INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-net-kasan-gce-4,10.128.0.55' (ECDSA) to the list of known hosts.
net.ipv6.conf.syz3.accept_dad = 0
net.ipv6.conf.syz7.accept_dad = 0
net.ipv6.conf.syz4.accept_dad = 0
net.ipv6.conf.syz1.accept_dad = 0
net.ipv6.conf.syz0.accept_dad = 0
net.ipv6.conf.syz5.accept_dad = 0
net.ipv6.conf.syz6.accept_dad = 0
net.ipv6.conf.syz2.accept_dad = 0
net.ipv6.conf.syz7.router_solicitations = 0
net.ipv6.conf.syz3.router_solicitations = 0
net.ipv6.conf.syz4.router_solicitations = 0
net.ipv6.conf.syz1.router_solicitations = 0
net.ipv6.conf.syz0.router_solicitations = 0
net.ipv6.conf.syz2.router_solicitations = 0
net.ipv6.conf.syz5.router_solicitations = 0
net.ipv6.conf.syz6.router_solicitations = 0
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
syzkaller login: [   40.483658] ==================================================================
[   40.484816] BUG: KASAN: use-after-free in aead_recvmsg+0x1758/0x1bc0
[   40.485673] Read of size 4 at addr ffff8801c6b29cdc by task syzkaller360215/3391
[   40.486660] 
[   40.486894] CPU: 1 PID: 3391 Comm: syzkaller360215 Not tainted 4.15.0-rc1+ #137
[   40.487892] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   40.489114] Call Trace:
[   40.489474]  dump_stack+0x194/0x257
[   40.489969]  ? arch_local_irq_restore+0x53/0x53
[   40.490591]  ? show_regs_print_info+0x65/0x65
[   40.491209]  ? af_alg_make_sg+0x510/0x510
[   40.491784]  ? aead_recvmsg+0x1758/0x1bc0
[   40.492375]  print_address_description+0x73/0x250
[   40.493122]  ? aead_recvmsg+0x1758/0x1bc0
[   40.493681]  kasan_report+0x25b/0x340
[   40.494244]  __asan_report_load4_noabort+0x14/0x20
[   40.494918]  aead_recvmsg+0x1758/0x1bc0
[   40.495469]  ? aead_release+0x50/0x50
[   40.495985]  ? selinux_socket_recvmsg+0x36/0x40
[   40.496627]  ? security_socket_recvmsg+0x91/0xc0
[   40.497263]  ? aead_release+0x50/0x50
[   40.497776]  sock_recvmsg+0xc9/0x110
[   40.498275]  ? __sock_recv_wifi_status+0x210/0x210
[   40.498935]  ___sys_recvmsg+0x29b/0x630
[   40.499545]  ? ___sys_sendmsg+0x8a0/0x8a0
[   40.500146]  ? fget_raw+0x20/0x20
[   40.500664]  ? __handle_mm_fault+0x3ad0/0x3ad0
[   40.501275]  ? vmacache_find+0x5f/0x280
[   40.501817]  ? up_read+0x1a/0x40
[   40.502285]  ? __do_page_fault+0x3d6/0xc90
[   40.502868]  ? lock_downgrade+0x980/0x980
[   40.503432]  ? __fdget+0x18/0x20
[   40.503893]  __sys_recvmsg+0xe2/0x210
[   40.507698]  ? __sys_recvmsg+0xe2/0x210
[   40.511653]  ? SyS_sendmmsg+0x60/0x60
[   40.515429]  ? __do_page_fault+0xc90/0xc90
[   40.519632]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   40.524626]  ? lockdep_sys_exit+0x47/0xf0
[   40.528753]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   40.533742]  SyS_recvmsg+0x2d/0x50
[   40.537252]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   40.541973] RIP: 0033:0x44a729
[   40.545129] RSP: 002b:00007fe42c336dc8 EFLAGS: 00000202 ORIG_RAX: 000000000000002f
[   40.552806] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000044a729
[   40.560044] RDX: 0000000000000040 RSI: 00000000206b0fc8 RDI: 0000000000000005
[   40.567281] RBP: 0000000000000000 R08: 00007fe42c337700 R09: 00007fe42c337700
[   40.574519] R10: 00007fe42c337700 R11: 0000000000000202 R12: 0000000000000000
[   40.581756] R13: 00007fff26c5379f R14: 00007fe42c3379c0 R15: 0000000000000000
[   40.589009] 
[   40.590606] Allocated by task 3289:
[   40.594202]  save_stack+0x43/0xd0
[   40.597622]  kasan_kmalloc+0xad/0xe0
[   40.601303]  __kmalloc+0x162/0x760
[   40.604825]  crypto_create_tfm+0x82/0x2e0
[   40.608939]  crypto_alloc_tfm+0x10e/0x2f0
[   40.613052]  crypto_alloc_skcipher+0x2c/0x40
[   40.617427]  crypto_get_default_null_skcipher+0x5f/0x80
[   40.622755]  aead_bind+0x89/0x140
[   40.626174]  alg_bind+0x1ab/0x440
[   40.629596]  SYSC_bind+0x1b4/0x3f0
[   40.633100]  SyS_bind+0x24/0x30
[   40.636345]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   40.641064] 
[   40.642659] Freed by task 3300:
[   40.645907]  save_stack+0x43/0xd0
[   40.649328]  kasan_slab_free+0x71/0xc0
[   40.653185]  kfree+0xca/0x250
[   40.656259]  kzfree+0x28/0x30
[   40.659330]  crypto_destroy_tfm+0x140/0x2e0
[   40.663616]  crypto_put_default_null_skcipher+0x35/0x60
[   40.668946]  aead_sock_destruct+0x13c/0x220
[   40.673232]  __sk_destruct+0xfd/0x910
[   40.676997]  sk_destruct+0x47/0x80
[   40.680510]  __sk_free+0x57/0x230
[   40.683932]  sk_free+0x2a/0x40
[   40.687093]  af_alg_release+0x5d/0x70
[   40.690867]  sock_release+0x8d/0x1e0
