[....] Starting enhanced syslogd: rsyslogd[ 10.716483] audit: type=1400 audit(1513788703.245:4): avc: denied { syslog } for pid=3182 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Starting mcstransd: [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added 'ci-android-49-kasan-gce-8,10.128.15.226' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 19.062579] ================================================================== [ 19.063660] BUG: KASAN: slab-out-of-bounds in pfkey_add+0x2702/0x3470 [ 19.064525] Read of size 6144 at addr ffff8801c8708018 by task syzkaller473739/3331 [ 19.065541] [ 19.065772] CPU: 0 PID: 3331 Comm: syzkaller473739 Not tainted 4.9.71-g319c8e1 #111 [ 19.066800] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 19.068017] ffff8801c84b7788 ffffffff81d91639 ffffea000721c200 ffff8801c8708018 [ 19.069166] 0000000000000000 ffff8801c8708200 ffff8801c84b79c8 ffff8801c84b77c0 [ 19.070326] ffffffff8153af43 ffff8801c8708018 0000000000001800 0000000000000000 [ 19.071473] Call Trace: [ 19.071830] [] dump_stack+0xc1/0x128 [ 19.072541] [] print_address_description+0x73/0x280 [ 19.073415] [] kasan_report+0x275/0x360 [ 19.074158] [] ? pfkey_add+0x2702/0x3470 [ 19.074922] [] check_memory_region+0x137/0x190 [ 19.075742] [] memcpy+0x23/0x50 [ 19.076393] [] pfkey_add+0x2702/0x3470 [ 19.077122] [] ? pfkey_delete+0x360/0x360 [ 19.077889] [] ? pfkey_seq_stop+0x80/0x80 [ 19.078681] [] ? __skb_clone+0x24a/0x7d0 [ 19.079455] [] ? pfkey_delete+0x360/0x360 [ 19.080218] [] pfkey_process+0x61e/0x730 [ 19.080972] [] ? pfkey_send_new_mapping+0x11b0/0x11b0 [ 19.081873] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 19.083342] [] pfkey_sendmsg+0x3a9/0x760 [ 19.089016] [] ? pfkey_spdget+0x820/0x820 [ 19.094778] [] sock_sendmsg+0xca/0x110 [ 19.100278] [] ___sys_sendmsg+0x6d1/0x7e0 [ 19.106042] [] ? copy_msghdr_from_user+0x550/0x550 [ 19.112586] [] ? __lru_cache_add+0x187/0x250 [ 19.118609] [] ? do_huge_pmd_anonymous_page+0xb05/0x10d0 [ 19.125680] [] ? _raw_spin_unlock+0x2c/0x50 [ 19.131617] [] ? do_huge_pmd_anonymous_page+0x2d4/0x10d0 [ 19.138683] [] ? handle_mm_fault+0x6ee/0x2530 [ 19.144803] [] ? __lock_is_held+0xa1/0xf0 [ 19.150575] [] ? __pmd_alloc+0x410/0x410 [ 19.156248] [] ? __fget_light+0x158/0x1e0 [ 19.162009] [] ? __fdget+0x18/0x20 [ 19.167163] [] __sys_sendmsg+0xd6/0x190 [ 19.172750] [] ? SyS_shutdown+0x1b0/0x1b0 [ 19.178510] [] ? __do_page_fault+0x5ec/0xd40 [ 19.184532] [] ? __do_page_fault+0x3bd/0xd40 [ 19.190556] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 19.197361] [] SyS_sendmsg+0x2d/0x50 [ 19.202690] [] entry_SYSCALL_64_fastpath+0x23/0xc6 [ 19.209231] [ 19.210823] Allocated by task 3331: [ 19.214416] save_stack_trace+0x16/0x20 [ 19.218353] save_stack+0x43/0xd0 [ 19.221771] kasan_kmalloc+0xad/0xe0 [ 19.225447] kasan_slab_alloc+0x12/0x20 [ 19.229382] __kmalloc_track_caller+0xda/0x2b0 [ 19.233948] __kmalloc_reserve.isra.37+0x33/0xc0 [ 19.238667] __alloc_skb+0x119/0x600 [ 19.242356] pfkey_sendmsg+0x135/0x760 [ 19.246207] sock_sendmsg+0xca/0x110 [ 19.249886] ___sys_sendmsg+0x6d1/0x7e0 [ 19.253823] __sys_sendmsg+0xd6/0x190 [ 19.257594] SyS_sendmsg+0x2d/0x50 [ 19.261101] entry_SYSCALL_64_fastpath+0x23/0xc6 [ 19.265816] [ 19.267416] Freed by task 1763: [ 19.270659] save_stack_trace+0x16/0x20 [ 19.274595] save_stack+0x43/0xd0 [ 19.278019] kasan_slab_free+0x72/0xc0 [ 19.281871] kfree+0xf0/0x2f0 [ 19.284941] skb_free_head+0x74/0xb0 [ 19.288617] skb_release_data+0x315/0x3f0 [ 19.292727] skb_release_all+0x4a/0x60 [ 19.296585] consume_skb+0xc6/0x340 [ 19.300179] skb_free_datagram+0x1a/0xe0 [ 19.304206] unix_dgram_recvmsg+0x983/0xf90 [ 19.308491] sock_recvmsg+0xc9/0x110 [ 