syzkaller login: [ 25.127163] audit: type=1400 audit(1518017352.091:7): avc: denied { map } for pid=4185 comm="syz-fuzzer" path="/root/syz-fuzzer" dev="sda1" ino=16479 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
[ 25.447145] audit: type=1400 audit(1518017352.411:8): avc: denied { map } for pid=4185 comm="syz-fuzzer" path="/sys/kernel/debug/kcov" dev="debugfs" ino=1133 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1
[ 27.088834] can: request_module (can-proto-0) failed.
[ 27.098499] can: request_module (can-proto-0) failed.
[ 27.557679] audit: type=1400 audit(1518017354.522:9): avc: denied { map } for pid=4185 comm="syz-fuzzer" path="/root/syzkaller-shm556552381" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1
[ 27.583146] audit: type=1400 audit(1518017354.522:10): avc: denied { sys_admin } for pid=4228 comm="syz-executor0" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1
[ 27.589413] IPVS: ftp: loaded support on port[0] = 21
[ 27.631519] audit: type=1400 audit(1518017354.596:11): avc: denied { net_admin } for pid=4229 comm="syz-executor0" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1
[ 27.874541] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[ 28.298529] audit: type=1400 audit(1518017355.263:12): avc: denied { sys_chroot } for pid=4229 comm="syz-executor0" capability=18 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1
Warning: Permanently added '10.128.0.44' (ECDSA) to the list of known hosts.
2018/02/07 15:29:46 parsed 1 programs
2018/02/07 15:29:46 executed programs: 0
[ 59.495721] IPVS: ftp: loaded support on port[0] = 21
[ 59.521981] IPVS: ftp: loaded support on port[0] = 21
[ 59.556561] IPVS: ftp: loaded support on port[0] = 21
[ 59.584579] IPVS: ftp: loaded support on port[0] = 21
[ 59.615957] IPVS: ftp: loaded support on port[0] = 21
[ 59.674651] IPVS: ftp: loaded support on port[0] = 21
[ 59.730477] IPVS: ftp: loaded support on port[0] = 21
[ 59.793412] IPVS: ftp: loaded support on port[0] = 21
2018/02/07 15:29:51 executed programs: 279
[ 65.846948] l2tp_core: tunl 3: fd 0 wrong protocol, got 1, expected 17
2018/02/07 15:29:56 executed programs: 518
[ 70.759485] l2tp_core: tunl 3: fd 0 wrong protocol, got 1, expected 17
2018/02/07 15:30:01 executed programs: 755
[ 78.605753] l2tp_core: tunl 3: fd 0 wrong protocol, got 1, expected 17
2018/02/07 15:30:06 executed programs: 993
[ 80.048090] ==================================================================
[ 80.055612] BUG: KASAN: use-after-free in l2tp_tunnel_del_work+0x22e/0x240
[ 80.062624] Read of size 8 at addr ffff8801cdbf2520 by task kworker/u4:14/5459
[ 80.069973]
[ 80.071596] CPU: 1 PID: 5459 Comm: kworker/u4:14 Not tainted 4.15.0+ #35
[ 80.078425] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 80.087789] Workqueue: l2tp l2tp_tunnel_del_work
[ 80.092537] Call Trace:
[ 80.095116] dump_stack+0x194/0x257
[ 80.098748] ? arch_local_irq_restore+0x53/0x53
[ 80.103425] ? show_regs_print_info+0x18/0x18
[ 80.107929] ? l2tp_tunnel_del_work+0x22e/0x240
[ 80.112597] print_address_description+0x73/0x250
[ 80.117435] ? l2tp_tunnel_del_work+0x22e/0x240
[ 80.122101] kasan_report+0x25b/0x340
[ 80.125906] __asan_report_load8_noabort+0x14/0x20
[ 80.130838] l2tp_tunnel_del_work+0x22e/0x240
[ 80.135339] process_one_work+0xbbf/0x1af0
[ 80.139572] ? trace_hardirqs_on+0xd/0x10
[ 80.143718] ? pwq_dec_nr_in_flight+0x450/0x450
[ 80.148399] ? __schedule+0x8f3/0x2060
[ 80.152298] ? debug_check_no_locks_freed+0x3c0/0x3c0
[ 80.157491] ? check_noncircular+0x20/0x20
[ 80.161733] ? account_entity_enqueue+0x3c8/0x6e0
[ 80.166614] ? lock_acquire+0x1d5/0x580
[ 80.170581] ? lock_acquire+0x1d5/0x580
[ 80.174551] ? worker_thread+0x4a3/0x1990
[ 80.178696] ? lock_downgrade+0x980/0x980
[ 80.182844] ? lock_release+0xa40/0xa40
[ 80.186816] ? retint_kernel+0x10/0x10
