[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [ 71.387299][ T26] audit: type=1800 audit(1577203460.800:25): pid=9218 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 71.420682][ T26] audit: type=1800 audit(1577203460.810:26): pid=9218 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 71.461677][ T26] audit: type=1800 audit(1577203460.810:27): pid=9218 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.2' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 82.474600][ T9372] netlink: 2 bytes leftover after parsing attributes in process `syz-executor569'. [ 82.510824][ C0] ================================================================== [ 82.519232][ C0] BUG: KASAN: use-after-free in __alloc_skb+0x37b/0x5e0 [ 82.526705][ C0] Write of size 32 at addr ffff88819ef1b3c0 by task net.agent/9374 [ 82.534604][ C0] [ 82.536953][ C0] CPU: 0 PID: 9374 Comm: net.agent Not tainted 5.5.0-rc2-next-20191220-syzkaller #0 [ 82.546322][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 82.556388][ C0] Call Trace: [ 82.559679][ C0] <IRQ> [ 82.562545][ C0] dump_stack+0x197/0x210 [ 82.566894][ C0] ? __alloc_skb+0x37b/0x5e0 [ 82.571507][ C0] print_address_description.constprop.0.cold+0xd4/0x30b [ 82.578543][ C0] ? __alloc_skb+0x37b/0x5e0 [ 82.583181][ C0] ? __alloc_skb+0x37b/0x5e0 [ 82.587801][ C0] __kasan_report.cold+0x1b/0x41 [ 82.592760][ C0] ? __alloc_skb+0x37b/0x5e0 [ 82.598331][ C0] kasan_report+0x12/0x20 [ 82.602675][ C0] check_memory_region+0x134/0x1a0 [ 82.607804][ C0] memset+0x24/0x40 [ 82.611629][ C0] __alloc_skb+0x37b/0x5e0 [ 82.616060][ C0] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 82.621969][ C0] ? print_circular_bug.isra.0+0x230/0x230 [ 82.627799][ C0] igmpv3_newpack+0x1b9/0x1110 [ 82.632603][ C0] ? ip_mc_join_group+0x30/0x30 [ 82.637474][ C0] ? __kasan_check_read+0x11/0x20 [ 82.642512][ C0] ? __lock_acquire+0x16f2/0x4a00 [ 82.647729][ C0] add_grhead.isra.0+0x235/0x300 [ 82.652682][ C0] add_grec+0x842/0x1230 [ 82.656942][ C0] ? do_raw_spin_lock+0x139/0x2f0 [ 82.661983][ C0] ? rwlock_bug.part.0+0x90/0x90 [ 82.666929][ C0] ? add_grhead.isra.0+0x300/0x300 [ 82.672067][ C0] igmp_ifc_timer_expire+0x4af/0xab0 [ 82.677375][ C0] call_timer_fn+0x1ac/0x780 [ 82.681983][ C0] ? __ip_mc_dec_group+0x520/0x520 [ 82.687109][ C0] ? msleep_interruptible+0x150/0x150 [ 82.692500][ C0] ? run_timer_softirq+0x6b1/0x1790 [ 82.697721][ C0] ? trace_hardirqs_on+0x67/0x240 [ 82.702760][ C0] ? __ip_mc_dec_group+0x520/0x520 [ 82.707888][ C0] ? __ip_mc_dec_group+0x520/0x520 [ 82.713030][ C0] run_timer_softirq+0x6c3/0x1790 [ 82.718084][ C0] ? add_timer+0x940/0x940 [ 82.722515][ C0] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 82.728713][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 82.734276][ C0] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 82.740275][ C0] ? trace_hardirqs_on+0x67/0x240 [ 82.745319][ C0] __do_softirq+0x262/0x98c [ 82.749830][ C0] ? sched_clock_cpu+0x1b/0x1b0 [ 82.754708][ C0] irq_exit+0x19b/0x1e0 [ 82.758875][ C0] smp_apic_timer_interrupt+0x1a3/0x610 [ 82.764442][ C0] apic_timer_interrupt+0xf/0x20 [ 82.769415][ C0] </IRQ> [ 82.772369][ C0] RIP: 0010:kernel_poison_pages+0x8/0x2b0 [ 82.778096][ C0] Code: cc cc 55 48 89 e5 e8 f7 c7 c2 ff 0f b6 05 c0 e8 ce 08 5d c3 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 41 56 <41> 55 49 89 fd 41 54 41 89 f4 53 89 d3 48 83 ec 10 e8 c2 c7 c2 ff [ 82.798058][ C0] RSP: 0018:ffffc90001d87480 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 [ 82.806486][ C0] RAX: ffffed1012a3d800 RBX: 0000000000000301 RCX: 0000000000000000 [ 82.814487][ C0] RDX: 0000000000000001 RSI: 0000000000000001 RDI: ffffea0002547b00 [ 82.822494][ C0] RBP: ffffc90001d87490 R08: 1ffffd40004a8f66 R09: ffffed1012a3d800 [ 82.830475][ C0] R10: fffff940004a8f66 R11: ffffea0002547b37 R12: ffffea0002547b00 [ 82.838458][ C0] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000400dc0 [ 82.846469][ C0] prep_new_page+0x11d/0x200 [ 82.851076][ C0] get_page_from_freelist+0x1741/0x42e0 [ 82.856647][ C0] ? __alloc_pages_nodemask+0x53d/0x910 [ 82.862226][ C0] ? __isolate_free_page+0x4c0/0x4c0 [ 82.867520][ C0] ? ___might_sleep+0x163/0x2c0 [ 82.872387][ C0] ? __might_sleep+0x95/0x190 [ 82.877079][ C0] __alloc_pages_nodemask+0x2d0/0x910 [ 82.882468][ C0] ? __pmd_alloc+0x377/0x460 [ 82.887076][ C0] ? __alloc_pages_slowpath+0x2900/0x2900 [ 82.892815][ C0] ? __pmd_alloc+0x377/0x460 [ 82.897423][ C0] ? lock_downgrade+0x920/0x920 [ 82.902289][ C0] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 82.908546][ C0] alloc_pages_current+0x107/0x210 [ 82.913682][ C0] pte_alloc_one+0x1b/0x1a0 [ 82.918202][ C0] __pte_alloc+0x20/0x310 [ 82.922549][ C0] copy_page_range+0x1629/0x20e0 [ 82.927527][ C0] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 82.933093][ C0] ? validate_mm_rb+0xa3/0xc0 [ 82.937791][ C0] ? __vma_link_rb+0x5ad/0x770 [ 82.942568][ C0] ? anon_vma_fork+0xd4/0x4a0 [ 82.947261][ C0] dup_mm+0xa67/0x1430 [ 82.951355][ C0] ? vm_area_dup+0x170/0x170 [ 82.955963][ C0] ? debug_mutex_init+0x2d/0x60 [ 82.960830][ C0] copy_process+0x2ad6/0x7220 [ 82.965516][ C0] ? find_held_lock+0x35/0x130 [ 82.970294][ C0] ? debug_object_active_state+0x28a/0x350 [ 82.976132][ C0] ? __cleanup_sighand+0xc0/0xc0 [ 82.981082][ C0] ? __kasan_check_read+0x11/0x20 [ 82.986130][ C0] _do_fork+0x146/0x1090 [ 82.990383][ C0] ? copy_init_mm+0x20/0x20 [ 82.994978][ C0] ? find_held_lock+0x35/0x130 [ 82.999767][ C0] ? task_work_run+0x118/0x1c0 [ 83.004556][ C0] ? lock_downgrade+0x920/0x920 [ 83.009438][ C0] __x64_sys_clone+0x19a/0x260 [ 83.014226][ C0] ? __ia32_sys_vfork+0xd0/0xd0 [ 83.019106][ C0] ? lockdep_hardirqs_on+0x421/0x5e0 [ 83.025087][ C0] ? trace_hardirqs_on+0x67/0x240 [ 83.030100][ C0] do_syscall_64+0xfa/0x790 [ 83.034636][ C0] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 83.040528][ C0] RIP: 0033:0x7faaf07ddf46 [ 83.044946][ C0] Code: f7 d8 64 89 04 25 d4 02 00 00 64 4c 8b 14 25 10 00 00 00 31 d2 49 81 c2 d0 02 00 00 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 31 01 00 00 85 c0 41 89 c4 0f 85 3b 01 00 [ 83.064595][ C0] RSP: 002b:00007ffc4d094490 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 83.073172][ C0] RAX: ffffffffffffffda RBX: 00007ffc4d094490 RCX: 00007faaf07ddf46 [ 83.081187][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 83.089186][ C0] RBP: 00007ffc4d0944d0 R08: 0000000000000000 R09: 000000000000249e [ 83.097146][ C0] R10: 00007faaf0cd49d0 R11: 0000000000000246 R12: 0000000000000000 [ 83.105099][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 83.115065][ C0] [ 83.117371][ C0] The buggy address belongs to the page: [ 83.122998][ C0] page:ffffea00067bc6c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 [ 83.132085][ C0] raw: 057ffe0000000000 ffffea00067bc6c8 ffffea00067bc6c8 