[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 16.029283] random: sshd: uninitialized urandom read (32 bytes read, 32 bits of entropy available) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 20.251063] random: sshd: uninitialized urandom read (32 bytes read, 38 bits of entropy available) [ 20.476522] random: sshd: uninitialized urandom read (32 bytes read, 38 bits of entropy available) [ 21.275303] random: sshd: uninitialized urandom read (32 bytes read, 96 bits of entropy available) [ 21.435878] random: sshd: uninitialized urandom read (32 bytes read, 100 bits of entropy available) Warning: Permanently added '10.128.0.44' (ECDSA) to the list of known hosts. [ 26.782501] random: sshd: uninitialized urandom read (32 bytes read, 105 bits of entropy available) 2018/01/02 09:39:10 parsed 1 programs 2018/01/02 09:39:10 executed programs: 0 [ 27.043515] IPVS: Creating netns size=2552 id=1 [ 27.070743] IPVS: Creating netns size=2552 id=2 [ 27.098148] IPVS: Creating netns size=2552 id=3 [ 27.131953] audit: type=1400 audit(1514885950.422:5): avc: denied { set_context_mgr } for pid=3344 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 27.136840] audit: type=1400 audit(1514885950.422:6): avc: denied { call } for pid=3347 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 27.148408] binder: send failed reply for transaction 2 to 3347:3348 [ 27.166657] binder: 3347:3348 transaction failed 29189/-22, size 0-0 line 3005 [ 27.177740] binder: undelivered TRANSACTION_COMPLETE [ 27.177756] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.177759] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.202332] binder: send failed reply for transaction 5 to 3353:3354 [ 27.221005] IPVS: Creating netns size=2552 id=4 [ 27.222467] binder: BINDER_SET_CONTEXT_MGR already set [ 27.222473] binder: 3344:3351 ioctl 40046207 0 returned -16 [ 27.222634] binder_alloc: binder_alloc_mmap_handler: 3344 20000000-20002000 already mapped failed -16 [ 27.224170] binder_alloc: 3344: binder_alloc_buf, no vma [ 27.224211] binder: 3344:3345 transaction failed 29189/-3, size 0-0 line 3128 [ 27.226473] binder: 3353:3354 transaction failed 29189/-22, size 0-0 line 3005 [ 27.234522] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.239479] binder: undelivered TRANSACTION_COMPLETE [ 27.239493] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.239495] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.243265] binder: send failed reply for transaction 10 to 3357:3358 [ 27.258828] binder: 3357:3358 transaction failed 29189/-22, size 0-0 line 3005 [ 27.263393] binder: send failed reply for transaction 13 to 3359:3361 [ 27.275833] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.275864] binder: undelivered TRANSACTION_COMPLETE [ 27.275877] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.292431] binder: send failed reply for transaction 15 to 3364:3365 [ 27.305721] binder: undelivered TRANSACTION_COMPLETE [ 27.305735] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.311452] binder: release 3364:3365 transaction 17 out, still active [ 27.311456] binder: undelivered TRANSACTION_COMPLETE [ 27.311499] binder: undelivered TRANSACTION_COMPLETE [ 27.311512] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.317530] binder: send failed reply for transaction 17, target dead [ 27.324423] binder: send failed reply for transaction 19 to 3363:3367 [ 27.347632] binder: 3363:3367 transaction failed 29189/-22, size 0-0 line 3005 [ 27.352344] binder: send failed reply for transaction 21 to 3368:3370 [ 27.356786] binder: send failed reply for transaction 24 to 3369:3372 [ 