[....] Starting enhanced syslogd: rsyslogd[ 11.381358] audit: type=1400 audit(1514540567.676:5): avc: denied { syslog } for pid=3002 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 16.732702] audit: type=1400 audit(1514540573.027:6): avc: denied { map } for pid=3141 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.15.202' (ECDSA) to the list of known hosts. executing program [ 22.930691] audit: type=1400 audit(1514540579.225:7): avc: denied { map } for pid=3155 comm="syzkaller097903" path="/root/syzkaller097903112" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 22.934358] ================================================================== [ 22.934373] BUG: KASAN: slab-out-of-bounds in cap_convert_nscap+0x501/0x610 [ 22.934377] Read of size 4 at addr ffff8801c9283ac0 by task syzkaller097903/3155 [ 22.934378] [ 22.934384] CPU: 1 PID: 3155 Comm: syzkaller097903 Not tainted 4.15.0-rc4-mm1+ #49 [ 22.934387] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 22.934389] Call Trace: [ 22.934397] dump_stack+0x194/0x257 [ 22.934405] ? arch_local_irq_restore+0x53/0x53 [ 22.934413] ? show_regs_print_info+0x18/0x18 [ 22.934422] ? lock_release+0xa40/0xa40 [ 22.934427] ? cap_convert_nscap+0x501/0x610 [ 22.934435] print_address_description+0x73/0x250 [ 22.934440] ? cap_convert_nscap+0x501/0x610 [ 22.934446] kasan_report+0x23b/0x360 [ 22.934455] __asan_report_load4_noabort+0x14/0x20 [ 22.934459] cap_convert_nscap+0x501/0x610 [ 22.934466] ? kasan_check_write+0x14/0x20 [ 22.934477] setxattr+0x365/0x400 [ 22.934480] ? setxattr+0x365/0x400 [ 22.934489] ? vfs_setxattr+0xe0/0xe0 [ 22.934495] ? lock_acquire+0x1d5/0x580 [ 22.934498] ? lock_acquire+0x1d5/0x580 [ 22.934503] ? mnt_want_write_file_path+0x68/0x110 [ 22.934517] ? __lock_is_held+0xb6/0x140 [ 22.934533] ? rcu_read_lock_sched_held+0x108/0x120 [ 22.934538] ? rcu_sync_lockdep_assert+0x6d/0xb0 [ 22.934542] ? mnt_clone_write+0xc9/0x110 [ 22.934549] ? __mnt_want_write_file+0x7c/0xb0 [ 22.934559] SyS_fsetxattr+0x130/0x190 [ 22.934570] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 22.934574] RIP: 0033:0x43fcb9 [ 22.934576] RSP: 002b:00007ffc25686908 EFLAGS: 00000203 ORIG_RAX: 00000000000000be [ 22.934581] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fcb9 [ 22.934584] RDX: 00000000209b8000 RSI: 0000000020d4bfe8 RDI: 0000000000000003 [ 22.934586] RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000 [ 22.934589] R10: 0000000000000001 R11: 0000000000000203 R12: 0000000000401620 [ 22.934591] R13: 00000000004016b0 R14: 0000000000000000 R15: 0000000000000000 [ 22.934608] [ 22.934610] Allocated by task 3155: [ 22.934615] save_stack+0x43/0xd0 [ 22.934618] kasan_kmalloc+0xad/0xe0 [ 22.934621] __kmalloc_node+0x47/0x70 [ 22.934626] kvmalloc_node+0x99/0xd0 [ 22.934630] setxattr+0x152/0x400 [ 22.934634] SyS_fsetxattr+0x130/0x190 [ 22.934637] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 22.934638] [ 22.934640] Freed by task 1649: [ 22.934643] save_stack+0x43/0xd0 [ 22.934647] kasan_slab_free+0x71/0xc0 [ 22.934650] kfree+0xd6/0x260 [ 22.934654] security_inode_init_security+0x1c3/0x390 [ 22.934657] shmem_mknod+0x9b/0x1b0 [ 22.934660] shmem_mkdir+0x29/0x50 [ 22.934664] vfs_mkdir+0x390/0x600 [ 22.934668] SyS_mkdir+0x220/0x2a0 [ 22.934671] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 22.934673] [ 22.934675] The buggy address belongs to the object at