[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 12.283314] audit: type=1400 audit(1515347466.109:6): avc: denied { map } for pid=3449 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.24' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 18.373224] audit: type=1400 audit(1515347472.199:7): avc: denied { map } for pid=3463 comm="syzkaller016367" path="/root/syzkaller016367115" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 executing program executing program executing program [ 18.639221] [ 18.640855] ========================= [ 18.644618] WARNING: held lock freed! [ 18.648381] 4.15.0-rc6-mm1+ #51 Not tainted [ 18.652667] ------------------------- [ 18.656436] syzkaller016367/3473 is freeing memory 000000008140089c-0000000092ed4e04, with a lock still held there! [ 18.666972] (sk_lock-AF_INET6){+.+.}, at: [<00000000d1d25638>] sctp_sendmsg+0x2499/0x3060 [ 18.675352] 1 lock held by syzkaller016367/3473: [ 18.680071] #0: (sk_lock-AF_INET6){+.+.}, at: [<00000000d1d25638>] sctp_sendmsg+0x2499/0x3060 [ 18.688880] [ 18.688880] stack backtrace: [ 18.693342] CPU: 1 PID: 3473 Comm: syzkaller016367 Not tainted 4.15.0-rc6-mm1+ #51 [ 18.701016] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 18.710333] Call Trace: [ 18.712890] dump_stack+0x137/0x198 [ 18.716487] debug_check_no_locks_freed+0x32f/0x3c0 [ 18.721481] kmem_cache_free+0x68/0x2b0 [ 18.725423] __sk_destruct+0x3e4/0x590 [ 18.729277] sk_destruct+0x47/0x80 [ 18.732784] __sk_free+0xf1/0x2b0 [ 18.736202] sk_free+0x2a/0x40 [ 18.739362] sctp_association_put+0xd4/0x230 [ 18.743737] sctp_sendmsg+0x2719/0x3060 [ 18.747686] ? sctp_id2assoc+0x280/0x280 [ 18.751726] ? check_noncircular+0x20/0x20 [ 18.755926] ? find_held_lock+0x35/0x1e0 [ 18.759956] ? sock_has_perm+0x1ed/0x290 [ 18.763984] ? finish_wait+0x2a0/0x2a0 [ 18.767840] ? __might_fault+0x110/0x1d0 [ 18.771878] inet_sendmsg+0xe0/0x4b0 [ 18.775558] ? inet_sendmsg+0xe0/0x4b0 [ 18.779412] ? inet_recvmsg+0x520/0x520 [ 18.783360] sock_sendmsg+0xca/0x110 [ 18.787042] SYSC_sendto+0x2e0/0x360 [ 18.790726] ? SYSC_connect+0x310/0x310 [ 18.794670] ? sock_enable_timestamp+0xb0/0xb0 [ 18.799219] ? selinux_netlbl_socket_setsockopt+0x10e/0x320 [ 18.804894] ? selinux_netlbl_sock_rcv_skb+0x450/0x450 [ 18.810147] ? SyS_futex+0x1fd/0x2b0 [ 18.813827] ? do_futex+0x1830/0x1830 [ 18.817594] ? entry_SYSCALL_64_fastpath+0x5/0x9a [ 18.822407] SyS_sendto+0x40/0x50 [ 18.825830] entry_SYSCALL_64_fastpath+0x23/0x9a [ 18.830552] RIP: 0033:0x445db9 [ 18.833710] RSP: 002b:00007f2ba666dd98 EFLAGS: 00000212 ORIG_RAX: 000000000000002c [ 18.841383] RAX: ffffffffffffffda RBX: 00000000006dbc84 RCX: 0000000000445db9 [ 18.848620] RDX: 0000000000000001 RSI: 000000002010bf14 RDI: 0000000000000005 [ 18.855857] RBP: 0000000000000000 R08: 00000000204d9000 R09: 000000000000001c [ 18.863093] R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006dbc80 [ 18.870328] R13: 00000000209a9000 R14: 0100000000000000 R15: 0000000000000001 [ 18.877643] ================================================================== [ 18.884984] BUG: KASAN: use-after-free in do_raw_spin_lock+0x1e0/0x220 [ 18.891614] Read of size 4 at addr ffff8801bf81108c by task syzkaller016367/3473 [ 18.899108] [ 18.900707] CPU: 1 PID: 3473 Comm: syzkaller016367 Not tainted 4.15.0-rc6-mm1+ #51 [ 