[....] Starting enhanced syslogd: rsyslogd[ 11.325557] audit: type=1400 audit(1516067750.401:5): avc: denied { syslog } for pid=3465 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 18.727044] audit: type=1400 audit(1516067757.802:6): avc: denied { map } for pid=3605 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.27' (ECDSA) to the list of known hosts. executing program [ 24.943041] audit: type=1400 audit(1516067764.018:7): avc: denied { map } for pid=3619 comm="syzkaller853755" path="/root/syzkaller853755440" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 24.992433] TCP: request_sock_TCP: Possible SYN flooding on port 20000. Sending cookies. Check SNMP counters. [ 25.008488] ================================================================== [ 25.015879] BUG: KASAN: use-after-free in tls_sk_proto_close+0x7a0/0x800 [ 25.022692] Read of size 8 at addr ffff8801cb0f0e88 by task syzkaller853755/3620 [ 25.030195] [ 25.031797] CPU: 1 PID: 3620 Comm: syzkaller853755 Not tainted 4.15.0-rc7-mm1+ #56 [ 25.039475] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 25.048802] Call Trace: [ 25.051369] dump_stack+0x194/0x257 [ 25.054975] ? arch_local_irq_restore+0x53/0x53 [ 25.059614] ? show_regs_print_info+0x18/0x18 [ 25.064082] ? mark_held_locks+0xaf/0x100 [ 25.068200] ? do_raw_spin_trylock+0x190/0x190 [ 25.072767] ? tls_sk_proto_close+0x7a0/0x800 [ 25.077244] print_address_description+0x73/0x250 [ 25.082069] ? tls_sk_proto_close+0x7a0/0x800 [ 25.086543] kasan_report+0x23b/0x360 [ 25.090319] __asan_report_load8_noabort+0x14/0x20 [ 25.095220] tls_sk_proto_close+0x7a0/0x800 [ 25.099513] ? lock_release+0xa40/0xa40 [ 25.103458] ? __dentry_kill+0x487/0x6d0 [ 25.107495] ? tls_write_space+0x2c0/0x2c0 [ 25.111709] ? locks_remove_file+0x3fa/0x5a0 [ 25.116091] ? fcntl_setlk+0x10c0/0x10c0 [ 25.120121] ? fsnotify+0x7b3/0x1140 [ 25.123813] ? ip_mc_drop_socket+0x1ce/0x230 [ 25.128199] inet_release+0xed/0x1c0 [ 25.131892] sock_release+0x8d/0x1e0 [ 25.135600] ? sock_alloc_file+0x560/0x560 [ 25.139810] sock_close+0x16/0x20 [ 25.143236] __fput+0x327/0x7e0 [ 25.146507] ? fput+0x140/0x140 [ 25.149784] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 25.155639] ? _raw_spin_unlock_irq+0x27/0x70 [ 25.160110] ____fput+0x15/0x20 [ 25.163361] task_work_run+0x199/0x270 [ 25.167220] ? task_work_cancel+0x210/0x210 [ 25.171512] ? _raw_spin_unlock+0x22/0x30 [ 25.175631] ? switch_task_namespaces+0x87/0xc0 [ 25.180279] do_exit+0x9bb/0x1ad0 [ 25.183709] ? mm_update_next_owner+0x930/0x930 [ 25.188356] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 25.193516] ? __might_sleep+0x95/0x190 [ 25.197467] ? find_held_lock+0x35/0x1d0 [ 25.201507] ? futex_wait+0x402/0x9a0 [ 25.205278] ? lock_downgrade+0x980/0x980 [ 25.209399] ? __unqueue_futex+0x1c0/0x290 [ 25.213604] ? lock_release+0xa40/0xa40 [ 25.217550] ? fault_in_user_writeable+0x90/0x90 [ 25.222277] ? do_raw_spin_trylock+0x190/0x190 [ 25.226830] ? futex_wake+0x680/0x680 [ 25.230602] ? check_noncircular+0x20/0x20 [ 25.234808] ? mmdrop+0x18/0x30 [ 25.238060] ? drop_futex_key_refs.isra.12+0x63/0xa0 [ 25.243134] ? futex_wait+0x6a9/0x9a0 [ 25.246917] ? find_held_lock+0x35/0x1d0 [ 25.250960] ? get_signal+0x7ae/0x16c0 [ 25.254819] ? lock_downgrade+0x980/0x980 [ 25.258946] do_group_exit+0x149/0x400 [ 25.262807] ? do_raw_spin_trylock+0x190/0x190 [ 25.267359] ? SyS_exit+0x30/0x30 [ 25.270785] ? _raw_spin_unlock_irq+0x27/0x70 [ 25.275253] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 25.280244] get_signal+0x73f/0x16c0 [ 25.283938] ? ptrace_notify+0x130/0x130 [ 25.287977] ? exit_robust_list+0x240/0x240 [ 25.292269] ? find_held_lock+0x35/0x1d0 [ 25.296309] ? handle_mm_fault+0x2a0/0x930 [ 25.300518] ? find_held_lock+0x35/0x1d0 [ 25.304555] do_signal+0x90/0x1eb0 [ 25.308068] ? __do_page_fault+0x5f7/0xc90 [ 25.312276] ? lock_downgrade+0x980/0x980 [ 25.316409] ? setup_sigcontext+0x7d0/0x7d0 [ 25.320707] ? handle_mm_fault+0x476/0x930 [ 25.324910] ? down_read_trylock+0xdb/0x170 [ 25.329214] ? __handle_mm_fault+0x3ce0/0x3ce0 [ 25.333765] ? vmacache_find+0x5f/0x280 [ 25.337716] ? up_read+0x1a/0x40 [ 25.341057] ? __do_page_fault+0x3d6/0xc90 [ 25.345266] ? SYSC_accept4+0x4ff/0x870 [ 25.349211] ? release_sock+0x1d4/0x2a0 [ 25.353164] ? exit_to_usermode_loop+0x8c/0x2f0 [ 25.357810] exit_to_usermode_loop+0x258/0x2f0 [ 25.362370] ? trace_event_raw_event_sys_exit+0x260/0x260 [ 25.367888] syscall_return_slowpath+0x490/0x550 [ 25.372615] ? prepare_exit_to_usermode+0x340/0x340 [ 25.377603] ? entry_SYSCALL_64_fastpath+0x73/0xa0 [ 25.382506] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 25.387494] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 25.392227] entry_SYSCALL_64_fastpath+0x9e/0xa0 [ 25.396955] RIP: 0033:0x4457a9 [ 25.400114] RSP: 002b:00007fda74d50db8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 25.407793] RAX: fffffffffffffe00 RBX: 00000000006dac24 RCX: 00000000004457a9 [ 25.415035] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000006dac24 [ 25.422277] RBP: 00000000006dac20 R08: 0000000000000000 R09: 0000000000000000 [ 25.429516] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 25.436754] R13: 00007fff8b3bb87f R14: 00007fda74d519c0 R15: 0000000000000001 [ 25.444016] [ 25.445620] Allocated by task 3620: [ 25.449220] save_stack+0x43/0xd0 [ 25.452646] kasan_kmalloc+0xad/0xe0 [ 25.456338] kmem_cache_alloc_trace+0x136/0x750 [ 25.460980] tls_init+0x4b/0x240 [ 25.464315] tcp_set_ulp+0x159/0x3e0 [ 25.468004] do_tcp_setsockopt.isra.37+0x316/0x2130 [ 25.472998] tcp_setsockopt+0xb0/0xd0 [ 25.476778] sock_common_setsockopt+0x95/0xd0 [ 25.481241] SyS_setsockopt+0x189/0x360 [ 25.485187] entry_SYSCALL_64_fastpath+0x29/0xa0 [ 25.489907] [ 25.491506] Freed by task 3620: [ 25.494756] save_stack+0x43/0xd0 [ 25.498178] __kasan_slab_free+0x11a/0x170 [ 25.502381] kasan_slab_free+0xe/0x10 [ 25.506151] kfree+0xd9/0x260 [ 25.509227] tls_sk_proto_close+0x4bf/0x800 [ 25.513521] inet_release+0xed/0x1c0 [ 25.517205] sock_release+0x8d/0x1e0 [ 25.520887] sock_close+0x16/0x20 [ 25.524311] __fput+0x327/0x7e0 [ 25.527557] ____fput+0x15/0x20 [ 25.530808] task_work_run+0x199/0x270 [ 25.534666] do_exit+0x9bb/0x1ad0 [ 