[ 63.504793][ T26] audit: type=1800 audit(1576308729.230:25): pid=8911 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 63.539880][ T26] audit: type=1800 audit(1576308729.230:26): pid=8911 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 63.561308][ T26] audit: type=1800 audit(1576308729.230:27): pid=8911 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [ 64.263910][ T8976] sshd (8976) used greatest stack depth: 22968 bytes left [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.1.39' (ECDSA) to the list of known hosts. 2019/12/14 07:32:44 parsed 1 programs syzkaller login: [ 100.075107][ T9073] as (9073) used greatest stack depth: 22840 bytes left 2019/12/14 07:32:46 executed programs: 0 [ 101.124339][ T9078] IPVS: ftp: loaded support on port[0] = 21 [ 101.190770][ T9078] chnl_net:caif_netlink_parms(): no params data found [ 101.220461][ T9078] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.229993][ T9078] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.238018][ T9078] device bridge_slave_0 entered promiscuous mode [ 101.246508][ T9078] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.253828][ T9078] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.261795][ T9078] device bridge_slave_1 entered promiscuous mode [ 101.282133][ T9078] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.293163][ T9078] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.311852][ T9078] team0: Port device team_slave_0 added [ 101.318960][ T9078] team0: Port device team_slave_1 added [ 101.374501][ T9078] device hsr_slave_0 entered promiscuous mode [ 101.412016][ T9078] device hsr_slave_1 entered promiscuous mode [ 101.484873][ T9078] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 101.544747][ T9078] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 101.613879][ T9078] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 101.664762][ T9078] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 101.734739][ T9078] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.741957][ T9078] bridge0: port 2(bridge_slave_1) entered forwarding state [ 101.749802][ T9078] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.756915][ T9078] bridge0: port 1(bridge_slave_0) entered forwarding state [ 101.795343][ T9078] 8021q: adding VLAN 0 to HW filter on device bond0 [ 101.810424][ T3397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 101.821176][ T3397] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.829922][ T3397] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.837970][ T3397] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 101.851319][ T9078] 8021q: adding VLAN 0 to HW filter on device team0 [ 101.863246][ T3041] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 101.872283][ T3041] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.879332][ T3041] bridge0: port 1(bridge_slave_0) entered forwarding state [ 101.893167][ T3397] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 101.901626][ T3397] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.908755][ T3397] bridge0: port 2(bridge_slave_1) entered forwarding state [ 101.933542][ T3041] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 101.942595][ T3041] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 101.951628][ T3041] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 101.960095][ T3041] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 101.969822][ T3041] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 101.978905][ T9078] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 101.995069][ T3041] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 102.004714][ T3041] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 102.017233][ T9078] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 103.298194][ T9303] [ 103.300564][ T9303] ===================================== [ 103.306190][ T9303] WARNING: bad unlock balance detected! [ 103.311805][ T9303] 5.5.0-rc1-next-20191213-syzkaller #0 Not tainted [ 103.318282][ T9303] ------------------------------------- [ 103.323911][ T9303] syz-executor.0/9303 is trying to release lock (&file->mut) at: [ 103.331635][ T9303] [] ucma_destroy_id+0x24a/0x490 [ 103.338248][ T9303] but there are no more locks to release! [ 103.343935][ T9303] [ 103.343935][ T9303] other info that might help us debug this: [ 103.351973][ T9303] 1 lock held by syz-executor.0/9303: [ 103.357581][ T9303] #0: ffff88809470fa60 (&file->mut){+.