INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-mmots-kasan-gce-0,10.128.0.39' (ECDSA) to the list of known hosts.
net.ipv6.conf.syz0.accept_dad = 0
net.ipv6.conf.syz0.router_solicitations = 0
executing program
syzkaller login: [   22.666908] ==================================================================
[   22.674338] BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x305b/0x3190
[   22.681495] Read of size 4 at addr ffff8801ce1ee898 by task syzkaller210298/3015
[   22.688993] 
[   22.690594] CPU: 0 PID: 3015 Comm: syzkaller210298 Not tainted 4.14.0-rc2-mm1+ #9
[   22.698180] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   22.707504] Call Trace:
[   22.710061]  dump_stack+0x194/0x257
[   22.713662]  ? arch_local_irq_restore+0x53/0x53
[   22.718302]  ? show_regs_print_info+0x65/0x65
[   22.722771]  ? lock_release+0xd70/0xd70
[   22.726717]  ? xfrm_state_find+0x305b/0x3190
[   22.731099]  print_address_description+0x73/0x250
[   22.735910]  ? xfrm_state_find+0x305b/0x3190
[   22.740288]  kasan_report+0x25b/0x340
[   22.744076]  __asan_report_load4_noabort+0x14/0x20
[   22.748976]  xfrm_state_find+0x305b/0x3190
[   22.753202]  ? xfrm_state_afinfo_get_rcu+0x160/0x160
[   22.758276]  ? print_usage_bug+0x480/0x480
[   22.762503]  ? __lock_acquire+0x732/0x4620
[   22.766723]  ? __lock_acquire+0x732/0x4620
[   22.770929]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   22.776095]  ? __lock_acquire+0x732/0x4620
[   22.780307]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   22.785479]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   22.790642]  ? check_noncircular+0x20/0x20
[   22.794847]  ? check_noncircular+0x20/0x20
[   22.799060]  xfrm_tmpl_resolve+0x309/0xc00
[   22.803280]  ? __xfrm_decode_session+0x100/0x100
[   22.808013]  ? rcu_read_lock_sched_held+0x108/0x120
[   22.812999]  ? fib_table_lookup+0xa07/0x1a30
[   22.817382]  ? check_noncircular+0x20/0x20
[   22.821602]  xfrm_resolve_and_create_bundle+0x186/0x24b0
[   22.827043]  ? xfrm_tmpl_resolve+0xc00/0xc00
[   22.831426]  ? lock_downgrade+0x990/0x990
[   22.835551]  ? xfrm_selector_match+0xe00/0xe00
[   22.840105]  ? rcu_read_lock_held+0xa9/0xc0
[   22.844396]  ? find_exception+0x3aa/0x520
[   22.848516]  ? lock_release+0xd70/0xd70
[   22.852471]  ? refcount_inc_not_zero+0xfe/0x180
[   22.857116]  ? xfrm_selector_match+0x3b/0xe00
[   22.861589]  ? xfrm_sk_policy_lookup+0x2cf/0x3d0
[   22.866332]  ? xfrm_selector_match+0xe00/0xe00
[   22.870886]  ? check_noncircular+0x20/0x20
[   22.875090]  ? ip_route_output_key_hash_rcu+0x604/0x2c20
[   22.880516]  xfrm_lookup+0xf0a/0x2540
[   22.884296]  ? xfrm_lookup+0xf0a/0x2540
[   22.888241]  ? ip_route_input_noref+0x1e0/0x1e0
[   22.892884]  ? xfrm_policy_lookup_bytype.constprop.49+0x16f0/0x16f0
[   22.899266]  ? find_held_lock+0x39/0x1d0
[   22.903318]  ? lock_downgrade+0x990/0x990
[   22.907439]  ? selinux_netlbl_sock_rcv_skb+0x9e/0x730
[   22.912610]  ? ip_route_output_key_hash+0x1a6/0x370
[   22.917604]  ? lock_release+0xd70/0xd70
[   22.921551]  ? selinux_nf_register+0x30/0x30
[   22.925933]  ? __lock_acquire+0x732/0x4620
[   22.930140]  ? check_noncircular+0x20/0x20
[   22.934348]  ? selinux_sock_rcv_skb_compat+0x2f4/0x480
[   22.939604]  ? ip_route_output_key_hash+0x252/0x370
[   22.944595]  ? ip_route_output_key_hash_rcu+0x2c20/0x2c20
[   22.950112]  xfrm_lookup_route+0x39/0x1a0
[   22.954236]  ip_route_output_flow+0x7c/0xa0
[   22.958538]  inet_csk_route_req+0x5d8/0x990
[   22.962851]  tcp_v4_send_synack+0x1e4/0x270
[   22.967145]  ? tcp_v4_send_check+0x90/0x90
[   22.971358]  ? prandom_u32_state+0x13/0x180
[   22.975655]  tcp_rtx_synack+0x119/0x2e0
[   22.979599]  ? tcp_event_new_data_sent+0x2e0/0x2e0
[   22.984504]  ? __lock_is_held+0xbc/0x140