27.364158] binder: undelivered TRANSACTION_COMPLETE [ 27.364172] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.364175] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.377707] binder: release 3368:3370 transaction 26 out, still active [ 27.377710] binder: undelivered TRANSACTION_COMPLETE [ 27.377752] binder: undelivered TRANSACTION_COMPLETE [ 27.377765] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.380703] binder: 3369:3372 transaction failed 29189/-22, size 0-0 line 3005 [ 27.383479] binder: send failed reply for transaction 26, target dead [ 27.395092] binder: undelivered TRANSACTION_COMPLETE [ 27.395106] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.395109] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.398467] binder: send failed reply for transaction 29 to 3374:3376 [ 27.415962] binder: 3374:3376 transaction failed 29189/-22, size 0-0 line 3005 [ 27.426453] binder: undelivered TRANSACTION_COMPLETE [ 27.426468] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.426471] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.433268] binder: send failed reply for transaction 32 to 3377:3379 [ 27.437028] binder: send failed reply for transaction 34 to 3378:3381 [ 27.454929] binder: 3377:3379 transaction failed 29189/-22, size 0-0 line 3005 [ 27.458914] binder: send failed reply for transaction 37 to 3382:3384 [ 27.468116] binder: undelivered TRANSACTION_COMPLETE [ 27.468130] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.468133] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.473942] binder: 3378:3381 transaction failed 29189/-22, size 0-0 line 3005 [ 27.482494] binder: 3382:3384 transaction failed 29189/-22, size 0-0 line 3005 [ 27.487848] binder: undelivered TRANSACTION_COMPLETE [ 27.487862] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.487865] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.489783] binder: send failed reply for transaction 40 to 3387:3388 [ 27.496414] binder: undelivered TRANSACTION_COMPLETE [ 27.496427] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.496430] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.504831] binder: 3387:3388 transaction failed 29189/-22, size 0-0 line 3005 [ 27.515251] binder: undelivered TRANSACTION_COMPLETE [ 27.515266] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.515268] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.642105] IPVS: Creating netns size=2552 id=5 [ 27.669842] IPVS: Creating netns size=2552 id=6 [ 27.680546] binder: send failed reply for transaction 44 to 3394:3395 [ 27.704966] binder: 3394:3395 transaction failed 29189/-22, size 0-0 line 3005 [ 27.705335] IPVS: Creating netns size=2552 id=7 [ 27.726999] binder: send failed reply for transaction 47 to 3399:3400 [ 27.740568] binder: undelivered TRANSACTION_COMPLETE [ 27.745985] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.754975] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.763312] binder: 3399:3400 transaction failed 29189/-22, size 0-0 line 3005 [ 27.776276] IPVS: Creating netns size=2552 id=8 [ 27.777752] binder: send failed reply for transaction 50 to 3404:3406 [ 27.783001] binder: undelivered TRANSACTION_COMPLETE [ 27.783016] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.783018] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.801292] binder: send failed reply for transaction 54 to 3408:3409 [ 27.808813] binder: send failed reply for transaction 52 to 3404:3406 [ 27.814946] binder: undelivered TRANSACTION_COMPLETE [ 27.814960] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.814992] binder: undelivered TRANSACTION_COMPLETE [ 