+.}, at: ucma_destroy_id+0x1e7/0x490 [ 103.366335][ T9303] [ 103.366335][ T9303] stack backtrace: [ 103.372208][ T9303] CPU: 0 PID: 9303 Comm: syz-executor.0 Not tainted 5.5.0-rc1-next-20191213-syzkaller #0 [ 103.381982][ T9303] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 103.392021][ T9303] Call Trace: [ 103.395295][ T9303] dump_stack+0x197/0x210 [ 103.399602][ T9303] ? ucma_destroy_id+0x24a/0x490 [ 103.404517][ T9303] print_unlock_imbalance_bug.cold+0x114/0x123 [ 103.410658][ T9303] ? ucma_destroy_id+0x24a/0x490 [ 103.415573][ T9303] lock_release+0x5f2/0x960 [ 103.420055][ T9303] ? lock_downgrade+0x920/0x920 [ 103.424880][ T9303] ? ucma_destroy_id+0x1e7/0x490 [ 103.429878][ T9303] ? ucma_destroy_id+0x1c0/0x490 [ 103.435918][ T9303] ? mutex_trylock+0x2f0/0x2f0 [ 103.440655][ T9303] ? ucma_destroy_id+0x1c0/0x490 [ 103.445577][ T9303] __mutex_unlock_slowpath+0x86/0x6a0 [ 103.450918][ T9303] ? lock_downgrade+0x920/0x920 [ 103.455759][ T9303] ? wait_for_completion+0x440/0x440 [ 103.461024][ T9303] mutex_unlock+0x1b/0x30 [ 103.465335][ T9303] ucma_destroy_id+0x24a/0x490 [ 103.470080][ T9303] ? ucma_close+0x310/0x310 [ 103.474564][ T9303] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 103.480778][ T9303] ? _copy_from_user+0x12c/0x1a0 [ 103.485691][ T9303] ucma_write+0x2d7/0x3c0 [ 103.489991][ T9303] ? ucma_close+0x310/0x310 [ 103.494475][ T9303] ? ucma_open+0x290/0x290 [ 103.498877][ T9303] ? apparmor_file_permission+0x27/0x30 [ 103.504406][ T9303] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 103.510629][ T9303] ? security_file_permission+0x8f/0x380 [ 103.516238][ T9303] __vfs_write+0x8a/0x110 [ 103.520541][ T9303] ? ucma_open+0x290/0x290 [ 103.524933][ T9303] vfs_write+0x268/0x5d0 [ 103.529149][ T9303] ksys_write+0x220/0x290 [ 103.533460][ T9303] ? __ia32_sys_read+0xb0/0xb0 [ 103.538198][ T9303] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 103.543628][ T9303] ? do_syscall_64+0x26/0x790 [ 103.548287][ T9303] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 103.554343][ T9303] ? do_syscall_64+0x26/0x790 [ 103.559020][ T9303] __x64_sys_write+0x73/0xb0 [ 103.563591][ T9303] do_syscall_64+0xfa/0x790 [ 103.568102][ T9303] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 103.573971][ T9303] RIP: 0033:0x45a909 [ 103.577851][ T9303] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 103.597433][ T9303] RSP: 002b:00007fab4c93fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 103.605913][ T9303] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a909 [ 103.613866][ T9303] RDX: 0000000000000018 RSI: 0000000020000140 RDI: 0000000000000003 [ 103.621824][ T9303] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 103.629787][ T9303] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fab4c9406d4 [ 103.637983][ T9303] R13: 00000000004d3a70 R14: 00000000004e5710 R15: 00000000ffffffff [ 103.649032][ T9303] ================================================================== [ 103.661627][ T9303] BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x93/0x6a0 [ 103.669499][ T9303] Read of size 8 at addr ffff8880a7850c00 by task syz-executor.0/9303 [ 103.677623][ T9303] [ 103.679941][ T9303] CPU: 0 PID: 9303 Comm: syz-executor.0 Not tainted 5.5.0-rc1-next-20191213-syzkaller #0 [ 103.689720][ T9303] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 103.699784][ T9303] Call Trace: [ 103.703067][ T9303] dump_stack+0x197/0x210 [ 103.707436][ T9303] ? __mutex_unlock_slowpath+0x93/0x6a0 [ 103.712961][ T9303] print_address_description.constprop.0.cold+0xd4/0x30b [ 103.719956][ T9303] ? __mutex_unlock_slowpath+0x93/0x6a0 [ 103.725476][ T9303] ? __mutex_unlock_slowpath+0x93/0x6a0 [ 103.730996][ T9303] __kasan_report.cold+0x1b/0x41 [ 103.735915][ T9303] ? __mutex_unlock_slowpath+0x93/0x6a0 [ 103.741437][ T9303] kasan_report+0x12/0x20 [ 103.745756][ T9303] check_memory_region+0x134/0x1a0 [ 103.750843][ T9303] __kasan_check_read+0x11/0x20 [ 103.755692][ T9303] __mutex_unlock_slowpath+0x93/0x6a0 [ 103.761040][ T9303] ? lock_downgrade+0x920/0x920 [ 103.765888][ T9303] ? wait_for_completion+0x440/0x440 [ 103.771161][ T9303] mutex_unlock+0x1b/0x30 [ 103.775469][ T9303] ucma_destroy_id+0x24a/0x490 [ 103.780206][ T9303] ? ucma_close+0x310/0x310 [ 103.784686][ T9303] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 103.790909][ T9303] ? _copy_from_user+0x12c/0x1a0 [ 103.795834][ T9303] ucma_write+0x2d7/0x3c0 [ 103.800138][ T9303] ? ucma_close+0x310/0x310 [ 103.804614][ T9303] ? ucma_open+0x290/0x290 [ 103.809003][ T9303] ? apparmor_file_permission+0x27/0x30 [ 103.814533][ T9303] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 103.820753][ T9303] ? security_file_permission+0x8f/0x380 [ 103.826364][ T9303] __vfs_write+0x8a/0x110 [ 103.830668][ T9303] ? ucma_open+0x290/0x290 [ 103.835061][ T9303] vfs_write+0x268/0x5d0 [ 103.839279][ T9303] ksys_write+0x220/0x290 [ 103.843585][ T9303] ? __ia32_sys_read+0xb0/0xb0 [ 103.848326][ T9303] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 103.853759][ T9303] ? do_syscall_64+0x26/0x790 [ 103.858415][ T9303] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 103.864491][ T9303] ? do_syscall_64+0x26/0x790 [ 103.869144][ T9303] __x64_sys_write+0x73/0xb0 [ 103.873716][ T9303] do_syscall_64+0xfa/0x790 [ 103.878196][ T9303] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 103.884065][ T9303] RIP: 0033:0x45a909 [ 103.887934][ T9303] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 103.907514][ T9303] RSP: 002b:00007fab4c93fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 103.915912][ T9303] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a909 [ 103.923875][ T9303] RDX: 0000000000000018 RSI: 0000000020000140 RDI: 0000000000000003 [ 103.931823][ T9303] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 103.939775][ T9303] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fab4c9406d4 [ 103.947730][ T9303] R13: 00000000004d3a70 R14: 00000000004e5710 R15: 00000000ffffffff [ 103.955704][ T9303] [ 103.958015][ T9303] Allocated by task 9307: [ 103.962342][ T9303] save_stack+0x23/0x90 [ 103.966485][ T9303] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 103.972100][ T9303] kasan_kmalloc+0x9/0x10 [ 103.976405][ T9303] kmem_cache_alloc_trace+0x158/0x790 [ 103.981762][ T9303] ucma_open+0x4f/0x290 [ 103.985896][ T9303] misc_open+0x395/0x4c0 [ 103.990114][ T9303] chrdev_open+0x245/0x6b0 [ 103.994504][ T9303] do_dentry_open+0x4ca/0x1350 [ 103.999241][ T9303] vfs_open+0xa0/0xd0 [ 104.003204][ T9303] path_openat+0x12fd/0x34d0 [ 104.007788][ T9303] do_filp_open+0x192/0x260 [ 104.012289][ T9303] do_sys_openat2+0x633/0x840 [ 104.016939][ T9303] do_sys_open+0xfc/0x190 [ 104.021255][ T9303] __x64_sys_openat+0x9d/0x100 [ 104.026007][ T9303] do_syscall_64+0xfa/0x790 [ 104.030487][ T9303] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 104.036346][ T9303] [ 104.038656][ T9303] Freed by task 9297: [ 104.042622][ T9303] save_stack+0x23/0x90 [ 104.046759][ T9303] __kasan_slab_free+0x102/0x150 [ 104.053843][ T9303] kasan_slab_free+0xe/0x10 [ 104.058335][ T9303] kfree+0x10a/0x2c0 [ 104.062221][ T9303] ucma_close+0x275/0x310 [ 104.066533][ T9303] __fput+0x2ff/0x890 [ 104.070511][ T9303] ____fput+0x16/0x20 [ 104.074496][ T9303] task_work_run+0x145/0x1c0 [ 104.079078][ T9303] exit_to_usermode_loop+0x316/0x380 [ 104.084357][ T9303] do_syscall_64+0x676/0x790 [ 104.088933][ T9303] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 104.094802][ T9303] [ 104.097112][ T9303] The buggy address belongs to the object at ffff8880a7850c00 [ 104.097112][ T9303] which belongs to the cache kmalloc-256 of size 256 [ 104.111231][ T9303] The buggy address is located 0 bytes inside of [ 104.111231][ T9303] 256-byte region [ffff8880a7850c00, ffff8880a7850d00) [ 104.124313][ T9303] The buggy address belongs to the page: [ 104.129924][ T9303] page:ffffea00029e1400 refcount:1 mapcount:0 