[....] Starting enhanced syslogd: rsyslogd[ 16.323604] audit: type=1400 audit(1520540627.685:5): avc: denied { syslog } for pid=4084 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 19.231441] audit: type=1400 audit(1520540630.593:6): avc: denied { map } for pid=4222 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.53' (ECDSA) to the list of known hosts. executing program [ 37.392435] audit: type=1400 audit(1520540648.754:7): avc: denied { map } for pid=4239 comm="syzkaller640986" path="/root/syzkaller640986640" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 37.396134] ================================================================== [ 37.425702] BUG: KASAN: slab-out-of-bounds in pfkey_add+0x259e/0x3270 [ 37.432257] Read of size 4096 at addr ffff8801d5829cc0 by task syzkaller640986/4239 [ 37.440025] [ 37.441634] CPU: 1 PID: 4239 Comm: syzkaller640986 Not tainted 4.16.0-rc4+ #346 [ 37.449053] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 37.458385] Call Trace: [ 37.460955] dump_stack+0x194/0x24d [ 37.464560] ? arch_local_irq_restore+0x53/0x53 [ 37.469206] ? show_regs_print_info+0x18/0x18 [ 37.473675] ? __lock_is_held+0xb6/0x140 [ 37.477717] ? pfkey_add+0x259e/0x3270 [ 37.481580] print_address_description+0x73/0x250 [ 37.486405] ? pfkey_add+0x259e/0x3270 [ 37.490267] kasan_report+0x23c/0x360 [ 37.494052] check_memory_region+0x137/0x190 [ 37.498445] memcpy+0x23/0x50 [ 37.501527] pfkey_add+0x259e/0x3270 [ 37.505225] ? set_ipsecrequest+0x310/0x310 [ 37.509521] ? lock_release+0xa40/0xa40 [ 37.513473] ? set_ipsecrequest+0x310/0x310 [ 37.517774] pfkey_process+0x67e/0x740 [ 37.521644] ? pfkey_send_new_mapping+0x11b0/0x11b0 [ 37.526630] ? kasan_check_write+0x14/0x20 [ 37.530854] ? dup_iter+0x252/0x260 [ 37.534458] pfkey_sendmsg+0x4dc/0xa00 [ 37.538318] ? pfkey_spdget+0xb00/0xb00 [ 37.542268] ? selinux_socket_sendmsg+0x36/0x40 [ 37.546911] ? security_socket_sendmsg+0x89/0xb0 [ 37.551639] ? pfkey_spdget+0xb00/0xb00 [ 37.555587] sock_sendmsg+0xca/0x110 [ 37.559279] ___sys_sendmsg+0x767/0x8b0 [ 37.563225] ? SyS_membarrier+0x700/0x700 [ 37.567349] ? copy_msghdr_from_user+0x590/0x590 [ 37.572081] ? __pmd_alloc+0x4e0/0x4e0 [ 37.575945] ? trace_hardirqs_off+0x10/0x10 [ 37.580235] ? find_held_lock+0x35/0x1d0 [ 37.584270] ? __fget_light+0x2b2/0x3c0 [ 37.588215] ? fget_raw+0x20/0x20 [ 37.591645] ? find_held_lock+0x35/0x1d0 [ 37.595687] ? __do_page_fault+0x5f7/0xc90 [ 37.599893] ? lock_downgrade+0x980/0x980 [ 37.604017] __sys_sendmsg+0xe5/0x210 [ 37.607788] ? __sys_sendmsg+0xe5/0x210 [ 37.611743] ? SyS_shutdown+0x290/0x290 [ 37.615708] ? __do_page_fault+0x3d6/0xc90 [ 37.619925] ? move_addr_to_kernel+0x60/0x60 [ 37.624312] SyS_sendmsg+0x2d/0x50 [ 37.627823] ? __sys_sendmsg+0x210/0x210 [ 37.631856] do_syscall_64+0x281/0x940 [ 37.635712] ? __do_page_fault+0xc90/0xc90 [ 37.639915] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 37.644644] ? syscall_return_slowpath+0x550/0x550 [ 