[....] Starting enhanced syslogd: rsyslogd[ 13.675064] audit: type=1400 audit(1542903280.647:4): avc: denied { syslog } for pid=1919 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.58' (ECDSA) to the list of known hosts. RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported Error: argument "bridge0" is wrong: Device does not exist Error: argument "bridge0" is wrong: Device does not exist Cannot find device "veth0_to_bridge" Cannot find device "veth1_to_bridge" RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported Error: argument "bond0" is wrong: Device does not exist Error: argument "bond0" is wrong: Device does not exist Cannot find device "veth0_to_bond" Cannot find device "veth1_to_bond" RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported Error: argument "team0" is wrong: Device does not exist Error: argument "team0" is wrong: Device does not exist Cannot find device "veth0_to_team" Cannot find device "veth1_to_team" Cannot find device "bridge_slave_0" Cannot find device "bridge_slave_1" RTNETLINK answers: Operation not supported Cannot find device "bridge0" Cannot find device "bridge0" Cannot find device "bridge0" Cannot find device "bridge0" Cannot find device "vcan0" Cannot find device "vcan0" Cannot find device "vcan0" Cannot find device "vcan0" Cannot find device "tunl0" Cannot find device "tunl0" Cannot find device "tunl0" Cannot find device "tunl0" Cannot find device "gre0" Cannot find device "gre0" Cannot find device "gre0" Cannot find device "gre0" Cannot find device "gretap0" Cannot find device "gretap0" Cannot find device "gretap0" Cannot find device "gretap0" RTNETLINK answers: Operation not supported RTNETLINK answers: Invalid argument RTNETLINK answers: Invalid argument Cannot find device "ip6gre0" Cannot find device "ip6gre0" Cannot find device "ip6gre0" Cannot find device "ip6gre0" Cannot find device "ip6gretap0" Cannot find device "ip6gretap0" Cannot find device "ip6gretap0" Cannot find device "ip6gretap0" Cannot find device "erspan0" Cannot find device "erspan0" Cannot find device "erspan0" Cannot find device "erspan0" Cannot find device "bond0" Cannot find device "bond0" Cannot find device "bond0" Cannot find device "bond0" Cannot find device "veth0" Cannot find device "veth0" Cannot find device "veth0" Cannot find device "veth0" Cannot find device "veth1" Cannot find device "veth1" Cannot find device "veth1" Cannot find device "veth1" Cannot find device "team0" Cannot find device "team0" Cannot find device "team0" Cannot find device "team0" Cannot find device "veth0_to_bridge" Cannot find device "veth0_to_bridge" Cannot find device "veth0_to_bridge" Cannot find device "veth0_to_bridge" Cannot find device "veth1_to_bridge" Cannot find device "veth1_to_bridge" Cannot find device "veth1_to_bridge" Cannot find device "veth1_to_bridge" Cannot find device "veth0_to_bond" Cannot find device "veth0_to_bond" Cannot find device "veth0_to_bond" Cannot find device "veth0_to_bond" Cannot find device "veth1_to_bond" Cannot find device "veth1_to_bond" Cannot find device "veth1_to_bond" Cannot find device "veth1_to_bond" Cannot find device "veth0_to_team" Cannot find device "veth0_to_team" Cannot find device "veth0_to_team" Cannot find device "veth0_to_team" Cannot find device "veth1_to_team" Cannot find device "veth1_to_team" Cannot find device "veth1_to_team" Cannot find device "veth1_to_team" executing program syzkaller login: [ 29.946309] ================================================================== [ 29.953704] BUG: KASAN: slab-out-of-bounds in ip6_tnl_xmit2+0x229d/0x2350 [ 29.960605] Read of size 16 at addr ffff8800b61d2230 by task syz-executor770/2072 [ 29.968197] [ 29.969801] CPU: 1 PID: 2072 Comm: syz-executor770 Not tainted 4.4.164+ #123 [ 29.976957] 0000000000000000 075b6e778f4def9e ffff8801d49feca0 