[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 31.914226] random: sshd: uninitialized urandom read (32 bytes read) [ 32.152473] audit: type=1400 audit(1536553428.027:6): avc: denied { map } for pid=5465 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 32.201353] random: sshd: uninitialized urandom read (32 bytes read) [ 32.815183] random: sshd: uninitialized urandom read (32 bytes read) [ 178.013072] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.60' (ECDSA) to the list of known hosts. [ 183.674711] random: sshd: uninitialized urandom read (32 bytes read) [ 183.821969] audit: type=1400 audit(1536553579.697:7): avc: denied { map } for pid=5480 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=16479 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2018/09/10 04:26:20 parsed 1 programs [ 184.319895] audit: type=1400 audit(1536553580.197:8): avc: denied { map } for pid=5480 comm="syz-execprog" path="/sys/kernel/debug/kcov" dev="debugfs" ino=1124 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 [ 184.776862] random: cc1: uninitialized urandom read (8 bytes read) 2018/09/10 04:26:21 executed programs: 0 [ 186.059049] audit: type=1400 audit(1536553581.937:9): avc: denied { map } for pid=5480 comm="syz-execprog" path="/root/syzkaller-shm283697197" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 186.094919] IPVS: ftp: loaded support on port[0] = 21 [ 186.354858] bridge0: port 1(bridge_slave_0) entered blocking state [ 186.361988] bridge0: port 1(bridge_slave_0) entered disabled state [ 186.369332] device bridge_slave_0 entered promiscuous mode [ 186.388121] bridge0: port 2(bridge_slave_1) entered blocking state [ 186.394539] bridge0: port 2(bridge_slave_1) entered disabled state [ 186.401849] device bridge_slave_1 entered promiscuous mode [ 186.420169] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 186.437911] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 186.489795] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 186.510428] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 186.585023] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 186.592626] team0: Port device team_slave_0 added [ 186.611960] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 186.619180] team0: Port device team_slave_1 added [ 186.635892] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 186.654925] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 186.675000] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 186.693941] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 186.838924] bridge0: port 2(bridge_slave_1) entered blocking state [ 186.845370] bridge0: port 2(bridge_slave_1) entered forwarding state [ 186.852350] bridge0: port 1(bridge_slave_0) entered blocking state [ 186.858932] bridge0: port 1(bridge_slave_0) entered forwarding state [ 187.368127] 8021q: adding VLAN 0 to HW filter on device bond0 [ 187.419096] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 187.471658] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 187.478162] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 187.485330] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 187.538656] 8021q: adding VLAN 0 to HW filter on device team0 [ 187.856881] ================================================================== [ 187.864554] BUG: KASAN: use-after-free in sock_i_ino+0x94/0xa0 [ 187.870528] Read of size 8 at addr ffff8801bb048ab0 by task syz-executor0/5751 [ 187.877882] [ 187.879513] CPU: 1 PID: 5751 Comm: syz-executor0 Not tainted 4.19.0-rc2+ #9 [ 187.886704] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 187.896056] Call Trace: [ 187.898641] dump_stack+0x1c4/0x2b4 [ 187.902268] ? dump_stack_print_info.cold.2+0x52/0x52 [ 187.907453] ? printk+0xa7/0xcf [ 187.910733] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 187.915492] print_address_description.cold.8+0x9/0x1ff [ 187.920855] kasan_report.cold.9+0x242/0x309 [ 187.925255] ? sock_i_ino+0x94/0xa0 [ 187.928878] __asan_report_load8_noabort+0x14/0x20 [ 187.933798] sock_i_ino+0x94/0xa0 [ 