[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 17.548697] audit: type=1400 audit(1519089869.759:6): avc: denied { map } for pid=4106 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.22' (ECDSA) to the list of known hosts. syzkaller login: [ 23.854107] audit: type=1400 audit(1519089876.064:7): avc: denied { map } for pid=4120 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=16479 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2018/02/20 01:24:36 parsed 1 programs 2018/02/20 01:24:36 executed programs: 0 [ 24.127274] audit: type=1400 audit(1519089876.337:8): avc: denied { map } for pid=4120 comm="syz-execprog" path="/root/syzkaller-shm244545395" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 24.142137] IPVS: ftp: loaded support on port[0] = 21 [ 24.377571] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 24.864379] [ 24.866054] ===================================== [ 24.870874] WARNING: bad unlock balance detected! [ 24.875774] 4.16.0-rc1+ #232 Not tainted [ 24.879862] ------------------------------------- [ 24.884683] syz-executor0/4127 is trying to release lock (rcu_read_lock_bh) at: [ 24.892218] [] hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 24.899201] but there are no more locks to release! [ 24.904187] [ 24.904187] other info that might help us debug this: [ 24.910832] 3 locks held by syz-executor0/4127: [ 24.915476] #0: ((&idev->mc_ifc_timer)){+.-.}, at: [<000000006860bd74>] call_timer_fn+0x1c6/0x820 [ 24.924644] #1: (rcu_read_lock){....}, at: [<00000000fd67366e>] mld_sendpack+0x180/0xe70 [ 24.933032] #2: (rcu_read_lock){....}, at: [<000000002f7c945e>] nf_hook.constprop.37+0x0/0x830 [ 24.941931] [ 24.941931] stack backtrace: [ 24.946406] CPU: 0 PID: 4127 Comm: syz-executor0 Not tainted 4.16.0-rc1+ #232 [ 24.953657] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 24.962989] Call Trace: [ 24.965543] [ 24.967678] dump_stack+0x194/0x257 [ 24.971292] ? arch_local_irq_restore+0x53/0x53 [ 24.975936] ? hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 24.981367] print_unlock_imbalance_bug+0x12f/0x140 [ 24.986535] lock_release+0x6fe/0xa40 [ 24.990504] ? hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 24.996021] ? lock_downgrade+0x980/0x980 [ 25.000153] ? lock_release+0xa40/0xa40 [ 25.004110] ? __raw_spin_lock_init+0x1c/0x100 [ 25.008667] ? do_raw_spin_trylock+0x190/0x190 [ 25.013238] hashlimit_mt_common.isra.10+0x1c08/0x2610 [ 25.018490] ? lock_downgrade+0x980/0x980 [ 25.022627] ? dsthash_find+0x5b0/0x5b0 [ 25.026597] ? __lock_acquire+0x664/0x3e00 [ 25.030829] ? is_bpf_text_address+0x7b/0x120 [ 25.035295] ? lock_downgrade+0x8da/0x980 [ 25.039423] ? rcutorture_record_progress+0x10/0x10 [ 25.044419] ? __kernel_text_address+0xd/0x40 [ 25.048893] ? unwind_get_return_address+0x61/0xa0 [ 25.053802] hashlimit_mt+0x78/0x90 [ 25.057407] ? hashlimit_mt+0x78/0x90 [ 25.061187] ip6t_do_table+0x98d/0x1a30 [ 25.065144] ? kmem_cache_alloc_trace+0x136/0x740 [ 25.069966] ? mld_sendpack+0x617/0xe70 [ 25.073921] ? ip6t_error+0x60/0x60 [ 25.077525] ? __do_replace+0xc2/0xa70 [ 25.081487] ? check_noncircular+0x20/0x20 [ 25.085709] ? lock_acquire+0x1d5/0x580 [ 25.089661] ? lock_acquire+0x1d5/0x580 [ 25.093630] ? igmp6_mcf_seq_next+0x660/0x660 [ 25.098107] ? lock_release+0xa40/0xa40 [ 25.102159] ip6table_raw_hook+0x65/0x80 [ 25.106206] nf_hook_slow+0xba/0x1a0 [ 