INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-kasan-gce-386-3,10.128.15.202' (ECDSA) to the list of known hosts.
net.ipv6.conf.syz0.accept_dad = 0
net.ipv6.conf.syz0.router_solicitations = 0
executing program
syzkaller login: [   45.535322] ==================================================================
[   45.542771] BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x305b/0x3190
[   45.549932] Read of size 4 at addr ffff8801cc8ee708 by task syzkaller075845/3020
[   45.557434] 
[   45.559041] CPU: 0 PID: 3020 Comm: syzkaller075845 Not tainted 4.14.0-rc2+ #10
[   45.566390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   45.575721] Call Trace:
[   45.578290]  dump_stack+0x194/0x257
[   45.581897]  ? arch_local_irq_restore+0x53/0x53
[   45.586539]  ? show_regs_print_info+0x65/0x65
[   45.591014]  ? lock_release+0xd70/0xd70
[   45.594961]  ? print_usage_bug+0x480/0x480
[   45.599172]  ? xfrm_state_find+0x305b/0x3190
[   45.603556]  print_address_description+0x73/0x250
[   45.608372]  ? xfrm_state_find+0x305b/0x3190
[   45.612759]  kasan_report+0x25b/0x340
[   45.616541]  __asan_report_load4_noabort+0x14/0x20
[   45.621443]  xfrm_state_find+0x305b/0x3190
[   45.625673]  ? xfrm_state_afinfo_get_rcu+0x160/0x160
[   45.630748]  ? print_usage_bug+0x480/0x480
[   45.634963]  ? __lock_acquire+0x732/0x4620
[   45.639188]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   45.644361]  ? __lock_acquire+0x732/0x4620
[   45.648583]  ? __lock_acquire+0x732/0x4620
[   45.652799]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   45.657974]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   45.663140]  ? check_noncircular+0x20/0x20
[   45.667346]  ? check_noncircular+0x20/0x20
[   45.671563]  xfrm_tmpl_resolve+0x2fb/0xbd0
[   45.675789]  ? __xfrm_decode_session+0x100/0x100
[   45.680543]  ? rcu_read_lock_sched_held+0x108/0x120
[   45.685537]  ? fib_table_lookup+0xa07/0x1a30
[   45.689924]  ? check_noncircular+0x20/0x20
[   45.694141]  xfrm_resolve_and_create_bundle+0x186/0x24b0
[   45.699564]  ? inet_netconf_get_devconf+0x4f0/0x4f0
[   45.704571]  ? xfrm_tmpl_resolve+0xbd0/0xbd0
[   45.708956]  ? lock_downgrade+0x990/0x990
[   45.713091]  ? xfrm_selector_match+0xe00/0xe00
[   45.717660]  ? rcu_read_lock_held+0xa9/0xc0
[   45.721956]  ? find_exception+0x3aa/0x520
[   45.726079]  ? lock_release+0xd70/0xd70
[   45.730030]  ? refcount_inc_not_zero+0xfe/0x180
[   45.734682]  ? xfrm_selector_match+0x3b/0xe00
[   45.739153]  ? xfrm_sk_policy_lookup+0x2cf/0x3d0
[   45.743898]  ? xfrm_selector_match+0xe00/0xe00
[   45.748465]  ? check_noncircular+0x20/0x20
[   45.752672]  ? ip_route_output_key_hash_rcu+0x604/0x2c20
[   45.758102]  xfrm_lookup+0xf0a/0x2540
[   45.761875]  ? xfrm_lookup+0xf0a/0x2540
[   45.765826]  ? ip_route_input_noref+0x1e0/0x1e0
[   45.770474]  ? xfrm_policy_lookup_bytype.constprop.49+0x16f0/0x16f0
[   45.776860]  ? find_held_lock+0x39/0x1d0
[   45.780905]  ? lock_downgrade+0x990/0x990
[   45.785026]  ? selinux_netlbl_sock_rcv_skb+0x9e/0x730
[   45.790194]  ? ip_route_output_key_hash+0x1a6/0x370
[   45.795191]  ? lock_release+0xd70/0xd70
[   45.799140]  ? selinux_nf_register+0x30/0x30
[   45.803522]  ? __lock_acquire+0x732/0x4620
[   45.807742]  ? selinux_sock_rcv_skb_compat+0x2f4/0x480
[   45.812998]  ? ip_route_output_key_hash+0x252/0x370
[   45.817991]  ? ip_route_output_key_hash_rcu+0x2c20/0x2c20
[   45.823512]  xfrm_lookup_route+0x39/0x1a0
[   45.827638]  ip_route_output_flow+0x7c/0xa0
[   45.831935]  inet_csk_route_req+0x5d8/0x990
[   45.836238]  tcp_v4_send_synack+0x1e4/0x270
[   45.840534]  ? tcp_v4_send_check+0x90/0x90
[   45.844756]  ? prandom_u32_state+0x13/0x180
[   45.849054]  tcp_rtx_synack+0x119/0x2e0
