audit: type=1400 audit(1602424934.152:8): avc: denied { execmem } for pid=6370 comm="syz-executor321" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 ================================================================== BUG: KASAN: slab-out-of-bounds in squashfs_inode_lookup fs/squashfs/export.c:57 [inline] BUG: KASAN: slab-out-of-bounds in squashfs_export_iget+0x193/0x1b0 fs/squashfs/export.c:82 Read of size 8 at addr ffff888090e6b238 by task syz-executor321/6370 CPU: 1 PID: 6370 Comm: syz-executor321 Not tainted 4.14.198-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x283 lib/dump_stack.c:58 print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252 kasan_report_error.cold+0x8a/0x194 mm/kasan/report.c:351 kasan_report mm/kasan/report.c:409 [inline] __asan_report_load8_noabort+0x68/0x70 mm/kasan/report.c:430 squashfs_inode_lookup fs/squashfs/export.c:57 [inline] squashfs_export_iget+0x193/0x1b0 fs/squashfs/export.c:82 squashfs_fh_to_dentry fs/squashfs/export.c:97 [inline] squashfs_fh_to_dentry+0x5f/0x90 fs/squashfs/export.c:90 exportfs_decode_fh+0x113/0x6bc fs/exportfs/expfs.c:433 do_handle_to_path fs/fhandle.c:153 [inline] handle_to_path fs/fhandle.c:208 [inline] do_handle_open+0x248/0x570 fs/fhandle.c:224 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x4443d9 RSP: 002b:00007ffcf4f70698 EFLAGS: 00000246 ORIG_RAX: 0000000000000130 RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 00000000004443d9 RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000005 RBP: 00000000006cf018 R08: 00007ffc00000015 R09: 00000000004002e0 R10: 00007ffcf4f70540 R11: 0000000000000246 R12: 0000000000401fc0 R13: 0000000000402050 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 4757: save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551 __do_kmalloc mm/slab.c:3720 [inline] __kmalloc+0x15a/0x400 mm/slab.c:3729 kmalloc include/linux/slab.h:493 [inline] shmem_initxattrs+0x14d/0x220 mm/shmem.c:3362 security_inode_init_security+0x253/0x320 security/security.c:492 shmem_mknod+0xbf/0x1d0 mm/shmem.c:3041 lookup_open+0x77a/0x1750 fs/namei.c:3241 do_last fs/namei.c:3334 [inline] path_openat+0xe08/0x2970 fs/namei.c:3569 do_filp_open+0x179/0x3c0 fs/namei.c:3603 do_sys_open+0x296/0x410 fs/open.c:1081 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb Freed by task 3652: save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0xc3/0x1a0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3496 [inline] kfree+0xc9/0x250 mm/slab.c:3815 security_context_to_sid_core+0x28a/0x3d0 security/selinux/ss/services.c:1460 selinux_inode_setsecurity+0x155/0x350 security/selinux/hooks.c:3377 selinux_inode_notifysecctx+0x2b/0x50 security/selinux/hooks.c:6152 security_inode_notifysecctx+0x76/0xb0 security/security.c:1314 kernfs_refresh_inode+0x328/0x4a0 fs/kernfs/inode.c:195 kernfs_iop_permission+0x59/0x90 fs/kernfs/inode.c:302 do_inode_permission fs/namei.c:384 [inline] __inode_permission+0x1f1/0x2f0 fs/namei.c:426 inode_permission fs/namei.c:476 [inline] may_lookup fs/namei.c:1717 [inline] link_path_walk+0x86a/0x10a0 fs/namei.c:2097 path_lookupat+0xcb/0x780 fs/namei.c:2342 filename_lookup+0x18a/0x510 fs/namei.c:2377 user_path_at include/linux/namei.h:57 [inline] vfs_statx+0xd1/0x180 fs/stat.c:185 vfs_lstat include/linux/fs.h:3070 [inline] SYSC_newlstat fs/stat.c:350 [inline] SyS_newlstat+0x83/0xe0 fs/stat.c:344 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb The buggy address belongs to the object at ffff888090e6b200 which belongs to the cache kmalloc-32 of size 32 The buggy address is located 24 bytes to the right of 32-byte region [ffff888090e6b200, ffff888090e6b220) The buggy address belongs to the page: page:ffffea0002439ac0 count:1 mapcount:0 mapping:ffff888090e6b000 index:0xffff888090e6bfc1 flags: 0xfffe0000000100(slab) raw: 00fffe0000000100 ffff888090e6b000 ffff888090e6bfc1 000000010000002a raw: ffffea00027aff20 ffffea00027a42a0 ffff88812fe501c0 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888090e6b100: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ffff888090e6b180: 00 00 01 fc fc fc fc fc 00 01 fc fc fc fc fc fc >ffff888090e6b200: 00 00 01 fc fc fc fc fc 00 fc fc fc fc fc fc fc ^ ffff888090e6b280: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ffff888090e6b300: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ==================================================================