[....] Starting enhanced syslogd: rsyslogd[ 13.092889] audit: type=1400 audit(1540786104.285:4): avc: denied { syslog } for pid=1920 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.113' (ECDSA) to the list of known hosts. RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported Error: argument "bridge0" is wrong: Device does not exist Error: argument "bridge0" is wrong: Device does not exist Cannot find device "veth0_to_bridge" Cannot find device "veth1_to_bridge" RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported Error: argument "bond0" is wrong: Device does not exist Error: argument "bond0" is wrong: Device does not exist Cannot find device "veth0_to_bond" Cannot find device "veth1_to_bond" RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported Error: argument "team0" is wrong: Device does not exist Error: argument "team0" is wrong: Device does not exist Cannot find device "veth0_to_team" Cannot find device "veth1_to_team" Cannot find device "bridge_slave_0" Cannot find device "bridge_slave_1" RTNETLINK answers: Operation not supported Cannot find device "bridge0" Cannot find device "bridge0" Cannot find device "bridge0" Cannot find device "bridge0" Cannot find device "vcan0" Cannot find device "vcan0" Cannot find device "vcan0" Cannot find device "vcan0" Cannot find device "tunl0" Cannot find device "tunl0" Cannot find device "tunl0" Cannot find device "tunl0" Cannot find device "gre0" Cannot find device "gre0" Cannot find device "gre0" Cannot find device "gre0" Cannot find device "gretap0" Cannot find device "gretap0" Cannot find device "gretap0" Cannot find device "gretap0" RTNETLINK answers: Operation not supported RTNETLINK answers: Invalid argument RTNETLINK answers: Invalid argument Cannot find device "ip6gre0" Cannot find device "ip6gre0" Cannot find device "ip6gre0" Cannot find device "ip6gre0" Cannot find device "ip6gretap0" Cannot find device "ip6gretap0" Cannot find device "ip6gretap0" Cannot find device "ip6gretap0" Cannot find device "erspan0" Cannot find device "erspan0" Cannot find device "erspan0" Cannot find device "erspan0" Cannot find device "bond0" Cannot find device "bond0" Cannot find device "bond0" Cannot find device "bond0" Cannot find device "veth0" Cannot find device "veth0" Cannot find device "veth0" Cannot find device "veth0" Cannot find device "veth1" Cannot find device "veth1" Cannot find device "veth1" Cannot find device "veth1" Cannot find device "team0" Cannot find device "team0" Cannot find device "team0" Cannot find device "team0" Cannot find device "veth0_to_bridge" Cannot find device "veth0_to_bridge" Cannot find device "veth0_to_bridge" Cannot find device "veth0_to_bridge" Cannot find device "veth1_to_bridge" Cannot find device "veth1_to_bridge" Cannot find device "veth1_to_bridge" Cannot find device "veth1_to_bridge" Cannot find device "veth0_to_bond" Cannot find device "veth0_to_bond" Cannot find device "veth0_to_bond" Cannot find device "veth0_to_bond" Cannot find device "veth1_to_bond" Cannot find device "veth1_to_bond" Cannot find device "veth1_to_bond" Cannot find device "veth1_to_bond" Cannot find device "veth0_to_team" Cannot find device "veth0_to_team" Cannot find device "veth0_to_team" Cannot find device "veth0_to_team" Cannot find device "veth1_to_team" Cannot find device "veth1_to_team" Cannot find device "veth1_to_team" Cannot find device "veth1_to_team" executing program executing program syzkaller login: [ 37.953485] ================================================================== [ 37.960868] BUG: KASAN: slab-out-of-bounds in ip6_tnl_xmit2+0x229d/0x2350 [ 37.967999] Read of size 16 at addr ffff8801d2abefb0 by task syz-executor175/2501 [ 37.975613] [ 37.977220] CPU: 0 PID: 2501 Comm: syz-executor175 Not tainted 4.4.162+ #117 [ 37.984376] 0000000000000000 e66fffc6500fbc73 ffff8801d1af6ca0 ffffffff81a994bd [ 37.992379] ffffea00074aaf00 ffff8801d2abefb0 0000000000000000 ffff8801d2abefb8 [ 38.000365] ffff8800bb89c400 ffff8801d1af6cd8 ffffffff8148a669 ffff8801d2abefb0 [ 38.008361] Call Trace: [ 38.010925] [] dump_stack+0xc1/0x124 [ 38.016264] [] print_address_description+0x6c/0x217 [ 38.022906] [] kasan_report.cold.6+0x175/0x2f7 [ 38.029117] [] ? ip6_tnl_xmit2+0x229d/0x2350 [ 38.035156] [] __asan_report_load_n_noabort+0xf/0x20 [ 38.041892] [] ip6_tnl_xmit2+0x229d/0x2350 [ 38.047762] [] ? ip6_tnl_create2+0x2d0/0x2d0 [ 38.053800] [] ? __lock_acquire+0xa85/0x5f10 [ 38.059835] [] ? trace_hardirqs_on+0x10/0x10 [ 38.065875] [] ? trace_hardirqs_on+0x10/0x10 [ 38.071911] [] ? make_kuid+0xf0/0x180 [ 38.077338] [] ip6_tnl_xmit+0x9f9/0xe10 [ 38.082935] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 38.089677] [] ? ip6ip6_dscp_ecn_decapsulate+0x7c0/0x7c0 [ 38.096755] [] ? trace_hardirqs_on+0x10/0x10 [ 38.102786] [] ? trace_hardirqs_on+0x10/0x10 [ 38.108820] [] ? netlink_has_listeners+0x1da/0x330 [ 38.115375] [] dev_hard_start_xmit+0x7bd/0x11c0 [ 38.121669] [] __dev_queue_xmit+0x16f5/0x1c30 [ 38.127790] [] ? __dev_queue_xmit+0x1d7/0x1c30 [ 38.133999] [] ? trace_hardirqs_on+0x10/0x10 [ 38.140034] [] ? check_preemption_disabled+0x3b/0x170 [ 38.146848] [] ? netdev_pick_tx+0x2c0/0x2c0 [ 38.152796] [] ? nf_ct_deliver_cached_events+0x335/0x560 [ 38.159871] [] ? nf_ct_deliver_cached_events+0x83/0x560 [ 38.166860] [] ? check_preemption_disabled+0x3b/0x170 [ 38.173677] [] dev_queue_xmit+0x17/0x20 [ 38.179275] [] neigh_direct_output+0x15/0x20 [ 38.185312] [] ip_finish_output2+0x8f0/0x1100 [ 38.191431] [] ? ip_finish_output2+0x20b/0x1100 [ 38.197723] [] ? ip_send_check+0xb0/0xb0 [ 38.203407] [] ? nf_hook_slow+0x202/0x340 [ 38.209177] [] ip_finish_output+0x882/0xc00 [ 38.215122] [] ip_output+0x219/0x4c0 [ 38.220460] [] ? ip_mc_output+0x980/0x980 [ 38.226231] [] ? ip_make_skb+0x116/0x210 [ 38.231918] [] ? ip_fragment.constprop.5+0x200/0x200 [ 38.238647] [] ? ip_flush_pending_frames+0x30/0x30 [ 38.245216] [] ip_local_out+0x9b/0x180 [ 38.250727] [] ip_send_skb+0x3c/0xc0 [ 38.256068] [] udp_send_skb+0x503/0xc70 [ 38.261670] [] udp_sendmsg+0x16c9/0x1c70 [ 38.267355] [] ? ip_reply_glue_bits+0xc0/0xc0 [ 38.273473] [] ? udp_lib_unhash+0x630/0x630 [ 38.279418] [] ? mark_held_locks+0xc7/0x130 [ 38.285371] [] ? __lock_acquire+0xa85/0x5f10 [ 38.291411] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 38.298137] [] udpv6_sendmsg+0x12cd/0x24c0 [ 38.303996] [] ? avc_has_perm+0x15a/0x3a0 [ 38.309771] [] ? udp_v6_flush_pending_frames+0xe0/0xe0 [ 38.316677] [] ? avc_has_perm_noaudit+0x2f0/0x2f0 [ 38.323143] [] ? trace_hardirqs_on+0x10/0x10 [ 38.329177] [] ? sock_has_perm+0x1c1/0x3f0 [ 38.335038] [] ? sock_has_perm+0x2a1/0x3f0 [ 