INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added 'ci-upstream-mmots-kasan-gce-5,10.128.0.18' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 32.631614] ================================================================== [ 32.632742] BUG: KASAN: use-after-free in aead_recvmsg+0x1758/0x1bc0 [ 32.633614] Read of size 4 at addr ffff8801cb85a6dc by task syzkaller186484/3084 [ 32.634630] [ 32.634928] CPU: 0 PID: 3084 Comm: syzkaller186484 Not tainted 4.15.0-rc1-mm1+ #29 [ 32.635984] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 32.637220] Call Trace: [ 32.637579] dump_stack+0x194/0x257 [ 32.638076] ? arch_local_irq_restore+0x53/0x53 [ 32.638712] ? show_regs_print_info+0x65/0x65 [ 32.639318] ? af_alg_make_sg+0x510/0x510 [ 32.639873] ? aead_recvmsg+0x1758/0x1bc0 [ 32.640483] print_address_description+0x73/0x250 [ 32.641141] ? aead_recvmsg+0x1758/0x1bc0 [ 32.641697] kasan_report+0x25b/0x340 [ 32.642228] __asan_report_load4_noabort+0x14/0x20 [ 32.642881] aead_recvmsg+0x1758/0x1bc0 [ 32.643431] ? aead_release+0x50/0x50 [ 32.643945] ? selinux_socket_recvmsg+0x36/0x40 [ 32.644568] ? security_socket_recvmsg+0x91/0xc0 [ 32.645202] ? aead_release+0x50/0x50 [ 32.645714] sock_recvmsg+0xc9/0x110 [ 32.646273] sock_read_iter+0x361/0x560 [ 32.646808] ? sock_recvmsg+0x110/0x110 [ 32.647360] do_iter_readv_writev+0x607/0x7f0 [ 32.647962] ? vfs_dedupe_file_range+0x900/0x900 [ 32.648614] ? rw_verify_area+0xe5/0x2b0 [ 32.649178] do_iter_read+0x220/0x5b0 [ 32.649689] ? dup_iter+0x260/0x260 [ 32.650188] vfs_readv+0x121/0x1c0 [ 32.650668] ? __fget_light+0x29d/0x390 [ 32.651242] ? compat_rw_copy_check_uvector+0x2e0/0x2e0 [ 32.653335] ? up_read+0x1a/0x40 [ 32.656673] ? __do_page_fault+0x3d6/0xc90 [ 32.660876] ? task_work_run+0x1f4/0x270 [ 32.664913] ? mm_fault_error+0x2c0/0x2c0 [ 32.669027] ? __fdget+0x18/0x20 [ 32.672365] ? __fdget_pos+0x136/0x1a0 [ 32.676220] ? __fdget_raw+0x20/0x20 [ 32.679900] ? __do_page_fault+0xc90/0xc90 [ 32.684104] do_readv+0xfc/0x2a0 [ 32.687436] ? do_readv+0xfc/0x2a0 [ 32.690946] ? vfs_readv+0x1c0/0x1c0 [ 32.694627] ? entry_SYSCALL_64_fastpath+0x5/0x96 [ 32.699442] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 32.704431] SyS_readv+0x27/0x30 [ 32.707765] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 32.712484] RIP: 0033:0x43fed9 [ 32.715642] RSP: 002b:00007ffcb0a2fa58 EFLAGS: 00000217 ORIG_RAX: 0000000000000013 [ 32.723317] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fed9 [ 32.730555] RDX: 0000000000000001 RSI: 0000000020f40fe0 RDI: 0000000000000004 [ 32.737793] RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000 [ 32.745029] R10: 0000000000000000 R11: 0000000000000217 R12: 0000000000401840 [ 32.752271] R13: 00000000004018d0 R14: 0000000000000000 R15: 0000000000000000 [ 32.759531] [ 32.761125] Allocated by task 3084: [ 32.764723] save_stack+0x43/0xd0 [ 32.768140] kasan_kmalloc+0xad/0xe0 [ 32.771820] __kmalloc+0x162/0x760 [ 32.775332] crypto_create_tfm+0x82/0x2e0 [ 32.779443] crypto_alloc_tfm+0x10e/0x2f0 [ 32.783555] crypto_alloc_skcipher+0x2c/0x40 [ 32.787931] crypto_get_default_null_skcipher+0x5f/0x80 [ 32.793258] aead_bind+0x89/0x140 [ 32.796675] alg_bind+0x1ab/0x440 [ 32.800095] SYSC_bind+0x1b4/0x3f0 [ 32.803599] SyS_bind+0x24/0x30 [ 32.806844] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 32.811561] [ 32.813155] Freed by task 3084: [ 32.816416] save_stack+0x43/0xd0 [ 32.819835] kasan_slab_free+0x71/0xc0 [ 32.823687] kfree+0xca/0x250 [ 32.826757] kzfree+0x28/0x30 [ 32.829827] crypto_destroy_tfm+0x140/0x2e0 [ 32.834200] crypto_put_default_null_skcipher+0x35/0x60 [ 32.839529] aead_sock_destruct+0x13c/0x220 [ 32.843817] __sk_destruct+0xfd/0x910 [ 32.847588] sk_destruct+0x47/0x80 [ 32.851094] __sk_free+0x57/0x230 [ 32.854519] sk_free+0x2a/0x40 [ 32.857676] af_alg_release+0x5d/0x70 [ 32.861450] sock_release+0x8d/0x1e0 [ 32.865129] sock_close+0x16/0x20 [ 32.868550] __fput+0x333/0x7f0 [ 32.871795] ____fput+0x15/0x20 [ 32.875048] task_work_run+0x199/0x270 [ 32.878904] exit_to_usermode_loop+0x296/0x310 [ 32.883452] syscall_return_slowpath+0x490/0x550 [ 