187.937254] tipc_sk_fill_sock_diag+0x39c/0xd90 [ 187.941919] ? tipc_diag_dump+0x30/0x30 [ 187.945913] ? tipc_getname+0x7f0/0x7f0 [ 187.949903] ? graph_lock+0x170/0x170 [ 187.953705] ? __lock_sock+0x203/0x350 [ 187.957604] ? find_held_lock+0x36/0x1c0 [ 187.961674] ? mark_held_locks+0xc7/0x130 [ 187.965826] ? __local_bh_enable_ip+0x160/0x260 [ 187.970601] ? __local_bh_enable_ip+0x160/0x260 [ 187.975273] ? lockdep_hardirqs_on+0x421/0x5c0 [ 187.979867] ? trace_hardirqs_on+0xbd/0x310 [ 187.984257] ? lock_release+0x970/0x970 [ 187.988242] ? lock_sock_nested+0xe2/0x120 [ 187.992485] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 187.997506] ? skb_put+0x17b/0x1e0 [ 188.001055] ? memset+0x31/0x40 [ 188.004337] ? __nlmsg_put+0x14c/0x1b0 [ 188.008332] __tipc_add_sock_diag+0x233/0x360 [ 188.012829] tipc_nl_sk_walk+0x122/0x1d0 [ 188.016888] ? tipc_sock_diag_handler_dump+0x3d0/0x3d0 [ 188.022158] tipc_diag_dump+0x24/0x30 [ 188.025948] netlink_dump+0x519/0xd50 [ 188.029738] ? netlink_broadcast+0x50/0x50 [ 188.034019] __netlink_dump_start+0x4f1/0x6f0 [ 188.038516] ? tipc_data_ready+0x3e0/0x3e0 [ 188.042747] tipc_sock_diag_handler_dump+0x28e/0x3d0 [ 188.047852] ? __tipc_diag_gen_cookie+0xc0/0xc0 [ 188.052537] ? tipc_data_ready+0x3e0/0x3e0 [ 188.056766] ? tipc_unregister_sysctl+0x20/0x20 [ 188.061429] ? tipc_ioctl+0x3a0/0x3a0 [ 188.065249] ? netlink_deliver_tap+0x355/0xf80 [ 188.069917] sock_diag_rcv_msg+0x31d/0x410 [ 188.074159] netlink_rcv_skb+0x172/0x440 [ 188.078220] ? sock_diag_bind+0x80/0x80 [ 188.082182] ? netlink_ack+0xb80/0xb80 [ 188.086058] sock_diag_rcv+0x2a/0x40 [ 188.089759] netlink_unicast+0x5a5/0x760 [ 188.093820] ? netlink_attachskb+0x9a0/0x9a0 [ 188.098244] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 188.103777] netlink_sendmsg+0xa18/0xfc0 [ 188.107831] ? netlink_unicast+0x760/0x760 [ 188.112053] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 188.117577] ? security_socket_sendmsg+0x94/0xc0 [ 188.122320] ? netlink_unicast+0x760/0x760 [ 188.126542] sock_sendmsg+0xd5/0x120 [ 188.130252] ___sys_sendmsg+0x7fd/0x930 [ 188.134250] ? __local_bh_enable_ip+0x160/0x260 [ 188.138916] ? copy_msghdr_from_user+0x580/0x580 [ 188.143663] ? kasan_check_write+0x14/0x20 [ 188.147885] ? _raw_spin_unlock_bh+0x30/0x40 [ 188.152289] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 188.157733] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 188.163255] ? release_sock+0x1ec/0x2c0 [ 188.167229] ? __fget_light+0x2e9/0x430 [ 188.171190] ? fget_raw+0x20/0x20 [ 188.174694] ? __release_sock+0x3a0/0x3a0 [ 188.178864] ? tipc_nametbl_build_group+0x273/0x360 [ 188.183885] ? tipc_setsockopt+0x726/0xd70 [ 188.188182] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 188.193720] ? sockfd_lookup_light+0xc5/0x160 [ 188.198266] __sys_sendmsg+0x11d/0x280 [ 188.202151] ? __ia32_sys_shutdown+0x80/0x80 [ 188.206557] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 188.212083] ? fput+0x130/0x1a0 [ 188.215364] ? __x64_sys_futex+0x47f/0x6a0 [ 188.219592] ? do_syscall_64+0x9a/0x820 [ 188.223566] ? do_syscall_64+0x9a/0x820 [ 188.227541] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 188.232998] __x64_sys_sendmsg+0x78/0xb0 [ 188.237058] do_syscall_64+0x1b9/0x820 [ 188.240939] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 188.246777] ? syscall_return_slowpath+0x5e0/0x5e0 [ 188.251706] ? trace_hardirqs_on_caller+0x310/0x310 [ 188.256826] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 188.261832] ? recalc_sigpending_tsk+0x180/0x180 [ 188.266585] ? kasan_check_write+0x14/0x20 [ 188.270811] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 188.275657] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 188.280833] RIP: 0033:0x457099 [ 188.284086] Code: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 188.303001] RSP: 002b:00007fb961928c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 188.310703] RAX: ffffffffffffffda RBX: 00007fb9619296d4 RCX: 0000000000457099 [ 188.317958] RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000006 [ 188.325218] RBP: 00000000009300a0 R08: 0000000000000000 R09: 