[ 87.478699][ T27] audit: type=1400 audit(1579478142.429:37): avc: denied { watch } for pid=10621 comm="restorecond" path="/root/.ssh" dev="sda1" ino=16179 scontext=system_u:system_r:kernel_t:s0 tcontext=unconfined_u:object_r:ssh_home_t:s0 tclass=dir permissive=1 [ 87.503984][ T27] audit: type=1400 audit(1579478142.429:38): avc: denied { watch } for pid=10621 comm="restorecond" path="/etc/selinux/restorecond.conf" dev="sda1" ino=2232 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 87.764027][ T27] audit: type=1800 audit(1579478142.719:39): pid=10530 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 87.786583][ T27] audit: type=1800 audit(1579478142.719:40): pid=10530 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 91.181540][ T27] audit: type=1400 audit(1579478146.129:41): avc: denied { map } for pid=10707 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.122' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 97.951552][ T27] audit: type=1400 audit(1579478152.899:42): avc: denied { map } for pid=10719 comm="syz-executor663" path="/root/syz-executor663197195" dev="sda1" ino=16483 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 97.978994][ T27] audit: type=1400 audit(1579478152.909:43): avc: denied { create } for pid=10720 comm="syz-executor663" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 98.004510][ T27] audit: type=1400 audit(1579478152.909:44): avc: denied { write } for pid=10720 comm="syz-executor663" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 98.962438][ C0] ================================================================== [ 98.970707][ C0] BUG: KASAN: slab-out-of-bounds in bitmap_port_gc+0x112/0x4f0 [ 98.980238][ C0] Read of size 8 at addr ffff88809a0e6640 by task syz-executor663/10719 [ 98.988546][ C0] [ 98.990865][ C0] CPU: 0 PID: 10719 Comm: syz-executor663 Not tainted 5.5.0-rc6-syzkaller #0 [ 98.999760][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 99.009902][ C0] Call Trace: [ 99.013207][ C0] [ 99.016057][ C0] dump_stack+0x197/0x210 [ 99.020399][ C0] ? bitmap_port_gc+0x112/0x4f0 [ 99.025236][ C0] print_address_description.constprop.0.cold+0xd4/0x30b [ 99.032273][ C0] ? bitmap_port_gc+0x112/0x4f0 [ 99.037130][ C0] ? bitmap_port_gc+0x112/0x4f0 [ 99.041966][ C0] __kasan_report.cold+0x1b/0x41 [ 99.046922][ C0] ? bitmap_port_gc+0x112/0x4f0 [ 99.051767][ C0] kasan_report+0x12/0x20 [ 99.056148][ C0] check_memory_region+0x134/0x1a0 [ 99.061251][ C0] __kasan_check_read+0x11/0x20 [ 99.066093][ C0] bitmap_port_gc+0x112/0x4f0 [ 99.070775][ C0] call_timer_fn+0x1ac/0x780 [ 99.075357][ C0] ? bitmap_port_test+0x170/0x170 [ 99.080386][ C0] ? msleep_interruptible+0x150/0x150 [ 99.085806][ C0] ? run_timer_softirq+0x6b1/0x1790 [ 99.091091][ C0] ? trace_hardirqs_on+0x67/0x240 [ 99.096112][ C0] ? bitmap_port_test+0x170/0x170 [ 99.101133][ C0] ? bitmap_port_test+0x170/0x170 [ 99.106258][ C0] run_timer_softirq+0x6c3/0x1790 [ 99.111282][ C0] ? add_timer+0x930/0x930 [ 99.115711][ C0] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 99.121863][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 99.127490][ C0] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 99.133498][ C0] ? trace_hardirqs_on+0x67/0x240 [ 99.138518][ C0] __do_softirq+0x262/0x98c [ 99.143005][ C0] ? sched_clock_cpu+0x1b/0x1b0 [ 99.147938][ C0] irq_exit+0x19b/0x1e0 [ 99.152090][ C0] smp_apic_timer_interrupt+0x1a3/0x610 [ 99.157690][ C0] apic_timer_interrupt+0xf/0x20 [ 99.162664][ C0] [ 99.165589][ C0] RIP: 0010:do_nanosleep+0x0/0x640 [ 99.170690][ C0] Code: c7 43 10 02 04 00 00 4c 89 e7 e8 8b f1 ff ff 5b 41 5c 5d c3 e8 91 b1 de f9 eb b5 e8 8a b1 de f9 eb dd cc cc cc cc cc cc cc cc <55> 48 89 e5 41 57 41 56 41 55 41 89 f5 41 54 49 bc 00 00 00 00 00 [ 99.190677][ C0] RSP: 0018:ffffc90001fd7d70 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13 [ 99.199194][ C0] RAX: 0000000000100590 RBX: 000000000000c350 RCX: ffffffff816566c4 [ 99.207158][ C0] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffc90001fd7dc0 [ 99.215232][ C0] RBP: ffffc90001fd7e78 R08: ffff8880a24fe2c0 R09: ffffc90001fd7dc0 [ 99.223195][ C0] R10: fffff520003fafbf R11: ffffc90001fd7dff R12: 0000000000100590 [ 99.231300][ C0] R13: 0000000000000001 R14: ffffc90001fd7e50 R15: ffffc90001fd7dc0 [ 99.239353][ C0] ? hrtimer_nanosleep+0x264/0x550 [ 99.244737][ C0] ? hrtimer_nanosleep+0x297/0x550 [ 99.249840][ C0] ? nanosleep_copyout+0x110/0x110 [ 99.254965][ C0] ? hrtimer_init_sleeper_on_stack+0xa0/0xa0 [ 99.261039][ C0] __x64_sys_nanosleep+0x1a6/0x220 [ 99.266148][ C0] ? hrtimer_nanosleep+0x550/0x550 [ 99.271252][ C0] ? do_syscall_64+0x26/0x790 [ 99.276013][ C0] ? lockdep_hardirqs_on+0x421/0x5e0 [ 99.281295][ C0] ? trace_hardirqs_on+0x67/0x240 [ 99.286322][ C0] do_syscall_64+0xfa/0x790 [ 99.290829][ C0] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 99.296715][ C0] RIP: 0033:0x46bf80 [ 99.300600][ C0] Code: 05 48 3d 01 f0 ff ff 0f 83 dd 5d f9 ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 3d 11 6c 26 00 00 75 14 b8 23 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 b4 5d f9 ff c3 48 83 ec 08 e8 6a 7e fd ff [ 99.320260][ C0] RSP: 002b:00007ffce47b4a18 EFLAGS: 00000246 ORIG_RAX: 0000000000000023 [ 99.328734][ C0] RAX: ffffffffffffffda RBX: 0000000000002b1f RCX: 000000000046bf80 [ 99.336783][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffce47b4a20 [ 99.344748][ C0] RBP: 0000000000018275 R08: 0000000000000000 R09: 00000000025d2880 [ 99.352715][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004021c0 [ 99.360736][ C0] R13: 0000000000402250 R14: 0000000000000000 R15: 0000000000000000 [ 99.368716][ C0] [ 99.371126][ C0] Allocated by task 10720: [ 99.375540][ C0] save_stack+0x23/0x90 [ 99.379687][ C0] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 99.385310][ C0] kasan_kmalloc+0x9/0x10 [ 99.389718][ C0] __kmalloc+0x163/0x770 [ 99.393950][ C0] ip_set_alloc+0x38/0x5e [ 99.398272][ C0] bitmap_port_create+0x3dc/0x7c0 [ 99.403285][ C0] ip_set_create+0x6f1/0x1500 [ 99.407998][ C0] nfnetlink_rcv_msg+0xcf2/0xfb0 [ 99.413056][ C0] netlink_rcv_skb+0x177/0x450 [ 99.417929][ C0] nfnetlink_rcv+0x1ba/0x460 [ 99.422506][ C0] netlink_unicast+0x58c/0x7d0 [ 99.427268][ C0] netlink_sendmsg+0x91c/0xea0 [ 99.432023][ C0] sock_sendmsg+0xd7/0x130 [ 99.436424][ C0] ____sys_sendmsg+0x753/0x880 [ 99.441233][ C0] ___sys_sendmsg+0x100/0x170 [ 99.445904][ C0] __sys_sendmsg+0x105/0x1d0 [ 99.450487][ C0] __x64_sys_sendmsg+0x78/0xb0 [ 99.455365][ C0] do_syscall_64+0xfa/0x790 [ 99.460012][ C0] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 99.465884][ C0] [ 99.468195][ C0] Freed by task 10492: [ 99.472777][ C0] save_stack+0x23/0x90 [ 99.476961][ C0] __kasan_slab_free+0x102/0x150 [ 99.481913][ C0] kasan_slab_free+0xe/0x10 [ 99.486410][ C0] kfree+0x10a/0x2c0 [ 99.490296][ C0] tomoyo_supervisor+0xc2c/0xef0 [ 99.495222][ C0] tomoyo_env_perm+0x18e/0x210 [ 99.499987][ C0] tomoyo_find_next_domain+0x1354/0x1f6c [ 99.505610][ C0] tomoyo_bprm_check_security+0x124/0x1a0 [ 99.511678][ C0] security_bprm_check+0x63/0xb0 [ 99.516609][ C0] search_binary_handler+0x71/0x570 [ 99.521792][ C0] __do_execve_file.isra.0+0x1329/0x22b0 [ 99.527416][ C0] __x64_sys_execve+0x8f/0xc0 [ 99.532191][ C0] do_syscall_64+0xfa/0x790 [ 99.536699][ C0] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 99.542571][ C0] [ 99.544890][ C0] The buggy address belongs to the object at ffff88809a0e6640 [ 99.544890][ C0] which belongs to the cache kmalloc-32 of size 32 [ 99.558878][ C0] The buggy address is located 0 bytes inside of [ 99.558878][ C0] 32-byte region [ffff88809a0e6640, ffff88809a0e6660) [ 99.571889][ C0] The buggy address belongs to the page: [ 99.577550][ C0] page:ffffea0002683980 refcount:1 mapcount:0 mapping:ffff8880aa4001c0 index:0xffff88809a0e6fc1 [ 99.588180][ C0] raw: 00fffe0000000200 ffffea000285a908 ffffea00028c9308 ffff8880aa4001c0 [ 99.596830][ C0] raw: ffff88809a0e6fc1 ffff88809a0e6000 0000000100000030 0000000000000000 [ 99.605400][ C0] page dumped because: kasan: bad access detected [ 99.611802][ C0] [ 99.614113][ C0] Memory state around the buggy address: [ 99.619759][ C0] ffff88809a0e6500: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 99.627809][ C0] ffff88809a0e6580: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 99.635857][ C0] >ffff88809a0e6600: fb fb fb fb fc fc fc fc 04 fc fc fc fc fc fc fc [ 99.644024][ C0] ^ [ 99.650168][ C0] ffff88809a0e6680: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 99.658219][ C0] ffff88809a0e6700: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 99.666266][ C0] ================================================================== [ 99.674406][ C0] Disabling lock debugging due to kernel taint [ 99.680595][ C0] Kernel panic - not syncing: panic_on_warn set ... [ 99.687454][ C0] CPU: 0 PID: 10719 Comm: syz-executor663 Tainted: G B 5.5.0-rc6-syzkaller #0 [ 99.697578][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 99.707614][ C0] Call Trace: [ 99.710884][ C0] [ 99.713741][ C0] dump_stack+0x197/0x210 [ 99.718161][ C0] panic+0x2e3/0x75c [ 99.722038][ C0] ? add_taint.cold+0x16/0x16 [ 99.726829][ C0] ? retint_kernel+0x2b/0x2b [ 99.731567][ C0] ? trace_hardirqs_on+0x5e/0x240 [ 99.737128][ C0] ? bitmap_port_gc+0x112/0x4f0 [ 99.741977][ C0] end_report+0x47/0x4f [ 99.746120][ C0] ? bitmap_port_gc+0x112/0x4f0 [ 99.751056][ C0] __kasan_report.cold+0xe/0x41 [ 99.755895][ C0] ? bitmap_port_gc+0x112/0x4f0 [ 99.760747][ C0] kasan_report+0x12/0x20 [ 99.765229][ C0] check_memory_region+0x134/0x1a0 [ 99.770331][ C0] __kasan_check_read+0x11/0x20 [ 99.775212][ C0] bitmap_port_gc+0x112/0x4f0 [ 99.779906][ C0] call_timer_fn+0x1ac/0x780 [ 99.784486][ C0] ? bitmap_port_test+0x170/0x170 [ 99.789635][ C0] ? msleep_interruptible+0x150/0x150 [ 99.795052][ C0] ? run_timer_softirq+0x6b1/0x1790 [ 99.800243][ C0] ? trace_hardirqs_on+0x67/0x240 [ 99.805256][ C0] ? bitmap_port_test+0x170/0x170 [ 99.810268][ C0] ? bitmap_port_test+0x170/0x170 [ 99.815298][ C0] run_timer_softirq+0x6c3/0x1790 [ 99.820312][ C0] ? add_timer+0x930/0x930 [ 99.824740][ C0] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 99.830896][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 99.836425][ C0] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 99.842656][ C0] ? trace_hardirqs_on+0x67/0x240 [ 99.847828][ C0] __do_softirq+0x262/0x98c [ 99.852325][ C0] ? sched_clock_cpu+0x1b/0x1b0 [ 99.857161][ C0] irq_exit+0x19b/0x1e0 [ 99.861346][ C0] smp_apic_timer_interrupt+0x1a3/0x610 [ 99.866905][ C0] apic_timer_interrupt+0xf/0x20 [ 99.871826][ C0] [ 99.874766][ C0] RIP: 0010:do_nanosleep+0x0/0x640 [ 99.879866][ C0] Code: c7 43 10 02 04 00 00 4c 89 e7 e8 8b f1 ff ff 5b 41 5c 5d c3 e8 91 b1 de f9 eb b5 e8 8a b1 de f9 eb dd cc cc cc cc cc cc cc cc <55> 48 89 e5 41 57 41 56 41 55 41 89 f5 41 54 49 bc 00 00 00 00 00 [ 99.899576][ C0] RSP: 0018:ffffc90001fd7d70 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13 [ 99.907984][ C0] RAX: 0000000000100590 RBX: 000000000000c350 RCX: ffffffff816566c4 [ 99.915952][ C0] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffc90001fd7dc0 [ 99.923919][ C0] RBP: ffffc90001fd7e78 R08: ffff8880a24fe2c0 R09: ffffc90001fd7dc0 [ 99.932657][ C0] R10: fffff520003fafbf R11: ffffc90001fd7dff R12: 0000000000100590 [ 99.940666][ C0] R13: 0000000000000001 R14: ffffc90001fd7e50 R15: ffffc90001fd7dc0 [ 99.948634][ C0] ? hrtimer_nanosleep+0x264/0x550 [ 99.953737][ C0] ? hrtimer_nanosleep+0x297/0x550 [ 99.958838][ C0] ? nanosleep_copyout+0x110/0x110 [ 99.963961][ C0] ? hrtimer_init_sleeper_on_stack+0xa0/0xa0 [ 99.969934][ C0] __x64_sys_nanosleep+0x1a6/0x220 [ 99.975032][ C0] ? hrtimer_nanosleep+0x550/0x550 [ 99.980130][ C0] ? do_syscall_64+0x26/0x790 [ 99.984842][ C0] ? lockdep_hardirqs_on+0x421/0x5e0 [ 99.990110][ C0] ? trace_hardirqs_on+0x67/0x240 [ 99.995124][ C0] do_syscall_64+0xfa/0x790 [ 99.999734][ C0] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 100.005610][ C0] RIP: 0033:0x46bf80 [ 100.009524][ C0] Code: 05 48 3d 01 f0 ff ff 0f 83 dd 5d f9 ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 3d 11 6c 26 00 00 75 14 b8 23 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 b4 5d f9 ff c3 48 83 ec 08 e8 6a 7e fd ff [ 100.029117][ C0] RSP: 002b:00007ffce47b4a18 EFLAGS: 00000246 ORIG_RAX: 0000000000000023 [ 100.037874][ C0] RAX: ffffffffffffffda RBX: 0000000000002b1f RCX: 000000000046bf80 [ 100.046500][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffce47b4a20 [ 100.054570][ C0] RBP: 0000000000018275 R08: 0000000000000000 R09: 00000000025d2880 [ 100.062524][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004021c0 [ 100.070481][ C0] R13: 0000000000402250 R14: 0000000000000000 R15: 0000000000000000 [ 100.080149][ C0] Kernel Offset: disabled [ 100.084529][ C0] Rebooting in 86400 seconds..