[....] Starting enhanced syslogd: rsyslogd[ 15.678773] audit: type=1400 audit(1520803263.631:5): avc: denied { syslog } for pid=4082 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 19.119955] audit: type=1400 audit(1520803267.072:6): avc: denied { map } for pid=4222 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.61' (ECDSA) to the list of known hosts. [ 25.450431] audit: type=1400 audit(1520803273.403:7): avc: denied { map } for pid=4236 comm="syzkaller687213" path="/root/syzkaller687213221" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 25.462360] IPVS: ftp: loaded support on port[0] = 21 net.ipv6.conf.syz_tun.accept_dad = 0 net.ipv6.conf.syz_tun.router_solicitations = 0 [ 25.476384] audit: type=1400 audit(1520803273.406:8): avc: denied { sys_admin } for pid=4236 comm="syzkaller687213" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 25.525444] audit: type=1400 audit(1520803273.478:9): avc: denied { net_admin } for pid=4237 comm="syzkaller687213" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 RTNETLINK answers: File exists RTNETLINK answers: Operation not supported RTNETLINK answers: No buffer space available RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported [ 25.798500] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Invalid argument RTNETLINK answers: Invalid argument RTNETLINK answers: Invalid argument [ 26.139314] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 26.145422] 8021q: adding VLAN 0 to HW filter on device bond0 executing program [ 26.182121] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 26.218115] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.230097] audit: type=1400 audit(1520803274.182:10): avc: denied { sys_chroot } for pid=4237 comm="syzkaller687213" capability=18 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 26.233486] ================================================================== [ 26.262044] BUG: KASAN: slab-out-of-bounds in ip6_xmit+0x1f76/0x2260 [ 26.268548] Read of size 8 at addr ffff8801b82d3218 by task syzkaller687213/4237 [ 26.276049] [ 26.277652] CPU: 1 PID: 4237 Comm: syzkaller687213 Not tainted 4.16.0-rc4+ #260 [ 26.285069] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 26.294404] Call Trace: [ 26.296966] dump_stack+0x194/0x24d [ 26.300569] ? arch_local_irq_restore+0x53/0x53 [ 26.305211] ? show_regs_print_info+0x18/0x18 [ 26.309685] ? ip6_xmit+0x1f76/0x2260 [ 26.313462] print_address_description+0x73/0x250 [ 26.318276] ? ip6_xmit+0x1f76/0x2260 [ 26.322056] kasan_report+0x23c/0x360 [ 26.325834] __asan_report_load8_noabort+0x14/0x20 [ 26.330735] ip6_xmit+0x1f76/0x2260 [ 26.334345] ? ip6_finish_output2+0x23d0/0x23d0 [ 26.338988] ? fl6_update_dst+0x127/0x2b0 [ 26.343116] ? inet6_csk_route_socket+0x691/0xe80 [ 26.347933] ? trace_hardirqs_off+0x10/0x10 [ 26.352226] ? lock_acquire+0x1d5/0x580 [ 26.356172] ? lock_acquire+0x1d5/0x580 [ 26.360118] ? inet6_csk_xmit+0x114/0x580 [ 26.364238] ? trace_hardirqs_off+0x10/0x10 [ 26.368534] ? lock_release+0xa40/0xa40 [ 26.372495] inet6_csk_xmit+0x2fc/0x580 [ 26.376444] ? inet6_csk_update_pmtu+0x160/0x160 [ 26.381173] ? __sk_dst_check+0x1a5/0x380 [ 26.385294] ? sock_kzfree_s+0x60/0x60 [ 26.389170] l2tp_xmit_skb+0x105f/0x1410 [ 