[....] Starting enhanced syslogd: rsyslogd[ 16.747523] audit: type=1400 audit(1519377534.068:5): avc: denied { syslog } for pid=4083 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 21.775037] audit: type=1400 audit(1519377539.095:6): avc: denied { map } for pid=4222 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.42' (ECDSA) to the list of known hosts. net.ipv6.conf.syz0.accept_dad = 0 net.ipv6.conf.syz0.router_solicitations = 0 [ 28.342868] audit: type=1400 audit(1519377545.663:7): avc: denied { map } for pid=4236 comm="syzkaller472699" path="/root/syzkaller472699584" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 RTNETLINK answers: File exists RTNETLINK answers: File exists RTNETLINK answers: Operation not supported RTNETLINK answers: No buffer space available RTNETLINK answers: Operation not supported [ 28.975564] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Invalid argument RTNETLINK answers: Invalid argument RTNETLINK answers: Invalid argument [ 29.336931] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 29.343060] 8021q: adding VLAN 0 to HW filter on device bond0 executing program [ 29.382915] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 29.420912] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.432474] [ 29.434151] ===================================== [ 29.438958] WARNING: bad unlock balance detected! [ 29.443769] 4.16.0-rc2+ #324 Not tainted [ 29.447795] ------------------------------------- [ 29.452604] swapper/0/0 is trying to release lock (rcu_read_lock_bh) at: [ 29.459420] [] hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 29.466409] but there are no more locks to release! [ 29.471392] [ 29.471392] other info that might help us debug this: [ 29.478028] 3 locks held by swapper/0/0: [ 29.482057] #0: ((&idev->mc_ifc_timer)){+.-.}, at: [<000000008bc1a72f>] call_timer_fn+0x1c6/0x820 [ 29.491217] #1: (rcu_read_lock){....}, at: [<00000000913be676>] mld_sendpack+0x180/0xe70 [ 29.499592] #2: (rcu_read_lock){....}, at: [<00000000adb5bf59>] nf_hook.constprop.37+0x0/0x830 [ 29.508500] [ 29.508500] stack backtrace: [ 29.512967] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.16.0-rc2+ #324 [ 29.519602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.528925] Call Trace: [ 29.531476] [ 29.533602] dump_stack+0x194/0x24d [ 29.537200] ? arch_local_irq_restore+0x53/0x53 [ 29.541844] ? hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 29.547275] print_unlock_imbalance_bug+0x12f/0x140 [ 29.552271] lock_release+0x6fe/0xa40 [ 29.556043] ? hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 29.561463] ? lock_downgrade+0x980/0x980 [ 29.565582] ? lock_release+0xa40/0xa40 [ 29.569531] ? __raw_spin_lock_init+0x1c/0x100 [ 29.574085] ? do_raw_spin_trylock+0x190/0x190 [ 29.578640] hashlimit_mt_common.isra.10+0x1c08/0x2610 [ 29.583885] ? lock_downgrade+0x980/0x980 [ 29.588010] ? dsthash_find+0x5b0/0x5b0 [ 29.591963] ? __lock_acquire+0x664/0x3e00 [ 29.596173] ? is_bpf_text_address+0x7b/0x120 [ 29.600648] ? lock_downgrade+0x95a/0x980 [ 29.604772] ? unwind_dump+0x4d0/0x4d0 [ 29.608632] ? rcutorture_record_progress+0x10/0x10 [ 29.613622] ? x86_64_start_kernel+0x77/0x7a [ 29.618014] hashlimit_mt+0x78/0x90 [ 29.621616] ? hashlimit_mt+0x78/0x90 [ 29.625388] ip6t_do_table+0x98d/0x1a30 [ 29.629333] ? kmem_cache_alloc_trace+0x136/0x740 [ 29.634157] ? mld_sendpack+0x617/0xe70 [ 29.638106] ? ip6t_error+0x60/0x60 [ 29.641714] ? check_noncircular+0x20/0x20 [ 29.645920] ? lock_acquire+0x1d5/0x580 [ 29.649870] ? lock_acquire+0x1d5/0x580 [ 29.653813] ? igmp6_mcf_seq_next+0x660/0x660 [ 29.658280] ? lock_release+0xa40/0xa40 [ 29.662226] ip6table_raw_hook+0x65/0x80 [ 29.666270] nf_hook_slow+0xba/0x1a0 [ 29.669954] nf_hook.constprop.37+0x3f6/0x830 [ 