INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added 'ci-upstream-mmots-kasan-gce-2,10.128.0.58' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 27.184819] ================================================================== [ 27.185919] BUG: KASAN: slab-out-of-bounds in sha3_final+0xeb/0x2e0 [ 27.186774] Write of size 4294967223 at addr ffff8801cd62a759 by task syzkaller427261/3047 [ 27.187872] [ 27.188104] CPU: 1 PID: 3047 Comm: syzkaller427261 Not tainted 4.14.0-mm1+ #25 [ 27.189105] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.190323] Call Trace: [ 27.190720] dump_stack+0x194/0x257 [ 27.191212] ? arch_local_irq_restore+0x53/0x53 [ 27.191867] ? show_regs_print_info+0x65/0x65 [ 27.192467] ? sock_sendmsg+0xca/0x110 [ 27.192990] ? entry_SYSCALL_64_fastpath+0x1f/0x96 [ 27.193648] ? sha3_final+0xeb/0x2e0 [ 27.194149] print_address_description+0x73/0x250 [ 27.194792] ? sha3_final+0xeb/0x2e0 [ 27.195320] kasan_report+0x25b/0x340 [ 27.195854] check_memory_region+0x137/0x190 [ 27.196444] memset+0x23/0x40 [ 27.196867] sha3_final+0xeb/0x2e0 [ 27.197350] ? sha3_512_init+0x20/0x20 [ 27.197874] crypto_shash_final+0xd3/0x1f0 [ 27.198440] ? __lock_is_held+0xbc/0x140 [ 27.199009] hmac_final+0x16c/0x2b0 [ 27.199501] ? hmac_finup+0x330/0x330 [ 27.200016] crypto_shash_final+0xd3/0x1f0 [ 27.200602] ? hash_sendmsg+0xcb/0x9c0 [ 27.201129] hmac_final+0x16c/0x2b0 [ 27.201635] ? hmac_finup+0x330/0x330 [ 27.202150] crypto_shash_final+0xd3/0x1f0 [ 27.202719] ? copy_overflow+0x30/0x30 [ 27.203241] ? crypto_shash_digest+0x120/0x120 [ 27.203854] shash_async_final+0x35/0x40 [ 27.204398] crypto_ahash_op+0xbc/0x140 [ 27.204952] crypto_ahash_final+0x57/0x70 [ 27.209070] hash_sendmsg+0x686/0x9c0 [ 27.212848] ? hash_recvmsg+0x9b0/0x9b0 [ 27.216793] sock_sendmsg+0xca/0x110 [ 27.220476] ___sys_sendmsg+0x322/0x8a0 [ 27.224422] ? copy_msghdr_from_user+0x590/0x590 [ 27.229144] ? find_held_lock+0x39/0x1d0 [ 27.233191] ? fget_raw+0x20/0x20 [ 27.236621] ? lock_downgrade+0x980/0x980 [ 27.240752] ? __fdget+0x18/0x20 [ 27.244090] __sys_sendmmsg+0x1e6/0x5f0 [ 27.248029] ? __sys_sendmmsg+0x1e6/0x5f0 [ 27.252150] ? SyS_sendmsg+0x50/0x50 [ 27.255839] ? mm_fault_error+0x2c0/0x2c0 [ 27.259955] ? kernel_accept+0x2f0/0x2f0 [ 27.263994] ? __do_page_fault+0xc90/0xc90 [ 27.268200] ? SyS_setsockopt+0x215/0x360 [ 27.272320] ? lockdep_sys_exit+0x47/0xf0 [ 27.276452] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 27.281443] SyS_sendmmsg+0x35/0x60 [ 27.285041] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 27.289764] RIP: 0033:0x4403f9 [ 27.292920] RSP: 002b:00007ffd689bc258 EFLAGS: 00000207 ORIG_RAX: 0000000000000133 [ 27.300595] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004403f9 [ 27.307835] RDX: 0000000000000005 RSI: 00000000209fe000 RDI: 0000000000000004 [ 27.315071] RBP: 0000000000000086 R08: 0000000000000000 R09: 0000000000000000 [ 27.322309] R10: 0000000000000000 R11: 0000000000000207 R12: 0000000000401d60 [ 27.329548] R13: 0000000000401df0 R14: 0000000000000000 R15: 0000000000000000 [ 27.336800] [ 27.338397] Allocated by task 3047: [ 27.341990] save_stack+0x43/0xd0 [ 27.345408] kasan_kmalloc+0xad/0xe0 [ 27.349086] __kmalloc+0x162/0x760 [ 27.352590] sock_kmalloc+0x112/0x190 [ 27.356355] hash_accept_parent_nokey+0x76/0x320 [ 27.361075] hash_accept_parent+0x9a/0xd0 [ 27.365189] af_alg_accept+0x125/0x670 [ 27.369047] alg_accept+0x46/0x60 [ 27.372466] SYSC_accept4+0x384/0x850 [ 27.376233] SyS_accept+0x26/0x30 [ 27.379650] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 27.384368] [ 27.385962] Freed by task 0: [ 27.388943] (stack is not available) [ 27.392618] [ 27.394210] The buggy address belongs to the object at ffff8801cd62a240 [ 27.394210] which belongs to the cache kmalloc-2048 of size 2048 [ 27.407010] The buggy address is located 1305 bytes inside of [ 27.407010] 2048-byte region [ffff8801cd62a240, ffff8801cd62aa40) [ 27.419027] The buggy address belongs to the page: [ 