[....] Starting enhanced syslogd: rsyslogd[ 12.866887] audit: type=1400 audit(1515780374.613:5): avc: denied { syslog } for pid=3345 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 18.722085] audit: type=1400 audit(1515780380.468:6): avc: denied { map } for pid=3484 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.15.236' (ECDSA) to the list of known hosts. 2018/01/12 18:06:28 fuzzer started [ 26.395516] audit: type=1400 audit(1515780388.142:7): avc: denied { map } for pid=3495 comm="syz-fuzzer" path="/root/syz-fuzzer" dev="sda1" ino=16479 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2018/01/12 18:06:28 dialing manager at 10.128.0.26:35227 2018/01/12 18:06:32 kcov=true, comps=true [ 30.306350] audit: type=1400 audit(1515780392.053:8): avc: denied { map } for pid=3495 comm="syz-fuzzer" path="/sys/kernel/debug/kcov" dev="debugfs" ino=8848 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 2018/01/12 18:06:34 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000ebc000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000090a000)={0x54, 0x0, &(0x7f00009d5000)=[@transaction_sg={0x40486311, {{0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x28, 0x0, &(0x7f0000a0a000-0x50)=[@ptr={0x70742a85, 0x0, &(0x7f00009f6000)=0x0, 0x1, 0x0, 0x0}], &(0x7f0000711000)=[]}, 0x80000001}}, @release={0x40046306, 0x0}], 0x0, 0x0, &(0x7f0000f98000-0x22)=""}) 2018/01/12 18:06:34 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) close(0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_open_dev$tun(&(0x7f0000c7f000-0xd)='/dev/net/tun\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00001aa000+0x9be)={@syzn={0x73, 0x79, 0x7a, 0x0, 0x0}, @ifru_map={0x5, 0x0, 0x0, 0x0, 0x0, 0x0}}) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000769000-0x20)={@syzn={0x73, 0x79, 0x7a, 0x0, 0x0}, @ifru_addrs={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f000035d000-0x4)=0x80000000002d, 0xffffffffffffff40) connect$inet(r0, &(0x7f0000561000)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) sendto$inet(r0, &(0x7f0000191000-0xad)="", 0x0, 0x0, &(0x7f00006e2000-0x10)={0x2, 0x0, @broadcast=0xffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) 2018/01/12 18:06:34 executing program 1: mmap(&(0x7f0000000000/0xb000)=nil, 0xb000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f000000a000-0x12)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xb) ioctl(r0, 0xc1004110, &(0x7f0000002000-0x9c)="ac7d34f6f2995a5fb9cae8959c") 2018/01/12 18:06:34 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000ccf000-0xb)='/dev/loop#\x00', 0x0, 0x44001) r1 = memfd_create(&(0x7f000025c000)="74086e750000000000000000008c00", 0x0) pwritev(r1, &(0x7f0000f51000-0x70)=[{&(0x7f00001f2000)="aa", 0x1}], 0x1, 0x0) sendfile(r0, r1, &(0x7f0000ec0000-0x8)=0x0, 0xfffffffe) 2018/01/12 18:06:34 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$inet6_sctp(0xa, 0x0, 0x84, &(0x7f0000526000-0x8)={0x0, 0x0}) bind(r1, &(0x7f0000735000+0x404)=@llc={0x1a, 0x17, 0x800, 0x3f, 0xffffffffffffffff, 0x7, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x0}, [0x0, 0x0]}, 0x10) getsockopt(r1, 0x4, 