[....] Starting enhanced syslogd: rsyslogd[ 12.534134] audit: type=1400 audit(1515345038.782:5): avc: denied { syslog } for pid=3340 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 18.429975] audit: type=1400 audit(1515345044.678:6): avc: denied { map } for pid=3480 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.15.238' (ECDSA) to the list of known hosts. [ 24.636972] audit: type=1400 audit(1515345050.885:7): avc: denied { map } for pid=3495 comm="syzkaller065230" path="/root/syzkaller065230940" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 executing program executing program executing program executing program [ 25.056445] [ 25.058100] ========================= [ 25.061864] WARNING: held lock freed! [ 25.065632] 4.15.0-rc6+ #250 Not tainted [ 25.069655] ------------------------- [ 25.073423] syzkaller065230/3505 is freeing memory 000000007fcba654-00000000499fef26, with a lock still held there! [ 25.083959] (sk_lock-AF_INET6){+.+.}, at: [<00000000abe26b8e>] sctp_wait_for_sndbuf+0x509/0x8d0 [ 25.092871] 1 lock held by syzkaller065230/3505: [ 25.097592] #0: (sk_lock-AF_INET6){+.+.}, at: [<00000000abe26b8e>] sctp_wait_for_sndbuf+0x509/0x8d0 [ 25.106926] [ 25.106926] stack backtrace: [ 25.111388] CPU: 0 PID: 3505 Comm: syzkaller065230 Not tainted 4.15.0-rc6+ #250 [ 25.118800] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 25.128122] Call Trace: [ 25.130685] dump_stack+0x194/0x257 [ 25.134284] ? arch_local_irq_restore+0x53/0x53 [ 25.138929] debug_check_no_locks_freed+0x32f/0x3c0 [ 25.143918] kmem_cache_free+0x68/0x2a0 [ 25.147864] __sk_destruct+0x622/0x910 [ 25.151718] ? kasan_slab_free+0x71/0xc0 [ 25.155748] ? sock_rfree+0x160/0x160 [ 25.159515] ? inet_sendmsg+0x11f/0x5e0 [ 25.163455] ? SYSC_sendto+0x361/0x5c0 [ 25.167307] ? SyS_sendto+0x40/0x50 [ 25.170902] ? entry_SYSCALL_64_fastpath+0x23/0x9a [ 25.175818] ? check_noncircular+0x20/0x20 [ 25.180019] ? print_irqtrace_events+0x270/0x270 [ 25.184756] ? free_obj_work+0x690/0x690 [ 25.188787] ? sctp_put_port+0x495/0x640 [ 25.192826] ? sctp_poll+0xc00/0xc00 [ 25.196510] ? refcount_sub_and_test+0x115/0x1b0 [ 25.201233] ? refcount_inc+0x50/0x50 [ 25.204999] ? refcount_inc+0x50/0x50 [ 25.208770] sk_destruct+0x47/0x80 [ 25.212275] __sk_free+0x57/0x230 [ 25.215698] sk_free+0x2a/0x40 [ 25.218857] sctp_association_put+0x14c/0x2f0 [ 25.223318] ? sctp_association_hold+0x20/0x20 [ 25.227865] ? lock_sock_nested+0x91/0x110 [ 25.232068] ? trace_hardirqs_on+0xd/0x10 [ 25.236186] ? __local_bh_enable_ip+0x121/0x230 [ 25.240833] sctp_wait_for_sndbuf+0x673/0x8d0 [ 25.245307] ? sctp_init_sock+0x13b0/0x13b0 [ 25.249597] ? do_raw_spin_trylock+0x190/0x190 [ 25.254155] ? __local_bh_enable_ip+0x121/0x230 [ 25.258789] ? sctp_prsctp_prune+0x97/0x6f0 [ 25.263080] ? prepare_to_wait+0x4d0/0x4d0 [ 25.267976] ? trace_hardirqs_on+0xd/0x10 [ 25.272095] sctp_sendmsg+0x277d/0x3360 [ 25.276050] ? put_pi_state+0x3c0/0x560 [ 25.280001] ? sctp_id2assoc+0x390/0x390 [ 25.284031] ? avc_has_perm+0x43e/0x680 [ 25.287975] ? avc_has_perm_noaudit+0x520/0x520 [ 25.292621] ? __fget+0x35c/0x570 [ 25.296047] ? iterate_fd+0x3f0/0x3f0 [ 25.299819] ? find_held_lock+0x35/0x1d0 [ 25.303862] ? sock_has_perm+0x2a4/0x420 [ 25.307889] ? lock_release+0x962/0xa40 [ 25.311829] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 