[ 32.474433] audit: type=1800 audit(1555954957.578:33): pid=6908 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op="collect_data" cause="failed(directio)" comm="startpar" name="rc.local" dev="sda1" ino=2465 res=0 [ 32.503216] audit: type=1800 audit(1555954957.578:34): pid=6908 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op="collect_data" cause="failed(directio)" comm="startpar" name="rmnologin" dev="sda1" ino=2456 res=0 Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 35.865100] random: sshd: uninitialized urandom read (32 bytes read) [ 36.199826] audit: type=1400 audit(1555954961.298:35): avc: denied { map } for pid=7083 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 36.258903] random: sshd: uninitialized urandom read (32 bytes read) [ 36.849643] random: sshd: uninitialized urandom read (32 bytes read) [ 37.046619] random: sshd: uninitialized urandom read (32 bytes read) [ 42.762299] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.201' (ECDSA) to the list of known hosts. [ 43.145431] audit: type=1400 audit(1555954968.248:36): avc: denied { map } for pid=7095 comm="syz-executor915" path="/root/syz-executor915206775" dev="sda1" ino=16484 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 44.000443] IPVS: ftp: loaded support on port[0] = 21 [ 44.339348] chnl_net:caif_netlink_parms(): no params data found [ 44.372718] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.379339] bridge0: port 1(bridge_slave_0) entered disabled state [ 44.387607] device bridge_slave_0 entered promiscuous mode [ 44.395067] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.401547] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.408515] device bridge_slave_1 entered promiscuous mode [ 44.423896] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 44.433374] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 44.449520] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 44.457526] team0: Port device team_slave_0 added [ 44.463104] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 44.470616] team0: Port device team_slave_1 added [ 44.476167] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 44.483952] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 44.552200] device hsr_slave_0 entered promiscuous mode [ 44.590425] device hsr_slave_1 entered promiscuous mode [ 44.630691] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 44.637959] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 44.651875] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.658383] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.665695] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.672088] bridge0: port 1(bridge_slave_0) entered forwarding state [ 44.701880] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 44.708123] 8021q: adding VLAN 0 to HW filter on device bond0 [ 44.716784] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 44.725889] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 44.735298] bridge0: port 1(bridge_slave_0) entered disabled state [ 44.742791] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.752949] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 44.759048] 8021q: adding VLAN 0 to HW filter on device team0 [ 44.768464] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 44.776461] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.782857] bridge0: port 1(bridge_slave_0) entered forwarding state [ 44.793945] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 44.801657] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.808021] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.829775] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 44.840279] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 44.851433] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 44.858457] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 44.866473] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 44.874227] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 44.881849] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 44.889916] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 44.897152] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready executing program [ 44.908849] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 44.919159] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 44.951494] hsr_addr_subst_dest: Unknown node [ 44.956389] ------------[ cut here ]------------ [ 44.961217] WARNING: CPU: 0 PID: 7106 at net/hsr/hsr_framereg.c:313 hsr_addr_subst_dest.cold+0x45/0x4f [ 44.970916] Kernel panic - not syncing: panic_on_warn set ... [ 44.970916] [ 44.978277] CPU: 0 PID: 7106 Comm: syz-executor915 Not tainted 4.14.113 #3 [ 44.985274] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 44.994786] Call Trace: [ 44.997371] dump_stack+0x138/0x19c [ 45.001014] panic+0x1f2/0x438 [ 45.004225] ? add_taint.cold+0x16/0x16 [ 45.008281] ? hsr_addr_subst_dest.cold+0x45/0x4f [ 45.013303] ? hsr_addr_subst_dest.cold+0x45/0x4f [ 45.018138] __warn.cold+0x2f/0x34 [ 45.021687] ? ist_end_non_atomic+0x10/0x10 [ 45.025998] ? hsr_addr_subst_dest.cold+0x45/0x4f [ 45.030839] report_bug+0x216/0x254 [ 45.034454] do_error_trap+0x1bb/0x310 [ 45.038374] ? math_error+0x360/0x360 [ 45.042186] ? vprintk_emit+0x171/0x600 [ 45.046232] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 45.051134] do_invalid_op+0x1b/0x20 [ 45.054852] invalid_op+0x1b/0x40 [ 45.058299] RIP: 0010:hsr_addr_subst_dest.cold+0x45/0x4f [ 45.063724] RSP: 0018:ffff88808503f698 EFLAGS: 00010286 [ 45.069076] RAX: 0000000000000021 RBX: dffffc0000000000 RCX: 0000000000000000 [ 45.076344] RDX: 0000000000000000 RSI: ffffffff866d0860 RDI: ffffed1010a07ec9 [ 45.083612] RBP: ffff88808503f6d8 R08: 0000000000000021 R09: ffff888090aa0a60 [ 45.090876] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880a4e85460 [ 45.098131] R13: 00000000aaaaaaaa R14: ffff8880a4e85460 R15: 000000000000aaaa [ 45.105450] ? hsr_addr_subst_dest.cold+0x45/0x4f [ 45.110299] hsr_forward_skb+0x1025/0x1940 [ 45.114531] hsr_dev_xmit+0x72/0xa0 [ 45.118167] dev_hard_start_xmit+0x191/0x8c0 [ 45.122595] ? assoc_array_gc+0x1130/0x11d0 [ 45.126921] __dev_queue_xmit+0x1da3/0x25f0 [ 45.131340] ? find_held_lock+0x35/0x130 [ 45.135418] ? netdev_pick_tx+0x300/0x300 [ 45.139591] ? iov_iter_advance+0x218/0xc60 [ 45.144076] ? memcpy+0x46/0x50 [ 45.147347] dev_queue_xmit+0x18/0x20 [ 45.151210] ? dev_queue_xmit+0x18/0x20 [ 45.155212] pppoe_sendmsg+0x5cf/0x730 [ 45.159099] ? ether_setup+0x2d0/0x2d0 [ 45.162976] ? pppoe_getname+0x140/0x140 [ 45.167038] ? selinux_socket_sendmsg+0x36/0x40 [ 45.171690] ? security_socket_sendmsg+0x8f/0xc0 [ 45.176439] ? pppoe_getname+0x140/0x140 [ 45.180485] sock_sendmsg+0xd0/0x110 [ 45.184200] ___sys_sendmsg+0x349/0x850 [ 45.188282] ? copy_msghdr_from_user+0x3f0/0x3f0 [ 45.193407] ? trace_hardirqs_on+0x10/0x10 [ 45.197800] ? save_trace+0x290/0x290 [ 45.201593] ? save_trace+0x290/0x290 [ 45.205393] ? save_trace+0x290/0x290 [ 45.209226] ? reacquire_held_locks+0xb7/0x3b0 [ 45.213921] ? release_sock+0x14c/0x1c0 [ 45.217885] ? find_held_lock+0x35/0x130 [ 45.221934] ? release_sock+0x14c/0x1c0 [ 45.226034] ? __local_bh_enable_ip+0x99/0x1a0 [ 45.230761] ? __fget_light+0x172/0x1f0 [ 45.234731] ? __fdget+0x1b/0x20 [ 45.238178] ? sockfd_lookup_light+0xb4/0x160 [ 45.242776] __sys_sendmmsg+0x152/0x3a0 [ 45.246739] ? SyS_sendmsg+0x50/0x50 [ 45.250477] ? SYSC_connect+0xe7/0x2d0 [ 45.254356] ? SYSC_bind+0x220/0x220 [ 45.258187] ? up_read+0x1a/0x40 [ 45.261648] ? __do_page_fault+0x358/0xb80 [ 45.265881] SyS_sendmmsg+0x35/0x60 [ 45.269498] ? __sys_sendmmsg+0x3a0/0x3a0 [ 45.273635] do_syscall_64+0x1eb/0x630 [ 45.277638] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 45.282489] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 45.287671] RIP: 0033:0x4421a9 [ 45.290840] RSP: 002b:00007ffdd1ca2fd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 45.298535] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004421a9 [ 45.305795] RDX: 04000000000000eb RSI: 000000002000d180 RDI: 0000000000000003 [ 45.313170] RBP: 00000000004a93b0 R08: 0000000001bbbbbb R09: 0000000001bbbbbb [ 45.320451] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004030b0 [ 45.327714] R13: 0000000000403140 R14: 0000000000000000 R15: 0000000000000000 [ 45.335971] Kernel Offset: disabled [ 45.343361] Rebooting in 86400 seconds..