[....] Starting enhanced syslogd: rsyslogd[ 13.080326] audit: type=1400 audit(1516309868.875:5): avc: denied { syslog } for pid=3502 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 18.257945] audit: type=1400 audit(1516309874.052:6): avc: denied { map } for pid=3641 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.2' (ECDSA) to the list of known hosts. executing program [ 33.992610] audit: type=1400 audit(1516309889.787:7): avc: denied { map } for pid=3658 comm="syzkaller692142" path="/root/syzkaller692142332" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 33.998037] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=2816 sclass=netlink_tcpdiag_socket pig=3658 comm=syzkaller692142 [ 33.998108] ================================================================== [ 33.998123] BUG: KASAN: stack-out-of-bounds in __nla_put+0x37/0x40 [ 33.998127] Read of size 255 at addr ffff8801bbc078b0 by task syzkaller692142/3658 [ 33.998128] [ 33.998132] CPU: 1 PID: 3658 Comm: syzkaller692142 Not tainted 4.15.0-rc8+ #268 [ 33.998135] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 33.998137] Call Trace: [ 33.998145] dump_stack+0x194/0x257 [ 33.998154] ? arch_local_irq_restore+0x53/0x53 [ 33.998161] ? show_regs_print_info+0x18/0x18 [ 33.998171] ? __alloc_skb+0x57e/0x780 [ 33.998177] ? __nla_put+0x37/0x40 [ 33.998186] print_address_description+0x73/0x250 [ 33.998191] ? __nla_put+0x37/0x40 [ 33.998197] kasan_report+0x25b/0x340 [ 33.998206] check_memory_region+0x137/0x190 [ 33.998211] memcpy+0x23/0x50 [ 33.998217] __nla_put+0x37/0x40 [ 33.998224] nla_put+0xf5/0x130 [ 33.998234] netlink_ack+0x78a/0xa10 [ 33.998243] ? netlink_sendmsg+0xe60/0xe60 [ 33.998250] ? netlink_deliver_tap+0x171/0xcf0 [ 33.998262] netlink_rcv_skb+0x2d1/0x400 [ 33.998268] ? sock_diag_bind+0x80/0x80 [ 33.998274] ? netlink_ack+0xa10/0xa10 [ 33.998281] ? idr_get_free_cmn+0xfd0/0xfd0 [ 33.998287] ? netlink_skb_destructor+0x1d0/0x1d0 [ 33.998299] sock_diag_rcv+0x2a/0x40 [ 33.998303] netlink_unicast+0x4ee/0x700 [ 33.998313] ? netlink_attachskb+0x8a0/0x8a0 [ 33.998324] ? security_netlink_send+0x81/0xb0 [ 33.998332] netlink_sendmsg+0xa4a/0xe60 [ 33.998343] ? netlink_unicast+0x700/0x700 [ 33.998352] ? security_socket_sendmsg+0x89/0xb0 [ 33.998356] ? netlink_unicast+0x700/0x700 [ 33.998363] sock_sendmsg+0xca/0x110 [ 33.998370] ___sys_sendmsg+0x767/0x8b0 [ 33.998380] ? copy_msghdr_from_user+0x590/0x590 [ 33.998394] ? __do_page_fault+0x5f7/0xc90 [ 33.998402] ? lock_downgrade+0x980/0x980 [ 33.998415] ? __fget_light+0x297/0x380 [ 33.998421] ? fget_raw+0x20/0x20 [ 33.998428] ? __handle_mm_fault+0x3ce0/0x3ce0 [ 33.998433] ? vmacache_find+0x5f/0x280 [ 33.998444] ? up_read+0x1a/0x40 [ 33.998450] ? __do_page_fault+0x3d6/0xc90 [ 33.998454] ? lock_release+0xa40/0xa40 [ 33.998465] ? __fdget+0x18/0x20 [ 33.998474] __sys_sendmsg+0xe5/0x210 [ 33.998477] ? __sys_sendmsg+0xe5/0x210 [ 33.998484] ? SyS_shutdown+0x290/0x290 [ 33.998490] ? __do_page_fault+0xc90/0xc90 [ 33.998499] ? SyS_setsockopt+0x215/0x360 [ 33.998514] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 33.998525] SyS_sendmsg+0x2d/0x50 [ 33.998534] entry_SYSCALL_64_fastpath+0x29/0xa0 [ 33.998538] RIP: 0033:0x43fdc9 [ 33.998540] RSP: 002b:00007ffe5ad2e038 EFLAGS: 00000217 ORIG_RAX: 000000000000002e [ 33.998545] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fdc9 [ 33.998548] RDX: 0000000000000000 RSI: 000000002058efc8 RDI: 0000000000000003 [ 33.998550] RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000 [ 33.998552] R10: 0000000000000004 R11: 0000000000000217 R12: 00000000004016f0 [ 33.998555] R13: 0000000000401780 R14: 0000000000000000 R15: 0000000000000000 [ 33.998571] [ 33.998573] The buggy address belongs to the page: [ 33.998578] page:ffffea0006ef01c0 count:0 mapcount:0 mapping: (null) index:0x0 [ 33.998581] flags: 0x2fffc0000000000() [ 33.998587] raw: 02fffc0000000000 0000000000000000 0000000000000000 