Starting sshd: OK syzkaller syzkaller login: [ 7.135113][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!! [ 14.329618][ T23] kauditd_printk_skb: 60 callbacks suppressed [ 14.329630][ T23] audit: type=1400 audit(1636547680.779:71): avc: denied { transition } for pid=291 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.335690][ T23] audit: type=1400 audit(1636547680.779:72): avc: denied { write } for pid=291 comm="sh" path="pipe:[369]" dev="pipefs" ino=369 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1 [ 15.305154][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #280!!! Warning: Permanently added '10.128.1.87' (ECDSA) to the list of known hosts. 2021/11/10 12:34:48 fuzzer started 2021/11/10 12:34:48 connecting to host at 10.128.0.163:38571 2021/11/10 12:34:48 checking machine... 2021/11/10 12:34:48 checking revisions... 2021/11/10 12:34:48 testing simple program... [ 21.844938][ T23] audit: type=1400 audit(1636547688.289:73): avc: denied { getattr } for pid=363 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 21.868690][ T23] audit: type=1400 audit(1636547688.299:74): avc: denied { read } for pid=363 comm="syz-fuzzer" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 21.870336][ T372] cgroup: Unknown subsys name 'net' [ 21.890582][ T23] audit: type=1400 audit(1636547688.299:75): avc: denied { open } for pid=363 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 21.919677][ T23] audit: type=1400 audit(1636547688.309:76): avc: denied { read } for pid=363 comm="syz-fuzzer" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.919892][ T372] cgroup: Unknown subsys name 'devices' [ 21.943848][ T23] audit: type=1400 audit(1636547688.309:77): avc: denied { open } for pid=363 comm="syz-fuzzer" path="/dev/raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.973073][ T23] audit: type=1400 audit(1636547688.319:78): avc: denied { mounton } for pid=372 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1136 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.996548][ T23] audit: type=1400 audit(1636547688.319:79): avc: denied { mount } for pid=372 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.020297][ T23] audit: type=1400 audit(1636547688.349:80): avc: denied { unmount } for pid=372 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.126831][ T372] cgroup: Unknown subsys name 'hugetlb' [ 22.133271][ T372] cgroup: Unknown subsys name 'rlimit' [ 22.236176][ T23] audit: type=1400 audit(1636547688.689:81): avc: denied { setattr } for pid=372 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.273215][ T23] audit: type=1400 audit(1636547688.719:82): avc: denied { execmem } for pid=373 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 22.373091][ T374] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.381272][ T374] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.389047][ T374] device bridge_slave_0 entered promiscuous mode [ 22.396527][ T374] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.403986][ T374] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.412499][ T374] device bridge_slave_1 entered promiscuous mode [ 22.449613][ T374] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.457556][ T374] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.465285][ T374] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.472610][ T374] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.493516][ T74] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.501807][ T74] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.509565][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 22.517959][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.528693][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.539518][ T24] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.547349][ T24] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.565926][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.575372][ T24] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.582770][ T24] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.591138][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.599864][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.611454][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.623499][ T109] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.637626][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.650899][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.660760][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.677255][ T380] ================================================================================ [ 22.686877][ T380] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:2023:28 [ 22.694857][ T380] member access within address ffffc90000cb71c0 with insufficient space [ 22.705075][ T380] for an object of type 'struct sk_buff' [ 22.710718][ T380] CPU: 1 PID: 380 Comm: kworker/1:3 Not tainted 5.10.78-syzkaller-01155-gbb235e8cc2b6 #0 [ 22.720520][ T380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 22.730974][ T380] Workqueue: ipv6_addrconf addrconf_dad_work [ 22.737037][ T380] Call Trace: [ 22.740419][ T380] dump_stack_lvl+0x1e2/0x24b [ 22.745363][ T380] ? show_regs_print_info+0x18/0x18 [ 22.750993][ T380] ? wg_allowedips_lookup_dst+0x190/0x190 [ 22.757351][ T380] dump_stack+0x15/0x1d [ 22.761587][ T380] ubsan_type_mismatch_common+0x1ed/0x3a0 [ 22.767385][ T380] ? __sanitizer_cov_trace_switch+0x74/0x90 [ 22.773258][ T380] __ubsan_handle_type_mismatch_v1+0x5b/0x70 [ 22.779480][ T380] wg_xmit+0x4a2/0xae0 [ 22.783554][ T380] ? wg_stop+0x140/0x140 [ 22.788158][ T380] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20 [ 22.794692][ T380] netdev_start_xmit+0x8a/0x160 [ 22.799806][ T380] dev_hard_start_xmit+0x18d/0x2f0 [ 22.805016][ T380] __dev_queue_xmit+0xfbe/0x1bb0 [ 22.810221][ T380] ? dev_queue_xmit+0x20/0x20 [ 22.815081][ T380] ? __local_bh_enable_ip+0xa8/0x170 [ 22.820452][ T380] ? do_raw_spin_unlock+0x50/0x50 [ 22.826186][ T380] ? _local_bh_enable+0x30/0x30 [ 22.831045][ T380] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 22.838595][ T380] ? ndisc_constructor+0x690/0x8a0 [ 22.843840][ T380] ? _raw_write_unlock_bh+0x31/0x47 [ 22.849397][ T380] ? dev_hard_header+0xdb/0xf0 [ 22.854268][ T380] dev_queue_xmit+0x17/0x20 [ 22.858787][ T380] neigh_connected_output+0x288/0x2b0 [ 22.864258][ T380] ip6_finish_output2+0xde2/0x1440 [ 22.869643][ T380] ? __rcu_read_lock+0x50/0x50 [ 22.874755][ T380] ? __ip6_finish_output+0x520/0x520 [ 22.880169][ T380] ? dst_cow_metrics_generic+0x55/0x1d0 [ 22.885856][ T380] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 22.892534][ T380] ? ip6_skb_dst_mtu+0xaf/0x260 [ 22.897472][ T380] __ip6_finish_output+0x3e4/0x520 [ 22.902763][ T380] ip6_finish_output+0x3f/0x220 [ 22.907787][ T380] ? ip6_output+0x1d3/0x4b0 [ 22.912382][ T380] ip6_output+0x1f8/0x4b0 [ 22.916974][ T380] ? asan.module_dtor+0x20/0x20 [ 22.921806][ T380] ? skb_dst+0x40/0x40 [ 22.926021][ T380] ? __rcu_read_lock+0x50/0x50 [ 22.931246][ T380] ? selinux_ipv6_forward+0x50/0x50 [ 22.936768][ T380] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 22.942856][ T380] ? nf_hook_slow+0x150/0x1b0 [ 22.947877][ T380] NF_HOOK+0xdd/0x280 [ 22.952308][ T380] ? addrconf_addr_solict_mult+0xe0/0xe0 [ 22.959072][ T380] ? NF_HOOK+0x280/0x280 [ 22.963314][ T380] ? __rcu_read_lock+0x50/0x50 [ 22.968353][ T380] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 22.974787][ T380] ? ndisc_send_skb+0x547/0x9f0 [ 22.979630][ T380] ? memcpy+0x56/0x70 [ 22.983609][ T380] ndisc_send_skb+0x646/0x9f0 [ 22.988766][ T380] ? slab_post_alloc_hook+0x90/0xa0 [ 22.994424][ T380] ? ndisc_fill_addr_option+0x2f0/0x2f0 [ 23.000977][ T380] ? skb_set_owner_w+0x1a8/0x310 [ 23.006576][ T380] ? __sanitizer_cov_trace_cmp4+0x19/0x20 [ 23.012408][ T380] ? skb_put+0x11d/0x200 [ 23.017927][ T380] ndisc_send_rs+0x26c/0x360 [ 23.022630][ T380] addrconf_dad_completed+0x4f3/0x9f0 [ 23.028117][ T380] ? addrconf_dad_stop+0x430/0x430 [ 23.033752][ T380] ? psi_task_switch+0x1f7/0x3b0 [ 23.038675][ T380] addrconf_dad_work+0x9c1/0x1520 [ 23.043854][ T380] ? ipv6_use_optimistic_addr+0x1d0/0x1d0 [ 23.049833][ T380] ? __kasan_check_write+0x14/0x20 [ 23.055200][ T380] process_one_work+0x3ca/0x660 [ 23.060121][ T380] worker_thread+0x709/0xa20 [ 23.064710][ T380] ? __kthread_parkme+0x11b/0x150 [ 23.069774][ T380] kthread+0x371/0x390 [ 23.073935][ T380] ? pr_cont_work+0x110/0x110 [ 23.078870][ T380] ? __list_add+0xc0/0xc0 [ 23.083196][ T380] ret_from_fork+0x1f/0x30 [ 23.088235][ T380] ================================================================================ [ 23.098170][ T380] ================================================================================ [ 23.107773][ T380] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:1916:2 [ 23.116183][ T380] member access within address ffffc90000cb71c0 with insufficient space [ 23.124752][ T380] for an object of type 'struct sk_buff' [ 23.130509][ T380] CPU: 1 PID: 380 Comm: kworker/1:3 Not tainted 5.10.78-syzkaller-01155-gbb235e8cc2b6 #0 [ 23.140800][ T380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 23.151273][ T380] Workqueue: ipv6_addrconf addrconf_dad_work [ 23.157781][ T380] Call Trace: [ 23.161278][ T380] dump_stack_lvl+0x1e2/0x24b [ 23.165950][ T380] ? show_regs_print_info+0x18/0x18 [ 23.171158][ T380] ? wg_allowedips_lookup_dst+0x190/0x190 [ 23.176892][ T380] dump_stack+0x15/0x1d [ 23.181270][ T380] ubsan_type_mismatch_common+0x1ed/0x3a0 [ 23.187576][ T380] __ubsan_handle_type_mismatch_v1+0x5b/0x70 [ 23.193644][ T380] wg_xmit+0x513/0xae0 [ 23.197717][ T380] ? wg_stop+0x140/0x140 [ 23.202016][ T380] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20 [ 23.208448][ T380] netdev_start_xmit+0x8a/0x160 [ 23.213560][ T380] dev_hard_start_xmit+0x18d/0x2f0 [ 23.219357][ T380] __dev_queue_xmit+0xfbe/0x1bb0 [ 23.224401][ T380] ? dev_queue_xmit+0x20/0x20 [ 23.229508][ T380] ? __local_bh_enable_ip+0xa8/0x170 [ 23.234860][ T380] ? do_raw_spin_unlock+0x50/0x50 [ 23.240119][ T380] ? _local_bh_enable+0x30/0x30 [ 23.245013][ T380] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 23.251854][ T380] ? ndisc_constructor+0x690/0x8a0 [ 23.257530][ T380] ? _raw_write_unlock_bh+0x31/0x47 [ 23.262837][ T380] ? dev_hard_header+0xdb/0xf0 [ 23.267969][ T380] dev_queue_xmit+0x17/0x20 [ 23.272743][ T380] neigh_connected_output+0x288/0x2b0 [ 23.278536][ T380] ip6_finish_output2+0xde2/0x1440 [ 23.283665][ T380] ? __rcu_read_lock+0x50/0x50 [ 23.288785][ T380] ? __ip6_finish_output+0x520/0x520 [ 23.294457][ T380] ? dst_cow_metrics_generic+0x55/0x1d0 [ 23.300350][ T380] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 23.306925][ T380] ? ip6_skb_dst_mtu+0xaf/0x260 [ 23.313113][ T380] __ip6_finish_output+0x3e4/0x520 [ 23.318759][ T380] ip6_finish_output+0x3f/0x220 [ 23.324025][ T380] ? ip6_output+0x1d3/0x4b0 [ 23.328542][ T380] ip6_output+0x1f8/0x4b0 [ 23.332878][ T380] ? asan.module_dtor+0x20/0x20 [ 23.337720][ T380] ? skb_dst+0x40/0x40 [ 23.341770][ T380] ? __rcu_read_lock+0x50/0x50 [ 23.347211][ T380] ? selinux_ipv6_forward+0x50/0x50 [ 23.353324][ T380] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 23.359824][ T380] ? nf_hook_slow+0x150/0x1b0 [ 23.364925][ T380] NF_HOOK+0xdd/0x280 [ 23.369183][ T380] ? addrconf_addr_solict_mult+0xe0/0xe0 [ 23.375016][ T380] ? NF_HOOK+0x280/0x280 [ 23.379827][ T380] ? __rcu_read_lock+0x50/0x50 [ 23.384858][ T380] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 23.391874][ T380] ? ndisc_send_skb+0x547/0x9f0 [ 23.397248][ T380] ? memcpy+0x56/0x70 [ 23.401229][ T380] ndisc_send_skb+0x646/0x9f0 [ 23.405913][ T380] ? slab_post_alloc_hook+0x90/0xa0 [ 23.411335][ T380] ? ndisc_fill_addr_option+0x2f0/0x2f0 [ 23.417066][ T380] ? skb_set_owner_w+0x1a8/0x310 [ 23.422099][ T380] ? __sanitizer_cov_trace_cmp4+0x19/0x20 [ 23.428381][ T380] ? skb_put+0x11d/0x200 [ 23.432814][ T380] ndisc_send_rs+0x26c/0x360 [ 23.437590][ T380] addrconf_dad_completed+0x4f3/0x9f0 [ 23.442964][ T380] ? addrconf_dad_stop+0x430/0x430 [ 23.448080][ T380] ? psi_task_switch+0x1f7/0x3b0 [ 23.453176][ T380] addrconf_dad_work+0x9c1/0x1520 [ 23.458313][ T380] ? ipv6_use_optimistic_addr+0x1d0/0x1d0 [ 23.464035][ T380] ? __kasan_check_write+0x14/0x20 [ 23.469176][ T380] process_one_work+0x3ca/0x660 [ 23.474213][ T380] worker_thread+0x709/0xa20 [ 23.478893][ T380] ? __kthread_parkme+0x11b/0x150 [ 23.483914][ T380] kthread+0x371/0x390 [ 23.488148][ T380] ? pr_cont_work+0x110/0x110 [ 23.492965][ T380] ? __list_add+0xc0/0xc0 [ 23.497677][ T380] ret_from_fork+0x1f/0x30 2021/11/10 12:34:50 building call list... [ 23.502424][ T380] ================================================================================ [ 23.515403][ T374] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 24.125349][ T178] device bridge_slave_1 left promiscuous mode [ 24.131551][ T178] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.139933][ T178] device bridge_slave_0 left promiscuous mode [ 24.146537][ T178] bridge0: port 1(bridge_slave_0) entered disabled state