Starting mcstransd: [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 10.126312] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. D[ 11.295406] random: crng init done ebian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.6' (ECDSA) to the list of known hosts. net.ipv6.conf.syz_tun.accept_dad = 0 net.ipv6.conf.syz_tun.router_solicitations = 0 executing program syzkaller login: [ 34.681133] ================================================================== [ 34.682280] BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x269d/0x2920 [ 34.683406] Read of size 4 at addr ffff8801ceb07650 by task syz-executor926/2052 [ 34.684443] [ 34.684702] CPU: 1 PID: 2052 Comm: syz-executor926 Not tainted 4.9.142+ #74 [ 34.685657] ffff8801ceb06cc0 ffffffff81b43969 ffffea00073ac1c0 ffff8801ceb07650 [ 34.686925] 0000000000000000 ffff8801ceb07650 ffff8801ce0961f0 ffff8801ceb06cf8 [ 34.688142] ffffffff81500a28 ffff8801ceb07650 0000000000000004 0000000000000000 [ 34.689366] Call Trace: [ 34.689764] [] dump_stack+0xc1/0x128 [ 34.690504] [] print_address_description+0x6c/0x234 [ 34.691439] [] kasan_report.cold.6+0x242/0x2fe [ 34.692395] [] ? xfrm_state_find+0x269d/0x2920 [ 34.693346] [] __asan_report_load4_noabort+0x14/0x20 [ 34.694259] [] xfrm_state_find+0x269d/0x2920 [ 34.695347] [] ? xfrm_state_find+0x28e/0x2920 [ 34.696179] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 34.697154] [] ? xfrm_unregister_mode+0x190/0x190 [ 34.698048] [] ? trace_hardirqs_on+0x10/0x10 [ 34.698912] [] ? kasan_slab_free+0x119/0x190 [ 34.699786] [] ? save_stack_trace+0x16/0x20 [ 34.700660] [] ? kasan_slab_free+0xac/0x190 [ 34.703646] [] ? kmem_cache_free+0xbe/0x310 [ 34.709598] [] ? kfree_skbmem+0x98/0x100 [ 34.715282] [] ? kfree_skb+0xd4/0x340 [ 34.720706] [] ? kfree_skb_list+0x3e/0x60 [ 34.726483] [] ? __dev_queue_xmit+0x1746/0x1b90 [ 34.732775] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 34.739502] [] xfrm_tmpl_resolve_one+0x1d2/0x7a0 [ 34.745879] [] ? xfrm_expand_policies.constprop.14+0x290/0x290 [ 34.753594] [] ? depot_save_stack+0x20f/0x470 [ 34.759716] [] ? __lock_acquire+0x654/0x4a10 [ 34.765874] [] ? kasan_kmalloc.part.1+0xc9/0xf0 [ 34.772178] [] xfrm_resolve_and_create_bundle+0x21f/0x1e70 [ 34.779424] [] ? xfrm_tmpl_resolve_one+0x7a0/0x7a0 [ 34.785974] [] ? trace_hardirqs_on+0x10/0x10 [ 34.792004] [] ? __dev_queue_xmit+0x944/0x1b90 [ 34.798208] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 34.804937] [] ? check_preemption_disabled+0x3b/0x200 [ 34.811751] [] ? check_preemption_disabled+0x3b/0x200 [ 34.818580] [] ? xfrm_sk_policy_lookup+0x2a0/0x430 [ 34.825148] [] ? xfrm_sk_policy_lookup+0x2c7/0x430 [ 34.831699] [] ? xfrm_selector_match+0xe40/0xe40 [ 34.838076] [] xfrm_lookup+0x239/0xc00 [ 34.843587] [] ? xfrm_sk_policy_lookup+0x430/0x430 [ 34.850204] [] ? check_preemption_disabled+0x3b/0x200 [ 34.857025] [] ? __ip_route_output_key_hash+0xc7b/0x2090 [ 34.864098] [] ? __ip_route_output_key_hash+0xca2/0x2090 [ 34.871174] [] ? __ip_route_output_key_hash+0x16a/0x2090 [ 34.878249] [] ? ip6_finish_output2+0x177/0x1d10 [ 34.884626] [] ? rt_set_nexthop.constprop.13+0xcc0/0xcc0 [ 34.891703] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 34.898425] [] xfrm_lookup_route+0x39/0x140 [ 34.904369] [] ip_route_output_flow+0x90/0xa0 [ 34.910506] [] udp_sendmsg+0x13d9/0x1c60 [ 34.916190] [] ? udp_sendmsg+0xe9f/0x1c60 [ 34.921974] [] ? __lock_acquire+0x654/0x4a10 [ 34.928004] [] ? ip6_finish_output+0x35d/0x980 [ 34.934210] [] ? ip_reply_glue_bits+0xb0/0xb0 [ 34.940330] [] ? udp_v4_get_port+0x100/0x100 [ 34.946362] [] ? xfrm_lookup_route+0x61/0x140 [ 34.952481] [] ? __lock_acquire+0x654/0x4a10 [ 34.958509] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 34.965236] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 34.971962] [] udpv6_sendmsg+0x127d/0x2430 [ 34.977821] [] ? __lock_acquire+0x654/0x4a10 [ 34.983853] [] ? udp_v6_flush_pending_frames+0xe0/0xe0 [ 34.990751] [] ? trace_hardirqs_on+0x10/0x10 [ 34.996783] [] ? sock_has_perm+0x1c1/0x3e0 [ 35.002717] [] ? sock_has_perm+0x293/0x3e0 [ 35.008583] [] ? sock_has_perm+0x9f/0x3e0 [ 35.014357] [] ? selinux_msg_queue_alloc_security+0x2e0/0x2e0 [ 35.021868] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 35.028593] [] ? check_preemption_disabled+0x3b/0x200 [ 35.035509] [] ? check_preemption_disabled+0x3b/0x200 [ 35.042328] [] ? inet_sendmsg+0x143/0x4d0 [ 35.048106] [] inet_sendmsg+0x203/0x4d0 [ 35.053709] [] ? inet_sendmsg+0x73/0x4d0 [ 35.059395] [] ? inet_recvmsg+0x4c0/0x4c0 [ 35.065169] [] sock_sendmsg+0xbb/0x110 [ 35.070681] [] ___sys_sendmsg+0x47a/0x840 [ 35.076450] [] ? copy_msghdr_from_user+0x530/0x530 [ 35.083002] [] ? trace_hardirqs_on+0x10/0x10 [ 35.089034] [] ? trace_hardirqs_on+0x10/0x10 [ 35.095073] [] ? trace_hardirqs_on+0x10/0x10 [ 35.101109] [] ? trace_hardirqs_on+0x10/0x10 [ 35.107205] [] ? ip6_datagram_send_ctl+0x10f0/0x10f0 [ 35.113950] [] __sys_sendmmsg+0x161/0x3d0 [ 35.119733] [] ? SyS_sendmsg+0x50/0x50 [ 35.125249] [] ? release_sock+0x14e/0x1c0 [ 35.131033] [] ? ip6_datagram_connect+0x3a/0x50 [ 35.137336] [] ? inet_dgram_connect+0x11e/0x200 [ 35.143844] [] ? SyS_connect+0x203/0x310 [ 35.149543] [] ? sock_common_setsockopt+0x9a/0xe0 [ 35.156060] [] ? SyS_setsockopt+0x185/0x260 [ 35.162102] [] ? SyS_recv+0x40/0x40 [ 35.167371] [] ? __do_page_fault+0x554/0xa60 [ 35.173415] [] SyS_sendmmsg+0x35/0x60 [ 35.178842] [] ? __sys_sendmmsg+0x3d0/0x3d0 [ 35.184795] [] do_syscall_64+0x19f/0x550 [ 35.190486] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 35.197383] [ 35.198986] The buggy address belongs to the page: [ 35.203889] page:ffffea00073ac1c0 count:0 mapcount:0 mapping: (null) index:0x0 [ 35.212129] flags: 0x4000000000000000() [ 35.216073] page dumped because: kasan: bad access detected [ 35.221752] [ 