27.815005] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.834092] binder: send failed reply for transaction 56 to 3411:3414 [ 27.841043] binder: send failed reply for transaction 58 to 3412:3415 [ 27.864676] binder: release 3411:3414 transaction 60 out, still active [ 27.888927] binder: undelivered TRANSACTION_COMPLETE [ 27.894167] binder: send failed reply for transaction 60, target dead [ 27.901932] binder: send failed reply for transaction 66 to 3410:3420 [ 27.909216] binder: release 3412:3415 transaction 64 out, still active [ 27.916455] binder: undelivered TRANSACTION_COMPLETE [ 27.921025] binder: BINDER_SET_CONTEXT_MGR already set [ 27.921031] binder: 3421:3422 ioctl 40046207 0 returned -16 [ 27.921157] binder_alloc: 3408: binder_alloc_buf, no vma [ 27.921198] binder: 3421:3422 transaction failed 29189/-3, size 0-0 line 3128 [ 27.945662] binder: send failed reply for transaction 70 to 3423:3424 [ 27.952469] binder: undelivered TRANSACTION_COMPLETE [ 27.957039] binder: 3423:3424 transaction failed 29189/-22, size 0-0 line 3005 [ 27.965044] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.970587] binder: undelivered TRANSACTION_COMPLETE [ 27.975694] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.981204] binder: undelivered TRANSACTION_ERROR: 29189 [ 28.006555] binder: undelivered TRANSACTION_ERROR: 29189 [ 28.021059] binder: BINDER_SET_CONTEXT_MGR already set [ 28.031014] binder: send failed reply for transaction 77 to 3431:3437 [ 28.032327] binder: BINDER_SET_CONTEXT_MGR already set [ 28.032333] binder: 3432:3435 ioctl 40046207 0 returned -16 [ 28.032467] binder_alloc: 3410: binder_alloc_buf, no vma [ 28.032507] binder: 3432:3435 transaction failed 29189/-3, size 0-0 line 3128 [ 28.048423] binder: 3430:3438 ioctl 40046207 0 returned -16 [ 28.063443] binder: 3428:3439 got new transaction with bad transaction stack, transaction 80 has target 3428:0 [ 28.063454] binder: 3428:3439 transaction failed 29201/-71, size 0-0 line 3032 [ 28.065564] binder: 3433:3440 got new transaction with bad transaction stack, transaction 82 has target 3433:0 [ 28.065573] binder: 3433:3440 transaction failed 29201/-71, size 0-0 line 3032 [ 28.089980] binder_alloc: 3410: binder_alloc_buf, no vma [ 28.090021] binder: 3432:3435 transaction failed 29189/-3, size 0-0 line 3128 [ 28.092892] binder: 3427:3434 got new transaction with bad transaction stack, transaction 73 has target 3427:0 [ 28.092901] binder: 3427:3434 transaction failed 29201/-71, size 0-0 line 3032 [ 28.142720] binder: BINDER_SET_CONTEXT_MGR already set [ 28.144209] binder_alloc: 3412: binder_alloc_buf, no vma [ 28.144253] binder: 3430:3438 transaction failed 29189/-3, size 0-0 line 3128 [ 28.162797] binder: BINDER_SET_CONTEXT_MGR already set [ 28.163502] binder: BINDER_SET_CONTEXT_MGR already set [ 28.163508] binder: 3442:3444 ioctl 40046207 0 returned -16 [ 28.163643] binder_alloc: 3408: binder_alloc_buf, no vma [ 28.163684] binder: 3442:3444 transaction failed 29189/-3, size 0-0 line 3128 [ 28.172057] binder: BINDER_SET_CONTEXT_MGR already set [ 28.172063] binder: 3461:3463 ioctl 40046207 0 returned -16 [ 28.172197] binder_alloc: 3412: binder_alloc_buf, no vma [ 28.172238] binder: 3461:3463 transaction failed 29189/-3, size 0-0 line 3128 [ 28.175695] binder: 3454:3456 ioctl 40046207 0 returned -16 [ 28.185541] binder: undelivered TRANSACTION_ERROR: 29189 [ 28.185577] binder: release 3429:3436 transaction 75 out, still active [ 28.185579] binder: undelivered TRANSACTION_COMPLETE [ 28.185705] binder: undelivered TRANSACTION_ERROR: 29189 [ 28.185736] binder: undelivered TRANSACTION_ERROR: 29189 [ 