[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 17.811528] audit: type=1400 audit(1519106650.604:6): avc: denied { map } for pid=4073 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.44' (ECDSA) to the list of known hosts. syzkaller login: [ 24.065296] audit: type=1400 audit(1519106656.858:7): avc: denied { map } for pid=4087 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=16479 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2018/02/20 06:04:17 parsed 1 programs 2018/02/20 06:04:17 executed programs: 0 [ 24.327798] audit: type=1400 audit(1519106657.120:8): avc: denied { map } for pid=4087 comm="syz-execprog" path="/root/syzkaller-shm093128053" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 24.342862] IPVS: ftp: loaded support on port[0] = 21 [ 24.571516] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 25.160343] [ 25.162012] ===================================== [ 25.166827] WARNING: bad unlock balance detected! [ 25.171636] 4.16.0-rc1+ #232 Not tainted [ 25.175663] ------------------------------------- [ 25.180470] syz-executor0/4094 is trying to release lock (rcu_read_lock_bh) at: [ 25.187895] [] hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 25.194873] but there are no more locks to release! [ 25.199856] [ 25.199856] other info that might help us debug this: [ 25.206488] 6 locks held by syz-executor0/4094: [ 25.211120] #0: (sk_lock-AF_INET6){+.+.}, at: [<000000004d9a8e38>] ipv6_getsockopt+0x1c5/0x2e0 [ 25.220022] #1: (&xt[i].mutex){+.+.}, at: [<000000000d5dc847>] xt_find_table_lock+0x3e/0x3e0 [ 25.228747] #2: (rcu_read_lock){....}, at: [<0000000084c9624f>] __is_insn_slot_addr+0x0/0x330 [ 25.237555] #3: ((&idev->mc_ifc_timer)){+.-.}, at: [<0000000091aa23c1>] call_timer_fn+0x1c6/0x820 [ 25.246711] #4: (rcu_read_lock){....}, at: [<000000007672fc4b>] mld_sendpack+0x180/0xe70 [ 25.255082] #5: (rcu_read_lock){....}, at: [<00000000d01c1925>] nf_hook.constprop.37+0x0/0x830 [ 25.263977] [ 25.263977] stack backtrace: [ 25.268445] CPU: 1 PID: 4094 Comm: syz-executor0 Not tainted 4.16.0-rc1+ #232 [ 25.275682] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 25.285002] Call Trace: [ 25.287562] [ 25.289685] dump_stack+0x194/0x257 [ 25.293283] ? arch_local_irq_restore+0x53/0x53 [ 25.297921] ? hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 25.303340] print_unlock_imbalance_bug+0x12f/0x140 [ 25.308324] lock_release+0x6fe/0xa40 [ 25.312093] ? hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 25.317510] ? lock_downgrade+0x980/0x980 [ 25.321627] ? lock_release+0xa40/0xa40 [ 25.325568] ? __raw_spin_lock_init+0x1c/0x100 [ 25.330117] ? do_raw_spin_trylock+0x190/0x190 [ 25.334671] hashlimit_mt_common.isra.10+0x1c08/0x2610 [ 25.339915] ? lock_downgrade+0x980/0x980 [ 25.344036] ? dsthash_find+0x5b0/0x5b0 [ 25.347977] ? __lock_acquire+0x664/0x3e00 [ 25.352180] ? is_bpf_text_address+0x7b/0x120 [ 25.356644] ? lock_downgrade+0x8da/0x980 [ 25.360762] ? rcutorture_record_progress+0x10/0x10 [ 25.365748] ? __kernel_text_address+0xd/0x40 [ 25.370211] ? unwind_get_return_address+0x61/0xa0 [ 25.375108] hashlimit_mt+0x78/0x90 [ 25.378701] ? hashlimit_mt+0x78/0x90 [ 25.382471] ip6t_do_table+0x98d/0x1a30 [ 25.386417] ? kmem_cache_alloc_trace+0x136/0x740 [ 25.391228] ? mld_sendpack+0x617/0xe70 [ 25.395173] ? ip6t_error+0x60/0x60 [ 25.398767] ? alloc_counters.isra.10+0x9a/0x7e0 [ 25.403491] ? check_noncircular+0x20/0x20 [ 25.407695] ? lock_acquire+0x1d5/0x580 [ 25.411637] ? lock_acquire+0x1d5/0x580 [ 25.415582] ? igmp6_mcf_seq_next+0x660/0x660 [ 