25.538090] do_group_exit+0x149/0x400 [ 25.541950] get_signal+0x73f/0x16c0 [ 25.545644] do_signal+0x90/0x1eb0 [ 25.549156] exit_to_usermode_loop+0x258/0x2f0 [ 25.553708] syscall_return_slowpath+0x490/0x550 [ 25.558439] entry_SYSCALL_64_fastpath+0x9e/0xa0 [ 25.563161] [ 25.564759] The buggy address belongs to the object at ffff8801cb0f0e00 [ 25.564759] which belongs to the cache kmalloc-192 of size 192 [ 25.577383] The buggy address is located 136 bytes inside of [ 25.577383] 192-byte region [ffff8801cb0f0e00, ffff8801cb0f0ec0) [ 25.589224] The buggy address belongs to the page: [ 25.594123] page:ffffea00072c3c00 count:1 mapcount:0 mapping:ffff8801cb0f0000 index:0xffff8801cb0f0000 [ 25.603556] flags: 0x2fffc0000000100(slab) [ 25.607764] raw: 02fffc0000000100 ffff8801cb0f0000 ffff8801cb0f0000 0000000100000005 [ 25.615614] raw: ffffea0007661860 ffffea0007535d20 ffff8801dac00040 0000000000000000 [ 25.623461] page dumped because: kasan: bad access detected [ 25.629139] [ 25.630738] Memory state around the buggy address: [ 25.635638] ffff8801cb0f0d80: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc [ 25.642968] ffff8801cb0f0e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.650295] >ffff8801cb0f0e80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 25.657622] ^ [ 25.661219] ffff8801cb0f0f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.668547] ffff8801cb0f0f80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 25.675876] ================================================================== [ 25.683204] Disabling lock debugging due to kernel taint [ 25.688687] Kernel panic - not syncing: panic_on_warn set ... [ 25.688687] [ 25.696043] CPU: 1 PID: 3620 Comm: syzkaller853755 Tainted: G B 4.15.0-rc7-mm1+ #56 [ 25.705032] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 25.714358] Call Trace: [ 25.716925] dump_stack+0x194/0x257 [ 25.720544] ? arch_local_irq_restore+0x53/0x53 [ 25.725194] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 25.729919] ? vsnprintf+0x1ed/0x1900 [ 25.733695] ? tls_sk_proto_close+0x770/0x800 [ 25.738161] panic+0x1e4/0x41c [ 25.741322] ? refcount_error_report+0x214/0x214 [ 25.746050] ? add_taint+0x1c/0x50 [ 25.749557] ? add_taint+0x1c/0x50 [ 25.753068] ? tls_sk_proto_close+0x7a0/0x800 [ 25.757534] kasan_end_report+0x50/0x50 [ 25.761475] kasan_report+0x148/0x360 [ 25.765247] __asan_report_load8_noabort+0x14/0x20 [ 25.770147] tls_sk_proto_close+0x7a0/0x800 [ 25.774436] ? lock_release+0xa40/0xa40 [ 25.778381] ? __dentry_kill+0x487/0x6d0 [ 25.782414] ? tls_write_space+0x2c0/0x2c0 [ 25.786625] ? locks_remove_file+0x3fa/0x5a0 [ 25.791003] ? fcntl_setlk+0x10c0/0x10c0 [ 25.795042] ? fsnotify+0x7b3/0x1140 [ 25.798728] ? ip_mc_drop_socket+0x1ce/0x230 [ 25.803109] inet_release+0xed/0x1c0 [ 25.806795] sock_release+0x8d/0x1e0 [ 25.810478] ? sock_alloc_file+0x560/0x560 [ 25.814687] sock_close+0x16/0x20 [ 25.818118] __fput+0x327/0x7e0 [ 25.821372] ? fput+0x140/0x140 [ 25.824622] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 25.830475] ? _raw_spin_unlock_irq+0x27/0x70 [ 25.834941] ____fput+0x15/0x20 [ 