[....] Starting enhanced syslogd: rsyslogd[ 10.770441] audit: type=1400 audit(1514497731.181:4): avc: denied { syslog } for pid=3169 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.15.211' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 28.373744] ================================================================== [ 28.374850] BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x2453/0x2830 [ 28.375832] Read of size 4 at addr ffff8801c8e9f850 by task syzkaller022144/3327 [ 28.376842] [ 28.377072] CPU: 0 PID: 3327 Comm: syzkaller022144 Not tainted 4.9.72-gcb7518e #10 [ 28.378097] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 28.379327] ffff8801c8e9eea0 ffffffff81d922b9 ffffea000723a7c0 ffff8801c8e9f850 [ 28.380497] 0000000000000000 ffff8801c8e9f850 ffff8801c8e87420 ffff8801c8e9eed8 [ 28.381645] ffffffff8153bab3 ffff8801c8e9f850 0000000000000004 0000000000000000 [ 28.382786] Call Trace: [ 28.383156] [] dump_stack+0xc1/0x128 [ 28.383911] [] print_address_description+0x73/0x280 [ 28.384785] [] kasan_report+0x275/0x360 [ 28.385526] [] ? xfrm_state_find+0x2453/0x2830 [ 28.386369] [] __asan_report_load4_noabort+0x14/0x20 [ 28.387257] [] xfrm_state_find+0x2453/0x2830 [ 28.388116] [] ? xfrm_state_find+0x25a/0x2830 [ 28.389231] [] ? xfrm_unregister_mode+0x200/0x200 [ 28.390088] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 28.391008] [] ? check_usage_forwards+0x310/0x310 [ 28.391876] [] xfrm_tmpl_resolve+0x298/0xa90 [ 28.392673] [] ? __xfrm_decode_session+0x100/0x100 [ 28.393536] [] ? __lock_acquire+0x629/0x3640 [ 28.394343] [] ? save_stack+0xa3/0xd0 [ 28.399758] [] xfrm_resolve_and_create_bundle+0xd7/0x1d90 [ 28.406920] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 28.413902] [] ? xfrm_tmpl_resolve+0xa90/0xa90 [ 28.420099] [] ? check_preemption_disabled+0x3b/0x200 [ 28.426904] [] ? xfrm_sk_policy_lookup+0x200/0x370 [ 28.433447] [] ? xfrm_sk_policy_lookup+0x227/0x370 [ 28.439990] [] ? xfrm_selector_match+0xe40/0xe40 [ 28.446361] [] ? xfrm_expand_policies+0x25b/0x5b0 [ 28.452817] [] xfrm_lookup+0x984/0xbf0 [ 28.458317] [] ? xfrm_bundle_lookup+0x11b0/0x11b0 [ 28.464776] [] ? __ip_route_output_key_hash+0x7e5/0x23e0 [ 28.471839] [] ? __ip_route_output_key_hash+0x80c/0x23e0 [ 28.478903] [] ? __ip_route_output_key_hash+0x16a/0x23e0 [ 28.485969] [] ? ip_rt_update_pmtu+0x8b0/0x8b0 [ 28.492172] [] xfrm_lookup_route+0x39/0x1a0 [ 28.498105] [] ip_route_output_flow+0x7f/0xa0 [ 28.504211] [] udp_sendmsg+0xe36/0x1c10 [ 28.509802] [] ? udp_sendmsg+0x1232/0x1c10 [ 28.515649] [] ? ip_reply_glue_bits+0xb0/0xb0 [ 28.521764] [] ? udp_lib_get_port+0x1830/0x1830 [ 28.528045] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 28.534327] [] udpv6_sendmsg+0x588/0x2540 [ 28.540089] [] ? trace_hardirqs_on+0xd/0x10 [ 28.546028] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 28.552307] [] ? udp_v6_rehash+0xa0/0xa0 [ 28.557980] [] ? udp_seq_next+0x80/0x80 [ 28.563570] [] ? release_sock+0x20/0x1c0 [ 28.569242] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 