Starting mcstransd: 
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

syzkaller login: [   52.428921] kauditd_printk_skb: 3 callbacks suppressed
[   52.428934] audit: type=1400 audit(1585591947.314:35): avc:  denied  { map } for  pid=8078 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1
[  327.095133] audit: type=1400 audit(1585592221.984:36): avc:  denied  { map } for  pid=8086 comm="sh" path="/bin/dash" dev="sda1" ino=1473 scontext=system_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1
Warning: Permanently added '10.128.1.14' (ECDSA) to the list of known hosts.
[ 1025.694940] audit: type=1400 audit(1585592920.584:37): avc:  denied  { map } for  pid=8093 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
2020/03/30 18:28:40 parsed 1 programs
[ 1026.994307] audit: type=1400 audit(1585592921.874:38): avc:  denied  { map } for  pid=8093 comm="syz-execprog" path="/sys/kernel/debug/kcov" dev="debugfs" ino=17143 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1
2020/03/30 18:28:42 executed programs: 0
[ 1027.191086] IPVS: ftp: loaded support on port[0] = 21
[ 1027.257889] chnl_net:caif_netlink_parms(): no params data found
[ 1027.311152] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1027.318421] bridge0: port 1(bridge_slave_0) entered disabled state
[ 1027.326085] device bridge_slave_0 entered promiscuous mode
[ 1027.333654] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1027.340618] bridge0: port 2(bridge_slave_1) entered disabled state
[ 1027.347951] device bridge_slave_1 entered promiscuous mode
[ 1027.365440] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 1027.374789] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 1027.392782] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[ 1027.400507] team0: Port device team_slave_0 added
[ 1027.406547] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[ 1027.413820] team0: Port device team_slave_1 added
[ 1027.428663] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 1027.435021] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 1027.460691] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 1027.472509] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 1027.479080] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 1027.504703] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 1027.515965] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[ 1027.523548] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[ 1027.577072] device hsr_slave_0 entered promiscuous mode
[ 1027.614529] device hsr_slave_1 entered promiscuous mode
[ 1027.685161] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[ 1027.692437] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[ 1027.745962] audit: type=1400 audit(1585592922.634:39): avc:  denied  { create } for  pid=8110 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[ 1027.769634] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1027.771375] audit: type=1400 audit(1585592922.634:40): avc:  denied  { write } for  pid=8110 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[ 1027.776786] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 1027.802200] audit: type=1400 audit(1585592922.634:41): avc:  denied  { read } for  pid=8110 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[ 1027.807705] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1027.837230] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 1027.876049] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready
[ 1027.882161] 8021q: adding VLAN 0 to HW filter on device bond0
[ 1027.891845] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[ 1027.901729] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 1027.921106] bridge0: port 1(bridge_slave_0) entered disabled state
[ 1027.928864] bridge0: port 2(bridge_slave_1) entered disabled state
[ 1027.936714] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 1027.947908] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[ 1027.953990] 8021q: adding VLAN 0 to HW filter on device team0
[ 1027.964100] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 1027.971923] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1027.978456] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 1027.989880] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 1027.998205] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1028.004748] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 1028.021183] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 1028.030359] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 1028.040391] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 1028.051740] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 1028.062642] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 1028.072903] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[ 1028.079066] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 1028.095202] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready
[ 1028.102716] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 1028.110102] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 1028.122040] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 1028.136224] IPv6: ADDRCONF(NETDEV_UP): veth0_virt_wifi: link is not ready
[ 1028.147092] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 1028.188866] IPv6: ADDRCONF(NETDEV_UP): veth0_vlan: link is not ready
[ 1028.196460] IPv6: ADDRCONF(NETDEV_UP): vlan0: link is not ready
[ 1028.202993] IPv6: ADDRCONF(NETDEV_UP): vlan1: link is not ready
[ 1028.212855] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 1028.221112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 1028.228291] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 1028.237598] device veth0_vlan entered promiscuous mode
[ 1028.248534] device veth1_vlan entered promiscuous mode
[ 1028.254949] IPv6: ADDRCONF(NETDEV_UP): macvlan0: link is not ready
[ 1028.261759] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 1028.280604] IPv6: ADDRCONF(NETDEV_UP): veth0_macvtap: link is not ready
[ 1028.290241] IPv6: ADDRCONF(NETDEV_UP): veth1_macvtap: link is not ready
[ 1028.297343] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 1028.305691] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 1028.315548] device veth0_macvtap entered promiscuous mode
[ 1028.322075] IPv6: ADDRCONF(NETDEV_UP): macvtap0: link is not ready
[ 1028.331544] device veth1_macvtap entered promiscuous mode
[ 1028.338286] IPv6: ADDRCONF(NETDEV_UP): macsec0: link is not ready
[ 1028.347611] IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready
[ 1028.357871] IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready
[ 1028.367506] IPv6: ADDRCONF(NETDEV_UP): batadv_slave_0: link is not ready
[ 1028.374823] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 1028.381572] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 1028.389094] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 1028.396373] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 1028.404678] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 1028.415904] IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready
[ 1028.422899] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 1028.429977] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 1028.437975] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 1028.547305] audit: type=1400 audit(1585592923.434:42): avc:  denied  { associate } for  pid=8110 comm="syz-executor.0" name="syz0" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1
[ 1028.645489] ==================================================================
[ 1028.653143] BUG: KASAN: use-after-free in __list_add_valid+0x93/0xa0
[ 1028.659650] Read of size 8 at addr ffff888090899420 by task syz-executor.0/8155
[ 1028.667089] 
[ 1028.668716] CPU: 0 PID: 8155 Comm: syz-executor.0 Not tainted 4.19.113-syzkaller #0
[ 1028.676497] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1028.685847] Call Trace:
[ 1028.688479]  dump_stack+0x188/0x20d
[ 1028.692111]  ? __list_add_valid+0x93/0xa0
[ 1028.696254]  print_address_description.cold+0x7c/0x212
[ 1028.701524]  ? __list_add_valid+0x93/0xa0
[ 1028.705666]  kasan_report.cold+0x88/0x2b9
[ 1028.709806]  __list_add_valid+0x93/0xa0
[ 1028.713834]  rdma_listen+0x609/0x880
[ 1028.717626]  ucma_listen+0x14d/0x1c0
[ 1028.721343]  ? ucma_notify+0x190/0x190
[ 1028.725244]  ? __might_fault+0x192/0x1d0
[ 1028.729296]  ? _copy_from_user+0xd2/0x140
[ 1028.733432]  ? ucma_notify+0x190/0x190
[ 1028.737319]  ucma_write+0x285/0x350
[ 1028.740948]  ? ucma_open+0x280/0x280
[ 1028.744653]  ? __fget+0x319/0x510
[ 1028.748098]  __vfs_write+0xf7/0x760
[ 1028.751729]  ? ucma_open+0x280/0x280
[ 1028.755450]  ? kernel_read+0x110/0x110
[ 1028.759359]  ? __inode_security_revalidate+0xd3/0x120
[ 1028.764547]  ? avc_policy_seqno+0x9/0x70
[ 1028.769127]  ? selinux_file_permission+0x87/0x520
[ 1028.773961]  ? security_file_permission+0x84/0x220
[ 1028.778883]  vfs_write+0x206/0x550
[ 1028.782412]  ksys_write+0x12b/0x2a0
[ 1028.786048]  ? __ia32_sys_read+0xb0/0xb0
[ 1028.790104]  ? __ia32_sys_clock_settime+0x260/0x260
[ 1028.795131]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[ 1028.799904]  ? trace_hardirqs_off_caller+0x55/0x210
[ 1028.804908]  ? do_syscall_64+0x21/0x620
[ 1028.808877]  do_syscall_64+0xf9/0x620
[ 1028.812731]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 1028.817919] RIP: 0033:0x45c849
[ 1028.821103] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 1028.840344] RSP: 002b:00007fe96b76dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 1028.848061] RAX: ffffffffffffffda RBX: 00007fe96b76e6d4 RCX: 000000000045c849
[ 1028.856013] RDX: 0000000000000010 RSI: 0000000020000040 RDI: 0000000000000003
[ 1028.863272] RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000
[ 1028.870529] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
