[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [ 18.974749] audit: type=1400 audit(1520533927.970:6): avc: denied { map } for pid=4222 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.31' (ECDSA) to the list of known hosts. syzkaller login: [ 27.134327] audit: type=1400 audit(1520533936.130:7): avc: denied { map } for pid=4237 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=16479 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2018/03/08 18:32:16 parsed 1 programs 2018/03/08 18:32:16 executed programs: 0 [ 27.390582] audit: type=1400 audit(1520533936.385:8): avc: denied { map } for pid=4237 comm="syz-execprog" path="/root/syzkaller-shm555629545" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 27.403964] IPVS: ftp: loaded support on port[0] = 21 [ 27.447893] ================================================================== [ 27.455326] BUG: KASAN: stack-out-of-bounds in rdma_resolve_addr+0x12e/0x26c0 [ 27.462586] Read of size 48 at addr ffff8801b0b4f9f4 by task syz-executor0/4245 [ 27.470014] [ 27.471625] CPU: 0 PID: 4245 Comm: syz-executor0 Not tainted 4.16.0-rc4+ #256 [ 27.478879] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.488205] Call Trace: [ 27.490774] dump_stack+0x194/0x24d [ 27.494387] ? arch_local_irq_restore+0x53/0x53 [ 27.499035] ? show_regs_print_info+0x18/0x18 [ 27.503526] ? rdma_resolve_addr+0x12e/0x26c0 [ 27.507999] print_address_description+0x73/0x250 [ 27.512818] ? rdma_resolve_addr+0x12e/0x26c0 [ 27.517298] kasan_report+0x23c/0x360 [ 27.521079] check_memory_region+0x137/0x190 [ 27.525463] memcpy+0x23/0x50 [ 27.528549] rdma_resolve_addr+0x12e/0x26c0 [ 27.532848] ? find_held_lock+0x35/0x1d0 [ 27.536894] ? rdma_bind_addr+0x1b50/0x1b50 [ 27.541200] ? lock_downgrade+0x980/0x980 [ 27.545327] ? futex_wake+0x2ca/0x680 [ 27.549102] ? SyS_membarrier+0x700/0x700 [ 27.553224] ? __radix_tree_lookup+0x435/0x5e0 [ 27.557795] ? __mutex_unlock_slowpath+0xe9/0xac0 [ 27.562618] ? wait_for_completion+0x770/0x770 [ 27.567176] ? check_same_owner+0x320/0x320 [ 27.571473] ? lock_release+0xa40/0xa40 [ 27.575418] ? check_same_owner+0x320/0x320 [ 27.579725] ? find_held_lock+0x35/0x1d0 [ 27.583790] ucma_resolve_ip+0x142/0x1f0 [ 27.587823] ? ucma_resolve_ip+0x142/0x1f0 [ 27.592034] ? ucma_resolve_addr+0x330/0x330 [ 27.596425] ? kasan_check_write+0x14/0x20 [ 27.600640] ucma_write+0x2d6/0x3d0 [ 27.604241] ? ucma_resolve_addr+0x330/0x330 [ 27.608625] ? ucma_resolve_route+0x1a0/0x1a0 [ 27.613111] ? ucma_resolve_route+0x1a0/0x1a0 [ 27.617578] __vfs_write+0xef/0x970 [ 27.621183] ? rcu_note_context_switch+0x710/0x710 [ 27.626091] ? kernel_read+0x120/0x120 [ 27.629960] ? __might_sleep+0x95/0x190 [ 27.633913] ? _cond_resched+0x14/0x30 [ 27.637781] ? __inode_security_revalidate+0xd9/0x130 [ 27.642955] ? avc_policy_seqno+0x9/0x20 [ 27.647003] ? selinux_file_permission+0x82/0x460 [ 27.651842] ? security_file_permission+0x89/0x1e0 [ 27.656765] ? rw_verify_area+0xe5/0x2b0 [ 27.660806] ? __fdget_raw+0x20/0x20 [ 27.664500] vfs_write+0x189/0x510 [ 27.668020] SyS_write+0xef/0x220 [ 27.671455] ? __do_page_fault+0x3d6/0xc90 [ 27.675664] ? SyS_read+0x220/0x220 [ 27.679268] ? do_fast_syscall_32+0x156/0xf9f [ 27.683758] ? SyS_read+0x220/0x220 [ 27.687359] do_fast_syscall_32+0x3ec/0xf9f [ 27.691661] ? do_int80_syscall_32+0x9c0/0x9c0 [ 27.696217] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 27.700953] ? syscall_return_slowpath+0x2ac/0x550 [ 27.705869] ? prepare_exit_to_usermode+0x350/0x350 [ 27.710863] ? sysret32_from_system_call+0x5/0x3c [ 27.715696] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 27.720520] entry_SYSENTER_compat+0x70/0x7f [ 27.724902] RIP: 0023:0xf7ffcc99 [ 27.728238] RSP: 002b:00000000ffb82d2c EFLAGS: 00000286 ORIG_RAX: 0000000000000004 [ 27.735920] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020000740 [ 27.743171] RDX: 0000000000000048 RSI: 0000000000000000 RDI: 0000000000000000 [ 27.750414] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 27.757664] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 27.764908] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 27.772169] [ 27.773776] The buggy address belongs to the page: [ 27.778683] page:ffffea0006c2d3c0 count:0 mapcount:0 mapping:0000000000000000 index:0x0 [ 27.786797] flags: 0x2fffc0000000000() [ 27.790659] raw: 02fffc0000000000 0000000000000000 