[....] Starting enhanced syslogd: rsyslogd[ 12.406700] audit: type=1400 audit(1515917393.258:5): avc: denied { syslog } for pid=3508 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 18.198669] audit: type=1400 audit(1515917399.050:6): avc: denied { map } for pid=3648 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.15.245' (ECDSA) to the list of known hosts. executing program executing program [ 32.305611] audit: type=1400 audit(1515917413.157:7): avc: denied { map } for pid=3664 comm="syzkaller583599" path="/root/syzkaller583599471" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 executing program executing program [ 32.475641] [ 32.477322] ========================= [ 32.481096] WARNING: held lock freed! [ 32.484862] 4.15.0-rc7-next-20180112+ #96 Not tainted [ 32.490015] ------------------------- [ 32.493782] syzkaller583599/3666 is freeing memory 000000007db82c44-000000003ad84a09, with a lock still held there! [ 32.504318] (sk_lock-AF_INET6){+.+.}, at: [<0000000090c78302>] sctp_wait_for_sndbuf+0x509/0x8d0 [ 32.513233] 1 lock held by syzkaller583599/3666: [ 32.517966] #0: (sk_lock-AF_INET6){+.+.}, at: [<0000000090c78302>] sctp_wait_for_sndbuf+0x509/0x8d0 [ 32.528429] [ 32.528429] stack backtrace: [ 32.532893] CPU: 0 PID: 3666 Comm: syzkaller583599 Not tainted 4.15.0-rc7-next-20180112+ #96 [ 32.541440] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 32.550757] Call Trace: [ 32.553313] dump_stack+0x194/0x257 [ 32.556919] ? arch_local_irq_restore+0x53/0x53 [ 32.561576] debug_check_no_locks_freed+0x32f/0x3c0 [ 32.566651] kmem_cache_free+0x68/0x2b0 [ 32.570595] __sk_destruct+0x622/0x910 [ 32.574802] ? kfree+0xd9/0x260 [ 32.578056] ? sock_rfree+0x160/0x160 [ 32.581833] ? sock_sendmsg+0xca/0x110 [ 32.587006] ? SyS_sendto+0x40/0x50 [ 32.590871] ? entry_SYSCALL_64_fastpath+0x29/0xa0 [ 32.595780] ? debug_check_no_obj_freed+0x611/0xf1f [ 32.600765] ? check_noncircular+0x20/0x20 [ 32.604967] ? print_irqtrace_events+0x270/0x270 [ 32.609702] ? __local_bh_enable_ip+0x121/0x230 [ 32.614347] ? sctp_put_port+0x495/0x640 [ 32.618386] ? sctp_poll+0xc00/0xc00 [ 32.622070] ? refcount_sub_and_test+0x115/0x1b0 [ 32.627051] ? refcount_inc+0x50/0x50 [ 32.630816] ? refcount_inc+0x50/0x50 [ 32.634593] sk_destruct+0x47/0x80 [ 32.638100] __sk_free+0xf1/0x2b0 [ 32.641521] sk_free+0x2a/0x40 [ 32.644683] sctp_association_put+0x14c/0x2f0 [ 32.649756] ? sctp_association_hold+0x20/0x20 [ 32.654304] ? lock_sock_nested+0x91/0x110 [ 32.658506] ? trace_hardirqs_on+0xd/0x10 [ 32.662622] ? __local_bh_enable_ip+0x121/0x230 [ 32.667262] sctp_wait_for_sndbuf+0x673/0x8d0 [ 32.671730] ? sctp_init_sock+0x13b0/0x13b0 [ 32.676017] ? do_raw_spin_trylock+0x190/0x190 [ 32.680566] ? __local_bh_enable_ip+0x121/0x230 [ 32.685202] ? sctp_prsctp_prune+0x97/0x790 [ 32.689491] ? prepare_to_wait+0x4d0/0x4d0 [ 32.693699] ? trace_hardirqs_on+0xd/0x10 [ 32.697818] sctp_sendmsg+0x28f7/0x33f0 [ 32.701769] ? sctp_id2assoc+0x390/0x390 [ 32.705799] ? avc_has_perm+0x43e/0x680 [ 32.709740] ? avc_has_perm_noaudit+0x520/0x520 [ 32.714376] ? __fget+0x35c/0x570 [ 32.717800] ? iterate_fd+0x3f0/0x3f0 [ 32.721572] ? find_held_lock+0x35/0x1d0 [ 32.725610] ? sock_has_perm+0x2a4/0x420 [ 32.729641] ? lock_release+0x972/0xa40 [ 