[....] Starting enhanced syslogd: rsyslogd[ 10.606025] audit: type=1400 audit(1514548091.774:4): avc: denied { syslog } for pid=3173 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.43' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 48.687466] ================================================================== [ 48.688589] BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x2453/0x2830 [ 48.689582] Read of size 4 at addr ffff8801c0d17850 by task syzkaller959366/3346 [ 48.690565] [ 48.690796] CPU: 0 PID: 3346 Comm: syzkaller959366 Not tainted 4.9.72-gcb7518e #10 [ 48.691819] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 48.693068] ffff8801c0d16ea0 ffffffff81d922b9 ffffea00070345c0 ffff8801c0d17850 [ 48.694208] 0000000000000000 ffff8801c0d17850 ffff8801c9f5b420 ffff8801c0d16ed8 [ 48.695360] ffffffff8153bab3 ffff8801c0d17850 0000000000000004 0000000000000000 [ 48.696516] Call Trace: [ 48.696876] [] dump_stack+0xc1/0x128 [ 48.697586] [] print_address_description+0x73/0x280 [ 48.698475] [] kasan_report+0x275/0x360 [ 48.699218] [] ? xfrm_state_find+0x2453/0x2830 [ 48.700038] [] __asan_report_load4_noabort+0x14/0x20 [ 48.700925] [] xfrm_state_find+0x2453/0x2830 [ 48.701723] [] ? xfrm_state_find+0x25a/0x2830 [ 48.702531] [] ? xfrm_unregister_mode+0x200/0x200 [ 48.703458] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 48.704397] [] ? check_usage_forwards+0x310/0x310 [ 48.705281] [] xfrm_tmpl_resolve+0x298/0xa90 [ 48.706080] [] ? __xfrm_decode_session+0x100/0x100 [ 48.706945] [] ? __lock_acquire+0x629/0x3640 [ 48.708842] [] ? save_stack+0xa3/0xd0 [ 48.714261] [] xfrm_resolve_and_create_bundle+0xd7/0x1d90 [ 48.721418] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 48.728399] [] ? xfrm_tmpl_resolve+0xa90/0xa90 [ 48.734601] [] ? check_preemption_disabled+0x3b/0x200 [ 48.741409] [] ? xfrm_sk_policy_lookup+0x200/0x370 [ 48.747956] [] ? xfrm_sk_policy_lookup+0x227/0x370 [ 48.754512] [] ? xfrm_selector_match+0xe40/0xe40 [ 48.760894] [] ? xfrm_expand_policies+0x25b/0x5b0 [ 48.767354] [] xfrm_lookup+0x984/0xbf0 [ 48.772861] [] ? xfrm_bundle_lookup+0x11b0/0x11b0 [ 48.779327] [] ? __ip_route_output_key_hash+0x7e5/0x23e0 [ 48.786391] [] ? __ip_route_output_key_hash+0x80c/0x23e0 [ 48.793458] [] ? __ip_route_output_key_hash+0x16a/0x23e0 [ 48.800524] [] ? ip_rt_update_pmtu+0x8b0/0x8b0 [ 48.806724] [] xfrm_lookup_route+0x39/0x1a0 [ 48.812659] [] ip_route_output_flow+0x7f/0xa0 [ 48.818773] [] udp_sendmsg+0xe36/0x1c10 [ 48.824361] [] ? udp_sendmsg+0x1232/0x1c10 [ 48.830210] [] ? ip_reply_glue_bits+0xb0/0xb0 [ 48.836322] [] ? udp_lib_get_port+0x1830/0x1830 [ 48.842606] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 48.848893] [] udpv6_sendmsg+0x588/0x2540 [ 48.854657] [] ? trace_hardirqs_on+0xd/0x10 [ 48.860594] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 48.866878] [] ? udp_v6_rehash+0xa0/0xa0 [ 48.872554] [] ? udp_seq_next+0x80/0x80 [ 48.878143] [] ? release_sock+0x20/0x1c0 [ 48.883819] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 