25.420052] ? lock_release+0xa40/0xa40 [ 25.423996] ip6table_raw_hook+0x65/0x80 [ 25.428035] nf_hook_slow+0xba/0x1a0 [ 25.431719] nf_hook.constprop.37+0x3f6/0x830 [ 25.436184] ? igmp6_mcf_seq_next+0x660/0x660 [ 25.440646] ? trace_hardirqs_on+0xd/0x10 [ 25.444763] ? __local_bh_enable_ip+0x121/0x230 [ 25.449400] ? _raw_spin_unlock_bh+0x30/0x40 [ 25.453775] ? rt6_uncached_list_add+0x1b7/0x240 [ 25.458499] ? rt6_fill_node+0x18b0/0x18b0 [ 25.462701] ? icmp6_dst_alloc+0x475/0x660 [ 25.466904] ? ip6_mc_leave_src+0x1d0/0x1d0 [ 25.471193] ? icmpv6_flow_init+0x1f6/0x270 [ 25.475481] mld_sendpack+0x6c2/0xe70 [ 25.479253] ? nf_hook.constprop.37+0x830/0x830 [ 25.483893] ? mark_held_locks+0xaf/0x100 [ 25.488015] ? trace_hardirqs_on+0xd/0x10 [ 25.492134] ? __local_bh_enable_ip+0x121/0x230 [ 25.496769] mld_ifc_timer_expire+0x3d9/0x770 [ 25.501236] call_timer_fn+0x228/0x820 [ 25.505092] ? mld_dad_timer_expire+0x100/0x100 [ 25.509726] ? process_timeout+0x40/0x40 [ 25.513756] ? __run_timers+0x7e3/0xb70 [ 25.517696] ? lock_downgrade+0x980/0x980 [ 25.521814] ? debug_object_deactivate+0x364/0x560 [ 25.526710] ? lock_release+0xa40/0xa40 [ 25.530664] ? mark_held_locks+0xaf/0x100 [ 25.534790] ? trace_hardirqs_on_caller+0x19e/0x5c0 [ 25.539774] ? mld_dad_timer_expire+0x100/0x100 [ 25.544409] ? mld_dad_timer_expire+0x100/0x100 [ 25.549044] __run_timers+0x7ee/0xb70 [ 25.552816] ? trigger_dyntick_cpu.isra.29+0x150/0x150 [ 25.558065] ? timerqueue_add+0x1e9/0x280 [ 25.562182] ? check_noncircular+0x20/0x20 [ 25.566387] ? enqueue_hrtimer+0x177/0x4b0 [ 25.570592] ? lock_release+0xa40/0xa40 [ 25.574534] ? retrigger_next_event+0x1e0/0x1e0 [ 25.579173] ? print_irqtrace_events+0x270/0x270 [ 25.584268] ? check_noncircular+0x20/0x20 [ 25.588476] ? clockevents_program_event+0x163/0x2e0 [ 25.593546] ? lock_downgrade+0x980/0x980 [ 25.597663] ? __lock_is_held+0xb6/0x140 [ 25.601695] run_timer_softirq+0x4c/0x70 [ 25.605726] __do_softirq+0x2d7/0xb85 [ 25.609495] ? ktime_get+0x26f/0x3a0 [ 25.613180] ? __irqentry_text_end+0x1f8ee4/0x1f8ee4 [ 25.618250] ? check_noncircular+0x20/0x20 [ 25.622452] ? native_apic_msr_write+0x5c/0x80 [ 25.627004] ? lapic_next_event+0x54/0x80 [ 25.631126] ? clockevents_program_event+0x108/0x2e0 [ 25.636197] ? tick_program_event+0x83/0x100 [ 25.640573] ? __lock_is_held+0xb6/0x140 [ 25.644609] irq_exit+0x1cc/0x200 [ 25.648035] smp_apic_timer_interrupt+0x16b/0x700 [ 25.652844] ? smp_reschedule_interrupt+0xe6/0x650 [ 25.657740] ? smp_call_function_single_interrupt+0x640/0x640 [ 25.663593] ? _raw_spin_lock+0x32/0x40 [ 25.667536] ? _raw_spin_unlock+0x22/0x30 [ 25.671651] ? handle_edge_irq+0x2b4/0x7c0 [ 25.675859] ? task_prio+0x50/0x50 [ 25.679371] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 25.684183] apic_timer_interrupt+0xa9/0xb0 [ 25.688470] [ 25.690677] RIP: 0010:lock_release+0xe4/0xa40 [ 25.695139] RSP: 0018:ffff8801c074f210 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff12 [ 25.702813] RAX: dffffc0000000000 RBX: ffff8801bfc52280 RCX: ffffffff8171af5d [ 25.710052] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffff86ac9660 [ 25.717291] RBP: ffff8801c074f340 R08: 0000000000000000 R09: 0000000000000002 [ 25.724529] R10: ffff8801c074f220 R11: 0000000000000000 R12: ffff8801c074f318 [ 25.731768] R13: 0000000000000000 R14: ffff8801c074f410 R15: 1ffff100380e9e47 [ 25.739017] ? __is_insn_slot_addr+0x20d/0x330 [ 25.743575] ? lock_acquire+0x1d5/0x580 [ 25.747531] ? __is_insn_slot_addr+0x1fc/0x330 [ 25.752089] ? lock_downgrade+0x980/0x980 [ 25.756206] ? lock_release+0xa40/0xa40 [ 