[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller[ 18.999809] audit: type=1400 audit(1520783473.973:6): avc: denied { map } for pid=4220 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.14' (ECDSA) to the list of known hosts. login: [ 25.318203] audit: type=1400 audit(1520783480.291:7): avc: denied { map } for pid=4234 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=16479 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2018/03/11 15:51:20 parsed 1 programs 2018/03/11 15:51:20 executed programs: 0 [ 25.570592] audit: type=1400 audit(1520783480.543:8): avc: denied { map } for pid=4234 comm="syz-execprog" path="/root/syzkaller-shm981966086" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 25.583926] IPVS: ftp: loaded support on port[0] = 21 [ 25.627244] ================================================================== [ 25.634650] BUG: KASAN: use-after-free in ucma_close+0x2d7/0x2f0 [ 25.640767] Read of size 8 at addr ffff8801aed78640 by task syz-executor0/4242 [ 25.648095] [ 25.649695] CPU: 0 PID: 4242 Comm: syz-executor0 Not tainted 4.16.0-rc4+ #259 [ 25.657380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 25.666707] Call Trace: [ 25.669268] dump_stack+0x194/0x24d [ 25.672870] ? arch_local_irq_restore+0x53/0x53 [ 25.677513] ? show_regs_print_info+0x18/0x18 [ 25.681982] ? save_stack+0xa3/0xd0 [ 25.685589] ? ucma_close+0x2d7/0x2f0 [ 25.689362] print_address_description+0x73/0x250 [ 25.694178] ? ucma_close+0x2d7/0x2f0 [ 25.697952] kasan_report+0x23c/0x360 [ 25.701727] __asan_report_load8_noabort+0x14/0x20 [ 25.706629] ucma_close+0x2d7/0x2f0 [ 25.710229] ? __might_sleep+0x95/0x190 [ 25.714185] ? ucma_free_ctx+0xd90/0xd90 [ 25.718220] __fput+0x327/0x7e0 [ 25.721506] ? fput+0x140/0x140 [ 25.724762] ? _raw_spin_unlock_irq+0x27/0x70 [ 25.729235] ____fput+0x15/0x20 [ 25.732487] task_work_run+0x199/0x270 [ 25.736349] ? task_work_cancel+0x210/0x210 [ 25.740643] ? _raw_spin_unlock+0x22/0x30 [ 25.744766] ? switch_task_namespaces+0x87/0xc0 [ 25.749412] do_exit+0x9bb/0x1ad0 [ 25.752839] ? ucma_create_id+0x45b/0x620 [ 25.756964] ? mm_update_next_owner+0x930/0x930 [ 25.761607] ? ucma_create_id+0x17b/0x620 [ 25.765729] ? ucma_get_event+0xa90/0xa90 [ 25.769857] ? __might_sleep+0x95/0x190 [ 25.773824] ? kasan_check_write+0x14/0x20 [ 25.778046] ? _copy_from_user+0x99/0x110 [ 25.782180] ? ucma_write+0x11f/0x3d0 [ 25.785952] ? ucma_get_event+0xa90/0xa90 [ 25.790077] ? ucma_resolve_route+0x1a0/0x1a0 [ 25.794554] ? ucma_resolve_route+0x1a0/0x1a0 [ 25.799025] ? __vfs_write+0xf7/0x970 [ 25.802806] ? rcu_note_context_switch+0x710/0x710 [ 25.807710] ? kernel_read+0x120/0x120 [ 25.811569] ? __might_sleep+0x95/0x190 [ 25.815516] ? _cond_resched+0x14/0x30 [ 25.819378] ? __inode_security_revalidate+0xd9/0x130 [ 25.824542] ? avc_policy_seqno+0x9/0x20 [ 25.828584] ? security_file_permission+0x89/0x1e0 [ 25.833497] ? compat_SyS_futex+0x288/0x380 [ 25.837788] ? vfs_write+0x224/0x510 [ 25.841478] do_group_exit+0x149/0x400 [ 25.845335] ? compat_SyS_get_robust_list+0x300/0x300 [ 25.850493] ? SyS_write+0x184/0x220 [ 25.854183] ? __do_page_fault+0x3d6/0xc90 [ 25.858388] ? SyS_exit+0x30/0x30 [ 25.861814] ? SyS_read+0x220/0x220 [ 25.865416] ? do_fast_syscall_32+0x156/0xf9f [ 25.869885] ? do_group_exit+0x400/0x400 [ 25.873919] SyS_exit_group+0x1d/0x20 [ 25.877694] do_fast_syscall_32+0x3ec/0xf9f [ 25.882003] ? do_int80_syscall_32+0x9c0/0x9c0 [ 25.886566] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 25.891297] ? syscall_return_slowpath+0x2ac/0x550 [ 25.896199] ? prepare_exit_to_usermode+0x350/0x350 [ 25.901187] ? sysret32_from_system_call+0x5/0x3c [ 25.906014] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 25.910848] entry_SYSENTER_compat+0x70/0x7f [ 25.915236] RIP: 0023:0xf7f35c99 [ 25.918571] RSP: 002b:00000000ff8540ac EFLAGS: 00000286 ORIG_RAX: 00000000000000fc [ 25.926249] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000000000 [ 25.933489] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 25.940727] RBP: 00000000080a2c25 R08: 0000000000000000 R09: 0000000000000000 [ 25.947967] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 25.955209] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 25.962464] [ 25.964066] Allocated by task 4242: [ 25.967667] save_stack+0x43/0xd0 [ 25.971094] kasan_kmalloc+0xad/0xe0 [ 25.974781] kmem_cache_alloc_trace+0x136/0x740 [ 25.979422] ucma_alloc_ctx+0xce/0x610 [ 25.983280] ucma_create_id+0x205/0x620 [ 25.987227] ucma_write+0x2d6/0x3d0 [ 25.990829] __vfs_write+0xef/0x970 [ 25.994430] vfs_write+0x189/0x510 [ 25.997940] SyS_write+0xef/0x220 [ 26.001363] do_fast_syscall_32+0x3ec/0xf9f [ 26.005654] entry_SYSENTER_compat+0x70/0x7f [ 26.010032] [ 26.011645] Freed by task 4242: [ 26.014902] save_stack+0x43/0xd0 [ 26.018332] __kasan_slab_free+0x11a/0x170 [ 26.022537] kasan_slab_free+0xe/0x10 [ 26.026308] kfree+0xd9/0x260 [ 26.029382] ucma_create_id+0x45b/0x620 [ 26.033326] ucma_write+0x2d6/0x3d0 [ 26.036923] __vfs_write+0xef/0x970 [ 26.040519] vfs_write+0x189/0x510 [ 26.044027] SyS_write+0xef/0x220 [ 26.047451] do_fast_syscall_32+0x3ec/0xf9f [ 26.051744] entry_SYSENTER_compat+0x70/0x7f [ 26.056119] [ 26.057722] The buggy address belongs to the object at ffff8801aed785c0 [ 26.057722] which belongs to the cache kmalloc-256 of size 256 [ 26.070344] The buggy address is located 128 bytes inside of [ 26.070344] 256-byte region [ffff8801aed785c0, ffff8801aed786c0) [ 26.082185] The buggy address belongs to the page: [ 26.087087] page:ffffea0006bb5e00 count:1 mapcount:0 mapping:ffff8801aed780c0 index:0xffff8801aed78e80 [ 26.096508] flags: 0x2fffc0000000100(slab) [ 26.100717] raw: 02fffc0000000100 ffff8801aed780c0 ffff8801aed78e80 0000000100000006 [ 26.108575] raw: ffffea0006bb62a0 ffffea0006bcbda0 ffff8801dac007c0 0000000000000000 [ 26.116427] page dumped because: kasan: bad access detected [ 26.122106] [ 26.123705] Memory state around the buggy address: [ 26.128606] ffff8801aed78500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.135942] ffff8801aed78580: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 26.143279] >ffff8801aed78600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.150606] ^ [ 26.156027] ffff8801aed78680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 26.163352] ffff8801aed78700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.170684] ================================================================== [ 26.178011] Disabling lock debugging due to kernel taint [ 26.183503] Kernel panic - not syncing: panic_on_warn set ... [ 26.183503] [ 26.190846] CPU: 0 PID: 4242 Comm: syz-executor0 Tainted: G B 4.16.0-rc4+ #259 [ 26.199388] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 26.208711] Call Trace: [ 26.211272] dump_stack+0x194/0x24d [ 26.214868] ? arch_local_irq_restore+0x53/0x53 [ 26.219506] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 26.224232] ? vsnprintf+0x1ed/0x1900 [ 26.228001] ? ucma_close+0x280/0x2f0 [ 26.231778] panic+0x1e4/0x41c [ 26.234941] ? refcount_error_report+0x214/0x214 [ 26.239665] ? add_taint+0x1c/0x50 [ 26.243174] ? add_taint+0x1c/0x50 [ 26.246682] ? ucma_close+0x2d7/0x2f0 [ 26.250455] kasan_end_report+0x50/0x50 [ 26.254398] kasan_report+0x149/0x360 [ 26.258169] __asan_report_load8_noabort+0x14/0x20 [ 26.263077] ucma_close+0x2d7/0x2f0 [ 26.266675] ? __might_sleep+0x95/0x190 [ 26.270619] ? ucma_free_ctx+0xd90/0xd90 [ 26.274650] __fput+0x327/0x7e0 [ 26.277898] ? fput+0x140/0x140 [ 26.281148] ? _raw_spin_unlock_irq+0x27/0x70 [ 26.285616] ____fput+0x15/0x20 [ 26.288864] task_work_run+0x199/0x270 [ 26.292721] ? task_work_cancel+0x210/0x210 [ 26.297013] ? _raw_spin_unlock+0x22/0x30 [ 26.301135] ? switch_task_namespaces+0x87/0xc0 [ 26.305772] do_exit+0x9bb/0x1ad0 [ 26.309193] ? ucma_create_id+0x45b/0x620 [ 26.313311] ? mm_update_next_owner+0x930/0x930 [ 26.317949] ? ucma_create_id+0x17b/0x620 [ 26.322068] ? ucma_get_event+0xa90/0xa90 [ 26.326189] ? __might_sleep+0x95/0x190 [ 26.330136] ? kasan_check_write+0x14/0x20 [ 26.334341] ? _copy_from_user+0x99/0x110 [ 26.338459] ? ucma_write+0x11f/0x3d0 [ 26.342228] ? ucma_get_event+0xa90/0xa90 [ 26.346344] ? ucma_resolve_route+0x1a0/0x1a0 [ 26.350814] ? ucma_resolve_route+0x1a0/0x1a0 [ 26.355278] ? __vfs_write+0xf7/0x970 [ 26.359050] ? rcu_note_context_switch+0x710/0x710 [ 26.363950] ? kernel_read+0x120/0x120 [ 26.367803] ? __might_sleep+0x95/0x190 [ 26.371748] ? _cond_resched+0x14/0x30 [ 26.375606] ? __inode_security_revalidate+0xd9/0x130 [ 26.380765] ? avc_policy_seqno+0x9/0x20 [ 26.384800] ? security_file_permission+0x89/0x1e0 [ 26.389702] ? compat_SyS_futex+0x288/0x380 [ 26.393992] ? vfs_write+0x224/0x510 [ 26.397679] do_group_exit+0x149/0x400 [ 26.401533] ? compat_SyS_get_robust_list+0x300/0x300 [ 26.406688] ? SyS_write+0x184/0x220 [ 26.410370] ? __do_page_fault+0x3d6/0xc90 [ 26.414572] ? SyS_exit+0x30/0x30 [ 26.417992] ? SyS_read+0x220/0x220 [ 26.421594] ? do_fast_syscall_32+0x156/0xf9f [ 26.426056] ? do_group_exit+0x400/0x400 [ 26.430087] SyS_exit_group+0x1d/0x20 [ 26.433860] do_fast_syscall_32+0x3ec/0xf9f [ 26.438152] ? do_int80_syscall_32+0x9c0/0x9c0 [ 26.442700] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 26.447425] ? syscall_return_slowpath+0x2ac/0x550 [ 26.452322] ? prepare_exit_to_usermode+0x350/0x350 [ 26.457308] ? sysret32_from_system_call+0x5/0x3c [ 26.462120] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 26.466934] entry_SYSENTER_compat+0x70/0x7f [ 26.471321] RIP: 0023:0xf7f35c99 [ 26.474651] RSP: 002b:00000000ff8540ac EFLAGS: 00000286 ORIG_RAX: 00000000000000fc [ 26.482327] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000000000 [ 26.489563] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 26.496802] RBP: 00000000080a2c25 R08: 0000000000000000 R09: 0000000000000000 [ 26.504037] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 26.511273] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 26.518972] Dumping ftrace buffer: [ 26.522479] (ftrace buffer empty) [ 26.526158] Kernel Offset: disabled [ 26.529753] Rebooting in 86400 seconds..