unfix general protection fault in incfs_kill_sb

[Tadeusz Struk]

#syz unfix

[Tadeusz Struk]

#syz test: https://android.googlesource.com/kernel/common android13-5.10

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

0 PID: 66 Comm: kworker/0:1 Not tainted 5.10.107-syzkaller-00363-gb6079b142e3d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: ipv6_addrconf addrconf_dad_work
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118
dump_stack+0x15/0x1d lib/dump_stack.c:135
ubsan_epilogue lib/ubsan.c:148 [inline]
handle_object_size_mismatch lib/ubsan.c:297 [inline]
ubsan_type_mismatch_common+0x1ed/0x3a0 lib/ubsan.c:310
__ubsan_handle_type_mismatch_v1+0x5b/0x70 lib/ubsan.c:339
__skb_insert include/linux/skbuff.h:1932 [inline]
__skb_queue_before include/linux/skbuff.h:2039 [inline]
__skb_queue_tail include/linux/skbuff.h:2072 [inline]
wg_xmit+0x513/0xae0 drivers/net/wireguard/device.c:185
__netdev_start_xmit include/linux/netdevice.h:4831 [inline]
netdev_start_xmit+0x8a/0x160 include/linux/netdevice.h:4845
xmit_one net/core/dev.c:3591 [inline]
dev_hard_start_xmit+0x18d/0x2f0 net/core/dev.c:3607
__dev_queue_xmit+0x100c/0x1c30 net/core/dev.c:4173
dev_queue_xmit+0x17/0x20 net/core/dev.c:4206
neigh_connected_output+0x288/0x2b0 net/core/neighbour.c:1531
neigh_output include/net/neighbour.h:524 [inline]
ip6_finish_output2+0xde2/0x1440 net/ipv6/ip6_output.c:145
__ip6_finish_output+0x3e4/0x520 net/ipv6/ip6_output.c:210
ip6_finish_output+0x3f/0x220 net/ipv6/ip6_output.c:220
NF_HOOK_COND include/linux/netfilter.h:293 [inline]
ip6_output+0x1f8/0x4b0 net/ipv6/ip6_output.c:243
dst_output include/net/dst.h:443 [inline]
NF_HOOK+0xdd/0x280 include/linux/netfilter.h:304
ndisc_send_skb+0x646/0x9f0 net/ipv6/ndisc.c:508
ndisc_send_rs+0x26c/0x360 net/ipv6/ndisc.c:702
addrconf_dad_completed+0x4f3/0x9f0 net/ipv6/addrconf.c:4241
addrconf_dad_work+0x9c1/0x1520
process_one_work+0x3ca/0x660 kernel/workqueue.c:2298
worker_thread+0x709/0xa20 kernel/workqueue.c:2444
kthread+0x389/0x3c0 kernel/kthread.c:313
ret_from_fork+0x1f/0x30
================================================================================


