[....] Starting enhanced syslogd: rsyslogd[ 11.141381] audit: type=1400 audit(1514079726.053:5): avc: denied { syslog } for pid=2990 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 15.815161] audit: type=1400 audit(1514079730.726:6): avc: denied { map } for pid=3132 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added 'ci-upstream-kasan-gce-0,10.128.0.49' (ECDSA) to the list of known hosts. executing program [ 23.142545] audit: type=1400 audit(1514079738.054:7): avc: denied { map } for pid=3146 comm="syzkaller827021" path="/root/syzkaller827021105" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 23.187965] ================================================================== [ 23.195359] BUG: KASAN: wild-memory-access in scatterwalk_copychunks+0x206/0x480 [ 23.202871] Write of size 16 at addr 00050800c803ecd8 by task syzkaller827021/3146 [ 23.210541] [ 23.212140] CPU: 0 PID: 3146 Comm: syzkaller827021 Not tainted 4.15.0-rc4+ #236 [ 23.219550] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 23.228869] Call Trace: [ 23.231426] dump_stack+0x194/0x257 [ 23.235031] ? arch_local_irq_restore+0x53/0x53 [ 23.239678] ? scatterwalk_copychunks+0x206/0x480 [ 23.244490] kasan_report+0x13b/0x340 [ 23.248262] check_memory_region+0x137/0x190 [ 23.252641] memcpy+0x37/0x50 [ 23.255717] scatterwalk_copychunks+0x206/0x480 [ 23.260362] blkcipher_walk_done+0xa4b/0xde0 [ 23.264748] glue_ctr_crypt_128bit+0x597/0xc20 [ 23.269309] ? glue_ecb_crypt_128bit+0x5c0/0x5c0 [ 23.274050] ? memset+0x31/0x40 [ 23.277307] ? memzero_explicit+0xe/0x10 [ 23.281342] ? wp384_final+0xa6/0xf0 [ 23.285031] ? wp256_final+0xf0/0xf0 [ 23.288715] ? sock_kfree_s+0x29/0x60 [ 23.292513] ctr_crypt+0x34/0x40 [ 23.295845] ? ctr_crypt+0x34/0x40 [ 23.299355] ? lrw_encrypt+0x430/0x430 [ 23.303211] __ablk_encrypt+0x1d1/0x2d0 [ 23.307155] ? ablk_set_key+0x1a0/0x1a0 [ 23.311104] ? shash_async_update+0x20/0x20 [ 23.315393] ? kfree+0xf0/0x260 [ 23.318643] ? __ablk_encrypt+0x2d0/0x2d0 [ 23.322762] ablk_encrypt+0x23e/0x2c0 [ 23.326532] ? __ablk_encrypt+0x2d0/0x2d0 [ 23.330660] skcipher_decrypt_ablkcipher+0x312/0x420 [ 23.335731] ? scatterwalk_ffwd+0xbf/0x370 [ 23.339938] poly_tail_continue+0x42a/0x6b0 [ 23.344234] poly_tail+0x40f/0x520 [ 23.347745] poly_cipherpad+0x33e/0x470 [ 23.351693] poly_cipher+0x303/0x440 [ 23.355382] poly_adpad+0x347/0x480 [ 23.358992] poly_ad+0x25c/0x300 [ 23.362338] poly_setkey+0x2fc/0x3e0 [ 23.366021] poly_init+0x16c/0x1d0 [ 23.369546] poly_genkey+0x422/0x590 [ 23.373231] chachapoly_decrypt+0x73/0x90 [ 23.377348] aead_recvmsg+0x154a/0x1cf0 [ 23.381321] ? aead_release+0x50/0x50 [ 23.385095] ? selinux_socket_recvmsg+0x36/0x40 [ 23.389732] ? security_socket_recvmsg+0x91/0xc0 [ 23.394458] ? aead_release+0x50/0x50 [ 23.398228] sock_recvmsg+0xc9/0x110 [ 23.401908] ? __sock_recv_wifi_status+0x210/0x210 [ 23.406806] ___sys_recvmsg+0x2a4/0x640 [ 23.410757] ? ___sys_sendmsg+0x8b0/0x8b0 [ 23.414878] ? __do_page_fault+0x5f7/0xc90 [ 23.419086] ? lock_downgrade+0x980/0x980 [ 23.423209] ? __fget_light+0x297/0x380 [ 23.427150] ? fget_raw+0x20/0x20 [ 23.430572] ? __handle_mm_fault+0x3ce0/0x3ce0 [ 23.435123] ? vmacache_find+0x5f/0x280 [ 23.439070] ? up_read+0x1a/0x40 [ 23.442406] ? __do_page_fault+0x3d6/0xc90 [ 23.446608] ? SYSC_accept4+0x4ff/0x870 [ 23.450555] ? __fdget+0x18/0x20 [ 23.453893] __sys_recvmsg+0xe2/0x210 [ 23.457661] ? __sys_recvmsg+0xe2/0x210 [ 23.461615] ? SyS_sendmmsg+0x60/0x60 [ 23.465391] ? __do_page_fault+0xc90/0xc90 [ 23.469598] ? SyS_setsockopt+0x215/0x360 [ 23.473726] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 23.478715] SyS_recvmsg+0x2d/0x50 [ 23.482227] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 23.486949] RIP: 0033:0x43fef9 [ 23.490107] RSP: 002b:00007ffe45dac418 EFLAGS: 00000217 ORIG_RAX: 000000000000002f [ 23.497782] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fef9 [ 23.505019] RDX: 0000000000000000 RSI: 000000002022efc8 RDI: 0000000000000004 [ 23.512262] RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000 [ 23.519503] R10: 0000000000000000 R11: 0000000000000217 R12: 0000000000401860 [ 23.526747] R13: 00000000004018f0 R14: 0000000000000000 R15: 0000000000000000 [ 23.534005] ================================================================== [ 23.541348] Disabling lock debugging due to kernel taint [ 23.546838] Kernel panic - not syncing: panic_on_warn set ... [ 23.546838] [ 23.554172] CPU: 0 PID: 3146 Comm: syzkaller827021 Tainted: G B 4.15.0-rc4+ #236 [ 23.562884] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 23.572205] Call Trace: [ 23.574764] dump_stack+0x194/0x257 [ 23.578362] ? arch_local_irq_restore+0x53/0x53 [ 23.582999] ? kasan_end_report+0x32/0x50 [ 23.587115] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 23.591836] ? vsnprintf+0x1ed/0x1900 [ 23.595606] ? scatterwalk_copychunks+0x120/0x480 [ 23.600414] panic+0x1e4/0x41c [ 23.603575] ? refcount_error_report+0x214/0x214 [ 23.608299] ? add_taint+0x1c/0x50 [ 23.611802] ? add_taint+0x1c/0x50 [ 23.615311] ? scatterwalk_copychunks+0x206/0x480 [ 23.620120] kasan_end_report+0x50/0x50 [ 23.624059] kasan_report+0x144/0x340 [ 23.627828] check_memory_region+0x137/0x190 [ 23.632202] memcpy+0x37/0x50 [ 23.635274] scatterwalk_copychunks+0x206/0x480 [ 23.639913] blkcipher_walk_done+0xa4b/0xde0 [ 23.644292] glue_ctr_crypt_128bit+0x597/0xc20 [ 23.648846] ? glue_ecb_crypt_128bit+0x5c0/0x5c0 [ 23.653569] ? memset+0x31/0x40 [ 23.656819] ? memzero_explicit+0xe/0x10 [ 23.660846] ? wp384_final+0xa6/0xf0 [ 23.664525] ? wp256_final+0xf0/0xf0 [ 23.668210] ? sock_kfree_s+0x29/0x60 [ 23.671996] ctr_crypt+0x34/0x40 [ 23.675329] ? ctr_crypt+0x34/0x40 [ 23.678836] ? lrw_encrypt+0x430/0x430 [ 23.682690] __ablk_encrypt+0x1d1/0x2d0 [ 23.686631] ? ablk_set_key+0x1a0/0x1a0 [ 23.690574] ? shash_async_update+0x20/0x20 [ 23.694863] ? kfree+0xf0/0x260 [ 23.698109] ? __ablk_encrypt+0x2d0/0x2d0 [ 23.702224] ablk_encrypt+0x23e/0x2c0 [ 23.705992] ? __ablk_encrypt+0x2d0/0x2d0 [ 23.710106] skcipher_decrypt_ablkcipher+0x312/0x420 [ 23.715173] ? scatterwalk_ffwd+0xbf/0x370 [ 23.719376] poly_tail_continue+0x42a/0x6b0 [ 23.723665] poly_tail+0x40f/0x520 [ 23.727173] poly_cipherpad+0x33e/0x470 [ 23.731119] poly_cipher+0x303/0x440 [ 23.734801] poly_adpad+0x347/0x480 [ 23.738410] poly_ad+0x25c/0x300 [ 23.741744] poly_setkey+0x2fc/0x3e0 [ 23.745425] poly_init+0x16c/0x1d0 [ 23.748931] poly_genkey+0x422/0x590 [ 23.752615] chachapoly_decrypt+0x73/0x90 [ 23.756727] aead_recvmsg+0x154a/0x1cf0 [ 23.760676] ? aead_release+0x50/0x50 [ 23.764444] ? selinux_socket_recvmsg+0x36/0x40 [ 23.769082] ? security_socket_recvmsg+0x91/0xc0 [ 23.773808] ? aead_release+0x50/0x50 [ 23.777577] sock_recvmsg+0xc9/0x110 [ 23.781256] ? __sock_recv_wifi_status+0x210/0x210 [ 23.786152] ___sys_recvmsg+0x2a4/0x640 [ 23.790094] ? ___sys_sendmsg+0x8b0/0x8b0 [ 23.794216] ? __do_page_fault+0x5f7/0xc90 [ 23.798423] ? lock_downgrade+0x980/0x980 [ 23.802538] ? __fget_light+0x297/0x380 [ 23.806478] ? fget_raw+0x20/0x20 [ 23.809900] ? __handle_mm_fault+0x3ce0/0x3ce0 [ 23.814450] ? vmacache_find+0x5f/0x280 [ 23.818393] ? up_read+0x1a/0x40 [ 23.821726] ? __do_page_fault+0x3d6/0xc90 [ 23.825926] ? SYSC_accept4+0x4ff/0x870 [ 23.829869] ? __fdget+0x18/0x20 [ 23.833203] __sys_recvmsg+0xe2/0x210 [ 23.836972] ? __sys_recvmsg+0xe2/0x210 [ 23.840914] ? SyS_sendmmsg+0x60/0x60 [ 23.844682] ? __do_page_fault+0xc90/0xc90 [ 23.848884] ? SyS_setsockopt+0x215/0x360 [ 23.853003] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 23.857987] SyS_recvmsg+0x2d/0x50 [ 23.861494] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 23.866215] RIP: 0033:0x43fef9 [ 23.869376] RSP: 002b:00007ffe45dac418 EFLAGS: 00000217 ORIG_RAX: 000000000000002f [ 23.877047] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fef9 [ 23.884281] RDX: 0000000000000000 RSI: 000000002022efc8 RDI: 0000000000000004 [ 23.891516] RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000 [ 23.898752] R10: 0000000000000000 R11: 0000000000000217 R12: 0000000000401860 [ 23.905988] R13: 00000000004018f0 R14: 0000000000000000 R15: 0000000000000000 [ 23.913268] Dumping ftrace buffer: [ 23.916774] (ftrace buffer empty) [ 23.920449] Kernel Offset: disabled [ 23.924042] Rebooting in 86400 seconds..