[....] Starting enhanced syslogd: rsyslogd[ 16.049400] audit: type=1400 audit(1518268994.490:5): avc: denied { syslog } for pid=4008 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 19.354204] audit: type=1400 audit(1518268997.795:6): avc: denied { map } for pid=4147 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.15.197' (ECDSA) to the list of known hosts. executing program [ 25.613794] audit: type=1400 audit(1518269004.054:7): avc: denied { map } for pid=4161 comm="syzkaller163237" path="/root/syzkaller163237601" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 25.641208] ================================================================== [ 25.648606] BUG: KASAN: use-after-free in ip6_xmit+0x1f76/0x2260 [ 25.654724] Read of size 8 at addr ffff8801d4c47e18 by task syzkaller163237/4162 [ 25.662222] [ 25.663822] CPU: 0 PID: 4162 Comm: syzkaller163237 Not tainted 4.15.0+ #217 [ 25.670892] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 25.680214] Call Trace: [ 25.682775] dump_stack+0x194/0x257 [ 25.686378] ? arch_local_irq_restore+0x53/0x53 [ 25.691026] ? show_regs_print_info+0x18/0x18 [ 25.695503] ? ip6_xmit+0x1f76/0x2260 [ 25.699275] print_address_description+0x73/0x250 [ 25.704088] ? ip6_xmit+0x1f76/0x2260 [ 25.707862] kasan_report+0x23b/0x360 [ 25.711638] __asan_report_load8_noabort+0x14/0x20 [ 25.716536] ip6_xmit+0x1f76/0x2260 [ 25.720159] ? ip6_finish_output2+0x23a0/0x23a0 [ 25.724805] ? fl6_update_dst+0x127/0x2b0 [ 25.728927] ? inet6_csk_route_socket+0x691/0xe80 [ 25.733743] ? check_noncircular+0x20/0x20 [ 25.737948] ? lock_acquire+0x1d5/0x580 [ 25.741893] ? lock_acquire+0x1d5/0x580 [ 25.745838] ? inet6_csk_xmit+0x114/0x580 [ 25.749957] ? check_noncircular+0x20/0x20 [ 25.754169] ? lock_release+0xa40/0xa40 [ 25.758131] inet6_csk_xmit+0x2fc/0x580 [ 25.762079] ? inet6_csk_update_pmtu+0x160/0x160 [ 25.766807] ? __sk_dst_check+0x1a5/0x380 [ 25.770929] ? sk_wait_data+0x610/0x610 [ 25.774893] l2tp_xmit_skb+0x105f/0x1410 [ 25.778938] ? l2tp_session_create+0xb80/0xb80 [ 25.783490] ? sock_wmalloc+0x15d/0x1d0 [ 25.787437] ? iov_iter_advance+0x13f0/0x13f0 [ 25.791907] ? pppol2tp_sendmsg+0x41b/0x670 [ 25.796204] pppol2tp_sendmsg+0x470/0x670 [ 25.800329] ? selinux_socket_sendmsg+0x36/0x40 [ 25.804974] ? pppol2tp_session_ioctl+0xa90/0xa90 [ 25.809790] sock_sendmsg+0xca/0x110 [ 25.813479] ___sys_sendmsg+0x767/0x8b0 [ 25.817430] ? copy_msghdr_from_user+0x590/0x590 [ 25.822159] ? _raw_spin_unlock+0x22/0x30 [ 25.826300] ? __pmd_alloc+0x4e0/0x4e0 [ 25.830161] ? check_noncircular+0x20/0x20 [ 25.834368] ? lock_release+0xa40/0xa40 [ 25.838312] ? trace_event_raw_event_sched_switch+0x810/0x810 [ 25.844171] ? __fget_light+0x2b2/0x3c0 [ 25.848118] ? fget_raw+0x20/0x20 [ 25.851561] ? handle_mm_fault+0x270/0x970 [ 25.855779] ? find_held_lock+0x35/0x1d0 [ 25.859827] __sys_sendmsg+0xe5/0x210 [ 25.863600] ? __sys_sendmsg+0xe5/0x210 [ 25.867550] ? SyS_shutdown+0x290/0x290 [ 25.871500] ? __handle_mm_fault+0x3ce0/0x3ce0 [ 25.876052] ? vmacache_find+0x5f/0x280 [ 25.880038] compat_SyS_sendmsg+0x2a/0x40 [ 25.884159] ? compat_SyS_getsockopt+0x420/0x420 [ 25.888889] do_fast_syscall_32+0x3ee/0xfa1 [ 25.893188] ? do_int80_syscall_32+0x9d0/0x9d0 [ 25.897742] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 25.902476] ? syscall_return_slowpath+0x2ac/0x550 [ 25.907378] ? prepare_exit_to_usermode+0x350/0x350 [ 