[ 1028.877793] R13: 0000000000000cc0 R14: 00000000004cee4e R15: 000000000076bf0c
[ 1028.885063] 
[ 1028.886704] Allocated by task 8149:
[ 1028.890322]  kasan_kmalloc+0xbf/0xe0
[ 1028.894028]  kmem_cache_alloc_trace+0x14d/0x7a0
[ 1028.898736]  __rdma_create_id+0x5b/0x630
[ 1028.902791]  ucma_create_id+0x1cb/0x5a0
[ 1028.906854]  ucma_write+0x285/0x350
[ 1028.910468]  __vfs_write+0xf7/0x760
[ 1028.914079]  vfs_write+0x206/0x550
[ 1028.917626]  ksys_write+0x12b/0x2a0
[ 1028.921241]  do_syscall_64+0xf9/0x620
[ 1028.925029]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 1028.930202] 
[ 1028.933820] Freed by task 8149:
[ 1028.937157]  __kasan_slab_free+0xf7/0x140
[ 1028.941292]  kfree+0xce/0x220
[ 1028.944400]  ucma_close+0x10b/0x320
[ 1028.948027]  __fput+0x2cd/0x890
[ 1028.951295]  task_work_run+0x13f/0x1b0
[ 1028.955182]  exit_to_usermode_loop+0x25a/0x2b0
[ 1028.959860]  do_syscall_64+0x538/0x620
[ 1028.963763]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 1028.969247] 
[ 1028.970888] The buggy address belongs to the object at ffff888090899240
[ 1028.970888]  which belongs to the cache kmalloc-2048 of size 2048
[ 1028.983893] The buggy address is located 480 bytes inside of
[ 1028.983893]  2048-byte region [ffff888090899240, ffff888090899a40)
[ 1028.995898] The buggy address belongs to the page:
[ 1029.000849] page:ffffea0002422600 count:1 mapcount:0 mapping:ffff88812c3dcc40 index:0x0 compound_mapcount: 0
[ 1029.010824] flags: 0xfffe0000008100(slab|head)
[ 1029.015397] raw: 00fffe0000008100 ffffea00023a7408 ffffea00024b2d88 ffff88812c3dcc40
[ 1029.023277] raw: 0000000000000000 ffff888090898140 0000000100000003 0000000000000000
[ 1029.031145] page dumped because: kasan: bad access detected
[ 1029.036848] 
[ 1029.038470] Memory state around the buggy address:
[ 1029.043390]  ffff888090899300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1029.051184]  ffff888090899380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1029.058531] >ffff888090899400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1029.066003]                                ^
[ 1029.070534]  ffff888090899480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1029.077911]  ffff888090899500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1029.085342] ==================================================================
[ 1029.092682] Disabling lock debugging due to kernel taint
[ 1029.102219] Kernel panic - not syncing: panic_on_warn set ...
[ 1029.102219] 
[ 1029.109719] CPU: 1 PID: 8155 Comm: syz-executor.0 Tainted: G    B             4.19.113-syzkaller #0
[ 1029.118944] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1029.128371] Call Trace:
[ 1029.130949]  dump_stack+0x188/0x20d
[ 1029.134565]  panic+0x26a/0x50e
[ 1029.137801]  ? __warn_printk+0xf3/0xf3
[ 1029.141718]  ? preempt_schedule_common+0x4a/0xc0
[ 1029.146470]  ? __list_add_valid+0x93/0xa0
[ 1029.150607]  ? ___preempt_schedule+0x16/0x18
[ 1029.155005]  ? trace_hardirqs_on+0x55/0x210
[ 1029.159374]  ? __list_add_valid+0x93/0xa0
[ 1029.163554]  kasan_end_report+0x43/0x49
[ 1029.167649]  kasan_report.cold+0xa4/0x2b9
[ 1029.171784]  __list_add_valid+0x93/0xa0
[ 1029.175817]  rdma_listen+0x609/0x880
[ 1029.179520]  ucma_listen+0x14d/0x1c0
[ 1029.183220]  ? ucma_notify+0x190/0x190
[ 1029.187098]  ? __might_fault+0x192/0x1d0
[ 1029.191163]  ? _copy_from_user+0xd2/0x140
[ 1029.195303]  ? ucma_notify+0x190/0x190
[ 1029.199181]  ucma_write+0x285/0x350
[ 1029.202852]  ? ucma_open+0x280/0x280
[ 1029.206561]  ? __fget+0x319/0x510
[ 1029.210001]  __vfs_write+0xf7/0x760
[ 1029.213614]  ? ucma_open+0x280/0x280
[ 1029.217315]  ? kernel_read+0x110/0x110
[ 1029.221220]  ? __inode_security_revalidate+0xd3/0x120
[ 1029.226517]  ? avc_policy_seqno+0x9/0x70
[ 1029.230571]  ? selinux_file_permission+0x87/0x520
[ 1029.235408]  ? security_file_permission+0x84/0x220
[ 1029.240524]  vfs_write+0x206/0x550
[ 1029.244057]  ksys_write+0x12b/0x2a0
[ 1029.247668]  ? __ia32_sys_read+0xb0/0xb0
[ 1029.251713]  ? __ia32_sys_clock_settime+0x260/0x260
[ 1029.256714]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[ 1029.261450]  ? trace_hardirqs_off_caller+0x55/0x210
[ 1029.266457]  ? do_syscall_64+0x21/0x620
[ 1029.270416]  do_syscall_64+0xf9/0x620
[ 1029.274242]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 1029.279493] RIP: 0033:0x45c849
[ 1029.282716] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 1029.301789] RSP: 002b:00007fe96b76dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 1029.309483] RAX: ffffffffffffffda RBX: 00007fe96b76e6d4 RCX: 000000000045c849
[ 1029.316756] RDX: 0000000000000010 RSI: 0000000020000040 RDI: 0000000000000003
[ 1029.324014] RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000
[ 1029.331289] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
[ 1029.338555] R13: 0000000000000cc0 R14: 00000000004cee4e R15: 000000000076bf0c
[ 1029.347351] Kernel Offset: disabled
[ 1029.350980] Rebooting in 86400 seconds..