[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 17.913911] audit: type=1400 audit(1519103808.691:6): avc: denied { map } for pid=4136 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.15.192' (ECDSA) to the list of known hosts. syzkaller login: [ 24.210967] audit: type=1400 audit(1519103814.988:7): avc: denied { map } for pid=4150 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=16479 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2018/02/20 05:16:55 parsed 1 programs 2018/02/20 05:16:55 executed programs: 0 [ 24.472902] audit: type=1400 audit(1519103815.250:8): avc: denied { map } for pid=4150 comm="syz-execprog" path="/root/syzkaller-shm521104787" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 24.490202] IPVS: ftp: loaded support on port[0] = 21 [ 24.498754] audit: type=1400 audit(1519103815.260:9): avc: denied { sys_admin } for pid=4155 comm="syz-executor0" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 24.532695] audit: type=1400 audit(1519103815.310:10): avc: denied { net_admin } for pid=4158 comm="syz-executor0" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 24.726690] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 25.052434] audit: type=1400 audit(1519103815.830:11): avc: denied { sys_chroot } for pid=4158 comm="syz-executor0" capability=18 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 25.065139] [ 25.076902] audit: type=1400 audit(1519103815.838:12): avc: denied { net_raw } for pid=4285 comm="syz-executor0" capability=13 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 25.078478] ===================================== [ 25.078480] WARNING: bad unlock balance detected! [ 25.078484] 4.16.0-rc1+ #232 Not tainted [ 25.078486] ------------------------------------- [ 25.078489] syz-executor0/4285 is trying to release lock (rcu_read_lock_bh) at: [ 25.128469] [] hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 25.135456] but there are no more locks to release! [ 25.140446] [ 25.140446] other info that might help us debug this: [ 25.147094] 5 locks held by syz-executor0/4285: [ 25.151744] #0: (rcu_read_lock){....}, at: [<00000000f4b1d9d8>] netif_receive_skb_internal+0xa2/0x670 [ 25.161250] #1: (rcu_read_lock){....}, at: [<000000005701b738>] ipv6_rcv+0x117/0x1fa0 [ 25.169900] #2: (k-slock-AF_INET6){+...}, at: [<000000004b2f2ed6>] icmp6_send+0x1250/0x2bb0 [ 25.178543] #3: (rcu_read_lock){....}, at: [<000000007b4f372b>] icmp6_send+0x1d37/0x2bb0 [ 25.186920] #4: (rcu_read_lock){....}, at: [<000000007f7b5117>] __ip6_local_out+0x2f1/0xaa0 [ 25.195557] [ 25.195557] stack backtrace: [ 25.200032] CPU: 1 PID: 4285 Comm: syz-executor0 Not tainted 4.16.0-rc1+ #232 [ 25.207274] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 25.216597] Call Trace: [ 25.219157] dump_stack+0x194/0x257 [ 25.222756] ? arch_local_irq_restore+0x53/0x53 [ 25.227404] ? hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 25.232825] print_unlock_imbalance_bug+0x12f/0x140 [ 25.237817] lock_release+0x6fe/0xa40 [ 25.241590] ? hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 25.247023] ? lock_downgrade+0x980/0x980 [ 