[....] Starting enhanced syslogd: rsyslogd[ 13.181315] audit: type=1400 audit(1538210067.121:4): avc: denied { syslog } for pid=1919 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.25' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 33.089448] ================================================================== [ 33.096960] BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x2418/0x24e0 [ 33.104125] Read of size 4 at addr ffff8800b6bef660 by task syz-executor434/2071 [ 33.111630] [ 33.113235] CPU: 1 PID: 2071 Comm: syz-executor434 Not tainted 4.4.158+ #105 [ 33.120391] 0000000000000000 c8fcbd098412c719 ffff8800b6beece0 ffffffff81a991dd [ 33.128373] ffffea0002dafbc0 ffff8800b6bef660 0000000000000000 ffff8800b6bef660 [ 33.136356] 0000000000000003 ffff8800b6beed18 ffffffff8148a7c9 ffff8800b6bef660 [ 33.144337] Call Trace: [ 33.146911] [] dump_stack+0xc1/0x124 [ 33.152384] [] print_address_description+0x6c/0x217 [ 33.159027] [] kasan_report.cold.6+0x175/0x2f7 [ 33.165238] [] ? xfrm_state_find+0x2418/0x24e0 [ 33.171445] [] __asan_report_load4_noabort+0x14/0x20 [ 33.178176] [] xfrm_state_find+0x2418/0x24e0 [ 33.184291] [] ? xfrm_unregister_mode+0x190/0x190 [ 33.190767] [] ? trace_hardirqs_on+0x10/0x10 [ 33.196800] [] ? __module_text_address+0x13/0x140 [ 33.203267] [] ? check_usage_backwards+0x122/0x290 [ 33.209827] [] ? check_usage_forwards+0x290/0x290 [ 33.216299] [] xfrm_tmpl_resolve_one+0x1d2/0x7a0 [ 33.222680] [] ? xfrm_expand_policies.constprop.15+0x290/0x290 [ 33.230278] [] ? usage_match+0x80/0x80 [ 33.235787] [] ? mark_lock+0x8bc/0x12c0 [ 33.241446] [] ? check_usage_forwards+0x290/0x290 [ 33.247927] [] ? __lock_acquire+0x17e4/0x5f10 [ 33.254056] [] xfrm_resolve_and_create_bundle+0x219/0x1da0 [ 33.261307] [] ? trace_hardirqs_on+0x10/0x10 [ 33.267345] [] ? xfrm_tmpl_resolve_one+0x7a0/0x7a0 [ 33.273914] [] ? trace_hardirqs_on+0x10/0x10 [ 33.279950] [] ? __lock_acquire+0xa85/0x5f10 [ 33.286058] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 33.292796] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 33.299536] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 33.305834] [] ? xfrm_sk_policy_lookup+0x228/0x350 [ 33.312392] [] ? xfrm_sk_policy_lookup+0x24f/0x350 [ 33.318954] [] ? xfrm_expand_policies.constprop.15+0x1c1/0x290 [ 33.326554] [] xfrm_lookup+0x238/0xb70 [ 33.332069] [] ? __down_interruptible+0x2b2/0x480 [ 33.338664] [] ? xfrm_sk_policy_lookup+0x350/0x350 [ 33.345222] [] ? __ip_route_output_key_hash+0xc7b/0x2040 [ 33.352346] [] ? __ip_route_output_key_hash+0xca2/0x2040 [ 33.359441] [] ? __ip_route_output_key_hash+0x16a/0x2040 [ 33.366518] [] ? rt_set_nexthop.constprop.13+0xcc0/0xcc0 [ 33.373598] [] xfrm_lookup_route+0x39/0x140 [ 33.379547] [] ip_route_output_flow+0x90/0xa0 [ 33.385666] [] udp_sendmsg+0x1480/0x1c70 [ 33.391358] [] ? udp_sendmsg+0x615/0x1c70 [ 33.397132] [] ? ip_reply_glue_bits+0xc0/0xc0 [ 33.403323] [] ? udp_lib_unhash+0x630/0x630 [ 33.409290] [] ? trace_hardirqs_on+0x10/0x10 [ 33.415324] [] ? mark_held_locks+0xc7/0x130 [ 33.421273] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 33.427568] [] udpv6_sendmsg+0x12cd/0x24c0 [ 33.433428] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 33.439796] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 33.446617] [] ? udp_lib_get_port+0x718/0xe20 [ 33.452739] [] ? udp_v6_flush_pending_frames+0xe0/0xe0 [ 33.459644] [] ? udpv6_rcv+0x30/0x30 [ 33.464983] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 