INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added 'ci-upstream-net-kasan-gce-5,10.128.0.35' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 44.830614] ================================================================== [ 44.831701] BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x30fc/0x3230 [ 44.832645] Read of size 4 at addr ffff8801ccaa7af8 by task syzkaller231684/3045 [ 44.833627] [ 44.833860] CPU: 0 PID: 3045 Comm: syzkaller231684 Not tainted 4.14.0+ #128 [ 44.834800] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 44.836018] Call Trace: [ 44.836377] dump_stack+0x194/0x257 [ 44.836870] ? arch_local_irq_restore+0x53/0x53 [ 44.837494] ? show_regs_print_info+0x65/0x65 [ 44.838097] ? lock_release+0xda0/0xda0 [ 44.838630] ? xfrm_state_find+0x30fc/0x3230 [ 44.839222] print_address_description+0x73/0x250 [ 44.839865] ? xfrm_state_find+0x30fc/0x3230 [ 44.840453] kasan_report+0x25b/0x340 [ 44.840967] __asan_report_load4_noabort+0x14/0x20 [ 44.841620] xfrm_state_find+0x30fc/0x3230 [ 44.842212] ? xfrm_state_afinfo_get_rcu+0x160/0x160 [ 44.842889] ? check_noncircular+0x20/0x20 [ 44.843454] ? find_held_lock+0x39/0x1d0 [ 44.844006] ? check_noncircular+0x20/0x20 [ 44.844569] ? lock_downgrade+0x980/0x980 [ 44.845125] ? __free_insn_slot+0x5c0/0x5c0 [ 44.845706] ? __lock_acquire+0x2727/0x47f0 [ 44.846281] ? find_held_lock+0x39/0x1d0 [ 44.846842] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 44.847531] ? print_usage_bug+0x3f0/0x3f0 [ 44.848098] ? lock_downgrade+0x980/0x980 [ 44.848654] ? depot_save_stack+0x1c2/0x490 [ 44.849235] ? lock_release+0xda0/0xda0 [ 44.849771] ? is_bpf_text_address+0xa4/0x120 [ 44.850376] ? __lock_acquire+0x6e9/0x47f0 [ 44.850940] ? check_noncircular+0x20/0x20 [ 44.855141] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 44.860128] xfrm_tmpl_resolve+0x2fb/0xbd0 [ 44.864344] ? __xfrm_decode_session+0x110/0x110 [ 44.869072] ? lock_downgrade+0x980/0x980 [ 44.873198] ? rt_add_uncached_list+0xa2/0x240 [ 44.877745] ? check_noncircular+0x20/0x20 [ 44.881951] ? check_noncircular+0x20/0x20 [ 44.886165] xfrm_resolve_and_create_bundle+0x11b/0x2600 [ 44.891585] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 44.896564] ? rt_add_uncached_list+0x1b7/0x240 [ 44.901202] ? __local_bh_enable_ip+0x121/0x230 [ 44.905838] ? _raw_spin_unlock_bh+0x30/0x40 [ 44.910219] ? find_held_lock+0x39/0x1d0 [ 44.914246] ? xfrm_tmpl_resolve+0xbd0/0xbd0 [ 44.918626] ? lock_downgrade+0x980/0x980 [ 44.922743] ? xfrm_selector_match+0xe00/0xe00 [ 44.927558] ? rt_cache_route+0x300/0x300 [ 44.931675] ? lock_release+0xda0/0xda0 [ 44.935620] ? refcount_inc_not_zero+0xfe/0x180 [ 44.940655] ? selinux_xfrm_policy_lookup+0xac/0xd0 [ 44.945642] ? security_xfrm_policy_lookup+0x92/0xc0 [ 44.950716] ? xfrm_sk_policy_lookup+0x334/0x490 [ 44.955447] ? xfrm_selector_match+0xe00/0xe00 [ 44.959999] ? check_noncircular+0x20/0x20 [ 44.964207] xfrm_lookup+0x1574/0x23f0 [ 44.968061] ? xfrm_lookup+0x1574/0x23f0 [ 44.972093] ? __mem_cgroup_threshold+0x8f0/0x8f0 [ 44.976910] ? xfrm_policy_lookup_bytype.constprop.47+0x960/0x960 [ 