25.251150] ? lock_release+0xa40/0xa40 [ 25.255093] ? __raw_spin_lock_init+0x1c/0x100 [ 25.259643] ? do_raw_spin_trylock+0x190/0x190 [ 25.264199] hashlimit_mt_common.isra.10+0x1c08/0x2610 [ 25.269446] ? ipv6_dev_get_saddr+0x4e2/0xdc0 [ 25.273914] ? dsthash_find+0x5b0/0x5b0 [ 25.277868] ? __lock_acquire+0x664/0x3e00 [ 25.282072] ? refcount_add+0x2a/0x60 [ 25.285844] ? skb_set_owner_w+0x232/0x330 [ 25.290051] ? icmp6_send+0x24c5/0x2bb0 [ 25.294006] ? print_irqtrace_events+0x270/0x270 [ 25.298744] ? sock_wmalloc+0x1d0/0x1d0 [ 25.302688] ? __lock_acquire+0x664/0x3e00 [ 25.306903] hashlimit_mt+0x78/0x90 [ 25.310500] ? hashlimit_mt+0x78/0x90 [ 25.314269] ip6t_do_table+0x98d/0x1a30 [ 25.318211] ? nf_ct_attach+0x8c/0x2a0 [ 25.322068] ? skb_make_writable+0x750/0x750 [ 25.326444] ? lock_downgrade+0x980/0x980 [ 25.330565] ? ip6t_error+0x60/0x60 [ 25.334165] ? check_noncircular+0x20/0x20 [ 25.338376] ? lock_acquire+0x1d5/0x580 [ 25.342327] ? lock_acquire+0x1d5/0x580 [ 25.346273] ? __ip6_local_out+0x2f1/0xaa0 [ 25.350479] ? lock_release+0xa40/0xa40 [ 25.354425] ip6table_raw_hook+0x65/0x80 [ 25.358455] nf_hook_slow+0xba/0x1a0 [ 25.362140] __ip6_local_out+0x517/0xaa0 [ 25.366173] ? dst_output+0x140/0x140 [ 25.369941] ? ip6_setup_cork+0xeb8/0x1740 [ 25.374152] ? ipv6_select_ident+0x120/0x120 [ 25.378540] ? check_noncircular+0x20/0x20 [ 25.382743] ip6_local_out+0x2d/0x160 [ 25.386517] ip6_send_skb+0xa1/0x330 [ 25.390200] ip6_push_pending_frames+0xb3/0xe0 [ 25.394761] icmpv6_push_pending_frames+0x338/0x520 [ 25.399749] icmp6_send+0x2244/0x2bb0 [ 25.403523] ? icmpv6_push_pending_frames+0x520/0x520 [ 25.408683] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 25.413840] ? __lock_acquire+0x664/0x3e00 [ 25.418048] ? get_page_from_freelist+0x2deb/0x52d0 [ 25.423037] ? __lock_acquire+0x664/0x3e00 [ 25.427242] ? pmd_huge+0x44/0xc0 [ 25.430666] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 25.435828] ? print_irqtrace_events+0x270/0x270 [ 25.440555] ? check_noncircular+0x20/0x20 [ 25.444763] icmpv6_param_prob+0x2c/0x40 [ 25.448792] ? icmpv6_param_prob+0x2c/0x40 [ 25.452995] ip6_parse_tlv+0x573/0x650 [ 25.456859] ipv6_parse_hopopts+0x246/0x530 [ 25.461154] ipv6_rcv+0xe3b/0x1fa0 [ 25.464675] ? ip6_rcv_finish+0x8c0/0x8c0 [ 25.468793] ? lock_downgrade+0x980/0x980 [ 25.472913] ? lock_release+0xa40/0xa40 [ 25.476866] ? is_bpf_text_address+0xa4/0x120 [ 25.481331] ? __lock_is_held+0xb6/0x140 [ 25.485364] ? ip6_rcv_finish+0x8c0/0x8c0 [ 25.489484] __netif_receive_skb_core+0x1a41/0x3460 [ 25.494470] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 25.499633] ? nf_ingress+0x9f0/0x9f0 [ 25.503403] ? __skb_flow_dissect+0x4ce/0x3f00 [ 25.507956] ? do_syscall_64+0x282/0x940 [ 25.511986] ? entry_SYSCALL_64_after_hwframe+0x26/0x9b [ 25.517323] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 25.522493] ? __skb_flow_get_ports+0x420/0x420 [ 25.527131] ? check_noncircular+0x20/0x20 [ 25.531337] ? __lock_is_held+0xb6/0x140 [ 25.535370] ? print_irqtrace_events+0x270/0x270 [ 25.540095] ? find_held_lock+0x35/0x1d0 [ 25.544127] ? lock_downgrade+0x980/0x980 [ 25.548245] ? tun_build_skb.isra.50+0xb81/0x1850 [ 