[ 41.330961] audit: type=1800 audit(1555864473.612:29): pid=7787 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2447 res=0 [ 41.372934] audit: type=1800 audit(1555864473.612:30): pid=7787 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2490 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.189' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 49.284330] kauditd_printk_skb: 5 callbacks suppressed [ 49.284346] audit: type=1400 audit(1555864481.562:36): avc: denied { map } for pid=7972 comm="syz-executor095" path="/root/syz-executor095656850" dev="sda1" ino=16484 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 49.329870] FAULT_INJECTION: forcing a failure. [ 49.329870] name failslab, interval 1, probability 0, space 0, times 1 [ 49.341331] CPU: 0 PID: 7973 Comm: syz-executor095 Not tainted 4.19.36 #4 [ 49.348249] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 49.357587] Call Trace: [ 49.360178] dump_stack+0x172/0x1f0 [ 49.363795] should_fail.cold+0xa/0x1b [ 49.367668] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 49.372776] ? lock_downgrade+0x810/0x810 [ 49.376912] ? ___might_sleep+0x163/0x280 [ 49.381061] __should_failslab+0x121/0x190 [ 49.385306] should_failslab+0x9/0x14 [ 49.389092] __kmalloc+0x2e5/0x750 [ 49.392619] ? lock_downgrade+0x810/0x810 [ 49.396756] ? tls_push_record+0x107/0x13b0 [ 49.401063] tls_push_record+0x107/0x13b0 [ 49.405217] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 49.410219] ? _copy_from_iter+0x30d/0xb50 [ 49.414442] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 49.419965] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 49.425499] ? __check_object_size+0x3d/0x42f [ 49.430008] tls_sw_sendmsg+0xd31/0x1220 [ 49.434087] ? decrypt_skb_update+0x5c0/0x5c0 [ 49.438584] ? iterate_fd+0x360/0x360 [ 49.442370] ? proc_cwd_link+0x1d0/0x1d0 [ 49.446438] inet_sendmsg+0x147/0x5d0 [ 49.450229] ? ipip_gro_receive+0x100/0x100 [ 49.454538] sock_sendmsg+0xdd/0x130 [ 49.458242] __sys_sendto+0x262/0x380 [ 49.462034] ? __ia32_sys_getpeername+0xb0/0xb0 [ 49.466691] ? __mutex_unlock_slowpath+0xf8/0x6b0 [ 49.471524] ? __sb_end_write+0xd9/0x110 [ 49.475578] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 49.481104] ? fput+0x128/0x1a0 [ 49.484373] ? ksys_write+0x166/0x1f0 [ 49.488172] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 49.492932] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 49.497683] ? do_syscall_64+0x26/0x610 [ 49.501660] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 49.507012] __x64_sys_sendto+0xe1/0x1a0 [ 49.511066] do_syscall_64+0x103/0x610 [ 49.514943] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 49.520116] RIP: 0033:0x445c49 [ 49.523291] Code: e8 fc ba 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 8b 12 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 49.542201] RSP: 002b:00007faec64b7d78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 49.550166] RAX: ffffffffffffffda RBX: 00000000006dac28 RCX: 0000000000445c49 [ 49.557432] RDX: fffffffffffffee0 RSI: 00000000200005c0 RDI: 0000000000000003 [ 49.564696] RBP: 00000000006dac20 R08: 0000000000000000 R09: 00000000000000b6 [ 49.571959] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dac2c [ 49.579229] R13: 00007faec64b7d90 R14: 0000000000000004 R15: 20c49ba5e353f7cf [ 49.588888] ================================================================== [ 49.596367] BUG: KASAN: use-after-free in tls_push_record+0x1035/0x13b0 [ 49.603110] Write of size 1 at addr ffff8880858e0000 by task syz-executor095/7973 [ 49.610714] [ 