[....] Starting enhanced syslogd: rsyslogd[ 13.186071] audit: type=1400 audit(1520536335.534:4): avc: denied { syslog } for pid=3648 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.53' (ECDSA) to the list of known hosts. 2018/03/08 19:12:29 parsed 1 programs 2018/03/08 19:12:29 executed programs: 0 syzkaller login: [ 26.996350] IPVS: Creating netns size=2536 id=1 [ 27.014780] ================================================================== [ 27.022151] BUG: KASAN: slab-out-of-bounds in pfkey_add+0x2702/0x3470 [ 27.028701] Read of size 4096 at addr ffff8801c6266a40 by task syz-executor0/3818 [ 27.036287] [ 27.037884] CPU: 1 PID: 3818 Comm: syz-executor0 Not tainted 4.9.86-g00db063 #60 [ 27.045382] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.054704] ffff8801b0f27718 ffffffff81d956f9 ffffea0007189980 ffff8801c6266a40 [ 27.062672] 0000000000000000 ffff8801c6266c00 ffff8801b0f27958 ffff8801b0f27750 [ 27.070638] ffffffff8153e083 ffff8801c6266a40 0000000000001000 0000000000000000 [ 27.078608] Call Trace: [ 27.081168] [] dump_stack+0xc1/0x128 [ 27.086501] [] print_address_description+0x73/0x280 [ 27.093138] [] kasan_report+0x275/0x360 [ 27.098732] [] ? pfkey_add+0x2702/0x3470 [ 27.104414] [] check_memory_region+0x137/0x190 [ 27.110613] [] memcpy+0x23/0x50 [ 27.115512] [] pfkey_add+0x2702/0x3470 [ 27.121014] [] ? pfkey_delete+0x360/0x360 [ 27.126780] [] ? pfkey_seq_stop+0x80/0x80 [ 27.132545] [] ? __skb_clone+0x24a/0x7d0 [ 27.138222] [] ? pfkey_delete+0x360/0x360 [ 27.143988] [] pfkey_process+0x68b/0x750 [ 27.149667] [] ? pfkey_send_new_mapping+0x11b0/0x11b0 [ 27.156478] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 27.163285] [] pfkey_sendmsg+0x3a9/0x760 [ 27.168966] [] ? pfkey_spdget+0x820/0x820 [ 27.174730] [] sock_sendmsg+0xca/0x110 [ 27.180237] [] ___sys_sendmsg+0x6d1/0x7e0 [ 27.186004] [] ? copy_msghdr_from_user+0x570/0x570 [ 27.192553] [] ? do_futex+0x3f8/0x15c0 [ 27.198060] [] ? __lru_cache_add+0x187/0x250 [ 27.204091] [] ? do_huge_pmd_anonymous_page+0xb05/0x10d0 [ 27.211162] [] ? exit_robust_list+0x230/0x230 [ 27.217273] [] ? do_huge_pmd_anonymous_page+0x2d4/0x10d0 [ 27.224341] [] ? __fget_light+0x169/0x1f0 [ 27.230108] [] ? __fdget+0x18/0x20 [ 27.235268] [] ? sockfd_lookup_light+0x118/0x160 [ 27.241640] [] __sys_sendmsg+0xd6/0x190 [ 27.247231] [] ? SyS_shutdown+0x1b0/0x1b0 [ 27.252994] [] ? compat_SyS_futex+0x1f9/0x2a0 [ 27.259107] [] compat_SyS_sendmsg+0x2a/0x40 [ 27.265046] [] ? compat_SyS_getsockopt+0x2a0/0x2a0 [ 27.271595] [] do_fast_syscall_32+0x2f5/0x870 [ 27.277708] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 27.284339] [] entry_SYSENTER_compat+0x90/0xa2 [ 27.290910] [ 27.292506] Allocated by task 3818: [ 27.296103] save_stack_trace+0x16/0x20 [ 27.300042] save_stack+0x43/0xd0 [ 27.303459] kasan_kmalloc+0xad/0xe0 [ 27.307138] kasan_slab_alloc+0x12/0x20 [ 27.311076] __kmalloc_track_caller+0xda/0x2b0 [ 27.315630] __kmalloc_reserve.isra.37+0x33/0xc0 [ 27.320352] __alloc_skb+0x119/0x600 [ 27.324030] pfkey_sendmsg+0x135/0x760 [ 27.327884] sock_sendmsg+0xca/0x110 [ 27.331564] ___sys_sendmsg+0x6d1/0x7e0 [ 27.335505] __sys_sendmsg+0xd6/0x190 [ 27.339274] compat_SyS_sendmsg+0x2a/0x40 [ 27.343391] do_fast_syscall_32+0x2f5/0x870 [ 27.347681] entry_SYSENTER_compat+0x90/0xa2 [ 27.352050] [ 27.353646] Freed by task 2146: [ 27.356891] save_stack_trace+0x16/0x20 [ 27.360829] save_stack+0x43/0xd0 [ 27.364249] kasan_slab_free+0x72/0xc0 [ 27.368100] kfree+0x103/0x300 [ 27.371257] skb_free_head+0x74/0xb0 [ 27.374937] skb_release_data+0x315/0x3f0 [ 27.379052] skb_release_all+0x4a/0x60 [ 27.382904] __kfree_skb+0x15/0x20 [ 27.386409] kfree_skb+0xcc/0x330 [ 27.389828] netlink_unicast+0x653/0x750 [ 27.393855] netlink_sendmsg+0x8e8/0xc50 [ 27.397881] sock_sendmsg+0xca/0x110 [ 