[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 27.430255] kauditd_printk_skb: 7 callbacks suppressed [ 27.430266] audit: type=1800 audit(1540933208.977:29): pid=5538 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 27.460819] audit: type=1800 audit(1540933208.977:30): pid=5538 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.29' (ECDSA) to the list of known hosts. syzkaller login: [ 46.410369] IPVS: ftp: loaded support on port[0] = 21 [ 46.573088] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.580308] bridge0: port 1(bridge_slave_0) entered disabled state [ 46.587299] device bridge_slave_0 entered promiscuous mode [ 46.605502] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.611968] bridge0: port 2(bridge_slave_1) entered disabled state [ 46.619139] device bridge_slave_1 entered promiscuous mode [ 46.636424] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 46.654873] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 46.704817] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 46.726343] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 46.801098] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 46.808546] team0: Port device team_slave_0 added [ 46.825368] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 46.833573] team0: Port device team_slave_1 added [ 46.850570] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 46.872892] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 46.891264] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 46.911483] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready RTNETLINK answers: Operation not supported RTNETLINK answers: No buffer space available RTNETLINK answers: Operation not supported [ 47.054509] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.060965] bridge0: port 2(bridge_slave_1) entered forwarding state [ 47.068330] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.074681] bridge0: port 1(bridge_slave_0) entered forwarding state RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Invalid argument RTNETLINK answers: Invalid argument RTNETLINK answers: Invalid argument [ 47.599237] 8021q: adding VLAN 0 to HW filter on device bond0 [ 47.651789] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 47.705146] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 47.711797] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 47.719229] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 47.763940] 8021q: adding VLAN 0 to HW filter on device team0 executing program [ 48.051074] ================================================================== [ 48.058657] BUG: KASAN: slab-out-of-bounds in _decode_session6+0x134a/0x1500 [ 48.065988] Read of size 1 at addr ffff8801cc9bc487 by task syz-executor171/5694 [ 48.073510] [ 48.075139] CPU: 1 PID: 5694 Comm: syz-executor171 Not tainted 4.19.0+ #88 [ 48.082142] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 48.091531] Call Trace: [ 48.094118] dump_stack+0x244/0x39d [ 48.097756] ? dump_stack_print_info.cold.1+0x20/0x20 [ 48.102955] ? printk+0xa7/0xcf [ 48.106228] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 48.110988] print_address_description.cold.7+0x9/0x1ff [ 48.116346] kasan_report.cold.8+0x242/0x309 [ 48.120750] ? _decode_session6+0x134a/0x1500 [ 48.125250] __asan_report_load1_noabort+0x14/0x20 [ 48.130290] _decode_session6+0x134a/0x1500 [ 48.134623] __xfrm_decode_session+0x71/0x140 [ 48.139119] vti6_tnl_xmit+0x3fc/0x1c10 [ 48.143127] ? __lock_acquire+0x62f/0x4c20 [ 48.147840] ? vti6_tnl_create2+0x430/0x430 [ 48.152164] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 48.157698] ? check_preemption_disabled+0x48/0x280 [ 48.162892] dev_hard_start_xmit+0x295/0xc90 [ 48.167314] ? dev_direct_xmit+0x6b0/0x6b0 [ 48.171548] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 48.177105] ? netif_skb_features+0x690/0xb70 [ 48.181601] ? rcu_softirq_qs+0x20/0x20 [ 48.185578] ? lock_acquire+0x1ed/0x520 [ 48.189551] ? __dev_queue_xmit+0x3063/0x3ad0 [ 48.194483] ? kasan_check_read+0x11/0x20 [ 48.198806] ? do_raw_spin_lock+0x14f/0x350 [ 48.203215] ? rwlock_bug.part.2+0x90/0x90 [ 48.207444] ? netif_skb_features+0xb70/0xb70 [ 48.212108] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 48.217646] ? check_preemption_disabled+0x48/0x280 [ 48.222659] __dev_queue_xmit+0x2f71/0x3ad0 [ 48.226975] ? save_stack+0x43/0xd0 [ 48.230598] ? kasan_kmalloc+0xc7/0xe0 [ 48.234479] ? __kmalloc_node_track_caller+0x50/0x70 [ 48.239585] ? netdev_pick_tx+0x310/0x310 [ 48.243728] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 48.249417] ? check_preemption_disabled+0x48/0x280 [ 48.254683] ? __lock_is_held+0xb5/0x140 [ 48.258748] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 48.263757] ? skb_release_data+0x1c4/0x880 [ 48.268094] ? kmem_cache_alloc_node_trace+0x34b/0x740 [ 48.273369] ? kasan_unpoison_shadow+0x35/0x50 [ 48.277946] ? skb_tx_error+0x2f0/0x2f0 [ 48.281916] ? __kmalloc_node_track_caller+0x50/0x70 [ 48.287013] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 48.292549] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 48.298174] ? kasan_check_write+0x14/0x20 [ 48.302486] ? pskb_expand_head+0x6b3/0x10f0 [ 48.306897] ? find_held_lock+0x36/0x1c0 [ 48.311092] ? skb_release_data+0x880/0x880 [ 48.315418] ? __alloc_skb+0x770/0x770 [ 48.319306] ? __lock_is_held+0xb5/0x140 [ 48.323369] ? kasan_check_write+0x14/0x20 [ 48.327605] ? __skb_clone+0x6c7/0xa00 [ 48.331507] ? __copy_skb_header+0x6b0/0x6b0 [ 48.335909] ? kmem_cache_alloc+0x33a/0x730 [ 48.340229] ? depot_save_stack+0x292/0x470 [ 48.344649] ? skb_ensure_writable+0x15e/0x640 [ 48.349238] dev_queue_xmit+0x17/0x20 [ 48.353039] ? dev_queue_xmit+0x17/0x20 [ 48.357044] __bpf_redirect+0x5cf/0xb20 [ 48.361131] bpf_clone_redirect+0x2f6/0x490 [ 48.365458] bpf_prog_c39d1ba309a769f7+0x881/0x1000 [ 48.370471] ? bpf_test_run+0x175/0x780 [ 48.374455] ? lock_downgrade+0x900/0x900 [ 48.378616] ? ktime_get+0x332/0x400 [ 48.382330] ? find_held_lock+0x36/0x1c0 [ 48.386388] ? lock_acquire+0x1ed/0x520 [ 48.390361] ? bpf_test_run+0x3cb/0x780 [ 48.394333] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 48.399869] ? check_preemption_disabled+0x48/0x280 [ 48.405032] ? kasan_check_read+0x11/0x20 [ 48.409209] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 48.414570] ? rcu_softirq_qs+0x20/0x20 [ 48.418547] ? bpf_cgroup_storage_release+0x220/0x220 [ 48.423730] ? skb_try_coalesce+0x1b70/0x1b70 [ 48.428224] ? bpf_test_run+0x25d/0x780 [ 48.432196] ? netlink_diag_dump+0x2a0/0x2a0 [ 48.436598] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 48.442263] ? bpf_test_init.isra.10+0x70/0x100 [ 48.446931] ? bpf_prog_test_run_skb+0x73b/0xcb0 [ 48.451775] ? bpf_test_finish.isra.9+0x1f0/0x1f0 [ 48.456682] ? bpf_prog_add+0x69/0xd0 [ 48.460491] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 48.466110] ? __bpf_prog_get+0x9b/0x290 [ 48.470251] ? bpf_test_finish.isra.9+0x1f0/0x1f0 [ 48.475247] ? bpf_prog_test_run+0x130/0x1a0 [ 48.479656] ? __x64_sys_bpf+0x3d8/0x520 [ 48.483713] ? bpf_prog_get+0x20/0x20 [ 48.487535] ? do_syscall_64+0x1b9/0x820 [ 48.491726] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 48.497114] ? syscall_return_slowpath+0x5e0/0x5e0 [ 48.502044] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 48.507078] ? trace_hardirqs_on_caller+0x310/0x310 [ 48.512108] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 48.517214] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 48.523104] ? prepare_exit_to_usermode+0x291/0x3b0 [ 48.528122] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 48.532967] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 48.538504] [ 48.540134] Allocated by task 5694: [ 48.543933] save_stack+0x43/0xd0 [ 48.547385] kasan_kmalloc+0xc7/0xe0 [ 48.551186] __kmalloc_node_track_caller+0x50/0x70 [ 48.556122] __kmalloc_reserve.isra.40+0x41/0xe0 [ 48.560877] pskb_expand_head+0x230/0x10f0 [ 48.565109] skb_ensure_writable+0x3dd/0x640 [ 48.569603] bpf_clone_redirect+0x14a/0x490 [ 48.573919] bpf_prog_c39d1ba309a769f7+0x881/0x1000 [ 48.579070] [ 48.580692] Freed by task 4310: [ 48.584044] save_stack+0x43/0xd0 [ 48.587538] __kasan_slab_free+0x102/0x150 [ 48.591931] kasan_slab_free+0xe/0x10 [ 48.595726] kfree+0xcf/0x230 [ 48.598981] load_elf_binary+0x25b4/0x5620 [ 48.603229] search_binary_handler+0x17d/0x570 [ 48.607806] __do_execve_file.isra.33+0x1661/0x25d0 [ 48.612893] __x64_sys_execve+0x8f/0xc0 [ 48.616869] do_syscall_64+0x1b9/0x820 [ 48.620753] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 48.625937] [ 48.627571] The buggy address belongs to the object at ffff8801cc9bc280 [ 48.627571] which belongs to the cache kmalloc-512 of size 512 [ 48.640249] The buggy address is located 7 bytes to the right of [ 48.640249] 512-byte region [ffff8801cc9bc280, ffff8801cc9bc480) [ 48.652554] The buggy address belongs to the page: [ 48.657489] page:ffffea0007326f00 count:1 mapcount:0 mapping:ffff8801da800940 index:0x0 [ 48.665640] flags: 0x2fffc0000000200(slab) [ 48.669876] raw: 02fffc0000000200 ffffea000734e788 ffffea0007302848 ffff8801da800940 [ 48.677756] raw: 0000000000000000 ffff8801cc9bc000 0000000100000006 0000000000000000 [ 48.685916] page dumped because: kasan: bad access detected [ 48.691619] [ 48.693315] Memory state around the buggy address: [ 48.698248] ffff8801cc9bc380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 48.705732] ffff8801cc9bc400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 48.713099] >ffff8801cc9bc480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.720641] ^ [ 48.724008] ffff8801cc9bc500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 48.731361] ffff8801cc9bc580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 48.738709] ================================================================== [ 48.746210] Disabling lock debugging due to kernel taint [ 48.751900] Kernel panic - not syncing: panic_on_warn set ... [ 48.751900] [ 48.759287] CPU: 1 PID: 5694 Comm: syz-executor171 Tainted: G B 4.19.0+ #88 [ 48.767933] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 48.777355] Call Trace: [ 48.780093] dump_stack+0x244/0x39d [ 48.783720] ? dump_stack_print_info.cold.1+0x20/0x20 [ 48.788905] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 48.793804] panic+0x238/0x4e7 [ 48.796994] ? add_taint.cold.5+0x16/0x16 [ 48.801146] ? trace_hardirqs_on+0x9a/0x310 [ 48.805466] ? trace_hardirqs_on+0xb4/0x310 [ 48.809787] ? trace_hardirqs_on+0xb4/0x310 [ 48.814121] kasan_end_report+0x47/0x4f [ 48.818340] kasan_report.cold.8+0x76/0x309 [ 48.822660] ? _decode_session6+0x134a/0x1500 [ 48.827358] __asan_report_load1_noabort+0x14/0x20 [ 48.832287] _decode_session6+0x134a/0x1500 [ 48.836610] __xfrm_decode_session+0x71/0x140 [ 48.841199] vti6_tnl_xmit+0x3fc/0x1c10 [ 48.845330] ? __lock_acquire+0x62f/0x4c20 [ 48.849569] ? vti6_tnl_create2+0x430/0x430 [ 48.853959] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 48.859499] ? check_preemption_disabled+0x48/0x280 [ 48.864519] dev_hard_start_xmit+0x295/0xc90 [ 48.868924] ? dev_direct_xmit+0x6b0/0x6b0 [ 48.873157] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 48.878687] ? netif_skb_features+0x690/0xb70 [ 48.883178] ? rcu_softirq_qs+0x20/0x20 [ 48.887274] ? lock_acquire+0x1ed/0x520 [ 