[ 38.459290] audit: type=1800 audit(1583369381.620:33): pid=7362 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op="collect_data" cause="failed(directio)" comm="startpar" name="rc.local" dev="sda1" ino=2465 res=0
[ 38.491153] audit: type=1800 audit(1583369381.620:34): pid=7362 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op="collect_data" cause="failed(directio)" comm="startpar" name="rmnologin" dev="sda1" ino=2456 res=0
Debian GNU/Linux 7 syzkaller ttyS0
syzkaller login: [ 42.984695] random: sshd: uninitialized urandom read (32 bytes read)
[ 43.307696] audit: type=1400 audit(1583369386.470:35): avc: denied { map } for pid=7533 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1
[ 43.357840] random: sshd: uninitialized urandom read (32 bytes read)
[ 44.084026] random: sshd: uninitialized urandom read (32 bytes read)
[ 44.277407] random: sshd: uninitialized urandom read (32 bytes read)
Warning: Permanently added '10.128.0.202' (ECDSA) to the list of known hosts.
[ 49.852658] random: sshd: uninitialized urandom read (32 bytes read)
[ 50.075444] audit: type=1400 audit(1583369393.240:36): avc: denied { map } for pid=7545 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
2020/03/05 00:49:53 parsed 1 programs
[ 50.771146] random: cc1: uninitialized urandom read (8 bytes read)
2020/03/05 00:49:55 executed programs: 0
[ 51.821144] audit: type=1400 audit(1583369394.990:37): avc: denied { map } for pid=7545 comm="syz-execprog" path="/sys/kernel/debug/kcov" dev="debugfs" ino=1160 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1
[ 52.121168] IPVS: ftp: loaded support on port[0] = 21
[ 52.910641] chnl_net:caif_netlink_parms(): no params data found
[ 52.959326] bridge0: port 1(bridge_slave_0) entered blocking state
[ 52.966287] bridge0: port 1(bridge_slave_0) entered disabled state
[ 52.974174] device bridge_slave_0 entered promiscuous mode
[ 52.981794] bridge0: port 2(bridge_slave_1) entered blocking state
[ 52.988221] bridge0: port 2(bridge_slave_1) entered disabled state
[ 52.995360] device bridge_slave_1 entered promiscuous mode
[ 53.011054] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 53.019993] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 53.037926] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[ 53.045526] team0: Port device team_slave_0 added
[ 53.051354] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[ 53.058535] team0: Port device team_slave_1 added
[ 53.073100] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 53.079371] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 53.104688] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 53.115979] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 53.122458] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 53.147744] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 53.158231] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[ 53.166114] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[ 53.222470] device hsr_slave_0 entered promiscuous mode
[ 53.290330] device hsr_slave_1 entered promiscuous mode
[ 53.350781] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[ 53.358073] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[ 53.410318] audit: type=1400 audit(1583369396.570:38): avc: denied { create } for pid=7563 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[ 53.439371] audit: type=1400 audit(1583369396.590:39): avc: denied { write } for pid=7563 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[ 53.453266] bridge0: port 2(bridge_slave_1) entered blocking state
[ 53.464017] audit: type=1400 audit(1583369396.600:40): avc: denied { read } for pid=7563 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[ 53.469781] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 53.500462] bridge0: port 1(bridge_slave_0) entered blocking state
[ 53.506827] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 53.539706] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready
[ 53.546095] 8021q: adding VLAN 0 to HW filter on device bond0
[ 53.554611] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[ 53.564046] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 53.583043] bridge0: port 1(bridge_slave_0) entered disabled state
[ 53.590355] bridge0: port 2(bridge_slave_1) entered disabled state
[ 53.599925] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[ 53.607786] 8021q: adding VLAN 0 to HW filter on device team0
[ 53.617013] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 53.624682] bridge0: port 1(bridge_slave_0) entered blocking state
