INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-kasan-gce-386-3,10.128.15.228' (ECDSA) to the list of known hosts.
net.ipv6.conf.syz0.accept_dad = 0
net.ipv6.conf.syz0.router_solicitations = 0
executing program
syzkaller login: [   28.965521] ==================================================================
[   28.972952] BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x305b/0x3190
[   28.980114] Read of size 4 at addr ffff8801cd176708 by task syzkaller264070/3017
[   28.987616] 
[   28.989261] CPU: 1 PID: 3017 Comm: syzkaller264070 Not tainted 4.14.0-rc1+ #4
[   28.996506] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   29.005838] Call Trace:
[   29.008401]  dump_stack+0x194/0x257
[   29.012008]  ? arch_local_irq_restore+0x53/0x53
[   29.016652]  ? show_regs_print_info+0x65/0x65
[   29.021126]  ? lock_release+0xd70/0xd70
[   29.025073]  ? print_usage_bug+0x480/0x480
[   29.029283]  ? xfrm_state_find+0x305b/0x3190
[   29.033665]  print_address_description+0x73/0x250
[   29.038478]  ? xfrm_state_find+0x305b/0x3190
[   29.042859]  kasan_report+0x24e/0x340
[   29.046636]  __asan_report_load4_noabort+0x14/0x20
[   29.051536]  xfrm_state_find+0x305b/0x3190
[   29.055765]  ? xfrm_state_afinfo_get_rcu+0x160/0x160
[   29.060844]  ? print_usage_bug+0x480/0x480
[   29.065056]  ? check_noncircular+0x20/0x20
[   29.069264]  ? find_held_lock+0x39/0x1d0
[   29.073303]  ? check_noncircular+0x20/0x20
[   29.077514]  ? lock_downgrade+0x990/0x990
[   29.081640]  ? find_held_lock+0x39/0x1d0
[   29.085680]  ? __lock_acquire+0x732/0x4620
[   29.089885]  ? find_held_lock+0x39/0x1d0
[   29.093937]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   29.099102]  ? depot_save_stack+0x1c2/0x490
[   29.103399]  ? unwind_dump+0x4c0/0x4c0
[   29.107260]  ? do_raw_spin_trylock+0x190/0x190
[   29.111827]  xfrm_tmpl_resolve+0x2fb/0xbd0
[   29.116054]  ? __xfrm_decode_session+0x100/0x100
[   29.120780]  ? save_stack_trace+0x16/0x20
[   29.124901]  ? save_stack+0x43/0xd0
[   29.128496]  ? kasan_kmalloc+0xad/0xe0
[   29.132351]  ? kasan_slab_alloc+0x12/0x20
[   29.136470]  ? kmem_cache_alloc+0x12e/0x760
[   29.140764]  ? dst_alloc+0x11f/0x1a0
[   29.144447]  ? rt_dst_alloc+0xe9/0x540
[   29.148306]  ? ip_route_output_key_hash+0x20b/0x370
[   29.153292]  ? ip_route_output_flow+0x26/0xa0
[   29.157759]  ? inet_csk_route_req+0x5d8/0x990
[   29.162225]  ? tcp_v4_send_synack+0x1e4/0x270
[   29.166692]  ? tcp_rtx_synack+0x119/0x2e0
[   29.170810]  ? inet_rtx_syn_ack+0x64/0xd0
[   29.174928]  ? tcp_check_req+0xaf5/0x1630
[   29.179045]  ? tcp_v4_rcv+0x17b0/0x2f20
[   29.182988]  ? ip_local_deliver_finish+0x2e2/0xba0
[   29.187898]  ? check_noncircular+0x20/0x20
[   29.192108]  ? __netif_receive_skb_core+0x19af/0x33d0
[   29.197267]  ? __netif_receive_skb+0x2c/0x1b0
