syzkaller login: [ 11.930728][ T23] kauditd_printk_skb: 60 callbacks suppressed [ 11.930736][ T23] audit: type=1400 audit(1636362686.959:71): avc: denied { transition } for pid=289 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 11.943895][ T23] audit: type=1400 audit(1636362686.969:72): avc: denied { write } for pid=289 comm="sh" path="pipe:[11641]" dev="pipefs" ino=11641 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1 [ 11.948949][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 12.267173][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #88!!! [ 12.269314][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #88!!! [ 12.272859][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 12.277293][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 12.317142][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #88!!! [ 12.320098][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #88!!! Warning: Permanently added '10.128.0.48' (ECDSA) to the list of known hosts. 2021/11/08 09:11:34 fuzzer started 2021/11/08 09:11:34 connecting to host at 10.128.0.163:33433 2021/11/08 09:11:34 checking machine... 2021/11/08 09:11:34 checking revisions... 2021/11/08 09:11:34 testing simple program... [ 19.270639][ T23] audit: type=1400 audit(1636362694.299:73): avc: denied { getattr } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 19.274801][ T23] audit: type=1400 audit(1636362694.299:74): avc: denied { read } for pid=362 comm="syz-fuzzer" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 19.278844][ T23] audit: type=1400 audit(1636362694.299:75): avc: denied { open } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 19.286052][ T23] audit: type=1400 audit(1636362694.309:76): avc: denied { read } for pid=362 comm="syz-fuzzer" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 19.290737][ T23] audit: type=1400 audit(1636362694.309:77): avc: denied { open } for pid=362 comm="syz-fuzzer" path="/dev/raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 19.297985][ T371] cgroup: Unknown subsys name 'net' [ 19.314882][ T23] audit: type=1400 audit(1636362694.319:78): avc: denied { mounton } for pid=371 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1136 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 19.343127][ T23] audit: type=1400 audit(1636362694.319:79): avc: denied { mount } for pid=371 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.343400][ T371] cgroup: Unknown subsys name 'devices' [ 19.365279][ T23] audit: type=1400 audit(1636362694.349:80): avc: denied { unmount } for pid=371 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.538996][ T371] cgroup: Unknown subsys name 'hugetlb' [ 19.544845][ T371] cgroup: Unknown subsys name 'rlimit' [ 19.728246][ T23] audit: type=1400 audit(1636362694.759:81): avc: denied { setattr } for pid=371 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 19.772015][ T23] audit: type=1400 audit(1636362694.799:82): avc: denied { execmem } for pid=372 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 19.868787][ T373] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.876007][ T373] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.883806][ T373] device bridge_slave_0 entered promiscuous mode [ 19.890970][ T373] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.898298][ T373] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.906072][ T373] device bridge_slave_1 entered promiscuous mode [ 19.939879][ T373] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.947081][ T373] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.954538][ T373] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.961687][ T373] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.983698][ T74] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.991533][ T74] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.999380][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 20.008089][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.017422][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.025601][ T24] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.032695][ T24] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.044087][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.052718][ T74] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.059814][ T74] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.078367][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.087676][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 