[....] Starting enhanced syslogd: rsyslogd[ 10.878205] audit: type=1400 audit(1515859665.347:4): avc: denied { syslog } for pid=3178 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.48' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 26.629846] ================================================================== [ 26.630939] BUG: KASAN: slab-out-of-bounds in sg_remove_request+0x103/0x120 [ 26.631870] Read of size 8 at addr ffff8801c89a4140 by task syzkaller926211/3335 [ 26.632851] [ 26.633081] CPU: 1 PID: 3335 Comm: syzkaller926211 Not tainted 4.9.76-g8e170a5 #11 [ 26.634100] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 26.635319] ffff8801c81a79b0 ffffffff81d93149 ffffea0007226900 ffff8801c89a4140 [ 26.636456] 0000000000000000 ffff8801c89a4140 ffff8801c7420238 ffff8801c81a79e8 [ 26.637583] ffffffff8153cb43 ffff8801c89a4140 0000000000000008 0000000000000000 [ 26.638729] Call Trace: [ 26.639114] [] dump_stack+0xc1/0x128 [ 26.639829] [] print_address_description+0x73/0x280 [ 26.640707] [] kasan_report+0x275/0x360 [ 26.641459] [] ? sg_remove_request+0x103/0x120 [ 26.642294] [] __asan_report_load8_noabort+0x14/0x20 [ 26.643179] [] sg_remove_request+0x103/0x120 [ 26.643987] [] sg_finish_rem_req+0x295/0x340 [ 26.644785] [] sg_read+0xa1c/0x1440 [ 26.645484] [] ? sg_proc_seq_show_debug+0xd10/0xd10 [ 26.646372] [] ? fsnotify+0xf30/0xf30 [ 26.647095] [] ? avc_policy_seqno+0x9/0x20 [ 26.647875] [] do_loop_readv_writev.part.17+0x141/0x1e0 [ 26.648806] [] ? security_file_permission+0x89/0x1e0 [ 26.649692] [] ? sg_proc_seq_show_debug+0xd10/0xd10 [ 26.650568] [] ? sg_proc_seq_show_debug+0xd10/0xd10 [ 26.657202] [] do_readv_writev+0x520/0x750 [ 26.663049] [] ? vfs_write+0x530/0x530 [ 26.668557] [] ? _raw_spin_unlock+0x2c/0x50 [ 26.674495] [] ? __pmd_alloc+0x410/0x410 [ 26.680171] [] ? dev_seq_stop+0x50/0x50 [ 26.685763] [] ? __do_page_fault+0x5ec/0xd40 [ 26.691789] [] vfs_readv+0x84/0xc0 [ 26.696943] [] do_readv+0xe6/0x250 [ 26.702096] [] ? vfs_readv+0xc0/0xc0 [ 26.707426] [] ? entry_SYSCALL_64_fastpath+0x5/0xe2 [ 26.714059] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 26.720863] [] SyS_readv+0x27/0x30 [ 26.726020] [] entry_SYSCALL_64_fastpath+0x23/0xe2 [ 26.732559] [ 26.734151] Allocated by task 0: [ 26.737478] (stack is not available) [ 26.741153] [ 26.742743] Freed by task 0: [ 26.745722] (stack is not available) [ 26.749398] [ 26.750990] The buggy address belongs to the object at ffff8801c89a4100 [ 26.750990] which belongs to the cache fasync_cache of size 96 [ 26.763610] The buggy address is located 64 bytes inside of [ 26.763610] 96-byte region [ffff8801c89a4100, ffff8801c89a4160) [ 26.775272] The buggy address belongs to the page: [ 26.780167] page:ffffea0007226900 count:1 mapcount:0 mapping: (null) index:0x0 [ 26.788386] flags: 0x8000000000000080(slab) [ 26.792667] page dumped because: kasan: bad access detected [ 26.798338] [ 26.799928] Memory state around the buggy address: [ 26.804829] ffff8801c89a4000: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 26.812170] ffff8801c89a4080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.819509] >ffff8801c89a4100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.826838] ^ [ 26.832253] ffff8801c89a4180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.839585] ffff8801c89a4200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.846907] ================================================================== [ 26.854241] Disabling lock debugging due to kernel taint [ 26.860285] Kernel panic - not syncing: panic_on_warn set ... [ 26.860285] [ 26.867623] CPU: 1 PID: 3335 Comm: syzkaller926211 Tainted: G B 4.9.76-g8e170a5 #11 [ 26.876510] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 26.885832] ffff8801c81a7908 ffffffff81d93149 ffffffff84195c17 ffff8801c81a79e0 [ 26.893772] 0000000000000000 ffff8801c89a4140 ffff8801c7420238 ffff8801c81a79d0 [ 26.901714] ffffffff8142e371 0000000041b58ab3 ffffffff84189678 ffffffff8142e1b5 [ 26.909662] Call Trace: [ 26.912219] [] dump_stack+0xc1/0x128 [ 26.917550] [] panic+0x1bc/0x3a8 [ 26.922544] [] ? percpu_up_read_preempt_enable.constprop.53+0xd7/0xd7 [ 26.930742] [] ? preempt_schedule+0x25/0x30 [ 26.936677] [] ? ___preempt_schedule+0x16/0x18 [ 26.942873] [] kasan_end_report+0x50/0x50 [ 26.948634] [] kasan_report+0x167/0x360 [ 26.954224] [] ? sg_remove_request+0x103/0x120 [ 26.960419] [] __asan_report_load8_noabort+0x14/0x20 [ 26.967138] [] sg_remove_request+0x103/0x120 [ 26.973159] [] sg_finish_rem_req+0x295/0x340 [ 26.979189] [] sg_read+0xa1c/0x1440 [ 26.984433] [] ? sg_proc_seq_show_debug+0xd10/0xd10 [ 26.991065] [] ? fsnotify+0xf30/0xf30 [ 26.996485] [] ? avc_policy_seqno+0x9/0x20 [ 27.002337] [] do_loop_readv_writev.part.17+0x141/0x1e0 [ 27.009332] [] ? security_file_permission+0x89/0x1e0 [ 27.016067] [] ? sg_proc_seq_show_debug+0xd10/0xd10 [ 27.022716] [] ? sg_proc_seq_show_debug+0xd10/0xd10 [ 27.029353] [] do_readv_writev+0x520/0x750 [ 27.035206] [] ? vfs_write+0x530/0x530 [ 27.040715] [] ? _raw_spin_unlock+0x2c/0x50 [ 27.046653] [] ? __pmd_alloc+0x410/0x410 [ 27.052331] [] ? dev_seq_stop+0x50/0x50 [ 27.057937] [] ? __do_page_fault+0x5ec/0xd40 [ 27.063966] [] vfs_readv+0x84/0xc0 [ 27.069153] [] do_readv+0xe6/0x250 [ 27.074314] [] ? vfs_readv+0xc0/0xc0 [ 27.079645] [] ? entry_SYSCALL_64_fastpath+0x5/0xe2 [ 27.086275] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 27.093081] [] SyS_readv+0x27/0x30 [ 27.098235] [] entry_SYSCALL_64_fastpath+0x23/0xe2 [ 27.104819] Dumping ftrace buffer: [ 27.108325] (ftrace buffer empty) [ 27.112013] Kernel Offset: disabled [ 27.115611] Rebooting in 86400 seconds..