[....] Starting enhanced syslogd: rsyslogd[ 15.591612] audit: type=1400 audit(1519103164.429:5): avc: denied { syslog } for pid=3964 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 17.871285] audit: type=1400 audit(1519103166.708:6): avc: denied { map } for pid=4104 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.61' (ECDSA) to the list of known hosts. [ 24.134605] audit: type=1400 audit(1519103172.972:7): avc: denied { map } for pid=4118 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=16479 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2018/02/20 05:06:13 parsed 1 programs 2018/02/20 05:06:13 executed programs: 0 [ 24.394122] audit: type=1400 audit(1519103173.231:8): avc: denied { map } for pid=4118 comm="syz-execprog" path="/root/syzkaller-shm352714892" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 24.410752] IPVS: ftp: loaded support on port[0] = 21 [ 24.621724] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 25.439320] [ 25.440991] ===================================== [ 25.445811] WARNING: bad unlock balance detected! [ 25.450634] 4.16.0-rc1+ #232 Not tainted [ 25.454674] ------------------------------------- [ 25.459490] syz-execprog/4120 is trying to release lock (rcu_read_lock_bh) at: [ 25.466837] [] hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 25.473827] but there are no more locks to release! [ 25.478814] [ 25.478814] other info that might help us debug this: [ 25.485456] 3 locks held by syz-execprog/4120: [ 25.490015] #0: ((&idev->mc_ifc_timer)){+.-.}, at: [<00000000fc3de8f9>] call_timer_fn+0x1c6/0x820 [ 25.499184] #1: (rcu_read_lock){....}, at: [<0000000043ea27e8>] mld_sendpack+0x180/0xe70 [ 25.507568] #2: (rcu_read_lock){....}, at: [<00000000bf1c91e1>] nf_hook.constprop.37+0x0/0x830 [ 25.516472] [ 25.516472] stack backtrace: [ 25.520946] CPU: 0 PID: 4120 Comm: syz-execprog Not tainted 4.16.0-rc1+ #232 [ 25.528108] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 25.537440] Call Trace: [ 25.540003] [ 25.542138] dump_stack+0x194/0x257 [ 25.545744] ? arch_local_irq_restore+0x53/0x53 [ 25.550397] ? hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 25.555830] print_unlock_imbalance_bug+0x12f/0x140 [ 25.560824] lock_release+0x6fe/0xa40 [ 25.564602] ? hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 25.570032] ? lock_downgrade+0x980/0x980 [ 25.574156] ? lock_release+0xa40/0xa40 [ 25.578112] ? __raw_spin_lock_init+0x1c/0x100 [ 25.582672] ? do_raw_spin_trylock+0x190/0x190 [ 25.587239] hashlimit_mt_common.isra.10+0x1c08/0x2610 [ 25.592491] ? lock_downgrade+0x980/0x980 [ 25.596619] ? dsthash_find+0x5b0/0x5b0 [ 25.600575] ? __lock_acquire+0x664/0x3e00 [ 25.604789] ? is_bpf_text_address+0x7b/0x120 [ 25.609261] ? lock_downgrade+0x8da/0x980 [ 25.613391] ? rcutorture_record_progress+0x10/0x10 [ 25.618390] ? __kernel_text_address+0xd/0x40 [ 25.622864] ? unwind_get_return_address+0x61/0xa0 [ 25.627775] hashlimit_mt+0x78/0x90 [ 25.631382] ? hashlimit_mt+0x78/0x90 [ 25.635160] ip6t_do_table+0x98d/0x1a30 [ 25.639116] ? kmem_cache_alloc_trace+0x136/0x740 [ 25.643941] ? mld_sendpack+0x617/0xe70 [ 25.647894] ? ip6t_error+0x60/0x60 [ 25.651499] ? check_noncircular+0x20/0x20 [ 25.655714] ? lock_acquire+0x1d5/0x580 [ 25.659665] ? lock_acquire+0x1d5/0x580 [ 25.663617] ? igmp6_mcf_seq_next+0x660/0x660 [ 