[....] Starting enhanced syslogd: rsyslogd[ 16.715263] audit: type=1400 audit(1521071637.889:5): avc: denied { syslog } for pid=4095 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 22.764206] audit: type=1400 audit(1521071643.937:6): avc: denied { map } for pid=4235 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.8' (ECDSA) to the list of known hosts. [ 62.041437] audit: type=1400 audit(1521071683.215:7): avc: denied { map } for pid=4251 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=16479 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2018/03/14 23:54:43 parsed 1 programs 2018/03/14 23:54:43 executed programs: 0 [ 62.270509] audit: type=1400 audit(1521071683.443:8): avc: denied { map } for pid=4251 comm="syz-execprog" path="/root/syzkaller-shm278778628" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 62.278374] IPVS: ftp: loaded support on port[0] = 21 [ 62.533266] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 62.865329] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 62.871418] 8021q: adding VLAN 0 to HW filter on device bond0 [ 62.906983] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 62.942317] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 2018/03/14 23:54:48 executed programs: 88 2018/03/14 23:54:53 executed programs: 143 2018/03/14 23:54:58 executed programs: 197 2018/03/14 23:55:03 executed programs: 252 2018/03/14 23:55:08 executed programs: 307 2018/03/14 23:55:13 executed programs: 361 2018/03/14 23:55:18 executed programs: 416 2018/03/14 23:55:23 executed programs: 471 2018/03/14 23:55:28 executed programs: 525 2018/03/14 23:55:33 executed programs: 580 2018/03/14 23:55:38 executed programs: 635 2018/03/14 23:55:43 executed programs: 689 2018/03/14 23:55:48 executed programs: 744 2018/03/14 23:55:53 executed programs: 799 [ 134.811347] ================================================================== [ 134.818839] BUG: KASAN: use-after-free in pfifo_fast_enqueue+0x4bc/0x5e0 [ 134.825655] Read of size 4 at addr ffff8801cb044e68 by task syz-executor0/7656 [ 134.832980] [ 134.834581] CPU: 1 PID: 7656 Comm: syz-executor0 Not tainted 4.16.0-rc5+ #263 [ 134.841820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 134.851143] Call Trace: [ 134.853705] dump_stack+0x194/0x24d [ 134.857309] ? arch_local_irq_restore+0x53/0x53 [ 134.861951] ? show_regs_print_info+0x18/0x18 [ 134.866423] ? pfifo_fast_enqueue+0x4bc/0x5e0 [ 134.870891] print_address_description+0x73/0x250 [ 134.875704] ? pfifo_fast_enqueue+0x4bc/0x5e0 [ 134.880171] kasan_report+0x23c/0x360 [ 134.883950] __asan_report_load4_noabort+0x14/0x20 [ 134.888851] pfifo_fast_enqueue+0x4bc/0x5e0 [ 134.893155] ? pfifo_fast_dequeue+0xb00/0xb00 [ 134.897632] __dev_queue_xmit+0xd50/0x2f30 [ 134.901842] ? __lock_acquire+0x664/0x3e00 [ 134.906068] ? netdev_pick_tx+0x2c0/0x2c0 [ 134.910191] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 134.915351] ? __lock_is_held+0xb6/0x140 [ 134.919397] ? netif_rx_internal+0x14f/0x940 [ 134.923779] ? print_irqtrace_events+0x270/0x270 [ 134.928513] ? trace_hardirqs_off+0x10/0x10 [ 134.932805] ? selinux_ip_postroute+0x541/0xee0 [ 134.937459] ? selinux_ip_postroute_compat+0x6b0/0x6b0 [ 134.942710] ? trace_hardirqs_off+0x10/0x10 [ 134.947004] ? mark_held_locks+0xaf/0x100 [ 134.951132] ? do_softirq.part.19+0xd1/0x190 [ 134.955515] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 134.960502] ? trace_hardirqs_on+0xd/0x10 [ 134.964627] ? print_irqtrace_events+0x270/0x270 [ 134.969362] ? ip6_finish_output+0x69b/0xaf0 [ 134.973742] ? lock_downgrade+0x980/0x980 [ 134.977859] ? lock_downgrade+0x980/0x980 [ 134.981983] ? lock_release+0xa40/0xa40 [ 134.985932] ? dev_loopback_xmit+0x263/0x670 [ 134.990318] ? mark_held_locks+0xaf/0x100 [ 134.994445] dev_queue_xmit+0x17/0x20 [ 134.998217] ? dev_queue_xmit+0x17/0x20 [ 135.002161] ip6_finish_output2+0x1492/0x23a0 [ 135.006635] ? ip6_copy_metadata+0xad0/0xad0 [ 135.011030] ? ip6_mtu+0x369/0x4d0 [ 135.014556] ? lock_downgrade+0x980/0x980 [ 135.018685] ? __lock_is_held+0xb6/0x140 [ 135.022732] ? netif_rx_ni+0x3c0/0x3c0 [ 135.026591] ? nf_nat_ipv6_out+0x262/0x570 [ 135.030815] ip6_finish_output+0x69b/0xaf0 [ 135.035025] ? ip6_finish_output+0x69b/0xaf0 [ 135.039412] ip6_output+0x1eb/0x840 [ 135.043022] ? ip6_finish_output+0xaf0/0xaf0 [ 135.047416] ? lock_acquire+0x1d5/0x580 [ 135.051366] ? rawv6_sendmsg+0x1d86/0x40c0 [ 135.055583] ? ip6_fragment+0x3470/0x3470 [ 135.059712] ip6_local_out+0x95/0x160 [ 135.063488] ip6_send_skb+0xa1/0x330 [ 135.067177] ip6_push_pending_frames+0xb3/0xe0 [ 135.071733] rawv6_sendmsg+0x2f96/0x40c0 [ 135.075780] ? rawv6_getsockopt+0xf0/0xf0 [ 135.079907] ? avc_has_perm+0x35e/0x680 [ 135.083863] ? lock_downgrade+0x980/0x980 [ 135.087997] ? lock_release+0xa40/0xa40 [ 135.091966] ? avc_has_perm+0x43e/0x680 [ 135.095917] ? avc_has_perm_noaudit+0x520/0x520 [ 135.100559] ? trace_hardirqs_off+0x10/0x10 [ 135.104855] ? find_held_lock+0x35/0x1d0 [ 135.108897] ? __might_fault+0x110/0x1d0 [ 135.112930] ? lock_downgrade+0x980/0x980 [ 135.117061] ? compat_rw_copy_check_uvector+0x25f/0x2f0 [ 135.122414] inet_sendmsg+0x11f/0x5e0 [ 135.126186] ? inet_sendmsg+0x11f/0x5e0 [ 135.130145] ? inet_create+0xf50/0xf50 [ 135.134021] ? selinux_socket_sendmsg+0x36/0x40 [ 135.138671] ? security_socket_sendmsg+0x89/0xb0 [ 135.143399] ? inet_create+0xf50/0xf50 [ 135.147258] sock_sendmsg+0xca/0x110 [ 135.150947] ___sys_sendmsg+0x320/0x8b0 [ 135.154897] ? copy_msghdr_from_user+0x590/0x590 [ 135.159629] ? __schedule+0x903/0x1ec0 [ 135.163495] ? __sched_text_start+0x8/0x8 [ 135.167623] ? __fget_light+0x2b2/0x3c0 [ 135.171570] ? fget_raw+0x20/0x20 [ 135.175000] ? __schedule+0x903/0x1ec0 [ 135.178881] ? rcu_note_context_switch+0x710/0x710 [ 135.183785] ? check_same_owner+0x320/0x320 [ 135.188085] __sys_sendmmsg+0x31b/0x620 [ 135.192036] ? __sys_sendmmsg+0x31b/0x620 [ 135.196162] ? SyS_sendmsg+0x50/0x50 [ 135.199856] ? __schedule+0x1ec0/0x1ec0 [ 135.203823] ? compat_SyS_futex+0x288/0x380 [ 135.208123] ? compat_SyS_get_robust_list+0x300/0x300 [ 135.213285] ? exit_to_usermode_loop+0x198/0x2f0 [ 135.218031] ? trace_event_raw_event_sys_exit+0x260/0x260 [ 135.223545] compat_SyS_sendmmsg+0x32/0x40 [ 135.227750] ? compat_SyS_sendmsg+0x40/0x40 [ 135.232051] do_fast_syscall_32+0x3ec/0xf9f [ 135.236342] ? _raw_spin_unlock_irq+0x27/0x70 [ 135.240815] ? do_int80_syscall_32+0x9c0/0x9c0 [ 135.245369] ? _raw_spin_unlock_irq+0x27/0x70 [ 