25.553057] ? pvclock_read_flags+0x160/0x160 [ 25.557522] ? lock_acquire+0x1d5/0x580 [ 25.561465] ? lock_acquire+0x1d5/0x580 [ 25.565416] ? netif_receive_skb_internal+0xa2/0x670 [ 25.570488] ? ktime_get_with_offset+0x2c1/0x420 [ 25.575230] ? lock_release+0xa40/0xa40 [ 25.579176] ? do_gettimeofday+0x190/0x190 [ 25.583385] ? tun_build_skb.isra.50+0x397/0x1850 [ 25.588198] __netif_receive_skb+0x2c/0x1b0 [ 25.592489] ? __netif_receive_skb+0x2c/0x1b0 [ 25.596953] netif_receive_skb_internal+0x10b/0x670 [ 25.601954] ? dev_cpu_dead+0xb00/0xb00 [ 25.605899] ? pagevec_lru_move_fn+0x1ce/0x260 [ 25.610449] ? get_kernel_page+0x110/0x110 [ 25.614660] ? rcu_pm_notify+0xc0/0xc0 [ 25.618522] netif_receive_skb+0xae/0x390 [ 25.622640] ? print_irqtrace_events+0x270/0x270 [ 25.627365] ? netif_receive_skb_internal+0x670/0x670 [ 25.632525] ? find_held_lock+0x35/0x1d0 [ 25.636556] ? tun_rx_batched.isra.52+0x5c4/0x870 [ 25.641367] tun_rx_batched.isra.52+0x5ee/0x870 [ 25.646007] ? skb_probe_transport_header.constprop.68+0x14a/0x2f0 [ 25.652301] ? tun_sock_write_space+0x370/0x370 [ 25.656944] tun_get_user+0x25de/0x3940 [ 25.660888] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 25.666050] ? do_huge_pmd_anonymous_page+0xab1/0x1b00 [ 25.671299] ? tun_build_skb.isra.50+0x1850/0x1850 [ 25.676201] ? clear_huge_page+0x309/0x730 [ 25.680407] ? _raw_spin_unlock+0x22/0x30 [ 25.684525] ? mmdrop+0x18/0x30 [ 25.687776] ? drop_futex_key_refs.isra.13+0x63/0xa0 [ 25.692850] ? find_held_lock+0x35/0x1d0 [ 25.698202] ? tun_get+0x1ab/0x2e0 [ 25.701719] ? lock_release+0xa40/0xa40 [ 25.705665] ? __lock_is_held+0xb6/0x140 [ 25.709698] ? tun_get+0x1d4/0x2e0 [ 25.713207] ? tun_do_read+0x26c0/0x26c0 [ 25.717239] ? __check_object_size+0x8b/0x530 [ 25.721705] ? rcu_note_context_switch+0x710/0x710 [ 25.726611] tun_chr_write_iter+0xbd/0x1c0 [ 25.730816] do_iter_readv_writev+0x55c/0x830 [ 25.735291] ? vfs_dedupe_file_range+0x8f0/0x8f0 [ 25.740022] ? rw_verify_area+0xe5/0x2b0 [ 25.744056] do_iter_write+0x154/0x540 [ 25.747913] ? dup_iter+0x260/0x260 [ 25.751524] vfs_writev+0x18a/0x340 [ 25.755122] ? vfs_iter_write+0xb0/0xb0 [ 25.759071] ? __fdget_pos+0x130/0x190 [ 25.762930] ? __handle_mm_fault+0x3ce0/0x3ce0 [ 25.767488] ? __fdget_raw+0x20/0x20 [ 25.771174] do_writev+0xfc/0x2a0 [ 25.774596] ? do_writev+0xfc/0x2a0 [ 25.778192] ? vfs_writev+0x340/0x340 [ 25.781965] ? mm_fault_error+0x2c0/0x2c0 [ 25.786096] ? move_addr_to_kernel+0x60/0x60 [ 25.790482] SyS_writev+0x27/0x30 [ 25.793903] ? SyS_readv+0x30/0x30 [ 25.797417] do_syscall_64+0x282/0x940 [ 25.801284] ? __do_page_fault+0xc90/0xc90 [ 25.805490] ? trace_event_raw_event_sys_exit+0x260/0x260 [ 25.811008] ? syscall_return_slowpath+0x550/0x550 [ 25.815936] ? syscall_return_slowpath+0x2ac/0x550 [ 25.820846] ? entry_SYSCALL_64_after_hwframe+0x36/0x9b [ 25.826184] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 25.831000] entry_SYSCALL_64_after_hwframe+0x26/0x9b [ 25.836167] RIP: 0033:0x453c60 [ 25.839328] RSP: 002b:0000000000a3e8f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 25.847006] RAX: ffffffffffffffda RBX: 0000000000000046 RCX: 0000000000453c60 [ 25.854256] RDX: