[....] Starting enhanced syslogd: rsyslogd[ 10.809923] audit: type=1400 audit(1515044065.497:4): avc: denied { syslog } for pid=3170 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.15.237' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 20.729933] ================================================================== [ 20.731035] BUG: KASAN: slab-out-of-bounds in pfkey_add+0x153e/0x3470 [ 20.731922] Read of size 8192 at addr ffff8801ccd58a18 by task syzkaller248753/3324 [ 20.732957] [ 20.733187] CPU: 0 PID: 3324 Comm: syzkaller248753 Not tainted 4.9.74-g4406671 #13 [ 20.734232] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 20.735466] ffff8801c9857718 ffffffff81d91d19 ffffea0007335600 ffff8801ccd58a18 [ 20.736607] 0000000000000000 ffff8801ccd58c00 ffff8801c9857958 ffff8801c9857750 [ 20.737737] ffffffff8153b503 ffff8801ccd58a18 0000000000002000 0000000000000000 [ 20.738937] Call Trace: [ 20.739295] [] dump_stack+0xc1/0x128 [ 20.740065] [] print_address_description+0x73/0x280 [ 20.740975] [] kasan_report+0x275/0x360 [ 20.741716] [] ? pfkey_add+0x153e/0x3470 [ 20.742494] [] check_memory_region+0x137/0x190 [ 20.743329] [] memcpy+0x23/0x50 [ 20.743983] [] pfkey_add+0x153e/0x3470 [ 20.744714] [] ? pfkey_delete+0x360/0x360 [ 20.745478] [] ? pfkey_seq_stop+0x80/0x80 [ 20.746295] [] ? __skb_clone+0x24a/0x7d0 [ 20.747065] [] ? pfkey_delete+0x360/0x360 [ 20.747839] [] pfkey_process+0x61e/0x730 [ 20.748592] [] ? pfkey_send_new_mapping+0x11b0/0x11b0 [ 20.749492] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 20.750390] [] pfkey_sendmsg+0x3a9/0x760 [ 20.756065] [] ? pfkey_spdget+0x820/0x820 [ 20.761829] [] sock_sendmsg+0xca/0x110 [ 20.767331] [] ___sys_sendmsg+0x6d1/0x7e0 [ 20.773095] [] ? copy_msghdr_from_user+0x550/0x550 [ 20.779644] [] ? __lru_cache_add+0x187/0x250 [ 20.785670] [] ? do_huge_pmd_anonymous_page+0xb05/0x10d0 [ 20.792733] [] ? _raw_spin_unlock+0x2c/0x50 [ 20.798684] [] ? do_huge_pmd_anonymous_page+0x2d4/0x10d0 [ 20.805752] [] ? handle_mm_fault+0x6ee/0x2530 [ 20.811862] [] ? __fget_light+0x158/0x1e0 [ 20.817623] [] ? __fdget+0x18/0x20 [ 20.822778] [] ? sockfd_lookup_light+0x118/0x160 [ 20.829147] [] __sys_sendmsg+0xd6/0x190 [ 20.834735] [] ? SyS_shutdown+0x1b0/0x1b0 [ 20.840497] [] ? __do_page_fault+0x5ec/0xd40 [ 20.846520] [] compat_SyS_sendmsg+0x2a/0x40 [ 20.852456] [] ? compat_SyS_getsockopt+0x2a0/0x2a0 [ 20.859000] [] do_fast_syscall_32+0x2f7/0x890 [ 20.865108] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 20.871739] [] entry_SYSENTER_compat+0x51/0x60 [ 20.877940] [ 20.879535] Allocated by task 3324: [ 20.883137] save_stack_trace+0x16/0x20 [ 20.887077] save_stack+0x43/0xd0 [ 20.890496] kasan_kmalloc+0xad/0xe0 [ 20.894183] kasan_slab_alloc+0x12/0x20 [ 20.898122] __kmalloc_track_caller+0xda/0x2b0 [ 20.902668] __kmalloc_reserve.isra.37+0x33/0xc0 [ 20.907389] __alloc_skb+0x119/0x600 [ 20.911070] pfkey_sendmsg+0x135/0x760 [ 20.914921] sock_sendmsg+0xca/0x110 [ 20.918599] ___sys_sendmsg+0x6d1/0x7e0 [ 20.922534] __sys_sendmsg+0xd6/0x190 [ 20.926299] compat_SyS_sendmsg+0x2a/0x40 [ 20.930430] do_fast_syscall_32+0x2f7/0x890 [ 20.934717] entry_SYSENTER_compat+0x51/0x60 [ 20.939099] [ 20.940691] Freed by task 1763: [ 20.943934] save_stack_trace+0x16/0x20 [ 20.947874] save_stack+0x43/0xd0 [ 20.951291] kasan_slab_free+0x72/0xc0 [ 20.955143] kfree+0x103/0x300 [ 20.958301] skb_free_head+0x74/0xb0 [ 20.963207] skb_release_data+0x315/0x3f0 [ 20.967669] skb_release_all+0x4a/0x60 [ 20.971708] consume_skb+0xc6/0x340 [ 20.975298] skb_free_datagram+0x1a/0xe0 [ 20.979323] netlink_recvmsg+0x60b/0xe10 [ 20.983347] sock_recvmsg+0xc9/0x110 [ 20.987024] ___sys_recvmsg+0x24c/0x530 [ 20.990963] __sys_recvmsg+0xd3/0x190 [ 20.994728] SyS_recvmsg+0x2d/0x50 [ 20.998234] entry_SYSCALL_64_fastpath+0x23/0xc6 [ 21.002950] [ 21.004544] The buggy address belongs to the object at ffff8801ccd58a00 [ 21.004544] which belongs to the cache kmalloc-512 of size 512 [ 21.017164] The buggy address is located 24 bytes inside of [ 21.017164] 512-byte region [ffff8801ccd58a00, ffff8801ccd58c00) [ 21.028920] The buggy address belongs to the page: [ 21.033816] page:ffffea0007335600 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 21.043969] flags: 0x8000000000004080(slab|head) [ 21.048687] page dumped because: kasan: bad access detected [ 21.054359] [ 21.055952] Memory state around the buggy address: [ 21.060843] ffff8801ccd58b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 21.068167] ffff8801ccd58b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 21.075492] >ffff8801ccd58c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.082813] ^ [ 21.086143] ffff8801ccd58c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.093468] ffff8801ccd58d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.100792] ================================================================== [ 21.108113] Disabling lock debugging due to kernel taint [ 21.113783] Kernel panic - not syncing: panic_on_warn set ... [ 21.113783] [ 21.121128] CPU: 0 PID: 3324 Comm: syzkaller248753 Tainted: G B 4.9.74-g4406671 #13 [ 21.130025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 21.139761] ffff8801c9857670 ffffffff81d91d19 ffffffff8419562f ffff8801c9857748 [ 21.147723] 0000000000000000 ffff8801ccd58c00 ffff8801c9857958 ffff8801c9857738 [ 21.155677] ffffffff8142d161 0000000041b58ab3 ffffffff84189070 ffffffff8142cfa5 [ 21.163633] Call Trace: [ 21.166190] [] dump_stack+0xc1/0x128 [ 21.171520] [] panic+0x1bc/0x3a8 [ 21.176502] [] ? percpu_up_read_preempt_enable.constprop.53+0xd7/0xd7 [ 21.184695] [] ? preempt_schedule+0x25/0x30 [ 21.190630] [] ? ___preempt_schedule+0x16/0x18 [ 21.196827] [] kasan_end_report+0x50/0x50 [ 21.202590] [] kasan_report+0x167/0x360 [ 21.208180] [] ? pfkey_add+0x153e/0x3470 [ 21.214899] [] check_memory_region+0x137/0x190 [ 21.221976] [] memcpy+0x23/0x50 [ 21.226874] [] pfkey_add+0x153e/0x3470 [ 21.232373] [] ? pfkey_delete+0x360/0x360 [ 21.238135] [] ? pfkey_seq_stop+0x80/0x80 [ 21.243900] [] ? __skb_clone+0x24a/0x7d0 [ 21.249586] [] ? pfkey_delete+0x360/0x360 [ 21.255348] [] pfkey_process+0x61e/0x730 [ 21.261032] [] ? pfkey_send_new_mapping+0x11b0/0x11b0 [ 21.267839] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 21.274645] [] pfkey_sendmsg+0x3a9/0x760 [ 21.280319] [] ? pfkey_spdget+0x820/0x820 [ 21.286080] [] sock_sendmsg+0xca/0x110 [ 21.291583] [] ___sys_sendmsg+0x6d1/0x7e0 [ 21.297344] [] ? copy_msghdr_from_user+0x550/0x550 [ 21.303888] [] ? __lru_cache_add+0x187/0x250 [ 21.309912] [] ? do_huge_pmd_anonymous_page+0xb05/0x10d0 [ 21.316992] [] ? _raw_spin_unlock+0x2c/0x50 [ 21.322936] [] ? do_huge_pmd_anonymous_page+0x2d4/0x10d0 [ 21.330003] [] ? handle_mm_fault+0x6ee/0x2530 [ 21.336113] [] ? __fget_light+0x158/0x1e0 [ 21.341881] [] ? __fdget+0x18/0x20 [ 21.347039] [] ? sockfd_lookup_light+0x118/0x160 [ 21.353410] [] __sys_sendmsg+0xd6/0x190 [ 21.358998] [] ? SyS_shutdown+0x1b0/0x1b0 [ 21.364762] [] ? __do_page_fault+0x5ec/0xd40 [ 21.370787] [] compat_SyS_sendmsg+0x2a/0x40 [ 21.376723] [] ? compat_SyS_getsockopt+0x2a0/0x2a0 [ 21.383264] [] do_fast_syscall_32+0x2f7/0x890 [ 21.389373] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 21.396005] [] entry_SYSENTER_compat+0x51/0x60 [ 21.402643] Dumping ftrace buffer: [ 21.406149] (ftrace buffer empty) [ 21.409823] Kernel Offset: disabled [ 21.413416] Rebooting in 86400 seconds..