syzkaller syzkaller login: [ 6.041533][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #280!!! [ 10.811640][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!! [ 10.813784][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!! [ 10.861575][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 10.960324][ T23] kauditd_printk_skb: 60 callbacks suppressed [ 10.960333][ T23] audit: type=1400 audit(1636370938.859:71): avc: denied { transition } for pid=289 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 10.966962][ T23] audit: type=1400 audit(1636370938.869:72): avc: denied { write } for pid=289 comm="sh" path="pipe:[10136]" dev="pipefs" ino=10136 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1 Warning: Permanently added '10.128.1.208' (ECDSA) to the list of known hosts. 2021/11/08 11:29:05 fuzzer started 2021/11/08 11:29:06 connecting to host at 10.128.0.163:40523 2021/11/08 11:29:06 checking machine... 2021/11/08 11:29:06 checking revisions... 2021/11/08 11:29:06 testing simple program... [ 18.207498][ T23] audit: type=1400 audit(1636370946.109:73): avc: denied { getattr } for pid=363 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 18.215132][ T23] audit: type=1400 audit(1636370946.109:74): avc: denied { read } for pid=363 comm="syz-fuzzer" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 18.223278][ T23] audit: type=1400 audit(1636370946.109:75): avc: denied { open } for pid=363 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 18.232954][ T372] cgroup: Unknown subsys name 'net' [ 18.235768][ T23] audit: type=1400 audit(1636370946.119:76): avc: denied { read } for pid=363 comm="syz-fuzzer" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 18.264062][ T23] audit: type=1400 audit(1636370946.119:77): avc: denied { open } for pid=363 comm="syz-fuzzer" path="/dev/raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 18.264265][ T372] cgroup: Unknown subsys name 'devices' [ 18.288208][ T23] audit: type=1400 audit(1636370946.139:78): avc: denied { mounton } for pid=372 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1136 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 18.318483][ T23] audit: type=1400 audit(1636370946.139:79): avc: denied { mount } for pid=372 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 18.343578][ T23] audit: type=1400 audit(1636370946.149:80): avc: denied { unmount } for pid=372 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 18.453549][ T372] cgroup: Unknown subsys name 'hugetlb' [ 18.459806][ T372] cgroup: Unknown subsys name 'rlimit' [ 18.553379][ T23] audit: type=1400 audit(1636370946.459:81): avc: denied { setattr } for pid=372 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 18.577443][ T23] audit: type=1400 audit(1636370946.479:82): avc: denied { execmem } for pid=374 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 18.655694][ T375] bridge0: port 1(bridge_slave_0) entered blocking state [ 18.663118][ T375] bridge0: port 1(bridge_slave_0) entered disabled state [ 18.670622][ T375] device bridge_slave_0 entered promiscuous mode [ 18.677799][ T375] bridge0: port 2(bridge_slave_1) entered blocking state [ 18.685120][ T375] bridge0: port 2(bridge_slave_1) entered disabled state [ 18.692736][ T375] device