[ 54.604629][ T26] audit: type=1400 audit(1581495631.296:42): avc: denied { map } for pid=8410 comm="syz-fuzzer" path="/root/syz-fuzzer" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 55.403642][ T26] audit: type=1400 audit(1581495632.096:43): avc: denied { integrity } for pid=8410 comm="syz-fuzzer" lockdown_reason="debugfs access" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=lockdown permissive=1 [ 55.589586][ T8428] IPVS: ftp: loaded support on port[0] = 21 [ 55.905750][ T501] tipc: TX() has been purged, node left! [ 56.128528][ T8414] can: request_module (can-proto-0) failed. [ 58.840978][ T8414] can: request_module (can-proto-0) failed. [ 58.851971][ T8414] can: request_module (can-proto-0) failed. [ 59.077949][ T26] audit: type=1400 audit(1581495635.776:44): avc: denied { create } for pid=8410 comm="syz-fuzzer" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_crypto_socket permissive=1 [ 59.102641][ T26] audit: type=1400 audit(1581495635.776:45): avc: denied { create } for pid=8410 comm="syz-fuzzer" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 59.127435][ T26] audit: type=1400 audit(1581495635.776:46): avc: denied { create } for pid=8410 comm="syz-fuzzer" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 Warning: Permanently added '10.128.0.57' (ECDSA) to the list of known hosts. 2020/02/12 08:20:42 parsed 1 programs 2020/02/12 08:20:43 executed programs: 0 [ 66.491011][ T8508] IPVS: ftp: loaded support on port[0] = 21 [ 66.510922][ T8505] IPVS: ftp: loaded support on port[0] = 21 [ 66.527118][ T8510] IPVS: ftp: loaded support on port[0] = 21 [ 66.583086][ T8511] IPVS: ftp: loaded support on port[0] = 21 [ 66.600837][ T8514] IPVS: ftp: loaded support on port[0] = 21 [ 66.612589][ T8515] IPVS: ftp: loaded support on port[0] = 21 [ 66.703852][ T8508] chnl_net:caif_netlink_parms(): no params data found [ 66.747145][ T8508] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.754471][ T8508] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.763026][ T8508] device bridge_slave_0 entered promiscuous mode [ 66.772440][ T8508] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.779870][ T8508] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.787701][ T8508] device bridge_slave_1 entered promiscuous mode [ 66.908600][ T8510] chnl_net:caif_netlink_parms(): no params data found [ 66.924516][ T8508] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.949839][ T8508] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.965468][ T8505] chnl_net:caif_netlink_parms(): no params data found [ 66.974243][ T8511] chnl_net:caif_netlink_parms(): no params data found [ 67.024354][ T8508] team0: Port device team_slave_0 added [ 67.038150][ T8508] team0: Port device team_slave_1 added [ 67.045405][ T8510] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.054226][ T8510] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.062684][ T8510] device bridge_slave_0 entered promiscuous mode [ 67.072548][ T8510] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.079755][ T8510] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.087767][ T8510] device bridge_slave_1 entered promiscuous mode [ 67.103068][ T8511] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.110323][ T8511] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.118304][ T8511] device bridge_slave_0 entered promiscuous mode [ 67.149293][ T8511] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.156495][ T8511] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.164391][ T8511] device bridge_slave_1 entered promiscuous mode [ 67.180159][ T8510] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 67.199622][ T8505] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.207142][ T8505] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.214742][ T8505] device bridge_slave_0 entered promiscuous mode [ 67.228403][ T8505] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.235520][ T8505] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.243757][ T8505] device bridge_slave_1 entered promiscuous mode [ 67.263904][ T8510] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 67.338738][ T8508] device hsr_slave_0 entered promiscuous mode [ 67.376085][ T8508] device hsr_slave_1 entered promiscuous mode [ 67.455055][ T8515] chnl_net:caif_netlink_parms(): no params data found [ 67.469620][ T8511] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 67.480989][ T8510] team0: Port device team_slave_0 added [ 67.491479][ T8505] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 67.505727][ T8505] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 67.529366][ T8511] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 67.539811][ T8514] chnl_net:caif_netlink_parms(): no params data found [ 67.548831][ T8510] team0: Port device team_slave_1 added [ 67.559424][ T8505] team0: Port device team_slave_0 added [ 67.588650][ T8515] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.595860][ T8515] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.603699][ T8515] device bridge_slave_0 entered promiscuous mode [ 67.623263][ T8505] team0: Port device team_slave_1 added [ 67.641141][ T8515] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.648640][ T8515] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.656739][ T8515] device bridge_slave_1 entered promiscuous mode [ 67.665216][ T8511] team0: Port device team_slave_0 added [ 67.738483][ T8510] device hsr_slave_0 