18.908378] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 18.917699] Call Trace: [ 18.920253] dump_stack+0x137/0x198 [ 18.923851] ? do_raw_spin_lock+0x1e0/0x220 [ 18.928144] print_address_description+0x73/0x250 [ 18.932956] ? do_raw_spin_lock+0x1e0/0x220 executing program [ 18.937244] kasan_report+0x23b/0x360 [ 18.941020] __asan_report_load4_noabort+0x14/0x20 [ 18.945927] do_raw_spin_lock+0x1e0/0x220 [ 18.950049] _raw_spin_lock_bh+0x39/0x40 [ 18.954078] ? release_sock+0x20/0x1c0 [ 18.957947] release_sock+0x20/0x1c0 [ 18.961629] sctp_sendmsg+0x2721/0x3060 [ 18.965578] ? sctp_id2assoc+0x280/0x280 [ 18.969607] ? check_noncircular+0x20/0x20 [ 18.973809] ? find_held_lock+0x35/0x1e0 [ 18.977841] ? sock_has_perm+0x1ed/0x290 [ 18.981870] ? finish_wait+0x2a0/0x2a0 [ 18.985726] ? __might_fault+0x110/0x1d0 [ 18.989760] inet_sendmsg+0xe0/0x4b0 [ 18.993441] ? inet_sendmsg+0xe0/0x4b0 [ 18.997297] ? inet_recvmsg+0x520/0x520 [ 19.001237] sock_sendmsg+0xca/0x110 [ 19.004920] SYSC_sendto+0x2e0/0x360 [ 19.008615] ? SYSC_connect+0x310/0x310 [ 19.012557] ? sock_enable_timestamp+0xb0/0xb0 [ 19.017108] ? selinux_netlbl_socket_setsockopt+0x10e/0x320 [ 19.022787] ? selinux_netlbl_sock_rcv_skb+0x450/0x450 [ 19.028041] ? SyS_futex+0x1fd/0x2b0 [ 19.031723] ? do_futex+0x1830/0x1830 [ 19.035489] ? entry_SYSCALL_64_fastpath+0x5/0x9a [ 19.040299] SyS_sendto+0x40/0x50 [ 19.043720] entry_SYSCALL_64_fastpath+0x23/0x9a [ 19.048443] RIP: 0033:0x445db9 [ 19.051599] RSP: 002b:00007f2ba666dd98 EFLAGS: 00000212 ORIG_RAX: 000000000000002c [ 19.059271] RAX: ffffffffffffffda RBX: 00000000006dbc84 RCX: 0000000000445db9 [ 19.066507] RDX: 0000000000000001 RSI: 000000002010bf14 RDI: 0000000000000005 [ 19.073746] RBP: 0000000000000000 R08: 00000000204d9000 R09: 000000000000001c [ 19.080983] R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006dbc80 [ 19.088218] R13: 00000000209a9000 R14: 0100000000000000 R15: 0000000000000001 [ 19.095466] [ 19.097063] Allocated by task 3474: [ 19.100660] save_stack+0x43/0xd0 [ 19.104079] kasan_kmalloc+0xad/0xe0 [ 19.107758] kasan_slab_alloc+0x12/0x20 [ 19.111698] kmem_cache_alloc+0x12e/0x760 [ 19.115814] sk_prot_alloc+0x65/0x2a0 [ 19.119580] sk_alloc+0x37/0xd60 [ 19.122912] sctp_v6_create_accept_sk+0xf5/0x830 [ 19.127633] sctp_accept+0x3ab/0x620 [ 19.131311] inet_accept+0xef/0x7f0 [ 19.134904] SYSC_accept4+0x342/0x650 [ 19.138672] SyS_accept+0x26/0x30 [ 19.142092] entry_SYSCALL_64_fastpath+0x23/0x9a [ 19.146810] [ 19.148402] Freed by task 3473: [ 19.151646] save_stack+0x43/0xd0 [ 19.155065] __kasan_slab_free+0x11a/0x170 [ 19.159264] kasan_slab_free+0xe/0x10 [ 19.163030] kmem_cache_free+0x86/0x2b0 [ 19.166968] __sk_destruct+0x3e4/0x590 [ 19.170819] sk_destruct+0x47/0x80 [ 19.174321] __sk_free+0xf1/0x2b0 [ 19.177737] sk_free+0x2a/0x40 [ 19.180895] sctp_association_put+0xd4/0x230 [ 19.185269] sctp_sendmsg+0x2719/0x3060 [ 19.189207] inet_sendmsg+0xe0/0x4b0 [ 19.192886] sock_sendmsg+0xca/0x110 [ 19.196563] SYSC_sendto+0x2e0/0x360 [ 19.200240] SyS_sendto+0x40/0x50 [ 19.203667] entry_SYSCALL_64_fastpath+0x23/0x9a [ 19.208385] [ 19.209979] The buggy address belongs to the object at ffff8801bf811000 [ 19.209979] which belongs to the cache SCTPv6 of size 1888 [ 19.222251] The buggy address is located 140 bytes inside of [ 19.222251] 1888-byte region [ffff8801bf811000, ffff8801bf811760) [ 19.234179] The