[....] Starting enhanced syslogd: rsyslogd[ 10.666947] audit: type=1400 audit(1516167481.442:4): avc: denied { syslog } for pid=3168 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.33' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 20.867690] ================================================================== [ 20.868824] BUG: KASAN: slab-out-of-bounds in sg_remove_request+0x103/0x120 [ 20.869787] Read of size 8 at addr ffff8801c1f2f140 by task syzkaller638875/3318 [ 20.870792] [ 20.871073] CPU: 0 PID: 3318 Comm: syzkaller638875 Not tainted 4.9.76-g8dec074 #23 [ 20.872181] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 20.873432] ffff8801c8997940 ffffffff81d93169 ffffea000707cbc0 ffff8801c1f2f140 [ 20.874731] 0000000000000000 ffff8801c1f2f140 ffff8801cc174438 ffff8801c8997978 [ 20.875963] ffffffff8153cb43 ffff8801c1f2f140 0000000000000008 0000000000000000 [ 20.877234] Call Trace: [ 20.877630] [] dump_stack+0xc1/0x128 [ 20.878381] [] print_address_description+0x73/0x280 [ 20.879334] [] kasan_report+0x275/0x360 [ 20.880150] [] ? sg_remove_request+0x103/0x120 [ 20.881068] [] __asan_report_load8_noabort+0x14/0x20 [ 20.881976] [] sg_remove_request+0x103/0x120 [ 20.882796] [] sg_finish_rem_req+0x295/0x340 [ 20.883616] [] sg_read+0xa1c/0x1440 [ 20.884319] [] ? sg_proc_seq_show_debug+0xd10/0xd10 [ 20.885280] [] ? fsnotify+0xf30/0xf30 [ 20.886025] [] ? avc_policy_seqno+0x9/0x20 [ 20.886837] [] do_loop_readv_writev.part.17+0x141/0x1e0 [ 20.887759] [] ? security_file_permission+0x89/0x1e0 [ 20.888691] [] ? sg_proc_seq_show_debug+0xd10/0xd10 [ 20.895325] [] ? sg_proc_seq_show_debug+0xd10/0xd10 [ 20.901958] [] compat_do_readv_writev+0x522/0x760 [ 20.908834] [] ? do_pwritev+0x1a0/0x1a0 [ 20.914468] [] ? __lru_cache_add+0x187/0x250 [ 20.920539] [] ? _raw_spin_unlock+0x2c/0x50 [ 20.926521] [] ? __pmd_alloc+0x410/0x410 [ 20.932235] [] compat_readv+0xe3/0x150 [ 20.937748] [] do_compat_readv+0xf4/0x1d0 [ 20.943531] [] ? compat_readv+0x150/0x150 [ 20.949301] [] compat_SyS_readv+0x26/0x30 [ 20.955071] [] ? SyS_pwritev2+0x80/0x80 [ 20.960667] [] do_fast_syscall_32+0x2f7/0x890 [ 20.966794] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 20.973433] [] entry_SYSENTER_compat+0x74/0x83 [ 20.979636] [ 20.981236] Allocated by task 0: [ 20.984607] (stack is not available) [ 20.988290] [ 20.989885] Freed by task 0: [ 20.992870] (stack is not available) [ 20.996555] [ 20.998158] The buggy address belongs to the object at ffff8801c1f2f100 [ 20.998158] which belongs to the cache fasync_cache of size 96 [ 21.010785] The buggy address is located 64 bytes inside of [ 21.010785] 96-byte region [ffff8801c1f2f100, ffff8801c1f2f160) [ 21.022455] The buggy address belongs to the page: [ 21.027369] page:ffffea000707cbc0 count:1 mapcount:0 mapping: (null) index:0x0 [ 21.035602] flags: 0x8000000000000080(slab) [ 21.039898] page dumped because: kasan: bad access detected [ 21.045576] [ 21.047172] Memory state around the buggy address: [ 21.052072] ffff8801c1f2f000: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 21.059404] ffff8801c1f2f080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.066736] >ffff8801c1f2f100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.074064] ^ [ 21.079493] ffff8801c1f2f180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.086829] ffff8801c1f2f200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.094156] ================================================================== [ 21.101495] Disabling lock debugging due to kernel taint [ 21.107035] Kernel panic - not syncing: panic_on_warn set ... [ 21.107035] [ 21.114375] CPU: 0 PID: 3318 Comm: syzkaller638875 Tainted: G B 4.9.76-g8dec074 #23 [ 21.123267] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 21.132593] ffff8801c8997898 ffffffff81d93169 ffffffff84195c2f ffff8801c8997970 [ 21.140579] 0000000000000000 ffff8801c1f2f140 ffff8801cc174438 ffff8801c8997960 [ 21.148561] ffffffff8142e371 0000000041b58ab3 ffffffff84189690 ffffffff8142e1b5 [ 21.156529] Call Trace: [ 21.159092] [] dump_stack+0xc1/0x128 [ 21.164428] [] panic+0x1bc/0x3a8 [ 21.169416] [] ? percpu_up_read_preempt_enable.constprop.53+0xd7/0xd7 [ 21.177622] [] ? preempt_schedule+0x25/0x30 [ 21.183606] [] ? ___preempt_schedule+0x16/0x18 [ 21.189826] [] kasan_end_report+0x50/0x50 [ 21.189830] [] kasan_report+0x167/0x360 [ 21.189837] [] ? sg_remove_request+0x103/0x120 [ 21.189846] [] __asan_report_load8_noabort+0x14/0x20 [ 21.189850] [] sg_remove_request+0x103/0x120 [ 21.189854] [] sg_finish_rem_req+0x295/0x340 [ 21.189857] [] sg_read+0xa1c/0x1440 [ 21.189861] [] ? sg_proc_seq_show_debug+0xd10/0xd10 [ 21.189865] [] ? fsnotify+0xf30/0xf30 [ 21.189872] [] ? avc_policy_seqno+0x9/0x20 [ 21.189878] [] do_loop_readv_writev.part.17+0x141/0x1e0 [ 21.189882] [] ? security_file_permission+0x89/0x1e0 [ 21.189885] [] ? sg_proc_seq_show_debug+0xd10/0xd10 [ 21.189889] [] ? sg_proc_seq_show_debug+0xd10/0xd10 [ 21.189893] [] compat_do_readv_writev+0x522/0x760 [ 21.189896] [] ? do_pwritev+0x1a0/0x1a0 [ 21.189902] [] ? __lru_cache_add+0x187/0x250 [ 21.189909] [] ? _raw_spin_unlock+0x2c/0x50 [ 21.189913] [] ? __pmd_alloc+0x410/0x410 [ 21.189917] [] compat_readv+0xe3/0x150 [ 21.189922] [] do_compat_readv+0xf4/0x1d0 [ 21.189925] [] ? compat_readv+0x150/0x150 [ 21.189929] [] compat_SyS_readv+0x26/0x30 [ 21.189933] [] ? SyS_pwritev2+0x80/0x80 [ 21.189937] [] do_fast_syscall_32+0x2f7/0x890 [ 21.189941] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 21.189945] [] entry_SYSENTER_compat+0x74/0x83 [ 21.195987] Dumping ftrace buffer: [ 21.195990] (ftrace buffer empty) [ 21.195993] Kernel Offset: disabled [ 21.365463] Rebooting in 86400 seconds..