syzkaller syzkaller login: [ 6.227216][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 12.467150][ T23] kauditd_printk_skb: 60 callbacks suppressed [ 12.467158][ T23] audit: type=1400 audit(1636817732.010:71): avc: denied { transition } for pid=291 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.482624][ T23] audit: type=1400 audit(1636817732.020:72): avc: denied { write } for pid=291 comm="sh" path="pipe:[11292]" dev="pipefs" ino=11292 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1 [ 12.503390][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 12.688470][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #282!!! Warning: Permanently added '10.128.10.22' (ECDSA) to the list of known hosts. 2021/11/13 15:35:39 fuzzer started 2021/11/13 15:35:39 connecting to host at 10.128.0.163:41969 2021/11/13 15:35:39 checking machine... 2021/11/13 15:35:39 checking revisions... 2021/11/13 15:35:39 testing simple program... [ 19.727495][ T23] audit: type=1400 audit(1636817739.270:73): avc: denied { getattr } for pid=363 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 19.747308][ T372] cgroup: Unknown subsys name 'net' [ 19.751213][ T23] audit: type=1400 audit(1636817739.270:74): avc: denied { read } for pid=363 comm="syz-fuzzer" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 19.778766][ T23] audit: type=1400 audit(1636817739.270:75): avc: denied { open } for pid=363 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 19.778950][ T372] cgroup: Unknown subsys name 'devices' [ 19.802743][ T23] audit: type=1400 audit(1636817739.280:76): avc: denied { read } for pid=363 comm="syz-fuzzer" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 19.832571][ T23] audit: type=1400 audit(1636817739.280:77): avc: denied { open } for pid=363 comm="syz-fuzzer" path="/dev/raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 19.856321][ T23] audit: type=1400 audit(1636817739.280:78): avc: denied { mounton } for pid=372 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1136 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 19.879838][ T23] audit: type=1400 audit(1636817739.280:79): avc: denied { mount } for pid=372 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.902591][ T23] audit: type=1400 audit(1636817739.300:80): avc: denied { unmount } for pid=372 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.018833][ T372] cgroup: Unknown subsys name 'hugetlb' [ 20.024846][ T372] cgroup: Unknown subsys name 'rlimit' [ 20.088475][ T23] audit: type=1400 audit(1636817739.630:81): avc: denied { setattr } for pid=372 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 20.126243][ T23] audit: type=1400 audit(1636817739.660:82): avc: denied { execmem } for pid=374 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 20.217110][ T375] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.224517][ T375] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.232456][ T375] device bridge_slave_0 entered promiscuous mode [ 20.239589][ T375] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.249954][ T375] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.257548][ T375] device bridge_slave_1 entered promiscuous mode [ 20.289314][ T375] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.296366][ T375] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.303990][ T375] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.311054][ T375] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.330294][ T24] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.338405][ T24] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.346252][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 20.354680][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.364214][ T72] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.373053][ T72] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.380209][ T72] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.397844][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.406480][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.415131][ T24] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.422380][ T24] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.429837][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.438785][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.451001][ T72] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 20.467643][ T24] ================================================================================ [ 20.477226][ T24] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:2023:28 [ 20.485185][ T24] member access within address ffffc9000019f1c0 with insufficient space [ 20.494372][ T24] for an object of type 'struct sk_buff' [ 20.500157][ T24] CPU: 1 PID: 24 Comm: kworker/1:1 Not tainted 5.10.79-syzkaller-01201-g87acf4924e1b #0 [ 20.510650][ T24] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 20.521000][ T24] Workqueue: ipv6_addrconf addrconf_dad_work [ 20.527054][ T24] Call Trace: [ 20.530340][ T24] dump_stack_lvl+0x1e2/0x24b [ 20.535018][ T24] ? show_regs_print_info+0x18/0x18 [ 20.540302][ T24] ? wg_allowedips_lookup_dst+0x190/0x190 [ 20.546018][ T24] dump_stack+0x15/0x1d [ 20.550200][ T24] ubsan_type_mismatch_common+0x1ed/0x3a0 [ 20.555916][ T24] ? __sanitizer_cov_trace_switch+0x74/0x90 [ 20.561810][ T24] __ubsan_handle_type_mismatch_v1+0x5b/0x70 [ 20.567813][ T24] wg_xmit+0x4a2/0xae0 [ 20.571907][ T24] ? worker_thread+0x709/0xa20 [ 20.576673][ T24] ? wg_stop+0x140/0x140 [ 20.580992][ T24] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20 [ 20.587252][ T24] netdev_start_xmit+0x8a/0x160 [ 20.592367][ T24] dev_hard_start_xmit+0x18d/0x2f0 [ 20.597773][ T24] __dev_queue_xmit+0xfbe/0x1bb0 [ 20.602717][ T24] ? dev_queue_xmit+0x20/0x20 [ 20.607388][ T24] ? __local_bh_enable_ip+0xa8/0x170 [ 20.612683][ T24] ? do_raw_spin_unlock+0x50/0x50 [ 20.617717][ T24] ? _local_bh_enable+0x30/0x30 [ 20.622771][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 20.629135][ T24] ? ndisc_constructor+0x690/0x8a0 [ 20.634418][ T24] ? _raw_write_unlock_bh+0x31/0x47 [ 20.639659][ T24] ? dev_hard_header+0xdb/0xf0 [ 20.644434][ T24] dev_queue_xmit+0x17/0x20 [ 20.648932][ T24] neigh_connected_output+0x288/0x2b0 [ 20.654310][ T24] ip6_finish_output2+0xde2/0x1440 [ 20.659554][ T24] ? __rcu_read_lock+0x50/0x50 [ 20.664436][ T24] ? __ip6_finish_output+0x520/0x520 [ 20.669723][ T24] ? dst_cow_metrics_generic+0x55/0x1d0 [ 20.675274][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 20.681506][ T24] ? ip6_skb_dst_mtu+0xaf/0x260 [ 20.686354][ T24] __ip6_finish_output+0x3e4/0x520 [ 20.691465][ T24] ip6_finish_output+0x3f/0x220 [ 20.696322][ T24] ? ip6_output+0x1d3/0x4b0 [ 20.700815][ T24] ip6_output+0x1f8/0x4b0 [ 20.705293][ T24] ? asan.module_dtor+0x20/0x20 [ 20.710151][ T24] ? skb_dst+0x40/0x40 [ 20.714299][ T24] ? __rcu_read_lock+0x50/0x50 [ 20.719106][ T24] ? selinux_ipv6_forward+0x50/0x50 [ 20.724325][ T24] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 20.730114][ T24] ? nf_hook_slow+0x150/0x1b0 [ 20.735198][ T24] NF_HOOK+0xdd/0x280 [ 20.739390][ T24] ? addrconf_addr_solict_mult+0xe0/0xe0 [ 20.745297][ T24] ? NF_HOOK+0x280/0x280 [ 20.750067][ T24] ? __rcu_read_lock+0x50/0x50 [ 20.754821][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 20.761044][ T24] ? ndisc_send_skb+0x547/0x9f0 [ 20.765895][ T24] ? memcpy+0x56/0x70 [ 20.769878][ T24] ndisc_send_skb+0x646/0x9f0 [ 20.774619][ T24] ? slab_post_alloc_hook+0x90/0xa0 [ 20.780122][ T24] ? ndisc_fill_addr_option+0x2f0/0x2f0 [ 20.785657][ T24] ? skb_set_owner_w+0x1a8/0x310 [ 20.790670][ T24] ? __sanitizer_cov_trace_cmp4+0x19/0x20 [ 20.796386][ T24] ? skb_put+0x11d/0x200 [ 20.801047][ T24] ndisc_send_rs+0x26c/0x360 [ 20.805704][ T24] addrconf_dad_completed+0x4f3/0x9f0 [ 20.811304][ T24] ? addrconf_dad_stop+0x430/0x430 [ 20.816407][ T24] addrconf_dad_work+0x9c1/0x1520 [ 20.821973][ T24] ? move_linked_works+0x118/0x130 [ 20.827227][ T24] ? ipv6_use_optimistic_addr+0x1d0/0x1d0 [ 20.832947][ T24] ? __kasan_check_write+0x14/0x20 [ 20.838049][ T24] process_one_work+0x3ca/0x660 [ 20.843027][ T24] worker_thread+0x709/0xa20 [ 20.847784][ T24] ? __kthread_parkme+0x11b/0x150 [ 20.853107][ T24] kthread+0x371/0x390 [ 20.857174][ T24] ? pr_cont_work+0x110/0x110 [ 20.861848][ T24] ? __list_add+0xc0/0xc0 [ 20.866280][ T24] ret_from_fork+0x1f/0x30 [ 20.871008][ T24] ================================================================================ [ 20.880612][ T24] ================================================================================ [ 20.890067][ T24] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:1916:2 [ 20.897814][ T24] member access within address