Warning: Permanently added '10.128.1.76' (ECDSA) to the list of known hosts.
2022/03/22 22:02:42 fuzzer started
2022/03/22 22:02:42 connecting to host at 10.128.0.163:36653
2022/03/22 22:02:42 checking machine...
2022/03/22 22:02:42 checking revisions...
2022/03/22 22:02:43 testing simple program...
[ 20.906723][ T23] audit: type=1400 audit(1647986563.089:73): avc: denied { getattr } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 20.930874][ T23] audit: type=1400 audit(1647986563.089:74): avc: denied { read } for pid=362 comm="syz-fuzzer" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 20.931522][ T370] cgroup: Unknown subsys name 'net'
[ 20.952049][ T23] audit: type=1400 audit(1647986563.089:75): avc: denied { open } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 20.980021][ T23] audit: type=1400 audit(1647986563.089:76): avc: denied { read } for pid=362 comm="syz-fuzzer" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 20.980282][ T370] cgroup: Unknown subsys name 'devices'
[ 21.002856][ T23] audit: type=1400 audit(1647986563.089:77): avc: denied { open } for pid=362 comm="syz-fuzzer" path="/dev/raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 21.031725][ T23] audit: type=1400 audit(1647986563.089:78): avc: denied { mounton } for pid=370 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1136 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 21.054884][ T23] audit: type=1400 audit(1647986563.089:79): avc: denied { mount } for pid=370 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 21.077190][ T23] audit: type=1400 audit(1647986563.139:80): avc: denied { unmount } for pid=370 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 21.214843][ T370] cgroup: Unknown subsys name 'hugetlb'
[ 21.220530][ T370] cgroup: Unknown subsys name 'rlimit'
[ 21.284258][ T23] audit: type=1400 audit(1647986563.469:81): avc: denied { setattr } for pid=370 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 21.307522][ T23] audit: type=1400 audit(1647986563.469:82): avc: denied { execmem } for pid=372 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 21.356590][ T373] bridge0: port 1(bridge_slave_0) entered blocking state
[ 21.363738][ T373] bridge0: port 1(bridge_slave_0) entered disabled state
[ 21.371271][ T373] device bridge_slave_0 entered promiscuous mode
[ 21.378347][ T373] bridge0: port 2(bridge_slave_1) entered blocking state
[ 21.385412][ T373] bridge0: port 2(bridge_slave_1) entered disabled state
[ 21.392660][ T373] device bridge_slave_1 entered promiscuous mode
[ 21.422783][ T373] bridge0: port 2(bridge_slave_1) entered blocking state
[ 21.429826][ T373] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 21.437306][ T373] bridge0: port 1(bridge_slave_0) entered blocking state
[ 21.444615][ T373] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 21.463786][ T24] bridge0: port 1(bridge_slave_0) entered disabled state
[ 21.471214][ T24] bridge0: port 2(bridge_slave_1) entered disabled state
[ 21.478591][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 21.485958][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 21.504487][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 21.512946][ T24] bridge0: port 1(bridge_slave_0) entered blocking state
[ 21.520313][ T24] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 21.527701][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 21.536064][ T24] bridge0: port 2(bridge_slave_1) entered blocking state
[ 21.543076][ T24] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 21.550901][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 21.558905][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 21.578505][ T66] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 21.587032][ T66] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 21.593880][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!!
[ 21.595678][ T66] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 21.611913][ T66] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 21.620408][ T66] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 21.629278][ T66] ================================================================================
