[ 41.974516] audit: type=1800 audit(1578387086.828:32): pid=7703 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2450 res=0
Starting mcstransd:
[....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
Debian GNU/Linux 7 syzkaller ttyS0
syzkaller login: [ 46.483598] kauditd_printk_skb: 2 callbacks suppressed
[ 46.483614] audit: type=1400 audit(1578387091.388:35): avc: denied { map } for pid=7876 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1
Warning: Permanently added '10.128.0.117' (ECDSA) to the list of known hosts.
[ 63.717292] audit: type=1400 audit(1578387108.628:36): avc: denied { map } for pid=7888 comm="syz-executor603" path="/root/syz-executor603025872" dev="sda1" ino=16484 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
[ 63.738558] IPVS: ftp: loaded support on port[0] = 21
[ 63.773525] audit: type=1400 audit(1578387108.678:37): avc: denied { create } for pid=7889 comm="syz-executor603" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[ 63.799951] audit: type=1400 audit(1578387108.678:38): avc: denied { write } for pid=7889 comm="syz-executor603" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[ 63.825077] audit: type=1400 audit(1578387108.678:39): avc: denied { read } for pid=7889 comm="syz-executor603" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[ 63.873301] chnl_net:caif_netlink_parms(): no params data found
[ 63.909832] bridge0: port 1(bridge_slave_0) entered blocking state
[ 63.917196] bridge0: port 1(bridge_slave_0) entered disabled state
[ 63.924492] device bridge_slave_0 entered promiscuous mode
[ 63.932027] bridge0: port 2(bridge_slave_1) entered blocking state
[ 63.939624] bridge0: port 2(bridge_slave_1) entered disabled state
[ 63.946609] device bridge_slave_1 entered promiscuous mode
[ 63.962240] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 63.971706] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 63.988614] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[ 63.996726] team0: Port device team_slave_0 added
[ 64.002404] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[ 64.009812] team0: Port device team_slave_1 added
[ 64.015267] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[ 64.022688] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[ 64.086938] device hsr_slave_0 entered promiscuous mode
[ 64.135119] device hsr_slave_1 entered promiscuous mode
[ 64.175247] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[ 64.182530] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[ 64.227952] bridge0: port 2(bridge_slave_1) entered blocking state
[ 64.234813] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 64.241589] bridge0: port 1(bridge_slave_0) entered blocking state
[ 64.248076] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 64.281588] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready
[ 64.288910] 8021q: adding VLAN 0 to HW filter on device bond0
[ 64.298474] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[ 64.308070] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 64.328123] bridge0: port 1(bridge_slave_0) entered disabled state
[ 64.335926] bridge0: port 2(bridge_slave_1) entered disabled state
[ 64.342958] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 64.354043] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[ 64.360516] 8021q: adding VLAN 0 to HW filter on device team0
[ 64.370362] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 64.378061] bridge0: port 1(bridge_slave_0) entered blocking state
[ 64.384416] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 64.393988] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 64.401920] bridge0: port 2(bridge_slave_1) entered blocking state
[ 64.408328] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 64.423745] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 64.432133] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 64.442421] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 64.453561] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 64.464332] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 64.473554] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[ 64.480011] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 64.493918] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready
[ 64.501599] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 64.508451] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 64.519784] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 64.531923] IPv6: ADDRCONF(NETDEV_UP): veth0_virt_wifi: link is not ready
[ 64.542173] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 64.582083] IPv6: ADDRCONF(NETDEV_UP): veth0_vlan: link is not ready
[ 64.589284] IPv6: ADDRCONF(NETDEV_UP): vlan0: link is not ready
[ 64.596273] IPv6: ADDRCONF(NETDEV_UP): vlan1: link is not ready
[ 64.605747] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 64.613257] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 64.620811] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
executing program
[ 64.629909] device veth0_vlan entered promiscuous mode
[ 64.639198] device veth1_vlan entered promiscuous mode
[ 64.645980] IPv6: ADDRCONF(NETDEV_UP): macvlan0: link is not ready
[ 64.654713] IPv6: ADDRCONF(NETDEV_UP): macvlan1: link is not ready
[ 64.714840] protocol 88fb is buggy, dev hsr_slave_0
[ 64.720122] protocol 88fb is buggy, dev hsr_slave_1
[ 64.725546] ==================================================================
[ 64.733029] BUG: KASAN: use-after-free in macvlan_broadcast+0x57c/0x660
[ 64.739896] Read of size 4 at addr ffff88809b55fa41 by task syz-executor603/7889
[ 64.747436]
[ 64.749141] CPU: 1 PID: 7889 Comm: syz-executor603 Not tainted 4.19.93-syzkaller #0
[ 64.756925] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 64.768029] Call Trace:
[ 64.770618] dump_stack+0x197/0x210
[ 64.774253] ? macvlan_broadcast+0x57c/0x660
[ 64.779106] print_address_description.cold+0x7c/0x20d
[ 64.784480] ? macvlan_broadcast+0x57c/0x660
[ 64.788924] kasan_report.cold+0x8c/0x2ba
[ 64.793088] __asan_report_load_n_noabort+0xf/0x20
[ 64.798019] macvlan_broadcast+0x57c/0x660
[ 64.802275] macvlan_start_xmit+0x408/0x785
[ 64.806614] dev_direct_xmit+0x34d/0x650
[ 64.810666] ? validate_xmit_skb_list+0x130/0x130
[ 64.815517] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 64.821051] ? skb_copy_datagram_from_iter+0x441/0x660
[ 64.826345] packet_direct_xmit+0xf9/0x170
[ 64.830588] packet_sendmsg+0x3bb2/0x6440
[ 64.834762] ? packet_notifier+0x840/0x840
[ 64.839006] ? release_sock+0x156/0x1c0
[ 64.842980] ? selinux_socket_sendmsg+0x36/0x40
[ 64.847643] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 64.853189] ? security_socket_sendmsg+0x8d/0xc0
[ 64.857942] ? packet_notifier+0x840/0x840
[ 64.862171] sock_sendmsg+0xd7/0x130
[ 64.865104] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 64.865882] __sys_sendto+0x262/0x380
[ 64.873313] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 64.876427] ? __ia32_sys_getpeername+0xb0/0xb0
[ 64.876454] ? __ia32_sys_socketpair+0xf0/0xf0
[ 64.876480] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 64.876497] ? trace_hardirqs_on_thunk+0x1a/0x1c
[ 64.876512] ? trace_hardirqs_on_thunk+0x1a/0x1c
[ 64.876525] ? do_syscall_64+0x26/0x620
[ 64.876544] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 64.917204] __x64_sys_sendto+0xe1/0x1a0
[ 64.921282] do_syscall_64+0xfd/0x620
[ 64.925095] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 64.930290] RIP: 0033:0x442529
[ 64.933489] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00
[ 64.952982] RSP: 002b:00007ffd492895f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[ 64.960702] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000442529
[ 64.967987] RDX: 000000000000000e RSI: 0000000020000080 RDI: 0000000000000003
[ 64.975361] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
[ 64.982937] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 64.990354] R13: 0000000000403aa0 R14: 0000000000000000 R15: 0000000000000000
[ 64.997653]
[ 64.999273] Allocated by task 7703:
[ 65.002979] save_stack+0x45/0xd0
[ 65.006495] kasan_kmalloc+0xce/0xf0
[ 65.010236] kasan_slab_alloc+0xf/0x20
[ 65.014125] kmem_cache_alloc+0x12e/0x700
[ 65.018283] anon_vma_clone+0xde/0x480
[ 65.022174] anon_vma_fork+0x8f/0x4a0
[ 65.025977] copy_process.part.0+0x34e5/0x7a30
[ 65.030577] _do_fork+0x257/0xfd0
[ 65.034029] __x64_sys_clone+0xbf/0x150
[ 65.038008] do_syscall_64+0xfd/0x620
[ 65.041806] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 65.047305]
[ 65.048950] Freed by task 7704:
[ 65.052357] save_stack+0x45/0xd0
[ 65.056064] __kasan_slab_free+0x102/0x150
[ 65.060294] kasan_slab_free+0xe/0x10
[ 65.064189] kmem_cache_free+0x86/0x260
[ 65.068407] unlink_anon_vmas+0x2ba/0x860
[ 65.072559] free_pgtables+0x1af/0x2f0
