syzkaller syzkaller login: [ 12.132863][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!! [ 13.397398][ T23] kauditd_printk_skb: 60 callbacks suppressed [ 13.397406][ T23] audit: type=1400 audit(1636634177.599:71): avc: denied { transition } for pid=290 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.426529][ T23] audit: type=1400 audit(1636634177.639:72): avc: denied { write } for pid=290 comm="sh" path="pipe:[1396]" dev="pipefs" ino=1396 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1 [ 13.448831][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 13.642867][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!! [ 14.182805][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #88!!! [ 14.191672][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #88!!! Warning: Permanently added '10.128.10.32' (ECDSA) to the list of known hosts. 2021/11/11 12:36:24 fuzzer started 2021/11/11 12:36:24 connecting to host at 10.128.0.163:39161 2021/11/11 12:36:24 checking machine... 2021/11/11 12:36:24 checking revisions... 2021/11/11 12:36:24 testing simple program... [ 20.590640][ T23] audit: type=1400 audit(1636634184.789:73): avc: denied { getattr } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 20.608871][ T370] cgroup: Unknown subsys name 'net' [ 20.614170][ T23] audit: type=1400 audit(1636634184.789:74): avc: denied { read } for pid=362 comm="syz-fuzzer" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 20.640236][ T23] audit: type=1400 audit(1636634184.789:75): avc: denied { open } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 20.640419][ T370] cgroup: Unknown subsys name 'devices' [ 20.663468][ T23] audit: type=1400 audit(1636634184.789:76): avc: denied { read } for pid=362 comm="syz-fuzzer" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 20.691981][ T23] audit: type=1400 audit(1636634184.789:77): avc: denied { open } for pid=362 comm="syz-fuzzer" path="/dev/raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 20.715388][ T23] audit: type=1400 audit(1636634184.789:78): avc: denied { mounton } for pid=370 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1136 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.738217][ T23] audit: type=1400 audit(1636634184.789:79): avc: denied { mount } for pid=370 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.760409][ T23] audit: type=1400 audit(1636634184.819:80): avc: denied { unmount } for pid=370 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.864598][ T370] cgroup: Unknown subsys name 'hugetlb' [ 20.870389][ T370] cgroup: Unknown subsys name 'rlimit' [ 20.963909][ T23] audit: type=1400 audit(1636634185.169:81): avc: denied { setattr } for pid=370 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 20.987095][ T23] audit: type=1400 audit(1636634185.189:82): avc: denied { execmem } for pid=373 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 21.061939][ T374] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.069099][ T374] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.076734][ T374] device bridge_slave_0 entered promiscuous mode [ 21.083723][ T374] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.090830][ T374] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.098362][ T374] device bridge_slave_1 entered promiscuous mode [ 21.128877][ T374] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.136033][ T374] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.143738][ T374] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.150852][ T374] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.168674][ T74] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.175942][ T74] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.184403][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 21.191758][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.200993][ T19] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.209154][ T19] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.216389][ T19] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.233954][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.242143][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.250423][ T74] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.257453][ T74] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.264874][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.272741][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.291191][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.299484][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.308341][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.316850][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.325903][ T74] ================================================================================ [ 21.335216][ T74] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:2023:28 [ 21.343028][ T74] member access within address ffffc9000028f1c0 with insufficient space [ 21.351468][ T74] for an object of type 'struct sk_buff' [ 21.357143][ T74] CPU: 0 PID: 74 Comm: kworker/0:1 Not tainted 5.10.78-syzkaller-01179-gbe686d451ef9 #0 [ 21.366845][ T74] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 21.376900][ T74] Workqueue: ipv6_addrconf addrconf_dad_work [ 21.383034][ T74] Call Trace: [ 21.386306][ T74] dump_stack_lvl+0x1e2/0x24b [ 21.390969][ T74] ? show_regs_print_info+0x18/0x18 [ 21.396160][ T74] ? wg_allowedips_lookup_dst+0x190/0x190 [ 21.401859][ T74] dump_stack+0x15/0x1d [ 21.405996][ T74] ubsan_type_mismatch_common+0x1ed/0x3a0 [ 21.411707][ T74] ? __sanitizer_cov_trace_switch+0x74/0x90 [ 21.417590][ T74] __ubsan_handle_type_mismatch_v1+0x5b/0x70 [ 21.423564][ T74] wg_xmit+0x4a2/0xae0 [ 21.427630][ T74] ? wg_stop+0x140/0x140 [ 21.431854][ T74] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20 [ 21.438084][ T74] netdev_start_xmit+0x8a/0x160 [ 21.442911][ T74] dev_hard_start_xmit+0x18d/0x2f0 [ 21.448007][ T74] __dev_queue_xmit+0xfbe/0x1bb0 [ 21.453011][ T74] ? dev_queue_xmit+0x20/0x20 [ 21.457679][ T74] ? __local_bh_enable_ip+0xa8/0x170 [ 21.462953][ T74] ? do_raw_spin_unlock+0x50/0x50 [ 21.467953][ T74] ? _local_bh_enable+0x30/0x30 [ 21.472786][ T74] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 21.479007][ T74] ? ndisc_constructor+0x690/0x8a0 [ 21.484217][ T74] ? _raw_write_unlock_bh+0x31/0x47 [ 21.490187][ T74] ? dev_hard_header+0xdb/0xf0 [ 21.494934][ T74] dev_queue_xmit+0x17/0x20 [ 21.499423][ T74] neigh_connected_output+0x288/0x2b0 [ 21.504887][ T74] ip6_finish_output2+0xde2/0x1440 [ 21.510021][ T74] ? __rcu_read_lock+0x50/0x50 [ 21.514809][ T74] ? __ip6_finish_output+0x520/0x520 [ 21.520167][ T74] ? dst_cow_metrics_generic+0x55/0x1d0 [ 21.525710][ T74] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 21.531925][ T74] ? ip6_skb_dst_mtu+0xaf/0x260 [ 21.536837][ T74] __ip6_finish_output+0x3e4/0x520 [ 21.541927][ T74] ip6_finish_output+0x3f/0x220 [ 21.546841][ T74] ? ip6_output+0x1d3/0x4b0 [ 21.551315][ T74] ip6_output+0x1f8/0x4b0 [ 21.555634][ T74] ? asan.module_dtor+0x20/0x20 [ 21.560459][ T74] ? skb_dst+0x40/0x40 [ 21.564514][ T74] ? __rcu_read_lock+0x50/0x50 [ 21.569264][ T74] ? selinux_ipv6_forward+0x50/0x50 [ 21.574448][ T74] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 21.580143][ T74] ? nf_hook_slow+0x150/0x1b0 [ 21.584795][ T74] NF_HOOK+0xdd/0x280 [ 21.588754][ T74] ? addrconf_addr_solict_mult+0xe0/0xe0 [ 21.594360][ T74] ? NF_HOOK+0x280/0x280 [ 21.598836][ T74] ? __rcu_read_lock+0x50/0x50 [ 21.603616][ T74] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 21.610003][ T74] ? ndisc_send_skb+0x547/0x9f0 [ 21.614828][ T74] ? memcpy+0x56/0x70 [ 21.618783][ T74] ndisc_send_skb+0x646/0x9f0 [ 21.623435][ T74] ? slab_post_alloc_hook+0x90/0xa0 [ 21.628608][ T74] ? ndisc_fill_addr_option+0x2f0/0x2f0 [ 21.634134][ T74] ? skb_set_owner_w+0x1a8/0x310 [ 21.639059][ T74] ? __sanitizer_cov_trace_cmp4+0x19/0x20 [ 21.644836][ T74] ? skb_put+0x11d/0x200 [ 21.649063][ T74] ndisc_send_rs+0x26c/0x360 [ 21.653650][ T74] addrconf_dad_completed+0x4f3/0x9f0 [ 21.659006][ T74] ? addrconf_dad_stop+0x430/0x430 [ 21.664091][ T74] ? mutex_unlock+0x34/0x40 [ 21.668569][ T74] addrconf_dad_work+0x9c1/0x1520 [ 21.673571][ T74] ? move_linked_works+0x118/0x130 [ 21.678656][ T74] ? ipv6_use_optimistic_addr+0x1d0/0x1d0 [ 21.684350][ T74] ? __kasan_check_write+0x14/0x20 [ 21.689455][ T74] process_one_work+0x3ca/0x660 [ 21.694286][ T74] worker_thread+0x709/0xa20 [ 21.699095][ T74] ? __kthread_parkme+0x11b/0x150 [ 21.704096][ T74] kthread+0x371/0x390 [ 21.708155][ T74] ? pr_cont_work+0x110/0x110 [ 21.712808][ T74] ? __list_add+0xc0/0xc0 [ 21.717142][ T74] ret_from_fork+0x1f/0x30 [ 21.721683][ T74] ================================================================================ [ 21.732723][ T74] ================================================================================ [ 21.742124][ T74] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:1916:2 [ 21.749864][ T74] member access within address ffffc9000028f1c0 with insufficient space [ 21.758197][ T74] for an object of type 'struct sk_buff' [ 21.763922][ T74] CPU: 0 PID: 74 Comm: kworker/0:1 Not tainted 5.10.78-syzkaller-01179-gbe686d451ef9 #0 [ 21.773608][ T74] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 21.783648][ T74] Workqueue: ipv6_addrconf addrconf_dad_work [ 21.789601][ T74] Call Trace: [ 21.792887][ T74] dump_stack_lvl+0x1e2/0x24b [ 21.797549][ T74] ? show_regs_print_info+0x18/0x18 [ 21.802724][ T74] ? wg_allowedips_lookup_dst+0x190/0x190 [ 21.808427][ T74] dump_stack+0x15/0x1d [ 21.812576][ T74] ubsan_type_mismatch_common+0x1ed/0x3a0 [ 21.818378][ T74] __ubsan_handle_type_mismatch_v1+0x5b/0x70 [ 21.824341][ T74] wg_xmit+0x513/0xae0 [ 21.828387][ T74] ? wg_stop+0x140/0x140 [ 21.832605][ T74] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20 [ 21.838909][ T74] netdev_start_xmit+0x8a/0x160 [ 21.843754][ T74] dev_hard_start_xmit+0x18d/0x2f0 [ 21.848904][ T74] __dev_queue_xmit+0xfbe/0x1bb0 [ 21.853818][ T74] ? dev_queue_xmit+0x20/0x20 [ 21.858466][ T74] ? __local_bh_enable_ip+0xa8/0x170 [ 21.863822][ T74] ? do_raw_spin_unlock+0x50/0x50 [ 21.868832][ T74] ? _local_bh_enable+0x30/0x30 [ 21.873671][ T74] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 21.879927][ T74] ? ndisc_constructor+0x690/0x8a0 [ 21.885041][ T74] ? _raw_write_unlock_bh+0x31/0x47 [ 21.890214][ T74] ? dev_hard_header+0xdb/0xf0 [ 21.894957][ T74] dev_queue_xmit+0x17/0x20 [ 21.899437][ T74] neigh_connected_output+0x288/0x2b0 [ 21.904795][ T74] ip6_finish_output2+0xde2/0x1440 [ 21.909895][ T74] ? __rcu_read_lock+0x50/0x50 [ 21.914704][ T74] ? __ip6_finish_output+0x520/0x520 [ 21.920002][ T74] ? dst_cow_metrics_generic+0x55/0x1d0 [ 21.925547][ T74] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 21.931773][ T74] ? ip6_skb_dst_mtu+0xaf/0x260 [ 21.936615][ T74] __ip6_finish_output+0x3e4/0x520 [ 21.941706][ T74] ip6_finish_output+0x3f/0x220 [ 21.946527][ T74] ? ip6_output+0x1d3/0x4b0 [ 21.951000][ T74] ip6_output+0x1f8/0x4b0 [ 21.955369][ T74] ? asan.module_dtor+0x20/0x20 [ 21.960217][ T74] ? skb_dst+0x40/0x40 [ 21.964268][ T74] ? __rcu_read_lock+0x50/0x50 [ 21.969011][ T74] ? selinux_ipv6_forward+0x50/0x50 [ 21.974186][ T74] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 21.979878][ T74] ? nf_hook_slow+0x150/0x1b0 [ 21.984565][ T74] NF_HOOK+0xdd/0x280 [ 21.988521][ T74] ? addrconf_addr_solict_mult+0xe0/0xe0 [ 21.994137][ T74] ? NF_HOOK+0x280/0x280 [ 21.998363][ T74] ? __rcu_read_lock+0x50/0x50 [ 22.003109][ T74] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20 [ 22.009326][ T74] ? ndisc_send_skb+0x547/0x9f0 [ 22.014155][ T74] ? memcpy+0x56/0x70 [ 22.018128][ T74] ndisc_send_skb+0x646/0x9f0 [ 22.022787][ T74] ? slab_post_alloc_hook+0x90/0xa0 [ 22.027968][ T74] ? ndisc_fill_addr_option+0x2f0/0x2f0 [ 22.033586][ T74] ? skb_set_owner_w+0x1a8/0x310 [ 22.038507][ T74] ? __sanitizer_cov_trace_cmp4+0x19/0x20 [ 22.044207][ T74] ? skb_put+0x11d/0x200 [ 22.048513][ T74] ndisc_send_rs+0x26c/0x360 [ 22.053096][ T74] addrconf_dad_completed+0x4f3/0x9f0 [ 22.058445][ T74] ? addrconf_dad_stop+0x430/0x430 [ 22.063530][ T74] ? mutex_unlock+0x34/0x40 [ 22.068009][ T74] addrconf_dad_work+0x9c1/0x1520 [ 22.073012][ T74] ? move_linked_works+0x118/0x130 [ 22.078117][ T74] ? ipv6_use_optimistic_addr+0x1d0/0x1d0 [ 22.083977][ T74] ? __kasan_check_write+0x14/0x20 [ 22.089071][ T74] process_one_work+0x3ca/0x660 [ 22.093913][ T74] worker_thread+0x709/0xa20 [ 22.098496][ T74] ? __kthread_parkme+0x11b/0x150 [ 22.103514][ T74] kthread+0x371/0x390 [ 22.107568][ T74] ? pr_cont_work+0x110/0x110 [ 22.112232][ T74] ? __list_add+0xc0/0xc0 [ 22.116547][ T74] ret_from_fork+0x1f/0x30 [ 22.121005][ T74] ================================================================================ 2021/11/11 12:36:26 building call list... [ 22.140535][ T374] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 22.713001][ T177] device bridge_slave_1 left promiscuous mode [ 22.719148][ T177] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.726975][ T177] device bridge_slave_0 left promiscuous mode [ 22.733559][ T177] bridge0: port 1(bridge_slave_0) entered disabled state