[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [ 101.466920][ T27] kauditd_printk_skb: 4 callbacks suppressed [ 101.466933][ T27] audit: type=1800 audit(1579432056.419:29): pid=9824 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 101.494183][ T27] audit: type=1800 audit(1579432056.419:30): pid=9824 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.38' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 111.063554][ T9977] ================================================================== [ 111.071920][ T9977] BUG: KASAN: slab-out-of-bounds in bitmap_ipmac_list+0x635/0x1080 [ 111.079850][ T9977] Read of size 8 at addr ffff88809d6b3180 by task syz-executor564/9977 [ 111.088122][ T9977] [ 111.090451][ T9977] CPU: 1 PID: 9977 Comm: syz-executor564 Not tainted 5.5.0-rc5-syzkaller #0 [ 111.099106][ T9977] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 111.109149][ T9977] Call Trace: [ 111.112434][ T9977] dump_stack+0x197/0x210 [ 111.116765][ T9977] ? bitmap_ipmac_list+0x635/0x1080 [ 111.121976][ T9977] print_address_description.constprop.0.cold+0xd4/0x30b [ 111.129033][ T9977] ? bitmap_ipmac_list+0x635/0x1080 [ 111.134267][ T9977] ? bitmap_ipmac_list+0x635/0x1080 [ 111.139459][ T9977] __kasan_report.cold+0x1b/0x41 [ 111.144396][ T9977] ? bitmap_ipmac_list+0x635/0x1080 [ 111.149673][ T9977] kasan_report+0x12/0x20 [ 111.153984][ T9977] check_memory_region+0x134/0x1a0 [ 111.159100][ T9977] __kasan_check_read+0x11/0x20 [ 111.163996][ T9977] bitmap_ipmac_list+0x635/0x1080 [ 111.169019][ T9977] ? bitmap_ipmac_head+0x8a0/0x8a0 [ 111.174132][ T9977] ? nla_put+0x110/0x150 [ 111.179993][ T9977] ip_set_dump_start+0x96c/0x1ca0 [ 111.185072][ T9977] ? ip_set_rename+0x720/0x720 [ 111.189897][ T9977] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 111.195439][ T9977] ? perf_trace_lock_acquire+0x4b0/0x530 [ 111.201286][ T9977] ? __kasan_check_write+0x14/0x20 [ 111.206530][ T9977] netlink_dump+0x558/0xfb0 [ 111.211521][ T9977] ? __netlink_sendskb+0xc0/0xc0 [ 111.216449][ T9977] __netlink_dump_start+0x66a/0x930 [ 111.221865][ T9977] ip_set_dump+0x15a/0x1d0 [ 111.226262][ T9977] ? call_ad+0x5a0/0x5a0 [ 111.230488][ T9977] ? ip_set_rename+0x720/0x720 [ 111.242295][ T9977] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 111.248269][ T9977] ? call_ad+0x5a0/0x5a0 [ 111.252757][ T9977] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 111.257907][ T9977] ? nfnetlink_bind+0x2c0/0x2c0 [ 111.262771][ T9977] ? __kasan_check_read+0x11/0x20 [ 111.267841][ T9977] ? __lock_acquire+0x8a0/0x4a00 [ 111.272819][ T9977] ? save_stack+0x5c/0x90 [ 111.277769][ T9977] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 111.284719][ T9977] ? apparmor_capable+0x497/0x900 [ 111.289731][ T9977] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 111.296107][ T9977] ? __kasan_check_read+0x11/0x20 [ 111.301240][ T9977] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 111.306746][ T9977] netlink_rcv_skb+0x177/0x450 [ 111.311502][ T9977] ? nfnetlink_bind+0x2c0/0x2c0 [ 111.316341][ T9977] ? netlink_ack+0xb50/0xb50 [ 111.320923][ T9977] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 111.327159][ T9977] ? ns_capable_common+0x93/0x100 [ 111.332235][ T9977] ? ns_capable+0x20/0x30 [ 111.336566][ T9977] ? __netlink_ns_capable+0x104/0x140 [ 111.341930][ T9977] nfnetlink_rcv+0x1ba/0x460 [ 111.346508][ T9977] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 111.351965][ T9977] ? netlink_deliver_tap+0x24a/0xbe0 [ 111.357247][ T9977] ? __kasan_check_write+0x14/0x20 [ 111.362371][ T9977] netlink_unicast+0x58c/0x7d0 [ 111.367167][ T9977] ? netlink_attachskb+0x870/0x870 [ 111.372275][ T9977] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 111.378212][ T9977] ? __check_object_size+0x3d/0x437 [ 111.383427][ T9977] netlink_sendmsg+0x91c/0xea0 [ 111.388449][ T9977] ? netlink_unicast+0x7d0/0x7d0 [ 111.393368][ T9977] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 111.401324][ T9977] ? apparmor_socket_sendmsg+0x2a/0x30 [ 111.406873][ T9977] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 111.413128][ T9977] ? security_socket_sendmsg+0x8d/0xc0 [ 111.418590][ T9977] ? netlink_unicast+0x7d0/0x7d0 [ 111.428308][ T9977] sock_sendmsg+0xd7/0x130 [ 111.432889][ T9977] ____sys_sendmsg+0x753/0x880 [ 111.437755][ T9977] ? kernel_sendmsg+0x50/0x50 [ 111.442457][ T9977] ? lockdep_init_map+0x1be/0x6d0 [ 111.447483][ T9977] ___sys_sendmsg+0x100/0x170 [ 111.452208][ T9977] ? sendmsg_copy_msghdr+0x70/0x70 [ 111.461850][ T9977] ? __kasan_check_read+0x11/0x20 [ 111.466877][ T9977] ? __lock_acquire+0x8a0/0x4a00 [ 111.472282][ T9977] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 111.478696][ T9977] ? __this_cpu_preempt_check+0x35/0x190 [ 111.484455][ T9977] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 111.490701][ T9977] ? percpu_counter_add_batch+0x13c/0x190 [ 111.496405][ T9977] ? __fd_install+0x1bc/0x640 [ 111.501117][ T9977] ? find_held_lock+0x35/0x130 [ 111.505875][ T9977] ? __fd_install+0x1bc/0x640 [ 111.510629][ T9977] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 111.516866][ T9977] ? __fget_light+0x1a9/0x230 [ 111.521655][ T9977] ? __fdget+0x1b/0x20 [ 111.525723][ T9977] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 111.531965][ T9977] __sys_sendmsg+0x105/0x1d0 [ 111.536565][ T9977] ? __sys_sendmsg_sock+0xc0/0xc0 [ 111.541930][ T9977] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 111.547413][ T9977] ? do_syscall_64+0x26/0x790 [ 111.552086][ T9977] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 111.558166][ T9977] ? do_syscall_64+0x26/0x790 [ 111.562859][ T9977] __x64_sys_sendmsg+0x78/0xb0 [ 111.567622][ T9977] do_syscall_64+0xfa/0x790 [ 111.572536][ T9977] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 111.578458][ T9977] RIP: 0033:0x4402c9 [ 111.582345][ T9977] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 111.602159][ T9977] RSP: 002b:00007ffcf78b5598 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 111.610571][ T9977] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004402c9 [ 111.618646][ T9977] RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000004 [ 111.626661][ T9977] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 111.634628][ T9977] R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000401b50 [ 