INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-kasan-gce-386-2,10.128.0.12' (ECDSA) to the list of known hosts.
net.ipv6.conf.syz0.accept_dad = 0
net.ipv6.conf.syz0.router_solicitations = 0
executing program
syzkaller login: [   40.262297] ==================================================================
[   40.269698] BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x305b/0x3190
[   40.276860] Read of size 4 at addr ffff8801d2c36708 by task syzkaller414975/3018
[   40.284365] 
[   40.285971] CPU: 1 PID: 3018 Comm: syzkaller414975 Not tainted 4.14.0-rc1+ #4
[   40.293212] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   40.302537] Call Trace:
[   40.305100]  dump_stack+0x194/0x257
[   40.308705]  ? arch_local_irq_restore+0x53/0x53
[   40.313346]  ? show_regs_print_info+0x65/0x65
[   40.317814]  ? lock_release+0xd70/0xd70
[   40.321784]  ? xfrm_state_find+0x305b/0x3190
[   40.326166]  print_address_description+0x73/0x250
[   40.330980]  ? xfrm_state_find+0x305b/0x3190
[   40.335367]  kasan_report+0x24e/0x340
[   40.339149]  __asan_report_load4_noabort+0x14/0x20
[   40.344052]  xfrm_state_find+0x305b/0x3190
[   40.348281]  ? xfrm_state_afinfo_get_rcu+0x160/0x160
[   40.353359]  ? print_usage_bug+0x480/0x480
[   40.357573]  ? __lock_acquire+0x732/0x4620
[   40.361803]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   40.366974]  ? __lock_acquire+0x732/0x4620
[   40.371191]  ? __lock_acquire+0x732/0x4620
[   40.375404]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   40.380576]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   40.385740]  ? check_noncircular+0x20/0x20
[   40.389944]  ? check_noncircular+0x20/0x20
[   40.394160]  xfrm_tmpl_resolve+0x2fb/0xbd0
[   40.398384]  ? __xfrm_decode_session+0x100/0x100
[   40.403123]  ? rcu_read_lock_sched_held+0x108/0x120
[   40.408112]  ? fib_table_lookup+0xa07/0x1a30
[   40.412495]  ? check_noncircular+0x20/0x20
[   40.416711]  xfrm_resolve_and_create_bundle+0x186/0x24b0
[   40.422132]  ? inet_netconf_get_devconf+0x4f0/0x4f0
[   40.427136]  ? xfrm_tmpl_resolve+0xbd0/0xbd0
[   40.431519]  ? lock_downgrade+0x990/0x990
[   40.435646]  ? xfrm_selector_match+0xe00/0xe00
[   40.440197]  ? rcu_read_lock_held+0xa9/0xc0
[   40.444490]  ? find_exception+0x3aa/0x520
[   40.448613]  ? lock_release+0xd70/0xd70
[   40.452561]  ? refcount_inc_not_zero+0xfe/0x180
[   40.457206]  ? xfrm_selector_match+0x3b/0xe00
[   40.461674]  ? xfrm_sk_policy_lookup+0x2cf/0x3d0
[   40.466404]  ? xfrm_selector_match+0xe00/0xe00
[   40.470960]  ? check_noncircular+0x20/0x20
[   40.475161]  ? ip_route_output_key_hash_rcu+0x604/0x2c20
[   40.480586]  xfrm_lookup+0xf0a/0x2540
[   40.484362]  ? xfrm_lookup+0xf0a/0x2540
[   40.488307]  ? ip_route_input_noref+0x1e0/0x1e0
[   40.492952]  ? xfrm_policy_lookup_bytype.constprop.49+0x16f0/0x16f0
[   40.499330]  ? find_held_lock+0x39/0x1d0
[   40.503373]  ? lock_downgrade+0x990/0x990
[   40.507495]  ? selinux_netlbl_sock_rcv_skb+0x9e/0x730
[   40.512660]  ? ip_route_output_key_hash+0x1a6/0x370
[   40.517653]  ? lock_release+0xd70/0xd70
[   40.521608]  ? selinux_nf_register+0x30/0x30
[   40.525988]  ? __lock_acquire+0x732/0x4620
[   40.530201]  ? selinux_sock_rcv_skb_compat+0x2f4/0x480
[   40.535454]  ? ip_route_output_key_hash+0x252/0x370
[   40.540443]  ? ip_route_output_key_hash_rcu+0x2c20/0x2c20
[   40.545959]  xfrm_lookup_route+0x39/0x1a0
[   40.550082]  ip_route_output_flow+0x7c/0xa0
[   40.554375]  inet_csk_route_req+0x5d8/0x990
[   40.558685]  tcp_v4_send_synack+0x1e4/0x270
[   40.562978]  ? tcp_v4_send_check+0x90/0x90
[   40.567191]  ? sk_filter_trim_cap+0x12f/0x9b0
[   40.571655]  ? prandom_u32_state+0x13/0x180
[   40.575954]  tcp_rtx_synack+0x119/0x2e0
