[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. [ OK ] Started Update UTMP about System Runlevel Changes. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.5' (ECDSA) to the list of known hosts. syzkaller login: [ 42.252423] audit: type=1400 audit(1601953488.473:8): avc: denied { execmem } for pid=6490 comm="syz-executor174" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 42.720397] skbuff: skb_over_panic: text:00000000a4992447 len:232 put:72 head:00000000b2795519 data:00000000b2795519 tail:0xe8 end:0xc0 dev: [ 42.938799] ------------[ cut here ]------------ [ 42.943589] kernel BUG at net/core/skbuff.c:104! [ 43.119556] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 43.124977] CPU: 0 PID: 6511 Comm: syz-executor174 Not tainted 4.19.149-syzkaller #0 [ 43.132854] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 43.142221] RIP: 0010:skb_panic+0x158/0x1e0 [ 43.146548] Code: 01 84 c0 74 04 3c 03 7e 33 8b 8b 80 00 00 00 41 56 45 89 e8 48 c7 c7 e0 89 b4 88 41 57 56 48 89 ee 52 4c 89 e2 e8 27 84 47 fb <0f> 0b 48 c7 c7 40 3c dd 8a 48 83 c4 20 e8 d6 53 a2 fd 4c 89 4c 24 [ 43.165450] RSP: 0018:ffff8880a703efb0 EFLAGS: 00010286 [ 43.170811] RAX: 0000000000000086 RBX: ffff8880a38c4c00 RCX: 0000000000000000 [ 43.178086] RDX: 0000000000000000 RSI: ffffffff815b623f RDI: ffffed1014e07de8 [ 43.185355] RBP: ffffffff88b494e0 R08: 0000000000000086 R09: 0000000000000000 [ 43.192623] R10: 0000000000000005 R11: 0000000000000000 R12: ffffffff86d00743 [ 43.199895] R13: 0000000000000048 R14: ffffffff88b489a0 R15: 00000000000000c0 [ 43.207167] FS: 00007f41b7f65700(0000) GS:ffff8880ae200000(0000) knlGS:0000000000000000 [ 43.215416] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 43.221294] CR2: 00007ffd55686a20 CR3: 0000000091423000 CR4: 00000000001406f0 [ 43.228566] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 43.235842] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 43.243109] Call Trace: [ 43.245729] ? pfkey_send_acquire+0x1853/0x2540 [ 43.250405] skb_put+0x183/0x1c0 [ 43.253779] pfkey_send_acquire+0x1853/0x2540 [ 43.258282] km_query+0xe2/0x240 [ 43.261657] xfrm_state_find+0x1c58/0x2c90 [ 43.265903] ? xfrm_state_afinfo_get_rcu+0x120/0x120 [ 43.271019] xfrm_tmpl_resolve+0x2f3/0xc50 [ 43.275263] ? xfrm_net_init+0xa70/0xa70 [ 43.279331] ? find_held_lock+0x2d/0x110 [ 43.283393] ? xfrm_sk_policy_lookup+0x538/0x710 [ 43.288154] ? lock_downgrade+0x750/0x750 [ 43.292313] xfrm_resolve_and_create_bundle+0xd8/0x3e0 [ 43.297620] ? xfrm_tmpl_resolve+0xc50/0xc50 [ 43.302033] ? xfrm_sk_policy_lookup+0x55f/0x710 [ 43.306793] ? xfrm_selector_match+0xf90/0xf90 [ 43.311380] ? xfrm_expand_policies+0x418/0x5e0 [ 43.316055] xfrm_lookup_with_ifid+0x241/0x1f60 [ 43.320731] ? lock_downgrade+0x750/0x750 [ 43.324911] ? lock_acquire+0x170/0x3f0 [ 43.328917] ? xfrm_expand_policies+0x5e0/0x5e0 [ 43.333606] ? check_preemption_disabled+0x41/0x2b0 [ 43.338629] ? ip_route_output_key_hash+0x257/0x350 [ 43.343651] ? ip_route_output_key_hash_rcu+0x31b0/0x31b0 [ 43.349197] xfrm_lookup_route+0x36/0x200 [ 43.353373] ip_route_output_flow+0xa6/0xc0 [ 43.357704] udp_sendmsg+0x19fc/0x2530 [ 43.361598] ? ip_do_fragment+0x2210/0x2210 [ 43.365929] ? udp_destroy_sock+0x1a0/0x1a0 [ 