[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 84.265412][ T27] audit: type=1800 audit(1580289994.180:25): pid=9190 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 84.290993][ T27] audit: type=1800 audit(1580289994.180:26): pid=9190 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 84.322244][ T27] audit: type=1800 audit(1580289994.180:27): pid=9190 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.1.56' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 93.443144][ T9345] ================================================================== [ 93.451414][ T9345] BUG: KASAN: slab-out-of-bounds in bitmap_ip_list+0x40f/0xf20 [ 93.458948][ T9345] Read of size 8 at addr ffff8880a6ecdf40 by task syz-executor544/9345 [ 93.467160][ T9345] [ 93.469476][ T9345] CPU: 1 PID: 9345 Comm: syz-executor544 Not tainted 5.5.0-rc6-next-20200116-syzkaller #0 [ 93.479338][ T9345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 93.489372][ T9345] Call Trace: [ 93.492646][ T9345] dump_stack+0x197/0x210 [ 93.496955][ T9345] ? bitmap_ip_list+0x40f/0xf20 [ 93.501791][ T9345] print_address_description.constprop.0.cold+0xd4/0x30b [ 93.508792][ T9345] ? bitmap_ip_list+0x40f/0xf20 [ 93.513678][ T9345] ? bitmap_ip_list+0x40f/0xf20 [ 93.518515][ T9345] __kasan_report.cold+0x1b/0x32 [ 93.523439][ T9345] ? bitmap_ip_list+0x40f/0xf20 [ 93.528276][ T9345] kasan_report+0x12/0x20 [ 93.532590][ T9345] check_memory_region+0x134/0x1a0 [ 93.537715][ T9345] __kasan_check_read+0x11/0x20 [ 93.542600][ T9345] bitmap_ip_list+0x40f/0xf20 [ 93.547273][ T9345] ? bitmap_ip_add+0xe60/0xe60 [ 93.552084][ T9345] ? nla_put+0x110/0x150 [ 93.556372][ T9345] ip_set_dump_start+0x96c/0x1ca0 [ 93.561385][ T9345] ? ip_set_rename+0x720/0x720 [ 93.566132][ T9345] ? __kmalloc_reserve.isra.0+0x70/0xf0 [ 93.571660][ T9345] ? __lock_acquire+0x2660/0x4a00 [ 93.576675][ T9345] ? __kasan_check_write+0x14/0x20 [ 93.581773][ T9345] netlink_dump+0x558/0xfb0 [ 93.586314][ T9345] ? __netlink_sendskb+0xc0/0xc0 [ 93.591247][ T9345] __netlink_dump_start+0x673/0x930 [ 93.596427][ T9345] ip_set_dump+0x15a/0x1d0 [ 93.600824][ T9345] ? call_ad+0x5a0/0x5a0 [ 93.605054][ T9345] ? ip_set_rename+0x720/0x720 [ 93.609813][ T9345] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 93.615604][ T9345] ? call_ad+0x5a0/0x5a0 [ 93.619832][ T9345] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 93.624760][ T9345] ? nfnetlink_bind+0x2c0/0x2c0 [ 93.629601][ T9345] ? __kasan_check_read+0x11/0x20 [ 93.634608][ T9345] ? __lock_acquire+0x8a0/0x4a00 [ 93.639529][ T9345] ? save_stack+0x5c/0x90 [ 93.643851][ T9345] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 93.650152][ T9345] ? apparmor_capable+0x4df/0x910 [ 93.655209][ T9345] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 93.661430][ T9345] ? __kasan_check_read+0x11/0x20 [ 93.666468][ T9345] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 93.671920][ T9345] netlink_rcv_skb+0x177/0x450 [ 93.676770][ T9345] ? nfnetlink_bind+0x2c0/0x2c0 [ 93.681606][ T9345] ? netlink_ack+0xb50/0xb50 [ 93.686214][ T9345] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 93.692471][ T9345] ? ns_capable_common+0x93/0x100 [ 93.697475][ T9345] ? ns_capable+0x20/0x30 [ 93.701785][ T9345] ? __netlink_ns_capable+0x104/0x140 [ 93.707137][ T9345] nfnetlink_rcv+0x1ba/0x460 [ 93.711710][ T9345] ? nfnetlink_rcv_batch+0x1780/0x1780 [ 93.717149][ T9345] ? netlink_deliver_tap+0x248/0xbf0 [ 93.722420][ T9345] ? __kasan_check_write+0x14/0x20 [ 93.727514][ T9345] netlink_unicast+0x59e/0x7e0 [ 93.732261][ T9345] ? netlink_attachskb+0x870/0x870 [ 93.737361][ T9345] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 93.743064][ T9345] ? __check_object_size+0x3d/0x437 [ 93.748248][ T9345] netlink_sendmsg+0x91c/0xea0 [ 93.752993][ T9345] ? netlink_unicast+0x7e0/0x7e0 [ 93.757916][ T9345] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 93.763517][ T9345] ? apparmor_socket_sendmsg+0x2a/0x30 [ 93.769008][ T9345] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 93.775229][ T9345] ? security_socket_sendmsg+0x8d/0xc0 [ 93.780701][ T9345] ? netlink_unicast+0x7e0/0x7e0 [ 93.785626][ T9345] sock_sendmsg+0xd7/0x130 [ 93.790057][ T9345] ____sys_sendmsg+0x753/0x880 [ 93.794807][ T9345] ? kernel_sendmsg+0x50/0x50 [ 93.799467][ T9345] ? lockdep_init_map+0x1be/0x6d0 [ 93.804483][ T9345] ___sys_sendmsg+0x100/0x170 [ 93.809151][ T9345] ? sendmsg_copy_msghdr+0x70/0x70 [ 93.814248][ T9345] ? __kasan_check_read+0x11/0x20 [ 93.819253][ T9345] ? __lock_acquire+0x8a0/0x4a00 [ 93.824177][ T9345] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 93.830530][ T9345] ? __this_cpu_preempt_check+0x35/0x190 [ 93.836176][ T9345] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 93.842399][ T9345] ? percpu_counter_add_batch+0x13c/0x190 [ 93.848103][ T9345] ? __fd_install+0x1bc/0x640 [ 93.852764][ T9345] ? find_held_lock+0x35/0x130 [ 93.857507][ T9345] ? __fd_install+0x1bc/0x640 [ 93.862175][ T9345] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 93.868398][ T9345] ? __fget_light+0x1ad/0x270 [ 93.873158][ T9345] ? __fdget+0x1b/0x20 [ 93.877210][ T9345] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 93.883433][ T9345] __sys_sendmsg+0x105/0x1d0 [ 93.888005][ T9345] ? __sys_sendmsg_sock+0xc0/0xc0 [ 93.893022][ T9345] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 93.898462][ T9345] ? do_syscall_64+0x26/0x790 [ 93.903116][ T9345] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 93.909201][ T9345] ? do_syscall_64+0x26/0x790 [ 93.913901][ T9345] __x64_sys_sendmsg+0x78/0xb0 [ 93.918678][ T9345] do_syscall_64+0xfa/0x790 [ 93.923175][ T9345] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 93.929048][ T9345] RIP: 0033:0x440559 [ 93.932926][ T9345] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 93.952610][ T9345] RSP: 002b:00007ffdf7cbc148 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 93.961002][ T9345] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440559 [ 93.968953][ T9345] RDX: 0000000000000080 RSI: 00000000200000c0 RDI: 0000000000000004 [ 93.976907][ T9345] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 93.984859][ T9345] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000401de0 [ 93.992817][ T9345] R13: 0000000000401e70 R14: 0000000000000000 R15: 0000000000000000 [ 94.000778][ T9345] [ 94.003088][ T9345] Allocated by task 9345: [ 94.007436][ T9345] save_stack+0x23/0x90 [ 94.011575][ T9345] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 94.017191][ T9345] kasan_kmalloc+0x9/0x10 [ 94.021541][ T9345] __kmalloc+0x163/0x770 [ 94.025764][ T9345] ip_set_alloc+0x38/0x5e [ 94.030071][ T9345] bitmap_ip_create+0x6ec/0xc20 [ 94.034900][ T9345] ip_set_create+0x6f1/0x1500 [ 94.039553][ T9345] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 94.044466][ T9345] netlink_rcv_skb+0x177/0x450 [ 94.049205][ T9345] nfnetlink_rcv+0x1ba/0x460 [ 94.053767][ T9345] netlink_unicast+0x59e/0x7e0 [ 94.058505][ T9345] netlink_sendmsg+0x91c/0xea0 [ 94.063244][ T9345] sock_sendmsg+0xd7/0x130 [ 94.067692][ T9345] ____sys_sendmsg+0x753/0x880 [ 94.072441][ T9345] ___sys_sendmsg+0x100/0x170 [ 94.077091][ T9345] __sys_sendmsg+0x105/0x1d0 [ 94.081658][ T9345] __x64_sys_sendmsg+0x78/0xb0 [ 94.086398][ T9345] do_syscall_64+0xfa/0x790 [ 94.090888][ T9345] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 94.096756][ T9345] [ 94.099056][ T9345] Freed by task 9070: [ 94.103015][ T9345] save_stack+0x23/0x90 [ 94.107147][ T9345] __kasan_slab_free+0x102/0x150 [ 94.112059][ T9345] kasan_slab_free+0xe/0x10 [ 94.116537][ T9345] kfree+0x10a/0x2c0 [ 94.120405][ T9345] tomoyo_path_perm+0x24e/0x430 [ 94.125229][ T9345] tomoyo_inode_getattr+0x1d/0x30 [ 94.130230][ T9345] security_inode_getattr+0xf2/0x150 [ 94.135490][ T9345] vfs_getattr+0x25/0x70 [ 94.139705][ T9345] vfs_statx+0x15d/0x200 [ 94.143924][ T9345] __do_sys_newstat+0xa4/0x130 [ 94.148660][ T9345] __x64_sys_newstat+0x54/0x80 [ 94.153399][ T9345] do_syscall_64+0xfa/0x790 [ 94.157880][ T9345] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 94.163739][ T9345] [ 94.166044][ T9345] The buggy address belongs to the object at ffff8880a6ecdf40 [ 94.166044][ T9345] which belongs to the cache kmalloc-32 of size 32 [ 94.179898][ T9345] The buggy address is located 0 bytes inside of [ 94.179898][ T9345] 32-byte region [ffff8880a6ecdf40, ffff8880a6ecdf60) [ 94.192877][ T9345] The buggy address belongs to the page: [ 94.198487][ T9345] page:ffffea00029bb340 refcount:1 mapcount:0 mapping:ffff8880aa4001c0 index:0xffff8880a6ecdfc1 [ 94.208879][ T9345] flags: 0xfffe0000000200(slab) [ 94.213707][ T9345] raw: 00fffe0000000200 ffffea00028e0e48 ffffea00027b5008 ffff8880aa4001c0 [ 94.222270][ T9345] raw: ffff8880a6ecdfc1 ffff8880a6ecd000 000000010000003f 0000000000000000 [ 94.230823][ T9345] page dumped because: kasan: bad access detected [ 94.237207][ T9345] [ 94.239507][ T9345] Memory state around the buggy address: [ 94.245116][ T9345] ffff8880a6ecde00: 00 fc fc fc fc fc fc fc 00 02 fc fc fc fc fc fc [ 94.253157][ T9345] ffff8880a6ecde80: 00 03 fc fc fc fc fc fc 00 03 fc fc fc fc fc fc [ 94.261190][ T9345] >ffff8880a6ecdf00: fb fb fb fb fc fc fc fc 04 fc fc fc fc fc fc fc [ 94.269245][ T9345] ^ [ 94.275373][ T9345] ffff8880a6ecdf80: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc [ 94.283417][ T9345] ffff8880a6ece000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.291449][ T9345] ================================================================== [ 94.299480][ T9345] Disabling lock debugging due to kernel taint [ 94.306374][ T9345] Kernel panic - not syncing: panic_on_warn set ... [ 94.312953][ T9345] CPU: 1 PID: 9345 Comm: syz-executor544 Tainted: G B 5.5.0-rc6-next-20200116-syzkaller #0 [ 94.324194][ T9345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 94.334220][ T9345] Call Trace: [ 94.337487][ T9345] dump_stack+0x197/0x210 [ 94.341882][ T9345] panic+0x2e3/0x75c [ 94.345786][ T9345] ? add_taint.cold+0x16/0x16 [ 94.350529][ T9345] ? bitmap_ip_list+0x40f/0xf20 [ 94.355355][ T9345] ? preempt_schedule+0x4b/0x60 [ 94.360194][ T9345] ? ___preempt_schedule+0x16/0x18 [ 94.365278][ T9345] ? trace_hardirqs_on+0x5e/0x240 [ 94.370271][ T9345] ? bitmap_ip_list+0x40f/0xf20 [ 94.375137][ T9345] end_report+0x47/0x4f [ 94.379260][ T9345] ? bitmap_ip_list+0x40f/0xf20 [ 94.384081][ T9345] __kasan_report.cold+0xe/0x32 [ 94.388940][ T9345] ? bitmap_ip_list+0x40f/0xf20 [ 94.393767][ T9345] kasan_report+0x12/0x20 [ 94.398067][ T9345] check_memory_region+0x134/0x1a0 [ 94.403161][ T9345] __kasan_check_read+0x11/0x20 [ 94.407999][ T9345] bitmap_ip_list+0x40f/0xf20 [ 94.412651][ T9345] ? bitmap_ip_add+0xe60/0xe60 [ 94.417390][ T9345] ? nla_put+0x110/0x150 [ 94.421631][ T9345] ip_set_dump_start+0x96c/0x1ca0 [ 94.426643][ T9345] ? ip_set_rename+0x720/0x720 [ 94.431477][ T9345] ? __kmalloc_reserve.isra.0+0x70/0xf0 [ 94.437000][ T9345] ? __lock_acquire+0x2660/0x4a00 [ 94.442003][ T9345] ? __kasan_check_write+0x14/0x20 [ 94.447088][ T9345] netlink_dump+0x558/0xfb0 [ 94.451564][ T9345] ? __netlink_sendskb+0xc0/0xc0 [ 94.456483][ T9345] __netlink_dump_start+0x673/0x930 [ 94.461668][ T9345] ip_set_dump+0x15a/0x1d0 [ 94.466059][ T9345] ? call_ad+0x5a0/0x5a0 [ 94.470269][ T9345] ? ip_set_rename+0x720/0x720 [ 94.475003][ T9345] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 94.480829][ T9345] ? call_ad+0x5a0/0x5a0 [ 94.485057][ T9345] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 94.489969][ T9345] ? nfnetlink_bind+0x2c0/0x2c0 [ 94.494843][ T9345] ? __kasan_check_read+0x11/0x20 [ 94.499844][ T9345] ? __lock_acquire+0x8a0/0x4a00 [ 94.504787][ T9345] ? save_stack+0x5c/0x90 [ 94.509198][ T9345] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 94.515410][ T9345] ? apparmor_capable+0x4df/0x910 [ 94.520409][ T9345] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 94.526618][ T9345] ? __kasan_check_read+0x11/0x20 [ 94.531647][ T9345] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 94.537077][ T9345] netlink_rcv_skb+0x177/0x450 [ 94.541816][ T9345] ? nfnetlink_bind+0x2c0/0x2c0 [ 94.546657][ T9345] ? netlink_ack+0xb50/0xb50 [ 94.551219][ T9345] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 94.557432][ T9345] ? ns_capable_common+0x93/0x100 [ 94.562432][ T9345] ? ns_capable+0x20/0x30 [ 94.566746][ T9345] ? __netlink_ns_capable+0x104/0x140 [ 94.572090][ T9345] nfnetlink_rcv+0x1ba/0x460 [ 94.576654][ T9345] ? nfnetlink_rcv_batch+0x1780/0x1780 [ 94.582085][ T9345] ? netlink_deliver_tap+0x248/0xbf0 [ 94.587343][ T9345] ? __kasan_check_write+0x14/0x20 [ 94.592426][ T9345] netlink_unicast+0x59e/0x7e0 [ 94.597168][ T9345] ? netlink_attachskb+0x870/0x870 [ 94.602253][ T9345] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 94.608030][ T9345] ? __check_object_size+0x3d/0x437 [ 94.613202][ T9345] netlink_sendmsg+0x91c/0xea0 [ 94.617937][ T9345] ? netlink_unicast+0x7e0/0x7e0 [ 94.622969][ T9345] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 94.628494][ T9345] ? apparmor_socket_sendmsg+0x2a/0x30 [ 94.633930][ T9345] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 94.640141][ T9345] ? security_socket_sendmsg+0x8d/0xc0 [ 94.645569][ T9345] ? netlink_unicast+0x7e0/0x7e0 [ 94.650476][ T9345] sock_sendmsg+0xd7/0x130 [ 94.654864][ T9345] ____sys_sendmsg+0x753/0x880 [ 94.659601][ T9345] ? kernel_sendmsg+0x50/0x50 [ 94.664247][ T9345] ? lockdep_init_map+0x1be/0x6d0 [ 94.669240][ T9345] ___sys_sendmsg+0x100/0x170 [ 94.673888][ T9345] ? sendmsg_copy_msghdr+0x70/0x70 [ 94.678971][ T9345] ? __kasan_check_read+0x11/0x20 [ 94.683967][ T9345] ? __lock_acquire+0x8a0/0x4a00 [ 94.688875][ T9345] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 94.695086][ T9345] ? __this_cpu_preempt_check+0x35/0x190 [ 94.700688][ T9345] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 94.706896][ T9345] ? percpu_counter_add_batch+0x13c/0x190 [ 94.712590][ T9345] ? __fd_install+0x1bc/0x640 [ 94.717238][ T9345] ? find_held_lock+0x35/0x130 [ 94.722036][ T9345] ? __fd_install+0x1bc/0x640 [ 94.726723][ T9345] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 94.732945][ T9345] ? __fget_light+0x1ad/0x270 [ 94.737599][ T9345] ? __fdget+0x1b/0x20 [ 94.741679][ T9345] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 94.747887][ T9345] __sys_sendmsg+0x105/0x1d0 [ 94.752447][ T9345] ? __sys_sendmsg_sock+0xc0/0xc0 [ 94.757447][ T9345] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 94.762902][ T9345] ? do_syscall_64+0x26/0x790 [ 94.767652][ T9345] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 94.773699][ T9345] ? do_syscall_64+0x26/0x790 [ 94.778352][ T9345] __x64_sys_sendmsg+0x78/0xb0 [ 94.783093][ T9345] do_syscall_64+0xfa/0x790 [ 94.787574][ T9345] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 94.793469][ T9345] RIP: 0033:0x440559 [ 94.797338][ T9345] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 94.817001][ T9345] RSP: 002b:00007ffdf7cbc148 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 94.825384][ T9345] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440559 [ 94.833338][ T9345] RDX: 0000000000000080 RSI: 00000000200000c0 RDI: 0000000000000004 [ 94.841282][ T9345] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 94.849316][ T9345] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000401de0 [ 94.857262][ T9345] R13: 0000000000401e70 R14: 0000000000000000 R15: 0000000000000000 [ 94.866475][ T9345] Kernel Offset: disabled [ 94.870802][ T9345] Rebooting in 86400 seconds..