ffffffff81aa5d4d [ 29.984971] ffffea0002d87400 ffff8800b61d2230 0000000000000000 ffff8800b61d2238 [ 29.992962] ffff8801d9fb9100 ffff8801d49fecd8 ffffffff8148b2eb ffff8800b61d2230 [ 30.000949] Call Trace: [ 30.003513] [] dump_stack+0xc1/0x124 [ 30.008853] [] print_address_description+0x6c/0x217 [ 30.015493] [] kasan_report.cold.6+0x175/0x2f7 [ 30.021700] [] ? ip6_tnl_xmit2+0x229d/0x2350 [ 30.027737] [] __asan_report_load_n_noabort+0xf/0x20 [ 30.034464] [] ip6_tnl_xmit2+0x229d/0x2350 [ 30.040338] [] ? __kernel_text_address+0x6b/0xa0 [ 30.046727] [] ? ip6_tnl_create2+0x2d0/0x2d0 [ 30.052790] [] ? save_stack_trace+0x26/0x50 [ 30.058742] [] ? save_trace+0xe0/0x2b0 [ 30.064253] [] ? mark_lock+0x28f/0x1410 [ 30.069858] [] ? check_usage_forwards+0x290/0x290 [ 30.076324] [] ? make_kuid+0xf0/0x180 [ 30.081768] [] ip6_tnl_xmit+0x9f9/0xe10 [ 30.087367] [] ? ip6ip6_dscp_ecn_decapsulate+0x7c0/0x7c0 [ 30.094439] [] ? trace_hardirqs_on+0x10/0x10 [ 30.100469] [] ? trace_hardirqs_on+0x10/0x10 [ 30.106523] [] dev_hard_start_xmit+0x7bd/0x11c0 [ 30.112819] [] __dev_queue_xmit+0x16f5/0x1c30 [ 30.118942] [] ? __dev_queue_xmit+0x1d7/0x1c30 [ 30.125150] [] ? netdev_pick_tx+0x2f0/0x2f0 [ 30.131093] [] ? __local_bh_enable_ip+0x6a/0xe0 [ 30.137387] [] ? _raw_write_unlock_bh+0x30/0x40 [ 30.143679] [] ? __neigh_create+0x965/0x1b20 [ 30.149713] [] dev_queue_xmit+0x17/0x20 [ 30.155309] [] neigh_direct_output+0x15/0x20 [ 30.161349] [] ip_finish_output2+0x8f0/0x1100 [ 30.167469] [] ? ip_finish_output2+0x20b/0x1100 [ 30.173762] [] ? ip_send_check+0xb0/0xb0 [ 30.179449] [] ? nf_hook_slow+0x202/0x340 [ 30.185222] [] ip_finish_output+0x882/0xc00 [ 30.191181] [] ip_output+0x219/0x4c0 [ 30.196538] [] ? ip_mc_output+0x980/0x980 [ 30.202309] [] ? ip_make_skb+0x116/0x210 [ 30.207994] [] ? ip_fragment.constprop.5+0x200/0x200 [ 30.214720] [] ? ip_flush_pending_frames+0x30/0x30 [ 30.221282] [] ip_local_out+0x9b/0x180 [ 30.226808] [] ip_send_skb+0x3c/0xc0 [ 30.232147] [] udp_send_skb+0x503/0xc70 [ 30.237748] [] udp_sendmsg+0x16c9/0x1c70 [ 30.243448] [] ? ip_reply_glue_bits+0xc0/0xc0 [ 30.249567] [] ? udp_lib_unhash+0x630/0x630 [ 30.255510] [] ? mark_held_locks+0xc7/0x130 [ 30.261485] [] ? __lock_acquire+0x9f6/0x5530 [ 30.267553] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 30.274281] [] udpv6_sendmsg+0x12cd/0x24c0 [ 30.280156] [] ? avc_has_perm+0x15a/0x3a0 [ 30.285941] [] ? udp_v6_flush_pending_frames+0xe0/0xe0 [ 30.292843] [] ? avc_has_perm_noaudit+0x2f0/0x2f0 [ 30.299322] [] ? trace_hardirqs_on+0x10/0x10 [ 30.305356] [] ? sock_has_perm+0x1c1/0x3f0 [ 30.311402] [] ? sock_has_perm+0x2a1/0x3f0 [ 30.317272] [] ? sock_has_perm+0x9f/0x3f0 [ 30.323045] [] ? selinux_msg_queue_alloc_security+0x2e0/0x2e0 [ 30.330554] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 30.337281] [] ? check_preemption_disabled+0x3b/0x200 [ 30.344107] [] ? inet_sendmsg+0x143/0x4d0 [ 30.349881] [] inet_sendmsg+0x203/0x4d0 [ 30.355477] [] ? inet_sendmsg+0x73/0x4d0 [ 30.361170] [] ? inet_recvmsg+0x4c0/0x4c0 [ 30.366959] [] sock_sendmsg+0xbb/0x110 [ 30.372472] [] ___sys_sendmsg+0x745/0x880 [ 30.378244] [] ? check_preemption_disabled+0x3b/0x200 [ 30.385084] [] ? copy_msghdr_from_user+0x550/0x550 [ 30.391641] [] ? prandom_u32+0x71/0xa0 [ 30.397151] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 30.403877] [] ? __local_bh_enable_ip+0x6a/0xe0 [ 30.410195] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 30.417020] [] ? release_sock+0x3b6/0x500 [ 30.422805] [] ? trace_hardirqs_on+0xd/0x10 [ 30.428791] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 30.435522] [] ? __fget_light+0x9f/0x1f0 [ 30.441204] [] ? __fdget+0x18/0x20 [ 30.446370] [] __sys_sendmsg+0xd6/0x190 [ 30.451979] [] ? SyS_shutdown+0x1b0/0x1b0 [ 30.457749] [] ? move_addr_to_kernel+0x50/0x50 [ 30.463966] [] SyS_sendmsg+0x2d/0x50 [ 