27.401562] ___sys_sendmsg+0x6d1/0x7e0 [ 27.405503] __sys_sendmsg+0xd6/0x190 [ 27.409269] SyS_sendmsg+0x2d/0x50 [ 27.412775] do_syscall_64+0x1a4/0x490 [ 27.416629] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 27.421696] [ 27.423290] The buggy address belongs to the object at ffff8801c6266a00 [ 27.423290] which belongs to the cache kmalloc-512 of size 512 [ 27.435911] The buggy address is located 64 bytes inside of [ 27.435911] 512-byte region [ffff8801c6266a00, ffff8801c6266c00) [ 27.447661] The buggy address belongs to the page: [ 27.452557] page:ffffea0007189980 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 27.462731] flags: 0x8000000000004080(slab|head) [ 27.467453] page dumped because: kasan: bad access detected [ 27.473124] [ 27.474720] Memory state around the buggy address: [ 27.479618] ffff8801c6266b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.486948] ffff8801c6266b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.494271] >ffff8801c6266c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.501595] ^ [ 27.504929] ffff8801c6266c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.512253] ffff8801c6266d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.519574] ================================================================== [ 27.526898] Disabling lock debugging due to kernel taint [ 27.532560] Kernel panic - not syncing: panic_on_warn set ... [ 27.532560] [ 27.539892] CPU: 1 PID: 3818 Comm: syz-executor0 Tainted: G B 4.9.86-g00db063 #60 [ 27.548605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.557928] ffff8801b0f27670 ffffffff81d956f9 ffffffff84197a0f ffff8801b0f27748 [ 27.565887] 0000000000000000 ffff8801c6266c00 ffff8801b0f27958 ffff8801b0f27738 [ 27.573850] ffffffff8142f531 0000000041b58ab3 ffffffff8418b470 ffffffff8142f375 [ 27.581809] Call Trace: [ 27.584366] [] dump_stack+0xc1/0x128 [ 27.589699] [] panic+0x1bc/0x3a8 [ 27.594682] [] ? percpu_up_read_preempt_enable.constprop.53+0xd7/0xd7 [ 27.602878] [] ? preempt_schedule+0x25/0x30 [ 27.608815] [] ? ___preempt_schedule+0x16/0x18 [ 27.615014] [] kasan_end_report+0x50/0x50 [ 27.620777] [] kasan_report+0x167/0x360 [ 27.626370] [] ? pfkey_add+0x2702/0x3470 [ 27.632045] [] check_memory_region+0x137/0x190 [ 27.638243] [] memcpy+0x23/0x50 [ 27.643140] [] pfkey_add+0x2702/0x3470 [ 27.648642] [] ? pfkey_delete+0x360/0x360 [ 27.654404] [] ? pfkey_seq_stop+0x80/0x80 [ 27.660167] [] ? __skb_clone+0x24a/0x7d0 [ 27.665844] [] ? pfkey_delete+0x360/0x360 [ 27.671606] [] pfkey_process+0x68b/0x750 [ 27.677285] [] ? pfkey_send_new_mapping+0x11b0/0x11b0 [ 27.684100] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 27.690908] [] pfkey_sendmsg+0x3a9/0x760 [ 27.696594] [] ? pfkey_spdget+0x820/0x820 [ 27.702360] [] sock_sendmsg+0xca/0x110 [ 27.707863] [] ___sys_sendmsg+0x6d1/0x7e0 [ 27.713625] [] ? copy_msghdr_from_user+0x570/0x570 [ 27.720171] [] ? do_futex+0x3f8/0x15c0 [ 27.725688] [] ? __lru_cache_add+0x187/0x250 [ 27.731718] [] ? do_huge_pmd_anonymous_page+0xb05/0x10d0 [ 27.738786] [] ? exit_robust_list+0x230/0x230 [ 27.744899] [] ? do_huge_pmd_anonymous_page+0x2d4/0x10d0 [ 27.751966] [] ? __fget_light+0x169/0x1f0 [ 27.757728] [] ? __fdget+0x18/0x20 [ 27.762885] [] ? sockfd_lookup_light+0x118/0x160 [ 27.769258] [] __sys_sendmsg+0xd6/0x190 [ 27.774846] [] ? SyS_shutdown+0x1b0/0x1b0 [ 27.780608] [] ? compat_SyS_futex+0x1f9/0x2a0 [ 27.786719] [] compat_SyS_sendmsg+0x2a/0x40 [ 27.792658] [] ? compat_SyS_getsockopt+0x2a0/0x2a0 [ 27.799202] [] do_fast_syscall_32+0x2f5/0x870 [ 27.805316] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 27.811950] [] entry_SYSENTER_compat+0x90/0xa2 [ 27.818511] Dumping ftrace buffer: [ 27.822027] (ftrace buffer empty) [ 27.825711] Kernel Offset: disabled [ 27.829307] Rebooting in 86400 seconds..