0000000000000000 00000000ffffffff [ 27.798511] raw: 0000000000000000 ffffea0006c20101 0000000000000000 0000000000000000 [ 27.806455] page dumped because: kasan: bad access detected [ 27.812137] [ 27.813752] Memory state around the buggy address: [ 27.818654] ffff8801b0b4f900: f2 f2 f2 f2 00 00 f2 f2 00 00 00 00 00 00 00 00 [ 27.825986] ffff8801b0b4f980: 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 [ 27.833316] >ffff8801b0b4fa00: 00 00 00 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 [ 27.840653] ^ [ 27.844781] ffff8801b0b4fa80: 00 00 00 00 00 f1 f1 f1 f1 00 f2 f2 f2 f3 f3 f3 [ 27.852115] ffff8801b0b4fb00: f3 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 [ 27.859446] ================================================================== [ 27.866776] Disabling lock debugging due to kernel taint [ 27.872252] Kernel panic - not syncing: panic_on_warn set ... [ 27.872252] [ 27.879601] CPU: 0 PID: 4245 Comm: syz-executor0 Tainted: G B 4.16.0-rc4+ #256 [ 27.888143] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.897466] Call Trace: [ 27.900035] dump_stack+0x194/0x24d [ 27.903634] ? arch_local_irq_restore+0x53/0x53 [ 27.908272] ? kasan_end_report+0x32/0x50 [ 27.912390] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 27.917116] ? vsnprintf+0x1ed/0x1900 [ 27.920888] ? rdma_resolve_addr+0x100/0x26c0 [ 27.925355] panic+0x1e4/0x41c [ 27.928517] ? refcount_error_report+0x214/0x214 [ 27.933253] ? add_taint+0x1c/0x50 [ 27.936774] ? add_taint+0x1c/0x50 [ 27.940293] ? rdma_resolve_addr+0x12e/0x26c0 [ 27.944759] kasan_end_report+0x50/0x50 [ 27.948703] kasan_report+0x149/0x360 [ 27.952564] check_memory_region+0x137/0x190 [ 27.956941] memcpy+0x23/0x50 [ 27.960025] rdma_resolve_addr+0x12e/0x26c0 [ 27.964322] ? find_held_lock+0x35/0x1d0 [ 27.968358] ? rdma_bind_addr+0x1b50/0x1b50 [ 27.972649] ? lock_downgrade+0x980/0x980 [ 27.976776] ? futex_wake+0x2ca/0x680 [ 27.980546] ? SyS_membarrier+0x700/0x700 [ 27.984668] ? __radix_tree_lookup+0x435/0x5e0 [ 27.989227] ? __mutex_unlock_slowpath+0xe9/0xac0 [ 27.994040] ? wait_for_completion+0x770/0x770 [ 27.998593] ? check_same_owner+0x320/0x320 [ 28.002896] ? lock_release+0xa40/0xa40 [ 28.006839] ? check_same_owner+0x320/0x320 [ 28.011140] ? find_held_lock+0x35/0x1d0 [ 28.015181] ucma_resolve_ip+0x142/0x1f0 [ 28.019213] ? ucma_resolve_ip+0x142/0x1f0 [ 28.023439] ? ucma_resolve_addr+0x330/0x330 [ 28.027821] ? kasan_check_write+0x14/0x20 [ 28.032031] ucma_write+0x2d6/0x3d0 [ 28.035629] ? ucma_resolve_addr+0x330/0x330 [ 28.040024] ? ucma_resolve_route+0x1a0/0x1a0 [ 28.044514] ? ucma_resolve_route+0x1a0/0x1a0 [ 28.048981] __vfs_write+0xef/0x970 [ 28.052582] ? rcu_note_context_switch+0x710/0x710 [ 28.057481] ? kernel_read+0x120/0x120 [ 28.061338] ? __might_sleep+0x95/0x190 [ 28.065284] ? _cond_resched+0x14/0x30 [ 28.069149] ? __inode_security_revalidate+0xd9/0x130 [ 28.074309] ? avc_policy_seqno+0x9/0x20 [ 28.078338] ? selinux_file_permission+0x82/0x460 [ 28.083153] ? security_file_permission+0x89/0x1e0 [ 28.088057] ? rw_verify_area+0xe5/0x2b0 [ 28.092086] ? __fdget_raw+0x20/0x20 [ 28.095773] vfs_write+0x189/0x510 [ 28.099288] SyS_write+0xef/0x220 [ 28.102716] ? __do_page_fault+0x3d6/0xc90 [ 28.106923] ? SyS_read+0x220/0x220 [ 28.110522] ? do_fast_syscall_32+0x156/0xf9f [ 28.114988] ? SyS_read+0x220/0x220 [ 28.118585] do_fast_syscall_32+0x3ec/0xf9f [ 28.122882] ? do_int80_syscall_32+0x9c0/0x9c0 [ 28.127433] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 28.132162] ? syscall_return_slowpath+0x2ac/0x550 [ 28.137063] ? prepare_exit_to_usermode+0x350/0x350 [ 28.142053] ? sysret32_from_system_call+0x5/0x3c [ 28.146877] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 28.151694] entry_SYSENTER_compat+0x70/0x7f [ 28.156077] RIP: 0023:0xf7ffcc99 [ 28.159412] RSP: 002b:00000000ffb82d2c EFLAGS: 00000286 ORIG_RAX: 0000000000000004 [ 28.167094] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020000740 [ 28.174336] RDX: 0000000000000048 RSI: 0000000000000000 RDI: 0000000000000000 [ 28.181575] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 28.188815] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 28.196054] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 28.203742] Dumping ftrace buffer: [ 28.207249] (ftrace buffer empty) [ 28.210928] Kernel Offset: disabled [ 28.214523] Rebooting in 86400 seconds..