INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-mmots-kasan-gce-8,10.128.0.31' (ECDSA) to the list of known hosts.
net.ipv6.conf.syz0.accept_dad = 0
net.ipv6.conf.syz0.router_solicitations = 0
executing program
syzkaller login: [   44.431624] ==================================================================
[   44.439059] BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x305b/0x3190
[   44.446228] Read of size 4 at addr ffff8801ce446898 by task syzkaller578005/3024
[   44.453740] 
[   44.455342] CPU: 0 PID: 3024 Comm: syzkaller578005 Not tainted 4.13.0-mm1+ #7
[   44.462583] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   44.471924] Call Trace:
[   44.474497]  dump_stack+0x194/0x257
[   44.478110]  ? arch_local_irq_restore+0x53/0x53
[   44.482752]  ? show_regs_print_info+0x65/0x65
[   44.487223]  ? lock_release+0xd70/0xd70
[   44.491167]  ? print_usage_bug+0x480/0x480
[   44.495383]  ? xfrm_state_find+0x305b/0x3190
[   44.499765]  print_address_description+0x73/0x250
[   44.504582]  ? xfrm_state_find+0x305b/0x3190
[   44.508965]  kasan_report+0x24e/0x340
[   44.512742]  __asan_report_load4_noabort+0x14/0x20
[   44.517653]  xfrm_state_find+0x305b/0x3190
[   44.521885]  ? xfrm_state_afinfo_get_rcu+0x160/0x160
[   44.526960]  ? print_usage_bug+0x480/0x480
[   44.531173]  ? __lock_acquire+0x732/0x4620
[   44.535507]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   44.540683]  ? __lock_acquire+0x732/0x4620
[   44.544900]  ? __lock_acquire+0x732/0x4620
[   44.549113]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   44.554287]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   44.559451]  ? check_noncircular+0x20/0x20
[   44.563669]  ? check_noncircular+0x20/0x20
[   44.567888]  xfrm_tmpl_resolve+0x2fb/0xbd0
[   44.572123]  ? __xfrm_decode_session+0x100/0x100
[   44.576862]  ? rcu_read_lock_sched_held+0x108/0x120
[   44.581855]  ? fib_table_lookup+0xa07/0x1a30
[   44.586242]  ? check_noncircular+0x20/0x20
[   44.590465]  xfrm_resolve_and_create_bundle+0x186/0x24b0
[   44.595892]  ? inet_netconf_get_devconf+0x4f0/0x4f0
[   44.600900]  ? xfrm_tmpl_resolve+0xbd0/0xbd0
[   44.605287]  ? lock_downgrade+0x990/0x990
[   44.609416]  ? xfrm_selector_match+0xe00/0xe00
[   44.613973]  ? rcu_read_lock_held+0xa9/0xc0
[   44.618268]  ? find_exception+0x3aa/0x520
[   44.622392]  ? lock_release+0xd70/0xd70
[   44.626370]  ? refcount_inc_not_zero+0xfe/0x180
[   44.631034]  ? xfrm_selector_match+0x3b/0xe00
[   44.635515]  ? xfrm_sk_policy_lookup+0x2cf/0x3d0
[   44.640260]  ? xfrm_selector_match+0xe00/0xe00
[   44.644825]  ? check_noncircular+0x20/0x20
[   44.649032]  ? ip_route_output_key_hash_rcu+0x604/0x2c20
[   44.654464]  xfrm_lookup+0xf0a/0x2540
[   44.658241]  ? xfrm_lookup+0xf0a/0x2540
[   44.662192]  ? ip_route_input_noref+0x1e0/0x1e0
[   44.666846]  ? xfrm_policy_lookup_bytype.constprop.49+0x16f0/0x16f0
[   44.673228]  ? find_held_lock+0x39/0x1d0
[   44.677274]  ? lock_downgrade+0x990/0x990
[   44.681408]  ? selinux_netlbl_sock_rcv_skb+0x9e/0x730
[   44.686579]  ? ip_route_output_key_hash+0x1a6/0x370
[   44.691587]  ? lock_release+0xd70/0xd70
[   44.695546]  ? selinux_nf_register+0x30/0x30
[   44.699926]  ? __lock_acquire+0x732/0x4620
[   44.704142]  ? selinux_sock_rcv_skb_compat+0x2f4/0x480
[   44.709396]  ? ip_route_output_key_hash+0x252/0x370
[   44.714387]  ? ip_route_output_key_hash_rcu+0x2c20/0x2c20
[   44.719906]  xfrm_lookup_route+0x39/0x1a0
[   44.724039]  ip_route_output_flow+0x7c/0xa0
[   44.728338]  inet_csk_route_req+0x5d8/0x990
[   44.732641]  tcp_v4_send_synack+0x1e4/0x270
[   44.736939]  ? tcp_v4_send_check+0x90/0x90
[   44.741157]  ? sk_filter_trim_cap+0x12f/0x9b0
[   44.745636]  ? prandom_u32_state+0x13/0x180
[   44.749951]  tcp_rtx_synack+0x119/0x2e0
