[ 31.152932][ T3174] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
syzkaller login: [ 40.095429][ T25] kauditd_printk_skb: 37 callbacks suppressed
[ 40.095443][ T25] audit: type=1400 audit(1645431230.901:73): avc: denied { transition } for pid=3381 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 40.125176][ T25] audit: type=1400 audit(1645431230.931:74): avc: denied { write } for pid=3381 comm="sh" path="pipe:[27370]" dev="pipefs" ino=27370 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1
[ 40.151487][ T3381] sh (3381) used greatest stack depth: 22992 bytes left
Warning: Permanently added '10.128.0.80' (ECDSA) to the list of known hosts.
executing program
executing program
executing program
executing program
executing program
[ 47.681191][ T25] audit: type=1400 audit(1645431238.481:75): avc: denied { execmem } for pid=3588 comm="syz-executor309" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
executing program
[ 47.727157][ T25] audit: type=1400 audit(1645431238.531:76): avc: denied { create } for pid=3595 comm="syz-executor309" dev="anon_inodefs" ino=27766 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1
executing program
executing program
executing program
executing program
executing program
executing program
[ 47.841483][ C1] ==================================================================
[ 47.845136][ T8] ------------[ cut here ]------------
[ 47.849783][ C1] BUG: KASAN: use-after-free in io_rsrc_node_ref_zero+0x5a/0x274
[ 47.849854][ C1] Read of size 8 at addr ffff888014fd2a00 by task syz-executor309/3618
[ 47.855666][ T8] WARNING: CPU: 0 PID: 8 at fs/io_uring.c:9457 io_ring_exit_work+0x90f/0xbcc
[ 47.863068][ C1]
[ 47.863077][ C1] CPU: 1 PID: 3618 Comm: syz-executor309 Not tainted 5.17.0-rc4-syzkaller-00241-g7f25f0412c9e #0
[ 47.863108][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 47.863125][ C1] Call Trace:
[ 47.863134][ C1]
[ 47.863143][ C1] dump_stack_lvl+0xcd/0x134
[ 47.863174][ C1] print_address_description.constprop.0.cold+0x8d/0x303
[ 47.873184][ T8] Modules linked in:
[ 47.880143][ C1] ? io_rsrc_node_ref_zero+0x5a/0x274
[ 47.880186][ C1] ? io_rsrc_node_ref_zero+0x5a/0x274
[ 47.880217][ C1] kasan_report.cold+0x83/0xdf
[ 47.882702][ T8]
[ 47.893013][ C1] ? io_rsrc_node_ref_zero+0x5a/0x274
[ 47.893054][ C1] io_rsrc_node_ref_zero+0x5a/0x274
[ 47.893092][ C1] percpu_ref_put_many.constprop.0+0x22b/0x260
[ 47.893127][ C1] rcu_core+0x7b1/0x1820
[ 47.904092][ T8] CPU: 0 PID: 8 Comm: kworker/u4:0 Not tainted 5.17.0-rc4-syzkaller-00241-g7f25f0412c9e #0
[ 47.906470][ C1] ? rcu_momentary_dyntick_idle+0x30/0x30
[ 47.906515][ C1] __do_softirq+0x29b/0x9c2
[ 47.906548][ C1] __irq_exit_rcu+0x123/0x180
[ 47.909559][ T8] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 47.913971][ C1] irq_exit_rcu+0x5/0x20
[ 47.914024][ C1] sysvec_apic_timer_interrupt+0x93/0xc0
[ 47.914063][ C1]
[ 47.914072][ C1]
[ 47.914080][ C1] asm_sysvec_apic_timer_interrupt+0x12/0x20
[ 47.921307][ T8] Workqueue: events_unbound io_ring_exit_work
[ 47.924985][ C1] RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x60
