[....] Starting enhanced syslogd: rsyslogd[ 16.605542] audit: type=1400 audit(1519113938.894:5): avc: denied { syslog } for pid=4016 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 18.988591] audit: type=1400 audit(1519113941.277:6): avc: denied { map } for pid=4156 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.13' (ECDSA) to the list of known hosts. [ 25.307919] audit: type=1400 audit(1519113947.596:7): avc: denied { map } for pid=4170 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=16479 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2018/02/20 08:05:47 parsed 1 programs 2018/02/20 08:05:47 executed programs: 0 [ 25.575422] audit: type=1400 audit(1519113947.864:8): avc: denied { map } for pid=4170 comm="syz-execprog" path="/root/syzkaller-shm743089636" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 25.594075] IPVS: ftp: loaded support on port[0] = 21 [ 25.811405] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 26.184326] [ 26.185964] ===================================== [ 26.190775] WARNING: bad unlock balance detected! [ 26.195590] 4.16.0-rc1+ #232 Not tainted [ 26.199616] ------------------------------------- [ 26.204431] syz-executor0/4178 is trying to release lock (rcu_read_lock_bh) at: [ 26.211857] [] hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 26.218834] but there are no more locks to release! [ 26.223816] [ 26.223816] other info that might help us debug this: [ 26.230450] 3 locks held by syz-executor0/4178: [ 26.235087] #0: ((&idev->mc_ifc_timer)){+.-.}, at: [<00000000f05bd828>] call_timer_fn+0x1c6/0x820 [ 26.244247] #1: (rcu_read_lock){....}, at: [<0000000095ada7a8>] mld_sendpack+0x180/0xe70 [ 26.252628] #2: (rcu_read_lock){....}, at: [<00000000f23a3bb0>] nf_hook.constprop.37+0x0/0x830 [ 26.261521] [ 26.261521] stack backtrace: [ 26.265984] CPU: 1 PID: 4178 Comm: syz-executor0 Not tainted 4.16.0-rc1+ #232 [ 26.273222] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 26.282542] Call Trace: [ 26.285097] [ 26.287220] dump_stack+0x194/0x257 [ 26.290822] ? arch_local_irq_restore+0x53/0x53 [ 26.295461] ? hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 26.300887] print_unlock_imbalance_bug+0x12f/0x140 [ 26.305870] lock_release+0x6fe/0xa40 [ 26.309641] ? hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 26.315065] ? lock_downgrade+0x980/0x980 [ 26.319183] ? lock_release+0xa40/0xa40 [ 26.323125] ? __raw_spin_lock_init+0x1c/0x100 [ 26.327673] ? do_raw_spin_trylock+0x190/0x190 [ 26.332228] hashlimit_mt_common.isra.10+0x1c08/0x2610 [ 26.337479] ? lock_downgrade+0x980/0x980 [ 26.341598] ? dsthash_find+0x5b0/0x5b0 [ 26.345544] ? __lock_acquire+0x664/0x3e00 [ 26.349748] ? is_bpf_text_address+0x7b/0x120 [ 26.354209] ? lock_downgrade+0x8da/0x980 [ 