[....] Starting enhanced syslogd: rsyslogd[ 10.622530] audit: type=1400 audit(1514680790.909:5): avc: denied { syslog } for pid=3027 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 12.754229] audit: type=1400 audit(1514680793.041:6): avc: denied { map } for pid=3168 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.15.234' (ECDSA) to the list of known hosts. executing program [ 18.894362] audit: type=1400 audit(1514680799.181:7): avc: denied { map } for pid=3182 comm="syzkaller252218" path="/root/syzkaller252218608" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 18.899540] ================================================================== [ 18.899554] BUG: KASAN: use-after-free in __lock_acquire+0x3d4d/0x3e00 [ 18.899559] Read of size 8 at addr ffff8801c8e285b0 by task syzkaller252218/3182 [ 18.899560] [ 18.899567] CPU: 0 PID: 3182 Comm: syzkaller252218 Not tainted 4.15.0-rc5+ #242 [ 18.899570] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 18.899572] Call Trace: [ 18.899583] dump_stack+0x194/0x257 [ 18.899592] ? arch_local_irq_restore+0x53/0x53 [ 18.899599] ? show_regs_print_info+0x18/0x18 [ 18.899604] ? print_irqtrace_events+0x270/0x270 [ 18.899610] ? __lock_acquire+0x664/0x3e00 [ 18.899617] ? __lock_acquire+0x3d4d/0x3e00 [ 18.899625] print_address_description+0x73/0x250 [ 18.899632] ? __lock_acquire+0x3d4d/0x3e00 [ 18.899638] kasan_report+0x25b/0x340 [ 18.899646] __asan_report_load8_noabort+0x14/0x20 [ 18.899651] __lock_acquire+0x3d4d/0x3e00 [ 18.899657] ? __lock_acquire+0x664/0x3e00 [ 18.899663] ? lock_downgrade+0x980/0x980 [ 18.899668] ? lock_downgrade+0x980/0x980 [ 18.899677] ? remove_wait_queue+0x81/0x350 [ 18.899686] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 18.899692] ? __lock_acquire+0x664/0x3e00 [ 18.899698] ? check_noncircular+0x20/0x20 [ 18.899710] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 18.899718] ? lock_acquire+0x1d5/0x580 [ 18.899723] ? lock_acquire+0x1d5/0x580 [ 18.899730] ? ep_free+0xf4/0x320 [ 18.899738] ? lock_release+0xa40/0xa40 [ 18.899744] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 18.899751] ? print_irqtrace_events+0x270/0x270 [ 18.899759] ? rcu_note_context_switch+0x710/0x710 [ 18.899766] ? __might_sleep+0x95/0x190 [ 18.899772] ? ep_free+0xf4/0x320 [ 18.899780] ? __mutex_lock+0x16f/0x1a80 [ 18.899784] ? ep_free+0xf4/0x320 [ 18.899791] ? print_irqtrace_events+0x270/0x270 [ 18.899795] ? ep_free+0xf4/0x320 [ 18.899804] lock_acquire+0x1d5/0x580 [ 18.899809] ? lock_acquire+0x1d5/0x580 [ 18.899815] ? remove_wait_queue+0x81/0x350 [ 18.899821] ? __lock_acquire+0x664/0x3e00 [ 18.899828] ? lock_release+0xa40/0xa40 [ 18.899843] ? lock_acquire+0x1d5/0x580 [ 18.899849] ? lock_acquire+0x1d5/0x580 [ 18.899855] ? ep_unregister_pollwait.isra.7+0x323/0x590 [ 18.899862] _raw_spin_lock_irqsave+0x96/0xc0 [ 18.899867] ? remove_wait_queue+0x81/0x350 [ 18.899874] remove_wait_queue+0x81/0x350 [ 18.899882] ? add_wait_queue+0x290/0x290 [ 18.899887] ? rcutorture_record_progress+0x10/0x10 [ 18.899897] ep_unregister_pollwait.isra.7+0x18c/0x590 [ 