[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 44.551283] kauditd_printk_skb: 9 callbacks suppressed [ 44.551299] audit: type=1400 audit(1539134663.570:35): avc: denied { map } for pid=5944 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.39' (ECDSA) to the list of known hosts. [ 76.273349] audit: type=1400 audit(1539134695.290:36): avc: denied { map } for pid=5956 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=16479 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2018/10/10 01:24:55 parsed 1 programs [ 76.822848] audit: type=1400 audit(1539134695.840:37): avc: denied { map } for pid=5956 comm="syz-execprog" path="/sys/kernel/debug/kcov" dev="debugfs" ino=14791 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 2018/10/10 01:24:57 executed programs: 0 [ 78.444655] IPVS: ftp: loaded support on port[0] = 21 [ 78.644458] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.650947] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.658073] device bridge_slave_0 entered promiscuous mode [ 78.673300] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.679813] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.686966] device bridge_slave_1 entered promiscuous mode [ 78.701316] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 78.716696] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 78.758028] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 78.776102] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 78.835589] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 78.842675] team0: Port device team_slave_0 added [ 78.858232] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 78.865455] team0: Port device team_slave_1 added [ 78.879926] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 78.899723] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 78.916170] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 78.933943] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 79.048510] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.054902] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.061469] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.067898] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.469168] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 79.475561] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.517002] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 79.559418] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 79.566332] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 79.601309] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.830853] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. [ 79.879238] hrtimer: interrupt took 21059 ns 2018/10/10 01:25:02 executed programs: 124 [ 85.516013] ------------[ cut here ]------------ [ 85.520887] refcount_t: increment on 0; use-after-free. [ 85.527364] WARNING: CPU: 0 PID: 7079 at lib/refcount.c:153 refcount_inc_checked+0x5d/0x70 [ 85.535769] Kernel panic - not syncing: panic_on_warn set ... [ 85.535769] [ 85.543116] CPU: 0 PID: 7079 Comm: syz-executor0 Not tainted 4.19.0-rc7+ #54 [ 85.550280] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 85.559615] Call Trace: [ 85.562187] dump_stack+0x1c4/0x2b4 [ 85.565828] ? dump_stack_print_info.cold.2+0x52/0x52 [ 85.571002] panic+0x238/0x4e7 [ 85.574178] ? add_taint.cold.5+0x16/0x16 [ 85.578307] ? __warn.cold.8+0x148/0x1ba [ 85.582350] ? __warn.cold.8+0x117/0x1ba [ 85.586398] ? refcount_inc_checked+0x5d/0x70 [ 85.590893] __warn.cold.8+0x163/0x1ba [ 85.594763] ? refcount_inc_checked+0x5d/0x70 [ 85.599249] report_bug+0x254/0x2d0 [ 85.602862] do_error_trap+0x1fc/0x4d0 [ 85.606734] ? __fd_install+0x2ec/0x8f0 [ 85.610710] ? math_error+0x3f0/0x3f0 [ 85.614496] ? vprintk_default+0x28/0x30 [ 85.618538] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 