[ 31.511726] audit: type=1800 audit(1562181138.560:33): pid=6847 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op="collect_data" cause="failed(directio)" comm="startpar" name="rc.local" dev="sda1" ino=2465 res=0 [ 31.538539] audit: type=1800 audit(1562181138.560:34): pid=6847 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op="collect_data" cause="failed(directio)" comm="startpar" name="rmnologin" dev="sda1" ino=2456 res=0 Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 33.394791] random: sshd: uninitialized urandom read (32 bytes read) [ 33.709489] audit: type=1400 audit(1562181140.750:35): avc: denied { map } for pid=7021 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 33.754483] random: sshd: uninitialized urandom read (32 bytes read) [ 34.317957] random: sshd: uninitialized urandom read (32 bytes read) [ 34.506946] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.13' (ECDSA) to the list of known hosts. [ 40.007187] random: sshd: uninitialized urandom read (32 bytes read) [ 40.182300] audit: type=1400 audit(1562181147.230:36): avc: denied { map } for pid=7034 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2019/07/03 19:12:28 parsed 1 programs [ 40.991371] audit: type=1400 audit(1562181148.040:37): avc: denied { map } for pid=7034 comm="syz-execprog" path="/sys/kernel/debug/kcov" dev="debugfs" ino=13057 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 [ 41.909340] random: cc1: uninitialized urandom read (8 bytes read) 2019/07/03 19:12:30 executed programs: 0 [ 42.956208] audit: type=1400 audit(1562181150.000:38): avc: denied { map } for pid=7034 comm="syz-execprog" path="/root/syzkaller-shm470884346" dev="sda1" ino=16490 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 43.710251] IPVS: ftp: loaded support on port[0] = 21 [ 43.999236] chnl_net:caif_netlink_parms(): no params data found [ 44.029298] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.036787] bridge0: port 1(bridge_slave_0) entered disabled state [ 44.044277] device bridge_slave_0 entered promiscuous mode [ 44.051434] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.058044] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.065302] device bridge_slave_1 entered promiscuous mode [ 44.082469] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 44.091530] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 44.107942] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 44.115297] team0: Port device team_slave_0 added [ 44.120698] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 44.127707] team0: Port device team_slave_1 added [ 44.133242] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 44.140843] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 44.192318] device hsr_slave_0 entered promiscuous mode [ 44.260474] device hsr_slave_1 entered promiscuous mode [ 44.330766] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 44.338375] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 44.351632] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.358266] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.365762] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.372246] bridge0: port 1(bridge_slave_0) entered forwarding state [ 44.400345] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 44.406884] 8021q: adding VLAN 0 to HW filter on device bond0 [ 44.415853] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 44.424679] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 44.443666] bridge0: port 1(bridge_slave_0) entered disabled state [ 44.451203] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.461132] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 44.469579] 8021q: adding VLAN 