32.733585] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 32.739437] ? __check_object_size+0x8b/0x530 [ 32.743903] inet_sendmsg+0x11f/0x5e0 [ 32.747670] ? inet_sendmsg+0x11f/0x5e0 [ 32.751611] ? __might_sleep+0x95/0x190 [ 32.755552] ? inet_create+0xf50/0xf50 [ 32.759405] ? selinux_socket_sendmsg+0x36/0x40 [ 32.764040] ? security_socket_sendmsg+0x89/0xb0 [ 32.768761] ? inet_create+0xf50/0xf50 [ 32.772616] sock_sendmsg+0xca/0x110 [ 32.776298] SYSC_sendto+0x361/0x5c0 [ 32.779979] ? SYSC_connect+0x4a0/0x4a0 [ 32.783920] ? up_read+0x1a/0x40 [ 32.787254] ? __do_page_fault+0x3d6/0xc90 [ 32.792084] ? __do_page_fault+0xc90/0xc90 [ 32.796470] ? SyS_futex+0x269/0x390 [ 32.800152] ? SyS_setsockopt+0x215/0x360 [ 32.804269] ? do_futex+0x22a0/0x22a0 [ 32.808052] ? entry_SYSCALL_64_fastpath+0x5/0xa0 [ 32.812867] SyS_sendto+0x40/0x50 [ 32.816299] entry_SYSCALL_64_fastpath+0x29/0xa0 [ 32.821020] RIP: 0033:0x445819 [ 32.824175] RSP: 002b:00007f7ed49c1da8 EFLAGS: 00000216 ORIG_RAX: 000000000000002c [ 32.831860] RAX: ffffffffffffffda RBX: 00000000006dac3c RCX: 0000000000445819 [ 32.839097] RDX: 0000000000000001 RSI: 000000002010bf14 RDI: 0000000000000005 [ 32.846344] RBP: 00000000006dac38 R08: 00000000204d9000 R09: 000000000000001c [ 32.853581] R10: 0000000000000000 R11: 0000000000000216 R12: 0000000000000000 [ 32.860820] R13: 00007ffdb956e09f R14: 00007f7ed49c29c0 R15: 0000000000000001 [ 32.868158] ================================================================== executing program [ 32.875496] BUG: KASAN: use-after-free in do_raw_spin_lock+0x1e0/0x220 [ 32.882129] Read of size 4 at addr ffff8801bc08b88c by task syzkaller583599/3666 [ 32.889626] [ 32.891232] CPU: 0 PID: 3666 Comm: syzkaller583599 Not tainted 4.15.0-rc7-next-20180112+ #96 [ 32.899945] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 32.909264] Call Trace: [ 32.911821] dump_stack+0x194/0x257 [ 32.915414] ? arch_local_irq_restore+0x53/0x53 [ 32.920051] ? show_regs_print_info+0x18/0x18 [ 32.924528] ? lock_acquire+0x1d5/0x580 [ 32.928480] ? trace_hardirqs_on+0xd/0x10 [ 32.932605] ? do_raw_spin_lock+0x1e0/0x220 [ 32.936906] print_address_description+0x73/0x250 [ 32.941716] ? do_raw_spin_lock+0x1e0/0x220 [ 32.946003] kasan_report+0x23b/0x360 [ 32.949773] __asan_report_load4_noabort+0x14/0x20 [ 32.955189] do_raw_spin_lock+0x1e0/0x220 [ 32.959653] _raw_spin_lock_bh+0x39/0x40 [ 32.963683] ? release_sock+0x74/0x2a0 [ 32.967536] release_sock+0x74/0x2a0 [ 32.971216] ? sctp_prsctp_prune+0x97/0x790 [ 32.975503] ? __release_sock+0x360/0x360 [ 32.979622] ? trace_hardirqs_on+0xd/0x10 [ 32.983740] sctp_sendmsg+0x2993/0x33f0 [ 32.987688] ? sctp_id2assoc+0x390/0x390 [ 32.992064] ? avc_has_perm+0x43e/0x680 [ 32.996116] ? avc_has_perm_noaudit+0x520/0x520 [ 33.000768] ? __fget+0x35c/0x570 [ 33.004208] ? iterate_fd+0x3f0/0x3f0 [ 33.007982] ? find_held_lock+0x35/0x1d0 [ 33.012016] ? sock_has_perm+0x2a4/0x420 [ 33.016583] ? lock_release+0x972/0xa40 [ 33.020526] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 33.026390] ? __check_object_size+0x8b/0x530 [ 33.030858] inet_sendmsg+0x11f/0x5e0 [ 33.034625] ? inet_sendmsg+0x11f/0x5e0 [ 33.038567] ? __might_sleep+0x95/0x190 [ 33.042516] ? inet_create+0xf50/0xf50 [ 33.046373] ? selinux_socket_sendmsg+0x36/0x40 [ 