[....] Starting enhanced syslogd: rsyslogd[ 11.511506] audit: type=1400 audit(1514228935.229:5): avc: denied { syslog } for pid=2987 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 16.305516] audit: type=1400 audit(1514228940.023:6): avc: denied { map } for pid=3126 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added 'ci-upstream-net-kasan-gce-4,10.128.15.194' (ECDSA) to the list of known hosts. executing program [ 22.522787] audit: type=1400 audit(1514228946.240:7): avc: denied { map } for pid=3140 comm="syzkaller155931" path="/root/syzkaller155931225" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 22.550429] ================================================================== [ 22.557806] BUG: KASAN: wild-memory-access in scatterwalk_copychunks+0x206/0x480 [ 22.565306] Write of size 16 at addr 00050800d055e7d8 by task syzkaller155931/3140 [ 22.572976] [ 22.574576] CPU: 1 PID: 3140 Comm: syzkaller155931 Not tainted 4.15.0-rc4+ #164 [ 22.581987] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 22.591307] Call Trace: [ 22.593868] dump_stack+0x194/0x257 [ 22.597469] ? arch_local_irq_restore+0x53/0x53 [ 22.602115] ? scatterwalk_copychunks+0x206/0x480 [ 22.606932] kasan_report+0x13b/0x340 [ 22.610703] check_memory_region+0x137/0x190 [ 22.615078] memcpy+0x37/0x50 [ 22.618154] scatterwalk_copychunks+0x206/0x480 [ 22.622798] blkcipher_walk_done+0xa4b/0xde0 [ 22.627186] glue_ctr_crypt_128bit+0x597/0xc20 [ 22.631767] ? glue_ecb_crypt_128bit+0x5c0/0x5c0 [ 22.636504] ? sha512_base_init+0x220/0x220 [ 22.640833] ctr_crypt+0x34/0x40 [ 22.644169] ? ctr_crypt+0x34/0x40 [ 22.647678] ? twofish_enc_blk_3way+0x30/0x30 [ 22.652145] __ablk_encrypt+0x1d1/0x2d0 [ 22.656091] ? ablk_set_key+0x1a0/0x1a0 [ 22.660040] ? shash_async_update+0x20/0x20 [ 22.664331] ? kfree+0xf0/0x260 [ 22.667579] ? __ablk_encrypt+0x2d0/0x2d0 [ 22.671701] ablk_encrypt+0x23e/0x2c0 [ 22.675472] ? __ablk_encrypt+0x2d0/0x2d0 [ 22.679593] skcipher_decrypt_ablkcipher+0x312/0x420 [ 22.684668] ? scatterwalk_ffwd+0xbf/0x370 [ 22.688875] poly_tail_continue+0x42a/0x6b0 [ 22.693171] poly_tail+0x40f/0x520 [ 22.696681] poly_cipherpad+0x33e/0x470 [ 22.700626] poly_cipher+0x303/0x440 [ 22.704312] poly_adpad+0x347/0x480 [ 22.707911] poly_ad+0x25c/0x300 [ 22.711250] poly_setkey+0x2fc/0x3e0 [ 22.714934] poly_init+0x16c/0x1d0 [ 22.718443] poly_genkey+0x422/0x590 [ 22.722130] chachapoly_decrypt+0x73/0x90 [ 22.726248] aead_recvmsg+0x14a7/0x1bc0 [ 22.730208] ? aead_release+0x50/0x50 [ 22.733975] ? selinux_socket_recvmsg+0x36/0x40 [ 22.738611] ? security_socket_recvmsg+0x91/0xc0 [ 22.743339] ? aead_release+0x50/0x50 [ 22.747105] sock_recvmsg+0xc9/0x110 [ 22.750784] ? __sock_recv_wifi_status+0x210/0x210 [ 22.755691] ___sys_recvmsg+0x2a4/0x640 [ 22.759644] ? ___sys_sendmsg+0x8b0/0x8b0 [ 22.763773] ? __do_page_fault+0x5f7/0xc90 [ 22.767977] ? lock_downgrade+0x980/0x980 [ 22.772110] ? __fget_light+0x297/0x380 [ 22.776061] ? fget_raw+0x20/0x20 [ 22.779486] ? __handle_mm_fault+0x3ce0/0x3ce0 [ 22.784037] ? vmacache_find+0x5f/0x280 [ 22.787990] ? up_read+0x1a/0x40 [ 22.791330] ? __do_page_fault+0x3d6/0xc90 [ 22.795531] ? SYSC_accept4+0x4ff/0x870 [ 22.799480] ? __fdget+0x18/0x20 [ 22.802819] __sys_recvmsg+0xe2/0x210 [ 22.806589] ? __sys_recvmsg+0xe2/0x210 [ 22.810535] ? SyS_sendmmsg+0x60/0x60 [ 22.814309] ? __do_page_fault+0xc90/0xc90 [ 22.818513] ? SyS_setsockopt+0x215/0x360 [ 22.822639] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 22.827628] SyS_recvmsg+0x2d/0x50 [ 22.831140] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 22.835863] RIP: 0033:0x43fef9 [ 22.839026] RSP: 002b:00007fff24494648 EFLAGS: 00000217 ORIG_RAX: 000000000000002f [ 22.846707] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fef9 [ 22.853954] RDX: 0000000000000000 RSI: 000000002022efc8 RDI: 0000000000000004 [ 22.861190] RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000 [ 22.868432] R10: 0000000000000000 R11: 0000000000000217 R12: 0000000000401860 [ 22.875670] R13: 