85.623365] ? trace_hardirqs_on_caller+0x310/0x310 [ 85.628363] ? printk+0xa7/0xcf [ 85.631629] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 85.636455] do_invalid_op+0x1b/0x20 [ 85.640176] invalid_op+0x14/0x20 [ 85.643618] RIP: 0010:refcount_inc_checked+0x5d/0x70 [ 85.648704] Code: 1d 2b 7d 62 06 31 ff 89 de e8 1f bc f2 fd 84 db 75 df e8 46 bb f2 fd 48 c7 c7 80 72 40 88 c6 05 0b 7d 62 06 01 e8 23 8e bc fd <0f> 0b eb c3 0f 1f 44 00 00 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 [ 85.667587] RSP: 0018:ffff8801cea7f708 EFLAGS: 00010286 [ 85.672932] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 85.680184] RDX: 0000000000000000 RSI: ffffffff81650405 RDI: 0000000000000005 [ 85.687436] RBP: ffff8801cea7f710 R08: ffff8801c95fc1c0 R09: ffffed003b5c4fe8 [ 85.694701] R10: ffffed003b5c4fe8 R11: ffff8801dae27f47 R12: ffff8801cea7f7c0 [ 85.701953] R13: ffff8801b8f24900 R14: ffffffff892b6ec0 R15: ffffc90004357000 [ 85.709214] ? vprintk_func+0x85/0x181 [ 85.713117] ? refcount_inc_checked+0x5d/0x70 [ 85.717596] kvm_vm_ioctl+0xed7/0x1d40 [ 85.721467] ? drop_futex_key_refs.isra.15+0x6d/0xe0 [ 85.726554] ? kvm_set_memory_region+0x50/0x50 [ 85.731118] ? smp_call_on_cpu+0x560/0x560 [ 85.735347] ? __do_sys_perf_event_open+0x1ff3/0x2f30 [ 85.740524] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 85.746050] ? kasan_check_read+0x11/0x20 [ 85.750181] ? mark_held_locks+0x130/0x130 [ 85.754402] ? do_futex+0x249/0x26d0 [ 85.758098] ? thread_cpu_timer_create+0x50/0x50 [ 85.762837] ? __fd_install+0x2b5/0x8f0 [ 85.766813] ? exit_robust_list+0x280/0x280 [ 85.771119] ? __fget+0x4aa/0x740 [ 85.774571] ? lock_downgrade+0x900/0x900 [ 85.778706] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 85.784489] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 85.789410] ? get_unused_fd_flags+0x1a0/0x1a0 [ 85.793993] ? __fget+0x4d1/0x740 [ 85.797433] ? ksys_dup3+0x680/0x680 [ 85.801153] ? __might_fault+0x12b/0x1e0 [ 85.805199] ? lock_downgrade+0x900/0x900 [ 85.809580] ? lock_release+0x970/0x970 [ 85.813540] ? arch_local_save_flags+0x40/0x40 [ 85.818104] ? kvm_set_memory_region+0x50/0x50 [ 85.822672] do_vfs_ioctl+0x1de/0x1720 [ 85.826545] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 85.831720] ? ioctl_preallocate+0x300/0x300 [ 85.836121] ? selinux_file_mprotect+0x620/0x620 [ 85.840868] ? logic_pio_to_hwaddr+0x1e0/0x290 [ 85.845433] ? __sanitizer_cov_trace_cmp2+0xb/0x20 [ 85.850349] ? put_timespec64+0x10f/0x1b0 [ 85.854480] ? nsecs_to_jiffies+0x30/0x30 [ 85.858612] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 85.864134] ? security_file_ioctl+0x94/0xc0 [ 85.868531] ksys_ioctl+0xa9/0xd0 [ 85.871967] __x64_sys_ioctl+0x73/0xb0 [ 85.875841] do_syscall_64+0x1b9/0x820 [ 85.879730] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 85.885081] ? syscall_return_slowpath+0x5e0/0x5e0 [ 85.889993] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 85.894822] ? trace_hardirqs_on_caller+0x310/0x310 [ 85.899820] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 85.904820] ? prepare_exit_to_usermode+0x291/0x3b0 [ 85.909823] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 85.914650] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 85.919824] RIP: 0033:0x457579 [ 85.923002] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 85.941887] RSP: 002b:00007f29da949c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 85.949580] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457579 [ 85.956833] RDX: 00000000200002c0 RSI: 00000000c00caee0 RDI: 0000000000000008 [ 85.964102] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 85.971356] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f29da94a6d4 [ 85.978608] R13: 00000000004bfbd1 R14: 00000000004cfc58 R15: 00000000ffffffff [ 85.986847] Kernel Offset: disabled [ 85.990470] Rebooting in 86400 seconds..