[   44.753897]  ? tcp_event_new_data_sent+0x2e0/0x2e0
[   44.758802]  ? __lock_is_held+0xbc/0x140
[   44.762848]  inet_rtx_syn_ack+0x64/0xd0
[   44.766798]  tcp_check_req+0xaf5/0x1630
[   44.770751]  ? tcp_openreq_init_rwin+0xae0/0xae0
[   44.775487]  ? refcount_inc_not_zero+0xfe/0x180
[   44.780146]  ? refcount_add+0x60/0x60
[   44.783921]  ? tcp_v4_reqsk_send_ack+0x3e0/0x3e0
[   44.788654]  ? tcp_filter+0x111/0x160
[   44.792432]  tcp_v4_rcv+0x17b0/0x2f20
[   44.796209]  ? lock_acquire+0x1d5/0x580
[   44.800174]  ? tcp_v4_early_demux+0xa30/0xa30
[   44.804653]  ip_local_deliver_finish+0x2e2/0xba0
[   44.809385]  ? inet_del_offload+0x40/0x40
[   44.813509]  ? nf_hook_slow+0xd3/0x1a0
[   44.817377]  ip_local_deliver+0x1ce/0x6e0
[   44.821499]  ? ip_call_ra_chain+0x6d0/0x6d0
[   44.825803]  ? inet_del_offload+0x40/0x40
[   44.829933]  ip_rcv_finish+0x8db/0x19c0
[   44.833884]  ? ip_local_deliver_finish+0xba0/0xba0
[   44.838787]  ? iptable_nat_ipv4_fn+0x40/0x40
[   44.843171]  ? nf_nat_ipv4_in_range+0xf0/0xf0
[   44.847650]  ? ip_rcv+0xbb0/0x17d0
[   44.851163]  ? find_held_lock+0x39/0x1d0
[   44.855198]  ? tcp_v4_send_synack+0x270/0x270
[   44.859675]  ? nf_nat_ipv4_in+0x1cd/0x270
[   44.863793]  ? iptable_nat_ipv4_fn+0x40/0x40
[   44.868183]  ? nf_hook_slow+0xd3/0x1a0
[   44.872050]  ip_rcv+0xc3f/0x17d0
[   44.875399]  ? ip_local_deliver+0x6e0/0x6e0
[   44.879697]  ? __lock_acquire+0x732/0x4620
[   44.883915]  ? ip_local_deliver_finish+0xba0/0xba0
[   44.888820]  ? ip_local_deliver+0x6e0/0x6e0
[   44.893116]  __netif_receive_skb_core+0x19af/0x33d0
[   44.898103]  ? print_usage_bug+0x480/0x480
[   44.902319]  ? nf_ingress+0x9f0/0x9f0
[   44.906091]  ? save_stack+0x43/0xd0
[   44.909691]  ? kasan_slab_alloc+0x12/0x20
[   44.913809]  ? kmem_cache_alloc+0x12e/0x760
[   44.918100]  ? __build_skb+0x9d/0x450
[   44.921872]  ? build_skb+0x6f/0x260
[   44.925483]  ? tun_build_skb.isra.42+0x92f/0x1690
[   44.930293]  ? tun_get_user+0x1dad/0x2150
[   44.934409]  ? tun_chr_write_iter+0xde/0x190
[   44.938789]  ? vfs_write+0x18f/0x510
[   44.942474]  ? __skb_flow_get_ports+0x151/0x400
[   44.947116]  ? skb_flow_dissector_init+0x280/0x280
[   44.952023]  ? check_noncircular+0x20/0x20
[   44.956227]  ? __skb_flow_get_ports+0x151/0x400
[   44.960872]  ? __skb_flow_dissect+0x85b/0x3bc0
[   44.965426]  ? print_usage_bug+0x480/0x480
[   44.969646]  ? find_held_lock+0x39/0x1d0
[   44.973691]  ? lock_downgrade+0x990/0x990
[   44.977812]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   44.982983]  ? netif_receive_skb_internal+0x1d7/0x670
[   44.988172]  ? pvclock_read_flags+0x160/0x160
[   44.992639]  ? tun_build_skb.isra.42+0x455/0x1690
[   44.997462]  ? lock_acquire+0x1d5/0x580
[   45.001409]  ? netif_receive_skb_internal+0xa2/0x670
[   45.006486]  ? ktime_get_with_offset+0x2c1/0x420
[   45.011217]  ? lock_release+0xd70/0xd70
[   45.015163]  ? ktime_get+0x3a0/0x3a0
[   45.018853]  ? skb_put+0x149/0x1c0
[   45.022376]  __netif_receive_skb+0x2c/0x1b0
[   45.027304]  ? __netif_receive_skb+0x2c/0x1b0
[   45.031777]  netif_receive_skb_internal+0x10b/0x670
[   45.036767]  ? dev_cpu_dead+0xb00/0xb00
[   45.040731]  ? is_bpf_text_address+0xa4/0x120
[   45.045210]  ? rcu_pm_notify+0xc0/0xc0
[   45.049074]  ? unwind_get_return_address+0x61/0xa0
[   45.053990]  netif_receive_skb+0xae/0x390
[   45.058113]  ? netif_receive_skb_internal+0x670/0x670
[   45.063281]  ? lock_downgrade+0x990/0x990
[   45.067410]  ? tun_rx_batched.isra.43+0x5c3/0x860
[   45.072228]  tun_rx_batched.isra.43+0x5ed/0x860
[   45.076874]  ? skb_get_hash_perturb+0x9d0/0x9d0
[   45.081517]  ? tun_sock_write_space+0x370/0x370
[   45.086176]  tun_get_user+0x11dd/0x2150
[   45.090137]  ? tun_build_skb.isra.42+0x1690/0x1690
[   45.095040]  ? lock_release+0xd70/0xd70
