[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 17.999674] audit: type=1400 audit(1521536297.975:6): avc: denied { map } for pid=4220 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.21' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 24.325712] audit: type=1400 audit(1521536304.301:7): avc: denied { map } for pid=4234 comm="syzkaller880356" path="/root/syzkaller880356729" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 24.330293] ================================================================== [ 24.358998] BUG: KASAN: slab-out-of-bounds in pfkey_add+0x1634/0x3270 [ 24.365553] Read of size 8160 at addr ffff8801b1be42c0 by task syzkaller880356/4234 [ 24.373314] [ 24.374914] CPU: 0 PID: 4234 Comm: syzkaller880356 Not tainted 4.16.0-rc4+ #273 [ 24.382327] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 24.391648] Call Trace: [ 24.394210] dump_stack+0x194/0x24d [ 24.397813] ? arch_local_irq_restore+0x53/0x53 [ 24.402455] ? show_regs_print_info+0x18/0x18 [ 24.406921] ? __lock_is_held+0xb6/0x140 [ 24.410961] ? pfkey_add+0x1634/0x3270 [ 24.414822] print_address_description+0x73/0x250 [ 24.419636] ? pfkey_add+0x1634/0x3270 [ 24.423495] kasan_report+0x23c/0x360 [ 24.427270] check_memory_region+0x137/0x190 [ 24.431651] memcpy+0x23/0x50 [ 24.434729] pfkey_add+0x1634/0x3270 [ 24.438424] ? set_ipsecrequest+0x310/0x310 [ 24.442720] ? lock_release+0xa40/0xa40 [ 24.446667] ? set_ipsecrequest+0x310/0x310 [ 24.450963] pfkey_process+0x67e/0x740 [ 24.454827] ? pfkey_send_new_mapping+0x11b0/0x11b0 [ 24.459811] ? kasan_check_write+0x14/0x20 [ 24.464036] ? dup_iter+0x182/0x260 [ 24.467641] pfkey_sendmsg+0x4dc/0xa00 [ 24.471503] ? pfkey_spdget+0xb00/0xb00 [ 24.475451] ? selinux_socket_sendmsg+0x36/0x40 [ 24.480093] ? security_socket_sendmsg+0x89/0xb0 [ 24.484820] ? pfkey_spdget+0xb00/0xb00 [ 24.488766] sock_sendmsg+0xca/0x110 [ 24.492454] ___sys_sendmsg+0x767/0x8b0 [ 24.496400] ? SyS_membarrier+0x700/0x700 [ 24.500524] ? copy_msghdr_from_user+0x590/0x590 [ 24.505256] ? __pmd_alloc+0x4e0/0x4e0 [ 24.509122] ? trace_hardirqs_off+0x10/0x10 [ 24.513415] ? find_held_lock+0x35/0x1d0 [ 24.517451] ? __fget_light+0x2b2/0x3c0 [ 24.521398] ? fget_raw+0x20/0x20 [ 24.524827] ? find_held_lock+0x35/0x1d0 [ 24.528867] ? __do_page_fault+0x5f7/0xc90 [ 24.533074] ? lock_downgrade+0x980/0x980 [ 24.537201] __sys_sendmsg+0xe5/0x210 [ 24.540974] ? __sys_sendmsg+0xe5/0x210 [ 24.544920] ? SyS_shutdown+0x290/0x290 [ 24.548872] ? __do_page_fault+0x3d6/0xc90 [ 24.553089] ? move_addr_to_kernel+0x60/0x60 [ 24.557472] SyS_sendmsg+0x2d/0x50 [ 24.560982] ? __sys_sendmsg+0x210/0x210 [ 24.565014] do_syscall_64+0x281/0x940 [ 24.568873] ? __do_page_fault+0xc90/0xc90 [ 24.573081] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 24.577808] ? syscall_return_slowpath+0x550/0x550 [ 24.582709] ? syscall_return_slowpath+0x2ac/0x550 [ 24.587611] ? prepare_exit_to_usermode+0x350/0x350 [ 24.592612] ? retint_user+0x18/0x18 [ 24.596304] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 24.601126] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 24.606285] RIP: 0033:0x43fd19 [ 24.609444] RSP: 002b:00007fff6486a5e8 EFLAGS: 00000213 ORIG_RAX: 000000000000002e [ 24.617121] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fd19 [ 24.624361] RDX: 0000000000000000 RSI: 0000000020b6dfc8 RDI: 0000000000000003 [ 24.631600] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 24.638839] R10: 00000000004002c8 R11: 0000000000000213 R12: 0000000000401640 [ 24.646080] R13: 00000000004016d0 R14: 0000000000000000 R15: 0000000000000000 [ 24.653337] [ 24.654938] Allocated by task 4234: [ 24.658536] save_stack+0x43/0xd0 [ 24.661958] kasan_kmalloc+0xad/0xe0 [ 24.665642] __kmalloc_node_track_caller+0x47/0x70 [ 24.670540] __kmalloc_reserve.isra.39+0x41/0xd0 [ 24.675265] __alloc_skb+0x13b/0x780 [ 24.678949] pfkey_sendmsg+0x20f/0xa00 [ 24.682806] sock_sendmsg+0xca/0x110 [ 24.686486] ___sys_sendmsg+0x767/0x8b0 [ 24.690431] __sys_sendmsg+0xe5/0x210 [ 24.694201] SyS_sendmsg+0x2d/0x50 [ 24.697713] do_syscall_64+0x281/0x940 [ 24.701571] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 24.706726] [ 24.708327] Freed by task 0: [ 24.711311] (stack is not available) [ 24.714990] [ 24.716594] The buggy address belongs to the object at ffff8801b1be4280 [ 24.716594] which belongs to the cache kmalloc-512 of size 512 [ 24.729218] The buggy address