25.912366] ? retint_user+0x18/0x18 [ 25.916058] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 25.920877] entry_SYSENTER_compat+0x54/0x63 [ 25.925256] RIP: 0023:0xf7f35c79 [ 25.928590] RSP: 002b:00000000ff8aa72c EFLAGS: 00000217 ORIG_RAX: 0000000000000172 [ 25.936267] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000020ab9000 [ 25.943508] RDX: 0000000000008090 RSI: 000000000000016a RDI: 0000000000000004 [ 25.950748] RBP: 00000000205fafd2 R08: 0000000000000000 R09: 0000000000000000 [ 25.957990] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 25.965233] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 25.972488] [ 25.974093] Allocated by task 2500: [ 25.977695] save_stack+0x43/0xd0 [ 25.981119] kasan_kmalloc+0xad/0xe0 [ 25.984802] kasan_slab_alloc+0x12/0x20 [ 25.988744] kmem_cache_alloc+0x12e/0x760 [ 25.992869] dst_alloc+0x11f/0x1a0 [ 25.996384] rt_dst_alloc+0xe9/0x520 [ 26.000072] ip_route_input_rcu+0x1076/0x3200 [ 26.004541] ip_route_input_noref+0xf5/0x1e0 [ 26.008918] ip_rcv_finish+0x3a6/0x2040 [ 26.012861] ip_rcv+0xc5a/0x1840 [ 26.016200] __netif_receive_skb_core+0x1a41/0x3460 [ 26.021188] __netif_receive_skb+0x2c/0x1b0 [ 26.025477] netif_receive_skb_internal+0x10b/0x670 [ 26.030467] napi_gro_receive+0x3d0/0x500 [ 26.034586] receive_buf+0xb6e/0x2530 [ 26.038356] virtnet_poll+0x320/0xb70 [ 26.042127] net_rx_action+0x792/0x1910 [ 26.046074] __do_softirq+0x2d7/0xb85 [ 26.049842] [ 26.051440] Freed by task 3841: [ 26.054689] save_stack+0x43/0xd0 [ 26.058119] __kasan_slab_free+0x11a/0x170 [ 26.062333] kasan_slab_free+0xe/0x10 [ 26.066104] kmem_cache_free+0x83/0x2a0 [ 26.070052] dst_destroy+0x257/0x370 [ 26.073737] dst_destroy_rcu+0x16/0x20 [ 26.077599] rcu_process_callbacks+0xd6c/0x17f0 [ 26.082246] __do_softirq+0x2d7/0xb85 [ 26.086015] [ 26.087618] The buggy address belongs to the object at ffff8801d4c47e00 [ 26.087618] which belongs to the cache ip_dst_cache of size 168 [ 26.100330] The buggy address is located 24 bytes inside of [ 26.100330] 168-byte region [ffff8801d4c47e00, ffff8801d4c47ea8) [ 26.112094] The buggy address belongs to the page: [ 26.116992] page:ffffea00075311c0 count:1 mapcount:0 mapping:ffff8801d4c47000 index:0xffff8801d4c47000 [ 26.126410] flags: 0x2fffc0000000100(slab) [ 26.130617] raw: 02fffc0000000100 ffff8801d4c47000 ffff8801d4c47000 000000010000000a [ 26.138468] raw: ffff8801d5db9b38 ffffea0006d41660 ffff8801d5dbab00 0000000000000000 [ 26.147274] page dumped because: kasan: bad access detected [ 26.152952] [ 26.154556] Memory state around the buggy address: [ 26.159460] ffff8801d4c47d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.166791] ffff8801d4c47d80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 26.174119] >ffff8801d4c47e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.181444] ^ [ 26.185561] ffff8801d4c47e80: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc [ 26.192887] ffff8801d4c47f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.200220] ================================================================== [ 26.207547] Disabling lock debugging due to kernel taint [ 26.213006] Kernel panic - not syncing: panic_on_warn set ... [ 26.213006] [ 26.220349] CPU: 0 PID: 4162 Comm: syzkaller163237 Tainted: G B 4.15.0+ #217 [ 26.228717] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 26.238039] Call Trace: [ 26.240601] dump_stack+0x194/0x257 [ 26.244200] ? arch_local_irq_restore+0x53/0x53 [ 26.248837] ? kasan_end_report+0x32/0x50 [ 26.252957] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 26.257681] ? vsnprintf+0x1ed/0x1900 [ 26.261449] ? ip6_xmit+0x1ed0/0x2260 [ 26.265220] panic+0x1e4/0x41c [ 26.268381] ? refcount_error_report+0x214/0x214 [ 26.273106] ? add_taint+0x1c/0x50 [ 26.276615] ? add_taint+0x1c/0x50 [ 26.280126] ? ip6_xmit+0x1f76/0x2260 [ 26.283897] kasan_end_report+0x50/0x50 [ 26.287842] kasan_report+0x148/0x360 [ 26.291613] __asan_report_load8_noabort+0x14/0x20 [ 26.296509] ip6_xmit+0x1f76/0x2260 [ 26.300113] ? ip6_finish_output2+0x23a0/0x23a0 [ 26.304751] ? fl6_update_dst+0x127/0x2b0 [ 26.308869] ? inet6_csk_route_socket+0x691/0xe80 [ 26.313682] ? check_noncircular+0x20/0x20 [ 26.318417] ? lock_acquire+0x1d5/0x580 [ 26.322362] ? lock_acquire+0x1d5/0x580 [ 26.326309] ? inet6_csk_xmit+0x114/0x580 [ 26.330427] ? check_noncircular+0x20/0x20 [ 26.334635] ? lock_release+0xa40/0xa40 [ 26.338605] inet6_csk_xmit+0x2fc/0x580 [ 26.342549] ? inet6_csk_update_pmtu+0x160/0x160 [ 26.347275] ? __sk_dst_check+0x1a5/0x380 [ 26.351401] ? sk_wait_data+0x610/0x610 [ 26.355352] l2tp_xmit_skb+0x105f/0x1410 [ 26.359400] ? l2tp_session_create+0xb80/0xb80 [ 26.363956] ? sock_wmalloc+0x15d/0x1d0 [ 26.367901] ? iov_iter_advance+0x13f0/0x13f0 [ 26.372368] ? pppol2tp_sendmsg+0x41b/0x670 [ 26.376659] pppol2tp_sendmsg+0x470/0x670 [ 26.380780] ? selinux_socket_sendmsg+0x36/0x40 [ 26.385417] ? pppol2tp_session_ioctl+0xa90/0xa90 [ 26.390230] sock_sendmsg+0xca/0x110 [ 26.393914] ___sys_sendmsg+0x767/0x8b0 [ 26.397861] ? copy_msghdr_from_user+0x590/0x590 [ 26.402587] ? _raw_spin_unlock+0x22/0x30 [ 26.406712] ? __pmd_alloc+0x4e0/0x4e0 [ 26.410568] ? check_noncircular+0x20/0x20 [ 26.414769] ? lock_release+0xa40/0xa40 [ 26.418714] ? trace_event_raw_event_sched_switch+0x810/0x810 [ 26.424569] ? __fget_light+0x2b2/0x3c0 [ 26.428512] ? fget_raw+0x20/0x20 [ 26.431941] ? handle_mm_fault+0x270/0x970 [ 26.436149] ? find_held_lock+0x35/0x1d0 [ 26.440186] __sys_sendmsg+0xe5/0x210 [ 26.443957] ? __sys_sendmsg+0xe5/0x210 [ 26.447910] ? SyS_shutdown+0x290/0x290 [ 26.451854] ? __handle_mm_fault+0x3ce0/0x3ce0 [ 26.456407] ? vmacache_find+0x5f/0x280 [ 26.460372] compat_SyS_sendmsg+0x2a/0x40 [ 26.464489] ? compat_SyS_getsockopt+0x420/0x420 [ 26.469213] do_fast_syscall_32+0x3ee/0xfa1 [ 26.473515] ? do_int80_syscall_32+0x9d0/0x9d0 [ 26.478066] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 26.482795] ? syscall_return_slowpath+0x2ac/0x550 [ 26.487693] ? prepare_exit_to_usermode+0x350/0x350 [ 26.492681] ? retint_user+0x18/0x18 [ 26.496371] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 26.501185] entry_SYSENTER_compat+0x54/0x63 [ 26.505567] RIP: 0023:0xf7f35c79 [ 26.508902] RSP: 002b:00000000ff8aa72c EFLAGS: 00000217 ORIG_RAX: 0000000000000172 [ 26.516577] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000020ab9000 [ 26.523817] RDX: 0000000000008090 RSI: 000000000000016a RDI: 0000000000000004 [ 26.531056] RBP: 00000000205fafd2 R08: 0000000000000000 R09: 0000000000000000 [ 26.538296] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 26.545533] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 26.553198] Dumping ftrace buffer: [ 26.556710] (ftrace buffer empty) [ 26.560390] Kernel Offset: disabled [ 26.563989] Rebooting in 86400 seconds..