[....] Starting enhanced syslogd: rsyslogd[ 12.924243] audit: type=1400 audit(1515102928.132:4): avc: denied { syslog } for pid=3172 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.15.230' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 47.080516] ================================================================== [ 47.087890] BUG: KASAN: slab-out-of-bounds in pfkey_add+0x153e/0x3470 [ 47.094436] Read of size 8192 at addr ffff8801c8413918 by task syzkaller622926/3344 [ 47.102203] [ 47.103797] CPU: 1 PID: 3344 Comm: syzkaller622926 Not tainted 4.9.74-g173c52e #14 [ 47.111466] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 47.120787] ffff8801c8707718 ffffffff81d91b09 ffffea0007210480 ffff8801c8413918 [ 47.128740] 0000000000000000 ffff8801c8413b00 ffff8801c8707958 ffff8801c8707750 [ 47.136688] ffffffff8153b503 ffff8801c8413918 0000000000002000 0000000000000000 [ 47.144636] Call Trace: [ 47.147193] [] dump_stack+0xc1/0x128 [ 47.152541] [] print_address_description+0x73/0x280 [ 47.159170] [] kasan_report+0x275/0x360 [ 47.164758] [] ? pfkey_add+0x153e/0x3470 [ 47.170437] [] check_memory_region+0x137/0x190 [ 47.176632] [] memcpy+0x23/0x50 [ 47.181544] [] pfkey_add+0x153e/0x3470 [ 47.187045] [] ? pfkey_delete+0x360/0x360 [ 47.192807] [] ? pfkey_seq_stop+0x80/0x80 [ 47.198582] [] ? __skb_clone+0x24a/0x7d0 [ 47.204256] [] ? pfkey_delete+0x360/0x360 [ 47.210023] [] pfkey_process+0x61e/0x730 [ 47.215698] [] ? pfkey_send_new_mapping+0x11b0/0x11b0 [ 47.222506] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 47.229333] [] pfkey_sendmsg+0x3a9/0x760 [ 47.235008] [] ? pfkey_spdget+0x820/0x820 [ 47.240771] [] sock_sendmsg+0xca/0x110 [ 47.246270] [] ___sys_sendmsg+0x6d1/0x7e0 [ 47.252031] [] ? copy_msghdr_from_user+0x550/0x550 [ 47.258574] [] ? __lru_cache_add+0x187/0x250 [ 47.264604] [] ? do_huge_pmd_anonymous_page+0xb05/0x10d0 [ 47.271668] [] ? _raw_spin_unlock+0x2c/0x50 [ 47.277602] [] ? do_huge_pmd_anonymous_page+0x2d4/0x10d0 [ 47.284669] [] ? handle_mm_fault+0x6ee/0x2530 [ 47.290780] [] ? __fget_light+0x158/0x1e0 [ 47.296540] [] ? __fdget+0x18/0x20 [ 47.301697] [] ? sockfd_lookup_light+0x118/0x160 [ 47.308077] [] __sys_sendmsg+0xd6/0x190 [ 47.313667] [] ? SyS_shutdown+0x1b0/0x1b0 [ 47.319432] [] ? __do_page_fault+0x5ec/0xd40 [ 47.325463] [] compat_SyS_sendmsg+0x2a/0x40 [ 47.331398] [] ? compat_SyS_getsockopt+0x2a0/0x2a0 [ 47.337944] [] do_fast_syscall_32+0x2f7/0x890 [ 47.344060] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 47.350698] [] entry_SYSENTER_compat+0x51/0x60 [ 47.356896] [ 47.358498] Allocated by task 3344: [ 47.362091] save_stack_trace+0x16/0x20 [ 47.366029] save_stack+0x43/0xd0 [ 47.369445] kasan_kmalloc+0xad/0xe0 [ 47.373122] kasan_slab_alloc+0x12/0x20 [ 47.377059] __kmalloc_track_caller+0xda/0x2b0 [ 47.381607] __kmalloc_reserve.isra.37+0x33/0xc0 [ 47.386326] __alloc_skb+0x119/0x600 [ 47.390004] pfkey_sendmsg+0x135/0x760 [ 47.393853] sock_sendmsg+0xca/0x110 [ 47.397529] ___sys_sendmsg+0x6d1/0x7e0 [ 47.401467] __sys_sendmsg+0xd6/0x190 [ 47.405231] compat_SyS_sendmsg+0x2a/0x40 [ 47.409351] do_fast_syscall_32+0x2f7/0x890 [ 47.413641] entry_SYSENTER_compat+0x51/0x60 [ 47.418010] [ 47.419610] Freed by task 1763: [ 47.422852] save_stack_trace+0x16/0x20 [ 47.426790] save_stack+0x43/0xd0 [ 47.430208] kasan_slab_free+0x72/0xc0 [ 47.434059] kfree+0x103/0x300 [ 47.437215] skb_free_head+0x74/0xb0 [ 47.440899] skb_release_data+0x315/0x3f0 [ 47.445019] skb_release_all+0x4a/0x60 [ 47.448870] consume_skb+0xc6/0x340 [ 47.452459] skb_free_datagram+0x1a/0xe0 [ 47.456486] unix_dgram_recvmsg+0x983/0xf90 [ 47.460770] sock_recvmsg+0xc9/0x110 [ 47.464448] SYSC_recvfrom+0x1fc/0x330 [ 