[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 35.821370][ T25] audit: type=1800 audit(1571854471.659:25): pid=7103 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2447 res=0 [ 35.873908][ T25] audit: type=1800 audit(1571854471.659:26): pid=7103 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2490 res=0 [ 35.894333][ T25] audit: type=1800 audit(1571854471.659:27): pid=7103 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2469 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.39' (ECDSA) to the list of known hosts. 2019/10/23 18:14:43 fuzzer started 2019/10/23 18:14:44 dialing manager at 10.128.0.105:40369 2019/10/23 18:14:45 syscalls: 2524 2019/10/23 18:14:45 code coverage: enabled 2019/10/23 18:14:45 comparison tracing: enabled 2019/10/23 18:14:45 extra coverage: extra coverage is not supported by the kernel 2019/10/23 18:14:45 setuid sandbox: enabled 2019/10/23 18:14:45 namespace sandbox: enabled 2019/10/23 18:14:45 Android sandbox: /sys/fs/selinux/policy does not exist 2019/10/23 18:14:45 fault injection: enabled 2019/10/23 18:14:45 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/10/23 18:14:45 net packet injection: enabled 2019/10/23 18:14:45 net device setup: enabled 2019/10/23 18:14:45 concurrency sanitizer: enabled syzkaller login: [ 58.919047][ T7274] KCSAN: could not find function: 'poll_schedule_timeout' 2019/10/23 18:14:59 adding functions to KCSAN blacklist: 'handle_mm_fault' 'generic_fillattr' 'ep_poll' 'dd_has_work' '__filemap_fdatawrite_range' 'pipe_wait' 'do_writev' 'tcp_add_backlog' 'tick_do_update_jiffies64' 'ext4_writepages' 'kauditd_thread' 'do_wait' 'ns_capable_common' 'pcpu_alloc' 'generic_permission' 'ktime_get_real_seconds' 'echo_char' 'find_next_bit' 'ext4_nonda_switch' 'kvm_arch_vcpu_load' '__alloc_file' 'tomoyo_supervisor' 'enqueue_timer' 'ksys_read' 'mm_update_next_owner' '__hrtimer_run_queues' 'blk_mq_get_request' 'update_defense_level' 'timer_clear_idle' 'balance_dirty_pages' 'blk_mq_run_hw_queue' 'find_get_pages_range_tag' 'wbt_issue' '__skb_wait_for_more_packets' '__snd_rawmidi_transmit_ack' 'generic_write_end' 'ext4_free_inode' 'do_nanosleep' 'futex_wait_queue_me' 'shmem_file_read_iter' 'wbc_detach_inode' '__mark_inode_dirty' 'taskstats_exit' 'ktime_get_seconds' 'snapshot_refaults' 'mem_cgroup_select_victim_node' 'pid_update_inode' 'vm_area_dup' 'mod_timer' 'ext4_mb_good_group' 'rcu_gp_fqs_loop' '__writeback_single_inode' 'blk_mq_dispatch_rq_list' 'rcu_gp_fqs_check_wake' 'blk_mq_sched_dispatch_requests' 'pipe_poll' 'ext4_has_free_clusters' 'vti_tunnel_xmit' '__splice_from_pipe' 'poll_schedule_timeout' 'icmp_global_allow' 'xas_find_marked' '__nf_conntrack_find_get' 'add_timer' 'tick_nohz_idle_stop_tick' 'page_counter_try_charge' 'tick_sched_do_timer' '__ext4_new_inode' 'copy_process' 'run_timer_softirq' 'common_perm_cond' 'sit_tunnel_xmit' 'commit_echoes' 'handle_userfault' 'do_syslog' 'list_lru_count_one' 'ext4_free_inodes_count' '__nf_ct_refresh_acct' 'fanotify_handle_event' 'atime_needs_update' 'tcp_poll' 18:18:57 executing program 0: r0 = perf_event_open(&(0x7f0000000280)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuacct.usage_sys\x00\xc7\xec\xac\xd9&{\x0f\x96\xad\xd1\x8fl![\x8f\xb9\f\xca\x1d\xc2{\xee\xb7\x03K\x0f\xa6\xaa;\xf6\x89\xf7b^\xa5\xafI\r\xc4\x9f\v\xf2\x1c\xdc\xddp2\xb7\xbb\x1b\xfev\xea\xed\xe0\xaa\xe8\xceR`\xbb\xf2\xed;pC\x19\xbfn\x16\xaa\x199\xfe.Q\xebvB\xd2\x19&l?\x87\x17H\x1f.