[....] Starting enhanced syslogd: rsyslogd[ 16.942438] audit: type=1400 audit(1521025373.817:5): avc: denied { syslog } for pid=4093 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 22.485153] audit: type=1400 audit(1521025379.359:6): avc: denied { map } for pid=4234 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.48' (ECDSA) to the list of known hosts. [ 28.809239] audit: type=1400 audit(1521025385.684:7): avc: denied { map } for pid=4248 comm="syzkaller157144" path="/root/syzkaller157144191" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 28.820144] IPVS: ftp: loaded support on port[0] = 21 net.ipv6.conf.syz_tun.accept_dad = 0 net.ipv6.conf.syz_tun.router_solicitations = 0 [ 28.835174] audit: type=1400 audit(1521025385.684:8): avc: denied { sys_admin } for pid=4248 comm="syzkaller157144" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 28.868115] audit: type=1400 audit(1521025385.742:9): avc: denied { net_admin } for pid=4249 comm="syzkaller157144" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 RTNETLINK answers: File exists RTNETLINK answers: Operation not supported RTNETLINK answers: No buffer space available RTNETLINK answers: Operation not supported [ 29.106619] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Invalid argument RTNETLINK answers: Invalid argument RTNETLINK answers: Invalid argument [ 29.458797] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 29.464886] 8021q: adding VLAN 0 to HW filter on device bond0 executing program [ 29.502633] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 29.540968] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.550555] audit: type=1400 audit(1521025386.425:10): avc: denied { sys_chroot } for pid=4249 comm="syzkaller157144" capability=18 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 29.553845] ================================================================== [ 29.582513] BUG: KASAN: slab-out-of-bounds in ip6_xmit+0x1f76/0x2260 [ 29.588977] Read of size 8 at addr ffff8801cbef7218 by task syzkaller157144/4249 [ 29.596478] [ 29.598089] CPU: 0 PID: 4249 Comm: syzkaller157144 Not tainted 4.16.0-rc4+ #264 [ 29.605505] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.614830] Call Trace: [ 29.617394] dump_stack+0x194/0x24d [ 29.620994] ? arch_local_irq_restore+0x53/0x53 [ 29.625656] ? show_regs_print_info+0x18/0x18 [ 29.630134] ? ip6_xmit+0x1f76/0x2260 [ 29.633910] print_address_description+0x73/0x250 [ 29.638724] ? ip6_xmit+0x1f76/0x2260 [ 29.642498] kasan_report+0x23c/0x360 [ 29.646272] __asan_report_load8_noabort+0x14/0x20 [ 29.651181] ip6_xmit+0x1f76/0x2260 [ 29.654794] ? ip6_finish_output2+0x23d0/0x23d0 [ 29.659440] ? fl6_update_dst+0x127/0x2b0 [ 29.663561] ? inet6_csk_route_socket+0x691/0xe80 [ 29.668377] ? trace_hardirqs_off+0x10/0x10 [ 29.672672] ? lock_acquire+0x1d5/0x580 [ 29.676620] ? lock_acquire+0x1d5/0x580 [ 29.680569] ? inet6_csk_xmit+0x114/0x580 [ 29.684691] ? trace_hardirqs_off+0x10/0x10 [ 29.688987] ? lock_release+0xa40/0xa40 [ 29.692950] inet6_csk_xmit+0x2fc/0x580 [ 29.696896] ? inet6_csk_update_pmtu+0x160/0x160 [ 29.701657] ? __sk_dst_check+0x1a5/0x380 [ 29.705781] ? sock_kzfree_s+0x60/0x60 [ 29.709659] l2tp_xmit_skb+0x105f/0x1410 [ 29.713702] ? l2tp_session_create+0xb80/0xb80 [ 29.718257] ? sock_wmalloc+0x15d/0x1d0 [ 29.722202] ? iov_iter_advance+0x13f0/0x13f0 [ 29.726673] ? pppol2tp_sendmsg+0x41b/0x670 [ 29.730969] pppol2tp_sendmsg+0x470/0x670 [ 29.735092] ? selinux_socket_sendmsg+0x36/0x40 [ 29.739734] ? pppol2tp_getsockopt+0x900/0x900 [ 29.744286] sock_sendmsg+0xca/0x110 [ 29.747971] SYSC_sendto+0x361/0x5c0 [ 29.751660] ? SYSC_connect+0x4a0/0x4a0 [ 29.755617] ? inet_dgram_connect+0x172/0x1f0 [ 29.760086] ? SYSC_connect+0x2e0/0x4a0 [ 29.764062] ? mm_fault_error+0x2c0/0x2c0 [ 29.768180] ? move_addr_to_kernel+0x60/0x60 [ 29.772564] SyS_sendto+0x40/0x50 [ 29.775988] ? SyS_getpeername+0x30/0x30 [ 29.780034] do_syscall_64+0x281/0x940 [ 29.783893] ? __do_page_fault+0xc90/0xc90 [ 29.788101] ? _raw_spin_unlock_irq+0x27/0x70 [ 29.792574] ? finish_task_switch+0x1c1/0x7e0 [ 29.797041] ? syscall_return_slowpath+0x550/0x550 [ 29.801942] ? syscall_return_slowpath+0x2ac/0x550 [ 29.806842] ? prepare_exit_to_usermode+0x350/0x350 [ 29.811829] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 29.817167] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 29.821984] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 29.827142] RIP: 0033:0x441eb9 [ 29.830300] RSP: 002b:00000000007dfe68 EFLAGS: 00000216 ORIG_RAX: 000000000000002c [ 29.837979] RAX: ffffffffffffffda RBX: 000000000000001a RCX: 0000000000441eb9 [ 29.845224] RDX: 0000000000000000 RSI: 0000000020001180 RDI: 0000000000000004 [ 29.852467] RBP: 00000000004a3ee6 R08: 00000000200021c0 R09: 0000000000000080 [ 29.859707] R10: 0000000000040001 R11: 0000000000000216 R12: 00000000007dff70 [ 29.866945] R13: 0000000000402ef0 R14: 0000000000000000 R15: 0000000000000000 [ 29.874200] [ 29.875799] Allocated by task 0: [ 29.879133] (stack is not available) [ 29.882820] [ 29.884416] Freed by task 0: [ 29.887399] (stack is not available) [ 29.891077] [ 29.892686] The buggy address belongs to the object at ffff8801cbef7200 [ 29.892686] which belongs to the cache ip_dst_cache of size 160 [ 29.905398] The buggy address is located 24 bytes inside of [ 29.905398] 160-byte region [ffff8801cbef7200, ffff8801cbef72a0) [ 29.917152] The buggy address belongs to the page: [ 29.922055] page:ffffea00072fbdc0 count:1 mapcount:0 mapping:ffff8801cbef7000 index:0x0 [ 29.930167] flags: 0x2fffc0000000100(slab) [ 29.934371] raw: 02fffc0000000100 ffff8801cbef7000 0000000000000000 0000000100000010 [ 29.942220] raw: ffffea00075b90a0 ffff8801d5912648 ffff8801d6bb9340 0000000000000000 [ 29.950500] page dumped because: kasan: bad access detected [ 29.956175] [ 29.957773] Memory state around the buggy address: [ 29.962672] ffff8801cbef7100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 29.970000] ffff8801cbef7180: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc [ 29.977331] >ffff8801cbef7200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.984659] ^ [ 29.988773] ffff8801cbef7280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.996106] ffff8801cbef7300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.003434] ================================================================== [ 30.010759] Disabling lock debugging due to kernel taint [ 30.016216] Kernel panic - not syncing: panic_on_warn set ... [ 30.016216] [ 