INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.49' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 41.094185] ================================================================== [ 41.101601] BUG: KASAN: slab-out-of-bounds in pfkey_add+0x259e/0x3270 [ 41.108154] Read of size 2081 at addr ffff8801ad73ca58 by task syzkaller669007/4481 [ 41.115913] [ 41.117516] CPU: 0 PID: 4481 Comm: syzkaller669007 Not tainted 4.16.0+ #380 [ 41.124583] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 41.133909] Call Trace: [ 41.136471] dump_stack+0x1a7/0x27d [ 41.140070] ? arch_local_irq_restore+0x53/0x53 [ 41.144714] ? show_regs_print_info+0x18/0x18 [ 41.149180] ? __lock_is_held+0xb6/0x140 [ 41.153214] ? kasan_check_write+0x14/0x20 [ 41.157420] ? pfkey_add+0x259e/0x3270 [ 41.161281] print_address_description+0x73/0x250 [ 41.166111] ? pfkey_add+0x259e/0x3270 [ 41.169967] kasan_report+0x23c/0x360 [ 41.173740] check_memory_region+0x137/0x190 [ 41.178120] memcpy+0x23/0x50 [ 41.181200] pfkey_add+0x259e/0x3270 [ 41.184889] ? set_ipsecrequest+0x310/0x310 [ 41.189190] ? lock_release+0xa40/0xa40 [ 41.193135] ? set_ipsecrequest+0x310/0x310 [ 41.197427] pfkey_process+0x67e/0x740 [ 41.201289] ? pfkey_send_new_mapping+0x11e0/0x11e0 [ 41.206274] ? kasan_check_write+0x14/0x20 [ 41.210485] ? dup_iter+0x260/0x260 [ 41.214089] pfkey_sendmsg+0x4dc/0xa00 [ 41.217954] ? pfkey_spdget+0xb00/0xb00 [ 41.221906] ? move_addr_to_kernel.part.17+0x100/0x100 [ 41.227155] ? security_socket_sendmsg+0x89/0xb0 [ 41.231883] ? pfkey_spdget+0xb00/0xb00 [ 41.235830] sock_sendmsg+0xca/0x110 [ 41.239516] ___sys_sendmsg+0x767/0x8b0 [ 41.243463] ? copy_msghdr_from_user+0x590/0x590 [ 41.248201] ? __pmd_alloc+0x4f0/0x4f0 [ 41.252058] ? __fd_install+0x25f/0x740 [ 41.256002] ? trace_hardirqs_off+0x10/0x10 [ 41.260296] ? kasan_check_read+0x11/0x20 [ 41.264416] ? __fget_light+0x2bc/0x400 [ 41.268361] ? fget_raw+0x20/0x20 [ 41.271783] ? handle_mm_fault+0x35b/0xb20 [ 41.275995] ? __do_page_fault+0x58e/0xbe0 [ 41.280201] ? __fdget+0x18/0x20 [ 41.283549] __sys_sendmsg+0x105/0x250 [ 41.287408] ? __sys_sendmsg+0x105/0x250 [ 41.291438] ? SyS_shutdown+0x30/0x30 [ 41.295208] ? __do_page_fault+0x358/0xbe0 [ 41.299410] ? fd_install+0x4d/0x60 [ 41.303015] SyS_sendmsg+0x29/0x30 [ 41.306523] ? __sys_sendmsg+0x250/0x250 [ 41.310556] do_syscall_64+0x281/0x940 [ 41.314411] ? vmalloc_sync_all+0x30/0x30 [ 41.318538] ? trace_event_raw_event_sys_exit+0x260/0x260 [ 41.324055] ? syscall_return_slowpath+0x550/0x550 [ 41.328955] ? syscall_return_slowpath+0x2ac/0x550 [ 41.333857] ? retint_user+0x18/0x18 [ 41.337541] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 41.342353] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 41.347511] RIP: 0033:0x43fdd9 [ 41.350669] RSP: 002b:00007fff742337c8 EFLAGS: 00000213 ORIG_RAX: 000000000000002e [ 41.358349] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fdd9 [ 41.365590] RDX: 0000000000000000 RSI: 0000000020f56000 RDI: 0000000000000003 [ 41.372829] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 41.380068] R10: 00000000004002c8 R11: 0000000000000213 R12: 0000000000401700 [ 41.387315] R13: 0000000000401790 R14: 0000000000000000 R15: 0000000000000000 [ 41.394559] [ 41.396160] Allocated by task 4481: [ 41.399769] save_stack+0x43/0xd0 [ 41.403192] kasan_kmalloc+0xad/0xe0 [ 41.406874] __kmalloc_node_track_caller+0x47/0x70 [ 41.411771] __kmalloc_reserve.isra.39+0x41/0xd0 [ 41.416494] __alloc_skb+0x12a/0x760 [ 41.420180] pfkey_sendmsg+0x20f/0xa00 [ 41.424037] sock_sendmsg+0xca/0x110 [ 41.427719] ___sys_sendmsg+0x767/0x8b0 [ 41.431665] __sys_sendmsg+0x105/0x250 [ 41.435525] SyS_sendmsg+0x29/0x30 [ 41.439121] do_syscall_64+0x281/0x940 [ 41.442983] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 41.448139] [ 41.449734] Freed by task 0: [ 41.452721] (stack is not available) [ 41.456408] [ 41.458005] The buggy address belongs to the object at ffff8801ad73ca40 [ 41.458005] which belongs to the cache kmalloc-512 of size 512 [ 41.470632] The buggy address is located 24 bytes inside of [ 41.470632] 512-byte region [ffff8801ad73ca40, ffff8801ad73cc40) [ 41.482386] The buggy address belongs to the page: [ 