[ 47.925024][ C1] Code: 48 89 ef 5d e9 41 8b 46 00 5d be 03 00 00 00 e9 d6 f7 67 02 66 0f 1f 44 00 00 48 8b be b0 01 00 00 e8 b4 ff ff ff 31 c0 c3 90 <65> 8b 05 39 5b 8a 7e 89 c1 48 8b 34 24 81 e1 00 01 00 00 65 48 8b
[ 47.925053][ C1] RSP: 0018:ffffc90002087e08 EFLAGS: 00000293
[ 47.925080][ C1] RAX: 0000000000000000 RBX: 0000000000000200 RCX: 0000000000000000
[ 47.925098][ C1] RDX: ffff88807e2b6140 RSI: ffffffff8167f8f4 RDI: 0000000000000003
[ 47.930695][ T8]
[ 47.935810][ C1] RBP: 00000000000021ac R08: 0000000000000000 R09: 0000000000000001
[ 47.935830][ C1] R10: ffffffff8167f8ea R11: 0000000000000001 R12: 0000000000000000
[ 47.935847][ C1] R13: dffffc0000000000 R14: 00007fa4f85b44ac R15: 00007ffe9f5e7080
[ 47.935869][ C1] ? ktime_get+0x18a/0x470
[ 47.935901][ C1] ? ktime_get+0x194/0x470
[ 47.935933][ C1] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70
[ 47.940921][ T8] RIP: 0010:io_ring_exit_work+0x90f/0xbcc
[ 47.943031][ C1] ktime_get+0x19a/0x470
[ 47.943063][ C1] __x64_sys_futex+0x388/0x4a0
[ 47.943093][ C1] ? do_futex+0x300/0x300
[ 47.943120][ C1] ? syscall_enter_from_user_mode+0x21/0x70
[ 47.943158][ C1] do_syscall_64+0x35/0xb0
[ 47.948732][ T8] Code: ff 37 00 48 c1 ea 03 48 c1 e0 2a 80 3c 02 00 74 08 4c 89 e7 e8 c4 89 b2 f8 48 8b 83 e0 fe ff ff 49 39 c4 74 07 e8 53 8b 6b f8 <0f> 0b e8 4c 8b 6b f8 48 8d bb d8 fe ff ff b8 ff ff 37 00 48 89 fa
[ 47.953705][ C1] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 47.953744][ C1] RIP: 0033:0x7fa4f852b1c9
[ 47.953769][ C1] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 47.953796][ C1] RSP: 002b:00007ffe9f5e04e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 47.953826][ C1] RAX: ffffffffffffffda RBX: 000000000000babd RCX: 00007fa4f852b1c9
[ 47.953845][ C1] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fa4f85b44ac
[ 47.953868][ C1] RBP: 0000000000000032 R08: 00007ffe9f5e7080 R09: 0000000000000000
[ 47.960347][ T8] RSP: 0018:ffffc90000eefbc8 EFLAGS: 00010293
[ 47.964256][ C1] R10: 00007ffe9f5e0520 R11: 0000000000000246 R12: 00007fa4f85b44ac
[ 47.964278][ C1] R13: 00007ffe9f5e0520 R14: 00007ffe9f5e0540 R15: 00007fa4f84e72d0
[ 47.964299][ C1]
[ 47.964309][ C1]
[ 47.964315][ C1] Allocated by task 3606:
[ 47.964328][ C1] kasan_save_stack+0x1e/0x40
[ 47.964363][ C1] __kasan_kmalloc+0xa6/0xd0
[ 47.964391][ C1] __kmalloc+0x209/0x4d0
[ 47.964415][ C1] io_rsrc_data_alloc+0x40/0x3b8
[ 47.974741][ T8]
[ 47.980538][ C1] io_sqe_buffers_register.cold+0x1f/0x443
[ 47.980578][ C1] __do_sys_io_uring_register+0x109b/0x15a0
[ 47.980609][ C1] do_syscall_64+0x35/0xb0
[ 47.980638][ C1] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 47.980666][ C1]
[ 47.980674][ C1] Freed by task 3606:
[ 47.985437][ T8] RAX: 0000000000000000 RBX: ffff88801db16688 RCX: 0000000000000000
[ 47.989827][ C1] kasan_save_stack+0x1e/0x40
[ 47.989859][ C1] kasan_set_track+0x21/0x30
[ 47.989886][ C1] kasan_set_free_info+0x20/0x30
[ 47.989918][ C1] ____kasan_slab_free+0xff/0x140
[ 47.989946][ C1] kfree+0xf8/0x2b0
