[....] Starting enhanced syslogd: rsyslogd[ 15.234284] audit: type=1400 audit(1519113918.014:5): avc: denied { syslog } for pid=3933 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 17.595162] audit: type=1400 audit(1519113920.374:6): avc: denied { map } for pid=4072 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.37' (ECDSA) to the list of known hosts. [ 25.324858] audit: type=1400 audit(1519113928.104:7): avc: denied { map } for pid=4086 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=16479 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2018/02/20 08:05:28 parsed 1 programs 2018/02/20 08:05:28 executed programs: 0 [ 25.590986] audit: type=1400 audit(1519113928.370:8): avc: denied { map } for pid=4086 comm="syz-execprog" path="/root/syzkaller-shm100432355" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 25.604122] IPVS: ftp: loaded support on port[0] = 21 [ 25.824892] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 26.465281] [ 26.466935] ===================================== [ 26.471756] WARNING: bad unlock balance detected! [ 26.476569] 4.16.0-rc2+ #320 Not tainted [ 26.480597] ------------------------------------- [ 26.485409] syz-executor0/4245 is trying to release lock (rcu_read_lock_bh) at: [ 26.492837] [] hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 26.499816] but there are no more locks to release! [ 26.504797] [ 26.504797] other info that might help us debug this: [ 26.511429] 3 locks held by syz-executor0/4245: [ 26.516071] #0: ((&idev->mc_ifc_timer)){+.-.}, at: [<0000000032ed0ca2>] call_timer_fn+0x1c6/0x820 [ 26.525234] #1: (rcu_read_lock){....}, at: [<0000000071c537f3>] mld_sendpack+0x180/0xe70 [ 26.533621] #2: (rcu_read_lock){....}, at: [<0000000002d1b51f>] nf_hook.constprop.37+0x0/0x830 [ 26.542528] [ 26.542528] stack backtrace: [ 26.546993] CPU: 0 PID: 4245 Comm: syz-executor0 Not tainted 4.16.0-rc2+ #320 [ 26.554236] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 26.563568] Call Trace: [ 26.566124] [ 26.568246] dump_stack+0x194/0x257 [ 26.571844] ? arch_local_irq_restore+0x53/0x53 [ 26.576490] ? hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 26.581922] print_unlock_imbalance_bug+0x12f/0x140 [ 26.586909] lock_release+0x6fe/0xa40 [ 26.590692] ? hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 26.596125] ? lock_downgrade+0x980/0x980 [ 26.600242] ? lock_release+0xa40/0xa40 [ 26.604186] ? __raw_spin_lock_init+0x1c/0x100 [ 26.608746] ? do_raw_spin_trylock+0x190/0x190 [ 26.613301] hashlimit_mt_common.isra.10+0x1c08/0x2610 [ 26.618556] ? lock_downgrade+0x980/0x980 [ 26.622696] ? dsthash_find+0x5b0/0x5b0 [ 26.626727] ? __lock_acquire+0x664/0x3e00 [ 26.630934] ? is_bpf_text_address+0x7b/0x120 [ 26.635418] ? lock_downgrade+0x95a/0x980 [ 26.639538] ? rcutorture_record_progress+0x10/0x10 [ 26.644525] ? __kernel_text_address+0xd/0x40 [ 26.648989] ? unwind_get_return_address+0x61/0xa0 [ 26.653982] hashlimit_mt+0x78/0x90 [ 26.657579] ? hashlimit_mt+0x78/0x90 [ 26.661348] ip6t_do_table+0x98d/0x1a30 [ 26.665296] ? kmem_cache_alloc_trace+0x136/0x740 [ 26.670109] ? mld_sendpack+0x617/0xe70 [ 26.674057] ? ip6t_error+0x60/0x60 [ 26.677667] ? __fput+0x327/0x7e0 [ 26.681095] ? check_noncircular+0x20/0x20 [ 26.685299] ? lock_acquire+0x1d5/0x580 [ 26.689242] ? lock_acquire+0x1d5/0x580 [ 