INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-kasan-gce-386-4,10.128.15.204' (ECDSA) to the list of known hosts.
net.ipv6.conf.syz0.accept_dad = 0
net.ipv6.conf.syz0.router_solicitations = 0
executing program
syzkaller login: [   30.024150] ==================================================================
[   30.031562] BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x305b/0x3190
[   30.038722] Read of size 4 at addr ffff8801ce9d6708 by task syzkaller346283/3018
[   30.046223] 
[   30.047826] CPU: 0 PID: 3018 Comm: syzkaller346283 Not tainted 4.14.0-rc1+ #4
[   30.055067] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   30.064393] Call Trace:
[   30.066954]  dump_stack+0x194/0x257
[   30.070556]  ? arch_local_irq_restore+0x53/0x53
[   30.075198]  ? show_regs_print_info+0x65/0x65
[   30.079668]  ? lock_release+0xd70/0xd70
[   30.083613]  ? print_usage_bug+0x480/0x480
[   30.087821]  ? xfrm_state_find+0x305b/0x3190
[   30.092204]  print_address_description+0x73/0x250
[   30.097019]  ? xfrm_state_find+0x305b/0x3190
[   30.101401]  kasan_report+0x24e/0x340
[   30.105179]  __asan_report_load4_noabort+0x14/0x20
[   30.110079]  xfrm_state_find+0x305b/0x3190
[   30.114309]  ? xfrm_state_afinfo_get_rcu+0x160/0x160
[   30.119386]  ? print_usage_bug+0x480/0x480
[   30.123598]  ? __lock_acquire+0x732/0x4620
[   30.127823]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   30.133005]  ? __lock_acquire+0x732/0x4620
[   30.137222]  ? __lock_acquire+0x732/0x4620
[   30.141440]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   30.146612]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   30.151776]  ? check_noncircular+0x20/0x20
[   30.155980]  ? check_noncircular+0x20/0x20
[   30.160198]  xfrm_tmpl_resolve+0x2fb/0xbd0
[   30.164425]  ? __xfrm_decode_session+0x100/0x100
[   30.169162]  ? rcu_read_lock_sched_held+0x108/0x120
[   30.174152]  ? fib_table_lookup+0xa07/0x1a30
[   30.178538]  ? check_noncircular+0x20/0x20
[   30.182756]  xfrm_resolve_and_create_bundle+0x186/0x24b0
[   30.188180]  ? inet_netconf_get_devconf+0x4f0/0x4f0
[   30.193185]  ? xfrm_tmpl_resolve+0xbd0/0xbd0
[   30.197568]  ? lock_downgrade+0x990/0x990
[   30.201695]  ? xfrm_selector_match+0xe00/0xe00
[   30.206247]  ? rcu_read_lock_held+0xa9/0xc0
[   30.210541]  ? find_exception+0x3aa/0x520
[   30.214664]  ? lock_release+0xd70/0xd70
[   30.218615]  ? refcount_inc_not_zero+0xfe/0x180
[   30.223264]  ? xfrm_selector_match+0x3b/0xe00
[   30.227737]  ? xfrm_sk_policy_lookup+0x2cf/0x3d0
[   30.232470]  ? xfrm_selector_match+0xe00/0xe00
[   30.237025]  ? check_noncircular+0x20/0x20
[   30.241230]  ? ip_route_output_key_hash_rcu+0x604/0x2c20
[   30.246659]  xfrm_lookup+0xf0a/0x2540
[   30.250430]  ? xfrm_lookup+0xf0a/0x2540
[   30.254378]  ? ip_route_input_noref+0x1e0/0x1e0
[   30.259026]  ? xfrm_policy_lookup_bytype.constprop.49+0x16f0/0x16f0
[   30.265407]  ? find_held_lock+0x39/0x1d0
[   30.269455]  ? lock_downgrade+0x990/0x990
[   30.273575]  ? selinux_netlbl_sock_rcv_skb+0x9e/0x730
[   30.278743]  ? ip_route_output_key_hash+0x1a6/0x370
[   30.283738]  ? lock_release+0xd70/0xd70
[   30.287684]  ? selinux_nf_register+0x30/0x30
[   30.292072]  ? __lock_acquire+0x732/0x4620
[   30.296289]  ? selinux_sock_rcv_skb_compat+0x2f4/0x480
[   30.301546]  ? ip_route_output_key_hash+0x252/0x370
[   30.306538]  ? ip_route_output_key_hash_rcu+0x2c20/0x2c20
[   30.312055]  xfrm_lookup_route+0x39/0x1a0
[   30.316178]  ip_route_output_flow+0x7c/0xa0
[   30.320478]  inet_csk_route_req+0x5d8/0x990
[   30.324782]  tcp_v4_send_synack+0x1e4/0x270
[   30.329077]  ? tcp_v4_send_check+0x90/0x90
[   30.333293]  ? sk_filter_trim_cap+0x12f/0x9b0
[   30.337760]  ? prandom_u32_state+0x13/0x180