[   45.853003]  ? tcp_event_new_data_sent+0x2e0/0x2e0
[   45.857912]  ? __lock_is_held+0xbc/0x140
[   45.861957]  inet_rtx_syn_ack+0x64/0xd0
[   45.865920]  tcp_check_req+0xaf5/0x1630
[   45.869876]  ? tcp_openreq_init_rwin+0xae0/0xae0
[   45.874614]  ? refcount_inc_not_zero+0xfe/0x180
[   45.879260]  ? refcount_add+0x60/0x60
[   45.883035]  ? tcp_v4_reqsk_send_ack+0x3e0/0x3e0
[   45.887774]  ? tcp_filter+0x111/0x160
[   45.891553]  tcp_v4_rcv+0x17b0/0x2f20
[   45.895334]  ? lock_acquire+0x1d5/0x580
[   45.899298]  ? tcp_v4_early_demux+0xa30/0xa30
[   45.903791]  ip_local_deliver_finish+0x2e2/0xba0
[   45.908525]  ? inet_del_offload+0x40/0x40
[   45.912653]  ? nf_hook_slow+0xd3/0x1a0
[   45.916518]  ip_local_deliver+0x1ce/0x6e0
[   45.920643]  ? ip_call_ra_chain+0x6d0/0x6d0
[   45.924947]  ? inet_del_offload+0x40/0x40
[   45.929076]  ip_rcv_finish+0x8db/0x19c0
[   45.933032]  ? ip_local_deliver_finish+0xba0/0xba0
[   45.937935]  ? iptable_nat_ipv4_fn+0x40/0x40
[   45.942318]  ? nf_nat_ipv4_in_range+0xf0/0xf0
[   45.946788]  ? ip_rcv+0xc20/0x17d0
[   45.950305]  ? tcp_v4_send_synack+0x270/0x270
[   45.954780]  ? nf_nat_ipv4_in+0x1cd/0x270
[   45.958903]  ? iptable_nat_ipv4_fn+0x40/0x40
[   45.963296]  ? nf_hook_slow+0xd3/0x1a0
[   45.967165]  ip_rcv+0xc3f/0x17d0
[   45.970512]  ? ip_local_deliver+0x6e0/0x6e0
[   45.974815]  ? __lock_acquire+0x732/0x4620
[   45.979021]  ? print_usage_bug+0x480/0x480
[   45.983243]  ? ip_local_deliver_finish+0xba0/0xba0
[   45.988151]  ? ip_local_deliver+0x6e0/0x6e0
[   45.992453]  __netif_receive_skb_core+0x19af/0x33d0
[   45.997440]  ? print_usage_bug+0x480/0x480
[   46.001659]  ? nf_ingress+0x9f0/0x9f0
[   46.005436]  ? kasan_kmalloc+0xad/0xe0
[   46.009296]  ? kmem_cache_alloc+0x12e/0x760
[   46.013588]  ? __build_skb+0x9d/0x450
[   46.017359]  ? build_skb+0x6f/0x260
[   46.020959]  ? tun_build_skb.isra.42+0x92f/0x1690
[   46.025774]  ? tun_get_user+0x1dad/0x2150
[   46.029897]  ? tun_chr_write_iter+0xde/0x190
[   46.034746]  ? __vfs_write+0x68a/0x970
[   46.038613]  ? __skb_flow_get_ports+0x151/0x400
[   46.043257]  ? skb_flow_dissector_init+0x280/0x280
[   46.048168]  ? check_noncircular+0x20/0x20
[   46.052377]  ? __skb_flow_get_ports+0x151/0x400
[   46.057022]  ? __skb_flow_dissect+0x85b/0x3bc0
[   46.061594]  ? find_held_lock+0x39/0x1d0
[   46.065651]  ? lock_downgrade+0x990/0x990
[   46.069775]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   46.074941]  ? lock_acquire+0x1d5/0x580
[   46.078891]  ? netif_receive_skb_internal+0x1d7/0x670
[   46.084070]  ? pvclock_read_flags+0x160/0x160
[   46.088541]  ? tun_build_skb.isra.42+0x455/0x1690
[   46.093362]  ? lock_acquire+0x1d5/0x580
[   46.097309]  ? netif_receive_skb_internal+0xa2/0x670
[   46.102388]  ? ktime_get_with_offset+0x2c1/0x420
[   46.107118]  ? lock_release+0xd70/0xd70
[   46.111066]  ? ktime_get+0x3a0/0x3a0
[   46.114762]  ? skb_put+0x149/0x1c0
[   46.118284]  __netif_receive_skb+0x2c/0x1b0
[   46.122579]  ? __netif_receive_skb+0x2c/0x1b0
[   46.127047]  netif_receive_skb_internal+0x10b/0x670
[   46.132038]  ? dev_cpu_dead+0xb00/0xb00
[   46.135988]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   46.141160]  ? rcu_pm_notify+0xc0/0xc0
[   46.145032]  netif_receive_skb+0xae/0x390
[   46.149153]  ? netif_receive_skb_internal+0x670/0x670
[   46.154324]  ? lock_downgrade+0x990/0x990
[   46.158451]  ? tun_rx_batched.isra.43+0x5c3/0x860
[   46.163269]  tun_rx_batched.isra.43+0x5ed/0x860
[   46.167911]  ? skb_get_hash_perturb+0x9d0/0x9d0
[   46.172552]  ? tun_sock_write_space+0x370/0x370
[   46.177214]  tun_get_user+0x11dd/0x2150
[   46.181177]  ? tun_build_skb.isra.42+0x1690/0x1690
[   46.186080]  ? lock_release+0xd70/0xd70
[   46.190033]  ? tun_chr_close+0x60/0x60
