[....] Starting enhanced syslogd: rsyslogd[ 17.116810] audit: type=1400 audit(1519101544.763:5): avc: denied { syslog } for pid=4017 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 22.267559] audit: type=1400 audit(1519101549.914:6): avc: denied { map } for pid=4157 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.15.204' (ECDSA) to the list of known hosts. [ 28.527491] audit: type=1400 audit(1519101556.174:7): avc: denied { map } for pid=4171 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=16479 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2018/02/20 04:39:16 parsed 1 programs 2018/02/20 04:39:16 executed programs: 0 [ 28.792161] audit: type=1400 audit(1519101556.437:8): avc: denied { map } for pid=4171 comm="syz-execprog" path="/root/syzkaller-shm606219689" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 28.805873] IPVS: ftp: loaded support on port[0] = 21 [ 28.817777] audit: type=1400 audit(1519101556.446:9): avc: denied { sys_admin } for pid=4176 comm="syz-executor0" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 28.851331] audit: type=1400 audit(1519101556.497:10): avc: denied { net_admin } for pid=4178 comm="syz-executor0" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 29.049923] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 29.386376] audit: type=1400 audit(1519101557.033:11): avc: denied { sys_chroot } for pid=4178 comm="syz-executor0" capability=18 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 29.400331] [ 29.410869] audit: type=1400 audit(1519101557.043:12): avc: denied { net_raw } for pid=4305 comm="syz-executor0" capability=13 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 29.412404] ===================================== [ 29.412406] WARNING: bad unlock balance detected! [ 29.412410] 4.16.0-rc2+ #320 Not tainted [ 29.412412] ------------------------------------- [ 29.412415] syz-executor0/4305 is trying to release lock (rcu_read_lock_bh) at: [ 29.462376] [] hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 29.469353] but there are no more locks to release! [ 29.474332] [ 29.474332] other info that might help us debug this: [ 29.480964] 2 locks held by syz-executor0/4305: [ 29.485597] #0: (rcu_read_lock){....}, at: [<000000001be7fa2d>] netif_receive_skb_internal+0xa2/0x670 [ 29.495105] #1: (rcu_read_lock){....}, at: [<00000000fb875daa>] ipv6_rcv+0x1446/0x1fa0 [ 29.503306] [ 29.503306] stack backtrace: [ 29.507778] CPU: 0 PID: 4305 Comm: syz-executor0 Not tainted 4.16.0-rc2+ #320 [ 29.515017] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.524338] Call Trace: [ 29.526897] dump_stack+0x194/0x257 [ 29.530498] ? arch_local_irq_restore+0x53/0x53 [ 29.535135] ? hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 29.540555] print_unlock_imbalance_bug+0x12f/0x140 [ 29.545545] lock_release+0x6fe/0xa40 [ 29.549314] ? hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 29.554732] ? lock_downgrade+0x980/0x980 [ 29.558849] ? lock_release+0xa40/0xa40 [ 29.562876] ? __raw_spin_lock_init+0x1c/0x100 [ 29.567428] ? do_raw_spin_trylock+0x190/0x190 [ 29.571987] hashlimit_mt_common.isra.10+0x1c08/0x2610 [ 29.577237] ? dsthash_find+0x5b0/0x5b0 [ 29.581183] ? __lock_acquire+0x664/0x3e00 [ 29.585391] ? __lock_acquire+0x664/0x3e00 [ 29.589594] ? lock_release+0xa40/0xa40 [ 29.593537] ? rb_erase_cached+0xf50/0x3540 [ 29.597831] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 29.602992] ? __lock_acquire+0x664/0x3e00 [ 29.607201] ? get_page_from_freelist+0x2deb/0x52d0 [ 29.612192] hashlimit_mt+0x78/0x90 [ 29.615787] ? hashlimit_mt+0x78/0x90 [ 29.619555] ip6t_do_table+0x98d/0x1a30 [ 29.623498] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 29.628655] ? check_noncircular+0x20/0x20 [ 29.632861] ? ip6t_error+0x60/0x60 [ 29.636464] ? find_held_lock+0x35/0x1d0 [ 29.640496] ? check_noncircular+0x20/0x20 [ 29.644698] ? lock_acquire+0x1d5/0x580 [ 29.648640] ? lock_acquire+0x1d5/0x580 [ 29.652580] ? ipv6_rcv+0x1446/0x1fa0 [ 29.656348] ? lock_release+0xa40/0xa40 [ 29.660290] ip6table_raw_hook+0x65/0x80 [ 29.664325] nf_hook_slow+0xba/0x1a0 [ 29.668009] ipv6_rcv+0x1687/0x1fa0 [ 29.671611] ? ip6_rcv_finish+0x8c0/0x8c0 [ 29.675726] ? lock_downgrade+0x980/0x980 [ 29.679843] ? lock_release+0xa40/0xa40 [ 