Starting sshd: OK syzkaller syzkaller login: [ 12.212349][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #280!!! [ 12.298826][ T23] kauditd_printk_skb: 60 callbacks suppressed [ 12.298832][ T23] audit: type=1400 audit(1635277339.710:71): avc: denied { transition } for pid=290 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.305488][ T23] audit: type=1400 audit(1635277339.720:72): avc: denied { write } for pid=290 comm="sh" path="pipe:[10066]" dev="pipefs" ino=10066 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1 [ 12.352414][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! Warning: Permanently added '10.128.1.221' (ECDSA) to the list of known hosts. executing program [ 25.562343][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 25.570805][ T23] audit: type=1400 audit(1635277352.980:73): avc: denied { execmem } for pid=365 comm="syz-executor921" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 25.574152][ T23] audit: type=1400 audit(1635277352.990:74): avc: denied { mounton } for pid=366 comm="syz-executor921" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 25.578063][ T23] audit: type=1400 audit(1635277352.990:75): avc: denied { mount } for pid=366 comm="syz-executor921" name="/" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 25.581694][ T23] audit: type=1400 audit(1635277352.990:76): avc: denied { mounton } for pid=366 comm="syz-executor921" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 25.588966][ T366] ================================================================== [ 25.607129][ T366] BUG: KASAN: stack-out-of-bounds in iov_iter_revert+0x269/0xa30 [ 25.615014][ T366] Read of size 8 at addr ffffc9000022ef38 by task syz-executor921/366 [ 25.623165][ T366] [ 25.625474][ T366] CPU: 0 PID: 366 Comm: syz-executor921 Not tainted 5.10.75-syzkaller-01082-g234d53d2bb60 #0 [ 25.635588][ T366] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 25.645644][ T366] Call Trace: [ 25.648916][ T366] dump_stack_lvl+0x1e2/0x24b [ 25.653565][ T366] ? printk+0xcf/0x119 [ 25.657606][ T366] ? show_regs_print_info+0x18/0x18 [ 25.662777][ T366] ? wake_up_klogd+0xb8/0xf0 [ 25.667342][ T366] ? devkmsg_release+0x127/0x127 [ 25.672263][ T366] print_address_description+0x8d/0x3d0 [ 25.677797][ T366] __kasan_report+0x142/0x220 [ 25.682447][ T366] ? iov_iter_revert+0x269/0xa30 [ 25.687358][ T366] kasan_report+0x51/0x70 [ 25.691670][ T366] __asan_report_load8_noabort+0x14/0x20 [ 25.697361][ T366] iov_iter_revert+0x269/0xa30 [ 25.702114][ T366] ? ext4_file_read_iter+0x4d0/0x4d0 [ 25.707387][ T366] ? security_file_permission+0xa8/0xc0 [ 25.712919][ T366] io_write+0xaf1/0xf80 [ 25.717057][ T366] ? io_arm_poll_handler+0xeb0/0xeb0 [ 25.722334][ T366] ? __kasan_check_write+0x14/0x20 [ 25.727422][ T366] ? __jbd2_journal_temp_unlink_buffer+0x37a/0x450 [ 25.733909][ T366] io_issue_sqe+0x1397/0xfc10 [ 25.738564][ T366] ? __io_req_task_cancel+0x720/0x720 [ 25.743909][ T366] ? __rcu_read_lock+0x50/0x50 [ 25.748657][ T366] ? is_bpf_text_address+0x1a2/0x1c0 [ 25.753925][ T366] ? is_module_text_address+0xe1/0x140 [ 25.759371][ T366] ? stack_trace_save+0x1e0/0x1e0 [ 25.764371][ T366] ? __kernel_text_address+0x9a/0x110 [ 25.769715][ T366] ? unwind_get_return_address+0x4c/0x90 [ 25.775321][ T366] ? arch_stack_walk+0xf8/0x140 [ 