[....] Starting enhanced syslogd: rsyslogd[ 12.866355] audit: type=1400 audit(1515908414.264:5): avc: denied { syslog } for pid=3509 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 19.281063] audit: type=1400 audit(1515908420.678:6): avc: denied { map } for pid=3650 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.15.225' (ECDSA) to the list of known hosts. executing program [ 25.524737] audit: type=1400 audit(1515908426.922:7): avc: denied { map } for pid=3664 comm="syzkaller260762" path="/root/syzkaller260762038" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 executing program executing program [ 25.708763] [ 25.710404] ========================= [ 25.714171] WARNING: held lock freed! [ 25.717940] 4.15.0-rc7-mm1+ #56 Not tainted [ 25.722232] ------------------------- [ 25.726013] syzkaller260762/3668 is freeing memory 0000000023114213-00000000343b65e0, with a lock still held there! [ 25.736553] (sk_lock-AF_INET6){+.+.}, at: [<00000000b0fedcd4>] sctp_wait_for_sndbuf+0x509/0x8d0 [ 25.745505] 1 lock held by syzkaller260762/3668: [ 25.750231] #0: (sk_lock-AF_INET6){+.+.}, at: [<00000000b0fedcd4>] sctp_wait_for_sndbuf+0x509/0x8d0 [ 25.759567] [ 25.759567] stack backtrace: [ 25.764037] CPU: 0 PID: 3668 Comm: syzkaller260762 Not tainted 4.15.0-rc7-mm1+ #56 [ 25.771714] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 25.781045] Call Trace: [ 25.783610] dump_stack+0x194/0x257 [ 25.787214] ? arch_local_irq_restore+0x53/0x53 [ 25.791864] debug_check_no_locks_freed+0x32f/0x3c0 [ 25.796860] kmem_cache_free+0x68/0x2b0 [ 25.800817] __sk_destruct+0x622/0x910 [ 25.804678] ? kfree+0xd9/0x260 [ 25.807930] ? sock_rfree+0x160/0x160 [ 25.811701] ? sock_sendmsg+0xca/0x110 [ 25.815563] ? SyS_sendto+0x40/0x50 [ 25.819164] ? entry_SYSCALL_64_fastpath+0x29/0xa0 [ 25.824067] ? debug_check_no_obj_freed+0x611/0xf1f [ 25.829060] ? check_noncircular+0x20/0x20 [ 25.833267] ? print_irqtrace_events+0x270/0x270 [ 25.837999] ? __local_bh_enable_ip+0x121/0x230 [ 25.842653] ? sctp_put_port+0x495/0x640 [ 25.846697] ? sctp_poll+0xc00/0xc00 [ 25.850388] ? refcount_sub_and_test+0x115/0x1b0 [ 25.855117] ? refcount_inc+0x50/0x50 [ 25.858888] ? refcount_inc+0x50/0x50 [ 25.862663] sk_destruct+0x47/0x80 [ 25.866185] __sk_free+0xf1/0x2b0 [ 25.869620] sk_free+0x2a/0x40 [ 25.872786] sctp_association_put+0x14c/0x2f0 [ 25.877252] ? sctp_association_hold+0x20/0x20 [ 25.881813] ? lock_sock_nested+0x91/0x110 [ 25.886023] ? trace_hardirqs_on+0xd/0x10 [ 25.890146] ? __local_bh_enable_ip+0x121/0x230 [ 25.894797] sctp_wait_for_sndbuf+0x673/0x8d0 [ 25.899272] ? sctp_init_sock+0x13b0/0x13b0 [ 25.903567] ? do_raw_spin_trylock+0x190/0x190 [ 25.908123] ? __local_bh_enable_ip+0x121/0x230 [ 25.912765] ? sctp_prsctp_prune+0x97/0x790 [ 25.917060] ? prepare_to_wait+0x4d0/0x4d0 [ 25.921276] ? trace_hardirqs_on+0xd/0x10 [ 25.925404] sctp_sendmsg+0x28f7/0x33f0 [ 25.929372] ? sctp_id2assoc+0x390/0x390 [ 25.933410] ? avc_has_perm+0x43e/0x680 [ 25.937366] ? avc_has_perm_noaudit+0x520/0x520 [ 25.942013] ? __fget+0x35c/0x570 [ 25.945452] ? iterate_fd+0x3f0/0x3f0 [ 25.949232] ? find_held_lock+0x35/0x1d0 [ 25.953273] ? sock_has_perm+0x2a4/0x420 [ 25.957311] ? lock_release+0x9a2/0xa40 [ 25.961263] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 