syzkaller syzkaller login: [ 5.210344][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!! [ 10.330214][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 10.483630][ T23] kauditd_printk_skb: 60 callbacks suppressed [ 10.483638][ T23] audit: type=1400 audit(1638204813.660:71): avc: denied { transition } for pid=289 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 10.490476][ T23] audit: type=1400 audit(1638204813.670:72): avc: denied { write } for pid=289 comm="sh" path="pipe:[11373]" dev="pipefs" ino=11373 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1 [ 10.930158][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 11.690259][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #c0!!! Warning: Permanently added '10.128.1.57' (ECDSA) to the list of known hosts. 2021/11/29 16:53:40 fuzzer started 2021/11/29 16:53:40 connecting to host at 10.128.0.163:39139 2021/11/29 16:53:40 checking machine... 2021/11/29 16:53:40 checking revisions... 2021/11/29 16:53:40 testing simple program... [ 17.614232][ T23] audit: type=1400 audit(1638204820.790:73): avc: denied { getattr } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 17.630969][ T371] cgroup: Unknown subsys name 'net' [ 17.637650][ T23] audit: type=1400 audit(1638204820.790:74): avc: denied { read } for pid=362 comm="syz-fuzzer" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 17.664116][ T23] audit: type=1400 audit(1638204820.790:75): avc: denied { open } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 17.664280][ T371] cgroup: Unknown subsys name 'devices' [ 17.687668][ T23] audit: type=1400 audit(1638204820.790:76): avc: denied { read } for pid=362 comm="syz-fuzzer" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 17.715946][ T23] audit: type=1400 audit(1638204820.790:77): avc: denied { open } for pid=362 comm="syz-fuzzer" path="/dev/raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 17.739279][ T23] audit: type=1400 audit(1638204820.790:78): avc: denied { mounton } for pid=371 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1136 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 17.762208][ T23] audit: type=1400 audit(1638204820.790:79): avc: denied { mount } for pid=371 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 17.784362][ T23] audit: type=1400 audit(1638204820.820:80): avc: denied { unmount } for pid=371 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 17.862359][ T371] cgroup: Unknown subsys name 'hugetlb' [ 17.868148][ T371] cgroup: Unknown subsys name 'rlimit' [ 17.991220][ T23] audit: type=1400 audit(1638204821.170:81): avc: denied { setattr } for pid=371 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 18.014913][ T23] audit: type=1400 audit(1638204821.190:82): avc: denied { execmem } for pid=372 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 18.093673][ T373] bridge0: port 1(bridge_slave_0) entered blocking state [ 18.100887][ T373] bridge0: port 1(bridge_slave_0) entered disabled state [ 18.108241][ T373] device bridge_slave_0 entered promiscuous mode [ 18.115454][ T373] bridge0: port 2(bridge_slave_1) entered blocking state [ 18.122534][ T373] bridge0: port 2(bridge_slave_1) entered disabled state [ 18.130044][ T373] device bridge_slave_1 entered promiscuous mode [ 18.161069][ T373] bridge0: port 