Starting mcstransd: [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [ 36.167599] audit: type=1800 audit(1569223596.926:33): pid=7262 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2465 res=0 [ 36.190796] audit: type=1800 audit(1569223596.926:34): pid=7262 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2456 res=0 Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 41.883741] audit: type=1400 audit(1569223602.636:35): avc: denied { map } for pid=7435 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.197' (ECDSA) to the list of known hosts. executing program [ 48.393520] audit: type=1400 audit(1569223609.146:36): avc: denied { map } for pid=7447 comm="syz-executor465" path="/root/syz-executor465046457" dev="sda1" ino=16483 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 48.396797] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 48.451247] ================================================================== [ 48.458891] BUG: KASAN: null-ptr-deref in kvm_write_guest_virt_system+0x64/0x90 [ 48.466325] Write of size 24 at addr 0000000000000000 by task syz-executor465/7447 [ 48.474074] [ 48.475690] CPU: 1 PID: 7447 Comm: syz-executor465 Not tainted 4.19.75 #0 [ 48.482662] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 48.492013] Call Trace: [ 48.495144] dump_stack+0x172/0x1f0 [ 48.498778] ? kvm_write_guest_virt_system+0x64/0x90 [ 48.503956] kasan_report.cold+0x199/0x2ba [ 48.508220] check_memory_region+0x123/0x190 [ 48.512614] memset+0x24/0x40 [ 48.515720] kvm_write_guest_virt_system+0x64/0x90 [ 48.520633] handle_vmread+0x7fe/0xa10 [ 48.524513] ? handle_invpcid+0xa80/0xa80 [ 48.528649] ? __lock_is_held+0xb6/0x140 [ 48.532698] ? __lock_is_held+0xb6/0x140 [ 48.536747] ? handle_invpcid+0xa80/0xa80 [ 48.540881] vmx_handle_exit+0x276/0x16b0 [ 48.545017] ? lock_acquire+0x16f/0x3f0 [ 48.548986] ? vcpu_enter_guest+0xf15/0x5ed0 [ 48.553383] vcpu_enter_guest+0x10ca/0x5ed0 [ 48.557690] ? kvm_vcpu_ioctl+0x181/0xf90 [ 48.561884] ? emulator_read_emulated+0x50/0x50 [ 48.566548] ? lock_acquire+0x16f/0x3f0 [ 48.570507] ? kvm_check_async_pf_completion+0x2d8/0x440 [ 48.575947] kvm_arch_vcpu_ioctl_run+0x457/0x16b0 [ 48.580788] ? kvm_arch_vcpu_ioctl_run+0x457/0x16b0 [ 48.585888] kvm_vcpu_ioctl+0x4dc/0xf90 [ 48.589860] ? kvm_vcpu_block+0xcc0/0xcc0 [ 48.595042] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 48.600574] ? check_preemption_disabled+0x48/0x290 [ 48.605589] ? check_preemption_disabled+0x48/0x290 [ 48.610594] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 48.615598] ? __set_current_blocked+0xe4/0x120 [ 48.620257] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 48.625777] ? signal_setup_done+0xbe/0x2a0 [ 48.630615] ? set_current_blocked+0x50/0x50 [ 48.635007] ? rcu_read_lock_sched_held+0x110/0x130 [ 48.640027] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 48.645554] ? kvm_vcpu_block+0xcc0/0xcc0 [ 48.649693] do_vfs_ioctl+0xd5f/0x1380 [ 48.653567] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 48.659088] ? selinux_file_ioctl+0x125/0x5e0 [ 48.663578] ? ioctl_preallocate+0x210/0x210 [ 48.667980] ? selinux_file_mprotect+0x620/0x620 [ 48.672731] ? write_comp_data+0x3b/0x70 [ 48.676776] ? __fget_light+0x1a9/0x230 [ 48.680743] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 48.686279] ? __fdget_pos+0x89/0x110 [ 48.690077] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 48.695665] ? security_file_ioctl+0x8d/0xc0 [ 48.700066] ksys_ioctl+0xab/0xd0 [ 48.703506] __x64_sys_ioctl+0x73/0xb0 [ 48.707381] do_syscall_64+0xfd/0x620 [ 48.711173] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 48.716352] RIP: 0033:0x443679 [ 48.719532] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 1b 0c fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 48.738435] RSP: 002b:00007ffe01fbb3e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 48.746132] RAX: ffffffffffffffda RBX: 00007ffe01fbb3f0 RCX: 0000000000443679 [ 48.753383] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 