[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 30.673901] random: sshd: uninitialized urandom read (32 bytes read) [ 30.884667] kauditd_printk_skb: 7 callbacks suppressed [ 30.884674] audit: type=1400 audit(1566876263.065:35): avc: denied { map } for pid=6660 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 30.935160] random: sshd: uninitialized urandom read (32 bytes read) [ 31.375770] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.57' (ECDSA) to the list of known hosts. [ 36.916561] urandom_read: 1 callbacks suppressed [ 36.916565] random: sshd: uninitialized urandom read (32 bytes read) [ 37.100147] audit: type=1400 audit(1566876269.275:36): avc: denied { map } for pid=6674 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2019/08/27 03:24:30 parsed 1 programs [ 37.811287] audit: type=1400 audit(1566876269.995:37): avc: denied { map } for pid=6674 comm="syz-execprog" path="/sys/kernel/debug/kcov" dev="debugfs" ino=13768 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 [ 38.499806] random: cc1: uninitialized urandom read (8 bytes read) 2019/08/27 03:24:31 executed programs: 0 [ 39.096056] audit: type=1400 audit(1566876271.275:38): avc: denied { map } for pid=6674 comm="syz-execprog" path="/root/syzkaller-shm331374753" dev="sda1" ino=16484 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 39.380867] IPVS: ftp: loaded support on port[0] = 21 [ 40.223969] chnl_net:caif_netlink_parms(): no params data found [ 40.249775] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.256456] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.263299] device bridge_slave_0 entered promiscuous mode [ 40.269924] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.276625] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.283409] device bridge_slave_1 entered promiscuous mode [ 40.295842] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 40.304241] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 40.317987] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 40.325071] team0: Port device team_slave_0 added [ 40.330393] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 40.337327] team0: Port device team_slave_1 added [ 40.342472] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 40.349581] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 40.401563] device hsr_slave_0 entered promiscuous mode [ 40.470252] device hsr_slave_1 entered promiscuous mode [ 40.510602] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 40.517372] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 40.529086] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.535585] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.542298] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.548634] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.572634] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 40.578857] 8021q: adding VLAN 0 to HW filter on device bond0 [ 40.586842] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 40.594736] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 40.613212] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.620409] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.629253] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 40.635495] 8021q: adding VLAN 0 to HW filter on device team0 [ 40.643157] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 40.650662] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.656968] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.665284] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 40.673093] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.679405] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.694176] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 40.704380] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 40.714726] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 40.723105] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 40.730884] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 40.738187] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 40.745715] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 40.753579] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 40.760339] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 40.769990] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 40.778865] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 