0x9, &(0x7f00009c6000)=""/106, &(0x7f0000f4f000)=0x6a) r2 = creat(&(0x7f00007ad000-0x8)='./file0\x00', 0x20) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f000015a000-0x14)={0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000635000)=0x14) pipe2(&(0x7f0000e42000)={0x0, 0x0}, 0x80800) r4 = socket$inet_tcp(0x2, 0x1, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000a3c000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockname$ipx(0xffffffffffffffff, &(0x7f000061a000-0x10)={0x0, 0x0, 0x0, ""/6, 0x0, 0x0}, &(0x7f0000f32000)=0x10) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000)=0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0x0) socket$nl_xfrm(0x10, 0x3, 0x6) getgroups(0x1, &(0x7f0000000000)=[0xffffffffffffffff]) bind$inet6(r5, &(0x7f0000d9e000-0x1c)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f000007a000)={0x0, 0xfe, 0x0}, &(0x7f00005ed000-0x4)=0x8) setsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000e3f000-0x8)=@assoc_value={r6, 0xabca}, 0x8) r7 = semget(0x0, 0x4, 0x226) semctl$SEM_INFO(r7, 0x4, 0x13, &(0x7f00008ed000-0xf2)=""/242) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000f0f000)={0x0, 0x7fffffff}, &(0x7f0000f39000)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f0000369000-0x10)={0x6, 0x8004, 0x0, 0x1, r8}, 0x10) listen(r5, 0x0) sendto$inet(r4, &(0x7f0000a29000-0x1)="", 0x0, 0x20008045, &(0x7f00005f0000-0x10)={0x2, 0x2, @loopback=0x7f000001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) accept(r5, &(0x7f0000681000)=@ethernet={0x0, @random=""/6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000209000-0x4)=0x10) 2018/01/12 18:06:34 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) getsockname(r0, &(0x7f0000bdd000)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local={[0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, [0x0, 0x0]}, &(0x7f0000f72000-0x4)=0x14) r2 = epoll_create(0x9) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f00003b5000)='/dev/rfkill\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f00002ba000-0xc)={0x408000000002, 0x0}) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r3, &(0x7f0000350000)={0x0, 0x0}) epoll_wait(r2, &(0x7f0000cef000-0x30)=[{0x0, 0x0}], 0x1, 0x0) getsockopt$inet6_mreq(r3, 0x29, 0x1f, &(0x7f0000cdd000)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000996000)=0x14) openat$autofs(0xffffffffffffff9c, &(0x7f0000112000)='/dev/autofs\x00', 0x2a000, 0x0) ioctl$LOOP_SET_STATUS(r3, 0x4c02, &(0x7f0000cd5000)={0x0, 0x0, 0x0, 0x0, 0x9, 0x5, 0x1e, 0x19, "8ed9aba1eeac3f09f0a531970edc9690a62b3e250b1f05af2ad3ce37f840292e8dd4afd80646c0543b54254fcb3109e217a560ab210b0eb2a27fe5b14ed19a3a", "a8b54d41005a000000eb000404604df09fcc32417f000001000000005a0064a6", [0x9, 0xfffffffffffffffb], 0x0}) connect(r0, &(0x7f00007d7000)=@ll={0x11, 0x6, r1, 0x1, 0x2, 0x6, @random="ec036d6d0a2b", [0x0, 0x0]}, 0x14) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f000070b000)={0x0, 0x7530}, 0x10) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f000016c000-0xc)={0x0, 0x0, 0x0}, &(0x7f0000173000-0x4)=0xc) lstat(&(0x7f0000840000)='./file0\x00', &(0x7f000006e000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$inet(0x2, 