28.185770] binder: release 3427:3434 transaction 73 out, still active [ 28.185773] binder: undelivered TRANSACTION_COMPLETE [ 28.185785] binder: undelivered TRANSACTION_ERROR: 29201 [ 28.185866] binder: release 3433:3440 transaction 82 out, still active [ 28.185868] binder: undelivered TRANSACTION_COMPLETE [ 28.185881] binder: undelivered TRANSACTION_ERROR: 29201 [ 28.214569] binder_alloc: 3433: binder_alloc_buf, no vma [ 28.214611] binder: 3454:3456 transaction failed 29189/-3, size 0-0 line 3128 [ 28.215600] binder: BINDER_SET_CONTEXT_MGR already set [ 28.215606] binder: 3457:3462 ioctl 40046207 0 returned -16 [ 28.215723] binder_alloc: 3410: binder_alloc_buf, no vma [ 28.215761] binder: 3457:3462 transaction failed 29189/-3, size 0-0 line 3128 [ 28.247144] binder: BINDER_SET_CONTEXT_MGR already set [ 28.247150] binder: 3457:3462 ioctl 40046207 0 returned -16 [ 28.247303] binder_alloc: 3410: binder_alloc_buf, no vma [ 28.247345] binder: 3457:3462 transaction failed 29189/-3, size 0-0 line 3128 [ 28.282605] binder: BINDER_SET_CONTEXT_MGR already set [ 28.282612] binder: 3459:3469 ioctl 40046207 0 returned -16 [ 28.286710] binder_alloc: 3427: binder_alloc_buf, no vma [ 28.286751] binder: 3459:3469 transaction failed 29189/-3, size 0-0 line 3128 [ 28.308939] binder: BINDER_SET_CONTEXT_MGR already set [ 28.308946] binder: 3473:3477 ioctl 40046207 0 returned -16 [ 28.309081] binder_alloc: 3408: binder_alloc_buf, no vma [ 28.309126] binder: 3473:3477 transaction failed 29189/-3, size 0-0 line 3128 [ 28.310638] binder: BINDER_SET_CONTEXT_MGR already set [ 28.310643] binder: 3474:3478 ioctl 40046207 0 returned -16 [ 28.310874] binder_alloc: 3412: binder_alloc_buf, no vma [ 28.310912] binder: 3474:3478 transaction failed 29189/-3, size 0-0 line 3128 [ 28.323299] binder: BINDER_SET_CONTEXT_MGR already set [ 28.323306] binder: 3475:3476 ioctl 40046207 0 returned -16 [ 28.323433] binder_alloc: 3410: binder_alloc_buf, no vma [ 28.323473] binder: 3475:3476 transaction failed 29189/-3, size 0-0 line 3128 [ 28.387171] binder: BINDER_SET_CONTEXT_MGR already set [ 28.387177] binder: 3460:3483 ioctl 40046207 0 returned -16 [ 28.387310] binder_alloc: 3429: binder_alloc_buf, no vma [ 28.387350] binder: 3460:3483 transaction failed 29189/-3, size 0-0 line 3128 [ 28.402116] binder: BINDER_SET_CONTEXT_MGR already set [ 28.402122] binder: 3472:3484 ioctl 40046207 0 returned -16 [ 28.402377] binder_alloc: 3433: binder_alloc_buf, no vma [ 28.402423] binder: 3472:3484 transaction failed 29189/-3, size 0-0 line 3128 [ 28.459547] binder: BINDER_SET_CONTEXT_MGR already set [ 28.459553] binder: 3486:3492 ioctl 40046207 0 returned -16 [ 28.459961] binder_alloc: 3427: binder_alloc_buf, no vma [ 28.460001] binder: 3486:3492 transaction failed 29189/-3, size 0-0 line 3128 [ 28.461085] binder: BINDER_SET_CONTEXT_MGR already set [ 28.461091] binder: 3487:3493 ioctl 40046207 0 returned -16 [ 28.461393] binder_alloc: 3412: binder_alloc_buf, no vma [ 28.461434] binder: 3487:3493 transaction failed 29189/-3, size 0-0 line 3128 [ 28.470963] binder: BINDER_SET_CONTEXT_MGR already set [ 28.470968] binder: 3489:3494 ioctl 40046207 0 returned -16 [ 28.471102] binder_alloc: 3410: binder_alloc_buf, no vma [ 28.471141] binder: 3489:3494 transaction failed 29189/-3, size 0-0 line 3128 [ 28.476259] binder: BINDER_SET_CONTEXT_MGR already set [ 28.476265] binder: 3490:3496 ioctl 40046207 0 returned -16 [ 28.476393] binder_alloc: 3408: binder_alloc_buf, no vma [ 28.476448] binder: 3490:3496 transaction failed 29189/-3, size 0-0 line 3128 [ 28.481658] binder: BINDER_SET_CONTEXT_MGR already set [ 