bridge_slave_1 entered promiscuous mode [ 18.723441][ T375] bridge0: port 2(bridge_slave_1) entered blocking state [ 18.730729][ T375] bridge0: port 2(bridge_slave_1) entered forwarding state [ 18.738716][ T375] bridge0: port 1(bridge_slave_0) entered blocking state [ 18.746026][ T375] bridge0: port 1(bridge_slave_0) entered forwarding state [ 18.765216][ T19] bridge0: port 1(bridge_slave_0) entered disabled state [ 18.772964][ T19] bridge0: port 2(bridge_slave_1) entered disabled state [ 18.780767][ T19] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 18.789081][ T19] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 18.798812][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 18.807514][ T52] bridge0: port 1(bridge_slave_0) entered blocking state [ 18.815236][ T52] bridge0: port 1(bridge_slave_0) entered forwarding state [ 18.832995][ T19] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 18.843053][ T19] bridge0: port 2(bridge_slave_1) entered blocking state [ 18.851129][ T19] bridge0: port 2(bridge_slave_1) entered forwarding state [ 18.858771][ T19] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 18.867636][ T19] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 18.888909][ T19] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 18.897817][ T19] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 18.907467][ T19] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 18.916189][ T19] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 18.924733][ T19] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 18.939632][ T375] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 18.950158][ T19] ================================================================================ [ 18.959562][ T19] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:2023:28 [ 18.967664][ T19] member access within address ffffc900001471c0 with insufficient space [ 18.977055][ T19] for an object of type 'struct sk_buff' 2021/11/08 11:29:06 building call list... [ 18.983071][ T19] CPU: 1 PID: 19 Comm: kworker/1:0 Not tainted 5.10.78-syzkaller-01155-gbb235e8cc2b6 #0 [ 18.992999][ T19] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 19.003164][ T19] Workqueue: ipv6_addrconf addrconf_dad_work [ 19.009320][ T19] Call Trace: [ 19.012617][ T19] dump_stack_lvl+0x1e2/0x24b [ 19.017327][ T19] ? show_regs_print_info+0x18/0x18 [ 19.022540][ T19] ? wg_allowedips_lookup_dst+0x190/0x190 [ 19.028267][ T19] dump_stack+0x15/0x1d [ 19.032437][ T19] ubsan_type_mismatch_common+0x1ed/0x3a0 [ 19.038245][ T19] ? __sanitizer_cov_trace_switch+0x74/0x90 [ 19.044399][ T19] __ubsan_handle_type_mismatch_v1+0x5b/0x70 [ 19.050559][ T19] wg_xmit+0x4a2/0xae0 [ 19.054726][ T19] ? wg_stop+0x140/0x140 [ 19.059022][ T19] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20 [ 19.065261][ T19] netdev_start_xmit+0x8a/0x160 [ 19.070192][ T19] dev_hard_start_xmit+0x18d/0x2f0 [ 19.075384][ T19] __dev_queue_xmit+0xfbe/0x1bb0 [ 19.080330][ T19] ? dev_queue_xmit+0x20/0x20 [ 19.085002][ T19] ? __local_bh_enable_ip+0xa8/0x170 [ 19.090804][ T19] ? do_raw_spin_unlock+0x50/0x50 [ 19.095827][ T19] ? _local_bh_enable+0x30/0x30 [ 19.100683][ T19] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 19.107018][ T19] ? ndisc_constructor+0x690/0x8a0 [ 19.112252][ T19] ? _raw_write_unlock_bh+0x31/0x47 [ 19.117448][ T19] ? dev_hard_header+0xdb/0xf0 [ 19.122314][ T19] dev_queue_xmit+0x17/0x20 [ 19.126831][ T19] neigh_connected_output+0x288/0x2b0 [ 19.132302][ T19] ip6_finish_output2+0xde2/0x1440 [ 19.137507][ T19] ? __rcu_read_lock+0x50/0x50 [ 19.143240][ T19] ? __ip6_finish_output+0x520/0x520 [ 19.149064][ T19] ? dst_cow_metrics_generic+0x55/0x1d0 [ 19.154612][ T19] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 19.161029][ T19] ? ip6_skb_dst_mtu+0xaf/0x260 [ 19.165962][ T19] __ip6_finish_output+0x3e4/0x520 [ 19.172374][ T19] ip6_finish_output+0x3f/0x220 [ 19.177662][ T19] ? ip6_output+0x1d3/0x4b0 [ 19.182779][ T19] ip6_output+0x1f8/0x4b0 [ 19.187386][ T19] ? asan.module_dtor+0x20/0x20 [ 19.192474][ T19] ? skb_dst+0x40/0x40 [ 19.196544][ T19] ? __rcu_read_lock+0x50/0x50 [ 19.201314][ T19] ? selinux_ipv6_forward+0x50/0x50 [ 19.206517][ T19] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 19.212558][ T19] ? nf_hook_slow+0x150/0x1b0 [ 19.217241][ T19] NF_HOOK+0xdd/0x280 [ 19.221403][ T19] ? addrconf_addr_solict_mult+0xe0/0xe0 [ 19.227027][ T19] ? NF_HOOK+0x280/0x280 [ 19.231279][ T19] ? __rcu_read_lock+0x50/0x50 [ 19.236309][ T19] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 19.243419][ T19] ? ndisc_send_skb+0x547/0x9f0 [ 19.248348][ T19] ? memcpy+0x56/0x70 [ 19.252410][ T19] ndisc_send_skb+0x646/0x9f0 [ 19.257607][ T19] ? slab_post_alloc_hook+0x90/0xa0 [ 19.263058][ T19] ? ndisc_fill_addr_option+0x2f0/0x2f0 [ 19.269258][ T19] ? skb_set_owner_w+0x1a8/0x310 [ 19.274367][ T19] ? __sanitizer_cov_trace_cmp4+0x19/0x20 [ 19.280081][ T19] ? skb_put+0x11d/0x200 [ 19.284317][ T19] ndisc_send_rs+0x26c/0x360 [ 19.289082][ T19] addrconf_dad_completed+0x4f3/0x9f0 [ 19.294453][ T19] ? addrconf_dad_stop+0x430/0x430 [ 19.299648][ T19] addrconf_dad_work+0x9c1/0x1520 [ 19.305358][ T19] ? move_linked_works+0x118/0x130 [ 19.310465][ T19] ? ipv6_use_optimistic_addr+0x1d0/0x1d0 [ 19.316176][ T19] ? __kasan_check_write+0x14/0x20 [ 19.321375][ T19] process_one_work+0x3ca/0x660 [ 19.326245][ T19] worker_thread+0x709/0xa20 [ 19.330839][ T19] kthread+0x371/0x390 [ 19.334999][ T19] ? pr_cont_work+0x110/0x110 [ 19.339668][ T19] ? __list_add+0xc0/0xc0 [ 19.343991][ T19] ret_from_fork+0x1f/0x30 [ 19.348679][ T19] ================================================================================ [ 19.358336][ T19] ================================================================================ [ 19.367669][ T19] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:1916:2 [ 19.375886][ T19] member access within address ffffc900001471c0 with insufficient space [ 19.384315][ T19] for an object of type 'struct sk_buff' [ 19.390051][ T19] CPU: 1 PID: 19 Comm: kworker/1:0 Not tainted 5.10.78-syzkaller-01155-gbb235e8cc2b6 #0 [ 19.400399][ T19] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 19.412113][ T19] Workqueue: ipv6_addrconf addrconf_dad_work [ 19.418106][ T19] Call Trace: [ 19.421390][ T19] dump_stack_lvl+0x1e2/0x24b [ 19.426153][ T19] ? show_regs_print_info+0x18/0x18 [ 19.431342][ T19] ? wg_allowedips_lookup_dst+0x190/0x190 [ 19.437408][ T19] dump_stack+0x15/0x1d [ 19.441735][ T19] ubsan_type_mismatch_common+0x1ed/0x3a0 [ 19.447453][ T19] __ubsan_handle_type_mismatch_v1+0x5b/0x70 [ 19.453570][ T19] wg_xmit+0x513/0xae0 [ 19.457672][ T19] ? wg_stop+0x140/0x140 [ 19.461911][ T19] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20 [ 19.468230][ T19] netdev_start_xmit+0x8a/0x160 [ 19.473073][ T19] dev_hard_start_xmit+0x18d/0x2f0 [ 19.479568][ T19] __dev_queue_xmit+0xfbe/0x1bb0 [ 19.484585][ T19] ? dev_queue_xmit+0x20/0x20 [ 19.489282][ T19] ? __local_bh_enable_ip+0xa8/0x170 [ 19.494642][ T19] ? do_raw_spin_unlock+0x50/0x50 [ 19.499741][ T19] ? _local_bh_enable+0x30/0x30 [ 19.504771][ T19] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 19.511134][ T19] ? ndisc_constructor+0x690/0x8a0 [ 19.516328][ T19] ? _raw_write_unlock_bh+0x31/0x47 [ 19.521521][ T19] ? dev_hard_header+0xdb/0xf0 [ 19.526393][ T19] dev_queue_xmit+0x17/0x20 [ 19.531022][ T19] neigh_connected_output+0x288/0x2b0 [ 19.536647][ T19] ip6_finish_output2+0xde2/0x1440 [ 19.541750][ T19] ? __rcu_read_lock+0x50/0x50 [ 19.546586][ T19] ? __ip6_finish_output+0x520/0x520 [ 19.552085][ T19] ? dst_cow_metrics_generic+0x55/0x1d0 [ 19.557714][ T19] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 19.564239][ T19] ? ip6_skb_dst_mtu+0xaf/0x260 [ 19.569696][ T19] __ip6_finish_output+0x3e4/0x520 [ 19.574801][ T19] ip6_finish_output+0x3f/0x220 [ 19.579960][ T19] ? ip6_output+0x1d3/0x4b0 [ 19.584493][ T19] ip6_output+0x1f8/0x4b0 [ 19.588902][ T19] ? asan.module_dtor+0x20/0x20 [ 19.594097][ T19] ? skb_dst+0x40/0x40 [ 19.598439][ T19] ? __rcu_read_lock+0x50/0x50 [ 19.603306][ T19] ? selinux_ipv6_forward+0x50/0x50 [ 19.608766][ T19] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 19.615367][ T19] ? nf_hook_slow+0x150/0x1b0 [ 19.620222][ T19] NF_HOOK+0xdd/0x280 [ 19.624418][ T19] ? addrconf_addr_solict_mult+0xe0/0xe0 [ 19.630137][ T19] ? NF_HOOK+0x280/0x280 [ 19.634374][ T19] ? __rcu_read_lock+0x50/0x50 [ 19.639153][ T19] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 19.646102][ T19] ? ndisc_send_skb+0x547/0x9f0 [ 19.651217][ T19] ? memcpy+0x56/0x70 [ 19.655381][ T19] ndisc_send_skb+0x646/0x9f0 [ 19.660226][ T19] ? slab_post_alloc_hook+0x90/0xa0 [ 19.666793][ T19] ? ndisc_fill_addr_option+0x2f0/0x2f0 [ 19.672426][ T19] ? skb_set_owner_w+0x1a8/0x310 [ 19.677554][ T19] ? __sanitizer_cov_trace_cmp4+0x19/0x20 [ 19.683352][ T19] ? skb_put+0x11d/0x200 [ 19.688126][ T19] ndisc_send_rs+0x26c/0x360 [ 19.692717][ T19] addrconf_dad_completed+0x4f3/0x9f0 [ 19.698997][ T19] ? addrconf_dad_stop+0x430/0x430 [ 19.704341][ T19] addrconf_dad_work+0x9c1/0x1520 [ 19.709390][ T19] ? move_linked_works+0x118/0x130 [ 19.714762][ T19] ? ipv6_use_optimistic_addr+0x1d0/0x1d0 [ 19.721121][ T19] ? __kasan_check_write+0x14/0x20 [ 19.727163][ T19] process_one_work+0x3ca/0x660 [ 19.732309][ T19] worker_thread+0x709/0xa20 [ 19.737385][ T19] kthread+0x371/0x390 [ 19.741474][ T19] ? pr_cont_work+0x110/0x110 [ 19.746506][ T19] ? __list_add+0xc0/0xc0 [ 19.750835][ T19] ret_from_fork+0x1f/0x30 [ 19.756451][ T19] ================================================================================ [ 20.251957][ T7] device bridge_slave_1 left promiscuous mode [ 20.258947][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.267060][ T7] device bridge_slave_0 left promiscuous mode [ 20.277182][ T7] bridge0: port 1(bridge_slave_0) entered disabled state