00000000ffffffff [ 33.998592] raw: 0000000000000000 0000000100000001 0000000000000000 0000000000000000 [ 33.998594] page dumped because: kasan: bad access detected [ 33.998595] [ 33.998596] Memory state around the buggy address: [ 33.998600] ffff8801bbc07780: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f2 f2 f2 [ 33.998603] ffff8801bbc07800: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.998606] >ffff8801bbc07880: f1 f1 f1 f1 00 00 00 00 00 f2 f2 f2 00 00 00 00 [ 33.998608] ^ [ 33.998610] ffff8801bbc07900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.998613] ffff8801bbc07980: 00 f1 f1 f1 f1 00 f2 f2 f2 f3 f3 f3 f3 00 00 00 [ 33.998615] ================================================================== [ 33.998616] Disabling lock debugging due to kernel taint [ 33.998619] Kernel panic - not syncing: panic_on_warn set ... [ 33.998619] [ 33.998623] CPU: 1 PID: 3658 Comm: syzkaller692142 Tainted: G B 4.15.0-rc8+ #268 [ 33.998625] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 33.998626] Call Trace: [ 33.998630] dump_stack+0x194/0x257 [ 33.998636] ? arch_local_irq_restore+0x53/0x53 [ 33.998639] ? kasan_end_report+0x32/0x50 [ 33.998644] ? lock_downgrade+0x980/0x980 [ 33.998648] ? vsnprintf+0x1ed/0x1900 [ 33.998653] ? nla_put_64bit+0x130/0x150 [ 33.998657] panic+0x1e4/0x41c [ 33.998661] ? refcount_error_report+0x214/0x214 [ 33.998668] ? add_taint+0x40/0x50 [ 33.998671] ? add_taint+0x1c/0x50 [ 33.998676] ? __nla_put+0x37/0x40 [ 33.998680] kasan_end_report+0x50/0x50 [ 33.998684] kasan_report+0x144/0x340 [ 33.998690] check_memory_region+0x137/0x190 [ 33.998694] memcpy+0x23/0x50 [ 33.998698] __nla_put+0x37/0x40 [ 33.998703] nla_put+0xf5/0x130 [ 33.998708] netlink_ack+0x78a/0xa10 [ 33.998714] ? netlink_sendmsg+0xe60/0xe60 [ 33.998719] ? netlink_deliver_tap+0x171/0xcf0 [ 33.998726] netlink_rcv_skb+0x2d1/0x400 [ 33.998729] ? sock_diag_bind+0x80/0x80 [ 33.998734] ? netlink_ack+0xa10/0xa10 [ 33.998738] ? idr_get_free_cmn+0xfd0/0xfd0 [ 33.998743] ? netlink_skb_destructor+0x1d0/0x1d0 [ 33.998750] sock_diag_rcv+0x2a/0x40 [ 33.998754] netlink_unicast+0x4ee/0x700 [ 33.998760] ? netlink_attachskb+0x8a0/0x8a0 [ 33.998766] ? security_netlink_send+0x81/0xb0 [ 33.998771] netlink_sendmsg+0xa4a/0xe60 [ 33.998778] ? netlink_unicast+0x700/0x700 [ 33.998784] ? security_socket_sendmsg+0x89/0xb0 [ 33.998788] ? netlink_unicast+0x700/0x700 [ 33.998792] sock_sendmsg+0xca/0x110 [ 33.998797] ___sys_sendmsg+0x767/0x8b0 [ 33.998803] ? copy_msghdr_from_user+0x590/0x590 [ 33.998811] ? __do_page_fault+0x5f7/0xc90 [ 33.998815] ? lock_downgrade+0x980/0x980 [ 33.998822] ? __fget_light+0x297/0x380 [ 33.998826] ? fget_raw+0x20/0x20 [ 33.998830] ? __handle_mm_fault+0x3ce0/0x3ce0 [ 33.998834] ? vmacache_find+0x5f/0x280 [ 33.998841] ? up_read+0x1a/0x40 [ 33.998845] ? __do_page_fault+0x3d6/0xc90 [ 33.998849] ? lock_release+0xa40/0xa40 [ 33.998855] ? __fdget+0x18/0x20 [ 33.998861] __sys_sendmsg+0xe5/0x210 [ 33.998864] ? __sys_sendmsg+0xe5/0x210 [ 33.998869] ? SyS_shutdown+0x290/0x290 [ 33.998874] ? __do_page_fault+0xc90/0xc90 [ 33.998880] ? SyS_setsockopt+0x215/0x360 [ 33.998889] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 33.998896] SyS_sendmsg+0x2d/0x50 [ 33.998901] entry_SYSCALL_64_fastpath+0x29/0xa0 [ 33.998903] RIP: 0033:0x43fdc9 [ 33.998905] RSP: 002b:00007ffe5ad2e038 EFLAGS: 00000217 ORIG_RAX: 000000000000002e [ 33.998913] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fdc9 [ 33.998915] RDX: 0000000000000000 RSI: 000000002058efc8 RDI: 0000000000000003 [ 33.998917] RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000 [ 33.998919] R10: 0000000000000004 R11: 0000000000000217 R12: 00000000004016f0 [ 33.998921] R13: 0000000000401780 R14: 0000000000000000 R15: 0000000000000000 [ 34.018827] Dumping ftrace buffer: [ 34.018831] (ftrace buffer empty) [ 34.018833] Kernel Offset: disabled [ 34.721437] Rebooting in 86400 seconds..