[....] Starting enhanced syslogd: rsyslogd[ 16.811676] audit: type=1400 audit(1520757992.369:5): avc: denied { syslog } for pid=4100 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 23.102894] audit: type=1400 audit(1520757998.660:6): avc: denied { map } for pid=4240 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.10.19' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program executing program [ 29.408991] audit: type=1400 audit(1520758004.966:7): avc: denied { map } for pid=4254 comm="syzkaller148246" path="/root/syzkaller148246598" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 29.576854] ================================================================== [ 29.584271] BUG: KASAN: use-after-free in ip6_xmit+0x1f76/0x2260 [ 29.590385] Read of size 8 at addr ffff8801cadaae18 by task syzkaller148246/4271 [ 29.597886] [ 29.599487] CPU: 0 PID: 4271 Comm: syzkaller148246 Not tainted 4.16.0-rc4+ #260 [ 29.606901] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.616222] Call Trace: [ 29.618782] dump_stack+0x194/0x24d [ 29.622384] ? arch_local_irq_restore+0x53/0x53 [ 29.627024] ? show_regs_print_info+0x18/0x18 [ 29.631493] ? ip6_xmit+0x1f76/0x2260 [ 29.635263] print_address_description+0x73/0x250 [ 29.640078] ? ip6_xmit+0x1f76/0x2260 [ 29.643848] kasan_report+0x23c/0x360 [ 29.647621] __asan_report_load8_noabort+0x14/0x20 [ 29.652526] ip6_xmit+0x1f76/0x2260 [ 29.656135] ? ip6_finish_output2+0x23d0/0x23d0 [ 29.660774] ? fl6_update_dst+0x127/0x2b0 [ 29.664894] ? inet6_csk_route_socket+0x691/0xe80 [ 29.669708] ? trace_hardirqs_off+0x10/0x10 [ 29.673998] ? lock_acquire+0x1d5/0x580 [ 29.677939] ? lock_acquire+0x1d5/0x580 [ 29.681890] ? inet6_csk_xmit+0x114/0x580 [ 29.686011] ? trace_hardirqs_off+0x10/0x10 [ 29.690306] ? lock_release+0xa40/0xa40 [ 29.694265] inet6_csk_xmit+0x2fc/0x580 [ 29.698211] ? inet6_csk_update_pmtu+0x160/0x160 [ 29.702938] ? __sk_dst_check+0x1a5/0x380 [ 29.707055] ? sock_kzfree_s+0x60/0x60 [ 29.710928] l2tp_xmit_skb+0x105f/0x1410 [ 29.714966] ? l2tp_session_create+0xb80/0xb80 [ 29.719518] ? sock_wmalloc+0x15d/0x1d0 [ 29.723462] ? iov_iter_advance+0x13f0/0x13f0 [ 29.727929] ? pppol2tp_sendmsg+0x41b/0x670 [ 29.732227] pppol2tp_sendmsg+0x470/0x670 [ 29.736345] ? selinux_socket_sendmsg+0x36/0x40 [ 29.740984] ? pppol2tp_getsockopt+0x900/0x900 [ 29.745539] sock_sendmsg+0xca/0x110 [ 29.749226] SYSC_sendto+0x361/0x5c0 [ 29.752912] ? SYSC_connect+0x4a0/0x4a0 [ 29.756864] ? inet_dgram_connect+0x172/0x1f0 [ 29.761328] ? SYSC_connect+0x2e0/0x4a0 [ 29.765298] ? mm_fault_error+0x2c0/0x2c0 [ 29.769414] ? move_addr_to_kernel+0x60/0x60 [ 29.773793] SyS_sendto+0x40/0x50 [ 29.777217] ? SyS_getpeername+0x30/0x30 [ 29.781248] do_syscall_64+0x281/0x940 [ 29.785102] ? __do_page_fault+0xc90/0xc90 [ 29.789305] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 29.794029] ? syscall_return_slowpath+0x550/0x550 [ 29.798930] ? syscall_return_slowpath+0x2ac/0x550 [ 29.803833] ? prepare_exit_to_usermode+0x350/0x350 [ 29.808822] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 29.814163] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 29.818982] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 