[   40.694551]  sock_close+0x16/0x20
[   40.697970]  __fput+0x333/0x7f0
[   40.701217]  ____fput+0x15/0x20
[   40.704468]  task_work_run+0x199/0x270
[   40.708327]  do_exit+0x9bb/0x1ae0
[   40.711746]  do_group_exit+0x149/0x400
[   40.715601]  SyS_exit_group+0x1d/0x20
[   40.719370]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   40.724089] 
[   40.725687] The buggy address belongs to the object at ffff8801c6b29cc0
[   40.725687]  which belongs to the cache kmalloc-128 of size 128
[   40.738311] The buggy address is located 28 bytes inside of
[   40.738311]  128-byte region [ffff8801c6b29cc0, ffff8801c6b29d40)
[   40.750076] The buggy address belongs to the page:
[   40.754975] page:00000000417b216a count:1 mapcount:0 mapping:000000005abf053a index:0x0
[   40.763084] flags: 0x2fffc0000000100(slab)
[   40.767288] raw: 02fffc0000000100 ffff8801c6b29000 0000000000000000 0000000100000015
[   40.775139] raw: ffffea00071b7220 ffffea00071be620 ffff8801db000640 0000000000000000
[   40.782983] page dumped because: kasan: bad access detected
[   40.788656] 
[   40.790250] Memory state around the buggy address:
[   40.795145]  ffff8801c6b29b80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   40.802471]  ffff8801c6b29c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   40.809801] >ffff8801c6b29c80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[   40.817125]                                                     ^
[   40.823322]  ffff8801c6b29d00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   40.830647]  ffff8801c6b29d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   40.837971] ==================================================================
[   40.845297] Disabling lock debugging due to kernel taint
[   40.850961] Kernel panic - not syncing: panic_on_warn set ...
[   40.850961] 
[   40.858314] CPU: 1 PID: 3391 Comm: syzkaller360215 Tainted: G    B            4.15.0-rc1+ #137
[   40.867027] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   40.876349] Call Trace:
[   40.878907]  dump_stack+0x194/0x257
executing program
[   40.882501]  ? arch_local_irq_restore+0x53/0x53
[   40.887138]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   40.891864]  ? vsnprintf+0x1ed/0x1900
[   40.895631]  ? aead_recvmsg+0x1710/0x1bc0
[   40.899746]  panic+0x1e4/0x41c
[   40.902906]  ? refcount_error_report+0x214/0x214
[   40.907642]  ? add_taint+0x1c/0x50
[   40.911150]  ? add_taint+0x1c/0x50
[   40.914657]  ? aead_recvmsg+0x1758/0x1bc0
[   40.918775]  kasan_end_report+0x50/0x50
[   40.922719]  kasan_report+0x144/0x340
[   40.926489]  __asan_report_load4_noabort+0x14/0x20
[   40.931394]  aead_recvmsg+0x1758/0x1bc0
[   40.935354]  ? aead_release+0x50/0x50
[   40.939126]  ? selinux_socket_recvmsg+0x36/0x40
[   40.943760]  ? security_socket_recvmsg+0x91/0xc0
[   40.948481]  ? aead_release+0x50/0x50
[   40.952246]  sock_recvmsg+0xc9/0x110
[   40.955925]  ? __sock_recv_wifi_status+0x210/0x210
[   40.960820]  ___sys_recvmsg+0x29b/0x630
[   40.964765]  ? ___sys_sendmsg+0x8a0/0x8a0
[   40.968889]  ? fget_raw+0x20/0x20
[   40.972310]  ? __handle_mm_fault+0x3ad0/0x3ad0
[   40.976857]  ? vmacache_find+0x5f/0x280
[   40.980801]  ? up_read+0x1a/0x40
[   40.984138]  ? __do_page_fault+0x3d6/0xc90
[   40.988340]  ? lock_downgrade+0x980/0x980
[   40.992456]  ? __fdget+0x18/0x20
[   40.995792]  __sys_recvmsg+0xe2/0x210
[   40.999559]  ? __sys_recvmsg+0xe2/0x210
[   41.003498]  ? SyS_sendmmsg+0x60/0x60
[   41.007266]  ? __do_page_fault+0xc90/0xc90
[   41.011469]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   41.016451]  ? lockdep_sys_exit+0x47/0xf0
[   41.020567]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   41.025550]  SyS_recvmsg+0x2d/0x50
[   41.029057]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   41.033775] RIP: 0033:0x44a729
[   41.036930] RSP: 002b:00007fe42c336dc8 EFLAGS: 00000202 ORIG_RAX: 000000000000002f
[   41.044613] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000044a729
[   41.051850] RDX: 0000000000000040 RSI: 00000000206b0fc8 RDI: 0000000000000005
[   41.059085] RBP: 0000000000000000 R08: 00007fe42c337700 R09: 00007fe42c337700
[   41.066322] R10: 00007fe42c337700 R11: 0000000000000202 R12: 0000000000000000
[   41.073557] R13: 00007fff26c5379f R14: 00007fe42c3379c0 R15: 0000000000000000
[   41.080832] Dumping ftrace buffer:
[   41.084338]    (ftrace buffer empty)
[   41.088026] Kernel Offset: disabled
[   41.091621] Rebooting in 86400 seconds..