[....] Starting enhanced syslogd: rsyslogd[ 10.405984] audit: type=1400 audit(1513772924.491:5): avc: denied { syslog } for pid=2987 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 12.532801] audit: type=1400 audit(1513772926.618:6): avc: denied { map } for pid=3128 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added 'ci-upstream-kasan-gce-2,10.128.15.205' (ECDSA) to the list of known hosts. [ 21.378832] audit: type=1400 audit(1513772935.464:7): avc: denied { map } for pid=3143 comm="syzkaller392542" path="/root/syzkaller392542656" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 net.ipv6.conf.syz1.accept_dad = 0 net.ipv6.conf.syz2.accept_dad = 0 net.ipv6.conf.syz0.accept_dad = 0 net.ipv6.conf.syz7.accept_dad = 0 net.ipv6.conf.syz4.accept_dad = 0 net.ipv6.conf.syz3.accept_dad = 0 net.ipv6.conf.syz5.accept_dad = 0 net.ipv6.conf.syz6.accept_dad = 0 net.ipv6.conf.syz7.router_solicitations = 0 net.ipv6.conf.syz0.router_solicitations = 0 net.ipv6.conf.syz5.router_solicitations = 0 net.ipv6.conf.syz2.router_solicitations = 0 net.ipv6.conf.syz1.router_solicitations = 0 net.ipv6.conf.syz3.router_solicitations = 0 net.ipv6.conf.syz6.router_solicitations = 0 net.ipv6.conf.syz4.router_solicitations = 0 executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 27.442858] ================================================================== [ 27.450264] BUG: KASAN: use-after-free in crypto_chacha20_crypt+0xaf1/0xbd0 [ 27.457349] Read of size 4 at addr ffff880100000006 by task syzkaller392542/8351 [ 27.465732] [ 27.467336] CPU: 1 PID: 8351 Comm: syzkaller392542 Not tainted 4.15.0-rc4+ #229 [ 27.474748] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.484074] Call Trace: [ 27.486643] dump_stack+0x194/0x257 executing program executing program executing program [ 27.490245] ? arch_local_irq_restore+0x53/0x53 [ 27.494884] ? show_regs_print_info+0x18/0x18 [ 27.499353] ? rcutorture_record_progress+0x10/0x10 [ 27.504342] ? crypto_chacha20_crypt+0xaf1/0xbd0 [ 27.509079] print_address_description+0x73/0x250 [ 27.513913] ? crypto_chacha20_crypt+0xaf1/0xbd0 [ 27.518649] kasan_report+0x25b/0x340 [ 27.522425] __asan_report_load4_noabort+0x14/0x20 [ 27.527327] crypto_chacha20_crypt+0xaf1/0xbd0 [ 27.531886] ? crypto_chacha20_setkey+0xc0/0xc0 [ 27.536539] ? __kmalloc+0x162/0x760 [ 27.540223] ? sock_kmalloc+0x112/0x190 [ 27.544169] ? skcipher_recvmsg+0x3f2/0xf10 [ 27.548456] ? sock_recvmsg+0xc9/0x110 [ 27.552310] ? sock_read_iter+0x35b/0x560 [ 27.556424] ? do_iter_readv_writev+0x5fb/0x7f0 [ 27.561057] ? do_iter_read+0x21a/0x5a0 [ 27.565000] ? vfs_readv+0x121/0x1c0 [ 27.568704] ? do_readv+0xfc/0x2a0 [ 27.574467] ? SyS_readv+0x27/0x30 [ 27.579283] ? entry_SYSCALL_64_fastpath+0x1f/0x96 [ 27.584622] ? check_noncircular+0x20/0x20 [ 27.588823] ? lock_downgrade+0x980/0x980 [ 27.592942] ? af_alg_pull_tsgl+0x8b6/0xc10 [ 27.597237] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 27.602680] chacha20_simd+0xe4/0x410 [ 27.606449] ? chacha20_simd+0xe4/0x410 [ 27.610393] ? af_alg_get_rsgl+0x980/0x980 [ 27.614597] ? chacha20_dosimd+0x340/0x340 [ 27.618807] ? rcu_read_lock_sched_held+0x108/0x120 [ 27.623802] ? sock_kmalloc+0x112/0x190 [ 27.627750] ? sock_kmalloc+0x11f/0x190 [ 27.631692] ? copy_overflow+0x30/0x30 [ 27.635546] ? lock_sock_nested+0x91/0x110 [ 27.639749] ? trace_hardirqs_on+0xd/0x10 [ 27.643868] ? memset+0x31/0x40 [ 27.647122] skcipher_recvmsg+0xa4e/0xf10 [ 27.651236] ? skcipher_recvmsg+0xa4e/0xf10 [ 27.655527] ? avc_has_perm+0x43e/0x680 [ 27.659483] ? skcipher_release+0x50/0x50 [ 27.663602] ? selinux_socket_recvmsg+0x36/0x40 [ 27.668240] ? security_socket_recvmsg+0x91/0xc0 [ 27.672968] ? skcipher_release+0x50/0x50 [ 27.677084] sock_recvmsg+0xc9/0x110 [ 27.680771] sock_read_iter+0x35b/0x560 [ 27.684715] ? sock_recvmsg+0x110/0x110 [ 27.688680] do_iter_readv_writev+0x5fb/0x7f0 [ 27.693148] ? vfs_dedupe_file_range+0x8f0/0x8f0 [ 27.697880] ? rw_verify_area+0xe5/0x2b0 [ 27.701913] do_iter_read+0x21a/0x5a0 [ 27.705683] ? dup_iter+0x260/0x260 [ 27.709288] vfs_readv+0x121/0x1c0 [ 27.712796] ? __fget_light+0x297/0x380 [ 27.716741] ? compat_rw_copy_check_uvector+0x2e0/0x2e0 [ 27.722073] ? up_read+0x1a/0x40 [ 27.725409] ? __do_page_fault+0x3d6/0xc90 [ 27.729621] ? mm_fault_error+0x2c0/0x2c0 [ 27.733751] ? __fdget_raw+0x20/0x20 [ 27.737435] ? __do_page_fault+0xc90/0xc90 [ 27.741642] do_readv+0xfc/0x2a0 [ 27.744975] ? do_readv+0xfc/0x2a0 [ 27.748487] ? vfs_readv+0x1c0/0x1c0 [ 27.752171] ? entry_SYSCALL_64_fastpath+0x5/0x96 [ 27.756984] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 27.761973] SyS_readv+0x27/0x30 [ 27.765311] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 27.770034] RIP: 0033:0x44abf9 [ 27.773190] RSP: 002b:00007fcd6800ddc8 EFLAGS: 00000202 ORIG_RAX: 0000000000000013 [ 27.780874] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000044abf9 [ 27.788113] RDX: 0000000000000005 RSI: 0000000020b3a000 RDI: 000000000000008f [ 27.795352] RBP: 0000000000000000 R08: 00007fcd6800e700 R09: 00007fcd6800e700 [ 27.802592] R10: 00007fcd6800e700 R11: 0000000000000202 R12: 0000000000000000 [ 27.809831] R13: 00007ffe76d6b40f R14: 00007fcd6800e9c0 R15: 0000000000000000 [ 27.817090] [ 27.818683] The buggy address belongs to the page: [ 27.823581] page:000000005d51089a count:0 mapcount:-127 mapping: (null) index:0x0 [ 27.831950] flags: 0x2fffc0000000000() [ 27.835820] raw: 02fffc0000000000 0000000000000000 0000000000000000 00000000ffffff80 [ 27.843668] raw: ffff88021fffae20 ffffea0004010020 000000000000000a 0000000000000000 [ 27.851518] page dumped because: kasan: bad access detected [ 27.857190] [ 27.858783] Memory state around the buggy address: [ 27.864032] BUG: unable to handle kernel paging request at ffffed001fffffe0 [ 27.871106] IP: memcpy_erms+0x6/0x10 [ 27.874785] PGD 21ffd6067 P4D 21ffd6067 PUD 21ffd5067 PMD 0 [ 27.880558] Oops: 0000 [#1] SMP KASAN [ 27.884325] Dumping ftrace buffer: [ 27.887827] (ftrace buffer empty) [ 27.891509] Modules linked in: [ 27.894671] CPU: 1 PID: 8351 Comm: syzkaller392542 Not tainted 4.15.0-rc4+ #229 [ 27.902086] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.912109] RIP: 0010:memcpy_erms+0x6/0x10 [ 27.916306] RSP: 0018:ffff8801be94f408 EFLAGS: 00010092 [ 27.921634] RAX: ffff8801be94f414 RBX: ffffed001fffffe0 RCX: 0000000000000010 [ 27.928869] RDX: 0000000000000010 RSI: ffffed001fffffe0 RDI: ffff8801be94f414 [ 27.936107] RBP: ffff8801be94f460 R08: ffffed0037d29e87 R09: ffffed0037d29e87 [ 27.943343] R10: dffffc0000000000 R11: ffffed0037d29e86 R12: 00000000fffffffe [ 27.950578] R13: ffff8800ffffff00 R14: ffffed0020000000 R15: 0000000000000014 [ 27.957822] FS: 00007fcd6800e700(0000) GS:ffff8801db500000(0000) knlGS:0000000000000000 [ 27.966015] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.971864] CR2: ffffed001fffffe0 CR3: 00000001d025c004 CR4: 00000000001606e0 [ 27.979100] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 27.986339] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 27.993581] Call Trace: [ 27.996134] ? print_shadow_for_address+0xa8/0x170 [ 28.001032] ? dump_page+0x1d/0x30 [ 28.004546] ? crypto_chacha20_crypt+0xaf1/0xbd0 [ 28.009267] kasan_report+0x26f/0x340 [ 28.013035] __asan_report_load4_noabort+0x14/0x20 [ 28.017928] crypto_chacha20_crypt+0xaf1/0xbd0 [ 28.022491] ? crypto_chacha20_setkey+0xc0/0xc0 [ 28.027131] ? __kmalloc+0x162/0x760 [ 28.030813] ? sock_kmalloc+0x112/0x190 [ 28.034755] ? skcipher_recvmsg+0x3f2/0xf10 [ 28.039042] ? sock_recvmsg+0xc9/0x110 [ 28.043422] ? sock_read_iter+0x35b/0x560 [ 28.047538] ? do_iter_readv_writev+0x5fb/0x7f0 [ 28.052173] ? do_iter_read+0x21a/0x5a0 [ 28.056115] ? vfs_readv+0x121/0x1c0 [ 28.059792] ? do_readv+0xfc/0x2a0 [ 28.063297] ? SyS_readv+0x27/0x30 [ 28.066807] ? entry_SYSCALL_64_fastpath+0x1f/0x96 [ 28.071706] ? check_noncircular+0x20/0x20 [ 28.075906] ? lock_downgrade+0x980/0x980 [ 28.080023] ? af_alg_pull_tsgl+0x8b6/0xc10 [ 28.084312] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 28.089300] chacha20_simd+0xe4/0x410 [ 28.093066] ? chacha20_simd+0xe4/0x410 [ 28.097009] ? af_alg_get_rsgl+0x980/0x980 [ 28.101211] ? chacha20_dosimd+0x340/0x340 [ 28.105418] ? rcu_read_lock_sched_held+0x108/0x120 [ 28.110405] ? sock_kmalloc+0x112/0x190 [ 28.114347] ? sock_kmalloc+0x11f/0x190 [ 28.118290] ? copy_overflow+0x30/0x30 [ 28.122141] ? lock_sock_nested+0x91/0x110 [ 28.126342] ? trace_hardirqs_on+0xd/0x10 [ 28.130456] ? memset+0x31/0x40 [ 28.133706] skcipher_recvmsg+0xa4e/0xf10 [ 28.137821] ? skcipher_recvmsg+0xa4e/0xf10 [ 28.142107] ? avc_has_perm+0x43e/0x680 [ 28.146056] ? skcipher_release+0x50/0x50 [ 28.150171] ? selinux_socket_recvmsg+0x36/0x40 [ 28.154809] ? security_socket_recvmsg+0x91/0xc0 [ 28.159533] ? skcipher_release+0x50/0x50 [ 28.163646] sock_recvmsg+0xc9/0x110 [ 28.167327] sock_read_iter+0x35b/0x560 [ 28.171272] ? sock_recvmsg+0x110/0x110 [ 28.175223] do_iter_readv_writev+0x5fb/0x7f0 [ 28.179694] ? vfs_dedupe_file_range+0x8f0/0x8f0 [ 28.184420] ? rw_verify_area+0xe5/0x2b0 [ 28.188450] do_iter_read+0x21a/0x5a0 [ 28.192218] ? dup_iter+0x260/0x260 [ 28.195817] vfs_readv+0x121/0x1c0 [ 28.199322] ? __fget_light+0x297/0x380 [ 28.203263] ? compat_rw_copy_check_uvector+0x2e0/0x2e0 [ 28.209294] ? up_read+0x1a/0x40 [ 28.213670] ? __do_page_fault+0x3d6/0xc90 [ 28.218576] ? mm_fault_error+0x2c0/0x2c0 [ 28.222696] ? __fdget_raw+0x20/0x20 [ 28.226378] ? __do_page_fault+0xc90/0xc90 [ 28.230580] do_readv+0xfc/0x2a0 [ 28.234781] ? do_readv+0xfc/0x2a0 [ 28.238290] ? vfs_readv+0x1c0/0x1c0 [ 28.241972] ? entry_SYSCALL_64_fastpath+0x5/0x96 [ 28.248344] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 28.255325] SyS_readv+0x27/0x30 [ 28.259180] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 28.263901] RIP: 0033:0x44abf9 [ 28.267057] RSP: 002b:00007fcd6800ddc8 EFLAGS: 00000202 ORIG_RAX: 0000000000000013 [ 28.274731] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000044abf9 [ 28.281967] RDX: 0000000000000005 RSI: 0000000020b3a000 RDI: 000000000000008f [ 28.289203] RBP: 0000000000000000 R08: 00007fcd6800e700 R09: 00007fcd6800e700 [ 28.296446] R10: 00007fcd6800e700 R11: 0000000000000202 R12: 0000000000000000 [ 28.303687] R13: 00007ffe76d6b40f R14: 00007fcd6800e9c0 R15: 0000000000000000 [ 28.310932] Code: 90 90 90 90 90 eb 1e 0f 1f 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 a4 c3 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20 72 7e 40 38 [ 28.330027] RIP: memcpy_erms+0x6/0x10 RSP: ffff8801be94f408 [ 28.335708] CR2: ffffed001fffffe0 [ 28.339131] ---[ end trace 13660e7c8dcc7b1a ]--- [ 28.343849] Kernel panic - not syncing: Fatal exception [ 28.349592] Dumping ftrace buffer: [ 28.353097] (ftrace buffer empty) [ 28.356773] Kernel Offset: disabled [ 28.360366] Rebooting in 86400 seconds..