29.683786] ? is_bpf_text_address+0xa4/0x120 [ 29.688255] ? ip6_input+0x560/0x560 [ 29.691935] ? ip6_rcv_finish+0x8c0/0x8c0 [ 29.696068] __netif_receive_skb_core+0x1a41/0x3460 [ 29.701053] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 29.706218] ? nf_ingress+0x9f0/0x9f0 [ 29.709990] ? __skb_flow_dissect+0x4ce/0x3f00 [ 29.714541] ? do_syscall_64+0x280/0x940 [ 29.718571] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 29.723904] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 29.729065] ? __skb_flow_get_ports+0x420/0x420 [ 29.733704] ? check_noncircular+0x20/0x20 [ 29.737910] ? __lock_is_held+0xb6/0x140 [ 29.741950] ? print_irqtrace_events+0x270/0x270 [ 29.746685] ? find_held_lock+0x35/0x1d0 [ 29.750726] ? lock_downgrade+0x980/0x980 [ 29.754849] ? tun_build_skb.isra.50+0xb11/0x1850 [ 29.759663] ? pvclock_read_flags+0x160/0x160 [ 29.764128] ? lock_acquire+0x1d5/0x580 [ 29.768070] ? lock_acquire+0x1d5/0x580 [ 29.772012] ? netif_receive_skb_internal+0xa2/0x670 [ 29.777085] ? ktime_get_with_offset+0x2c1/0x420 [ 29.781810] ? lock_release+0xa40/0xa40 [ 29.785754] ? do_gettimeofday+0x190/0x190 [ 29.789957] ? tun_build_skb.isra.50+0x397/0x1850 [ 29.794771] __netif_receive_skb+0x2c/0x1b0 [ 29.799063] ? __netif_receive_skb+0x2c/0x1b0 [ 29.803526] netif_receive_skb_internal+0x10b/0x670 [ 29.808520] ? dev_cpu_dead+0xb00/0xb00 [ 29.812465] ? pagevec_lru_move_fn+0x1ce/0x260 [ 29.817015] ? get_kernel_page+0x110/0x110 [ 29.821220] ? rcu_pm_notify+0xc0/0xc0 [ 29.825080] netif_receive_skb+0xae/0x390 [ 29.829201] ? print_irqtrace_events+0x270/0x270 [ 29.833925] ? netif_receive_skb_internal+0x670/0x670 [ 29.839085] ? find_held_lock+0x35/0x1d0 [ 29.843131] ? tun_rx_batched.isra.52+0x5c4/0x870 [ 29.847942] tun_rx_batched.isra.52+0x5ee/0x870 [ 29.852581] ? skb_probe_transport_header.constprop.68+0x14a/0x2f0 [ 29.858868] ? tun_sock_write_space+0x370/0x370 [ 29.863510] tun_get_user+0x25de/0x3940 [ 29.867455] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 29.872626] ? do_huge_pmd_anonymous_page+0xab1/0x1b00 [ 29.877874] ? tun_build_skb.isra.50+0x1850/0x1850 [ 29.882772] ? clear_huge_page+0x309/0x730 [ 29.886976] ? _raw_spin_unlock+0x22/0x30 [ 29.891096] ? mmdrop+0x18/0x30 [ 29.894346] ? drop_futex_key_refs.isra.13+0x63/0xa0 [ 29.899419] ? find_held_lock+0x35/0x1d0 [ 29.903450] ? tun_get+0x1ab/0x2e0 [ 29.906959] ? lock_release+0xa40/0xa40 [ 29.910904] ? __lock_is_held+0xb6/0x140 [ 29.914937] ? tun_get+0x1d4/0x2e0 [ 29.918447] ? tun_do_read+0x26c0/0x26c0 [ 29.922478] ? __check_object_size+0x8b/0x530 [ 29.926945] ? rcu_note_context_switch+0x710/0x710 [ 29.931850] tun_chr_write_iter+0xbd/0x1c0 [ 29.936056] do_iter_readv_writev+0x55c/0x830 [ 29.940528] ? vfs_dedupe_file_range+0x8f0/0x8f0 [ 29.945258] ? rw_verify_area+0xe5/0x2b0 [ 29.949287] do_iter_write+0x154/0x540 [ 29.953144] ? dup_iter+0x260/0x260 [ 29.956739] vfs_writev+0x18a/0x340 [ 29.960335] ? vfs_iter_write+0xb0/0xb0 [ 29.964287] ? __fdget_pos+0x130/0x190 [ 29.968145] ? __handle_mm_fault+0x3ce0/0x3ce0 [ 29.972696] ? __fdget_raw+0x20/0x20 [ 29.976384] do_writev+0xfc/0x2a0 [ 29.979811] ? do_writev+0xfc/0x2a0 [ 29.983413] ? vfs_writev+0x340/0x340 [ 29.987184] ? mm_fault_error+0x2c0/0x2c0 [ 29.991305] ? move_addr_to_kernel+0x60/0x60 [ 29.995684] ? SyS_readv+0x30/0x30 [ 29.999192] SyS_writev+0x27/0x30 [ 30.002618] do_syscall_64+0x280/0x940 [ 30.006483] ? __do_page_fault+0xc90/0xc90 [ 30.010686] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 30.015420] ? syscall_return_slowpath+0x550/0x550 [ 30.020319] ? syscall_return_slowpath+0x2ac/0x550 [ 30.025217] ? prepare_exit_to_usermode+0x350/0x350 [ 30.030209] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 30.035546] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 30.040358] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 30.045517] RIP: 0033:0x453c60 [ 30.048675] RSP: 002b:0000000000a3e8f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 30.056358] RAX: ffffffffffffffda RBX: 0000000000000046 RCX: 0000000000453c60 [ 30.063605] RDX: 0000000000000001 RSI: 0000000000a3e940 RDI: 0000000000000000 [ 30.070859] RBP: 00000000208bbfba R08: 0000000000000000 R09: 0000000000000000 [ 30.078101] R10: 0000000000000046 R11: 0000000000000246 R12: 00000000ffffffff [ 30.085340] R13: 0000000000000610 R14: 000000