entered promiscuous mode [ 67.796153][ T8510] device hsr_slave_1 entered promiscuous mode [ 67.835849][ T8510] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 67.843637][ T8510] Cannot create hsr debugfs directory [ 67.867956][ T8511] team0: Port device team_slave_1 added [ 67.891143][ T26] audit: type=1400 audit(1581495644.586:47): avc: denied { write } for pid=8508 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 67.916937][ T26] audit: type=1400 audit(1581495644.586:48): avc: denied { read } for pid=8508 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 67.956349][ T8514] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.963455][ T8514] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.972469][ T8514] device bridge_slave_0 entered promiscuous mode [ 67.980200][ T8508] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 68.010074][ T8515] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.058348][ T8505] device hsr_slave_0 entered promiscuous mode [ 68.096056][ T8505] device hsr_slave_1 entered promiscuous mode [ 68.135783][ T8505] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 68.143394][ T8505] Cannot create hsr debugfs directory [ 68.149147][ T8514] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.157051][ T8514] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.164944][ T8514] device bridge_slave_1 entered promiscuous mode [ 68.190831][ T8508] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 68.248542][ T8515] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.263864][ T8514] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.278078][ T8508] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 68.323813][ T8508] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 68.379946][ T8514] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.427926][ T8511] device hsr_slave_0 entered promiscuous mode [ 68.466263][ T8511] device hsr_slave_1 entered promiscuous mode [ 68.515796][ T8511] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 68.523403][ T8511] Cannot create hsr debugfs directory [ 68.558535][ T8515] team0: Port device team_slave_0 added [ 68.567394][ T8515] team0: Port device team_slave_1 added [ 68.581367][ T8510] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 68.647105][ T8514] team0: Port device team_slave_0 added [ 68.655045][ T8514] team0: Port device team_slave_1 added [ 68.669424][ T8510] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 68.752179][ T8510] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 68.828230][ T8505] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 68.879007][ T8510] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 68.998480][ T8514] device hsr_slave_0 entered promiscuous mode [ 69.036229][ T8514] device hsr_slave_1 entered promiscuous mode [ 69.075847][ T8514] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 69.083872][ T8514] Cannot create hsr debugfs directory [ 69.089651][ T8505] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 69.187641][ T8515] device hsr_slave_0 entered promiscuous mode [ 69.216490][ T8515] device hsr_slave_1 entered promiscuous mode [ 69.275776][ T8515] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 69.283486][ T8515] Cannot create hsr debugfs directory [ 69.297231][ T8505] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 69.353379][ T8505] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 69.411300][ T8511] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 69.490156][ T8511] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 69.556209][ T8511] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 69.599093][ T8511] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 69.699487][ T8515] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 69.768510][ T8515] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 69.801724][ T8515] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 69.857653][ T8514] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 69.919828][ T8514] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 69.974667][ T8508] 8021q: adding VLAN 0 to HW filter on device bond0 [ 69.991013][ T8515] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 70.042264][ T8514] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 70.109256][ T8514] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 70.182253][ T8508] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.203825][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 70.213332][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 70.243151][ T8505] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.261446][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 70.272226][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 70.281312][ T3163] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.288576][ T3163] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.298600][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 70.324789][ T3164] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 70.333471][ T3164] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 70.342247][ T3164] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 70.351213][ T3164] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 70.360094][ T3164] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.367351][ T3164] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.386525][ T3161] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 