41.220649] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 42.039047] kasan: CONFIG_KASAN_INLINE enabled [ 42.044120] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 42.051534] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 42.058080] Modules linked in: [ 42.061247] CPU: 0 PID: 6723 Comm: syz-executor.0 Not tainted 4.14.140 #36 [ 42.068232] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 42.077559] task: ffff88808fd58300 task.stack: ffff888082550000 [ 42.083590] RIP: 0010:__smc_diag_dump.isra.0+0x342/0x17b0 [ 42.089106] RSP: 0018:ffff8880825574f0 EFLAGS: 00010203 [ 42.094443] RAX: dffffc0000000000 RBX: ffff888092100e00 RCX: 0000000000000001 [ 42.101685] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000e [ 42.108942] RBP: ffff8880825576c8 R08: 0000000000000040 R09: ffff888092100e50 [ 42.116184] R10: ffff88808fd58bf8 R11: ffff88808fd58300 R12: ffff8880825576a0 [ 42.123432] R13: ffff88808b06f190 R14: ffff88808b220200 R15: ffff88808b220650 [ 42.130678] FS: 00007f52c5fe3700(0000) GS:ffff8880aee00000(0000) knlGS:0000000000000000 [ 42.138874] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 42.144725] CR2: 00007fa6e9b4a000 CR3: 0000000094925000 CR4: 00000000001406f0 [ 42.151967] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 42.159207] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 42.166566] Call Trace: [ 42.169142] ? smc_diag_handler_dump+0x200/0x200 [ 42.173873] ? rcu_lockdep_current_cpu_online+0xf2/0x140 [ 42.179296] ? __kmalloc_node_track_caller+0x3d/0x80 [ 42.184428] ? rcu_read_lock_sched_held+0x110/0x130 [ 42.189425] ? kmem_cache_alloc_node_trace+0x379/0x770 [ 42.194680] ? kasan_unpoison_shadow+0x35/0x50 [ 42.199343] ? kasan_kmalloc+0xce/0xf0 [ 42.203291] ? lock_acquire+0x16f/0x430 [ 42.207239] ? smc_diag_dump+0x8d/0x2a0 [ 42.211185] smc_diag_dump+0x1e5/0x2a0 [ 42.215046] netlink_dump+0x3fa/0xb10 [ 42.218827] __netlink_dump_start+0x4ff/0x750 [ 42.223295] smc_diag_handler_dump+0x1b7/0x200 [ 42.227842] ? smc_gid_be16_convert+0x2c0/0x2c0 [ 42.232485] ? __smc_diag_dump.isra.0+0x17b0/0x17b0 [ 42.237475] sock_diag_rcv_msg+0x29e/0x3a0 [ 42.241767] netlink_rcv_skb+0x14f/0x3c0 [ 42.245797] ? sock_diag_bind+0x90/0x90 [ 42.249741] ? lock_downgrade+0x6e0/0x6e0 [ 42.253858] ? netlink_ack+0x9a0/0x9a0 [ 42.257715] sock_diag_rcv+0x2b/0x40 [ 42.261400] netlink_unicast+0x45d/0x640 [ 42.265428] ? netlink_attachskb+0x6a0/0x6a0 [ 42.269804] ? security_netlink_send+0x81/0xb0 [ 42.274352] netlink_sendmsg+0x7c4/0xc60 [ 42.278384] ? netlink_unicast+0x640/0x640 [ 42.282587] ? security_socket_sendmsg+0x89/0xb0 [ 42.287309] ? netlink_unicast+0x640/0x640 [ 42.291514] sock_sendmsg+0xce/0x110 [ 42.295198] ___sys_sendmsg+0x70a/0x840 [ 42.299139] ? copy_msghdr_from_user+0x3f0/0x3f0 [ 42.303861] ? __fget+0x210/0x370 [ 42.307287] ? find_held_lock+0x35/0x130 [ 42.311368] ? __fget+0x210/0x370 [ 42.314805] ? lock_downgrade+0x6e0/0x6e0 [ 42.318932] ? __fget+0x237/0x370 [ 42.322370] ? __fget_light+0x172/0x1f0 [ 42.326317] ? __fdget+0x1b/0x20 [ 42.329793] ? sockfd_lookup_light+0xb4/0x160 [ 42.334276] __sys_sendmsg+0xb9/0x140 [ 42.338052] ? SyS_shutdown+0x170/0x170 [ 42.342004] ? put_timespec64+0xb4/0x100 [ 42.346047] ? SyS_clock_gettime+0xf8/0x180 [ 42.350341] SyS_sendmsg+0x2d/0x50 [ 42.353859] ? __sys_sendmsg+0x140/0x140 [ 42.357891] do_syscall_64+0x1e8/0x640 [ 42.361813] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 42.366648] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 42.371813] RIP: 0033:0x459879 [ 42.375293] RSP: 002b:00007f52c5fe2c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 42.382981] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459879 [ 42.390227] RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000004 [ 42.397475] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 42.404717] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f52c5fe36d4 [ 42.411960] R13: 00000000004c773e R14: 00000000004dcf58 R15: 00000000ffffffff [ 42.419207] Code: 20 48 89 f9 48 c1 e9 03 80 3c 11 00 0f 85 b2 13 00 00 48 8b 50 20 48 b8 00 00 00 00 00 fc ff df 48 8d 7a 0e 48 89 f9 48 c1 e9 03 <0f> b6 0c 01 48 89 f8 83 e0 07 83 c0 01 38 c8 7c 08 84 c9 0f 85 [ 42.438268] RIP: __smc_diag_dump.isra.0+0x342/0x17b0 RSP: ffff8880825574f0 [ 42.445334] ---[ end trace 4b1f8368396c5a17 ]--- [ 42.450073] Kernel panic - not syncing: Fatal exception [ 42.456433] Kernel Offset: disabled [ 42.460044] Rebooting in 86400 seconds..