[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 18.206829] audit: type=1400 audit(1518965235.495:6): avc: denied { map } for pid=4148 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.22' (ECDSA) to the list of known hosts. net.ipv6.conf.syz0.accept_dad = 0 net.ipv6.conf.syz0.router_solicitations = 0 syzkaller login: [ 24.463578] audit: type=1400 audit(1518965241.752:7): avc: denied { map } for pid=4162 comm="syzkaller546592" path="/root/syzkaller546592854" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 RTNETLINK answers: Operation not supported RTNETLINK answers: No buffer space available RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported [ 24.839613] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Invalid argument RTNETLINK answers: Invalid argument RTNETLINK answers: Invalid argument executing program [ 25.158860] ================================================================== [ 25.166313] BUG: KASAN: use-after-free in nf_nat_ipv6_manip_pkt+0x47c/0x490 [ 25.173385] Write of size 16 at addr ffff8801d551e0e0 by task syzkaller546592/4162 [ 25.181058] [ 25.182661] CPU: 0 PID: 4162 Comm: syzkaller546592 Not tainted 4.16.0-rc1+ #231 [ 25.190077] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 25.199401] Call Trace: [ 25.201964] dump_stack+0x194/0x257 [ 25.205566] ? arch_local_irq_restore+0x53/0x53 [ 25.210206] ? show_regs_print_info+0x18/0x18 [ 25.214679] ? nf_nat_ipv6_manip_pkt+0x47c/0x490 [ 25.219410] print_address_description+0x73/0x250 [ 25.224225] ? nf_nat_ipv6_manip_pkt+0x47c/0x490 [ 25.228953] kasan_report+0x23b/0x360 [ 25.232731] __asan_report_store_n_noabort+0x12/0x14 [ 25.237806] nf_nat_ipv6_manip_pkt+0x47c/0x490 [ 25.242366] ? icmpv6_pkt_to_tuple+0x300/0x300 [ 25.246924] ? __lock_is_held+0xb6/0x140 [ 25.250969] nf_nat_packet+0x3cb/0x560 [ 25.254828] ? ip6t_error+0x60/0x60 [ 25.258466] ? __nf_nat_decode_session+0x280/0x280 [ 25.263427] nf_nat_ipv6_fn+0x679/0xa80 [ 25.267383] ? ip6table_nat_fn+0x40/0x40 [ 25.271420] ? nf_nat_ipv6_secure_port+0x30/0x30 [ 25.276158] ? ip6table_mangle_hook+0x117/0x920 [ 25.280803] ? check_noncircular+0x20/0x20 [ 25.285016] ? ip6table_mangle_net_exit+0xa0/0xa0 [ 25.289838] ? __ip6_make_skb+0x1450/0x2190 [ 25.294136] ? ip6table_nat_fn+0x40/0x40 [ 25.298168] nf_nat_ipv6_local_fn+0x33/0x5d0 [ 25.302553] ip6table_nat_local_fn+0x2c/0x40 [ 25.306934] nf_hook_slow+0xba/0x1a0 [ 25.310628] __ip6_local_out+0x517/0xaa0 [ 25.314664] ? dst_output+0x140/0x140 [ 25.318457] ? lock_acquire+0x1d5/0x580 [ 25.322404] ? rawv6_sendmsg+0x1d86/0x40c0 [ 25.326626] ? ipv6_select_ident+0x120/0x120 [ 25.331024] ip6_local_out+0x2d/0x160 [ 25.334804] ip6_send_skb+0xa1/0x330 [ 25.338493] ip6_push_pending_frames+0xb3/0xe0 [ 25.343052] rawv6_sendmsg+0x2f96/0x40c0 [ 25.347088] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 25.352262] ? rawv6_bind+0x8c0/0x8c0 [ 25.356048] ? avc_has_perm+0x35e/0x680 [ 25.360008] ? lock_downgrade+0x980/0x980 [ 25.364147] ? lock_release+0xa40/0xa40 [ 25.368105] ? find_held_lock+0x35/0x1d0 [ 25.372151] ? avc_has_perm+0x43e/0x680 [ 25.376101] ? avc_has_perm_noaudit+0x520/0x520 [ 25.380742] ? _raw_spin_unlock+0x22/0x30 [ 25.384868] ? __might_sleep+0x95/0x190 [ 25.388831] ? kasan_check_write+0x14/0x20 [ 25.393047] ? _copy_from_user+0x99/0x110 [ 