48.890104] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 48.896906] [] ? release_sock+0x14c/0x1c0 [ 48.902668] [] ? trace_hardirqs_on+0xd/0x10 [ 48.908605] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 48.914887] [] ? _raw_spin_unlock_bh+0x30/0x40 [ 48.921082] [] ? release_sock+0x14c/0x1c0 [ 48.926848] [] inet_sendmsg+0x2bc/0x4c0 [ 48.932438] [] ? inet_sendmsg+0x73/0x4c0 [ 48.938131] [] ? inet_recvmsg+0x4c0/0x4c0 [ 48.943894] [] sock_sendmsg+0xca/0x110 [ 48.949395] [] SYSC_sendto+0x2c8/0x340 [ 48.954896] [] ? SYSC_connect+0x310/0x310 [ 48.960673] [] ? handle_mm_fault+0xb12/0x2530 [ 48.966785] [] ? _raw_spin_unlock+0x2c/0x50 [ 48.972724] [] ? handle_mm_fault+0x6ee/0x2530 [ 48.978837] [] ? __pmd_alloc+0x410/0x410 [ 48.984516] [] ? __do_page_fault+0x5ec/0xd40 [ 48.990538] [] ? up_read+0x1a/0x40 [ 48.995694] [] ? __do_page_fault+0x3bd/0xd40 [ 49.001718] [] SyS_sendto+0x40/0x50 [ 49.006958] [] ? SyS_getpeername+0x30/0x30 [ 49.012806] [] do_fast_syscall_32+0x2f7/0x890 [ 49.018915] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 49.025544] [] entry_SYSENTER_compat+0x51/0x60 [ 49.031738] [ 49.033331] The buggy address belongs to the page: [ 49.038229] page:ffffea00070345c0 count:0 mapcount:0 mapping: (null) index:0x0 [ 49.046449] flags: 0x8000000000000000() [ 49.050385] page dumped because: kasan: bad access detected [ 49.056057] [ 49.057663] Memory state around the buggy address: [ 49.062556] ffff8801c0d17700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 [ 49.069890] ffff8801c0d17780: f1 f1 f1 00 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 f2 [ 49.077215] >ffff8801c0d17800: f2 f2 f2 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 00 [ 49.084539] ^ [ 49.090562] ffff8801c0d17880: 00 00 00 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 [ 49.097886] ffff8801c0d17900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 49.105207] ================================================================== [ 49.112529] Disabling lock debugging due to kernel taint [ 49.118258] Kernel panic - not syncing: panic_on_warn set ... [ 49.118258] [ 49.125609] CPU: 0 PID: 3346 Comm: syzkaller959366 Tainted: G B 4.9.72-gcb7518e #10 [ 49.134510] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 49.143837] ffff8801c0d16df8 ffffffff81d922b9 ffffffff841955bf ffff8801c0d16ed0 [ 49.151803] 0000000000000000 ffff8801c0d17850 ffff8801c9f5b420 ffff8801c0d16ec0 [ 49.159760] ffffffff8142d741 0000000041b58ab3 ffffffff84189000 ffffffff8142d585 [ 49.167714] Call Trace: [ 49.170270] [] dump_stack+0xc1/0x128 [ 49.175601] [] panic+0x1bc/0x3a8 [ 49.180582] [] ? percpu_up_read_preempt_enable.constprop.53+0xd7/0xd7 [ 49.188787] [] ? preempt_schedule+0x25/0x30 [ 49.194726] [] ? ___preempt_schedule+0x16/0x18 [ 49.200924] [] kasan_end_report+0x50/0x50 [ 49.206691] [] kasan_report+0x167/0x360 [ 49.212281] [] ? xfrm_state_find+0x2453/0x2830 [ 49.218479] [] __asan_report_load4_noabort+0x14/0x20 [ 49.225195] [] xfrm_state_find+0x2453/0x2830 [ 49.231219] [] ? xfrm_state_find+0x25a/0x2830 [ 