[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 34.137303] random: sshd: uninitialized urandom read (32 bytes read) [ 34.392569] kauditd_printk_skb: 9 callbacks suppressed [ 34.392577] audit: type=1400 audit(1565683365.277:35): avc: denied { map } for pid=6856 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 34.447606] random: sshd: uninitialized urandom read (32 bytes read) [ 34.954002] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.5' (ECDSA) to the list of known hosts. [ 40.688621] urandom_read: 1 callbacks suppressed [ 40.688625] random: sshd: uninitialized urandom read (32 bytes read) [ 40.870909] audit: type=1400 audit(1565683371.757:36): avc: denied { map } for pid=6869 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=16480 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2019/08/13 08:02:52 parsed 1 programs [ 41.685401] audit: type=1400 audit(1565683372.567:37): avc: denied { map } for pid=6869 comm="syz-execprog" path="/sys/kernel/debug/kcov" dev="debugfs" ino=895 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 [ 42.092082] random: cc1: uninitialized urandom read (8 bytes read) 2019/08/13 08:02:53 executed programs: 0 [ 42.741622] audit: type=1400 audit(1565683373.627:38): avc: denied { map } for pid=6869 comm="syz-execprog" path="/root/syzkaller-shm459940087" dev="sda1" ino=16483 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 43.020883] IPVS: ftp: loaded support on port[0] = 21 [ 43.843954] chnl_net:caif_netlink_parms(): no params data found [ 43.871275] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.877834] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.885215] device bridge_slave_0 entered promiscuous mode [ 43.892008] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.898531] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.905551] device bridge_slave_1 entered promiscuous mode [ 43.918918] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 43.927804] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 43.943697] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 43.950963] team0: Port device team_slave_0 added [ 43.956253] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 43.963359] team0: Port device team_slave_1 added [ 43.968445] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 43.975743] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 44.021730] device hsr_slave_0 entered promiscuous mode [ 44.080331] device hsr_slave_1 entered promiscuous mode [ 44.120612] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 44.127451] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 44.139974] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.146403] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.153276] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.159620] bridge0: port 1(bridge_slave_0) entered forwarding state [ 44.185010] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 44.191843] 8021q: adding VLAN 0 to HW filter on device bond0 [ 44.200874] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 44.208532] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 44.216605] bridge0: port 1(bridge_slave_0) entered disabled state [ 44.223476] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.232432] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 44.238481] 8021q: adding VLAN 0 to HW filter on device team0 [ 44.246764] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 44.254371] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.260708] bridge0: port 1(bridge_slave_0) entered forwarding state [ 44.268992] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 44.277426] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.283784] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.300764] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 44.308230] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 