[ 50.962145][ T26] audit: type=1800 audit(1573488017.226:27): pid=7840 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2469 res=0 [ 50.984084][ T26] audit: type=1800 audit(1573488017.226:28): pid=7840 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2450 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 51.561802][ T26] audit: type=1800 audit(1573488017.906:29): pid=7840 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2465 res=0 [ 51.585325][ T26] audit: type=1800 audit(1573488017.906:30): pid=7840 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2456 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.15.218' (ECDSA) to the list of known hosts. 2019/11/11 16:00:29 fuzzer started 2019/11/11 16:00:30 dialing manager at 10.128.0.105:44241 2019/11/11 16:00:30 syscalls: 2566 2019/11/11 16:00:30 code coverage: enabled 2019/11/11 16:00:30 comparison tracing: enabled 2019/11/11 16:00:30 extra coverage: extra coverage is not supported by the kernel 2019/11/11 16:00:30 setuid sandbox: enabled 2019/11/11 16:00:30 namespace sandbox: enabled 2019/11/11 16:00:30 Android sandbox: /sys/fs/selinux/policy does not exist 2019/11/11 16:00:30 fault injection: enabled 2019/11/11 16:00:30 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/11/11 16:00:30 net packet injection: enabled 2019/11/11 16:00:30 net device setup: enabled 2019/11/11 16:00:30 concurrency sanitizer: enabled 2019/11/11 16:00:30 devlink PCI setup: PCI device 0000:00:10.0 is not available 2019/11/11 16:00:31 adding functions to KCSAN blacklist: 'tick_do_update_jiffies64' 'tomoyo_supervisor' 'tcp_add_backlog' 'find_get_pages_range_tag' 'generic_write_end' 'pid_update_inode' '__hrtimer_run_queues' 16:00:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = socket$inet6(0xa, 0x4000000000000002, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x80000000000014}, 0x1c) sendmmsg(r1, &(0x7f00000089c0)=[{{&(0x7f0000000440)=@in={0x2, 0x4e24, @multicast2=0xe0000363}, 0x80, 0x0}}], 0x400000000000105, 0x0) syzkaller login: [ 67.876241][ T8012] IPVS: ftp: loaded support on port[0] = 21 16:00:34 executing program 1: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fstat(0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f00000000c0)=@ipx, 0x80, 0x0}}], 0x3fffffffffffe7e, 0x0, 0x0) setuid(0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='fd/3\x00\x02\x17\x87:\xf4\x03\xdfc\x88,5I\xd7^\xb5D\xf7\xd7\xdb,(\x03\x00\xc2\x06MG\xcd\xe9w\xe5s\x02\xf2\xea\xb6\xabsp\x12xT8\x01\x00\xd4S\xd8F\xab.x|\x8b\x87\xb0\xa2\xf5Y>\xb1 p\x998(\xe63\xcf\x7f\xac\x89F\x03n\x96\x15zsw\x98\xca\xcb3\xb6M=h\x01i.\xa3\xda}\x190~\xe7d6\xa5\x17\xb3\xe9\xd9QV\x0f\xf3\x02\xd6\xc1\xc3n\xcd*R\x9a\x95\x12\x05K\xa0<\xc9\xe3\xed\xab\xc9\x8bK\xb3\x86\xe2\x93f\x92iKA|e\x97k :,J36\x11\xf0\x99\x96\xb7]\xfd\xe3\v\xd8\x98\xc5o\xc6\xde\x80\xf7_\xc9\x8f\xaf\xf9\xd5\xb7ui\xea\xde\xd0\xeb\xd9\xf5_\v\xe2*\xa3\xf4\xab?n\xcb\x19i\x80\x91\xd2\xf6\x14\xfe!!0\x84L\x86\x81\x95,B\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\xab*[\xa5\xb217\x93\xf3\x88\x92\xa6\xde\x11\xa2-J\x9d\xc9\xb2\x97\xa3\x88v\x9eR\x155\xc7N!\xdb\"8\xc8I\xb9c\xed\xa7!\t\x85s\xb1\xa5\xa7R2Yf\x1c\xf8\xc2z>\xb1\x9c\x02a\x87\xe9\xb8\xf8\xdcv\xb6\xe4\xa6\n\x0e\x83lM7\xcc?\xea\x19\x99\xce\x1c\x10\xd2lQ(\xc7\xe9\xef\xd2Q\vY\xf58\x10|8}uE\xaf\xb4w;\xbc\xe4\x01\xd8\xf2\xf9u\xc1Dt\'\x84\xb5\xa4\x83\xeft\xfc\xf3\t\x870xffffffffffffffff, 0xffffffffffffffff}) openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ptmx\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) write(r1, &(0x7f00000001c0), 0xfffffef3) fsetxattr$security_smack_transmute(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2) r2 = socket(0x100000000011, 0x2, 0x0) getsockname$packet(r2, &(0x7f0000000040), &(0x7f00000001c0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000300)={{{@in=@multicast2, @in=@dev}}, {{@in6=@mcast2}, 0x0, @in6=@dev}}, &(0x7f0000000080)=0xe8) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 16:00:52 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x223e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xf98}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') writev(r1, &(0x7f0000000b40)=[{&(0x7f0000000380)="08d6bc530decf5942209871f8a0fb5b31caf9a6b8747459aac5cb0813503118438f8fa3bda12d3694bacd4eb96759af94badf70865f2729669ba19223f9e3dc873640a56526e1113ddddf492c61ba7bd6635b9ee9b551538c0dacb7c7c34f5f883a564f08bea212685f386db2d8cbdcbbf1613100d0e932bbed5ac3b0a8ec0d4b95590b6bf897de4b3", 