BUG: Bad page state in process syz-executor4 pfn:1d9acc page:00000000b545c834 count:1 mapcount:1 mapping: (null) index:0x0 flags: 0x2fffc0000000004(referenced) raw: 02fffc0000000004 0000000000000000 0000000000000000 0000000100000000 raw: dead000000000100 dead000000000200 0000000000000000 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set Modules linked in: CPU: 0 PID: 4058 Comm: syz-executor4 Not tainted 4.15.0-rc5+ #149 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 bad_page+0x230/0x2b0 mm/page_alloc.c:577 free_pages_check_bad+0x1f0/0x2e0 mm/page_alloc.c:955 free_pages_check mm/page_alloc.c:964 [inline] free_pages_prepare mm/page_alloc.c:1054 [inline] free_pcp_prepare mm/page_alloc.c:1079 [inline] free_unref_page_prepare mm/page_alloc.c:2622 [inline] free_unref_page+0x594/0x9e0 mm/page_alloc.c:2672 __free_pages+0x107/0x150 mm/page_alloc.c:4297 free_pages+0x51/0x90 mm/page_alloc.c:4309 mon_free_buff drivers/usb/mon/mon_bin.c:1331 [inline] mon_bin_ioctl+0x653/0xd40 drivers/usb/mon/mon_bin.c:1039 mon_bin_compat_ioctl+0x19a/0x4e0 drivers/usb/mon/mon_bin.c:1183 C_SYSC_ioctl fs/compat_ioctl.c:1473 [inline] compat_SyS_ioctl+0x151/0x2a30 fs/compat_ioctl.c:1419 do_syscall_32_irqs_on arch/x86/entry/common.c:327 [inline] do_fast_syscall_32+0x3ee/0xf9d arch/x86/entry/common.c:389 entry_SYSENTER_compat+0x54/0x63 arch/x86/entry/entry_64_compat.S:125 RIP: 0023:0xf7fe7c79 RSP: 002b:00000000f77c208c EFLAGS: 00000296 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 0000000000000016 RCX: 0000000000009204 RDX: 000000000000f0b1 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 BUG: Bad page map in process syz-executor4 pte:1d9acc025 pmd:1bf024067 page:00000000b545c834 count:1 mapcount:-1 mapping: (null) index:0x0 flags: 0x2fffc0000000000() raw: 02fffc0000000000 0000000000000000 0000000000000000 00000001fffffffe raw: dead000000000100 dead000000000200 0000000000000000 0000000000000000 page dumped because: bad pte addr:00000000ca5a22d1 vm_flags:040400d4 anon_vma: (null) mapping:000000009583eea7 index:3 file:usbmon0 fault:mon_bin_vma_fault mmap:mon_bin_mmap readpage: (null) CPU: 1 PID: 4058 Comm: syz-executor4 Tainted: G B 4.15.0-rc5+ #149 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 print_bad_pte+0x681/0x8f0 mm/memory.c:771 zap_pte_range mm/memory.c:1336 [inline] zap_pmd_range mm/memory.c:1438 [inline] zap_pud_range mm/memory.c:1467 [inline] zap_p4d_range mm/memory.c:1488 [inline] unmap_page_range+0x19fd/0x22e0 mm/memory.c:1509 unmap_single_vma+0x15f/0x2d0 mm/memory.c:1554 unmap_vmas+0xf1/0x1b0 mm/memory.c:1584 exit_mmap+0x232/0x4f0 mm/mmap.c:3020 __mmput kernel/fork.c:923 [inline] mmput+0x223/0x6d0 kernel/fork.c:944 exit_mm kernel/exit.c:544 [inline] do_exit+0x90a/0x1ad0 kernel/exit.c:852 do_group_exit+0x149/0x400 kernel/exit.c:968 get_signal+0x73f/0x16c0 kernel/signal.c:2335 do_signal+0x94/0x1ee0 arch/x86/kernel/signal.c:809 exit_to_usermode_loop+0x214/0x310 arch/x86/entry/common.c:158 prepare_exit_to_usermode arch/x86/entry/common.c:195 [inline] syscall_return_slowpath arch/x86/entry/common.c:264 [inline] do_syscall_32_irqs_on arch/x86/entry/common.c:333 [inline] do_fast_syscall_32+0xbfd/0xf9d arch/x86/entry/common.c:389 entry_SYSENTER_compat+0x54/0x63 arch/x86/entry/entry_64_compat.S:125 RIP: 0023:0xf7fe7c79 RSP: 002b:00000000f77c210c EFLAGS: 00000296 ORIG_RAX: 00000000000000f0 RAX: fffffffffffffe00 RBX: 000000000813af98 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 BUG: Bad page state