48.760639] RBP: 0000000000000000 R08: 0000000000400f60 R09: 0000000000400f60 [ 48.767898] R10: 0000000020003800 R11: 0000000000000246 R12: 0000000000404720 [ 48.775174] R13: 00000000004047b0 R14: 0000000000000000 R15: 0000000000000000 [ 48.782446] ================================================================== [ 48.789788] Disabling lock debugging due to kernel taint [ 48.796519] Kernel panic - not syncing: panic_on_warn set ... [ 48.796519] [ 48.803900] CPU: 0 PID: 7447 Comm: syz-executor465 Tainted: G B 4.19.75 #0 [ 48.812193] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 48.821578] Call Trace: [ 48.824158] dump_stack+0x172/0x1f0 [ 48.827872] ? kvm_write_guest_virt_system+0x64/0x90 [ 48.832979] panic+0x263/0x507 [ 48.836166] ? __warn_printk+0xf3/0xf3 [ 48.840051] ? kvm_write_guest_virt_system+0x64/0x90 [ 48.845147] ? preempt_schedule+0x4b/0x60 [ 48.849276] ? ___preempt_schedule+0x16/0x18 [ 48.853762] ? trace_hardirqs_on+0x5e/0x220 [ 48.858065] ? kvm_write_guest_virt_system+0x64/0x90 [ 48.863161] kasan_end_report+0x47/0x4f [ 48.867131] kasan_report.cold+0xa9/0x2ba [ 48.871264] check_memory_region+0x123/0x190 [ 48.875654] memset+0x24/0x40 [ 48.878742] kvm_write_guest_virt_system+0x64/0x90 [ 48.883653] handle_vmread+0x7fe/0xa10 [ 48.887533] ? handle_invpcid+0xa80/0xa80 [ 48.891662] ? __lock_is_held+0xb6/0x140 [ 48.895717] ? __lock_is_held+0xb6/0x140 [ 48.899760] ? handle_invpcid+0xa80/0xa80 [ 48.903889] vmx_handle_exit+0x276/0x16b0 [ 48.908016] ? lock_acquire+0x16f/0x3f0 [ 48.911971] ? vcpu_enter_guest+0xf15/0x5ed0 [ 48.916379] vcpu_enter_guest+0x10ca/0x5ed0 [ 48.920691] ? kvm_vcpu_ioctl+0x181/0xf90 [ 48.924824] ? emulator_read_emulated+0x50/0x50 [ 48.929514] ? lock_acquire+0x16f/0x3f0 [ 48.933483] ? kvm_check_async_pf_completion+0x2d8/0x440 [ 48.938922] kvm_arch_vcpu_ioctl_run+0x457/0x16b0 [ 48.944335] ? kvm_arch_vcpu_ioctl_run+0x457/0x16b0 [ 48.949345] kvm_vcpu_ioctl+0x4dc/0xf90 [ 48.953307] ? kvm_vcpu_block+0xcc0/0xcc0 [ 48.957443] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 48.962965] ? check_preemption_disabled+0x48/0x290 [ 48.967967] ? check_preemption_disabled+0x48/0x290 [ 48.972966] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 48.977966] ? __set_current_blocked+0xe4/0x120 [ 48.982624] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 48.988150] ? signal_setup_done+0xbe/0x2a0 [ 48.992456] ? set_current_blocked+0x50/0x50 [ 48.996845] ? rcu_read_lock_sched_held+0x110/0x130 [ 49.001839] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 49.007368] ? kvm_vcpu_block+0xcc0/0xcc0 [ 49.011518] do_vfs_ioctl+0xd5f/0x1380 [ 49.015386] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 49.020915] ? selinux_file_ioctl+0x125/0x5e0 [ 49.025391] ? ioctl_preallocate+0x210/0x210 [ 49.029778] ? selinux_file_mprotect+0x620/0x620 [ 49.034537] ? write_comp_data+0x3b/0x70 [ 49.038582] ? __fget_light+0x1a9/0x230 [ 49.043667] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 49.049271] ? __fdget_pos+0x89/0x110 [ 49.053056] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 49.058585] ? security_file_ioctl+0x8d/0xc0 [ 49.062979] ksys_ioctl+0xab/0xd0 [ 49.066418] __x64_sys_ioctl+0x73/0xb0 [ 49.070298] do_syscall_64+0xfd/0x620 [ 49.074092] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 49.079272] RIP: 0033:0x443679 [ 49.082448] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 1b 0c fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 49.101332] RSP: 002b:00007ffe01fbb3e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 49.109023] RAX: ffffffffffffffda RBX: 00007ffe01fbb3f0 RCX: 0000000000443679 [ 49.116275] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 49.123524] RBP: 0000000000000000 R08: 0000000000400f60 R09: 0000000000400f60 [ 49.130773] R10: 0000000020003800 R11: 0000000000000246 R12: 0000000000404720 [ 49.138026] R13: 00000000004047b0 R14: 0000000000000000 R15: 0000000000000000 [ 49.146772] Kernel Offset: disabled [ 49.150395] Rebooting in 86400 seconds..