[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 9.760444] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 13.578045] random: crng init done Warning: Permanently added '10.128.15.202' (ECDSA) to the list of known hosts. 2018/09/08 23:33:09 fuzzer started 2018/09/08 23:33:11 dialing manager at 10.128.0.26:39199 2018/09/08 23:33:11 syscalls: 1 2018/09/08 23:33:11 code coverage: enabled 2018/09/08 23:33:11 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2018/09/08 23:33:11 setuid sandbox: enabled 2018/09/08 23:33:11 namespace sandbox: enabled 2018/09/08 23:33:11 fault injection: kernel does not have systematic fault injection support 2018/09/08 23:33:11 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/09/08 23:33:11 net packed injection: enabled 2018/09/08 23:33:11 net device setup: enabled 23:33:38 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_opts(r0, 0x29, 0x3b, 0x0, &(0x7f00000004c0)) 23:33:38 executing program 0: clone(0x27fd, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe, 0xffffffffffffffff) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000200)) r1 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000080)) fcntl$addseals(0xffffffffffffffff, 0x409, 0x0) get_robust_list(0x0, &(0x7f00000003c0)=&(0x7f0000000340)={&(0x7f0000000280)={&(0x7f00000001c0)}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)}}, &(0x7f0000000400)=0x18) 23:33:38 executing program 7: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r0 = getpid() r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ptrace$getregset(0x4204, r0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=""/247, 0xf7}) syz_open_procfs(0x0, &(0x7f0000000080)='ns\x00') sched_setscheduler(r0, 0x0, &(0x7f0000000040)) ioctl$KDGETLED(r1, 0x4b31, &(0x7f0000000280)) ioctl$EXT4_IOC_SHUTDOWN(0xffffffffffffffff, 0x8004587d, &(0x7f0000000140)=0x1) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000000)) 23:33:38 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_opts(r0, 0x29, 0x37, 0x0, &(0x7f00000004c0)=0x6fff267e77952d82) 23:33:38 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x5c831, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) futex(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0, 0x0) 23:33:38 executing program 5: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) fallocate(r0, 0x0, 0x0, 0x10001) r1 = open(&(0x7f0000000040)='./bus\x00', 0x81, 0x0) sendfile(r1, r0, 0x0, 0xd7c3) lseek(r0, 0x0, 0x3) 23:33:38 executing program 1: r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x5) write$binfmt_elf64(r0, &(0x7f00000000c0)=ANY=[], 0xffffffe8) r1 = gettid() ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f0000000180)=""/255) timer_create(0x0, &(0x7f0000000140)={0x0, 0x12, 0x0, @thr={&(0x7f0000000040), &(0x7f0000000180)}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x77359400}, {0x0, 0x1c9c380}}, &(0x7f0000040000)) tkill(r1, 0x1004000000016) 23:33:38 executing program 6: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000002a40)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_aout(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="94"], 0x1) setsockopt$sock_int(r1, 0x1, 0x200000010, &(0x7f0000000040)=0x1, 0x4) write(r0, &(0x7f0000000140)='N', 0x1) recvmsg(r1, &(0x7f0000005f40)={&(0x7f0000005d00)=@can, 0x80, &(0x7f0000005e40), 0x0, &(0x7f0000005e80)=""/138, 0x8a}, 0x2) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, &(0x7f00000002c0), 0x0) [ 60.759876] audit: type=1400 audit(1536449618.676:5): avc: denied { sys_admin } for pid=2082 comm="syz-executor5" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 60.807660] audit: type=1400 audit(1536449618.726:6): avc: denied { net_admin } for pid=2087 comm="syz-executor5" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 67.213228] audit: type=1400 audit(1536449625.136:7): avc: denied { sys_chroot } for pid=2087 comm="syz-executor5" capability=18 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 67.279535] audit: type=1400 audit(1536449625.196:8): avc: denied { associate } for pid=2087 comm="syz-executor5" name="syz5" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1 [ 67.363856] audit: type=1400 audit(1536449625.286:9): avc: denied { dac_override } for pid=4133 comm="syz-executor5" capability=1 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 23:33:45 executing program 5: sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000080), 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x14}, 0x14}}, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f00000000c0), 0x0) r1 = socket$key(0xf, 0x3, 0x2) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000200)) bind(r1, &(0x7f00000002c0)=@in6, 0x80) clock_settime(0x0, &(0x7f0000000040)={0x0, 0x1c9c380}) 23:33:45 executing program 5: sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000080), 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x14}, 0x14}}, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f00000000c0), 0x0) r1 = socket$key(0xf, 0x3, 0x2) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000200)) bind(r1, &(0x7f00000002c0)=@in6, 0x80) clock_settime(0x0, &(0x7f0000000040)={0x0, 0x1c9c380}) 23:33:45 executing program 3: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) fsetxattr$trusted_overlay_opaque(0xffffffffffffffff, &(0x7f0000000100)='trusted.overlay.opaque\x00', &(0x7f0000000140)='y\x00', 0x2, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000000)={{}, {0x0, @local}, 0xfffffffffffffffd, {0x2, 0x0, @remote}, 'bond_slave_1\x00'}) 23:33:45 executing program 2: splice(0xffffffffffffffff, &(0x7f0000000740), 0xffffffffffffff9c, &(0x7f0000000780), 0x0, 0xa) 23:33:45 executing program 2: sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000080), 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x14}, 0x14}}, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000000)='#em1#+\x00', 0x0) write(r1, &(0x7f0000000440)="0795040000000029a77ce74fb58ddf0000356317b447d19ecd38b972a4220aae9720fe2c59e090b66f8fc48c26002c72a757a85b0700000000000000023f0683a2aaa95f07", 0x45) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r1, 0x0) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000200)) clock_settime(0x0, &(0x7f0000000040)={0x0, 0x1c9c380}) 23:33:45 executing program 0: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x100000, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x89, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = creat(&(0x7f00000001c0)='./file0\x00', 0x17) fcntl$setstatus(r1, 0x4, 0x80000000000) write$P9_RLERROR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0x0) unshare(0x40000000) write$P9_RFLUSH(0xffffffffffffffff, &(0x7f0000000280)={0x7, 0x6d, 0x1}, 0x7) fsetxattr$trusted_overlay_redirect(r3, &(0x7f0000000080)='trusted.overlay.redirect\x00', &(0x7f0000000140)='./file0\x00', 0x8, 0x0) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000000)) ioctl$TCGETS(r1, 0x5401, &(0x7f0000000040)) ioctl$FS_IOC_SETVERSION(r3, 0x40087602, &(0x7f0000000180)=0xb7) r4 = fcntl$getown(r3, 0x9) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000240)=r4) ioctl$FICLONERANGE(r2, 0x4020940d, &(0x7f0000000200)={r1, 0x0, 0xfffffffffffffff9, 0x7f, 0x1}) 23:33:45 executing program 5: sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000080), 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x14}, 0x14}}, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f00000000c0), 0x0) r1 = socket$key(0xf, 0x3, 0x2) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000200)) bind(r1, &(0x7f00000002c0)=@in6, 0x80) clock_settime(0x0, &(0x7f0000000040)={0x0, 0x1c9c380}) 23:33:45 executing program 3: splice(0xffffffffffffffff, &(0x7f0000000740), 0xffffffffffffff9c, &(0x7f0000000780), 0x0, 0xfffffffffffffffe) 23:33:45 executing program 2: clone(0x200, &(0x7f0000b6b000), &(0x7f0000744000), &(0x7f0000fef000), &(0x7f0000000000)) mknod(&(0x7f0000000100)='./file0\x00', 0x103f, 0x0) execve(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180), &(0x7f0000000140)) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='stack\x00') preadv(r0, &(0x7f0000000140)=[{&(0x7f0000002740)=""/85, 0x55}], 0x1, 0x0) execve(&(0x7f0000000080)='./file0\x00', &(0x7f0000000480), &(0x7f00000005c0)) open$dir(&(0x7f0000296ff8)='./file0\x00', 0x27e, 0x0) 23:33:45 executing program 3: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r0 = getpid() r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_FIOSETOWN(0xffffffffffffffff, 0x8901, &(0x7f0000000140)=r0) sched_setscheduler(r0, 0x5, &(0x7f0000000040)) readahead(r1, 0x9, 0x8) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x400043, 0x0) ioctl$BLKGETSIZE(r2, 0x1260, &(0x7f0000000600)) setsockopt$IP_VS_SO_SET_ZERO(r1, 0x0, 0x48f, &(0x7f00000000c0)={0x87, @broadcast, 0x4e20, 0x0, 'rr\x00', 0x0, 0x7}, 0x2c) ioctl$TIOCGSOFTCAR(0xffffffffffffffff, 0x5419, &(0x7f0000000000)) 23:33:46 executing program 3: write$FUSE_NOTIFY_DELETE(0xffffffffffffffff, &(0x7f0000000540)=ANY=[], 0x0) r0 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x252, 0x82) r1 = memfd_create(&(0x7f0000000140)="6367726f7570320075b536e08f97e10c4289e296462f3c8fc6a418228027bf4d75931e238b41cf55afcf7dd2284567ed5a738f3382aae6349e10336adf686499eb1d9379eb28", 0x0) ioctl$PIO_UNIMAPCLR(0xffffffffffffffff, 0x4b68, &(0x7f0000000100)={0x0, 0x2, 0xb61}) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, &(0x7f0000000000)=0x39044, 0x2000005) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000415fc8)={&(0x7f000034c000), 0xc, &(0x7f00000daff0)={&(0x7f0000417e08)=ANY=[@ANYBLOB="000000000000000000000000000000010000000033000000ac14ffbb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000004c0014006d643500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x1}}, 0x0) 23:33:46 executing program 0: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f0000000000)) 23:33:46 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0xa, 0x5, &(0x7f0000346fc8)=ANY=[@ANYBLOB="18000000000000000000000000000000611069000000000000000000000000009500000000000000"], &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) 23:33:46 executing program 7: splice(0xffffffffffffffff, &(0x7f0000000740), 0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0xf) [ 68.680864] audit: type=1400 audit(1536449626.596:10): avc: denied { prog_load } for pid=4329 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 23:33:47 executing program 1: 23:33:47 executing program 0: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x1, &(0x7f0000000180)=ANY=[@ANYBLOB="5000000090780000"], &(0x7f0000000040)) 23:33:47 executing program 3: sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000080), 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x14}, 0x14}}, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000000)='#em1#+\x00', 0x0) write(r1, &(0x7f0000000440)="0795040000000029a77ce74fb58ddf0000356317b447d19ecd38b972a4220aae9720fe2c59e090b66f8fc48c26002c72a757a85b0700000000000000023f0683a2aaa9", 0x43) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r1, 0x0) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000200)) clock_settime(0x0, &(0x7f0000000040)={0x0, 0x1c9c380}) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000340), &(0x7f0000000380)=0x4) 23:33:47 executing program 2: clone(0x200, &(0x7f0000b6b000), &(0x7f0000744000), &(0x7f0000fef000), &(0x7f0000000000)) mknod(&(0x7f0000000100)='./file0\x00', 0x103f, 0x0) execve(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180), &(0x7f0000000140)) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='stack\x00') preadv(r0, &(0x7f0000000140)=[{&(0x7f0000002740)=""/85, 0x55}], 0x1, 0x0) execve(&(0x7f0000000080)='./file0\x00', &(0x7f0000000480), &(0x7f00000005c0)) open$dir(&(0x7f0000296ff8)='./file0\x00', 0x27e, 0x0) 23:33:47 executing program 5: sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000080), 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x14}, 0x14}}, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f00000000c0), 0x0) r1 = socket$key(0xf, 0x3, 0x2) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000200)) bind(r1, &(0x7f00000002c0)=@in6, 0x80) clock_settime(0x0, &(0x7f0000000040)={0x0, 0x1c9c380}) 23:33:47 executing program 6: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x2, 0x7) write(r0, &(0x7f0000000000)="240000001a0025f0046bbc04fef7001c", 0x10) 23:33:47 executing program 7: write$FUSE_NOTIFY_DELETE(0xffffffffffffffff, &(0x7f0000000540)=ANY=[], 0x0) r0 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x252, 0x82) r1 = memfd_create(&(0x7f0000000140)="6367726f7570320075b536e08f97e10c4289e296462f3c8fc6a418228027bf4d75931e238b41cf55afcf7dd2284567ed5a738f3382aae6349e10336adf686499eb1d9379eb28", 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806) sendfile(r0, r0, &(0x7f0000000000)=0x39044, 0x2000005) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 23:33:47 executing program 4: clone(0x27fd, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe, 0xffffffffffffffff) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000200)) r1 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, &(0x7f0000000000)={0x0, @speck128, 0x0, "b22ac447938a4dce"}) fcntl$addseals(0xffffffffffffffff, 0x409, 0x0) 23:33:47 executing program 4: write$FUSE_NOTIFY_DELETE(0xffffffffffffffff, &(0x7f0000000540)=ANY=[], 0x0) r0 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x252, 0x82) r1 = memfd_create(&(0x7f0000000140)="6367726f7570320075b536e08f97e10c4289e296462f3c8fc6a418228027bf4d75931e238b41cf55afcf7dd2284567ed5a738f3382aae6349e10336adf686499eb1d9379eb28", 0x0) ioctl$PIO_UNIMAPCLR(0xffffffffffffffff, 0x4b68, &(0x7f0000000100)={0x0, 0x2, 0xb61}) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806) sendmsg(0xffffffffffffffff, &(0x7f0000000dc0)={&(0x7f00000004c0)=@pppoe={0x18, 0x0, {0x0, @local, 'yam0\x00'}}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000e00)=ANY=[], 0x0, 0x840}, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, &(0x7f0000000000)=0x39044, 0x2000005) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000415fc8)={&(0x7f000034c000), 0xc, &(0x7f00000daff0)={&(0x7f0000417e08)=ANY=[@ANYBLOB="000000000000000000000000000000010000000033000000ac14ffbb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000004c0014006d64350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x1}}, 0x0) 23:33:47 executing program 3: splice(0xffffffffffffffff, &(0x7f0000000740), 0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x5) 23:33:47 executing program 1: clone(0x200, &(0x7f0000b6b000), &(0x7f0000744000), &(0x7f0000fef000), &(0x7f0000000000)) mknod(&(0x7f0000000100)='./file0\x00', 0x103f, 0x0) execve(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180), &(0x7f0000000140)) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='stack\x00') preadv(r0, &(0x7f0000000140)=[{&(0x7f0000002740)=""/85, 0x55}], 0x1, 0x0) pread64(r0, &(0x7f0000000200)=""/102, 0xfffffd96, 0x0) open$dir(&(0x7f0000296ff8)='./file0\x00', 0x27e, 0x0) 23:33:47 executing program 0: write$FUSE_NOTIFY_DELETE(0xffffffffffffffff, &(0x7f0000000540)=ANY=[], 0x0) r0 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x252, 0x82) r1 = memfd_create(&(0x7f0000000140)="6367726f7570320075b536e08f97e10c4289e296462f3c8fc6a418228027bf4d75931e238b41cf55afcf7dd2284567ed5a738f3382aae6349e10336adf686499eb1d9379eb28", 0x0) ioctl$PIO_UNIMAPCLR(0xffffffffffffffff, 0x4b68, &(0x7f0000000100)={0x0, 0x2, 0xb61}) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806) sendmsg(0xffffffffffffffff, &(0x7f0000000dc0)={&(0x7f00000004c0)=@pppoe={0x18, 0x0, {0x0, @local, 'yam0\x00'}}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000e00)=ANY=[]}, 0x0) sendfile(r0, r0, &(0x7f0000000000)=0x39044, 0x2000005) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000415fc8)={&(0x7f000034c000), 0xc, &(0x7f00000daff0)={&(0x7f0000417e08)=ANY=[@ANYBLOB="000000000000000000000000000000010000000033000000ac14ffbb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000004c0014006d6435000000"], 0x1}}, 0x0) 23:33:47 executing program 6: splice(0xffffffffffffffff, &(0x7f0000000740), 0xffffffffffffff9c, &(0x7f0000000780), 0x0, 0x1) 23:33:47 executing program 7: write$FUSE_NOTIFY_DELETE(0xffffffffffffffff, &(0x7f0000000540)=ANY=[], 0x0) r0 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x252, 0x82) r1 = memfd_create(&(0x7f0000000140)="6367726f7570320075b536e08f97e10c4289e296462f3c8fc6a418228027bf4d75931e238b41cf55afcf7dd2284567ed5a738f3382aae6349e10336adf686499eb1d9379eb28", 0x0) ioctl$PIO_UNIMAPCLR(0xffffffffffffffff, 0x4b68, &(0x7f0000000100)={0x0, 0x2}) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806) sendmsg(0xffffffffffffffff, &(0x7f0000000dc0)={&(0x7f00000004c0)=@pppoe={0x18, 