[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[   86.977557][   T27] audit: type=1800 audit(1579408615.909:25): pid=9668 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0
[   86.997554][   T27] audit: type=1800 audit(1579408615.929:26): pid=9668 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0
[   87.029657][   T27] audit: type=1800 audit(1579408615.929:27): pid=9668 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added '10.128.0.102' (ECDSA) to the list of known hosts.
executing program
syzkaller login: [   96.668863][ T9820] ==================================================================
[   96.677276][ T9820] BUG: KASAN: slab-out-of-bounds in bitmap_ip_list+0x40f/0xf20
[   96.684884][ T9820] Read of size 8 at addr ffff8880a17c6a40 by task syz-executor299/9820
[   96.693199][ T9820] 
[   96.695516][ T9820] CPU: 1 PID: 9820 Comm: syz-executor299 Not tainted 5.5.0-rc5-syzkaller #0
[   96.704546][ T9820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   96.714593][ T9820] Call Trace:
[   96.717888][ T9820]  dump_stack+0x197/0x210
[   96.722212][ T9820]  ? bitmap_ip_list+0x40f/0xf20
[   96.727051][ T9820]  print_address_description.constprop.0.cold+0xd4/0x30b
[   96.734354][ T9820]  ? bitmap_ip_list+0x40f/0xf20
[   96.739210][ T9820]  ? bitmap_ip_list+0x40f/0xf20
[   96.744166][ T9820]  __kasan_report.cold+0x1b/0x41
[   96.749106][ T9820]  ? bitmap_ip_list+0x40f/0xf20
[   96.754057][ T9820]  kasan_report+0x12/0x20
[   96.758438][ T9820]  check_memory_region+0x134/0x1a0
[   96.763723][ T9820]  __kasan_check_read+0x11/0x20
[   96.768727][ T9820]  bitmap_ip_list+0x40f/0xf20
[   96.773456][ T9820]  ? bitmap_ip_add+0xe60/0xe60
[   96.778307][ T9820]  ? nla_put+0x110/0x150
[   96.782711][ T9820]  ip_set_dump_start+0x96c/0x1ca0
[   96.787731][ T9820]  ? ip_set_rename+0x720/0x720
[   96.792498][ T9820]  ? __kmalloc_reserve.isra.0+0xf0/0xf0
[   96.798215][ T9820]  ? perf_trace_lock_acquire+0x4b0/0x530
[   96.803851][ T9820]  ? __kasan_check_write+0x14/0x20
[   96.809051][ T9820]  netlink_dump+0x558/0xfb0
[   96.813558][ T9820]  ? __netlink_sendskb+0xc0/0xc0
[   96.818511][ T9820]  __netlink_dump_start+0x66a/0x930
[   96.823724][ T9820]  ip_set_dump+0x15a/0x1d0
[   96.828152][ T9820]  ? call_ad+0x5a0/0x5a0
[   96.832445][ T9820]  ? ip_set_rename+0x720/0x720
[   96.837219][ T9820]  ? __ip_set_put_netlink.isra.0+0x90/0x90
[   96.844121][ T9820]  ? call_ad+0x5a0/0x5a0
[   96.848573][ T9820]  nfnetlink_rcv_msg+0xcf2/0xfb0
[   96.853523][ T9820]  ? nfnetlink_bind+0x2c0/0x2c0
[   96.858372][ T9820]  ? __kasan_check_read+0x11/0x20
[   96.863400][ T9820]  ? __lock_acquire+0x8a0/0x4a00
[   96.868326][ T9820]  ? save_stack+0x5c/0x90
[   96.872664][ T9820]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   96.878940][ T9820]  ? apparmor_capable+0x497/0x900
[   96.883967][ T9820]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   96.890201][ T9820]  ? __kasan_check_read+0x11/0x20
[   96.895212][ T9820]  ? apparmor_cred_prepare+0x7b0/0x7b0
[   96.900724][ T9820]  netlink_rcv_skb+0x177/0x450
[   96.905713][ T9820]  ? nfnetlink_bind+0x2c0/0x2c0
[   96.910911][ T9820]  ? netlink_ack+0xb50/0xb50
[   96.915503][ T9820]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   96.921735][ T9820]  ? ns_capable_common+0x93/0x100