20.095592][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.104804][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.123948][ T377] ================================================================================ [ 20.133466][ T377] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:2023:28 [ 20.141299][ T377] member access within address ffffc90000bd71c0 with insufficient space [ 20.149927][ T377] for an object of type 'struct sk_buff' [ 20.155909][ T377] CPU: 0 PID: 377 Comm: kworker/0:2 Not tainted 5.10.78-syzkaller-01155-gbb235e8cc2b6 #0 [ 20.166157][ T377] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 20.176766][ T377] Workqueue: ipv6_addrconf addrconf_dad_work [ 20.182891][ T377] Call Trace: [ 20.186367][ T377] dump_stack_lvl+0x1e2/0x24b [ 20.191048][ T377] ? show_regs_print_info+0x18/0x18 [ 20.196428][ T377] ? wg_allowedips_lookup_dst+0x190/0x190 [ 20.202248][ T377] dump_stack+0x15/0x1d [ 20.206755][ T377] ubsan_type_mismatch_common+0x1ed/0x3a0 [ 20.212899][ T377] ? __sanitizer_cov_trace_switch+0x74/0x90 [ 20.218870][ T377] __ubsan_handle_type_mismatch_v1+0x5b/0x70 [ 20.224960][ T377] wg_xmit+0x4a2/0xae0 [ 20.229025][ T377] ? wg_stop+0x140/0x140 [ 20.233251][ T377] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20 [ 20.239496][ T377] netdev_start_xmit+0x8a/0x160 [ 20.244353][ T377] dev_hard_start_xmit+0x18d/0x2f0 [ 20.249525][ T377] __dev_queue_xmit+0xfbe/0x1bb0 [ 20.254666][ T377] ? dev_queue_xmit+0x20/0x20 [ 20.259337][ T377] ? __local_bh_enable_ip+0xa8/0x170 [ 20.264603][ T377] ? do_raw_spin_unlock+0x50/0x50 [ 20.269602][ T377] ? _local_bh_enable+0x30/0x30 [ 20.274673][ T377] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 20.281078][ T377] ? ndisc_constructor+0x690/0x8a0 [ 20.286454][ T377] ? _raw_write_unlock_bh+0x31/0x47 [ 20.291744][ T377] ? dev_hard_header+0xdb/0xf0 [ 20.296576][ T377] dev_queue_xmit+0x17/0x20 [ 20.301279][ T377] neigh_connected_output+0x288/0x2b0 [ 20.307061][ T377] ip6_finish_output2+0xde2/0x1440 [ 20.312369][ T377] ? __rcu_read_lock+0x50/0x50 [ 20.317206][ T377] ? __ip6_finish_output+0x520/0x520 [ 20.322556][ T377] ? dst_cow_metrics_generic+0x55/0x1d0 [ 20.328100][ T377] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 20.334479][ T377] ? ip6_skb_dst_mtu+0xaf/0x260 [ 20.339745][ T377] __ip6_finish_output+0x3e4/0x520 [ 20.345250][ T377] ip6_finish_output+0x3f/0x220 [ 20.350124][ T377] ? ip6_output+0x1d3/0x4b0 [ 20.354725][ T377] ip6_output+0x1f8/0x4b0 [ 20.359035][ T377] ? asan.module_dtor+0x20/0x20 [ 20.363874][ T377] ? skb_dst+0x40/0x40 [ 20.367921][ T377] ? __rcu_read_lock+0x50/0x50 [ 20.372689][ T377] ? selinux_ipv6_forward+0x50/0x50 [ 20.377879][ T377] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 20.383701][ T377] ? nf_hook_slow+0x150/0x1b0 [ 20.388519][ T377] NF_HOOK+0xdd/0x280 [ 20.392605][ T377] ? addrconf_addr_solict_mult+0xe0/0xe0 [ 20.398245][ T377] ? NF_HOOK+0x280/0x280 [ 20.402685][ T377] ? __rcu_read_lock+0x50/0x50 [ 20.407438][ T377] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 20.413758][ T377] ? ndisc_send_skb+0x547/0x9f0 [ 20.418629][ T377] ? memcpy+0x56/0x70 [ 20.422852][ T377] ndisc_send_skb+0x646/0x9f0 [ 20.427724][ T377] ? slab_post_alloc_hook+0x90/0xa0 [ 20.432905][ T377] ? ndisc_fill_addr_option+0x2f0/0x2f0 [ 20.438471][ T377] ? skb_set_owner_w+0x1a8/0x310 [ 20.443760][ T377] ? __sanitizer_cov_trace_cmp4+0x19/0x20 [ 20.449612][ T377] ? skb_put+0x11d/0x200 [ 20.453938][ T377] ndisc_send_rs+0x26c/0x360 [ 20.458600][ T377] addrconf_dad_completed+0x4f3/0x9f0 [ 20.464049][ T377] ? addrconf_dad_stop+0x430/0x430 [ 20.469311][ T377] addrconf_dad_work+0x9c1/0x1520 [ 20.474312][ T377] ? move_linked_works+0x118/0x130 [ 20.479399][ T377] ? ipv6_use_optimistic_addr+0x1d0/0x1d0 [ 20.485106][ T377] ? __kasan_check_write+0x14/0x20 [ 20.490194][ T377] process_one_work+0x3ca/0x660 [ 20.495141][ T377] worker_thread+0x709/0xa20 [ 20.499752][ T377] ? __kthread_parkme+0x11b/0x150 [ 20.504951][ T377] kthread+0x371/0x390 [ 20.509001][ T377] ? pr_cont_work+0x110/0x110 [ 20.513657][ T377] ? __list_add+0xc0/0xc0 [ 20.517962][ T377] ret_from_fork+0x1f/0x30 [ 20.522454][ T377] ================================================================================ [ 20.531899][ T377] ================================================================================ [ 20.541339][ T377] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:1916:2 [ 20.549255][ T377] member access within address ffffc90000bd71c0 with insufficient space [ 20.558641][ T377] for an object of type 'struct sk_buff' [ 20.564510][ T377] CPU: 0 PID: 377 Comm: kworker/0:2 Not tainted 5.10.78-syzkaller-01155-gbb235e8cc2b6 #0 [ 20.574494][ T377] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 20.584671][ T377] Workqueue: ipv6_addrconf addrconf_dad_work [ 20.590808][ T377] Call Trace: [ 20.594165][ T377] dump_stack_lvl+0x1e2/0x24b [ 20.598832][ T377] ? show_regs_print_info+0x18/0x18 [ 20.604015][ T377] ? wg_allowedips_lookup_dst+0x190/0x190 [ 20.609987][ T377] dump_stack+0x15/0x1d [ 20.614125][ T377] ubsan_type_mismatch_common+0x1ed/0x3a0 [ 20.619825][ T377] __ubsan_handle_type_mismatch_v1+0x5b/0x70 [ 20.625789][ T377] wg_xmit+0x513/0xae0 [ 20.629851][ T377] ? wg_stop+0x140/0x140 [ 20.634247][ T377] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20 [ 20.640909][ T377] netdev_start_xmit+0x8a/0x160 [ 20.645757][ T377] dev_hard_start_xmit+0x18d/0x2f0 [ 20.650856][ T377] __dev_queue_xmit+0xfbe/0x1bb0 [ 20.655913][ T377] ? dev_queue_xmit+0x20/0x20 [ 20.660651][ T377] ? __local_bh_enable_ip+0xa8/0x170 [ 20.666121][ T377] ? do_raw_spin_unlock+0x50/0x50 [ 20.671128][ T377] ? _local_bh_enable+0x30/0x30 [ 20.676045][ T377] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 20.682449][ T377] ? ndisc_constructor+0x690/0x8a0 [ 20.687544][ T377] ? _raw_write_unlock_bh+0x31/0x47 [ 20.692818][ T377] ? dev_hard_header+0xdb/0xf0 [ 20.697612][ T377] dev_queue_xmit+0x17/0x20 [ 20.702096][ T377] neigh_connected_output+0x288/0x2b0 [ 20.707446][ T377] ip6_finish_output2+0xde2/0x1440 [ 20.712709][ T377] ? __rcu_read_lock+0x50/0x50 [ 20.717446][ T377] ? __ip6_finish_output+0x520/0x520 [ 20.723054][ T377] ? dst_cow_metrics_generic+0x55/0x1d0 [ 20.728579][ T377] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 20.734906][ T377] ? ip6_skb_dst_mtu+0xaf/0x260 [ 20.739867][ T377] __ip6_finish_output+0x3e4/0x520 [ 20.745080][ T377] ip6_finish_output+0x3f/0x220 [ 20.750219][ T377] ? ip6_output+0x1d3/0x4b0 [ 20.754707][ T377] ip6_output+0x1f8/0x4b0 [ 20.759048][ T377] ? asan.module_dtor+0x20/0x20 [ 20.763889][ T377] ? skb_dst+0x40/0x40 [ 20.767946][ T377] ? __rcu_read_lock+0x50/0x50 [ 20.772777][ T377] ? selinux_ipv6_forward+0x50/0x50 [ 20.777956][ T377] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 20.783824][ T377] ? nf_hook_slow+0x150/0x1b0 [ 20.788576][ T377] NF_HOOK+0xdd/0x280 [ 20.792540][ T377] ? addrconf_addr_solict_mult+0xe0/0xe0 [ 20.798150][ T377] ? NF_HOOK+0x280/0x280 [ 20.802395][ T377] ? __rcu_read_lock+0x50/0x50 [ 20.807145][ T377] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 20.813462][ T377] ? ndisc_send_skb+0x547/0x9f0 [ 20.818314][ T377] ? memcpy+0x56/0x70 [ 20.822281][ T377] ndisc_send_skb+0x646/0x9f0 [ 20.826943][ T377] ? slab_post_alloc_hook+0x90/0xa0 [ 20.832125][ T377] ? ndisc_fill_addr_option+0x2f0/0x2f0 [ 20.837998][ T377] ? skb_set_owner_w+0x1a8/0x310 [ 20.842934][ T377] ? __sanitizer_cov_trace_cmp4+0x19/0x20 [ 20.848649][ T377] ? skb_put+0x11d/0x200 [ 20.852921][ T377] ndisc_send_rs+0x26c/0x360 [ 20.857756][ T377] addrconf_dad_completed+0x4f3/0x9f0 [ 20.863103][ T377] ? addrconf_dad_stop+0x430/0x430 [ 20.868194][ T377] addrconf_dad_work+0x9c1/0x1520 [ 20.873196][ T377] ? move_linked_works+0x118/0x130 [ 20.878280][ T377] ? ipv6_use_optimistic_addr+0x1d0/0x1d0 [ 20.884155][ T377] ? __kasan_check_write+0x14/0x20 [ 20.889250][ T377] process_one_work+0x3ca/0x660 [ 20.894264][ T377] worker_thread+0x709/0xa20 [ 20.899097][ T377] ? __kthread_parkme+0x11b/0x150 [ 20.904090][ T377] kthread+0x371/0x390 [ 20.908300][ T377] ? pr_cont_work+0x110/0x110 [ 20.912948][ T377] ? __list_add+0xc0/0xc0 [ 20.917345][ T377] ret_from_fork+0x1f/0x30 [ 20.921788][ T377] ================================================================================ [ 20.933081][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready 2021/11/08 09:11:36 building call list... [ 20.941567][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 20.950399][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 20.966892][ T373] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 21.537282][ T9] device bridge_slave_1 left promiscuous mode [ 21.543452][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.551850][ T9] device bridge_slave_0 left promiscuous mode [ 21.558603][ T9] bridge0: port 1(bridge_slave_0) entered disabled state