[....] Starting enhanced syslogd: rsyslogd[ 17.274737] audit: type=1400 audit(1520366575.200:5): avc: denied { syslog } for pid=4084 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 22.239780] audit: type=1400 audit(1520366580.165:6): avc: denied { map } for pid=4225 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.23' (ECDSA) to the list of known hosts. executing program [ 28.575788] audit: type=1400 audit(1520366586.501:7): avc: denied { map } for pid=4239 comm="syzkaller296139" path="/root/syzkaller296139392" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 28.588663] ================================================================== [ 28.601755] audit: type=1400 audit(1520366586.511:8): avc: denied { map } for pid=4239 comm="syzkaller296139" path=2F6D656D66643A49202864656C6574656429 dev="tmpfs" ino=13679 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:tmpfs_t:s0 tclass=file permissive=1 [ 28.609079] BUG: KASAN: use-after-free in ucma_close+0x2d7/0x2f0 [ 28.609085] Read of size 8 at addr ffff8801af1739c0 by task syzkaller296139/4243 [ 28.609087] [ 28.609096] CPU: 1 PID: 4243 Comm: syzkaller296139 Not tainted 4.16.0-rc4+ #343 [ 28.609102] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 28.609107] Call Trace: [ 28.670055] dump_stack+0x194/0x24d [ 28.673658] ? arch_local_irq_restore+0x53/0x53 [ 28.678298] ? show_regs_print_info+0x18/0x18 [ 28.682772] ? ucma_close+0x2d7/0x2f0 [ 28.686545] print_address_description+0x73/0x250 [ 28.691361] ? ucma_close+0x2d7/0x2f0 [ 28.695132] kasan_report+0x23c/0x360 [ 28.698909] __asan_report_load8_noabort+0x14/0x20 [ 28.703811] ucma_close+0x2d7/0x2f0 [ 28.707412] ? __might_sleep+0x95/0x190 [ 28.711361] ? ucma_free_ctx+0xd90/0xd90 [ 28.715393] __fput+0x327/0x7e0 [ 28.718652] ? fput+0x140/0x140 [ 28.721906] ? check_same_owner+0x320/0x320 [ 28.726199] ? _raw_spin_unlock_irq+0x27/0x70 [ 28.730671] ____fput+0x15/0x20 [ 28.733922] task_work_run+0x199/0x270 [ 28.737782] ? task_work_cancel+0x210/0x210 [ 28.742075] ? _raw_spin_unlock+0x22/0x30 [ 28.746195] ? switch_task_namespaces+0x87/0xc0 [ 28.750845] do_exit+0x9bb/0x1ad0 [ 28.754275] ? mm_update_next_owner+0x930/0x930 [ 28.758921] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 28.764082] ? __lock_acquire+0x664/0x3e00 [ 28.768304] ? trace_hardirqs_off+0x10/0x10 [ 28.772609] ? __lock_is_held+0xb6/0x140 [ 28.776649] ? trace_hardirqs_off+0x10/0x10 [ 28.780947] ? __lock_is_held+0xb6/0x140 [ 28.784978] ? nohz_balance_exit_idle.part.95+0x70/0x70 [ 28.790321] ? find_held_lock+0x35/0x1d0 [ 28.794365] ? kprobe_flush_task+0x1a3/0x5d0 [ 28.798750] ? trace_hardirqs_off+0x10/0x10 [ 28.803043] ? lock_downgrade+0x980/0x980 [ 28.807165] ? lock_release+0xa40/0xa40 [ 28.811114] ? memset+0x31/0x40 [ 28.814368] ? find_held_lock+0x35/0x1d0 [ 28.818409] ? get_signal+0x7a9/0x16d0 [ 28.822274] ? lock_downgrade+0x980/0x980 [ 28.826402] do_group_exit+0x149/0x400 [ 28.830274] ? do_raw_spin_trylock+0x190/0x190 [ 28.834842] ? SyS_exit+0x30/0x30 [ 28.838272] ? _raw_spin_unlock_irq+0x27/0x70 [ 28.842744] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 28.847736] get_signal+0x73a/0x16d0 [ 28.851431] ? ptrace_notify+0x130/0x130 [ 28.855920] ? __schedule+0x903/0x1ec0 [ 28.859789] ? __sched_text_start+0x8/0x8 [ 28.863910] ? save_stack+0xa3/0xd0 [ 28.867507] ? save_stack+0x43/0xd0 [ 28.871108] ? __kasan_slab_free+0x11a/0x170 [ 28.875490] ? kasan_slab_free+0xe/0x10 [ 28.879440] ? kfree+0xd9/0x260 [ 28.882692] ? SyS_memfd_create+0x381/0x4c0 [ 28.886989] ? do_syscall_64+0x281/0x940 [ 28.891035] do_signal+0x90/0x1e90 [ 28.894550] ? debug_check_no_obj_freed+0x3da/0xf1f [ 28.899546] ? setup_sigcontext+0x7d0/0x7d0 [ 28.903842] ? free_obj_work+0x690/0x690 [ 28.907882] ? schedule+0xf5/0x430 [ 28.911400] ? __schedule+0x1ec0/0x1ec0 [ 28.915358] ? __check_object_size+0x8b/0x530 [ 28.919845] ? exit_to_usermode_loop+0x8c/0x2f0 [ 28.924491] exit_to_usermode_loop+0x258/0x2f0 [ 28.929044] ? SyS_memfd_create+0x175/0x4c0 [ 28.933338] ? trace_event_raw_event_sys_exit+0x260/0x260 [ 28.938849] ? do_syscall_64+0xb7/0x940 [ 28.942802] do_syscall_64+0x6ec/0x940 [ 28.946672] ? _raw_spin_unlock_irq+0x27/0x70 [ 28.951148] ? finish_task_switch+0x1c1/0x7e0 [ 28.955619] ? syscall_return_slowpath+0x550/0x550 [ 28.960519] ? syscall_return_slowpath+0x2ac/0x550 [ 28.965422] ? prepare_exit_to_usermode+0x350/0x350 [ 28.970412] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 28.975751] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 28.980569] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 28.985730] RIP: 0033:0x445619 [ 28.988898] RSP: 002b:00007f603ee58da8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 28.996588] RAX: 0000000000000001 RBX: 00000000006dac3c RCX: 0000000000445619 [ 29.003830] RDX: 0000000000445619 RSI: 0000000000000001 RDI: 00000000006dac3c [ 29.011070] RBP: 00000000006dac38 R08: 0000000000000000 R09: 0000000000000000 [ 29.018322] R10: 00007f603ee59700 R11: 0000000000000246 R12: 006d635f616d6472 [ 29.025579] R13: 2f646e6162696e69 R14: 666e692f7665642f R15: 0000000000000004 [ 29.032849] [ 29.034448] Allocated by task 4240: [ 29.038068] save_stack+0x43/0xd0 [ 29.041491] kasan_kmalloc+0xad/0xe0 [ 29.045176] kmem_cache_alloc_trace+0x136/0x740 [ 29.049818] ucma_alloc_ctx+0xce/0x610 [ 29.053679] ucma_create_id+0x205/0x620 [ 29.057627] ucma_write+0x2d6/0x3d0 [ 29.061234] __vfs_write+0xef/0x970 [ 29.064839] vfs_write+0x189/0x510 [ 29.068359] SyS_write+0xef/0x220 [ 29.071786] do_syscall_64+0x281/0x940 [ 29.075648] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 29.080822] [ 29.082434] Freed by task 4240: [ 29.085712] save_stack+0x43/0xd0 [ 29.089147] __kasan_slab_free+0x11a/0x170 [ 29.093359] kasan_slab_free+0xe/0x10 [ 29.097133] kfree+0xd9/0x260 [ 29.100213] ucma_create_id+0x45b/0x620 [ 29.104159] ucma_write+0x2d6/0x3d0 [ 29.107756] __vfs_write+0xef/0x970 [ 