37.649542] ? syscall_return_slowpath+0x2ac/0x550 [ 37.654442] ? prepare_exit_to_usermode+0x350/0x350 [ 37.659432] ? retint_user+0x18/0x18 [ 37.663118] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 37.667937] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 37.673095] RIP: 0033:0x43ffd9 [ 37.676252] RSP: 002b:00007ffce15fe788 EFLAGS: 00000213 ORIG_RAX: 000000000000002e [ 37.683930] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043ffd9 [ 37.691167] RDX: 0000000000000000 RSI: 0000000020196fe4 RDI: 0000000000000003 [ 37.698405] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 37.705646] R10: 00000000004002c8 R11: 0000000000000213 R12: 0000000000401900 [ 37.712884] R13: 0000000000401990 R14: 0000000000000000 R15: 0000000000000000 [ 37.720137] [ 37.721734] Allocated by task 4239: [ 37.725331] save_stack+0x43/0xd0 [ 37.728750] kasan_kmalloc+0xad/0xe0 [ 37.732431] __kmalloc_node_track_caller+0x47/0x70 [ 37.737327] __kmalloc_reserve.isra.39+0x41/0xd0 [ 37.742053] __alloc_skb+0x13b/0x780 [ 37.745737] pfkey_sendmsg+0x20f/0xa00 [ 37.749591] sock_sendmsg+0xca/0x110 [ 37.753272] ___sys_sendmsg+0x767/0x8b0 [ 37.757215] __sys_sendmsg+0xe5/0x210 [ 37.760984] SyS_sendmsg+0x2d/0x50 [ 37.764495] do_syscall_64+0x281/0x940 [ 37.768353] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 37.773512] [ 37.775110] Freed by task 0: [ 37.778100] (stack is not available) [ 37.781784] [ 37.783385] The buggy address belongs to the object at ffff8801d5829c80 [ 37.783385] which belongs to the cache kmalloc-512 of size 512 [ 37.796012] The buggy address is located 64 bytes inside of [ 37.796012] 512-byte region [ffff8801d5829c80, ffff8801d5829e80) [ 37.807766] The buggy address belongs to the page: [ 37.812662] page:ffffea0007560a40 count:1 mapcount:0 mapping:ffff8801d5829000 index:0x0 [ 37.820783] flags: 0x2fffc0000000100(slab) [ 37.824990] raw: 02fffc0000000100 ffff8801d5829000 0000000000000000 0000000100000006 [ 37.832838] raw: ffffea0006c2f820 ffff8801dac01748 ffff8801dac00940 0000000000000000 [ 37.840697] page dumped because: kasan: bad access detected [ 37.846372] [ 37.847969] Memory state around the buggy address: [ 37.852867] ffff8801d5829d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 37.860192] ffff8801d5829e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 37.867519] >ffff8801d5829e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.874842] ^ [ 37.878174] ffff8801d5829f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.885500] ffff8801d5829f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.892826] ================================================================== [ 37.900151] Disabling lock debugging due to kernel taint [ 37.905801] Kernel panic - not syncing: panic_on_warn set ... [ 37.905801] [ 37.913139] CPU: 1 PID: 4239 Comm: syzkaller640986 Tainted: G B 4.16.0-rc4+ #346 [ 37.921856] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 37.931182] Call Trace: [ 37.933741] dump_stack+0x194/0x24d [ 