[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 55.759987][ T26] audit: type=1800 audit(1573421589.471:25): pid=8578 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 55.782539][ T26] audit: type=1800 audit(1573421589.481:26): pid=8578 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 55.809750][ T26] audit: type=1800 audit(1573421589.481:27): pid=8578 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.192' (ECDSA) to the list of known hosts. syzkaller login: [ 67.273653][ T8731] IPVS: ftp: loaded support on port[0] = 21 [ 67.339209][ T8731] chnl_net:caif_netlink_parms(): no params data found [ 67.367550][ T8731] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.376181][ T8731] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.384008][ T8731] device bridge_slave_0 entered promiscuous mode [ 67.392558][ T8731] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.399635][ T8731] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.407570][ T8731] device bridge_slave_1 entered promiscuous mode [ 67.426625][ T8731] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 67.438137][ T8731] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 67.457306][ T8731] team0: Port device team_slave_0 added [ 67.464704][ T8731] team0: Port device team_slave_1 added [ 67.513378][ T8731] device hsr_slave_0 entered promiscuous mode [ 67.580816][ T8731] device hsr_slave_1 entered promiscuous mode [ 67.710542][ T8731] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.717801][ T8731] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.725906][ T8731] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.733126][ T8731] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.938253][ T8731] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.965015][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 68.002692][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.032145][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.061550][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 68.106860][ T8731] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.152003][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 68.181199][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.188322][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.263896][ T3014] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 68.280998][ T3014] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.288094][ T3014] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.334838][ T3014] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 68.353399][ T3014] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 68.383780][ T3515] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 68.406963][ T3515] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 68.430266][ T8731] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 68.455391][ T8731] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 68.469972][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 68.481086][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 68.489712][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 68.501137][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 68.509441][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 68.524604][ T3014] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 68.532960][ T3014] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 68.544489][ T8731] 8021q: adding VLAN 0 to HW filter on device batadv0 executing program [ 69.902423][ C1] vcan0: j1939_tp_rxtimer: 0x0000000065e8616d: rx timeout, send abort [ 69.911517][ C1] vcan0: j1939_xtp_rx_abort_one: 0x0000000065e8616d: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. executing program [ 71.178681][ C0] vcan0: j1939_tp_rxtimer: 0x0000000088dcc520: rx timeout, send abort [ 71.191731][ C0] vcan0: j1939_xtp_rx_abort_one: 0x0000000088dcc520: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 72.471601][ C1] vcan0: j1939_tp_rxtimer: 0x00000000083605e9: rx timeout, send abort [ 72.480076][ C1] vcan0: j1939_xtp_rx_abort_one: 0x00000000083605e9: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 72.495214][ C1] ================================================================== [ 72.503482][ C1] BUG: KASAN: use-after-free in __lock_acquire+0x3a8b/0x4a00 [ 72.511265][ C1] Read of size 8 at addr ffff888094cf9080 by task