[ 48.000253][ T8] RDX: ffff888011c40200 RSI: ffffffff890c892d RDI: 0000000000000000
[ 48.004212][ C1] __io_sqe_buffers_unregister+0xf6/0x18d
[ 48.004245][ C1] __do_sys_io_uring_register.cold+0x28f/0x1611
[ 48.004278][ C1] do_syscall_64+0x35/0xb0
[ 48.004307][ C1] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 48.004336][ C1]
[ 48.004341][ C1] The buggy address belongs to the object at ffff888014fd2a00
[ 48.004341][ C1] which belongs to the cache kmalloc-192 of size 192
[ 48.010200][ T8] RBP: ffff88801db16000 R08: 0000000000000000 R09: 0000000000000000
[ 48.012905][ C1] The buggy address is located 0 bytes inside of
[ 48.012905][ C1] 192-byte region [ffff888014fd2a00, ffff888014fd2ac0)
[ 48.012934][ C1] The buggy address belongs to the page:
[ 48.012945][ C1] page:ffffea000053f480 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14fd2
[ 48.012975][ C1] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 48.013012][ C1] raw: 00fff00000000200 ffffea000053f388 ffffea000052fac8 ffff888010c40000
[ 48.013040][ C1] raw: 0000000000000000 ffff888014fd2000 0000000100000010 0000000000000000
[ 48.016172][ T8] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88801db16568
[ 48.021921][ C1] page dumped because: kasan: bad access detected
[ 48.021939][ C1] page_owner tracks the page as allocated
[ 48.021946][ C1] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2420c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE), pid 1, ts 2173654799, free_ts 0
[ 48.021987][ C1] get_page_from_freelist+0xa72/0x2f50
[ 48.022019][ C1] __alloc_pages+0x1b2/0x500
[ 48.022043][ C1] cache_grow_begin+0x75/0x390
[ 48.022068][ C1] cache_alloc_refill+0x27f/0x380
[ 48.022091][ C1] kmem_cache_alloc_trace+0x380/0x4a0
[ 48.028520][ T8] R13: ffff88801db16010 R14: ffffc90000eefc20 R15: 0000000000000000
[ 48.034279][ C1] call_usermodehelper_setup+0x9d/0x340
[ 48.034316][ C1] kobject_uevent_env+0xf28/0x1600
[ 48.034344][ C1] param_sysfs_init+0x367/0x43b
[ 48.034378][ C1] do_one_initcall+0x103/0x650
[ 48.034406][ C1] kernel_init_freeable+0x6b1/0x73a
[ 48.054298][ T8] FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
[ 48.060077][ C1] kernel_init+0x1a/0x1d0
[ 48.060105][ C1] ret_from_fork+0x1f/0x30
[ 48.060134][ C1] page_owner free stack trace missing
[ 48.060144][ C1]
[ 48.060149][ C1] Memory state around the buggy address:
[ 48.060163][ C1] ffff888014fd2900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 48.060182][ C1] ffff888014fd2980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 48.060201][ C1] >ffff888014fd2a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 48.060216][ C1] ^
[ 48.068516][ T8] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 48.076149][ C1] ffff888014fd2a80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 48.076168][ C1] ffff888014fd2b00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 48.076184][ C1] ==================================================================
[ 48.076194][ C1] Disabling lock debugging due to kernel taint
[ 48.076260][ C1] Kernel panic - not syncing: panic_on_warn set ...