[ 53.631223] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 53.640511] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 53.648179] bridge0: port 2(bridge_slave_1) entered blocking state
[ 53.654601] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 53.669217] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 53.676927] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 53.686590] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 53.697501] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 53.707394] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 53.716952] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[ 53.723165] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 53.735826] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready
[ 53.744346] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 53.751650] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 53.762664] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 53.824178] IPv6: ADDRCONF(NETDEV_UP): veth0_virt_wifi: link is not ready
[ 53.834870] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 53.870629] IPv6: ADDRCONF(NETDEV_UP): veth0_vlan: link is not ready
[ 53.877909] IPv6: ADDRCONF(NETDEV_UP): vlan0: link is not ready
[ 53.884992] IPv6: ADDRCONF(NETDEV_UP): vlan1: link is not ready
[ 53.894032] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 53.901516] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 53.908832] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 53.915832] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 53.924751] device veth0_vlan entered promiscuous mode
[ 53.935376] device veth1_vlan entered promiscuous mode
[ 53.948602] IPv6: ADDRCONF(NETDEV_UP): veth0_macvtap: link is not ready
[ 53.958405] IPv6: ADDRCONF(NETDEV_UP): veth1_macvtap: link is not ready
[ 53.965517] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 53.973728] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 53.983254] device veth0_macvtap entered promiscuous mode
[ 53.989426] IPv6: ADDRCONF(NETDEV_UP): macvtap0: link is not ready
[ 53.998056] device veth1_macvtap entered promiscuous mode
[ 54.004379] IPv6: ADDRCONF(NETDEV_UP): macsec0: link is not ready
[ 54.013652] IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready
[ 54.023207] IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready
[ 54.032575] IPv6: ADDRCONF(NETDEV_UP): batadv_slave_0: link is not ready
[ 54.039693] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 54.048216] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 54.055954] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 54.063171] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 54.071560] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 54.082582] IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready
[ 54.089508] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 54.097066] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 54.104923] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
2020/03/05 00:50:00 executed programs: 18
[ 57.850816] ==================================================================
[ 57.858933] BUG: KASAN: use-after-free in l2tp_session_queue_purge+0xea/0xf0
[ 57.866272] Read of size 4 at addr ffff88809f6ba7c0 by task syz-executor.0/7718
[ 57.873994]
[ 57.875633] CPU: 0 PID: 7718 Comm: syz-executor.0 Not tainted 4.14.172-syzkaller #0
[ 57.883897] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 57.893264] Call Trace:
[ 57.895861] dump_stack+0x13e/0x194
[ 57.899492] ? l2tp_session_queue_purge+0xea/0xf0
[ 57.904615] print_address_description.cold+0x7c/0x1e2
[ 57.910112] ? l2tp_session_queue_purge+0xea/0xf0
[ 57.914963] kasan_report.cold+0xa9/0x2ae
[ 57.919526] l2tp_session_queue_purge+0xea/0xf0
[ 57.924208] l2tp_tunnel_closeall+0x1fe/0x370
[ 57.928888] ? l2tp_tunnel_find+0x490/0x490
[ 57.933308] ? udp_v6_flush_pending_frames+0xd0/0xd0
[ 57.938537] l2tp_udp_encap_destroy+0x8d/0xf0
[ 57.943045] udpv6_destroy_sock+0xa6/0xd0
[ 57.947996] sk_common_release+0x64/0x2f0
[ 57.952606] inet_release+0xdf/0x1b0
[ 57.956937] inet6_release+0x4c/0x70
[ 57.961425] __sock_release+0xcd/0x2b0
[ 57.965985] ? __sock_release+0x2b0/0x2b0
[ 57.970922] sock_close+0x15/0x20
[ 57.974421] __fput+0x25f/0x790
[ 57.977709] task_work_run+0x113/0x190
[ 57.981982] exit_to_usermode_loop+0x1d6/0x220
[ 57.986935] do_syscall_64+0x4a3/0x640
[ 57.990985] entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 57.996200] RIP: 0033:0x416011
[ 57.999635] RSP: 002b:00007fffd455a7f0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
[ 58.007540] RAX: 0000000000000000 RBX: 0000000000000006 RCX: 0000000000416011
[ 58.014822] RDX: 0000000000000000 RSI: 0000000000000081 RDI: 0000000000000005