0 to HW filter on device team0 [ 44.478126] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 44.486592] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.493741] bridge0: port 1(bridge_slave_0) entered forwarding state [ 44.504037] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 44.516060] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.522755] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.541733] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 44.549895] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 44.557998] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 44.566053] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 44.575446] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 44.584273] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 44.590918] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 44.604684] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 44.614342] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 44.990563] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 45.724442] ================================================================== [ 45.732626] BUG: KASAN: use-after-free in __smc_diag_dump.isra.0+0x16e0/0x17b0 [ 45.740658] Read of size 8 at addr ffff88809a3cf120 by task syz-executor.0/7072 [ 45.748724] [ 45.750353] CPU: 0 PID: 7072 Comm: syz-executor.0 Not tainted 4.14.132 #26 [ 45.757883] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 45.767900] Call Trace: [ 45.770597] dump_stack+0x138/0x19c [ 45.774442] ? __smc_diag_dump.isra.0+0x16e0/0x17b0 [ 45.779916] print_address_description.cold+0x7c/0x1dc [ 45.785301] ? __smc_diag_dump.isra.0+0x16e0/0x17b0 [ 45.790594] kasan_report.cold+0xa9/0x2af [ 45.795169] __asan_report_load8_noabort+0x14/0x20 [ 45.800254] __smc_diag_dump.isra.0+0x16e0/0x17b0 [ 45.805097] ? smc_diag_handler_dump+0x200/0x200 [ 45.810162] ? rcu_lockdep_current_cpu_online+0xf2/0x140 [ 45.815802] ? __kmalloc_node_track_caller+0x3d/0x80 [ 45.821436] ? rcu_read_lock_sched_held+0x110/0x130 [ 45.826695] ? kmem_cache_alloc_node_trace+0x379/0x770 [ 45.832164] ? kasan_unpoison_shadow+0x35/0x50 [ 45.836827] ? kasan_kmalloc+0xce/0xf0 [ 45.840913] ? lock_acquire+0x16f/0x430 [ 45.844983] ? smc_diag_dump+0x8d/0x2a0 [ 45.849050] smc_diag_dump+0x1e5/0x2a0 [ 45.852938] netlink_dump+0x3fa/0xb10 [ 45.856995] __netlink_dump_start+0x4ff/0x750 [ 45.861505] smc_diag_handler_dump+0x1b7/0x200 [ 45.866184] ? smc_gid_be16_convert+0x2c0/0x2c0 [ 45.870997] ? __smc_diag_dump.isra.0+0x17b0/0x17b0 [ 45.876602] sock_diag_rcv_msg+0x29e/0x3a0 [ 45.881134] netlink_rcv_skb+0x14f/0x3c0 [ 45.885578] ? sock_diag_bind+0x90/0x90 [ 45.889907] ? netlink_ack+0x9a0/0x9a0 [ 45.893960] sock_diag_rcv+0x2b/0x40 [ 45.897810] netlink_unicast+0x45d/0x780 [ 45.901866] ? netlink_attachskb+0x6a0/0x6a0 [ 45.906377] ? security_netlink_send+0x81/0xb0 [ 45.910987] netlink_sendmsg+0x7c4/0xc60 [ 45.915324] ? netlink_unicast+0x780/0x780 [ 45.919564] ? security_socket_sendmsg+0x89/0xb0 [ 45.924548] ? netlink_unicast+0x780/0x780 [ 45.929293] sock_sendmsg+0xce/0x110 [ 45.933007] kernel_sendmsg+0x44/0x50 [ 45.936804] sock_no_sendpage+0x107/0x130 [ 45.941122] ? sock_kzfree_s+0x50/0x50 [ 45.945197] ? pipe_lock+0x63/0x80 [ 45.949001] kernel_sendpage+0x92/0xf0 [ 45.952985] ? sock_kzfree_s+0x50/0x50 [ 45.957049] sock_sendpage+0x8b/0xc0 [ 45.961020] ? kernel_sendpage+0xf0/0xf0 [ 45.965415] pipe_to_sendpage+0x242/0x340 [ 45.969657] ? direct_splice_actor+0x190/0x190 [ 45.974323] __splice_from_pipe+0x348/0x780 [ 45.978656] ? direct_splice_actor+0x190/0x190 [ 45.983654] ? direct_splice_actor+0x190/0x190 [ 45.988424] splice_from_pipe+0xf0/0x150 [ 45.992844] ? splice_shrink_spd+0xb0/0xb0 [ 