35.223351] Memory state around the buggy address: [ 35.228252] ffff8801ceb07500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 [ 35.235585] ffff8801ceb07580: f1 f1 f1 00 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 f2 [ 35.242917] >ffff8801ceb07600: f2 f2 f2 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 00 [ 35.250247] ^ [ 35.256190] ffff8801ceb07680: 00 00 00 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 [ 35.263530] ffff8801ceb07700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.270868] ================================================================== [ 35.278195] Disabling lock debugging due to kernel taint [ 35.284154] Kernel panic - not syncing: panic_on_warn set ... [ 35.284154] [ 35.291551] CPU: 1 PID: 2052 Comm: syz-executor926 Tainted: G B 4.9.142+ #74 [ 35.299838] ffff8801ceb06c20 ffffffff81b43969 ffffffff82e3a808 00000000ffffffff [ 35.307829] 0000000000000000 0000000000000001 ffff8801ce0961f0 ffff8801ceb06ce0 [ 35.315819] ffffffff813f71f5 0000000041b58ab3 ffffffff82e2e803 ffffffff813f7036 [ 35.323808] Call Trace: [ 35.326368] [] dump_stack+0xc1/0x128 [ 35.331705] [] panic+0x1bf/0x39f [ 35.336694] [] ? add_taint.cold.5+0x16/0x16 [ 35.342640] [] ? ___preempt_schedule+0x16/0x18 [ 35.348846] [] kasan_end_report+0x47/0x4f [ 35.354619] [] kasan_report.cold.6+0x76/0x2fe [ 35.360738] [] ? xfrm_state_find+0x269d/0x2920 [ 35.366945] [] __asan_report_load4_noabort+0x14/0x20 [ 35.373673] [] xfrm_state_find+0x269d/0x2920 [ 35.379706] [] ? xfrm_state_find+0x28e/0x2920 [ 35.385823] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 35.392554] [] ? xfrm_unregister_mode+0x190/0x190 [ 35.399024] [] ? trace_hardirqs_on+0x10/0x10 [ 35.405058] [] ? kasan_slab_free+0x119/0x190 [ 35.411093] [] ? save_stack_trace+0x16/0x20 [ 35.417038] [] ? kasan_slab_free+0xac/0x190 [ 35.422986] [] ? kmem_cache_free+0xbe/0x310 [ 35.428932] [] ? kfree_skbmem+0x98/0x100 [ 35.434615] [] ? kfree_skb+0xd4/0x340 [ 35.440039] [] ? kfree_skb_list+0x3e/0x60 [ 35.445809] [] ? __dev_queue_xmit+0x1746/0x1b90 [ 35.452102] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 35.458829] [] xfrm_tmpl_resolve_one+0x1d2/0x7a0 [ 35.465313] [] ? xfrm_expand_policies.constprop.14+0x290/0x290 [ 35.472910] [] ? depot_save_stack+0x20f/0x470 [ 35.479032] [] ? __lock_acquire+0x654/0x4a10 [ 35.485062] [] ? kasan_kmalloc.part.1+0xc9/0xf0 [ 35.491355] [] xfrm_resolve_and_create_bundle+0x21f/0x1e70 [ 35.498611] [] ? xfrm_tmpl_resolve_one+0x7a0/0x7a0 [ 35.505213] [] ? trace_hardirqs_on+0x10/0x10 [ 35.511259] [] ? __dev_queue_xmit+0x944/0x1b90 [ 35.517465] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 35.524206] [] ? check_preemption_disabled+0x3b/0x200 [ 35.531028] [] ? check_preemption_disabled+0x3b/0x200 [ 35.537848] [] ? xfrm_sk_policy_lookup+0x2a0/0x430 [ 35.544487] [] ? xfrm_sk_policy_lookup+0x2c7/0x430 [ 35.551048] [] ? xfrm_selector_match+0xe40/0xe40 [ 