[ 21.638585][ T66] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:2039:28
[ 21.646399][ T66] member access within address ffffc9000024f1c0 with insufficient space
[ 21.654827][ T66] for an object of type 'struct sk_buff'
[ 21.660461][ T66] CPU: 0 PID: 66 Comm: kworker/0:1 Not tainted 5.10.107-syzkaller-00363-gb6079b142e3d #0
[ 21.670273][ T66] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 21.680447][ T66] Workqueue: ipv6_addrconf addrconf_dad_work
[ 21.686406][ T66] Call Trace:
[ 21.689686][ T66] dump_stack_lvl+0x1e2/0x24b
[ 21.694342][ T66] ? show_regs_print_info+0x18/0x18
[ 21.699624][ T66] ? wg_allowedips_lookup_dst+0x190/0x190
[ 21.705328][ T66] dump_stack+0x15/0x1d
[ 21.709485][ T66] ubsan_type_mismatch_common+0x1ed/0x3a0
[ 21.715367][ T66] ? __sanitizer_cov_trace_switch+0x74/0x90
[ 21.721235][ T66] __ubsan_handle_type_mismatch_v1+0x5b/0x70
[ 21.727193][ T66] wg_xmit+0x4a2/0xae0
[ 21.731239][ T66] ? wg_stop+0x5d0/0x5d0
[ 21.735461][ T66] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20
[ 21.741769][ T66] netdev_start_xmit+0x8a/0x160
[ 21.746698][ T66] dev_hard_start_xmit+0x18d/0x2f0
[ 21.751786][ T66] __dev_queue_xmit+0x100c/0x1c30
[ 21.756882][ T66] ? dev_queue_xmit+0x20/0x20
[ 21.761535][ T66] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 21.767759][ T66] ? ndisc_constructor+0x690/0x8a0
[ 21.772958][ T66] ? _raw_write_unlock_bh+0x31/0x47
[ 21.778238][ T66] ? ___neigh_create+0x162d/0x1ab0
[ 21.783331][ T66] ? dev_hard_header+0xdb/0xf0
[ 21.788093][ T66] dev_queue_xmit+0x17/0x20
[ 21.792576][ T66] neigh_connected_output+0x288/0x2b0
[ 21.797926][ T66] ip6_finish_output2+0xde2/0x1440
[ 21.803112][ T66] ? __rcu_read_lock+0x50/0x50
[ 21.807863][ T66] ? __ip6_finish_output+0x520/0x520
[ 21.813125][ T66] ? dst_cow_metrics_generic+0x55/0x1d0
[ 21.818651][ T66] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 21.824870][ T66] ? ip6_skb_dst_mtu+0xaf/0x260
[ 21.829717][ T66] __ip6_finish_output+0x3e4/0x520
[ 21.834835][ T66] ip6_finish_output+0x3f/0x220
[ 21.839676][ T66] ? ip6_output+0x1d3/0x4b0
[ 21.844155][ T66] ip6_output+0x1f8/0x4b0
[ 21.848546][ T66] ? asan.module_dtor+0x20/0x20
[ 21.853370][ T66] ? skb_dst+0x40/0x40
[ 21.857417][ T66] ? __rcu_read_lock+0x50/0x50
[ 21.862166][ T66] ? selinux_ipv6_forward+0x50/0x50
[ 21.867440][ T66] ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 21.873219][ T66] ? nf_hook_slow+0x150/0x1b0
[ 21.877870][ T66] NF_HOOK+0xdd/0x280
[ 21.881828][ T66] ? addrconf_addr_solict_mult+0xe0/0xe0
[ 21.887450][ T66] ? NF_HOOK+0x280/0x280
[ 21.891667][ T66] ? __rcu_read_lock+0x50/0x50
[ 21.896492][ T66] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 21.902745][ T66] ? ndisc_send_skb+0x547/0x9f0
[ 21.907622][ T66] ? memcpy+0x56/0x70
[ 21.911580][ T66] ndisc_send_skb+0x646/0x9f0
[ 21.916230][ T66] ? slab_post_alloc_hook+0x90/0xa0
[ 21.921404][ T66] ? ndisc_fill_addr_option+0x2f0/0x2f0
[ 21.926925][ T66] ? skb_set_owner_w+0x1a8/0x310
[ 21.931961][ T66] ? __sanitizer_cov_trace_cmp4+0x19/0x20
[ 21.937658][ T66] ? skb_put+0x11d/0x210
[ 21.941884][ T66] ndisc_send_rs+0x26c/0x360
[ 21.946468][ T66] addrconf_dad_completed+0x4f3/0x9f0
[ 21.951818][ T66] ? addrconf_dad_stop+0x430/0x430
[ 21.956905][ T66] ? mutex_unlock+0x34/0x40
[ 21.961384][ T66] addrconf_dad_work+0x9c1/0x1520
[ 21.966402][ T66] ? move_linked_works+0x118/0x130
[ 21.971495][ T66] ? ipv6_use_optimistic_addr+0x1d0/0x1d0
[ 21.977195][ T66] ? __kasan_check_write+0x14/0x20
[ 21.982284][ T66] process_one_work+0x3ca/0x660
[ 21.987126][ T66] worker_thread+0x709/0xa20
[ 21.991691][ T66] ? __kthread_parkme+0x11b/0x150
[ 21.996685][ T66] kthread+0x389/0x3c0
[ 22.000726][ T66] ? pr_cont_work+0x110/0x110
[ 22.005374][ T66] ? __list_add+0xc0/0xc0
[ 22.009679][ T66] ret_from_fork+0x1f/0x30
[ 22.014100][ T66] ================================================================================
[ 22.023373][ T66] ================================================================================
[ 22.032623][ T66] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:1932:2
