[....] Starting enhanced syslogd: rsyslogd[ 12.207653] audit: type=1400 audit(1520722713.007:4): avc: denied { syslog } for pid=3633 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.30' (ECDSA) to the list of known hosts. 2018/03/10 22:58:41 parsed 1 programs 2018/03/10 22:58:41 executed programs: 0 syzkaller login: [ 20.779717] IPVS: Creating netns size=2536 id=1 [ 20.798954] ================================================================== [ 20.806336] BUG: KASAN: slab-out-of-bounds in pfkey_add+0x153e/0x3470 [ 20.812884] Read of size 2368 at addr ffff8801c53a1940 by task syz-executor0/3795 [ 20.820472] [ 20.822074] CPU: 0 PID: 3795 Comm: syz-executor0 Not tainted 4.9.86-g00db063 #60 [ 20.829572] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 20.838896] ffff8801d7917718 ffffffff81d956f9 ffffea000714e800 ffff8801c53a1940 [ 20.846896] 0000000000000000 ffff8801c53a1b00 ffff8801d7917958 ffff8801d7917750 [ 20.854866] ffffffff8153e083 ffff8801c53a1940 0000000000000940 0000000000000000 [ 20.862832] Call Trace: [ 20.865393] [] dump_stack+0xc1/0x128 [ 20.870733] [] print_address_description+0x73/0x280 [ 20.877369] [] kasan_report+0x275/0x360 [ 20.882962] [] ? pfkey_add+0x153e/0x3470 [ 20.888642] [] check_memory_region+0x137/0x190 [ 20.894840] [] memcpy+0x23/0x50 [ 20.899741] [] pfkey_add+0x153e/0x3470 [ 20.905247] [] ? pfkey_delete+0x360/0x360 [ 20.911014] [] ? pfkey_seq_stop+0x80/0x80 [ 20.916783] [] ? __skb_clone+0x24a/0x7d0 [ 20.922486] [] ? pfkey_delete+0x360/0x360 [ 20.928251] [] pfkey_process+0x68b/0x750 [ 20.933931] [] ? pfkey_send_new_mapping+0x11b0/0x11b0 [ 20.940741] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 20.947551] [] pfkey_sendmsg+0x3a9/0x760 [ 20.953230] [] ? pfkey_spdget+0x820/0x820 [ 20.958999] [] sock_sendmsg+0xca/0x110 [ 20.964504] [] ___sys_sendmsg+0x6d1/0x7e0 [ 20.970271] [] ? copy_msghdr_from_user+0x570/0x570 [ 20.976820] [] ? do_futex+0x3f8/0x15c0 [ 20.982325] [] ? __lru_cache_add+0x187/0x250 [ 20.988355] [] ? do_huge_pmd_anonymous_page+0xb05/0x10d0 [ 20.995425] [] ? exit_robust_list+0x230/0x230 [ 21.001542] [] ? do_huge_pmd_anonymous_page+0x2d4/0x10d0 [ 21.008615] [] ? __fget_light+0x169/0x1f0 [ 21.014383] [] ? __fdget+0x18/0x20 [ 21.019544] [] ? sockfd_lookup_light+0x118/0x160 [ 21.025920] [] __sys_sendmsg+0xd6/0x190 [ 21.031512] [] ? SyS_shutdown+0x1b0/0x1b0 [ 21.037291] [] ? compat_SyS_futex+0x1f9/0x2a0 [ 21.043408] [] compat_SyS_sendmsg+0x2a/0x40 [ 21.049348] [] ? compat_SyS_getsockopt+0x2a0/0x2a0 [ 21.055898] [] do_fast_syscall_32+0x2f5/0x870 [ 21.062010] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 21.068645] [] entry_SYSENTER_compat+0x90/0xa2 [ 21.074844] [ 21.076439] Allocated by task 3795: [ 21.080041] save_stack_trace+0x16/0x20 [ 21.083991] save_stack+0x43/0xd0 [ 21.087425] kasan_kmalloc+0xad/0xe0 [ 21.091108] kasan_slab_alloc+0x12/0x20 [ 21.095050] __kmalloc_track_caller+0xda/0x2b0 [ 21.099607] __kmalloc_reserve.isra.37+0x33/0xc0 [ 21.104340] __alloc_skb+0x119/0x600 [ 21.108024] pfkey_sendmsg+0x135/0x760 [ 21.111884] sock_sendmsg+0xca/0x110 [ 21.115569] ___sys_sendmsg+0x6d1/0x7e0 [ 21.119512] __sys_sendmsg+0xd6/0x190 [ 21.123281] compat_SyS_sendmsg+0x2a/0x40 [ 21.127398] do_fast_syscall_32+0x2f5/0x870 [ 21.131693] entry_SYSENTER_compat+0x90/0xa2 [ 21.136080] [ 21.137681] Freed by task 2183: [ 21.140930] save_stack_trace+0x16/0x20 [ 21.144873] save_stack+0x43/0xd0 [ 21.148304] kasan_slab_free+0x72/0xc0 [ 21.152159] kfree+0x103/0x300 [ 21.155320] kernfs_fop_release+0xff/0x140 [ 21.159532] __fput+0x28c/0x6e0 [ 21.162777] ____fput+0x15/0x20 [ 21.166026] task_work_run+0x115/0x190 [ 21.169881] exit_to_usermode_loop+0xfc/0x120 [ 