is located 64 bytes inside of [ 24.729218] 512-byte region [ffff8801b1be4280, ffff8801b1be4480) [ 24.740973] The buggy address belongs to the page: [ 24.745873] page:ffffea0006c6f900 count:1 mapcount:0 mapping:ffff8801b1be4000 index:0x0 [ 24.753985] flags: 0x2fffc0000000100(slab) [ 24.758193] raw: 02fffc0000000100 ffff8801b1be4000 0000000000000000 0000000100000006 [ 24.766054] raw: ffffea0006c46d60 ffff8801dac01748 ffff8801dac00940 0000000000000000 [ 24.773906] page dumped because: kasan: bad access detected [ 24.779583] [ 24.781182] Memory state around the buggy address: [ 24.786080] ffff8801b1be4380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.793408] ffff8801b1be4400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.800735] >ffff8801b1be4480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.808061] ^ [ 24.811398] ffff8801b1be4500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.818725] ffff8801b1be4580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.826055] ================================================================== [ 24.833382] Disabling lock debugging due to kernel taint [ 24.838952] Kernel panic - not syncing: panic_on_warn set ... [ 24.838952] [ 24.846297] CPU: 0 PID: 4234 Comm: syzkaller880356 Tainted: G B 4.16.0-rc4+ #273 [ 24.855017] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 24.864341] Call Trace: [ 24.866898] dump_stack+0x194/0x24d [ 24.870497] ? arch_local_irq_restore+0x53/0x53 [ 24.875137] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 24.879860] ? vsnprintf+0x1ed/0x1900 [ 24.883631] ? pfkey_add+0x1600/0x3270 [ 24.887487] panic+0x1e4/0x41c [ 24.890649] ? refcount_error_report+0x214/0x214 [ 24.895372] ? add_taint+0x1c/0x50 [ 24.898879] ? add_taint+0x1c/0x50 [ 24.902390] ? pfkey_add+0x1634/0x3270 [ 24.906245] kasan_end_report+0x50/0x50 [ 24.910185] kasan_report+0x149/0x360 [ 24.913955] check_memory_region+0x137/0x190 [ 24.918341] memcpy+0x23/0x50 [ 24.921424] pfkey_add+0x1634/0x3270 [ 24.925114] ? set_ipsecrequest+0x310/0x310 [ 24.929406] ? lock_release+0xa40/0xa40 [ 24.933349] ? set_ipsecrequest+0x310/0x310 [ 24.937639] pfkey_process+0x67e/0x740 [ 24.941498] ? pfkey_send_new_mapping+0x11b0/0x11b0 [ 24.946482] ? kasan_check_write+0x14/0x20 [ 24.950695] ? dup_iter+0x182/0x260 [ 24.954295] pfkey_sendmsg+0x4dc/0xa00 [ 24.958153] ? pfkey_spdget+0xb00/0xb00 [ 24.962097] ? selinux_socket_sendmsg+0x36/0x40 [ 24.966736] ? security_socket_sendmsg+0x89/0xb0 [ 24.971460] ? pfkey_spdget+0xb00/0xb00 [ 24.975404] sock_sendmsg+0xca/0x110 [ 24.979089] ___sys_sendmsg+0x767/0x8b0 [ 24.983043] ? SyS_membarrier+0x700/0x700 [ 24.987162] ? copy_msghdr_from_user+0x590/0x590 [ 24.991893] ? __pmd_alloc+0x4e0/0x4e0 [ 24.995751] ? trace_hardirqs_off+0x10/0x10 [ 25.000043] ? find_held_lock+0x35/0x1d0 [ 25.004077] ? __fget_light+0x2b2/0x3c0 [ 25.008028] ? fget_raw+0x20/0x20 [ 25.011453] ? find_held_lock+0x35/0x1d0 [ 25.015489] ? __do_page_fault+0x5f7/0xc90 [ 25.019695] ? lock_downgrade+0x980/0x980 [ 25.023815] __sys_sendmsg+0xe5/0x210 [ 25.027587] ? __sys_sendmsg+0xe5/0x210 [ 25.031529] ? SyS_shutdown+0x290/0x290 [ 25.035477] ? __do_page_fault+0x3d6/0xc90 [ 25.039684] ? move_addr_to_kernel+0x60/0x60 [ 25.044066] SyS_sendmsg+0x2d/0x50 [ 25.047573] ? __sys_sendmsg+0x210/0x210 [ 25.051601] do_syscall_64+0x281/0x940 [ 25.055456] ? __do_page_fault+0xc90/0xc90 [ 25.059658] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 25.064386] ? syscall_return_slowpath+0x550/0x550 [ 25.069283] ? syscall_return_slowpath+0x2ac/0x550 [ 25.074180] ? prepare_exit_to_usermode+0x350/0x350 [ 25.079166] ? retint_user+0x18/0x18 [ 25.082853] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 25.087669] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 25.092826] RIP: 0033:0x43fd19 [ 25.095984] RSP: 002b:00007fff6486a5e8 EFLAGS: 00000213 ORIG_RAX: 000000000000002e [ 25.103658] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fd19 [ 25.110895] RDX: 0000000000000000 RSI: 0000000020b6dfc8 RDI: 0000000000000003 [ 25.118136] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 25.125381] R10: 00000000004002c8 R11: 0000000000000213 R12: 0000000000401640 [ 25.132627] R13: 00000000004016d0 R14: 0000000000000000 R15: 0000000000000000 [ 25.140280] Dumping ftrace buffer: [ 25.143790] (ftrace buffer empty) [ 25.147470] Kernel Offset: disabled [ 25.151067] Rebooting in 86400 seconds..