\xdbA\x1b\xafz\xe3\xdc};*\xec\xfe\xfa\xfb/\x18g\x80y\xfe\x89', 0x26e1, 0x0) close(r0) close(r1) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)) write$cgroup_type(r1, 0x0, 0x0) write$cgroup_type(r1, &(0x7f0000000440)='threaded\x00', 0x9) recvmsg(r0, &(0x7f0000000140)={0x0, 0x1d, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/110, 0x1060841d}], 0x1, 0x0, 0xf601}, 0x0) [ 301.507134][ T7261] ================================================================== [ 301.515296][ T7261] BUG: KCSAN: data-race in tomoyo_domain_quota_is_ok / tomoyo_merge_path_acl [ 301.524044][ T7261] [ 301.526376][ T7261] write to 0xffff8881266e12da of 2 bytes by task 7276 on cpu 1: [ 301.534018][ T7261] tomoyo_merge_path_acl+0x6c/0xa0 [ 301.539127][ T7261] tomoyo_update_domain+0x323/0x450 [ 301.544319][ T7261] tomoyo_write_file+0x34e/0x580 [ 301.549403][ T7261] tomoyo_write_domain2+0xad/0x120 [ 301.554521][ T7261] tomoyo_supervisor+0xad7/0xd20 [ 301.559454][ T7261] tomoyo_path_permission+0x121/0x160 [ 301.564988][ T7261] tomoyo_check_open_permission+0x2b9/0x320 [ 301.570871][ T7261] tomoyo_file_open+0x75/0x90 [ 301.575534][ T7261] security_file_open+0x69/0x210 [ 301.580461][ T7261] do_dentry_open+0x20a/0x8f0 [ 301.585134][ T7261] vfs_open+0x62/0x80 [ 301.589139][ T7261] path_openat+0xf75/0x36e0 [ 301.593637][ T7261] do_filp_open+0x11e/0x1b0 [ 301.598131][ T7261] do_sys_open+0x3b3/0x4f0 [ 301.602526][ T7261] [ 301.604849][ T7261] read to 0xffff8881266e12da of 2 bytes by task 7261 on cpu 0: [ 301.612382][ T7261] tomoyo_domain_quota_is_ok+0x29c/0x2b0 [ 301.618019][ T7261] tomoyo_supervisor+0x22b/0xd20 [ 301.622947][ T7261] tomoyo_path_number_perm+0x323/0x3c0 [ 301.628394][ T7261] tomoyo_path_mkdir+0x6e/0xa0 [ 301.633145][ T7261] security_path_mkdir+0xb8/0xf0 [ 301.638067][ T7261] do_mkdirat+0xef/0x1f0 [ 301.642293][ T7261] __x64_sys_mkdirat+0x4d/0x60 [ 301.647047][ T7261] do_syscall_64+0xcc/0x370 [ 301.651551][ T7261] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 301.657420][ T7261] [ 301.659728][ T7261] Reported by Kernel Concurrency Sanitizer on: [ 301.665874][ T7261] CPU: 0 PID: 7261 Comm: syz-fuzzer Not tainted 5.4.0-rc3+ #0 [ 301.673312][ T7261] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 301.683349][ T7261] ================================================================== [ 301.691394][ T7261] Kernel panic - not syncing: panic_on_warn set ... [ 301.697970][ T7261] CPU: 0 PID: 7261 Comm: syz-fuzzer Not tainted 5.4.0-rc3+ #0 [ 301.705409][ T7261] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 301.715457][ T7261] Call Trace: [ 301.718746][ T7261] dump_stack+0xf5/0x159 [ 301.722988][ T7261] panic+0x210/0x640 [ 301.726870][ T7261] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 301.732928][ T7261] ? vprintk_func+0x8d/0x140 [ 301.737525][ T7261] kcsan_report.cold+0xc/0x10 [ 301.742195][ T7261] __kcsan_setup_watchpoint+0x32e/0x4a0 [ 301.747734][ T7261] __tsan_read2+0x2c/0x30 [ 301.752056][ T7261] tomoyo_domain_quota_is_ok+0x29c/0x2b0 [ 301.757681][ T7261] tomoyo_supervisor+0x22b/0xd20 [ 301.762636][ T7261] tomoyo_path_number_perm+0x323/0x3c0 [ 301.768118][ T7261] ? __kcsan_setup_watchpoint+0x6b/0x4a0 [ 301.773746][ T7261] tomoyo_path_mkdir+0x6e/0xa0 [ 301.778511][ T7261] security_path_mkdir+0xb8/0xf0 [ 301.783449][ T7261] do_mkdirat+0xef/0x1f0 [ 301.787688][ T7261] __x64_sys_mkdirat+0x4d/0x60 [ 301.792555][ T7261] do_syscall_64+0xcc/0x370 [ 301.797057][ T7261] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 301.802947][ T7261] RIP: 0033:0x47c530 [ 301.806959][ T7261] Code: 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 49 c7 c2 00 00 00 00 49 c7 c0 00 00 00 00 49 c7 c1 00 00 00 00 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30 [ 301.826701][ T7261] RSP: 002b:000000c43df0d990 EFLAGS: 00000206 ORIG_RAX: 0000000000000102 [ 301.835108][ T7261] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000047c530 [ 301.843245][ T7261] RDX: 00000000000001c0 RSI: 000000c43bf1a0c0 RDI: ffffffffffffff9c [ 301.852671][ T7261] RBP: 000000c43df0d9f0 R08: 0000000000000000 R09: 0000000000000000 [ 301.861431][ T7261] R10: 0000000000000000 R11: 0000000000000206 R12: ffffffffffffffff [ 301.869772][ T7261] R13: 0000000000000007 R14: 0000000000000006 R15: 0000000000000100 [ 301.880088][ T7261] Kernel Offset: disabled [ 301.884434][ T7261] Rebooting in 86400 seconds..