[ 38.666076] audit: type=1800 audit(1567805948.257:32): pid=7442 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2450 res=0 Starting mcstransd: [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 39.328947] audit: type=1800 audit(1567805949.017:33): pid=7442 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2465 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.29' (ECDSA) to the list of known hosts. 2019/09/06 21:39:22 parsed 1 programs syzkaller login: [ 52.821489] kauditd_printk_skb: 2 callbacks suppressed [ 52.821503] audit: type=1400 audit(1567805962.507:36): avc: denied { map } for pid=7630 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 52.899966] audit: type=1400 audit(1567805962.587:37): avc: denied { map } for pid=7630 comm="syz-execprog" path="/sys/kernel/debug/kcov" dev="debugfs" ino=102 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 2019/09/06 21:39:24 executed programs: 0 [ 54.365557] IPVS: ftp: loaded support on port[0] = 21 [ 54.429490] chnl_net:caif_netlink_parms(): no params data found [ 54.462239] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.469287] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.476801] device bridge_slave_0 entered promiscuous mode [ 54.485308] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.492131] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.499552] device bridge_slave_1 entered promiscuous mode [ 54.516072] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 54.525253] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 54.544542] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 54.552298] team0: Port device team_slave_0 added [ 54.558205] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 54.565746] team0: Port device team_slave_1 added [ 54.571014] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 54.578528] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 54.665766] device hsr_slave_0 entered promiscuous mode [ 54.713460] device hsr_slave_1 entered promiscuous mode [ 54.753858] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 54.760948] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 54.777030] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.783571] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.790530] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.796956] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.828866] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 54.836509] 8021q: adding VLAN 0 to HW filter on device bond0 [ 54.845145] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 54.855772] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 54.875650] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.894589] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.902337] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 54.915204] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 54.921571] 8021q: adding VLAN 0 to HW filter on device team0 [ 54.931256] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 54.939111] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.945589] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.957321] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 54.965541] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.971881] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.986469] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 54.995321] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 55.005607] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 55.018784] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 55.029971] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 55.040768] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 55.047394] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 55.055998] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 55.064617] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 55.076513] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 55.087629] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 55.098062] audit: type=1400 audit(1567805964.787:38): avc: denied { associate } for pid=7647 comm="syz-executor.0" name="syz0" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1 [ 56.408482] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 [ 56.416525] PGD 8b7ae067 P4D 8b7ae067 PUD 9f41d067 PMD 0 [ 56.422227] Oops: 0010 [#1] PREEMPT SMP KASAN [ 56.426711] CPU: 1 PID: 7914 Comm: syz-executor.0 Not tainted 4.19.70 #0 [ 56.433544] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 56.442903] RIP: 0010: (null) [ 56.446959] Code: Bad RIP value. [ 56.450392] RSP: 0018:ffff888080d3f4d8 EFLAGS: 00010246 [ 56.455754] RAX: dffffc0000000000 RBX: ffffffff87e1f620 RCX: ffffffff857e5ec4 [ 56.463130] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8880861660c0 [ 56.470458] RBP: ffff888080d3f5d0 R08: ffff88809732c180 R09: ffff888080d3f658 [ 56.477731] R10: ffffed10101a7ed9 R11: ffff888080d3f6cf R12: ffff888080d3f5a8 [ 56.485084] R13: ffff8880861660c0 R14: 0000000000000001 R15: ffffffff87e1f620 [ 56.492359] FS: 00007f56f799f700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 [ 56.500576] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 56.506596] CR2: ffffffffffffffd6 CR3: 0000000090bd2000 CR4: 00000000001406e0 [ 56.513937] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 56.521214] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 56.528916] Call Trace: [ 56.531594] tc_bind_tclass+0x13c/0x490 [ 56.535582] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 56.541116] ? __qdisc_calculate_pkt_len+0x2e0/0x2e0 [ 56.546212] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 56.551309] ? validate_nla+0x32f/0x810 [ 56.555296] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 56.560307] ? qdisc_match_from_root+0x18a/0x280 [ 56.565069] tc_ctl_tclass+0xaa9/0xc60 [ 56.568967] ? qdisc_tree_reduce_backlog+0x570/0x570 [ 56.574191] ? find_held_lock+0x35/0x130 [ 56.578367] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 56.585586] ? qdisc_tree_reduce_backlog+0x570/0x570 [ 56.590714] rtnetlink_rcv_msg+0x463/0xb00 [ 56.594987] ? rtnetlink_put_metrics+0x560/0x560 [ 56.599774] ? netdev_pick_tx+0x300/0x300 [ 56.604293] ? netlink_deliver_tap+0x22d/0xc20 [ 56.608896] ? find_held_lock+0x35/0x130 [ 56.612993] netlink_rcv_skb+0x17d/0x460 [ 56.617051] ? rtnetlink_put_metrics+0x560/0x560 [ 56.621804] ? netlink_ack+0xb30/0xb30 [ 56.625709] ? kasan_check_read+0x11/0x20 [ 56.629875] ? netlink_deliver_tap+0x254/0xc20 [ 56.634469] rtnetlink_rcv+0x1d/0x30 [ 56.638177] netlink_unicast+0x537/0x720 [ 56.642227] ? netlink_attachskb+0x770/0x770 [ 56.646626] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 56.652155] netlink_sendmsg+0x8ae/0xd70 [ 56.656408] ? netlink_unicast+0x720/0x720 [ 56.660636] ? selinux_socket_sendmsg+0x36/0x40 [ 56.665312] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 56.670934] ? security_socket_sendmsg+0x8d/0xc0 [ 56.675695] ? netlink_unicast+0x720/0x720 [ 56.679934] sock_sendmsg+0xd7/0x130 [ 56.683986] ___sys_sendmsg+0x803/0x920 [ 56.687967] ? copy_msghdr_from_user+0x430/0x430 [ 56.692713] ? lock_downgrade+0x810/0x810 [ 56.696851] ? kasan_check_read+0x11/0x20 [ 56.700987] ? __fget+0x367/0x540 [ 56.704429] ? iterate_fd+0x360/0x360 [ 56.708229] ? lock_downgrade+0x810/0x810 [ 56.712366] ? __fget_light+0x1a9/0x230 [ 56.716330] ? __fdget+0x1b/0x20 [ 56.719686] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 56.725326] __sys_sendmsg+0x105/0x1d0 [ 56.729821] ? __ia32_sys_shutdown+0x80/0x80 [ 56.734248] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 56.739006] ? do_syscall_64+0x26/0x620 [ 56.742993] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 56.748378] ? do_syscall_64+0x26/0x620 [ 56.752365] __x64_sys_sendmsg+0x78/0xb0 [ 56.756445] do_syscall_64+0xfd/0x620 [ 56.760254] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 56.765446] RIP: 0033:0x459879 [ 56.768627] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 56.787529] RSP: 002b:00007f56f799ec78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 56.795243] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459879 [ 56.802501] RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003 [ 56.809847] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 56.817117] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f56f799f6d4 [ 56.824374] R13: 00000000004c77c2 R14: 00000000004dd018 R15: 00000000ffffffff [ 56.831635] Modules linked in: [ 56.834817] CR2: 0000000000000000 [ 56.840147] ---[ end trace 555930ebde0b0f8d ]--- [ 56.845930] RIP: 0010: (null) [ 56.850006] Code: Bad RIP value. [ 56.853729] RSP: 0018:ffff888080d3f4d8 EFLAGS: 00010246 [ 56.859248] RAX: dffffc0000000000 RBX: ffffffff87e1f620 RCX: ffffffff857e5ec4 [ 56.866582] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8880861660c0 [ 56.873895] RBP: ffff888080d3f5d0 R08: ffff88809732c180 R09: ffff888080d3f658 [ 56.881182] R10: ffffed10101a7ed9 R11: ffff888080d3f6cf R12: ffff888080d3f5a8 [ 56.888582] R13: ffff8880861660c0 R14: 0000000000000001 R15: ffffffff87e1f620 [ 56.895930] FS: 00007f56f799f700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 [ 56.904192] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 56.910094] CR2: ffffffffffffffd6 CR3: 0000000090bd2000 CR4: 00000000001406f0 [ 56.917412] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 56.924725] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 56.931998] Kernel panic - not syncing: Fatal exception [ 56.939121] Kernel Offset: disabled [ 56.942755] Rebooting in 86400 seconds..