[....] Starting enhanced syslogd: rsyslogd[ 13.076111] audit: type=1400 audit(1512819639.891:5): avc: denied { syslog } for pid=2993 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 20.419861] audit: type=1400 audit(1512819647.235:6): avc: denied { map } for pid=3132 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added 'ci-upstream-kasan-gce-386-3,10.128.0.18' (ECDSA) to the list of known hosts. [ 26.676617] audit: type=1400 audit(1512819653.492:7): avc: denied { map } for pid=3146 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=16479 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2017/12/09 11:40:53 parsed 1 programs 2017/12/09 11:40:53 executed programs: 0 [ 27.157754] audit: type=1400 audit(1512819653.973:8): avc: denied { map } for pid=3146 comm="syz-execprog" path="/root/syzkaller-shm435885474" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 27.240641] audit: type=1400 audit(1512819654.056:9): avc: denied { map } for pid=3155 comm="syz-executor0" path="/dev/binder0" dev="devtmpfs" ino=8807 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=chr_file permissive=1 [ 27.241649] binder: 3155:3156 ERROR: BC_REGISTER_LOOPER called without request [ 27.272746] audit: type=1400 audit(1512819654.056:10): avc: denied { set_context_mgr } for pid=3155 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 27.296097] audit: type=1400 audit(1512819654.056:11): avc: denied { call } for pid=3155 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 27.300975] binder_alloc: binder_alloc_mmap_handler: 3155 20000000-20002000 already mapped failed -16 [ 27.302233] binder: BINDER_SET_CONTEXT_MGR already set [ 27.302241] binder: 3155:3156 ioctl 40046207 0 returned -16 [ 27.304571] binder_alloc: 3155: binder_alloc_buf, no vma [ 27.304593] binder: 3155:3157 transaction failed 29189/-3, size 0-0 line 2890 [ 27.304635] binder: 3155:3156 ERROR: BC_REGISTER_LOOPER called without request [ 27.316882] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.316978] binder: release 3155:3156 transaction 2 in, still active [ 27.316997] binder: send failed reply for transaction 2 to 3155:3157 [ 27.319334] binder: undelivered TRANSACTION_COMPLETE [ 27.319347] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.325043] binder: 3158:3159 ERROR: BC_REGISTER_LOOPER called without request [ 27.360221] binder: release 3158:3159 transaction 5 in, still active [ 27.360229] binder: send failed reply for transaction 5 to 3158:3160 [ 27.369258] binder: 3158:3159 ERROR: BC_REGISTER_LOOPER called without request [ 27.389238] binder: release 3158:3160 transaction 7 out, still active [ 27.389244] binder: undelivered TRANSACTION_COMPLETE [ 27.389251] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.389254] binder: undelivered TRANSACTION_COMPLETE [ 27.389279] binder: release 3158:3159 transaction 7 in, still active [ 27.389285] binder: send failed reply for transaction 7, target dead [ 27.397023] binder: 3161:3162 ERROR: BC_REGISTER_LOOPER called without request [ 27.433711] binder: release 3161:3162 transaction 9 in, still active [ 27.433719] binder: send failed reply for transaction 9 to 3161:3163 [ 27.451877] binder: 3161:3162 ERROR: BC_REGISTER_LOOPER called without request [ 27.462871] binder: release 3161:3162 transaction 11 in, still active [ 27.462878] binder: send failed reply for transaction 11 to 3161:3163 [ 27.462881] ------------[ cut here ]------------ [ 27.462885] Unexpected reply error: 29189 [ 27.462989] WARNING: CPU: 1 PID: 1404 at drivers/android/binder.c:1924 binder_send_failed_reply+0x13b/0x350 [ 27.462994] Kernel panic - not syncing: panic_on_warn set ... [ 27.462994] [ 27.463004] CPU: 1 PID: 1404 Comm: kworker/1:2 Not tainted 4.15.0-rc2+ #124 [ 27.463008] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.463014] Workqueue: events