syzkaller login: [ 6.961717][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #82!!! [ 13.522485][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #10!!! [ 14.793483][ T23] audit: type=1400 audit(1636817732.750:71): avc: denied { transition } for pid=290 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.818228][ T23] audit: type=1400 audit(1636817732.770:72): avc: denied { write } for pid=290 comm="sh" path="pipe:[1404]" dev="pipefs" ino=1404 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1 [ 15.201605][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #88!!! [ 15.691537][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!! [ 16.051575][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!! [ 16.191538][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!! [ 16.511708][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!! [ 17.191601][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!! [ 18.981590][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #280!!! Warning: Permanently added '10.128.1.133' (ECDSA) to the list of known hosts. 2021/11/13 15:35:39 fuzzer started 2021/11/13 15:35:40 connecting to host at 10.128.0.163:45967 2021/11/13 15:35:40 checking machine... 2021/11/13 15:35:40 checking revisions... 2021/11/13 15:35:40 testing simple program... [ 22.104722][ T23] audit: type=1400 audit(1636817740.060:73): avc: denied { getattr } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 22.121078][ T370] cgroup: Unknown subsys name 'net' [ 22.129327][ T23] audit: type=1400 audit(1636817740.060:74): avc: denied { read } for pid=362 comm="syz-fuzzer" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 22.156392][ T23] audit: type=1400 audit(1636817740.060:75): avc: denied { open } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 22.156625][ T370] cgroup: Unknown subsys name 'devices' [ 22.181117][ T23] audit: type=1400 audit(1636817740.060:76): avc: denied { read } for pid=362 comm="syz-fuzzer" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.210592][ T23] audit: type=1400 audit(1636817740.060:77): avc: denied { open } for pid=362 comm="syz-fuzzer" path="/dev/raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.235227][ T23] audit: type=1400 audit(1636817740.060:78): avc: denied { mounton } for pid=370 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1136 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.258953][ T23] audit: type=1400 audit(1636817740.060:79): avc: denied { mount } for pid=370 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.281614][ T23] audit: type=1400 audit(1636817740.090:80): avc: denied { unmount } for pid=370 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.363449][ T370] cgroup: Unknown subsys name 'hugetlb' [ 22.369287][ T370] cgroup: Unknown subsys name 'rlimit' [ 22.472739][ T23] audit: type=1400 audit(1636817740.430:81): avc: denied { setattr } for pid=370 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.508557][ T23] audit: type=1400 audit(1636817740.460:82): avc: denied { execmem } for pid=373 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 22.587609][ T374] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.594888][ T374] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.602574][ T374] device bridge_slave_0 entered promiscuous mode [ 22.609515][ T374] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.617068][ T374] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.624652][ T374] device bridge_slave_1 entered promiscuous mode [ 22.655956][ T374] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.664027][ T374] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.671447][ T374] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.678548][ T374] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.697464][ T24] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.704895][ T24] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.712879][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 22.720356][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.729438][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.738014][ T74] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.745126][ T74] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.762880][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.771012][ T74] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.778190][ T74] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.786122][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.794356][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.812046][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.820854][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.829199][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.837971][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.850594][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.859411][ T24] ================================================================================ [ 22.870924][ T24] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:2023:28 [ 22.878936][ T24] member access within address ffffc9000019f1c0 with insufficient space [ 22.887432][ T24] for an object of type 'struct sk_buff' [ 22.893359][ T24] CPU: 1 PID: 24 Comm: kworker/1:1 Not tainted 5.10.79-syzkaller-01201-g87acf4924e1b #0 [ 22.903506][ T24] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 22.913681][ T24] Workqueue: ipv6_addrconf addrconf_dad_work [ 22.920346][ T24] Call Trace: [ 22.923627][ T24] dump_stack_lvl+0x1e2/0x24b [ 22.928372][ T24] ? show_regs_print_info+0x18/0x18 [ 22.933682][ T24] ? wg_allowedips_lookup_dst+0x190/0x190 [ 22.939403][ T24] dump_stack+0x15/0x1d [ 22.943637][ T24] ubsan_type_mismatch_common+0x1ed/0x3a0 [ 22.949852][ T24] ? __sanitizer_cov_trace_switch+0x74/0x90 [ 22.956267][ T24] __ubsan_handle_type_mismatch_v1+0x5b/0x70 [ 22.962244][ T24] wg_xmit+0x4a2/0xae0 [ 22.966374][ T24] ? wg_stop+0x140/0x140 [ 22.970971][ T24] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20 [ 22.977407][ T24] netdev_start_xmit+0x8a/0x160 [ 22.982506][ T24] dev_hard_start_xmit+0x18d/0x2f0 [ 22.987697][ T24] __dev_queue_xmit+0xfbe/0x1bb0 [ 22.992616][ T24] ? dev_queue_xmit+0x20/0x20 [ 22.997278][ T24] ? __local_bh_enable_ip+0xa8/0x170 [ 23.002628][ T24] ? do_raw_spin_unlock+0x50/0x50 [ 23.007626][ T24] ? _local_bh_enable+0x30/0x30 [ 23.012709][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 23.019027][ T24] ? ndisc_constructor+0x690/0x8a0 [ 23.024127][ T24] ? _raw_write_unlock_bh+0x31/0x47 [ 23.029479][ T24] ? dev_hard_header+0xdb/0xf0 [ 23.034236][ T24] dev_queue_xmit+0x17/0x20 [ 23.038720][ T24] neigh_connected_output+0x288/0x2b0 [ 23.044201][ T24] ip6_finish_output2+0xde2/0x1440 [ 23.049729][ T24] ? __rcu_read_lock+0x50/0x50 [ 23.055198][ T24] ? __ip6_finish_output+0x520/0x520 [ 23.060872][ T24] ? dst_cow_metrics_generic+0x55/0x1d0 [ 23.066762][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 23.073329][ T24] ? ip6_skb_dst_mtu+0xaf/0x260 [ 23.078627][ T24] __ip6_finish_output+0x3e4/0x520 [ 23.083844][ T24] ip6_finish_output+0x3f/0x220 [ 23.088789][ T24] ? ip6_output+0x1d3/0x4b0 [ 23.093279][ T24] ip6_output+0x1f8/0x4b0 [ 23.097593][ T24] ? asan.module_dtor+0x20/0x20 [ 23.102443][ T24] ? skb_dst+0x40/0x40 [ 23.106599][ T24] ? __rcu_read_lock+0x50/0x50 [ 23.111545][ T24] ? selinux_ipv6_forward+0x50/0x50 [ 23.116734][ T24] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 23.122443][ T24] ? nf_hook_slow+0x150/0x1b0 [ 23.127165][ T24] NF_HOOK+0xdd/0x280 [ 23.131228][ T24] ? addrconf_addr_solict_mult+0xe0/0xe0 [ 23.136875][ T24] ? NF_HOOK+0x280/0x280 [ 23.141219][ T24] ? __rcu_read_lock+0x50/0x50 [ 23.146212][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 23.152703][ T24] ? ndisc_send_skb+0x547/0x9f0 [ 23.157697][ T24] ? memcpy+0x56/0x70 [ 23.162003][ T24] ndisc_send_skb+0x646/0x9f0 [ 23.167033][ T24] ? slab_post_alloc_hook+0x90/0xa0 [ 23.172542][ T24] ? ndisc_fill_addr_option+0x2f0/0x2f0 [ 23.178175][ T24] ? skb_set_owner_w+0x1a8/0x310 [ 23.183108][ T24] ? __sanitizer_cov_trace_cmp4+0x19/0x20 [ 23.188832][ T24] ? skb_put+0x11d/0x200 [ 23.193164][ T24] ndisc_send_rs+0x26c/0x360 [ 23.197759][ T24] addrconf_dad_completed+0x4f3/0x9f0 [ 23.203264][ T24] ? addrconf_dad_stop+0x430/0x430 [ 23.208489][ T24] ? mutex_unlock+0x34/0x40 [ 23.213560][ T24] addrconf_dad_work+0x9c1/0x1520 [ 23.218678][ T24] ? __kasan_check_write+0x14/0x20 [ 23.224176][ T24] ? ipv6_use_optimistic_addr+0x1d0/0x1d0 [ 23.229886][ T24] ? __kasan_check_write+0x14/0x20 [ 23.235067][ T24] process_one_work+0x3ca/0x660 [ 23.239914][ T24] worker_thread+0x709/0xa20 [ 23.244612][ T24] ? __kthread_parkme+0x11b/0x150 [ 23.250048][ T24] kthread+0x371/0x390 [ 23.254116][ T24] ? pr_cont_work+0x110/0x110 [ 23.258807][ T24] ? __list_add+0xc0/0xc0 [ 23.263667][ T24] ret_from_fork+0x1f/0x30 [ 23.268429][ T24] ================================================================================ [ 23.277742][ T24] ================================================================================ [ 23.287310][ T24] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:1916:2 [ 23.295133][ T24] member access within address ffffc9000019f1c0 with insufficient space [ 23.303643][ T24] for an object of type 'struct sk_buff' [ 23.309272][ T24] CPU: 1 PID: 24 Comm: kworker/1:1 Not tainted 5.10.79-syzkaller-01201-g87acf4924e1b #0 [ 23.319227][ T24] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 23.329636][ T24] Workqueue: ipv6_addrconf addrconf_dad_work [ 23.335896][ T24] Call Trace: [ 23.339818][ T24] dump_stack_lvl+0x1e2/0x24b [ 23.344498][ T24] ? show_regs_print_info+0x18/0x18 [ 23.349688][ T24] ? wg_allowedips_lookup_dst+0x190/0x190 [ 23.355578][ T24] dump_stack+0x15/0x1d [ 23.359889][ T24] ubsan_type_mismatch_common+0x1ed/0x3a0 [ 23.365679][ T24] __ubsan_handle_type_mismatch_v1+0x5b/0x70 [ 23.371651][ T24] wg_xmit+0x513/0xae0 [ 23.375807][ T24] ? wg_stop+0x140/0x140 [ 23.380057][ T24] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20 [ 23.386310][ T24] netdev_start_xmit+0x8a/0x160 [ 23.391157][ T24] dev_hard_start_xmit+0x18d/0x2f0 [ 23.396263][ T24] __dev_queue_xmit+0xfbe/0x1bb0 [ 23.401275][ T24] ? dev_queue_xmit+0x20/0x20 [ 23.406112][ T24] ? __local_bh_enable_ip+0xa8/0x170 [ 23.411646][ T24] ? do_raw_spin_unlock+0x50/0x50 [ 23.416653][ T24] ? _local_bh_enable+0x30/0x30 [ 23.421566][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 23.427797][ T24] ? ndisc_constructor+0x690/0x8a0 [ 23.433103][ T24] ? _raw_write_unlock_bh+0x31/0x47 [ 23.438333][ T24] ? dev_hard_header+0xdb/0xf0 [ 23.443102][ T24] dev_queue_xmit+0x17/0x20 [ 23.447588][ T24] neigh_connected_output+0x288/0x2b0 [ 23.453058][ T24] ip6_finish_output2+0xde2/0x1440 [ 23.458224][ T24] ? __rcu_read_lock+0x50/0x50 [ 23.463214][ T24] ? __ip6_finish_output+0x520/0x520 [ 23.468584][ T24] ? dst_cow_metrics_generic+0x55/0x1d0 [ 23.474203][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 23.480606][ T24] ? ip6_skb_dst_mtu+0xaf/0x260 [ 23.485440][ T24] __ip6_finish_output+0x3e4/0x520 [ 23.490529][ T24] ip6_finish_output+0x3f/0x220 [ 23.495366][ T24] ? ip6_output+0x1d3/0x4b0 [ 23.499937][ T24] ip6_output+0x1f8/0x4b0 [ 23.504259][ T24] ? asan.module_dtor+0x20/0x20 [ 23.509096][ T24] ? skb_dst+0x40/0x40 [ 23.513236][ T24] ? __rcu_read_lock+0x50/0x50 [ 23.518119][ T24] ? selinux_ipv6_forward+0x50/0x50 [ 23.523555][ T24] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 23.529357][ T24] ? nf_hook_slow+0x150/0x1b0 [ 23.534200][ T24] NF_HOOK+0xdd/0x280 [ 23.538175][ T24] ? addrconf_addr_solict_mult+0xe0/0xe0 [ 23.543970][ T24] ? NF_HOOK+0x280/0x280 [ 23.548204][ T24] ? __rcu_read_lock+0x50/0x50 [ 23.553616][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 23.560140][ T24] ? ndisc_send_skb+0x547/0x9f0 [ 23.564986][ T24] ? memcpy+0x56/0x70 [ 23.569076][ T24] ndisc_send_skb+0x646/0x9f0 [ 23.574098][ T24] ? slab_post_alloc_hook+0x90/0xa0 [ 23.579304][ T24] ? ndisc_fill_addr_option+0x2f0/0x2f0 [ 23.584930][ T24] ? skb_set_owner_w+0x1a8/0x310 [ 23.590156][ T24] ? __sanitizer_cov_trace_cmp4+0x19/0x20 [ 23.596051][ T24] ? skb_put+0x11d/0x200 [ 23.600364][ T24] ndisc_send_rs+0x26c/0x360 [ 23.605085][ T24] addrconf_dad_completed+0x4f3/0x9f0 [ 23.610647][ T24] ? addrconf_dad_stop+0x430/0x430 [ 23.615757][ T24] ? mutex_unlock+0x34/0x40 [ 23.620281][ T24] addrconf_dad_work+0x9c1/0x1520 [ 23.625805][ T24] ? __kasan_check_write+0x14/0x20 [ 23.631146][ T24] ? ipv6_use_optimistic_addr+0x1d0/0x1d0 [ 23.636852][ T24] ? __kasan_check_write+0x14/0x20 [ 23.642280][ T24] process_one_work+0x3ca/0x660 [ 23.647654][ T24] worker_thread+0x709/0xa20 [ 23.652492][ T24] ? __kthread_parkme+0x11b/0x150 [ 23.657834][ T24] kthread+0x371/0x390 2021/11/13 15:35:41 building call list... [ 23.662013][ T24] ? pr_cont_work+0x110/0x110 [ 23.667435][ T24] ? __list_add+0xc0/0xc0 [ 23.672091][ T24] ret_from_fork+0x1f/0x30 [ 23.676734][ T24] ================================================================================ [ 23.695678][ T374] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 24.331726][ T177] device bridge_slave_1 left promiscuous mode [ 24.339059][ T177] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.347455][ T177] device bridge_slave_0 left promiscuous mode [ 24.354260][ T177] bridge0: port 1(bridge_slave_0) entered disabled state