[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 32.415660] random: sshd: uninitialized urandom read (32 bytes read) [ 32.708431] kauditd_printk_skb: 9 callbacks suppressed [ 32.708439] audit: type=1400 audit(1566315269.902:35): avc: denied { map } for pid=6729 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 32.749464] random: sshd: uninitialized urandom read (32 bytes read) [ 33.235030] random: sshd: uninitialized urandom read (32 bytes read) [ 33.422787] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.8' (ECDSA) to the list of known hosts. [ 38.895279] random: sshd: uninitialized urandom read (32 bytes read) [ 39.071998] audit: type=1400 audit(1566315276.272:36): avc: denied { map } for pid=6742 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2019/08/20 15:34:37 parsed 1 programs [ 39.886515] audit: type=1400 audit(1566315277.082:37): avc: denied { map } for pid=6742 comm="syz-execprog" path="/sys/kernel/debug/kcov" dev="debugfs" ino=13821 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 [ 40.260594] random: cc1: uninitialized urandom read (8 bytes read) 2019/08/20 15:34:37 executed programs: 0 [ 40.781431] audit: type=1400 audit(1566315277.982:38): avc: denied { map } for pid=6742 comm="syz-execprog" path="/root/syzkaller-shm809648401" dev="sda1" ino=16484 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 41.050847] IPVS: ftp: loaded support on port[0] = 21 [ 41.814299] chnl_net:caif_netlink_parms(): no params data found [ 41.843387] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.850109] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.856941] device bridge_slave_0 entered promiscuous mode [ 41.863712] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.870342] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.877106] device bridge_slave_1 entered promiscuous mode [ 41.890639] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 41.899100] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 41.914144] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 41.921477] team0: Port device team_slave_0 added [ 41.926743] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 41.933848] team0: Port device team_slave_1 added [ 41.938924] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 41.946145] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 42.001996] device hsr_slave_0 entered promiscuous mode [ 42.050328] device hsr_slave_1 entered promiscuous mode [ 42.090447] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 42.097254] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 42.110181] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.116564] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.123452] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.129776] bridge0: port 1(bridge_slave_0) entered forwarding state [ 42.154656] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 42.161397] 8021q: adding VLAN 0 to HW filter on device bond0 [ 42.168693] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 42.176687] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 42.196379] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.203401] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.212808] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 42.218862] 8021q: adding VLAN 0 to HW filter on device team0 [ 42.226941] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 42.234487] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.240855] bridge0: port 1(bridge_slave_0) entered forwarding state [ 42.249182] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 42.256718] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.263077] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.279729] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 42.289642] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 42.300797] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 42.307527] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 42.315219] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 42.322667] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 42.330703] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 42.338071] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 42.344840] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 42.355404] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 42.366753] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 42.810435] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 43.630639] audit: type=1400 audit(1566315280.822:39): avc: denied { map } for pid=6772 comm="syz-executor.0" path="/root/syzkaller-testdir847071083/syzkaller.I4mqP9/0/file0/mem" dev="devtmpfs" ino=13688 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:memory_device_t:s0 tclass=chr_file permissive=1 [ 43.630913] x86/PAT: syz-executor.0:6772 freeing invalid memtype [mem 0x00001000-0x00001fff] [ 43.670476] FAULT_INJECTION: forcing a failure. [ 43.670476] name failslab, interval 1, probability 0, space 0, times 1 [ 43.682181] CPU: 0 PID: 6772 Comm: syz-executor.0 Not tainted 4.14.139 #35 [ 43.689179] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 43.698507] Call Trace: [ 43.701076] dump_stack+0x138/0x19c [ 43.704683] should_fail.cold+0x10f/0x159 [ 