27.423926] page:ffffea0007358a80 count:1 mapcount:0 mapping:ffff8801cd62a240 index:0x0 compound_mapcount: 0 [ 27.433862] flags: 0x2fffc0000008100(slab|head) [ 27.438510] raw: 02fffc0000008100 ffff8801cd62a240 0000000000000000 0000000100000003 [ 27.446354] raw: ffffea00073342a0 ffffea0007337a20 ffff8801db000c40 0000000000000000 [ 27.454197] page dumped because: kasan: bad access detected [ 27.459869] [ 27.461475] Memory state around the buggy address: [ 27.466372] ffff8801cd62a680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.473696] ffff8801cd62a700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.481020] >ffff8801cd62a780: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc [ 27.488342] ^ [ 27.492714] ffff8801cd62a800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.500039] ffff8801cd62a880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.507362] ================================================================== [ 27.514694] Disabling lock debugging due to kernel taint [ 27.520168] Kernel panic - not syncing: panic_on_warn set ... [ 27.520168] [ 27.527503] CPU: 1 PID: 3047 Comm: syzkaller427261 Tainted: G B 4.14.0-mm1+ #25 [ 27.536132] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.545453] Call Trace: [ 27.548017] dump_stack+0x194/0x257 [ 27.551610] ? arch_local_irq_restore+0x53/0x53 [ 27.556249] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 27.560974] ? vsnprintf+0x1ed/0x1900 [ 27.564742] ? sha3_final+0xe0/0x2e0 [ 27.568426] panic+0x1e4/0x41c [ 27.571583] ? refcount_error_report+0x214/0x214 [ 27.576304] ? add_taint+0x1c/0x50 [ 27.579808] ? add_taint+0x1c/0x50 [ 27.583314] ? sha3_final+0xeb/0x2e0 [ 27.586996] kasan_end_report+0x50/0x50 [ 27.590935] kasan_report+0x144/0x340 [ 27.594704] check_memory_region+0x137/0x190 [ 27.599078] memset+0x23/0x40 [ 27.602150] sha3_final+0xeb/0x2e0 [ 27.605656] ? sha3_512_init+0x20/0x20 [ 27.609508] crypto_shash_final+0xd3/0x1f0 [ 27.613716] ? __lock_is_held+0xbc/0x140 [ 27.617742] hmac_final+0x16c/0x2b0 [ 27.621334] ? hmac_finup+0x330/0x330 [ 27.625098] crypto_shash_final+0xd3/0x1f0 [ 27.629308] ? hash_sendmsg+0xcb/0x9c0 [ 27.633169] hmac_final+0x16c/0x2b0 [ 27.636764] ? hmac_finup+0x330/0x330 [ 27.640534] crypto_shash_final+0xd3/0x1f0 [ 27.644738] ? copy_overflow+0x30/0x30 [ 27.648606] ? crypto_shash_digest+0x120/0x120 [ 27.653155] shash_async_final+0x35/0x40 [ 27.657182] crypto_ahash_op+0xbc/0x140 [ 27.661122] crypto_ahash_final+0x57/0x70 [ 27.665236] hash_sendmsg+0x686/0x9c0 [ 27.669004] ? hash_recvmsg+0x9b0/0x9b0 [ 27.672941] sock_sendmsg+0xca/0x110 [ 27.676620] ___sys_sendmsg+0x322/0x8a0 [ 27.680560] ? copy_msghdr_from_user+0x590/0x590 [ 27.685282] ? find_held_lock+0x39/0x1d0 [ 27.689316] ? fget_raw+0x20/0x20 [ 27.692737] ? lock_downgrade+0x980/0x980 [ 27.696857] ? __fdget+0x18/0x20 [ 27.700189] __sys_sendmmsg+0x1e6/0x5f0 [ 27.704132] ? __sys_sendmmsg+0x1e6/0x5f0 [ 27.708249] ? SyS_sendmsg+0x50/0x50 [ 27.711934] ? mm_fault_error+0x2c0/0x2c0 [ 27.716047] ? kernel_accept+0x2f0/0x2f0 [ 27.720079] ? __do_page_fault+0xc90/0xc90 [ 27.724281] ? SyS_setsockopt+0x215/0x360 [ 27.728397] ? lockdep_sys_exit+0x47/0xf0 [ 27.732511] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 27.737492] SyS_sendmmsg+0x35/0x60 [ 27.741085] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 27.745810] RIP: 0033:0x4403f9 [ 27.748964] RSP: 002b:00007ffd689bc258 EFLAGS: 00000207 ORIG_RAX: 0000000000000133 [ 27.756637] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004403f9 [ 27.763871] RDX: 0000000000000005 RSI: 00000000209fe000 RDI: 0000000000000004 [ 27.771103] RBP: 0000000000000086 R08: 0000000000000000 R09: 0000000000000000 [ 27.778338] R10: 0000000000000000 R11: 0000000000000207 R12: 0000000000401d60 [ 27.785576] R13: 0000000000401df0 R14: 0000000000000000 R15: 0000000000000000 [ 27.793165] Dumping ftrace buffer: [ 27.796670] (ftrace buffer empty) [ 27.800348] Kernel Offset: disabled [ 27.803940] Rebooting in 86400 seconds..