[ 22.040342][ T66] member access within address ffffc9000024f1c0 with insufficient space
[ 22.048658][ T66] for an object of type 'struct sk_buff'
[ 22.054295][ T66] CPU: 0 PID: 66 Comm: kworker/0:1 Not tainted 5.10.107-syzkaller-00363-gb6079b142e3d #0
[ 22.064074][ T66] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 22.074111][ T66] Workqueue: ipv6_addrconf addrconf_dad_work
[ 22.080063][ T66] Call Trace:
[ 22.083327][ T66] dump_stack_lvl+0x1e2/0x24b
[ 22.087977][ T66] ? show_regs_print_info+0x18/0x18
[ 22.093148][ T66] ? wg_allowedips_lookup_dst+0x190/0x190
[ 22.098838][ T66] dump_stack+0x15/0x1d
[ 22.102966][ T66] ubsan_type_mismatch_common+0x1ed/0x3a0
[ 22.108657][ T66] __ubsan_handle_type_mismatch_v1+0x5b/0x70
[ 22.114611][ T66] wg_xmit+0x513/0xae0
[ 22.118678][ T66] ? wg_stop+0x5d0/0x5d0
[ 22.122894][ T66] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20
[ 22.129106][ T66] netdev_start_xmit+0x8a/0x160
[ 22.133927][ T66] dev_hard_start_xmit+0x18d/0x2f0
[ 22.139010][ T66] __dev_queue_xmit+0x100c/0x1c30
[ 22.144007][ T66] ? dev_queue_xmit+0x20/0x20
[ 22.148654][ T66] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 22.154864][ T66] ? ndisc_constructor+0x690/0x8a0
[ 22.159946][ T66] ? _raw_write_unlock_bh+0x31/0x47
[ 22.165114][ T66] ? ___neigh_create+0x162d/0x1ab0
[ 22.170196][ T66] ? dev_hard_header+0xdb/0xf0
[ 22.174931][ T66] dev_queue_xmit+0x17/0x20
[ 22.179403][ T66] neigh_connected_output+0x288/0x2b0
[ 22.184749][ T66] ip6_finish_output2+0xde2/0x1440
[ 22.189832][ T66] ? __rcu_read_lock+0x50/0x50
[ 22.194569][ T66] ? __ip6_finish_output+0x520/0x520
[ 22.199825][ T66] ? dst_cow_metrics_generic+0x55/0x1d0
[ 22.205356][ T66] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 22.211579][ T66] ? ip6_skb_dst_mtu+0xaf/0x260
[ 22.216422][ T66] __ip6_finish_output+0x3e4/0x520
[ 22.221543][ T66] ip6_finish_output+0x3f/0x220
[ 22.226366][ T66] ? ip6_output+0x1d3/0x4b0
[ 22.230843][ T66] ip6_output+0x1f8/0x4b0
[ 22.235252][ T66] ? asan.module_dtor+0x20/0x20
[ 22.240079][ T66] ? skb_dst+0x40/0x40
[ 22.244122][ T66] ? __rcu_read_lock+0x50/0x50
[ 22.248860][ T66] ? selinux_ipv6_forward+0x50/0x50
[ 22.254035][ T66] ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 22.259732][ T66] ? nf_hook_slow+0x150/0x1b0
[ 22.264385][ T66] NF_HOOK+0xdd/0x280
[ 22.268341][ T66] ? addrconf_addr_solict_mult+0xe0/0xe0
[ 22.273946][ T66] ? NF_HOOK+0x280/0x280
[ 22.278168][ T66] ? __rcu_read_lock+0x50/0x50
[ 22.282906][ T66] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 22.289130][ T66] ? ndisc_send_skb+0x547/0x9f0
[ 22.293959][ T66] ? memcpy+0x56/0x70
[ 22.297913][ T66] ndisc_send_skb+0x646/0x9f0
[ 22.302561][ T66] ? slab_post_alloc_hook+0x90/0xa0
[ 22.307734][ T66] ? ndisc_fill_addr_option+0x2f0/0x2f0
[ 22.313251][ T66] ? skb_set_owner_w+0x1a8/0x310
[ 22.318162][ T66] ? __sanitizer_cov_trace_cmp4+0x19/0x20
[ 22.323868][ T66] ? skb_put+0x11d/0x210
[ 22.328080][ T66] ndisc_send_rs+0x26c/0x360
[ 22.332646][ T66] addrconf_dad_completed+0x4f3/0x9f0
[ 22.337989][ T66] ? addrconf_dad_stop+0x430/0x430
[ 22.343074][ T66] ? mutex_unlock+0x34/0x40
[ 22.347561][ T66] addrconf_dad_work+0x9c1/0x1520
[ 22.352569][ T66] ? move_linked_works+0x118/0x130
[ 22.357653][ T66] ? ipv6_use_optimistic_addr+0x1d0/0x1d0
[ 22.363341][ T66] ? __kasan_check_write+0x14/0x20
[ 22.368420][ T66] process_one_work+0x3ca/0x660
[ 22.373244][ T66] worker_thread+0x709/0xa20
[ 22.377804][ T66] ? __kthread_parkme+0x11b/0x150
2022/03/22 22:02:44 building call list...
[ 22.382801][ T66] kthread+0x389/0x3c0
[ 22.386845][ T66] ? pr_cont_work+0x110/0x110
[ 22.391493][ T66] ? __list_add+0xc0/0xc0
[ 22.395809][ T66] ret_from_fork+0x1f/0x30
[ 22.400243][ T66] ================================================================================
[ 22.419853][ T373] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation
[ 22.960615][ T177] device bridge_slave_1 left promiscuous mode
[ 22.973224][ T177] bridge0: port 2(bridge_slave_1) entered disabled state
[ 22.983822][ T177] device bridge_slave_0 left promiscuous mode
[ 22.990029][ T177] bridge0: port 1(bridge_slave_0) entered disabled state