41.487284] page:ffffea0006b5cf00 count:1 mapcount:0 mapping:ffff8801ad73c040 index:0x0 [ 41.495397] flags: 0x2fffc0000000100(slab) [ 41.499603] raw: 02fffc0000000100 ffff8801ad73c040 0000000000000000 0000000100000006 [ 41.507454] raw: ffffea0006b69fa0 ffff8801dac01748 ffff8801dac00940 0000000000000000 [ 41.515309] page dumped because: kasan: bad access detected [ 41.520993] [ 41.522593] Memory state around the buggy address: [ 41.527492] ffff8801ad73cb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 41.534823] ffff8801ad73cb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 41.542150] >ffff8801ad73cc00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 41.549478] ^ [ 41.554895] ffff8801ad73cc80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 41.562236] ffff8801ad73cd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 41.569567] ================================================================== [ 41.576893] Disabling lock debugging due to kernel taint [ 41.582370] Kernel panic - not syncing: panic_on_warn set ... [ 41.582370] [ 41.589708] CPU: 0 PID: 4481 Comm: syzkaller669007 Tainted: G B 4.16.0+ #380 [ 41.598075] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 41.607400] Call Trace: [ 41.609959] dump_stack+0x1a7/0x27d [ 41.613558] ? arch_local_irq_restore+0x53/0x53 [ 41.618197] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 41.622919] ? vsnprintf+0x1ed/0x1900 [ 41.626697] ? pfkey_add+0x2590/0x3270 [ 41.630559] panic+0x1f8/0x42c [ 41.633721] ? refcount_error_report+0x214/0x214 [ 41.638457] ? do_raw_spin_unlock+0x9e/0x310 [ 41.642833] ? do_raw_spin_unlock+0x9e/0x310 [ 41.647211] ? pfkey_add+0x259e/0x3270 [ 41.651065] kasan_end_report+0x50/0x50 [ 41.655004] kasan_report+0x149/0x360 [ 41.658776] check_memory_region+0x137/0x190 [ 41.663160] memcpy+0x23/0x50 [ 41.666240] pfkey_add+0x259e/0x3270 [ 41.669930] ? set_ipsecrequest+0x310/0x310 [ 41.674221] ? lock_release+0xa40/0xa40 [ 41.678162] ? set_ipsecrequest+0x310/0x310 [ 41.682455] pfkey_process+0x67e/0x740 [ 41.686311] ? pfkey_send_new_mapping+0x11e0/0x11e0 [ 41.691294] ? kasan_check_write+0x14/0x20 [ 41.695501] ? dup_iter+0x260/0x260 [ 41.699099] pfkey_sendmsg+0x4dc/0xa00 [ 41.702955] ? pfkey_spdget+0xb00/0xb00 [ 41.706896] ? move_addr_to_kernel.part.17+0x100/0x100 [ 41.712141] ? security_socket_sendmsg+0x89/0xb0 [ 41.716862] ? pfkey_spdget+0xb00/0xb00 [ 41.720811] sock_sendmsg+0xca/0x110 [ 41.724492] ___sys_sendmsg+0x767/0x8b0 [ 41.728436] ? copy_msghdr_from_user+0x590/0x590 [ 41.733169] ? __pmd_alloc+0x4f0/0x4f0 [ 41.737026] ? __fd_install+0x25f/0x740 [ 41.740968] ? trace_hardirqs_off+0x10/0x10 [ 41.745257] ? kasan_check_read+0x11/0x20 [ 41.749374] ? __fget_light+0x2bc/0x400 [ 41.753317] ? fget_raw+0x20/0x20 [ 41.756738] ? handle_mm_fault+0x35b/0xb20 [ 41.760964] ? __do_page_fault+0x58e/0xbe0 [ 41.765253] ? __fdget+0x18/0x20 [ 41.768588] __sys_sendmsg+0x105/0x250 [ 41.772444] ? __sys_sendmsg+0x105/0x250 [ 41.776475] ? SyS_shutdown+0x30/0x30 [ 41.780244] ? __do_page_fault+0x358/0xbe0 [ 41.784445] ? fd_install+0x4d/0x60 [ 41.788044] SyS_sendmsg+0x29/0x30 [ 41.791555] ? __sys_sendmsg+0x250/0x250 [ 41.795626] do_syscall_64+0x281/0x940 [ 41.799478] ? vmalloc_sync_all+0x30/0x30 [ 41.803593] ? trace_event_raw_event_sys_exit+0x260/0x260 [ 41.809098] ? syscall_return_slowpath+0x550/0x550 [ 41.813995] ? syscall_return_slowpath+0x2ac/0x550 [ 41.818891] ? retint_user+0x18/0x18 [ 41.822575] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 41.827388] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 41.832544] RIP: 0033:0x43fdd9 [ 41.835702] RSP: 002b:00007fff742337c8 EFLAGS: 00000213 ORIG_RAX: 000000000000002e [ 41.843376] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fdd9 [ 41.850613] RDX: 0000000000000000 RSI: 0000000020f56000 RDI: 0000000000000003 [ 41.857853] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 41.865093] R10: 00000000004002c8 R11: 0000000000000213 R12: 0000000000401700 [ 41.872330] R13: 0000000000401790 R14: 0000000000000000 R15: 0000000000000000 [ 41.879941] Dumping ftrace buffer: [ 41.883453] (ftrace buffer empty) [ 41.887132] Kernel Offset: disabled [ 41.890729] Rebooting in 86400 seconds..