28.481664] binder: 3491:3495 ioctl 40046207 0 returned -16 [ 28.481794] binder_alloc: 3431: binder_alloc_buf, no vma [ 28.481832] binder: 3491:3495 transaction failed 29189/-3, size 0-0 line 3128 [ 28.521779] binder: BINDER_SET_CONTEXT_MGR already set [ 28.521786] binder: 3497:3503 ioctl 40046207 0 returned -16 [ 28.521923] binder_alloc: 3429: binder_alloc_buf, no vma [ 28.521964] binder: 3497:3503 transaction failed 29189/-3, size 0-0 line 3128 [ 28.538884] binder: BINDER_SET_CONTEXT_MGR already set [ 28.538890] binder: 3491:3495 ioctl 40046207 0 returned -16 [ 28.539834] binder_alloc: 3431: binder_alloc_buf, no vma [ 28.539877] binder: 3491:3495 transaction failed 29189/-3, size 0-0 line 3128 [ 28.654370] binder_alloc: 3428: binder_alloc_buf, no vma [ 28.654400] binder: undelivered TRANSACTION_ERROR: 29189 [ 28.654461] binder: undelivered TRANSACTION_ERROR: 29189 [ 28.654494] binder: undelivered TRANSACTION_ERROR: 29189 [ 28.654526] binder: undelivered TRANSACTION_ERROR: 29189 [ 28.654619] binder: undelivered TRANSACTION_ERROR: 29189 [ 28.654667] binder: undelivered TRANSACTION_ERROR: 29189 [ 28.654714] binder: undelivered TRANSACTION_ERROR: 29189 [ 28.655984] binder: undelivered TRANSACTION_ERROR: 29189 [ 28.656031] binder: undelivered TRANSACTION_ERROR: 29189 [ 28.656302] binder: send failed reply for transaction 99 to 3431:3437 [ 28.656305] ------------[ cut here ]------------ [ 28.656323] WARNING: CPU: 1 PID: 1315 at drivers/android/binder.c:2152 binder_send_failed_reply+0x147/0x3a0() [ 28.656325] Unexpected reply error: 29189 [ 28.656470] Kernel panic - not syncing: panic_on_warn set ... [ 28.656470] [ 28.656477] CPU: 1 PID: 1315 Comm: kworker/u4:3 Not tainted 4.4.107-g610c835 #4 [ 28.656481] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 28.656491] Workqueue: binder binder_deferred_func [ 28.656500] 0000000000000000 9948d37cdb4690f0 ffff8801d508f910 ffffffff81d0457d [ 28.656507] ffffffff838429a0 ffff8801d508f9e8 ffffffff83c74a40 0000000000000009 [ 28.656514] 0000000000000868 ffff8801d508f9d8 ffffffff8141774a 0000000041b58ab3 [ 28.656516] Call Trace: [ 28.656527] [] dump_stack+0xc1/0x124 [ 28.656537] [] panic+0x1aa/0x388 [ 28.656544] [] ? percpu_up_read.constprop.45+0xe1/0xe1 [ 28.656553] [] ? warn_slowpath_common+0x10a/0x140 [ 28.656558] [] warn_slowpath_common+0x125/0x140 [ 28.656565] [] ? binder_send_failed_reply+0x147/0x3a0 [ 28.656570] [] warn_slowpath_fmt+0xc1/0x110 [ 28.656576] [] ? warn_slowpath_common+0x140/0x140 [ 28.656583] [] ? _binder_inner_proc_lock+0x2c/0x50 [ 28.656589] [] binder_send_failed_reply+0x147/0x3a0 [ 28.656595] [] binder_cleanup_transaction+0xd2/0x140 [ 28.656601] [] binder_release_work+0x192/0x260 [ 28.656609] [] ? _raw_spin_unlock+0x2c/0x50 [ 28.656615] [] binder_deferred_func+0x9aa/0xd10 [ 28.656623] [] ? __lock_is_held+0xa1/0xf0 [ 28.656631] [] process_one_work+0x7d7/0x16e0 [ 28.656636] [] ? process_one_work+0x6f7/0x16e0 [ 28.656643] [] ? pwq_dec_nr_in_flight+0x280/0x280 [ 28.656648] [] ? worker_thread+0x284/0xfe0 [ 28.656654] [] worker_thread+0xdf/0xfe0 [ 28.656661] [] ? __schedule+0xa99/0x1c70 [ 28.656667] [] ? preempt_schedule+0x24/0x30 [ 28.656674] [] ? ___preempt_schedule+0x12/0x14 [ 28.656680] [] kthread+0x268/0x300 [ 28.656686] [] ? process_one_work+0x16e0/0x16e0 [ 28.656692] [] ? kthread_create_on_node+0x400/0x400 [ 28.656699] [] ? kthread_create_on_node+0x400/0x400 [ 28.656705] [] ret_from_fork+0x3f/0x70 [ 28.656712] [] ? kthread_create_on_node+0x400/0x400 [ 28.660235] Dumping ftrace buffer: [ 28.660266] (ftrace buffer empty) [ 28.660269] Kernel Offset: disabled [ 28.976827] Rebooting in 86400 seconds..