32.888186] entry_SYSCALL_64_fastpath+0x94/0x96 [ 32.892928] [ 32.894525] The buggy address belongs to the object at ffff8801cb85a6c0 [ 32.894525] which belongs to the cache kmalloc-128 of size 128 [ 32.907147] The buggy address is located 28 bytes inside of [ 32.907147] 128-byte region [ffff8801cb85a6c0, ffff8801cb85a740) [ 32.918916] The buggy address belongs to the page: [ 32.923811] page:0000000087ff96ef count:1 mapcount:0 mapping:00000000fd9db8bd index:0x0 [ 32.931921] flags: 0x2fffc0000000100(slab) [ 32.936124] raw: 02fffc0000000100 ffff8801cb85a000 0000000000000000 0000000100000015 [ 32.943970] raw: ffffea00072f08e0 ffffea0007305ae0 ffff8801db000640 0000000000000000 [ 32.951814] page dumped because: kasan: bad access detected [ 32.957486] [ 32.959076] Memory state around the buggy address: [ 32.963970] ffff8801cb85a580: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 32.971295] ffff8801cb85a600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.978617] >ffff8801cb85a680: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 32.985938] ^ [ 32.992220] ffff8801cb85a700: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 32.999541] ffff8801cb85a780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.006865] ================================================================== [ 33.014186] Disabling lock debugging due to kernel taint [ 33.019666] Kernel panic - not syncing: panic_on_warn set ... [ 33.019666] [ 33.026997] CPU: 0 PID: 3084 Comm: syzkaller186484 Tainted: G B 4.15.0-rc1-mm1+ #29 [ 33.035969] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 33.045288] Call Trace: [ 33.047847] dump_stack+0x194/0x257 [ 33.051439] ? arch_local_irq_restore+0x53/0x53 [ 33.056076] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 33.060886] ? vsnprintf+0x1ed/0x1900 [ 33.064662] ? aead_recvmsg+0x1710/0x1bc0 [ 33.068778] panic+0x1e4/0x41c [ 33.071938] ? refcount_error_report+0x214/0x214 [ 33.076661] ? add_taint+0x1c/0x50 [ 33.080163] ? add_taint+0x1c/0x50 [ 33.083669] ? aead_recvmsg+0x1758/0x1bc0 [ 33.087783] kasan_end_report+0x50/0x50 [ 33.091721] kasan_report+0x144/0x340 [ 33.095491] __asan_report_load4_noabort+0x14/0x20 [ 33.100386] aead_recvmsg+0x1758/0x1bc0 [ 33.104335] ? aead_release+0x50/0x50 [ 33.108100] ? selinux_socket_recvmsg+0x36/0x40 [ 33.112733] ? security_socket_recvmsg+0x91/0xc0 [ 33.117453] ? aead_release+0x50/0x50 [ 33.121220] sock_recvmsg+0xc9/0x110 [ 33.124899] sock_read_iter+0x361/0x560 [ 33.128840] ? sock_recvmsg+0x110/0x110 [ 33.132787] do_iter_readv_writev+0x607/0x7f0 [ 33.137255] ? vfs_dedupe_file_range+0x900/0x900 [ 33.141976] ? rw_verify_area+0xe5/0x2b0 [ 33.146000] do_iter_read+0x220/0x5b0 [ 33.149769] ? dup_iter+0x260/0x260 [ 33.153364] vfs_readv+0x121/0x1c0 [ 33.156870] ? __fget_light+0x29d/0x390 [ 33.160816] ? compat_rw_copy_check_uvector+0x2e0/0x2e0 [ 33.166146] ? up_read+0x1a/0x40 [ 33.169477] ? __do_page_fault+0x3d6/0xc90 [ 33.173675] ? task_work_run+0x1f4/0x270 [ 33.177702] ? mm_fault_error+0x2c0/0x2c0 [ 33.181812] ? __fdget+0x18/0x20 [ 33.185144] ? __fdget_pos+0x136/0x1a0 [ 33.189081] ? __fdget_raw+0x20/0x20 [ 33.192762] ? __do_page_fault+0xc90/0xc90 [ 33.196963] do_readv+0xfc/0x2a0 [ 33.200297] ? do_readv+0xfc/0x2a0 [ 33.203803] ? vfs_readv+0x1c0/0x1c0 [ 33.207481] ? entry_SYSCALL_64_fastpath+0x5/0x96 [ 33.212289] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 33.217272] SyS_readv+0x27/0x30 [ 33.220604] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 33.225326] RIP: 0033:0x43fed9 [ 33.228478] RSP: 002b:00007ffcb0a2fa58 EFLAGS: 00000217 ORIG_RAX: 0000000000000013 [ 33.236154] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fed9 [ 33.243389] RDX: 0000000000000001 RSI: 0000000020f40fe0 RDI: 0000000000000004 [ 33.250632] RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000 [ 33.257868] R10: 0000000000000000 R11: 0000000000000217 R12: 0000000000401840 [ 33.266056] R13: 00000000004018d0 R14: 0000000000000000 R15: 0000000000000000 [ 33.273332] Dumping ftrace buffer: [ 33.276839] (ftrace buffer empty) [ 33.280515] Kernel Offset: disabled [ 33.284108] Rebooting in 86400 seconds..