35.557430] [] xfrm_lookup+0x239/0xc00 [ 35.562945] [] ? xfrm_sk_policy_lookup+0x430/0x430 [ 35.569503] [] ? check_preemption_disabled+0x3b/0x200 [ 35.576337] [] ? __ip_route_output_key_hash+0xc7b/0x2090 [ 35.583428] [] ? __ip_route_output_key_hash+0xca2/0x2090 [ 35.590498] [] ? __ip_route_output_key_hash+0x16a/0x2090 [ 35.597579] [] ? ip6_finish_output2+0x177/0x1d10 [ 35.603965] [] ? rt_set_nexthop.constprop.13+0xcc0/0xcc0 [ 35.611045] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 35.617878] [] xfrm_lookup_route+0x39/0x140 [ 35.623833] [] ip_route_output_flow+0x90/0xa0 [ 35.629956] [] udp_sendmsg+0x13d9/0x1c60 [ 35.635648] [] ? udp_sendmsg+0xe9f/0x1c60 [ 35.641423] [] ? __lock_acquire+0x654/0x4a10 [ 35.647569] [] ? ip6_finish_output+0x35d/0x980 [ 35.653791] [] ? ip_reply_glue_bits+0xb0/0xb0 [ 35.659919] [] ? udp_v4_get_port+0x100/0x100 [ 35.665956] [] ? xfrm_lookup_route+0x61/0x140 [ 35.672087] [] ? __lock_acquire+0x654/0x4a10 [ 35.678127] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 35.684864] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 35.691596] [] udpv6_sendmsg+0x127d/0x2430 [ 35.697473] [] ? __lock_acquire+0x654/0x4a10 [ 35.703504] [] ? udp_v6_flush_pending_frames+0xe0/0xe0 [ 35.710405] [] ? trace_hardirqs_on+0x10/0x10 [ 35.716440] [] ? sock_has_perm+0x1c1/0x3e0 [ 35.722297] [] ? sock_has_perm+0x293/0x3e0 [ 35.728155] [] ? sock_has_perm+0x9f/0x3e0 [ 35.733928] [] ? selinux_msg_queue_alloc_security+0x2e0/0x2e0 [ 35.741436] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 35.748163] [] ? check_preemption_disabled+0x3b/0x200 [ 35.754974] [] ? check_preemption_disabled+0x3b/0x200 [ 35.761802] [] ? inet_sendmsg+0x143/0x4d0 [ 35.767573] [] inet_sendmsg+0x203/0x4d0 [ 35.773169] [] ? inet_sendmsg+0x73/0x4d0 [ 35.778852] [] ? inet_recvmsg+0x4c0/0x4c0 [ 35.784630] [] sock_sendmsg+0xbb/0x110 [ 35.790147] [] ___sys_sendmsg+0x47a/0x840 [ 35.795924] [] ? copy_msghdr_from_user+0x530/0x530 [ 35.802586] [] ? trace_hardirqs_on+0x10/0x10 [ 35.808630] [] ? trace_hardirqs_on+0x10/0x10 [ 35.814662] [] ? trace_hardirqs_on+0x10/0x10 [ 35.820694] [] ? trace_hardirqs_on+0x10/0x10 [ 35.826732] [] ? ip6_datagram_send_ctl+0x10f0/0x10f0 [ 35.833457] [] __sys_sendmmsg+0x161/0x3d0 [ 35.839250] [] ? SyS_sendmsg+0x50/0x50 [ 35.844769] [] ? release_sock+0x14e/0x1c0 [ 35.850550] [] ? ip6_datagram_connect+0x3a/0x50 [ 35.856848] [] ? inet_dgram_connect+0x11e/0x200 [ 35.863142] [] ? SyS_connect+0x203/0x310 [ 35.868829] [] ? sock_common_setsockopt+0x9a/0xe0 [ 35.875290] [] ? SyS_setsockopt+0x185/0x260 [ 35.881265] [] ? SyS_recv+0x40/0x40 [ 35.886516] [] ? __do_page_fault+0x554/0xa60 [ 35.892556] [] SyS_sendmmsg+0x35/0x60 [ 35.897999] [] ? __sys_sendmmsg+0x3d0/0x3d0 [ 35.903959] [] do_syscall_64+0x19f/0x550 [ 35.909687] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 35.916996] Kernel Offset: disabled [ 35.920599] Rebooting in 86400 seconds..