135.249838] ? finish_task_switch+0x1c1/0x7e0 [ 135.254309] ? syscall_return_slowpath+0x2ac/0x550 [ 135.259217] ? prepare_exit_to_usermode+0x350/0x350 [ 135.264204] ? sysret32_from_system_call+0x5/0x3c [ 135.269038] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 135.273863] entry_SYSENTER_compat+0x70/0x7f [ 135.278239] RIP: 0023:0xf7f3ec99 [ 135.281572] RSP: 002b:00000000f7ef809c EFLAGS: 00000286 ORIG_RAX: 0000000000000159 [ 135.289257] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000020001300 [ 135.296506] RDX: 0000000000000249 RSI: 0000000000000000 RDI: 0000000000000000 [ 135.303746] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 135.310984] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 135.318222] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 135.325477] [ 135.327074] Allocated by task 7656: [ 135.330674] save_stack+0x43/0xd0 [ 135.334096] kasan_kmalloc+0xad/0xe0 [ 135.337779] kasan_slab_alloc+0x12/0x20 [ 135.341722] kmem_cache_alloc_node+0x144/0x760 [ 135.346275] __alloc_skb+0xf1/0x780 [ 135.349870] sock_wmalloc+0x140/0x1d0 [ 135.353643] __ip6_append_data.isra.43+0x26b9/0x3390 [ 135.358713] ip6_append_data+0x189/0x290 [ 135.362743] rawv6_sendmsg+0x1e09/0x40c0 [ 135.366775] inet_sendmsg+0x11f/0x5e0 [ 135.370543] sock_sendmsg+0xca/0x110 [ 135.374228] ___sys_sendmsg+0x320/0x8b0 [ 135.378171] __sys_sendmmsg+0x31b/0x620 [ 135.382112] compat_SyS_sendmmsg+0x32/0x40 [ 135.386316] do_fast_syscall_32+0x3ec/0xf9f [ 135.390607] entry_SYSENTER_compat+0x70/0x7f [ 135.394981] [ 135.396579] Freed by task 7654: [ 135.399826] save_stack+0x43/0xd0 [ 135.403246] __kasan_slab_free+0x11a/0x170 [ 135.407451] kasan_slab_free+0xe/0x10 [ 135.411223] kmem_cache_free+0x83/0x2a0 [ 135.415165] kfree_skbmem+0x1a1/0x1d0 [ 135.418934] kfree_skb+0x165/0x4c0 [ 135.422442] ip_tunnel_xmit+0x710/0x3550 [ 135.426470] __gre_xmit+0x546/0x8b0 [ 135.430064] erspan_xmit+0x779/0x22a0 [ 135.433835] dev_hard_start_xmit+0x24e/0xac0 [ 135.438210] sch_direct_xmit+0x40d/0x1140 [ 135.442324] __qdisc_run+0x57d/0x19c0 [ 135.446091] __dev_queue_xmit+0xd5e/0x2f30 [ 135.450296] dev_queue_xmit+0x17/0x20 [ 135.454068] ip6_finish_output2+0x1492/0x23a0 [ 135.458531] ip6_finish_output+0x69b/0xaf0 [ 135.462735] ip6_output+0x1eb/0x840 [ 135.466331] ip6_local_out+0x95/0x160 [ 135.470102] ip6_send_skb+0xa1/0x330 [ 135.473786] ip6_push_pending_frames+0xb3/0xe0 [ 135.478338] rawv6_sendmsg+0x2f96/0x40c0 [ 135.482366] inet_sendmsg+0x11f/0x5e0 [ 135.486135] sock_sendmsg+0xca/0x110 [ 135.489817] ___sys_sendmsg+0x320/0x8b0 [ 135.493758] __sys_sendmmsg+0x31b/0x620 [ 135.497700] compat_SyS_sendmmsg+0x32/0x40 [ 135.501923] do_fast_syscall_32+0x3ec/0xf9f [ 135.506224] entry_SYSENTER_compat+0x70/0x7f [ 135.510598] [ 135.512195] The buggy address belongs to the object at ffff8801cb044e40 [ 135.512195] which belongs to the cache skbuff_head_cache of size 232 [ 135.525341] The buggy address is located 40 bytes inside of [ 135.525341] 232-byte region [ffff8801cb044e40, ffff8801cb044f28) [ 135.537093] The buggy address belongs to the page: [ 135.541992] page:ffffea00072c1100 count:1 mapcount:0 mapping:ffff8801cb044080 index:0x0 [ 135.550107] flags: 0x2fffc0000000100(slab) [ 135.554313] raw: 02fffc0000000100 ffff8801cb044080 