111.642590][ T9977] R13: 0000000000401be0 R14: 0000000000000000 R15: 0000000000000000 [ 111.650562][ T9977] [ 111.652876][ T9977] Allocated by task 9977: [ 111.657273][ T9977] save_stack+0x23/0x90 [ 111.661544][ T9977] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 111.667240][ T9977] kasan_kmalloc+0x9/0x10 [ 111.671575][ T9977] __kmalloc+0x163/0x770 [ 111.675826][ T9977] ip_set_alloc+0x38/0x5e [ 111.680146][ T9977] bitmap_ipmac_create+0x4e8/0xa00 [ 111.685252][ T9977] ip_set_create+0x6f1/0x1500 [ 111.690051][ T9977] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 111.695045][ T9977] netlink_rcv_skb+0x177/0x450 [ 111.699799][ T9977] nfnetlink_rcv+0x1ba/0x460 [ 111.704381][ T9977] netlink_unicast+0x58c/0x7d0 [ 111.709132][ T9977] netlink_sendmsg+0x91c/0xea0 [ 111.713891][ T9977] sock_sendmsg+0xd7/0x130 [ 111.718356][ T9977] ____sys_sendmsg+0x753/0x880 [ 111.723122][ T9977] ___sys_sendmsg+0x100/0x170 [ 111.727792][ T9977] __sys_sendmsg+0x105/0x1d0 [ 111.732395][ T9977] __x64_sys_sendmsg+0x78/0xb0 [ 111.737275][ T9977] do_syscall_64+0xfa/0x790 [ 111.741789][ T9977] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 111.747673][ T9977] [ 111.750062][ T9977] Freed by task 9696: [ 111.754181][ T9977] save_stack+0x23/0x90 [ 111.758611][ T9977] __kasan_slab_free+0x102/0x150 [ 111.763531][ T9977] kasan_slab_free+0xe/0x10 [ 111.768440][ T9977] kfree+0x10a/0x2c0 [ 111.772341][ T9977] tomoyo_check_open_permission+0x19e/0x3e0 [ 111.778373][ T9977] tomoyo_file_open+0xa9/0xd0 [ 111.783078][ T9977] security_file_open+0x71/0x300 [ 111.788033][ T9977] do_dentry_open+0x37a/0x1380 [ 111.793125][ T9977] vfs_open+0xa0/0xd0 [ 111.797227][ T9977] path_openat+0x10df/0x4500 [ 111.801824][ T9977] do_filp_open+0x1a1/0x280 [ 111.806459][ T9977] do_sys_open+0x3fe/0x5d0 [ 111.810997][ T9977] __x64_sys_open+0x7e/0xc0 [ 111.816579][ T9977] do_syscall_64+0xfa/0x790 [ 111.821071][ T9977] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 111.826953][ T9977] [ 111.829271][ T9977] The buggy address belongs to the object at ffff88809d6b3180 [ 111.829271][ T9977] which belongs to the cache kmalloc-32 of size 32 [ 111.843146][ T9977] The buggy address is located 0 bytes inside of [ 111.843146][ T9977] 32-byte region [ffff88809d6b3180, ffff88809d6b31a0) [ 111.856275][ T9977] The buggy address belongs to the page: [ 111.861905][ T9977] page:ffffea000275acc0 refcount:1 mapcount:0 mapping:ffff8880aa4001c0 index:0xffff88809d6b3fc1 [ 111.872459][ T9977] raw: 00fffe0000000200 ffffea00029a3d48 ffffea0002943908 ffff8880aa4001c0 [ 111.881044][ T9977] raw: ffff88809d6b3fc1 ffff88809d6b3000 000000010000003f 0000000000000000 [ 111.889817][ T9977] page dumped because: kasan: bad access detected [ 111.896362][ T9977] [ 111.898827][ T9977] Memory state around the buggy address: [ 111.904719][ T9977] ffff88809d6b3080: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 111.912868][ T9977] ffff88809d6b3100: 00 00 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 111.920933][ T9977] >ffff88809d6b3180: 04 fc fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 111.929130][ T9977] ^ [ 111.933184][ T9977] ffff88809d6b3200: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 111.941515][ T9977] ffff88809d6b3280: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 111.949755][ T9977] ================================================================== [ 111.957801][ T9977] Disabling lock debugging due to kernel taint [ 111.965290][ T9977] Kernel panic - not syncing: panic_on_warn set ... [ 111.971895][ T9977] CPU: 1 PID: 9977 Comm: syz-executor564 Tainted: G B 5.5.0-rc5-syzkaller #0 [ 111.981961][ T9977] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 111.992022][ T9977] Call Trace: [ 111.995334][ T9977] dump_stack+0x197/0x210 [ 111.999788][ T9977] panic+0x2e3/0x75c [ 112.003674][ T9977] ? add_taint.cold+0x16/0x16 [ 112.008490][ T9977] ? bitmap_ipmac_list+0x635/0x1080 [ 112.013680][ T9977] ? preempt_schedule+0x4b/0x60 [ 112.018639][ T9977] ? ___preempt_schedule+0x16/0x18 [ 112.023901][ T9977] ? trace_hardirqs_on+0x5e/0x240 [ 112.029201][ T9977] ? bitmap_ipmac_list+0x635/0x1080 [ 112.034394][ T9977] end_report+0x47/0x4f [ 112.038538][ T9977] ? bitmap_ipmac_list+0x635/0x1080 [ 112.043732][ T9977] __kasan_report.cold+0xe/0x41 [ 112.048663][ T9977] ? bitmap_ipmac_list+0x635/0x1080 [ 112.053843][ T9977] kasan_report+0x12/0x20 [ 112.058375][ T9977] check_memory_region+0x134/0x1a0 [ 112.063609][ T9977] __kasan_check_read+0x11/0x20 [ 112.068450][ T9977] bitmap_ipmac_list+0x635/0x1080 [ 112.073478][ T9977] ? bitmap_ipmac_head+0x8a0/0x8a0 [ 112.078578][ T9977] ? nla_put+0x110/0x150 [ 112.082923][ T9977] ip_set_dump_start+0x96c/0x1ca0 [ 112.088155][ T9977] ? ip_set_rename+0x720/0x720 [ 112.092918][ T9977] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 112.098651][ T9977] ? perf_trace_lock_acquire+0x4b0/0x530 [ 112.104306][ T9977] ? __kasan_check_write+0x14/0x20 [ 112.109413][ T9977] netlink_dump+0x558/0xfb0 [ 112.114152][ T9977] ? __netlink_sendskb+0xc0/0xc0 [ 112.119145][ T9977] __netlink_dump_start+0x66a/0x930 [ 112.124341][ T9977] ip_set_dump+0x15a/0x1d0 [ 112.128747][ T9977] ? call_ad+0x5a0/0x5a0 [ 112.132989][ T9977] ? ip_set_rename+0x720/0x720 [ 112.137742][ T9977] ? __ip_set_put_netlink.isra.0+0x90/0x90 [ 112.143648][ T9977] ? call_ad+0x5a0/0x5a0 [ 112.147888][ T9977] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 112.153094][ T9977] ? nfnetlink_bind+0x2c0/0x2c0 [ 112.157955][ T9977] ? __kasan_check_read+0x11/0x20 [ 112.163080][ T9977] ? __lock_acquire+0x8a0/0x4a00 [ 112.168115][ T9977] ? save_stack+0x5c/0x90 [ 112.172528][ T9977] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 112.178975][ T9977] ? apparmor_capable+0x497/0x900 [ 112.184049][ T9977] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 112.190295][ T9977] ? __kasan_check_read+0x11/0x20 [ 112.195351][ T9977] ? apparmor_cred_prepare+0x7b0/0x7b0 [ 112.201060][ T9977] netlink_rcv_skb+0x177/0x450 [ 112.205826][ T9977] ? nfnetlink_bind+0x2c0/0x2c0 [ 112.210667][ T9977] ? netlink_ack+0xb50/0xb50 [ 112.215242][ T9977] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 112.221602][ T9977] ? ns_capable_common+0x93/0x100 [ 112.227565][ T9977] ? ns_capable+0x20/0x30 [ 112.239448][ T9977] ? __netlink_ns_capable+0x104/0x140 [ 112.244857][ T9977] nfnetlink_rcv+0x1ba/0x460 [ 112.249443][ T9977] ? nfnetlink_rcv_batch+0x17a0/0x17a0 [ 112.255107][ T9977] ? netlink_deliver_tap+0x24a/0xbe0 [ 112.260382][ T9977] ? __kasan_check_write+0x14/0x20 [ 112.265652][ T9977] netlink_unicast+0x58c/0x7d0 [ 112.270617][ T9977] ? netlink_attachskb+0x870/0x870 [ 112.276091][ T9977] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 112.281809][ T9977] ? __check_object_size+0x3d/0x437 [ 112.287599][ T9977] netlink_sendmsg+0x91c/0xea0 [ 112.292675][ T9977] ? netlink_unicast+0x7d0/0x7d0 [ 112.297733][ T9977] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 112.303282][ T9977] ? apparmor_socket_sendmsg+0x2a/0x30 [ 112.308850][ T9977] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 112.315090][ T9977] ? security_socket_sendmsg+0x8d/0xc0 [ 112.320564][ T9977] ? netlink_unicast+0x7d0/0x7d0 [ 112.325634][ T9977] sock_sendmsg+0xd7/0x130 [ 112.330141][ T9977] ____sys_sendmsg+0x753/0x880 [ 112.334924][ T9977] ? kernel_sendmsg+0x50/0x50 [ 112.339592][ T9977] ? lockdep_init_map+0x1be/0x6d0 [ 112.344611][ T9977] ___sys_sendmsg+0x100/0x170 [ 112.349458][ T9977] ? sendmsg_copy_msghdr+0x70/0x70 [ 112.354571][ T9977] ? __kasan_check_read+0x11/0x20 [ 112.359670][ T9977] ? __lock_acquire+0x8a0/0x4a00 [ 112.364602][ T9977] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 112.370834][ T9977] ? __this_cpu_preempt_check+0x35/0x190 [ 112.376457][ T9977] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 112.382750][ T9977] ? percpu_counter_add_batch+0x13c/0x190 [ 112.388503][ T9977] ? __fd_install+0x1bc/0x640 [ 112.393335][ T9977] ? find_held_lock+0x35/0x130 [ 112.398146][ T9977] ? __fd_install+0x1bc/0x640 [ 112.402816][ T9977] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 112.410381][ T9977] ? __fget_light+0x1a9/0x230 [ 112.415050][ T9977] ? __fdget+0x1b/0x20 [ 112.419286][ T9977] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 112.425634][ T9977] __sys_sendmsg+0x105/0x1d0 [ 112.430209][ T9977] ? __sys_sendmsg_sock+0xc0/0xc0 [ 112.435237][ T9977] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 112.440693][ T9977] ? do_syscall_64+0x26/0x790 [ 112.445588][ T9977] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 112.451886][ T9977] ? do_syscall_64+0x26/0x790 [ 112.456564][ T9977] __x64_sys_sendmsg+0x78/0xb0 [ 112.461498][ T9977] do_syscall_64+0xfa/0x790 [ 112.466207][ T9977] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 112.472088][ T9977] RIP: 0033:0x4402c9 [ 112.476282][ T9977] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 112.496218][ T9977] RSP: 002b:00007ffcf78b5598 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 112.504629][ T9977] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004402c9 [ 112.512704][ T9977] RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000004 [ 112.520669][ T9977] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 112.528650][ T9977] R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000401b50 [ 112.536928][ T9977] R13: 0000000000401be0 R14: 0000000000000000 R15: 0000000000000000 [ 112.546458][ T9977] Kernel Offset: disabled [ 112.550940][ T9977] Rebooting in 86400 seconds..