ksoftirqd/1/16 [ 72.518948][ C1] [ 72.521271][ C1] CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.4.0-rc6+ #0 [ 72.528610][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 72.538725][ C1] Call Trace: [ 72.542083][ C1] dump_stack+0x197/0x210 [ 72.546406][ C1] ? __lock_acquire+0x3a8b/0x4a00 [ 72.551697][ C1] print_address_description.constprop.0.cold+0xd4/0x30b [ 72.558722][ C1] ? __lock_acquire+0x3a8b/0x4a00 [ 72.563758][ C1] ? __lock_acquire+0x3a8b/0x4a00 [ 72.569229][ C1] __kasan_report.cold+0x1b/0x41 [ 72.576982][ C1] ? can_rcv_filter+0x270/0x8e0 [ 72.581819][ C1] ? __lock_acquire+0x3a8b/0x4a00 [ 72.587480][ C1] kasan_report+0x12/0x20 [ 72.591827][ C1] __asan_report_load8_noabort+0x14/0x20 [ 72.597436][ C1] __lock_acquire+0x3a8b/0x4a00 [ 72.602266][ C1] ? lock_downgrade+0x920/0x920 [ 72.607097][ C1] ? mark_held_locks+0xf0/0xf0 [ 72.611837][ C1] ? trace_hardirqs_off+0x62/0x240 [ 72.616929][ C1] lock_acquire+0x190/0x410 [ 72.621516][ C1] ? j1939_session_get_by_addr+0x2d/0x60 [ 72.627495][ C1] _raw_spin_lock_bh+0x33/0x50 [ 72.632247][ C1] ? j1939_session_get_by_addr+0x2d/0x60 [ 72.637863][ C1] j1939_session_get_by_addr+0x2d/0x60 [ 72.648179][ C1] j1939_xtp_rx_abort_one+0x8d/0x100 [ 72.654011][ C1] ? j1939_ecu_get_by_addr_locked+0xc3/0xf0 [ 72.660407][ C1] j1939_tp_recv+0x798/0x9b0 [ 72.665249][ C1] j1939_can_recv+0x4bb/0x620 [ 72.669913][ C1] can_rcv_filter+0x292/0x8e0 [ 72.674576][ C1] can_receive+0x2e7/0x530 [ 72.679206][ C1] can_rcv+0x133/0x1b0 [ 72.683961][ C1] ? can_receive+0x530/0x530 [ 72.688547][ C1] __netif_receive_skb_one_core+0x113/0x1a0 [ 72.694430][ C1] ? __netif_receive_skb_core+0x3450/0x3450 [ 72.700343][ C1] ? lock_acquire+0x190/0x410 [ 72.705033][ C1] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 72.711265][ C1] __netif_receive_skb+0x2c/0x1d0 [ 72.716276][ C1] process_backlog+0x206/0x750 [ 72.721024][ C1] ? net_rx_action+0x27b/0x1120 [ 72.725858][ C1] ? lockdep_hardirqs_on+0x19e/0x5e0 [ 72.731180][ C1] net_rx_action+0x508/0x1120 [ 72.735844][ C1] ? napi_busy_loop+0x970/0x970 [ 72.740725][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 72.746250][ C1] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 72.752209][ C1] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 72.758430][ C1] __do_softirq+0x262/0x98c [ 72.762946][ C1] ? takeover_tasklets+0x820/0x820 [ 72.768049][ C1] run_ksoftirqd+0x8e/0x110 [ 72.772534][ C1] smpboot_thread_fn+0x6a3/0xa40 [ 72.777458][ C1] ? smpboot_register_percpu_thread+0x390/0x390 [ 72.783724][ C1] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 72.789942][ C1] ? __kthread_parkme+0x108/0x1c0 [ 72.794972][ C1] ? __kasan_check_read+0x11/0x20 [ 72.800001][ C1] kthread+0x361/0x430 [ 72.804063][ C1] ? smpboot_register_percpu_thread+0x390/0x390 [ 72.810337][ C1] ? kthread_mod_delayed_work+0x1f0/0x1f0 [ 72.816040][ C1] ret_from_fork+0x24/0x30 [ 72.820637][ C1] [ 72.822949][ C1] Allocated by task 8778: [ 72.827261][ C1] save_stack+0x23/0x90 [ 72.831642][ C1] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 72.837293][ C1] kasan_kmalloc+0x9/0x10 [ 72.841627][ C1] kmem_cache_alloc_trace+0x158/0x790 [ 72.846977][ C1] j1939_netdev_start+0xa4/0x550 [ 72.851894][ C1] j1939_sk_bind+0x65a/0x8e0 [ 72.856461][ C1] __sys_bind+0x239/0x290 [ 72.860766][ C1] __x64_sys_bind+0x73/0xb0 [ 72.865266][ C1] do_syscall_64+0xfa/0x760 [ 72.869747][ C1] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 72.875617][ C1] [ 72.877939][ C1] Freed by task 8777: [ 72.881898][ C1] save_stack+0x23/0x90 [ 72.886043][ C1] __kasan_slab_free+0x102/0x150 [ 72.890952][ C1] kasan_slab_free+0xe/0x10 [ 72.895427][ C1] kfree+0x10a/0x2c0 [ 72.899297][ C1] j1939_priv_put+0x8b/0xb0 [ 72.903774][ C1] j1939_netdev_stop+0x45/0x190 [ 72.908599][ C1] j1939_sk_release+0x3bd/0x5c0 [ 72.913449][ C1] __sock_release+0xce/0x280 [ 72.918010][ C1] sock_close+0x1e/0x30 [ 72.922142][ C1] __fput+0x2ff/0x890 [ 72.926109][ C1] ____fput+0x16/0x20 [ 72.930074][ C1] task_work_run+0x145/0x1c0 [ 72.934658][ C1] exit_to_usermode_loop+0x316/0x380 [ 72.939936][ C1] do_syscall_64+0x65f/0x760 [ 72.944518][ C1] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 72.950387][ C1] [ 72.952700][ C1] The buggy address belongs to the object at ffff888094cf8000 [ 72.952700][ C1] which belongs to the cache kmalloc-8k of size 8192 [ 72.966731][ C1] The buggy address is located 4224 bytes