[....] Starting enhanced syslogd: rsyslogd[ 15.802552] audit: type=1400 audit(1520900705.285:5): avc: denied { syslog } for pid=4065 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 18.073323] audit: type=1400 audit(1520900707.556:6): avc: denied { map } for pid=4203 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.29' (ECDSA) to the list of known hosts. [ 26.553668] audit: type=1400 audit(1520900716.036:7): avc: denied { map } for pid=4218 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=16479 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2018/03/13 00:25:16 parsed 1 programs 2018/03/13 00:25:16 executed programs: 0 [ 26.804090] audit: type=1400 audit(1520900716.286:8): avc: denied { map } for pid=4218 comm="syz-execprog" path="/root/syzkaller-shm897356248" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 26.824057] IPVS: ftp: loaded support on port[0] = 21 [ 26.945046] ================================================================== [ 26.952521] BUG: KASAN: null-ptr-deref in rdma_resolve_addr+0x12e/0x26c0 [ 26.959333] Write of size 28 at addr 00000000000000a0 by task syz-executor0/4270 [ 26.966834] [ 26.968438] CPU: 0 PID: 4270 Comm: syz-executor0 Not tainted 4.16.0-rc5+ #262 [ 26.975680] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 26.985010] Call Trace: [ 26.987587] dump_stack+0x194/0x24d [ 26.991192] ? arch_local_irq_restore+0x53/0x53 [ 26.995836] ? __might_sleep+0x95/0x190 [ 26.999790] ? rdma_resolve_addr+0x12e/0x26c0 [ 27.004261] kasan_report+0x140/0x360 [ 27.008052] check_memory_region+0x137/0x190 [ 27.012434] memcpy+0x37/0x50 [ 27.015517] rdma_resolve_addr+0x12e/0x26c0 [ 27.019813] ? futex_wait+0x6a9/0x9a0 [ 27.023598] ? find_held_lock+0x35/0x1d0 [ 27.027637] ? rdma_bind_addr+0x1b50/0x1b50 [ 27.031935] ? lock_downgrade+0x980/0x980 [ 27.036062] ? futex_wake+0x2ca/0x680 [ 27.039841] ? __radix_tree_lookup+0x435/0x5e0 [ 27.044412] ? __mutex_unlock_slowpath+0xe9/0xac0 [ 27.049233] ? wait_for_completion+0x770/0x770 [ 27.053794] ? lock_release+0xa40/0xa40 [ 27.057743] ? check_same_owner+0x320/0x320 [ 27.062045] ? find_held_lock+0x35/0x1d0 [ 27.066113] ucma_resolve_ip+0x142/0x1f0 [ 27.070158] ? ucma_resolve_ip+0x142/0x1f0 [ 27.074366] ? ucma_resolve_addr+0x330/0x330 [ 27.078757] ? kasan_check_write+0x14/0x20 [ 27.082967] ucma_write+0x2d6/0x3d0 [ 27.086567] ? ucma_resolve_addr+0x330/0x330 [ 27.090951] ? ucma_resolve_route+0x1a0/0x1a0 [ 27.095426] ? ucma_resolve_route+0x1a0/0x1a0 [ 27.099893] __vfs_write+0xef/0x970 [ 27.103496] ? rcu_note_context_switch+0x710/0x710 [ 27.108486] ? kernel_read+0x120/0x120 [ 27.112356] ? __might_sleep+0x95/0x190 [ 27.116316] ? _cond_resched+0x14/0x30 [ 27.120176] ? __inode_security_revalidate+0xd9/0x130 [ 27.125339] ? avc_policy_seqno+0x9/0x20 [ 27.129373] ? selinux_file_permission+0x82/0x460 [ 27.134196] ? security_file_permission+0x89/0x1e0 [ 27.139100] ? rw_verify_area+0xe5/0x2b0 [ 27.143140] ? __fdget_raw+0x20/0x20 [ 27.146836] vfs_write+0x189/0x510 [ 27.150352] SyS_write+0xef/0x220 [ 27.153782] ? SyS_read+0x220/0x220 [ 27.157386] ? do_fast_syscall_32+0x156/0xf9f [ 27.161855] ? SyS_read+0x220/0x220 [ 27.165455] do_fast_syscall_32+0x3ec/0xf9f [ 27.169752] ? _raw_spin_unlock_irq+0x27/0x70 [ 27.174227] ? do_int80_syscall_32+0x9c0/0x9c0 [ 27.178782] ? _raw_spin_unlock_irq+0x27/0x70 [ 27.183255] ? finish_task_switch+0x1c1/0x7e0 [ 27.187728] ? syscall_return_slowpath+0x2ac/0x550 [ 27.192632] ? prepare_exit_to_usermode+0x350/0x350 [ 27.197626] ? sysret32_from_system_call+0x5/0x3c [ 27.202445] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 27.207264] entry_SYSENTER_compat+0x70/0x7f [ 27.211647] RIP: 0023:0xf7ff9c99 [ 27.214987] RSP: 002b:00000000f7fd409c EFLAGS: 00000286 ORIG_RAX: 0000000000000004 [ 27.222670] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000200003c0 [ 27.229913] RDX: 0000000000000048 RSI: 