0x0, {0x0, @local, 'yam0\x00'}}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000e00)=ANY=[], 0x0, 0x840}, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, &(0x7f0000000000)=0x39044, 0x2000005) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000415fc8)={&(0x7f000034c000), 0xc, &(0x7f00000daff0)={&(0x7f0000417e08)=ANY=[@ANYBLOB], 0x1}}, 0x0) 23:33:47 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000080)='./file1\x00', 0x0) pwritev(r1, &(0x7f0000003440)=[{&(0x7f0000002400)='I', 0x1}], 0x1, 0x40000) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f0000000000)={0x0, 0xfffffffffffffffb, 0x0, 0x0, 0x48}) 23:33:47 executing program 6: 23:33:47 executing program 0: 23:33:47 executing program 3: 23:33:47 executing program 6: 23:33:47 executing program 2: clone(0x200, &(0x7f0000b6b000), &(0x7f0000744000), &(0x7f0000fef000), &(0x7f0000000000)) mknod(&(0x7f0000000100)='./file0\x00', 0x103f, 0x0) execve(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180), &(0x7f0000000140)) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='stack\x00') preadv(r0, &(0x7f0000000140)=[{&(0x7f0000002740)=""/85, 0x55}], 0x1, 0x0) execve(&(0x7f0000000080)='./file0\x00', &(0x7f0000000480), &(0x7f00000005c0)) open$dir(&(0x7f0000296ff8)='./file0\x00', 0x27e, 0x0) 23:33:47 executing program 7: 23:33:47 executing program 3: 23:33:47 executing program 6: 23:33:47 executing program 0: 23:33:47 executing program 4: 23:33:47 executing program 5: 23:33:47 executing program 1: 23:33:47 executing program 4: 23:33:47 executing program 5: 23:33:47 executing program 0: 23:33:47 executing program 6: 23:33:47 executing program 3: 23:33:47 executing program 7: sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000080), 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x14}, 0x14}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = getpid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f00000002c0)) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f2, &(0x7f0000000180)={'ip_vti0\x00', &(0x7f0000000240)=ANY=[]}) 23:33:47 executing program 4: 23:33:47 executing program 1: 23:33:47 executing program 2: clone(0x200, &(0x7f0000b6b000), &(0x7f0000744000), &(0x7f0000fef000), &(0x7f0000000000)) mknod(&(0x7f0000000100)='./file0\x00', 0x103f, 0x0) execve(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180), &(0x7f0000000140)) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='stack\x00') preadv(r0, &(0x7f0000000140)=[{&(0x7f0000002740)=""/85, 0x55}], 0x1, 0x0) execve(&(0x7f0000000080)='./file0\x00', &(0x7f0000000480), &(0x7f00000005c0)) open$dir(&(0x7f0000296ff8)='./file0\x00', 0x27e, 0x0) 23:33:47 executing program 3: 23:33:47 executing program 0: 23:33:47 executing program 6: 23:33:47 executing program 4: 23:33:47 executing program 5: 23:33:47 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_opts(r0, 0x29, 0x39, 0x0, &(0x7f0000000000)=0xfffffffffffffe4f) 23:33:47 executing program 7: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000180), 0xffffffffffffffff) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000000)) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f0000000080)={0x0, 0xa2, 0x80, 0x0, 0x4}) ioctl$KDDISABIO(0xffffffffffffffff, 0x4b37) 23:33:47 executing program 5: 23:33:47 executing program 0: 23:33:47 executing program 4: 23:33:47 executing program 6: 23:33:47 executing program 1: 23:33:47 executing program 3: 23:33:47 executing program 4: 23:33:47 executing program 6: r0 = socket$netlink(0x10, 0x3, 0x8000000004) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f0000000080)=0x10000, 0x4) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000140)="580000001400192340834b80043f679a10ff00804824ca945f640094000500289d5aaa000000000000008449bb06d383d537b300f0fffeff2c707f8f00ff200000000010000100090a000000000000000000000000000000", 0x58}], 0x1) [ 69.911996] audit: type=1400 audit(1536449627.826:11): avc: denied { net_broadcast } for pid=4463 comm="syz-executor6" capability=11 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 23:33:47 executing program 2: clone(0x200, &(0x7f0000b6b000), &(0x7f0000744000), &(0x7f0000fef000), &(0x7f0000000000)) mknod(&(0x7f0000000100)='./file0\x00', 