33.051008] ? security_socket_sendmsg+0x89/0xb0 [ 33.055738] ? inet_create+0xf50/0xf50 [ 33.059595] sock_sendmsg+0xca/0x110 [ 33.063277] SYSC_sendto+0x361/0x5c0 [ 33.066968] ? SYSC_connect+0x4a0/0x4a0 [ 33.070911] ? up_read+0x1a/0x40 [ 33.074781] ? __do_page_fault+0x3d6/0xc90 [ 33.080472] ? __do_page_fault+0xc90/0xc90 [ 33.084676] ? SyS_futex+0x269/0x390 [ 33.088357] ? SyS_setsockopt+0x215/0x360 [ 33.092474] ? do_futex+0x22a0/0x22a0 [ 33.096253] ? entry_SYSCALL_64_fastpath+0x5/0xa0 [ 33.101065] SyS_sendto+0x40/0x50 [ 33.104488] entry_SYSCALL_64_fastpath+0x29/0xa0 [ 33.109219] RIP: 0033:0x445819 [ 33.112387] RSP: 002b:00007f7ed49c1da8 EFLAGS: 00000216 ORIG_RAX: 000000000000002c [ 33.120061] RAX: ffffffffffffffda RBX: 00000000006dac3c RCX: 0000000000445819 [ 33.128272] RDX: 0000000000000001 RSI: 000000002010bf14 RDI: 0000000000000005 [ 33.135509] RBP: 00000000006dac38 R08: 00000000204d9000 R09: 000000000000001c [ 33.142748] R10: 0000000000000000 R11: 0000000000000216 R12: 0000000000000000 [ 33.149984] R13: 00007ffdb956e09f R14: 00007f7ed49c29c0 R15: 0000000000000001 [ 33.157247] [ 33.158843] Allocated by task 3667: [ 33.162443] save_stack+0x43/0xd0 [ 33.165861] kasan_kmalloc+0xad/0xe0 [ 33.169539] kasan_slab_alloc+0x12/0x20 [ 33.173480] kmem_cache_alloc+0x12e/0x760 [ 33.177594] sk_prot_alloc+0x65/0x2a0 [ 33.181359] sk_alloc+0x105/0x1440 [ 33.184868] sctp_v6_create_accept_sk+0x15a/0x9b0 [ 33.189677] sctp_accept+0x5c4/0x970 [ 33.193357] inet_accept+0x12c/0x930 [ 33.197045] SYSC_accept4+0x38d/0x870 [ 33.200811] SyS_accept4+0x2c/0x40 [ 33.204317] entry_SYSCALL_64_fastpath+0x29/0xa0 [ 33.209034] [ 33.210627] Freed by task 3666: [ 33.213874] save_stack+0x43/0xd0 [ 33.217292] __kasan_slab_free+0x11a/0x170 [ 33.221501] kasan_slab_free+0xe/0x10 [ 33.225268] kmem_cache_free+0x86/0x2b0 [ 33.229207] __sk_destruct+0x622/0x910 [ 33.233500] sk_destruct+0x47/0x80 [ 33.237006] __sk_free+0xf1/0x2b0 [ 33.240422] sk_free+0x2a/0x40 [ 33.243592] sctp_association_put+0x14c/0x2f0 [ 33.248061] sctp_wait_for_sndbuf+0x673/0x8d0 [ 33.253047] sctp_sendmsg+0x28f7/0x33f0 [ 33.256987] inet_sendmsg+0x11f/0x5e0 [ 33.260763] sock_sendmsg+0xca/0x110 [ 33.264443] SYSC_sendto+0x361/0x5c0 [ 33.268121] SyS_sendto+0x40/0x50 [ 33.271547] entry_SYSCALL_64_fastpath+0x29/0xa0 [ 33.276265] [ 33.277860] The buggy address belongs to the object at ffff8801bc08b800 [ 33.277860] which belongs to the cache SCTPv6 of size 1888 [ 33.290143] The buggy address is located 140 bytes inside of [ 33.290143] 1888-byte region [ffff8801bc08b800, ffff8801bc08bf60) [ 33.302068] The buggy address belongs to the page: [ 33.306962] page:ffffea0006f022c0 count:1 mapcount:0 mapping:ffff8801bc08b000 index:0x0 [ 33.315077] flags: 0x2fffc0000000100(slab) [ 33.319283] raw: 02fffc0000000100 ffff8801bc08b000 0000000000000000 0000000100000002 [ 33.327132] raw: ffffea0006f06ca0 ffffea00076555a0 ffff8801d2fa4680 0000000000000000 [ 33.334975] page dumped because: kasan: bad access detected [ 33.340655] [ 33.342257] Memory state around the buggy address: [ 33.347161] ffff8801bc08b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.355629] ffff8801bc08b800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.363563] >ffff8801bc08b880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.370890] ^ [ 33.374492] ffff8801bc08b900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.381821] ffff8801bc08b980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.389145] ================================================================== [ 33.396855] Kernel panic - not syncing: panic_on_warn set ... [ 33.396855] [ 33.404200] CPU: 0 PID: 3666 Comm: syzkaller583599 Tainted: G B 4.15.0-rc7-next-20180112+ #96 [ 33.415095] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 33.425453] Call Trace: [ 33.428015] dump_stack+0x194/0x257 [ 33.431612] ? arch_local_irq_restore+0x53/0x53 [ 33.436870] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 33.441605] ? vsnprintf+0x1ed/0x1900 [ 33.445376] ? do_raw_spin_lock+0x110/0x220 [ 33.449665] panic+0x1e4/0x41c [ 33.452827] ? refcount_error_report+0x214/0x214 [ 33.457556] ? add_taint+0x1c/0x50 [ 33.461064] ? add_taint+0x1c/0x50 [ 33.464573] ? do_raw_spin_lock+0x1e0/0x220 [ 33.468872] kasan_end_report+0x50/0x50 [ 33.472831] kasan_report+0x148/0x360 [ 33.476611] __asan_report_load4_noabort+0x14/0x20 [ 33.481505] do_raw_spin_lock+0x1e0/0x220 [ 33.485624] _raw_spin_lock_bh+0x39/0x40 [ 33.489653] ? release_sock+0x74/0x2a0 [ 33.493515] release_sock+0x74/0x2a0 [ 33.497196] ? sctp_prsctp_prune+0x97/0x790 [ 33.501485] ? __release_sock+0x360/0x360 [ 33.505599] ? trace_hardirqs_on+0xd/0x10 [ 33.509714] sctp_sendmsg+0x2993/0x33f0 [ 33.513662] ? sctp_id2assoc+0x390/0x390 [ 33.517707] ? avc_has_perm+0x43e/0x680 [ 33.521649] ? avc_has_perm_noaudit+0x520/0x520 [ 33.526287] ? __fget+0x35c/0x570 [ 33.529712] ? iterate_fd+0x3f0/0x3f0 [ 33.533485] ? find_held_lock+0x35/0x1d0 [ 33.538124] ? sock_has_perm+0x2a4/0x420 [ 33.542165] ? lock_release+0x972/0xa40 [ 33.546106] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 33.552045] ? __check_object_size+0x8b/0x530 [ 33.556511] inet_sendmsg+0x11f/0x5e0 [ 33.560293] ? inet_sendmsg+0x11f/0x5e0 [ 33.564236] ? __might_sleep+0x95/0x190 [ 33.568363] ? inet_create+0xf50/0xf50 [ 33.572220] ? selinux_socket_sendmsg+0x36/0x40 [ 33.576855] ? security_socket_sendmsg+0x89/0xb0 [ 33.581580] ? inet_create+0xf50/0xf50 [ 33.586323] sock_sendmsg+0xca/0x110 [ 33.591143] SYSC_sendto+0x361/0x5c0 [ 33.595986] ? SYSC_connect+0x4a0/0x4a0 [ 33.600627] ? up_read+0x1a/0x40 [ 33.603960] ? __do_page_fault+0x3d6/0xc90 [ 33.609744] ? __do_page_fault+0xc90/0xc90 [ 33.613949] ? SyS_futex+0x269/0x390 [ 33.617629] ? SyS_setsockopt+0x215/0x360 [ 33.621745] ? do_futex+0x22a0/0x22a0 [ 33.625516] ? entry_SYSCALL_64_fastpath+0x5/0xa0 [ 33.630337] SyS_sendto+0x40/0x50 [ 33.633768] entry_SYSCALL_64_fastpath+0x29/0xa0 [ 33.638491] RIP: 0033:0x445819 [ 33.641649] RSP: 002b:00007f7ed49c1da8 EFLAGS: 00000216 ORIG_RAX: 000000000000002c [ 33.649322] RAX: ffffffffffffffda RBX: 00000000006dac3c RCX: 0000000000445819 [ 33.656571] RDX: 0000000000000001 RSI: 000000002010bf14 RDI: 0000000000000005 [ 33.663808] RBP: 00000000006dac38 R08: 00000000204d9000 R09: 000000000000001c [ 33.671052] R10: 0000000000000000 R11: 0000000000000216 R12: 0000000000000000 [ 33.678310] R13: 00007ffdb956e09f R14: 00007f7ed49c29c0 R15: 0000000000000001 [ 33.686150] Dumping ftrace buffer: [ 33.689668] (ftrace buffer empty) [ 33.693369] Kernel Offset: disabled [ 33.696978] Rebooting in 86400 seconds..