[ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.15.211' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 33.464960] audit: type=1400 audit(1596296553.812:8): avc: denied { execmem } for pid=6354 comm="syz-executor676" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 33.468705] ip_tables: iptables: counters copy to user failed while replacing table [ 33.496547] ================================================================== [ 33.504065] BUG: KASAN: slab-out-of-bounds in u32_mt+0x508/0x5b0 [ 33.510194] Read of size 1 at addr ffff8880976a7770 by task sshd/6348 [ 33.516751] [ 33.518363] CPU: 1 PID: 6348 Comm: sshd Not tainted 4.14.191-syzkaller #0 [ 33.525264] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 33.534595] Call Trace: [ 33.537163] dump_stack+0x1b2/0x283 [ 33.540770] print_address_description.cold+0x54/0x1d3 [ 33.546110] kasan_report_error.cold+0x8a/0x194 [ 33.550755] ? u32_mt+0x508/0x5b0 [ 33.554185] __asan_report_load1_noabort+0x68/0x70 [ 33.559091] ? u32_mt+0x508/0x5b0 [ 33.562527] u32_mt+0x508/0x5b0 [ 33.565810] ? time_mt_check.cold+0x4a/0x4a [ 33.570116] ? check_preemption_disabled+0x35/0x240 [ 33.575110] ipt_do_table+0x87b/0x16f0 [ 33.578979] ? ipt_alloc_initial_table+0x630/0x630 [ 33.583884] ? ipt_alloc_initial_table+0x630/0x630 [ 33.588794] iptable_filter_hook+0x172/0x1e0 [ 33.593180] nf_hook_slow+0xb0/0x1a0 [ 33.596871] __ip_local_out+0x398/0x730 [ 33.600821] ? __ip_flush_pending_frames.constprop.0+0x2c0/0x2c0 [ 33.606943] ? is_bpf_text_address+0xb8/0x150 [ 33.611414] ? ip_forward_options.cold+0x1f/0x1f [ 33.616144] ? check_preemption_disabled+0x35/0x240 [ 33.621135] ip_local_out+0x25/0x170 [ 33.624825] ip_queue_xmit+0x7d3/0x1a80 [ 33.628908] __tcp_transmit_skb+0x17e2/0x2cb0 [ 33.633390] ? __tcp_select_window+0x680/0x680 [ 33.637947] ? check_preemption_disabled+0x35/0x240 [ 33.642942] ? sched_clock+0x2a/0x40 [ 33.646634] ? sched_clock_cpu+0x18/0x1b0 [ 33.650800] tcp_write_xmit+0x69d/0x4e10 [ 33.654964] ? iov_iter_advance+0x1d4/0xbe0 [ 33.659278] __tcp_push_pending_frames+0xa0/0x230 [ 33.664119] tcp_push+0x3fd/0x5f0 [ 33.667558] ? tcp_tx_timestamp+0x17/0x250 [ 33.671782] tcp_sendmsg_locked+0x2153/0x2ef0 [ 33.676270] ? tcp_sendpage+0x60/0x60 [ 33.680063] ? __local_bh_enable_ip+0xc1/0x170 [ 33.684631] tcp_sendmsg+0x2b/0x40 [ 33.688149] inet_sendmsg+0x11a/0x4e0 [ 33.691924] ? security_socket_sendmsg+0x83/0xb0 [ 33.696659] ? inet_recvmsg+0x4d0/0x4d0 [ 33.700611] sock_sendmsg+0xb5/0x100 [ 33.704301] sock_write_iter+0x22c/0x370 [ 33.708340] ? sock_sendmsg+0x100/0x100 [ 33.712295] ? inode_has_perm+0x157/0x1c0 [ 33.716425] ? iov_iter_init+0xa6/0x1c0 [ 33.720375] __vfs_write+0x44c/0x630 [ 33.724064] ? kernel_read+0x110/0x110 [ 33.727932] ? rw_verify_area+0xe1/0x2a0 [ 33.731986] vfs_write+0x17f/0x4d0 [ 33.735508] SyS_write+0xf2/0x210 [ 33.738937] ? SyS_read+0x210/0x210 [ 33.742548] ? do_syscall_64+0x4c/0x640 [ 33.746495] ? SyS_read+0x210/0x210 [ 33.750153] do_syscall_64+0x1d5/0x640 [ 33.754024] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 33.759190] RIP: 0033:0x7f172f0b8970 [ 33.762874] RSP: 002b:00007ffebc77ae48 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 33.770556] RAX: ffffffffffffffda RBX: 000000000000007c RCX: 00007f172f0b8970 [ 33.777802] RDX: 000000000000007c RSI: 000055f3841ff42c RDI: 0000000000000003 [ 33.785150] RBP: 000055f3841f06e0 R08: 00007ffebc77abf0 R09: 0000000000267792 [ 33.792497] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 33.800460] R13: 00007ffebc77aedf R14: 000055f382d6cbe7 R15: 0000000000000003 [ 33.807719] [ 33.809325] Allocated by task 6355: [ 33.812935] kasan_kmalloc+0xeb/0x160 [ 33.816713] __kmalloc_node+0x4c/0x70 [ 33.820487] kvmalloc_node+0x46/0xd0 [ 33.824175] xt_alloc_table_info+0x6a/0xe0 [ 33.828389] do_ipt_set_ctl+0x1b1/0x39e [ 33.832339] nf_setsockopt+0x5f/0xb0 [ 33.836025] ip_setsockopt+0x94/0xb0 [ 33.839714] udp_setsockopt+0x45/0x80 [ 33.843487] SyS_setsockopt+0x110/0x1e0 [ 33.847438] do_syscall_64+0x1d5/0x640 [ 33.851302] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 33.856461] [ 33.858065] Freed by task 0: [ 33.861053] (stack is not available) [ 33.864737] [ 33.866338] The buggy address belongs to the object at ffff8880976a6cc0 [ 33.866338] which belongs to the cache kmalloc-4096 of size 4096 [ 33.879141] The buggy address is located 2736 bytes inside of [ 33.879141] 4096-byte region [ffff8880976a6cc0, ffff8880976a7cc0) [ 33.891162] The buggy address belongs to the page: [ 33.896080] page:ffffea00025da980 count:1 mapcount:0 mapping:ffff8880976a6cc0 index:0x0 compound_mapcount: 0 [ 33.906035] flags: 0xfffe0000008100(slab|head) [ 33.910599] raw: 00fffe0000008100 ffff8880976a6cc0 0000000000000000 0000000100000001 [ 33.918456] raw: ffffea000261af20 ffff88812fe50a48 ffff88812fe52dc0 0000000000000000 [ 33.926306] page dumped because: kasan: bad access detected [ 33.931989] [ 33.933592] Memory state around the buggy address: [ 33.938495] ffff8880976a7600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.945838] ffff8880976a7680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.953184] >ffff8880976a7700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc [ 33.960520] ^ [ 33.967509] ffff8880976a7780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.974841] ffff8880976a7800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.982171] ================================================================== [ 33.989502] Disabling lock debugging due to kernel taint [ 33.994967] Kernel panic - not syncing: panic_on_warn set ... [ 33.994967] [ 34.002321] CPU: 1 PID: 6348 Comm: sshd Tainted: G B 4.14.191-syzkaller #0 [ 34.010465] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 34.019818] Call Trace: [ 34.022415] dump_stack+0x1b2/0x283 [ 