0x103f, 0x0) execve(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180), &(0x7f0000000140)) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='stack\x00') preadv(r0, &(0x7f0000000140)=[{&(0x7f0000002740)=""/85, 0x55}], 0x1, 0x0) execve(&(0x7f0000000080)='./file0\x00', &(0x7f0000000480), &(0x7f00000005c0)) 23:33:47 executing program 5: r0 = socket$inet6(0xa, 0x201000000000001, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000180), 0xffffffffffffffff) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000200)) getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x50, &(0x7f0000000040), &(0x7f0000000000)=0x68) 23:33:47 executing program 0: clone(0x10020002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r0 = socket(0x11, 0x200000000080002, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000040)) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000080)) setsockopt$packet_rx_ring(r0, 0x107, 0xf, &(0x7f0000000180), 0x8) 23:33:47 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_opts(r0, 0x29, 0x36, 0x0, &(0x7f0000000040)=0xfffffffffffffdcd) 23:33:47 executing program 3: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r0 = getpid() socket(0xa, 0x0, 0x0) sched_setscheduler(r0, 0x5, &(0x7f0000000200)) syz_genetlink_get_family_id$team(&(0x7f0000000080)='team\x00') ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'team_slave_0\x00'}) setpriority(0x0, 0x0, 0x0) 23:33:47 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x3}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @ipv4={[], [], @remote}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 23:33:47 executing program 7: r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000005c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) accept4$packet(0xffffffffffffffff, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000640)=0x14, 0x80800) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000680)={r1, @multicast2}, 0xc) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x2, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000440)=ANY=[@ANYBLOB="02120000020000000a004284a4ae0aa192e5b76d03538c53f9a6ff6f1e03e3689ea3585ead541ddfca090f09433d62fbf9559475b8f411533ee93728b6cd4b7cf6ae0b36b69df709de5b86f33bd6169320eb378bea9e8f96565d2740f5ce"], 0x5e}}, 0x0) 23:33:47 executing program 6: 23:33:47 executing program 6: openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0) sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x18, 0x0, 0x300, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DEST={0x4}]}, 0x18}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r1 = getpid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000100), 0x4) recvmmsg(0xffffffffffffffff, &(0x7f0000001b00), 0x0, 0x12000, &(0x7f00000009c0)={0x77359400}) sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$sock_SIOCETHTOOL(r0, 0x89f2, &(0x7f0000000180)={'ip_vti0\x00', &(0x7f0000000240)=ANY=[]}) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000340), &(0x7f0000000380)=0x4) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xcb, &(0x7f00000000c0)=0xcc, 0x4) 23:33:48 executing program 1: ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000000)=0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000180)=0x9) clone(0x2102001ff8, 0x0, 0xfffffffffffffffe, &(0x7f0000000200), 0xffffffffffffffff) r1 = getpid() r2 = memfd_create(&(0x7f0000000240)='TPROXY\x00', 0x0) sched_setscheduler(r1, 0x5, &(0x7f0000000080)) ioctl$IOC_PR_RESERVE(r2, 0x401070c9, &(0x7f0000000040)={0x0, 0x5}) ioctl$EVIOCGABS20(r2, 0x80184560, &(0x7f00000000c0)=""/166) remap_file_pages(&(0x7f0000fef000/0xf000)=nil, 0xf000, 0x1000002, 0x8, 0x0) [ 70.045169] audit: type=1400 audit(1536449627.966:12): avc: denied { net_raw } for pid=4473 comm="syz-executor0" capability=13 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 23:33:48 executing program 3: r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000005c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) accept4$packet(0xffffffffffffffff, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000640)=0x14, 0x80800) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000680)={r1, @multicast2}, 