25.780160][ T366] ? stack_trace_save+0x11b/0x1e0 [ 25.785169][ T366] ? stack_trace_snprint+0xe0/0xe0 [ 25.790257][ T366] ? __rcu_read_lock+0x50/0x50 [ 25.795006][ T366] ? is_bpf_text_address+0x1a2/0x1c0 [ 25.800265][ T366] ? is_module_text_address+0xe1/0x140 [ 25.805694][ T366] ? stack_trace_save+0x1e0/0x1e0 [ 25.810697][ T366] ? __kernel_text_address+0x9a/0x110 [ 25.816040][ T366] ? unwind_get_return_address+0x4c/0x90 [ 25.821645][ T366] ? __kasan_check_write+0x14/0x20 [ 25.826732][ T366] ? _raw_spin_lock_irqsave+0xf8/0x210 [ 25.832162][ T366] ? _raw_spin_lock+0x1b0/0x1b0 [ 25.836985][ T366] ? stack_trace_save+0x11b/0x1e0 [ 25.841979][ T366] ? stack_trace_snprint+0xe0/0xe0 [ 25.847082][ T366] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 25.852870][ T366] ? stack_depot_save+0x41e/0x480 [ 25.857889][ T366] ? io_prep_rw+0x781/0xb70 [ 25.862385][ T366] ? io_req_prep+0x1bd7/0x51b0 [ 25.867145][ T366] ? io_queue_sqe+0x1180/0x1180 [ 25.871986][ T366] ? __rcu_read_lock+0x50/0x50 [ 25.876792][ T366] __io_queue_sqe+0x2cf/0x2fa0 [ 25.881570][ T366] io_queue_sqe+0x295/0x1180 [ 25.886147][ T366] io_submit_sqe+0x385/0xfd0 [ 25.890729][ T366] ? io_file_get+0x437/0x9c0 [ 25.895354][ T366] io_submit_sqes+0x1050/0x2da0 [ 25.900187][ T366] ? vma_wants_writenotify+0x2ed/0x390 [ 25.905638][ T366] ? io_uring_add_task_file+0x290/0x290 [ 25.911177][ T366] ? __kasan_check_write+0x14/0x20 [ 25.916269][ T366] ? mutex_lock+0xa6/0x110 [ 25.920663][ T366] ? io_uring_add_task_file+0x127/0x290 [ 25.926201][ T366] ? __fdget+0x172/0x240 [ 25.930429][ T366] __se_sys_io_uring_enter+0x322/0x12b0 [ 25.935949][ T366] ? __x64_sys_io_uring_enter+0x100/0x100 [ 25.941649][ T366] ? fput_many+0x47/0x1a0 [ 25.945955][ T366] ? debug_smp_processor_id+0x1c/0x20 [ 25.951298][ T366] __x64_sys_io_uring_enter+0xe5/0x100 [ 25.956737][ T366] do_syscall_64+0x31/0x70 [ 25.961138][ T366] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 25.967006][ T366] RIP: 0033:0x7fad2a468a59 [ 25.971399][ T366] Code: 28 c3 e8 1a 15 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 25.990985][ T366] RSP: 002b:00007ffcb1010af8 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 25.999376][ T366] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007fad2a468a59 [ 26.007328][ T366] RDX: 0000000000000000 RSI: 0000000000007cdc RDI: 0000000000000004 [ 26.015279][ T366] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 26.023231][ T366] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcb1010b20 [ 26.031185][ T366] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 26.039147][ T366] [ 26.041711][ T366] [ 26.044018][ T366] addr ffffc9000022ef38 is located in stack of task syz-executor921/366 at offset 24 in frame: [ 26.054315][ T366] io_write+0x0/0xf80 [ 26.058273][ T366] [ 26.060592][ T366] this frame has 3 objects: [ 26.065068][ T366] [32, 160) 'inline_vecs' [ 26.065074][ T366] [192, 200) 'iovec' [ 26.069463][ T366] [224, 264) '__iter' [ 26.073414][ T366] [ 26.079752][ T366] Memory state around the buggy address: [ 26.085358][ T366] ffffc9000022ee00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.093395][ T366] ffffc9000022ee80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.101428][ T366] >ffffc9000022ef00: 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 [ 26.109471][ T366]