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=13b9b1dd700000


Tested on:

commit: b6079b14 ANDROID: incremental-fs: limit mount stack de..
git tree: https://android.googlesource.com/kernel/common android13-5.10
kernel config: https://syzkaller.appspot.com/x/.config?x=ca04e146f3fe0f6d
dashboard link: https://syzkaller.appspot.com/bug?extid=071207fec3b90d253e91
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2

Note: no patches were applied.

[Tadeusz Struk]

[Tadeusz Struk]

#syz fix: ANDROID: incremental-fs: limit mount stack depth

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

=================

UBSAN: object-size-mismatch in ./include/linux/skbuff.h:1932:2

member access within address ffffc90000ab71c0 with insufficient space

for an object of type 'struct sk_buff'

CPU: 0 PID: 108 Comm: kworker/0:2 Not tainted 5.10.107-syzkaller-00363-gb6079b142e3d #0

Warning: Permanently added '10.128.0.32' (ECDSA) to the list of known hosts.
2022/03/22 22:41:44 fuzzer started
2022/03/22 22:41:45 connecting to host at 10.128.0.163:36101
2022/03/22 22:41:45 checking machine...
2022/03/22 22:41:45 checking revisions...
2022/03/22 22:41:45 testing simple program...
[ 19.316147][ T23] audit: type=1400 audit(1647988905.259:73): avc: denied { getattr } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 19.319855][ T23] audit: type=1400 audit(1647988905.259:74): avc: denied { read } for pid=362 comm="syz-fuzzer" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 19.323558][ T23] audit: type=1400 audit(1647988905.259:75): avc: denied { open } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 19.327256][ T23] audit: type=1400 audit(1647988905.269:76): avc: denied { read } for pid=362 comm="syz-fuzzer" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 19.334004][ T23] audit: type=1400 audit(1647988905.269:77): avc: denied { open } for pid=362 comm="syz-fuzzer" path="/dev/raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 19.335781][ T371] cgroup: Unknown subsys name 'net'
[ 19.345764][ T23] audit: type=1400 audit(1647988905.279:78): avc: denied { mounton } for pid=371 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1136 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 19.373721][ T23] audit: type=1400 audit(1647988905.279:79): avc: denied { mount } for pid=371 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 19.373996][ T371] cgroup: Unknown subsys name 'devices'
[ 19.395962][ T23] audit: type=1400 audit(1647988905.289:80): avc: denied { unmount } for pid=371 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 19.504597][ T371] cgroup: Unknown subsys name 'hugetlb'
[ 19.510255][ T371] cgroup: Unknown subsys name 'rlimit'
[ 19.663945][ T23] audit: type=1400 audit(1647988905.609:81): avc: denied { setattr } for pid=371 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 19.690992][ T23] audit: type=1400 audit(1647988905.639:82): avc: denied { execmem } for pid=372 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 19.743417][ T373] bridge0: port 1(bridge_slave_0) entered blocking state
[ 19.750597][ T373] bridge0: port 1(bridge_slave_0) entered disabled state
[ 19.758227][ T373] device bridge_slave_0 entered promiscuous mode
[ 19.765096][ T373] bridge0: port 2(bridge_slave_1) entered blocking state
