[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 35.004214] random: sshd: uninitialized urandom read (32 bytes read) [ 35.278372] kauditd_printk_skb: 9 callbacks suppressed [ 35.278380] audit: type=1400 audit(1578527543.473:35): avc: denied { map } for pid=7083 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 35.454906] random: sshd: uninitialized urandom read (32 bytes read) [ 36.121931] random: sshd: uninitialized urandom read (32 bytes read) [ 52.592447] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.1' (ECDSA) to the list of known hosts. [ 58.272517] random: sshd: uninitialized urandom read (32 bytes read) executing program [ 58.401879] audit: type=1400 audit(1578527566.603:36): avc: denied { map } for pid=7095 comm="syz-executor124" path="/root/syz-executor124889595" dev="sda1" ino=16484 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 58.444982] device bridge1 entered promiscuous mode [ 58.550440] device bridge0 entered promiscuous mode [ 58.740881] device bridge3 entered promiscuous mode [ 59.036732] device bridge0 left promiscuous mode executing program [ 59.284727] device bridge5 entered promiscuous mode [ 59.520997] device bridge4 entered promiscuous mode [ 59.782348] device bridge7 entered promiscuous mode [ 60.234683] device bridge6 entered promiscuous mode [ 60.522520] device bridge4 left promiscuous mode [ 60.600152] device bridge6 left promiscuous mode executing program [ 60.757722] device bridge9 entered promiscuous mode [ 60.901159] device bridge8 entered promiscuous mode [ 61.162603] device bridge8 left promiscuous mode [ 61.215782] device bridge11 entered promiscuous mode [ 61.491116] device bridge10 entered promiscuous mode [ 61.741133] device bridge10 left promiscuous mode executing program [ 61.907523] device bridge13 entered promiscuous mode [ 62.031220] device bridge12 entered promiscuous mode [ 62.243653] device bridge15 entered promiscuous mode [ 62.390569] device bridge14 entered promiscuous mode [ 62.701797] device bridge12 left promiscuous mode [ 62.903454] device bridge14 left promiscuous mode executing program [ 63.096479] device bridge17 entered promiscuous mode [ 63.324689] device bridge16 entered promiscuous mode [ 63.433182] kasan: CONFIG_KASAN_INLINE enabled [ 63.444661] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 63.488756] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 63.495057] Modules linked in: [ 63.498250] CPU: 0 PID: 7558 Comm: syz-executor124 Not tainted 4.14.162-syzkaller #0 [ 63.506125] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 63.515476] task: ffff888086cb4380 task.stack: ffff88808bff8000 [ 63.521546] RIP: 0010:hsr_check_carrier_and_operstate+0x3e/0x5e0 [ 63.527703] RSP: 0018:ffff88808bffee90 EFLAGS: 00010202 [ 63.533068] RAX: dffffc0000000000 RBX: 0000000000000004 RCX: ffff888086cb4c00 [ 63.540336] RDX: 0000000000000002 RSI: 0000000000000004 RDI: ffff8880997f9920 [ 63.547600] RBP: ffff88808bffeec8 R08: ffff888086cb4380 R09: 0000000000000001 [ 63.554866] R10: 0000000000000000 R11: ffff888086cb4380 R12: 0000000000000000 [ 63.562132] R13: ffff888080bfd500 R14: 0000000000000010 R15: ffff88808098b540 [ 63.569397] FS: 00007f391fdbc700(0000) GS:ffff8880aec00000(0000) knlGS:0000000000000000 [ 63.577617] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 63.583522] CR2: 00007f66ae47d9b8 CR3: 000000009350a000 CR4: 00000000001406f0 [ 63.590787] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 