0000000000000000 [ 83.140662][ C0] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 83.149220][ C0] page dumped because: kasan: bad access detected [ 83.155796][ C0] [ 83.158117][ C0] Memory state around the buggy address: [ 83.163798][ C0] ffff88819ef1b280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 83.171941][ C0] ffff88819ef1b300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 83.180152][ C0] >ffff88819ef1b380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 83.188341][ C0] ^ [ 83.194522][ C0] ffff88819ef1b400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 83.202565][ C0] ffff88819ef1b480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 83.210602][ C0] ================================================================== [ 83.218639][ C0] Disabling lock debugging due to kernel taint [ 83.224812][ C0] Kernel panic - not syncing: panic_on_warn set ... [ 83.231413][ C0] CPU: 0 PID: 9374 Comm: net.agent Tainted: G B 5.5.0-rc2-next-20191220-syzkaller #0 [ 83.242283][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 83.252313][ C0] Call Trace: [ 83.255600][ C0] <IRQ> [ 83.258444][ C0] dump_stack+0x197/0x210 [ 83.262764][ C0] panic+0x2e3/0x75c [ 83.266644][ C0] ? add_taint.cold+0x16/0x16 [ 83.271327][ C0] ? retint_kernel+0x2b/0x2b [ 83.275920][ C0] ? trace_hardirqs_on+0x5e/0x240 [ 83.280934][ C0] ? __alloc_skb+0x37b/0x5e0 [ 83.285511][ C0] end_report+0x47/0x4f [ 83.289662][ C0] ? __alloc_skb+0x37b/0x5e0 [ 83.294248][ C0] __kasan_report.cold+0xe/0x41 [ 83.299088][ C0] ? __alloc_skb+0x37b/0x5e0 [ 83.303678][ C0] kasan_report+0x12/0x20 [ 83.308115][ C0] check_memory_region+0x134/0x1a0 [ 83.313223][ C0] memset+0x24/0x40 [ 83.317053][ C0] __alloc_skb+0x37b/0x5e0 [ 83.321461][ C0] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 83.326992][ C0] ? print_circular_bug.isra.0+0x230/0x230 [ 83.332796][ C0] igmpv3_newpack+0x1b9/0x1110 [ 83.337556][ C0] ? ip_mc_join_group+0x30/0x30 [ 83.342392][ C0] ? __kasan_check_read+0x11/0x20 [ 83.347408][ C0] ? __lock_acquire+0x16f2/0x4a00 [ 83.352411][ C0] add_grhead.isra.0+0x235/0x300 [ 83.357447][ C0] add_grec+0x842/0x1230 [ 83.361671][ C0] ? do_raw_spin_lock+0x139/0x2f0 [ 83.366672][ C0] ? rwlock_bug.part.0+0x90/0x90 [ 83.371588][ C0] ? add_grhead.isra.0+0x300/0x300 [ 83.377761][ C0] igmp_ifc_timer_expire+0x4af/0xab0 [ 83.383053][ C0] call_timer_fn+0x1ac/0x780 [ 83.387633][ C0] ? __ip_mc_dec_group+0x520/0x520 [ 83.392733][ C0] ? msleep_interruptible+0x150/0x150 [ 83.398082][ C0] ? run_timer_softirq+0x6b1/0x1790 [ 83.403262][ C0] ? trace_hardirqs_on+0x67/0x240 [ 83.408263][ C0] ? __ip_mc_dec_group+0x520/0x520 [ 83.413437][ C0] ? __ip_mc_dec_group+0x520/0x520 [ 83.418550][ C0] run_timer_softirq+0x6c3/0x1790 [ 83.423588][ C0] ? add_timer+0x940/0x940 [ 83.427996][ C0] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 83.434291][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 83.439862][ C0] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 83.445859][ C0] ? trace_hardirqs_on+0x67/0x240 [ 83.450891][ C0] __do_softirq+0x262/0x98c [ 83.455392][ C0] ? sched_clock_cpu+0x1b/0x1b0 [ 83.460244][ C0] irq_exit+0x19b/0x1e0 [ 83.464409][ C0] smp_apic_timer_interrupt+0x1a3/0x610 [ 83.470297][ C0] apic_timer_interrupt+0xf/0x20 [ 83.475298][ C0] </IRQ> [ 83.478218][ C0] RIP: 0010:kernel_poison_pages+0x8/0x2b0 [ 83.483918][ C0] Code: cc cc 55 48 89 e5 e8 f7 c7 c2 ff 0f