[....] Starting enhanced syslogd: rsyslogd[ 10.652107] audit: type=1400 audit(1515734551.980:4): avc: denied { syslog } for pid=3173 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.15.235' (ECDSA) to the list of known hosts. executing program executing program executing program syzkaller login: [ 21.934430] ================================================================== [ 21.935591] BUG: KASAN: slab-out-of-bounds in sg_remove_request+0x103/0x120 [ 21.936542] Read of size 8 at addr ffff8801c897c240 by task syzkaller702417/3329 [ 21.937608] [ 21.937857] CPU: 1 PID: 3329 Comm: syzkaller702417 Not tainted 4.9.76-g9154940 #20 [ 21.938875] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 21.940139] ffff8801c8bef940 ffffffff81d93149 ffffea0007225f00 ffff8801c897c240 [ 21.941309] 0000000000000000 ffff8801c897c240 ffff8801cbd88238 ffff8801c8bef978 [ 21.942494] ffffffff8153cb43 ffff8801c897c240 0000000000000008 0000000000000000 [ 21.943653] Call Trace: [ 21.944012] [] dump_stack+0xc1/0x128 [ 21.944725] [] print_address_description+0x73/0x280 [ 21.945614] [] kasan_report+0x275/0x360 [ 21.946408] [] ? sg_remove_request+0x103/0x120 [ 21.947245] [] __asan_report_load8_noabort+0x14/0x20 [ 21.948132] [] sg_remove_request+0x103/0x120 [ 21.948942] [] sg_finish_rem_req+0x295/0x340 [ 21.949750] [] sg_read+0xa1c/0x1440 [ 21.950448] [] ? sg_proc_seq_show_debug+0xd10/0xd10 [ 21.951339] [] ? fsnotify+0xf30/0xf30 [ 21.952095] [] ? avc_policy_seqno+0x9/0x20 [ 21.952873] [] do_loop_readv_writev.part.17+0x141/0x1e0 [ 21.953859] [] ? security_file_permission+0x89/0x1e0 [ 21.955926] [] ? sg_proc_seq_show_debug+0xd10/0xd10 [ 21.962559] [] ? sg_proc_seq_show_debug+0xd10/0xd10 [ 21.969206] [] compat_do_readv_writev+0x522/0x760 [ 21.975682] [] ? do_pwritev+0x1a0/0x1a0 [ 21.981275] [] ? _raw_spin_unlock+0x2c/0x50 [ 21.987215] [] ? check_preemption_disabled+0x3b/0x200 [ 21.994021] [] ? __fget+0x201/0x3a0 [ 21.999263] [] ? __fget+0x228/0x3a0 [ 22.004505] [] ? __fget+0x47/0x3a0 [ 22.009670] [] compat_readv+0xe3/0x150 [ 22.015179] [] do_compat_readv+0xf4/0x1d0 [ 22.020941] [] ? compat_readv+0x150/0x150 [ 22.026706] [] compat_SyS_readv+0x26/0x30 [ 22.032471] [] ? SyS_pwritev2+0x80/0x80 [ 22.038066] [] do_fast_syscall_32+0x2f7/0x890 [ 22.044180] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 22.050816] [] entry_SYSENTER_compat+0x74/0x83 [ 22.057012] [ 22.058606] Allocated by task 0: [ 22.061936] (stack is not available) [ 22.065623] [ 22.067215] Freed by task 0: [ 22.070205] (stack is not available) [ 22.073882] [ 22.075511] The buggy address belongs to the object at ffff8801c897c200 [ 22.075511] which belongs to the cache fasync_cache of size 96 [ 22.088134] The buggy address is located 64 bytes inside of [ 22.088134] 96-byte region [ffff8801c897c200, ffff8801c897c260) [ 22.099809] The buggy address belongs to the page: [ 22.104707] page:ffffea0007225f00 count:1 mapcount:0 mapping: (null) index:0x0 [ 22.112925] flags: 0x8000000000000080(slab) [ 22.117211] page dumped because: kasan: bad access detected [ 22.122886] [ 22.124481] Memory state around the buggy address: [ 22.129377] ffff8801c897c100: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 22.136701] ffff8801c897c180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.144027] >ffff8801c897c200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.151352] ^ [ 22.156769] ffff8801c897c280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.164095] ffff8801c897c300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.171418] ================================================================== [ 22.178743] Disabling lock debugging due to kernel taint [ 22.186521] Kernel panic - not syncing: panic_on_warn set ... [ 22.186521] [ 22.193885] CPU: 1 PID: 3329 Comm: syzkaller702417 Tainted: G B 4.9.76-g9154940 #20 [ 22.202774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 22.212100] ffff8801c8bef898 ffffffff81d93149 ffffffff84195c17 ffff8801c8bef970 [ 22.220052] 0000000000000000 ffff8801c897c240 ffff8801cbd88238 ffff8801c8bef960 [ 22.228025] ffffffff8142e371 0000000041b58ab3 ffffffff84189678 ffffffff8142e1b5 [ 22.235973] Call Trace: [ 22.238532] [] dump_stack+0xc1/0x128 [ 22.243864] [] panic+0x1bc/0x3a8 [ 22.248849] [] ? percpu_up_read_preempt_enable.constprop.53+0xd7/0xd7 [ 22.257049] [] ? preempt_schedule+0x25/0x30 [ 22.262990] [] ? ___preempt_schedule+0x16/0x18 [ 22.269190] [] kasan_end_report+0x50/0x50 [ 22.274965] [] kasan_report+0x167/0x360 [ 22.280555] [] ? sg_remove_request+0x103/0x120 [ 22.286755] [] __asan_report_load8_noabort+0x14/0x20 [ 22.293486] [] sg_remove_request+0x103/0x120 [ 22.299521] [] sg_finish_rem_req+0x295/0x340 [ 22.305549] [] sg_read+0xa1c/0x1440 [ 22.310802] [] ? sg_proc_seq_show_debug+0xd10/0xd10 [ 22.317443] [] ? fsnotify+0xf30/0xf30 [ 22.322861] [] ? avc_policy_seqno+0x9/0x20 [ 22.328722] [] do_loop_readv_writev.part.17+0x141/0x1e0 [ 22.335702] [] ? security_file_permission+0x89/0x1e0 [ 22.342427] [] ? sg_proc_seq_show_debug+0xd10/0xd10 [ 22.349070] [] ? sg_proc_seq_show_debug+0xd10/0xd10 [ 22.355703] [] compat_do_readv_writev+0x522/0x760 [ 22.362160] [] ? do_pwritev+0x1a0/0x1a0 [ 22.367760] [] ? _raw_spin_unlock+0x2c/0x50 [ 22.373700] [] ? check_preemption_disabled+0x3b/0x200 [ 22.380506] [] ? __fget+0x201/0x3a0 [ 22.385750] [] ? __fget+0x228/0x3a0 [ 22.391000] [] ? __fget+0x47/0x3a0 [ 22.396167] [] compat_readv+0xe3/0x150 [ 22.401673] [] do_compat_readv+0xf4/0x1d0 [ 22.407448] [] ? compat_readv+0x150/0x150 [ 22.413212] [] compat_SyS_readv+0x26/0x30 [ 22.418977] [] ? SyS_pwritev2+0x80/0x80 [ 22.424570] [] do_fast_syscall_32+0x2f7/0x890 [ 22.430682] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 22.437315] [] entry_SYSENTER_compat+0x74/0x83 [ 22.443911] Dumping ftrace buffer: [ 22.447418] (ftrace buffer empty) [ 22.451095] Kernel Offset: disabled [ 22.454689] Rebooting in 86400 seconds..