0000000000000000 RDI: 0000000000000000 [ 27.237155] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 27.244396] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 27.251639] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 27.258909] ================================================================== [ 27.266238] Disabling lock debugging due to kernel taint [ 27.271708] Kernel panic - not syncing: panic_on_warn set ... [ 27.271708] [ 27.279060] CPU: 0 PID: 4270 Comm: syz-executor0 Tainted: G B 4.16.0-rc5+ #262 [ 27.287605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.296930] Call Trace: [ 27.299496] dump_stack+0x194/0x24d [ 27.303097] ? arch_local_irq_restore+0x53/0x53 [ 27.307739] ? kasan_end_report+0x32/0x50 [ 27.311865] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 27.316592] ? vsnprintf+0x1ed/0x1900 [ 27.320376] ? rdma_resolve_addr+0x110/0x26c0 [ 27.324849] panic+0x1e4/0x41c [ 27.328019] ? refcount_error_report+0x214/0x214 [ 27.332764] ? add_taint+0x1c/0x50 [ 27.336275] ? add_taint+0x1c/0x50 [ 27.339800] ? rdma_resolve_addr+0x12e/0x26c0 [ 27.344269] kasan_end_report+0x50/0x50 [ 27.348215] kasan_report+0x149/0x360 [ 27.351996] check_memory_region+0x137/0x190 [ 27.356385] memcpy+0x37/0x50 [ 27.359465] rdma_resolve_addr+0x12e/0x26c0 [ 27.363769] ? futex_wait+0x6a9/0x9a0 [ 27.367553] ? find_held_lock+0x35/0x1d0 [ 27.371593] ? rdma_bind_addr+0x1b50/0x1b50 [ 27.375888] ? lock_downgrade+0x980/0x980 [ 27.380011] ? futex_wake+0x2ca/0x680 [ 27.383795] ? __radix_tree_lookup+0x435/0x5e0 [ 27.388370] ? __mutex_unlock_slowpath+0xe9/0xac0 [ 27.393186] ? wait_for_completion+0x770/0x770 [ 27.397748] ? lock_release+0xa40/0xa40 [ 27.401695] ? check_same_owner+0x320/0x320 [ 27.406085] ? find_held_lock+0x35/0x1d0 [ 27.410131] ucma_resolve_ip+0x142/0x1f0 [ 27.414163] ? ucma_resolve_ip+0x142/0x1f0 [ 27.418370] ? ucma_resolve_addr+0x330/0x330 [ 27.422756] ? kasan_check_write+0x14/0x20 [ 27.426963] ucma_write+0x2d6/0x3d0 [ 27.430562] ? ucma_resolve_addr+0x330/0x330 [ 27.434944] ? ucma_resolve_route+0x1a0/0x1a0 [ 27.439426] ? ucma_resolve_route+0x1a0/0x1a0 [ 27.443904] __vfs_write+0xef/0x970 [ 27.447506] ? rcu_note_context_switch+0x710/0x710 [ 27.452405] ? kernel_read+0x120/0x120 [ 27.456264] ? __might_sleep+0x95/0x190 [ 27.460210] ? _cond_resched+0x14/0x30 [ 27.464070] ? __inode_security_revalidate+0xd9/0x130 [ 27.469228] ? avc_policy_seqno+0x9/0x20 [ 27.473260] ? selinux_file_permission+0x82/0x460 [ 27.478089] ? security_file_permission+0x89/0x1e0 [ 27.482992] ? rw_verify_area+0xe5/0x2b0 [ 27.487034] ? __fdget_raw+0x20/0x20 [ 27.490729] vfs_write+0x189/0x510 [ 27.494241] SyS_write+0xef/0x220 [ 27.497667] ? SyS_read+0x220/0x220 [ 27.501268] ? do_fast_syscall_32+0x156/0xf9f [ 27.505735] ? SyS_read+0x220/0x220 [ 27.509334] do_fast_syscall_32+0x3ec/0xf9f [ 27.513630] ? _raw_spin_unlock_irq+0x27/0x70 [ 27.518100] ? do_int80_syscall_32+0x9c0/0x9c0 [ 27.522660] ? _raw_spin_unlock_irq+0x27/0x70 [ 27.527129] ? finish_task_switch+0x1c1/0x7e0 [ 27.531596] ? syscall_return_slowpath+0x2ac/0x550 [ 27.536495] ? prepare_exit_to_usermode+0x350/0x350 [ 27.541492] ? sysret32_from_system_call+0x5/0x3c [ 27.546307] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 27.551125] entry_SYSENTER_compat+0x70/0x7f [ 27.555504] RIP: 0023:0xf7ff9c99 [ 27.558835] RSP: 002b:00000000f7fd409c EFLAGS: 00000286 ORIG_RAX: 0000000000000004 [ 27.566514] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000200003c0 [ 27.573755] RDX: 0000000000000048 RSI: 0000000000000000 RDI: 0000000000000000 [ 27.580994] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 27.588237] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 27.595491] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 27.603115] Dumping ftrace buffer: [ 27.606623] (ftrace buffer empty) [ 27.610302] Kernel Offset: disabled [ 27.613898] Rebooting in 86400 seconds..