29.674424] ? igmp6_mcf_seq_next+0x660/0x660 [ 29.678891] ? trace_hardirqs_on+0xd/0x10 [ 29.683015] ? __local_bh_enable_ip+0x121/0x230 [ 29.687659] ? _raw_spin_unlock_bh+0x30/0x40 [ 29.692041] ? rt6_uncached_list_add+0x1b7/0x240 [ 29.696766] ? rt6_fill_node+0x18b0/0x18b0 [ 29.700983] ? icmp6_dst_alloc+0x475/0x660 [ 29.705189] ? ip6_mc_leave_src+0x1d0/0x1d0 [ 29.709489] ? icmpv6_flow_init+0x1f6/0x270 [ 29.713782] mld_sendpack+0x6c2/0xe70 [ 29.717558] ? nf_hook.constprop.37+0x830/0x830 [ 29.722198] ? mark_held_locks+0xaf/0x100 [ 29.726317] ? trace_hardirqs_on+0xd/0x10 [ 29.730435] ? __local_bh_enable_ip+0x121/0x230 [ 29.735079] mld_ifc_timer_expire+0x3d9/0x770 [ 29.739550] call_timer_fn+0x228/0x820 [ 29.743407] ? mld_dad_timer_expire+0x100/0x100 [ 29.748050] ? process_timeout+0x40/0x40 [ 29.752084] ? __run_timers+0x7e3/0xb70 [ 29.756033] ? lock_downgrade+0x980/0x980 [ 29.760157] ? debug_object_deactivate+0x364/0x560 [ 29.765055] ? lock_release+0xa40/0xa40 [ 29.769016] ? do_raw_spin_trylock+0x190/0x190 [ 29.773574] ? trace_hardirqs_on_caller+0x19e/0x5c0 [ 29.778560] ? mld_dad_timer_expire+0x100/0x100 [ 29.783199] ? mld_dad_timer_expire+0x100/0x100 [ 29.787847] __run_timers+0x7ee/0xb70 [ 29.791648] ? trigger_dyntick_cpu.isra.29+0x150/0x150 [ 29.796900] ? timerqueue_add+0x1e9/0x280 [ 29.801028] ? check_noncircular+0x20/0x20 [ 29.805247] ? enqueue_hrtimer+0x177/0x4b0 [ 29.809450] ? lock_release+0xa40/0xa40 [ 29.813396] ? retrigger_next_event+0x1e0/0x1e0 [ 29.818039] ? find_held_lock+0x35/0x1d0 [ 29.822073] ? clockevents_program_event+0x163/0x2e0 [ 29.827146] ? lock_downgrade+0x980/0x980 [ 29.831266] ? rcu_pm_notify+0xc0/0xc0 [ 29.835127] run_timer_softirq+0x4c/0x70 [ 29.839162] __do_softirq+0x2d7/0xb85 [ 29.842931] ? ktime_get+0x26f/0x3a0 [ 29.846614] ? __irqentry_text_end+0x1f8ad4/0x1f8ad4 [ 29.851690] ? do_timer+0x50/0x50 [ 29.855116] ? native_apic_msr_write+0x5c/0x80 [ 29.859667] ? lapic_next_event+0x54/0x80 [ 29.863787] ? clockevents_program_event+0x108/0x2e0 [ 29.868861] ? tick_program_event+0x83/0x100 [ 29.873241] ? rcu_pm_notify+0xc0/0xc0 [ 29.877103] irq_exit+0x1cc/0x200 [ 29.880531] smp_apic_timer_interrupt+0x16b/0x700 [ 29.885344] ? smp_call_function_single_interrupt+0x640/0x640 [ 29.891203] ? _raw_spin_lock+0x32/0x40 [ 29.895148] ? _raw_spin_unlock+0x22/0x30 [ 29.899267] ? handle_edge_irq+0x2b4/0x7c0 [ 29.903487] ? task_prio+0x50/0x50 [ 29.907013] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 29.911840] apic_timer_interrupt+0x8e/0xa0 [ 29.916129] [ 29.918337] RIP: 0010:native_safe_halt+0x6/0x10 [ 29.922972] RSP: 0018:ffffffff86e07c38 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff12 [ 29.930649] RAX: dffffc0000000000 RBX: 1ffffffff0dc0f8a RCX: 0000000000000000 [ 29.937890] RDX: 1ffffffff0dd92d8 RSI: 0000000000000001 RDI: ffffffff86ec96c0 [ 29.945132] RBP: ffffffff86e07c38 R08: 0000000000000000 R09: 0000000000000000 [ 29.952370] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 29.959611] R13: ffffffff86e07cf0 R14: ffffffff876df8a0 R15: 0000000000000000 [ 29.966870] ? trace_hardirqs_on+0xd/0x10 [ 29.970989] default_idle+0xbf/0x430 [ 29.974682] ? __sched_text_end+0x4/0x4 [ 29.978627] ? rcu_eqs_special_set+0x1e0/0x1e0 [ 29.983178] ? tsc_verify_tsc_adjust+0xf6/0x3e0 [ 29.987817] ? set_cpu_sd_state_idle+0x1dc/0x2d0 [ 29.992543] ? mark_tsc_async_resets+0x30/0x30 [ 29.997098] arch_cpu_idle+0xa/0x10 [ 30.000698] default_idle_call+0x36/0x90 [ 30.004731] do_idle+0x24a/0x3b0 [ 30.008069] cpu_startup_entry+0x104/0x120 [ 30.012274] ? cpu_in_idle+0x20/0x20 [ 30.015957] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 30.020943] ? trace_hardirqs_on+0xd/0x10 [ 30.025061] rest_init+0xed/0xf0 [ 30.028402] start_kernel+0x7f1/0x819 [ 30.032173] ? mem_encrypt_init+0xb/0xb