43.708808] should_failslab+0xdb/0x130 [ 43.712759] kmem_cache_alloc_trace+0x2e9/0x790 [ 43.717403] ? pat_pagerange_is_ram+0x90/0xf0 [ 43.721873] ? __init_cache_modes+0x240/0x240 [ 43.726345] reserve_memtype+0x164/0x640 [ 43.730383] ? lock_downgrade+0x6e0/0x6e0 [ 43.734507] ? pat_init+0x420/0x420 [ 43.738112] ? __init_cache_modes+0x240/0x240 [ 43.742583] reserve_pfn_range+0x11c/0x390 [ 43.746796] ? arch_io_reserve_memtype_wc+0x80/0x80 [ 43.751789] ? copy_process.part.0+0x444f/0x6a00 [ 43.756533] ? SyS_clone+0x37/0x50 [ 43.760051] ? do_syscall_64+0x1e8/0x640 [ 43.764086] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 43.769439] track_pfn_copy+0x14a/0x190 [ 43.773390] ? reserve_pfn_range+0x390/0x390 [ 43.777774] ? trace_hardirqs_on+0x10/0x10 [ 43.781995] copy_page_range+0x1255/0x1bd0 [ 43.786212] ? save_trace+0x290/0x290 [ 43.789990] ? copy_process.part.0+0x41de/0x6a00 [ 43.794722] ? find_held_lock+0x35/0x130 [ 43.798758] ? vma_compute_subtree_gap+0x190/0x1f0 [ 43.803662] ? vma_gap_callbacks_rotate+0x62/0x80 [ 43.808483] ? __rb_insert_augmented+0x22f/0xdf0 [ 43.813218] ? __pmd_alloc+0x410/0x410 [ 43.817095] ? __vma_link_rb+0x247/0x340 [ 43.821135] copy_process.part.0+0x4764/0x6a00 [ 43.825720] ? __cleanup_sighand+0x50/0x50 [ 43.829932] ? vfs_write+0x25f/0x500 [ 43.833625] _do_fork+0x19e/0xce0 [ 43.837057] ? fork_idle+0x280/0x280 [ 43.840747] ? vfs_write+0x104/0x500 [ 43.844437] ? SyS_write+0x15e/0x230 [ 43.848129] SyS_clone+0x37/0x50 [ 43.851589] ? sys_vfork+0x30/0x30 [ 43.855109] do_syscall_64+0x1e8/0x640 [ 43.858971] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 43.863795] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 43.868959] RIP: 0033:0x459829 [ 43.872122] RSP: 002b:00007ffdfcd52e68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 43.879805] RAX: ffffffffffffffda RBX: 00007ffdfcd52e80 RCX: 0000000000459829 [ 43.887050] RDX: 9999999999999999 RSI: 0000000000000000 RDI: 0000000000000000 [ 43.894294] RBP: 000000000075bf20 R08: ffffffffffffffff R09: 0000000000000000 [ 43.901539] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000f81914 [ 43.908784] R13: 00000000004bfce6 R14: 00000000004d1a58 R15: 0000000000000004 [ 43.918095] ------------[ cut here ]------------ [ 43.922852] WARNING: CPU: 0 PID: 6772 at arch/x86/mm/pat.c:1020 untrack_pfn+0x1dc/0x220 [ 43.930967] Kernel panic - not syncing: panic_on_warn set ... [ 43.930967] [ 43.938304] CPU: 0 PID: 6772 Comm: syz-executor.0 Not tainted 4.14.139 #35 [ 43.945288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 43.954623] Call Trace: [ 43.957188] dump_stack+0x138/0x19c [ 43.960794] panic+0x1f2/0x426 [ 43.963963] ? add_taint.cold+0x16/0x16 [ 43.967920] ? untrack_pfn+0x1dc/0x220 [ 43.971783] ? untrack_pfn+0x1dc/0x220 [ 43.975644] __warn.cold+0x2f/0x36 [ 43.979160] ? ist_end_non_atomic+0x10/0x10 [ 43.983459] ? untrack_pfn+0x1dc/0x220 [ 43.987329] report_bug+0x216/0x254 [ 43.990943] do_error_trap+0x1bb/0x310 [ 43.994806] ? math_error+0x360/0x360 [ 43.998582] ? lock_downgrade+0x6e0/0x6e0 [ 44.002705] ? unmap_page_range+0xbe7/0x1770 [ 44.007090] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 44.011913] do_invalid_op+0x1b/0x20 [ 44.015601] invalid_op+0x1b/0x40 [ 44.019028] RIP: 0010:untrack_pfn+0x1dc/0x220 [ 44.023501] RSP: 0018:ffff88809530f948 EFLAGS: 00010297 [ 44.028842] RAX: ffff88809644a580 RBX: ffff88808f641318 RCX: 0000000000000000 [ 44.036097] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 [ 44.043343] RBP: ffff88809530f9d8 R08: ffff88809644a580 R09: 0000000000000000 [ 44.050586] R10: 0000000000000000 R11: ffff88809644a580 R12: 1ffff11012a61f2a [ 44.057834] R13: 0000000000000000 R14: 0000000000000000 R15: ffff88809530f9b0 [ 44.065109] ? untrack_pfn+0x1dc/0x220 [ 44.068970] ? track_pfn_insert+0x150/0x150 [ 44.073266] ? vm_normal_page_pmd+0x360/0x360 [ 44.077737] ? uprobe_munmap+0x94/0x210 [ 44.081699] unmap_single_vma+0x182/0x2c0 [ 44.085824] unmap_vmas+0xac/0x170 [ 44.089347] exit_mmap+0x285/0x4e0 [ 44.092872] ? SyS_munmap+0x30/0x30 [ 44.096481] ? kmem_cache_free+0x244/0x2b0 [ 44.100694] ? __khugepaged_exit+0xcf/0x3d0 [ 44.105000] ? lock_downgrade+0x6e0/0x6e0 [ 44.109138] mmput+0x114/0x440 [ 44.112310] copy_process.part.0+0x4743/0x6a00 [ 44.116878] ? __cleanup_sighand+0x50/0x50 [ 44.121093] ? vfs_write+0x25f/0x500 [ 44.124785] _do_fork+0x19e/0xce0 [ 44.128214] ? fork_idle+0x280/0x280 [ 44.131916] ? vfs_write+0x104/0x500 [ 44.135621] ? SyS_write+0x15e/0x230 [ 44.139320] SyS_clone+0x37/0x50 [ 44.142668] ? sys_vfork+0x30/0x30 [ 44.146190] do_syscall_64+0x1e8/0x640 [ 44.150055] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 44.154876] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 44.160051] RIP: 0033:0x459829 [ 44.163223] RSP: 002b:00007ffdfcd52e68 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 44.170914] RAX: ffffffffffffffda RBX: 00007ffdfcd52e80 RCX: 0000000000459829 [ 44.178166] RDX: 9999999999999999 RSI: 0000000000000000 RDI: 0000000000000000 [ 44.185412] RBP: 000000000075bf20 R08: ffffffffffffffff R09: 0000000000000000 [ 44.192660] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000f81914 [ 44.199906] R13: 00000000004bfce6 R14: 00000000004d1a58 R15: 0000000000000004 [ 44.208435] Kernel Offset: disabled [ 44.212129] Rebooting in 86400 seconds..