61d8 RDI: 00000000080eb2e0 [ 67.100698][ T8526] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 67.108641][ T8526] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 67.116586][ T8526] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 67.125956][ T8526] Kernel Offset: disabled [ 67.130333][ T8526] Rebooting in 86400 seconds..