[   46.193911]  ? lock_release+0xd70/0xd70
[   46.197864]  ? __lock_is_held+0xbc/0x140
[   46.201913]  ? __tun_get+0x1d4/0x2e0
[   46.205602]  ? tun_chr_close+0x60/0x60
[   46.209472]  tun_chr_write_iter+0xde/0x190
[   46.213685]  __vfs_write+0x68a/0x970
[   46.217377]  ? kernel_read+0x120/0x120
[   46.221250]  ? avc_policy_seqno+0x9/0x20
[   46.225287]  ? selinux_file_permission+0x82/0x460
[   46.230115]  ? rw_verify_area+0xe5/0x2b0
[   46.234158]  ? __fdget_raw+0x20/0x20
[   46.237861]  vfs_write+0x18f/0x510
[   46.241382]  SyS_write+0xef/0x220
[   46.244811]  ? __schedule+0x2070/0x2070
[   46.248764]  ? SyS_read+0x220/0x220
[   46.252371]  ? do_fast_syscall_32+0x158/0xf05
[   46.256844]  ? SyS_read+0x220/0x220
[   46.260465]  do_fast_syscall_32+0x3f2/0xf05
[   46.264782]  ? do_int80_syscall_32+0x940/0x940
[   46.269354]  ? trace_event_raw_event_sys_exit+0x260/0x260
[   46.274871]  ? lockdep_sys_exit+0x47/0xf0
[   46.279005]  ? syscall_return_slowpath+0x2b3/0x510
[   46.283911]  ? finish_task_switch+0x1aa/0x740
[   46.288390]  ? retint_user+0x18/0x20
[   46.292088]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   46.296914]  entry_SYSENTER_compat+0x51/0x60
[   46.301309] RIP: 0023:0xf7f41c79
[   46.304647] RSP: 002b:00000000f2f331f4 EFLAGS: 00000292 ORIG_RAX: 0000000000000004
[   46.312332] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020002000
[   46.319578] RDX: 0000000000000036 RSI: 0000000000000000 RDI: 00000000003d0f00
[   46.326823] RBP: 00000000f2f332e8 R08: 0000000000000000 R09: 0000000000000000
[   46.334066] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[   46.341318] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   46.348581] 
[   46.350184] The buggy address belongs to the page:
[   46.355090] page:ffffea0007323b80 count:0 mapcount:0 mapping:          (null) index:0xffff8801cc8ee080
[   46.364514] flags: 0x200000000000000()
[   46.368374] raw: 0200000000000000 0000000000000000 ffff8801cc8ee080 00000000ffffffff
[   46.376226] raw: 0000000000000000 dead000000000200 0000000000000000 0000000000000000
[   46.384074] page dumped because: kasan: bad access detected
[   46.389753] 
[   46.391352] Memory state around the buggy address:
[   46.396254]  ffff8801cc8ee600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   46.403599]  ffff8801cc8ee680: 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 00
[   46.410935] >ffff8801cc8ee700: 00 f2 f3 f3 f3 f3 00 00 00 00 00 00 00 f1 f1 f1
[   46.418274]                       ^
[   46.421875]  ffff8801cc8ee780: f1 00 00 00 00 00 00 00 00 00 00 00 f2 f3 f3 f3
[   46.429215]  ffff8801cc8ee800: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   46.436554] ==================================================================
[   46.443884] Disabling lock debugging due to kernel taint
[   46.449348] Kernel panic - not syncing: panic_on_warn set ...
[   46.449348] 
[   46.456681] CPU: 0 PID: 3020 Comm: syzkaller075845 Tainted: G    B           4.14.0-rc2+ #10
[   46.465245] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   46.474564] Call Trace:
[   46.477123]  dump_stack+0x194/0x257
[   46.480735]  ? arch_local_irq_restore+0x53/0x53
[   46.485377]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   46.490101]  ? xfrm_state_find+0x2fc0/0x3190
[   46.494476]  panic+0x1e4/0x417
[   46.497635]  ? __warn+0x1d9/0x1d9
[   46.501063]  ? xfrm_state_find+0x305b/0x3190
[   46.505439]  kasan_end_report+0x50/0x50
[   46.509378]  kasan_report+0x144/0x340
[   46.513155]  __asan_report_load4_noabort+0x14/0x20
[   46.518048]  xfrm_state_find+0x305b/0x3190
[   46.522261]  ? xfrm_state_afinfo_get_rcu+0x160/0x160
[   46.527334]  ? print_usage_bug+0x480/0x480
[   46.531538]  ? __lock_acquire+0x732/0x4620