[ 20.626753][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.635707][ T7] device bridge_slave_0 left promiscuous mode [ 20.641849][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.650259][ T7] device veth1_macvtap left promiscuous mode [ 20.656195][ T7] device veth0_vlan left promiscuous mode [ 31.527307][ T24] kauditd_printk_skb: 74 callbacks suppressed [ 31.527320][ T24] audit: type=1400 audit(1693726779.080:150): avc: denied { transition } for pid=314 comm="sshd" path="/bin/sh" dev="sda1" ino=89 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 31.555430][ T24] audit: type=1400 audit(1693726779.080:151): avc: denied { noatsecure } for pid=314 comm="sshd" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 31.574911][ T24] audit: type=1400 audit(1693726779.090:152): avc: denied { rlimitinh } for pid=314 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 31.593523][ T24] audit: type=1400 audit(1693726779.090:153): avc: denied { siginh } for pid=314 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.47' (ED25519) to the list of known hosts. 2023/09/03 07:39:46 ignoring optional flag "sandboxArg"="0" 2023/09/03 07:39:46 parsed 1 programs [ 39.144295][ T24] audit: type=1400 audit(1693726786.700:154): avc: denied { mounton } for pid=335 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 39.169229][ T24] audit: type=1400 audit(1693726786.710:155): avc: denied { mount } for pid=335 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 2023/09/03 07:39:46 executed programs: 0 [ 39.192409][ T24] audit: type=1400 audit(1693726786.730:156): avc: denied { unlink } for pid=335 comm="syz-executor" name="swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 39.224558][ T335] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 39.276415][ T341] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.283909][ T341] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.291814][ T341] device bridge_slave_0 entered promiscuous mode [ 39.298673][ T341] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.305597][ T341] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.313444][ T341] device bridge_slave_1 entered promiscuous mode [ 39.347505][ T24] audit: type=1400 audit(1693726786.900:157): avc: denied { write } for pid=341 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 39.352869][ T341] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.369310][ T24] audit: type=1400 audit(1693726786.910:158): avc: denied { read } for pid=341 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 39.376082][ T341] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.403983][ T341] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.410835][ T341] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.429264][ T36] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.436433][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.444219][ T36] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 39.452403][ T36] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 39.468250][ T36] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 39.476820][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.483726][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.492651][ T36] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 39.500859][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.507996][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.515209][ T36] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 39.523202][ T36] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 39.534691][ T15] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 39.545703][ T341] device veth0_vlan entered promiscuous mode [ 39.552213][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 39.560503][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 39.568305][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 39.580032][ T341] device veth1_macvtap entered promiscuous mode [ 39.588166][ T51] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 39.600968][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 