34.026042] panic+0x1f9/0x42d [ 34.029226] ? add_taint.cold+0x16/0x16 [ 34.033182] kasan_end_report+0x43/0x49 [ 34.037741] kasan_report_error.cold+0xa7/0x194 [ 34.042390] ? u32_mt+0x508/0x5b0 [ 34.045825] __asan_report_load1_noabort+0x68/0x70 [ 34.050732] ? u32_mt+0x508/0x5b0 [ 34.054375] u32_mt+0x508/0x5b0 [ 34.057640] ? time_mt_check.cold+0x4a/0x4a [ 34.061940] ? check_preemption_disabled+0x35/0x240 [ 34.066935] ipt_do_table+0x87b/0x16f0 [ 34.070807] ? ipt_alloc_initial_table+0x630/0x630 [ 34.075709] ? ipt_alloc_initial_table+0x630/0x630 [ 34.080614] iptable_filter_hook+0x172/0x1e0 [ 34.085005] nf_hook_slow+0xb0/0x1a0 [ 34.088697] __ip_local_out+0x398/0x730 [ 34.092645] ? __ip_flush_pending_frames.constprop.0+0x2c0/0x2c0 [ 34.098762] ? is_bpf_text_address+0xb8/0x150 [ 34.103229] ? ip_forward_options.cold+0x1f/0x1f [ 34.107960] ? check_preemption_disabled+0x35/0x240 [ 34.112951] ip_local_out+0x25/0x170 [ 34.116640] ip_queue_xmit+0x7d3/0x1a80 [ 34.120592] __tcp_transmit_skb+0x17e2/0x2cb0 [ 34.125082] ? __tcp_select_window+0x680/0x680 [ 34.129649] ? check_preemption_disabled+0x35/0x240 [ 34.134646] ? sched_clock+0x2a/0x40 [ 34.138335] ? sched_clock_cpu+0x18/0x1b0 [ 34.142461] tcp_write_xmit+0x69d/0x4e10 [ 34.146503] ? iov_iter_advance+0x1d4/0xbe0 [ 34.150800] __tcp_push_pending_frames+0xa0/0x230 [ 34.155617] tcp_push+0x3fd/0x5f0 [ 34.159043] ? tcp_tx_timestamp+0x17/0x250 [ 34.163250] tcp_sendmsg_locked+0x2153/0x2ef0 [ 34.167786] ? tcp_sendpage+0x60/0x60 [ 34.171562] ? __local_bh_enable_ip+0xc1/0x170 [ 34.176117] tcp_sendmsg+0x2b/0x40 [ 34.179630] inet_sendmsg+0x11a/0x4e0 [ 34.183420] ? security_socket_sendmsg+0x83/0xb0 [ 34.188166] ? inet_recvmsg+0x4d0/0x4d0 [ 34.192123] sock_sendmsg+0xb5/0x100 [ 34.195813] sock_write_iter+0x22c/0x370 [ 34.199851] ? sock_sendmsg+0x100/0x100 [ 34.203852] ? inode_has_perm+0x157/0x1c0 [ 34.208116] ? iov_iter_init+0xa6/0x1c0 [ 34.212078] __vfs_write+0x44c/0x630 [ 34.215822] ? kernel_read+0x110/0x110 [ 34.219693] ? rw_verify_area+0xe1/0x2a0 [ 34.223725] vfs_write+0x17f/0x4d0 [ 34.227240] SyS_write+0xf2/0x210 [ 34.230668] ? SyS_read+0x210/0x210 [ 34.234276] ? do_syscall_64+0x4c/0x640 [ 34.238223] ? SyS_read+0x210/0x210 [ 34.241825] do_syscall_64+0x1d5/0x640 [ 34.245688] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 34.250853] RIP: 0033:0x7f172f0b8970 [ 34.254540] RSP: 002b:00007ffebc77ae48 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 34.262221] RAX: ffffffffffffffda RBX: 000000000000007c RCX: 00007f172f0b8970 [ 34.269465] RDX: 000000000000007c RSI: 000055f3841ff42c RDI: 0000000000000003 [ 34.276709] RBP: 000055f3841f06e0 R08: 00007ffebc77abf0 R09: 0000000000267792 [ 34.283953] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 34.291198] R13: 00007ffebc77aedf R14: 000055f382d6cbe7 R15: 0000000000000003 [ 34.299669] Kernel Offset: disabled [ 34.303434] Rebooting in 86400 seconds..