26.358329] ? rcutorture_record_progress+0x10/0x10 [ 26.363314] ? __kernel_text_address+0xd/0x40 [ 26.367776] ? unwind_get_return_address+0x61/0xa0 [ 26.372675] hashlimit_mt+0x78/0x90 [ 26.376272] ? hashlimit_mt+0x78/0x90 [ 26.380055] ip6t_do_table+0x98d/0x1a30 [ 26.383999] ? kmem_cache_alloc_trace+0x136/0x740 [ 26.388828] ? mld_sendpack+0x617/0xe70 [ 26.392774] ? ip6t_error+0x60/0x60 [ 26.396370] ? check_noncircular+0x20/0x20 [ 26.400575] ? lock_acquire+0x1d5/0x580 [ 26.404516] ? lock_acquire+0x1d5/0x580 [ 26.408458] ? igmp6_mcf_seq_next+0x660/0x660 [ 26.412925] ? lock_release+0xa40/0xa40 [ 26.416871] ip6table_raw_hook+0x65/0x80 [ 26.420900] nf_hook_slow+0xba/0x1a0 [ 26.424584] nf_hook.constprop.37+0x3f6/0x830 [ 26.429054] ? igmp6_mcf_seq_next+0x660/0x660 [ 26.433521] ? trace_hardirqs_on+0xd/0x10 [ 26.437637] ? __local_bh_enable_ip+0x121/0x230 [ 26.442285] ? _raw_spin_unlock_bh+0x30/0x40 [ 26.446670] ? rt6_uncached_list_add+0x1b7/0x240 [ 26.451396] ? rt6_fill_node+0x18b0/0x18b0 [ 26.455607] ? icmp6_dst_alloc+0x475/0x660 [ 26.459813] ? ip6_mc_leave_src+0x1d0/0x1d0 [ 26.464104] ? icmpv6_flow_init+0x1f6/0x270 [ 26.468394] mld_sendpack+0x6c2/0xe70 [ 26.472169] ? nf_hook.constprop.37+0x830/0x830 [ 26.476808] ? mark_held_locks+0xaf/0x100 [ 26.480927] ? trace_hardirqs_on+0xd/0x10 [ 26.485045] ? __local_bh_enable_ip+0x121/0x230 [ 26.489684] mld_ifc_timer_expire+0x3d9/0x770 [ 26.494154] call_timer_fn+0x228/0x820 [ 26.498018] ? mld_dad_timer_expire+0x100/0x100 [ 26.502671] ? process_timeout+0x40/0x40 [ 26.506706] ? __run_timers+0x7e3/0xb70 [ 26.510654] ? lock_downgrade+0x980/0x980 [ 26.514775] ? debug_object_deactivate+0x364/0x560 [ 26.519677] ? lock_release+0xa40/0xa40 [ 26.523627] ? do_raw_spin_trylock+0x190/0x190 [ 26.528191] ? trace_hardirqs_on_caller+0x19e/0x5c0 [ 26.533176] ? mld_dad_timer_expire+0x100/0x100 [ 26.537813] ? mld_dad_timer_expire+0x100/0x100 [ 26.542450] __run_timers+0x7ee/0xb70 [ 26.546229] ? trigger_dyntick_cpu.isra.29+0x150/0x150 [ 26.551480] ? timerqueue_add+0x1e9/0x280 [ 26.555598] ? check_noncircular+0x20/0x20 [ 26.559800] ? enqueue_hrtimer+0x177/0x4b0 [ 26.564009] ? lock_release+0xa40/0xa40 [ 26.567961] ? retrigger_next_event+0x1e0/0x1e0 [ 26.572606] ? find_held_lock+0x35/0x1d0 [ 26.576645] ? clockevents_program_event+0x163/0x2e0 [ 26.581718] ? lock_downgrade+0x980/0x980 [ 26.585844] ? rcu_pm_notify+0xc0/0xc0 [ 26.589706] run_timer_softirq+0x4c/0x70 [ 26.593743] __do_softirq+0x2d7/0xb85 [ 26.597525] ? ktime_get+0x26f/0x3a0 [ 26.601217] ? __irqentry_text_end+0x1f8ee4/0x1f8ee4 [ 26.606304] ? do_timer+0x50/0x50 [ 26.609736] ? native_apic_msr_write+0x5c/0x80 [ 26.614287] ? lapic_next_event+0x54/0x80 [ 26.618411] ? clockevents_program_event+0x108/0x2e0 [ 26.623485] ? tick_program_event+0x83/0x100 [ 