0000000000000000 000000010000000c [ 135.562160] raw: ffffea0007119ea0 ffffea0007302c60 ffff8801d9bec680 0000000000000000 [ 135.570010] page dumped because: kasan: bad access detected [ 135.575693] [ 135.577290] Memory state around the buggy address: [ 135.582187] ffff8801cb044d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 135.589513] ffff8801cb044d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc [ 135.596839] >ffff8801cb044e00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 135.604165] ^ [ 135.610886] ffff8801cb044e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 135.618212] ffff8801cb044f00: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc [ 135.625542] ================================================================== [ 135.632867] Disabling lock debugging due to kernel taint [ 135.638332] Kernel panic - not syncing: panic_on_warn set ... [ 135.638332] [ 135.645682] CPU: 1 PID: 7656 Comm: syz-executor0 Tainted: G B 4.16.0-rc5+ #263 [ 135.654231] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 135.663575] Call Trace: [ 135.666135] dump_stack+0x194/0x24d [ 135.669730] ? arch_local_irq_restore+0x53/0x53 [ 135.674365] ? kasan_end_report+0x32/0x50 [ 135.678483] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 135.683207] ? vsnprintf+0x1ed/0x1900 [ 135.686978] ? pfifo_fast_enqueue+0x470/0x5e0 [ 135.691443] panic+0x1e4/0x41c [ 135.694603] ? refcount_error_report+0x214/0x214 [ 135.699329] ? add_taint+0x1c/0x50 [ 135.702836] ? add_taint+0x1c/0x50 [ 135.706345] ? pfifo_fast_enqueue+0x4bc/0x5e0 [ 135.710809] kasan_end_report+0x50/0x50 [ 135.714752] kasan_report+0x149/0x360 [ 135.718522] __asan_report_load4_noabort+0x14/0x20 [ 135.723417] pfifo_fast_enqueue+0x4bc/0x5e0 [ 135.727709] ? pfifo_fast_dequeue+0xb00/0xb00 [ 135.732180] __dev_queue_xmit+0xd50/0x2f30 [ 135.736385] ? __lock_acquire+0x664/0x3e00 [ 135.740594] ? netdev_pick_tx+0x2c0/0x2c0 [ 135.744712] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 135.749870] ? __lock_is_held+0xb6/0x140 [ 135.753918] ? netif_rx_internal+0x14f/0x940 [ 135.758297] ? print_irqtrace_events+0x270/0x270 [ 135.763028] ? trace_hardirqs_off+0x10/0x10 [ 135.767321] ? selinux_ip_postroute+0x541/0xee0 [ 135.771963] ? selinux_ip_postroute_compat+0x6b0/0x6b0 [ 135.777211] ? trace_hardirqs_off+0x10/0x10 [ 135.781502] ? mark_held_locks+0xaf/0x100 [ 135.785619] ? do_softirq.part.19+0xd1/0x190 [ 135.789995] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 135.794984] ? trace_hardirqs_on+0xd/0x10 [ 135.799103] ? print_irqtrace_events+0x270/0x270 [ 135.803832] ? ip6_finish_output+0x69b/0xaf0 [ 135.808208] ? lock_downgrade+0x980/0x980 [ 135.812328] ? lock_downgrade+0x980/0x980 [ 135.816445] ? lock_release+0xa40/0xa40 [ 135.820389] ? dev_loopback_xmit+0x263/0x670 [ 135.824777] ? mark_held_locks+0xaf/0x100 [ 135.828896] dev_queue_xmit+0x17/0x20 [ 135.832666] ? dev_queue_xmit+0x17/0x20 [ 135.836609] ip6_finish_output2+0x1492/0x23a0 [ 135.841077] ? ip6_copy_metadata+0xad0/0xad0 [ 135.845454] ? ip6_mtu+0x369/0x4d0 [ 135.848965] ? lock_downgrade+0x980/0x980 [ 135.853085] ? __lock_is_held+0xb6/0x140 [ 135.857121] ? netif_rx_ni+0x3c0/0x3c0 [ 135.860976] ? nf_nat_ipv6_out+0x262/0x570 [ 