[....] Starting enhanced syslogd: rsyslogd[ 13.017773] audit: type=1400 audit(1519581911.946:4): avc: denied { syslog } for pid=3650 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.49' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 34.448919] ================================================================== [ 34.456354] BUG: KASAN: slab-out-of-bounds in pfkey_add+0x2702/0x3470 [ 34.462928] Read of size 4096 at addr ffff8801b2ad7940 by task syzkaller663155/3815 [ 34.470693] [ 34.472297] CPU: 0 PID: 3815 Comm: syzkaller663155 Not tainted 4.9.83-ga92bb8d #43 [ 34.479979] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 34.489310] ffff8801c8be7728 ffffffff81d95149 ffffea0006cab580 ffff8801b2ad7940 [ 34.497289] 0000000000000000 ffff8801b2ad7b00 ffff8801c8be7968 ffff8801c8be7760 [ 34.505264] ffffffff8153e213 ffff8801b2ad7940 0000000000001000 0000000000000000 [ 34.513242] Call Trace: [ 34.515815] [] dump_stack+0xc1/0x128 [ 34.521153] [] print_address_description+0x73/0x280 [ 34.527790] [] kasan_report+0x275/0x360 [ 34.533386] [] ? pfkey_add+0x2702/0x3470 [ 34.539071] [] check_memory_region+0x137/0x190 [ 34.545275] [] memcpy+0x23/0x50 [ 34.550174] [] pfkey_add+0x2702/0x3470 [ 34.555683] [] ? pfkey_delete+0x360/0x360 [ 34.561450] [] ? pfkey_seq_stop+0x80/0x80 [ 34.567233] [] ? __skb_clone+0x24a/0x7d0 [ 34.572915] [] ? pfkey_delete+0x360/0x360 [ 34.578687] [] pfkey_process+0x68b/0x750 [ 34.584370] [] ? pfkey_send_new_mapping+0x11b0/0x11b0 [ 34.591180] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 34.597991] [] pfkey_sendmsg+0x3a9/0x760 [ 34.603673] [] ? pfkey_spdget+0x820/0x820 [ 34.609445] [] sock_sendmsg+0xca/0x110 [ 34.614953] [] ___sys_sendmsg+0x6d1/0x7e0 [ 34.620721] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 34.627530] [] ? copy_msghdr_from_user+0x570/0x570 [ 34.634082] [] ? __lru_cache_add+0x187/0x250 [ 34.640116] [] ? do_huge_pmd_anonymous_page+0xb05/0x10d0 [ 34.647187] [] ? _raw_spin_unlock+0x2c/0x50 [ 34.653130] [] ? do_huge_pmd_anonymous_page+0x2d4/0x10d0 [ 34.660203] [] ? handle_mm_fault+0x6ee/0x2530 [ 34.666321] [] ? __fget_light+0x169/0x1f0 [ 34.672098] [] ? __fdget+0x18/0x20 [ 34.677266] [] ? sockfd_lookup_light+0x118/0x160 [ 34.683923] [] __sys_sendmsg+0xd6/0x190 [ 34.689520] [] ? SyS_shutdown+0x1b0/0x1b0 [ 34.695293] [] ? __do_page_fault+0x5ec/0xd40 [ 34.701323] [] SyS_sendmsg+0x2d/0x50 [ 34.706657] [] ? __sys_sendmsg+0x190/0x190 [ 34.712516] [] do_syscall_64+0x1a4/0x490 [ 34.718201] [] entry_SYSCALL_64_after_swapgs+0x47/0xc5 [ 34.725098] [ 34.726700] Allocated by task 3815: [ 34.730303] save_stack_trace+0x16/0x20 [ 34.734251] save_stack+0x43/0xd0 [ 34.737674] kasan_kmalloc+0xad/0xe0 [ 34.742061] kasan_slab_alloc+0x12/0x20 [ 34.746012] __kmalloc_track_caller+0xda/0x2b0 [ 34.750567] __kmalloc_reserve.isra.37+0x33/0xc0 [ 34.755296] __alloc_skb+0x119/0x600 [ 34.758982] pfkey_sendmsg+0x135/0x760 [ 34.762841] sock_sendmsg+0xca/0x110 [ 34.766523] ___sys_sendmsg+0x6d1/0x7e0 [ 34.770465] __sys_sendmsg+0xd6/0x190 [ 34.774238] SyS_sendmsg+0x2d/0x50 [ 34.777753] do_syscall_64+0x1a4/0x490 [ 34.781613] entry_SYSCALL_64_after_swapgs+0x47/0xc5 [ 34.786686] [ 34.788284] Freed by task 2426: [ 34.791535] save_stack_trace+0x16/0x20 [ 34.795481] save_stack+0x43/0xd0 [ 34.798905] kasan_slab_free+0x72/0xc0 [ 34.802761] kfree+0x103/0x300 [ 34.805925] load_elf_binary+0x1cf1/0x4690 [ 34.810134] search_binary_handler+0x142/0x6b0 [ 34.814690] do_execveat_common.isra.37+0x1594/0x1f10 [ 34.819849] SyS_execve+0x42/0x50 [ 34.823271] do_syscall_64+0x1a4/0x490 [ 34.827129] entry_SYSCALL_64_after_swapgs+0x47/0xc5 [ 34.832200] [ 34.833799] The buggy address belongs to the object at ffff8801b2ad7900 [ 34.833799] which belongs to the cache kmalloc-512 of size 512 [ 34.846427] The buggy address is located 64 bytes inside of [ 34.846427] 512-byte region [ffff8801b2ad7900, ffff8801b2ad7b00) [ 34.858185] The buggy address belongs to the page: [ 34.863092] page:ffffea0006cab580 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 34.873265] flags: 0x8000000000004080(slab|head) [ 34.877989] page dumped because: kasan: bad access detected [ 34.883667] [ 34.885266] Memory state around the buggy address: [ 34.890164] ffff8801b2ad7a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 34.897495] ffff8801b2ad7a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 34.904825] >ffff8801b2ad7b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.912153] ^ [ 34.915487] ffff8801b2ad7b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.922816] ffff8801b2ad7c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.930145] ================================================================== [ 34.937473] Disabling lock debugging due to kernel taint [ 34.943292] Kernel panic - not syncing: panic_on_warn set ... [ 34.943292] [ 34.950641] CPU: 0 PID: 3815 Comm: syzkaller663155 Tainted: G B 4.9.83-ga92bb8d #43 [ 34.959538] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 34.968873] ffff8801c8be7680 ffffffff81d95149 ffffffff8419777f ffff8801c8be7758 [ 34.976846] 0000000000000000 ffff8801b2ad7b00 ffff8801c8be7968 ffff8801c8be7748 [ 34.984818] ffffffff8142f6c1 0000000041b58ab3 ffffffff8418b1f0 ffffffff8142f505 [ 34.992796] Call Trace: [ 34.995360] [] dump_stack+0xc1/0x128 [ 35.000700] [] panic+0x1bc/0x3a8 [ 35.005686] [] ? percpu_up_read_preempt_enable.constprop.53+0xd7/0xd7 [ 35.013886] [] ? preempt_schedule+0x25/0x30 [ 35.019833] [] ? ___preempt_schedule+0x16/0x18 [ 35.026043] [] kasan_end_report+0x50/0x50 [ 35.031811] [] kasan_report+0x167/0x360 [ 35.037409] [] ? pfkey_add+0x2702/0x3470 [ 35.043091] [] check_memory_region+0x137/0x190 [ 35.049296] [] memcpy+0x23/0x50 [ 35.054194] [] pfkey_add+0x2702/0x3470 [ 35.059702] [] ? pfkey_delete+0x360/0x360 [ 35.065468] [] ? pfkey_seq_stop+0x80/0x80 [ 35.071240] [] ? __skb_clone+0x24a/0x7d0 [ 35.076924] [] ? pfkey_delete+0x360/0x360 [ 35.082692] [] pfkey_process+0x68b/0x750 [ 35.088374] [] ? pfkey_send_new_mapping+0x11b0/0x11b0 [ 35.095186] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 35.101994] [] pfkey_sendmsg+0x3a9/0x760 [ 35.107676] [] ? pfkey_spdget+0x820/0x820 [ 35.113447] [] sock_sendmsg+0xca/0x110 [ 35.118956] [] ___sys_sendmsg+0x6d1/0x7e0 [ 35.124725] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 35.131532] [] ? copy_msghdr_from_user+0x570/0x570 [ 35.138083] [] ? __lru_cache_add+0x187/0x250 [ 35.144116] [] ? do_huge_pmd_anonymous_page+0xb05/0x10d0 [ 35.151187] [] ? _raw_spin_unlock+0x2c/0x50 [ 35.157131] [] ? do_huge_pmd_anonymous_page+0x2d4/0x10d0 [ 35.164204] [] ? handle_mm_fault+0x6ee/0x2530 [ 35.170320] [] ? __fget_light+0x169/0x1f0 [ 35.176091] [] ? __fdget+0x18/0x20 [ 35.181251] [] ? sockfd_lookup_light+0x118/0x160 [ 35.187625] [] __sys_sendmsg+0xd6/0x190 [ 35.193220] [] ? SyS_shutdown+0x1b0/0x1b0 [ 35.198990] [] ? __do_page_fault+0x5ec/0xd40 [ 35.205018] [] SyS_sendmsg+0x2d/0x50 [ 35.210352] [] ? __sys_sendmsg+0x190/0x190 [ 35.216210] [] do_syscall_64+0x1a4/0x490 [ 35.221893] [] entry_SYSCALL_64_after_swapgs+0x47/0xc5 [ 35.229183] Dumping ftrace buffer: [ 35.232692] (ftrace buffer empty) [ 35.236376] Kernel Offset: disabled [ 35.239974] Rebooting in 86400 seconds..