30.469316] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 30.475867] [ 30.477483] Allocated by task 2072: [ 30.481076] [] save_stack_trace+0x26/0x50 [ 30.486971] [] kasan_kmalloc.part.1+0x62/0xf0 [ 30.493221] [] kasan_kmalloc+0xaf/0xc0 [ 30.498868] [] __kmalloc+0x13d/0x330 [ 30.504361] [] __neigh_create+0x1d6/0x1b20 [ 30.510350] [] ipv4_neigh_lookup+0x4de/0x700 [ 30.516541] [] ip6_tnl_xmit2+0x28a/0x2350 [ 30.522430] [] ip6_tnl_xmit+0x9f9/0xe10 [ 30.528141] [] dev_hard_start_xmit+0x7bd/0x11c0 [ 30.534558] [] __dev_queue_xmit+0x16f5/0x1c30 [ 30.540802] [] dev_queue_xmit+0x17/0x20 [ 30.546537] [] neigh_direct_output+0x15/0x20 [ 30.552683] [] ip_finish_output2+0x8f0/0x1100 [ 30.558927] [] ip_finish_output+0x882/0xc00 [ 30.565000] [] ip_output+0x219/0x4c0 [ 30.570454] [] ip_local_out+0x9b/0x180 [ 30.576120] [] ip_send_skb+0x3c/0xc0 [ 30.581578] [] udp_send_skb+0x503/0xc70 [ 30.587307] [] udp_sendmsg+0x16c9/0x1c70 [ 30.593125] [] udpv6_sendmsg+0x12cd/0x24c0 [ 30.599100] [] inet_sendmsg+0x203/0x4d0 [ 30.604838] [] sock_sendmsg+0xbb/0x110 [ 30.610474] [] ___sys_sendmsg+0x745/0x880 [ 30.616365] [] __sys_sendmsg+0xd6/0x190 [ 30.622090] [] SyS_sendmsg+0x2d/0x50 [ 30.627550] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 30.634219] [ 30.635818] Freed by task 504: [ 30.638978] [] save_stack_trace+0x26/0x50 [ 30.644868] [] kasan_slab_free+0xac/0x190 [ 30.650755] [] kfree+0xf4/0x310 [ 30.655776] [] skb_release_data+0x2e8/0x380 [ 30.661834] [] skb_release_all+0x4a/0x60 [ 30.667638] [] kfree_skb+0xf7/0x3f0 [ 30.673026] [] netlink_unicast+0x623/0x700 [ 30.679000] [] netlink_sendmsg+0x694/0xc30 [ 30.684970] [] sock_sendmsg+0xbb/0x110 [ 30.690595] [] ___sys_sendmsg+0x745/0x880 [ 30.696483] [] __sys_sendmsg+0xd6/0x190 [ 30.702200] [] SyS_sendmsg+0x2d/0x50 [ 30.707652] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 30.714330] [ 30.715936] The buggy address belongs to the object at ffff8800b61d1f80 [ 30.715936] which belongs to the cache kmalloc-1024 of size 1024 [ 30.728751] The buggy address is located 688 bytes inside of [ 30.728751] 1024-byte region [ffff8800b61d1f80, ffff8800b61d2380) [ 30.740678] The buggy address belongs to the page: [ 32.213444] double fault: 0000 [#1] PREEMPT SMP KASAN [ 32.219125] Modules linked in: [ 32.222413] CPU: 1 PID: 2072 Comm: syz-executor770 Not tainted 4.4.164+ #123 [ 32.229572] task: ffff8801d4d28000 task.stack: ffff8801d49f8000 [ 32.235600] RIP: 0010:[] [] dump_page_badflags+0x4/0x70 [ 32.244276] RSP: 0018:ffff880100000000 EFLAGS: 00010046 [ 32.249697] RAX: ffff8801d4d28000 RBX: ffffea0002d87400 RCX: 0000000000000000 [ 32.256940] RDX: 0000000000000000 RSI: ffffffff82891020 RDI: ffffea0002d87400 [ 32.264186] RBP: ffff880100000000 R08: 0000000000000001 R09: 0000000000000000 [ 32.271432] R10: 0000000000000001 R11: ffffffff83fd7174 R12: ffffffff82891020 [ 32.278679] R13: ffffffff82891020 R14: ffff8800b61d1f80 R15: ffff8800b61d2380 [ 32.285926] FS: 000000000096d880(0063) GS:ffff8801db700000(0000) knlGS:0000000000000000 [ 32.294125] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.299984] CR2: ffff8800fffffff8 CR3: 00000001d5b81000 CR4: 00000000001606b0 [ 32.307230] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 32.314619] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 32.321872] Stack: [ 32.323994] [ 32.325590] Call Trace: [ 32.328145] [ 32.330191] Code: e8 3e 48 69 c0 80 06 00 00 f0 48 ff 80 28 f8 18 83 5b 5d c3 48 89 df e8 4b 97 05 00 eb dd 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 <41> 57 41 56 41 55 49 89 f5 41 54 49 89 d4 53 48 89 fb 48 83 ec [ 32.357631] RIP [] dump_page_badflags+0x4/0x70 [ 32.364025] RSP [ 32.367638] ---[ end trace 6bd42102a79c8339 ]--- [ 32.372387] Kernel panic - not syncing: Fatal exception in interrupt [ 32.379226] Kernel Offset: disabled [ 32.382838] Rebooting in 86400 seconds..