25.109906] nf_hook.constprop.37+0x3f6/0x830 [ 25.114382] ? igmp6_mcf_seq_next+0x660/0x660 [ 25.119472] ? trace_hardirqs_on+0xd/0x10 [ 25.123611] ? __local_bh_enable_ip+0x121/0x230 [ 25.128258] ? _raw_spin_unlock_bh+0x30/0x40 [ 25.132665] ? rt6_uncached_list_add+0x1b7/0x240 [ 25.137409] ? rt6_fill_node+0x18b0/0x18b0 [ 25.141624] ? icmp6_dst_alloc+0x475/0x660 [ 25.145836] ? ip6_mc_leave_src+0x1d0/0x1d0 [ 25.150138] ? icmpv6_flow_init+0x1f6/0x270 [ 25.154438] mld_sendpack+0x6c2/0xe70 [ 25.158217] ? nf_hook.constprop.37+0x830/0x830 [ 25.162860] ? mark_held_locks+0xaf/0x100 [ 25.166979] ? trace_hardirqs_on+0xd/0x10 [ 25.171118] ? __local_bh_enable_ip+0x121/0x230 [ 25.175761] mld_ifc_timer_expire+0x3d9/0x770 [ 25.180248] call_timer_fn+0x228/0x820 [ 25.184117] ? mld_dad_timer_expire+0x100/0x100 [ 25.188790] ? process_timeout+0x40/0x40 [ 25.192829] ? __run_timers+0x7e3/0xb70 [ 25.196795] ? lock_downgrade+0x980/0x980 [ 25.200919] ? debug_object_deactivate+0x364/0x560 [ 25.205834] ? lock_release+0xa40/0xa40 [ 25.209818] ? do_raw_spin_trylock+0x190/0x190 [ 25.214380] ? trace_hardirqs_on_caller+0x19e/0x5c0 [ 25.219457] ? mld_dad_timer_expire+0x100/0x100 [ 25.224099] ? mld_dad_timer_expire+0x100/0x100 [ 25.228755] __run_timers+0x7ee/0xb70 [ 25.232537] ? trigger_dyntick_cpu.isra.29+0x150/0x150 [ 25.237802] ? timerqueue_add+0x1e9/0x280 [ 25.241930] ? check_noncircular+0x20/0x20 [ 25.246144] ? enqueue_hrtimer+0x177/0x4b0 [ 25.250357] ? lock_release+0xa40/0xa40 [ 25.254309] ? retrigger_next_event+0x1e0/0x1e0 [ 25.259051] ? find_held_lock+0x35/0x1d0 [ 25.263089] ? clockevents_program_event+0x163/0x2e0 [ 25.268166] ? lock_downgrade+0x980/0x980 [ 25.272556] ? rcu_pm_notify+0xc0/0xc0 [ 25.276424] run_timer_softirq+0x4c/0x70 [ 25.281854] __do_softirq+0x2d7/0xb85 [ 25.285636] ? ktime_get+0x26f/0x3a0 [ 25.289419] ? __irqentry_text_end+0x1f8ee4/0x1f8ee4 [ 25.294504] ? do_timer+0x50/0x50 [ 25.297935] ? native_apic_msr_write+0x5c/0x80 [ 25.302500] ? lapic_next_event+0x54/0x80 [ 25.306626] ? clockevents_program_event+0x108/0x2e0 [ 25.311708] ? tick_program_event+0x83/0x100 [ 25.316092] ? rcu_pm_notify+0xc0/0xc0 [ 25.319966] irq_exit+0x1cc/0x200 [ 25.323392] smp_apic_timer_interrupt+0x16b/0x700 [ 25.328209] ? smp_reschedule_interrupt+0xe6/0x650 [ 25.333123] ? smp_call_function_single_interrupt+0x640/0x640 [ 25.339007] ? _raw_spin_lock+0x32/0x40 [ 25.342953] ? _raw_spin_unlock+0x22/0x30 [ 25.347075] ? handle_edge_irq+0x2b4/0x7c0 [ 25.351281] ? task_prio+0x50/0x50 [ 25.354804] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 25.359623] apic_timer_interrupt+0xa9/0xb0 [ 25.363913] [ 25.366136] RIP: 0010:lock_release+0x503/0xa40 [ 25.370707] RSP: 0018:ffff8801ba25f2b0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff12 [ 25.378397] RAX: dffffc0000000000 RBX: ffff8801b4428380 RCX: 1ffff1003688517d [ 25.385654] RDX: 1ffffffff0d592cd RSI: 0000000000000001 RDI: 0000000000000282 [ 25.392909] RBP: ffff8801ba25f3e0 R08: 0000000000000000 R09: 1ffff1003744be5f [ 25.400177] R10: ffff8801ba25f2c0 R11: 0000000000000000 R12: 0000000000000000 [ 25.407426] R13: ffff8801b4428380 R14: ffff8801ba25f2f8 R15: 1ffff1003744be5b [ 25.414700] ? __is_insn_slot_addr+0x1fc/0x330 [ 25.419258] ? lock_downgrade+0x980/0x980 [ 25.423379] ? lock_release+0xa40/0xa40 [ 25.427338] ? is_bpf_text_address+0x7b/0x120 [ 25.431809] __is_insn_slot_addr+0x225/0x330 [ 25.436195] ? __free_insn_slot+0x5c0/0x5c0 [ 25.440495] ? rcutorture_record_progress+0x10/0x10 [ 25.445511] ? __module_text_address+0x13/0x150 [ 25.450165] kernel_text_address+0x11b/0x140 [ 25.454561] __kernel_text_address+0xd/0x40 [ 25.458857] unwind_get_return_address+0x61/0xa0 [ 25.463585] __save_stack_trace+0x7e/0xd0 [ 25.467707] save_stack_trace+0x1a/0x20 [ 25.471655] save_stack+0x43/0xd0 [ 25.475084] ? save_stack+0x43/0xd0 [ 25.478685] ? kasan_kmalloc+0xad/0xe0 [ 25.482547] ? kmem_cache_alloc_node_trace+0x150/0x760 [ 25.487806] ? __get_vm_area_node+0xae/0x340 [ 25.492200] ? __vmalloc_node_range+0xa3/0x650 [ 25.496761] ? vzalloc+0x45/0x50 [ 25.500114] ? __do_replace+0xc2/0xa70 [ 25.503972] ? do_ip6t_set_ctl+0x40f/0x5f0 [ 25.508179] ? nf_setsockopt+0x67/0xc0 [ 25.512038] ? ipv6_setsockopt+0x10b/0x130 [ 25.516250] ? tcp_setsockopt+0x82/0xd0 [ 25.520198] ? sock_common_setsockopt+0x95/0xd0 [ 25.524843] ? SyS_setsockopt+0x189/0x360 [ 25.528969] ? do_syscall_64+0x282/0x940 [ 25.533009] ? entry_SYSCALL_64_after_hwframe+0x26/0x9b [ 25.538354] ? find_held_lock+0x35/0x1d0 [ 25.542409] ? trace_event_raw_event_sched_switch+0x810/0x810 [ 25.548280] ? xt_find_target+0x17b/0x1e0 [ 25.552405] ? rcu_note_context_switch+0x710/0x710 [ 25.557314] ? kasan_unpoison_shadow+0x35/0x50 [ 25.561877] kasan_kmalloc+0xad/0xe0 [ 25.565568] kmem_cache_alloc_node_trace+0x150/0x760 [ 25.570656] __get_vm_area_node+0xae/0x340 [ 25.574874] __vmalloc_node_range+0xa3/0x650 [ 25.579257] ? __do_replace+0xc2/0xa70 [ 25.583127] ? trace_hardirqs_on+0xd/0x10 [ 25.587258] vzalloc+0x45/0x50 [ 25.590423] ? __do_replace+0xc2/0xa70 [ 25.594294] __do_replace+0xc2/0xa70 [ 25.597995] ? compat_table_info+0x4a0/0x4a0 [ 25.602384] ? kasan_check_write+0x14/0x20 [ 25.606605] ? _copy_from_user+0x99/0x110 [ 25.610730] do_ip6t_set_ctl+0x40f/0x5f0 [ 25.614771] ? translate_compat_table+0x1c50/0x1c50 [ 25.619764] ? mutex_unlock+0xd/0x10 [ 25.623453] ? nf_sockopt_find.constprop.0+0x1a7/0x220 [ 25.628722] nf_setsockopt+0x67/0xc0 [ 25.632423] ipv6_setsockopt+0x10b/0x130 [ 25.636463] tcp_setsockopt+0x82/0xd0 [ 25.640245] sock_common_setsockopt+0x95/0xd0 [ 25.644719] SyS_setsockopt+0x189/0x360 [ 25.648678] ? SyS_recv+0x40/0x40 [ 25.652218] ? mm_fault_error+0x2c0/0x2c0 [ 25.657137] ? move_addr_to_kernel+0x60/0x60 [ 25.661527] ? do_syscall_64+0xb7/0x940 [ 25.665477] ? SyS_recv+0x40/0x40 [ 25.668906] do_syscall_64+0x282/0x940 [ 25.672772] ? __do_page_fault+0xc90/0xc90 [ 25.677160] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 25.681894] ? syscall_return_slowpath+0x550/0x550 [ 25.686803] ? syscall_return_slowpath+0x2ac/0x550 [ 25.691707] ? prepare_exit_to_usermode+0x350/0x350 [ 25.696702] ? retint_user+0x18/0x18 [ 25.700406] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 25.705231] entry_SYSCALL_64_after_hwframe+0x26/0x9b [ 25.710409] RIP: 0033:0x45689a [ 25.713579] RSP: 002b:00007fff9c7eab38 EFLAGS: 00000202 ORIG_RAX: 0000000000000036 [ 25.721269] RAX: ffffffffffffffda RBX: 00007fff9c7eab60 RCX: 000000000045689a [ 25.728532] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000003 [ 25.735783] RBP: 00000000006fd6c0 R08: 00000000000002e8 R09: 0000000000004000 [ 25.743043] R10: 00000000006fc8e0 R11: 0000000000000202 R12: 0000000000000000 [ 25.750302] R13: 0000000000000003 R14: 0000000000000029 R15: 00000000006fc940 2018/02/20 01:24:41 executed programs: 447 2018/02/20 01:24:46 executed programs: 1101