33.471714] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 33.478008] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 33.484823] [] ? release_sock+0x3b6/0x500 [ 33.490603] [] ? trace_hardirqs_on+0xd/0x10 [ 33.496604] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 33.502958] [] ? _raw_spin_unlock_bh+0x30/0x40 [ 33.509172] [] ? release_sock+0x3b6/0x500 [ 33.514947] [] ? udp_v6_get_port+0xa7/0xd0 [ 33.520874] [] inet_sendmsg+0x203/0x4d0 [ 33.526480] [] ? inet_sendmsg+0x73/0x4d0 [ 33.532167] [] ? inet_recvmsg+0x4c0/0x4c0 [ 33.537942] [] sock_sendmsg+0xbb/0x110 [ 33.543452] [] ___sys_sendmsg+0x441/0x880 [ 33.549224] [] ? copy_msghdr_from_user+0x550/0x550 [ 33.555778] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 33.562505] [] ? avc_has_perm+0x15a/0x3a0 [ 33.568278] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 33.575006] [] ? __fget_light+0x9f/0x1f0 [ 33.580754] [] ? __fdget+0x18/0x20 [ 33.585933] [] __sys_sendmmsg+0x12e/0x2e0 [ 33.591707] [] ? SyS_sendmsg+0x50/0x50 [ 33.597231] [] ? handle_mm_fault+0x49a/0x2f30 [ 33.603368] [] ? ipv6_setsockopt+0x68/0x130 [ 33.609314] [] ? sock_common_setsockopt+0x9a/0xe0 [ 33.615894] [] ? SyS_setsockopt+0x185/0x260 [ 33.621847] [] ? __do_page_fault+0x2b6/0x7e0 [ 33.627893] [] ? SyS_recv+0x40/0x40 [ 33.633145] [] ? retint_user+0x18/0x3c [ 33.638656] [] SyS_sendmmsg+0x35/0x60 [ 33.644085] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 33.650634] [ 33.652237] The buggy address belongs to the page: [ 33.657138] page:ffffea0002dafbc0 count:0 mapcount:0 mapping: (null) index:0x0 [ 33.665250] flags: 0x0() [ 33.668012] page dumped because: kasan: bad access detected [ 33.673743] [ 33.675355] Memory state around the buggy address: [ 33.680257] ffff8800b6bef500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.687590] ffff8800b6bef580: 00 f1 f1 f1 f1 00 f2 f2 f2 f2 f2 f2 f2 00 00 00 [ 33.694919] >ffff8800b6bef600: f2 f2 f2 f2 f2 00 00 00 00 00 00 00 f2 f2 f2 f2 [ 33.702249] ^ [ 33.708712] ffff8800b6bef680: f2 00 00 00 00 00 00 00 00 00 f2 f2 f2 00 00 00 [ 33.716091] ffff8800b6bef700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.723429] ================================================================== [ 33.730761] Disabling lock debugging due to kernel taint [ 33.736248] Kernel panic - not syncing: panic_on_warn set ... [ 33.736248] [ 33.743609] CPU: 1 PID: 2071 Comm: syz-executor434 Tainted: G B 4.4.158+ #105 [ 33.751995] 0000000000000000 c8fcbd098412c719 ffff8800b6beec40 ffffffff81a991dd [ 33.759979] ffffffff82c4b2e1 0000000000000004 0000000000000000 ffff8800b6bef660 [ 33.767955] 0000000000000003 ffff8800b6beed00 ffffffff813a1024 0000000041b58ab3 [ 33.775935] Call Trace: [ 33.778504] [] dump_stack+0xc1/0x124 [ 33.783850] [] panic+0x19e/0x359 [ 33.788839] [] ? add_taint.cold.4+0x16/0x16 [ 33.794787] [] kasan_end_report+0x47/0x4f [ 33.800559] [] kasan_report.cold.6+0x192/0x2f7 [ 33.806770] [] ? xfrm_state_find+0x2418/0x24e0 [ 33.812978] [] __asan_report_load4_noabort+0x14/0x20 [ 33.819706] [] xfrm_state_find+0x2418/0x24e0 [ 33.825792] [] ? xfrm_unregister_mode+0x190/0x190 [ 33.832268] [] ? trace_hardirqs_on+0x10/0x10 [ 33.838305] [] ? __module_text_address+0x13/0x140 [ 33.844780] [] ? check_usage_backwards+0x122/0x290 [ 33.851337] [] ? check_usage_forwards+0x290/0x290 [ 33.857815] [] xfrm_tmpl_resolve_one+0x1d2/0x7a0 [ 33.864197] [] ? xfrm_expand_policies.constprop.15+0x290/0x290 [ 