[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 22.336546] audit: type=1400 audit(1520717834.594:6): avc: denied { map } for pid=4246 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 22.366384] sshd (4243) used greatest stack depth: 16584 bytes left Warning: Permanently added '10.128.0.31' (ECDSA) to the list of known hosts. executing program [ 57.855869] audit: type=1400 audit(1520717870.113:7): avc: denied { map } for pid=4262 comm="syzkaller285424" path="/root/syzkaller285424264" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 57.859665] ================================================================== [ 57.889147] BUG: KASAN: slab-out-of-bounds in pfkey_add+0x1634/0x3270 [ 57.895696] Read of size 2368 at addr ffff8801ad680a80 by task syzkaller285424/4262 [ 57.903456] [ 57.905057] CPU: 0 PID: 4262 Comm: syzkaller285424 Not tainted 4.16.0-rc4+ #260 [ 57.912472] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 57.921795] Call Trace: [ 57.924360] dump_stack+0x194/0x24d [ 57.927964] ? arch_local_irq_restore+0x53/0x53 [ 57.932604] ? show_regs_print_info+0x18/0x18 [ 57.937074] ? __lock_is_held+0xb6/0x140 [ 57.941113] ? pfkey_add+0x1634/0x3270 [ 57.944984] print_address_description+0x73/0x250 [ 57.949801] ? pfkey_add+0x1634/0x3270 [ 57.953664] kasan_report+0x23c/0x360 [ 57.957444] check_memory_region+0x137/0x190 [ 57.961824] memcpy+0x23/0x50 [ 57.964903] pfkey_add+0x1634/0x3270 [ 57.968598] ? set_ipsecrequest+0x310/0x310 [ 57.972894] ? lock_release+0xa40/0xa40 [ 57.976840] ? set_ipsecrequest+0x310/0x310 [ 57.981134] pfkey_process+0x67e/0x740 [ 57.985000] ? pfkey_send_new_mapping+0x11b0/0x11b0 [ 57.989988] ? kasan_check_write+0x14/0x20 [ 57.994212] ? dup_iter+0x182/0x260 [ 57.997815] pfkey_sendmsg+0x4dc/0xa00 [ 58.001677] ? pfkey_spdget+0xb00/0xb00 [ 58.005624] ? selinux_socket_sendmsg+0x36/0x40 [ 58.010269] ? security_socket_sendmsg+0x89/0xb0 [ 58.015003] ? pfkey_spdget+0xb00/0xb00 [ 58.018962] sock_sendmsg+0xca/0x110 [ 58.022666] ___sys_sendmsg+0x767/0x8b0 [ 58.026618] ? SyS_membarrier+0x700/0x700 [ 58.030740] ? copy_msghdr_from_user+0x590/0x590 [ 58.035476] ? __pmd_alloc+0x4e0/0x4e0 [ 58.039345] ? trace_hardirqs_off+0x10/0x10 [ 58.043641] ? find_held_lock+0x35/0x1d0 [ 58.047683] ? __fget_light+0x2b2/0x3c0 [ 58.051629] ? fget_raw+0x20/0x20 [ 58.055057] ? find_held_lock+0x35/0x1d0 [ 58.059099] ? __do_page_fault+0x5f7/0xc90 [ 58.063303] ? lock_downgrade+0x980/0x980 [ 58.067428] __sys_sendmsg+0xe5/0x210 [ 58.071204] ? __sys_sendmsg+0xe5/0x210 [ 58.075152] ? SyS_shutdown+0x290/0x290 [ 58.079118] ? __do_page_fault+0x3d6/0xc90 [ 58.083331] ? move_addr_to_kernel+0x60/0x60 [ 58.087714] SyS_sendmsg+0x2d/0x50 [ 58.091227] ? __sys_sendmsg+0x210/0x210 [ 58.095261] do_syscall_64+0x281/0x940 [ 58.099115] ? __do_page_fault+0xc90/0xc90 [ 58.103320] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 58.108047] ? syscall_return_slowpath+0x550/0x550 [ 58.112948] ? syscall_return_slowpath+0x2ac/0x550 [ 58.117847] ? prepare_exit_to_usermode+0x350/0x350 [ 58.122845] ? retint_user+0x18/0x18 [ 58.126534] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 58.131352] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 58.136513] RIP: 0033:0x43fd19 [ 58.139672] RSP: 002b:00007ffe3a969de8 EFLAGS: 00000213 ORIG_RAX: 000000000000002e [ 58.147351] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fd19 [ 58.154594] RDX: 0000000000000000 RSI: 0000000020b6dfc8 RDI: 0000000000000003 [ 58.161837] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 58.169079] R10: 00000000004002c8 R11: 0000000000000213 R12: 0000000000401640 [ 58.176323] R13: 00000000004016d0 R14: 0000000000000000 R15: 0000000000000000 [ 58.183589] [ 58.185193] Allocated by task 4262: [ 58.188795] save_stack+0x43/0xd0 [ 58.192216] kasan_kmalloc+0xad/0xe0 [ 58.195898] __kmalloc_node_track_caller+0x47/0x70 [ 58.200799] __kmalloc_reserve.isra.39+0x41/0xd0 [ 58.205523] __alloc_skb+0x13b/0x780 [ 58.209208] pfkey_sendmsg+0x20f/0xa00 [ 58.213077] sock_sendmsg+0xca/0x110 [ 58.216760] ___sys_sendmsg+0x767/0x8b0 [ 58.220702] __sys_sendmsg+0xe5/0x210 [ 58.224471] SyS_sendmsg+0x2d/0x50 [ 58.227988] do_syscall_64+0x281/0x940 [ 58.231845] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 58.237003] [ 58.238598] Freed by task 0: [ 58.241584] (stack is not available) [ 58.245264] [ 58.246865] The buggy address belongs to the object at ffff8801ad680a40 [ 58.246865] which belongs to the cache kmalloc-512 of size 512 [ 58.259491] The buggy address is located 64 bytes inside of [ 58.259491] 512-byte region [ffff8801ad680a40, ffff8801ad680c40) [ 58.271243] The buggy address belongs to the page: [ 58.276146] page:ffffea0006b5a000 count:1 mapcount:0 mapping:ffff8801ad680040 index:0x0 [ 58.284258] flags: 0x2fffc0000000100(slab) [ 58.288463] raw: 02fffc0000000100 ffff8801ad680040 0000000000000000 0000000100000006 [ 58.296333] raw: ffffea0006c13660 ffff8801dac01748 ffff8801dac00940 0000000000000000 [ 58.304180] page dumped because: kasan: bad access detected [ 58.309854] [ 58.311449] Memory state around the buggy address: [ 58.316348] ffff8801ad680b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 58.323696] ffff8801ad680b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 58.331022] >ffff8801ad680c00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 58.338347] ^ [ 58.343763] ffff8801ad680c80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 58.351092] ffff8801ad680d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 58.358438] ================================================================== [ 58.365766] Disabling lock debugging due to kernel taint [ 58.371298] Kernel panic - not syncing: panic_on_warn set ... [ 58.371298] [ 58.378632] CPU: 0 PID: 4262 Comm: syzkaller285424 Tainted: G B 4.16.0-rc4+ #260 [ 58.387351] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 58.396674] Call Trace: [ 58.399243] dump_stack+0x194/0x24d [ 