[....] Starting enhanced syslogd: rsyslogd[ 15.836866] audit: type=1400 audit(1519111042.771:5): avc: denied { syslog } for pid=4015 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 18.679579] audit: type=1400 audit(1519111045.614:6): avc: denied { map } for pid=4153 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.47' (ECDSA) to the list of known hosts. [ 24.982191] audit: type=1400 audit(1519111051.916:7): avc: denied { map } for pid=4167 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=16479 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2018/02/20 07:17:32 parsed 1 programs 2018/02/20 07:17:32 executed programs: 0 [ 25.247674] audit: type=1400 audit(1519111052.182:8): avc: denied { map } for pid=4167 comm="syz-execprog" path="/root/syzkaller-shm122474065" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 25.282750] audit: type=1400 audit(1519111052.216:9): avc: denied { sys_admin } for pid=4172 comm="syz-executor0" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 25.293358] IPVS: ftp: loaded support on port[0] = 21 [ 25.354497] IPVS: ftp: loaded support on port[0] = 21 [ 25.380434] IPVS: ftp: loaded support on port[0] = 21 [ 25.380758] audit: type=1400 audit(1519111052.315:10): avc: denied { sys_chroot } for pid=4177 comm="syz-executor6" capability=18 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 25.417223] audit: type=1400 audit(1519111052.347:11): avc: denied { net_admin } for pid=4189 comm="syz-executor3" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 25.418085] IPVS: ftp: loaded support on port[0] = 21 [ 25.456963] audit: type=1400 audit(1519111052.391:12): avc: denied { net_raw } for pid=4191 comm="syz-executor6" capability=13 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 25.503188] IPVS: ftp: loaded support on port[0] = 21 [ 25.587881] IPVS: ftp: loaded support on port[0] = 21 [ 25.669485] IPVS: ftp: loaded support on port[0] = 21 [ 25.786784] IPVS: ftp: loaded support on port[0] = 21 2018/02/20 07:17:37 executed programs: 261 [ 30.913290] ------------[ cut here ]------------ [ 30.919166] ODEBUG: free active (active state 0) object type: work_struct hint: htable_gc+0x0/0xc0 [ 30.928326] WARNING: CPU: 1 PID: 4176 at lib/debugobjects.c:291 debug_print_object+0x166/0x220 [ 30.937056] Kernel panic - not syncing: panic_on_warn set ... [ 30.937056] [ 30.944396] CPU: 1 PID: 4176 Comm: syz-executor0 Not tainted 4.16.0-rc1+ #232 [ 30.951659] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 30.960986] Call Trace: [ 30.963556] dump_stack+0x194/0x257 [ 30.967157] ? arch_local_irq_restore+0x53/0x53 [ 30.971803] ? vsnprintf+0x1ed/0x1900 [ 30.975586] panic+0x1e4/0x41c [ 30.978755] ? refcount_error_report+0x214/0x214 [ 30.983482] ? show_regs_print_info+0x18/0x18 [ 30.987955] ? __warn+0x1c1/0x200 [ 30.991387] ? debug_print_object+0x166/0x220 [ 30.995856] __warn+0x1dc/0x200 [ 30.999111] ? debug_print_object+0x166/0x220 [ 31.003580] report_bug+0x211/0x2d0 [ 31.007182] fixup_bug.part.11+0x37/0x80 [ 31.011218] do_error_trap+0x2d7/0x3e0 [ 31.015078] ? __usermodehelper_disable+0x2f0/0x2f0 [ 31.020065] ? vprintk_default+0x28/0x30 [ 31.024099] ? math_error+0x400/0x400 [ 31.027873] ? printk+0xaa/0xca [ 31.031127] ? show_regs_print_info+0x18/0x18 [ 31.035599] ? __usermodehelper_disable+0x2f0/0x2f0 [ 31.040590] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 31.045408] ? __usermodehelper_disable+0x2f0/0x2f0 [ 31.050398] do_invalid_op+0x1b/0x20 [ 31.054086] invalid_op+0x22/0x40 [ 31.057512] RIP: 0010:debug_print_object+0x166/0x220 [ 31.062586] RSP: 0018:ffff8801b4467778 EFLAGS: 00010082 [ 31.067924] RAX: dffffc0000000008 RBX: 0000000000000003 RCX: ffffffff815aaf3e [ 31.075165] RDX: 0000000000000000 RSI: 1ffff1003688ce9f RDI: 1ffff1003688ce74 [ 31.082407] RBP: ffff8801b44677b8 R08: 0000000000000000 R09: 1ffff1003688ce46 [ 31.089649] R10: ffffed003688cf1e R11: ffffffff86b39478 R12: 0000000000000001 [ 31.096889] R13: ffffffff86b14d40 R14: ffffffff86007c60 R15: ffffffff81479bc0 [ 31.104133] ? __usermodehelper_disable+0x2f0/0x2f0 [ 31.109125] ? vprintk_func+0x5e/0xc0 [ 31.112903] ? debug_print_object+0x166/0x220 [ 31.117378] debug_check_no_obj_freed+0x662/0xf1f [ 31.122193] ? print_irqtrace_events+0x270/0x270 [ 31.126927] ? free_obj_work+0x690/0x690 [ 31.130961] ? do_raw_spin_trylock+0x190/0x190 [ 31.135523] ? mark_held_locks+0xaf/0x100 [ 31.139647] ? __vunmap+0xb6/0x380 [ 31.143168] __vunmap+0x112/0x380 [ 31.146597] vfree+0x50/0xe0 [ 31.149592] do_ipt_get_ctl+0x7f5/0xac0 [ 31.153544] ? get_info+0x690/0x690 [ 31.157144] ? ip_getsockopt+0x143/0x220 [ 31.161186] ? mark_held_locks+0xaf/0x100 [ 31.165309] ? mutex_unlock+0xd/0x10 [ 31.168997] ? nf_sockopt_find.constprop.0+0x1a7/0x220 [ 31.174247] nf_getsockopt+0x6a/0xc0 [ 31.177938] ip_getsockopt+0x15c/0x220 [ 31.181800] ? do_ip_getsockopt+0x2170/0x2170 [ 31.186273] tcp_getsockopt+0x82/0xd0 [ 31.190052] sock_common_getsockopt+0x95/0xd0 [ 31.194522] SyS_getsockopt+0x178/0x340 [ 31.198473] ? SyS_setsockopt+0x360/0x360 [ 31.202598] ? move_addr_to_kernel+0x60/0x60 [ 31.206981] ? do_syscall_64+0xb7/0x940 [ 31.210930] ? SyS_setsockopt+0x360/0x360 [ 31.215052] do_syscall_64+0x282/0x940 [ 31.218915] ? __do_page_fault+0xc90/0xc90 [ 31.223124] ? finish_task_switch+0x1e2/0x890 [ 31.227592] ? finish_task_switch+0x1b9/0x890 [ 31.232063] ? syscall_return_slowpath+0x550/0x550 [ 31.236964] ? syscall_return_slowpath+0x2ac/0x550 [ 31.241866] ? prepare_exit_to_usermode+0x350/0x350 [ 31.246860] ? entry_SYSCALL_64_after_hwframe+0x36/0x9b [ 31.252199] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 31.257020] entry_SYSCALL_64_after_hwframe+0x26/0x9b [ 31.262181] RIP: 0033:0x45687a [ 31.265343] RSP: 002b:0000000000a3e3b8 EFLAGS: 00000212 ORIG_RAX: 0000000000000037 [ 31.273023] RAX: ffffffffffffffda RBX: 0000000000a3e3e0 RCX: 000000000045687a [ 31.280265] RDX: 0000000000000041 RSI: 0000000000000000 RDI: 0000000000000000 [ 31.287507] RBP: 00000000006ff880 R08: 0000000000a3e3dc R09: 0000000000004000 [ 31.294753] R10: 0000000000a3e4e0 R11: 0000000000000212 R12: 0000000000000000 [ 31.301995] R13: 0000000000000000 R14: 0000000000000000 R15: 00000000006fe440 [ 31.309250] [ 31.309253] ====================================================== [ 31.309255] WARNING: possible circular locking dependency detected [ 31.309257] 4.16.0-rc1+ #232 Not tainted [ 31.309259] ------------------------------------------------------ [ 31.309261] syz-executor0/4176 is trying to acquire lock: [ 31.309262] ((console_sem).lock){..