[   29.201731]  ? netif_receive_skb_internal+0x10b/0x670
[   29.206894]  ? check_noncircular+0x20/0x20
[   29.211099]  ? tun_chr_write_iter+0xde/0x190
[   29.215477]  ? __vfs_write+0x68a/0x970
[   29.219340]  xfrm_resolve_and_create_bundle+0x186/0x24b0
[   29.224765]  ? inet_netconf_get_devconf+0x4f0/0x4f0
[   29.229770]  ? xfrm_tmpl_resolve+0xbd0/0xbd0
[   29.234153]  ? lock_downgrade+0x990/0x990
[   29.238273]  ? dst_init+0x4d9/0x6a0
[   29.241877]  ? xfrm_selector_match+0xe00/0xe00
[   29.246432]  ? rcu_read_lock_held+0xa9/0xc0
[   29.250739]  ? lock_release+0xd70/0xd70
[   29.254690]  ? refcount_inc_not_zero+0xfe/0x180
[   29.259337]  ? xfrm_selector_match+0x3b/0xe00
[   29.263810]  ? xfrm_sk_policy_lookup+0x2cf/0x3d0
[   29.268542]  ? xfrm_selector_match+0xe00/0xe00
[   29.273099]  ? check_noncircular+0x20/0x20
[   29.277304]  ? ip_route_output_key_hash_rcu+0x604/0x2c20
[   29.282730]  xfrm_lookup+0xf0a/0x2540
[   29.286502]  ? xfrm_lookup+0xf0a/0x2540
[   29.290449]  ? ip_route_input_noref+0x1e0/0x1e0
[   29.295098]  ? xfrm_policy_lookup_bytype.constprop.49+0x16f0/0x16f0
[   29.301480]  ? find_held_lock+0x39/0x1d0
[   29.305525]  ? lock_downgrade+0x990/0x990
[   29.309645]  ? selinux_netlbl_sock_rcv_skb+0x9e/0x730
[   29.314814]  ? ip_route_output_key_hash+0x1a6/0x370
[   29.319810]  ? lock_release+0xd70/0xd70
[   29.323755]  ? selinux_nf_register+0x30/0x30
[   29.328136]  ? __lock_acquire+0x732/0x4620
[   29.332353]  ? selinux_sock_rcv_skb_compat+0x2f4/0x480
[   29.337605]  ? ip_route_output_key_hash+0x252/0x370
[   29.342597]  ? ip_route_output_key_hash_rcu+0x2c20/0x2c20
[   29.348118]  xfrm_lookup_route+0x39/0x1a0
[   29.352242]  ip_route_output_flow+0x7c/0xa0
[   29.356539]  inet_csk_route_req+0x5d8/0x990
[   29.360843]  tcp_v4_send_synack+0x1e4/0x270
[   29.365137]  ? tcp_v4_send_check+0x90/0x90
[   29.369351]  ? sk_filter_trim_cap+0x12f/0x9b0
[   29.373819]  ? prandom_u32_state+0x13/0x180
[   29.378117]  tcp_rtx_synack+0x119/0x2e0
[   29.382064]  ? tcp_event_new_data_sent+0x2e0/0x2e0
[   29.386967]  ? tcp_parse_fastopen_option+0xc1/0xf0
[   29.391873]  ? tcp_parse_options+0x188/0xa10
[   29.396264]  inet_rtx_syn_ack+0x64/0xd0
[   29.400213]  tcp_check_req+0xaf5/0x1630
[   29.404168]  ? tcp_openreq_init_rwin+0xae0/0xae0
[   29.408897]  ? refcount_inc_not_zero+0xfe/0x180
[   29.413538]  ? refcount_add+0x60/0x60
[   29.417310]  ? tcp_v4_reqsk_send_ack+0x3e0/0x3e0
[   29.422042]  ? tcp_filter+0x111/0x160
[   29.425819]  tcp_v4_rcv+0x17b0/0x2f20
[   29.429610]  ? lock_acquire+0x1d5/0x580
[   29.433573]  ? tcp_v4_early_demux+0xa30/0xa30
[   29.438053]  ip_local_deliver_finish+0x2e2/0xba0
[   29.442785]  ? inet_del_offload+0x40/0x40
[   29.446911]  ? nf_hook_slow+0xd3/0x1a0
[   29.450776]  ip_local_deliver+0x1ce/0x6e0
[   29.454900]  ? ip_call_ra_chain+0x6d0/0x6d0