25.838190] task_work_run+0x199/0x270 [ 25.842048] ? task_work_cancel+0x210/0x210 [ 25.846339] ? _raw_spin_unlock+0x22/0x30 [ 25.850457] ? switch_task_namespaces+0x87/0xc0 [ 25.855099] do_exit+0x9bb/0x1ad0 [ 25.858525] ? mm_update_next_owner+0x930/0x930 [ 25.863167] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 25.868326] ? __might_sleep+0x95/0x190 [ 25.872272] ? find_held_lock+0x35/0x1d0 [ 25.876306] ? futex_wait+0x402/0x9a0 [ 25.880076] ? lock_downgrade+0x980/0x980 [ 25.884191] ? __unqueue_futex+0x1c0/0x290 [ 25.888404] ? lock_release+0xa40/0xa40 [ 25.892347] ? fault_in_user_writeable+0x90/0x90 [ 25.897073] ? do_raw_spin_trylock+0x190/0x190 [ 25.901632] ? futex_wake+0x680/0x680 [ 25.905401] ? check_noncircular+0x20/0x20 [ 25.909607] ? mmdrop+0x18/0x30 [ 25.912857] ? drop_futex_key_refs.isra.12+0x63/0xa0 [ 25.917928] ? futex_wait+0x6a9/0x9a0 [ 25.921708] ? find_held_lock+0x35/0x1d0 [ 25.925744] ? get_signal+0x7ae/0x16c0 [ 25.929599] ? lock_downgrade+0x980/0x980 [ 25.933721] do_group_exit+0x149/0x400 [ 25.937578] ? do_raw_spin_trylock+0x190/0x190 [ 25.942129] ? SyS_exit+0x30/0x30 [ 25.945551] ? _raw_spin_unlock_irq+0x27/0x70 [ 25.950021] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 25.955017] get_signal+0x73f/0x16c0 [ 25.958709] ? ptrace_notify+0x130/0x130 [ 25.962746] ? exit_robust_list+0x240/0x240 [ 25.967041] ? find_held_lock+0x35/0x1d0 [ 25.971086] ? handle_mm_fault+0x2a0/0x930 [ 25.975294] ? find_held_lock+0x35/0x1d0 [ 25.979331] do_signal+0x90/0x1eb0 [ 25.982845] ? __do_page_fault+0x5f7/0xc90 [ 25.987049] ? lock_downgrade+0x980/0x980 [ 25.991169] ? setup_sigcontext+0x7d0/0x7d0 [ 25.995465] ? handle_mm_fault+0x476/0x930 [ 25.999669] ? down_read_trylock+0xdb/0x170 [ 26.003964] ? __handle_mm_fault+0x3ce0/0x3ce0 [ 26.008514] ? vmacache_find+0x5f/0x280 [ 26.012468] ? up_read+0x1a/0x40 [ 26.015804] ? __do_page_fault+0x3d6/0xc90 [ 26.020269] ? SYSC_accept4+0x4ff/0x870 [ 26.024213] ? release_sock+0x1d4/0x2a0 [ 26.028162] ? exit_to_usermode_loop+0x8c/0x2f0 [ 26.032804] exit_to_usermode_loop+0x258/0x2f0 [ 26.037356] ? trace_event_raw_event_sys_exit+0x260/0x260 [ 26.042869] syscall_return_slowpath+0x490/0x550 [ 26.047595] ? prepare_exit_to_usermode+0x340/0x340 [ 26.052589] ? entry_SYSCALL_64_fastpath+0x73/0xa0 [ 26.057487] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 26.062473] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 26.067203] entry_SYSCALL_64_fastpath+0x9e/0xa0 [ 26.071929] RIP: 0033:0x4457a9 [ 26.075088] RSP: 002b:00007fda74d50db8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 26.082763] RAX: fffffffffffffe00 RBX: 00000000006dac24 RCX: 00000000004457a9 [ 26.090008] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000006dac24 [ 26.097262] RBP: 00000000006dac20 R08: 0000000000000000 R09: 0000000000000000 [ 26.104514] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 26.111757] R13: 00007fff8b3bb87f R14: 00007fda74d519c0 R15: 0000000000000001 [ 26.119429] Dumping ftrace buffer: [ 26.122946] (ftrace buffer empty) [ 26.126624] Kernel Offset: disabled [ 26.130220] Rebooting in 86400 seconds..