[....] Starting enhanced syslogd: rsyslogd[ 17.290779] audit: type=1400 audit(1520643654.257:5): avc: denied { syslog } for pid=4094 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 23.355383] audit: type=1400 audit(1520643660.322:6): avc: denied { map } for pid=4234 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.17' (ECDSA) to the list of known hosts. net.ipv6.conf.syz_tun.accept_dad = 0 net.ipv6.conf.syz_tun.router_solicitations = 0 [ 29.687806] audit: type=1400 audit(1520643666.654:7): avc: denied { map } for pid=4248 comm="syzkaller992837" path="/root/syzkaller992837570" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 29.697589] IPVS: ftp: loaded support on port[0] = 21 RTNETLINK answers: File exists RTNETLINK answers: Operation not supported RTNETLINK answers: No buffer space available RTNETLINK answers: Operation not supported [ 29.979349] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Invalid argument RTNETLINK answers: Invalid argument RTNETLINK answers: Invalid argument [ 30.352170] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 30.358260] 8021q: adding VLAN 0 to HW filter on device bond0 executing program [ 30.397857] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 30.437096] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 30.442702] ================================================================== [ 30.451127] BUG: KASAN: slab-out-of-bounds in ip6_xmit+0x1f76/0x2260 [ 30.457594] Read of size 8 at addr ffff8801c0535818 by task syzkaller992837/4249 [ 30.465107] [ 30.466721] CPU: 1 PID: 4249 Comm: syzkaller992837 Not tainted 4.16.0-rc4+ #347 [ 30.474135] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 30.483467] Call Trace: [ 30.486041] dump_stack+0x194/0x24d [ 30.489658] ? arch_local_irq_restore+0x53/0x53 [ 30.494301] ? show_regs_print_info+0x18/0x18 [ 30.498774] ? ip6_xmit+0x1f76/0x2260 [ 30.502562] print_address_description+0x73/0x250 [ 30.507378] ? ip6_xmit+0x1f76/0x2260 [ 30.511156] kasan_report+0x23c/0x360 [ 30.514932] __asan_report_load8_noabort+0x14/0x20 [ 30.519833] ip6_xmit+0x1f76/0x2260 [ 30.523445] ? ip6_finish_output2+0x23a0/0x23a0 [ 30.528090] ? fl6_update_dst+0x127/0x2b0 [ 30.532213] ? inet6_csk_route_socket+0x691/0xe80 [ 30.537038] ? trace_hardirqs_off+0x10/0x10 [ 30.541340] ? lock_acquire+0x1d5/0x580 [ 30.545284] ? lock_acquire+0x1d5/0x580 [ 30.549229] ? inet6_csk_xmit+0x114/0x580 [ 30.553359] ? trace_hardirqs_off+0x10/0x10 [ 30.557657] ? lock_release+0xa40/0xa40 [ 30.561619] inet6_csk_xmit+0x2fc/0x580 [ 30.565569] ? inet6_csk_update_pmtu+0x160/0x160 [ 30.570304] ? __sk_dst_check+0x1a5/0x380 [ 30.574427] ? sock_kfree_s+0x60/0x60 [ 30.578216] l2tp_xmit_skb+0x105f/0x1410 [ 30.582262] ? l2tp_session_create+0xb80/0xb80 [ 30.586817] ? sock_wmalloc+0x15d/0x1d0 [ 30.590766] ? iov_iter_advance+0x13f0/0x13f0 [ 30.595235] ? pppol2tp_sendmsg+0x41b/0x670 [ 30.599536] pppol2tp_sendmsg+0x470/0x670 [ 30.603659] ? selinux_socket_sendmsg+0x36/0x40 [ 30.608304] ? pppol2tp_getsockopt+0x900/0x900 [ 30.612859] sock_sendmsg+0xca/0x110 [ 30.616550] SYSC_sendto+0x361/0x5c0 [ 