[   45.098993]  ? tun_chr_close+0x60/0x60
[   45.102860]  ? lock_release+0xd70/0xd70
[   45.106813]  ? __lock_is_held+0xbc/0x140
[   45.110859]  ? __tun_get+0x1d4/0x2e0
[   45.114547]  ? tun_chr_close+0x60/0x60
[   45.118418]  tun_chr_write_iter+0xde/0x190
[   45.122629]  __vfs_write+0x68a/0x970
[   45.126331]  ? kernel_read+0x120/0x120
[   45.130204]  ? avc_policy_seqno+0x9/0x20
[   45.134238]  ? selinux_file_permission+0x82/0x460
[   45.139064]  ? rw_verify_area+0xe5/0x2b0
[   45.143097]  ? __fdget_raw+0x20/0x20
[   45.146787]  vfs_write+0x18f/0x510
[   45.150306]  SyS_write+0xef/0x220
[   45.153738]  ? SyS_read+0x220/0x220
[   45.157345]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   45.162338]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   45.167073]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   45.171799] RIP: 0033:0x405b21
[   45.174962] RSP: 002b:00007f8bed4e9d90 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
[   45.182645] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000405b21
[   45.189888] RDX: 0000000000000036 RSI: 0000000020002000 RDI: 0000000000000003
[   45.197130] RBP: 0000000000000082 R08: 0000000000000013 R09: 00007f8bed4ea700
[   45.204374] R10: 00007f8bed4ea9d0 R11: 0000000000000293 R12: 0000000000000000
[   45.211615] R13: 00007ffdd0aff11f R14: 00007f8bed4ea9c0 R15: 0000000000000000
[   45.218877] 
[   45.220475] The buggy address belongs to the page:
[   45.225386] page:ffffea0007391180 count:0 mapcount:0 mapping:          (null) index:0xffff8801ce446100
[   45.234814] flags: 0x200000000000000()
[   45.238675] raw: 0200000000000000 0000000000000000 ffff8801ce446100 00000000ffffffff
[   45.246528] raw: dead000000000100 dead000000000200 0000000000000000 0000000000000000
[   45.254376] page dumped because: kasan: bad access detected
[   45.260059] 
[   45.261669] Memory state around the buggy address:
[   45.266570]  ffff8801ce446780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   45.273899]  ffff8801ce446800: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00
[   45.281229] >ffff8801ce446880: 00 00 00 f2 f3 f3 f3 f3 00 00 00 00 00 00 00 f1
[   45.288569]                             ^
[   45.292688]  ffff8801ce446900: f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 f2 f3
[   45.300019]  ffff8801ce446980: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00
[   45.307344] ==================================================================
[   45.314670] Disabling lock debugging due to kernel taint
[   45.320127] Kernel panic - not syncing: panic_on_warn set ...
[   45.320127] 
[   45.327457] CPU: 0 PID: 3024 Comm: syzkaller578005 Tainted: G    B           4.13.0-mm1+ #7
[   45.335917] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   45.345238] Call Trace:
[   45.347797]  dump_stack+0x194/0x257
[   45.351391]  ? arch_local_irq_restore+0x53/0x53
[   45.356027]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   45.360752]  ? xfrm_state_find+0x2fe0/0x3190
[   45.365128]  panic+0x1e4/0x417
[   45.368292]  ? __warn+0x1d9/0x1d9
[   45.371724]  ? xfrm_state_find+0x305b/0x3190
[   45.376103]  kasan_end_report+0x50/0x50
[   45.380060]  kasan_report+0x137/0x340
[   45.383829]  __asan_report_load4_noabort+0x14/0x20
[   45.388723]  xfrm_state_find+0x305b/0x3190
[   45.392934]  ? xfrm_state_afinfo_get_rcu+0x160/0x160
[   45.398006]  ? print_usage_bug+0x480/0x480
[   45.402209]  ? __lock_acquire+0x732/0x4620
[   45.406417]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   45.411578]  ? __lock_acquire+0x732/0x4620
[   45.415783]  ? __lock_acquire+0x732/0x4620
[   45.419986]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   45.425147]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   45.430314]  ? check_noncircular+0x20/0x20