[....] Starting enhanced syslogd: rsyslogd[ 11.652685] audit: type=1400 audit(1515495901.335:4): avc: denied { syslog } for pid=3174 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.7' (ECDSA) to the list of known hosts. executing program executing program syzkaller login: [ 20.762092] ================================================================== [ 20.769483] BUG: KASAN: slab-out-of-bounds in sg_remove_request+0x103/0x120 [ 20.776548] Read of size 8 at addr ffff8801c9bc1240 by task syzkaller663645/3325 [ 20.784047] [ 20.785644] CPU: 0 PID: 3325 Comm: syzkaller663645 Not tainted 4.9.75-gb54d99a #18 [ 20.793314] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 20.802645] ffff8801c94b7940 ffffffff81d93049 ffffea000726f040 ffff8801c9bc1240 [ 20.810605] 0000000000000000 ffff8801c9bc1240 ffff8801c74a8238 ffff8801c94b7978 [ 20.818559] ffffffff8153ca53 ffff8801c9bc1240 0000000000000008 0000000000000000 [ 20.826504] Call Trace: [ 20.829058] [] dump_stack+0xc1/0x128 [ 20.834385] [] print_address_description+0x73/0x280 [ 20.841025] [] kasan_report+0x275/0x360 [ 20.846623] [] ? sg_remove_request+0x103/0x120 [ 20.852820] [] __asan_report_load8_noabort+0x14/0x20 [ 20.859539] [] sg_remove_request+0x103/0x120 [ 20.865573] [] sg_finish_rem_req+0x295/0x340 [ 20.871602] [] sg_read+0xa1c/0x1440 [ 20.876847] [] ? sg_proc_seq_show_debug+0xd10/0xd10 [ 20.883482] [] ? fsnotify+0xf30/0xf30 [ 20.888899] [] ? avc_policy_seqno+0x9/0x20 [ 20.894753] [] do_loop_readv_writev.part.17+0x141/0x1e0 [ 20.902727] [] ? security_file_permission+0x89/0x1e0 [ 20.909453] [] ? sg_proc_seq_show_debug+0xd10/0xd10 [ 20.916083] [] ? sg_proc_seq_show_debug+0xd10/0xd10 [ 20.922717] [] compat_do_readv_writev+0x522/0x760 [ 20.929184] [] ? do_pwritev+0x1a0/0x1a0 [ 20.934777] [] ? _raw_spin_unlock+0x2c/0x50 [ 20.940713] [] ? __fget+0x228/0x3a0 [ 20.945961] [] ? __fget+0x47/0x3a0 [ 20.951122] [] compat_readv+0xe3/0x150 [ 20.956631] [] do_compat_readv+0xf4/0x1d0 [ 20.962395] [] ? compat_readv+0x150/0x150 [ 20.968157] [] compat_SyS_readv+0x26/0x30 [ 20.973932] [] ? SyS_pwritev2+0x80/0x80 [ 20.979520] [] do_fast_syscall_32+0x2f7/0x890 [ 20.985630] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 20.992261] [] entry_SYSENTER_compat+0x74/0x83 [ 20.998455] [ 21.000050] Allocated by task 0: [ 21.003380] (stack is not available) [ 21.007054] [ 21.008646] Freed by task 0: [ 21.011625] (stack is not available) [ 21.015298] [ 21.016891] The buggy address belongs to the object at ffff8801c9bc1200 [ 21.016891] which belongs to the cache fasync_cache of size 96 [ 21.029512] The buggy address is located 64 bytes inside of [ 21.029512] 96-byte region [ffff8801c9bc1200, ffff8801c9bc1260) [ 21.041178] The buggy address belongs to the page: [ 21.046075] page:ffffea000726f040 count:1 mapcount:0 mapping: (null) index:0x0 [ 21.054305] flags: 0x8000000000000080(slab) [ 21.058587] page dumped because: kasan: bad access detected [ 21.064264] [ 21.065858] Memory state around the buggy address: [ 21.070764] ffff8801c9bc1100: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 21.078088] ffff8801c9bc1180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.085411] >ffff8801c9bc1200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.092732] ^ [ 21.098146] ffff8801c9bc1280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.105479] ffff8801c9bc1300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc executing program [ 21.112799] ================================================================== [ 21.120129] Disabling lock debugging due to kernel taint [ 21.126806] Kernel panic - not syncing: panic_on_warn set ... [ 21.126806] [ 21.134173] CPU: 0 PID: 3325 Comm: syzkaller663645 Tainted: G B 4.9.75-gb54d99a #18 [ 21.143065] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 21.152389] ffff8801c94b7898 ffffffff81d93049 ffffffff84195be7 ffff8801c94b7970 [ 21.160344] 0000000000000000 ffff8801c9bc1240 ffff8801c74a8238 ffff8801c94b7960 [ 21.168302] ffffffff8142e281 0000000041b58ab3 ffffffff84189648 ffffffff8142e0c5 [ 21.176271] Call Trace: [ 21.178831] [] dump_stack+0xc1/0x128 [ 21.184174] [] panic+0x1bc/0x3a8 [ 21.189159] [] ? percpu_up_read_preempt_enable.constprop.53+0xd7/0xd7 [ 21.197356] [] ? preempt_schedule+0x25/0x30 [ 21.203294] [] ? ___preempt_schedule+0x16/0x18 [ 21.209495] [] kasan_end_report+0x50/0x50 [ 21.215261] [] kasan_report+0x167/0x360 [ 21.220854] [] ? sg_remove_request+0x103/0x120 [ 21.227064] [] __asan_report_load8_noabort+0x14/0x20 [ 21.233782] [] sg_remove_request+0x103/0x120 [ 21.239895] [] sg_finish_rem_req+0x295/0x340 [ 21.245920] [] sg_read+0xa1c/0x1440 [ 21.251162] [] ? sg_proc_seq_show_debug+0xd10/0xd10 [ 21.257796] [] ? fsnotify+0xf30/0xf30 [ 21.263230] [] ? avc_policy_seqno+0x9/0x20 [ 21.269084] [] do_loop_readv_writev.part.17+0x141/0x1e0 [ 21.276064] [] ? security_file_permission+0x89/0x1e0 [ 21.282799] [] ? sg_proc_seq_show_debug+0xd10/0xd10 [ 21.289442] [] ? sg_proc_seq_show_debug+0xd10/0xd10 [ 21.296077] [] compat_do_readv_writev+0x522/0x760 [ 21.302536] [] ? do_pwritev+0x1a0/0x1a0 [ 21.308127] [] ? _raw_spin_unlock+0x2c/0x50 [ 21.314079] [] ? __fget+0x228/0x3a0 [ 21.320191] [] ? __fget+0x47/0x3a0 [ 21.325361] [] compat_readv+0xe3/0x150 [ 21.330867] [] do_compat_readv+0xf4/0x1d0 [ 21.336631] [] ? compat_readv+0x150/0x150 [ 21.342397] [] compat_SyS_readv+0x26/0x30 [ 21.348162] [] ? SyS_pwritev2+0x80/0x80 [ 21.353756] [] do_fast_syscall_32+0x2f7/0x890 [ 21.359867] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 21.366502] [] entry_SYSENTER_compat+0x74/0x83 [ 21.373441] Dumping ftrace buffer: [ 21.376952] (ftrace buffer empty) [ 21.380633] Kernel Offset: disabled [ 21.384233] Rebooting in 86400 seconds..