29.824143] RIP: 0033:0x4418b9 [ 29.827300] RSP: 002b:00007ffdefefa748 EFLAGS: 00000212 ORIG_RAX: 000000000000002c [ 29.834976] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004418b9 [ 29.842216] RDX: 0000000000000000 RSI: 0000000020001180 RDI: 0000000000000004 [ 29.849454] RBP: 000000000000737e R08: 00000000200021c0 R09: 0000000000000080 [ 29.856691] R10: 0000000000040001 R11: 0000000000000212 R12: 0000000000000000 [ 29.863928] R13: 00000000006cd448 R14: 0000000000000000 R15: 0000000000000000 [ 29.871181] [ 29.872777] Allocated by task 7: [ 29.876111] save_stack+0x43/0xd0 [ 29.879532] kasan_kmalloc+0xad/0xe0 [ 29.883211] kasan_slab_alloc+0x12/0x20 [ 29.887152] kmem_cache_alloc+0x12e/0x760 [ 29.891266] dst_alloc+0x11f/0x1a0 [ 29.894774] rt_dst_alloc+0xe9/0x4e0 [ 29.898454] ip_route_input_slow+0x1284/0x3c80 [ 29.903007] ip_route_input_rcu+0xf1/0xd20 [ 29.907209] ip_route_input_noref+0xf5/0x1e0 [ 29.911584] ip_rcv_finish+0x3a6/0x2040 [ 29.915523] ip_rcv+0xb76/0x1820 [ 29.918858] __netif_receive_skb_core+0x1a41/0x3460 [ 29.923841] __netif_receive_skb+0x2c/0x1b0 [ 29.928131] netif_receive_skb_internal+0x10b/0x670 [ 29.933114] napi_gro_receive+0x3d0/0x500 [ 29.937232] receive_buf+0xb6f/0x2530 [ 29.941001] virtnet_poll+0x320/0xb70 [ 29.944770] net_rx_action+0x792/0x1910 [ 29.948713] __do_softirq+0x2d7/0xb85 [ 29.952477] [ 29.954077] Freed by task 0: [ 29.957067] save_stack+0x43/0xd0 [ 29.960490] __kasan_slab_free+0x11a/0x170 [ 29.964690] kasan_slab_free+0xe/0x10 [ 29.968457] kmem_cache_free+0x83/0x2a0 [ 29.972398] dst_destroy+0x257/0x370 [ 29.976084] dst_destroy_rcu+0x16/0x20 [ 29.979948] rcu_process_callbacks+0xd6c/0x17f0 [ 29.984587] __do_softirq+0x2d7/0xb85 [ 29.988353] [ 29.989949] The buggy address belongs to the object at ffff8801cadaae00 [ 29.989949] which belongs to the cache ip_dst_cache of size 160 [ 30.002658] The buggy address is located 24 bytes inside of [ 30.002658] 160-byte region [ffff8801cadaae00, ffff8801cadaaea0) [ 30.014411] The buggy address belongs to the page: [ 30.019309] page:ffffea00072b6a80 count:1 mapcount:0 mapping:ffff8801cadaa000 index:0xffff8801cadaab00 [ 30.028720] flags: 0x2fffc0000000100(slab) [ 30.032925] raw: 02fffc0000000100 ffff8801cadaa000 ffff8801cadaab00 000000010000000e [ 30.040772] raw: ffff8801d5ba5f38 ffffea0006dfbce0 ffff8801d5ba4e00 0000000000000000 [ 30.048615] page dumped because: kasan: bad access detected [ 30.054288] [ 30.055982] Memory state around the buggy address: [ 30.060877] ffff8801cadaad00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 30.068202] ffff8801cadaad80: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc [ 30.075540] >ffff8801cadaae00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.082866] ^ [ 30.086981] ffff8801cadaae80: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc [ 30.094307] ffff8801cadaaf00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.101630] ================================================================== [ 30.108955] Disabling lock debugging due to kernel taint [ 30.114403] Kernel panic - not syncing: panic_on_warn set ... [ 30.114403] [ 30.121734] CPU: 0 PID: 4271 Comm: syzkaller148246 