[ 58.023365] RBP: 0000000000000000 R08: 00000000007703e0 R09: 01ffffffffffffff
[ 58.031628] R10: 00007fffd455a8c0 R11: 0000000000000293 R12: 000000000076bf20
[ 58.039891] R13: 00000000007703e8 R14: 0000000000000000 R15: 000000000076bf2c
[ 58.050546]
[ 58.052180] Allocated by task 7719:
[ 58.056242] save_stack+0x32/0xa0
[ 58.060292] kasan_kmalloc+0xbf/0xe0
[ 58.064007] __kmalloc+0x15b/0x7c0
[ 58.067535] l2tp_session_create+0x35/0x16f0
[ 58.071924] pppol2tp_connect+0x1154/0x17b0
[ 58.076561] SYSC_connect+0x1c6/0x250
[ 58.080450] do_syscall_64+0x1d5/0x640
[ 58.084933] entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 58.090366]
[ 58.091983] Freed by task 7719:
[ 58.095260] save_stack+0x32/0xa0
[ 58.098722] kasan_slab_free+0x75/0xc0
[ 58.102783] kfree+0xcb/0x260
[ 58.106116] pppol2tp_session_destruct+0xcd/0x110
[ 58.111101] __sk_destruct+0x49/0x640
[ 58.115322] sk_destruct+0x97/0xc0
[ 58.118859] __sk_free+0x4c/0x220
[ 58.122310] sk_free+0x2b/0x40
[ 58.125633] pppol2tp_release+0x247/0x2f0
[ 58.130137] __sock_release+0xcd/0x2b0
[ 58.134020] sock_close+0x15/0x20
[ 58.137651] __fput+0x25f/0x790
[ 58.141019] task_work_run+0x113/0x190
[ 58.145552] exit_to_usermode_loop+0x1d6/0x220
[ 58.150256] do_syscall_64+0x4a3/0x640
[ 58.154167] entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 58.159350]
[ 58.161070] The buggy address belongs to the object at ffff88809f6ba7c0
[ 58.161070] which belongs to the cache kmalloc-512 of size 512
[ 58.173837] The buggy address is located 0 bytes inside of
[ 58.173837] 512-byte region [ffff88809f6ba7c0, ffff88809f6ba9c0)
[ 58.185822] The buggy address belongs to the page:
[ 58.191022] page:ffffea00027dae80 count:1 mapcount:0 mapping:ffff88809f6ba040 index:0x0
[ 58.199550] flags: 0xfffe0000000100(slab)
[ 58.204764] raw: 00fffe0000000100 ffff88809f6ba040 0000000000000000 0000000100000006
[ 58.213467] raw: ffffea000285d6a0 ffffea00027c8ca0 ffff88812fe56940 0000000000000000
[ 58.221611] page dumped because: kasan: bad access detected
[ 58.227497]
[ 58.229297] Memory state around the buggy address:
[ 58.234844] ffff88809f6ba680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 58.242396] ffff88809f6ba700: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 58.250322] >ffff88809f6ba780: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[ 58.257786] ^
[ 58.263288] ffff88809f6ba800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 58.270654] ffff88809f6ba880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 58.278221] ==================================================================
[ 58.285802] Disabling lock debugging due to kernel taint
[ 58.295582] Kernel panic - not syncing: panic_on_warn set ...
[ 58.295582]
[ 58.316896] CPU: 0 PID: 7718 Comm: syz-executor.0 Tainted: G B 4.14.172-syzkaller #0
[ 58.330543] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 58.339883] Call Trace:
[ 58.342483] dump_stack+0x13e/0x194
[ 58.346398] panic+0x1f9/0x42d
[ 58.349601] ? add_taint.cold+0x16/0x16
[ 58.353686] ? preempt_schedule_common+0x4a/0xc0
[ 58.358507] ? l2tp_session_queue_purge+0xea/0xf0
[ 58.363349] ? ___preempt_schedule+0x16/0x18
[ 58.376616] ? l2tp_session_queue_purge+0xea/0xf0
[ 58.381632] kasan_end_report+0x43/0x49
[ 58.386647] kasan_report.cold+0x12f/0x2ae
[ 58.391149] l2tp_session_queue_purge+0xea/0xf0
[ 58.396176] l2tp_tunnel_closeall+0x1fe/0x370
[ 58.401418] ? l2tp_tunnel_find+0x490/0x490
[ 58.405868] ? udp_v6_flush_pending_frames+0xd0/0xd0
[ 58.414997] l2tp_udp_encap_destroy+0x8d/0xf0
[ 58.422467] udpv6_destroy_sock+0xa6/0xd0
[ 58.426623] sk_common_release+0x64/0x2f0
[ 58.432161] inet_release+0xdf/0x1b0
[ 58.436052] inet6_release+0x4c/0x70
[ 58.440006] __sock_release+0xcd/0x2b0
[ 58.443930] ? __sock_release+0x2b0/0x2b0
[ 58.453082] sock_close+0x15/0x20
[ 58.457432] __fput+0x25f/0x790
[ 58.460978] task_work_run+0x113/0x190
[ 58.465483] exit_to_usermode_loop+0x1d6/0x220
[ 58.470154] do_syscall_64+0x4a3/0x640
[ 58.474515] entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 58.480957] RIP: 0033:0x416011
[ 58.484319] RSP: 002b:00007fffd455a7f0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
[ 58.492795] RAX: 0000000000000000 RBX: 0000000000000006 RCX: 0000000000416011
[ 58.503477] RDX: 0000000000000000 RSI: 0000000000000081 RDI: 0000000000000005
[ 58.511559] RBP: 0000000000000000 R08: 00000000007703e0 R09: 01ffffffffffffff
[ 58.519915] R10: 00007fffd455a8c0 R11: 0000000000000293 R12: 000000000076bf20
[ 58.527696] R13: 00000000007703e8 R14: 0000000000000000 R15: 000000000076bf2c
[ 58.536430] Kernel Offset: disabled
[ 58.540072] Rebooting in 86400 seconds..