45.997241] ? security_file_permission+0x89/0x1f0 [ 46.002313] generic_splice_sendpage+0x3c/0x50 [ 46.006896] ? splice_from_pipe+0x150/0x150 [ 46.011668] SyS_splice+0xd92/0x1430 [ 46.015382] ? put_timespec64+0xb4/0x100 [ 46.019554] ? compat_SyS_vmsplice+0x250/0x250 [ 46.024506] ? do_syscall_64+0x53/0x640 [ 46.028576] ? compat_SyS_vmsplice+0x250/0x250 [ 46.033182] do_syscall_64+0x1e8/0x640 [ 46.037249] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 46.042116] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 46.047541] RIP: 0033:0x4597c9 [ 46.051053] RSP: 002b:00007fec9aac4c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 46.059014] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000004597c9 [ 46.066367] RDX: 0000000000000007 RSI: 0000000000000000 RDI: 0000000000000005 [ 46.073872] RBP: 000000000075bf20 R08: 0000000080000001 R09: 0000000000000002 [ 46.081696] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fec9aac56d4 [ 46.089054] R13: 00000000004c8d54 R14: 00000000004def30 R15: 00000000ffffffff [ 46.096964] [ 46.098590] Allocated by task 7072: [ 46.102392] save_stack_trace+0x16/0x20 [ 46.106461] save_stack+0x45/0xd0 [ 46.109906] kasan_kmalloc+0xce/0xf0 [ 46.113758] kasan_slab_alloc+0xf/0x20 [ 46.117647] kmem_cache_alloc+0x12e/0x780 [ 46.121819] sock_alloc_inode+0x1d/0x260 [ 46.125874] alloc_inode+0x64/0x180 [ 46.129591] new_inode_pseudo+0x19/0xf0 [ 46.133596] sock_alloc+0x41/0x280 [ 46.137323] __sock_create+0x8f/0x620 [ 46.141120] sock_create_kern+0x3b/0x50 [ 46.145091] smc_create+0x109/0x300 [ 46.148753] __sock_create+0x2f6/0x620 [ 46.152643] SyS_socket+0xd3/0x170 [ 46.156189] do_syscall_64+0x1e8/0x640 [ 46.160085] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 46.165272] [ 46.167024] Freed by task 7071: [ 46.170431] save_stack_trace+0x16/0x20 [ 46.174861] save_stack+0x45/0xd0 [ 46.178452] kasan_slab_free+0x75/0xc0 [ 46.182639] kmem_cache_free+0x83/0x2b0 [ 46.186703] sock_destroy_inode+0x54/0x60 [ 46.190865] destroy_inode+0xc2/0x120 [ 46.194743] evict+0x3e6/0x630 [ 46.197931] iput+0x471/0x900 [ 46.201030] __sock_release+0x236/0x2b0 [ 46.204999] sock_release+0x18/0x20 [ 46.208789] smc_release+0x23b/0x630 [ 46.212503] __sock_release+0xce/0x2b0 [ 46.216741] sock_close+0x1b/0x30 [ 46.220290] __fput+0x275/0x7a0 [ 46.223649] ____fput+0x16/0x20 [ 46.226922] task_work_run+0x114/0x190 [ 46.230924] exit_to_usermode_loop+0x1da/0x220 [ 46.235595] do_syscall_64+0x4bc/0x640 [ 46.239717] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 46.245350] [ 46.247074] The buggy address belongs to the object at ffff88809a3cf100 [ 46.247074] which belongs to the cache sock_inode_cache of size 992 [ 46.260502] The buggy address is located 32 bytes inside of [ 46.260502] 992-byte region [ffff88809a3cf100, ffff88809a3cf4e0) [ 46.272372] The buggy address belongs to the page: [ 46.277300] page:ffffea000268f3c0 count:1 mapcount:0 mapping:ffff88809a3cf100 index:0xffff88809a3cfffd [ 46.287103] flags: 0x1fffc0000000100(slab) [ 46.291393] raw: 01fffc0000000100 ffff88809a3cf100 ffff88809a3cfffd 0000000100000003 [ 46.299357] raw: ffffea00026820a0 ffffea000268f360 ffff88821b7573c0 0000000000000000 [ 46.307237] page dumped because: kasan: bad access detected [ 46.312996] [ 46.314690] Memory state around the buggy address: [ 46.319875] ffff88809a3cf000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 46.332546] ffff88809a3cf080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 46.339975] >ffff88809a3cf100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 46.347521] ^ [ 46.351926] ffff88809a3cf180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 46.359839] ffff88809a3cf200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 