25.397171] ? rw_copy_check_uvector+0x1be/0x280 [ 25.401924] inet_sendmsg+0x11f/0x5e0 [ 25.405698] ? inet_sendmsg+0x11f/0x5e0 [ 25.409645] ? copy_msghdr_from_user+0x3a6/0x590 [ 25.414373] ? inet_create+0xf50/0xf50 [ 25.418246] ? selinux_socket_sendmsg+0x36/0x40 [ 25.422897] ? security_socket_sendmsg+0x89/0xb0 [ 25.427634] ? inet_create+0xf50/0xf50 [ 25.431497] sock_sendmsg+0xca/0x110 [ 25.435198] ___sys_sendmsg+0x767/0x8b0 [ 25.439150] ? copy_msghdr_from_user+0x590/0x590 [ 25.443889] ? check_noncircular+0x20/0x20 [ 25.448106] ? find_held_lock+0x35/0x1d0 [ 25.452145] ? __fget_light+0x2b2/0x3c0 [ 25.456094] ? fget_raw+0x20/0x20 [ 25.459518] ? handle_mm_fault+0x270/0x970 [ 25.463729] ? find_held_lock+0x35/0x1d0 [ 25.467771] ? __do_page_fault+0x5f7/0xc90 [ 25.471979] ? lock_downgrade+0x980/0x980 [ 25.476111] __sys_sendmsg+0xe5/0x210 [ 25.479885] ? __sys_sendmsg+0xe5/0x210 [ 25.483836] ? SyS_shutdown+0x290/0x290 [ 25.487807] ? __do_page_fault+0x3d6/0xc90 [ 25.492046] ? trace_event_raw_event_sys_exit+0x260/0x260 [ 25.497562] SyS_sendmsg+0x2d/0x50 [ 25.501077] ? __sys_sendmsg+0x210/0x210 [ 25.505110] do_syscall_64+0x282/0x940 [ 25.508970] ? __do_page_fault+0xc90/0xc90 [ 25.513177] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 25.517909] ? syscall_return_slowpath+0x550/0x550 [ 25.522830] ? syscall_return_slowpath+0x2ac/0x550 [ 25.527734] ? prepare_exit_to_usermode+0x350/0x350 [ 25.532735] ? retint_user+0x18/0x18 [ 25.536430] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 25.541254] entry_SYSCALL_64_after_hwframe+0x26/0x9b [ 25.546414] RIP: 0033:0x446ea9 [ 25.549576] RSP: 002b:00007ffc61680508 EFLAGS: 00000217 ORIG_RAX: 000000000000002e [ 25.557267] RAX: ffffffffffffffda RBX: 000000000000003e RCX: 0000000000446ea9 [ 25.564519] RDX: 0000000000000000 RSI: 00000000209f2fc8 RDI: 0000000000000004 [ 25.571771] RBP: 00007ffc61680618 R08: 0000000000008a7f R09: 0000000000008a7f [ 25.579019] R10: 0000000000000000 R11: 0000000000000217 R12: 00007ffc61680618 [ 25.586266] R13: 0000000000404370 R14: 0000000000000000 R15: 0000000000000000 [ 25.593522] [ 25.595126] Allocated by task 4162: [ 25.598726] save_stack+0x43/0xd0 [ 25.602151] kasan_kmalloc+0xad/0xe0 [ 25.605836] __kmalloc_node_track_caller+0x47/0x70 [ 25.610738] __kmalloc_reserve.isra.39+0x41/0xd0 [ 25.615469] __alloc_skb+0x13b/0x780 [ 25.619165] sock_wmalloc+0x140/0x1d0 [ 25.622950] __ip6_append_data.isra.44+0x26b9/0x3390 [ 25.628284] ip6_append_data+0x189/0x290 [ 25.632320] rawv6_sendmsg+0x1e09/0x40c0 [ 25.636351] inet_sendmsg+0x11f/0x5e0 [ 25.640125] sock_sendmsg+0xca/0x110 [ 25.643813] ___sys_sendmsg+0x767/0x8b0 [ 25.647761] __sys_sendmsg+0xe5/0x210 [ 25.651542] SyS_sendmsg+0x2d/0x50 [ 25.655058] do_syscall_64+0x282/0x940 [ 25.658918] entry_SYSCALL_64_after_hwframe+0x26/0x9b [ 25.664078] [ 25.665676] Freed by task 4162: [ 25.668929] save_stack+0x43/0xd0 [ 25.672352] __kasan_slab_free+0x11a/0x170 [ 25.676558] kasan_slab_free+0xe/0x10 [ 25.680329] kfree+0xd9/0x260 [ 25.683406] skb_free_head+0x74/0xb0 [ 25.687093] pskb_expand_head+0x36b/0x1210 [ 25.691298] __pskb_pull_tail+0x14a/0x17f0 [ 25.695510] skb_make_writable+0x15b/0x750 [ 25.699723] tcp_manip_pkt+0x82/0x2d0 [ 25.703495] nf_nat_ipv6_manip_pkt+0x22d/0x490 [ 25.708050] nf_nat_packet+0x3cb/0x560 [ 25.711909] nf_nat_ipv6_fn+0x679/0xa80 [ 