[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 46.016490] kauditd_printk_skb: 9 callbacks suppressed [ 46.016505] audit: type=1400 audit(1539001565.795:35): avc: denied { map } for pid=5927 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.21' (ECDSA) to the list of known hosts. [ 52.548702] audit: type=1400 audit(1539001572.325:36): avc: denied { map } for pid=5939 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=16479 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2018/10/08 12:26:12 parsed 1 programs [ 53.087092] audit: type=1400 audit(1539001572.865:37): avc: denied { map } for pid=5939 comm="syz-execprog" path="/sys/kernel/debug/kcov" dev="debugfs" ino=14382 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 2018/10/08 12:26:14 executed programs: 0 [ 54.796587] IPVS: ftp: loaded support on port[0] = 21 [ 54.992124] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.998497] bridge0: port 1(bridge_slave_0) entered disabled state [ 55.005555] device bridge_slave_0 entered promiscuous mode [ 55.020064] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.026431] bridge0: port 2(bridge_slave_1) entered disabled state [ 55.033615] device bridge_slave_1 entered promiscuous mode [ 55.047404] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 55.063065] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 55.101711] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 55.119185] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 55.176204] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 55.183417] team0: Port device team_slave_0 added [ 55.196891] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 55.204481] team0: Port device team_slave_1 added [ 55.218144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 55.239719] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 55.255864] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 55.271862] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 55.383045] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.389402] bridge0: port 2(bridge_slave_1) entered forwarding state [ 55.396028] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.402378] bridge0: port 1(bridge_slave_0) entered forwarding state [ 55.782272] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 55.788352] 8021q: adding VLAN 0 to HW filter on device bond0 [ 55.828457] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 55.867937] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 55.875777] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 55.914472] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 55.920588] 8021q: adding VLAN 0 to HW filter on device team0 [ 55.940382] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 56.153627] audit: type=1400 audit(1539001575.935:38): avc: denied { map_create } for pid=6208 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 [ 56.161419] BUG: sleeping function called from invalid context at net/core/dev.c:9010 [ 56.177049] audit: type=1400 audit(1539001575.935:39): avc: denied { map_read map_write } for pid=6208 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 [ 56.184285] in_atomic(): 1, irqs_disabled(): 0, pid: 6211, name: syz-executor0 [ 56.214777] INFO: lockdep is turned off. [ 56.218816] Preemption disabled at: [ 56.218833] [] map_update_elem+0x423/0xd50 [ 56.228414] CPU: 0 PID: 6211 Comm: syz-executor0 Not tainted 4.19.0-rc7+ #52 [ 56.235579] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 56.244911] Call Trace: [ 56.247482] dump_stack+0x1c4/0x2b4 [ 56.251094] ? dump_stack_print_info.cold.2+0x52/0x52 [ 56.256265] ? vprintk_func+0x85/0x181 [ 56.260149] ? vprintk_func+0x85/0x181 [ 56.264031] ? map_update_elem+0x423/0xd50 [ 56.268253] ___might_sleep.cold.82+0x1ba/0x1f3 [ 56.272908] ? arch_local_save_flags+0x40/0x40 [ 56.277473] ? lock_downgrade+0x900/0x900 [ 56.281607] __might_sleep+0x95/0x190 [ 56.285401] synchronize_net+0x1d/0x60 [ 56.289281] xsk_map_update_elem+0x2b0/0x470 [ 56.293671] ? xsk_map_lookup_elem+0x10/0x10 [ 56.298063] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 56.303583] ? check_preemption_disabled+0x48/0x200 [ 56.308582] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 56.314101] ? xsk_map_lookup_elem+0x10/0x10 [ 56.318490] map_update_elem+0x60c/0xd50 [ 56.322536] __x64_sys_bpf+0x32d/0x510 [ 56.326406] ? bpf_prog_get+0x20/0x20 [ 56.330194] do_syscall_64+0x1b9/0x820 [ 56.334075] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 56.339420] ? syscall_return_slowpath+0x5e0/0x5e0 [ 56.344332] ? trace_hardirqs_on_caller+0x310/0x310 [ 56.349331] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 56.354349] ? recalc_sigpending_tsk+0x180/0x180 [ 56.359087] ? kasan_check_write+0x14/0x20 [ 56.363318] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 56.368154] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 56.373328] RIP: 