[ 80.190705] ? do_raw_spin_trylock+0x190/0x190
[ 80.195308] worker_thread+0x223/0x1990
[ 80.199313] ? process_one_work+0x1af0/0x1af0
[ 80.203810] ? _raw_spin_unlock_irq+0x27/0x70
[ 80.208304] ? trace_hardirqs_on_caller+0x421/0x5c0
[ 80.213329] ? trace_hardirqs_on+0xd/0x10
[ 80.217474] ? _raw_spin_unlock_irq+0x27/0x70
[ 80.221967] ? finish_task_switch+0x1d3/0x740
[ 80.226449] ? finish_task_switch+0x1aa/0x740
[ 80.230948] ? copy_overflow+0x20/0x20
[ 80.234851] ? __schedule+0x8f3/0x2060
[ 80.238754] ? check_noncircular+0x20/0x20
[ 80.242984] ? find_held_lock+0x35/0x1d0
[ 80.247054] ? cache_grow_end.part.35+0x84/0x180
[ 80.251814] ? find_held_lock+0x35/0x1d0
[ 80.255881] ? complete+0x62/0x80
[ 80.259350] ? __schedule+0x2060/0x2060
[ 80.263319] ? do_wait_intr_irq+0x3e0/0x3e0
[ 80.267638] ? __lockdep_init_map+0xe4/0x650
[ 80.272042] ? do_raw_spin_trylock+0x190/0x190
[ 80.276621] ? lockdep_init_map+0x9/0x10
[ 80.280680] ? _raw_spin_unlock_irqrestore+0x31/0xba
[ 80.285783] ? trace_hardirqs_on_caller+0x421/0x5c0
[ 80.290794] ? trace_hardirqs_on+0xd/0x10
[ 80.294936] ? __kthread_parkme+0x175/0x240
[ 80.299258] kthread+0x33c/0x400
[ 80.302622] ? process_one_work+0x1af0/0x1af0
[ 80.307114] ? kthread_stop+0x7a0/0x7a0
[ 80.311087] ret_from_fork+0x3a/0x50
[ 80.314816]
[ 80.316433] Allocated by task 13247:
[ 80.320140] save_stack+0x43/0xd0
[ 80.323583] kasan_kmalloc+0xad/0xe0
[ 80.327290] kasan_slab_alloc+0x12/0x20
[ 80.331257] kmem_cache_alloc+0x12e/0x760
[ 80.335400] sock_alloc_inode+0x70/0x300
[ 80.339454] alloc_inode+0x65/0x180
[ 80.343077] new_inode_pseudo+0x69/0x190
[ 80.347133] sock_alloc+0x41/0x270
[ 80.350669] __sock_create+0x148/0x850
[ 80.354549] SyS_socket+0xeb/0x1d0
[ 80.358083] entry_SYSCALL_64_fastpath+0x29/0xa0
[ 80.362832]
[ 80.364451] Freed by task 13264:
[ 80.367810] save_stack+0x43/0xd0
[ 80.371259] kasan_slab_free+0x71/0xc0
[ 80.375143] kmem_cache_free+0x83/0x2a0
[ 80.379109] sock_destroy_inode+0x56/0x70
[ 80.383248] destroy_inode+0x15d/0x200
[ 80.387129] evict+0x57e/0x920
[ 80.390312] iput+0x7b9/0xaf0
[ 80.393408] dentry_unlink_inode+0x4b0/0x5e0
[ 80.397807] __dentry_kill+0x3de/0x700
[ 80.401685] dput.part.21+0x6fb/0x830
[ 80.405476] dput+0x1f/0x30
[ 80.408397] __fput+0x51c/0x7e0
[ 80.411668] ____fput+0x15/0x20
[ 80.414939] task_work_run+0x199/0x270
[ 80.418820] exit_to_usermode_loop+0x275/0x2f0
[ 80.423396] syscall_return_slowpath+0x490/0x550
[ 80.428150] entry_SYSCALL_64_fastpath+0x9e/0xa0
[ 80.432893]
[ 80.434514] The buggy address belongs to the object at ffff8801cdbf2500
[ 80.434514] which belongs to the cache sock_inode_cache of size 992
[ 80.447596] The buggy address is located 32 bytes inside of
[ 80.447596] 992-byte region [ffff8801cdbf2500, ffff8801cdbf28e0)
[ 80.459372] The buggy address belongs to the page:
[ 80.464294] page:ffffea000736fc80 count:1 mapcount:0 mapping:ffff8801cdbf2080 index:0xffff8801cdbf2ffd
[ 80.473737] flags: 0x2fffc0000000100(slab)
[ 80.477969] raw: 02fffc0000000100 ffff8801cdbf2080 ffff8801cdbf2ffd 0000000100000003
[ 80.485843] raw: ffffea0006eb0420 ffffea000736fee0 ffff8801d9fea380 0000000000000000
[ 80.493713] page dumped because: kasan: bad access detected
[ 80.499421]
[ 80.501040] Memory state around the buggy address:
[ 80.505963] ffff8801cdbf2400: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 80.513317] ffff8801cdbf2480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 80.520665] >ffff8801cdbf2500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 80.528013] ^
[ 80.532411] ffff8801cdbf2580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 80.539768] ffff8801cdbf2600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 80.547114] ==================================================================
[ 80.554469] Disabling lock debugging due to kernel taint
[ 80.560049] Kernel panic - not syncing: panic_on_warn set ...