47.468299] SyS_recvfrom+0x40/0x50 [ 47.471891] entry_SYSCALL_64_fastpath+0x23/0xc6 [ 47.476608] [ 47.478202] The buggy address belongs to the object at ffff8801c8413900 [ 47.478202] which belongs to the cache kmalloc-512 of size 512 [ 47.490820] The buggy address is located 24 bytes inside of [ 47.490820] 512-byte region [ffff8801c8413900, ffff8801c8413b00) [ 47.502580] The buggy address belongs to the page: [ 47.507476] page:ffffea0007210480 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 47.517631] flags: 0x8000000000004080(slab|head) [ 47.522349] page dumped because: kasan: bad access detected [ 47.528018] [ 47.529610] Memory state around the buggy address: [ 47.534524] ffff8801c8413a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 47.541847] ffff8801c8413a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 47.549168] >ffff8801c8413b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 47.556492] ^ [ 47.559822] ffff8801c8413b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 47.567150] ffff8801c8413c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 47.574475] ================================================================== [ 47.581812] Disabling lock debugging due to kernel taint [ 47.587330] Kernel panic - not syncing: panic_on_warn set ... [ 47.587330] [ 47.594670] CPU: 1 PID: 3344 Comm: syzkaller622926 Tainted: G B 4.9.74-g173c52e #14 [ 47.603566] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 47.612896] ffff8801c8707670 ffffffff81d91b09 ffffffff841955df ffff8801c8707748 [ 47.620844] 0000000000000000 ffff8801c8413b00 ffff8801c8707958 ffff8801c8707738 [ 47.628798] ffffffff8142d161 0000000041b58ab3 ffffffff84189020 ffffffff8142cfa5 [ 47.636743] Call Trace: [ 47.639300] [] dump_stack+0xc1/0x128 [ 47.644654] [] panic+0x1bc/0x3a8 [ 47.649646] [] ? percpu_up_read_preempt_enable.constprop.53+0xd7/0xd7 [ 47.657844] [] ? preempt_schedule+0x25/0x30 [ 47.663783] [] ? ___preempt_schedule+0x16/0x18 [ 47.669979] [] kasan_end_report+0x50/0x50 [ 47.675740] [] kasan_report+0x167/0x360 [ 47.681329] [] ? pfkey_add+0x153e/0x3470 [ 47.687004] [] check_memory_region+0x137/0x190 [ 47.693204] [] memcpy+0x23/0x50 [ 47.698101] [] pfkey_add+0x153e/0x3470 [ 47.703602] [] ? pfkey_delete+0x360/0x360 [ 47.709364] [] ? pfkey_seq_stop+0x80/0x80 [ 47.715127] [] ? __skb_clone+0x24a/0x7d0 [ 47.720805] [] ? pfkey_delete+0x360/0x360 [ 47.726575] [] pfkey_process+0x61e/0x730 [ 47.732253] [] ? pfkey_send_new_mapping+0x11b0/0x11b0 [ 47.739060] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 47.745866] [] pfkey_sendmsg+0x3a9/0x760 [ 47.751542] [] ? pfkey_spdget+0x820/0x820 [ 47.757306] [] sock_sendmsg+0xca/0x110 [ 47.762806] [] ___sys_sendmsg+0x6d1/0x7e0 [ 47.768571] [] ? copy_msghdr_from_user+0x550/0x550 [ 47.775126] [] ? __lru_cache_add+0x187/0x250 [ 47.781158] [] ? do_huge_pmd_anonymous_page+0xb05/0x10d0 [ 47.788226] [] ? _raw_spin_unlock+0x2c/0x50 [ 47.794163] [] ? do_huge_pmd_anonymous_page+0x2d4/0x10d0 [ 47.801241] [] ? handle_mm_fault+0x6ee/0x2530 [ 47.807348] [] ? __fget_light+0x158/0x1e0 [ 47.813713] [] ? __fdget+0x18/0x20 [ 47.819302] [] ? sockfd_lookup_light+0x118/0x160 [ 47.825671] [] __sys_sendmsg+0xd6/0x190 [ 47.831258] [] ? SyS_shutdown+0x1b0/0x1b0 [ 47.837023] [] ? __do_page_fault+0x5ec/0xd40 [ 47.843053] [] compat_SyS_sendmsg+0x2a/0x40 [ 47.848992] [] ? compat_SyS_getsockopt+0x2a0/0x2a0 [ 47.855538] [] do_fast_syscall_32+0x2f7/0x890 [ 47.861646] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 47.868278] [] entry_SYSENTER_compat+0x51/0x60 [ 47.874886] Dumping ftrace buffer: [ 47.878393] (ftrace buffer empty) [ 47.882067] Kernel Offset: disabled [ 47.885661] Rebooting in 86400 seconds..