in process syz-executor4 pfn:1d9acc page:00000000b545c834 count:0 mapcount:-1 mapping: (null) index:0x0 flags: 0x2fffc0000000000() raw: 02fffc0000000000 0000000000000000 0000000000000000 00000000fffffffe raw: ffffea00075ffa60 ffffea0006ed4620 0000000000000000 0000000000000000 page dumped because: nonzero mapcount Modules linked in: CPU: 1 PID: 4058 Comm: syz-executor4 Tainted: G B 4.15.0-rc5+ #149 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 bad_page+0x230/0x2b0 mm/page_alloc.c:577 free_pages_check_bad+0x1f0/0x2e0 mm/page_alloc.c:955 free_pages_check mm/page_alloc.c:964 [inline] free_pages_prepare mm/page_alloc.c:1054 [inline] free_pcp_prepare mm/page_alloc.c:1079 [inline] free_unref_page_prepare mm/page_alloc.c:2622 [inline] free_unref_page_list+0x4ba/0x1380 mm/page_alloc.c:2692 release_pages+0xbd1/0x1230 mm/swap.c:820 free_pages_and_swap_cache+0x2ad/0x400 mm/swap_state.c:322 tlb_flush_mmu_free+0xb4/0x160 mm/memory.c:260 zap_pte_range mm/memory.c:1401 [inline] zap_pmd_range mm/memory.c:1438 [inline] zap_pud_range mm/memory.c:1467 [inline] zap_p4d_range mm/memory.c:1488 [inline] unmap_page_range+0x181e/0x22e0 mm/memory.c:1509 unmap_single_vma+0x15f/0x2d0 mm/memory.c:1554 unmap_vmas+0xf1/0x1b0 mm/memory.c:1584 exit_mmap+0x232/0x4f0 mm/mmap.c:3020 __mmput kernel/fork.c:923 [inline] mmput+0x223/0x6d0 kernel/fork.c:944 exit_mm kernel/exit.c:544 [inline] do_exit+0x90a/0x1ad0 kernel/exit.c:852 do_group_exit+0x149/0x400 kernel/exit.c:968 get_signal+0x73f/0x16c0 kernel/signal.c:2335 do_signal+0x94/0x1ee0 arch/x86/kernel/signal.c:809 exit_to_usermode_loop+0x214/0x310 arch/x86/entry/common.c:158 prepare_exit_to_usermode arch/x86/entry/common.c:195 [inline] syscall_return_slowpath arch/x86/entry/common.c:264 [inline] do_syscall_32_irqs_on arch/x86/entry/common.c:333 [inline] do_fast_syscall_32+0xbfd/0xf9d arch/x86/entry/common.c:389 entry_SYSENTER_compat+0x54/0x63 arch/x86/entry/entry_64_compat.S:125 RIP: 0023:0xf7fe7c79 RSP: 002b:00000000f77c210c EFLAGS: 00000296 ORIG_RAX: 00000000000000f0 RAX: fffffffffffffe00 RBX: 000000000813af98 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 kauditd_printk_skb: 7 callbacks suppressed audit: type=1400 audit(1514440647.419:27): avc: denied { create } for pid=4067 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 netlink: 16 bytes leftover after parsing attributes in process `syz-executor4'. netlink: 16 bytes leftover after parsing attributes in process `syz-executor4'. audit: type=1400 audit(1514440647.420:28): avc: denied { write } for pid=4067 comm="syz-executor4" path="socket:[13935]" dev="sockfs" ino=13935 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1514440647.420:29): avc: denied { listen } for pid=4067 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1514440647.420:30): avc: denied { setopt } for pid=4067 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1514440647.420:31): avc: denied { connect } for pid=4067 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 netlink: 16 bytes leftover after parsing attributes in process `syz-executor4'. netlink: 16 bytes leftover after parsing attributes in process `syz-executor2'. netlink: 16 bytes leftover after parsing attributes in process `syz-executor4'. netlink: 16 bytes leftover after parsing attributes in process `syz-executor4'. FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 1 CPU: 0 PID: 4457 Comm: syz-executor3 Tainted: G B 4.15.0-rc5+ #149 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc_node