49.612339] CPU: 0 PID: 7973 Comm: syz-executor095 Not tainted 4.19.36 #4 [ 49.619244] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 49.628581] Call Trace: [ 49.631162] dump_stack+0x172/0x1f0 [ 49.634792] ? tls_push_record+0x1035/0x13b0 [ 49.639210] print_address_description.cold+0x7c/0x20d [ 49.644475] ? tls_push_record+0x1035/0x13b0 [ 49.648872] kasan_report.cold+0x8c/0x2ba [ 49.653012] __asan_report_store1_noabort+0x17/0x20 [ 49.658058] tls_push_record+0x1035/0x13b0 [ 49.662285] ? __local_bh_enable_ip+0x15a/0x270 [ 49.666944] ? lock_sock_nested+0x9a/0x120 [ 49.671173] tls_sw_push_pending_record+0x23/0x30 [ 49.676037] tls_sk_proto_close+0x5c5/0xaa0 [ 49.680350] ? debug_object_activate+0x2c8/0x4f0 [ 49.685095] ? tcp_check_oom+0x560/0x560 [ 49.689145] ? tls_write_space+0x310/0x310 [ 49.693366] ? ip_mc_drop_socket+0x20c/0x270 [ 49.697765] ? __sock_release+0x89/0x2b0 [ 49.701814] inet_release+0x105/0x1f0 [ 49.705616] inet6_release+0x53/0x80 [ 49.709316] __sock_release+0xd3/0x2b0 [ 49.713192] ? __sock_release+0x2b0/0x2b0 [ 49.717340] sock_close+0x1b/0x30 [ 49.720782] __fput+0x2df/0x8b0 [ 49.724049] ____fput+0x16/0x20 [ 49.727316] task_work_run+0x14a/0x1c0 [ 49.731192] do_exit+0x933/0x2fa0 [ 49.734632] ? _raw_spin_unlock_bh+0x31/0x40 [ 49.739031] ? release_sock+0x158/0x1c0 [ 49.742995] ? get_signal+0x331/0x1d50 [ 49.746870] ? mm_update_next_owner+0x660/0x660 [ 49.751530] ? _raw_spin_unlock_irq+0x28/0x90 [ 49.756012] ? get_signal+0x331/0x1d50 [ 49.759900] ? _raw_spin_unlock_irq+0x28/0x90 [ 49.764381] do_group_exit+0x135/0x370 [ 49.768270] get_signal+0x399/0x1d50 [ 49.771980] ? inet_sendmsg+0x14f/0x5d0 [ 49.775946] do_signal+0x95/0x1950 [ 49.779480] ? __ia32_sys_getpeername+0xb0/0xb0 [ 49.784134] ? setup_sigcontext+0x7d0/0x7d0 [ 49.788457] ? __sb_end_write+0xd9/0x110 [ 49.792520] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 49.798049] ? fput+0x128/0x1a0 [ 49.801318] ? ksys_write+0x166/0x1f0 [ 49.805107] ? exit_to_usermode_loop+0x43/0x2c0 [ 49.809782] ? do_syscall_64+0x52d/0x610 [ 49.813828] ? exit_to_usermode_loop+0x43/0x2c0 [ 49.818497] ? lockdep_hardirqs_on+0x415/0x5d0 [ 49.823082] ? trace_hardirqs_on+0x67/0x230 [ 49.827391] exit_to_usermode_loop+0x244/0x2c0 [ 49.831988] do_syscall_64+0x52d/0x610 [ 49.835861] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 49.841035] RIP: 0033:0x445c49 [ 49.844219] Code: Bad RIP value. [ 49.847576] RSP: 002b:00007faec64b7d78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 49.855287] RAX: 0000000000004000 RBX: 00000000006dac28 RCX: 0000000000445c49 [ 49.862545] RDX: fffffffffffffee0 RSI: 00000000200005c0 RDI: 0000000000000003 [ 49.869799] RBP: 00000000006dac20 R08: 0000000000000000 R09: 00000000000000b6 [ 49.877066] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dac2c [ 49.884324] R13: 00007faec64b7d90 R14: 0000000000000004 R15: 20c49ba5e353f7cf [ 49.891589] [ 49.893197] The buggy address belongs to the page: [ 49.898107] page:ffffea0002163800 count:0 mapcount:-128 mapping:0000000000000000 index:0x0 [ 49.906491] flags: 0x1fffc0000000000() [ 49.910364] raw: 01fffc0000000000 ffffea00021a2a08 ffff88812fffc878 0000000000000000 [ 49.918231] raw: 0000000000000000 0000000000000003 00000000ffffff7f 0000000000000000 [ 49.926093] page dumped because: kasan: bad access detected [ 49.931787] [ 49.933393] Memory state around the buggy address: [ 49.938306] ffff8880858dff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 49.945652] ffff8880858dff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 