00000000004018f0 R14: 0000000000000000 R15: 0000000000000000 [ 22.882923] ================================================================== [ 22.890248] Disabling lock debugging due to kernel taint [ 22.895822] Kernel panic - not syncing: panic_on_warn set ... [ 22.895822] [ 22.903165] CPU: 1 PID: 3140 Comm: syzkaller155931 Tainted: G B 4.15.0-rc4+ #164 [ 22.911879] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 22.921204] Call Trace: [ 22.923767] dump_stack+0x194/0x257 [ 22.927361] ? arch_local_irq_restore+0x53/0x53 [ 22.931997] ? kasan_end_report+0x32/0x50 [ 22.936115] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 22.940839] ? vsnprintf+0x1ed/0x1900 [ 22.944605] ? scatterwalk_copychunks+0x170/0x480 [ 22.949413] panic+0x1e4/0x41c [ 22.952581] ? refcount_error_report+0x214/0x214 [ 22.957308] ? add_taint+0x1c/0x50 [ 22.960815] ? add_taint+0x1c/0x50 [ 22.964323] ? scatterwalk_copychunks+0x206/0x480 [ 22.969132] kasan_end_report+0x50/0x50 [ 22.973072] kasan_report+0x144/0x340 [ 22.976845] check_memory_region+0x137/0x190 [ 22.981218] memcpy+0x37/0x50 [ 22.984291] scatterwalk_copychunks+0x206/0x480 [ 22.988930] blkcipher_walk_done+0xa4b/0xde0 [ 22.993314] glue_ctr_crypt_128bit+0x597/0xc20 [ 22.997867] ? glue_ecb_crypt_128bit+0x5c0/0x5c0 [ 23.002604] ? sha512_base_init+0x220/0x220 [ 23.006935] ctr_crypt+0x34/0x40 [ 23.010280] ? ctr_crypt+0x34/0x40 [ 23.013791] ? twofish_enc_blk_3way+0x30/0x30 [ 23.018253] __ablk_encrypt+0x1d1/0x2d0 [ 23.022194] ? ablk_set_key+0x1a0/0x1a0 [ 23.026135] ? shash_async_update+0x20/0x20 [ 23.030419] ? kfree+0xf0/0x260 [ 23.033664] ? __ablk_encrypt+0x2d0/0x2d0 [ 23.037775] ablk_encrypt+0x23e/0x2c0 [ 23.041541] ? __ablk_encrypt+0x2d0/0x2d0 [ 23.045654] skcipher_decrypt_ablkcipher+0x312/0x420 [ 23.050720] ? scatterwalk_ffwd+0xbf/0x370 [ 23.054924] poly_tail_continue+0x42a/0x6b0 [ 23.059211] poly_tail+0x40f/0x520 [ 23.062718] poly_cipherpad+0x33e/0x470 [ 23.066660] poly_cipher+0x303/0x440 [ 23.070340] poly_adpad+0x347/0x480 [ 23.073934] poly_ad+0x25c/0x300 [ 23.077267] poly_setkey+0x2fc/0x3e0 [ 23.080946] poly_init+0x16c/0x1d0 [ 23.084453] poly_genkey+0x422/0x590 [ 23.088133] chachapoly_decrypt+0x73/0x90 [ 23.092250] aead_recvmsg+0x14a7/0x1bc0 [ 23.096198] ? aead_release+0x50/0x50 [ 23.099964] ? selinux_socket_recvmsg+0x36/0x40 [ 23.104599] ? security_socket_recvmsg+0x91/0xc0 [ 23.109323] ? aead_release+0x50/0x50 [ 23.113090] sock_recvmsg+0xc9/0x110 [ 23.116767] ? __sock_recv_wifi_status+0x210/0x210 [ 23.121663] ___sys_recvmsg+0x2a4/0x640 [ 23.125616] ? ___sys_sendmsg+0x8b0/0x8b0 [ 23.129733] ? __do_page_fault+0x5f7/0xc90 [ 23.133947] ? lock_downgrade+0x980/0x980 [ 23.138066] ? __fget_light+0x297/0x380 [ 23.142006] ? fget_raw+0x20/0x20 [ 23.145431] ? __handle_mm_fault+0x3ce0/0x3ce0 [ 23.149988] ? vmacache_find+0x5f/0x280 [ 23.153932] ? up_read+0x1a/0x40 [ 23.157269] ? __do_page_fault+0x3d6/0xc90 [ 23.161468] ? SYSC_accept4+0x4ff/0x870 [ 23.165411] ? __fdget+0x18/0x20 [ 23.168745] __sys_recvmsg+0xe2/0x210 [ 23.172510] ? __sys_recvmsg+0xe2/0x210 [ 23.176449] ? SyS_sendmmsg+0x60/0x60 [ 23.180562] ? __do_page_fault+0xc90/0xc90 [ 23.184766] ? SyS_setsockopt+0x215/0x360 [ 23.188902] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 23.193885] SyS_recvmsg+0x2d/0x50 [ 23.197395] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 23.202129] RIP: 0033:0x43fef9 [ 23.205287] RSP: 002b:00007fff24494648 EFLAGS: 00000217 ORIG_RAX: 000000000000002f [ 23.212965] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fef9 [ 23.220203] RDX: 0000000000000000 RSI: 000000002022efc8 RDI: 0000000000000004 [ 23.227439] RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000 [ 23.234673] R10: 0000000000000000 R11: 0000000000000217 R12: 0000000000401860 [ 23.241907] R13: 00000000004018f0 R14: 0000000000000000 R15: 0000000000000000 [ 23.249580] Dumping ftrace buffer: [ 23.253086] (ftrace buffer empty) [ 23.256760] Kernel Offset: disabled [ 23.260352] Rebooting in 86400 seconds..