syzkaller syzkaller login: [ 11.427710][ T23] kauditd_printk_skb: 60 callbacks suppressed [ 11.427718][ T23] audit: type=1400 audit(1636634175.639:71): avc: denied { transition } for pid=290 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 11.433988][ T23] audit: type=1400 audit(1636634175.649:72): avc: denied { write } for pid=290 comm="sh" path="pipe:[10848]" dev="pipefs" ino=10848 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1 [ 11.909248][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #88!!! [ 11.918211][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #88!!! [ 12.329393][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!! [ 12.989165][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!! [ 13.169146][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!! Warning: Permanently added '10.128.1.198' (ECDSA) to the list of known hosts. 2021/11/11 12:36:22 fuzzer started 2021/11/11 12:36:22 connecting to host at 10.128.0.163:39863 2021/11/11 12:36:22 checking machine... 2021/11/11 12:36:22 checking revisions... 2021/11/11 12:36:22 testing simple program... [ 18.582135][ T23] audit: type=1400 audit(1636634182.799:73): avc: denied { getattr } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 18.598243][ T370] cgroup: Unknown subsys name 'net' [ 18.605580][ T23] audit: type=1400 audit(1636634182.799:74): avc: denied { read } for pid=362 comm="syz-fuzzer" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 18.631907][ T23] audit: type=1400 audit(1636634182.799:75): avc: denied { open } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 18.632099][ T370] cgroup: Unknown subsys name 'devices' [ 18.655095][ T23] audit: type=1400 audit(1636634182.799:76): avc: denied { read } for pid=362 comm="syz-fuzzer" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 18.683537][ T23] audit: type=1400 audit(1636634182.799:77): avc: denied { open } for pid=362 comm="syz-fuzzer" path="/dev/raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 18.706883][ T23] audit: type=1400 audit(1636634182.799:78): avc: denied { mounton } for pid=370 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1136 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 18.729639][ T23] audit: type=1400 audit(1636634182.799:79): avc: denied { mount } for pid=370 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 18.751950][ T23] audit: type=1400 audit(1636634182.839:80): avc: denied { unmount } for pid=370 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 18.860903][ T370] cgroup: Unknown subsys name 'hugetlb' [ 18.866626][ T370] cgroup: Unknown subsys name 'rlimit' [ 18.960617][ T23] audit: type=1400 audit(1636634183.179:81): avc: denied { setattr } for pid=370 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 18.995907][ T23] audit: type=1400 audit(1636634183.219:82): avc: denied { execmem } for pid=372 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 19.070862][ T373] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.078157][ T373] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.085662][ T373] device bridge_slave_0 entered promiscuous mode [ 19.092709][ T373] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.099858][ T373] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.107128][ T373] device bridge_slave_1 entered promiscuous mode [ 19.137492][ T373] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.144550][ T373] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.151913][ T373] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.158935][ T373] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.177819][ T374] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.185076][ T374] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.192998][ T374] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 19.200636][ T374] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 19.220391][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 19.228618][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 19.229333][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 19.236801][ T74] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.253356][ T74] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.260827][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 19.268925][ T74] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.275972][ T74] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.283470][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 19.292067][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 19.311899][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 19.320849][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 19.329453][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 19.337301][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 19.346090][ T24] ================================================================================ [ 19.355394][ T24] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:2023:28 [ 19.363204][ T24] member access within address ffffc9000019f1c0 with insufficient space [ 19.371528][ T24] for an object of type 'struct sk_buff' [ 19.377151][ T24] CPU: 1 PID: 24 Comm: kworker/1:1 Not tainted 5.10.78-syzkaller-01179-gbe686d451ef9 #0 [ 19.386870][ T24] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 19.397031][ T24] Workqueue: ipv6_addrconf addrconf_dad_work [ 19.403085][ T24] Call Trace: [ 19.406432][ T24] dump_stack_lvl+0x1e2/0x24b [ 19.411099][ T24] ? show_regs_print_info+0x18/0x18 [ 19.416455][ T24] ? wg_allowedips_lookup_dst+0x190/0x190 [ 19.422179][ T24] dump_stack+0x15/0x1d [ 19.426400][ T24] ubsan_type_mismatch_common+0x1ed/0x3a0 [ 19.432112][ T24] ? __sanitizer_cov_trace_switch+0x74/0x90 [ 19.438157][ T24] __ubsan_handle_type_mismatch_v1+0x5b/0x70 [ 19.444124][ T24] wg_xmit+0x4a2/0xae0 [ 19.448184][ T24] ? wg_stop+0x140/0x140 [ 19.452407][ T24] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20 [ 19.458628][ T24] netdev_start_xmit+0x8a/0x160 [ 19.463460][ T24] dev_hard_start_xmit+0x18d/0x2f0 [ 19.468559][ T24] __dev_queue_xmit+0xfbe/0x1bb0 [ 19.473479][ T24] ? dev_queue_xmit+0x20/0x20 [ 19.478133][ T24] ? __local_bh_enable_ip+0xa8/0x170 [ 19.483397][ T24] ? do_raw_spin_unlock+0x50/0x50 [ 19.488401][ T24] ? _local_bh_enable+0x30/0x30 [ 19.493246][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 19.499641][ T24] ? ndisc_constructor+0x690/0x8a0 [ 19.504737][ T24] ? _raw_write_unlock_bh+0x31/0x47 [ 19.509931][ T24] ? dev_hard_header+0xdb/0xf0 [ 19.514704][ T24] dev_queue_xmit+0x17/0x20 [ 19.519205][ T24] neigh_connected_output+0x288/0x2b0 [ 19.524564][ T24] ip6_finish_output2+0xde2/0x1440 [ 19.529671][ T24] ? __rcu_read_lock+0x50/0x50 [ 19.534860][ T24] ? __ip6_finish_output+0x520/0x520 [ 19.540125][ T24] ? dst_cow_metrics_generic+0x55/0x1d0 [ 19.545653][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 19.551872][ T24] ? ip6_skb_dst_mtu+0xaf/0x260 [ 19.556705][ T24] __ip6_finish_output+0x3e4/0x520 [ 19.561840][ T24] ip6_finish_output+0x3f/0x220 [ 19.566696][ T24] ? ip6_output+0x1d3/0x4b0 [ 19.571460][ T24] ip6_output+0x1f8/0x4b0 [ 19.575786][ T24] ? asan.module_dtor+0x20/0x20 [ 19.580635][ T24] ? skb_dst+0x40/0x40 [ 19.584793][ T24] ? __rcu_read_lock+0x50/0x50 [ 19.589538][ T24] ? selinux_ipv6_forward+0x50/0x50 [ 19.594715][ T24] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 19.600422][ T24] ? nf_hook_slow+0x150/0x1b0 [ 19.605078][ T24] NF_HOOK+0xdd/0x280 [ 19.609041][ T24] ? addrconf_addr_solict_mult+0xe0/0xe0 [ 19.614663][ T24] ? NF_HOOK+0x280/0x280 [ 19.618887][ T24] ? __rcu_read_lock+0x50/0x50 [ 19.623639][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 19.630119][ T24] ? ndisc_send_skb+0x547/0x9f0 [ 19.634969][ T24] ? memcpy+0x56/0x70 [ 19.639116][ T24] ndisc_send_skb+0x646/0x9f0 [ 19.643816][ T24] ? slab_post_alloc_hook+0x90/0xa0 [ 19.649447][ T24] ? ndisc_fill_addr_option+0x2f0/0x2f0 [ 19.655073][ T24] ? skb_set_owner_w+0x1a8/0x310 [ 19.660012][ T24] ? __sanitizer_cov_trace_cmp4+0x19/0x20 [ 19.665708][ T24] ? skb_put+0x11d/0x200 [ 19.670355][ T24] ndisc_send_rs+0x26c/0x360 [ 19.674944][ T24] addrconf_dad_completed+0x4f3/0x9f0 [ 19.680651][ T24] ? addrconf_dad_stop+0x430/0x430 [ 19.685764][ T24] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 19.691476][ T24] addrconf_dad_work+0x9c1/0x1520 [ 19.696483][ T24] ? ipv6_use_optimistic_addr+0x1d0/0x1d0 [ 19.702181][ T24] ? __kasan_check_write+0x14/0x20 [ 19.708314][ T24] process_one_work+0x3ca/0x660 [ 19.713144][ T24] worker_thread+0x709/0xa20 [ 19.717733][ T24] ? __kthread_parkme+0x11b/0x150 [ 19.722819][ T24] kthread+0x371/0x390 [ 19.726867][ T24] ? pr_cont_work+0x110/0x110 [ 19.731525][ T24] ? __list_add+0xc0/0xc0 [ 19.736024][ T24] ret_from_fork+0x1f/0x30 [ 19.740451][ T24] ================================================================================ [ 19.749907][ T24] ================================================================================ [ 19.759194][ T24] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:1916:2 [ 19.766890][ T24] member access within address ffffc9000019f1c0 with insufficient space [ 19.775514][ T24] for an object of type 'struct sk_buff' [ 19.781161][ T24] CPU: 1 PID: 24 Comm: kworker/1:1 Not tainted 5.10.78-syzkaller-01179-gbe686d451ef9 #0 [ 19.790851][ T24] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 19.800904][ T24] Workqueue: ipv6_addrconf addrconf_dad_work [ 19.806873][ T24] Call Trace: [ 19.810158][ T24] dump_stack_lvl+0x1e2/0x24b [ 19.814818][ T24] ? show_regs_print_info+0x18/0x18 [ 19.820004][ T24] ? wg_allowedips_lookup_dst+0x190/0x190 [ 19.825793][ T24] dump_stack+0x15/0x1d [ 19.829924][ T24] ubsan_type_mismatch_common+0x1ed/0x3a0 [ 19.835643][ T24] __ubsan_handle_type_mismatch_v1+0x5b/0x70 [ 19.841617][ T24] wg_xmit+0x513/0xae0 [ 19.845671][ T24] ? wg_stop+0x140/0x140 [ 19.849939][ T24] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20 [ 19.856171][ T24] netdev_start_xmit+0x8a/0x160 [ 19.861018][ T24] dev_hard_start_xmit+0x18d/0x2f0 [ 19.866105][ T24] __dev_queue_xmit+0xfbe/0x1bb0 [ 19.871018][ T24] ? dev_queue_xmit+0x20/0x20 [ 19.875680][ T24] ? __local_bh_enable_ip+0xa8/0x170 [ 19.881043][ T24] ? do_raw_spin_unlock+0x50/0x50 [ 19.886049][ T24] ? _local_bh_enable+0x30/0x30 [ 19.890968][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 19.897209][ T24] ? ndisc_constructor+0x690/0x8a0 [ 19.902299][ T24] ? _raw_write_unlock_bh+0x31/0x47 [ 19.907478][ T24] ? dev_hard_header+0xdb/0xf0 [ 19.912224][ T24] dev_queue_xmit+0x17/0x20 [ 19.916898][ T24] neigh_connected_output+0x288/0x2b0 [ 19.922246][ T24] ip6_finish_output2+0xde2/0x1440 [ 19.927334][ T24] ? __rcu_read_lock+0x50/0x50 [ 19.932071][ T24] ? __ip6_finish_output+0x520/0x520 [ 19.937417][ T24] ? dst_cow_metrics_generic+0x55/0x1d0 [ 19.942951][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 19.949189][ T24] ? ip6_skb_dst_mtu+0xaf/0x260 [ 19.954021][ T24] __ip6_finish_output+0x3e4/0x520 [ 19.959112][ T24] ip6_finish_output+0x3f/0x220 [ 19.963959][ T24] ? ip6_output+0x1d3/0x4b0 [ 19.968435][ T24] ip6_output+0x1f8/0x4b0 [ 19.972753][ T24] ? asan.module_dtor+0x20/0x20 [ 19.977579][ T24] ? skb_dst+0x40/0x40 [ 19.981655][ T24] ? __rcu_read_lock+0x50/0x50 [ 19.986489][ T24] ? selinux_ipv6_forward+0x50/0x50 [ 19.991687][ T24] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 19.997377][ T24] ? nf_hook_slow+0x150/0x1b0 [ 20.002034][ T24] NF_HOOK+0xdd/0x280 [ 20.005993][ T24] ? addrconf_addr_solict_mult+0xe0/0xe0 [ 20.011637][ T24] ? NF_HOOK+0x280/0x280 [ 20.015858][ T24] ? __rcu_read_lock+0x50/0x50 [ 20.020603][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 20.027005][ T24] ? ndisc_send_skb+0x547/0x9f0 [ 20.031832][ T24] ? memcpy+0x56/0x70 [ 20.036050][ T24] ndisc_send_skb+0x646/0x9f0 [ 20.040703][ T24] ? slab_post_alloc_hook+0x90/0xa0 [ 20.045879][ T24] ? ndisc_fill_addr_option+0x2f0/0x2f0 [ 20.051400][ T24] ? skb_set_owner_w+0x1a8/0x310 [ 20.056311][ T24] ? __sanitizer_cov_trace_cmp4+0x19/0x20 [ 20.062093][ T24] ? skb_put+0x11d/0x200 [ 20.066369][ T24] ndisc_send_rs+0x26c/0x360 [ 20.070943][ T24] addrconf_dad_completed+0x4f3/0x9f0 [ 20.076289][ T24] ? addrconf_dad_stop+0x430/0x430 [ 20.081373][ T24] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 20.087068][ T24] addrconf_dad_work+0x9c1/0x1520 [ 20.092074][ T24] ? ipv6_use_optimistic_addr+0x1d0/0x1d0 [ 20.098227][ T24] ? __kasan_check_write+0x14/0x20 [ 20.103319][ T24] process_one_work+0x3ca/0x660 [ 20.108144][ T24] worker_thread+0x709/0xa20 [ 20.112757][ T24] ? __kthread_parkme+0x11b/0x150 [ 20.117760][ T24] kthread+0x371/0x390 [ 20.121834][ T24] ? pr_cont_work+0x110/0x110 [ 20.126511][ T24] ? __list_add+0xc0/0xc0 [ 20.130842][ T24] ret_from_fork+0x1f/0x30 2021/11/11 12:36:24 building call list... [ 20.135289][ T24] ================================================================================ [ 20.150556][ T373] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 20.729636][ T9] device bridge_slave_1 left promiscuous mode [ 20.735789][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.743853][ T9] device bridge_slave_0 left promiscuous mode [ 20.750276][ T9] bridge0: port 1(bridge_slave_0) entered disabled state