Warning: Permanently added '10.128.0.146' (ECDSA) to the list of known hosts. 2020/07/18 20:44:36 parsed 1 programs 2020/07/18 20:44:36 executed programs: 0 [ 1042.538213][ T22] audit: type=1400 audit(1595105076.986:8): avc: denied { execmem } for pid=360 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 1042.552334][ T364] cgroup1: Unknown subsys name 'perf_event' [ 1042.564873][ T366] cgroup1: Unknown subsys name 'perf_event' [ 1042.566100][ T367] cgroup1: Unknown subsys name 'perf_event' [ 1042.574053][ T366] cgroup1: Unknown subsys name 'net_cls' [ 1042.579454][ T364] cgroup1: Unknown subsys name 'net_cls' [ 1042.588967][ T367] cgroup1: Unknown subsys name 'net_cls' [ 1042.589272][ T370] cgroup1: Unknown subsys name 'perf_event' [ 1042.599361][ T373] cgroup1: Unknown subsys name 'perf_event' [ 1042.602723][ T372] cgroup1: Unknown subsys name 'perf_event' [ 1042.607916][ T373] cgroup1: Unknown subsys name 'net_cls' [ 1042.613018][ T372] cgroup1: Unknown subsys name 'net_cls' [ 1042.624316][ T370] cgroup1: Unknown subsys name 'net_cls' 2020/07/18 20:44:42 executed programs: 40 2020/07/18 20:44:47 executed programs: 166 2020/07/18 20:44:52 executed programs: 295 2020/07/18 20:44:57 executed programs: 421 2020/07/18 20:45:02 executed programs: 551 2020/07/18 20:45:07 executed programs: 681 2020/07/18 20:45:12 executed programs: 812 [ 1080.411673][ C0] ================================================================== [ 1080.419779][ C0] BUG: KASAN: use-after-free in __run_timers+0x55e/0x7b0 [ 1080.426774][ C0] Write of size 8 at addr ffff8881c4b2f188 by task systemd-udevd/6641 [ 1080.435073][ C0] [ 1080.437376][ C0] CPU: 0 PID: 6641 Comm: systemd-udevd Not tainted 5.4.52-syzkaller-00272-g0c0d417747d8 #0 [ 1080.447314][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1080.457467][ C0] Call Trace: [ 1080.460723][ C0] [ 1080.463551][ C0] dump_stack+0x14a/0x1ce [ 1080.467851][ C0] ? show_regs_print_info+0x12/0x12 [ 1080.473046][ C0] ? printk+0xd2/0x114 [ 1080.477089][ C0] print_address_description+0x93/0x620 [ 1080.482603][ C0] ? load_balance+0x4330/0x4330 [ 1080.487671][ C0] __kasan_report+0x16d/0x1e0 [ 1080.492317][ C0] ? __run_timers+0x55e/0x7b0 [ 1080.496962][ C0] kasan_report+0x36/0x60 [ 1080.501260][ C0] __run_timers+0x55e/0x7b0 [ 1080.505740][ C0] ? enqueue_hrtimer+0x1cf/0x230 [ 1080.510647][ C0] ? detach_timer+0x260/0x260 [ 1080.515305][ C0] ? __run_hrtimer+0x601/0x7a0 [ 1080.520049][ C0] ? clockevents_program_event+0x214/0x2d0 [ 1080.525956][ C0] ? hrtimer_interrupt+0xe75/0x10a0 [ 1080.531148][ C0] run_timer_softirq+0x19/0x30 [ 1080.535898][ C0] __do_softirq+0x2d5/0x725 [ 1080.540441][ C0] ? __irqentry_text_end+0x1fc47b/0x1fc47b [ 1080.546234][ C0] ? hrtimer_init+0x340/0x340 [ 1080.550884][ C0] ? kvm_sched_clock_read+0x15/0x40 [ 1080.556052][ C0] irq_exit+0x16d/0x180 [ 1080.560181][ C0] smp_apic_timer_interrupt+0x281/0x3f0 [ 1080.565698][ C0] apic_timer_interrupt+0xf/0x20 [ 1080.570607][ C0] [ 1080.573520][ C0] RIP: 0010:__sanitizer_cov_trace_pc+0x4/0x50 [ 1080.579555][ C0] Code: 00 0f 0b 0f 1f 00 53 48 89 fb e8 17 00 00 00 48 8b 3d 18 12 97 03 48 89 de 5b e9 57 81 2d 00 90 90 90 90 90 90 90 48 8b 04 24 <65> 48 8b 0c 25 00 ed 01 00 65 8b 15 88 ed bf 7e