44.983112] ? find_held_lock+0x39/0x1d0 [ 44.987149] ? lock_downgrade+0x980/0x980 [ 44.991266] ? ip_route_output_key_hash+0x1a6/0x370 [ 44.996253] ? lock_release+0xda0/0xda0 [ 45.000208] ? lock_downgrade+0x980/0x980 [ 45.004329] ? ip_route_output_key_hash+0x252/0x370 [ 45.009313] ? ip_route_output_key_hash_rcu+0x2c20/0x2c20 [ 45.014815] ? lock_release+0xda0/0xda0 [ 45.018761] xfrm_lookup_route+0x39/0x1a0 [ 45.022876] ip_route_output_flow+0x7c/0xa0 [ 45.027166] raw_sendmsg+0xc4f/0x3920 [ 45.030938] ? debug_check_no_locks_freed+0x3c0/0x3d0 [ 45.036103] ? raw_setsockopt+0xd0/0xd0 [ 45.040046] ? do_ip_setsockopt.isra.12+0x2a9/0x3200 [ 45.045121] ? alloc_file+0x26/0x3a0 [ 45.048800] ? sock_alloc_file+0x1fd/0x550 [ 45.052999] ? sock_map_fd+0x34/0x70 [ 45.056680] ? entry_SYSCALL_64_fastpath+0x1f/0x96 [ 45.061581] ? find_held_lock+0x39/0x1d0 [ 45.065610] ? check_noncircular+0x20/0x20 [ 45.069831] ? find_held_lock+0x39/0x1d0 [ 45.073873] ? __might_fault+0xe0/0x1d0 [ 45.077814] ? sock_has_perm+0x29c/0x400 [ 45.081848] ? selinux_secmark_relabel_packet+0xc0/0xc0 [ 45.087179] ? lock_release+0xda0/0xda0 [ 45.091118] ? trace_event_raw_event_sched_switch+0x8a0/0x8a0 [ 45.096972] ? __check_object_size+0x25d/0x4f0 [ 45.101527] inet_sendmsg+0x11f/0x5e0 [ 45.105295] ? __might_sleep+0x95/0x190 [ 45.109236] ? inet_recvmsg+0x5f0/0x5f0 [ 45.113182] ? selinux_socket_sendmsg+0x36/0x40 [ 45.117816] ? security_socket_sendmsg+0x89/0xb0 [ 45.122536] ? inet_recvmsg+0x5f0/0x5f0 [ 45.126479] sock_sendmsg+0xca/0x110 [ 45.130161] SYSC_sendto+0x358/0x5a0 [ 45.133846] ? SYSC_connect+0x480/0x480 [ 45.137788] ? __do_page_fault+0x3d6/0xc90 [ 45.141994] ? mm_fault_error+0x2c0/0x2c0 [ 45.146117] ? ip_setsockopt+0x6f/0xb0 [ 45.149978] ? __do_page_fault+0xc90/0xc90 [ 45.154183] ? SyS_setsockopt+0x215/0x360 [ 45.158303] ? lockdep_sys_exit+0x47/0xf0 [ 45.162415] ? entry_SYSCALL_64_fastpath+0x5/0x96 [ 45.167226] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 45.172210] SyS_sendto+0x40/0x50 [ 45.175633] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 45.180353] RIP: 0033:0x43ff09 [ 45.183508] RSP: 002b:00007fffb0363278 EFLAGS: 00000217 ORIG_RAX: 000000000000002c [ 45.191182] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043ff09 [ 45.198416] RDX: 0000000000000000 RSI: 0000000020098000 RDI: 0000000000000003 [ 45.205653] RBP: 0000000000000086 R08: 0000000020c24000 R09: 0000000000000010 [ 45.212888] R10: fffffffffffffffe R11: 0000000000000217 R12: 0000000000401870 [ 45.220123] R13: 0000000000401900 R14: 0000000000000000 R15: 0000000000000000 [ 45.227375] [ 45.228968] The buggy address belongs to the page: [ 45.233860] page:ffffea000732a9c0 count:0 mapcount:0 mapping: (null) index:0x0 [ 45.241968] flags: 0x2fffc0000000000() [ 45.245821] raw: 02fffc0000000000 0000000000000000 0000000000000000 00000000ffffffff [ 45.253665] raw: 0000000000000000 0000000100000001 0000000000000000 0000000000000000 [ 45.261505] page dumped because: kasan: bad access detected [ 45.267176] [ 45.268775] Memory state around the buggy address: [ 45.273667] ffff8801ccaa7980: f2 f2 f2 