INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-kasan-gce-386-2,10.128.0.21' (ECDSA) to the list of known hosts.
net.ipv6.conf.syz0.accept_dad = 0
net.ipv6.conf.syz0.router_solicitations = 0
executing program
syzkaller login: [   25.469909] ==================================================================
[   25.477334] BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x305b/0x3190
[   25.484493] Read of size 4 at addr ffff8801cd7d6708 by task syzkaller109277/3013
[   25.491995] 
[   25.493604] CPU: 1 PID: 3013 Comm: syzkaller109277 Not tainted 4.14.0-rc2+ #11
[   25.500933] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   25.510261] Call Trace:
[   25.512827]  dump_stack+0x194/0x257
[   25.516429]  ? arch_local_irq_restore+0x53/0x53
[   25.521070]  ? show_regs_print_info+0x65/0x65
[   25.525541]  ? lock_release+0xd70/0xd70
[   25.529487]  ? print_usage_bug+0x480/0x480
[   25.533696]  ? xfrm_state_find+0x305b/0x3190
[   25.538079]  print_address_description+0x73/0x250
[   25.542893]  ? xfrm_state_find+0x305b/0x3190
[   25.547271]  kasan_report+0x25b/0x340
[   25.551045]  __asan_report_load4_noabort+0x14/0x20
[   25.555947]  xfrm_state_find+0x305b/0x3190
[   25.560174]  ? xfrm_state_afinfo_get_rcu+0x160/0x160
[   25.565247]  ? print_usage_bug+0x480/0x480
[   25.569459]  ? __lock_acquire+0x732/0x4620
[   25.573689]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   25.578867]  ? __lock_acquire+0x732/0x4620
[   25.583098]  ? __lock_acquire+0x732/0x4620
[   25.587311]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   25.592484]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   25.597649]  ? check_noncircular+0x20/0x20
[   25.601860]  ? check_noncircular+0x20/0x20
[   25.606077]  xfrm_tmpl_resolve+0x2fb/0xbd0
[   25.610301]  ? __xfrm_decode_session+0x100/0x100
[   25.615034]  ? rcu_read_lock_sched_held+0x108/0x120
[   25.620023]  ? fib_table_lookup+0xa07/0x1a30
[   25.624408]  ? check_noncircular+0x20/0x20
[   25.628626]  xfrm_resolve_and_create_bundle+0x186/0x24b0
[   25.634051]  ? inet_netconf_get_devconf+0x4f0/0x4f0
[   25.639056]  ? xfrm_tmpl_resolve+0xbd0/0xbd0
[   25.643441]  ? lock_downgrade+0x990/0x990
[   25.647579]  ? xfrm_selector_match+0xe00/0xe00
[   25.652139]  ? rcu_read_lock_held+0xa9/0xc0
[   25.656434]  ? find_exception+0x3aa/0x520
[   25.660555]  ? lock_release+0xd70/0xd70
[   25.664506]  ? refcount_inc_not_zero+0xfe/0x180
[   25.669155]  ? xfrm_selector_match+0x3b/0xe00
[   25.673627]  ? xfrm_sk_policy_lookup+0x2cf/0x3d0
[   25.678360]  ? xfrm_selector_match+0xe00/0xe00
[   25.682915]  ? check_noncircular+0x20/0x20
[   25.687118]  ? ip_route_output_key_hash_rcu+0x604/0x2c20
[   25.692552]  xfrm_lookup+0xf0a/0x2540
[   25.696324]  ? xfrm_lookup+0xf0a/0x2540
[   25.700272]  ? ip_route_input_noref+0x1e0/0x1e0
[   25.704929]  ? xfrm_policy_lookup_bytype.constprop.49+0x16f0/0x16f0
[   25.711310]  ? find_held_lock+0x39/0x1d0
[   25.715354]  ? lock_downgrade+0x990/0x990
[   25.719483]  ? selinux_netlbl_sock_rcv_skb+0x9e/0x730
[   25.724660]  ? ip_route_output_key_hash+0x1a6/0x370
[   25.729656]  ? lock_release+0xd70/0xd70
[   25.733604]  ? selinux_nf_register+0x30/0x30
[   25.737985]  ? __lock_acquire+0x732/0x4620
[   25.742212]  ? selinux_sock_rcv_skb_compat+0x2f4/0x480
[   25.747464]  ? ip_route_output_key_hash+0x252/0x370
[   25.752454]  ? ip_route_output_key_hash_rcu+0x2c20/0x2c20
[   25.757972]  xfrm_lookup_route+0x39/0x1a0
[   25.762095]  ip_route_output_flow+0x7c/0xa0
[   25.766393]  inet_csk_route_req+0x5d8/0x990
[   25.770695]  tcp_v4_send_synack+0x1e4/0x270
[   25.774998]  ? tcp_v4_send_check+0x90/0x90
[   25.779211]  ? prandom_u32_state+0x13/0x180
[   25.783511]  tcp_rtx_synack+0x119/0x2e0