38.340911] [] ? sock_has_perm+0x9f/0x3f0 [ 38.346684] [] ? selinux_msg_queue_alloc_security+0x2e0/0x2e0 [ 38.354213] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 38.360945] [] ? check_preemption_disabled+0x3b/0x170 [ 38.367760] [] ? inet_sendmsg+0x143/0x4d0 [ 38.373539] [] inet_sendmsg+0x203/0x4d0 [ 38.379142] [] ? inet_sendmsg+0x73/0x4d0 [ 38.384829] [] ? inet_recvmsg+0x4c0/0x4c0 [ 38.390613] [] sock_sendmsg+0xbb/0x110 [ 38.396129] [] ___sys_sendmsg+0x745/0x880 [ 38.401903] [] ? copy_msghdr_from_user+0x550/0x550 [ 38.408460] [] ? prandom_u32+0x71/0xa0 [ 38.413970] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 38.420702] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 38.427001] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 38.433813] [] ? release_sock+0x3b6/0x500 [ 38.439588] [] ? trace_hardirqs_on+0xd/0x10 [ 38.445557] [] ? __fget_light+0x9f/0x1f0 [ 38.451242] [] ? __fdget+0x18/0x20 [ 38.456407] [] __sys_sendmsg+0xd6/0x190 [ 38.462008] [] ? SyS_shutdown+0x1b0/0x1b0 [ 38.467781] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 38.474602] [] SyS_sendmsg+0x2d/0x50 [ 38.479950] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 38.486501] [ 38.488112] Allocated by task 2501: [ 38.491799] [] save_stack_trace+0x26/0x50 [ 38.497692] [] kasan_kmalloc.part.1+0x62/0xf0 [ 38.503935] [] kasan_kmalloc+0xaf/0xc0 [ 38.509566] [] __kmalloc+0x13d/0x330 [ 38.515021] [] __neigh_create+0x1d6/0x1b20 [ 38.521000] [] ipv4_neigh_lookup+0x4de/0x700 [ 38.527152] [] ip6_tnl_xmit2+0x28a/0x2350 [ 38.533042] [] ip6_tnl_xmit+0x9f9/0xe10 [ 38.538762] [] dev_hard_start_xmit+0x7bd/0x11c0 [ 38.545176] [] __dev_queue_xmit+0x16f5/0x1c30 [ 38.551416] [] dev_queue_xmit+0x17/0x20 [ 38.557133] [] neigh_direct_output+0x15/0x20 [ 38.563293] [] ip_finish_output2+0x8f0/0x1100 [ 38.569537] [] ip_finish_output+0x882/0xc00 [ 38.575619] [] ip_output+0x219/0x4c0 [ 38.581225] [] ip_local_out+0x9b/0x180 [ 38.586856] [] ip_send_skb+0x3c/0xc0 [ 38.592320] [] udp_send_skb+0x503/0xc70 [ 38.598056] [] udp_sendmsg+0x16c9/0x1c70 [ 38.603862] [] udpv6_sendmsg+0x12cd/0x24c0 [ 38.609843] [] inet_sendmsg+0x203/0x4d0 [ 38.615566] [] sock_sendmsg+0xbb/0x110 [ 38.621230] [] ___sys_sendmsg+0x745/0x880 [ 38.627126] [] __sys_sendmsg+0xd6/0x190 [ 38.632847] [] SyS_sendmsg+0x2d/0x50 [ 38.638310] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 38.644986] [ 38.646614] Freed by task 0: [ 38.649615] (stack is not available) [ 38.653302] [ 38.654911] The buggy address belongs to the object at ffff8801d2abed00 [ 38.654911] which belongs to the cache kmalloc-1024 of size 1024 [ 38.667712] The buggy address is located 688 bytes inside of [ 38.667712] 1024-byte region [ffff8801d2abed00, ffff8801d2abf100) [ 38.679645] The buggy address belongs to the page: [ 38.685272] kasan: CONFIG_KASAN_INLINE enabled [ 38.689690] kasan: GPF could be caused by NULL-ptr deref or user memory access[ 38.697204] ------------[ cut here ]------------ [ 38.701968] WARNING: CPU: 1 PID: 2079 at kernel/sched/core.c:7946 __might_sleep+0x138/0x1a0() [ 38.710633] do not call blocking ops when !TASK_RUNNING; state=1 set at [] do_wait+0x270/0xa30 [ 38.720966] Kernel panic - not syncing: panic_on_warn set ... [ 38.720966] [ 39.885512] Shutting down cpus with NMI [ 39.889843] Kernel Offset: disabled [ 39.893472] Rebooting in 86400 seconds..