mapping:ffff8880aa4008c0 index:0x0 [ 104.139063][ T9303] raw: 00fffe0000000200 ffffea000251c3c8 ffff8880aa401648 ffff8880aa4008c0 [ 104.147675][ T9303] raw: 0000000000000000 ffff8880a7850000 0000000100000008 0000000000000000 [ 104.156237][ T9303] page dumped because: kasan: bad access detected [ 104.162639][ T9303] [ 104.164963][ T9303] Memory state around the buggy address: [ 104.170585][ T9303] ffff8880a7850b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 104.178650][ T9303] ffff8880a7850b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 104.186687][ T9303] >ffff8880a7850c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 104.194732][ T9303] ^ [ 104.198778][ T9303] ffff8880a7850c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 104.206818][ T9303] ffff8880a7850d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 104.214853][ T9303] ================================================================== [ 104.225748][ T9303] Kernel panic - not syncing: panic_on_warn set ... [ 104.232373][ T9303] CPU: 0 PID: 9303 Comm: syz-executor.0 Tainted: G B 5.5.0-rc1-next-20191213-syzkaller #0 [ 104.243564][ T9303] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 104.253605][ T9303] Call Trace: [ 104.257137][ T9303] dump_stack+0x197/0x210 [ 104.261446][ T9303] panic+0x2e3/0x75c [ 104.265320][ T9303] ? add_taint.cold+0x16/0x16 [ 104.269987][ T9303] ? __mutex_unlock_slowpath+0x93/0x6a0 [ 104.275537][ T9303] ? preempt_schedule+0x4b/0x60 [ 104.280392][ T9303] ? ___preempt_schedule+0x16/0x18 [ 104.285920][ T9303] ? trace_hardirqs_on+0x5e/0x240 [ 104.290924][ T9303] ? __mutex_unlock_slowpath+0x93/0x6a0 [ 104.296469][ T9303] end_report+0x47/0x4f [ 104.300617][ T9303] ? __mutex_unlock_slowpath+0x93/0x6a0 [ 104.306152][ T9303] __kasan_report.cold+0xe/0x41 [ 104.310995][ T9303] ? __mutex_unlock_slowpath+0x93/0x6a0 [ 104.316540][ T9303] kasan_report+0x12/0x20 [ 104.320871][ T9303] check_memory_region+0x134/0x1a0 [ 104.326002][ T9303] __kasan_check_read+0x11/0x20 [ 104.330844][ T9303] __mutex_unlock_slowpath+0x93/0x6a0 [ 104.336196][ T9303] ? lock_downgrade+0x920/0x920 [ 104.341023][ T9303] ? wait_for_completion+0x440/0x440 [ 104.346983][ T9303] mutex_unlock+0x1b/0x30 [ 104.351311][ T9303] ucma_destroy_id+0x24a/0x490 [ 104.356053][ T9303] ? ucma_close+0x310/0x310 [ 104.360623][ T9303] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 104.366861][ T9303] ? _copy_from_user+0x12c/0x1a0 [ 104.371780][ T9303] ucma_write+0x2d7/0x3c0 [ 104.376100][ T9303] ? ucma_close+0x310/0x310 [ 104.380597][ T9303] ? ucma_open+0x290/0x290 [ 104.385000][ T9303] ? apparmor_file_permission+0x27/0x30 [ 104.390552][ T9303] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 104.396807][ T9303] ? security_file_permission+0x8f/0x380 [ 104.402502][ T9303] __vfs_write+0x8a/0x110 [ 104.406831][ T9303] ? ucma_open+0x290/0x290 [ 104.411235][ T9303] vfs_write+0x268/0x5d0 [ 104.415486][ T9303] ksys_write+0x220/0x290 [ 104.419918][ T9303] ? __ia32_sys_read+0xb0/0xb0 [ 104.424685][ T9303] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 104.430142][ T9303] ? do_syscall_64+0x26/0x790 [ 104.434820][ T9303] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 104.440904][ T9303] ? do_syscall_64+0x26/0x790 [ 104.445568][ T9303] __x64_sys_write+0x73/0xb0 [ 104.450144][ T9303] do_syscall_64+0xfa/0x790 [ 104.454640][ T9303] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 104.460605][ T9303] RIP: 0033:0x45a909 [ 104.464495][ T9303] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 104.484081][ T9303] RSP: 002b:00007fab4c93fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 104.492471][ T9303] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a909 [ 104.500428][ T9303] RDX: 0000000000000018 RSI: 0000000020000140 RDI: 0000000000000003 [ 104.508378][ T9303] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 104.516326][ T9303] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fab4c9406d4 [ 104.524278][ T9303] R13: 00000000004d3a70 R14: 00000000004e5710 R15: 00000000ffffffff [ 104.533599][ T9303] Kernel Offset: disabled [ 104.537954][ T9303] Rebooting in 86400 seconds..