26.693195] ? igmp6_mcf_seq_next+0x660/0x660 [ 26.697663] ? lock_release+0xa40/0xa40 [ 26.701611] ip6table_raw_hook+0x65/0x80 [ 26.705644] nf_hook_slow+0xba/0x1a0 [ 26.709328] nf_hook.constprop.37+0x3f6/0x830 [ 26.713793] ? igmp6_mcf_seq_next+0x660/0x660 [ 26.718256] ? trace_hardirqs_on+0xd/0x10 [ 26.722376] ? __local_bh_enable_ip+0x121/0x230 [ 26.727019] ? _raw_spin_unlock_bh+0x30/0x40 [ 26.731405] ? rt6_uncached_list_add+0x1b7/0x240 [ 26.736131] ? rt6_fill_node+0x18b0/0x18b0 [ 26.740337] ? icmp6_dst_alloc+0x475/0x660 [ 26.744552] ? ip6_mc_leave_src+0x1d0/0x1d0 [ 26.748853] ? icmpv6_flow_init+0x1f6/0x270 [ 26.753145] mld_sendpack+0x6c2/0xe70 [ 26.756927] ? nf_hook.constprop.37+0x830/0x830 [ 26.761566] ? mark_held_locks+0xaf/0x100 [ 26.765689] ? trace_hardirqs_on+0xd/0x10 [ 26.769806] ? __local_bh_enable_ip+0x121/0x230 [ 26.774443] mld_ifc_timer_expire+0x3d9/0x770 [ 26.778911] call_timer_fn+0x228/0x820 [ 26.782779] ? mld_dad_timer_expire+0x100/0x100 [ 26.787419] ? process_timeout+0x40/0x40 [ 26.791449] ? __run_timers+0x7e3/0xb70 [ 26.795403] ? lock_downgrade+0x980/0x980 [ 26.799524] ? debug_object_deactivate+0x364/0x560 [ 26.804428] ? lock_release+0xa40/0xa40 [ 26.808382] ? do_raw_spin_trylock+0x190/0x190 [ 26.812935] ? trace_hardirqs_on_caller+0x19e/0x5c0 [ 26.817919] ? mld_dad_timer_expire+0x100/0x100 [ 26.822558] ? mld_dad_timer_expire+0x100/0x100 [ 26.827195] __run_timers+0x7ee/0xb70 [ 26.830971] ? trigger_dyntick_cpu.isra.29+0x150/0x150 [ 26.836218] ? timerqueue_add+0x1e9/0x280 [ 26.840342] ? check_noncircular+0x20/0x20 [ 26.844547] ? enqueue_hrtimer+0x177/0x4b0 [ 26.848749] ? lock_release+0xa40/0xa40 [ 26.852693] ? retrigger_next_event+0x1e0/0x1e0 [ 26.857333] ? find_held_lock+0x35/0x1d0 [ 26.861364] ? clockevents_program_event+0x163/0x2e0 [ 26.866436] ? lock_downgrade+0x980/0x980 [ 26.870557] ? rcu_pm_notify+0xc0/0xc0 [ 26.874416] run_timer_softirq+0x4c/0x70 [ 26.878448] __do_softirq+0x2d7/0xb85 [ 26.882219] ? ktime_get+0x26f/0x3a0 [ 26.885904] ? __irqentry_text_end+0x1f8ad4/0x1f8ad4 [ 26.890975] ? do_timer+0x50/0x50 [ 26.894398] ? native_apic_msr_write+0x5c/0x80 [ 26.898948] ? lapic_next_event+0x54/0x80 [ 26.903067] ? clockevents_program_event+0x108/0x2e0 [ 26.908140] ? tick_program_event+0x83/0x100 [ 26.912518] ? rcu_pm_notify+0xc0/0xc0 [ 26.916377] irq_exit+0x1cc/0x200 [ 26.919810] smp_apic_timer_interrupt+0x16b/0x700 [ 26.924629] ? smp_reschedule_interrupt+0xe6/0x650 [ 26.929526] ? smp_call_function_single_interrupt+0x640/0x640 [ 26.935381] ? _raw_spin_lock+0x32/0x40 [ 26.939325] ? _raw_spin_unlock+0x22/0x30 [ 26.943458] ? handle_edge_irq+0x2b4/0x7c0 [ 26.947665] ? task_prio+0x50/0x50 [ 26.951269] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 26.956086] apic_timer_interrupt+0x8e/0xa0 [ 26.960375] [ 26.962588] RIP: 0010:kfree+0x106/0x260 [ 26.966539] RSP: 0018:ffff8801bc5173a0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff12 [ 26.974230] RAX: 0000000000000007 RBX: ffff8801d8335500 RCX: 0000000000000000 [ 26.981487] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000282 [ 26.988726] RBP: ffff8801bc5173c0 R08: 0000000000000018 R09: 0000000000000000 [ 26.995973] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000282 [ 27.003223] R13: ffff8801db0001c0 R14: ffffffff8221b5bf R15: 0000000000000000 [ 