[....] Starting enhanced syslogd: rsyslogd[ 13.033663] audit: type=1400 audit(1516342938.499:5): avc: denied { syslog } for pid=3507 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 19.515047] audit: type=1400 audit(1516342944.980:6): avc: denied { map } for pid=3649 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.15.237' (ECDSA) to the list of known hosts. executing program [ 25.750258] audit: type=1400 audit(1516342951.216:7): avc: denied { map } for pid=3663 comm="syzkaller342578" path="/root/syzkaller342578537" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 25.756094] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=2816 sclass=netlink_tcpdiag_socket pig=3663 comm=syzkaller342578 [ 25.788969] ================================================================== [ 25.796394] BUG: KASAN: stack-out-of-bounds in __nla_put+0x37/0x40 [ 25.802691] Read of size 255 at addr ffff8801d9bef8b0 by task syzkaller342578/3663 [ 25.810369] [ 25.811974] CPU: 1 PID: 3663 Comm: syzkaller342578 Not tainted 4.15.0-rc8-next-20180118+ #100 [ 25.820606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 25.830107] Call Trace: [ 25.832674] dump_stack+0x194/0x257 [ 25.836276] ? arch_local_irq_restore+0x53/0x53 [ 25.840915] ? show_regs_print_info+0x18/0x18 [ 25.845399] ? __alloc_skb+0x57e/0x780 [ 25.849260] ? __nla_put+0x37/0x40 [ 25.852771] print_address_description+0x73/0x250 [ 25.857584] ? __nla_put+0x37/0x40 [ 25.861097] kasan_report+0x23b/0x360 [ 25.864875] check_memory_region+0x137/0x190 [ 25.869259] memcpy+0x23/0x50 [ 25.872338] __nla_put+0x37/0x40 [ 25.875682] nla_put+0xf5/0x130 [ 25.878948] netlink_ack+0x78a/0xa10 [ 25.882641] ? netlink_sendmsg+0xe60/0xe60 [ 25.886853] ? netlink_tap_init_net+0x350/0x350 [ 25.891500] netlink_rcv_skb+0x2d1/0x400 [ 25.895537] ? sock_diag_bind+0x80/0x80 [ 25.899494] ? netlink_ack+0xa10/0xa10 [ 25.903368] ? idr_get_free_cmn+0xfd0/0xfd0 [ 25.907672] ? netlink_skb_destructor+0x1d0/0x1d0 [ 25.912495] sock_diag_rcv+0x2a/0x40 [ 25.916184] netlink_unicast+0x4c4/0x6b0 [ 25.920225] ? netlink_attachskb+0x8a0/0x8a0 [ 25.924614] ? security_netlink_send+0x81/0xb0 [ 25.929173] netlink_sendmsg+0xa4a/0xe60 [ 25.933225] ? netlink_unicast+0x6b0/0x6b0 [ 25.937438] ? security_socket_sendmsg+0x89/0xb0 [ 25.942168] ? netlink_unicast+0x6b0/0x6b0 [ 25.946379] sock_sendmsg+0xca/0x110 [ 25.950073] ___sys_sendmsg+0x767/0x8b0 [ 25.954028] ? copy_msghdr_from_user+0x590/0x590 [ 25.958771] ? __do_page_fault+0x5f7/0xc90 [ 25.962980] ? lock_downgrade+0x980/0x980 [ 25.967108] ? __fget_light+0x297/0x380 [ 25.971056] ? fget_raw+0x20/0x20 [ 25.974483] ? __handle_mm_fault+0x3ce0/0x3ce0 [ 25.979046] ? vmacache_find+0x5f/0x280 [ 25.983002] ? up_read+0x1a/0x40 [ 25.986345] ? __do_page_fault+0x3d6/0xc90 [ 25.990552] ? lock_release+0xa40/0xa40 [ 25.994504] ? __fdget+0x18/0x20 [ 25.997852] __sys_sendmsg+0xe5/0x210 [ 26.001623] ? __sys_sendmsg+0xe5/0x210 [ 26.005577] ? SyS_shutdown+0x290/0x290 [ 26.009527] ? __do_page_fault+0xc90/0xc90 [ 26.013739] ? SyS_setsockopt+0x215/0x360 [ 26.017870] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 26.022863] SyS_sendmsg+0x2d/0x50 [ 26.026379] entry_SYSCALL_64_fastpath+0x29/0xa0 [ 26.031107] RIP: 0033:0x43fdc9 [ 26.034267] RSP: 002b:00007ffd852b7178 EFLAGS: 00000217 ORIG_RAX: 000000000000002e [ 26.041947] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fdc9 [ 26.049190] RDX: 0000000000000000 RSI: 000000002058efc8 RDI: 0000000000000003 [ 26.056433] RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000 [ 26.063685] R10: 0000000000000004 R11: 0000000000000217 R12: 00000000004016f0 [ 26.070934] R13: 0000000000401780 R14: 0000000000000000 R15: 0000000000000000 [ 26.078191] [ 26.079793] The buggy address belongs to the page: [ 26.084695] page:ffffea000766fbc0 count:0 mapcount:0 mapping: (null) index:0x0 [ 26.092810] flags: 0x2fffc0000000000() [ 26.096675] raw: 02fffc0000000000 0000000000000000 0000000000000000 