[   25.787459]  ? tcp_event_new_data_sent+0x2e0/0x2e0
[   25.792362]  ? __lock_is_held+0xbc/0x140
[   25.796407]  inet_rtx_syn_ack+0x64/0xd0
[   25.800352]  tcp_check_req+0xaf5/0x1630
[   25.804312]  ? tcp_openreq_init_rwin+0xae0/0xae0
[   25.809040]  ? refcount_inc_not_zero+0xfe/0x180
[   25.813688]  ? refcount_add+0x60/0x60
[   25.817458]  ? tcp_v4_reqsk_send_ack+0x3e0/0x3e0
[   25.822190]  ? tcp_filter+0x111/0x160
[   25.825965]  tcp_v4_rcv+0x17b0/0x2f20
[   25.829744]  ? lock_acquire+0x1d5/0x580
[   25.833707]  ? tcp_v4_early_demux+0xa30/0xa30
[   25.838186]  ip_local_deliver_finish+0x2e2/0xba0
[   25.842926]  ? inet_del_offload+0x40/0x40
[   25.847050]  ? nf_hook_slow+0xd3/0x1a0
[   25.850918]  ip_local_deliver+0x1ce/0x6e0
[   25.855039]  ? ip_call_ra_chain+0x6d0/0x6d0
[   25.859341]  ? inet_del_offload+0x40/0x40
[   25.863467]  ip_rcv_finish+0x8db/0x19c0
[   25.867421]  ? ip_local_deliver_finish+0xba0/0xba0
[   25.872323]  ? iptable_nat_ipv4_fn+0x40/0x40
[   25.876708]  ? nf_nat_ipv4_in_range+0xf0/0xf0
[   25.881174]  ? ip_rcv+0xc20/0x17d0
[   25.884691]  ? tcp_v4_send_synack+0x270/0x270
[   25.889158]  ? nf_nat_ipv4_in+0x1cd/0x270
[   25.893274]  ? iptable_nat_ipv4_fn+0x40/0x40
[   25.897661]  ? nf_hook_slow+0xd3/0x1a0
[   25.901525]  ip_rcv+0xc3f/0x17d0
[   25.904871]  ? ip_local_deliver+0x6e0/0x6e0
[   25.909168]  ? __lock_acquire+0x732/0x4620
[   25.913388]  ? ip_local_deliver_finish+0xba0/0xba0
[   25.918295]  ? ip_local_deliver+0x6e0/0x6e0
[   25.922600]  __netif_receive_skb_core+0x19af/0x33d0
[   25.927618]  ? print_usage_bug+0x480/0x480
[   25.931839]  ? nf_ingress+0x9f0/0x9f0
[   25.935616]  ? kasan_kmalloc+0xad/0xe0
[   25.939472]  ? kmem_cache_alloc+0x12e/0x760
[   25.943763]  ? __build_skb+0x9d/0x450
[   25.947542]  ? build_skb+0x6f/0x260
[   25.951141]  ? tun_build_skb.isra.42+0x92f/0x1690
[   25.955955]  ? tun_get_user+0x1dad/0x2150
[   25.960073]  ? tun_chr_write_iter+0xde/0x190
[   25.964452]  ? __vfs_write+0x68a/0x970
[   25.968312]  ? __skb_flow_get_ports+0x151/0x400
[   25.972953]  ? skb_flow_dissector_init+0x280/0x280
[   25.977857]  ? check_noncircular+0x20/0x20
[   25.982061]  ? __skb_flow_get_ports+0x151/0x400
[   25.986709]  ? __skb_flow_dissect+0x85b/0x3bc0
[   25.991277]  ? find_held_lock+0x39/0x1d0
[   25.995321]  ? lock_downgrade+0x990/0x990
[   25.999442]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   26.004607]  ? lock_acquire+0x1d5/0x580
[   26.008561]  ? netif_receive_skb_internal+0x1d7/0x670
[   26.013739]  ? pvclock_read_flags+0x160/0x160
[   26.018202]  ? tun_build_skb.isra.42+0x455/0x1690
[   26.023029]  ? lock_acquire+0x1d5/0x580
[   26.026977]  ? netif_receive_skb_internal+0xa2/0x670
[   26.032065]  ? ktime_get_with_offset+0x2c1/0x420
[   26.036796]  ? lock_release+0xd70/0xd70
[   26.040742]  ? ktime_get+0x3a0/0x3a0
[   26.044428]  ? skb_put+0x149/0x1c0
[   26.047950]  __netif_receive_skb+0x2c/0x1b0
[   26.052244]  ? __netif_receive_skb+0x2c/0x1b0
[   26.056713]  netif_receive_skb_internal+0x10b/0x670
[   26.061704]  ? dev_cpu_dead+0xb00/0xb00
[   26.065652]  ? lock_release+0xd70/0xd70
[   26.069597]  ? is_bpf_text_address+0x7b/0x120
[   26.074063]  ? lock_downgrade+0x990/0x990
[   26.078186]  ? rcu_pm_notify+0xc0/0xc0
[   26.082044]  ? bpf_prog_alloc+0x310/0x310
[   26.086175]  netif_receive_skb+0xae/0x390
[   26.090296]  ? netif_receive_skb_internal+0x670/0x670
[   26.095461]  ? lock_downgrade+0x990/0x990
[   26.099587]  ? tun_rx_batched.isra.43+0x5c3/0x860
[   26.104405]  tun_rx_batched.isra.43+0x5ed/0x860
[   26.109047]  ? skb_get_hash_perturb+0x9d0/0x9d0
[   26.113695]  ? tun_sock_write_space+0x370/0x370
[   26.118353]  tun_get_user+0x11dd/0x2150
[   26.122313]  ? tun_build_skb.isra.42+0x1690/0x1690
[   26.127216]  ? lock_release+0xd70/0xd70