mm/slab.c:3289 [inline] kmem_cache_alloc_node+0x56/0x760 mm/slab.c:3632 alloc_task_struct_node kernel/fork.c:156 [inline] dup_task_struct kernel/fork.c:521 [inline] copy_process.part.38+0x198d/0x4b20 kernel/fork.c:1590 copy_process kernel/fork.c:1565 [inline] _do_fork+0x1f7/0xfe0 kernel/fork.c:2044 SYSC_clone kernel/fork.c:2154 [inline] SyS_clone+0x37/0x50 kernel/fork.c:2148 do_syscall_32_irqs_on arch/x86/entry/common.c:327 [inline] do_fast_syscall_32+0x3ee/0xf9d arch/x86/entry/common.c:389 entry_SYSENTER_compat+0x54/0x63 arch/x86/entry/entry_64_compat.S:125 RIP: 0023:0xf7fd8c79 RSP: 002b:00000000f77d408c EFLAGS: 00000296 ORIG_RAX: 0000000000000078 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000020e69000 RDX: 00000000209c4ffc RSI: 00000000201cc000 RDI: 0000000020a46000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 4665 Comm: syz-executor0 Tainted: G B 4.15.0-rc5+ #149 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc_node mm/slab.c:3289 [inline] kmem_cache_alloc_node+0x56/0x760 mm/slab.c:3632 __alloc_skb+0xf1/0x780 net/core/skbuff.c:193 alloc_skb include/linux/skbuff.h:983 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1147 [inline] netlink_sendmsg+0xa86/0xe60 net/netlink/af_netlink.c:1839 sock_sendmsg_nosec net/socket.c:636 [inline] sock_sendmsg+0xca/0x110 net/socket.c:646 sock_write_iter+0x31a/0x5d0 net/socket.c:915 call_write_iter include/linux/fs.h:1772 [inline] new_sync_write fs/read_write.c:469 [inline] __vfs_write+0x684/0x970 fs/read_write.c:482 vfs_write+0x189/0x510 fs/read_write.c:544 SYSC_write fs/read_write.c:589 [inline] SyS_write+0xef/0x220 fs/read_write.c:581 do_syscall_32_irqs_on arch/x86/entry/common.c:327 [inline] do_fast_syscall_32+0x3ee/0xf9d arch/x86/entry/common.c:389 entry_SYSENTER_compat+0x54/0x63 arch/x86/entry/entry_64_compat.S:125 RIP: 0023:0xf7fd7c79 RSP: 002b:00000000f77d308c EFLAGS: 00000296 ORIG_RAX: 0000000000000004 RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 00000000208f6fde RDX: 0000000000000022 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 4675 Comm: syz-executor0 Tainted: G B 4.15.0-rc5+ #149 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc_node mm/slab.c:3289 [inline] kmem_cache_alloc_node_trace+0x5a/0x750 mm/slab.c:3651 __do_kmalloc_node mm/slab.c:3671 [inline] __kmalloc_node_track_caller+0x33/0x70 mm/slab.c:3686 __kmalloc_reserve.isra.41+0x41/0xd0 net/core/skbuff.c:137 __alloc_skb+0x13b/0x780 net/core/skbuff.c:205 alloc_skb include/linux/skbuff.h:983 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1147 [inline] netlink_sendmsg+0xa86/0xe60 net/netlink/af_netlink.c:1839 sock_sendmsg_nosec net/socket.c:636 [inline] sock_sendmsg+0xca/0x110 net/socket.c:646 sock_write_iter+0x31a/0x5d0 net/socket.c:915 call_write_iter include/linux/fs.h:1772 [inline] new_sync_write fs/read_write.c:469 [inline] __vfs_write+0x684/0x970 fs/read_write.c:482 vfs_write+0x189/0x510 fs/read_write.c:544 SYSC_write fs/read_write.c:589 [inline] SyS_write+0xef/0x220 fs/read_write.c:581 do_syscall_32_irqs_on arch/x86/entry/common.c:327 [inline] do_fast_syscall_32+0x3ee/0xf9d arch/x86/entry/common.c:389 entry_SYSENTER_compat+0x54/0x63 arch/x86/entry/entry_64_compat.S:125 RIP: 0023:0xf7fd7c79 RSP: 002b:00000000f77d308c EFLAGS: 00000296 ORIG_RAX: 0000000000000004 RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 00000000208f6fde RDX: 0000000000000022 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 CPU: 0 PID: 4660 