0xa, 0x800) truncate(&(0x7f0000ea4000-0x8)='./file0\x00', 0x31e) syz_fuseblk_mount(&(0x7f00006a2000)='./file0\x00', &(0x7f0000e3c000)='./file0\x00', 0x5000, r4, r5, 0x8001, 0x0, 0x100080) r6 = dup(r0) setsockopt$inet6_tcp_int(r0, 0x6, 0x20000000000002, &(0x7f0000001000-0x4)=0x81, 0x4) setsockopt$inet_tcp_int(r6, 0x6, 0x19, &(0x7f0000001000-0x4)=0x4, 0x4) bind$inet6(r0, &(0x7f0000001000-0x1c)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}, 0x0}, 0x1c) sendto$inet6(r0, &(0x7f0000e78000-0x1)="", 0x0, 0x20000004, &(0x7f00008d5000-0x1c)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}, 0x0}, 0x1c) sendto$inet6(r6, &(0x7f00002cf000-0x284)="740000e0c9e7472238d0e51375a830155f9f2fd324540a30d7c3a1082e29c214b863347943fcc1a6d4c3e1aa2c9544e3de8e5a46f75f9afcd592ae50a02d3ef77e7634fca456afbf3642824125670a0f4d580c83ed702cc59fedd9fe457cb1cd803767f0d7c1f1f58986465df795b41e17d649735a987a559f0043743ff011414bb89b990c8d7ea1d7c42698d25c23cbe0d6f2b4b5e10500000000000000d71ec50b7730172d6eeb1157779b538b9b9db1915ae654c1521350064f49ee608ace2bc34cb6e90afd28a06b07fbab416b9a18b097c8c64cc3e839508cb381af297a4af4bbb6aa4be0453b2ac75674018cf8b9b97fddc7781209e37ba5151d4719a34cff8fb756488a0898a94b1b5569f8a8940d2f27d6f16b1d5796e69507aa462e0eb6791e6fae5aa0be660531790a86e5a6683120a9ca958ce3d9f3efcd255f5708e41c21d4d690c7346973fe4f7a8e8e580426e3a132af427ebcc1ce594c6eb2400d4f181b45a50ab3e30244c467eed4af0efd01e00154d2efda60352861ff594bc0f833b2691d79391e95bf2a70129723dda5faef8b2392b3b4e4320cfdb3cb187b2ddf5e6157f9ee48e9dabbfb819adb49f6ebfc1223f128794b7497f37a0f5601be377332f2bacb23b4415b0666e7392afdb8106f6b4fbf2a65e2539e99086e4c10dbcd8661a143a14491a494f75ac6e2d10d911200585bda372f2c7c8057548d923342fad2631a4618865e8768a544dc1a30ecce4c858c1250df6d348d698ab96fde7f8f464745783680dec9af4bcc5c72aa39ca96da28c5129e6abed1650cbe7ecdb4958b9d77cd6f5bf046d86d8f8ad5ffc6ffc66ae4854ec7d79bfd03cf8ee4efcae855e71263cf37778962cd516fe0736c25767dce54ec306e877ba738e38749", 0x284, 0x100000000031, 0x0, 0x0) 2018/01/12 18:06:34 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) getsockname(r0, &(0x7f0000bdd000)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local={[0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, [0x0, 0x0]}, &(0x7f0000f72000-0x4)=0x14) r2 = epoll_create(0x9) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f00003b5000)='/dev/rfkill\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f00002ba000-0xc)={0x408000000002, 0x0}) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r3, &(0x7f0000350000)={0x0, 0x0}) epoll_wait(r2, &(0x7f0000cef000-0x30)=[{0x0, 0x0}], 0x1, 0x0) getsockopt$inet6_mreq(r3, 0x29, 0x1f, &(0x7f0000cdd000)={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000996000)=0x14) openat$autofs(0xffffffffffffff9c, &(0x7f0000112000)='/dev/autofs\x00', 0x2a000, 0x0) ioctl$LOOP_SET_STATUS(r3, 0x4c02, &(0x7f0000cd5000)={0x0, 0x0, 0x0, 0x0, 0x9, 0x5, 0x1e, 0x19, "8ed9aba1eeac3f09f0a531970edc9690a62b3e250b1f05af2ad3ce37f840292e8dd4afd80646c0543b54254fcb3109e217a560ab210b0eb2a27fe5b14ed19a3a", "a8b54d41005a000000eb000404604df09fcc32417f000001000000005a0064a6", [0x9, 0xfffffffffffffffb], 