f2 00 f2 f2 f2 f2 f2 f2 f2 00 00 00 f2 [ 45.280990] ffff8801ccaa7a00: f2 f2 f2 f2 00 00 00 00 f2 f2 f2 f2 00 00 00 00 [ 45.288314] >ffff8801ccaa7a80: 00 00 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 f2 [ 45.295635] ^ [ 45.302872] ffff8801ccaa7b00: f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 f2 f2 f2 [ 45.310193] ffff8801ccaa7b80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 f1 f1 [ 45.317513] ================================================================== [ 45.324832] Disabling lock debugging due to kernel taint [ 45.330352] Kernel panic - not syncing: panic_on_warn set ... [ 45.330352] [ 45.337694] CPU: 0 PID: 3045 Comm: syzkaller231684 Tainted: G B 4.14.0+ #128 [ 45.346065] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 45.355383] Call Trace: [ 45.357935] dump_stack+0x194/0x257 [ 45.361527] ? arch_local_irq_restore+0x53/0x53 [ 45.366162] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 45.370888] ? vsnprintf+0x1ed/0x1900 [ 45.374656] ? xfrm_state_find+0x30a0/0x3230 [ 45.379032] panic+0x1e4/0x41c [ 45.382187] ? refcount_error_report+0x214/0x214 [ 45.386906] ? add_taint+0x1c/0x50 [ 45.390410] ? add_taint+0x1c/0x50 [ 45.393914] ? xfrm_state_find+0x30fc/0x3230 [ 45.398288] kasan_end_report+0x50/0x50 [ 45.402227] kasan_report+0x144/0x340 [ 45.405992] __asan_report_load4_noabort+0x14/0x20 [ 45.410884] xfrm_state_find+0x30fc/0x3230 [ 45.415093] ? xfrm_state_afinfo_get_rcu+0x160/0x160 [ 45.420159] ? check_noncircular+0x20/0x20 [ 45.424356] ? find_held_lock+0x39/0x1d0 [ 45.428383] ? check_noncircular+0x20/0x20 [ 45.432582] ? lock_downgrade+0x980/0x980 [ 45.436696] ? __free_insn_slot+0x5c0/0x5c0 [ 45.440981] ? __lock_acquire+0x2727/0x47f0 [ 45.445266] ? find_held_lock+0x39/0x1d0 [ 45.449301] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 45.454454] ? print_usage_bug+0x3f0/0x3f0 [ 45.458651] ? lock_downgrade+0x980/0x980 [ 45.462762] ? depot_save_stack+0x1c2/0x490 [ 45.467049] ? lock_release+0xda0/0xda0 [ 45.470988] ? is_bpf_text_address+0xa4/0x120 [ 45.475447] ? __lock_acquire+0x6e9/0x47f0 [ 45.479646] ? check_noncircular+0x20/0x20 [ 45.483843] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 45.488826] xfrm_tmpl_resolve+0x2fb/0xbd0 [ 45.493034] ? __xfrm_decode_session+0x110/0x110 [ 45.497757] ? lock_downgrade+0x980/0x980 [ 45.501869] ? rt_add_uncached_list+0xa2/0x240 [ 45.506412] ? check_noncircular+0x20/0x20 [ 45.510613] ? check_noncircular+0x20/0x20 [ 45.514812] xfrm_resolve_and_create_bundle+0x11b/0x2600 [ 45.520225] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 45.525205] ? rt_add_uncached_list+0x1b7/0x240 [ 45.529837] ? __local_bh_enable_ip+0x121/0x230 [ 45.534468] ? _raw_spin_unlock_bh+0x30/0x40 [ 45.538840] ? find_held_lock+0x39/0x1d0 [ 45.542863] ? xfrm_tmpl_resolve+0xbd0/0xbd0 [ 45.547238] ? lock_downgrade+0x980/0x980 [ 45.551351] ? xfrm_selector_match+0xe00/0xe00 [ 45.555897] ? rt_cache_route+0x300/0x300 [ 45.560009] ? lock_release+0xda0/0xda0 [ 45.563952] ? refcount_inc_not_zero+0xfe/0x180 [ 45.568586] ? selinux_xfrm_policy_lookup+0xac/0xd0 [ 