Comm: syz-executor1 Tainted: G B 4.15.0-rc5+ #149 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3368 [inline] kmem_cache_alloc+0x47/0x760 mm/slab.c:3542 getname_flags+0xcb/0x580 fs/namei.c:138 getname+0x19/0x20 fs/namei.c:209 do_sys_open+0x2e7/0x6d0 fs/open.c:1053 C_SYSC_open fs/open.c:1096 [inline] compat_SyS_open+0x2a/0x40 fs/open.c:1094 do_syscall_32_irqs_on arch/x86/entry/common.c:327 [inline] do_fast_syscall_32+0x3ee/0xf9d arch/x86/entry/common.c:389 entry_SYSENTER_compat+0x54/0x63 arch/x86/entry/entry_64_compat.S:125 RIP: 0023:0xf7f6fc79 RSP: 002b:00000000f776afd4 EFLAGS: 00000296 ORIG_RAX: 0000000000000005 RAX: ffffffffffffffda RBX: 00000000f776b00c RCX: 0000000000000002 RDX: 000000000810f2a4 RSI: 0000000000000583 RDI: 00000000f776b08c RBP: 000000000810f2a4 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 4695 Comm: syz-executor0 Tainted: G B 4.15.0-rc5+ #149 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc_node mm/slab.c:3289 [inline] kmem_cache_alloc_node+0x56/0x760 mm/slab.c:3632 __alloc_skb+0xf1/0x780 net/core/skbuff.c:193 alloc_skb include/linux/skbuff.h:983 [inline] nlmsg_new include/net/netlink.h:511 [inline] netlink_ack+0x283/0xa10 net/netlink/af_netlink.c:2343 netlink_rcv_skb+0x369/0x460 net/netlink/af_netlink.c:2414 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4423 netlink_unicast_kernel net/netlink/af_netlink.c:1275 [inline] netlink_unicast+0x4e8/0x6f0 net/netlink/af_netlink.c:1301 netlink_sendmsg+0xa4a/0xe60 net/netlink/af_netlink.c:1864 sock_sendmsg_nosec net/socket.c:636 [inline] sock_sendmsg+0xca/0x110 net/socket.c:646 sock_write_iter+0x31a/0x5d0 net/socket.c:915 call_write_iter include/linux/fs.h:1772 [inline] new_sync_write fs/read_write.c:469 [inline] __vfs_write+0x684/0x970 fs/read_write.c:482 vfs_write+0x189/0x510 fs/read_write.c:544 SYSC_write fs/read_write.c:589 [inline] SyS_write+0xef/0x220 fs/read_write.c:581 do_syscall_32_irqs_on arch/x86/entry/common.c:327 [inline] do_fast_syscall_32+0x3ee/0xf9d arch/x86/entry/common.c:389 entry_SYSENTER_compat+0x54/0x63 arch/x86/entry/entry_64_compat.S:125 RIP: 0023:0xf7fd7c79 RSP: 002b:00000000f77d308c EFLAGS: 00000296 ORIG_RAX: 0000000000000004 RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 00000000208f6fde RDX: 0000000000000022 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 4755 Comm: syz-executor0 Tainted: G B 4.15.0-rc5+ #149 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc_node mm/slab.c:3289 [inline] kmem_cache_alloc_node_trace+0x5a/0x750 mm/slab.c:3651 __do_kmalloc_node mm/slab.c:3671 [inline] __kmalloc_node_track_caller+0x33/0x70 mm/slab.c:3686 __kmalloc_reserve.isra.41+0x41/0xd0 net/core/skbuff.c:137 __alloc_skb+0x13b/0x780 net/core/skbuff.c:205 alloc_skb include/linux/skbuff.h:983 [inline] nlmsg_new include/net/netlink.h:511 [inline] netlink_ack+0x283/0xa10 net/netlink/af_netlink.c:2343 netlink_rcv_skb+0x369/0x460 net/netlink/af_netlink.c:2414 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4423 netlink_unicast_kernel net/netlink/af_netlink.c:1275 [inline] netlink_unicast+0x4e8/0x6f0 net/netlink/af_netlink.c:1301 netlink_sendmsg+0xa4a/0xe60 net/netlink/af_netlink.c:1864 sock_sendmsg_nosec net/socket.c:636 [inline] sock_sendmsg+0xca/0x110 net/socket.c:646 sock_write_iter+0x31a/0x5d0 net/socket.c:915 call_write_iter include/linux/fs.h:1772 [inline] new_sync_write fs/read_write.c:469 [inline] __vfs_write+0x684/0x970 fs/read_write.c:482 vfs_write+0x189/0x510 fs/read_write.c:544 