25.317689] ? __check_object_size+0x25d/0x4f0 [ 25.322261] inet_sendmsg+0x11f/0x5e0 [ 25.326027] ? inet_sendmsg+0x11f/0x5e0 [ 25.329968] ? __might_sleep+0x95/0x190 [ 25.333909] ? inet_recvmsg+0x5f0/0x5f0 [ 25.337854] ? selinux_socket_sendmsg+0x36/0x40 [ 25.342500] ? security_socket_sendmsg+0x89/0xb0 [ 25.347220] ? inet_recvmsg+0x5f0/0x5f0 [ 25.351161] sock_sendmsg+0xca/0x110 [ 25.354841] SYSC_sendto+0x361/0x5c0 [ 25.358521] ? SYSC_connect+0x4a0/0x4a0 [ 25.362461] ? selinux_secmark_relabel_packet+0xc0/0xc0 [ 25.367791] ? __do_page_fault+0x3d6/0xc90 [ 25.371995] ? selinux_netlbl_sock_rcv_skb+0x730/0x730 [ 25.377250] ? SyS_futex+0x269/0x390 [ 25.380930] ? SyS_setsockopt+0x215/0x360 [ 25.385059] ? do_futex+0x22a0/0x22a0 [ 25.388827] ? entry_SYSCALL_64_fastpath+0x5/0x9a [ 25.393648] SyS_sendto+0x40/0x50 [ 25.397077] entry_SYSCALL_64_fastpath+0x23/0x9a [ 25.401808] RIP: 0033:0x445db9 [ 25.404964] RSP: 002b:00007f2467415d98 EFLAGS: 00000212 ORIG_RAX: 000000000000002c [ 25.412638] RAX: ffffffffffffffda RBX: 00000000006dbc84 RCX: 0000000000445db9 [ 25.419874] RDX: 0000000000000001 RSI: 000000002010bf14 RDI: 0000000000000005 [ 25.428507] RBP: 0000000000000000 R08: 00000000204d9000 R09: 000000000000001c [ 25.435744] R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006dbc80 [ 25.443327] R13: 00000000209a9000 R14: 0100000000000000 R15: 0000000000000001 [ 25.450699] ================================================================== [ 25.458054] BUG: KASAN: use-after-free in do_raw_spin_lock+0x1e0/0x220 [ 25.464687] Read of size 4 at addr ffff8801c17ab08c by task syzkaller065230/3505 [ 25.472194] [ 25.473979] CPU: 0 PID: 3505 Comm: syzkaller065230 Not tainted 4.15.0-rc6+ #250 [ 25.481401] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 25.490723] Call Trace: [ 25.493295] dump_stack+0x194/0x257 [ 25.496903] ? arch_local_irq_restore+0x53/0x53 [ 25.501542] ? show_regs_print_info+0x18/0x18 [ 25.506013] ? lock_acquire+0x1d5/0x580 [ 25.509964] ? trace_hardirqs_on+0xd/0x10 [ 25.514083] ? do_raw_spin_lock+0x1e0/0x220 [ 25.518374] print_address_description+0x73/0x250 [ 25.523185] ? do_raw_spin_lock+0x1e0/0x220 [ 25.527478] kasan_report+0x25b/0x340 [ 25.531250] __asan_report_load4_noabort+0x14/0x20 [ 25.536146] do_raw_spin_lock+0x1e0/0x220 [ 25.540354] _raw_spin_lock_bh+0x39/0x40 [ 25.544387] ? release_sock+0x74/0x2a0 [ 25.548241] release_sock+0x74/0x2a0 [ 25.551928] ? sctp_prsctp_prune+0x97/0x6f0 [ 25.556218] ? __release_sock+0x360/0x360 [ 25.560330] ? trace_hardirqs_on+0xd/0x10 [ 25.564449] sctp_sendmsg+0x2c61/0x3360 [ 25.568390] ? put_pi_state+0x3c0/0x560 [ 25.572335] ? sctp_id2assoc+0x390/0x390 [ 25.576363] ? avc_has_perm+0x43e/0x680 [ 25.580303] ? avc_has_perm_noaudit+0x520/0x520 [ 25.584958] ? __fget+0x35c/0x570 [ 25.588382] ? iterate_fd+0x3f0/0x3f0 [ 25.592154] ? find_held_lock+0x35/0x1d0 [ 25.596185] ? sock_has_perm+0x2a4/0x420 [ 25.600213] ? lock_release+0x962/0xa40 [ 25.604154] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 25.610004] ? __check_object_size+0x25d/0x4f0 [ 25.614559] inet_sendmsg+0x11f/0x5e0 [ 25.618337] ? inet_sendmsg+0x11f/0x5e0 [ 25.622280] ? __might_sleep+0x95/0x190 [ 25.626220] ? inet_recvmsg+0x5f0/0x5f0 [ 25.630161] ? selinux_socket_sendmsg+0x36/0x40 [ 