25.715853] nf_nat_ipv6_local_fn+0x33/0x5d0 [ 25.720231] ip6table_nat_local_fn+0x2c/0x40 [ 25.724609] nf_hook_slow+0xba/0x1a0 [ 25.728291] __ip6_local_out+0x517/0xaa0 [ 25.732322] ip6_local_out+0x2d/0x160 [ 25.736094] ip6_send_skb+0xa1/0x330 [ 25.739778] ip6_push_pending_frames+0xb3/0xe0 [ 25.744333] rawv6_sendmsg+0x2f96/0x40c0 [ 25.748366] inet_sendmsg+0x11f/0x5e0 [ 25.752140] sock_sendmsg+0xca/0x110 [ 25.755826] ___sys_sendmsg+0x767/0x8b0 [ 25.759773] __sys_sendmsg+0xe5/0x210 [ 25.763543] SyS_sendmsg+0x2d/0x50 [ 25.767084] do_syscall_64+0x282/0x940 [ 25.770950] entry_SYSCALL_64_after_hwframe+0x26/0x9b [ 25.776120] [ 25.777722] The buggy address belongs to the object at ffff8801d551e040 [ 25.777722] which belongs to the cache kmalloc-512 of size 512 [ 25.790349] The buggy address is located 160 bytes inside of [ 25.790349] 512-byte region [ffff8801d551e040, ffff8801d551e240) [ 25.802192] The buggy address belongs to the page: [ 25.807093] page:ffffea0007554780 count:1 mapcount:0 mapping:ffff8801d551e040 index:0x0 [ 25.815206] flags: 0x2fffc0000000100(slab) [ 25.819413] raw: 02fffc0000000100 ffff8801d551e040 0000000000000000 0000000100000006 [ 25.827264] raw: ffffea00075763e0 ffffea00075571e0 ffff8801db000940 0000000000000000 [ 25.835114] page dumped because: kasan: bad access detected [ 25.840805] [ 25.842409] Memory state around the buggy address: [ 25.847401] ffff8801d551df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.854735] ffff8801d551e000: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 25.862072] >ffff8801d551e080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.869402] ^ [ 25.875872] ffff8801d551e100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.883201] ffff8801d551e180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.890531] ================================================================== [ 25.897868] Disabling lock debugging due to kernel taint [ 25.903744] Kernel panic - not syncing: panic_on_warn set ... [ 25.903744] [ 25.911099] CPU: 0 PID: 4162 Comm: syzkaller546592 Tainted: G B 4.16.0-rc1+ #231 [ 25.919819] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 25.929142] Call Trace: [ 25.931717] dump_stack+0x194/0x257 [ 25.935316] ? arch_local_irq_restore+0x53/0x53 [ 25.939959] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 25.944694] ? vsnprintf+0x1ed/0x1900 [ 25.948466] ? nf_nat_ipv6_manip_pkt+0x460/0x490 [ 25.953194] panic+0x1e4/0x41c [ 25.956358] ? refcount_error_report+0x214/0x214 [ 25.961088] ? add_taint+0x1c/0x50 [ 25.964600] ? add_taint+0x1c/0x50 [ 25.968110] ? nf_nat_ipv6_manip_pkt+0x47c/0x490 [ 25.972846] kasan_end_report+0x50/0x50 [ 25.976798] kasan_report+0x148/0x360 [ 25.980570] __asan_report_store_n_noabort+0x12/0x14 [ 25.985642] nf_nat_ipv6_manip_pkt+0x47c/0x490 [ 25.990216] ? icmpv6_pkt_to_tuple+0x300/0x300 [ 25.994772] ? __lock_is_held+0xb6/0x140 [ 25.998821] nf_nat_packet+0x3cb/0x560 [ 26.002678] ? ip6t_error+0x60/0x60 [ 26.006276] ? __nf_nat_decode_session+0x280/0x280 [ 26.011189] nf_nat_ipv6_fn+0x679/0xa80 [ 26.015135] ? ip6table_nat_fn+0x40/0x40 [ 26.019169] ? nf_nat_ipv6_secure_port+0x30/0x30 [ 26.023894] ? ip6table_mangle_hook+0x117/0x920 [ 26.028533] ? check_noncircular+0x20/0x20 [ 26.032738] ? ip6table_mangle_net_exit+0xa0/0xa0 [ 26.037552] ? __ip6_make_skb+0x1450/0x2190 [ 26.041852] ? ip6table_nat_fn+0x40/0x40 [ 26.045883] nf_nat_ipv6_local_fn+0x33/0x5d0 [ 26.050265] ip6table_nat_local_fn+0x2c/0x40 [ 26.055341] nf_hook_slow+0xba/0x1a0 [ 26.059034] __ip6_local_out+0x517/0xaa0 [ 26.063069] ? dst_output+0x140/0x140 [ 26.066852] ? lock_acquire+0x1d5/0x580 [ 26.070808] ? rawv6_sendmsg+0x1d86/0x40c0 [ 26.075021] ? ipv6_select_ident+0x120/0x120 [ 26.079420] ip6_local_out+0x2d/0x160 [ 26.083192] ip6_send_skb+0xa1/0x330 [ 26.086877] ip6_push_pending_frames+0xb3/0xe0 [ 26.091429] rawv6_sendmsg+0x2f96/0x40c0 [ 26.095470] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 26.100637] ? rawv6_bind+0x8c0/0x8c0 [ 26.104412] ? avc_has_perm+0x35e/0x680 [ 26.108359] ? lock_downgrade+0x980/0x980 [ 26.112478] ? lock_release+0xa40/0xa40 [ 26.116421] ? find_held_lock+0x35/0x1d0 [ 26.120457] ? avc_has_perm+0x43e/0x680 [ 26.124401] ? avc_has_perm_noaudit+0x520/0x520 [ 26.129044] ? _raw_spin_unlock+0x22/0x30 [ 26.133170] ? __might_sleep+0x95/0x190 [ 26.137119] ? kasan_check_write+0x14/0x20 [ 26.141345] ? _copy_from_user+0x99/0x110 [ 26.145466] ? rw_copy_check_uvector+0x1be/0x280 [ 26.150204] inet_sendmsg+0x11f/0x5e0 [ 26.153974] ? inet_sendmsg+0x11f/0x5e0 [ 26.157920] ? copy_msghdr_from_user+0x3a6/0x590 [ 26.162646] ? inet_create+0xf50/0xf50 [ 26.166516] ? selinux_socket_sendmsg+0x36/0x40 [ 26.171158] ? security_socket_sendmsg+0x89/0xb0 [ 26.175901] ? inet_create+0xf50/0xf50 [ 26.179761] sock_sendmsg+0xca/0x110 [ 26.183455] ___sys_sendmsg+0x767/0x8b0 [ 26.187418] ? copy_msghdr_from_user+0x590/0x590 [ 26.192161] ? check_noncircular+0x20/0x20 [ 26.196366] ? find_held_lock+0x35/0x1d0 [ 26.200408] ? __fget_light+0x2b2/0x3c0 [ 26.204354] ? fget_raw+0x20/0x20 [ 26.207781] ? handle_mm_fault+0x270/0x970 [ 26.211988] ? find_held_lock+0x35/0x1d0 [ 26.216035] ? __do_page_fault+0x5f7/0xc90 [ 26.220243] ? lock_downgrade+0x980/0x980 [ 26.224367] __sys_sendmsg+0xe5/0x210 [ 26.228139] ? __sys_sendmsg+0xe5/0x210 [ 26.232086] ? SyS_shutdown+0x290/0x290 [ 26.236041] ? __do_page_fault+0x3d6/0xc90 [ 26.240253] ? trace_event_raw_event_sys_exit+0x260/0x260 [ 26.245767] SyS_sendmsg+0x2d/0x50 [ 26.249285] ? __sys_sendmsg+0x210/0x210 [ 26.253327] do_syscall_64+0x282/0x940 [ 26.257193] ? __do_page_fault+0xc90/0xc90 [ 26.261408] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 26.266137] ? syscall_return_slowpath+0x550/0x550 [ 26.271045] ? syscall_return_slowpath+0x2ac/0x550 [ 26.275950] ? prepare_exit_to_usermode+0x350/0x350 [ 26.280940] ? retint_user+0x18/0x18 [ 26.284627] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 26.289445] entry_SYSCALL_64_after_hwframe+0x26/0x9b [ 26.294606] RIP: 0033:0x446ea9 [ 26.297775] RSP: 002b:00007ffc61680508 EFLAGS: 00000217 ORIG_RAX: 000000000000002e [ 26.305452] RAX: ffffffffffffffda RBX: 000000000000003e RCX: 0000000000446ea9 [ 26.312692] RDX: 0000000000000000 RSI: 00000000209f2fc8 RDI: 0000000000000004 [ 26.319934] RBP: 00007ffc61680618 R08: 0000000000008a7f R09: 0000000000008a7f [ 26.327173] R10: 0000000000000000 R11: 0000000000000217 R12: 00007ffc61680618 [ 26.334414] R13: 0000000000404370 R14: 0000000000000000 R15: 0000000000000000 [ 26.342159] Dumping ftrace buffer: [ 26.345678] (ftrace buffer empty) [ 26.349357] Kernel Offset: disabled [ 26.352963] Rebooting in 86400 seconds..