25.967122] ? __check_object_size+0x8b/0x530 [ 25.971595] inet_sendmsg+0x11f/0x5e0 [ 25.975371] ? inet_sendmsg+0x11f/0x5e0 [ 25.979321] ? __might_sleep+0x95/0x190 [ 25.983268] ? inet_create+0xf50/0xf50 [ 25.987130] ? selinux_socket_sendmsg+0x36/0x40 [ 25.991782] ? security_socket_sendmsg+0x89/0xb0 [ 25.996515] ? inet_create+0xf50/0xf50 [ 26.000379] sock_sendmsg+0xca/0x110 [ 26.004065] SYSC_sendto+0x361/0x5c0 [ 26.007754] ? SYSC_connect+0x4a0/0x4a0 [ 26.011702] ? selinux_secmark_relabel_packet+0xc0/0xc0 [ 26.017038] ? __do_page_fault+0x3d6/0xc90 [ 26.021249] ? selinux_netlbl_sock_rcv_skb+0x730/0x730 [ 26.026515] ? SyS_futex+0x269/0x390 [ 26.030210] ? SyS_setsockopt+0x215/0x360 [ 26.034334] ? do_futex+0x22a0/0x22a0 [ 26.038108] ? entry_SYSCALL_64_fastpath+0x5/0xa0 [ 26.042927] SyS_sendto+0x40/0x50 [ 26.046359] entry_SYSCALL_64_fastpath+0x29/0xa0 [ 26.051086] RIP: 0033:0x4457e9 [ 26.054251] RSP: 002b:00007fcfb8ee2da8 EFLAGS: 00000216 ORIG_RAX: 000000000000002c [ 26.061931] RAX: ffffffffffffffda RBX: 00000000006dac6c RCX: 00000000004457e9 [ 26.069175] RDX: 0000000000000001 RSI: 000000002010bf14 RDI: 0000000000000004 [ 26.076418] RBP: 00000000006dac68 R08: 00000000204d9000 R09: 000000000000001c [ 26.083665] R10: 0000000000000000 R11: 0000000000000216 R12: 0000000000000000 [ 26.090909] R13: 00007ffcc8572a1f R14: 00007fcfb8ee39c0 R15: 0000000000000001 [ 26.098278] ================================================================== [ 26.105625] BUG: KASAN: use-after-free in do_raw_spin_lock+0x1e0/0x220 [ 26.112264] Read of size 4 at addr ffff8801bb98708c by task syzkaller260762/3668 [ 26.119763] [ 26.121370] CPU: 0 PID: 3668 Comm: syzkaller260762 Not tainted 4.15.0-rc7-mm1+ #56 [ 26.129050] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 26.138381] Call Trace: [ 26.140948] dump_stack+0x194/0x257 [ 26.144546] ? arch_local_irq_restore+0x53/0x53 [ 26.149192] ? show_regs_print_info+0x18/0x18 [ 26.153672] ? lock_acquire+0x1d5/0x580 [ 26.157627] ? trace_hardirqs_on+0xd/0x10 [ 26.161744] ? do_raw_spin_lock+0x1e0/0x220 [ 26.166045] print_address_description+0x73/0x250 [ 26.170872] ? do_raw_spin_lock+0x1e0/0x220 [ 26.175175] kasan_report+0x23b/0x360 [ 26.178947] __asan_report_load4_noabort+0x14/0x20 [ 26.183849] do_raw_spin_lock+0x1e0/0x220 [ 26.187976] _raw_spin_lock_bh+0x39/0x40 [ 26.192013] ? release_sock+0x74/0x2a0 [ 26.195875] release_sock+0x74/0x2a0 [ 26.199560] ? sctp_prsctp_prune+0x97/0x790 [ 26.203854] ? __release_sock+0x360/0x360 [ 26.207976] ? trace_hardirqs_on+0xd/0x10 [ 26.212104] sctp_sendmsg+0x2993/0x33f0 [ 26.216060] ? sctp_id2assoc+0x390/0x390 [ 26.220103] ? avc_has_perm+0x43e/0x680 [ 26.224054] ? avc_has_perm_noaudit+0x520/0x520 [ 26.228696] ? __fget+0x35c/0x570 [ 26.232126] ? iterate_fd+0x3f0/0x3f0 [ 26.236166] ? find_held_lock+0x35/0x1d0 [ 26.240206] ? sock_has_perm+0x2a4/0x420 [ 26.244242] ? lock_release+0x9a2/0xa40 [ 26.248191] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 26.254049] ? __check_object_size+0x8b/0x530 [ 26.258535] inet_sendmsg+0x11f/0x5e0 [ 26.262310] ? inet_sendmsg+0x11f/0x5e0 [ 26.266261] ? __might_sleep+0x95/0x190 [ 26.270207] ? inet_create+0xf50/0xf50 [ 26.274069] ? selinux_socket_sendmsg+0x36/0x40 [ 26.278712] ? security_socket_sendmsg+0x89/0xb0 [ 26.283443] ? inet_create+0xf50/0xf50 [ 26.287328] sock_sendmsg+0xca/0x110 [ 26.291020] SYSC_sendto+0x361/0x5c0 [ 26.294711] ? SYSC_connect+0x4a0/0x4a0 [ 26.298663] ? selinux_secmark_relabel_packet+0xc0/0xc0 [ 26.303999] ? __do_page_fault+0x3d6/0xc90 [ 26.308213] ? selinux_netlbl_sock_rcv_skb+0x730/0x730 [ 26.313477] ? SyS_futex+0x269/0x390 [ 26.317161] ? SyS_setsockopt+0x215/0x360 [ 26.321292] ? do_futex+0x22a0/0x22a0 [ 26.325070] ? entry_SYSCALL_64_fastpath+0x5/0xa0 [ 26.329889] SyS_sendto+0x40/0x50 [ 26.333318] entry_SYSCALL_64_fastpath+0x29/0xa0 [ 26.338059] RIP: 0033:0x4457e9 [ 26.341224] RSP: 002b:00007fcfb8ee2da8 EFLAGS: 00000216 ORIG_RAX: 000000000000002c [ 26.348904] RAX: ffffffffffffffda RBX: 00000000006dac6c RCX: 00000000004457e9 [ 26.356147] RDX: 0000000000000001 RSI: 000000002010bf14 RDI: 0000000000000004 [ 26.363389] RBP: 00000000006dac68 R08: 00000000204d9000 R09: 000000000000001c [ 26.370631] R10: 0000000000000000 R11: 0000000000000216 R12: 0000000000000000 [ 26.377876] R13: 00007ffcc8572a1f R14: 00007fcfb8ee39c0 R15: 0000000000000001 [ 26.385128] [ 26.386731] Allocated by task 3673: [ 26.390333] save_stack+0x43/0xd0 [ 26.393767] kasan_kmalloc+0xad/0xe0 [ 26.397454] kasan_slab_alloc+0x12/0x20 [ 26.401401] kmem_cache_alloc+0x12e/0x760 [ 26.405522] sk_prot_alloc+0x65/0x2a0 [ 26.409296] sk_alloc+0x105/0x1440 [ 26.412808] sctp_v6_create_accept_sk+0x15a/0x9b0 [ 26.417620] sctp_accept+0x5c4/0x970 [ 26.421317] inet_accept+0x12c/0x930 [ 26.425007] SYSC_accept4+0x38d/0x870 [ 26.428791] SyS_accept+0x26/0x30 [ 26.432221] entry_SYSCALL_64_fastpath+0x29/0xa0 [ 26.436942] [ 26.438542] Freed by task 3668: [ 26.441798] save_stack+0x43/0xd0 [ 26.445232] __kasan_slab_free+0x11a/0x170 [ 26.449439] kasan_slab_free+0xe/0x10 [ 26.453213] kmem_cache_free+0x86/0x2b0 [ 26.457169] __sk_destruct+0x622/0x910 [ 26.461029] sk_destruct+0x47/0x80 [ 26.464540] __sk_free+0xf1/0x2b0 [ 26.467963] sk_free+0x2a/0x40 [ 26.471130] sctp_association_put+0x14c/0x2f0 [ 26.475599] sctp_wait_for_sndbuf+0x673/0x8d0 [ 26.480068] sctp_sendmsg+0x28f7/0x33f0 [ 26.484026] inet_sendmsg+0x11f/0x5e0 [ 26.487798] sock_sendmsg+0xca/0x110 [ 26.491484] SYSC_sendto+0x361/0x5c0 [ 26.495170] SyS_sendto+0x40/0x50 [ 26.498595] entry_SYSCALL_64_fastpath+0x29/0xa0 [ 26.503317] [ 26.504918] The buggy address belongs to the object at ffff8801bb987000 [ 26.504918] which belongs to the cache SCTPv6 of size 1888 [ 26.517196] The buggy address is located 140 bytes inside of [ 26.517196] 1888-byte region [ffff8801bb987000, ffff8801bb987760) [ 26.529133] The buggy address belongs to the page: [ 26.534042] page:ffffea0006ee61c0 count:1 mapcount:0 mapping:ffff8801bb987000 index:0x0 [ 26.542155] flags: 0x2fffc0000000100(slab) [ 26.546365] raw: 02fffc0000000100 ffff8801bb987000 0000000000000000 0000000100000002 [ 26.554220] raw: ffffea0007480360 ffffea0007666020 ffff8801d200ccc0 0000000000000000 [ 26.562071] page dumped because: kasan: bad access detected [ 26.567752] [ 26.569353] Memory state around the buggy address: [ 26.574256] ffff8801bb986f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 26.581591] ffff8801bb987000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.588930] >ffff8801bb987080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.596872] ^ [ 