70.395515][ T3161] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 70.410142][ T8505] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.428135][ T8510] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.459895][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 70.472524][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 70.481199][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 70.490778][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 70.500061][ T3128] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.507343][ T3128] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.514897][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 70.522894][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 70.535807][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 70.543622][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 70.557888][ T8511] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.579637][ T8515] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.590403][ T8510] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.609872][ T3164] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 70.620005][ T3164] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 70.628885][ T3164] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.636083][ T3164] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.643682][ T3164] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 70.653017][ T3164] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 70.669802][ T8515] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.688267][ T3161] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 70.700228][ T3161] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 70.709325][ T3161] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 70.718290][ T3161] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 70.726861][ T3161] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 70.735791][ T3161] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 70.743902][ T3161] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 70.752563][ T3161] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 70.761357][ T3161] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 70.769574][ T3161] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 70.796934][ T8511] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.807303][ T8508] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 70.819290][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 70.829242][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 70.837962][ T3128] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.845007][ T3128] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.852867][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 70.863183][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 70.871605][ T3128] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.878742][ T3128] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.886516][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 70.895078][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 70.903499][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 70.912014][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 70.921443][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 70.930905][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 70.941183][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 70.971435][ T3164] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 70.980232][ T3164] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 70.988751][ T3164] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.995955][ T3164] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.004113][ T3164] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 71.013054][ T3164] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 71.021668][ T3164] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 71.030262][ T3164] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.037460][ T3164] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.044967][ T3164] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 71.054179][ T3164] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 71.062663][ T3164] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.069793][ T3164] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.077745][ T3164] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 71.086724][ T3164] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 71.095044][ T3164] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.102173][ T3164] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.111209][ T3164] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 71.119646][ T3164] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 71.127883][ T3164] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 71.135919][ T3164] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 71.169429][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 71.178672][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 71.187933][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 71.197212][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 71.205826][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 71.214226][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 71.222979][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 71.231131][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 