43.370289] ? rw_copy_check_uvector+0x27c/0x340 [ 43.375058] ? __might_fault+0x192/0x1d0 [ 43.379124] ? __sock_recv_ts_and_drops+0x540/0x540 [ 43.384178] inet_sendmsg+0x174/0x640 [ 43.387983] ? security_socket_sendmsg+0x83/0xb0 [ 43.392743] ? inet_sock_destruct+0x800/0x800 [ 43.397249] sock_sendmsg+0xc7/0x130 [ 43.400982] ___sys_sendmsg+0x3b3/0x8f0 [ 43.404992] ? copy_msghdr_from_user+0x440/0x440 [ 43.409755] ? mark_held_locks+0xa6/0xf0 [ 43.413821] ? mark_held_locks+0xf0/0xf0 [ 43.417885] ? lockdep_hardirqs_on+0x3c1/0x5e0 [ 43.422494] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 43.427257] ? find_held_lock+0x2d/0x110 [ 43.431322] ? __might_fault+0x11f/0x1d0 [ 43.435389] ? lock_downgrade+0x750/0x750 [ 43.439561] ? lock_acquire+0x170/0x3f0 [ 43.443538] ? __might_fault+0xef/0x1d0 [ 43.447522] __sys_sendmmsg+0x195/0x470 [ 43.451501] ? __ia32_sys_sendmsg+0x220/0x220 [ 43.456006] ? ip_setsockopt+0x5e/0xf0 [ 43.459904] ? __se_sys_futex+0x2af/0x3d0 [ 43.464056] ? __se_sys_futex+0x2b8/0x3d0 [ 43.468210] ? do_futex+0x1c60/0x1c60 [ 43.472017] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 43.477387] __x64_sys_sendmmsg+0x99/0x100 [ 43.481622] ? lockdep_hardirqs_on+0x3c1/0x5e0 [ 43.486211] do_syscall_64+0xf9/0x670 [ 43.490017] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 43.495227] RIP: 0033:0x447239 [ 43.498423] Code: e8 dc e6 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 ab 05 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 43.517323] RSP: 002b:00007f41b7f64da8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 43.525034] RAX: ffffffffffffffda RBX: 00000000006dcc58 RCX: 0000000000447239 [ 43.532329] RDX: 000000000800001d RSI: 0000000020007fc0 RDI: 0000000000000003 [ 43.539597] RBP: 00000000006dcc50 R08: 0000000000000000 R09: 0000000000000000 [ 43.546869] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dcc5c [ 43.554167] R13: 0000000000000002 R14: 0000000009000702 R15: 0000000000000005 [ 43.561442] Modules linked in: [ 45.248492] ---[ end trace 6f0428ae9617ecfc ]--- [ 45.253335] RIP: 0010:skb_panic+0x158/0x1e0 [ 45.257660] Code: 01 84 c0 74 04 3c 03 7e 33 8b 8b 80 00 00 00 41 56 45 89 e8 48 c7 c7 e0 89 b4 88 41 57 56 48 89 ee 52 4c 89 e2 e8 27 84 47 fb <0f> 0b 48 c7 c7 40 3c dd 8a 48 83 c4 20 e8 d6 53 a2 fd 4c 89 4c 24 [ 45.278330] RSP: 0018:ffff8880a703efb0 EFLAGS: 00010286 [ 45.284225] RAX: 0000000000000086 RBX: ffff8880a38c4c00 RCX: 0000000000000000 [ 45.292863] RDX: 0000000000000000 RSI: ffffffff815b623f RDI: ffffed1014e07de8 [ 45.300141] RBP: ffffffff88b494e0 R08: 0000000000000086 R09: 0000000000000000 [ 45.308305] R10: 0000000000000005 R11: 0000000000000000 R12: ffffffff86d00743 [ 45.316088] R13: 0000000000000048 R14: ffffffff88b489a0 R15: 00000000000000c0 [ 45.323916] FS: 00007f41b7f65700(0000) GS:ffff8880ae200000(0000) knlGS:0000000000000000 [ 45.340352] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 45.346248] CR2: 00007f15702fa000 CR3: 0000000091423000 CR4: 00000000001406f0 [ 45.355224] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 45.362929] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 45.370191] Kernel panic - not syncing: Fatal exception [ 45.376640] Kernel Offset: disabled [ 45.380256] Rebooting in 86400 seconds..