0x89}], 0x1) [ 86.485615][ T7979] ================================================================== [ 86.493815][ T7979] BUG: KCSAN: data-race in generic_permission / kernfs_refresh_inode [ 86.501892][ T7979] [ 86.504240][ T7979] write to 0xffff888125719788 of 2 bytes by task 7980 on cpu 1: [ 86.511910][ T7979] kernfs_refresh_inode+0x42/0x140 [ 86.517036][ T7979] kernfs_iop_permission+0x66/0xa0 [ 86.522170][ T7979] inode_permission+0x241/0x3c0 [ 86.527046][ T7979] link_path_walk.part.0+0x622/0xa90 [ 86.532339][ T7979] path_openat+0x14f/0x36e0 [ 86.536848][ T7979] do_filp_open+0x11e/0x1b0 [ 86.541361][ T7979] do_sys_open+0x3b3/0x4f0 [ 86.545787][ T7979] __x64_sys_open+0x55/0x70 [ 86.550304][ T7979] do_syscall_64+0xcc/0x370 [ 86.554820][ T7979] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 86.560714][ T7979] [ 86.563049][ T7979] read to 0xffff888125719788 of 2 bytes by task 7979 on cpu 0: [ 86.570603][ T7979] generic_permission+0x36/0x3d0 [ 86.575567][ T7979] kernfs_iop_permission+0x7d/0xa0 [ 86.580696][ T7979] inode_permission+0x241/0x3c0 [ 86.585570][ T7979] link_path_walk.part.0+0x622/0xa90 [ 86.590873][ T7979] path_lookupat.isra.0+0x77/0x5a0 [ 86.595997][ T7979] filename_lookup+0x145/0x2b0 [ 86.600786][ T7979] user_path_at_empty+0x4c/0x70 [ 86.605653][ T7979] do_readlinkat+0x84/0x220 [ 86.610178][ T7979] __x64_sys_readlink+0x51/0x70 [ 86.615054][ T7979] do_syscall_64+0xcc/0x370 [ 86.619581][ T7979] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 86.625478][ T7979] [ 86.627808][ T7979] Reported by Kernel Concurrency Sanitizer on: [ 86.633983][ T7979] CPU: 0 PID: 7979 Comm: udevd Not tainted 5.4.0-rc6+ #0 [ 86.641020][ T7979] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 86.651089][ T7979] ================================================================== [ 86.659190][ T7979] Kernel panic - not syncing: panic_on_warn set ... [ 86.665801][ T7979] CPU: 0 PID: 7979 Comm: udevd Not tainted 5.4.0-rc6+ #0 [ 86.672828][ T7979] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 86.682893][ T7979] Call Trace: [ 86.686208][ T7979] dump_stack+0xf5/0x159 [ 86.690467][ T7979] panic+0x210/0x640 [ 86.694384][ T7979] ? vprintk_func+0x8d/0x140 [ 86.699019][ T7979] kcsan_report.cold+0xc/0xe [ 86.703640][ T7979] kcsan_setup_watchpoint+0x3fe/0x410 [ 86.709036][ T7979] __tsan_read2+0x145/0x1f0 [ 86.713678][ T7979] generic_permission+0x36/0x3d0 [ 86.718655][ T7979] kernfs_iop_permission+0x7d/0xa0 [ 86.723793][ T7979] ? kernfs_iop_getattr+0x90/0x90 [ 86.728839][ T7979] inode_permission+0x241/0x3c0 [ 86.733718][ T7979] link_path_walk.part.0+0x622/0xa90 [ 86.739044][ T7979] path_lookupat.isra.0+0x77/0x5a0 [ 86.744182][ T7979] ? __rcu_read_unlock+0x66/0x3c0 [ 86.749247][ T7979] ? __read_once_size.constprop.0+0x12/0x20 [ 86.755261][ T7979] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 86.764761][ T7979] filename_lookup+0x145/0x2b0 [ 86.769564][ T7979] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 86.775832][ T7979] ? strncpy_from_user+0x219/0x2b0 [ 86.781007][ T7979] ? getname_flags+0x1a4/0x380 [ 86.785783][ T7979] user_path_at_empty+0x4c/0x70 [ 86.790646][ T7979] do_readlinkat+0x84/0x220 [ 86.795181][ T7979] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 86.801450][ T7979] __x64_sys_readlink+0x51/0x70 [ 86.806331][ T7979] do_syscall_64+0xcc/0x370 [ 86.810864][ T7979] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 86.816759][ T7979] RIP: 0033:0x7f2c7a58d577 [ 86.821209][ T7979] Code: f0 ff ff 77 02 f3 c3 48 8b 15 bd 38 2b 00 f7 d8 64 89 02 83 c8 ff c3 90 90 90 90 90 90 90 90 90 90 90 90 b8 59 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 91 38 2b 00 31 d2 48 29 c2 64 [ 86.840829][ T7979] RSP: 002b:00007fff84f3b638 EFLAGS: 00000202 ORIG_RAX: 0000000000000059 [ 86.849340][ T7979] RAX: ffffffffffffffda RBX: 00007fff84f3be70 RCX: 00007f2c7a58d577 [ 86.857336][ T7979] RDX: 0000000000000400 RSI: 00007fff84f3ba40 RDI: 00007fff84f3b640 [ 86.865941][ T7979] RBP: 0000000000000200 R08: 000000000042033b R09: 00007f2c7a5e1c20 [ 86.873945][ T7979] R10: 7269762f73656369 R11: 0000000000000202 R12: 0000000002499e10 [ 86.881922][ T7979] R13: 0000000000625500 R14: 0000000002494250 R15: 000000000000000b [ 86.891499][ T7979] Kernel Offset: disabled [ 86.895949][ T7979] Rebooting in 86400 seconds..