[   22.988554]  inet_rtx_syn_ack+0x64/0xd0
[   22.992505]  tcp_check_req+0xae3/0x1620
[   22.996459]  ? tcp_openreq_init_rwin+0xae0/0xae0
[   23.001183]  ? refcount_inc_not_zero+0xfe/0x180
[   23.005823]  ? refcount_add+0x60/0x60
[   23.009594]  ? tcp_v4_reqsk_send_ack+0x3e0/0x3e0
[   23.014326]  ? tcp_filter+0x111/0x160
[   23.018102]  tcp_v4_rcv+0x17ad/0x2f20
[   23.021879]  ? lock_acquire+0x1d5/0x580
[   23.025840]  ? tcp_v4_early_demux+0xa30/0xa30
[   23.030317]  ip_local_deliver_finish+0x2e2/0xba0
[   23.035049]  ? inet_del_offload+0x40/0x40
[   23.039174]  ? nf_hook_slow+0xd3/0x1a0
[   23.043039]  ip_local_deliver+0x1ce/0x6e0
[   23.047159]  ? ip_call_ra_chain+0x6d0/0x6d0
[   23.051465]  ? inet_del_offload+0x40/0x40
[   23.055591]  ip_rcv_finish+0x8db/0x19c0
[   23.059544]  ? ip_local_deliver_finish+0xba0/0xba0
[   23.064449]  ? iptable_nat_ipv4_fn+0x40/0x40
[   23.068848]  ? nf_nat_ipv4_in_range+0xf0/0xf0
[   23.073321]  ? ip_rcv+0xc60/0x17d0
[   23.076837]  ? tcp_v4_send_synack+0x270/0x270
[   23.081306]  ? nf_nat_ipv4_in+0x1cd/0x270
[   23.085424]  ? iptable_nat_ipv4_fn+0x40/0x40
[   23.089815]  ? nf_hook_slow+0xd3/0x1a0
[   23.093679]  ip_rcv+0xc3f/0x17d0
[   23.097023]  ? ip_local_deliver+0x6e0/0x6e0
[   23.101319]  ? __lock_acquire+0x732/0x4620
[   23.105544]  ? ip_local_deliver_finish+0xba0/0xba0
[   23.110451]  ? ip_local_deliver+0x6e0/0x6e0
[   23.114748]  __netif_receive_skb_core+0x19af/0x33d0
[   23.119736]  ? print_usage_bug+0x480/0x480
[   23.123952]  ? nf_ingress+0x9f0/0x9f0
[   23.127724]  ? save_stack+0x43/0xd0
[   23.131321]  ? kasan_slab_alloc+0x12/0x20
[   23.135440]  ? kmem_cache_alloc+0x12e/0x760
[   23.139732]  ? __build_skb+0x9d/0x450
[   23.143501]  ? build_skb+0x6f/0x260
[   23.147100]  ? tun_build_skb.isra.42+0x92f/0x1690
[   23.151910]  ? tun_get_user+0x1dad/0x2150
[   23.156025]  ? tun_chr_write_iter+0xde/0x190
[   23.160402]  ? vfs_write+0x18f/0x510
[   23.164090]  ? __skb_flow_get_ports+0x151/0x400
[   23.168731]  ? skb_flow_dissector_init+0x280/0x280
[   23.173636]  ? check_noncircular+0x20/0x20
[   23.177842]  ? __skb_flow_get_ports+0x151/0x400
[   23.182496]  ? __skb_flow_dissect+0x85b/0x3bc0
[   23.187046]  ? print_usage_bug+0x480/0x480
[   23.191266]  ? find_held_lock+0x39/0x1d0
[   23.195309]  ? lock_downgrade+0x990/0x990
[   23.199432]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   23.204600]  ? netif_receive_skb_internal+0x1d7/0x670
[   23.209775]  ? pvclock_read_flags+0x160/0x160
[   23.214240]  ? tun_build_skb.isra.42+0x455/0x1690
[   23.219061]  ? lock_acquire+0x1d5/0x580
[   23.223007]  ? netif_receive_skb_internal+0xa2/0x670
[   23.228082]  ? ktime_get_with_offset+0x2c1/0x420
[   23.232812]  ? lock_release+0xd70/0xd70
[   23.236757]  ? ktime_get+0x3a0/0x3a0
[   23.240450]  ? skb_put+0x149/0x1c0
[   23.243971]  __netif_receive_skb+0x2c/0x1b0
[   23.248620]  ? __netif_receive_skb+0x2c/0x1b0
[   23.253090]  netif_receive_skb_internal+0x10b/0x670
[   23.258076]  ? dev_cpu_dead+0xb00/0xb00
[   23.262029]  ? save_stack_trace+0x16/0x20
[   23.266147]  ? __lock_acquire+0x20fd/0x4620
[   23.270446]  ? kernel_text_address+0x102/0x140
[   23.275005]  ? rcu_pm_notify+0xc0/0xc0
[   23.278865]  ? unwind_get_return_address+0x61/0xa0
[   23.283777]  netif_receive_skb+0xae/0x390
[   23.287898]  ? netif_receive_skb_internal+0x670/0x670
[   23.293063]  ? lock_downgrade+0x990/0x990
[   23.297187]  ? tun_rx_batched.isra.43+0x5c3/0x860
[   23.302003]  tun_rx_batched.isra.43+0x5ed/0x860
[   23.306646]  ? skb_get_hash_perturb+0x9d0/0x9d0
[   23.311289]  ? tun_sock_write_space+0x370/0x370
[   23.315947]  tun_get_user+0x11dd/0x2150
[   23.319908]  ? tun_build_skb.isra.42+0x1690/0x1690
[   23.324809]  ? lock_release+0xd70/0xd70
[   23.328760]  ? tun_chr_close+0x60/0x60