[   96.926764][ T9820]  ? ns_capable+0x20/0x30
[   96.931112][ T9820]  ? __netlink_ns_capable+0x104/0x140
[   96.936481][ T9820]  nfnetlink_rcv+0x1ba/0x460
[   96.941293][ T9820]  ? nfnetlink_rcv_batch+0x17a0/0x17a0
[   96.946744][ T9820]  ? netlink_deliver_tap+0x24a/0xbe0
[   96.952122][ T9820]  ? __kasan_check_write+0x14/0x20
[   96.957355][ T9820]  netlink_unicast+0x58c/0x7d0
[   96.962121][ T9820]  ? netlink_attachskb+0x870/0x870
[   96.967232][ T9820]  ? __sanitizer_cov_trace_cmp8+0x18/0x20
[   96.973167][ T9820]  ? __check_object_size+0x3d/0x437
[   96.978527][ T9820]  netlink_sendmsg+0x91c/0xea0
[   96.983308][ T9820]  ? netlink_unicast+0x7d0/0x7d0
[   96.988235][ T9820]  ? aa_sock_msg_perm.isra.0+0xba/0x170
[   96.993784][ T9820]  ? apparmor_socket_sendmsg+0x2a/0x30
[   96.999264][ T9820]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   97.005497][ T9820]  ? security_socket_sendmsg+0x8d/0xc0
[   97.010952][ T9820]  ? netlink_unicast+0x7d0/0x7d0
[   97.015982][ T9820]  sock_sendmsg+0xd7/0x130
[   97.020391][ T9820]  ____sys_sendmsg+0x753/0x880
[   97.025157][ T9820]  ? kernel_sendmsg+0x50/0x50
[   97.030540][ T9820]  ? lockdep_init_map+0x1be/0x6d0
[   97.035696][ T9820]  ___sys_sendmsg+0x100/0x170
[   97.040369][ T9820]  ? sendmsg_copy_msghdr+0x70/0x70
[   97.045484][ T9820]  ? __kasan_check_read+0x11/0x20
[   97.050539][ T9820]  ? __lock_acquire+0x8a0/0x4a00
[   97.055622][ T9820]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   97.061861][ T9820]  ? __this_cpu_preempt_check+0x35/0x190
[   97.067504][ T9820]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   97.073775][ T9820]  ? percpu_counter_add_batch+0x13c/0x190
[   97.079600][ T9820]  ? __fd_install+0x1bc/0x640
[   97.084732][ T9820]  ? find_held_lock+0x35/0x130
[   97.089520][ T9820]  ? __fd_install+0x1bc/0x640
[   97.094435][ T9820]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   97.100674][ T9820]  ? __fget_light+0x1a9/0x230
[   97.105357][ T9820]  ? __fdget+0x1b/0x20
[   97.109512][ T9820]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[   97.115790][ T9820]  __sys_sendmsg+0x105/0x1d0
[   97.120482][ T9820]  ? __sys_sendmsg_sock+0xc0/0xc0
[   97.125579][ T9820]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   97.131281][ T9820]  ? do_syscall_64+0x26/0x790
[   97.135949][ T9820]  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   97.142018][ T9820]  ? do_syscall_64+0x26/0x790
[   97.146940][ T9820]  __x64_sys_sendmsg+0x78/0xb0
[   97.151891][ T9820]  do_syscall_64+0xfa/0x790
[   97.156925][ T9820]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   97.163559][ T9820] RIP: 0033:0x440559
[   97.168224][ T9820] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
[   97.188056][ T9820] RSP: 002b:00007ffed73a3618 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[   97.197359][ T9820] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440559
[   97.205445][ T9820] RDX: 0000000000000080 RSI: 00000000200000c0 RDI: 0000000000000004
[   97.213527][ T9820] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8
[   97.221638][ T9820] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000401de0
[   97.229639][ T9820] R13: 0000000000401e70 R14: 0000000000000000 R15: 0000000000000000
[   97.237840][ T9820] 