0000000000000000 [ 188.332482] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 188.339737] R13: 00000000004d4bc0 R14: 00000000004c910b R15: 0000000000000000 [ 188.347005] [ 188.348623] Allocated by task 5751: [ 188.352254] save_stack+0x43/0xd0 [ 188.355705] kasan_kmalloc+0xc7/0xe0 [ 188.359411] kasan_slab_alloc+0x12/0x20 [ 188.363374] kmem_cache_alloc+0x12e/0x730 [ 188.367616] sock_alloc_inode+0x1d/0x260 [ 188.371669] alloc_inode+0x63/0x190 [ 188.375280] new_inode_pseudo+0x71/0x1a0 [ 188.379338] sock_alloc+0x41/0x270 [ 188.382869] __sock_create+0x175/0x930 [ 188.386745] __sys_socket+0x106/0x260 [ 188.390528] __x64_sys_socket+0x73/0xb0 [ 188.394487] do_syscall_64+0x1b9/0x820 [ 188.398359] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 188.403538] [ 188.405149] Freed by task 5750: [ 188.408411] save_stack+0x43/0xd0 [ 188.411863] __kasan_slab_free+0x102/0x150 [ 188.416080] kasan_slab_free+0xe/0x10 [ 188.419864] kmem_cache_free+0x83/0x290 [ 188.423819] sock_destroy_inode+0x51/0x60 [ 188.427950] destroy_inode+0x159/0x200 [ 188.431818] evict+0x5e0/0x980 [ 188.434989] iput+0x679/0xa90 [ 188.438093] dentry_unlink_inode+0x461/0x5e0 [ 188.442483] __dentry_kill+0x44c/0x7a0 [ 188.446352] dentry_kill+0xc9/0x5a0 [ 188.449970] dput.part.26+0x660/0x790 [ 188.453752] dput+0x15/0x20 [ 188.456666] __fput+0x4cf/0xa30 [ 188.459941] ____fput+0x15/0x20 [ 188.463203] task_work_run+0x1e8/0x2a0 [ 188.467120] exit_to_usermode_loop+0x318/0x380 [ 188.471702] do_syscall_64+0x6be/0x820 [ 188.475591] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 188.480759] [ 188.482376] The buggy address belongs to the object at ffff8801bb048a40 [ 188.482376] which belongs to the cache sock_inode_cache of size 984 [ 188.495460] The buggy address is located 112 bytes inside of [ 188.495460] 984-byte region [ffff8801bb048a40, ffff8801bb048e18) [ 188.507322] The buggy address belongs to the page: [ 188.512246] page:ffffea0006ec1200 count:1 mapcount:0 mapping:ffff8801d9427c00 index:0xffff8801bb048ffd [ 188.521697] flags: 0x2fffc0000000100(slab) [ 188.525929] raw: 02fffc0000000100 ffffea00071d5888 ffffea0006ec1408 ffff8801d9427c00 [ 188.533795] raw: ffff8801bb048ffd ffff8801bb048140 0000000100000003 0000000000000000 [ 188.541658] page dumped because: kasan: bad access detected [ 188.547363] [ 188.548970] Memory state around the buggy address: [ 188.553878] ffff8801bb048980: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc [ 188.561229] ffff8801bb048a00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 188.568575] >ffff8801bb048a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 188.575913] ^ [ 188.580826] ffff8801bb048b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 188.588168] ffff8801bb048b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 188.595519] ================================================================== [ 188.602857] Disabling lock debugging due to kernel taint [ 188.608357] Kernel panic - not syncing: panic_on_warn set ... [ 188.608357] [ 188.615742] CPU: 1 PID: 5751 Comm: syz-executor0 Tainted: G B 4.19.0-rc2+ #9 [ 188.624232] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 188.633571] Call Trace: [ 188.636144] dump_stack+0x1c4/0x2b4 [ 188.639757] ? dump_stack_print_info.cold.2+0x52/0x52 [ 188.644930] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 188.649675] panic+0x238/0x4e7 [ 188.652854] ? add_taint.cold.5+0x16/0x16 [ 188.656994] ? trace_hardirqs_on+0x9a/0x310 [ 188.661304] ? trace_hardirqs_on+0xb4/0x310 [ 188.665609] ? trace_hardirqs_on+0xb4/0x310 [ 188.669926] kasan_end_report+0x47/0x4f [ 188.673898] kasan_report.cold.9+0x76/0x309 [ 188.678205] ? sock_i_ino+0x94/0xa0 [ 188.681829] __asan_report_load8_noabort+0x14/0x20 [ 188.686749] sock_i_ino+0x94/0xa0 [ 188.690189] tipc_sk_fill_sock_diag+0x39c/0xd90 [ 188.694849] ? tipc_diag_dump+0x30/0x30 [ 188.698808] ? tipc_getname+0x7f0/0x7f0 [ 188.702768] ? graph_lock+0x170/0x170 [ 188.706557] ? __lock_sock+0x203/0x350 [ 188.710430] ? find_held_lock+0x36/0x1c0 [ 188.714478] ? mark_held_locks+0xc7/0x130 [ 188.718611] ? __local_bh_enable_ip+0x160/0x260 [ 188.723262] ? __local_bh_enable_ip+0x160/0x260 [ 188.727915] ? lockdep_hardirqs_on+0x421/0x5c0 [ 188.732493] ? trace_hardirqs_on+0xbd/0x310 [ 188.736818] ? lock_release+0x970/0x970 [ 188.740791] ? lock_sock_nested+0xe2/0x120 [ 188.745013] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 188.750015] ? skb_put+0x17b/0x1e0 [ 188.753553] ? memset+0x31/0x40 [ 188.756816] ? __nlmsg_put+0x14c/0x1b0 [ 188.760688] __tipc_add_sock_diag+0x233/0x360 [ 188.765172] tipc_nl_sk_walk+0x122/0x1d0 [ 188.769227] ? tipc_sock_diag_handler_dump+0x3d0/0x3d0 [ 188.774488] tipc_diag_dump+0x24/0x30 [ 188.778276] netlink_dump+0x519/0xd50 [ 188.782065] ? netlink_broadcast+0x50/0x50 [ 188.786291] __netlink_dump_start+0x4f1/0x6f0 [ 188.790774] ? tipc_data_ready+0x3e0/0x3e0 [ 188.795035] tipc_sock_diag_handler_dump+0x28e/0x3d0 [ 188.800127] ? __tipc_diag_gen_cookie+0xc0/0xc0 [ 188.804784] ? tipc_data_ready+0x3e0/0x3e0 [ 188.808999] ? tipc_unregister_sysctl+0x20/0x20 [ 188.813652] ? tipc_ioctl+0x3a0/0x3a0 [ 188.817450] ? netlink_deliver_tap+0x355/0xf80 [ 188.822019] sock_diag_rcv_msg+0x31d/0x410 [ 188.826243] netlink_rcv_skb+0x172/0x440 [ 188.830289] ? sock_diag_bind+0x80/0x80 [ 188.834249] ? netlink_ack+0xb80/0xb80 [ 188.838123] sock_diag_rcv+0x2a/0x40 [ 188.841821] netlink_unicast+0x5a5/0x760 [ 188.845869] ? netlink_attachskb+0x9a0/0x9a0 [ 188.850263] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 188.855801] netlink_sendmsg+0xa18/0xfc0 [ 188.859853] ? netlink_unicast+0x760/0x760 [ 188.864079] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 188.869599] ? security_socket_sendmsg+0x94/0xc0 [ 188.874338] ? netlink_unicast+0x760/0x760 [ 188.878558] sock_sendmsg+0xd5/0x120 [ 188.882255] ___sys_sendmsg+0x7fd/0x930 [ 188.886220] ? __local_bh_enable_ip+0x160/0x260 [ 188.890876] ? copy_msghdr_from_user+0x580/0x580 [ 188.895616] ? kasan_check_write+0x14/0x20 [ 188.899833] ? _raw_spin_unlock_bh+0x30/0x40 [ 188.904233] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 188.909667] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 188.915187] ? release_sock+0x1ec/0x2c0 [ 188.919145] ? __fget_light+0x2e9/0x430 [ 188.923101] ? fget_raw+0x20/0x20 [ 188.926539] ? __release_sock+0x3a0/0x3a0 [ 188.930678] ? tipc_nametbl_build_group+0x273/0x360 [ 188.935681] ? tipc_setsockopt+0x726/0xd70 [ 188.939925] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 188.945461] ? sockfd_lookup_light+0xc5/0x160 [ 188.949942] __sys_sendmsg+0x11d/0x280 [ 188.953815] ? __ia32_sys_shutdown+0x80/0x80 [ 188.958207] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 188.963739] ? fput+0x130/0x1a0 [ 188.967008] ? __x64_sys_futex+0x47f/0x6a0 [ 188.971234] ? do_syscall_64+0x9a/0x820 [ 188.975192] ? do_syscall_64+0x9a/0x820 [ 188.979160] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 188.984595] __x64_sys_sendmsg+0x78/0xb0 [ 188.988642] do_syscall_64+0x1b9/0x820 [ 188.992539] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 188.997904] ? syscall_return_slowpath+0x5e0/0x5e0 [ 189.002833] ? trace_hardirqs_on_caller+0x310/0x310 [ 189.007832] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 189.012832] ? recalc_sigpending_tsk+0x180/0x180 [ 189.017572] ? kasan_check_write+0x14/0x20 [ 189.021794] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 189.026624] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 189.031797] RIP: 0033:0x457099 [ 189.034972] Code: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 189.053871] RSP: 002b:00007fb961928c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 189.061561] RAX: ffffffffffffffda RBX: 00007fb9619296d4 RCX: 0000000000457099 [ 189.068811] RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000006 [ 189.076061] RBP: 00000000009300a0 R08: 0000000000000000 R09: 0000000000000000 [ 189.083323] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 189.090574] R13: 00000000004d4bc0 R14: 00000000004c910b R15: 0000000000000000 [ 189.098199] Dumping ftrace buffer: [ 189.101738] (ftrace buffer empty) [ 189.106116] Kernel Offset: disabled [ 189.109740] Rebooting in 86400 seconds..