[ 65.076440] exit_mmap+0x2d1/0x530
[ 65.079991] mmput+0x15f/0x4c0
[ 65.083176] flush_old_exec+0x8d9/0x1c20
[ 65.087234] load_elf_binary+0x9c0/0x53a0
[ 65.091721] search_binary_handler+0x179/0x570
[ 65.096319] load_script+0x671/0x8d0
[ 65.100033] search_binary_handler+0x179/0x570
[ 65.104611] __do_execve_file.isra.0+0x1227/0x2150
[ 65.109542] __x64_sys_execve+0x8f/0xc0
[ 65.113575] do_syscall_64+0xfd/0x620
[ 65.117462] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 65.122660]
[ 65.124300] The buggy address belongs to the object at ffff88809b55fa10
[ 65.124300] which belongs to the cache anon_vma_chain of size 80
[ 65.137483] The buggy address is located 49 bytes inside of
[ 65.137483] 80-byte region [ffff88809b55fa10, ffff88809b55fa60)
[ 65.149361] The buggy address belongs to the page:
[ 65.154285] page:ffffea00026d57c0 count:1 mapcount:0 mapping:ffff88821bc334c0 index:0xffff88809b55f380
[ 65.163738] flags: 0xfffe0000000100(slab)
[ 65.167881] raw: 00fffe0000000100 ffffea0002118f08 ffffea0002835f08 ffff88821bc334c0
[ 65.175752] raw: ffff88809b55f380 ffff88809b55f000 000000010000001b 0000000000000000
[ 65.183618] page dumped because: kasan: bad access detected
[ 65.189341]
[ 65.190975] Memory state around the buggy address:
[ 65.195985] ffff88809b55f900: fb fb fc fc fc fc fb fb fb fb fb fb fb fb fb fb
[ 65.203344] ffff88809b55f980: fc fc fc fc fb fb fb fb fb fb fb fb fb fb fc fc
[ 65.210706] >ffff88809b55fa00: fc fc fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 65.218054] ^
[ 65.223521] ffff88809b55fa80: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fb fb
[ 65.231069] ffff88809b55fb00: fb fb fb fb fb fb fb fb fc fc fc fc fb fb fb fb
[ 65.238420] ==================================================================
[ 65.245784] Disabling lock debugging due to kernel taint
[ 65.251554] Kernel panic - not syncing: panic_on_warn set ...
[ 65.251554]
[ 65.258937] CPU: 1 PID: 7889 Comm: syz-executor603 Tainted: G B 4.19.93-syzkaller #0
[ 65.268326] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 65.277842] Call Trace:
[ 65.280440] dump_stack+0x197/0x210
[ 65.284085] ? macvlan_broadcast+0x57c/0x660
[ 65.288485] panic+0x26a/0x50e
[ 65.291663] ? __warn_printk+0xf3/0xf3
[ 65.295556] ? retint_kernel+0x2d/0x2d
[ 65.299438] ? trace_hardirqs_on+0x5e/0x220
[ 65.303749] ? macvlan_broadcast+0x57c/0x660
[ 65.308164] kasan_end_report+0x47/0x4f
[ 65.312149] kasan_report.cold+0xa9/0x2ba
[ 65.316289] __asan_report_load_n_noabort+0xf/0x20
[ 65.321307] macvlan_broadcast+0x57c/0x660
[ 65.325551] macvlan_start_xmit+0x408/0x785
[ 65.329864] dev_direct_xmit+0x34d/0x650
[ 65.334003] ? validate_xmit_skb_list+0x130/0x130
[ 65.338838] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 65.344377] ? skb_copy_datagram_from_iter+0x441/0x660
[ 65.349667] packet_direct_xmit+0xf9/0x170
[ 65.353903] packet_sendmsg+0x3bb2/0x6440
[ 65.358062] ? packet_notifier+0x840/0x840
[ 65.362289] ? release_sock+0x156/0x1c0
[ 65.366256] ? selinux_socket_sendmsg+0x36/0x40
[ 65.370932] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 65.376482] ? security_socket_sendmsg+0x8d/0xc0
[ 65.381245] ? packet_notifier+0x840/0x840
[ 65.385508] sock_sendmsg+0xd7/0x130
[ 65.389275] __sys_sendto+0x262/0x380
[ 65.393139] ? __ia32_sys_getpeername+0xb0/0xb0
[ 65.397833] ? __ia32_sys_socketpair+0xf0/0xf0
[ 65.402412] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 65.407963] ? trace_hardirqs_on_thunk+0x1a/0x1c
[ 65.412708] ? trace_hardirqs_on_thunk+0x1a/0x1c
[ 65.417453] ? do_syscall_64+0x26/0x620
[ 65.421416] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 65.426809] __x64_sys_sendto+0xe1/0x1a0
[ 65.430866] do_syscall_64+0xfd/0x620
[ 65.434806] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 65.440582] RIP: 0033:0x442529
[ 65.443870] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00
[ 65.463072] RSP: 002b:00007ffd492895f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[ 65.470861] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000442529
[ 65.478252] RDX: 000000000000000e RSI: 0000000020000080 RDI: 0000000000000003
[ 65.485534] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
[ 65.492794] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 65.500149] R13: 0000000000403aa0 R14: 0000000000000000 R15: 0000000000000000
[ 65.509088] Kernel Offset: disabled
[ 65.512729] Rebooting in 86400 seconds..