[   97.240306][ T9820] Allocated by task 9820:
[   97.244719][ T9820]  save_stack+0x23/0x90
[   97.248873][ T9820]  __kasan_kmalloc.constprop.0+0xcf/0xe0
[   97.254652][ T9820]  kasan_kmalloc+0x9/0x10
[   97.259297][ T9820]  __kmalloc+0x163/0x770
[   97.264820][ T9820]  ip_set_alloc+0x38/0x5e
[   97.269148][ T9820]  bitmap_ip_create+0x6ec/0xc20
[   97.273991][ T9820]  ip_set_create+0x6f1/0x1500
[   97.278671][ T9820]  nfnetlink_rcv_msg+0xcf2/0xfb0
[   97.283705][ T9820]  netlink_rcv_skb+0x177/0x450
[   97.288479][ T9820]  nfnetlink_rcv+0x1ba/0x460
[   97.293068][ T9820]  netlink_unicast+0x58c/0x7d0
[   97.297987][ T9820]  netlink_sendmsg+0x91c/0xea0
[   97.304031][ T9820]  sock_sendmsg+0xd7/0x130
[   97.308447][ T9820]  ____sys_sendmsg+0x753/0x880
[   97.313380][ T9820]  ___sys_sendmsg+0x100/0x170
[   97.318051][ T9820]  __sys_sendmsg+0x105/0x1d0
[   97.322732][ T9820]  __x64_sys_sendmsg+0x78/0xb0
[   97.327494][ T9820]  do_syscall_64+0xfa/0x790
[   97.332278][ T9820]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   97.338356][ T9820] 
[   97.340689][ T9820] Freed by task 9545:
[   97.344672][ T9820]  save_stack+0x23/0x90
[   97.349149][ T9820]  __kasan_slab_free+0x102/0x150
[   97.354084][ T9820]  kasan_slab_free+0xe/0x10
[   97.358734][ T9820]  kfree+0x10a/0x2c0
[   97.363402][ T9820]  single_release+0x95/0xc0
[   97.367893][ T9820]  __fput+0x2ff/0x890
[   97.372001][ T9820]  ____fput+0x16/0x20
[   97.375967][ T9820]  task_work_run+0x145/0x1c0
[   97.380557][ T9820]  exit_to_usermode_loop+0x316/0x380
[   97.385988][ T9820]  do_syscall_64+0x676/0x790
[   97.390574][ T9820]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   97.396886][ T9820] 
[   97.399214][ T9820] The buggy address belongs to the object at ffff8880a17c6a40
[   97.399214][ T9820]  which belongs to the cache kmalloc-32 of size 32
[   97.413212][ T9820] The buggy address is located 0 bytes inside of
[   97.413212][ T9820]  32-byte region [ffff8880a17c6a40, ffff8880a17c6a60)
[   97.426398][ T9820] The buggy address belongs to the page:
[   97.432037][ T9820] page:ffffea000285f180 refcount:1 mapcount:0 mapping:ffff8880aa4001c0 index:0xffff8880a17c6fc1
[   97.442563][ T9820] raw: 00fffe0000000200 ffffea00029ee4c8 ffffea0002524588 ffff8880aa4001c0
[   97.451605][ T9820] raw: ffff8880a17c6fc1 ffff8880a17c6000 0000000100000033 0000000000000000
[   97.460726][ T9820] page dumped because: kasan: bad access detected
[   97.467185][ T9820] 
[   97.470208][ T9820] Memory state around the buggy address:
[   97.475916][ T9820]  ffff8880a17c6900: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
[   97.483976][ T9820]  ffff8880a17c6980: fb fb fb fb fc fc fc fc 00 07 fc fc fc fc fc fc
[   97.492077][ T9820] >ffff8880a17c6a00: fb fb fb fb fc fc fc fc 04 fc fc fc fc fc fc fc
[   97.500247][ T9820]                                            ^
[   97.506394][ T9820]  ffff8880a17c6a80: fb fb fb fb fc fc fc fc 00 00 fc fc fc fc fc fc
[   97.514888][ T9820]  ffff8880a17c6b00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
[   97.523042][ T9820] ==================================================================
[   97.531180][ T9820] Disabling lock debugging due to kernel taint
[   97.538912][ T9820] Kernel panic - not syncing: panic_on_warn set ...