19.312169] SYSC_recvfrom+0x1fc/0x330 [ 19.316021] SyS_recvfrom+0x40/0x50 [ 19.319612] entry_SYSCALL_64_fastpath+0x23/0xc6 [ 19.324331] [ 19.325925] The buggy address belongs to the object at ffff8801c8708000 [ 19.325925] which belongs to the cache kmalloc-512 of size 512 [ 19.338542] The buggy address is located 24 bytes inside of [ 19.338542] 512-byte region [ffff8801c8708000, ffff8801c8708200) [ 19.350291] The buggy address belongs to the page: [ 19.355192] page:ffffea000721c200 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 19.365344] flags: 0x8000000000004080(slab|head) [ 19.370059] page dumped because: kasan: bad access detected [ 19.375729] [ 19.377319] Memory state around the buggy address: [ 19.382210] ffff8801c8708100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 19.389532] ffff8801c8708180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 19.396853] >ffff8801c8708200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.404176] ^ [ 19.407504] ffff8801c8708280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.414826] ffff8801c8708300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.422145] ================================================================== [ 19.429465] Disabling lock debugging due to kernel taint [ 19.435115] Kernel panic - not syncing: panic_on_warn set ... [ 19.435115] [ 19.442458] CPU: 0 PID: 3331 Comm: syzkaller473739 Tainted: G B 4.9.71-g319c8e1 #111 [ 19.451428] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 19.460747] ffff8801c84b76e0 ffffffff81d91639 ffffffff84193767 ffff8801c84b77b8 [ 19.468689] 0000000000000000 ffff8801c8708200 ffff8801c84b79c8 ffff8801c84b77a8 [ 19.476635] ffffffff8142ccd1 0000000041b58ab3 ffffffff841871e0 ffffffff8142cb15 [ 19.484582] Call Trace: [ 19.487135] [] dump_stack+0xc1/0x128 [ 19.492465] [] panic+0x1bc/0x3a8 [ 19.497446] [] ? percpu_up_read_preempt_enable.constprop.54+0xd7/0xd7 [ 19.505641] [] ? preempt_schedule+0x25/0x30 [ 19.511578] [] ? ___preempt_schedule+0x16/0x18 [ 19.517775] [] kasan_end_report+0x50/0x50 [ 19.523536] [] kasan_report+0x167/0x360 [ 19.529121] [] ? pfkey_add+0x2702/0x3470 [ 19.534795] [] check_memory_region+0x137/0x190 [ 19.540992] [] memcpy+0x23/0x50 [ 19.545884] [] pfkey_add+0x2702/0x3470 [ 19.551386] [] ? pfkey_delete+0x360/0x360 [ 19.557147] [] ? pfkey_seq_stop+0x80/0x80 [ 19.562909] [] ? __skb_clone+0x24a/0x7d0 [ 19.568581] [] ? pfkey_delete+0x360/0x360 [ 19.574342] [] pfkey_process+0x61e/0x730 [ 19.580017] [] ? pfkey_send_new_mapping+0x11b0/0x11b0 [ 19.586825] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 19.593638] [] pfkey_sendmsg+0x3a9/0x760 [ 19.599313] [] ? pfkey_spdget+0x820/0x820 [ 19.605082] [] sock_sendmsg+0xca/0x110 [ 19.610582] [] ___sys_sendmsg+0x6d1/0x7e0 [ 19.616343] [] ? copy_msghdr_from_user+0x550/0x550 [ 19.622885] [] ? __lru_cache_add+0x187/0x250 [ 19.628908] [] ? do_huge_pmd_anonymous_page+0xb05/0x10d0 [ 19.635980] [] ? _raw_spin_unlock+0x2c/0x50 [ 19.641923] [] ? do_huge_pmd_anonymous_page+0x2d4/0x10d0 [ 19.648986] [] ? handle_mm_fault+0x6ee/0x2530 [ 19.655097] [] ? __lock_is_held+0xa1/0xf0 [ 19.660860] [] ? __pmd_alloc+0x410/0x410 [ 19.666536] [] ? __fget_light+0x158/0x1e0 [ 19.672302] [] ? __fdget+0x18/0x20 [ 19.677465] [] __sys_sendmsg+0xd6/0x190 [ 19.683054] [] ? SyS_shutdown+0x1b0/0x1b0 [ 19.688816] [] ? __do_page_fault+0x5ec/0xd40 [ 19.694845] [] ? __do_page_fault+0x3bd/0xd40 [ 19.700870] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 19.707673] [] SyS_sendmsg+0x2d/0x50 [ 19.713013] [] entry_SYSCALL_64_fastpath+0x23/0xc6 [ 19.719604] Dumping ftrace buffer: [ 19.723110] (ftrace buffer empty) [ 19.726787] Kernel Offset: disabled [ 19.730377] Rebooting in 86400 seconds..