Tainted: G B 4.16.0-rc4+ #260 [ 30.130450] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 30.139769] Call Trace: [ 30.142324] dump_stack+0x194/0x24d [ 30.145921] ? arch_local_irq_restore+0x53/0x53 [ 30.150558] ? kasan_end_report+0x32/0x50 [ 30.154674] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 30.159395] ? vsnprintf+0x1ed/0x1900 [ 30.163168] ? ip6_xmit+0x1eb0/0x2260 [ 30.166937] panic+0x1e4/0x41c [ 30.170095] ? refcount_error_report+0x214/0x214 [ 30.174818] ? add_taint+0x1c/0x50 [ 30.178326] ? add_taint+0x1c/0x50 [ 30.181833] ? ip6_xmit+0x1f76/0x2260 [ 30.185599] kasan_end_report+0x50/0x50 [ 30.189539] kasan_report+0x149/0x360 [ 30.193312] __asan_report_load8_noabort+0x14/0x20 [ 30.198207] ip6_xmit+0x1f76/0x2260 [ 30.201808] ? ip6_finish_output2+0x23d0/0x23d0 [ 30.206448] ? fl6_update_dst+0x127/0x2b0 [ 30.210566] ? inet6_csk_route_socket+0x691/0xe80 [ 30.215379] ? trace_hardirqs_off+0x10/0x10 [ 30.219671] ? lock_acquire+0x1d5/0x580 [ 30.223613] ? lock_acquire+0x1d5/0x580 [ 30.227554] ? inet6_csk_xmit+0x114/0x580 [ 30.231668] ? trace_hardirqs_off+0x10/0x10 [ 30.235959] ? lock_release+0xa40/0xa40 [ 30.239911] inet6_csk_xmit+0x2fc/0x580 [ 30.243856] ? inet6_csk_update_pmtu+0x160/0x160 [ 30.248587] ? __sk_dst_check+0x1a5/0x380 [ 30.252702] ? sock_kzfree_s+0x60/0x60 [ 30.256571] l2tp_xmit_skb+0x105f/0x1410 [ 30.260603] ? l2tp_session_create+0xb80/0xb80 [ 30.265152] ? sock_wmalloc+0x15d/0x1d0 [ 30.269095] ? iov_iter_advance+0x13f0/0x13f0 [ 30.273561] ? pppol2tp_sendmsg+0x41b/0x670 [ 30.277853] pppol2tp_sendmsg+0x470/0x670 [ 30.281972] ? selinux_socket_sendmsg+0x36/0x40 [ 30.286608] ? pppol2tp_getsockopt+0x900/0x900 [ 30.291159] sock_sendmsg+0xca/0x110 [ 30.294841] SYSC_sendto+0x361/0x5c0 [ 30.298525] ? SYSC_connect+0x4a0/0x4a0 [ 30.302473] ? inet_dgram_connect+0x172/0x1f0 [ 30.306937] ? SYSC_connect+0x2e0/0x4a0 [ 30.310893] ? mm_fault_error+0x2c0/0x2c0 [ 30.315010] ? move_addr_to_kernel+0x60/0x60 [ 30.319386] SyS_sendto+0x40/0x50 [ 30.322809] ? SyS_getpeername+0x30/0x30 [ 30.326838] do_syscall_64+0x281/0x940 [ 30.330693] ? __do_page_fault+0xc90/0xc90 [ 30.334896] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 30.339620] ? syscall_return_slowpath+0x550/0x550 [ 30.344516] ? syscall_return_slowpath+0x2ac/0x550 [ 30.349413] ? prepare_exit_to_usermode+0x350/0x350 [ 30.354396] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 30.359731] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 30.364545] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 30.369701] RIP: 0033:0x4418b9 [ 30.372859] RSP: 002b:00007ffdefefa748 EFLAGS: 00000212 ORIG_RAX: 000000000000002c [ 30.380532] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004418b9 [ 30.387769] RDX: 0000000000000000 RSI: 0000000020001180 RDI: 0000000000000004 [ 30.395009] RBP: 000000000000737e R08: 00000000200021c0 R09: 0000000000000080 [ 30.402248] R10: 0000000000040001 R11: 0000000000000212 R12: 0000000000000000 [ 30.409484] R13: 00000000006cd448 R14: 0000000000000000 R15: 0000000000000000 [ 30.417091] Dumping ftrace buffer: [ 30.420596] (ftrace buffer empty) [ 30.424276] Kernel Offset: disabled [ 30.427872] Rebooting in 86400 seconds..