ffffc9000019f1c0 with insufficient space [ 20.906388][ T24] for an object of type 'struct sk_buff' [ 20.912093][ T24] CPU: 1 PID: 24 Comm: kworker/1:1 Not tainted 5.10.79-syzkaller-01201-g87acf4924e1b #0 [ 20.922276][ T24] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 20.932543][ T24] Workqueue: ipv6_addrconf addrconf_dad_work [ 20.938604][ T24] Call Trace: [ 20.941900][ T24] dump_stack_lvl+0x1e2/0x24b [ 20.946671][ T24] ? show_regs_print_info+0x18/0x18 [ 20.951977][ T24] ? wg_allowedips_lookup_dst+0x190/0x190 [ 20.958227][ T24] dump_stack+0x15/0x1d [ 20.962379][ T24] ubsan_type_mismatch_common+0x1ed/0x3a0 [ 20.968106][ T24] __ubsan_handle_type_mismatch_v1+0x5b/0x70 [ 20.974199][ T24] wg_xmit+0x513/0xae0 [ 20.978360][ T24] ? worker_thread+0x709/0xa20 [ 20.983172][ T24] ? wg_stop+0x140/0x140 [ 20.987483][ T24] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20 [ 20.993716][ T24] netdev_start_xmit+0x8a/0x160 [ 20.998563][ T24] dev_hard_start_xmit+0x18d/0x2f0 [ 21.003674][ T24] __dev_queue_xmit+0xfbe/0x1bb0 [ 21.008606][ T24] ? dev_queue_xmit+0x20/0x20 [ 21.013288][ T24] ? __local_bh_enable_ip+0xa8/0x170 [ 21.018674][ T24] ? do_raw_spin_unlock+0x50/0x50 [ 21.023787][ T24] ? _local_bh_enable+0x30/0x30 [ 21.028637][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 21.034908][ T24] ? ndisc_constructor+0x690/0x8a0 [ 21.040008][ T24] ? _raw_write_unlock_bh+0x31/0x47 [ 21.045278][ T24] ? dev_hard_header+0xdb/0xf0 [ 21.050040][ T24] dev_queue_xmit+0x17/0x20 [ 21.054551][ T24] neigh_connected_output+0x288/0x2b0 [ 21.060076][ T24] ip6_finish_output2+0xde2/0x1440 [ 21.065192][ T24] ? __rcu_read_lock+0x50/0x50 [ 21.069986][ T24] ? __ip6_finish_output+0x520/0x520 [ 21.075279][ T24] ? dst_cow_metrics_generic+0x55/0x1d0 [ 21.080837][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 21.087225][ T24] ? ip6_skb_dst_mtu+0xaf/0x260 [ 21.092068][ T24] __ip6_finish_output+0x3e4/0x520 [ 21.097161][ T24] ip6_finish_output+0x3f/0x220 [ 21.102097][ T24] ? ip6_output+0x1d3/0x4b0 [ 21.106589][ T24] ip6_output+0x1f8/0x4b0 [ 21.110906][ T24] ? asan.module_dtor+0x20/0x20 [ 21.115755][ T24] ? skb_dst+0x40/0x40 [ 21.119822][ T24] ? __rcu_read_lock+0x50/0x50 [ 21.124683][ T24] ? selinux_ipv6_forward+0x50/0x50 [ 21.129895][ T24] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 21.135697][ T24] ? nf_hook_slow+0x150/0x1b0 [ 21.140377][ T24] NF_HOOK+0xdd/0x280 [ 21.144350][ T24] ? addrconf_addr_solict_mult+0xe0/0xe0 [ 21.150158][ T24] ? NF_HOOK+0x280/0x280 [ 21.154462][ T24] ? __rcu_read_lock+0x50/0x50 [ 21.159312][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 21.165639][ T24] ? ndisc_send_skb+0x547/0x9f0 [ 21.170486][ T24] ? memcpy+0x56/0x70 [ 21.174555][ T24] ndisc_send_skb+0x646/0x9f0 [ 21.179311][ T24] ? slab_post_alloc_hook+0x90/0xa0 [ 21.184621][ T24] ? ndisc_fill_addr_option+0x2f0/0x2f0 [ 21.190173][ T24] ? skb_set_owner_w+0x1a8/0x310 [ 21.195366][ T24] ? __sanitizer_cov_trace_cmp4+0x19/0x20 [ 21.201170][ T24] ? skb_put+0x11d/0x200 [ 21.205589][ T24] ndisc_send_rs+0x26c/0x360 [ 21.210179][ T24] addrconf_dad_completed+0x4f3/0x9f0 [ 21.215706][ T24] ? addrconf_dad_stop+0x430/0x430 [ 21.220821][ T24] addrconf_dad_work+0x9c1/0x1520 [ 21.225854][ T24] ? move_linked_works+0x118/0x130 [ 21.231104][ T24] ? ipv6_use_optimistic_addr+0x1d0/0x1d0 [ 21.236959][ T24] ? __kasan_check_write+0x14/0x20 [ 21.242338][ T24] process_one_work+0x3ca/0x660 [ 21.247175][ T24] worker_thread+0x709/0xa20 [ 21.251746][ T24] ? __kthread_parkme+0x11b/0x150 [ 21.256748][ T24] kthread+0x371/0x390 [ 21.262202][ T24] ? pr_cont_work+0x110/0x110 [ 21.267115][ T24] ? __list_add+0xc0/0xc0 [ 21.271506][ T24] ret_from_fork+0x1f/0x30 [ 21.276039][ T24] ================================================================================ [ 21.287009][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.295517][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2021/11/13 15:35:40 building call list... [ 21.305510][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.322262][ T375] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 21.917286][ T9] device bridge_slave_1 left promiscuous mode [ 21.923773][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.931651][ T9] device bridge_slave_0 left promiscuous mode [ 21.938330][ T9] bridge0: port 1(bridge_slave_0) entered disabled state