28.575522] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 28.582324] [] ? release_sock+0x14c/0x1c0 [ 28.588089] [] ? trace_hardirqs_on+0xd/0x10 [ 28.594022] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 28.600306] [] ? _raw_spin_unlock_bh+0x30/0x40 [ 28.606498] [] ? release_sock+0x14c/0x1c0 [ 28.612258] [] inet_sendmsg+0x2bc/0x4c0 [ 28.617859] [] ? inet_sendmsg+0x73/0x4c0 [ 28.623535] [] ? inet_recvmsg+0x4c0/0x4c0 [ 28.629295] [] sock_sendmsg+0xca/0x110 [ 28.634796] [] SYSC_sendto+0x2c8/0x340 [ 28.640296] [] ? SYSC_connect+0x310/0x310 [ 28.646056] [] ? do_huge_pmd_anonymous_page+0x2d4/0x10d0 [ 28.653124] [] ? handle_mm_fault+0x6ee/0x2530 [ 28.659233] [] ? __pmd_alloc+0x410/0x410 [ 28.664913] [] ? __do_page_fault+0x5ec/0xd40 [ 28.670933] [] ? up_read+0x1a/0x40 [ 28.676084] [] ? __do_page_fault+0x3bd/0xd40 [ 28.682103] [] SyS_sendto+0x40/0x50 [ 28.687342] [] ? SyS_getpeername+0x30/0x30 [ 28.693189] [] do_fast_syscall_32+0x2f7/0x890 [ 28.699295] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 28.705925] [] entry_SYSENTER_compat+0x51/0x60 [ 28.712116] [ 28.713705] The buggy address belongs to the page: [ 28.718598] page:ffffea000723a7c0 count:0 mapcount:0 mapping: (null) index:0x0 [ 28.726812] flags: 0x8000000000000000() [ 28.730749] page dumped because: kasan: bad access detected [ 28.736419] [ 28.738008] Memory state around the buggy address: [ 28.742898] ffff8801c8e9f700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 [ 28.750221] ffff8801c8e9f780: f1 f1 f1 00 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 f2 [ 28.757544] >ffff8801c8e9f800: f2 f2 f2 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 00 [ 28.764864] ^ [ 28.770794] ffff8801c8e9f880: 00 00 00 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 [ 28.778118] ffff8801c8e9f900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 28.785439] ================================================================== [ 28.792760] Disabling lock debugging due to kernel taint [ 28.798262] Kernel panic - not syncing: panic_on_warn set ... [ 28.798262] [ 28.805597] CPU: 0 PID: 3327 Comm: syzkaller022144 Tainted: G B 4.9.72-gcb7518e #10 [ 28.814482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 28.823802] ffff8801c8e9edf8 ffffffff81d922b9 ffffffff841955bf ffff8801c8e9eed0 [ 28.831746] 0000000000000000 ffff8801c8e9f850 ffff8801c8e87420 ffff8801c8e9eec0 [ 28.839688] ffffffff8142d741 0000000041b58ab3 ffffffff84189000 ffffffff8142d585 [ 28.847637] Call Trace: [ 28.850190] [] dump_stack+0xc1/0x128 [ 28.855517] [] panic+0x1bc/0x3a8 [ 28.860498] [] ? percpu_up_read_preempt_enable.constprop.53+0xd7/0xd7 [ 28.868699] [] ? preempt_schedule+0x25/0x30 [ 28.874633] [] ? ___preempt_schedule+0x16/0x18 [ 28.880829] [] kasan_end_report+0x50/0x50 [ 28.886590] [] kasan_report+0x167/0x360 [ 28.892181] [] ? xfrm_state_find+0x2453/0x2830 [ 28.898382] [] __asan_report_load4_noabort+0x14/0x20 [ 28.905105] [] xfrm_state_find+0x2453/0x2830 [ 28.911126] [] ? xfrm_state_find+0x25a/0x2830 [ 28.917235] [] ? xfrm_unregister_mode+0x200/0x200 [ 28.923694] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 28.930670] [] ? check_usage_forwards+0x310/0x310 [ 28.937126] [] xfrm_tmpl_resolve+0x298/0xa90 [ 28.943148] [] ? __xfrm_decode_session+0x100/0x100 [ 28.949696] [] ? __lock_acquire+0x629/0x3640 [ 28.955720] [] ? save_stack+0xa3/0xd0 [ 28.961133] [] xfrm_resolve_and_create_bundle+0xd7/0x1d90 [ 28.968283] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 28.975266] [] ? xfrm_tmpl_resolve+0xa90/0xa90 [ 28.981463] [] ? check_preemption_disabled+0x3b/0x200 [ 28.988268] [] ? xfrm_sk_policy_lookup+0x200/0x370 [ 28.994814] [] ? xfrm_sk_policy_lookup+0x227/0x370 [ 29.001363] [] ? xfrm_selector_match+0xe40/0xe40 [ 29.007732] [] ? xfrm_expand_policies+0x25b/0x5b0 [ 29.014189] [] xfrm_lookup+0x984/0xbf0 [ 29.019692] [] ? xfrm_bundle_lookup+0x11b0/0x11b0 [ 29.026150] [] ? __ip_route_output_key_hash+0x7e5/0x23e0 [ 29.033214] [] ? __ip_route_output_key_hash+0x80c/0x23e0 [ 29.040279] [] ? __ip_route_output_key_hash+0x16a/0x23e0 [ 29.047431] [] ? ip_rt_update_pmtu+0x8b0/0x8b0 [ 29.053635] [] xfrm_lookup_route+0x39/0x1a0 [ 29.059576] [] ip_route_output_flow+0x7f/0xa0 [ 29.065685] [] udp_sendmsg+0xe36/0x1c10 [ 29.071272] [] ? udp_sendmsg+0x1232/0x1c10 [ 29.077122] [] ? ip_reply_glue_bits+0xb0/0xb0 [ 29.083235] [] ? udp_lib_get_port+0x1830/0x1830 [ 29.089518] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 29.095801] [] udpv6_sendmsg+0x588/0x2540 [ 29.101565] [] ? trace_hardirqs_on+0xd/0x10 [ 29.107499] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 29.113781] [] ? udp_v6_rehash+0xa0/0xa0 [ 29.119456] [] ? udp_seq_next+0x80/0x80 [ 29.125046] [] ? release_sock+0x20/0x1c0 [ 29.130721] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 29.137011] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 29.143815] [] ? release_sock+0x14c/0x1c0 [ 29.149577] [] ? trace_hardirqs_on+0xd/0x10 [ 29.155512] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 29.161797] [] ? _raw_spin_unlock_bh+0x30/0x40 [ 29.167993] [] ? release_sock+0x14c/0x1c0 [ 29.173753] [] inet_sendmsg+0x2bc/0x4c0 [ 29.179338] [] ? inet_sendmsg+0x73/0x4c0 [ 29.185014] [] ? inet_recvmsg+0x4c0/0x4c0 [ 29.190775] [] sock_sendmsg+0xca/0x110 [ 29.196275] [] SYSC_sendto+0x2c8/0x340 [ 29.201778] [] ? SYSC_connect+0x310/0x310 [ 29.207543] [] ? do_huge_pmd_anonymous_page+0x2d4/0x10d0 [ 29.214643] [] ? handle_mm_fault+0x6ee/0x2530 [ 29.220956] [] ? __pmd_alloc+0x410/0x410 [ 29.226636] [] ? __do_page_fault+0x5ec/0xd40 [ 29.232662] [] ? up_read+0x1a/0x40 [ 29.237818] [] ? __do_page_fault+0x3bd/0xd40 [ 29.243842] [] SyS_sendto+0x40/0x50 [ 29.249085] [] ? SyS_getpeername+0x30/0x30 [ 29.254934] [] do_fast_syscall_32+0x2f7/0x890 [ 29.261041] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 29.267677] [] entry_SYSENTER_compat+0x51/0x60 [ 29.274284] Dumping ftrace buffer: [ 29.277787] (ftrace buffer empty) [ 29.281466] Kernel Offset: disabled [ 29.285059] Rebooting in 86400 seconds..