[   30.342058]  tcp_rtx_synack+0x119/0x2e0
[   30.346007]  ? tcp_event_new_data_sent+0x2e0/0x2e0
[   30.350912]  ? __lock_is_held+0xbc/0x140
[   30.354957]  inet_rtx_syn_ack+0x64/0xd0
[   30.358904]  tcp_check_req+0xaf5/0x1630
[   30.362857]  ? tcp_openreq_init_rwin+0xae0/0xae0
[   30.367598]  ? refcount_inc_not_zero+0xfe/0x180
[   30.372240]  ? refcount_add+0x60/0x60
[   30.376012]  ? tcp_v4_reqsk_send_ack+0x3e0/0x3e0
[   30.380745]  ? tcp_filter+0x111/0x160
[   30.384520]  tcp_v4_rcv+0x17b0/0x2f20
[   30.388297]  ? lock_acquire+0x1d5/0x580
[   30.392259]  ? tcp_v4_early_demux+0xa30/0xa30
[   30.396738]  ip_local_deliver_finish+0x2e2/0xba0
[   30.401471]  ? inet_del_offload+0x40/0x40
[   30.405605]  ? nf_hook_slow+0xd3/0x1a0
[   30.409474]  ip_local_deliver+0x1ce/0x6e0
[   30.413596]  ? ip_call_ra_chain+0x6d0/0x6d0
[   30.417901]  ? inet_del_offload+0x40/0x40
[   30.422029]  ip_rcv_finish+0x8db/0x19c0
[   30.425984]  ? ip_local_deliver_finish+0xba0/0xba0
[   30.430886]  ? iptable_nat_ipv4_fn+0x40/0x40
[   30.435273]  ? nf_nat_ipv4_in_range+0xf0/0xf0
[   30.439743]  ? ip_rcv+0xba0/0x17d0
[   30.443261]  ? tcp_v4_send_synack+0x270/0x270
[   30.447745]  ? nf_nat_ipv4_in+0x1cd/0x270
[   30.451863]  ? iptable_nat_ipv4_fn+0x40/0x40
[   30.456264]  ? nf_hook_slow+0xd3/0x1a0
[   30.460129]  ip_rcv+0xc3f/0x17d0
[   30.463475]  ? ip_local_deliver+0x6e0/0x6e0
[   30.467773]  ? __lock_acquire+0x732/0x4620
[   30.471990]  ? print_usage_bug+0x480/0x480
[   30.476208]  ? ip_local_deliver_finish+0xba0/0xba0
[   30.481115]  ? ip_local_deliver+0x6e0/0x6e0
[   30.485416]  __netif_receive_skb_core+0x19af/0x33d0
[   30.490407]  ? print_usage_bug+0x480/0x480
[   30.494626]  ? nf_ingress+0x9f0/0x9f0
[   30.498399]  ? kasan_kmalloc+0xad/0xe0
[   30.502261]  ? kmem_cache_alloc+0x12e/0x760
[   30.506566]  ? __build_skb+0x9d/0x450
[   30.510337]  ? build_skb+0x6f/0x260
[   30.513934]  ? tun_build_skb.isra.42+0x92f/0x1690
[   30.518747]  ? tun_get_user+0x1dad/0x2150
[   30.522863]  ? tun_chr_write_iter+0xde/0x190
[   30.527241]  ? __vfs_write+0x68a/0x970
[   30.531100]  ? __skb_flow_get_ports+0x151/0x400
[   30.535743]  ? skb_flow_dissector_init+0x280/0x280
[   30.540648]  ? check_noncircular+0x20/0x20
[   30.544853]  ? __skb_flow_get_ports+0x151/0x400
[   30.549498]  ? __skb_flow_dissect+0x85b/0x3bc0
[   30.554068]  ? find_held_lock+0x39/0x1d0
[   30.558113]  ? lock_downgrade+0x990/0x990
[   30.562235]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   30.567407]  ? lock_acquire+0x1d5/0x580
[   30.571353]  ? netif_receive_skb_internal+0x1d7/0x670
[   30.576530]  ? pvclock_read_flags+0x160/0x160
[   30.580997]  ? tun_build_skb.isra.42+0x455/0x1690
[   30.585834]  ? lock_acquire+0x1d5/0x580
[   30.589779]  ? netif_receive_skb_internal+0xa2/0x670
[   30.594858]  ? ktime_get_with_offset+0x2c1/0x420
[   30.599591]  ? lock_release+0xd70/0xd70
[   30.603535]  ? ktime_get+0x3a0/0x3a0
[   30.607226]  ? skb_put+0x149/0x1c0
[   30.610749]  __netif_receive_skb+0x2c/0x1b0
[   30.615040]  ? __netif_receive_skb+0x2c/0x1b0
[   30.619509]  netif_receive_skb_internal+0x10b/0x670
[   30.624500]  ? dev_cpu_dead+0xb00/0xb00
[   30.628446]  ? save_stack_trace+0x16/0x20
[   30.632565]  ? __lock_acquire+0x20fd/0x4620
[   30.636865]  ? rcu_pm_notify+0xc0/0xc0
[   30.640738]  netif_receive_skb+0xae/0x390
[   30.644858]  ? netif_receive_skb_internal+0x670/0x670
[   30.650023]  ? lock_downgrade+0x990/0x990
[   30.654148]  ? tun_rx_batched.isra.43+0x5c3/0x860
[   30.658967]  tun_rx_batched.isra.43+0x5ed/0x860
[   30.663608]  ? skb_get_hash_perturb+0x9d0/0x9d0
[   30.668250]  ? tun_sock_write_space+0x370/0x370
[   30.672908]  tun_get_user+0x11dd/0x2150
[   30.676869]  ? tun_build_skb.isra.42+0x1690/0x1690
[   30.681771]  ? lock_release+0xd70/0xd70
