forked to background, child pid 197 Starting sshd: OK syzkaller syzkaller login: [ 5.838166][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 12.663042][ T23] kauditd_printk_skb: 60 callbacks suppressed [ 12.663050][ T23] audit: type=1400 audit(1636462505.850:71): avc: denied { transition } for pid=290 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.677776][ T23] audit: type=1400 audit(1636462505.870:72): avc: denied { write } for pid=290 comm="sh" path="pipe:[2041]" dev="pipefs" ino=2041 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1 Warning: Permanently added '10.128.1.150' (ECDSA) to the list of known hosts. 2021/11/09 12:55:12 fuzzer started 2021/11/09 12:55:13 connecting to host at 10.128.0.163:43451 2021/11/09 12:55:13 checking machine... 2021/11/09 12:55:13 checking revisions... 2021/11/09 12:55:13 testing simple program... [ 19.863415][ T23] audit: type=1400 audit(1636462513.050:73): avc: denied { getattr } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 19.867689][ T23] audit: type=1400 audit(1636462513.050:74): avc: denied { read } for pid=362 comm="syz-fuzzer" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 19.871086][ T23] audit: type=1400 audit(1636462513.050:75): avc: denied { open } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 19.875252][ T23] audit: type=1400 audit(1636462513.060:76): avc: denied { read } for pid=362 comm="syz-fuzzer" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 19.879808][ T23] audit: type=1400 audit(1636462513.060:77): avc: denied { open } for pid=362 comm="syz-fuzzer" path="/dev/raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 19.883598][ T371] cgroup: Unknown subsys name 'net' [ 19.885628][ T23] audit: type=1400 audit(1636462513.070:78): avc: denied { mounton } for pid=371 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1136 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 19.885648][ T23] audit: type=1400 audit(1636462513.070:79): avc: denied { mount } for pid=371 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.936502][ T23] audit: type=1400 audit(1636462513.080:80): avc: denied { unmount } for pid=371 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.936672][ T371] cgroup: Unknown subsys name 'devices' [ 20.049640][ T371] cgroup: Unknown subsys name 'hugetlb' [ 20.055320][ T371] cgroup: Unknown subsys name 'rlimit' [ 20.149280][ T23] audit: type=1400 audit(1636462513.340:81): avc: denied { setattr } for pid=371 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 20.172561][ T23] audit: type=1400 audit(1636462513.340:82): avc: denied { execmem } for pid=372 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 20.242807][ T373] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.250001][ T373] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.257426][ T373] device bridge_slave_0 entered promiscuous mode [ 20.264543][ T373] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.271635][ T373] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.279106][ T373] device bridge_slave_1 entered promiscuous mode [ 20.307939][ T373] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.314967][ T373] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.322903][ T373] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.329948][ T373] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.347811][ T24] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.355816][ T24] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.363383][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 20.371004][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.380010][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.388296][ T74] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.395567][ T74] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.418859][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.427252][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 20.436577][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 20.444766][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.453082][ T74] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.460115][ T74] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.467539][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.475583][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.488805][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 