39.609655][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 39.621429][ T24] audit: type=1400 audit(1693726787.180:159): avc: denied { mounton } for pid=341 comm="syz-executor.0" path="/dev/binderfs" dev="devtmpfs" ino=357 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 39.648401][ T24] audit: type=1400 audit(1693726787.200:160): avc: denied { mounton } for pid=347 comm="syz-executor.0" path="/root/syzkaller-testdir3051322231/syzkaller.oRayQS/0/file0" dev="sda1" ino=1938 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 39.749608][ T350] ================================================================== [ 39.757846][ T350] BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 [ 39.763922][ T350] Write of size 4 at addr 0000000000000170 by task syz-executor.0/350 [ 39.772022][ T350] [ 39.774200][ T350] CPU: 0 PID: 350 Comm: syz-executor.0 Not tainted 5.10.192-syzkaller-989228-gc8ca447a86a2 #0 [ 39.784796][ T350] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 [ 39.794668][ T350] Call Trace: [ 39.797810][ T350] dump_stack_lvl+0x1e2/0x24b [ 39.802405][ T350] ? panic+0x80b/0x80b [ 39.806323][ T350] ? bfq_pos_tree_add_move+0x43b/0x43b [ 39.811601][ T350] ? fuse_put_request+0x26e/0x2d0 [ 39.816462][ T350] kasan_report+0x167/0x1c0 [ 39.820807][ T350] ? fuse_simple_request+0x13db/0x1a10 [ 39.826106][ T350] ? ihold+0x20/0x60 [ 39.829840][ T350] ? ihold+0x20/0x60 [ 39.833551][ T350] kasan_check_range+0x293/0x2a0 [ 39.838325][ T350] __kasan_check_write+0x14/0x20 [ 39.843097][ T350] ihold+0x20/0x60 [ 39.846661][ T350] backing_data_changed+0x1d9/0x4f0 [ 39.851702][ T350] ? fuse_init_symlink+0x70/0x70 [ 39.856467][ T350] ? dput+0x2b0/0x310 [ 39.860377][ T350] fuse_dentry_revalidate+0x826/0xe70 [ 39.865579][ T350] ? fuse_invalidate_entry_cache+0x270/0x270 [ 39.871416][ T350] ? _raw_spin_trylock_bh+0x190/0x190 [ 39.876606][ T350] __lookup_hash+0x1b3/0x290 [ 39.881036][ T350] do_renameat2+0x624/0x1130 [ 39.885542][ T350] ? fsnotify_move+0x290/0x290 [ 39.890228][ T350] ? getname_flags+0x1fd/0x520 [ 39.894829][ T350] __x64_sys_rename+0x86/0x90 [ 39.899341][ T350] do_syscall_64+0x34/0x70 [ 39.903596][ T350] entry_SYSCALL_64_after_hwframe+0x61/0xc6 [ 39.909328][ T350] RIP: 0033:0x7f87e5542ae9 [ 39.913571][ T350] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 39.933027][ T350] RSP: 002b:00007f87e50a40c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 [ 39.941356][ T350] RAX: ffffffffffffffda RBX: 00007f87e5662050 RCX: 00007f87e5542ae9 [ 39.949158][ T350] RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000020000100 [ 39.957064][ T350] RBP: 00007f87e558e47a R08: 0000000000000000 R09: 0000000000000000 [ 39.964976][ T350] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 39.972771][ T350] R13: 000000000000006e R14: 00007f87e5662050 R15: 00007ffe09318558 [ 39.980666][ T350] ================================================================== [ 39.988645][ T350] Disabling lock debugging due to kernel taint [ 39.995398][ T350] BUG: kernel NULL pointer dereference, address: 0000000000000170 [ 40.003016][ T350] #PF: supervisor write access in kernel mode [ 40.008912][ T350] #PF: error_code(0x0002) - not-present page [ 40.014817][ T350] PGD 10ce7e067 P4D 10ce7e067 PUD 10b8a8067 PMD 0 [ 40.021251][ T350] Oops: 0002 [#1] PREEMPT SMP KASAN [ 40.026280][ T350] CPU: 0 PID: 350 Comm: syz-executor.0 Tainted: G B 5.10.192-syzkaller-989228-gc8ca447a86a2 #0 [ 40.037734][ T350] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 [ 40.047642][ T350] RIP: 0010:ihold+0x25/0x60 [ 40.052008][ T350] Code: 00 00 00 00 00 55 48 89 e5 41 56 53 49 89 fe e8 31 83 b3 ff 49 8d be 70 01 00 00 be 04 00 00 00 e8 90 d7 f0 ff bb 01 00 00 00 41 0f c1 9e 70 01 00 00 ff c3 bf 02 00 00 00 89 de e8 b4 86 b3 [ 40.071587][ T350] RSP: 0018:ffffc90000f378c0 EFLAGS: 00010246 [ 40.077612][ T350] RAX: ffff88811eca9300 RBX: 0000000000000001 RCX: ffff88811eca93c0 [ 40.085497][ T350] RDX: 0000000000000000 RSI: 0000000000000286 RDI: 00000000ffffffff [ 40.093313][ T350] RBP: ffffc90000f378d0 R08: ffffffff813e2e1b R09: 0000000000000003 [ 40.101329][ T350] R10: fffffbfff0d50048 R11: dffffc0000000001 R12: ffffc90000f37960 [ 40.109208][ T350] R13: 1ffff920001e6f24 R14: 0000000000000000 R15: ffff88811c73df80 [ 40.117013][ T350] FS: 00007f87e50a46c0(0000) GS:ffff8881f7200000(0000) knlGS:0000000000000000 [ 40.125851][ T350] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 40.132538][ T350] CR2: 0000000000000170 CR3: 000000010ce79000 CR4: 00000000003506b0 [ 40.140342][ T350] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 40.148238][ T350] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 40.156185][ T350] Call Trace: [ 40.159316][ T350] ? __die_body+0x62/0xb0 [ 40.163565][ T350] ? __die+0x7e/0x90 [ 40.167296][ T350] ? no_context+0xbc8/0xf20 [ 40.171729][ T350] ? is_prefetch+0x5c0/0x5c0 [ 40.176385][ T350] ? preempt_schedule+0xd9/0xe0 [ 40.181060][ T350] ? __kasan_check_read+0x11/0x20 [ 40.185913][ T350] ? preempt_schedule_common+0xbe/0xf0 [ 40.191205][ T350] ? preempt_schedule+0xd9/0xe0 [ 40.195986][ T350] ? schedule_preempt_disabled+0x20/0x20 [ 40.201622][ T350] ? sysvec_apic_timer_interrupt+0xcb/0xe0 [ 40.207836][ T350] ? __bad_area_nosemaphore+0xcd/0x440 [ 40.213278][ T350] ? bad_area_nosemaphore+0x2d/0x40 [ 40.218565][ T350] ? exc_page_fault+0x3ea/0x5b0 [ 40.223333][ T350] ? asm_exc_page_fault+0x1e/0x30 [ 40.228191][ T350] ? check_panic_on_warn+0x5b/0xb0 [ 40.233237][ T350] ? ihold+0x25/0x60 [ 40.237042][ T350] backing_data_changed+0x1d9/0x4f0 [ 40.242263][ T350] ? fuse_init_symlink+0x70/0x70 [ 40.247272][ T350] ? dput+0x2b0/0x310 [ 40.251096][ T350] fuse_dentry_revalidate+0x826/0xe70 [ 40.256635][ T350] ? fuse_invalidate_entry_cache+0x270/0x270 [ 40.262464][ T350] ? _raw_spin_trylock_bh+0x190/0x190 [ 40.267655][ T350] __lookup_hash+0x1b3/0x290 [ 40.272073][ T350] do_renameat2+0x624/0x1130 [ 40.276508][ T350] ? fsnotify_move+0x290/0x290 [ 40.281275][ T350] ? getname_flags+0x1fd/0x520 [ 40.286129][ T350] __x64_sys_rename+0x86/0x90 [ 40.290997][ T350] do_syscall_64+0x34/0x70 [ 40.295240][ T350] entry_SYSCALL_64_after_hwframe+0x61/0xc6 [ 40.301053][ T350] RIP: 0033:0x7f87e5542ae9 [ 40.305504][ T350] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 40.325383][ T350] RSP: 002b:00007f87e50a40c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 [ 40.333827][ T350] RAX: ffffffffffffffda RBX: 00007f87e5662050 RCX: 00007f87e5542ae9 [ 40.341835][ T350] RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000020000100 [ 40.349811][ T350] RBP: 00007f87e558e47a R08: 0000000000000000 R09: 0000000000000000 [ 40.357625][ T350] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 40.365521][ T350] R13: 000000000000006e R14: 00007f87e5662050 R15: 00007ffe09318558 [ 40.373329][ T350] Modules linked in: [ 40.377059][ T350] CR2: 0000000000000170 [ 40.381050][ T350] ---[ end trace 53b8a6d269bb63ed ]--- [ 40.386355][ T350] RIP: 0010:ihold+0x25/0x60 [ 40.390687][ T350] Code: 00 00 00 00 00 55 48 89 e5 41 56 53 49 89 fe e8 31 83 b3 ff 49 8d be 70 01 00 00 be 04 00 00 00 e8 90 d7 f0 ff bb 01 00 00 00 41 0f c1 9e 70 01 00 00 ff c3 bf 02 00 00 00 89 de e8 b4 86 b3 [ 40.410127][ T350] RSP: 0018:ffffc90000f378c0 EFLAGS: 00010246 [ 40.416031][ T350] RAX: ffff88811eca9300 RBX: 0000000000000001 RCX: ffff88811eca93c0 [ 40.423870][ T350] RDX: 0000000000000000 RSI: 0000000000000286 RDI: 00000000ffffffff [ 40.431653][ T350] RBP: ffffc90000f378d0 R08: ffffffff813e2e1b R09: 0000000000000003 [ 40.439549][ T350] R10: fffffbfff0d50048 R11: dffffc0000000001 R12: ffffc90000f37960 [ 40.447360][ T350] R13: 1ffff920001e6f24 R14: 0000000000000000 R15: ffff88811c73df80 [ 40.455186][ T350] FS: 00007f87e50a46c0(0000) GS:ffff8881f7200000(0000) knlGS:0000000000000000 [ 40.463939][ T350] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 40.470661][ T350] CR2: 0000000000000170 CR3: 000000010ce79000 CR4: 00000000003506b0 [ 40.478465][ T350] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 40.486279][ T350] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 40.494082][ T350] Kernel panic - not syncing: Fatal exception [ 40.500277][ T350] Kernel Offset: disabled [ 40.504405][ T350] Rebooting in 86400 seconds..