Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 70.918092][ T25] kauditd_printk_skb: 7 callbacks suppressed [ 70.918103][ T25] audit: type=1800 audit(1575180298.454:39): pid=9372 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 70.946369][ T25] audit: type=1800 audit(1575180298.464:40): pid=9372 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 73.399106][ T25] audit: type=1400 audit(1575180300.944:41): avc: denied { map } for pid=9546 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.77' (ECDSA) to the list of known hosts. executing program [ 82.777349][ T25] audit: type=1400 audit(1575180310.314:42): avc: denied { map } for pid=9558 comm="syz-executor351" path="/root/syz-executor351082759" dev="sda1" ino=16483 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 82.796345][ T9558] ------------[ cut here ]------------ [ 82.810271][ T9558] refcount_t: underflow; use-after-free. [ 82.816327][ T9558] WARNING: CPU: 0 PID: 9558 at lib/refcount.c:28 refcount_warn_saturate+0x1dc/0x1f0 [ 82.825704][ T9558] Kernel panic - not syncing: panic_on_warn set ... [ 82.832290][ T9558] CPU: 0 PID: 9558 Comm: syz-executor351 Not tainted 5.4.0-syzkaller #0 [ 82.841029][ T9558] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 82.851277][ T9558] Call Trace: [ 82.854567][ T9558] dump_stack+0x197/0x210 [ 82.858898][ T9558] ? refcount_warn_saturate+0x190/0x1f0 [ 82.864534][ T9558] panic+0x2e3/0x75c [ 82.868434][ T9558] ? add_taint.cold+0x16/0x16 [ 82.873125][ T9558] ? __kasan_check_write+0x14/0x20 [ 82.878395][ T9558] ? __warn.cold+0x14/0x3e [ 82.882796][ T9558] ? __warn+0xd9/0x1cf [ 82.886850][ T9558] ? refcount_warn_saturate+0x1dc/0x1f0 [ 82.892379][ T9558] __warn.cold+0x2f/0x3e [ 82.896607][ T9558] ? refcount_warn_saturate+0x1dc/0x1f0 [ 82.902158][ T9558] report_bug+0x289/0x300 [ 82.906473][ T9558] do_error_trap+0x11b/0x200 [ 82.911063][ T9558] do_invalid_op+0x37/0x50 [ 82.915463][ T9558] ? refcount_warn_saturate+0x1dc/0x1f0 [ 82.921024][ T9558] invalid_op+0x23/0x30 [ 82.925167][ T9558] RIP: 0010:refcount_warn_saturate+0x1dc/0x1f0 [ 82.931309][ T9558] Code: e9 d8 fe ff ff 48 89 df e8 c1 5a 24 fe e9 85 fe ff ff e8 e7 08 e7 fd 48 c7 c7 a0 6f 4f 88 c6 05 60 b8 a4 06 01 e8 53 bd b7 fd <0f> 0b e9 ac fe ff ff 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 55 48 [ 82.951109][ T9558] RSP: 0018:ffff88809afff5d0 EFLAGS: 00010282 [ 82.957279][ T9558] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 82.965418][ T9558] RDX: 0000000000000000 RSI: ffffffff815e4316 RDI: ffffed10135ffeac [ 82.973477][ T9558] RBP: ffff88809afff5e0 R08: ffff888092648100 R09: ffffed1015d045c9 [ 82.981571][ T9558] R10: ffffed1015d045c8 R11: ffff8880ae822e47 R12: 0000000000000003 [ 82.989542][ T9558] R13: ffff8880a158da04 R14: 0000000000000900 R15: ffff888089ecb7c0 [ 82.997552][ T9558] ? vprintk_func+0x86/0x189 [ 83.002140][ T9558] sock_wfree+0x1f8/0x260 [ 83.006590][ T9558] sctp_wfree+0x389/0x990 [ 83.011086][ T9558] ? __sctp_write_space+0x5d0/0x5d0 [ 83.016273][ T9558] skb_release_head_state+0xeb/0x260 [ 83.021544][ T9558] skb_release_all+0x16/0x60 [ 83.026413][ T9558] consume_skb+0xfb/0x410 [ 83.030740][ T9558] sctp_chunk_put+0x1d4/0x2f0 [ 83.035406][ T9558] sctp_chunk_free+0x56/0x70 [ 83.040001][ T9558] __sctp_outq_teardown+0x1d0/0xc60 [ 83.045192][ T9558] sctp_outq_free+0x16/0x20 [ 83.049709][ T9558] sctp_association_free+0x208/0x7e0 [ 83.056103][ T9558] sctp_do_sm+0x3a6a/0x5190 [ 83.060969][ T9558] ? __kmalloc_node_track_caller+0x3d/0x70 [ 83.067377][ T9558] ? sctp_do_8_2_transport_strike.isra.0+0xa60/0xa60 [ 83.074064][ T9558] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 83.080747][ T9558] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 83.086364][ T9558] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 83.093028][ T9558] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 83.099088][ T9558] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 83.104956][ T9558] ? sctp_init_cause+0x1ae/0x230 [ 83.109894][ T9558] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 83.115600][ T9558] ? skb_put+0x177/0x1d0 [ 83.119826][ T9558] ? memcpy+0x46/0x50 [ 83.123794][ T9558] sctp_primitive_ABORT+0xa0/0xd0 [ 83.128804][ T9558] sctp_close+0x259/0x960 [ 83.133121][ T9558] ? sctp_accept+0x710/0x710 [ 83.137698][ T9558] ? __kasan_check_write+0x14/0x20 [ 83.142824][ T9558] ? down_write+0xdf/0x150 [ 83.156950][ T9558] ? ip_mc_drop_socket+0x211/0x270 [ 83.162142][ T9558] inet_release+0xed/0x200 [ 83.166733][ T9558] __sock_release+0xce/0x280 [ 83.171321][ T9558] sock_close+0x1e/0x30 [ 83.175464][ T9558] __fput+0x2ff/0x890 [ 83.179434][ T9558] ? __sock_release+0x280/0x280 [ 83.184272][ T9558] ____fput+0x16/0x20 [ 83.188259][ T9558] task_work_run+0x145/0x1c0 [ 83.192851][ T9558] do_exit+0x8e7/0x2ef0 [ 83.196994][ T9558] ? sock_common_getsockopt+0x94/0xd0 [ 83.202366][ T9558] ? mm_update_next_owner+0x7c0/0x7c0 [ 83.207726][ T9558] ? __sys_getsockopt+0x1b2/0x310 [ 83.212748][ T9558] ? kernel_accept+0x310/0x310 [ 83.217525][ T9558] ? handle_mm_fault+0x4ab/0xa50 [ 83.222461][ T9558] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 83.227911][ T9558] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 83.233378][ T9558] do_group_exit+0x135/0x360 [ 83.237977][ T9558] __x64_sys_exit_group+0x44/0x50 [ 83.243025][ T9558] do_syscall_64+0xfa/0x790 [ 83.247529][ T9558] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 83.253411][ T9558] RIP: 0033:0x43ef98 [ 83.257398][ T9558] Code: Bad RIP value. [ 83.261448][ T9558] RSP: 002b:00007ffe27676848 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 83.269847][ T9558] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043ef98 [ 83.277823][ T9558] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 83.285789][ T9558] RBP: 00000000004be7a8 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 83.293759][ T9558] R10: 000000002059aff8 R11: 0000000000000246 R12: 0000000000000001 [ 83.301761][ T9558] R13: 00000000006d01a0 R14: 0000000000000000 R15: 0000000000000000 [ 83.311144][ T9558] Kernel Offset: disabled [ 83.315676][ T9558] Rebooting in 86400 seconds..