[   97.545583][ T9820] CPU: 0 PID: 9820 Comm: syz-executor299 Tainted: G    B             5.5.0-rc5-syzkaller #0
[   97.555645][ T9820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   97.565690][ T9820] Call Trace:
[   97.568973][ T9820]  dump_stack+0x197/0x210
[   97.573291][ T9820]  panic+0x2e3/0x75c
[   97.577169][ T9820]  ? add_taint.cold+0x16/0x16
[   97.583951][ T9820]  ? bitmap_ip_list+0x40f/0xf20
[   97.589499][ T9820]  ? preempt_schedule+0x4b/0x60
[   97.594552][ T9820]  ? ___preempt_schedule+0x16/0x18
[   97.599800][ T9820]  ? trace_hardirqs_on+0x5e/0x240
[   97.604922][ T9820]  ? bitmap_ip_list+0x40f/0xf20
[   97.609830][ T9820]  end_report+0x47/0x4f
[   97.613985][ T9820]  ? bitmap_ip_list+0x40f/0xf20
[   97.618933][ T9820]  __kasan_report.cold+0xe/0x41
[   97.624082][ T9820]  ? bitmap_ip_list+0x40f/0xf20
[   97.628932][ T9820]  kasan_report+0x12/0x20
[   97.633267][ T9820]  check_memory_region+0x134/0x1a0
[   97.638414][ T9820]  __kasan_check_read+0x11/0x20
[   97.643348][ T9820]  bitmap_ip_list+0x40f/0xf20
[   97.648153][ T9820]  ? bitmap_ip_add+0xe60/0xe60
[   97.652912][ T9820]  ? nla_put+0x110/0x150
[   97.657371][ T9820]  ip_set_dump_start+0x96c/0x1ca0
[   97.662916][ T9820]  ? ip_set_rename+0x720/0x720
[   97.667886][ T9820]  ? __kmalloc_reserve.isra.0+0xf0/0xf0
[   97.673466][ T9820]  ? perf_trace_lock_acquire+0x4b0/0x530
[   97.679099][ T9820]  ? __kasan_check_write+0x14/0x20
[   97.684429][ T9820]  netlink_dump+0x558/0xfb0
[   97.689067][ T9820]  ? __netlink_sendskb+0xc0/0xc0
[   97.694005][ T9820]  __netlink_dump_start+0x66a/0x930
[   97.699366][ T9820]  ip_set_dump+0x15a/0x1d0
[   97.703784][ T9820]  ? call_ad+0x5a0/0x5a0
[   97.708146][ T9820]  ? ip_set_rename+0x720/0x720
[   97.712953][ T9820]  ? __ip_set_put_netlink.isra.0+0x90/0x90
[   97.718870][ T9820]  ? call_ad+0x5a0/0x5a0
[   97.723192][ T9820]  nfnetlink_rcv_msg+0xcf2/0xfb0
[   97.728276][ T9820]  ? nfnetlink_bind+0x2c0/0x2c0
[   97.733236][ T9820]  ? __kasan_check_read+0x11/0x20
[   97.738244][ T9820]  ? __lock_acquire+0x8a0/0x4a00
[   97.743279][ T9820]  ? save_stack+0x5c/0x90
[   97.747611][ T9820]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   97.753951][ T9820]  ? apparmor_capable+0x497/0x900
[   97.758975][ T9820]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   97.768077][ T9820]  ? __kasan_check_read+0x11/0x20
[   97.773097][ T9820]  ? apparmor_cred_prepare+0x7b0/0x7b0
[   97.778554][ T9820]  netlink_rcv_skb+0x177/0x450
[   97.783321][ T9820]  ? nfnetlink_bind+0x2c0/0x2c0
[   97.788169][ T9820]  ? netlink_ack+0xb50/0xb50
[   97.792764][ T9820]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   97.798996][ T9820]  ? ns_capable_common+0x93/0x100
[   97.804030][ T9820]  ? ns_capable+0x20/0x30
[   97.808355][ T9820]  ? __netlink_ns_capable+0x104/0x140
[   97.815215][ T9820]  nfnetlink_rcv+0x1ba/0x460
[   97.819787][ T9820]  ? nfnetlink_rcv_batch+0x17a0/0x17a0
[   97.825237][ T9820]  ? netlink_deliver_tap+0x24a/0xbe0
[   97.830659][ T9820]  ? __kasan_check_write+0x14/0x20