2(bridge_slave_1) entered blocking state [ 18.168500][ T373] bridge0: port 2(bridge_slave_1) entered forwarding state [ 18.176039][ T373] bridge0: port 1(bridge_slave_0) entered blocking state [ 18.183105][ T373] bridge0: port 1(bridge_slave_0) entered forwarding state [ 18.202093][ T38] bridge0: port 1(bridge_slave_0) entered disabled state [ 18.209428][ T38] bridge0: port 2(bridge_slave_1) entered disabled state [ 18.217704][ T38] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 18.225682][ T38] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 18.234981][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 18.243235][ T24] bridge0: port 1(bridge_slave_0) entered blocking state [ 18.250522][ T24] bridge0: port 1(bridge_slave_0) entered forwarding state [ 18.260894][ T38] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 18.269051][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 18.276112][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 18.287823][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 18.311021][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 18.319757][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 18.328875][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 18.337343][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 18.345544][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 18.354896][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 18.365726][ T38] ================================================================================ [ 18.375340][ T38] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:2023:28 [ 18.383391][ T38] member access within address ffffc9000023f1c0 with insufficient space [ 18.391919][ T38] for an object of type 'struct sk_buff' [ 18.397618][ T38] CPU: 1 PID: 38 Comm: kworker/1:1 Not tainted 5.10.82-syzkaller-00156-g8d21bcc704ea #0 [ 18.407950][ T38] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 18.418108][ T38] Workqueue: ipv6_addrconf addrconf_dad_work [ 18.424662][ T38] Call Trace: [ 18.427946][ T38] dump_stack_lvl+0x1e2/0x24b [ 18.432645][ T38] ? show_regs_print_info+0x18/0x18 [ 18.438560][ T38] ? wg_allowedips_lookup_dst+0x190/0x190 [ 18.444275][ T38] dump_stack+0x15/0x1d [ 18.448973][ T38] ubsan_type_mismatch_common+0x1ed/0x3a0 [ 18.454769][ T38] ? __sanitizer_cov_trace_switch+0x74/0x90 [ 18.460666][ T38] __ubsan_handle_type_mismatch_v1+0x5b/0x70 [ 18.466858][ T38] wg_xmit+0x4a2/0xae0 [ 18.470926][ T38] ? wg_stop+0x140/0x140 [ 18.475181][ T38] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20 [ 18.481496][ T38] netdev_start_xmit+0x8a/0x160 [ 18.486374][ T38] dev_hard_start_xmit+0x18d/0x2f0 [ 18.491587][ T38] __dev_queue_xmit+0xfbe/0x1bb0 [ 18.496532][ T38] ? __local_bh_enable_ip+0xa8/0x170 [ 18.501811][ T38] ? ndisc_mc_map+0x329/0x9e0 [ 18.506474][ T38] ? dev_queue_xmit+0x20/0x20 [ 18.511140][ T38] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 18.517473][ T38] ? ndisc_constructor+0x690/0x8a0 [ 18.522616][ T38] ? _raw_write_unlock_bh+0x31/0x47 [ 18.527802][ T38] ? ___neigh_create+0x162d/0x1ab0 [ 18.533024][ T38] ? dev_hard_header+0xdb/0xf0 [ 18.537882][ T38] dev_queue_xmit+0x17/0x20 [ 18.542380][ T38] neigh_connected_output+0x288/0x2b0 [ 18.547773][ T38] ip6_finish_output2+0xde2/0x1440 [ 18.552932][ T38] ? __rcu_read_lock+0x50/0x50 [ 18.557715][ T38] ? __ip6_finish_output+0x520/0x520 [ 18.563006][ T38] ? dst_cow_metrics_generic+0x55/0x1d0 [ 18.568544][ T38] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 18.574787][ T38] ? ip6_skb_dst_mtu+0xaf/0x260 [ 18.579627][ T38] __ip6_finish_output+0x3e4/0x520 [ 18.584899][ T38] ip6_finish_output+0x3f/0x220 [ 18.589846][ T38] ? ip6_output+0x1d3/0x4b0 [ 18.594342][ T38] ip6_output+0x1f8/0x4b0 [ 18.598663][ T38] ? asan.module_dtor+0x20/0x20 [ 18.603500][ T38] ? skb_dst+0x40/0x40 [ 18.607554][ T38] ? __rcu_read_lock+0x50/0x50 [ 18.612317][ T38] ? selinux_ipv6_forward+0x50/0x50 [ 18.617501][ T38] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 18.623211][ T38] ? nf_hook_slow+0x150/0x1b0 [ 18.627884][ T38] NF_HOOK+0xdd/0x280 [ 18.632222][ T38] ? addrconf_addr_solict_mult+0xe0/0xe0 [ 18.638030][ T38] ? NF_HOOK+0x280/0x280 [ 18.642340][ T38] ? __rcu_read_lock+0x50/0x50 [ 18.647100][ T38] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 18.653325][ T38] ? ndisc_send_skb+0x547/0x9f0 [ 18.658177][ T38] ? memcpy+0x56/0x70 [ 18.662506][ T38] ndisc_send_skb+0x646/0x9f0 [ 18.667177][ T38] ? slab_post_alloc_hook+0x90/0xa0 [ 18.672738][ T38] ? ndisc_fill_addr_option+0x2f0/0x2f0 [ 18.678472][ T38] ? skb_set_owner_w+0x1a8/0x310 [ 18.683674][ T38] ? __sanitizer_cov_trace_cmp4+0x19/0x20 [ 18.689570][ T38] ? skb_put+0x11d/0x200 [ 18.693815][ T38] ndisc_send_rs+0x26c/0x360 [ 18.698562][ T38] addrconf_dad_completed+0x4f3/0x9f0 [ 18.703965][ T38] ? addrconf_dad_stop+0x430/0x430 [ 18.709101][ T38] ? __queue_delayed_work+0x16c/0x1f0 [ 18.714468][ T38] addrconf_dad_work+0x9c1/0x1520 [ 18.719485][ T38] ? __kasan_check_write+0x14/0x20 [ 18.724599][ T38] ? ipv6_use_optimistic_addr+0x1d0/0x1d0 [ 18.730310][ T38] ? __kasan_check_write+0x14/0x20 [ 18.735418][ T38] process_one_work+0x3ca/0x660 [ 18.740470][ T38] worker_thread+0x709/0xa20 [ 18.745066][ T38] ? __kthread_parkme+0x11b/0x150 [ 18.750076][ T38] kthread+0x371/0x390 [ 18.754134][ T38] ? pr_cont_work+0x110/0x110 [ 18.758785][ T38] ? __list_add+0xc0/0xc0 [ 18.763089][ T38] ret_from_fork+0x1f/0x30 [ 18.767559][ T38] ================================================================================ [ 18.777030][ T38] ================================================================================ [ 18.786376][ T38] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:1916:2 [ 18.794289][ T38] member access within address ffffc9000023f1c0 with insufficient space [ 18.802889][ T38] for an object of type 'struct sk_buff' [ 18.808519][ T38] CPU: 1 PID: 38 Comm: kworker/1:1 Not tainted 5.10.82-syzkaller-00156-g8d21bcc704ea #0 [ 18.818215][ T38] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 18.828265][ T38] Workqueue: ipv6_addrconf addrconf_dad_work [ 18.834507][ T38] Call Trace: [ 18.837776][ T38] dump_stack_lvl+0x1e2/0x24b [ 18.842433][ T38] ? show_regs_print_info+0x18/0x18 [ 18.847782][ T38] ? wg_allowedips_lookup_dst+0x190/0x190 [ 18.853724][ T38] dump_stack+0x15/0x1d [ 18.857888][ T38] ubsan_type_mismatch_common+0x1ed/0x3a0 [ 18.863706][ T38] __ubsan_handle_type_mismatch_v1+0x5b/0x70 [ 18.869894][ T38] wg_xmit+0x513/0xae0 [ 18.873959][ T38] ? wg_stop+0x140/0x140 [ 18.878207][ T38] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20 [ 18.884453][ T38] netdev_start_xmit+0x8a/0x160 [ 18.889312][ T38] dev_hard_start_xmit+0x18d/0x2f0 [ 18.894401][ T38] __dev_queue_xmit+0xfbe/0x1bb0 [ 18.899332][ T38] ? __local_bh_enable_ip+0xa8/0x170 [ 18.904594][ T38] ? ndisc_mc_map+0x329/0x9e0 [ 18.909260][ T38] ? dev_queue_xmit+0x20/0x20 [ 18.914042][ T38] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 18.920286][ T38] ? ndisc_constructor+0x690/0x8a0 [ 18.925394][ T38] ? _raw_write_unlock_bh+0x31/0x47 [ 18.930588][ T38] ? ___neigh_create+0x162d/0x1ab0 [ 18.935784][ T38] ? dev_hard_header+0xdb/0xf0 [ 18.940536][ T38] dev_queue_xmit+0x17/0x20 [ 18.945022][ T38] neigh_connected_output+0x288/0x2b0 [ 18.950394][ T38] ip6_finish_output2+0xde2/0x1440 [ 18.955499][ T38] ? __rcu_read_lock+0x50/0x50 [ 18.960330][ T38] ? __ip6_finish_output+0x520/0x520 [ 18.965612][ T38] ? dst_cow_metrics_generic+0x55/0x1d0 [ 18.971326][ T38] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 18.977560][ T38] ? ip6_skb_dst_mtu+0xaf/0x260 [ 18.982396][ T38] __ip6_finish_output+0x3e4/0x520 [ 18.987506][ T38] ip6_finish_output+0x3f/0x220 [ 18.992453][ T38] ? ip6_output+0x1d3/0x4b0 [ 18.997026][ T38] ip6_output+0x1f8/0x4b0 [ 19.001331][ T38] ? asan.module_dtor+0x20/0x20 [ 19.006155][ T38] ? skb_dst+0x40/0x40 [ 19.010222][ T38] ? __rcu_read_lock+0x50/0x50 [ 19.015075][ T38] ? selinux_ipv6_forward+0x50/0x50 [ 19.020351][ T38] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 19.026157][ T38] ? nf_hook_slow+0x150/0x1b0 [ 19.030823][ T38] NF_HOOK+0xdd/0x280 [ 19.034978][ T38] ? addrconf_addr_solict_mult+0xe0/0xe0 [ 19.040838][ T38] ? NF_HOOK+0x280/0x280 [ 19.045083][ T38] ? __rcu_read_lock+0x50/0x50 [ 19.049837][ T38] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 19.056149][ T38] ? ndisc_send_skb+0x547/0x9f0 [ 19.060977][ T38] ? memcpy+0x56/0x70 [ 19.064938][ T38] ndisc_send_skb+0x646/0x9f0 [ 19.069615][ T38] ? slab_post_alloc_hook+0x90/0xa0 [ 19.074795][ T38] ? ndisc_fill_addr_option+0x2f0/0x2f0 [ 19.080581][ T38] ? skb_set_owner_w+0x1a8/0x310 [ 19.085575][ T38] ? __sanitizer_cov_trace_cmp4+0x19/0x20 [ 19.091273][ T38] ? skb_put+0x11d/0x200 [ 19.095493][ T38] ndisc_send_rs+0x26c/0x360 [ 19.100064][ T38] addrconf_dad_completed+0x4f3/0x9f0 [ 19.105414][ T38] ? addrconf_dad_stop+0x430/0x430 [ 19.110507][ T38] ? __queue_delayed_work+0x16c/0x1f0 [ 19.115854][ T38] addrconf_dad_work+0x9c1/0x1520 [ 19.120856][ T38] ? __kasan_check_write+0x14/0x20 [ 19.126044][ T38] ? ipv6_use_optimistic_addr+0x1d0/0x1d0 [ 19.131747][ T38] ? __kasan_check_write+0x14/0x20 [ 19.136937][ T38] process_one_work+0x3ca/0x660 [ 19.141858][ T38] worker_thread+0x709/0xa20 [ 19.146445][ T38] ? __kthread_parkme+0x11b/0x150 [ 19.151453][ T38] kthread+0x371/0x390 [ 19.155506][ T38] ? pr_cont_work+0x110/0x110 [ 19.160164][ T38] ? __list_add+0xc0/0xc0 2021/11/29 16:53:42 building call list... [ 19.164473][ T38] ret_from_fork+0x1f/0x30 [ 19.168953][ T38] ================================================================================ [ 19.187841][ T373] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 19.720461][ T260] device bridge_slave_1 left promiscuous mode [ 19.726712][ T260] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.734742][ T260] device bridge_slave_0 left promiscuous mode [ 19.741022][ T260] bridge0: port 1(bridge_slave_0) entered disabled state