forked to background, child pid 197 Starting sshd: OK syzkaller syzkaller login: [ 12.890843][ T23] kauditd_printk_skb: 60 callbacks suppressed [ 12.890856][ T23] audit: type=1400 audit(1637354053.910:71): avc: denied { transition } for pid=290 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.898468][ T23] audit: type=1400 audit(1637354053.930:72): avc: denied { write } for pid=290 comm="sh" path="pipe:[10871]" dev="pipefs" ino=10871 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1 [ 13.451081][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!! Warning: Permanently added '10.128.1.114' (ECDSA) to the list of known hosts. 2021/11/19 20:34:20 fuzzer started 2021/11/19 20:34:21 connecting to host at 10.128.0.163:43617 2021/11/19 20:34:21 checking machine... 2021/11/19 20:34:21 checking revisions... 2021/11/19 20:34:21 testing simple program... [ 20.138035][ T23] audit: type=1400 audit(1637354061.160:73): avc: denied { getattr } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 20.161217][ T371] cgroup: Unknown subsys name 'net' [ 20.162081][ T23] audit: type=1400 audit(1637354061.170:74): avc: denied { read } for pid=362 comm="syz-fuzzer" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 20.188615][ T23] audit: type=1400 audit(1637354061.170:75): avc: denied { open } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 20.188793][ T371] cgroup: Unknown subsys name 'devices' [ 20.212061][ T23] audit: type=1400 audit(1637354061.180:76): avc: denied { read } for pid=362 comm="syz-fuzzer" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 20.240374][ T23] audit: type=1400 audit(1637354061.180:77): avc: denied { open } for pid=362 comm="syz-fuzzer" path="/dev/raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 20.263608][ T23] audit: type=1400 audit(1637354061.180:78): avc: denied { mounton } for pid=371 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1136 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.286405][ T23] audit: type=1400 audit(1637354061.180:79): avc: denied { mount } for pid=371 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.309036][ T23] audit: type=1400 audit(1637354061.190:80): avc: denied { unmount } for pid=371 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.412802][ T371] cgroup: Unknown subsys name 'hugetlb' [ 20.418509][ T371] cgroup: Unknown subsys name 'rlimit' [ 20.482466][ T23] audit: type=1400 audit(1637354061.510:81): avc: denied { setattr } for pid=371 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 20.507125][ T23] audit: type=1400 audit(1637354061.540:82): avc: denied { execmem } for pid=373 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 20.586963][ T374] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.594338][ T374] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.601827][ T374] device bridge_slave_0 entered promiscuous mode [ 20.608855][ T374] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.616251][ T374] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.623688][ T374] device bridge_slave_1 entered promiscuous mode [ 20.655204][ T374] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.662256][ T374] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.669529][ T374] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.677104][ T374] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.696198][ T372] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.703495][ T372] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.710759][ T372] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 20.719111][ T372] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.728599][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.736850][ T39] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.743895][ T39] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.762046][ T372] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.770420][ T372] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.778722][ T372] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.785758][ T372] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.793095][ T372] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.802386][ T372] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.820884][ T372] ================================================================================ [ 20.830302][ T372] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:2023:28 [ 20.838117][ T372] member access within address ffffc90000a1f1c0 with insufficient space [ 20.846441][ T372] for an object of type 'struct sk_buff' [ 20.852089][ T372] CPU: 1 PID: 372 Comm: kworker/1:2 Not tainted 5.10.80-syzkaller-01801-g971945b72224 #0 [ 20.862069][ T372] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 20.872213][ T372] Workqueue: ipv6_addrconf addrconf_dad_work [ 20.878180][ T372] Call Trace: [ 20.881541][ T372] dump_stack_lvl+0x1e2/0x24b [ 20.886194][ T372] ? show_regs_print_info+0x18/0x18 [ 20.891376][ T372] ? wg_allowedips_lookup_dst+0x190/0x190 [ 20.897080][ T372] dump_stack+0x15/0x1d [ 20.901305][ T372] ubsan_type_mismatch_common+0x1ed/0x3a0 [ 20.907013][ T372] ? __sanitizer_cov_trace_switch+0x74/0x90 [ 20.912888][ T372] __ubsan_handle_type_mismatch_v1+0x5b/0x70 [ 20.918945][ T372] wg_xmit+0x4a2/0xae0 [ 20.923249][ T372] ? wg_stop+0x140/0x140 [ 20.927466][ T372] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20 [ 20.933696][ T372] netdev_start_xmit+0x8a/0x160 [ 20.938632][ T372] dev_hard_start_xmit+0x18d/0x2f0 [ 20.943804][ T372] __dev_queue_xmit+0xfbe/0x1bb0 [ 20.948874][ T372] ? __local_bh_enable_ip+0xa8/0x170 [ 20.954206][ T372] ? ndisc_mc_map+0x33d/0xa70 [ 20.958868][ T372] ? dev_queue_xmit+0x20/0x20 [ 20.963540][ T372] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 20.969849][ T372] ? ndisc_constructor+0x690/0x8a0 [ 20.974937][ T372] ? _raw_write_unlock_bh+0x31/0x47 [ 20.980111][ T372] ? ___neigh_create+0x162d/0x1ab0 [ 20.985218][ T372] ? dev_hard_header+0xdb/0xf0 [ 20.989986][ T372] dev_queue_xmit+0x17/0x20 [ 20.994524][ T372] neigh_connected_output+0x288/0x2b0 [ 20.999945][ T372] ip6_finish_output2+0xde2/0x1440 [ 21.005046][ T372] ? __rcu_read_lock+0x50/0x50 [ 21.009798][ T372] ? __ip6_finish_output+0x520/0x520 [ 21.015074][ T372] ? dst_cow_metrics_generic+0x55/0x1d0 [ 21.020609][ T372] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 21.026922][ T372] ? ip6_skb_dst_mtu+0xaf/0x260 [ 21.031757][ T372] __ip6_finish_output+0x3e4/0x520 [ 21.036844][ T372] ip6_finish_output+0x3f/0x220 [ 21.041668][ T372] ? ip6_output+0x1d3/0x4b0 [ 21.046249][ T372] ip6_output+0x1f8/0x4b0 [ 21.050555][ T372] ? asan.module_dtor+0x20/0x20 [ 21.055386][ T372] ? skb_dst+0x40/0x40 [ 21.059429][ T372] ? __rcu_read_lock+0x50/0x50 [ 21.064184][ T372] ? selinux_ipv6_forward+0x50/0x50 [ 21.069363][ T372] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 21.075151][ T372] ? nf_hook_slow+0x150/0x1b0 [ 21.079803][ T372] NF_HOOK+0xdd/0x280 [ 21.083871][ T372] ? addrconf_addr_solict_mult+0xe0/0xe0 [ 21.089573][ T372] ? NF_HOOK+0x280/0x280 [ 21.093795][ T372] ? __rcu_read_lock+0x50/0x50 [ 21.098533][ T372] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 21.104767][ T372] ? ndisc_send_skb+0x547/0x9f0 [ 21.109687][ T372] ? memcpy+0x56/0x70 [ 21.113643][ T372] ndisc_send_skb+0x646/0x9f0 [ 21.118390][ T372] ? slab_post_alloc_hook+0x90/0xa0 [ 21.123586][ T372] ? ndisc_fill_addr_option+0x2f0/0x2f0 [ 21.129215][ T372] ? skb_set_owner_w+0x1a8/0x310 [ 21.134666][ T372] ? __sanitizer_cov_trace_cmp4+0x19/0x20 [ 21.140369][ T372] ? skb_put+0x11d/0x200 [ 21.144896][ T372] ndisc_send_rs+0x26c/0x360 [ 21.149672][ T372] addrconf_dad_completed+0x4f3/0x9f0 [ 21.155060][ T372] ? addrconf_dad_stop+0x430/0x430 [ 21.160169][ T372] addrconf_dad_work+0x9c1/0x1520 [ 21.165193][ T372] ? move_linked_works+0x118/0x130 [ 21.170292][ T372] ? ipv6_use_optimistic_addr+0x1d0/0x1d0 [ 21.175995][ T372] ? __kasan_check_write+0x14/0x20 [ 21.181207][ T372] process_one_work+0x3ca/0x660 [ 21.186045][ T372] worker_thread+0x709/0xa20 [ 21.190618][ T372] ? __kthread_parkme+0x11b/0x150 [ 21.195715][ T372] kthread+0x371/0x390 [ 21.199757][ T372] ? pr_cont_work+0x110/0x110 [ 21.204628][ T372] ? __list_add+0xc0/0xc0 [ 21.208977][ T372] ret_from_fork+0x1f/0x30 [ 21.213437][ T372] ================================================================================ [ 21.222757][ T372] ================================================================================ [ 21.232065][ T372] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:1916:2 [ 21.239771][ T372] member access within address ffffc90000a1f1c0 with insufficient space [ 21.248200][ T372] for an object of type 'struct sk_buff' [ 21.253926][ T372] CPU: 1 PID: 372 Comm: kworker/1:2 Not tainted 5.10.80-syzkaller-01801-g971945b72224 #0 [ 21.263716][ T372] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 21.273771][ T372] Workqueue: ipv6_addrconf addrconf_dad_work [ 21.279825][ T372] Call Trace: [ 21.283103][ T372] dump_stack_lvl+0x1e2/0x24b [ 21.287759][ T372] ? show_regs_print_info+0x18/0x18 [ 21.292935][ T372] ? wg_allowedips_lookup_dst+0x190/0x190 [ 21.298631][ T372] dump_stack+0x15/0x1d [ 21.302763][ T372] ubsan_type_mismatch_common+0x1ed/0x3a0 [ 21.308462][ T372] __ubsan_handle_type_mismatch_v1+0x5b/0x70 [ 21.314599][ T372] wg_xmit+0x513/0xae0 [ 21.318644][ T372] ? wg_stop+0x140/0x140 [ 21.323125][ T372] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20 [ 21.329354][ T372] netdev_start_xmit+0x8a/0x160 [ 21.334205][ T372] dev_hard_start_xmit+0x18d/0x2f0 [ 21.339301][ T372] __dev_queue_xmit+0xfbe/0x1bb0 [ 21.344222][ T372] ? __local_bh_enable_ip+0xa8/0x170 [ 21.349504][ T372] ? ndisc_mc_map+0x33d/0xa70 [ 21.354153][ T372] ? dev_queue_xmit+0x20/0x20 [ 21.358806][ T372] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 21.365113][ T372] ? ndisc_constructor+0x690/0x8a0 [ 21.370208][ T372] ? _raw_write_unlock_bh+0x31/0x47 [ 21.375483][ T372] ? ___neigh_create+0x162d/0x1ab0 [ 21.380578][ T372] ? dev_hard_header+0xdb/0xf0 [ 21.385333][ T372] dev_queue_xmit+0x17/0x20 [ 21.389822][ T372] neigh_connected_output+0x288/0x2b0 [ 21.395176][ T372] ip6_finish_output2+0xde2/0x1440 [ 21.400268][ T372] ? __rcu_read_lock+0x50/0x50 [ 21.405008][ T372] ? __ip6_finish_output+0x520/0x520 [ 21.410276][ T372] ? dst_cow_metrics_generic+0x55/0x1d0 [ 21.415798][ T372] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 21.422013][ T372] ? ip6_skb_dst_mtu+0xaf/0x260 [ 21.427099][ T372] __ip6_finish_output+0x3e4/0x520 [ 21.432449][ T372] ip6_finish_output+0x3f/0x220 [ 21.437881][ T372] ? ip6_output+0x1d3/0x4b0 [ 21.442543][ T372] ip6_output+0x1f8/0x4b0 [ 21.446849][ T372] ? asan.module_dtor+0x20/0x20 [ 21.451686][ T372] ? skb_dst+0x40/0x40 [ 21.455828][ T372] ? __rcu_read_lock+0x50/0x50 [ 21.460570][ T372] ? selinux_ipv6_forward+0x50/0x50 [ 21.465744][ T372] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 21.471447][ T372] ? nf_hook_slow+0x150/0x1b0 [ 21.476100][ T372] NF_HOOK+0xdd/0x280 [ 21.480076][ T372] ? addrconf_addr_solict_mult+0xe0/0xe0 [ 21.485692][ T372] ? NF_HOOK+0x280/0x280 [ 21.489927][ T372] ? __rcu_read_lock+0x50/0x50 [ 21.494691][ T372] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 21.501282][ T372] ? ndisc_send_skb+0x547/0x9f0 [ 21.506123][ T372] ? memcpy+0x56/0x70 [ 21.510093][ T372] ndisc_send_skb+0x646/0x9f0 [ 21.514753][ T372] ? slab_post_alloc_hook+0x90/0xa0 [ 21.520377][ T372] ? ndisc_fill_addr_option+0x2f0/0x2f0 [ 21.526114][ T372] ? skb_set_owner_w+0x1a8/0x310 [ 21.531298][ T372] ? __sanitizer_cov_trace_cmp4+0x19/0x20 [ 21.536999][ T372] ? skb_put+0x11d/0x200 [ 21.541228][ T372] ndisc_send_rs+0x26c/0x360 [ 21.545804][ T372] addrconf_dad_completed+0x4f3/0x9f0 [ 21.551164][ T372] ? addrconf_dad_stop+0x430/0x430 [ 21.556253][ T372] addrconf_dad_work+0x9c1/0x1520 [ 21.561346][ T372] ? move_linked_works+0x118/0x130 [ 21.566438][ T372] ? ipv6_use_optimistic_addr+0x1d0/0x1d0 [ 21.572136][ T372] ? __kasan_check_write+0x14/0x20 [ 21.577225][ T372] process_one_work+0x3ca/0x660 [ 21.582053][ T372] worker_thread+0x709/0xa20 [ 21.586635][ T372] ? __kthread_parkme+0x11b/0x150 [ 21.591647][ T372] kthread+0x371/0x390 [ 21.595695][ T372] ? pr_cont_work+0x110/0x110 [ 21.600348][ T372] ? __list_add+0xc0/0xc0 [ 21.604831][ T372] ret_from_fork+0x1f/0x30 [ 21.609282][ T372] ================================================================================ 2021/11/19 20:34:22 building call list... [ 21.620322][ T19] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.629089][ T19] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.637884][ T19] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.647349][ T19] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.663159][ T374] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 22.261345][ T9] device bridge_slave_1 left promiscuous mode [ 22.267616][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.275503][ T9] device bridge_slave_0 left promiscuous mode [ 22.281756][ T9] bridge0: port 1(bridge_slave_0) entered disabled state