25.634795] ? security_socket_sendmsg+0x89/0xb0 [ 25.639516] ? inet_recvmsg+0x5f0/0x5f0 [ 25.643458] sock_sendmsg+0xca/0x110 [ 25.647150] SYSC_sendto+0x361/0x5c0 [ 25.650835] ? SYSC_connect+0x4a0/0x4a0 [ 25.654777] ? selinux_secmark_relabel_packet+0xc0/0xc0 [ 25.660117] ? __do_page_fault+0x3d6/0xc90 [ 25.664325] ? selinux_netlbl_sock_rcv_skb+0x730/0x730 [ 25.669584] ? SyS_futex+0x269/0x390 [ 25.673263] ? SyS_setsockopt+0x215/0x360 [ 25.677380] ? do_futex+0x22a0/0x22a0 [ 25.681151] ? entry_SYSCALL_64_fastpath+0x5/0x9a [ 25.685962] SyS_sendto+0x40/0x50 [ 25.689383] entry_SYSCALL_64_fastpath+0x23/0x9a [ 25.694106] RIP: 0033:0x445db9 [ 25.697274] RSP: 002b:00007f2467415d98 EFLAGS: 00000212 ORIG_RAX: 000000000000002c [ 25.704961] RAX: ffffffffffffffda RBX: 00000000006dbc84 RCX: 0000000000445db9 [ 25.712198] RDX: 0000000000000001 RSI: 000000002010bf14 RDI: 0000000000000005 [ 25.719439] RBP: 0000000000000000 R08: 00000000204d9000 R09: 000000000000001c [ 25.726690] R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006dbc80 [ 25.733928] R13: 00000000209a9000 R14: 0100000000000000 R15: 0000000000000001 [ 25.741176] [ 25.742773] Allocated by task 3506: [ 25.746374] save_stack+0x43/0xd0 [ 25.749791] kasan_kmalloc+0xad/0xe0 [ 25.753469] kasan_slab_alloc+0x12/0x20 [ 25.757409] kmem_cache_alloc+0x12e/0x760 [ 25.761528] sk_prot_alloc+0x65/0x2a0 [ 25.765293] sk_alloc+0x105/0x1410 [ 25.768817] sctp_v6_create_accept_sk+0x15a/0x9b0 [ 25.773631] sctp_accept+0x5c4/0x970 [ 25.777319] inet_accept+0x12c/0x930 [ 25.781001] SYSC_accept4+0x38d/0x870 [ 25.784767] SyS_accept+0x26/0x30 [ 25.788189] entry_SYSCALL_64_fastpath+0x23/0x9a [ 25.792906] [ 25.794501] Freed by task 3505: [ 25.797745] save_stack+0x43/0xd0 [ 25.801163] kasan_slab_free+0x71/0xc0 [ 25.805016] kmem_cache_free+0x83/0x2a0 [ 25.808956] __sk_destruct+0x622/0x910 [ 25.812810] sk_destruct+0x47/0x80 [ 25.816501] __sk_free+0x57/0x230 [ 25.821396] sk_free+0x2a/0x40 [ 25.824829] sctp_association_put+0x14c/0x2f0 [ 25.829293] sctp_wait_for_sndbuf+0x673/0x8d0 [ 25.833757] sctp_sendmsg+0x277d/0x3360 [ 25.837702] inet_sendmsg+0x11f/0x5e0 [ 25.841468] sock_sendmsg+0xca/0x110 [ 25.845146] SYSC_sendto+0x361/0x5c0 [ 25.848826] SyS_sendto+0x40/0x50 [ 25.852250] entry_SYSCALL_64_fastpath+0x23/0x9a [ 25.856968] [ 25.858567] The buggy address belongs to the object at ffff8801c17ab000 [ 25.858567] which belongs to the cache SCTPv6 of size 1888 [ 25.870850] The buggy address is located 140 bytes inside of [ 25.870850] 1888-byte region [ffff8801c17ab000, ffff8801c17ab760) [ 25.882775] The buggy address belongs to the page: [ 25.887676] page:ffffea000705eac0 count:1 mapcount:0 mapping:ffff8801c17ab000 index:0x0 [ 25.895786] flags: 0x2fffc0000000100(slab) [ 25.899996] raw: 02fffc0000000100 ffff8801c17ab000 0000000000000000 0000000100000002 [ 25.908190] raw: ffffea00070173e0 ffffea0007044860 ffff8801d32b0380 0000000000000000 [ 25.918997] page dumped because: kasan: bad access detected [ 25.926496] [ 25.929043] Memory state around the buggy address: [ 25.935500] ffff8801c17aaf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.944919] ffff8801c17ab000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.952253] >ffff8801c17ab080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.959576] ^ [ 