[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 16.874093] random: sshd: uninitialized urandom read (32 bytes read, 32 bits of entropy available) [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 21.341742] random: sshd: uninitialized urandom read (32 bytes read, 37 bits of entropy available) [ 21.835793] random: sshd: uninitialized urandom read (32 bytes read, 38 bits of entropy available) [ 22.755419] random: sshd: uninitialized urandom read (32 bytes read, 117 bits of entropy available) [ 22.924589] random: sshd: uninitialized urandom read (32 bytes read, 121 bits of entropy available) Warning: Permanently added '10.128.0.14' (ECDSA) to the list of known hosts. [ 28.335621] random: nonblocking pool is initialized executing program [ 28.458051] ================================================================== [ 28.465453] BUG: KASAN: use-after-free in __lock_acquire+0x387e/0x4b50 [ 28.472093] Read of size 8 at addr ffff8801d0412fb8 by task syzkaller073170/3324 [ 28.479589] [ 28.481184] CPU: 0 PID: 3324 Comm: syzkaller073170 Not tainted 4.4.111-gf851888 #16 [ 28.488941] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 28.498264] 0000000000000000 3e8c6184e6a857b7 ffff8801d16f7850 ffffffff81d0507d [ 28.506219] ffffea0007410480 ffff8801d0412fb8 0000000000000000 ffff8801d0412fb8 [ 28.514166] 0000000000000000 ffff8801d16f7888 ffffffff814fd433 ffff8801d0412fb8 [ 28.522111] Call Trace: [ 28.524664] [] dump_stack+0xc1/0x124 [ 28.529993] [] print_address_description+0x73/0x260 [ 28.536625] [] kasan_report+0x285/0x370 [ 28.542219] [] ? __lock_acquire+0x387e/0x4b50 [ 28.548327] [] __asan_report_load8_noabort+0x14/0x20 [ 28.555043] [] __lock_acquire+0x387e/0x4b50 [ 28.560978] [] ? __lock_acquire+0xb5f/0x4b50 [ 28.567006] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 28.573983] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 28.581309] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 28.590944] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 28.597928] [] lock_acquire+0x15e/0x460 [ 28.603524] [] ? remove_wait_queue+0x14/0x40 [ 28.609548] [] _raw_spin_lock_irqsave+0x4e/0x70 [ 28.617481] [] ? remove_wait_queue+0x14/0x40 [ 28.624979] [] remove_wait_queue+0x14/0x40 [ 28.630830] [] ep_unregister_pollwait.isra.6+0xa8/0x220 [ 28.637812] [] ? ep_unregister_pollwait.isra.6+0x114/0x220 [ 28.645051] [] ? ep_free+0x1c0/0x1c0 [ 28.650379] [] ep_free+0x93/0x1c0 [ 28.655447] [] ? ep_free+0x1c0/0x1c0 [ 28.660775] [] ep_eventpoll_release+0x44/0x60 [ 28.666888] [] __fput+0x233/0x6d0 [ 28.671963] [] ____fput+0x15/0x20 [ 28.677039] [] task_work_run+0x104/0x180 [ 28.683070] [] do_exit+0x871/0x2a20 [ 28.690057] [] ? handle_mm_fault+0x192d/0x3190 [ 28.696514] [] ? handle_mm_fault+0x3f2/0x3190 [ 28.702623] [] ? release_task+0x1240/0x1240 [ 28.708561] [] do_group_exit+0x108/0x320 [ 28.714236] [] SyS_exit_group+0x1d/0x20 [ 28.719823] [] ? do_group_exit+0x320/0x320 [ 28.726108] [] do_fast_syscall_32+0x314/0x890 [ 28.734580] [] sysenter_flags_fixed+0xd/0x17 [ 28.742423] [ 28.744016] Allocated by task 3324: [ 28.747603] [] save_stack_trace+0x26/0x50 [ 28.753479] [] save_stack+0x43/0xd0 [ 28.758833] [] kasan_kmalloc+0xad/0xe0 [ 28.764447] [] kmem_cache_alloc_trace+0x100/0x2b0 [ 28.771019] [] binder_get_thread+0x181/0x7a0 [ 28.777155] [] binder_poll+0x4a/0x210 [ 28.782686] [] SyS_epoll_ctl+0x10b1/0x2050 [ 28.790304] [] do_fast_syscall_32+0x314/0x890 [ 28.797056] [] sysenter_flags_fixed+0xd/0x17 [ 28.803199] [ 28.804792] Freed by task 3324: [ 28.808030] [] save_stack_trace+0x26/0x50 [ 28.813903] [] save_stack+0x43/0xd0 [ 28.819259] [] kasan_slab_free+0x72/0xc0 [ 28.825042] [] kfree+0xfc/0x300 [ 28.830048] [] binder_thread_dec_tmpref+0x1c1/0x250 [ 28.836794] [] binder_thread_release+0x27d/0x540 [ 28.843277] [] binder_ioctl+0xb94/0x12e0 [ 28.849069] [] compat_SyS_ioctl+0x28a/0x2540 [ 28.855205] [] do_fast_syscall_32+0x314/0x890 [ 28.861427] [] sysenter_flags_fixed+0xd/0x17 [ 28.867565] [ 28.869167] The buggy address belongs to the object at ffff8801d0412f00 [ 28.869167] which belongs to the cache kmalloc-512 of size 512 [ 28.881792] The buggy address is located 184 bytes inside of [ 28.881792] 512-byte region [ffff8801d0412f00, ffff8801d0413100) [ 28.894006] The buggy address belongs to the page: [ 29.332570] SELinux: Invalid class 0 [ 29.336568] ------------[ cut here ]------------ [ 29.341312] kernel BUG at security/selinux/avc.c:119! [ 29.346526] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 29.352389] Dumping ftrace buffer: [ 29.355921] (ftrace buffer empty) [ 29.359622] Modules linked in: [ 29.362933] CPU: 1 PID: 1734 Comm: udevd Not tainted 4.4.111-gf851888 #16 [ 29.369851] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.379200] task: ffff8801d3ac0000 task.stack: ffff8801d3ac8000 [ 29.385248] RIP: 0010:[] [] avc_audit_pre_callback+0x25f/0x2b0 [ 29.394583] RSP: 0018:ffff8801d3acf3d8 EFLAGS: 00010293 [ 29.400026] RAX: ffff8801d3ac0000 RBX: 0000000000000000 RCX: ffffffff81b498df [ 29.407295] RDX: 0000000000000000 RSI: 000000000000000d RDI: ffff8801d3acf660 [ 29.414560] RBP: ffff8801d3acf410 R08: ffffed003a0ab887 R09: ffffed003a0ab887 [ 29.421822] R10: 0000000000000001 R11: ffffed003a0ab886 R12: ffffffff839c6cc0 [ 29.429080] R13: 0000000000400000 R14: ffffffff81b49280 R15: ffffffff81b49680 [ 29.436344] FS: 00007f1599d127a0(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000 [ 29.444563] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.450442] CR2: 00005642386330d0 CR3: 00000001d3ab6000 CR4: 0000000000160670 [ 29.457728] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 29.464996] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 29.472255] Stack: [ 29.474391] ffff8801d85fc600 08a85c184676e5c3 1ffff1003a759e88 ffff8801d3acf790 [ 29.482428] ffff8801d85fc600 ffffffff81b49280 ffffffff81b49680 ffff8801d3acf610 [ 29.490457] ffffffff81bad348 ffff8801d3acf4a8 0000000000000046 0000000000000000 [ 29.501280] Call Trace: [ 29.504295] [] ? securityfs_remove+0x260/0x260 [ 29.510525] [] ? avc_audit_post_callback+0x400/0x400 [ 29.519039] [] common_lsm_audit+0x128/0x1a40 [ 29.526420] [] ? debug_object_active_state+0xfa/0x420 [ 29.533891] [] ? ipv6_skb_to_auditdata+0xd80/0xd80 [ 29.542310] [] ? debug_object_active_state+0x2b4/0x420 [ 29.549985] [] ? _raw_spin_unlock_irqrestore+0x45/0x70 [ 29.557921] [] ? debug_object_active_state+0x2b4/0x420 [ 29.564846] [] ? debug_object_assert_init+0x360/0x360 [ 29.571837] [] ? check_preemption_disabled+0x3b/0x200 [ 29.578672] [] ? trace_hardirqs_off+0xd/0x10 [ 29.585173] [] ? __call_rcu.constprop.69+0x223/0x930 [ 29.591933] [] ? avc_update_node+0x8e/0xa40 [ 29.597915] [] slow_avc_audit+0x181/0x210 [ 29.603717] [] ? avc_get_hash_stats+0x230/0x230 [ 29.610038] [] audit_inode_permission+0x1ec/0x310 [ 29.617308] [] ? selinux_cred_prepare+0xa0/0xa0 [ 29.624861] [] ? mutex_lock_nested+0x5d4/0x850 [ 29.631098] [] selinux_inode_permission+0x3f0/0x4b0 [ 29.637767] [] ? selinux_bprm_committed_creds+0x440/0x440 [ 29.644949] [] security_inode_permission+0xaf/0xf0 [ 29.651532] [] __inode_permission2+0x93/0x240 [ 29.657685] [] inode_permission2+0x2f/0x100 [ 29.663649] [] link_path_walk+0x8a8/0x16e0 [ 29.669528] [] ? walk_component+0xff0/0xff0 [ 29.675494] [] ? __mutex_init+0xca/0x100 [ 29.681215] [] path_openat+0x22d/0x3b60 [ 29.686838] [] ? path_mountpoint+0x830/0x830 [ 29.692891] [] ? getname_flags+0xcb/0x580 [ 29.701027] [] ? getname+0x19/0x20 [ 29.706911] [] ? do_sys_open+0x205/0x4b0 [ 29.713315] [] ? SyS_open+0x2d/0x40 [ 29.719291] [] ? entry_SYSCALL_64_fastpath+0x16/0x92 [ 29.726053] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 29.733073] [] ? __lock_is_held+0xa1/0xf0 [ 29.738878] [] do_filp_open+0x197/0x290 [ 29.744504] [] ? user_path_mountpoint_at+0x40/0x40 [ 29.751172] [] ? _raw_spin_unlock+0x2c/0x50 [ 29.757138] [] ? __alloc_fd+0x1e3/0x500 [ 29.762760] [] do_sys_open+0x343/0x4b0 [ 29.768295] [] ? filp_open+0x70/0x70 [ 29.773655] [] ? SyS_read+0x1b0/0x1b0 [ 29.779114] [] SyS_open+0x2d/0x40 [ 29.784218] [] entry_SYSCALL_64_fastpath+0x16/0x92 [ 29.790782] Code: ea 48 c7 c6 40 6e 9c 83 e8 4f 07 7f ff eb ad e8 b8 65 81 ff 48 8b 7d c8 48 c7 c6 80 6d 9c 83 e8 38 07 7f ff eb ab e8 a1 65 81 ff <0f> 0b e8 6a 41 9b ff e9 c2 fe ff ff 48 89 df e8 9d 41 9b ff e9 [ 29.817930] RIP [] avc_audit_pre_callback+0x25f/0x2b0 [ 29.825067] RSP [ 29.828846] ---[ end trace 38b944db3c1cb7b6 ]--- [ 29.833680] Kernel panic - not syncing: Fatal exception [ 30.682293] PANIC: double fault, error_code: 0x0 [ 30.687063] CPU: 0 PID: 3324 Comm: syzkaller073170 Tainted: G D 4.4.111-gf851888 #16 [ 30.696040] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 30.705363] task: ffff8801d1dc8000 task.stack: ffff8801d16f0000 [ 30.711393] RIP: 0010:[] [] dump_page_badflags+0x1a/0x250 [ 30.720235] RSP: 0018:ffff880100000000 EFLAGS: 00010086 [ 30.725650] RAX: ffff8801d1dc8000 RBX: ffffea0007410480 RCX: ffffffff8148f980 [ 30.732888] RDX: 0000000000000000 RSI: ffffffff838a83a0 RDI: ffffea0007410480 [ 30.740136] RBP: ffff880100000030 R08: 0000000000000001 R09: 0000000000000000 [ 30.749111] R10: 0000000000000002 R11: fffffbfff0ad781e R12: 0000000000000000 [ 30.756350] R13: ffffffff838a83a0 R14: 0000000000000000 R15: 0000000000000000 [ 30.763596] FS: 0000000000000000(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000 [ 30.771791] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 30.777647] CR2: ffff8800fffffff8 CR3: 000000000420c000 CR4: 0000000000160670 [ 30.784886] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 30.792124] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 30.799361] Stack: [ 30.801475] [ 30.803069] Call Trace: [ 30.805890] [ 30.808524] Code: e2 06 00 e9 1d fd ff ff 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 41 56 41 55 49 89 f5 41 54 49 89 d4 53 48 89 fb 48 83 ec 08 61 06 ed ff 48 8d 7b 10 48 b8 00 00 00 00 00 fc ff df 48 89 [ 30.963061] Shutting down cpus with NMI [ 30.967443] Dumping ftrace buffer: [ 30.970950] (ftrace buffer empty) [ 30.974631] Kernel Offset: disabled [ 30.978222] Rebooting in 86400 seconds..