71.240301][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 71.249192][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 71.264039][ T3161] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 71.273030][ T3161] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 71.281793][ T3161] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 71.291421][ T3161] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 71.300743][ T3161] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 71.309390][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 71.323453][ T8508] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.347672][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 71.357345][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 71.368522][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 71.378086][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 71.386738][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 71.395172][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 71.403800][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 71.412550][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 71.426840][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 71.434524][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 71.444434][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 71.453029][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 71.461557][ T3163] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 71.477624][ T8514] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.494705][ T8510] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 71.506845][ T8510] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 71.515266][ T8515] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 71.537253][ T2697] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 71.553086][ T2697] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 71.563216][ T2697] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 71.572220][ T2697] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 71.581134][ T2697] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 71.589643][ T2697] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 71.600464][ T8511] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 71.645500][ T8505] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.653385][ T3164] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 71.662318][ T3164] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 71.670072][ T3164] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 71.679003][ T3164] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 71.694559][ T26] audit: type=1400 audit(1581495648.386:49): avc: denied { associate } for pid=8508 comm="syz-executor.4" name="syz4" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1 [ 71.722019][ T8514] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.741301][ T8510] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.751771][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 71.759951][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 71.778912][ T3160] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 71.790399][ T3160] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 71.799297][ T3160] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.806568][ T3160] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.815060][ T3160] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 71.823695][ T3160] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 71.832171][ T3160] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.839278][ T3160] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.851472][ T3160] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 71.859592][ T3160] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 71.867720][ T3160] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 71.901789][ T3160] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 71.917033][ T3160] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 71.924642][ T3160] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 71.939619][ T3160] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 71.959995][ T8515] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.984800][ T8511] 8021q: adding VLAN 0 to HW filter on device batadv0 2020/02/12 08:20:48 executed programs: 6 [ 72.006750][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 72.015356][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 72.093982][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 72.156619][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 72.184106][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 72.194338][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 72.203363][ T3128] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 72.231331][ T2697] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 72.248079][ T2697] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 72.263235][ T8514] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 72.358671][ T2662] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 72.371390][ T2662] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 72.401876][ T8514] 8021q: adding VLAN 0 to HW filter on device batadv0 2020/02/12 08:20:53 executed programs: 102 2020/02/12 08:20:58 executed programs: 218 2020/02/12 08:21:03 executed programs: 328 2020/02/12 08:21:08 executed programs: 437 2020/02/12 08:21:13 executed programs: 549 [ 97.991655][T15044] [ 97.994125][T15044] ===================================== [ 98.000172][T15044] WARNING: bad unlock balance detected! [ 98.005704][T15044] 5.6.0-rc1-syzkaller #0 Not tainted [ 98.011159][T15044] ------------------------------------- [ 98.016679][T15044] syz-executor.5/15044 is trying to release lock (&file->mut) at: [ 98.024473][T15044] [] ucma_destroy_id+0x23e/0x400 [ 98.031056][T15044] but there are no more locks to release! [ 98.036769][T15044] [ 98.036769][T15044] other info that might help us debug this: [ 98.045155][T15044] 1 lock held by syz-executor.5/15044: [ 98.050596][T15044] #0: ffff888098f26860 (&file->mut){+.