26.393215] ? l2tp_session_create+0xb80/0xb80 [ 26.397782] ? sock_wmalloc+0x15d/0x1d0 [ 26.401729] ? iov_iter_advance+0x13f0/0x13f0 [ 26.406200] ? pppol2tp_sendmsg+0x41b/0x670 [ 26.410496] pppol2tp_sendmsg+0x470/0x670 [ 26.414620] ? selinux_socket_sendmsg+0x36/0x40 [ 26.419263] ? pppol2tp_getsockopt+0x900/0x900 [ 26.423819] sock_sendmsg+0xca/0x110 [ 26.427505] SYSC_sendto+0x361/0x5c0 [ 26.431196] ? SYSC_connect+0x4a0/0x4a0 [ 26.435151] ? inet_dgram_connect+0x172/0x1f0 [ 26.439620] ? SYSC_connect+0x2e0/0x4a0 [ 26.443596] ? mm_fault_error+0x2c0/0x2c0 [ 26.447715] ? move_addr_to_kernel+0x60/0x60 [ 26.452098] SyS_sendto+0x40/0x50 [ 26.455522] ? SyS_getpeername+0x30/0x30 [ 26.459561] do_syscall_64+0x281/0x940 [ 26.463419] ? __do_page_fault+0xc90/0xc90 [ 26.467625] ? _raw_spin_unlock_irq+0x27/0x70 [ 26.472091] ? finish_task_switch+0x1c1/0x7e0 [ 26.476558] ? syscall_return_slowpath+0x550/0x550 [ 26.481459] ? syscall_return_slowpath+0x2ac/0x550 [ 26.486362] ? prepare_exit_to_usermode+0x350/0x350 [ 26.491351] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 26.496692] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 26.501513] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 26.506673] RIP: 0033:0x442b49 [ 26.509833] RSP: 002b:00000000007dfe88 EFLAGS: 00000212 ORIG_RAX: 000000000000002c [ 26.517511] RAX: ffffffffffffffda RBX: 000000000000001a RCX: 0000000000442b49 [ 26.524761] RDX: 0000000000000000 RSI: 0000000020001180 RDI: 0000000000000004 [ 26.532004] RBP: 00000000004a49f9 R08: 00000000200021c0 R09: 0000000000000080 [ 26.539252] R10: 0000000000040001 R11: 0000000000000212 R12: 00000000007dff70 [ 26.546766] R13: 0000000000403b80 R14: 0000000000000000 R15: 0000000000000000 [ 26.554038] [ 26.555646] Allocated by task 0: [ 26.558978] (stack is not available) [ 26.562659] [ 26.564256] Freed by task 0: [ 26.567242] (stack is not available) [ 26.570923] [ 26.572522] The buggy address belongs to the object at ffff8801b82d3200 [ 26.572522] which belongs to the cache ip_dst_cache of size 160 [ 26.585239] The buggy address is located 24 bytes inside of [ 26.585239] 160-byte region [ffff8801b82d3200, ffff8801b82d32a0) [ 26.596996] The buggy address belongs to the page: [ 26.601900] page:ffffea0006e0b4c0 count:1 mapcount:0 mapping:ffff8801b82d3000 index:0x0 [ 26.610018] flags: 0x2fffc0000000100(slab) [ 26.614232] raw: 02fffc0000000100 ffff8801b82d3000 0000000000000000 0000000100000010 [ 26.622082] raw: ffffea0006e022a0 ffff8801d58e7648 ffff8801d5bf74c0 0000000000000000 [ 26.629930] page dumped because: kasan: bad access detected [ 26.635605] [ 26.637201] Memory state around the buggy address: [ 26.642098] ffff8801b82d3100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.649426] ffff8801b82d3180: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc [ 26.656753] >ffff8801b82d3200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.664081] ^ [ 26.668198] ffff8801b82d3280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.675530] ffff8801b82d3300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.682857] ================================================================== [ 26.690186] Disabling lock debugging due to kernel taint [ 26.695630] Kernel panic - not syncing: panic_on_warn set ... [ 26.695630] [ 