44.316019] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 44.324016] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 44.332038] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 44.339202] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 44.345346] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 44.357258] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 44.366339] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 44.840656] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 45.438818] audit: type=1400 audit(1565683376.317:39): avc: denied { map } for pid=6898 comm="syz-executor.0" path="/root/syzkaller-testdir946885185/syzkaller.fNdtzP/0/file0/mem" dev="devtmpfs" ino=12863 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:memory_device_t:s0 tclass=chr_file permissive=1 [ 45.469520] FAULT_INJECTION: forcing a failure. [ 45.469520] name failslab, interval 1, probability 0, space 0, times 1 [ 45.481938] CPU: 1 PID: 6898 Comm: syz-executor.0 Not tainted 4.14.138 #34 [ 45.488944] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 45.498280] Call Trace: [ 45.500857] dump_stack+0x138/0x19c [ 45.504474] should_fail.cold+0x10f/0x159 [ 45.508604] should_failslab+0xdb/0x130 [ 45.512555] kmem_cache_alloc+0x2d7/0x780 [ 45.516681] ? __pmd_alloc+0x410/0x410 [ 45.520556] copy_process.part.0+0x444f/0x6a00 [ 45.525147] ? __cleanup_sighand+0x50/0x50 [ 45.529362] ? vfs_write+0x25f/0x500 [ 45.533056] _do_fork+0x19e/0xce0 [ 45.536498] ? fork_idle+0x280/0x280 [ 45.540194] ? vfs_write+0x104/0x500 [ 45.543895] ? SyS_write+0x15e/0x230 [ 45.547639] SyS_clone+0x37/0x50 [ 45.550984] ? sys_vfork+0x30/0x30 [ 45.554521] do_syscall_64+0x1e8/0x640 [ 45.558388] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 45.563211] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 45.568379] RIP: 0033:0x459829 [ 45.571589] RSP: 002b:00007ffc35e75b98 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 45.579281] RAX: ffffffffffffffda RBX: 00007ffc35e75bb0 RCX: 0000000000459829 [ 45.586528] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 45.593779] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 45.601027] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000002069914 [ 45.608316] R13: 00000000004bfce6 R14: 00000000004d1a38 R15: 0000000000000004 [ 45.617485] x86/PAT: syz-executor.0:6898 freeing invalid memtype [mem 0x00002000-0x00002fff] [ 45.681154] FAULT_INJECTION: forcing a failure. [ 45.681154] name failslab, interval 1, probability 0, space 0, times 0 [ 45.692507] CPU: 0 PID: 6901 Comm: syz-executor.0 Not tainted 4.14.138 #34 [ 45.699502] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 45.708834] Call Trace: [ 45.711402] dump_stack+0x138/0x19c [ 45.715007] should_fail.cold+0x10f/0x159 [ 45.719136] should_failslab+0xdb/0x130 [ 45.723101] kmem_cache_alloc_trace+0x2e9/0x790 [ 45.727854] ? pat_pagerange_is_ram+0x90/0xf0 [ 45.732331] ? __init_cache_modes+0x240/0x240 [ 45.736804] reserve_memtype+0x164/0x640 [ 45.740842] ? lock_downgrade+0x6e0/0x6e0 [ 45.744970] ? pat_init+0x420/0x420 [ 45.748569] ? __init_cache_modes+0x240/0x240 [ 45.753040] reserve_pfn_range+0x11c/0x390 [ 45.757252] ? arch_io_reserve_memtype_wc+0x80/0x80 [ 45.762249] ? copy_process.part.0+0x444f/0x6a00 [ 45.766980] ? SyS_clone+0x37/0x50 [ 45.770515] ? do_syscall_64+0x1e8/0x640 [ 45.774563] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 45.779905] track_pfn_copy+0x14a/0x190 [ 45.783856] ? reserve_pfn_range+0x390/0x390 [ 45.788241] ? trace_hardirqs_on+0x10/0x10 [ 45.792455] ? __pte_alloc_kernel+0x210/0x210 [ 45.797036] copy_page_range+0x1255/0x1bd0 [ 45.801246] ? save_trace+0x290/0x290 [ 45.805720] ? copy_process.part.0+0x41de/0x6a00 [ 45.810457] ? find_held_lock+0x35/0x130 [ 45.814524] ? __pmd_alloc+0x410/0x410 [ 45.818388] ? __vma_link_rb+0x247/0x340 [ 45.822426] copy_process.part.0+0x4764/0x6a00 [ 45.826997] ? __cleanup_sighand+0x50/0x50 [ 45.831212] ? vfs_write+0x25f/0x500 [ 