21.174345] do_syscall_64+0x36f/0x490 [ 21.178203] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 21.183269] [ 21.184869] The buggy address belongs to the object at ffff8801c53a1900 [ 21.184869] which belongs to the cache kmalloc-512 of size 512 [ 21.197494] The buggy address is located 64 bytes inside of [ 21.197494] 512-byte region [ffff8801c53a1900, ffff8801c53a1b00) [ 21.209250] The buggy address belongs to the page: [ 21.214150] page:ffffea000714e800 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 21.224352] flags: 0x8000000000004080(slab|head) [ 21.229077] page dumped because: kasan: bad access detected [ 21.234755] [ 21.236353] Memory state around the buggy address: [ 21.241252] ffff8801c53a1a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 21.248579] ffff8801c53a1a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 21.255914] >ffff8801c53a1b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.263248] ^ [ 21.266588] ffff8801c53a1b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 21.273914] ffff8801c53a1c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 21.281241] ================================================================== [ 21.288573] Disabling lock debugging due to kernel taint [ 21.294120] Kernel panic - not syncing: panic_on_warn set ... [ 21.294120] [ 21.301464] CPU: 0 PID: 3795 Comm: syz-executor0 Tainted: G B 4.9.86-g00db063 #60 [ 21.310181] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 21.319504] ffff8801d7917670 ffffffff81d956f9 ffffffff84197a0f ffff8801d7917748 [ 21.327473] 0000000000000000 ffff8801c53a1b00 ffff8801d7917958 ffff8801d7917738 [ 21.335436] ffffffff8142f531 0000000041b58ab3 ffffffff8418b470 ffffffff8142f375 [ 21.343398] Call Trace: [ 21.345954] [] dump_stack+0xc1/0x128 [ 21.351288] [] panic+0x1bc/0x3a8 [ 21.356275] [] ? percpu_up_read_preempt_enable.constprop.53+0xd7/0xd7 [ 21.364470] [] ? preempt_schedule+0x25/0x30 [ 21.370407] [] ? ___preempt_schedule+0x16/0x18 [ 21.376608] [] kasan_end_report+0x50/0x50 [ 21.382372] [] kasan_report+0x167/0x360 [ 21.387965] [] ? pfkey_add+0x153e/0x3470 [ 21.393644] [] check_memory_region+0x137/0x190 [ 21.399845] [] memcpy+0x23/0x50 [ 21.404740] [] pfkey_add+0x153e/0x3470 [ 21.410247] [] ? pfkey_delete+0x360/0x360 [ 21.416021] [] ? pfkey_seq_stop+0x80/0x80 [ 21.421787] [] ? __skb_clone+0x24a/0x7d0 [ 21.427468] [] ? pfkey_delete+0x360/0x360 [ 21.433232] [] pfkey_process+0x68b/0x750 [ 21.438910] [] ? pfkey_send_new_mapping+0x11b0/0x11b0 [ 21.445720] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 21.452526] [] pfkey_sendmsg+0x3a9/0x760 [ 21.458204] [] ? pfkey_spdget+0x820/0x820 [ 21.463968] [] sock_sendmsg+0xca/0x110 [ 21.469481] [] ___sys_sendmsg+0x6d1/0x7e0 [ 21.475248] [] ? copy_msghdr_from_user+0x570/0x570 [ 21.481797] [] ? do_futex+0x3f8/0x15c0 [ 21.487304] [] ? __lru_cache_add+0x187/0x250 [ 21.493330] [] ? do_huge_pmd_anonymous_page+0xb05/0x10d0 [ 21.500396] [] ? exit_robust_list+0x230/0x230 [ 21.506508] [] ? do_huge_pmd_anonymous_page+0x2d4/0x10d0 [ 21.513575] [] ? __fget_light+0x169/0x1f0 [ 21.519339] [] ? __fdget+0x18/0x20 [ 21.524497] [] ? sockfd_lookup_light+0x118/0x160 [ 21.530869] [] __sys_sendmsg+0xd6/0x190 [ 21.536461] [] ? SyS_shutdown+0x1b0/0x1b0 [ 21.542223] [] ? compat_SyS_futex+0x1f9/0x2a0 [ 21.548339] [] compat_SyS_sendmsg+0x2a/0x40 [ 21.554279] [] ? compat_SyS_getsockopt+0x2a0/0x2a0 [ 21.560827] [] do_fast_syscall_32+0x2f5/0x870 [ 21.566940] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 21.573575] [] entry_SYSENTER_compat+0x90/0xa2 [ 21.580202] Dumping ftrace buffer: [ 21.583714] (ftrace buffer empty) [ 21.587395] Kernel Offset: disabled [ 21.590990] Rebooting in 86400 seconds..