46.367200] ================================================================== [ 46.374951] Disabling lock debugging due to kernel taint [ 46.381720] Kernel panic - not syncing: panic_on_warn set ... [ 46.381720] [ 46.389099] CPU: 0 PID: 7072 Comm: syz-executor.0 Tainted: G B 4.14.132 #26 [ 46.397360] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 46.406936] Call Trace: [ 46.409893] dump_stack+0x138/0x19c [ 46.413538] ? __smc_diag_dump.isra.0+0x16e0/0x17b0 [ 46.418788] panic+0x1f2/0x426 [ 46.421973] ? add_taint.cold+0x16/0x16 [ 46.426336] kasan_end_report+0x47/0x4f [ 46.430451] kasan_report.cold+0x130/0x2af [ 46.435019] __asan_report_load8_noabort+0x14/0x20 [ 46.439944] __smc_diag_dump.isra.0+0x16e0/0x17b0 [ 46.444783] ? smc_diag_handler_dump+0x200/0x200 [ 46.449867] ? rcu_lockdep_current_cpu_online+0xf2/0x140 [ 46.455652] ? __kmalloc_node_track_caller+0x3d/0x80 [ 46.461122] ? rcu_read_lock_sched_held+0x110/0x130 [ 46.466143] ? kmem_cache_alloc_node_trace+0x379/0x770 [ 46.471507] ? kasan_unpoison_shadow+0x35/0x50 [ 46.476084] ? kasan_kmalloc+0xce/0xf0 [ 46.480058] ? lock_acquire+0x16f/0x430 [ 46.484116] ? smc_diag_dump+0x8d/0x2a0 [ 46.488146] smc_diag_dump+0x1e5/0x2a0 [ 46.492028] netlink_dump+0x3fa/0xb10 [ 46.495893] __netlink_dump_start+0x4ff/0x750 [ 46.500384] smc_diag_handler_dump+0x1b7/0x200 [ 46.504961] ? smc_gid_be16_convert+0x2c0/0x2c0 [ 46.510189] ? __smc_diag_dump.isra.0+0x17b0/0x17b0 [ 46.515298] sock_diag_rcv_msg+0x29e/0x3a0 [ 46.519646] netlink_rcv_skb+0x14f/0x3c0 [ 46.523931] ? sock_diag_bind+0x90/0x90 [ 46.529720] ? netlink_ack+0x9a0/0x9a0 [ 46.538096] sock_diag_rcv+0x2b/0x40 [ 46.541807] netlink_unicast+0x45d/0x780 [ 46.545865] ? netlink_attachskb+0x6a0/0x6a0 [ 46.550369] ? security_netlink_send+0x81/0xb0 [ 46.554947] netlink_sendmsg+0x7c4/0xc60 [ 46.559180] ? netlink_unicast+0x780/0x780 [ 46.563504] ? security_socket_sendmsg+0x89/0xb0 [ 46.568559] ? netlink_unicast+0x780/0x780 [ 46.572922] sock_sendmsg+0xce/0x110 [ 46.576648] kernel_sendmsg+0x44/0x50 [ 46.580519] sock_no_sendpage+0x107/0x130 [ 46.584815] ? sock_kzfree_s+0x50/0x50 [ 46.588700] ? pipe_lock+0x63/0x80 [ 46.592256] kernel_sendpage+0x92/0xf0 [ 46.596412] ? sock_kzfree_s+0x50/0x50 [ 46.600297] sock_sendpage+0x8b/0xc0 [ 46.604068] ? kernel_sendpage+0xf0/0xf0 [ 46.608461] pipe_to_sendpage+0x242/0x340 [ 46.612741] ? direct_splice_actor+0x190/0x190 [ 46.618895] __splice_from_pipe+0x348/0x780 [ 46.623711] ? direct_splice_actor+0x190/0x190 [ 46.629714] ? direct_splice_actor+0x190/0x190 [ 46.634704] splice_from_pipe+0xf0/0x150 [ 46.639111] ? splice_shrink_spd+0xb0/0xb0 [ 46.644248] ? security_file_permission+0x89/0x1f0 [ 46.650110] generic_splice_sendpage+0x3c/0x50 [ 46.655317] ? splice_from_pipe+0x150/0x150 [ 46.660493] SyS_splice+0xd92/0x1430 [ 46.664674] ? put_timespec64+0xb4/0x100 [ 46.669347] ? compat_SyS_vmsplice+0x250/0x250 [ 46.674790] ? do_syscall_64+0x53/0x640 [ 46.680133] ? compat_SyS_vmsplice+0x250/0x250 [ 46.685129] do_syscall_64+0x1e8/0x640 [ 46.689845] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 46.695875] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 46.702345] RIP: 0033:0x4597c9 [ 46.705985] RSP: 002b:00007fec9aac4c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 46.714398] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000004597c9 [ 46.723198] RDX: 0000000000000007 RSI: 0000000000000000 RDI: 0000000000000005 [ 46.730946] RBP: 000000000075bf20 R08: 0000000080000001 R09: 0000000000000002 [ 46.738713] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fec9aac56d4 [ 46.745974] R13: 00000000004c8d54 R14: 00000000004def30 R15: 00000000ffffffff [ 46.755109] Kernel Offset: disabled [ 46.758740] Rebooting in 86400 seconds..