26.702973] CPU: 1 PID: 4237 Comm: syzkaller687213 Tainted: G B 4.16.0-rc4+ #260 [ 26.711688] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 26.721015] Call Trace: [ 26.723582] dump_stack+0x194/0x24d [ 26.727180] ? arch_local_irq_restore+0x53/0x53 [ 26.731818] ? kasan_end_report+0x32/0x50 [ 26.735937] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 26.740663] ? vsnprintf+0x1ed/0x1900 [ 26.744440] ? ip6_xmit+0x1eb0/0x2260 [ 26.748215] panic+0x1e4/0x41c [ 26.751382] ? refcount_error_report+0x214/0x214 [ 26.756108] ? add_taint+0x1c/0x50 [ 26.759617] ? add_taint+0x1c/0x50 [ 26.763129] ? ip6_xmit+0x1f76/0x2260 [ 26.766899] kasan_end_report+0x50/0x50 [ 26.770842] kasan_report+0x149/0x360 [ 26.774612] __asan_report_load8_noabort+0x14/0x20 [ 26.779512] ip6_xmit+0x1f76/0x2260 [ 26.783114] ? ip6_finish_output2+0x23d0/0x23d0 [ 26.787756] ? fl6_update_dst+0x127/0x2b0 [ 26.791877] ? inet6_csk_route_socket+0x691/0xe80 [ 26.796691] ? trace_hardirqs_off+0x10/0x10 [ 26.800983] ? lock_acquire+0x1d5/0x580 [ 26.804929] ? lock_acquire+0x1d5/0x580 [ 26.808871] ? inet6_csk_xmit+0x114/0x580 [ 26.812989] ? trace_hardirqs_off+0x10/0x10 [ 26.817282] ? lock_release+0xa40/0xa40 [ 26.821232] inet6_csk_xmit+0x2fc/0x580 [ 26.825174] ? inet6_csk_update_pmtu+0x160/0x160 [ 26.829901] ? __sk_dst_check+0x1a5/0x380 [ 26.834024] ? sock_kzfree_s+0x60/0x60 [ 26.837894] l2tp_xmit_skb+0x105f/0x1410 [ 26.841930] ? l2tp_session_create+0xb80/0xb80 [ 26.846481] ? sock_wmalloc+0x15d/0x1d0 [ 26.850429] ? iov_iter_advance+0x13f0/0x13f0 [ 26.854897] ? pppol2tp_sendmsg+0x41b/0x670 [ 26.859188] pppol2tp_sendmsg+0x470/0x670 [ 26.863311] ? selinux_socket_sendmsg+0x36/0x40 [ 26.867953] ? pppol2tp_getsockopt+0x900/0x900 [ 26.872507] sock_sendmsg+0xca/0x110 [ 26.876190] SYSC_sendto+0x361/0x5c0 [ 26.879874] ? SYSC_connect+0x4a0/0x4a0 [ 26.883826] ? inet_dgram_connect+0x172/0x1f0 [ 26.888291] ? SYSC_connect+0x2e0/0x4a0 [ 26.892252] ? mm_fault_error+0x2c0/0x2c0 [ 26.896372] ? move_addr_to_kernel+0x60/0x60 [ 26.900751] SyS_sendto+0x40/0x50 [ 26.904173] ? SyS_getpeername+0x30/0x30 [ 26.908216] do_syscall_64+0x281/0x940 [ 26.912074] ? __do_page_fault+0xc90/0xc90 [ 26.916280] ? _raw_spin_unlock_irq+0x27/0x70 [ 26.920748] ? finish_task_switch+0x1c1/0x7e0 [ 26.925213] ? syscall_return_slowpath+0x550/0x550 [ 26.930116] ? syscall_return_slowpath+0x2ac/0x550 [ 26.935037] ? prepare_exit_to_usermode+0x350/0x350 [ 26.940036] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 26.945382] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 26.950197] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 26.955355] RIP: 0033:0x442b49 [ 26.958516] RSP: 002b:00000000007dfe88 EFLAGS: 00000212 ORIG_RAX: 000000000000002c [ 26.966191] RAX: ffffffffffffffda RBX: 000000000000001a RCX: 0000000000442b49 [ 26.973430] RDX: 0000000000000000 RSI: 0000000020001180 RDI: 0000000000000004 [ 26.980668] RBP: 00000000004a49f9 R08: 00000000200021c0 R09: 0000000000000080 [ 26.987908] R10: 0000000000040001 R11: 0000000000000212 R12: 00000000007dff70 [ 26.995146] R13: 0000000000403b80 R14: 0000000000000000 R15: 0000000000000000 [ 27.002805] Dumping ftrace buffer: [ 27.006328] (ftrace buffer empty) [ 27.010006] Kernel Offset: disabled [ 27.013603] Rebooting in 86400 seconds..