26.627867] ? rcu_pm_notify+0xc0/0xc0 [ 26.631728] irq_exit+0x1cc/0x200 [ 26.635154] smp_apic_timer_interrupt+0x16b/0x700 [ 26.639970] ? smp_reschedule_interrupt+0xe6/0x650 [ 26.644872] ? smp_call_function_single_interrupt+0x640/0x640 [ 26.650733] ? _raw_spin_lock+0x32/0x40 [ 26.654684] ? _raw_spin_unlock+0x22/0x30 [ 26.658807] ? handle_edge_irq+0x2b4/0x7c0 [ 26.663014] ? task_prio+0x50/0x50 [ 26.666531] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 26.671347] apic_timer_interrupt+0xa9/0xb0 [ 26.675635] [ 26.677844] RIP: 0010:lock_is_held_type+0x197/0x210 [ 26.682825] RSP: 0018:ffff8801af7cfaf0 EFLAGS: 00000296 ORIG_RAX: ffffffffffffff12 [ 26.690501] RAX: 0000000000000000 RBX: 0000000000000282 RCX: ffffffff81b85edc [ 26.697756] RDX: 1ffffffff0d592cd RSI: 00000000ffffffff RDI: 0000000000000282 [ 26.704996] RBP: ffff8801af7cfb08 R08: 0000000000000000 R09: 1ffff10035ef9f70 [ 26.712242] R10: ffff8801af7cfa10 R11: 0000000000000000 R12: ffff8801aec12200 [ 26.719496] R13: 0000000000000000 R14: 000000000000031a R15: ffff8801b9ac32c0 [ 26.726743] ? dput.part.21+0x7c/0x830 [ 26.730608] ___might_sleep+0x35e/0x470 [ 26.734557] ? trace_event_raw_event_sched_switch+0x810/0x810 [ 26.740417] ? mnt_drop_write+0x67/0x80 [ 26.744360] ? lock_downgrade+0x980/0x980 [ 26.748474] __might_sleep+0x95/0x190 [ 26.752244] dput.part.21+0x8f/0x830 [ 26.755924] ? dentry_path_raw+0x30/0x30 [ 26.759956] dput+0x1f/0x30 [ 26.762863] do_rmdir+0x1bd/0x5f0 [ 26.766289] ? user_path_create+0x40/0x40 [ 26.771027] ? exit_to_usermode_loop+0x198/0x2f0 [ 26.776023] ? fillonedir+0x250/0x250 [ 26.779801] ? do_syscall_64+0xb7/0x940 [ 26.783748] ? SyS_mkdir+0x2a0/0x2a0 [ 26.787431] SyS_rmdir+0x1a/0x20 [ 26.790765] do_syscall_64+0x282/0x940 [ 26.794624] ? __do_page_fault+0xc90/0xc90 [ 26.798833] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 26.803564] ? syscall_return_slowpath+0x550/0x550 [ 26.808469] ? syscall_return_slowpath+0x2ac/0x550 [ 26.813375] ? prepare_exit_to_usermode+0x350/0x350 [ 26.818376] ? entry_SYSCALL_64_after_hwframe+0x36/0x9b [ 26.823712] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 26.828527] entry_SYSCALL_64_after_hwframe+0x26/0x9b [ 26.833687] RIP: 0033:0x453b37 [ 26.836850] RSP: 002b:00007ffd67041918 EFLAGS: 00000206 ORIG_RAX: 0000000000000054 [ 26.844528] RAX: ffffffffffffffda RBX: 0000000000000065 RCX: 0000000000453b37 [ 26.851771] RDX: 0000000000000000 RSI: 00007ffd670436d0 RDI: 00007ffd670436d0 [ 26.859012] RBP: 00007ffd670436d0 R08: 0000000000000001 R09: 0000000000000001 [ 26.866263] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000001a0b940 [ 26.873511] R13: 0000000000000000 R14: 0000000000000003 R15: 0000000001a0a914 2018/02/20 08:05:52 executed programs: 600 2018/02/20 08:05:57 executed programs: 1412