[   29.459205]  ? inet_del_offload+0x40/0x40
[   29.463336]  ip_rcv_finish+0x8db/0x19c0
[   29.467291]  ? ip_local_deliver_finish+0xba0/0xba0
[   29.472203]  ? iptable_nat_ipv4_fn+0x40/0x40
[   29.476586]  ? nf_nat_ipv4_in_range+0xf0/0xf0
[   29.481056]  ? ip_rcv+0xba0/0x17d0
[   29.484571]  ? tcp_v4_send_synack+0x270/0x270
[   29.489042]  ? nf_nat_ipv4_in+0x1cd/0x270
[   29.493158]  ? iptable_nat_ipv4_fn+0x40/0x40
[   29.497548]  ? nf_hook_slow+0xd3/0x1a0
[   29.501412]  ip_rcv+0xc3f/0x17d0
[   29.504757]  ? ip_local_deliver+0x6e0/0x6e0
[   29.509054]  ? __lock_acquire+0x732/0x4620
[   29.513273]  ? ip_local_deliver_finish+0xba0/0xba0
[   29.518180]  ? ip_local_deliver+0x6e0/0x6e0
[   29.522477]  __netif_receive_skb_core+0x19af/0x33d0
[   29.527472]  ? print_usage_bug+0x480/0x480
[   29.531690]  ? nf_ingress+0x9f0/0x9f0
[   29.535463]  ? kasan_kmalloc+0xad/0xe0
[   29.539321]  ? kmem_cache_alloc+0x12e/0x760
[   29.543613]  ? __build_skb+0x9d/0x450
[   29.547383]  ? build_skb+0x6f/0x260
[   29.550981]  ? tun_build_skb.isra.42+0x92f/0x1690
[   29.555798]  ? tun_get_user+0x1dad/0x2150
[   29.559915]  ? tun_chr_write_iter+0xde/0x190
[   29.564294]  ? __vfs_write+0x68a/0x970
[   29.568151]  ? __skb_flow_get_ports+0x151/0x400
[   29.572792]  ? skb_flow_dissector_init+0x280/0x280
[   29.577697]  ? check_noncircular+0x20/0x20
[   29.581901]  ? __skb_flow_get_ports+0x151/0x400
[   29.586545]  ? __skb_flow_dissect+0x85b/0x3bc0
[   29.591115]  ? find_held_lock+0x39/0x1d0
[   29.595159]  ? lock_downgrade+0x990/0x990
[   29.599279]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   29.604446]  ? lock_acquire+0x1d5/0x580
[   29.608390]  ? netif_receive_skb_internal+0x1d7/0x670
[   29.613568]  ? pvclock_read_flags+0x160/0x160
[   29.618044]  ? tun_build_skb.isra.42+0x455/0x1690
[   29.622866]  ? lock_acquire+0x1d5/0x580
[   29.626812]  ? netif_receive_skb_internal+0xa2/0x670
[   29.631903]  ? ktime_get_with_offset+0x2c1/0x420
[   29.636638]  ? lock_release+0xd70/0xd70
[   29.640582]  ? ktime_get+0x3a0/0x3a0
[   29.644272]  ? skb_put+0x149/0x1c0
[   29.647793]  __netif_receive_skb+0x2c/0x1b0
[   29.652089]  ? __netif_receive_skb+0x2c/0x1b0
[   29.656556]  netif_receive_skb_internal+0x10b/0x670
[   29.661546]  ? dev_cpu_dead+0xb00/0xb00
[   29.665496]  ? lock_release+0xd70/0xd70
[   29.669440]  ? __read_once_size_nocheck.constprop.8+0x10/0x10
[   29.675295]  ? is_bpf_text_address+0x7b/0x120
[   29.679767]  ? rcu_pm_notify+0xc0/0xc0
[   29.683640]  netif_receive_skb+0xae/0x390
[   29.687762]  ? netif_receive_skb_internal+0x670/0x670
[   29.692926]  ? lock_downgrade+0x990/0x990
[   29.697050]  ? tun_rx_batched.isra.43+0x5c3/0x860
[   29.701869]  tun_rx_batched.isra.43+0x5ed/0x860
[   29.706510]  ? skb_get_hash_perturb+0x9d0/0x9d0