30.620251] ? SYSC_connect+0x4a0/0x4a0 [ 30.624213] ? __do_page_fault+0x5f7/0xc90 [ 30.628423] ? lock_downgrade+0x980/0x980 [ 30.632552] ? handle_mm_fault+0x465/0xb10 [ 30.636760] ? check_same_owner+0x320/0x320 [ 30.641088] ? mm_fault_error+0x2c0/0x2c0 [ 30.645219] ? move_addr_to_kernel+0x60/0x60 [ 30.649604] SyS_sendto+0x40/0x50 [ 30.653037] ? SyS_getpeername+0x30/0x30 [ 30.657091] do_syscall_64+0x281/0x940 [ 30.660953] ? __do_page_fault+0xc90/0xc90 [ 30.665161] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 30.669898] ? syscall_return_slowpath+0x550/0x550 [ 30.674802] ? syscall_return_slowpath+0x2ac/0x550 [ 30.679712] ? prepare_exit_to_usermode+0x350/0x350 [ 30.684797] ? retint_user+0x18/0x18 [ 30.688493] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 30.693319] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 30.698483] RIP: 0033:0x441ab9 [ 30.701655] RSP: 002b:00007fff559ced28 EFLAGS: 00000212 ORIG_RAX: 000000000000002c [ 30.709337] RAX: ffffffffffffffda RBX: 000000000000001a RCX: 0000000000441ab9 [ 30.716590] RDX: 0000000000000000 RSI: 0000000020de7000 RDI: 0000000000000004 [ 30.723834] RBP: 00000000004a3d0e R08: 000000002064eff0 R09: 0000000000000080 [ 30.731076] R10: c3fe68eda9554f8b R11: 0000000000000212 R12: 00007fff559cee20 [ 30.738317] R13: 00000000004027e0 R14: 0000000000000000 R15: 0000000000000000 [ 30.745576] [ 30.747177] Allocated by task 0: [ 30.750513] (stack is not available) [ 30.754195] [ 30.755794] Freed by task 0: [ 30.758782] (stack is not available) [ 30.762464] [ 30.764067] The buggy address belongs to the object at ffff8801c0535800 [ 30.764067] which belongs to the cache ip_dst_cache of size 168 [ 30.776781] The buggy address is located 24 bytes inside of [ 30.776781] 168-byte region [ffff8801c0535800, ffff8801c05358a8) [ 30.788539] The buggy address belongs to the page: [ 30.793441] page:ffffea0007014d40 count:1 mapcount:0 mapping:ffff8801c0535000 index:0x0 [ 30.801562] flags: 0x2fffc0000000100(slab) [ 30.805771] raw: 02fffc0000000100 ffff8801c0535000 0000000000000000 0000000100000010 [ 30.813628] raw: ffff8801d5b6b848 ffff8801d5b6b848 ffff8801d5b704c0 0000000000000000 [ 30.821480] page dumped because: kasan: bad access detected [ 30.827171] [ 30.828769] Memory state around the buggy address: [ 30.833680] ffff8801c0535700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 30.841012] ffff8801c0535780: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 30.848348] >ffff8801c0535800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.855678] ^ [ 30.859817] ffff8801c0535880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.867157] ffff8801c0535900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.874485] ================================================================== [ 30.881818] Disabling lock debugging due to kernel taint [ 30.887267] Kernel panic - not syncing: panic_on_warn set ... [ 30.887267] [ 30.894614] CPU: 1 PID: 4249 Comm: syzkaller992837 Tainted: G B 4.16.0-rc4+ #347 [ 30.903332] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 30.912662] Call Trace: [ 30.915229] dump_stack+0x194/0x24d [ 30.918829] ? arch_local_irq_restore+0x53/0x53 [ 30.923475] ? kasan_end_report+0x32/0x50 [ 30.927599] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 30.932325] ? vsnprintf+0x1ed/0x1900 [ 30.936106] ? ip6_xmit+0x1f30/0x2260 [ 30.939886] panic+0x1e4/0x41c [ 30.943048] ? refcount_error_report+0x214/0x214 [ 30.947790] ? add_taint+0x1c/0x50 [ 30.951305] ? add_taint+0x1c/0x50 [ 30.954818] ? ip6_xmit+0x1f76/0x2260 [ 30.958588] kasan_end_report+0x50/0x50 [ 30.962533] kasan_report+0x149/0x360 [ 30.966314] __asan_report_load8_noabort+0x14/0x20 [ 30.971226] ip6_xmit+0x1f76/0x2260 [ 30.974832] ? ip6_finish_output2+0x23a0/0x23a0 [ 30.979473] ? fl6_update_dst+0x127/0x2b0 [ 30.983592] ? inet6_csk_route_socket+0x691/0xe80 [ 30.988406] ? trace_hardirqs_off+0x10/0x10 [ 30.992696] ? lock_acquire+0x1d5/0x580 [ 30.996643] ? lock_acquire+0x1d5/0x580 [ 31.000587] ? inet6_csk_xmit+0x114/0x580 [ 31.004706] ? trace_hardirqs_off+0x10/0x10 [ 31.008998] ? lock_release+0xa40/0xa40 [ 31.012961] inet6_csk_xmit+0x2fc/0x580 [ 31.016909] ? inet6_csk_update_pmtu+0x160/0x160 [ 31.021656] ? __sk_dst_check+0x1a5/0x380 [ 31.025787] ? sock_kfree_s+0x60/0x60 [ 31.029573] l2tp_xmit_skb+0x105f/0x1410 [ 31.033612] ? l2tp_session_create+0xb80/0xb80 [ 31.038174] ? sock_wmalloc+0x15d/0x1d0 [ 31.042122] ? iov_iter_advance+0x13f0/0x13f0 [ 31.046592] ? pppol2tp_sendmsg+0x41b/0x670 [ 31.050886] pppol2tp_sendmsg+0x470/0x670 [ 31.055009] ? selinux_socket_sendmsg+0x36/0x40 [ 31.059658] ? pppol2tp_getsockopt+0x900/0x900 [ 31.064223] sock_sendmsg+0xca/0x110 [ 31.067918] SYSC_sendto+0x361/0x5c0 [ 31.071615] ? SYSC_connect+0x4a0/0x4a0 [ 31.075564] ? __do_page_fault+0x5f7/0xc90 [ 31.079772] ? lock_downgrade+0x980/0x980 [ 31.083898] ? handle_mm_fault+0x465/0xb10 [ 31.088103] ? check_same_owner+0x320/0x320 [ 31.092407] ? mm_fault_error+0x2c0/0x2c0 [ 31.096531] ? move_addr_to_kernel+0x60/0x60 [ 31.100914] SyS_sendto+0x40/0x50 [ 31.104341] ? SyS_getpeername+0x30/0x30 [ 31.108375] do_syscall_64+0x281/0x940 [ 31.112234] ? __do_page_fault+0xc90/0xc90 [ 31.116440] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 31.121186] ? syscall_return_slowpath+0x550/0x550 [ 31.126106] ? syscall_return_slowpath+0x2ac/0x550 [ 31.131013] ? prepare_exit_to_usermode+0x350/0x350 [ 31.136022] ? retint_user+0x18/0x18 [ 31.139713] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 31.144621] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 31.149788] RIP: 0033:0x441ab9 [ 31.152947] RSP: 002b:00007fff559ced28 EFLAGS: 00000212 ORIG_RAX: 000000000000002c [ 31.160625] RAX: ffffffffffffffda RBX: 000000000000001a RCX: 0000000000441ab9 [ 31.167876] RDX: 0000000000000000 RSI: 0000000020de7000 RDI: 0000000000000004 [ 31.175122] RBP: 00000000004a3d0e R08: 000000002064eff0 R09: 0000000000000080 [ 31.182364] R10: c3fe68eda9554f8b R11: 0000000000000212 R12: 00007fff559cee20 [ 31.189606] R13: 00000000004027e0 R14: 0000000000000000 R15: 0000000000000000 [ 31.196914] Dumping ftrace buffer: [ 31.200436] (ftrace buffer empty) [ 31.204119] Kernel Offset: disabled [ 31.207721] Rebooting in 86400 seconds..