+.}, at: ucma_destroy_id+0x1de/0x400 [ 98.059293][T15044] [ 98.059293][T15044] stack backtrace: [ 98.065235][T15044] CPU: 0 PID: 15044 Comm: syz-executor.5 Not tainted 5.6.0-rc1-syzkaller #0 [ 98.073894][T15044] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 98.084074][T15044] Call Trace: [ 98.087351][T15044] dump_stack+0x12d/0x187 [ 98.091673][T15044] ? ucma_destroy_id+0x23e/0x400 [ 98.098521][T15044] print_unlock_imbalance_bug.cold.53+0x114/0x123 [ 98.104963][T15044] lock_release+0x60e/0x910 [ 98.109679][T15044] ? ucma_destroy_id+0x23e/0x400 [ 98.114815][T15044] ? lock_downgrade+0x900/0x900 [ 98.119669][T15044] __mutex_unlock_slowpath+0x86/0x690 [ 98.125033][T15044] ? wait_for_completion+0x460/0x460 [ 98.130406][T15044] mutex_unlock+0xd/0x10 [ 98.134637][T15044] ucma_destroy_id+0x23e/0x400 [ 98.139509][T15044] ? ucma_close+0x2d0/0x2d0 [ 98.144255][T15044] ? __kasan_check_write+0x14/0x20 [ 98.149351][T15044] ucma_write+0x203/0x2d0 [ 98.153678][T15044] ? selinux_file_permission+0x34d/0x430 [ 98.159314][T15044] ? ucma_open+0x250/0x250 [ 98.163715][T15044] ? security_file_permission+0x4c/0x290 [ 98.169356][T15044] __vfs_write+0x5e/0x110 [ 98.173676][T15044] vfs_write+0x18a/0x520 [ 98.177943][T15044] ksys_write+0x197/0x220 [ 98.182269][T15044] ? __ia32_sys_read+0xa0/0xa0 [ 98.187056][T15044] ? do_syscall_64+0x21/0x5f0 [ 98.191726][T15044] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 98.197917][T15044] __x64_sys_write+0x6e/0xb0 [ 98.202780][T15044] do_syscall_64+0xca/0x5f0 [ 98.207282][T15044] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 98.213169][T15044] RIP: 0033:0x45a679 [ 98.217055][T15044] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 98.236645][T15044] RSP: 002b:00007f9247488c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 98.245128][T15044] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a679 [ 98.253096][T15044] RDX: 0000000000000018 RSI: 0000000020000140 RDI: 0000000000000003 [ 98.261174][T15044] RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000 [ 98.269399][T15044] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f92474896d4 [ 98.277369][T15044] R13: 00000000004d2b38 R14: 00000000004e3be0 R15: 00000000ffffffff [ 98.295694][T15044] ================================================================== [ 98.304824][T15044] BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x93/0x690 [ 98.312813][T15044] Read of size 8 at addr ffff888095023200 by task syz-executor.5/15044 [ 98.321397][T15044] [ 98.323880][T15044] CPU: 0 PID: 15044 Comm: syz-executor.5 Not tainted 5.6.0-rc1-syzkaller #0 [ 98.333424][T15044] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 98.343464][T15044] Call Trace: [ 98.346748][T15044] dump_stack+0x12d/0x187 [ 98.351201][T15044] print_address_description.constprop.8.cold.10+0x9/0x31d [ 98.358388][T15044] ? __mutex_unlock_slowpath+0x93/0x690 [ 98.364055][T15044] __kasan_report.cold.11+0x1b/0x32 [ 98.369243][T15044] ? __mutex_unlock_slowpath+0x93/0x690 [ 98.374793][T15044] ? __mutex_unlock_slowpath+0x93/0x690 [ 98.381031][T15044] kasan_report+0x12/0x20 [ 98.385465][T15044] check_memory_region+0x153/0x1d0 [ 98.390592][T15044] __kasan_check_read+0x11/0x20 [ 98.395439][T15044] __mutex_unlock_slowpath+0x93/0x690 [ 98.401061][T15044] ? wait_for_completion+0x460/0x460 [ 98.406457][T15044] mutex_unlock+0xd/0x10 [ 98.410800][T15044] ucma_destroy_id+0x23e/0x400 [ 98.415581][T15044] ? ucma_close+0x2d0/0x2d0 [ 98.420093][T15044] ? __kasan_check_write+0x14/0x20 [ 98.425238][T15044] ucma_write+0x203/0x2d0 [ 98.429663][T15044] ? selinux_file_permission+0x34d/0x430 [ 98.435898][T15044] ? ucma_open+0x250/0x250 [ 98.440315][T15044] ? security_file_permission+0x4c/0x290 [ 98.446069][T15044] __vfs_write+0x5e/0x110 [ 98.450401][T15044] vfs_write+0x18a/0x520 [ 98.454761][T15044] ksys_write+0x197/0x220 [ 98.459099][T15044] ? __ia32_sys_read+0xa0/0xa0 [ 98.463860][T15044] ? do_syscall_64+0x21/0x5f0 [ 98.468533][T15044] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 98.474606][T15044] __x64_sys_write+0x6e/0xb0 [ 98.479313][T15044] do_syscall_64+0xca/0x5f0 [ 98.483950][T15044] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 98.489986][T15044] RIP: 0033:0x45a679 [ 98.493877][T15044] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 98.513619][T15044] RSP: 002b:00007f9247488c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 98.522081][T15044] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a679 [ 98.530300][T15044] RDX: 0000000000000018 RSI: 0000000020000140 RDI: 0000000000000003 [ 98.538268][T15044] RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000 [ 98.546454][T15044] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f92474896d4 [ 98.554429][T15044] R13: 00000000004d2b38 R14: 00000000004e3be0 R15: 00000000ffffffff [ 98.562422][T15044] [ 