-.}, at: [<00000000bd3b5cdd>] down_trylock+0x13/0x70 [ 31.309268] [ 31.309269] but task is already holding lock: [ 31.309270] (&obj_hash[i].lock){-.-.}, at: [<000000006d0fc161>] debug_check_no_obj_freed+0x1e9/0xf1f [ 31.309276] [ 31.309278] which lock already depends on the new lock. [ 31.309279] [ 31.309280] [ 31.309282] the existing dependency chain (in reverse order) is: [ 31.309283] [ 31.309283] -> #3 (&obj_hash[i].lock){-.-.}: [ 31.309289] _raw_spin_lock_irqsave+0x96/0xc0 [ 31.309291] __debug_object_init+0x109/0x1040 [ 31.309293] debug_object_init+0x17/0x20 [ 31.309295] hrtimer_init+0x8c/0x410 [ 31.309296] init_dl_task_timer+0x1b/0x50 [ 31.309298] __sched_fork+0x2bb/0xb60 [ 31.309299] init_idle+0x75/0x820 [ 31.309301] sched_init+0xb19/0xc43 [ 31.309303] start_kernel+0x452/0x819 [ 31.309304] x86_64_start_reservations+0x2a/0x2c [ 31.309306] x86_64_start_kernel+0x77/0x7a [ 31.309308] secondary_startup_64+0xa5/0xb0 [ 31.309309] [ 31.309310] -> #2 (&rq->lock){-.-.}: [ 31.309315] _raw_spin_lock+0x2a/0x40 [ 31.309317] task_fork_fair+0x7a/0x690 [ 31.309319] sched_fork+0x450/0xc10 [ 31.309321] copy_process.part.37+0x1758/0x4b60 [ 31.309322] _do_fork+0x1f7/0xf70 [ 31.309324] kernel_thread+0x34/0x40 [ 31.309325] rest_init+0x22/0xf0 [ 31.309327] start_kernel+0x7f1/0x819 [ 31.309329] x86_64_start_reservations+0x2a/0x2c [ 31.309331] x86_64_start_kernel+0x77/0x7a [ 31.309332] secondary_startup_64+0xa5/0xb0 [ 31.309333] [ 31.309334] -> #1 (&p->pi_lock){-.-.}: [ 31.309340] _raw_spin_lock_irqsave+0x96/0xc0 [ 31.309341] try_to_wake_up+0xbc/0x15f0 [ 31.309343] wake_up_process+0x10/0x20 [ 31.309345] __up.isra.0+0x1cc/0x2c0 [ 31.309346] up+0x13b/0x1d0 [ 31.309348] __up_console_sem+0xb2/0x1a0 [ 31.309349] console_unlock+0x5af/0xfb0 [ 31.309351] vprintk_emit+0x5c3/0xb90 [ 31.309353] vprintk_default+0x28/0x30 [ 31.309354] vprintk_func+0x57/0xc0 [ 31.309356] printk+0xaa/0xca [ 31.309357] kauditd_hold_skb+0x163/0x180 [ 31.309359] kauditd_send_queue+0xfa/0x140 [ 31.309361] kauditd_thread+0x660/0x940 [ 31.309362] kthread+0x33c/0x400 [ 31.309364] ret_from_fork+0x3a/0x50 [ 31.309365] [ 31.309366] -> #0 ((console_sem).lock){..-.}: [ 31.309371] lock_acquire+0x1d5/0x580 [ 31.309373] _raw_spin_lock_irqsave+0x96/0xc0 [ 31.309374] down_trylock+0x13/0x70 [ 31.309376] __down_trylock_console_sem+0xa2/0x1e0 [ 31.309378] console_trylock+0x15/0x70 [ 31.309380] vprintk_emit+0x5b5/0xb90 [ 31.309381] vprintk_default+0x28/0x30 [ 31.309383] vprintk_func+0x57/0xc0 [ 31.309384] printk+0xaa/0xca [ 31.309386] __warn_printk+0x90/0xf0 [ 31.309388] debug_print_object+0x166/0x220 [ 31.309390] debug_check_no_obj_freed+0x662/0xf1f [ 31.309391] __vunmap+0x112/0x380 [ 31.309392] vfree+0x50/0xe0 [ 31.309394] do_ipt_get_ctl+0x7f5/0xac0 [ 31.309396] nf_getsockopt+0x6a/0xc0 [ 31.309397] ip_getsockopt+0x15c/0x220 [ 31.309399] tcp_getsockopt+0x82/0xd0 [ 31.309401] sock_common_getsockopt+0x95/0xd0 [ 31.309402] SyS_getsockopt+0x178/0x340 [ 31.309404] do_syscall_64+0x282/0x940 [ 31.309406] entry_SYSCALL_64_after_hwframe+0x26/0x9b [ 31.309407] [ 31.309409] other info that might help us debug this: [ 31.309410] [ 31.309411] Chain exists of: [ 31.309412] (console_sem).lock --> &rq->lock --> &obj_hash[i].lock [ 31.309419] [ 31.309420] Possible unsafe locking scenario: [ 31.309421] [ 31.309423] CPU0 CPU1 [ 31.309425] ---- ---- [ 31.309426] lock(&obj_hash[i].lock); [ 31.309429] lock(&rq->lock); [ 31.309433] lock(&obj_hash[i].lock); [ 31.309436] lock((console_sem).lock); [ 31.309439] [ 31.309440] *** DEADLOCK *** [ 31.309441] [ 31.309443] 3 locks held by syz-executor0/4176: [ 31.309444] #0: (sk_lock-AF_INET){+.+.}, at: [<00000000d5c1ff0d>] ip_getsockopt+0x143/0x220 [ 31.309450] #1: (&xt[i].mutex){+.+.}, at: [<00000000ec933095>] xt_find_table_lock+0x3e/0x3e0 [ 31.309456] #2: (&obj_hash[i].lock){-.-.}, at: [<000000006d0fc161>] debug_check_no_obj_freed+0x1e9/0xf1f [ 31.309462] [ 31.309463] stack backtrace: [ 31.309466] CPU: 1 PID: 4176 Comm: syz-executor0 Not tainted 4.16.0-rc1+ #232 [ 31.309469] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 31.309470] Call Trace: [ 31.309472] dump_stack+0x194/0x257 [ 31.309474] ? arch_local_irq_restore+0x53/0x53 [ 31.309476] print_circular_bug.isra.38+0x2cd/0x2dc [ 31.309477] ? save_trace+0xe0/0x2b0 [ 31.309479] __lock_acquire+0x30a8/0x3e00 [ 31.309481] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 31.309483] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 31.309484] ? save_stack+0x43/0xd0 [ 31.309486] ? kasan_kmalloc+0xad/0xe0 [ 31.309487] ? vfree+0x50/0xe0 [ 31.309489] ? check_noncircular+0x20/0x20 [ 31.309490] ? check_noncircular+0x20/0x20 [ 31.309492] ? SyS_getsockopt+0x178/0x340 [ 31.309494] ? do_syscall_64+0x282/0x940 [ 31.309496] ? entry_SYSCALL_64_after_hwframe+0x26/0x9b [ 31.309498] ? print_irqtrace_events+0x270/0x270 [ 31.309499] ? check_noncircular+0x20/0x20 [ 31.309501] ? print_irqtrace_events+0x270/0x270 [ 31.309503] ? check_noncircular+0x20/0x20 [ 31.309504] ? check_noncircular+0x20/0x20 [ 31.309506] lock_acquire+0x1d5/0x580 [ 31.309507] ? lock_acquire+0x1d5/0x580 [ 31.309509] ? down_trylock+0x13/0x70 [ 31.309511] ? lock_release+0xa40/0xa40 [ 31.309512] ? vprintk_emit+0x43b/0xb90 [ 31.309514] ? lock_downgrade+0x980/0x980 [ 31.309516] ? kvm_sched_clock_read+0x25/0x40 [ 31.309517] ? sched_clock+0x31/0x40 [ 31.309519] ? sched_clock_cpu+0x1b/0x180 [ 31.309520] ? vprintk_emit+0x5b5/0xb90 [ 31.309522] _raw_spin_lock_irqsave+0x96/0xc0 [ 31.309524] ? down_trylock+0x13/0x70 [ 31.309525] down_trylock+0x13/0x70 [ 31.309527] ? vprintk_emit+0x5b5/0xb90 [ 31.309528] __down_trylock_console_sem+0xa2/0x1e0 [ 31.309530] console_trylock+0x15/0x70 [ 31.309532] vprintk_emit+0x5b5/0xb90 [ 31.309533] ? console_unlock+0xfb0/0xfb0 [ 31.309535] ? trace_hardirqs_on+0xd/0x10 [ 31.309537] ? debug_object_active_state+0x3a5/0x580 [ 31.309539] ? debug_object_activate+0x404/0x730 [ 31.309540] ? debug_object_deactivate+0x560/0x560 [ 31.309542] ? mark_held_locks+0xaf/0x100 [ 31.309544] ? __usermodehelper_disable+0x2f0/0x2f0 [ 31.309546] vprintk_default+0x28/0x30 [ 31.309547] vprintk_func+0x57/0xc0 [ 31.309548] printk+0xaa/0xca [ 31.309550] ? show_regs_print_info+0x18/0x18 [ 31.309552] ? __warn_printk+0x84/0xf0 [ 31.309554] ? htable_selective_cleanup+0x3d0/0x3d0 [ 31.309555] __warn_printk+0x90/0xf0 [ 31.309557] ? test_taint+0x20/0x20 [ 31.309558] ? lock_release+0xa40/0xa40 [ 31.309560] ? __schedule+0x8ea/0x2040 [ 31.309562] ? htable_selective_cleanup+0x3d0/0x3d0 [ 31.309563] debug_print_object+0x166/0x220 [ 31.309565] debug_check_no_obj_freed+0x662/0xf1f [ 31.309567] ? print_irqtrace_events+0x270/0x270 [ 31.309569] ? free_obj_work+0x690/0x690 [ 31.309570] ? do_raw_spin_trylock+0x190/0x190 [ 31.309572] ? mark_held_locks+0xaf/0x100 [ 31.309574] ? __vunmap+0xb6/0x380 [ 31.309575] __vunmap+0x112/0x380 [ 31.309576] vfree+0x50/0xe0 [ 31.309578] do_ipt_get_ctl+0x7f5/0xac0 [ 31.309579] ? get_info+0x690/0x690 [ 31.309581] ? ip_getsockopt+0x143/0x220 [ 31.309583] ? mark_held_locks+0xaf/0x100 [ 31.309584] ? mutex_unlock+0xd/0x10 [ 31.309586] ? nf_sockopt_find.constprop.0+0x1a7/0x220 [ 31.309588] nf_getsockopt+0x6a/0xc0 [ 31.309589] ip_getsockopt+0x15c/0x220 [ 31.309591] ? do_ip_getsockopt+0x2170/0x2170 [ 31.309592] tcp_getsockopt+0x82/0xd0 [ 31.309594] sock_common_getsockopt+0x95/0xd0 [ 31.309596] SyS_getsockopt+0x178/0x340 [ 31.309597] ? SyS_setsockopt+0x360/0x360 [ 31.309599] ? move_addr_to_kernel+0x60/0x60 [ 31.309601] ? do_syscall_64+0xb7/0x940 [ 31.309602] ? SyS_setsockopt+0x360/0x360 [ 31.309604] do_syscall_64+0x282/0x940 [ 31.309606] ? __do_page_fault+0xc90/0xc90 [ 31.309607] ? finish_task_switch+0x1e2/0x890 [ 31.309609] ? finish_task_switch+0x1b9/0x890 [ 31.309611] ? syscall_return_slowpath+0x550/0x550 [ 31.309613] ? syscall_return_slowpath+0x2ac/0x550 [ 31.309615] ? prepare_exit_to_usermode+0x350/0x350 [ 31.309617] ? entry_SYSCALL_64_after_hwframe+0x36/0x9b [ 31.309619] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 31.309621] entry_SYSCALL_64_after_hwframe+0x26/0x9b [ 31.309622] RIP: 0033:0x45687a [ 31.309624] RSP: 002b:0000000000a3e3b8 EFLAGS: 00000212 ORIG_RAX: 0000000000000037 [ 31.309628] RAX: ffffffffffffffda RBX: 0000000000a3e3e0 RCX: 000000000045687a [ 31.309631] RDX: 0000000000000041 RSI: 0000000000000000 RDI: 0000000000000000 [ 31.309633] RBP: 00000000006ff880 R08: 0000000000a3e3dc R09: 0000000000004000 [ 31.309636] R10: 0000000000a3e4e0 R11: 0000000000000212 R12: 0000000000000000 [ 31.309638] R13: 0000000000000000 R14: 0000000000000000 R15: 00000000006fe440 [ 32.379669] Shutting down cpus with NMI [ 33.289951] Dumping ftrace buffer: [ 33.293467] (ftrace buffer empty) [ 33.297160] Kernel Offset: disabled [ 33.300760] Rebooting in 86400 seconds..