45.834909] _do_fork+0x19e/0xce0 [ 45.838355] ? fork_idle+0x280/0x280 [ 45.842057] ? vfs_write+0x104/0x500 [ 45.845754] ? SyS_write+0x15e/0x230 [ 45.849446] SyS_clone+0x37/0x50 [ 45.852788] ? sys_vfork+0x30/0x30 [ 45.856312] do_syscall_64+0x1e8/0x640 [ 45.860176] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 45.865087] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 45.870263] RIP: 0033:0x459829 [ 45.873428] RSP: 002b:00007ffc35e75b98 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 45.881113] RAX: ffffffffffffffda RBX: 00007ffc35e75bb0 RCX: 0000000000459829 [ 45.888360] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 45.895604] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 45.902864] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000002069914 [ 45.910111] R13: 00000000004bfce6 R14: 00000000004d1a38 R15: 0000000000000004 [ 45.919665] ------------[ cut here ]------------ [ 45.924429] WARNING: CPU: 0 PID: 6901 at arch/x86/mm/pat.c:1020 untrack_pfn+0x1dc/0x220 [ 45.932549] Kernel panic - not syncing: panic_on_warn set ... [ 45.932549] [ 45.939886] CPU: 0 PID: 6901 Comm: syz-executor.0 Not tainted 4.14.138 #34 [ 45.946873] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 45.956200] Call Trace: [ 45.958773] dump_stack+0x138/0x19c [ 45.962395] panic+0x1f2/0x426 [ 45.965566] ? add_taint.cold+0x16/0x16 [ 45.969514] ? untrack_pfn+0x1dc/0x220 [ 45.973378] ? untrack_pfn+0x1dc/0x220 [ 45.977259] __warn.cold+0x2f/0x36 [ 45.980782] ? ist_end_non_atomic+0x10/0x10 [ 45.985100] ? untrack_pfn+0x1dc/0x220 [ 45.988970] report_bug+0x216/0x254 [ 45.992599] do_error_trap+0x1bb/0x310 [ 45.996464] ? math_error+0x360/0x360 [ 46.000239] ? lock_downgrade+0x6e0/0x6e0 [ 46.004360] ? unmap_page_range+0xbe7/0x1770 [ 46.008750] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 46.013568] do_invalid_op+0x1b/0x20 [ 46.017258] invalid_op+0x1b/0x40 [ 46.020687] RIP: 0010:untrack_pfn+0x1dc/0x220 [ 46.025173] RSP: 0018:ffff8880a8cc7948 EFLAGS: 00010297 [ 46.030521] RAX: ffff888099ca23c0 RBX: ffff8880831a3358 RCX: 0000000000000000 [ 46.037765] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 [ 46.045014] RBP: ffff8880a8cc79d8 R08: ffff888099ca23c0 R09: 0000000000000000 [ 46.052263] R10: 0000000000000000 R11: ffff888099ca23c0 R12: 1ffff11015198f2a [ 46.059508] R13: 0000000000000000 R14: 0000000000000000 R15: ffff8880a8cc79b0 [ 46.066767] ? untrack_pfn+0x1dc/0x220 [ 46.070641] ? track_pfn_insert+0x150/0x150 [ 46.074942] ? vm_normal_page_pmd+0x360/0x360 [ 46.079414] ? uprobe_munmap+0x94/0x210 [ 46.083363] unmap_single_vma+0x182/0x2c0 [ 46.087486] unmap_vmas+0xac/0x170 [ 46.091008] exit_mmap+0x285/0x4e0 [ 46.094525] ? SyS_munmap+0x30/0x30 [ 46.098147] ? kmem_cache_free+0x244/0x2b0 [ 46.102369] ? __khugepaged_exit+0xcf/0x3d0 [ 46.106667] ? lock_downgrade+0x6e0/0x6e0 [ 46.110793] mmput+0x114/0x440 [ 46.113963] copy_process.part.0+0x4743/0x6a00 [ 46.118532] ? __cleanup_sighand+0x50/0x50 [ 46.122742] ? vfs_write+0x25f/0x500 [ 46.126441] _do_fork+0x19e/0xce0 [ 46.129882] ? fork_idle+0x280/0x280 [ 46.133570] ? vfs_write+0x104/0x500 [ 46.137262] ? SyS_write+0x15e/0x230 [ 46.140966] SyS_clone+0x37/0x50 [ 46.144307] ? sys_vfork+0x30/0x30 [ 46.147825] do_syscall_64+0x1e8/0x640 [ 46.151688] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 46.156515] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 46.161694] RIP: 0033:0x459829 [ 46.164876] RSP: 002b:00007ffc35e75b98 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 46.172563] RAX: ffffffffffffffda RBX: 00007ffc35e75bb0 RCX: 0000000000459829 [ 46.179831] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 46.187080] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 46.194326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000002069914 [ 46.201598] R13: 00000000004bfce6 R14: 00000000004d1a38 R15: 0000000000000004 [ 46.210112] Kernel Offset: disabled [ 46.213787] Rebooting in 86400 seconds..