[   97.835781][ T9820]  netlink_unicast+0x58c/0x7d0
[   97.840533][ T9820]  ? netlink_attachskb+0x870/0x870
[   97.845690][ T9820]  ? __sanitizer_cov_trace_cmp8+0x18/0x20
[   97.851395][ T9820]  ? __check_object_size+0x3d/0x437
[   97.856595][ T9820]  netlink_sendmsg+0x91c/0xea0
[   97.861378][ T9820]  ? netlink_unicast+0x7d0/0x7d0
[   97.866413][ T9820]  ? aa_sock_msg_perm.isra.0+0xba/0x170
[   97.871982][ T9820]  ? apparmor_socket_sendmsg+0x2a/0x30
[   97.877559][ T9820]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   97.883927][ T9820]  ? security_socket_sendmsg+0x8d/0xc0
[   97.889403][ T9820]  ? netlink_unicast+0x7d0/0x7d0
[   97.894341][ T9820]  sock_sendmsg+0xd7/0x130
[   97.898775][ T9820]  ____sys_sendmsg+0x753/0x880
[   97.903641][ T9820]  ? kernel_sendmsg+0x50/0x50
[   97.908324][ T9820]  ? lockdep_init_map+0x1be/0x6d0
[   97.913361][ T9820]  ___sys_sendmsg+0x100/0x170
[   97.918081][ T9820]  ? sendmsg_copy_msghdr+0x70/0x70
[   97.923311][ T9820]  ? __kasan_check_read+0x11/0x20
[   97.928460][ T9820]  ? __lock_acquire+0x8a0/0x4a00
[   97.933746][ T9820]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   97.939975][ T9820]  ? __this_cpu_preempt_check+0x35/0x190
[   97.945607][ T9820]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   97.951958][ T9820]  ? percpu_counter_add_batch+0x13c/0x190
[   97.957787][ T9820]  ? __fd_install+0x1bc/0x640
[   97.962457][ T9820]  ? find_held_lock+0x35/0x130
[   97.967214][ T9820]  ? __fd_install+0x1bc/0x640
[   97.971985][ T9820]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[   97.978226][ T9820]  ? __fget_light+0x1a9/0x230
[   97.982903][ T9820]  ? __fdget+0x1b/0x20
[   97.986979][ T9820]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[   97.993217][ T9820]  __sys_sendmsg+0x105/0x1d0
[   97.997799][ T9820]  ? __sys_sendmsg_sock+0xc0/0xc0
[   98.002938][ T9820]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   98.008600][ T9820]  ? do_syscall_64+0x26/0x790
[   98.013273][ T9820]  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   98.019510][ T9820]  ? do_syscall_64+0x26/0x790
[   98.024199][ T9820]  __x64_sys_sendmsg+0x78/0xb0
[   98.029120][ T9820]  do_syscall_64+0xfa/0x790
[   98.034061][ T9820]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   98.040815][ T9820] RIP: 0033:0x440559
[   98.044700][ T9820] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
[   98.064532][ T9820] RSP: 002b:00007ffed73a3618 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[   98.072938][ T9820] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440559
[   98.081108][ T9820] RDX: 0000000000000080 RSI: 00000000200000c0 RDI: 0000000000000004
[   98.090133][ T9820] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8
[   98.098143][ T9820] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000401de0
[   98.106863][ T9820] R13: 0000000000401e70 R14: 0000000000000000 R15: 0000000000000000
[   98.116395][ T9820] Kernel Offset: disabled
[   98.120739][ T9820] Rebooting in 86400 seconds..