29.111354] vfs_write+0x189/0x510 [ 29.114865] SyS_write+0xef/0x220 [ 29.118294] do_syscall_64+0x281/0x940 [ 29.122154] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 29.127318] [ 29.128922] The buggy address belongs to the object at ffff8801af173940 [ 29.128922] which belongs to the cache kmalloc-256 of size 256 [ 29.141553] The buggy address is located 128 bytes inside of [ 29.141553] 256-byte region [ffff8801af173940, ffff8801af173a40) [ 29.153397] The buggy address belongs to the page: [ 29.158295] page:ffffea0006bc5cc0 count:1 mapcount:0 mapping:ffff8801af173080 index:0x0 [ 29.166410] flags: 0x2fffc0000000100(slab) [ 29.170615] raw: 02fffc0000000100 ffff8801af173080 0000000000000000 000000010000000c [ 29.178468] raw: ffffea0006bda620 ffff8801dac01648 ffff8801dac007c0 0000000000000000 [ 29.186316] page dumped because: kasan: bad access detected [ 29.191993] [ 29.193593] Memory state around the buggy address: [ 29.198491] ffff8801af173880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.205822] ffff8801af173900: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 29.213154] >ffff8801af173980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.220483] ^ [ 29.225905] ffff8801af173a00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 29.233234] ffff8801af173a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.240576] ================================================================== [ 29.247906] Disabling lock debugging due to kernel taint [ 29.253671] Kernel panic - not syncing: panic_on_warn set ... [ 29.253671] [ 29.261022] CPU: 1 PID: 4243 Comm: syzkaller296139 Tainted: G B 4.16.0-rc4+ #343 [ 29.269757] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.279083] Call Trace: [ 29.281647] dump_stack+0x194/0x24d [ 29.285246] ? arch_local_irq_restore+0x53/0x53 [ 29.289886] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 29.294621] ? vsnprintf+0x1ed/0x1900 [ 29.298394] ? ucma_close+0x2d0/0x2f0 [ 29.302165] panic+0x1e4/0x41c [ 29.305326] ? refcount_error_report+0x214/0x214 [ 29.310054] ? add_taint+0x1c/0x50 [ 29.313566] ? add_taint+0x1c/0x50 [ 29.317077] ? ucma_close+0x2d7/0x2f0 [ 29.320848] kasan_end_report+0x50/0x50 [ 29.324805] kasan_report+0x149/0x360 [ 29.328576] __asan_report_load8_noabort+0x14/0x20 [ 29.333476] ucma_close+0x2d7/0x2f0 [ 29.337072] ? __might_sleep+0x95/0x190 [ 29.341021] ? ucma_free_ctx+0xd90/0xd90 [ 29.345053] __fput+0x327/0x7e0 [ 29.348306] ? fput+0x140/0x140 [ 29.351554] ? check_same_owner+0x320/0x320 [ 29.355843] ? _raw_spin_unlock_irq+0x27/0x70 [ 29.360309] ____fput+0x15/0x20 [ 29.363559] task_work_run+0x199/0x270 [ 29.367417] ? task_work_cancel+0x210/0x210 [ 29.371707] ? _raw_spin_unlock+0x22/0x30 [ 29.375829] ? switch_task_namespaces+0x87/0xc0 [ 29.380471] do_exit+0x9bb/0x1ad0 [ 29.383900] ? mm_update_next_owner+0x930/0x930 [ 29.388538] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 29.393718] ? __lock_acquire+0x664/0x3e00 [ 