[ 19.772116][ T373] bridge0: port 2(bridge_slave_1) entered disabled state
[ 19.779516][ T373] device bridge_slave_1 entered promiscuous mode
[ 19.809929][ T373] bridge0: port 2(bridge_slave_1) entered blocking state
[ 19.816981][ T373] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 19.824281][ T373] bridge0: port 1(bridge_slave_0) entered blocking state
[ 19.831391][ T373] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 19.849867][ T67] bridge0: port 1(bridge_slave_0) entered disabled state
[ 19.857643][ T67] bridge0: port 2(bridge_slave_1) entered disabled state
[ 19.865143][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 19.872514][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 19.893798][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 19.902267][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 19.910754][ T67] bridge0: port 1(bridge_slave_0) entered blocking state
[ 19.917903][ T67] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 19.926234][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 19.934492][ T67] bridge0: port 2(bridge_slave_1) entered blocking state
[ 19.941498][ T67] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 19.948887][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 19.956805][ T67] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 19.973212][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 19.981534][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 19.990274][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 19.998327][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 20.015186][ T373] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation
[ 20.025700][ T108] ================================================================================
[ 20.035003][ T108] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:2039:28
[ 20.042802][ T108] member access within address ffffc90000ab71c0 with insufficient space
[ 20.051253][ T108] for an object of type 'struct sk_buff'
[ 20.056911][ T108] CPU: 0 PID: 108 Comm: kworker/0:2 Not tainted 5.10.107-syzkaller-00363-gb6079b142e3d #0
[ 20.066780][ T108] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 20.076842][ T108] Workqueue: ipv6_addrconf addrconf_dad_work
[ 20.082801][ T108] Call Trace:
[ 20.086085][ T108] dump_stack_lvl+0x1e2/0x24b
[ 20.090753][ T108] ? show_regs_print_info+0x18/0x18
[ 20.095941][ T108] ? wg_allowedips_lookup_dst+0x190/0x190
[ 20.101663][ T108] dump_stack+0x15/0x1d
[ 20.105838][ T108] ubsan_type_mismatch_common+0x1ed/0x3a0
[ 20.111557][ T108] ? __sanitizer_cov_trace_switch+0x74/0x90
[ 20.117437][ T108] __ubsan_handle_type_mismatch_v1+0x5b/0x70
[ 20.123400][ T108] wg_xmit+0x4a2/0xae0
[ 20.127447][ T108] ? wg_stop+0x5d0/0x5d0
[ 20.131685][ T108] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20
[ 20.137913][ T108] netdev_start_xmit+0x8a/0x160
[ 20.142744][ T108] dev_hard_start_xmit+0x18d/0x2f0
[ 20.147835][ T108] __dev_queue_xmit+0x100c/0x1c30
[ 20.152841][ T108] ? dev_queue_xmit+0x20/0x20
[ 20.157587][ T108] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 20.163817][ T108] ? ndisc_constructor+0x690/0x8a0
[ 20.168953][ T108] ? _raw_write_unlock_bh+0x31/0x47
[ 20.174134][ T108] ? ___neigh_create+0x162d/0x1ab0
[ 20.179226][ T108] ? dev_hard_header+0xdb/0xf0
[ 20.185361][ T108] dev_queue_xmit+0x17/0x20
[ 20.190012][ T108] neigh_connected_output+0x288/0x2b0