buggy address belongs to the page: [ 19.239075] page:ffffea0006fe0440 count:1 mapcount:0 mapping:ffff8801bf811000 index:0x0 [ 19.247181] flags: 0x2fffc0000000100(slab) [ 19.251384] raw: 02fffc0000000100 ffff8801bf811000 0000000000000000 0000000100000002 [ 19.259232] raw: ffffea0006fe0a20 ffffea0006fe2e60 ffff8801d35d3200 0000000000000000 [ 19.267077] page dumped because: kasan: bad access detected [ 19.272748] [ 19.274343] Memory state around the buggy address: [ 19.279238] ffff8801bf810f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.286564] ffff8801bf811000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.293889] >ffff8801bf811080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.301210] ^ [ 19.304802] ffff8801bf811100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.312126] ffff8801bf811180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.319453] ================================================================== [ 19.326814] Kernel panic - not syncing: panic_on_warn set ... [ 19.326814] [ 19.334164] CPU: 1 PID: 3473 Comm: syzkaller016367 Tainted: G B 4.15.0-rc6-mm1+ #51 [ 19.343158] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 19.352480] Call Trace: [ 19.355042] dump_stack+0x137/0x198 [ 19.358661] ? do_raw_spin_lock+0x1d0/0x220 [ 19.362962] panic+0x1e4/0x41c [ 19.366119] ? refcount_error_report+0x214/0x214 [ 19.370839] ? add_taint+0x1c/0x50 [ 19.374345] ? add_taint+0x1c/0x50 [ 19.377861] ? do_raw_spin_lock+0x1e0/0x220 [ 19.382155] kasan_end_report+0x50/0x50 [ 19.386095] kasan_report+0x148/0x360 [ 19.389862] __asan_report_load4_noabort+0x14/0x20 [ 19.394762] do_raw_spin_lock+0x1e0/0x220 [ 19.398878] _raw_spin_lock_bh+0x39/0x40 [ 19.402910] ? release_sock+0x20/0x1c0 [ 19.406764] release_sock+0x20/0x1c0 [ 19.410455] sctp_sendmsg+0x2721/0x3060 [ 19.414406] ? sctp_id2assoc+0x280/0x280 [ 19.418438] ? check_noncircular+0x20/0x20 [ 19.422641] ? find_held_lock+0x35/0x1e0 [ 19.426675] ? sock_has_perm+0x1ed/0x290 [ 19.430703] ? finish_wait+0x2a0/0x2a0 [ 19.434558] ? __might_fault+0x110/0x1d0 [ 19.438593] inet_sendmsg+0xe0/0x4b0 [ 19.442271] ? inet_sendmsg+0xe0/0x4b0 [ 19.446130] ? inet_recvmsg+0x520/0x520 [ 19.450072] sock_sendmsg+0xca/0x110 [ 19.453751] SYSC_sendto+0x2e0/0x360 [ 19.457431] ? SYSC_connect+0x310/0x310 [ 19.461371] ? sock_enable_timestamp+0xb0/0xb0 [ 19.465920] ? selinux_netlbl_socket_setsockopt+0x10e/0x320 [ 19.471596] ? selinux_netlbl_sock_rcv_skb+0x450/0x450 [ 19.476850] ? SyS_futex+0x1fd/0x2b0 [ 19.480533] ? do_futex+0x1830/0x1830 [ 19.484302] ? entry_SYSCALL_64_fastpath+0x5/0x9a [ 19.489114] SyS_sendto+0x40/0x50 [ 19.492534] entry_SYSCALL_64_fastpath+0x23/0x9a [ 19.497253] RIP: 0033:0x445db9 [ 19.500409] RSP: 002b:00007f2ba666dd98 EFLAGS: 00000212 ORIG_RAX: 000000000000002c [ 19.508082] RAX: ffffffffffffffda RBX: 00000000006dbc84 RCX: 0000000000445db9 [ 19.515318] RDX: 0000000000000001 RSI: 000000002010bf14 RDI: 0000000000000005 [ 19.522559] RBP: 0000000000000000 R08: 00000000204d9000 R09: 000000000000001c [ 19.529795] R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006dbc80 [ 19.537032] R13: 00000000209a9000 R14: 0100000000000000 R15: 0000000000000001 [ 19.544682] Dumping ftrace buffer: [ 19.548189] (ftrace buffer empty) [ 19.551865] Kernel Offset: disabled [ 19.555465] Rebooting in 86400 seconds..