0xc) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000440)=ANY=[@ANYBLOB="02120000020000000a004284a4ae0aa192e5b76d03538c53f9a6ff6f1e03e3689ea3585ead541ddfca090f09433d62fbf9559475b8f411533ee93728b6cd4b7cf6ae0b36b69df709de5b86f33bd6169320eb378bea9e8f96565d2740f5ce"], 0x5e}}, 0x0) dup2(r2, r3) 23:33:48 executing program 7: bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xe, 0x24, &(0x7f0000000680)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d03010000000000950000000000000071260000000000006706000002000000bf25000000000000620500000e0000007365000000000000bf540000000000000704000004faff003d4301000000000095000000000000005d54090000000000bf250000000000000f65000000000000070500000e000000bf5400000000000007040000040000003d4301000000000095000000000000006154000000000000bf25000000000000070500000e0000001f6500000000000007050000040000000f40000000000000bf5400000000000007040000040000003d3201000000000095000000000000004d54000000000000b7000000000000009500000000000000"], &(0x7f0000000100)='GPL\x00'}, 0x48) [ 70.074755] audit: type=1400 audit(1536449627.996:13): avc: denied { create } for pid=4487 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 23:33:48 executing program 7: timer_create(0x0, &(0x7f0000000180), &(0x7f00000000c0)) clone(0x20802102001ff9, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) creat(&(0x7f0000000080)='./file0\x00', 0x0) r0 = getpid() mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x1, 0x31, 0xffffffffffffffff, 0x0) sched_setscheduler(r0, 0x400000000000005, &(0x7f0000000200)) prlimit64(0x0, 0xf, &(0x7f0000000100)={0x0, 0x9a24}, &(0x7f0000000140)) [ 70.075125] audit: type=1400 audit(1536449627.996:14): avc: denied { write } for pid=4487 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 23:33:48 executing program 3: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000200)) clock_gettime(0x0, &(0x7f0000000040)) clock_settime(0x6, &(0x7f0000000080)) memfd_create(&(0x7f0000000a80)='{+cpuset&[\x00', 0x3) 23:33:48 executing program 5: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r0 = getpid() r1 = syz_open_procfs(0x0, &(0x7f0000000180)='ns\x00') sched_setscheduler(r0, 0x5, &(0x7f0000000040)) setsockopt$inet_mreq(r1, 0x0, 0x0, &(0x7f00000000c0)={@broadcast, @multicast2}, 0x8) ioctl$BLKGETSIZE(0xffffffffffffffff, 0x1260, &(0x7f0000000600)) 23:33:48 executing program 6: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r0 = getpid() r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sched_setscheduler(r0, 0x5, &(0x7f0000000040)) ioctl$BLKGETSIZE(0xffffffffffffffff, 0x1260, &(0x7f0000000600)) setsockopt$IP_VS_SO_SET_ZERO(r1, 0x0, 0x48f, &(0x7f00000000c0)={0x87, @broadcast, 0x4e20, 0x4, 'rr\x00', 0x21, 0x7}, 0x2c) sched_setscheduler(r0, 0x0, &(0x7f0000000100)) [ 70.836377] ================================================================== [ 70.843762] BUG: KASAN: stack-out-of-bounds in unwind_get_return_address+0x8f/0xa0 [ 70.851446] Read of size 8 at addr ffff8801aa10fde8 by task syz-executor2/4500 [ 70.858775] [ 70.860428] CPU: 1 PID: 4500 Comm: syz-executor2 Not tainted 4.9.125+ #41 [ 70.867326] ffff8801c52b77c8 ffffffff81af0ae9 ffffea0006a843c0 ffff8801aa10fde8 [ 70.875308] 0000000000000000 ffff8801aa10fde8 ffff8801c51188c0 ffff8801c52b7800 [ 70.883301] ffffffff814e0e1d ffff8801aa10fde8 0000000000000008 0000000000000000 [ 70.891278] Call Trace: [ 70.893844] [] dump_stack+0xc1/0x128 [ 70.899184] [] print_address_description+0x6c/0x234 [ 70.905827] [] kasan_report.cold.6+0x242/0x2fe [ 70.912052] [] ? unwind_get_return_address+0x8f/0xa0 [ 70.918787] [] __asan_report_load8_noabort+0x14/0x20 [ 70.925517] [] unwind_get_return_address+0x8f/0xa0 [ 70.932078] [] __save_stack_trace+0x8d/0xf0 [ 70.938029] [] save_stack_trace_tsk+0x48/0x70 [ 70.944155] [] proc_pid_stack+0x148/0x220 [ 70.949928] [] ? lock_trace+0xc0/0xc0 [ 70.955355] [] ? get_pid_task+0x9b/0x140 [ 70.961060] [] proc_single_show+0xfd/0x170 [ 70.966929] [] seq_read+0x4b6/0x12d0 [ 70.972267] [] ? seq_lseek+0x3c0/0x3c0 [ 70.977781] [] ? __fsnotify_inode_delete+0x30/0x30 [ 70.984336] [] ? __fsnotify_update_child_dentry_flags.part.0+0x300/0x300 [ 70.992807] [] do_loop_readv_writev.part.1+0xd5/0x280 [ 70.999633] [] compat_do_readv_writev+0x570/0x7b0 [ 71.006100] [] ? do_pwritev+0x240/0x240 [ 71.011703] [] ? _raw_spin_unlock_irqrestore+0x45/0x70 [ 71.018605] [] ? debug_check_no_obj_freed+0x2ce/0x890 [ 71.025424] [] ? __fd_install+0x20f/0x5d0 [ 71.031212] [] ? check_preemption_disabled+0x3b/0x170 [ 71.038031] [] ? check_preemption_disabled+0x3b/0x170 [ 71.046411] [] ? __fget+0x214/0x3d0 [ 71.051663] [] ? __fget+0x23b/0x3d0 [ 71.056916] [] ? __fget+0x47/0x3d0 [ 71.062087] [] compat_readv+0xe2/0x150 [ 71.067604] [] do_compat_preadv64+0x152/0x180 [ 71.073723] [] ? do_compat_readv+0x1d0/0x1d0 [ 71.079758] [] ? up_read+0x1a/0x40 [ 71.084922] [] compat_SyS_preadv+0x3b/0x50 [ 71.090779] [] ? compat_SyS_preadv64+0x40/0x40 [ 71.096986] [] do_fast_syscall_32+0x2f1/0x860 [ 71.103110] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 71.109752] [] entry_SYSENTER_compat+0x90/0xa2 [ 71.115954] [ 71.117551] The buggy address belongs to the page: [ 71.122472] page:ffffea0006a843c0 count:0 mapcount:0 mapping: (null) index:0x0 [ 71.130703] flags: 0x4000000000000000() [ 71.134645] page dumped because: kasan: bad access detected [ 71.140326] [ 71.141926] Memory state around the buggy address: [ 71.146829] ffff8801aa10fc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 71.154161] ffff8801aa10fd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 71.161493] >ffff8801aa10fd80: f1 f1 f1 f1 00 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 [ 71.168822] ^ [ 71.175548] ffff8801aa10fe00: f2 f2 f2 f2 00 00 f2 f2 00 00 00 00 00 00 00 00 [ 71.182888] ffff8801aa10fe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 71.190221] ================================================================== [ 71.197549] Disabling lock debugging due to kernel taint [ 71.203044] Kernel panic - not syncing: panic_on_warn set ... [ 71.203044] [ 71.210413] CPU: 1 PID: 4500 Comm: syz-executor2 Tainted: G B 4.9.125+ #41 [ 71.218528] ffff8801c52b7728 ffffffff81af0ae9 ffffffff82c34720 00000000ffffffff [ 71.226519] 0000000000000000 0000000000000001 ffff8801c51188c0 ffff8801c52b77e8 [ 71.234504] ffffffff813df095 0000000041b58ab3 ffffffff82c28773 ffffffff813deed6 [ 71.242493] Call Trace: [ 71.245069] [] dump_stack+0xc1/0x128 [ 71.250414] [] panic+0x1bf/0x39f [ 71.255414] [] ? add_taint.cold.6+0x16/0x16 [ 71.261374] [] ? ___preempt_schedule+0x16/0x18 [ 71.267600] [] kasan_end_report+0x47/0x4f [ 71.273396] [] kasan_report.cold.6+0x76/0x2fe [ 71.279519] [] ? unwind_get_return_address+0x8f/0xa0 [ 71.286247] [] __asan_report_load8_noabort+0x14/0x20 [ 71.292976] [] unwind_get_return_address+0x8f/0xa0 [ 71.299532] [] __save_stack_trace+0x8d/0xf0 [ 71.305483] [] save_stack_trace_tsk+0x48/0x70 [ 71.311615] [] proc_pid_stack+0x148/0x220 [ 71.317388] [] ? lock_trace+0xc0/0xc0 [ 71.322815] [] ? get_pid_task+0x9b/0x140 [ 71.328505] [] proc_single_show+0xfd/0x170 [ 71.334384] [] seq_read+0x4b6/0x12d0 [ 71.339726] [] ? seq_lseek+0x3c0/0x3c0 [ 71.345245] [] ? __fsnotify_inode_delete+0x30/0x30 [ 71.351800] [] ? __fsnotify_update_child_dentry_flags.part.0+0x300/0x300 [ 71.360266] [] do_loop_readv_writev.part.1+0xd5/0x280 [ 71.367087] [] compat_do_readv_writev+0x570/0x7b0 [ 71.373589] [] ? do_pwritev+0x240/0x240 [ 71.379191] [] ? _raw_spin_unlock_irqrestore+0x45/0x70 [ 71.386096] [] ? debug_check_no_obj_freed+0x2ce/0x890 [ 71.392913] [] ? __fd_install+0x20f/0x5d0 [ 71.398687] [] ? check_preemption_disabled+0x3b/0x170 [ 71.405504] [] ? check_preemption_disabled+0x3b/0x170 [ 71.412323] [] ? __fget+0x214/0x3d0 [ 71.417587] [] ? __fget+0x23b/0x3d0 [ 71.422857] [] ? __fget+0x47/0x3d0 [ 71.428028] [] compat_readv+0xe2/0x150 [ 71.433543] [] do_compat_preadv64+0x152/0x180 [ 71.439675] [] ? do_compat_readv+0x1d0/0x1d0 [ 71.445713] [] ? up_read+0x1a/0x40 [ 71.450882] [] compat_SyS_preadv+0x3b/0x50 [ 71.456743] [] ? compat_SyS_preadv64+0x40/0x40 [ 71.462951] [] do_fast_syscall_32+0x2f1/0x860 [ 71.469079] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 71.475725] [] entry_SYSENTER_compat+0x90/0xa2 [ 71.482267] Dumping ftrace buffer: [ 71.485791] (ftrace buffer empty) [ 71.489476] Kernel Offset: disabled [ 71.493078] Rebooting in 86400 seconds..