48.891371] ? __dev_queue_xmit+0x3063/0x3ad0 [ 48.895920] ? kasan_check_read+0x11/0x20 [ 48.900084] ? do_raw_spin_lock+0x14f/0x350 [ 48.904404] ? rwlock_bug.part.2+0x90/0x90 [ 48.908636] ? netif_skb_features+0xb70/0xb70 [ 48.913128] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 48.918661] ? check_preemption_disabled+0x48/0x280 [ 48.923715] __dev_queue_xmit+0x2f71/0x3ad0 [ 48.928034] ? save_stack+0x43/0xd0 [ 48.931717] ? kasan_kmalloc+0xc7/0xe0 [ 48.935638] ? __kmalloc_node_track_caller+0x50/0x70 [ 48.940853] ? netdev_pick_tx+0x310/0x310 [ 48.945000] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 48.950535] ? check_preemption_disabled+0x48/0x280 [ 48.955664] ? __lock_is_held+0xb5/0x140 [ 48.959720] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 48.964770] ? skb_release_data+0x1c4/0x880 [ 48.969146] ? kmem_cache_alloc_node_trace+0x34b/0x740 [ 48.974418] ? kasan_unpoison_shadow+0x35/0x50 [ 48.978997] ? skb_tx_error+0x2f0/0x2f0 [ 48.982970] ? __kmalloc_node_track_caller+0x50/0x70 [ 48.988086] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 48.993618] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 48.999192] ? kasan_check_write+0x14/0x20 [ 49.003423] ? pskb_expand_head+0x6b3/0x10f0 [ 49.007843] ? find_held_lock+0x36/0x1c0 [ 49.011911] ? skb_release_data+0x880/0x880 [ 49.016225] ? __alloc_skb+0x770/0x770 [ 49.020111] ? __lock_is_held+0xb5/0x140 [ 49.024167] ? kasan_check_write+0x14/0x20 [ 49.028396] ? __skb_clone+0x6c7/0xa00 [ 49.032279] ? __copy_skb_header+0x6b0/0x6b0 [ 49.036720] ? kmem_cache_alloc+0x33a/0x730 [ 49.041038] ? depot_save_stack+0x292/0x470 [ 49.045377] ? skb_ensure_writable+0x15e/0x640 [ 49.049960] dev_queue_xmit+0x17/0x20 [ 49.053809] ? dev_queue_xmit+0x17/0x20 [ 49.057789] __bpf_redirect+0x5cf/0xb20 [ 49.061798] bpf_clone_redirect+0x2f6/0x490 [ 49.066120] bpf_prog_c39d1ba309a769f7+0x881/0x1000 [ 49.071137] ? bpf_test_run+0x175/0x780 [ 49.075105] ? lock_downgrade+0x900/0x900 [ 49.079248] ? ktime_get+0x332/0x400 [ 49.082958] ? find_held_lock+0x36/0x1c0 [ 49.087015] ? lock_acquire+0x1ed/0x520 [ 49.090979] ? bpf_test_run+0x3cb/0x780 [ 49.094949] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 49.100481] ? check_preemption_disabled+0x48/0x280 [ 49.105496] ? kasan_check_read+0x11/0x20 [ 49.109645] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 49.114915] ? rcu_softirq_qs+0x20/0x20 [ 49.118883] ? bpf_cgroup_storage_release+0x220/0x220 [ 49.124119] ? skb_try_coalesce+0x1b70/0x1b70 [ 49.128613] ? bpf_test_run+0x25d/0x780 [ 49.132582] ? netlink_diag_dump+0x2a0/0x2a0 [ 49.137029] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 49.142581] ? bpf_test_init.isra.10+0x70/0x100 [ 49.147243] ? bpf_prog_test_run_skb+0x73b/0xcb0 [ 49.151995] ? bpf_test_finish.isra.9+0x1f0/0x1f0 [ 49.157109] ? bpf_prog_add+0x69/0xd0 [ 49.160909] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 49.166481] ? __bpf_prog_get+0x9b/0x290 [ 49.170540] ? bpf_test_finish.isra.9+0x1f0/0x1f0 [ 49.175374] ? bpf_prog_test_run+0x130/0x1a0 [ 49.179777] ? __x64_sys_bpf+0x3d8/0x520 [ 49.183836] ? bpf_prog_get+0x20/0x20 [ 49.187640] ? do_syscall_64+0x1b9/0x820 [ 49.191694] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 49.197050] ? syscall_return_slowpath+0x5e0/0x5e0 [ 49.201994] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 49.206875] ? trace_hardirqs_on_caller+0x310/0x310 [ 49.211886] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 49.216899] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 49.222438] ? prepare_exit_to_usermode+0x291/0x3b0 [ 49.227503] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 49.232410] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 49.238807] Kernel Offset: disabled [ 49.242464] Rebooting in 86400 seconds..