ffff8801c9283ac0 [ 22.934675] which belongs to the cache kmalloc-32 of size 32 [ 22.934679] The buggy address is located 0 bytes inside of [ 22.934679] 32-byte region [ffff8801c9283ac0, ffff8801c9283ae0) [ 22.934680] The buggy address belongs to the page: [ 22.934684] page:ffffea000724a0c0 count:1 mapcount:0 mapping:ffff8801c9283000 index:0xffff8801c9283fc1 [ 22.934688] flags: 0x2fffc0000000100(slab) [ 22.934694] raw: 02fffc0000000100 ffff8801c9283000 ffff8801c9283fc1 000000010000003f [ 22.934699] raw: ffffea000726c220 ffffea0007261c20 ffff8801dac001c0 0000000000000000 [ 22.934701] page dumped because: kasan: bad access detected [ 22.934702] [ 22.934704] Memory state around the buggy address: [ 22.934708] ffff8801c9283980: 00 00 00 fc fc fc fc fc 05 fc fc fc fc fc fc fc [ 22.934711] ffff8801c9283a00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 22.934714] >ffff8801c9283a80: fb fb fb fb fc fc fc fc 01 fc fc fc fc fc fc fc [ 22.934716] ^ [ 22.934719] ffff8801c9283b00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 22.934722] ffff8801c9283b80: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 22.934723] ================================================================== [ 22.934724] Disabling lock debugging due to kernel taint [ 22.934727] Kernel panic - not syncing: panic_on_warn set ... [ 22.934727] [ 22.934731] CPU: 1 PID: 3155 Comm: syzkaller097903 Tainted: G B 4.15.0-rc4-mm1+ #49 [ 22.934733] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 22.934734] Call Trace: [ 22.934738] dump_stack+0x194/0x257 [ 22.934743] ? arch_local_irq_restore+0x53/0x53 [ 22.934746] ? kasan_end_report+0x32/0x50 [ 22.934756] ? lock_downgrade+0x980/0x980 [ 22.934761] ? vsnprintf+0x1ed/0x1900 [ 22.934765] ? cap_convert_nscap+0x450/0x610 [ 22.934771] panic+0x1e4/0x41c [ 22.934775] ? refcount_error_report+0x214/0x214 [ 22.934781] ? add_taint+0x40/0x50 [ 22.934785] ? add_taint+0x1c/0x50 [ 22.934790] ? cap_convert_nscap+0x501/0x610 [ 22.934794] kasan_end_report+0x50/0x50 [ 22.934798] kasan_report+0x148/0x360 [ 22.934804] __asan_report_load4_noabort+0x14/0x20 [ 22.934808] cap_convert_nscap+0x501/0x610 [ 22.934812] ? kasan_check_write+0x14/0x20 [ 22.934818] setxattr+0x365/0x400 [ 22.934821] ? setxattr+0x365/0x400 [ 22.934827] ? vfs_setxattr+0xe0/0xe0 [ 22.934832] ? lock_acquire+0x1d5/0x580 [ 22.934835] ? lock_acquire+0x1d5/0x580 [ 22.934839] ? mnt_want_write_file_path+0x68/0x110 [ 22.934847] ? __lock_is_held+0xb6/0x140 [ 22.934855] ? rcu_read_lock_sched_held+0x108/0x120 [ 22.934859] ? rcu_sync_lockdep_assert+0x6d/0xb0 [ 22.934863] ? mnt_clone_write+0xc9/0x110 [ 22.934868] ? __mnt_want_write_file+0x7c/0xb0 [ 22.934874] SyS_fsetxattr+0x130/0x190 [ 22.934881] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 22.934883] RIP: 0033:0x43fcb9 [ 22.934885] RSP: 002b:00007ffc25686908 EFLAGS: 00000203 ORIG_RAX: 00000000000000be [ 22.934889] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fcb9 [ 22.934891] RDX: 00000000209b8000 RSI: 0000000020d4bfe8 RDI: 0000000000000003 [ 22.934893] RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000 [ 22.934895] R10: 0000000000000001 R11: 0000000000000203 R12: 0000000000401620 [ 22.934897] R13: 00000000004016b0 R14: 0000000000000000 R15: 0000000000000000 [ 22.956564] Dumping ftrace buffer: [ 22.956568] (ftrace buffer empty) [ 22.956570] Kernel Offset: disabled [ 23.550833] Rebooting in 86400 seconds..