49.953000] >ffff8880858e0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 49.960343] ^ [ 49.963688] ffff8880858e0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 49.971031] ffff8880858e0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 49.978368] ================================================================== [ 49.985707] Disabling lock debugging due to kernel taint [ 49.991240] Kernel panic - not syncing: panic_on_warn set ... [ 49.991240] [ 49.998624] CPU: 0 PID: 7973 Comm: syz-executor095 Tainted: G B 4.19.36 #4 [ 50.006934] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 50.016275] Call Trace: [ 50.018855] dump_stack+0x172/0x1f0 [ 50.022472] ? tls_push_record+0x1035/0x13b0 [ 50.026860] panic+0x263/0x51d [ 50.030039] ? __warn_printk+0xf3/0xf3 [ 50.033906] ? tls_push_record+0x1035/0x13b0 [ 50.038300] ? trace_hardirqs_on+0x5e/0x230 [ 50.042602] ? trace_hardirqs_on+0x5e/0x230 [ 50.046909] ? tls_push_record+0x1035/0x13b0 [ 50.051303] kasan_end_report+0x47/0x4f [ 50.055263] kasan_report.cold+0xa9/0x2ba [ 50.059398] __asan_report_store1_noabort+0x17/0x20 [ 50.064399] tls_push_record+0x1035/0x13b0 [ 50.068619] ? __local_bh_enable_ip+0x15a/0x270 [ 50.073273] ? lock_sock_nested+0x9a/0x120 [ 50.077492] tls_sw_push_pending_record+0x23/0x30 [ 50.082331] tls_sk_proto_close+0x5c5/0xaa0 [ 50.086638] ? debug_object_activate+0x2c8/0x4f0 [ 50.091392] ? tcp_check_oom+0x560/0x560 [ 50.095438] ? tls_write_space+0x310/0x310 [ 50.099657] ? ip_mc_drop_socket+0x20c/0x270 [ 50.104054] ? __sock_release+0x89/0x2b0 [ 50.108100] inet_release+0x105/0x1f0 [ 50.111883] inet6_release+0x53/0x80 [ 50.115598] __sock_release+0xd3/0x2b0 [ 50.119488] ? __sock_release+0x2b0/0x2b0 [ 50.123630] sock_close+0x1b/0x30 [ 50.127074] __fput+0x2df/0x8b0 [ 50.130337] ____fput+0x16/0x20 [ 50.133616] task_work_run+0x14a/0x1c0 [ 50.137486] do_exit+0x933/0x2fa0 [ 50.140922] ? _raw_spin_unlock_bh+0x31/0x40 [ 50.145313] ? release_sock+0x158/0x1c0 [ 50.149285] ? get_signal+0x331/0x1d50 [ 50.153155] ? mm_update_next_owner+0x660/0x660 [ 50.157810] ? _raw_spin_unlock_irq+0x28/0x90 [ 50.162289] ? get_signal+0x331/0x1d50 [ 50.166157] ? _raw_spin_unlock_irq+0x28/0x90 [ 50.170635] do_group_exit+0x135/0x370 [ 50.174509] get_signal+0x399/0x1d50 [ 50.178216] ? inet_sendmsg+0x14f/0x5d0 [ 50.182179] do_signal+0x95/0x1950 [ 50.185702] ? __ia32_sys_getpeername+0xb0/0xb0 [ 50.190356] ? setup_sigcontext+0x7d0/0x7d0 [ 50.194677] ? __sb_end_write+0xd9/0x110 [ 50.198725] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 50.204244] ? fput+0x128/0x1a0 [ 50.207515] ? ksys_write+0x166/0x1f0 [ 50.211305] ? exit_to_usermode_loop+0x43/0x2c0 [ 50.215954] ? do_syscall_64+0x52d/0x610 [ 50.220000] ? exit_to_usermode_loop+0x43/0x2c0 [ 50.224653] ? lockdep_hardirqs_on+0x415/0x5d0 [ 50.229217] ? trace_hardirqs_on+0x67/0x230 [ 50.233523] exit_to_usermode_loop+0x244/0x2c0 [ 50.238093] do_syscall_64+0x52d/0x610 [ 50.241980] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 50.247155] RIP: 0033:0x445c49 [ 50.250335] Code: Bad RIP value. [ 50.253681] RSP: 002b:00007faec64b7d78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 50.261380] RAX: 0000000000004000 RBX: 00000000006dac28 RCX: 0000000000445c49 [ 50.268644] RDX: fffffffffffffee0 RSI: 00000000200005c0 RDI: 0000000000000003 [ 50.276014] RBP: 00000000006dac20 R08: 0000000000000000 R09: 00000000000000b6 [ 50.283304] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dac2c [ 50.290561] R13: 00007faec64b7d90 R14: 0000000000000004 R15: 20c49ba5e353f7cf [ 50.298614] Kernel Offset: disabled [ 50.302241] Rebooting in 86400 seconds..