63.598053] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 63.605317] Call Trace: [ 63.607908] hsr_netdev_notify+0xef/0x8f0 [ 63.612083] notifier_call_chain+0x111/0x1b0 [ 63.616491] raw_notifier_call_chain+0x2e/0x40 [ 63.621079] call_netdevice_notifiers_info+0x56/0x70 [ 63.626183] netdev_state_change+0xbf/0xe0 [ 63.630439] ? dev_valid_name+0x1b0/0x1b0 [ 63.634588] do_setlink+0x23da/0x2c20 [ 63.638387] ? rtnl_register+0x50/0x50 [ 63.642281] ? __lock_acquire+0x5f7/0x4620 [ 63.646519] ? br_changelink+0x12eb/0x1660 [ 63.650762] ? br_fill_info+0x10a0/0x10a0 [ 63.654909] ? nla_parse+0x186/0x240 [ 63.658622] rtnl_newlink+0x11a7/0x1700 [ 63.662617] ? rtnl_link_unregister+0x200/0x200 [ 63.667283] ? finish_task_switch+0x178/0x650 [ 63.671779] ? finish_task_switch+0x14d/0x650 [ 63.676537] ? __mutex_lock+0x951/0x1470 [ 63.680634] ? lock_downgrade+0x740/0x740 [ 63.684797] ? rtnl_link_unregister+0x200/0x200 [ 63.689487] rtnetlink_rcv_msg+0x3da/0xb70 [ 63.693724] ? rtnl_bridge_getlink+0x7a0/0x7a0 [ 63.698312] ? netlink_deliver_tap+0x93/0x8f0 [ 63.702806] netlink_rcv_skb+0x14f/0x3c0 [ 63.706868] ? rtnl_bridge_getlink+0x7a0/0x7a0 [ 63.711448] ? lock_downgrade+0x740/0x740 [ 63.715596] ? netlink_ack+0x9a0/0x9a0 [ 63.719484] ? netlink_deliver_tap+0xba/0x8f0 [ 63.723992] rtnetlink_rcv+0x1d/0x30 [ 63.727704] netlink_unicast+0x44d/0x650 [ 63.731771] ? netlink_attachskb+0x6a0/0x6a0 [ 63.736185] ? security_netlink_send+0x81/0xb0 [ 63.740766] netlink_sendmsg+0x7c4/0xc60 [ 63.744830] ? netlink_unicast+0x650/0x650 [ 63.749063] ? security_socket_sendmsg+0x89/0xb0 [ 63.753985] ? netlink_unicast+0x650/0x650 [ 63.758202] sock_sendmsg+0xce/0x110 [ 63.761905] ___sys_sendmsg+0x70a/0x840 [ 63.765876] ? copy_msghdr_from_user+0x3f0/0x3f0 [ 63.770644] ? __fget+0x210/0x370 [ 63.774102] ? find_held_lock+0x35/0x130 [ 63.778178] ? __fget+0x210/0x370 [ 63.781634] ? lock_downgrade+0x740/0x740 [ 63.785781] ? __fget+0x237/0x370 [ 63.789235] ? __fget_light+0x172/0x1f0 [ 63.793207] ? __fdget+0x1b/0x20 [ 63.796573] ? sockfd_lookup_light+0xb4/0x160 [ 63.801066] __sys_sendmsg+0xb9/0x140 [ 63.804867] ? SyS_shutdown+0x170/0x170 [ 63.808842] ? do_futex+0x19e0/0x19e0 [ 63.812641] SyS_sendmsg+0x2d/0x50 [ 63.816176] ? __sys_sendmsg+0x140/0x140 [ 63.820237] do_syscall_64+0x1e8/0x640 [ 63.824119] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 63.828959] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 63.834141] RIP: 0033:0x446d89 [ 63.837322] RSP: 002b:00007f391fdbbdb8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 63.845028] RAX: ffffffffffffffda RBX: 00000000006dbc88 RCX: 0000000000446d89 [ 63.852295] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000009 [ 63.859559] RBP: 00000000006dbc80 R08: 0000000000000002 R09: 0000000000000000 [ 63.866827] R10: 0000000000000004 R11: 0000000000000246 R12: 00000000006dbc8c [ 63.874094] R13: 00007ffc0185f22f R14: 00007f391fdbc9c0 R15: 20c49ba5e353f7cf [ 63.881365] Code: 10 e8 47 84 fb fa 4c 89 e7 be 04 00 00 00 e8 4a ac ff ff 4c 8d 70 10 49 89 c4 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 <80> 3c 02 00 0f 85 0d 05 00 00 48 b8 00 00 00 00 00 fc ff df 49 [ 63.900531] RIP: hsr_check_carrier_and_operstate+0x3e/0x5e0 RSP: ffff88808bffee90 [ 63.921838] ---[ end trace 3a402e1c952e2ff2 ]--- [ 63.929640] Kernel panic - not syncing: Fatal exception [ 63.936343] Kernel Offset: disabled [ 63.940085] Rebooting in 86400 seconds..