kernel panic: Attempted to kill init!

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: b7e40c3d Merge 4.14.75 into android-4.14
git tree: android-4.14
console output: https://syzkaller.appspot.com/x/log.txt?x=14e32b4e400000
kernel config: https://syzkaller.appspot.com/x/.config?x=83372ecdbe063bdb
dashboard link: https://syzkaller.appspot.com/bug?extid=1fbcbd8d0940d271f3c9
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=174ae65e400000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11998ae9400000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+1fbcbd...@syzkaller.appspotmail.com

audit: type=1400 audit(1539269780.300:7): avc: denied { map } for
pid=1792 comm="syz-executor165" path="/root/syz-executor165556381"
dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
audit: type=1400 audit(1539269780.300:8): avc: denied { create } for
pid=1799 comm="syz-executor165"
scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tclass=netlink_generic_socket permissive=1
audit: type=1400 audit(1539269780.300:9): avc: denied { write } for
pid=1799 comm="syz-executor165"
scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tclass=netlink_generic_socket permissive=1
Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009

CPU: 1 PID: 1 Comm: init Not tainted 4.14.75+ #18
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0xb9/0x11b lib/dump_stack.c:53
panic+0x1bf/0x3a4 kernel/panic.c:181
find_child_reaper kernel/exit.c:578 [inline]
forget_original_parent kernel/exit.c:670 [inline]
exit_notify kernel/exit.c:706 [inline]
do_exit.cold.4+0xe0/0x2c0 kernel/exit.c:885
do_group_exit+0x100/0x2e0 kernel/exit.c:968
get_signal+0x4e5/0x1470 kernel/signal.c:2348
do_signal+0x8f/0x1660 arch/x86/kernel/signal.c:809
exit_to_usermode_loop+0x116/0x150 arch/x86/entry/common.c:159
prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
syscall_return_slowpath arch/x86/entry/common.c:267 [inline]
do_syscall_64+0x35d/0x4b0 arch/x86/entry/common.c:294
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7f8a6e600dd3
RSP: 002b:00007fff505c4638 EFLAGS: 00000246 ORIG_RAX: 0000000000000017
RAX: fffffffffffffdfe RBX: 00007fff505c47e0 RCX: 00007f8a6e600dd3
RDX: 0000000000000000 RSI: 00007fff505c4990 RDI: 000000000000000b
RBP: 00007fff505c4990 R08: 00007fff505c4a10 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00007fff505c6fa7 R14: 0000000000000001 R15: 0000000000000007
Kernel Offset: 0x14200000 from 0xffffffff81000000 (relocation range:
0xffffffff80000000-0xffffffffbfffffff)
Rebooting in 86400 seconds..


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 564ce1b4 Merge 4.4.164 into android-4.4
git tree: android-4.4
console output: https://syzkaller.appspot.com/x/log.txt?x=101da62b400000
kernel config: https://syzkaller.appspot.com/x/.config?x=94f69dc2a547eb32
dashboard link: https://syzkaller.appspot.com/bug?extid=70e358567f572928efce

compiler: gcc (GCC) 8.0.1 20180413 (experimental)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=106c177b400000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13573905400000

IMPORTANT: if you fix the bug, please add the following tag to the commit:

Reported-by: syzbot+70e358...@syzkaller.appspotmail.com

Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000005

CPU: 1 PID: 1 Comm: init Not tainted 4.4.164+ #123
0000000000000000 6605559270879af5 ffff8801da5ff9b8 ffffffff81aa5d4d
ffffffff82836620 0000000000000005 ffff8801da608010 dffffc0000000000
ffff8801da5ffbd8 ffff8801da5ffa78 ffffffff813a2404 0000000041b58ab3
Call Trace:
[<ffffffff81aa5d4d>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffffff81aa5d4d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
[<ffffffff813a2404>] panic+0x19e/0x359 kernel/panic.c:112
[<ffffffff813a2edc>] find_child_reaper kernel/exit.c:474 [inline]
[<ffffffff813a2edc>] forget_original_parent kernel/exit.c:563 [inline]
[<ffffffff813a2edc>] exit_notify kernel/exit.c:599 [inline]
[<ffffffff813a2edc>] do_exit.cold.6+0x19d/0x22e kernel/exit.c:776
[<ffffffff810dfc81>] do_group_exit+0x111/0x300 kernel/exit.c:885
[<ffffffff8110152c>] get_signal+0x4ec/0x14a0 kernel/signal.c:2321
[<ffffffff8100bf65>] do_signal+0x95/0x1840 arch/x86/kernel/signal.c:712
[<ffffffff81003eba>] exit_to_usermode_loop+0x11a/0x160
arch/x86/entry/common.c:250
[<ffffffff81005924>] prepare_exit_to_usermode arch/x86/entry/common.c:287
[inline]
[<ffffffff81005924>] syscall_return_slowpath+0x254/0x2d0
arch/x86/entry/common.c:352
[<ffffffff82713fed>] int_ret_from_sys_call+0x25/0xa3
Kernel Offset: disabled