37.937342] ? arch_local_irq_restore+0x53/0x53 [ 37.941983] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 37.946705] ? vsnprintf+0x1ed/0x1900 [ 37.950472] ? pfkey_add+0x2540/0x3270 [ 37.954330] panic+0x1e4/0x41c [ 37.957494] ? refcount_error_report+0x214/0x214 [ 37.962219] ? add_taint+0x1c/0x50 [ 37.965725] ? add_taint+0x1c/0x50 [ 37.969234] ? pfkey_add+0x259e/0x3270 [ 37.973088] kasan_end_report+0x50/0x50 [ 37.977031] kasan_report+0x149/0x360 [ 37.980803] check_memory_region+0x137/0x190 [ 37.985178] memcpy+0x23/0x50 [ 37.988250] pfkey_add+0x259e/0x3270 [ 37.991937] ? set_ipsecrequest+0x310/0x310 [ 37.996228] ? lock_release+0xa40/0xa40 [ 38.000172] ? set_ipsecrequest+0x310/0x310 [ 38.004463] pfkey_process+0x67e/0x740 [ 38.008322] ? pfkey_send_new_mapping+0x11b0/0x11b0 [ 38.013313] ? kasan_check_write+0x14/0x20 [ 38.017538] ? dup_iter+0x252/0x260 [ 38.021153] pfkey_sendmsg+0x4dc/0xa00 [ 38.025022] ? pfkey_spdget+0xb00/0xb00 [ 38.028974] ? selinux_socket_sendmsg+0x36/0x40 [ 38.033620] ? security_socket_sendmsg+0x89/0xb0 [ 38.038344] ? pfkey_spdget+0xb00/0xb00 [ 38.042289] sock_sendmsg+0xca/0x110 [ 38.045973] ___sys_sendmsg+0x767/0x8b0 [ 38.049916] ? SyS_membarrier+0x700/0x700 [ 38.054032] ? copy_msghdr_from_user+0x590/0x590 [ 38.058760] ? __pmd_alloc+0x4e0/0x4e0 [ 38.062624] ? trace_hardirqs_off+0x10/0x10 [ 38.066918] ? find_held_lock+0x35/0x1d0 [ 38.070951] ? __fget_light+0x2b2/0x3c0 [ 38.074895] ? fget_raw+0x20/0x20 [ 38.078318] ? find_held_lock+0x35/0x1d0 [ 38.082364] ? __do_page_fault+0x5f7/0xc90 [ 38.086566] ? lock_downgrade+0x980/0x980 [ 38.090686] __sys_sendmsg+0xe5/0x210 [ 38.094454] ? __sys_sendmsg+0xe5/0x210 [ 38.098398] ? SyS_shutdown+0x290/0x290 [ 38.102346] ? __do_page_fault+0x3d6/0xc90 [ 38.106552] ? move_addr_to_kernel+0x60/0x60 [ 38.110931] SyS_sendmsg+0x2d/0x50 [ 38.114441] ? __sys_sendmsg+0x210/0x210 [ 38.118469] do_syscall_64+0x281/0x940 [ 38.122326] ? __do_page_fault+0xc90/0xc90 [ 38.126532] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 38.131257] ? syscall_return_slowpath+0x550/0x550 [ 38.136153] ? syscall_return_slowpath+0x2ac/0x550 [ 38.141059] ? prepare_exit_to_usermode+0x350/0x350 [ 38.146052] ? retint_user+0x18/0x18 [ 38.149738] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 38.154563] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 38.159722] RIP: 0033:0x43ffd9 [ 38.162881] RSP: 002b:00007ffce15fe788 EFLAGS: 00000213 ORIG_RAX: 000000000000002e [ 38.170556] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043ffd9 [ 38.177798] RDX: 0000000000000000 RSI: 0000000020196fe4 RDI: 0000000000000003 [ 38.185039] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 38.192276] R10: 00000000004002c8 R11: 0000000000000213 R12: 0000000000401900 [ 38.199513] R13: 0000000000401990 R14: 0000000000000000 R15: 0000000000000000 [ 38.207174] Dumping ftrace buffer: [ 38.210683] (ftrace buffer empty) [ 38.214362] Kernel Offset: disabled [ 38.217957] Rebooting in 86400 seconds..