f7 c2 00 01 1f 00 [ 1080.599131][ C0] RSP: 0018:ffff8881ccde79b8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 [ 1080.607512][ C0] RAX: ffffffff8167f0b9 RBX: 0000000000000000 RCX: ffff8881c8815d00 [ 1080.615455][ C0] RDX: ffff8881c8815d00 RSI: 0000000000000000 RDI: 0000000000000000 [ 1080.623397][ C0] RBP: ffff8881ccde7b50 R08: ffffffff8167f0aa R09: fffff94000edcfa1 [ 1080.631341][ C0] R10: fffff94000edcfa1 R11: 0000000000000000 R12: 1ffffd4000edcfa1 [ 1080.639283][ C0] R13: ffffea00076e7d00 R14: ffffea00076e7d08 R15: dffffc0000000000 [ 1080.647233][ C0] ? unmap_page_range+0xbda/0x16e0 [ 1080.652313][ C0] ? unmap_page_range+0xbe9/0x16e0 [ 1080.657397][ C0] unmap_page_range+0xbe9/0x16e0 [ 1080.663003][ C0] ? copy_page_range+0x1710/0x1710 [ 1080.668087][ C0] unmap_vmas+0x1b5/0x230 [ 1080.672487][ C0] exit_mmap+0x28a/0x500 [ 1080.676699][ C0] ? vm_brk+0x240/0x240 [ 1080.680827][ C0] ? mutex_unlock+0x19/0x40 [ 1080.685299][ C0] ? uprobe_clear_state+0x291/0x2f0 [ 1080.690479][ C0] __mmput+0x34/0x240 [ 1080.694438][ C0] do_exit+0xa6c/0x2700 [ 1080.698574][ C0] ? mm_update_next_owner+0x600/0x600 [ 1080.703922][ C0] ? syscall_trace_enter+0x68d/0xa60 [ 1080.709293][ C0] ? do_syscall_64+0x150/0x150 [ 1080.714029][ C0] do_group_exit+0x155/0x2b0 [ 1080.718591][ C0] __do_sys_exit_group+0x13/0x20 [ 1080.723501][ C0] __se_sys_exit_group+0x10/0x10 [ 1080.728411][ C0] __x64_sys_exit_group+0x37/0x40 [ 1080.733404][ C0] do_syscall_64+0xcb/0x150 [ 1080.737882][ C0] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1080.743745][ C0] RIP: 0033:0x7f4bfb228618 [ 1080.748262][ C0] Code: 00 00 be 3c 00 00 00 eb 19 66 0f 1f 84 00 00 00 00 00 48 89 d7 89 f0 0f 05 48 3d 00 f0 ff ff 77 21 f4 48 89 d7 44 89 c0 0f 05 <48> 3d 00 f0 ff ff 76 e0 f7 d8 64 41 89 01 eb d8 0f 1f 84 00 00 00 [ 1080.767842][ C0] RSP: 002b:00007ffe9c62c438 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 1080.776228][ C0] RAX: ffffffffffffffda RBX: 00007ffe9c62c500 RCX: 00007f4bfb228618 [ 1080.784172][ C0] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 1080.792235][ C0] RBP: 00007ffe9c62c5b0 R08: 00000000000000e7 R09: fffffffffffffe50 [ 1080.800188][ C0] R10: 00000000ffffffff R11: 0000000000000206 R12: 0000000000000000 [ 1080.808130][ C0] R13: 0000000000000000 R14: 0000000000000003 R15: 000000000000000e [ 1080.816073][ C0] [ 1080.818371][ C0] The buggy address belongs to the page: [ 1080.824093][ C0] page:ffffea000712cbc0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 [ 1080.833162][ C0] flags: 0x8000000000000000() [ 1080.837817][ C0] raw: 8000000000000000 0000000000000000 dead000000000122 0000000000000000 [ 1080.846383][ C0] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 1080.854948][ C0] page dumped because: kasan: bad access detected [ 1080.861326][ C0] [ 1080.863634][ C0] Memory state around the buggy address: [ 1080.869241][ C0] ffff8881c4b2f080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1080.877354][ C0] ffff8881c4b2f100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1080.885390][ C0] >ffff8881c4b2f180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1080.893510][ C0] ^ [ 1080.897813][ C0] ffff8881c4b2f200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1080.905845][ C0] ffff8881c4b2f280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1080.913879][ C0] ================================================================== [ 1080.921940][ C0] Disabling lock debugging due to kernel taint [ 1080.928067][ C0] kasan: CONFIG_KASAN_INLINE enabled [ 1080.933318][ C0] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 1080.941378][ C0] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 1080.948579][ C0] CPU: 0 PID: 6641 Comm: systemd-udevd Tainted: G B 5.4.52-syzkaller-00272-g0c0d417747d8 #0 [ 1080.959913][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1080.971281][ C0] RIP: 0010:expire_timers+0x284/0x470 [ 1080.976634][ C0] Code: 89 e7 e8 df 31 3d 00 4d 89 3c 24 4d 85 ff 74 36 e8 41 02 0f 00 49 83 c7 08 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 ae 31 3d 00 4d 89 27 eb 0e 66 0f 1f [ 1080.996323][ C0] RSP: 0018:ffff8881db809c50 EFLAGS: 00010802 [ 1081.002366][ C0] RAX: 1bd5a00000000025 RBX: ffff8881db823708 RCX: dffffc0000000000 [ 1081.010321][ C0] RDX: 0000000080000102 RSI: 0000000000000008 RDI: ffff8881c4b2f188 [ 1081.018274][ C0] RBP: 1ffff11038965e31 R08: ffffffff8132fb29 R09: fffffbfff0ac35e9 [ 1081.026230][ C0] R10: fffffbfff0ac35e9 R11: 0000000000000000 R12: ffff8881db809d80 [ 1081.034173][ C0] R13: ffff8881c4b2f180 R14: ffff8881c4b2f188 R15: dead00000000012a [ 1081.042116][ C0] FS: 0000000000000000(0000) GS:ffff8881db800000(0000) knlGS:0000000000000000 [ 1081.051016][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1081.057756][ C0] CR2: 0000564062555398 CR3: 00000001c8bff003 CR4: 00000000001606f0 [ 1081.065708][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1081.073657][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1081.081609][ C0] Call Trace: [ 1081.084904][ C0] [ 1081.087731][ C0] __run_timers+0x662/0x7b0 [ 1081.092206][ C0] ? enqueue_hrtimer+0x1cf/0x230 [ 1081.097111][ C0] ? detach_timer+0x260/0x260 [ 1081.101774][ C0] ? __run_hrtimer+0x601/0x7a0 [ 1081.106511][ C0] ? clockevents_program_event+0x214/0x2d0 [ 1081.112288][ C0] ? hrtimer_interrupt+0xe75/0x10a0 [ 1081.117456][ C0] run_timer_softirq+0x19/0x30 [ 1081.122225][ C0] __do_softirq+0x2d5/0x725 [ 1081.126712][ C0] ? __irqentry_text_end+0x1fc47b/0x1fc47b [ 1081.132485][ C0] ? hrtimer_init+0x340/0x340 [ 1081.137131][ C0] ? kvm_sched_clock_read+0x15/0x40 [ 1081.142306][ C0] irq_exit+0x16d/0x180 [ 1081.146434][ C0] smp_apic_timer_interrupt+0x281/0x3f0 [ 1081.151961][ C0] apic_timer_interrupt+0xf/0x20 [ 1081.156962][ C0] [ 1081.159885][ C0] RIP: 0010:__sanitizer_cov_trace_pc+0x4/0x50 [ 1081.165943][ C0] Code: 00 0f 0b 0f 1f 00 53 48 89 fb e8 17 00 00 00 48 8b 3d 18 12 97 03 48 89 de 5b e9 57 81 2d 00 90 90 90 90 90 90 90 48 8b 04 24 <65> 48 8b 0c 25 00 ed 01 00 65 8b 15 88 ed bf 7e f7 c2 00 01 1f 00 [ 1081.186310][ C0] RSP: 0018:ffff8881ccde79b8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 [ 1081.194691][ C0] RAX: ffffffff8167f0b9 RBX: 0000000000000000 RCX: ffff8881c8815d00 [ 1081.202741][ C0] RDX: ffff8881c8815d00 RSI: 0000000000000000 RDI: 0000000000000000 [ 1081.210693][ C0] RBP: ffff8881ccde7b50 R08: ffffffff8167f0aa R09: fffff94000edcfa1 [ 1081.218688][ C0] R10: fffff94000edcfa1 R11: 0000000000000000 R12: 1ffffd4000edcfa1 [ 1081.226632][ C0] R13: ffffea00076e7d00 R14: ffffea00076e7d08 R15: dffffc0000000000 [ 1081.234588][ C0] ? unmap_page_range+0xbda/0x16e0 [ 1081.239671][ C0] ? unmap_page_range+0xbe9/0x16e0 [ 1081.244764][ C0] unmap_page_range+0xbe9/0x16e0 [ 1081.249684][ C0] ? copy_page_range+0x1710/0x1710 [ 1081.254769][ C0] unmap_vmas+0x1b5/0x230 [ 1081.259066][ C0] exit_mmap+0x28a/0x500 [ 1081.263279][ C0] ? vm_brk+0x240/0x240 [ 1081.267406][ C0] ? mutex_unlock+0x19/0x40 [ 1081.271880][ C0] ? uprobe_clear_state+0x291/0x2f0 [ 1081.277047][ C0] __mmput+0x34/0x240 [ 1081.280999][ C0] do_exit+0xa6c/0x2700 [ 1081.285125][ C0] ? mm_update_next_owner+0x600/0x600 [ 1081.290466][ C0] ? syscall_trace_enter+0x68d/0xa60 [ 1081.295721][ C0] ? do_syscall_64+0x150/0x150 [ 1081.300565][ C0] do_group_exit+0x155/0x2b0 [ 1081.305124][ C0] __do_sys_exit_group+0x13/0x20 [ 1081.310031][ C0] __se_sys_exit_group+0x10/0x10 [ 1081.314940][ C0] __x64_sys_exit_group+0x37/0x40 [ 1081.319936][ C0] do_syscall_64+0xcb/0x150 [ 1081.324427][ C0] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1081.330290][ C0] RIP: 0033:0x7f4bfb228618 [ 1081.334679][ C0] Code: 00 00 be 3c 00 00 00 eb 19 66 0f 1f 84 00 00 00 00 00 48 89 d7 89 f0 0f 05 48 3d 00 f0 ff ff 77 21 f4 48 89 d7 44 89 c0 0f 05 <48> 3d 00 f0 ff ff 76 e0 f7 d8 64 41 89 01 eb d8 0f 1f 84 00 00 00 [ 1081.354307][ C0] RSP: 002b:00007ffe9c62c438 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 1081.362811][ C0] RAX: ffffffffffffffda RBX: 00007ffe9c62c500 RCX: 00007f4bfb228618 [ 1081.370849][ C0] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 1081.378793][ C0] RBP: 00007ffe9c62c5b0 R08: 00000000000000e7 R09: fffffffffffffe50 [ 1081.387011][ C0] R10: 00000000ffffffff R11: 0000000000000206 R12: 0000000000000000 [ 1081.394959][ C0] R13: 0000000000000000 R14: 0000000000000003 R15: 000000000000000e [ 1081.402901][ C0] Modules linked in: [ 1081.406785][ C0] ---[ end trace ee8c0415b0019a73 ]--- [ 1081.412231][ C0] RIP: 0010:expire_timers+0x284/0x470 [ 1081.417583][ C0] Code: 89 e7 e8 df 31 3d 00 4d 89 3c 24 4d 85 ff 74 36 e8 41 02 0f 00 49 83 c7 08 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 ae 31 3d 00 4d 89 27 eb 0e 66 0f 1f [ 1081.437167][ C0] RSP: 0018:ffff8881db809c50 EFLAGS: 00010802 [ 1081.443257][ C0] RAX: 1bd5a00000000025 RBX: ffff8881db823708 RCX: dffffc0000000000 [ 1081.451902][ C0] RDX: 0000000080000102 RSI: 0000000000000008 RDI: ffff8881c4b2f188 [ 1081.459844][ C0] RBP: 1ffff11038965e31 R08: ffffffff8132fb29 R09: fffffbfff0ac35e9 [ 1081.467786][ C0] R10: fffffbfff0ac35e9 R11: 0000000000000000 R12: ffff8881db809d80 [ 1081.475729][ C0] R13: ffff8881c4b2f180 R14: ffff8881c4b2f188 R15: dead00000000012a [ 1081.483673][ C0] FS: 0000000000000000(0000) GS:ffff8881db800000(0000) knlGS:0000000000000000 [ 1081.493152][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1081.499836][ C0] CR2: 0000564062555398 CR3: 00000001c8bff003 CR4: 00000000001606f0 [ 1081.507787][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1081.515807][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1081.523907][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 1081.531944][ C0] Kernel Offset: disabled [ 1081.536254][ C0] Rebooting in 86400 seconds..