[ 20.195538][ T108] ip6_finish_output2+0xde2/0x1440
[ 20.200734][ T108] ? __rcu_read_lock+0x50/0x50
[ 20.205525][ T108] ? __ip6_finish_output+0x520/0x520
[ 20.210802][ T108] ? dst_cow_metrics_generic+0x55/0x1d0
[ 20.216329][ T108] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 20.222560][ T108] ? ip6_skb_dst_mtu+0xaf/0x260
[ 20.227408][ T108] __ip6_finish_output+0x3e4/0x520
[ 20.232499][ T108] ip6_finish_output+0x3f/0x220
[ 20.237796][ T108] ? ip6_output+0x1d3/0x4b0
[ 20.242301][ T108] ip6_output+0x1f8/0x4b0
[ 20.246607][ T108] ? asan.module_dtor+0x20/0x20
[ 20.251433][ T108] ? skb_dst+0x40/0x40
[ 20.255492][ T108] ? __rcu_read_lock+0x50/0x50
[ 20.260373][ T108] ? selinux_ipv6_forward+0x50/0x50
[ 20.265553][ T108] ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 20.271251][ T108] ? nf_hook_slow+0x150/0x1b0
[ 20.275918][ T108] NF_HOOK+0xdd/0x280
[ 20.279881][ T108] ? addrconf_addr_solict_mult+0xe0/0xe0
[ 20.285486][ T108] ? NF_HOOK+0x280/0x280
[ 20.289705][ T108] ? __rcu_read_lock+0x50/0x50
[ 20.294442][ T108] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 20.300744][ T108] ? ndisc_send_skb+0x547/0x9f0
[ 20.305601][ T108] ? memcpy+0x56/0x70
[ 20.309592][ T108] ndisc_send_skb+0x646/0x9f0
[ 20.314259][ T108] ? slab_post_alloc_hook+0x90/0xa0
[ 20.319528][ T108] ? ndisc_fill_addr_option+0x2f0/0x2f0
[ 20.325059][ T108] ? skb_set_owner_w+0x1a8/0x310
[ 20.329988][ T108] ? __sanitizer_cov_trace_cmp4+0x19/0x20
[ 20.335693][ T108] ? skb_put+0x11d/0x210
[ 20.339936][ T108] ndisc_send_rs+0x26c/0x360
[ 20.344612][ T108] addrconf_dad_completed+0x4f3/0x9f0
[ 20.349961][ T108] ? addrconf_dad_stop+0x430/0x430
[ 20.355049][ T108] addrconf_dad_work+0x9c1/0x1520
[ 20.360143][ T108] ? move_linked_works+0x118/0x130
[ 20.365236][ T108] ? ipv6_use_optimistic_addr+0x1d0/0x1d0
[ 20.370935][ T108] ? __kasan_check_write+0x14/0x20
[ 20.376023][ T108] process_one_work+0x3ca/0x660
[ 20.380850][ T108] worker_thread+0x709/0xa20
[ 20.385442][ T108] ? __kthread_parkme+0x11b/0x150
[ 20.390479][ T108] kthread+0x389/0x3c0
[ 20.394538][ T108] ? pr_cont_work+0x110/0x110
[ 20.399208][ T108] ? __list_add+0xc0/0xc0
[ 20.403529][ T108] ret_from_fork+0x1f/0x30
[ 20.407959][ T108] ================================================================================
[ 20.417246][ T108] ================================================================================
[ 20.426570][ T108] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:1932:2
[ 20.434321][ T108] member access within address ffffc90000ab71c0 with insufficient space
[ 20.442646][ T108] for an object of type 'struct sk_buff'
[ 20.448420][ T108] CPU: 0 PID: 108 Comm: kworker/0:2 Not tainted 5.10.107-syzkaller-00363-gb6079b142e3d #0
2022/03/22 22:41:46 building call list...
[ 20.458305][ T108] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 20.468370][ T108] Workqueue: ipv6_addrconf addrconf_dad_work
[ 20.474353][ T108] Call Trace:
[ 20.477633][ T108] dump_stack_lvl+0x1e2/0x24b
[ 20.482370][ T108] ? show_regs_print_info+0x18/0x18
[ 20.487565][ T108] ? wg_allowedips_lookup_dst+0x190/0x190
[ 20.493273][ T108] dump_stack+0x15/0x1d
[ 20.497413][ T108] ubsan_type_mismatch_common+0x1ed/0x3a0
[ 20.503250][ T108] __ubsan_handle_type_mismatch_v1+0x5b/0x70
[ 20.509240][ T108] wg_xmit+0x513/0xae0
[ 20.513304][ T108] ? wg_stop+0x5d0/0x5d0