binder_deferred_func [ 27.463020] Call Trace: [ 27.463028] dump_stack+0x194/0x257 [ 27.463038] ? arch_local_irq_restore+0x53/0x53 [ 27.463048] ? vsnprintf+0x1ed/0x1900 [ 27.463060] panic+0x1e4/0x41c [ 27.463067] ? refcount_error_report+0x214/0x214 [ 27.463074] ? show_regs_print_info+0x18/0x18 [ 27.463089] ? __warn+0x1c1/0x200 [ 27.463103] ? binder_send_failed_reply+0x13b/0x350 [ 27.463110] __warn+0x1dc/0x200 [ 27.463120] ? binder_send_failed_reply+0x13b/0x350 [ 27.463132] report_bug+0x211/0x2d0 [ 27.463147] fixup_bug.part.11+0x37/0x80 [ 27.463154] do_error_trap+0x2d7/0x3e0 [ 27.463165] ? math_error+0x400/0x400 [ 27.463170] ? vprintk_emit+0x3ea/0x590 [ 27.463178] ? vprintk_emit+0x3ea/0x590 [ 27.463193] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 27.463205] do_invalid_op+0x1b/0x20 [ 27.463211] invalid_op+0x18/0x20 [ 27.463217] RIP: 0010:binder_send_failed_reply+0x13b/0x350 [ 27.463221] RSP: 0018:ffff8801d2af71d0 EFLAGS: 00010282 [ 27.463228] RAX: dffffc0000000008 RBX: ffff8801d27ec900 RCX: ffffffff815a047e [ 27.463232] RDX: 0000000000000000 RSI: 1ffff1003a559131 RDI: 0000000000000293 [ 27.463235] RBP: ffff8801d2af71f8 R08: 1ffff1003a55edcd R09: 0000000000000000 [ 27.463239] R10: 000000000000000b R11: 0000000000000000 R12: ffff8801c5b75280 [ 27.463243] R13: 0000000000007205 R14: 0000000000007205 R15: 0000000000000c59 [ 27.463257] ? vprintk_func+0x5e/0xc0 [ 27.463290] binder_thread_release+0x263/0x540 [ 27.463304] binder_deferred_func+0x567/0x12f0 [ 27.463323] ? binder_cleanup_ref_olocked+0xab0/0xab0 [ 27.463331] ? unwind_next_frame.part.6+0x1a6/0xb40 [ 27.463337] ? unwind_dump+0x4d0/0x4d0 [ 27.463344] ? set_next_entity+0x2ed/0xd70 [ 27.463354] ? find_held_lock+0x39/0x1d0 [ 27.463366] ? check_noncircular+0x20/0x20 [ 27.463381] ? lock_acquire+0x1d5/0x580 [ 27.463388] ? process_one_work+0xb2f/0x1be0 [ 27.463396] ? __save_stack_trace+0x6e/0xd0 [ 27.463410] ? __lock_is_held+0xbc/0x140 [ 27.463429] process_one_work+0xbfd/0x1be0 [ 27.463447] ? pwq_dec_nr_in_flight+0x450/0x450 [ 27.463453] ? finish_task_switch+0x1d3/0x740 [ 27.463459] ? finish_task_switch+0x1aa/0x740 [ 27.463497] ? __sched_text_start+0x8/0x8 [ 27.463508] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 27.463519] ? check_noncircular+0x20/0x20 [ 27.463530] ? find_held_lock+0x39/0x1d0 [ 27.463548] ? lock_acquire+0x1d5/0x580 [ 27.463553] ? worker_thread+0x4a3/0x1990 [ 27.463566] ? lock_release+0xda0/0xda0 [ 27.463572] ? retint_kernel+0x10/0x10 [ 27.463581] ? do_raw_spin_trylock+0x190/0x190 [ 27.463600] worker_thread+0x223/0x1990 [ 27.463625] ? process_one_work+0x1be0/0x1be0 [ 27.463634] ? _raw_spin_unlock_irq+0x27/0x70 [ 27.463642] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 27.463649] ? trace_hardirqs_on+0xd/0x10 [ 27.463655] ? _raw_spin_unlock_irq+0x27/0x70 [ 27.463662] ? finish_task_switch+0x1d3/0x740 [ 27.463667] ? finish_task_switch+0x1aa/0x740 [ 27.463677] ? copy_overflow+0x20/0x20 [ 27.463693] ? __schedule+0x8f3/0x2060 [ 27.463698] ? check_noncircular+0x20/0x20 [ 27.463712] ? find_held_lock+0x39/0x1d0 [ 27.463731] ? find_held_lock+0x39/0x1d0 [ 27.463747] ? lock_downgrade+0x980/0x980 [ 27.463754] ? default_wake_function+0x30/0x50 [ 27.463768] ? __schedule+0x2060/0x2060 [ 27.463774] ? do_wait_intr_irq+0x3e0/0x3e0 [ 27.463783] ? do_raw_spin_trylock+0x190/0x190 [ 27.463791] ? _raw_spin_unlock_irqrestore+0x31/0xba [ 27.463799] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 27.463806] ? trace_hardirqs_on+0xd/0x10 [ 27.463812] ? __kthread_parkme+0x175/0x240 [ 27.463822] kthread+0x37a/0x440 [ 27.463828] ? process_one_work+0x1be0/0x1be0 [ 27.463832] ? kthread_stop+0x7b0/0x7b0 [ 27.463840] ret_from_fork+0x24/0x30 [ 27.465229] Dumping ftrace buffer: [ 27.465260] (ftrace buffer empty) [ 27.465264] Kernel Offset: disabled [ 27.897777] Rebooting in 86400 seconds..