29.397930] ? trace_hardirqs_off+0x10/0x10 [ 29.402220] ? __lock_is_held+0xb6/0x140 [ 29.406254] ? trace_hardirqs_off+0x10/0x10 [ 29.410550] ? __lock_is_held+0xb6/0x140 [ 29.414581] ? nohz_balance_exit_idle.part.95+0x70/0x70 [ 29.419921] ? find_held_lock+0x35/0x1d0 [ 29.423958] ? kprobe_flush_task+0x1a3/0x5d0 [ 29.428335] ? trace_hardirqs_off+0x10/0x10 [ 29.432625] ? lock_downgrade+0x980/0x980 [ 29.436745] ? lock_release+0xa40/0xa40 [ 29.440688] ? memset+0x31/0x40 [ 29.443939] ? find_held_lock+0x35/0x1d0 [ 29.448062] ? get_signal+0x7a9/0x16d0 [ 29.451918] ? lock_downgrade+0x980/0x980 [ 29.456039] do_group_exit+0x149/0x400 [ 29.459897] ? do_raw_spin_trylock+0x190/0x190 [ 29.464457] ? SyS_exit+0x30/0x30 [ 29.467881] ? _raw_spin_unlock_irq+0x27/0x70 [ 29.472355] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 29.477342] get_signal+0x73a/0x16d0 [ 29.481034] ? ptrace_notify+0x130/0x130 [ 29.485067] ? __schedule+0x903/0x1ec0 [ 29.488936] ? __sched_text_start+0x8/0x8 [ 29.493054] ? save_stack+0xa3/0xd0 [ 29.496653] ? save_stack+0x43/0xd0 [ 29.500250] ? __kasan_slab_free+0x11a/0x170 [ 29.504626] ? kasan_slab_free+0xe/0x10 [ 29.508569] ? kfree+0xd9/0x260 [ 29.511818] ? SyS_memfd_create+0x381/0x4c0 [ 29.516110] ? do_syscall_64+0x281/0x940 [ 29.520144] do_signal+0x90/0x1e90 [ 29.523657] ? debug_check_no_obj_freed+0x3da/0xf1f [ 29.528649] ? setup_sigcontext+0x7d0/0x7d0 [ 29.532943] ? free_obj_work+0x690/0x690 [ 29.536975] ? schedule+0xf5/0x430 [ 29.540486] ? __schedule+0x1ec0/0x1ec0 [ 29.544440] ? __check_object_size+0x8b/0x530 [ 29.548915] ? exit_to_usermode_loop+0x8c/0x2f0 [ 29.553556] exit_to_usermode_loop+0x258/0x2f0 [ 29.558106] ? SyS_memfd_create+0x175/0x4c0 [ 29.562398] ? trace_event_raw_event_sys_exit+0x260/0x260 [ 29.567906] ? do_syscall_64+0xb7/0x940 [ 29.571851] do_syscall_64+0x6ec/0x940 [ 29.575709] ? _raw_spin_unlock_irq+0x27/0x70 [ 29.580175] ? finish_task_switch+0x1c1/0x7e0 [ 29.584642] ? syscall_return_slowpath+0x550/0x550 [ 29.589542] ? syscall_return_slowpath+0x2ac/0x550 [ 29.594439] ? prepare_exit_to_usermode+0x350/0x350 [ 29.599426] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 29.604765] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 29.609579] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 29.614736] RIP: 0033:0x445619 [ 29.617894] RSP: 002b:00007f603ee58da8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 29.625570] RAX: 0000000000000001 RBX: 00000000006dac3c RCX: 0000000000445619 [ 29.632811] RDX: 0000000000445619 RSI: 0000000000000001 RDI: 00000000006dac3c [ 29.640058] RBP: 00000000006dac38 R08: 0000000000000000 R09: 0000000000000000 [ 29.647296] R10: 00007f603ee59700 R11: 0000000000000246 R12: 006d635f616d6472 [ 29.654545] R13: 2f646e6162696e69 R14: 666e692f7665642f R15: 0000000000000004 [ 29.662201] Dumping ftrace buffer: [ 29.665709] (ftrace buffer empty) [ 29.669390] Kernel Offset: disabled [ 29.672986] Rebooting in 86400 seconds..