58.402842] ? arch_local_irq_restore+0x53/0x53 [ 58.407480] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 58.412206] ? vsnprintf+0x1ed/0x1900 [ 58.415978] ? pfkey_add+0x15e0/0x3270 [ 58.419833] panic+0x1e4/0x41c [ 58.422994] ? refcount_error_report+0x214/0x214 [ 58.427720] ? add_taint+0x1c/0x50 [ 58.431228] ? add_taint+0x1c/0x50 [ 58.434739] ? pfkey_add+0x1634/0x3270 [ 58.438596] kasan_end_report+0x50/0x50 [ 58.442538] kasan_report+0x149/0x360 [ 58.446312] check_memory_region+0x137/0x190 [ 58.450697] memcpy+0x23/0x50 [ 58.453772] pfkey_add+0x1634/0x3270 [ 58.457460] ? set_ipsecrequest+0x310/0x310 [ 58.461750] ? lock_release+0xa40/0xa40 [ 58.465691] ? set_ipsecrequest+0x310/0x310 [ 58.469982] pfkey_process+0x67e/0x740 [ 58.473840] ? pfkey_send_new_mapping+0x11b0/0x11b0 [ 58.478823] ? kasan_check_write+0x14/0x20 [ 58.483048] ? dup_iter+0x182/0x260 [ 58.486647] pfkey_sendmsg+0x4dc/0xa00 [ 58.490507] ? pfkey_spdget+0xb00/0xb00 [ 58.494454] ? selinux_socket_sendmsg+0x36/0x40 [ 58.499094] ? security_socket_sendmsg+0x89/0xb0 [ 58.503820] ? pfkey_spdget+0xb00/0xb00 [ 58.507764] sock_sendmsg+0xca/0x110 [ 58.511467] ___sys_sendmsg+0x767/0x8b0 [ 58.515413] ? SyS_membarrier+0x700/0x700 [ 58.519532] ? copy_msghdr_from_user+0x590/0x590 [ 58.524261] ? __pmd_alloc+0x4e0/0x4e0 [ 58.528126] ? trace_hardirqs_off+0x10/0x10 [ 58.532423] ? find_held_lock+0x35/0x1d0 [ 58.536462] ? __fget_light+0x2b2/0x3c0 [ 58.540410] ? fget_raw+0x20/0x20 [ 58.543833] ? find_held_lock+0x35/0x1d0 [ 58.547867] ? __do_page_fault+0x5f7/0xc90 [ 58.552071] ? lock_downgrade+0x980/0x980 [ 58.556198] __sys_sendmsg+0xe5/0x210 [ 58.559967] ? __sys_sendmsg+0xe5/0x210 [ 58.563908] ? SyS_shutdown+0x290/0x290 [ 58.567854] ? __do_page_fault+0x3d6/0xc90 [ 58.572060] ? move_addr_to_kernel+0x60/0x60 [ 58.576450] SyS_sendmsg+0x2d/0x50 [ 58.579958] ? __sys_sendmsg+0x210/0x210 [ 58.583989] do_syscall_64+0x281/0x940 [ 58.587851] ? __do_page_fault+0xc90/0xc90 [ 58.592053] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 58.596781] ? syscall_return_slowpath+0x550/0x550 [ 58.601681] ? syscall_return_slowpath+0x2ac/0x550 [ 58.606581] ? prepare_exit_to_usermode+0x350/0x350 [ 58.611568] ? retint_user+0x18/0x18 [ 58.615254] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 58.620071] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 58.625227] RIP: 0033:0x43fd19 [ 58.628383] RSP: 002b:00007ffe3a969de8 EFLAGS: 00000213 ORIG_RAX: 000000000000002e [ 58.636066] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fd19 [ 58.643303] RDX: 0000000000000000 RSI: 0000000020b6dfc8 RDI: 0000000000000003 [ 58.650540] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 58.657778] R10: 00000000004002c8 R11: 0000000000000213 R12: 0000000000401640 [ 58.665019] R13: 00000000004016d0 R14: 0000000000000000 R15: 0000000000000000 [ 58.672734] Dumping ftrace buffer: [ 58.676241] (ftrace buffer empty) [ 58.679920] Kernel Offset: disabled [ 58.683517] Rebooting in 86400 seconds..