18.899906] ? __kernel_text_address+0xd/0x40 [ 18.899913] ? clear_tfile_check_list+0x370/0x370 [ 18.899921] ? check_noncircular+0x20/0x20 [ 18.899929] ? locks_remove_file+0x3fa/0x5a0 [ 18.899938] ep_free+0x13f/0x320 [ 18.899944] ? ep_remove+0x800/0x800 [ 18.899952] ? fsnotify_first_mark+0x2b0/0x2b0 [ 18.899959] ? ep_free+0x320/0x320 [ 18.899965] ep_eventpoll_release+0x44/0x60 [ 18.899972] __fput+0x327/0x7e0 [ 18.899980] ? fput+0x140/0x140 [ 18.899986] ? _raw_spin_unlock_irq+0x27/0x70 [ 18.899994] ____fput+0x15/0x20 [ 18.900004] task_work_run+0x199/0x270 [ 18.900012] ? task_work_cancel+0x210/0x210 [ 18.900020] ? _raw_spin_unlock+0x22/0x30 [ 18.900026] ? switch_task_namespaces+0x87/0xc0 [ 18.900036] do_exit+0x9bb/0x1ad0 [ 18.900046] ? binder_ioctl+0x571/0x1417 [ 18.900052] ? mm_update_next_owner+0x930/0x930 [ 18.900060] ? binder_ioctl_write_read.isra.41+0xcb0/0xcb0 [ 18.900071] ? avc_ss_reset+0x110/0x110 [ 18.900077] ? mutex_unlock+0xd/0x10 [ 18.900082] ? SyS_epoll_ctl+0x30a/0x1ab0 [ 18.900102] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 18.900107] ? up_read+0x1a/0x40 [ 18.900114] ? rcu_note_context_switch+0x710/0x710 [ 18.900121] ? __fd_install+0x288/0x740 [ 18.900131] ? binder_ioctl_write_read.isra.41+0xcb0/0xcb0 [ 18.900138] ? do_vfs_ioctl+0x486/0x1520 [ 18.900143] ? _cond_resched+0x14/0x30 [ 18.900152] ? ioctl_preallocate+0x2b0/0x2b0 [ 18.900159] ? selinux_capable+0x40/0x40 [ 18.900166] ? __alloc_fd+0x750/0x750 [ 18.900175] do_group_exit+0x149/0x400 [ 18.900181] ? SyS_exit+0x30/0x30 [ 18.900188] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 18.900196] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 18.900203] SyS_exit_group+0x1d/0x20 [ 18.900209] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 18.900214] RIP: 0033:0x4429f8 [ 18.900218] RSP: 002b:00007fff24fd23c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 18.900224] RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 00000000004429f8 [ 18.900227] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 18.900231] RBP: 00000000006ce018 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 18.900234] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a40 [ 18.900238] R13: 0000000000401ad0 R14: 0000000000000000 R15: 0000000000000000 [ 18.900246] [ 18.900249] Allocated by task 3182: [ 18.900255] save_stack+0x43/0xd0 [ 18.900259] kasan_kmalloc+0xad/0xe0 [ 18.900265] kmem_cache_alloc_trace+0x136/0x750 [ 18.900271] binder_get_thread+0x1cf/0x870 [ 18.900277] binder_poll+0x8c/0x390 [ 18.900281] ep_item_poll.isra.10+0xec/0x320 [ 18.900285] ep_insert+0x6a3/0x1b10 [ 18.900290] SyS_epoll_ctl+0x12e4/0x1ab0 [ 18.900295] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 18.900296] [ 18.900298] Freed by task 3182: [ 18.900302] save_stack+0x43/0xd0 [ 18.900307] kasan_slab_free+0x71/0xc0 [ 18.900310] kfree+0xd6/0x260 [ 18.900316] binder_thread_dec_tmpref+0x27f/0x310 [ 18.900321] binder_thread_release+0x27d/0x540 [ 18.900327] binder_ioctl+0xc02/0x1417 [ 18.900332] do_vfs_ioctl+0x1b1/0x1520 [ 18.900337] SyS_ioctl+0x8f/0xc0 [ 18.900341] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 