[   30.685732]  ? tun_chr_close+0x60/0x60
[   30.689601]  ? lock_release+0xd70/0xd70
[   30.693554]  ? __lock_is_held+0xbc/0x140
[   30.697601]  ? __tun_get+0x1d4/0x2e0
[   30.701286]  ? tun_chr_close+0x60/0x60
[   30.705156]  tun_chr_write_iter+0xde/0x190
[   30.709367]  __vfs_write+0x68a/0x970
[   30.713056]  ? kernel_read+0x120/0x120
[   30.716927]  ? avc_policy_seqno+0x9/0x20
[   30.720960]  ? selinux_file_permission+0x82/0x460
[   30.725785]  ? rw_verify_area+0xe5/0x2b0
[   30.729816]  ? __fdget_raw+0x20/0x20
[   30.733506]  vfs_write+0x18f/0x510
[   30.737023]  SyS_write+0xef/0x220
[   30.740454]  ? SyS_read+0x220/0x220
[   30.744056]  ? do_fast_syscall_32+0x158/0xeed
[   30.748526]  ? SyS_read+0x220/0x220
[   30.752126]  do_fast_syscall_32+0x3f2/0xeed
[   30.756429]  ? do_int80_syscall_32+0x930/0x930
[   30.760987]  ? lockdep_sys_exit+0x47/0xf0
[   30.765107]  ? syscall_return_slowpath+0x2b3/0x500
[   30.770021]  ? finish_task_switch+0x1aa/0x740
[   30.774493]  ? lockdep_sys_exit+0x47/0xf0
[   30.778614]  ? retint_user+0x18/0x20
[   30.782314]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   30.787150]  entry_SYSENTER_compat+0x51/0x60
[   30.791534] RIP: 0023:0xf7f35c79
[   30.794870] RSP: 002b:00000000f2f271f4 EFLAGS: 00000292 ORIG_RAX: 0000000000000004
[   30.802555] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020002000
[   30.809797] RDX: 0000000000000036 RSI: 0000000000000000 RDI: 00000000003d0f00
[   30.817038] RBP: 00000000f2f272e8 R08: 0000000000000000 R09: 0000000000000000
[   30.824285] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[   30.831529] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   30.838789] 
[   30.840393] The buggy address belongs to the page:
[   30.845295] page:ffffea00073a7580 count:0 mapcount:0 mapping:          (null) index:0xffff8801ce9d6880
[   30.854715] flags: 0x200000000000000()
[   30.858574] raw: 0200000000000000 0000000000000000 ffff8801ce9d6880 00000000ffffffff
[   30.866426] raw: dead000000000100 dead000000000200 0000000000000000 0000000000000000
[   30.874278] page dumped because: kasan: bad access detected
[   30.879955] 
[   30.881554] Memory state around the buggy address:
[   30.886454]  ffff8801ce9d6600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   30.893782]  ffff8801ce9d6680: 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 00
[   30.901112] >ffff8801ce9d6700: 00 f2 f3 f3 f3 f3 00 00 00 00 00 00 00 f1 f1 f1
[   30.908443]                       ^
[   30.912038]  ffff8801ce9d6780: f1 00 00 00 00 00 00 00 00 00 00 00 f2 f3 f3 f3
[   30.919369]  ffff8801ce9d6800: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   30.926704] ==================================================================
[   30.934031] Disabling lock debugging due to kernel taint
[   30.939482] Kernel panic - not syncing: panic_on_warn set ...
[   30.939482] 
[   30.946810] CPU: 0 PID: 3018 Comm: syzkaller346283 Tainted: G    B           4.14.0-rc1+ #4
[   30.955260] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   30.964579] Call Trace:
[   30.967135]  dump_stack+0x194/0x257
[   30.970730]  ? arch_local_irq_restore+0x53/0x53
[   30.975366]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   30.980090]  ? xfrm_state_find+0x2fc0/0x3190
[   30.984468]  panic+0x1e4/0x417
[   30.987628]  ? __warn+0x1d9/0x1d9
[   30.991749]  ? xfrm_state_find+0x305b/0x3190
[   30.996125]  kasan_end_report+0x50/0x50
[   31.000065]  kasan_report+0x137/0x340
[   31.003832]  __asan_report_load4_noabort+0x14/0x20
[   31.008724]  xfrm_state_find+0x305b/0x3190
[   31.012937]  ? xfrm_state_afinfo_get_rcu+0x160/0x160
[   31.018007]  ? print_usage_bug+0x480/0x480
[   31.022209]  ? __lock_acquire+0x732/0x4620