[ 48.078910][ T8] CR2: 00007fa4f84bb718 CR3: 0000000077472000 CR4: 00000000003506f0
[ 48.086679][ C1] CPU: 1 PID: 3618 Comm: syz-executor309 Tainted: G B 5.17.0-rc4-syzkaller-00241-g7f25f0412c9e #0
[ 48.086712][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 48.086727][ C1] Call Trace:
[ 48.086737][ C1]
[ 48.086743][ C1] dump_stack_lvl+0xcd/0x134
[ 48.086773][ C1] panic+0x2b0/0x6dd
[ 48.086800][ C1] ? __warn_printk+0xf3/0xf3
[ 48.086825][ C1] ? asm_sysvec_apic_timer_interrupt+0x12/0x20
[ 48.701494][ C1] ? trace_hardirqs_on+0x38/0x1c0
[ 48.706521][ C1] ? trace_hardirqs_on+0x51/0x1c0
[ 48.711538][ C1] ? io_rsrc_node_ref_zero+0x5a/0x274
[ 48.716906][ C1] ? io_rsrc_node_ref_zero+0x5a/0x274
[ 48.722277][ C1] end_report.cold+0x63/0x6f
[ 48.726893][ C1] kasan_report.cold+0x71/0xdf
[ 48.731656][ C1] ? io_rsrc_node_ref_zero+0x5a/0x274
[ 48.737023][ C1] io_rsrc_node_ref_zero+0x5a/0x274
[ 48.742241][ C1] percpu_ref_put_many.constprop.0+0x22b/0x260
[ 48.748401][ C1] rcu_core+0x7b1/0x1820
[ 48.752641][ C1] ? rcu_momentary_dyntick_idle+0x30/0x30
[ 48.758380][ C1] __do_softirq+0x29b/0x9c2
[ 48.762896][ C1] __irq_exit_rcu+0x123/0x180
[ 48.767583][ C1] irq_exit_rcu+0x5/0x20
[ 48.771821][ C1] sysvec_apic_timer_interrupt+0x93/0xc0
[ 48.777457][ C1]
[ 48.780384][ C1]
[ 48.783310][ C1] asm_sysvec_apic_timer_interrupt+0x12/0x20
[ 48.789290][ C1] RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x60
[ 48.795362][ C1] Code: 48 89 ef 5d e9 41 8b 46 00 5d be 03 00 00 00 e9 d6 f7 67 02 66 0f 1f 44 00 00 48 8b be b0 01 00 00 e8 b4 ff ff ff 31 c0 c3 90 <65> 8b 05 39 5b 8a 7e 89 c1 48 8b 34 24 81 e1 00 01 00 00 65 48 8b
[ 48.815149][ C1] RSP: 0018:ffffc90002087e08 EFLAGS: 00000293
[ 48.821209][ C1] RAX: 0000000000000000 RBX: 0000000000000200 RCX: 0000000000000000
[ 48.829178][ C1] RDX: ffff88807e2b6140 RSI: ffffffff8167f8f4 RDI: 0000000000000003
[ 48.837140][ C1] RBP: 00000000000021ac R08: 0000000000000000 R09: 0000000000000001
[ 48.845116][ C1] R10: ffffffff8167f8ea R11: 0000000000000001 R12: 0000000000000000
[ 48.853079][ C1] R13: dffffc0000000000 R14: 00007fa4f85b44ac R15: 00007ffe9f5e7080
[ 48.861044][ C1] ? ktime_get+0x18a/0x470
[ 48.865461][ C1] ? ktime_get+0x194/0x470
[ 48.869897][ C1] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70
[ 48.876142][ C1] ktime_get+0x19a/0x470
[ 48.880469][ C1] __x64_sys_futex+0x388/0x4a0
[ 48.885253][ C1] ? do_futex+0x300/0x300
[ 48.889575][ C1] ? syscall_enter_from_user_mode+0x21/0x70
[ 48.895470][ C1] do_syscall_64+0x35/0xb0
[ 48.899883][ C1] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 48.905777][ C1] RIP: 0033:0x7fa4f852b1c9
[ 48.910189][ C1] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 48.929814][ C1] RSP: 002b:00007ffe9f5e04e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 48.938234][ C1] RAX: ffffffffffffffda RBX: 000000000000babd RCX: 00007fa4f852b1c9
[ 48.946201][ C1] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fa4f85b44ac
[ 48.954178][ C1] RBP: 0000000000000032 R08: 00007ffe9f5e7080 R09: 0000000000000000
[ 48.962239][ C1] R10: 00007ffe9f5e0520 R11: 0000000000000246 R12: 00007fa4f85b44ac
[ 48.970205][ C1] R13: 00007ffe9f5e0520 R14: 00007ffe9f5e0540 R15: 00007fa4f84e72d0
[ 48.978195][ C1]
[ 48.981262][ C1] Kernel Offset: disabled
[ 48.985751][ C1] Rebooting in 86400 seconds..