27.010467] ? selinux_sk_free_security+0x4f/0x60 [ 27.015281] selinux_sk_free_security+0x4f/0x60 [ 27.019921] security_sk_free+0x48/0x80 [ 27.023874] __sk_destruct+0x60f/0x920 [ 27.027730] ? __sk_dst_check+0x380/0x380 [ 27.031849] ? check_noncircular+0x20/0x20 [ 27.036065] ? raw_unhash_sk+0x2f4/0x450 [ 27.040099] ? lock_release+0xa40/0xa40 [ 27.044043] ? find_held_lock+0x35/0x1d0 [ 27.048074] ? sk_common_release+0x166/0x2f0 [ 27.052454] ? lock_downgrade+0x980/0x980 [ 27.056839] ? lock_release+0xa40/0xa40 [ 27.060783] ? refcount_sub_and_test+0x115/0x1b0 [ 27.065506] ? refcount_inc+0x50/0x50 [ 27.069273] ? refcount_inc+0x50/0x50 [ 27.073043] sk_destruct+0x47/0x80 [ 27.076551] __sk_free+0xf1/0x2b0 [ 27.079980] ? compat_rawv6_ioctl+0x50/0x50 [ 27.084271] sk_free+0x2a/0x40 [ 27.087432] sk_common_release+0x1f0/0x2f0 [ 27.091635] rawv6_close+0x54/0x80 [ 27.095145] inet_release+0xed/0x1c0 [ 27.098828] inet6_release+0x50/0x70 [ 27.102512] sock_release+0x8d/0x1e0 [ 27.106194] ? sock_alloc_file+0x560/0x560 [ 27.110396] sock_close+0x16/0x20 [ 27.113821] __fput+0x327/0x7e0 [ 27.117071] ? fput+0x140/0x140 [ 27.120319] ? _raw_spin_unlock_irq+0x27/0x70 [ 27.124783] ____fput+0x15/0x20 [ 27.128036] task_work_run+0x199/0x270 [ 27.131896] ? task_work_cancel+0x210/0x210 [ 27.136189] ? _raw_spin_unlock+0x22/0x30 [ 27.140305] ? switch_task_namespaces+0x87/0xc0 [ 27.144953] do_exit+0x9bb/0x1ad0 [ 27.148378] ? __check_object_size+0x8b/0x530 [ 27.152932] ? mm_update_next_owner+0x930/0x930 [ 27.157579] ? __might_sleep+0x95/0x190 [ 27.161538] ? kasan_check_write+0x14/0x20 [ 27.165743] ? _copy_from_user+0x99/0x110 [ 27.169864] ? rw_copy_check_uvector+0x1be/0x280 [ 27.174590] ? rcu_pm_notify+0xc0/0xc0 [ 27.178447] ? vfs_writev+0x210/0x340 [ 27.182225] ? kfree+0x1f6/0x260 [ 27.185560] ? vfs_writev+0x215/0x340 [ 27.189333] ? nf_setsockopt+0x93/0xc0 [ 27.193192] ? __fdget_pos+0x130/0x190 [ 27.197049] ? __fdget_raw+0x20/0x20 [ 27.200736] ? SyS_futex+0x269/0x390 [ 27.204431] do_group_exit+0x149/0x400 [ 27.208288] ? do_futex+0x22a0/0x22a0 [ 27.212058] ? SyS_exit+0x30/0x30 [ 27.215483] ? move_addr_to_kernel+0x60/0x60 [ 27.219869] ? do_syscall_64+0xb6/0x940 [ 27.223818] ? do_group_exit+0x400/0x400 [ 27.227860] SyS_exit_group+0x1d/0x20 [ 27.231639] do_syscall_64+0x280/0x940 [ 27.235495] ? __do_page_fault+0xc90/0xc90 [ 27.239700] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 27.244425] ? syscall_return_slowpath+0x550/0x550 [ 27.249322] ? syscall_return_slowpath+0x2ac/0x550 [ 27.254222] ? prepare_exit_to_usermode+0x350/0x350 [ 27.259211] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 27.264544] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 27.269355] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 27.274522] RIP: 0033:0x453da9 [ 27.277681] RSP: 002b:00007ffcc9aff008 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 27.285356] RAX: ffffffffffffffda RBX: 0000000000000018 RCX: 0000000000453da9 [ 27.292593] RDX: 0000000000000610 RSI: 0000000000735188 RDI: 0000000000000000 [ 27.299831] RBP: 00007ffcc9aff6e0 R08: 0000000000000000 R09: 0000000000000003 [ 27.307068] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 27.314308] R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000001380 2018/02/20 08:05:33 executed programs: 570 2018/02/20 08:05:38 executed programs: 1398