45.573567] ? security_xfrm_policy_lookup+0x92/0xc0 [ 45.578637] ? xfrm_sk_policy_lookup+0x334/0x490 [ 45.583358] ? xfrm_selector_match+0xe00/0xe00 [ 45.587905] ? check_noncircular+0x20/0x20 [ 45.592106] xfrm_lookup+0x1574/0x23f0 [ 45.595955] ? xfrm_lookup+0x1574/0x23f0 [ 45.599980] ? __mem_cgroup_threshold+0x8f0/0x8f0 [ 45.604788] ? xfrm_policy_lookup_bytype.constprop.47+0x960/0x960 [ 45.610983] ? find_held_lock+0x39/0x1d0 [ 45.615011] ? lock_downgrade+0x980/0x980 [ 45.619121] ? ip_route_output_key_hash+0x1a6/0x370 [ 45.624104] ? lock_release+0xda0/0xda0 [ 45.628048] ? lock_downgrade+0x980/0x980 [ 45.632162] ? ip_route_output_key_hash+0x252/0x370 [ 45.637141] ? ip_route_output_key_hash_rcu+0x2c20/0x2c20 [ 45.642646] ? lock_release+0xda0/0xda0 [ 45.646589] xfrm_lookup_route+0x39/0x1a0 [ 45.650701] ip_route_output_flow+0x7c/0xa0 [ 45.654986] raw_sendmsg+0xc4f/0x3920 [ 45.658753] ? debug_check_no_locks_freed+0x3c0/0x3d0 [ 45.663910] ? raw_setsockopt+0xd0/0xd0 [ 45.667850] ? do_ip_setsockopt.isra.12+0x2a9/0x3200 [ 45.672927] ? alloc_file+0x26/0x3a0 [ 45.676603] ? sock_alloc_file+0x1fd/0x550 [ 45.680801] ? sock_map_fd+0x34/0x70 [ 45.684477] ? entry_SYSCALL_64_fastpath+0x1f/0x96 [ 45.689368] ? find_held_lock+0x39/0x1d0 [ 45.693393] ? check_noncircular+0x20/0x20 [ 45.697598] ? find_held_lock+0x39/0x1d0 [ 45.701628] ? __might_fault+0xe0/0x1d0 [ 45.705565] ? sock_has_perm+0x29c/0x400 [ 45.709591] ? selinux_secmark_relabel_packet+0xc0/0xc0 [ 45.714917] ? lock_release+0xda0/0xda0 [ 45.718855] ? trace_event_raw_event_sched_switch+0x8a0/0x8a0 [ 45.724702] ? __check_object_size+0x25d/0x4f0 [ 45.729251] inet_sendmsg+0x11f/0x5e0 [ 45.733013] ? __might_sleep+0x95/0x190 [ 45.736952] ? inet_recvmsg+0x5f0/0x5f0 [ 45.740889] ? selinux_socket_sendmsg+0x36/0x40 [ 45.745522] ? security_socket_sendmsg+0x89/0xb0 [ 45.750242] ? inet_recvmsg+0x5f0/0x5f0 [ 45.754180] sock_sendmsg+0xca/0x110 [ 45.757859] SYSC_sendto+0x358/0x5a0 [ 45.761539] ? SYSC_connect+0x480/0x480 [ 45.765476] ? __do_page_fault+0x3d6/0xc90 [ 45.769679] ? mm_fault_error+0x2c0/0x2c0 [ 45.773791] ? ip_setsockopt+0x6f/0xb0 [ 45.777645] ? __do_page_fault+0xc90/0xc90 [ 45.781844] ? SyS_setsockopt+0x215/0x360 [ 45.785960] ? lockdep_sys_exit+0x47/0xf0 [ 45.790069] ? entry_SYSCALL_64_fastpath+0x5/0x96 [ 45.794877] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 45.799859] SyS_sendto+0x40/0x50 [ 45.803278] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 45.807995] RIP: 0033:0x43ff09 [ 45.811150] RSP: 002b:00007fffb0363278 EFLAGS: 00000217 ORIG_RAX: 000000000000002c [ 45.818819] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043ff09 [ 45.826054] RDX: 0000000000000000 RSI: 0000000020098000 RDI: 0000000000000003 [ 45.833289] RBP: 0000000000000086 R08: 0000000020c24000 R09: 0000000000000010 [ 45.840531] R10: fffffffffffffffe R11: 0000000000000217 R12: 0000000000401870 [ 45.847767] R13: 0000000000401900 R14: 0000000000000000 R15: 0000000000000000 [ 45.855043] Dumping ftrace buffer: [ 45.858549] (ftrace buffer empty) [ 45.862223] Kernel Offset: disabled [ 45.865821] Rebooting in 86400 seconds..