20.497115][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 20.506237][ T74] ================================================================================ [ 20.515534][ T74] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:2023:28 [ 20.523346][ T74] member access within address ffffc900002cf1c0 with insufficient space [ 20.531680][ T74] for an object of type 'struct sk_buff' [ 20.537725][ T74] CPU: 0 PID: 74 Comm: kworker/0:1 Not tainted 5.10.78-syzkaller-01155-gbb235e8cc2b6 #0 [ 20.547428][ T74] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 20.557487][ T74] Workqueue: ipv6_addrconf addrconf_dad_work [ 20.563454][ T74] Call Trace: [ 20.566719][ T74] dump_stack_lvl+0x1e2/0x24b [ 20.571466][ T74] ? show_regs_print_info+0x18/0x18 [ 20.576644][ T74] ? wg_allowedips_lookup_dst+0x190/0x190 [ 20.582372][ T74] dump_stack+0x15/0x1d [ 20.586514][ T74] ubsan_type_mismatch_common+0x1ed/0x3a0 [ 20.592415][ T74] ? __sanitizer_cov_trace_switch+0x74/0x90 [ 20.598752][ T74] __ubsan_handle_type_mismatch_v1+0x5b/0x70 [ 20.604990][ T74] wg_xmit+0x4a2/0xae0 [ 20.609118][ T74] ? wg_stop+0x140/0x140 [ 20.613366][ T74] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20 [ 20.619767][ T74] netdev_start_xmit+0x8a/0x160 [ 20.624605][ T74] dev_hard_start_xmit+0x18d/0x2f0 [ 20.629782][ T74] __dev_queue_xmit+0xfbe/0x1bb0 [ 20.634701][ T74] ? dev_queue_xmit+0x20/0x20 [ 20.639354][ T74] ? __local_bh_enable_ip+0xa8/0x170 [ 20.644628][ T74] ? do_raw_spin_unlock+0x50/0x50 [ 20.649630][ T74] ? _local_bh_enable+0x30/0x30 [ 20.654470][ T74] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 20.660691][ T74] ? ndisc_constructor+0x690/0x8a0 [ 20.665788][ T74] ? _raw_write_unlock_bh+0x31/0x47 [ 20.671145][ T74] ? dev_hard_header+0xdb/0xf0 [ 20.676236][ T74] dev_queue_xmit+0x17/0x20 [ 20.680726][ T74] neigh_connected_output+0x288/0x2b0 [ 20.686166][ T74] ip6_finish_output2+0xde2/0x1440 [ 20.691257][ T74] ? __rcu_read_lock+0x50/0x50 [ 20.695999][ T74] ? __ip6_finish_output+0x520/0x520 [ 20.701276][ T74] ? dst_cow_metrics_generic+0x55/0x1d0 [ 20.706888][ T74] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 20.713105][ T74] ? ip6_skb_dst_mtu+0xaf/0x260 [ 20.717945][ T74] __ip6_finish_output+0x3e4/0x520 [ 20.723049][ T74] ip6_finish_output+0x3f/0x220 [ 20.727887][ T74] ? ip6_output+0x1d3/0x4b0 [ 20.732392][ T74] ip6_output+0x1f8/0x4b0 [ 20.736908][ T74] ? asan.module_dtor+0x20/0x20 [ 20.741824][ T74] ? skb_dst+0x40/0x40 [ 20.745872][ T74] ? __rcu_read_lock+0x50/0x50 [ 20.750712][ T74] ? selinux_ipv6_forward+0x50/0x50 [ 20.755991][ T74] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 20.761880][ T74] ? nf_hook_slow+0x150/0x1b0 [ 20.766645][ T74] NF_HOOK+0xdd/0x280 [ 20.770696][ T74] ? addrconf_addr_solict_mult+0xe0/0xe0 [ 20.776426][ T74] ? NF_HOOK+0x280/0x280 [ 20.780970][ T74] ? __rcu_read_lock+0x50/0x50 [ 20.785816][ T74] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 20.792049][ T74] ? ndisc_send_skb+0x547/0x9f0 [ 20.796906][ T74] ? memcpy+0x56/0x70 [ 20.800901][ T74] ndisc_send_skb+0x646/0x9f0 [ 20.805570][ T74] ? slab_post_alloc_hook+0x90/0xa0 [ 20.810937][ T74] ? ndisc_fill_addr_option+0x2f0/0x2f0 [ 20.816529][ T74] ? skb_set_owner_w+0x1a8/0x310 [ 20.821448][ T74] ? __sanitizer_cov_trace_cmp4+0x19/0x20 [ 20.827238][ T74] ? skb_put+0x11d/0x200 [ 20.831468][ T74] ndisc_send_rs+0x26c/0x360 [ 20.836045][ T74] addrconf_dad_completed+0x4f3/0x9f0 [ 20.841412][ T74] ? addrconf_dad_stop+0x430/0x430 [ 20.846504][ T74] ? mutex_unlock+0x34/0x40 [ 20.851011][ T74] addrconf_dad_work+0x9c1/0x1520 [ 20.856038][ T74] ? move_linked_works+0x118/0x130 [ 20.861315][ T74] ? ipv6_use_optimistic_addr+0x1d0/0x1d0 [ 20.867031][ T74] ? __kasan_check_write+0x14/0x20 [ 20.872209][ T74] process_one_work+0x3ca/0x660 [ 20.877042][ T74] worker_thread+0x709/0xa20 [ 20.881613][ T74] ? __kthread_parkme+0x11b/0x150 [ 20.886964][ T74] kthread+0x371/0x390 [ 20.891119][ T74] ? pr_cont_work+0x110/0x110 [ 20.895875][ T74] ? __list_add+0xc0/0xc0 [ 20.900215][ T74] ret_from_fork+0x1f/0x30 [ 20.904670][ T74] ================================================================================ [ 20.914235][ T74] ================================================================================ [ 20.923707][ T74] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:1916:2 [ 20.931718][ T74] member access within address ffffc900002cf1c0 with insufficient space [ 20.940215][ T74] for an object of type 'struct sk_buff' [ 20.945927][ T74] CPU: 0 PID: 74 Comm: kworker/0:1 Not tainted 5.10.78-syzkaller-01155-gbb235e8cc2b6 #0 [ 20.955755][ T74] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 20.965817][ T74] Workqueue: ipv6_addrconf addrconf_dad_work [ 20.971791][ T74] Call Trace: [ 20.975077][ T74] dump_stack_lvl+0x1e2/0x24b [ 20.979953][ T74] ? show_regs_print_info+0x18/0x18 [ 20.985251][ T74] ? wg_allowedips_lookup_dst+0x190/0x190 [ 20.990951][ T74] dump_stack+0x15/0x1d [ 20.995085][ T74] ubsan_type_mismatch_common+0x1ed/0x3a0 [ 21.000799][ T74] __ubsan_handle_type_mismatch_v1+0x5b/0x70 [ 21.006756][ T74] wg_xmit+0x513/0xae0 [ 21.010806][ T74] ? wg_stop+0x140/0x140 [ 21.015023][ T74] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20 [ 21.021324][ T74] netdev_start_xmit+0x8a/0x160 [ 21.026162][ T74] dev_hard_start_xmit+0x18d/0x2f0 [ 21.031247][ T74] __dev_queue_xmit+0xfbe/0x1bb0 [ 21.036163][ T74] ? dev_queue_xmit+0x20/0x20 [ 21.041000][ T74] ? __local_bh_enable_ip+0xa8/0x170 [ 21.046275][ T74] ? do_raw_spin_unlock+0x50/0x50 [ 21.051274][ T74] ? _local_bh_enable+0x30/0x30 [ 21.056100][ T74] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 21.062337][ T74] ? ndisc_constructor+0x690/0x8a0 [ 21.067542][ T74] ? _raw_write_unlock_bh+0x31/0x47 [ 21.073499][ T74] ? dev_hard_header+0xdb/0xf0 [ 21.078403][ T74] dev_queue_xmit+0x17/0x20 [ 21.083015][ T74] neigh_connected_output+0x288/0x2b0 [ 21.088476][ T74] ip6_finish_output2+0xde2/0x1440 [ 21.093727][ T74] ? __rcu_read_lock+0x50/0x50 [ 21.098487][ T74] ? __ip6_finish_output+0x520/0x520 [ 21.103768][ T74] ? dst_cow_metrics_generic+0x55/0x1d0 [ 21.109331][ T74] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 21.115702][ T74] ? ip6_skb_dst_mtu+0xaf/0x260 [ 21.120542][ T74] __ip6_finish_output+0x3e4/0x520 [ 21.125660][ T74] ip6_finish_output+0x3f/0x220 [ 21.130519][ T74] ? ip6_output+0x1d3/0x4b0 [ 21.135023][ T74] ip6_output+0x1f8/0x4b0 [ 21.139405][ T74] ? asan.module_dtor+0x20/0x20 [ 21.144255][ T74] ? skb_dst+0x40/0x40 [ 21.148425][ T74] ? __rcu_read_lock+0x50/0x50 [ 21.153307][ T74] ? selinux_ipv6_forward+0x50/0x50 [ 21.158490][ T74] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 21.164458][ T74] ? nf_hook_slow+0x150/0x1b0 [ 21.169172][ T74] NF_HOOK+0xdd/0x280 [ 21.173392][ T74] ? addrconf_addr_solict_mult+0xe0/0xe0 [ 21.179008][ T74] ? NF_HOOK+0x280/0x280 [ 21.183250][ T74] ? __rcu_read_lock+0x50/0x50 [ 21.188003][ T74] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 21.194217][ T74] ? ndisc_send_skb+0x547/0x9f0 [ 21.199052][ T74] ? memcpy+0x56/0x70 [ 21.203006][ T74] ndisc_send_skb+0x646/0x9f0 [ 21.207656][ T74] ? slab_post_alloc_hook+0x90/0xa0 [ 21.212838][ T74] ? ndisc_fill_addr_option+0x2f0/0x2f0 [ 21.218358][ T74] ? skb_set_owner_w+0x1a8/0x310 [ 21.223275][ T74] ? __sanitizer_cov_trace_cmp4+0x19/0x20 [ 21.228987][ T74] ? skb_put+0x11d/0x200 [ 21.233202][ T74] ndisc_send_rs+0x26c/0x360 [ 21.237770][ T74] addrconf_dad_completed+0x4f3/0x9f0 [ 21.243114][ T74] ? addrconf_dad_stop+0x430/0x430 [ 21.248199][ T74] ? mutex_unlock+0x34/0x40 [ 21.252769][ T74] addrconf_dad_work+0x9c1/0x1520 [ 21.257769][ T74] ? move_linked_works+0x118/0x130 [ 21.262865][ T74] ? ipv6_use_optimistic_addr+0x1d0/0x1d0 [ 21.268580][ T74] ? __kasan_check_write+0x14/0x20 [ 21.273751][ T74] process_one_work+0x3ca/0x660 [ 21.279008][ T74] worker_thread+0x709/0xa20 [ 21.283587][ T74] ? __kthread_parkme+0x11b/0x150 [ 21.288699][ T74] kthread+0x371/0x390 [ 21.292742][ T74] ? pr_cont_work+0x110/0x110 [ 21.297487][ T74] ? __list_add+0xc0/0xc0 [ 21.301806][ T74] ret_from_fork+0x1f/0x30 [ 21.306369][ T74] ================================================================================ 2021/11/09 12:55:14 building call list... [ 21.324695][ T373] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 21.888204][ T177] device bridge_slave_1 left promiscuous mode [ 21.894451][ T177] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.902454][ T177] device bridge_slave_0 left promiscuous mode [ 21.908761][ T177] bridge0: port 1(bridge_slave_0) entered disabled state