26.600471] ffff8801bb987100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.607803] ffff8801bb987180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.615131] ================================================================== [ 26.622510] Kernel panic - not syncing: panic_on_warn set ... [ 26.622510] [ 26.629882] CPU: 0 PID: 3668 Comm: syzkaller260762 Tainted: G B 4.15.0-rc7-mm1+ #56 [ 26.638870] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 26.648198] Call Trace: [ 26.650775] dump_stack+0x194/0x257 [ 26.654378] ? arch_local_irq_restore+0x53/0x53 [ 26.659024] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 26.663759] ? vsnprintf+0x1ed/0x1900 [ 26.667532] ? do_raw_spin_lock+0x140/0x220 [ 26.671826] panic+0x1e4/0x41c [ 26.674991] ? refcount_error_report+0x214/0x214 [ 26.679721] ? add_taint+0x1c/0x50 [ 26.683236] ? add_taint+0x1c/0x50 [ 26.686765] ? do_raw_spin_lock+0x1e0/0x220 [ 26.691063] kasan_end_report+0x50/0x50 [ 26.695012] kasan_report+0x148/0x360 [ 26.698799] __asan_report_load4_noabort+0x14/0x20 [ 26.703704] do_raw_spin_lock+0x1e0/0x220 [ 26.707831] _raw_spin_lock_bh+0x39/0x40 [ 26.711866] ? release_sock+0x74/0x2a0 [ 26.715742] release_sock+0x74/0x2a0 [ 26.719438] ? sctp_prsctp_prune+0x97/0x790 [ 26.723733] ? __release_sock+0x360/0x360 [ 26.727856] ? trace_hardirqs_on+0xd/0x10 [ 26.731983] sctp_sendmsg+0x2993/0x33f0 [ 26.735939] ? sctp_id2assoc+0x390/0x390 [ 26.739973] ? avc_has_perm+0x43e/0x680 [ 26.743921] ? avc_has_perm_noaudit+0x520/0x520 [ 26.748565] ? __fget+0x35c/0x570 [ 26.751995] ? iterate_fd+0x3f0/0x3f0 [ 26.755779] ? find_held_lock+0x35/0x1d0 [ 26.759830] ? sock_has_perm+0x2a4/0x420 [ 26.763867] ? lock_release+0x9a2/0xa40 [ 26.767816] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 26.773675] ? __check_object_size+0x8b/0x530 [ 26.778151] inet_sendmsg+0x11f/0x5e0 [ 26.781924] ? inet_sendmsg+0x11f/0x5e0 [ 26.785870] ? __might_sleep+0x95/0x190 [ 26.789824] ? inet_create+0xf50/0xf50 [ 26.793687] ? selinux_socket_sendmsg+0x36/0x40 [ 26.798332] ? security_socket_sendmsg+0x89/0xb0 [ 26.803063] ? inet_create+0xf50/0xf50 [ 26.806929] sock_sendmsg+0xca/0x110 [ 26.810619] SYSC_sendto+0x361/0x5c0 [ 26.814311] ? SYSC_connect+0x4a0/0x4a0 [ 26.818266] ? selinux_secmark_relabel_packet+0xc0/0xc0 [ 26.823606] ? __do_page_fault+0x3d6/0xc90 [ 26.827820] ? selinux_netlbl_sock_rcv_skb+0x730/0x730 [ 26.833086] ? SyS_futex+0x269/0x390 [ 26.836772] ? SyS_setsockopt+0x215/0x360 [ 26.840901] ? do_futex+0x22a0/0x22a0 [ 26.844679] ? entry_SYSCALL_64_fastpath+0x5/0xa0 [ 26.849501] SyS_sendto+0x40/0x50 [ 26.852932] entry_SYSCALL_64_fastpath+0x29/0xa0 [ 26.857662] RIP: 0033:0x4457e9 [ 26.860826] RSP: 002b:00007fcfb8ee2da8 EFLAGS: 00000216 ORIG_RAX: 000000000000002c [ 26.868506] RAX: ffffffffffffffda RBX: 00000000006dac6c RCX: 00000000004457e9 [ 26.875749] RDX: 0000000000000001 RSI: 000000002010bf14 RDI: 0000000000000004 [ 26.882991] RBP: 00000000006dac68 R08: 00000000204d9000 R09: 000000000000001c [ 26.890254] R10: 0000000000000000 R11: 0000000000000216 R12: 0000000000000000 [ 26.897497] R13: 00007ffcc8572a1f R14: 00007fcfb8ee39c0 R15: 0000000000000001 [ 26.905197] Dumping ftrace buffer: [ 26.908710] (ftrace buffer empty) [ 26.912388] Kernel Offset: disabled [ 26.915987] Rebooting in 86400 seconds..