[   40.579899]  ? tcp_event_new_data_sent+0x2e0/0x2e0
[   40.584800]  ? __lock_is_held+0xbc/0x140
[   40.588846]  inet_rtx_syn_ack+0x64/0xd0
[   40.592795]  tcp_check_req+0xaf5/0x1630
[   40.596758]  ? tcp_openreq_init_rwin+0xae0/0xae0
[   40.601487]  ? refcount_inc_not_zero+0xfe/0x180
[   40.606124]  ? refcount_add+0x60/0x60
[   40.609896]  ? tcp_v4_reqsk_send_ack+0x3e0/0x3e0
[   40.614628]  ? tcp_filter+0x111/0x160
[   40.618401]  tcp_v4_rcv+0x17b0/0x2f20
[   40.622177]  ? lock_acquire+0x1d5/0x580
[   40.626136]  ? tcp_v4_early_demux+0xa30/0xa30
[   40.630615]  ip_local_deliver_finish+0x2e2/0xba0
[   40.635345]  ? inet_del_offload+0x40/0x40
[   40.639466]  ? nf_hook_slow+0xd3/0x1a0
[   40.643328]  ip_local_deliver+0x1ce/0x6e0
[   40.647449]  ? ip_call_ra_chain+0x6d0/0x6d0
[   40.651764]  ? inet_del_offload+0x40/0x40
[   40.655890]  ip_rcv_finish+0x8db/0x19c0
[   40.659842]  ? ip_local_deliver_finish+0xba0/0xba0
[   40.664741]  ? iptable_nat_ipv4_fn+0x40/0x40
[   40.669124]  ? nf_nat_ipv4_in_range+0xf0/0xf0
[   40.673591]  ? ip_rcv+0xba0/0x17d0
[   40.677104]  ? tcp_v4_send_synack+0x270/0x270
[   40.681573]  ? nf_nat_ipv4_in+0x1cd/0x270
[   40.685691]  ? iptable_nat_ipv4_fn+0x40/0x40
[   40.690079]  ? nf_hook_slow+0xd3/0x1a0
[   40.693944]  ip_rcv+0xc3f/0x17d0
[   40.697287]  ? ip_local_deliver+0x6e0/0x6e0
[   40.701583]  ? __lock_acquire+0x732/0x4620
[   40.705788]  ? print_usage_bug+0x480/0x480
[   40.710010]  ? ip_local_deliver_finish+0xba0/0xba0
[   40.714914]  ? ip_local_deliver+0x6e0/0x6e0
[   40.719212]  __netif_receive_skb_core+0x19af/0x33d0
[   40.724197]  ? print_usage_bug+0x480/0x480
[   40.728412]  ? nf_ingress+0x9f0/0x9f0
[   40.732185]  ? kasan_kmalloc+0xad/0xe0
[   40.736042]  ? kmem_cache_alloc+0x12e/0x760
[   40.740335]  ? __build_skb+0x9d/0x450
[   40.744105]  ? build_skb+0x6f/0x260
[   40.747703]  ? tun_build_skb.isra.42+0x92f/0x1690
[   40.752515]  ? tun_get_user+0x1dad/0x2150
[   40.756631]  ? tun_chr_write_iter+0xde/0x190
[   40.761010]  ? __vfs_write+0x68a/0x970
[   40.764869]  ? __skb_flow_get_ports+0x151/0x400
[   40.769509]  ? skb_flow_dissector_init+0x280/0x280
[   40.774412]  ? check_noncircular+0x20/0x20
[   40.778618]  ? __skb_flow_get_ports+0x151/0x400
[   40.783262]  ? __skb_flow_dissect+0x85b/0x3bc0
[   40.787832]  ? find_held_lock+0x39/0x1d0
[   40.791875]  ? lock_downgrade+0x990/0x990
[   40.795995]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   40.801157]  ? lock_acquire+0x1d5/0x580
[   40.805101]  ? netif_receive_skb_internal+0x1d7/0x670
[   40.810285]  ? pvclock_read_flags+0x160/0x160
[   40.814751]  ? tun_build_skb.isra.42+0x455/0x1690
[   40.819571]  ? lock_acquire+0x1d5/0x580
[   40.823516]  ? netif_receive_skb_internal+0xa2/0x670
[   40.828590]  ? ktime_get_with_offset+0x2c1/0x420
[   40.833331]  ? lock_release+0xd70/0xd70
[   40.837274]  ? ktime_get+0x3a0/0x3a0
[   40.840957]  ? skb_put+0x149/0x1c0
[   40.844479]  __netif_receive_skb+0x2c/0x1b0
[   40.848769]  ? __netif_receive_skb+0x2c/0x1b0
[   40.853238]  netif_receive_skb_internal+0x10b/0x670
[   40.858223]  ? dev_cpu_dead+0xb00/0xb00
[   40.862179]  ? rcu_pm_notify+0xc0/0xc0
[   40.866050]  netif_receive_skb+0xae/0x390
[   40.870171]  ? netif_receive_skb_internal+0x670/0x670
[   40.875334]  ? lock_downgrade+0x990/0x990
[   40.879456]  ? tun_rx_batched.isra.43+0x5c3/0x860
[   40.884271]  tun_rx_batched.isra.43+0x5ed/0x860
[   40.888910]  ? skb_get_hash_perturb+0x9d0/0x9d0
[   40.893551]  ? tun_sock_write_space+0x370/0x370
[   40.898217]  tun_get_user+0x11dd/0x2150
[   40.902177]  ? tun_build_skb.isra.42+0x1690/0x1690
[   40.907080]  ? lock_release+0xd70/0xd70
[   40.911032]  ? tun_chr_close+0x60/0x60
[   40.914899]  ? lock_release+0xd70/0xd70
[   40.918847]  ? __lock_is_held+0xbc/0x140