25.963166] ffff8801c17ab100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.970491] ffff8801c17ab180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.977823] ================================================================== [ 25.985203] Kernel panic - not syncing: panic_on_warn set ... [ 25.985203] [ 25.992539] CPU: 0 PID: 3505 Comm: syzkaller065230 Tainted: G B 4.15.0-rc6+ #250 [ 26.001268] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 26.010591] Call Trace: [ 26.013156] dump_stack+0x194/0x257 [ 26.017192] ? arch_local_irq_restore+0x53/0x53 [ 26.021834] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 26.026561] ? vsnprintf+0x1ed/0x1900 [ 26.030335] ? do_raw_spin_lock+0x100/0x220 [ 26.034629] panic+0x1e4/0x41c [ 26.037792] ? refcount_error_report+0x214/0x214 [ 26.042541] ? add_taint+0x1c/0x50 [ 26.046051] ? add_taint+0x1c/0x50 [ 26.049563] ? do_raw_spin_lock+0x1e0/0x220 [ 26.053855] kasan_end_report+0x50/0x50 [ 26.057806] kasan_report+0x144/0x340 [ 26.061579] __asan_report_load4_noabort+0x14/0x20 [ 26.066479] do_raw_spin_lock+0x1e0/0x220 [ 26.070604] _raw_spin_lock_bh+0x39/0x40 [ 26.074637] ? release_sock+0x74/0x2a0 [ 26.078504] release_sock+0x74/0x2a0 [ 26.082187] ? sctp_prsctp_prune+0x97/0x6f0 [ 26.086475] ? __release_sock+0x360/0x360 [ 26.090590] ? trace_hardirqs_on+0xd/0x10 [ 26.094712] sctp_sendmsg+0x2c61/0x3360 [ 26.098654] ? put_pi_state+0x3c0/0x560 [ 26.102600] ? sctp_id2assoc+0x390/0x390 [ 26.106628] ? avc_has_perm+0x43e/0x680 [ 26.110569] ? avc_has_perm_noaudit+0x520/0x520 [ 26.115206] ? __fget+0x35c/0x570 [ 26.118627] ? iterate_fd+0x3f0/0x3f0 [ 26.122397] ? find_held_lock+0x35/0x1d0 [ 26.126437] ? sock_has_perm+0x2a4/0x420 [ 26.130467] ? lock_release+0x962/0xa40 [ 26.134409] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 26.140269] ? __check_object_size+0x25d/0x4f0 [ 26.144831] inet_sendmsg+0x11f/0x5e0 [ 26.148599] ? inet_sendmsg+0x11f/0x5e0 [ 26.152539] ? __might_sleep+0x95/0x190 [ 26.156478] ? inet_recvmsg+0x5f0/0x5f0 [ 26.160432] ? selinux_socket_sendmsg+0x36/0x40 [ 26.165069] ? security_socket_sendmsg+0x89/0xb0 [ 26.169790] ? inet_recvmsg+0x5f0/0x5f0 [ 26.173733] sock_sendmsg+0xca/0x110 [ 26.177425] SYSC_sendto+0x361/0x5c0 [ 26.181109] ? SYSC_connect+0x4a0/0x4a0 [ 26.185063] ? selinux_secmark_relabel_packet+0xc0/0xc0 [ 26.190395] ? __do_page_fault+0x3d6/0xc90 [ 26.194602] ? selinux_netlbl_sock_rcv_skb+0x730/0x730 [ 26.199869] ? SyS_futex+0x269/0x390 [ 26.203560] ? SyS_setsockopt+0x215/0x360 [ 26.207678] ? do_futex+0x22a0/0x22a0 [ 26.211446] ? entry_SYSCALL_64_fastpath+0x5/0x9a [ 26.216257] SyS_sendto+0x40/0x50 [ 26.219682] entry_SYSCALL_64_fastpath+0x23/0x9a [ 26.224416] RIP: 0033:0x445db9 [ 26.227572] RSP: 002b:00007f2467415d98 EFLAGS: 00000212 ORIG_RAX: 000000000000002c [ 26.235255] RAX: ffffffffffffffda RBX: 00000000006dbc84 RCX: 0000000000445db9 [ 26.242492] RDX: 0000000000000001 RSI: 000000002010bf14 RDI: 0000000000000005 [ 26.249731] RBP: 0000000000000000 R08: 00000000204d9000 R09: 000000000000001c [ 26.256982] R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006dbc80 [ 26.264217] R13: 00000000209a9000 R14: 0100000000000000 R15: 0000000000000001 [ 26.271497] Dumping ftrace buffer: [ 26.275005] (ftrace buffer empty) [ 26.278706] Kernel Offset: disabled [ 26.282303] Rebooting in 86400 seconds..