[ 20.517540][ T108] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20
[ 20.523769][ T108] netdev_start_xmit+0x8a/0x160
[ 20.528617][ T108] dev_hard_start_xmit+0x18d/0x2f0
[ 20.533900][ T108] __dev_queue_xmit+0x100c/0x1c30
[ 20.538921][ T108] ? dev_queue_xmit+0x20/0x20
[ 20.543589][ T108] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 20.549992][ T108] ? ndisc_constructor+0x690/0x8a0
[ 20.555099][ T108] ? _raw_write_unlock_bh+0x31/0x47
[ 20.560288][ T108] ? ___neigh_create+0x162d/0x1ab0
[ 20.565601][ T108] ? dev_hard_header+0xdb/0xf0
[ 20.570372][ T108] dev_queue_xmit+0x17/0x20
[ 20.574858][ T108] neigh_connected_output+0x288/0x2b0
[ 20.580227][ T108] ip6_finish_output2+0xde2/0x1440
[ 20.585333][ T108] ? __rcu_read_lock+0x50/0x50
[ 20.590090][ T108] ? __ip6_finish_output+0x520/0x520
[ 20.595367][ T108] ? dst_cow_metrics_generic+0x55/0x1d0
[ 20.601194][ T108] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 20.607992][ T108] ? ip6_skb_dst_mtu+0xaf/0x260
[ 20.613115][ T108] __ip6_finish_output+0x3e4/0x520
[ 20.618216][ T108] ip6_finish_output+0x3f/0x220
[ 20.623065][ T108] ? ip6_output+0x1d3/0x4b0
[ 20.627574][ T108] ip6_output+0x1f8/0x4b0
[ 20.631898][ T108] ? asan.module_dtor+0x20/0x20
[ 20.636741][ T108] ? skb_dst+0x40/0x40
[ 20.640794][ T108] ? __rcu_read_lock+0x50/0x50
[ 20.645556][ T108] ? selinux_ipv6_forward+0x50/0x50
[ 20.650740][ T108] ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 20.656455][ T108] ? nf_hook_slow+0x150/0x1b0
[ 20.661130][ T108] NF_HOOK+0xdd/0x280
[ 20.665108][ T108] ? addrconf_addr_solict_mult+0xe0/0xe0
[ 20.670732][ T108] ? NF_HOOK+0x280/0x280
[ 20.675048][ T108] ? __rcu_read_lock+0x50/0x50
[ 20.680079][ T108] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 20.686345][ T108] ? ndisc_send_skb+0x547/0x9f0
[ 20.691208][ T108] ? memcpy+0x56/0x70
[ 20.695197][ T108] ndisc_send_skb+0x646/0x9f0
[ 20.699858][ T108] ? slab_post_alloc_hook+0x90/0xa0
[ 20.705063][ T108] ? ndisc_fill_addr_option+0x2f0/0x2f0
[ 20.710613][ T108] ? skb_set_owner_w+0x1a8/0x310
[ 20.715536][ T108] ? __sanitizer_cov_trace_cmp4+0x19/0x20
[ 20.721235][ T108] ? skb_put+0x11d/0x210
[ 20.725479][ T108] ndisc_send_rs+0x26c/0x360
[ 20.730059][ T108] addrconf_dad_completed+0x4f3/0x9f0
[ 20.735414][ T108] ? addrconf_dad_stop+0x430/0x430
[ 20.740523][ T108] addrconf_dad_work+0x9c1/0x1520
[ 20.745555][ T108] ? move_linked_works+0x118/0x130
[ 20.750755][ T108] ? ipv6_use_optimistic_addr+0x1d0/0x1d0
[ 20.756472][ T108] ? __kasan_check_write+0x14/0x20
[ 20.761826][ T108] process_one_work+0x3ca/0x660
[ 20.766796][ T108] worker_thread+0x709/0xa20
[ 20.771389][ T108] ? __kthread_parkme+0x11b/0x150
[ 20.776403][ T108] kthread+0x389/0x3c0
[ 20.780551][ T108] ? pr_cont_work+0x110/0x110
[ 20.785223][ T108] ? __list_add+0xc0/0xc0
[ 20.789551][ T108] ret_from_fork+0x1f/0x30
[ 20.794000][ T108] ================================================================================
[ 21.283087][ T9] device bridge_slave_1 left promiscuous mode
[ 21.289239][ T9] bridge0: port 2(bridge_slave_1) entered disabled state
[ 21.297246][ T9] device bridge_slave_0 left promiscuous mode
[ 21.303564][ T9] bridge0: port 1(bridge_slave_0) entered disabled state

Error text is too large and was truncated, full error text is at:

https://syzkaller.appspot.com/x/error.txt?x=118c48ed700000