98.564742][T15044] Allocated by task 15044: [ 98.569152][T15044] save_stack+0x21/0x90 [ 98.573408][T15044] __kasan_kmalloc.constprop.13+0xc7/0xd0 [ 98.579318][T15044] kasan_kmalloc+0x9/0x10 [ 98.583877][T15044] kmem_cache_alloc_trace+0x15b/0x780 [ 98.589970][T15044] ucma_open+0x4d/0x250 [ 98.594120][T15044] misc_open+0x31b/0x4d0 [ 98.598738][T15044] chrdev_open+0x1ed/0x5c0 [ 98.603440][T15044] do_dentry_open+0x3fa/0x1100 [ 98.608199][T15044] vfs_open+0x9a/0xc0 [ 98.612170][T15044] path_openat+0x8fb/0x2d40 [ 98.616705][T15044] do_filp_open+0x171/0x240 [ 98.621323][T15044] do_sys_openat2+0x2e0/0x510 [ 98.625999][T15044] do_sys_open+0x90/0xe0 [ 98.630234][T15044] __x64_sys_openat+0x98/0xf0 [ 98.635046][T15044] do_syscall_64+0xca/0x5f0 [ 98.639570][T15044] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 98.645449][T15044] [ 98.647769][T15044] Freed by task 15002: [ 98.656180][T15044] save_stack+0x21/0x90 [ 98.660539][T15044] __kasan_slab_free+0x102/0x150 [ 98.665496][T15044] kasan_slab_free+0xe/0x10 [ 98.670151][T15044] kfree+0x108/0x2c0 [ 98.674043][T15044] ucma_close+0x22b/0x2d0 [ 98.678733][T15044] __fput+0x25a/0x770 [ 98.682722][T15044] ____fput+0x9/0x10 [ 98.686611][T15044] task_work_run+0x108/0x180 [ 98.691195][T15044] exit_to_usermode_loop+0x24e/0x2e0 [ 98.696481][T15044] do_syscall_64+0x4ff/0x5f0 [ 98.701066][T15044] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 98.706959][T15044] [ 98.709290][T15044] The buggy address belongs to the object at ffff888095023200 [ 98.709290][T15044] which belongs to the cache kmalloc-256 of size 256 [ 98.723449][T15044] The buggy address is located 0 bytes inside of [ 98.723449][T15044] 256-byte region [ffff888095023200, ffff888095023300) [ 98.736536][T15044] The buggy address belongs to the page: [ 98.742275][T15044] page:ffffea00025408c0 refcount:1 mapcount:0 mapping:ffff8880aa4008c0 index:0x0 [ 98.751767][T15044] flags: 0xfffe0000000200(slab) [ 98.756746][T15044] raw: 00fffe0000000200 ffffea00021fea88 ffffea000254cf48 ffff8880aa4008c0 [ 98.765662][T15044] raw: 0000000000000000 ffff888095023000 0000000100000008 0000000000000000 [ 98.775105][T15044] page dumped because: kasan: bad access detected [ 98.781505][T15044] [ 98.783898][T15044] Memory state around the buggy address: [ 98.790738][T15044] ffff888095023100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 98.798791][T15044] ffff888095023180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 98.806979][T15044] >ffff888095023200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 98.815136][T15044] ^ [ 98.819199][T15044] ffff888095023280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 98.827320][T15044] ffff888095023300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 98.835481][T15044] ================================================================== [ 98.853601][T15044] Kernel panic - not syncing: panic_on_warn set ... [ 98.860473][T15044] CPU: 0 PID: 15044 Comm: syz-executor.5 Tainted: G B 5.6.0-rc1-syzkaller #0 [ 98.870851][T15044] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 98.880900][T15044] Call Trace: [ 98.884192][T15044] dump_stack+0x12d/0x187 [ 98.888536][T15044] ? wait_for_completion+0x430/0x460 [ 98.893824][T15044] panic+0x22a/0x4e3 [ 98.897778][T15044] ? add_taint.cold.7+0x11/0x11 [ 98.902623][T15044] ? ___preempt_schedule+0x16/0x18 [ 98.908117][T15044] ? __mutex_unlock_slowpath+0x93/0x690 [ 98.913651][T15044] end_report+0x47/0x4f [ 98.917799][T15044] __kasan_report.cold.11+0xe/0x32 [ 98.923075][T15044] ? __mutex_unlock_slowpath+0x93/0x690 [ 98.928769][T15044] ? __mutex_unlock_slowpath+0x93/0x690 [ 98.934296][T15044] kasan_report+0x12/0x20 [ 98.938666][T15044] check_memory_region+0x153/0x1d0 [ 98.943944][T15044] __kasan_check_read+0x11/0x20 [ 98.948782][T15044] __mutex_unlock_slowpath+0x93/0x690 [ 98.954234][T15044] ? wait_for_completion+0x460/0x460 [ 98.959500][T15044] mutex_unlock+0xd/0x10 [ 98.963729][T15044] ucma_destroy_id+0x23e/0x400 [ 98.968481][T15044] ? ucma_close+0x2d0/0x2d0 [ 98.973004][T15044] ? __kasan_check_write+0x14/0x20 [ 98.978313][T15044] ucma_write+0x203/0x2d0 [ 98.982753][T15044] ? selinux_file_permission+0x34d/0x430 [ 98.988363][T15044] ? ucma_open+0x250/0x250 [ 98.992899][T15044] ? security_file_permission+0x4c/0x290 [ 98.998562][T15044] __vfs_write+0x5e/0x110 [ 99.002903][T15044] vfs_write+0x18a/0x520 [ 99.007151][T15044] ksys_write+0x197/0x220 [ 99.011468][T15044] ? __ia32_sys_read+0xa0/0xa0 [ 99.016230][T15044] ? do_syscall_64+0x21/0x5f0 [ 99.020897][T15044] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 99.026975][T15044] __x64_sys_write+0x6e/0xb0 [ 99.031697][T15044] do_syscall_64+0xca/0x5f0 [ 99.036197][T15044] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 99.042072][T15044] RIP: 0033:0x45a679 [ 99.045951][T15044] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 99.065765][T15044] RSP: 002b:00007f9247488c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 99.074191][T15044] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a679 [ 99.082208][T15044] RDX: 0000000000000018 RSI: 0000000020000140 RDI: 0000000000000003 [ 99.090273][T15044] RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000 [ 99.098390][T15044] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f92474896d4 [ 99.106393][T15044] R13: 00000000004d2b38 R14: 00000000004e3be0 R15: 00000000ffffffff [ 99.116258][T15044] Kernel Offset: disabled [ 99.120847][T15044] Rebooting in 86400 seconds..