49.237331] [] ? xfrm_unregister_mode+0x200/0x200 [ 49.243788] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 49.250767] [] ? check_usage_forwards+0x310/0x310 [ 49.257232] [] xfrm_tmpl_resolve+0x298/0xa90 [ 49.263257] [] ? __xfrm_decode_session+0x100/0x100 [ 49.269806] [] ? __lock_acquire+0x629/0x3640 [ 49.275833] [] ? save_stack+0xa3/0xd0 [ 49.281251] [] xfrm_resolve_and_create_bundle+0xd7/0x1d90 [ 49.288402] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 49.295379] [] ? xfrm_tmpl_resolve+0xa90/0xa90 [ 49.301579] [] ? check_preemption_disabled+0x3b/0x200 [ 49.308385] [] ? xfrm_sk_policy_lookup+0x200/0x370 [ 49.314929] [] ? xfrm_sk_policy_lookup+0x227/0x370 [ 49.321473] [] ? xfrm_selector_match+0xe40/0xe40 [ 49.327845] [] ? xfrm_expand_policies+0x25b/0x5b0 [ 49.334963] [] xfrm_lookup+0x984/0xbf0 [ 49.340468] [] ? xfrm_bundle_lookup+0x11b0/0x11b0 [ 49.346926] [] ? __ip_route_output_key_hash+0x7e5/0x23e0 [ 49.353992] [] ? __ip_route_output_key_hash+0x80c/0x23e0 [ 49.361067] [] ? __ip_route_output_key_hash+0x16a/0x23e0 [ 49.368138] [] ? ip_rt_update_pmtu+0x8b0/0x8b0 [ 49.374335] [] xfrm_lookup_route+0x39/0x1a0 [ 49.380271] [] ip_route_output_flow+0x7f/0xa0 [ 49.386397] [] udp_sendmsg+0xe36/0x1c10 [ 49.391985] [] ? udp_sendmsg+0x1232/0x1c10 [ 49.397838] [] ? ip_reply_glue_bits+0xb0/0xb0 [ 49.403949] [] ? udp_lib_get_port+0x1830/0x1830 [ 49.410236] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 49.416522] [] udpv6_sendmsg+0x588/0x2540 [ 49.422287] [] ? trace_hardirqs_on+0xd/0x10 [ 49.428222] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 49.434507] [] ? udp_v6_rehash+0xa0/0xa0 [ 49.440184] [] ? udp_seq_next+0x80/0x80 [ 49.445776] [] ? release_sock+0x20/0x1c0 [ 49.451450] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 49.457733] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 49.464539] [] ? release_sock+0x14c/0x1c0 [ 49.470301] [] ? trace_hardirqs_on+0xd/0x10 [ 49.476240] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 49.482525] [] ? _raw_spin_unlock_bh+0x30/0x40 [ 49.488723] [] ? release_sock+0x14c/0x1c0 [ 49.494489] [] inet_sendmsg+0x2bc/0x4c0 [ 49.500077] [] ? inet_sendmsg+0x73/0x4c0 [ 49.505752] [] ? inet_recvmsg+0x4c0/0x4c0 [ 49.511515] [] sock_sendmsg+0xca/0x110 [ 49.517017] [] SYSC_sendto+0x2c8/0x340 [ 49.522520] [] ? SYSC_connect+0x310/0x310 [ 49.528286] [] ? handle_mm_fault+0xb12/0x2530 [ 49.534396] [] ? _raw_spin_unlock+0x2c/0x50 [ 49.540332] [] ? handle_mm_fault+0x6ee/0x2530 [ 49.546441] [] ? __pmd_alloc+0x410/0x410 [ 49.552117] [] ? __do_page_fault+0x5ec/0xd40 [ 49.558140] [] ? up_read+0x1a/0x40 [ 49.563295] [] ? __do_page_fault+0x3bd/0xd40 [ 49.569317] [] SyS_sendto+0x40/0x50 [ 49.574558] [] ? SyS_getpeername+0x30/0x30 [ 49.580408] [] do_fast_syscall_32+0x2f7/0x890 [ 49.586518] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 49.593148] [] entry_SYSENTER_compat+0x51/0x60 [ 49.599382] Dumping ftrace buffer: [ 49.602887] (ftrace buffer empty) [ 49.606565] Kernel Offset: disabled [ 49.610156] Rebooting in 86400 seconds..