[   29.711153]  ? tun_sock_write_space+0x370/0x370
[   29.715811]  tun_get_user+0x11dd/0x2150
[   29.719773]  ? tun_build_skb.isra.42+0x1690/0x1690
[   29.724676]  ? lock_release+0xd70/0xd70
[   29.728628]  ? tun_chr_close+0x60/0x60
[   29.732493]  ? lock_release+0xd70/0xd70
[   29.736441]  ? __lock_is_held+0xbc/0x140
[   29.740487]  ? __tun_get+0x1d4/0x2e0
[   29.744174]  ? tun_chr_close+0x60/0x60
[   29.748042]  tun_chr_write_iter+0xde/0x190
[   29.752252]  __vfs_write+0x68a/0x970
[   29.755942]  ? kernel_read+0x120/0x120
[   29.759814]  ? avc_policy_seqno+0x9/0x20
[   29.763846]  ? selinux_file_permission+0x82/0x460
[   29.768670]  ? rw_verify_area+0xe5/0x2b0
[   29.772701]  ? __fdget_raw+0x20/0x20
[   29.776393]  vfs_write+0x18f/0x510
[   29.779912]  SyS_write+0xef/0x220
[   29.783343]  ? SyS_read+0x220/0x220
[   29.786941]  ? lock_acquire+0x1d5/0x580
[   29.790890]  ? finish_task_switch+0x1aa/0x740
[   29.795357]  ? do_fast_syscall_32+0x158/0xeed
[   29.799826]  ? SyS_read+0x220/0x220
[   29.803425]  do_fast_syscall_32+0x3f2/0xeed
[   29.807719]  ? compat_start_thread+0x80/0x80
[   29.812103]  ? do_int80_syscall_32+0x930/0x930
[   29.816664]  ? lockdep_sys_exit+0x47/0xf0
[   29.820784]  ? syscall_return_slowpath+0x2b3/0x500
[   29.825684]  ? finish_task_switch+0x1aa/0x740
[   29.830153]  ? prepare_exit_to_usermode+0x2c0/0x2c0
[   29.835145]  ? sysret32_from_system_call+0x5/0x3b
[   29.839979]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   29.844800]  entry_SYSENTER_compat+0x51/0x60
[   29.849180] RIP: 0023:0xf7f29c79
[   29.852516] RSP: 002b:00000000f2f1b1f4 EFLAGS: 00000292 ORIG_RAX: 0000000000000004
[   29.860199] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020002000
[   29.867450] RDX: 0000000000000046 RSI: 0000000000000000 RDI: 00000000003d0f00
[   29.874692] RBP: 00000000f2f1b2e8 R08: 0000000000000000 R09: 0000000000000000
[   29.881941] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[   29.889187] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   29.896447] 
[   29.898046] The buggy address belongs to the page:
[   29.902946] page:ffffea0007345d80 count:0 mapcount:0 mapping:          (null) index:0x0
[   29.911063] flags: 0x200000000000000()
[   29.914923] raw: 0200000000000000 0000000000000000 0000000000000000 00000000ffffffff
[   29.922774] raw: 0000000000000000 dead000000000200 0000000000000000 0000000000000000
[   29.930623] page dumped because: kasan: bad access detected
[   29.936300] 
[   29.937896] Memory state around the buggy address:
[   29.942794]  ffff8801cd176600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   29.950124]  ffff8801cd176680: 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 00
[   29.957454] >ffff8801cd176700: 00 f2 f3 f3 f3 f3 00 00 00 00 00 00 00 f1 f1 f1
[   29.964781]                       ^