18.900342] [ 18.900346] The buggy address belongs to the object at ffff8801c8e28500 [ 18.900346] which belongs to the cache kmalloc-512 of size 512 [ 18.900351] The buggy address is located 176 bytes inside of [ 18.900351] 512-byte region [ffff8801c8e28500, ffff8801c8e28700) [ 18.900353] The buggy address belongs to the page: [ 18.900358] page:00000000da85f31b count:1 mapcount:0 mapping:0000000055baaf23 index:0x0 [ 18.900363] flags: 0x2fffc0000000100(slab) [ 18.900371] raw: 02fffc0000000100 ffff8801c8e28000 0000000000000000 0000000100000006 [ 18.900378] raw: ffffea00072235a0 ffffea0007271620 ffff8801dac00940 0000000000000000 [ 18.900380] page dumped because: kasan: bad access detected [ 18.900381] [ 18.900383] Memory state around the buggy address: [ 18.900387] ffff8801c8e28480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.900392] ffff8801c8e28500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.900396] >ffff8801c8e28580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.900398] ^ [ 18.900402] ffff8801c8e28600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.900407] ffff8801c8e28680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.900409] ================================================================== [ 18.900410] Disabling lock debugging due to kernel taint [ 18.900413] Kernel panic - not syncing: panic_on_warn set ... [ 18.900413] [ 18.900419] CPU: 0 PID: 3182 Comm: syzkaller252218 Tainted: G B 4.15.0-rc5+ #242 [ 18.900422] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 18.900423] Call Trace: [ 18.900430] dump_stack+0x194/0x257 [ 18.900438] ? arch_local_irq_restore+0x53/0x53 [ 18.900443] ? kasan_end_report+0x32/0x50 [ 18.900449] ? lock_downgrade+0x980/0x980 [ 18.900455] ? vsnprintf+0x1ed/0x1900 [ 18.900461] ? __lock_acquire+0x3cf0/0x3e00 [ 18.900466] panic+0x1e4/0x41c [ 18.900472] ? refcount_error_report+0x214/0x214 [ 18.900479] ? add_taint+0x40/0x50 [ 18.900484] ? add_taint+0x1c/0x50 [ 18.900491] ? __lock_acquire+0x3d4d/0x3e00 [ 18.900497] kasan_end_report+0x50/0x50 [ 18.900502] kasan_report+0x144/0x340 [ 18.900510] __asan_report_load8_noabort+0x14/0x20 [ 18.900516] __lock_acquire+0x3d4d/0x3e00 [ 18.900521] ? __lock_acquire+0x664/0x3e00 [ 18.900527] ? lock_downgrade+0x980/0x980 [ 18.900532] ? lock_downgrade+0x980/0x980 [ 18.900539] ? remove_wait_queue+0x81/0x350 [ 18.900548] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 18.900555] ? __lock_acquire+0x664/0x3e00 [ 18.900560] ? check_noncircular+0x20/0x20 [ 18.900572] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 18.900579] ? lock_acquire+0x1d5/0x580 [ 18.900584] ? lock_acquire+0x1d5/0x580 [ 18.900589] ? ep_free+0xf4/0x320 [ 18.900597] ? lock_release+0xa40/0xa40 [ 18.900603] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 18.900609] ? print_irqtrace_events+0x270/0x270 [ 18.900615] ? rcu_note_context_switch+0x710/0x710 [ 18.900622] ? __might_sleep+0x95/0x190 [ 18.900627] ? ep_free+0xf4/0x320 [ 18.900633] ? __mutex_lock+0x16f/0x1a80 [ 18.900638] ? ep_free+0xf4/0x320 [ 18.900645] ? print_irqtrace_events+0x270/0x270 [ 18.900649] ? ep_free+0xf4/0x320 [ 18.900657] lock_acquire+0x1d5/0x580 [ 18.900662] ? lock_acquire+0x1d5/0x580 [ 18.900668] ? remove_wait_queue+0x81/0x350 [ 18.900674] ? __lock_acquire+0x664/0x3e00 [ 18.900681] ? lock_release+0xa40/0xa40 [ 18.900690] ? lock_acquire+0x1d5/0x580 [ 18.900695] ? lock_acquire+0x1d5/0x580 [ 18.900701] ? ep_unregister_pollwait.isra.7+0x323/0x590 [ 18.900708] _raw_spin_lock_irqsave+0x96/0xc0 [ 18.900713] ? remove_wait_queue+0x81/0x350 [ 18.900720] remove_wait_queue+0x81/0x350 [ 18.900727] ? add_wait_queue+0x290/0x290 [ 18.900733] ? rcutorture_record_progress+0x10/0x10 [ 18.900742] ep_unregister_pollwait.isra.7+0x18c/0x590 [ 18.900749] ? __kernel_text_address+0xd/0x40 [ 18.900756] ? clear_tfile_check_list+0x370/0x370 [ 18.900764] ? check_noncircular+0x20/0x20 [ 18.900771] ? locks_remove_file+0x3fa/0x5a0 [ 18.900780] ep_free+0x13f/0x320 [ 18.900785] ? ep_remove+0x800/0x800 [ 18.900792] ? fsnotify_first_mark+0x2b0/0x2b0 [ 18.900799] ? ep_free+0x320/0x320 [ 18.900804] ep_eventpoll_release+0x44/0x60 [ 18.900810] __fput+0x327/0x7e0 [ 18.900818] ? fput+0x140/0x140 [ 18.900823] ? _raw_spin_unlock_irq+0x27/0x70 [ 18.900831] ____fput+0x15/0x20 [ 18.900842] task_work_run+0x199/0x270 [ 18.900850] ? task_work_cancel+0x210/0x210 [ 18.900856] ? _raw_spin_unlock+0x22/0x30 [ 18.900862] ? switch_task_namespaces+0x87/0xc0 [ 18.900870] do_exit+0x9bb/0x1ad0 [ 18.900878] ? binder_ioctl+0x571/0x1417 [ 18.900884] ? mm_update_next_owner+0x930/0x930 [ 18.900893] ? binder_ioctl_write_read.isra.41+0xcb0/0xcb0 [ 18.900902] ? avc_ss_reset+0x110/0x110 [ 18.900908] ? mutex_unlock+0xd/0x10 [ 18.900913] ? SyS_epoll_ctl+0x30a/0x1ab0 [ 18.900931] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 18.900935] ? up_read+0x1a/0x40 [ 18.900942] ? rcu_note_context_switch+0x710/0x710 [ 18.900947] ? __fd_install+0x288/0x740 [ 18.900957] ? binder_ioctl_write_read.isra.41+0xcb0/0xcb0 [ 18.900963] ? do_vfs_ioctl+0x486/0x1520 [ 18.900968] ? _cond_resched+0x14/0x30 [ 18.900977] ? ioctl_preallocate+0x2b0/0x2b0 [ 18.900984] ? selinux_capable+0x40/0x40 [ 18.900990] ? __alloc_fd+0x750/0x750 [ 18.900999] do_group_exit+0x149/0x400 [ 18.901005] ? SyS_exit+0x30/0x30 [ 18.901012] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 18.901018] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 18.901026] SyS_exit_group+0x1d/0x20 [ 18.901031] entry_SYSCALL_64_fastpath+0x1f/0x96 [ 18.901035] RIP: 0033:0x4429f8 [ 18.901038] RSP: 002b:00007fff24fd23c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 18.901043] RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 00000000004429f8 [ 18.901047] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 18.901050] RBP: 00000000006ce018 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 18.901053] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a40 [ 18.901056] R13: 0000000000401ad0 R14: 0000000000000000 R15: 0000000000000000 [ 18.920733] Dumping ftrace buffer: [ 18.920737] (ftrace buffer empty) [ 18.920739] Kernel Offset: disabled [ 20.043832] Rebooting in 86400 seconds..