inside of [ 72.966731][ C1] 8192-byte region [ffff888094cf8000, ffff888094cfa000) [ 72.980158][ C1] The buggy address belongs to the page: [ 72.985774][ C1] page:ffffea0002533e00 refcount:1 mapcount:0 mapping:ffff8880aa4021c0 index:0x0 compound_mapcount: 0 [ 72.996694][ C1] flags: 0x1fffc0000010200(slab|head) [ 73.002050][ C1] raw: 01fffc0000010200 ffffea0002360a08 ffffea00026bba08 ffff8880aa4021c0 [ 73.010651][ C1] raw: 0000000000000000 ffff888094cf8000 0000000100000001 0000000000000000 [ 73.019286][ C1] page dumped because: kasan: bad access detected [ 73.025684][ C1] [ 73.027993][ C1] Memory state around the buggy address: [ 73.033598][ C1] ffff888094cf8f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 73.041638][ C1] ffff888094cf9000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 73.049681][ C1] >ffff888094cf9080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 73.057726][ C1] ^ [ 73.061777][ C1] ffff888094cf9100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 73.069836][ C1] ffff888094cf9180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 73.077869][ C1] ================================================================== [ 73.085900][ C1] Disabling lock debugging due to kernel taint [ 73.092042][ C1] Kernel panic - not syncing: panic_on_warn set ... [ 73.098620][ C1] CPU: 1 PID: 16 Comm: ksoftirqd/1 Tainted: G B 5.4.0-rc6+ #0 [ 73.107347][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 73.117377][ C1] Call Trace: [ 73.120645][ C1] dump_stack+0x197/0x210 [ 73.124957][ C1] panic+0x2e3/0x75c [ 73.128826][ C1] ? add_taint.cold+0x16/0x16 [ 73.133484][ C1] ? __lock_acquire+0x3a8b/0x4a00 [ 73.138498][ C1] ? trace_hardirqs_off+0x62/0x240 [ 73.143600][ C1] ? trace_hardirqs_off+0x59/0x240 [ 73.148705][ C1] ? __lock_acquire+0x3a8b/0x4a00 [ 73.153709][ C1] end_report+0x47/0x4f [ 73.157840][ C1] ? __lock_acquire+0x3a8b/0x4a00 [ 73.162841][ C1] __kasan_report.cold+0xe/0x41 [ 73.167686][ C1] ? can_rcv_filter+0x270/0x8e0 [ 73.172513][ C1] ? __lock_acquire+0x3a8b/0x4a00 [ 73.177511][ C1] kasan_report+0x12/0x20 [ 73.181820][ C1] __asan_report_load8_noabort+0x14/0x20 [ 73.187431][ C1] __lock_acquire+0x3a8b/0x4a00 [ 73.192257][ C1] ? lock_downgrade+0x920/0x920 [ 73.197085][ C1] ? mark_held_locks+0xf0/0xf0 [ 73.201834][ C1] ? trace_hardirqs_off+0x62/0x240 [ 73.206940][ C1] lock_acquire+0x190/0x410 [ 73.211422][ C1] ? j1939_session_get_by_addr+0x2d/0x60 [ 73.217232][ C1] _raw_spin_lock_bh+0x33/0x50 [ 73.221990][ C1] ? j1939_session_get_by_addr+0x2d/0x60 [ 73.227600][ C1] j1939_session_get_by_addr+0x2d/0x60 [ 73.233051][ C1] j1939_xtp_rx_abort_one+0x8d/0x100 [ 73.238314][ C1] ? j1939_ecu_get_by_addr_locked+0xc3/0xf0 [ 73.244185][ C1] j1939_tp_recv+0x798/0x9b0 [ 73.248753][ C1] j1939_can_recv+0x4bb/0x620 [ 73.253434][ C1] can_rcv_filter+0x292/0x8e0 [ 73.258101][ C1] can_receive+0x2e7/0x530 [ 73.262495][ C1] can_rcv+0x133/0x1b0 [ 73.266539][ C1] ? can_receive+0x530/0x530 [ 73.271113][ C1] __netif_receive_skb_one_core+0x113/0x1a0 [ 73.276989][ C1] ? __netif_receive_skb_core+0x3450/0x3450 [ 73.282859][ C1] ? lock_acquire+0x190/0x410 [ 73.287514][ C1] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 73.293731][ C1] __netif_receive_skb+0x2c/0x1d0 [ 73.298732][ C1] process_backlog+0x206/0x750 [ 73.303468][ C1] ? net_rx_action+0x27b/0x1120 [ 73.308295][ C1] ? lockdep_hardirqs_on+0x19e/0x5e0 [ 73.313554][ C1] net_rx_action+0x508/0x1120 [ 73.318224][ C1] ? napi_busy_loop+0x970/0x970 [ 73.323052][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 73.329615][ C1] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 73.335585][ C1] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 73.341829][ C1] __do_softirq+0x262/0x98c [ 73.346322][ C1] ? takeover_tasklets+0x820/0x820 [ 73.351412][ C1] run_ksoftirqd+0x8e/0x110 [ 73.355893][ C1] smpboot_thread_fn+0x6a3/0xa40 [ 73.360807][ C1] ? smpboot_register_percpu_thread+0x390/0x390 [ 73.367041][ C1] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 73.373275][ C1] ? __kthread_parkme+0x108/0x1c0 [ 73.378338][ C1] ? __kasan_check_read+0x11/0x20 [ 73.383341][ C1] kthread+0x361/0x430 [ 73.387496][ C1] ? smpboot_register_percpu_thread+0x390/0x390 [ 73.393713][ C1] ? kthread_mod_delayed_work+0x1f0/0x1f0 [ 73.399430][ C1] ret_from_fork+0x24/0x30 [ 73.405176][ C1] Kernel Offset: disabled [ 73.409499][ C1] Rebooting in 86400 seconds..