[   23.332625]  ? lock_release+0xd70/0xd70
[   23.336575]  ? __lock_is_held+0xbc/0x140
[   23.340618]  ? __tun_get+0x1d4/0x2e0
[   23.344301]  ? tun_chr_close+0x60/0x60
[   23.348168]  tun_chr_write_iter+0xde/0x190
[   23.352377]  __vfs_write+0x68a/0x970
[   23.356064]  ? kernel_read+0x120/0x120
[   23.359930]  ? _cond_resched+0x14/0x30
[   23.363792]  ? avc_policy_seqno+0x9/0x20
[   23.367822]  ? selinux_file_permission+0x82/0x460
[   23.372644]  ? rw_verify_area+0xe5/0x2b0
[   23.376677]  ? __fdget_raw+0x20/0x20
[   23.380364]  vfs_write+0x18f/0x510
[   23.383879]  SyS_write+0xef/0x220
[   23.387305]  ? SyS_read+0x220/0x220
[   23.390900]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   23.395888]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   23.400623]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   23.405348] RIP: 0033:0x405b21
[   23.408511] RSP: 002b:00007f64851a6d90 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
[   23.416193] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000405b21
[   23.423444] RDX: 0000000000000036 RSI: 0000000020002000 RDI: 0000000000000003
[   23.430685] RBP: 0000000000000086 R08: 0000000000000013 R09: 00007f64851a7700
[   23.437924] R10: 00007f64851a79d0 R11: 0000000000000293 R12: 0000000000000000
[   23.445163] R13: 00007ffd841b52ff R14: 00007f64851a79c0 R15: 0000000000000000
[   23.452421] 
[   23.454019] The buggy address belongs to the page:
[   23.458920] page:ffffea0007387b80 count:0 mapcount:0 mapping:          (null) index:0xffff8801ce1ee200
[   23.468335] flags: 0x200000000000000()
[   23.472193] raw: 0200000000000000 0000000000000000 ffff8801ce1ee200 00000000ffffffff
[   23.480044] raw: 0000000000000000 dead000000000200 ffff8801dac00dc0 0000000000000000
[   23.487901] page dumped because: kasan: bad access detected
[   23.493576] 
[   23.495171] Memory state around the buggy address:
[   23.500067]  ffff8801ce1ee780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   23.507396]  ffff8801ce1ee800: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00
[   23.514725] >ffff8801ce1ee880: 00 00 00 f2 f3 f3 f3 f3 00 00 00 00 00 00 00 f1
[   23.522051]                             ^
[   23.526178]  ffff8801ce1ee900: f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 f2 f3
[   23.533508]  ffff8801ce1ee980: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00
[   23.540843] ==================================================================
[   23.548168] Disabling lock debugging due to kernel taint
[   23.553620] Kernel panic - not syncing: panic_on_warn set ...
[   23.553620] 
[   23.560947] CPU: 0 PID: 3015 Comm: syzkaller210298 Tainted: G    B           4.14.0-rc2-mm1+ #9
[   23.569743] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   23.579058] Call Trace:
[   23.581609]  dump_stack+0x194/0x257
[   23.585201]  ? arch_local_irq_restore+0x53/0x53
[   23.589836]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   23.594561]  ? xfrm_state_find+0x2f60/0x3190
[   23.598935]  panic+0x1e4/0x417
[   23.602092]  ? __warn+0x1d9/0x1d9
[   23.605518]  ? xfrm_state_find+0x305b/0x3190
[   23.609894]  kasan_end_report+0x50/0x50
[   23.613831]  kasan_report+0x144/0x340
[   23.617597]  __asan_report_load4_noabort+0x14/0x20
[   23.622491]  xfrm_state_find+0x305b/0x3190
[   23.626713]  ? xfrm_state_afinfo_get_rcu+0x160/0x160
[   23.631780]  ? print_usage_bug+0x480/0x480
[   23.635989]  ? __lock_acquire+0x732/0x4620
[   23.640196]  ? __lock_acquire+0x732/0x4620
[   23.644398]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   23.649557]  ? __lock_acquire+0x732/0x4620
[   23.653760]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   23.658919]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   23.664074]  ? check_noncircular+0x20/0x20