SYSC_write fs/read_write.c:589 [inline] SyS_write+0xef/0x220 fs/read_write.c:581 do_syscall_32_irqs_on arch/x86/entry/common.c:327 [inline] do_fast_syscall_32+0x3ee/0xf9d arch/x86/entry/common.c:389 entry_SYSENTER_compat+0x54/0x63 arch/x86/entry/entry_64_compat.S:125 RIP: 0023:0xf7fd7c79 RSP: 002b:00000000f77d308c EFLAGS: 00000296 ORIG_RAX: 0000000000000004 RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 00000000208f6fde RDX: 0000000000000022 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=4941 comm=syz-executor0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=4941 comm=syz-executor0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2 sclass=netlink_route_socket pig=4980 comm=syz-executor0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2 sclass=netlink_route_socket pig=5001 comm=syz-executor0 audit: type=1400 audit(1514440651.825:32): avc: denied { create } for pid=5278 comm="syz-executor7" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_iscsi_socket permissive=1 device gre0 entered promiscuous mode audit: type=1400 audit(1514440652.454:33): avc: denied { map } for pid=5565 comm="syz-executor0" path="socket:[15644]" dev="sockfs" ino=15644 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_kobject_uevent_socket permissive=1 SELinux: unrecognized netlink message: protocol=4 nlmsg_type=24 sclass=netlink_tcpdiag_socket pig=5715 comm=syz-executor0 SELinux: unrecognized netlink message: protocol=4 nlmsg_type=24 sclass=netlink_tcpdiag_socket pig=5734 comm=syz-executor0 QAT: Invalid ioctl QAT: Invalid ioctl audit: type=1400 audit(1514440653.726:34): avc: denied { create } for pid=6182 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_fib_lookup_socket permissive=1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=177 sclass=netlink_route_socket pig=6256 comm=syz-executor0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=177 sclass=netlink_route_socket pig=6276 comm=syz-executor0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65304 sclass=netlink_route_socket pig=6350 comm=syz-executor0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65304 sclass=netlink_route_socket pig=6369 comm=syz-executor0 audit: type=1400 audit(1514440654.424:35): avc: denied { setuid } for pid=6506 comm="syz-executor3" capability=7 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 netlink: 'syz-executor0': attribute type 5 has an invalid length. netlink: 'syz-executor0': attribute type 5 has an invalid length. audit: type=1400 audit(1514440654.753:36): avc: denied { map } for pid=6686 comm="syz-executor0" path="/dev/sequencer2" dev="devtmpfs" ino=135 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sound_device_t:s0 tclass=chr_file permissive=1 audit: type=1400 audit(1514440654.846:37): avc: denied { write } for pid=6737 comm="syz-executor0" path="socket:[16188]" dev="sockfs" ino=16188 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_fib_lookup_socket permissive=1 audit: type=1400 audit(1514440654.894:38): avc: denied { map } for pid=6747 comm="syz-executor3" path=2F6D656D66643A70726F632B766D6E6574305E6D696D655F7479706575736572656D31776C616E3176626F786E6574306D696D655F7479706565746831202864656C6574656429 dev="tmpfs" ino=16818 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:tmpfs_t:s0 tclass=file permissive=1 audit: type=1400 audit(1514440655.677:39): avc: denied { create } for pid=7170 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_connector_socket permissive=1