30.023557] CPU: 0 PID: 4249 Comm: syzkaller157144 Tainted: G B 4.16.0-rc4+ #264 [ 30.032271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 30.041592] Call Trace: [ 30.044151] dump_stack+0x194/0x24d [ 30.047750] ? arch_local_irq_restore+0x53/0x53 [ 30.052388] ? kasan_end_report+0x32/0x50 [ 30.056505] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 30.061232] ? vsnprintf+0x1ed/0x1900 [ 30.065003] ? ip6_xmit+0x1f40/0x2260 [ 30.068778] panic+0x1e4/0x41c [ 30.071938] ? refcount_error_report+0x214/0x214 [ 30.076662] ? add_taint+0x1c/0x50 [ 30.080495] ? add_taint+0x1c/0x50 [ 30.084007] ? ip6_xmit+0x1f76/0x2260 [ 30.087782] kasan_end_report+0x50/0x50 [ 30.091725] kasan_report+0x149/0x360 [ 30.095499] __asan_report_load8_noabort+0x14/0x20 [ 30.100397] ip6_xmit+0x1f76/0x2260 [ 30.103998] ? ip6_finish_output2+0x23d0/0x23d0 [ 30.108640] ? fl6_update_dst+0x127/0x2b0 [ 30.112758] ? inet6_csk_route_socket+0x691/0xe80 [ 30.117570] ? trace_hardirqs_off+0x10/0x10 [ 30.121859] ? lock_acquire+0x1d5/0x580 [ 30.125802] ? lock_acquire+0x1d5/0x580 [ 30.129743] ? inet6_csk_xmit+0x114/0x580 [ 30.133859] ? trace_hardirqs_off+0x10/0x10 [ 30.138154] ? lock_release+0xa40/0xa40 [ 30.142106] inet6_csk_xmit+0x2fc/0x580 [ 30.146051] ? inet6_csk_update_pmtu+0x160/0x160 [ 30.150775] ? __sk_dst_check+0x1a5/0x380 [ 30.154901] ? sock_kzfree_s+0x60/0x60 [ 30.158767] l2tp_xmit_skb+0x105f/0x1410 [ 30.162803] ? l2tp_session_create+0xb80/0xb80 [ 30.167353] ? sock_wmalloc+0x15d/0x1d0 [ 30.171295] ? iov_iter_advance+0x13f0/0x13f0 [ 30.175763] ? pppol2tp_sendmsg+0x41b/0x670 [ 30.180052] pppol2tp_sendmsg+0x470/0x670 [ 30.184172] ? selinux_socket_sendmsg+0x36/0x40 [ 30.188817] ? pppol2tp_getsockopt+0x900/0x900 [ 30.193375] sock_sendmsg+0xca/0x110 [ 30.197059] SYSC_sendto+0x361/0x5c0 [ 30.200750] ? SYSC_connect+0x4a0/0x4a0 [ 30.204701] ? inet_dgram_connect+0x172/0x1f0 [ 30.209168] ? SYSC_connect+0x2e0/0x4a0 [ 30.213126] ? mm_fault_error+0x2c0/0x2c0 [ 30.217243] ? move_addr_to_kernel+0x60/0x60 [ 30.221624] SyS_sendto+0x40/0x50 [ 30.225049] ? SyS_getpeername+0x30/0x30 [ 30.229082] do_syscall_64+0x281/0x940 [ 30.232937] ? __do_page_fault+0xc90/0xc90 [ 30.237138] ? _raw_spin_unlock_irq+0x27/0x70 [ 30.241605] ? finish_task_switch+0x1c1/0x7e0 [ 30.246070] ? syscall_return_slowpath+0x550/0x550 [ 30.250966] ? syscall_return_slowpath+0x2ac/0x550 [ 30.255864] ? prepare_exit_to_usermode+0x350/0x350 [ 30.260852] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 30.266185] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 30.270999] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 30.276160] RIP: 0033:0x441eb9 [ 30.279318] RSP: 002b:00000000007dfe68 EFLAGS: 00000216 ORIG_RAX: 000000000000002c [ 30.286993] RAX: ffffffffffffffda RBX: 000000000000001a RCX: 0000000000441eb9 [ 30.294234] RDX: 0000000000000000 RSI: 0000000020001180 RDI: 0000000000000004 [ 30.301474] RBP: 00000000004a3ee6 R08: 00000000200021c0 R09: 0000000000000080 [ 30.308712] R10: 0000000000040001 R11: 0000000000000216 R12: 00000000007dff70 [ 30.315949] R13: 0000000000402ef0 R14: 0000000000000000 R15: 0000000000000000 [ 30.323610] Dumping ftrace buffer: [ 30.327123] (ftrace buffer empty) [ 30.330801] Kernel Offset: disabled [ 30.334397] Rebooting in 86400 seconds..