33.871791] [] ? usage_match+0x80/0x80 [ 33.877306] [] ? mark_lock+0x8bc/0x12c0 [ 33.882903] [] ? check_usage_forwards+0x290/0x290 [ 33.889375] [] ? __lock_acquire+0x17e4/0x5f10 [ 33.895503] [] xfrm_resolve_and_create_bundle+0x219/0x1da0 [ 33.902752] [] ? trace_hardirqs_on+0x10/0x10 [ 33.908788] [] ? xfrm_tmpl_resolve_one+0x7a0/0x7a0 [ 33.915359] [] ? trace_hardirqs_on+0x10/0x10 [ 33.921440] [] ? __lock_acquire+0xa85/0x5f10 [ 33.927489] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 33.934265] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 33.941068] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 33.947382] [] ? xfrm_sk_policy_lookup+0x228/0x350 [ 33.953934] [] ? xfrm_sk_policy_lookup+0x24f/0x350 [ 33.960491] [] ? xfrm_expand_policies.constprop.15+0x1c1/0x290 [ 33.968088] [] xfrm_lookup+0x238/0xb70 [ 33.973603] [] ? __down_interruptible+0x2b2/0x480 [ 33.980072] [] ? xfrm_sk_policy_lookup+0x350/0x350 [ 33.986625] [] ? __ip_route_output_key_hash+0xc7b/0x2040 [ 33.993703] [] ? __ip_route_output_key_hash+0xca2/0x2040 [ 34.000779] [] ? __ip_route_output_key_hash+0x16a/0x2040 [ 34.007853] [] ? rt_set_nexthop.constprop.13+0xcc0/0xcc0 [ 34.014930] [] xfrm_lookup_route+0x39/0x140 [ 34.020878] [] ip_route_output_flow+0x90/0xa0 [ 34.026998] [] udp_sendmsg+0x1480/0x1c70 [ 34.032683] [] ? udp_sendmsg+0x615/0x1c70 [ 34.038460] [] ? ip_reply_glue_bits+0xc0/0xc0 [ 34.044578] [] ? udp_lib_unhash+0x630/0x630 [ 34.050526] [] ? trace_hardirqs_on+0x10/0x10 [ 34.056558] [] ? mark_held_locks+0xc7/0x130 [ 34.062508] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 34.068805] [] udpv6_sendmsg+0x12cd/0x24c0 [ 34.074856] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 34.081152] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 34.087972] [] ? udp_lib_get_port+0x718/0xe20 [ 34.094143] [] ? udp_v6_flush_pending_frames+0xe0/0xe0 [ 34.101053] [] ? udpv6_rcv+0x30/0x30 [ 34.106397] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 34.113126] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 34.119426] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 34.126243] [] ? release_sock+0x3b6/0x500 [ 34.132016] [] ? trace_hardirqs_on+0xd/0x10 [ 34.138080] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 34.144381] [] ? _raw_spin_unlock_bh+0x30/0x40 [ 34.150593] [] ? release_sock+0x3b6/0x500 [ 34.156371] [] ? udp_v6_get_port+0xa7/0xd0 [ 34.162361] [] inet_sendmsg+0x203/0x4d0 [ 34.167962] [] ? inet_sendmsg+0x73/0x4d0 [ 34.173647] [] ? inet_recvmsg+0x4c0/0x4c0 [ 34.179423] [] sock_sendmsg+0xbb/0x110 [ 34.184933] [] ___sys_sendmsg+0x441/0x880 [ 34.190776] [] ? copy_msghdr_from_user+0x550/0x550 [ 34.197338] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 34.204076] [] ? avc_has_perm+0x15a/0x3a0 [ 34.209851] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 34.216578] [] ? __fget_light+0x9f/0x1f0 [ 34.222264] [] ? __fdget+0x18/0x20 [ 34.227429] [] __sys_sendmmsg+0x12e/0x2e0 [ 34.233199] [] ? SyS_sendmsg+0x50/0x50 [ 34.238711] [] ? handle_mm_fault+0x49a/0x2f30 [ 34.244834] [] ? ipv6_setsockopt+0x68/0x130 [ 34.250784] [] ? sock_common_setsockopt+0x9a/0xe0 [ 34.257255] [] ? SyS_setsockopt+0x185/0x260 [ 34.263210] [] ? __do_page_fault+0x2b6/0x7e0 [ 34.269253] [] ? SyS_recv+0x40/0x40 [ 34.274528] [] ? retint_user+0x18/0x3c [ 34.280057] [] SyS_sendmmsg+0x35/0x60 [ 34.285514] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 34.285847] Kernel Offset: disabled [ 34.295997] Rebooting in 86400 seconds..