25.668097] ? lock_release+0xa40/0xa40 [ 25.672052] ip6table_raw_hook+0x65/0x80 [ 25.676094] nf_hook_slow+0xba/0x1a0 [ 25.679786] nf_hook.constprop.37+0x3f6/0x830 [ 25.684261] ? igmp6_mcf_seq_next+0x660/0x660 [ 25.688737] ? trace_hardirqs_on+0xd/0x10 [ 25.692865] ? __local_bh_enable_ip+0x121/0x230 [ 25.697513] ? _raw_spin_unlock_bh+0x30/0x40 [ 25.701899] ? rt6_uncached_list_add+0x1b7/0x240 [ 25.706634] ? rt6_fill_node+0x18b0/0x18b0 [ 25.710852] ? icmp6_dst_alloc+0x475/0x660 [ 25.715065] ? ip6_mc_leave_src+0x1d0/0x1d0 [ 25.719365] ? icmpv6_flow_init+0x1f6/0x270 [ 25.723668] mld_sendpack+0x6c2/0xe70 [ 25.727451] ? nf_hook.constprop.37+0x830/0x830 [ 25.732099] ? mark_held_locks+0xaf/0x100 [ 25.736230] ? trace_hardirqs_on+0xd/0x10 [ 25.740359] ? __local_bh_enable_ip+0x121/0x230 [ 25.745005] mld_ifc_timer_expire+0x3d9/0x770 [ 25.749486] call_timer_fn+0x228/0x820 [ 25.753352] ? mld_dad_timer_expire+0x100/0x100 [ 25.757999] ? process_timeout+0x40/0x40 [ 25.762046] ? __run_timers+0x7e3/0xb70 [ 25.765999] ? lock_downgrade+0x980/0x980 [ 25.770128] ? debug_object_deactivate+0x364/0x560 [ 25.775038] ? lock_release+0xa40/0xa40 [ 25.778988] ? do_raw_spin_trylock+0x190/0x190 [ 25.783552] ? trace_hardirqs_on_caller+0x19e/0x5c0 [ 25.788544] ? mld_dad_timer_expire+0x100/0x100 [ 25.793191] ? mld_dad_timer_expire+0x100/0x100 [ 25.797836] __run_timers+0x7ee/0xb70 [ 25.801621] ? trigger_dyntick_cpu.isra.29+0x150/0x150 [ 25.806881] ? timerqueue_add+0x1e9/0x280 [ 25.811008] ? check_noncircular+0x20/0x20 [ 25.815224] ? enqueue_hrtimer+0x177/0x4b0 [ 25.819436] ? lock_release+0xa40/0xa40 [ 25.823388] ? retrigger_next_event+0x1e0/0x1e0 [ 25.828040] ? find_held_lock+0x35/0x1d0 [ 25.832085] ? clockevents_program_event+0x163/0x2e0 [ 25.837171] ? lock_downgrade+0x980/0x980 [ 25.841324] ? rcu_pm_notify+0xc0/0xc0 [ 25.845191] run_timer_softirq+0x4c/0x70 [ 25.849231] __do_softirq+0x2d7/0xb85 [ 25.853011] ? ktime_get+0x26f/0x3a0 [ 25.856709] ? __irqentry_text_end+0x1f8ee4/0x1f8ee4 [ 25.861793] ? do_timer+0x50/0x50 [ 25.865224] ? native_apic_msr_write+0x5c/0x80 [ 25.869785] ? lapic_next_event+0x54/0x80 [ 25.873910] ? clockevents_program_event+0x108/0x2e0 [ 25.878992] ? tick_program_event+0x83/0x100 [ 25.883380] ? rcu_pm_notify+0xc0/0xc0 [ 25.887250] irq_exit+0x1cc/0x200 [ 25.890684] smp_apic_timer_interrupt+0x16b/0x700 [ 25.895504] ? smp_reschedule_interrupt+0xe6/0x650 [ 25.900411] ? smp_call_function_single_interrupt+0x640/0x640 [ 25.906272] ? _raw_spin_lock+0x32/0x40 [ 25.910226] ? _raw_spin_unlock+0x22/0x30 [ 25.914354] ? handle_edge_irq+0x2b4/0x7c0 [ 25.918568] ? task_prio+0x50/0x50 [ 25.922090] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 25.926914] apic_timer_interrupt+0xa9/0xb0 [ 25.931211] [ 25.933427] RIP: 0033:0x4d8f2d [ 25.936597] RSP: 002b:000000c42041e8c8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff12 [ 25.944283] RAX: 0000000000000000 RBX: 0000000000eb2e00 RCX: 0000000000000000 [ 25.951531] RDX: 00000000004f29a0 RSI: 0000000000eb2e00 RDI: 000000c42041e968 [ 25.958782] RBP: 000000c42041e968 R08: 000000000167a740 R09: 00000000005494e0 [ 25.966034] R10: 00000000005ec58b R11: 0000000000000004 R12: 0000000000000000 [ 25.973280] R13: 0000000000000020 R14: 0000000000000013 R15: 0000000000000016 2018/02/20 05:06:18 executed programs: 589 2018/02/20 05:06:23 executed programs: 1406