0033:0x457579 [ 56.376511] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 56.395396] RSP: 002b:00007f61ee83cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 56.403086] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457579 [ 56.410336] RDX: 0000000000000020 RSI: 0000000020000100 RDI: 0000000000000002 [ 56.417586] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 56.424839] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f61ee83d6d4 [ 56.432089] R13: 00000000004bd93a R14: 00000000004cc2b0 R15: 00000000ffffffff [ 56.439409] BUG: scheduling while atomic: syz-executor0/6211/0x00000002 [ 56.446177] INFO: lockdep is turned off. [ 56.450260] Modules linked in: [ 56.453458] Preemption disabled at: [ 56.453475] [] map_update_elem+0x423/0xd50 [ 56.462884] Kernel panic - not syncing: scheduling while atomic [ 56.462884] [ 56.470428] CPU: 0 PID: 6211 Comm: syz-executor0 Tainted: G W 4.19.0-rc7+ #52 [ 56.478980] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 56.488313] Call Trace: [ 56.490890] dump_stack+0x1c4/0x2b4 [ 56.494504] ? dump_stack_print_info.cold.2+0x52/0x52 [ 56.499680] panic+0x238/0x4e7 [ 56.502861] ? add_taint.cold.5+0x16/0x16 [ 56.507009] ? trace_hardirqs_off+0xb8/0x310 [ 56.511401] ? vprintk_func+0x85/0x181 [ 56.515273] ? map_update_elem+0x423/0xd50 [ 56.519491] __schedule_bug.cold.84+0x11c/0x14d [ 56.524143] __schedule+0x1456/0x1ed0 [ 56.527927] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 56.532926] ? mark_held_locks+0x130/0x130 [ 56.537144] ? __sched_text_start+0x8/0x8 [ 56.541285] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 56.546820] ? irq_work_claim+0xac/0xd0 [ 56.550777] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 56.556298] ? irq_work_queue+0x36/0x1d0 [ 56.560339] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 56.565859] ? wake_up_klogd+0x11a/0x180 [ 56.569902] ? console_device+0xc0/0xc0 [ 56.573857] ? vprintk_emit+0x322/0x930 [ 56.577814] ? __down_trylock_console_sem+0x155/0x200 [ 56.582988] ? debug_object_active_state+0x2f5/0x4d0 [ 56.588083] schedule+0xfe/0x460 [ 56.591433] ? __schedule+0x1ed0/0x1ed0 [ 56.595388] ? debug_object_active_state+0x2f5/0x4d0 [ 56.600481] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 56.605928] ? kasan_check_write+0x14/0x20 [ 56.610160] ? wait_for_completion+0x41f/0x8a0 [ 56.614733] schedule_timeout+0x1cc/0x260 [ 56.618876] ? usleep_range+0x1a0/0x1a0 [ 56.622836] ? wait_for_completion+0x41f/0x8a0 [ 56.627399] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 56.632830] ? kasan_check_write+0x14/0x20 [ 56.637049] ? do_raw_spin_lock+0xc1/0x200 [ 56.641272] wait_for_completion+0x427/0x8a0 [ 56.645665] ? wait_for_completion_interruptible+0x840/0x840 [ 56.651446] ? wake_up_q+0x100/0x100 [ 56.655143] ? __lockdep_init_map+0x105/0x590 [ 56.659624] ? __init_waitqueue_head+0x9e/0x150 [ 56.664302] __wait_rcu_gp+0x265/0x360 [ 56.668179] synchronize_rcu.part.65+0x104/0x120 [ 56.672927] ? synchronize_rcu_expedited+0xb0/0xb0 [ 56.677844] ? __call_rcu.constprop.69+0xbc0/0xbc0 [ 56.682762] ? add_taint+0x29/0x70 [ 56.686293] ? map_update_elem+0x423/0xd50 [ 56.690508] ? ___might_sleep.cold.82+0x1c6/0x1f3 [ 56.695332] ? rcu_unexpedite_gp+0x20/0x20 [ 56.699556] ? __might_sleep+0x95/0x190 [ 56.703513] synchronize_rcu+0x27/0xa0 [ 56.707383] synchronize_net+0x4d/0x60 [ 56.711253] xsk_map_update_elem+0x2b0/0x470 [ 56.715643] ? xsk_map_lookup_elem+0x10/0x10 [ 56.720034] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 56.725566] ? check_preemption_disabled+0x48/0x200 [ 56.730575] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 56.736093] ? xsk_map_lookup_elem+0x10/0x10 [ 56.740484] map_update_elem+0x60c/0xd50 [ 56.744529] __x64_sys_bpf+0x32d/0x510 [ 56.748400] ? bpf_prog_get+0x20/0x20 [ 56.752189] do_syscall_64+0x1b9/0x820 [ 56.756067] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 56.761413] ? syscall_return_slowpath+0x5e0/0x5e0 [ 56.766323] ? trace_hardirqs_on_caller+0x310/0x310 [ 56.771321] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 56.776322] ? recalc_sigpending_tsk+0x180/0x180 [ 56.781057] ? kasan_check_write+0x14/0x20 [ 56.785281] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 56.790109] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 56.795282] RIP: 0033:0x457579 [ 56.798458] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 56.817339] RSP: 002b:00007f61ee83cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 56.825029] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457579 [ 56.832278] RDX: 0000000000000020 RSI: 0000000020000100 RDI: 0000000000000002 [ 56.839530] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 56.846781] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f61ee83d6d4 [ 56.854032] R13: 00000000004bd93a R14: 00000000004cc2b0 R15: 00000000ffffffff [ 56.862288] Kernel Offset: disabled [ 56.865911] Rebooting in 86400 seconds..