0x0}) connect(r0, &(0x7f00007d7000)=@ll={0x11, 0x6, r1, 0x1, 0x2, 0x6, @random="ec036d6d0a2b", [0x0, 0x0]}, 0x14) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f000070b000)={0x0, 0x7530}, 0x10) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f000016c000-0xc)={0x0, 0x0, 0x0}, &(0x7f0000173000-0x4)=0xc) lstat(&(0x7f0000840000)='./file0\x00', &(0x7f000006e000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$inet(0x2, 0xa, 0x800) truncate(&(0x7f0000ea4000-0x8)='./file0\x00', 0x31e) syz_fuseblk_mount(&(0x7f00006a2000)='./file0\x00', &(0x7f0000e3c000)='./file0\x00', 0x5000, r4, r5, 0x8001, 0x0, 0x100080) r6 = dup(r0) setsockopt$inet6_tcp_int(r0, 0x6, 0x20000000000002, &(0x7f0000001000-0x4)=0x81, 0x4) setsockopt$inet_tcp_int(r6, 0x6, 0x19, &(0x7f0000001000-0x4)=0x4, 0x4) bind$inet6(r0, &(0x7f0000001000-0x1c)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}, 0x0}, 0x1c) sendto$inet6(r0, &(0x7f0000e78000-0x1)="", 0x0, 0x20000004, &(0x7f00008d5000-0x1c)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}, 0x0}, 0x1c) readv(r0, &(0x7f00009f4000)=[{&(0x7f0000915000-0x1000)=""/4096, 0x1000}, {&(0x7f00001fd000)=""/115, 0x73}, {&(0x7f0000a81000-0x45)=""/232, 0xe8}, {&(0x7f0000f09000-0x18)=""/24, 0x18}, {&(0x7f0000086000-0xfe)=""/254, 0xfe}], 0x5) sendto$inet6(r6, &(0x7f00002cf000-0x284)="740000e0c9e7472238d0e51375a830155f9f2fd324540a30d7c3a1082e29c214b863347943fcc1a6d4c3e1aa2c9544e3de8e5a46f75f9afcd592ae50a02d3ef77e7634fca456afbf3642824125670a0f4d580c83ed702cc59fedd9fe457cb1cd803767f0d7c1f1f58986465df795b41e17d649735a987a559f0043743ff011414bb89b990c8d7ea1d7c42698d25c23cbe0d6f2b4b5e10500000000000000d71ec50b7730172d6eeb1157779b538b9b9db1915ae654c1521350064f49ee608ace2bc34cb6e90afd28a06b07fbab416b9a18b097c8c64cc3e839508cb381af297a4af4bbb6aa4be0453b2ac75674018cf8b9b97fddc7781209e37ba5151d4719a34cff8fb756488a0898a94b1b5569f8a8940d2f27d6f16b1d5796e69507aa462e0eb6791e6fae5aa0be660531790a86e5a6683120a9ca958ce3d9f3efcd255f5708e41c21d4d690c7346973fe4f7a8e8e580426e3a132af427ebcc1ce594c6eb2400d4f181b45a50ab3e30244c467eed4af0efd01e00154d2efda60352861ff594bc0f833b2691d79391e95bf2a70129723dda5faef8b2392b3b4e4320cfdb3cb187b2ddf5e6157f9ee48e9dabbfb819adb49f6ebfc1223f128794b7497f37a0f5601be377332f2bacb23b4415b0666e7392afdb8106f6b4fbf2a65e2539e99086e4c10dbcd8661a143a14491a494f75ac6e2d10d911200585bda372f2c7c8057548d923342fad2631a4618865e8768a544dc1a30ecce4c858c1250df6d348d698ab96fde7f8f464745783680dec9af4bcc5c72aa39ca96da28c5129e6abed1650cbe7ecdb4958b9d77cd6f5bf046d86d8f8ad5ffc6ffc66ae4854ec7d79bfd03cf8ee4efcae855e71263cf37778962cd516fe0736c25767dce54ec306e877ba738e38749", 0x284, 0x100000000031, 0x0, 0x0) 2018/01/12 18:06:34 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x801, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000e00000)=0x40, 0x4) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, 0x1c) listen(r0, 0x0) [ 32.417194] audit: type=1400 audit(1515780394.163:9): avc: denied { map } for pid=3495 comm="syz-fuzzer" path="/root/syzkaller-shm338027336" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 33.465378] audit: type=1400 audit(1515780395.212:10): avc: denied { sys_admin } for pid=3536 