[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 18.047356] audit: type=1400 audit(1519087338.552:6): avc: denied { map } for pid=4154 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.11' (ECDSA) to the list of known hosts. syzkaller login: [ 24.391459] audit: type=1400 audit(1519087344.896:7): avc: denied { map } for pid=4168 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=16479 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2018/02/20 00:42:25 parsed 1 programs 2018/02/20 00:42:25 executed programs: 0 [ 24.655970] audit: type=1400 audit(1519087345.160:8): avc: denied { map } for pid=4168 comm="syz-execprog" path="/root/syzkaller-shm879033798" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 24.670887] IPVS: ftp: loaded support on port[0] = 21 [ 24.882760] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 27.096337] [ 27.097984] ===================================== [ 27.102796] WARNING: bad unlock balance detected! [ 27.107604] 4.16.0-rc2+ #320 Not tainted [ 27.111631] ------------------------------------- [ 27.116437] syz-execprog/4174 is trying to release lock (rcu_read_lock_bh) at: [ 27.123778] [] hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 27.130754] but there are no more locks to release! [ 27.135738] [ 27.135738] other info that might help us debug this: [ 27.142370] 3 locks held by syz-execprog/4174: [ 27.146919] #0: ((&idev->mc_dad_timer)){+.-.}, at: [<0000000070300b74>] call_timer_fn+0x1c6/0x820 [ 27.156081] #1: (rcu_read_lock){....}, at: [<0000000075d08f74>] mld_sendpack+0x180/0xe70 [ 27.164458] #2: (rcu_read_lock){....}, at: [<00000000c36092d9>] nf_hook.constprop.37+0x0/0x830 [ 27.173353] [ 27.173353] stack backtrace: [ 27.177816] CPU: 0 PID: 4174 Comm: syz-execprog Not tainted 4.16.0-rc2+ #320 [ 27.184969] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.194289] Call Trace: [ 27.196841] [ 27.198963] dump_stack+0x194/0x257 [ 27.202561] ? arch_local_irq_restore+0x53/0x53 [ 27.207200] ? hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 27.212620] print_unlock_imbalance_bug+0x12f/0x140 [ 27.217604] lock_release+0x6fe/0xa40 [ 27.221374] ? hashlimit_mt_common.isra.10+0x1beb/0x2610 [ 27.226793] ? lock_downgrade+0x980/0x980 [ 27.230908] ? lock_release+0xa40/0xa40 [ 27.234852] ? __raw_spin_lock_init+0x1c/0x100 [ 27.239403] ? do_raw_spin_trylock+0x190/0x190 [ 27.243956] hashlimit_mt_common.isra.10+0x1c08/0x2610 [ 27.249205] ? dsthash_find+0x5b0/0x5b0 [ 27.253146] ? __lock_acquire+0x664/0x3e00 [ 27.257352] ? is_bpf_text_address+0x7b/0x120 [ 27.261815] ? lock_downgrade+0x980/0x980 [ 27.265932] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 27.271092] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 27.276249] ? is_bpf_text_address+0xa4/0x120 [ 27.280715] ? __kernel_text_address+0xd/0x40 [ 27.285181] ? unwind_get_return_address+0x61/0xa0 [ 27.290080] hashlimit_mt+0x78/0x90 [ 27.293674] ? hashlimit_mt+0x78/0x90 [ 27.297443] ip6t_do_table+0x98d/0x1a30 [ 27.301388] ? kmem_cache_alloc_trace+0x136/0x740 [ 27.306198] ? mld_sendpack+0x617/0xe70 [ 27.310147] ? ip6t_error+0x60/0x60 [ 27.313743] ? check_noncircular+0x20/0x20 [ 27.317946] ? lock_acquire+0x1d5/0x580 [ 27.321889] ? lock_acquire+0x1d5/0x580 [ 27.325839] ? igmp6_mcf_seq_next+0x660/0x660 [ 27.330308] ? lock_release+0xa40/0xa40 [ 27.334254] ip6table_raw_hook+0x65/0x80 [ 27.338286] nf_hook_slow+0xba/0x1a0 [ 27.341987] nf_hook.constprop.37+0x3f6/0x830 [ 27.346453] ? igmp6_mcf_seq_next+0x660/0x660 [ 27.350917] ? trace_hardirqs_on+0xd/0x10 [ 27.355036] ? __local_bh_enable_ip+0x121/0x230 [ 27.359675] ? _raw_spin_unlock_bh+0x30/0x40 [ 27.364056] ? rt6_uncached_list_add+0x1b7/0x240 [ 27.368780] ? rt6_fill_node+0x18b0/0x18b0 [ 27.372986] ? icmp6_dst_alloc+0x475/0x660 [ 27.377192] ? ip6_mc_leave_src+0x1d0/0x1d0 [ 27.381481] ? icmpv6_flow_init+0x1f6/0x270 [ 27.385771] mld_sendpack+0x6c2/0xe70 [ 27.389542] ? nf_hook.constprop.37+0x830/0x830 [ 27.394180] ? mark_held_locks+0xaf/0x100 [ 27.398299] ? trace_hardirqs_on+0xd/0x10 [ 27.402414] ? __local_bh_enable_ip+0x121/0x230 [ 27.407050] mld_send_initial_cr.part.25+0x103/0x150 [ 27.412121] mld_dad_timer_expire+0x31/0x100 [ 27.416497] call_timer_fn+0x228/0x820 [ 27.420355] ? mld_send_initial_cr.part.25+0x150/0x150 [ 27.425598] ? process_timeout+0x40/0x40 [ 27.429627] ? __run_timers+0x7e3/0xb70 [ 27.433571] ? lock_downgrade+0x980/0x980 [ 27.437688] ? debug_object_deactivate+0x364/0x560 [ 27.442592] ? lock_release+0xa40/0xa40 [ 27.446536] ? do_raw_spin_trylock+0x190/0x190 [ 27.451088] ? trace_hardirqs_on_caller+0x19e/0x5c0 [ 27.456079] ? mld_send_initial_cr.part.25+0x150/0x150 [ 27.461326] ? mld_send_initial_cr.part.25+0x150/0x150 [ 27.466573] __run_timers+0x7ee/0xb70 [ 27.470346] ? trigger_dyntick_cpu.isra.29+0x150/0x150 [ 27.475591] ? timerqueue_add+0x1e9/0x280 [ 27.479708] ? check_noncircular+0x20/0x20 [ 27.483914] ? enqueue_hrtimer+0x177/0x4b0 [ 27.488118] ? lock_release+0xa40/0xa40 [ 27.492061] ? retrigger_next_event+0x1e0/0x1e0 [ 27.496702] ? find_held_lock+0x35/0x1d0 [ 27.500735] ? clockevents_program_event+0x163/0x2e0 [ 27.505814] ? lock_downgrade+0x980/0x980 [ 27.509932] ? rcu_pm_notify+0xc0/0xc0 [ 27.513791] run_timer_softirq+0x4c/0x70 [ 27.517822] __do_softirq+0x2d7/0xb85 [ 27.521590] ? ktime_get+0x26f/0x3a0 [ 27.525273] ? __irqentry_text_end+0x1f8ad4/0x1f8ad4 [ 27.530343] ? do_timer+0x50/0x50 [ 27.533765] ? native_apic_msr_write+0x5c/0x80 [ 27.538318] ? lapic_next_event+0x54/0x80 [ 27.542435] ? clockevents_program_event+0x108/0x2e0 [ 27.547506] ? tick_program_event+0x83/0x100 [ 27.551883] ? rcu_pm_notify+0xc0/0xc0 [ 27.555748] irq_exit+0x1cc/0x200 [ 27.559171] smp_apic_timer_interrupt+0x16b/0x700 [ 27.563980] ? smp_reschedule_interrupt+0xe6/0x650 [ 27.568879] ? smp_call_function_single_interrupt+0x640/0x640 [ 27.574731] ? _raw_spin_lock+0x32/0x40 [ 27.578676] ? _raw_spin_unlock+0x22/0x30 [ 27.582793] ? handle_edge_irq+0x2b4/0x7c0 [ 27.586998] ? task_prio+0x50/0x50 [ 27.590513] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 27.595326] apic_timer_interrupt+0x8e/0xa0 [ 27.599614] [ 27.601819] RIP: 0033:0x4ccad0 [ 27.604977] RSP: 002b:000000c4200e08a0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff12 [ 27.612656] RAX: 000000c42031f4e0 RBX: 00000000770bed7c RCX: 0000000000000000 [ 27.619894] RDX: 00000000006e2b40 RSI: 00000000006e2b40 RDI: 00000000006e2a40 [ 27.627133] RBP: 000000c4200e0978 R08: 0000000000000000 R09: 0000000000000000 [ 27.634375] R10: 00000000005ec58b R11: 0000000000000004 R12: 0000000000000000 [ 27.641616] R13: 0000000000000020 R14: 0000000000000013 R15: 0000000000000002 2018/02/20 00:42:30 executed programs: 482 2018/02/20 00:42:35 executed programs: 1309