[....] Starting enhanced syslogd: rsyslogd[ 11.034596] audit: type=1400 audit(1515188937.517:4): avc: denied { syslog } for pid=3172 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.15.212' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 22.772988] ================================================================== [ 22.774086] BUG: KASAN: slab-out-of-bounds in pfkey_add+0x153e/0x3470 [ 22.774967] Read of size 8192 at addr ffff8801c8913418 by task syzkaller441281/3327 [ 22.775984] [ 22.776214] CPU: 0 PID: 3327 Comm: syzkaller441281 Not tainted 4.9.74-g173c52e #14 [ 22.777221] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 22.778440] ffff8801c85bf718 ffffffff81d91b09 ffffea0007224480 ffff8801c8913418 [ 22.779573] 0000000000000000 ffff8801c8913600 ffff8801c85bf958 ffff8801c85bf750 [ 22.780701] ffffffff8153b503 ffff8801c8913418 0000000000002000 0000000000000000 [ 22.781860] Call Trace: [ 22.782217] [] dump_stack+0xc1/0x128 [ 22.782948] [] print_address_description+0x73/0x280 [ 22.783860] [] kasan_report+0x275/0x360 [ 22.784604] [] ? pfkey_add+0x153e/0x3470 [ 22.785358] [] check_memory_region+0x137/0x190 [ 22.786187] [] memcpy+0x23/0x50 [ 22.786839] [] pfkey_add+0x153e/0x3470 [ 22.787584] [] ? pfkey_delete+0x360/0x360 [ 22.788367] [] ? pfkey_seq_stop+0x80/0x80 [ 22.789179] [] ? __skb_clone+0x24a/0x7d0 [ 22.789931] [] ? pfkey_delete+0x360/0x360 [ 22.790694] [] pfkey_process+0x61e/0x730 [ 22.791445] [] ? pfkey_send_new_mapping+0x11b0/0x11b0 [ 22.792342] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 22.794426] [] pfkey_sendmsg+0x3a9/0x760 [ 22.800101] [] ? pfkey_spdget+0x820/0x820 [ 22.805863] [] sock_sendmsg+0xca/0x110 [ 22.811372] [] ___sys_sendmsg+0x6d1/0x7e0 [ 22.817138] [] ? copy_msghdr_from_user+0x550/0x550 [ 22.823684] [] ? __lru_cache_add+0x187/0x250 [ 22.829715] [] ? do_huge_pmd_anonymous_page+0xb05/0x10d0 [ 22.836782] [] ? _raw_spin_unlock+0x2c/0x50 [ 22.842717] [] ? do_huge_pmd_anonymous_page+0x2d4/0x10d0 [ 22.849780] [] ? handle_mm_fault+0x6ee/0x2530 [ 22.855887] [] ? __fget_light+0x158/0x1e0 [ 22.861646] [] ? __fdget+0x18/0x20 [ 22.866802] [] ? sockfd_lookup_light+0x118/0x160 [ 22.873170] [] __sys_sendmsg+0xd6/0x190 [ 22.878757] [] ? SyS_shutdown+0x1b0/0x1b0 [ 22.884518] [] ? __do_page_fault+0x5ec/0xd40 [ 22.890549] [] compat_SyS_sendmsg+0x2a/0x40 [ 22.896488] [] ? compat_SyS_getsockopt+0x2a0/0x2a0 [ 22.903031] [] do_fast_syscall_32+0x2f7/0x890 [ 22.909140] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 22.915774] [] entry_SYSENTER_compat+0x51/0x60 [ 22.921968] [ 22.923568] Allocated by task 3327: [ 22.927159] save_stack_trace+0x16/0x20 [ 22.931094] save_stack+0x43/0xd0 [ 22.935000] kasan_kmalloc+0xad/0xe0 [ 22.938678] kasan_slab_alloc+0x12/0x20 [ 22.942616] __kmalloc_track_caller+0xda/0x2b0 [ 22.947165] __kmalloc_reserve.isra.37+0x33/0xc0 [ 22.951882] __alloc_skb+0x119/0x600 [ 22.955560] pfkey_sendmsg+0x135/0x760 [ 22.959411] sock_sendmsg+0xca/0x110 [ 22.963088] ___sys_sendmsg+0x6d1/0x7e0 [ 22.967024] __sys_sendmsg+0xd6/0x190 [ 22.970794] compat_SyS_sendmsg+0x2a/0x40 [ 22.974905] do_fast_syscall_32+0x2f7/0x890 [ 22.979190] entry_SYSENTER_compat+0x51/0x60 [ 22.983558] [ 22.985148] Freed by task 1873: [ 22.988394] save_stack_trace+0x16/0x20 [ 22.992336] save_stack+0x43/0xd0 [ 22.995752] kasan_slab_free+0x72/0xc0 [ 22.999601] kfree+0x103/0x300 [ 23.002756] kernfs_fop_release+0xff/0x140 [ 23.006962] __fput+0x28c/0x6e0 [ 23.010210] ____fput+0x15/0x20 [ 23.013460] task_work_run+0x115/0x190 [ 23.017309] exit_to_usermode_loop+0xfc/0x120 [ 23.021768] syscall_return_slowpath+0x1a0/0x1e0 [ 23.026488] entry_SYSCALL_64_fastpath+0xc4/0xc6 [ 23.031204] [ 23.032796] The buggy address belongs to the object at ffff8801c8913400 [ 23.032796] which belongs to the cache kmalloc-512 of size 512 [ 23.045421] The buggy address is located 24 bytes inside of [ 23.045421] 512-byte region [ffff8801c8913400, ffff8801c8913600) [ 23.057179] The buggy address belongs to the page: [ 23.062072] page:ffffea0007224480 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 23.072220] flags: 0x8000000000004080(slab|head) [ 23.076934] page dumped because: kasan: bad access detected [ 23.082602] [ 23.084192] Memory state around the buggy address: [ 23.089081] ffff8801c8913500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 23.096405] ffff8801c8913580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 23.103727] >ffff8801c8913600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.111050] ^ [ 23.114381] ffff8801c8913680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.121703] ffff8801c8913700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.129021] ================================================================== [ 23.136342] Disabling lock debugging due to kernel taint [ 23.142129] Kernel panic - not syncing: panic_on_warn set ... [ 23.142129] [ 23.149473] CPU: 0 PID: 3327 Comm: syzkaller441281 Tainted: G B 4.9.74-g173c52e #14 [ 23.158365] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 23.167686] ffff8801c85bf670 ffffffff81d91b09 ffffffff841955df ffff8801c85bf748 [ 23.175645] 0000000000000000 ffff8801c8913600 ffff8801c85bf958 ffff8801c85bf738 [ 23.183586] ffffffff8142d161 0000000041b58ab3 ffffffff84189020 ffffffff8142cfa5 [ 23.191527] Call Trace: [ 23.194084] [] dump_stack+0xc1/0x128 [ 23.199420] [] panic+0x1bc/0x3a8 [ 23.204404] [] ? percpu_up_read_preempt_enable.constprop.53+0xd7/0xd7 [ 23.212597] [] ? preempt_schedule+0x25/0x30 [ 23.218534] [] ? ___preempt_schedule+0x16/0x18 [ 23.224729] [] kasan_end_report+0x50/0x50 [ 23.230489] [] kasan_report+0x167/0x360 [ 23.236075] [] ? pfkey_add+0x153e/0x3470 [ 23.241749] [] check_memory_region+0x137/0x190 [ 23.247943] [] memcpy+0x23/0x50 [ 23.252836] [] pfkey_add+0x153e/0x3470 [ 23.258335] [] ? pfkey_delete+0x360/0x360 [ 23.264095] [] ? pfkey_seq_stop+0x80/0x80 [ 23.269855] [] ? __skb_clone+0x24a/0x7d0 [ 23.275526] [] ? pfkey_delete+0x360/0x360 [ 23.281285] [] pfkey_process+0x61e/0x730 [ 23.286961] [] ? pfkey_send_new_mapping+0x11b0/0x11b0 [ 23.293763] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 23.300567] [] pfkey_sendmsg+0x3a9/0x760 [ 23.306246] [] ? pfkey_spdget+0x820/0x820 [ 23.312014] [] sock_sendmsg+0xca/0x110 [ 23.317513] [] ___sys_sendmsg+0x6d1/0x7e0 [ 23.323273] [] ? copy_msghdr_from_user+0x550/0x550 [ 23.329816] [] ? __lru_cache_add+0x187/0x250 [ 23.335838] [] ? do_huge_pmd_anonymous_page+0xb05/0x10d0 [ 23.342909] [] ? _raw_spin_unlock+0x2c/0x50 [ 23.348845] [] ? do_huge_pmd_anonymous_page+0x2d4/0x10d0 [ 23.355908] [] ? handle_mm_fault+0x6ee/0x2530 [ 23.362016] [] ? __fget_light+0x158/0x1e0 [ 23.367783] [] ? __fdget+0x18/0x20 [ 23.372936] [] ? sockfd_lookup_light+0x118/0x160 [ 23.379303] [] __sys_sendmsg+0xd6/0x190 [ 23.384889] [] ? SyS_shutdown+0x1b0/0x1b0 [ 23.390654] [] ? __do_page_fault+0x5ec/0xd40 [ 23.396677] [] compat_SyS_sendmsg+0x2a/0x40 [ 23.402611] [] ? compat_SyS_getsockopt+0x2a0/0x2a0 [ 23.409158] [] do_fast_syscall_32+0x2f7/0x890 [ 23.415264] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 23.421893] [] entry_SYSENTER_compat+0x51/0x60 [ 23.428124] Dumping ftrace buffer: [ 23.431632] (ftrace buffer empty) [ 23.435319] Kernel Offset: disabled [ 23.438909] Rebooting in 86400 seconds..