135.865182] ip6_finish_output+0x69b/0xaf0 [ 135.869382] ? ip6_finish_output+0x69b/0xaf0 [ 135.873760] ip6_output+0x1eb/0x840 [ 135.877354] ? ip6_finish_output+0xaf0/0xaf0 [ 135.881729] ? lock_acquire+0x1d5/0x580 [ 135.885669] ? rawv6_sendmsg+0x1d86/0x40c0 [ 135.889877] ? ip6_fragment+0x3470/0x3470 [ 135.894004] ip6_local_out+0x95/0x160 [ 135.897780] ip6_send_skb+0xa1/0x330 [ 135.901463] ip6_push_pending_frames+0xb3/0xe0 [ 135.906020] rawv6_sendmsg+0x2f96/0x40c0 [ 135.910062] ? rawv6_getsockopt+0xf0/0xf0 [ 135.914180] ? avc_has_perm+0x35e/0x680 [ 135.918123] ? lock_downgrade+0x980/0x980 [ 135.922241] ? lock_release+0xa40/0xa40 [ 135.926191] ? avc_has_perm+0x43e/0x680 [ 135.930139] ? avc_has_perm_noaudit+0x520/0x520 [ 135.934779] ? trace_hardirqs_off+0x10/0x10 [ 135.939070] ? find_held_lock+0x35/0x1d0 [ 135.943104] ? __might_fault+0x110/0x1d0 [ 135.947133] ? lock_downgrade+0x980/0x980 [ 135.951253] ? compat_rw_copy_check_uvector+0x25f/0x2f0 [ 135.956595] inet_sendmsg+0x11f/0x5e0 [ 135.960364] ? inet_sendmsg+0x11f/0x5e0 [ 135.964305] ? inet_create+0xf50/0xf50 [ 135.968165] ? selinux_socket_sendmsg+0x36/0x40 [ 135.972804] ? security_socket_sendmsg+0x89/0xb0 [ 135.977529] ? inet_create+0xf50/0xf50 [ 135.981387] sock_sendmsg+0xca/0x110 [ 135.985074] ___sys_sendmsg+0x320/0x8b0 [ 135.989025] ? copy_msghdr_from_user+0x590/0x590 [ 135.993755] ? __schedule+0x903/0x1ec0 [ 135.997615] ? __sched_text_start+0x8/0x8 [ 136.001733] ? __fget_light+0x2b2/0x3c0 [ 136.005675] ? fget_raw+0x20/0x20 [ 136.009099] ? __schedule+0x903/0x1ec0 [ 136.012962] ? rcu_note_context_switch+0x710/0x710 [ 136.017861] ? check_same_owner+0x320/0x320 [ 136.022156] __sys_sendmmsg+0x31b/0x620 [ 136.026099] ? __sys_sendmmsg+0x31b/0x620 [ 136.030222] ? SyS_sendmsg+0x50/0x50 [ 136.033911] ? __schedule+0x1ec0/0x1ec0 [ 136.037860] ? compat_SyS_futex+0x288/0x380 [ 136.042151] ? compat_SyS_get_robust_list+0x300/0x300 [ 136.047309] ? exit_to_usermode_loop+0x198/0x2f0 [ 136.052038] ? trace_event_raw_event_sys_exit+0x260/0x260 [ 136.057546] compat_SyS_sendmmsg+0x32/0x40 [ 136.061746] ? compat_SyS_sendmsg+0x40/0x40 [ 136.066036] do_fast_syscall_32+0x3ec/0xf9f [ 136.070325] ? _raw_spin_unlock_irq+0x27/0x70 [ 136.074793] ? do_int80_syscall_32+0x9c0/0x9c0 [ 136.079340] ? _raw_spin_unlock_irq+0x27/0x70 [ 136.083803] ? finish_task_switch+0x1c1/0x7e0 [ 136.088268] ? syscall_return_slowpath+0x2ac/0x550 [ 136.093171] ? prepare_exit_to_usermode+0x350/0x350 [ 136.098156] ? sysret32_from_system_call+0x5/0x3c [ 136.102967] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 136.107782] entry_SYSENTER_compat+0x70/0x7f [ 136.112159] RIP: 0023:0xf7f3ec99 [ 136.115491] RSP: 002b:00000000f7ef809c EFLAGS: 00000286 ORIG_RAX: 0000000000000159 [ 136.123165] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000020001300 [ 136.130403] RDX: 0000000000000249 RSI: 0000000000000000 RDI: 0000000000000000 [ 136.137641] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 136.144880] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 136.152118] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 136.159811] Dumping ftrace buffer: [ 136.163317] (ftrace buffer empty) [ 136.166994] Kernel Offset: disabled [ 136.170594] Rebooting in 86400 seconds..