[   26.131168]  ? tun_chr_close+0x60/0x60
[   26.135035]  ? lock_release+0xd70/0xd70
[   26.138985]  ? __lock_is_held+0xbc/0x140
[   26.143033]  ? __tun_get+0x1d4/0x2e0
[   26.146725]  ? tun_chr_close+0x60/0x60
[   26.150594]  tun_chr_write_iter+0xde/0x190
[   26.154803]  __vfs_write+0x68a/0x970
[   26.158503]  ? kernel_read+0x120/0x120
[   26.162377]  ? avc_policy_seqno+0x9/0x20
[   26.166409]  ? selinux_file_permission+0x82/0x460
[   26.171234]  ? rw_verify_area+0xe5/0x2b0
[   26.175268]  ? __fdget_raw+0x20/0x20
[   26.178958]  vfs_write+0x18f/0x510
[   26.182476]  SyS_write+0xef/0x220
[   26.185906]  ? SyS_read+0x220/0x220
[   26.189503]  ? lock_acquire+0x1d5/0x580
[   26.193449]  ? finish_task_switch+0x1aa/0x740
[   26.197915]  ? do_fast_syscall_32+0x158/0xf05
[   26.202390]  ? SyS_read+0x220/0x220
[   26.205990]  do_fast_syscall_32+0x3f2/0xf05
[   26.210283]  ? compat_start_thread+0x80/0x80
[   26.214676]  ? do_int80_syscall_32+0x940/0x940
[   26.219234]  ? lockdep_sys_exit+0x47/0xf0
[   26.223352]  ? syscall_return_slowpath+0x2b3/0x510
[   26.228252]  ? finish_task_switch+0x1aa/0x740
[   26.232719]  ? prepare_exit_to_usermode+0x2d0/0x2d0
[   26.237718]  ? sysret32_from_system_call+0x5/0x3b
[   26.242537]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   26.247359]  entry_SYSENTER_compat+0x51/0x60
[   26.251746] RIP: 0023:0xf7f6ac79
[   26.255078] RSP: 002b:00000000f2f5c1f4 EFLAGS: 00000292 ORIG_RAX: 0000000000000004
[   26.262759] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020002000
[   26.270001] RDX: 0000000000000036 RSI: 0000000000000000 RDI: 00000000003d0f00
[   26.277241] RBP: 00000000f2f5c2e8 R08: 0000000000000000 R09: 0000000000000000
[   26.284482] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[   26.291724] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   26.298983] 
[   26.300579] The buggy address belongs to the page:
[   26.305490] page:ffffea000735f580 count:0 mapcount:0 mapping:          (null) index:0xffff8801cd7d68c0
[   26.314914] flags: 0x200000000000000()
[   26.318773] raw: 0200000000000000 0000000000000000 ffff8801cd7d68c0 00000000ffffffff
[   26.326622] raw: 0000000000000000 dead000000000200 0000000000000000 0000000000000000
[   26.334470] page dumped because: kasan: bad access detected
[   26.340146] 
[   26.341743] Memory state around the buggy address:
[   26.346642]  ffff8801cd7d6600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   26.353970]  ffff8801cd7d6680: 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 00
[   26.361298] >ffff8801cd7d6700: 00 f2 f3 f3 f3 f3 00 00 00 00 00 00 00 f1 f1 f1
[   26.368625]                       ^
[   26.372223]  ffff8801cd7d6780: f1 00 00 00 00 00 00 00 00 00 00 00 f2 f3 f3 f3
[   26.379556]  ffff8801cd7d6800: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   26.386893] ==================================================================
[   26.394225] Disabling lock debugging due to kernel taint
[   26.399679] Kernel panic - not syncing: panic_on_warn set ...
[   26.399679] 
[   26.407007] CPU: 1 PID: 3013 Comm: syzkaller109277 Tainted: G    B           4.14.0-rc2+ #11
[   26.415548] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   26.424864] Call Trace:
[   26.427420]  dump_stack+0x194/0x257
[   26.431013]  ? arch_local_irq_restore+0x53/0x53
[   26.435658]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   26.440382]  ? xfrm_state_find+0x2fc0/0x3190
[   26.444757]  panic+0x1e4/0x417
[   26.447922]  ? __warn+0x1d9/0x1d9
[   26.451346]  ? xfrm_state_find+0x305b/0x3190
[   26.455717]  kasan_end_report+0x50/0x50
[   26.459656]  kasan_report+0x144/0x340
[   26.463425]  __asan_report_load4_noabort+0x14/0x20
[   26.468318]  xfrm_state_find+0x305b/0x3190