[   40.922891]  ? __tun_get+0x1d4/0x2e0
[   40.926577]  ? tun_chr_close+0x60/0x60
[   40.930436]  ? __handle_mm_fault+0x587/0x39c0
[   40.934915]  tun_chr_write_iter+0xde/0x190
[   40.939124]  __vfs_write+0x68a/0x970
[   40.942815]  ? kernel_read+0x120/0x120
[   40.946684]  ? avc_policy_seqno+0x9/0x20
[   40.950718]  ? selinux_file_permission+0x82/0x460
[   40.955544]  ? rw_verify_area+0xe5/0x2b0
[   40.959573]  ? __fdget_raw+0x20/0x20
[   40.963262]  vfs_write+0x18f/0x510
[   40.966783]  SyS_write+0xef/0x220
[   40.970223]  ? SyS_read+0x220/0x220
[   40.973834]  ? do_fast_syscall_32+0x158/0xeed
[   40.978303]  ? SyS_read+0x220/0x220
[   40.981903]  do_fast_syscall_32+0x3f2/0xeed
[   40.986202]  ? do_int80_syscall_32+0x930/0x930
[   40.990760]  ? lockdep_sys_exit+0x47/0xf0
[   40.994880]  ? syscall_return_slowpath+0x2b3/0x500
[   40.999779]  ? finish_task_switch+0x4c9/0x740
[   41.004249]  ? lockdep_sys_exit+0x47/0xf0
[   41.008368]  ? retint_user+0x18/0x20
[   41.012059]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   41.016879]  entry_SYSENTER_compat+0x51/0x60
[   41.021256] RIP: 0023:0xf7f58c79
[   41.024589] RSP: 002b:00000000f2f4a1f4 EFLAGS: 00000292 ORIG_RAX: 0000000000000004
[   41.032269] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020002000
[   41.039507] RDX: 0000000000000036 RSI: 0000000000000000 RDI: 00000000003d0f00
[   41.046746] RBP: 00000000f2f4a2e8 R08: 0000000000000000 R09: 0000000000000000
[   41.053986] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[   41.061225] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   41.068486] 
[   41.070081] The buggy address belongs to the page:
[   41.074982] page:ffffea00074b0d80 count:0 mapcount:0 mapping:          (null) index:0x0
[   41.083103] flags: 0x200000000000000()
[   41.086960] raw: 0200000000000000 0000000000000000 0000000000000000 00000000ffffffff
[   41.094811] raw: 0000000000000000 ffffea00074b0da0 0000000000000000 0000000000000000
[   41.102659] page dumped because: kasan: bad access detected
[   41.108341] 
[   41.109941] Memory state around the buggy address:
[   41.114841]  ffff8801d2c36600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   41.122172]  ffff8801d2c36680: 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 00
[   41.129499] >ffff8801d2c36700: 00 f2 f3 f3 f3 f3 00 00 00 00 00 00 00 f1 f1 f1
[   41.136826]                       ^
[   41.140420]  ffff8801d2c36780: f1 00 00 00 00 00 00 00 00 00 00 00 f2 f3 f3 f3
[   41.147778]  ffff8801d2c36800: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   41.155105] ==================================================================
[   41.162430] Disabling lock debugging due to kernel taint
[   41.167872] Kernel panic - not syncing: panic_on_warn set ...
[   41.167872] 
[   41.175201] CPU: 1 PID: 3018 Comm: syzkaller414975 Tainted: G    B           4.14.0-rc1+ #4
[   41.183651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   41.192968] Call Trace:
[   41.195521]  dump_stack+0x194/0x257
[   41.199113]  ? arch_local_irq_restore+0x53/0x53
[   41.203750]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   41.208476]  ? xfrm_state_find+0x2fc0/0x3190
[   41.212849]  panic+0x1e4/0x417
[   41.216004]  ? __warn+0x1d9/0x1d9
[   41.219433]  ? xfrm_state_find+0x305b/0x3190
[   41.223808]  kasan_end_report+0x50/0x50
[   41.227749]  kasan_report+0x137/0x340
[   41.231522]  __asan_report_load4_noabort+0x14/0x20
[   41.236416]  xfrm_state_find+0x305b/0x3190
[   41.240628]  ? xfrm_state_afinfo_get_rcu+0x160/0x160
[   41.245695]  ? print_usage_bug+0x480/0x480
[   41.249895]  ? __lock_acquire+0x732/0x4620
[   41.254105]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   41.259269]  ? __lock_acquire+0x732/0x4620