[ 80.560049]
[ 80.567404] CPU: 1 PID: 5459 Comm: kworker/u4:14 Tainted: G B 4.15.0+ #35
[ 80.575529] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 80.584878] Workqueue: l2tp l2tp_tunnel_del_work
[ 80.589642] Call Trace:
[ 80.592221] dump_stack+0x194/0x257
[ 80.595843] ? arch_local_irq_restore+0x53/0x53
[ 80.600502] ? kasan_end_report+0x32/0x50
[ 80.604644] ? trace_hardirqs_on_thunk+0x1a/0x1c
[ 80.609389] ? vsnprintf+0x1ed/0x1900
[ 80.613181] ? l2tp_tunnel_del_work+0x170/0x240
[ 80.617846] panic+0x1e4/0x41c
[ 80.621030] ? refcount_error_report+0x214/0x214
[ 80.625780] ? add_taint+0x1c/0x50
[ 80.629308] ? add_taint+0x1c/0x50
[ 80.632845] ? l2tp_tunnel_del_work+0x22e/0x240
[ 80.637507] kasan_end_report+0x50/0x50
[ 80.641477] kasan_report+0x144/0x340
[ 80.645273] __asan_report_load8_noabort+0x14/0x20
[ 80.650194] l2tp_tunnel_del_work+0x22e/0x240
[ 80.654681] process_one_work+0xbbf/0x1af0
[ 80.658907] ? trace_hardirqs_on+0xd/0x10
[ 80.663056] ? pwq_dec_nr_in_flight+0x450/0x450
[ 80.667731] ? __schedule+0x8f3/0x2060
[ 80.671617] ? debug_check_no_locks_freed+0x3c0/0x3c0
[ 80.676799] ? check_noncircular+0x20/0x20
[ 80.681026] ? account_entity_enqueue+0x3c8/0x6e0
[ 80.685877] ? lock_acquire+0x1d5/0x580
[ 80.689843] ? lock_acquire+0x1d5/0x580
[ 80.693809] ? worker_thread+0x4a3/0x1990
[ 80.697947] ? lock_downgrade+0x980/0x980
[ 80.702090] ? lock_release+0xa40/0xa40
[ 80.706055] ? retint_kernel+0x10/0x10
[ 80.709933] ? do_raw_spin_trylock+0x190/0x190
[ 80.714518] worker_thread+0x223/0x1990
[ 80.718500] ? process_one_work+0x1af0/0x1af0
[ 80.722990] ? _raw_spin_unlock_irq+0x27/0x70
[ 80.727475] ? trace_hardirqs_on_caller+0x421/0x5c0
[ 80.732482] ? trace_hardirqs_on+0xd/0x10
[ 80.736655] ? _raw_spin_unlock_irq+0x27/0x70
[ 80.741145] ? finish_task_switch+0x1d3/0x740
[ 80.745630] ? finish_task_switch+0x1aa/0x740
[ 80.750116] ? copy_overflow+0x20/0x20
[ 80.754007] ? __schedule+0x8f3/0x2060
[ 80.757900] ? check_noncircular+0x20/0x20
[ 80.762125] ? find_held_lock+0x35/0x1d0
[ 80.766190] ? cache_grow_end.part.35+0x84/0x180
[ 80.770935] ? find_held_lock+0x35/0x1d0
[ 80.774994] ? complete+0x62/0x80
[ 80.778453] ? __schedule+0x2060/0x2060
[ 80.782426] ? do_wait_intr_irq+0x3e0/0x3e0
[ 80.786736] ? __lockdep_init_map+0xe4/0x650
[ 80.791135] ? do_raw_spin_trylock+0x190/0x190
[ 80.795715] ? lockdep_init_map+0x9/0x10
[ 80.799769] ? _raw_spin_unlock_irqrestore+0x31/0xba
[ 80.804865] ? trace_hardirqs_on_caller+0x421/0x5c0
[ 80.809874] ? trace_hardirqs_on+0xd/0x10
[ 80.814012] ? __kthread_parkme+0x175/0x240
[ 80.818326] kthread+0x33c/0x400
[ 80.821685] ? process_one_work+0x1af0/0x1af0
[ 80.826176] ? kthread_stop+0x7a0/0x7a0
[ 80.830145] ret_from_fork+0x3a/0x50
[ 80.834307] Dumping ftrace buffer:
[ 80.837830] (ftrace buffer empty)
[ 80.841511] Kernel Offset: disabled
[ 80.845109] Rebooting in 86400 seconds..