comm="syz-executor0" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 33.615462] audit: type=1400 audit(1515780395.362:11): avc: denied { sys_chroot } for pid=3722 comm="syz-executor0" capability=18 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 33.627960] binder: 3740:3741 transaction failed 29201/-28, size 40-0 line 2903 [ 33.631605] binder_alloc: binder_alloc_mmap_handler: 3740 20000000-20002000 already mapped failed -16 [ 33.634289] binder: BINDER_SET_CONTEXT_MGR already set [ 33.634302] binder: 3740:3741 ioctl 40046207 0 returned -16 [ 33.634363] binder_alloc: 3740: binder_alloc_buf, no vma [ 33.634389] binder: 3740:3742 transaction failed 29189/-3, size 40-8 line 2903 [ 33.642924] binder: undelivered TRANSACTION_ERROR: 29189 [ 33.643354] binder: release 3740:3741 transaction 2 out, still active [ 33.643391] binder: unexpected work type, 4, not freed [ 33.643394] binder: undelivered TRANSACTION_COMPLETE [ 33.643402] binder: undelivered TRANSACTION_ERROR: 29201 [ 33.643474] binder: send failed reply for transaction 2, target dead [ 33.715867] audit: type=1400 audit(1515780395.366:12): avc: denied { map } for pid=3740 comm="syz-executor0" path="/dev/binder0" dev="devtmpfs" ino=8898 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=chr_file permissive=1 [ 33.740621] audit: type=1400 audit(1515780395.367:13): avc: denied { set_context_mgr } for pid=3740 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 33.763969] audit: type=1400 audit(1515780395.371:14): avc: denied { call } for pid=3740 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 33.786846] audit: type=1400 audit(1515780395.371:15): avc: denied { transfer } for pid=3740 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 33.968922] audit: type=1400 audit(1515780395.715:16): avc: denied { net_admin } for pid=3744 comm="syz-executor7" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 34.031783] WARNING: CPU: 1 PID: 3748 at sound/core/pcm_lib.c:563 snd_interval_mulkdiv+0x5a9/0x650 [ 34.040919] Kernel panic - not syncing: panic_on_warn set ... [ 34.040919] [ 34.048294] CPU: 1 PID: 3748 Comm: syz-executor1 Not tainted 4.15.0-rc7+ #258 [ 34.055549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 34.064881] Call Trace: [ 34.067463] dump_stack+0x194/0x257 [ 34.071082] ? arch_local_irq_restore+0x53/0x53 [ 34.075730] ? vsnprintf+0x1ed/0x1900 [ 34.079509] panic+0x1e4/0x41c [ 34.082675] ? refcount_error_report+0x214/0x214 [ 34.087405] ? show_regs_print_info+0x18/0x18 [ 34.091903] ? __warn+0x1c1/0x200 [ 34.095343] ? snd_interval_mulkdiv+0x5a9/0x650 [ 34.099984] __warn+0x1dc/0x200 [ 34.103238] ? snd_interval_mulkdiv+0x5a9/0x650 [ 34.107900] report_bug+0x211/0x2d0 [ 34.111509] fixup_bug.part.11+0x37/0x80 [ 34.115544] do_error_trap+0x2d7/0x3e0 [ 34.119428] ? math_error+0x400/0x400 [ 34.123204] ? __lock_acquire+0x664/0x3e00 [ 34.127411] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 34.132582] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 34.137410] do_invalid_op+0x1b/0x20 [ 34.141098] invalid_op+0x22/0x40 [ 34.144525] RIP: 0010:snd_interval_mulkdiv+0x5a9/0x650 [ 34.149770] RSP: 0018:ffff8801d4807478 EFLAGS: 00010216 [ 34.155107] RAX: 0000000000010000 RBX: ffff8801d4807500 RCX: ffffffff841cc3e9 [ 34.162348] RDX: 00000000000001b5 RSI: ffffc900020bb000 RDI: 0000000000000008 [ 34.169601] RBP: ffff8801d48074c0 R08: 000000000000009c R09: ffffed003847f67b [ 34.176842] R10: 0000000000000013 R11: ffffed003847f67a R12: ffff8801c23fb38c [ 34.184098] R13: ffff8801c23fb380 R14: ffff8801c23fb394 R15: ffff8801c23fb388 [ 34.191354] ? snd_interval_mulkdiv+0x5a9/0x650 [ 34.196002] ? snd_interval_mulkdiv+0x5a9/0x650 [ 34.200646] ? check_noncircular+0x20/0x20 [ 34.204863] snd_pcm_hw_rule_mulkdiv+0xfd/0x1c0 [ 34.209508] ? snd_pcm_hw_rule_muldivk+0x1c0/0x1c0 [ 34.214411] ? __is_insn_slot_addr+0x1fc/0x330 [ 34.218976] ? check_noncircular+0x20/0x20 [ 34.223182] ? lock_downgrade+0x980/0x980 [ 34.227311] constrain_params_by_rules+0x625/0x11b0 [ 34.232309] ? __lock_acquire+0x664/0x3e00 [ 34.236536] ? snd_pcm_mmap_control_fault+0x380/0x380 [ 34.241696] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 34.246866] ? lock_downgrade+0x980/0x980 [ 34.250991] ? lock_release+0xa40/0xa40 [ 34.254952] ? is_bpf_text_address+0xa4/0x120 [ 34.259426] ? _raw_spin_unlock_irqrestore+0x31/0xba [ 34.264513] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 34.269502] ? trace_hardirqs_on+0xd/0x10 [ 34.273630] ? depot_save_stack+0x3b5/0x490 [ 34.277958] snd_pcm_hw_refine+0x818/0x1070 [ 34.282262] ? constrain_params_by_rules+0x11b0/0x11b0 [ 34.287521] ? __might_fault+0x110/0x1d0 [ 34.291577] ? lock_downgrade+0x980/0x980 [ 34.295701] ? lock_release+0xa40/0xa40 [ 34.299649] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 34.305506] ? __check_object_size+0x25d/0x4f0 [ 34.310068] ? __might_sleep+0x95/0x190 [ 34.314030] ? kasan_check_write+0x14/0x20 [ 34.318237] ? memcpy+0x45/0x50 [ 34.321497] snd_pcm_common_ioctl+0x7f9/0x1f60 [ 34.326059] ? snd_pcm_status_user+0x1b0/0x1b0 [ 34.330613] ? lock_release+0xa40/0xa40 [ 34.334562] ? __lock_is_held+0xb6/0x140 [ 34.338640] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 34.344502] ? rcu_note_context_switch+0x710/0x710 [ 34.349408] snd_pcm_ioctl+0x81/0xb0 [ 34.353099] ? snd_pcm_common_ioctl+0x1f60/0x1f60 [ 34.357927] do_vfs_ioctl+0x1b1/0x1520 [ 34.361786] ? _cond_resched+0x14/0x30 [ 34.365651] ? ioctl_preallocate+0x2b0/0x2b0 [ 34.370038] ? selinux_capable+0x40/0x40 [ 34.374078] ? SyS_futex+0x269/0x390 [ 34.377762] ? SyS_setsockopt+0x1cb/0x360 [ 34.381928] ? security_file_ioctl+0x89/0xb0 [ 34.386315] SyS_ioctl+0x8f/0xc0 [ 34.389660] entry_SYSCALL_64_fastpath+0x23/0x9a [ 34.394399] RIP: 0033:0x452ac9 [ 34.397561] RSP: 002b:00007f0534ab3c58 EFLAGS: 00000212 ORIG_RAX: 0000000000000010 [ 34.405241] RAX: ffffffffffffffda RBX: 00007f0534ab4700 RCX: 0000000000452ac9 [ 34.412482] RDX: 0000000020001f64 RSI: 00000000c1004110 RDI: 0000000000000013 [ 34.419726] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 34.426976] R10: 0000000000000000 R11: 0000000000000212 R12: 0000000000000000 [ 34.434216] R13: 0000000000a2f7ef R14: 00007f0534ab49c0 R15: 0000000000000000 [ 34.442231] Dumping ftrace buffer: [ 34.445813] (ftrace buffer empty) [ 34.449494] Kernel Offset: disabled [ 34.453096] Rebooting in 86400 seconds..