25.760151] ? rcutorture_record_progress+0x10/0x10 [ 25.765137] ? is_bpf_text_address+0x7b/0x120 [ 25.769603] __is_insn_slot_addr+0x225/0x330 [ 25.773983] ? __free_insn_slot+0x5c0/0x5c0 [ 25.778277] ? rcutorture_record_progress+0x10/0x10 [ 25.783261] ? __module_text_address+0x13/0x150 [ 25.787901] kernel_text_address+0x11b/0x140 [ 25.792277] __kernel_text_address+0xd/0x40 [ 25.796571] unwind_get_return_address+0x61/0xa0 [ 25.801312] __save_stack_trace+0x7e/0xd0 [ 25.805431] save_stack_trace+0x1a/0x20 [ 25.809375] save_stack+0x43/0xd0 [ 25.812796] ? save_stack+0x43/0xd0 [ 25.816390] ? kasan_kmalloc+0xad/0xe0 [ 25.820243] ? kmem_cache_alloc_node_trace+0x150/0x760 [ 25.825486] ? __kmalloc_node+0x33/0x70 [ 25.829432] ? __vmalloc_node_range+0x1a1/0x650 [ 25.834069] ? vzalloc+0x45/0x50 [ 25.837403] ? alloc_counters.isra.10+0x9a/0x7e0 [ 25.842124] ? do_ip6t_get_ctl+0x63e/0xaf0 [ 25.846326] ? nf_getsockopt+0x6a/0xc0 [ 25.850181] ? ipv6_getsockopt+0x1df/0x2e0 [ 25.854383] ? tcp_getsockopt+0x82/0xd0 [ 25.858326] ? sock_common_getsockopt+0x95/0xd0 [ 25.862965] ? SyS_getsockopt+0x178/0x340 [ 25.867081] ? do_syscall_64+0x282/0x940 [ 25.871111] ? entry_SYSCALL_64_after_hwframe+0x26/0x9b [ 25.876446] ? find_held_lock+0x35/0x1d0 [ 25.880475] ? print_irqtrace_events+0x270/0x270 [ 25.885199] ? __lock_is_held+0xb6/0x140 [ 25.889234] ? trace_event_raw_event_sched_switch+0x810/0x810 [ 25.895088] ? kasan_unpoison_shadow+0x35/0x50 [ 25.899640] kasan_kmalloc+0xad/0xe0 [ 25.903323] kmem_cache_alloc_node_trace+0x150/0x760 [ 25.908396] __kmalloc_node+0x33/0x70 [ 25.912166] __vmalloc_node_range+0x1a1/0x650 [ 25.916632] vzalloc+0x45/0x50 [ 25.919794] ? alloc_counters.isra.10+0x9a/0x7e0 [ 25.924518] alloc_counters.isra.10+0x9a/0x7e0 [ 25.929070] ? ip6t_alloc_initial_table+0x6a0/0x6a0 [ 25.934055] ? xt_find_table_lock+0x10b/0x3e0 [ 25.938518] do_ip6t_get_ctl+0x63e/0xaf0 [ 25.942549] ? get_info+0x690/0x690 [ 25.946147] ? ipv6_getsockopt+0x1c5/0x2e0 [ 25.950353] ? mutex_unlock+0xd/0x10 [ 25.954039] ? nf_sockopt_find.constprop.0+0x1a7/0x220 [ 25.959283] nf_getsockopt+0x6a/0xc0 [ 25.962966] ipv6_getsockopt+0x1df/0x2e0 [ 25.966995] ? do_ipv6_getsockopt.isra.5+0x30c0/0x30c0 [ 25.972246] tcp_getsockopt+0x82/0xd0 [ 25.976022] sock_common_getsockopt+0x95/0xd0 [ 25.980490] SyS_getsockopt+0x178/0x340 [ 25.984436] ? SyS_setsockopt+0x360/0x360 [ 25.988556] ? move_addr_to_kernel+0x60/0x60 [ 25.992934] ? do_syscall_64+0xb7/0x940 [ 25.996889] ? SyS_setsockopt+0x360/0x360 [ 26.001007] do_syscall_64+0x282/0x940 [ 26.004867] ? __do_page_fault+0xc90/0xc90 [ 26.009071] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 26.013796] ? syscall_return_slowpath+0x550/0x550 [ 26.018693] ? syscall_return_slowpath+0x2ac/0x550 [ 26.023592] ? prepare_exit_to_usermode+0x350/0x350 [ 26.028579] ? entry_SYSCALL_64_after_hwframe+0x36/0x9b [ 26.033913] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 26.038726] entry_SYSCALL_64_after_hwframe+0x26/0x9b [ 26.043883] RIP: 0033:0x45687a [ 26.047045] RSP: 002b:00007ffd61cd8868 EFLAGS: 00000216 ORIG_RAX: 0000000000000037 [ 26.054724] RAX: ffffffffffffffda RBX: 00007ffd61cd8890 RCX: 000000000045687a [ 26.061962] RDX: 0000000000000041 RSI: 0000000000000029 RDI: 0000000000000003 [ 26.069199] RBP: 00000000006fd6c0 R08: 00007ffd61cd888c R09: 0000000000004000 [ 26.076437] R10: 00007ffd61cd8990 R11: 0000000000000216 R12: 0000000000000000 [ 26.083675] R13: 0000000000000003 R14: 0000000000000029 R15: 00000000006fbbc0 2018/02/20 06:04:22 executed programs: 541 2018/02/20 06:04:27 executed programs: 1340