00000000ffffffff [ 26.104527] raw: 0000000000000000 ffffea0007660101 0000000000000000 0000000000000000 [ 26.112384] page dumped because: kasan: bad access detected [ 26.118061] [ 26.119658] Memory state around the buggy address: [ 26.124556] ffff8801d9bef780: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f2 f2 f2 [ 26.131897] ffff8801d9bef800: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.139232] >ffff8801d9bef880: f1 f1 f1 f1 00 00 00 00 00 f2 f2 f2 00 00 00 00 [ 26.146567] ^ [ 26.152334] ffff8801d9bef900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.159678] ffff8801d9bef980: 00 f1 f1 f1 f1 00 f2 f2 f2 f3 f3 f3 f3 00 00 00 [ 26.167008] ================================================================== [ 26.174341] Disabling lock debugging due to kernel taint [ 26.179828] Kernel panic - not syncing: panic_on_warn set ... [ 26.179828] [ 26.187166] CPU: 1 PID: 3663 Comm: syzkaller342578 Tainted: G B 4.15.0-rc8-next-20180118+ #100 [ 26.197100] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 26.206426] Call Trace: [ 26.208990] dump_stack+0x194/0x257 [ 26.212590] ? arch_local_irq_restore+0x53/0x53 [ 26.217229] ? kasan_end_report+0x32/0x50 [ 26.221347] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 26.226073] ? vsnprintf+0x1ed/0x1900 [ 26.230177] ? __nla_put+0x30/0x40 [ 26.233686] panic+0x1e4/0x41c [ 26.236851] ? refcount_error_report+0x214/0x214 [ 26.241581] ? add_taint+0x1c/0x50 [ 26.245099] ? add_taint+0x1c/0x50 [ 26.248611] ? __nla_put+0x37/0x40 [ 26.252134] kasan_end_report+0x50/0x50 [ 26.256091] kasan_report+0x148/0x360 [ 26.259883] check_memory_region+0x137/0x190 [ 26.264270] memcpy+0x23/0x50 [ 26.267347] __nla_put+0x37/0x40 [ 26.270684] nla_put+0xf5/0x130 [ 26.273938] netlink_ack+0x78a/0xa10 [ 26.277625] ? netlink_sendmsg+0xe60/0xe60 [ 26.281833] ? netlink_tap_init_net+0x350/0x350 [ 26.286475] netlink_rcv_skb+0x2d1/0x400 [ 26.290506] ? sock_diag_bind+0x80/0x80 [ 26.294450] ? netlink_ack+0xa10/0xa10 [ 26.298310] ? idr_get_free_cmn+0xfd0/0xfd0 [ 26.302612] ? netlink_skb_destructor+0x1d0/0x1d0 [ 26.307444] sock_diag_rcv+0x2a/0x40 [ 26.311133] netlink_unicast+0x4c4/0x6b0 [ 26.315169] ? netlink_attachskb+0x8a0/0x8a0 [ 26.319552] ? security_netlink_send+0x81/0xb0 [ 26.324107] netlink_sendmsg+0xa4a/0xe60 [ 26.328141] ? netlink_unicast+0x6b0/0x6b0 [ 26.332350] ? security_socket_sendmsg+0x89/0xb0 [ 26.337092] ? netlink_unicast+0x6b0/0x6b0 [ 26.341295] sock_sendmsg+0xca/0x110 [ 26.344979] ___sys_sendmsg+0x767/0x8b0 [ 26.348927] ? copy_msghdr_from_user+0x590/0x590 [ 26.353658] ? __do_page_fault+0x5f7/0xc90 [ 26.357866] ? lock_downgrade+0x980/0x980 [ 26.361990] ? __fget_light+0x297/0x380 [ 26.365934] ? fget_raw+0x20/0x20 [ 26.369359] ? __handle_mm_fault+0x3ce0/0x3ce0 [ 26.373910] ? vmacache_find+0x5f/0x280 [ 26.377857] ? up_read+0x1a/0x40 [ 26.381192] ? __do_page_fault+0x3d6/0xc90 [ 26.385396] ? lock_release+0xa40/0xa40 [ 26.389352] ? __fdget+0x18/0x20 [ 26.392698] __sys_sendmsg+0xe5/0x210 [ 26.396470] ? __sys_sendmsg+0xe5/0x210 [ 26.400415] ? SyS_shutdown+0x290/0x290 [ 26.404359] ? __do_page_fault+0xc90/0xc90 [ 26.408578] ? SyS_setsockopt+0x215/0x360 [ 26.412702] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 26.417690] SyS_sendmsg+0x2d/0x50 [ 26.421210] entry_SYSCALL_64_fastpath+0x29/0xa0 [ 26.425935] RIP: 0033:0x43fdc9 [ 26.429094] RSP: 002b:00007ffd852b7178 EFLAGS: 00000217 ORIG_RAX: 000000000000002e [ 26.436768] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fdc9 [ 26.444009] RDX: 0000000000000000 RSI: 000000002058efc8 RDI: 0000000000000003 [ 26.451249] RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000 [ 26.458487] R10: 0000000000000004 R11: 0000000000000217 R12: 00000000004016f0 [ 26.465735] R13: 0000000000401780 R14: 0000000000000000 R15: 0000000000000000 [ 26.473389] Dumping ftrace buffer: [ 26.476899] (ftrace buffer empty) [ 26.480579] Kernel Offset: disabled [ 26.484187] Rebooting in 86400 seconds..