b6 05 c0 e8 ce 08 5d c3 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 41 56 <41> 55 49 89 fd 41 54 41 89 f4 53 89 d3 48 83 ec 10 e8 c2 c7 c2 ff [ 83.503850][ C0] RSP: 0018:ffffc90001d87480 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 [ 83.512241][ C0] RAX: ffffed1012a3d800 RBX: 0000000000000301 RCX: 0000000000000000 [ 83.520189][ C0] RDX: 0000000000000001 RSI: 0000000000000001 RDI: ffffea0002547b00 [ 83.528312][ C0] RBP: ffffc90001d87490 R08: 1ffffd40004a8f66 R09: ffffed1012a3d800 [ 83.536272][ C0] R10: fffff940004a8f66 R11: ffffea0002547b37 R12: ffffea0002547b00 [ 83.544382][ C0] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000400dc0 [ 83.552354][ C0] prep_new_page+0x11d/0x200 [ 83.556971][ C0] get_page_from_freelist+0x1741/0x42e0 [ 83.562523][ C0] ? __alloc_pages_nodemask+0x53d/0x910 [ 83.568055][ C0] ? __isolate_free_page+0x4c0/0x4c0 [ 83.573405][ C0] ? ___might_sleep+0x163/0x2c0 [ 83.578230][ C0] ? __might_sleep+0x95/0x190 [ 83.582903][ C0] __alloc_pages_nodemask+0x2d0/0x910 [ 83.588267][ C0] ? __pmd_alloc+0x377/0x460 [ 83.592858][ C0] ? __alloc_pages_slowpath+0x2900/0x2900 [ 83.598563][ C0] ? __pmd_alloc+0x377/0x460 [ 83.603257][ C0] ? lock_downgrade+0x920/0x920 [ 83.608113][ C0] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 83.614361][ C0] alloc_pages_current+0x107/0x210 [ 83.619478][ C0] pte_alloc_one+0x1b/0x1a0 [ 83.623990][ C0] __pte_alloc+0x20/0x310 [ 83.628327][ C0] copy_page_range+0x1629/0x20e0 [ 83.633253][ C0] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 83.638818][ C0] ? validate_mm_rb+0xa3/0xc0 [ 83.643501][ C0] ? __vma_link_rb+0x5ad/0x770 [ 83.648244][ C0] ? anon_vma_fork+0xd4/0x4a0 [ 83.652905][ C0] dup_mm+0xa67/0x1430 [ 83.656958][ C0] ? vm_area_dup+0x170/0x170 [ 83.661530][ C0] ? debug_mutex_init+0x2d/0x60 [ 83.666374][ C0] copy_process+0x2ad6/0x7220 [ 83.671028][ C0] ? find_held_lock+0x35/0x130 [ 83.675792][ C0] ? debug_object_active_state+0x28a/0x350 [ 83.681601][ C0] ? __cleanup_sighand+0xc0/0xc0 [ 83.686667][ C0] ? __kasan_check_read+0x11/0x20 [ 83.691705][ C0] _do_fork+0x146/0x1090 [ 83.696136][ C0] ? copy_init_mm+0x20/0x20 [ 83.700634][ C0] ? find_held_lock+0x35/0x130 [ 83.705394][ C0] ? task_work_run+0x118/0x1c0 [ 83.710136][ C0] ? lock_downgrade+0x920/0x920 [ 83.715167][ C0] __x64_sys_clone+0x19a/0x260 [ 83.719947][ C0] ? __ia32_sys_vfork+0xd0/0xd0 [ 83.724832][ C0] ? lockdep_hardirqs_on+0x421/0x5e0 [ 83.730117][ C0] ? trace_hardirqs_on+0x67/0x240 [ 83.735128][ C0] do_syscall_64+0xfa/0x790 [ 83.739613][ C0] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 83.745484][ C0] RIP: 0033:0x7faaf07ddf46 [ 83.749877][ C0] Code: f7 d8 64 89 04 25 d4 02 00 00 64 4c 8b 14 25 10 00 00 00 31 d2 49 81 c2 d0 02 00 00 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 31 01 00 00 85 c0 41 89 c4 0f 85 3b 01 00 [ 83.769472][ C0] RSP: 002b:00007ffc4d094490 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 83.777862][ C0] RAX: ffffffffffffffda RBX: 00007ffc4d094490 RCX: 00007faaf07ddf46 [ 83.785900][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 83.793875][ C0] RBP: 00007ffc4d0944d0 R08: 0000000000000000 R09: 000000000000249e [ 83.801846][ C0] R10: 00007faaf0cd49d0 R11: 0000000000000246 R12: 0000000000000000 [ 83.809844][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 83.819668][ C0] Kernel Offset: disabled [ 83.824020][ C0] Rebooting in 86400 seconds..