[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.1.5' (ECDSA) to the list of known hosts. syzkaller login: [ 40.541858] audit: type=1400 audit(1595345495.195:8): avc: denied { execmem } for pid=6463 comm="syz-executor088" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 40.562811] IPVS: ftp: loaded support on port[0] = 21 [ 40.646599] chnl_net:caif_netlink_parms(): no params data found [ 40.712530] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.719146] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.727098] device bridge_slave_0 entered promiscuous mode [ 40.735671] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.742168] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.749169] device bridge_slave_1 entered promiscuous mode [ 40.767439] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 40.776529] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 40.795657] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 40.803089] team0: Port device team_slave_0 added [ 40.808697] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 40.816556] team0: Port device team_slave_1 added [ 40.832395] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 40.838658] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 40.863910] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 40.875508] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 40.881834] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 40.907155] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 40.918193] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 40.925997] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 40.984488] device hsr_slave_0 entered promiscuous mode [ 41.021686] device hsr_slave_1 entered promiscuous mode [ 41.061870] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 41.068964] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 41.138924] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.145409] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.152293] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.158694] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.195473] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 41.202714] 8021q: adding VLAN 0 to HW filter on device bond0 [ 41.212658] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 41.221024] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 41.241420] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.248686] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.257323] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 41.267922] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 41.274151] 8021q: adding VLAN 0 to HW filter on device team0 [ 41.283880] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 41.291796] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.298137] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.322130] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 41.333031] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 41.343644] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 41.352905] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 41.362422] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.368786] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.376564] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 41.384684] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 41.392707] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 41.400356] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 41.413965] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 41.421963] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 41.428655] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 41.435689] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 41.442640] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 41.455841] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 41.468523] IPv6: ADDRCONF(NETDEV_UP): veth0_virt_wifi: link is not ready [ 41.478994] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 41.512876] IPv6: ADDRCONF(NETDEV_UP): veth0_vlan: link is not ready [ 41.519909] IPv6: ADDRCONF(NETDEV_UP): vlan0: link is not ready [ 41.528001] IPv6: ADDRCONF(NETDEV_UP): vlan1: link is not ready [ 41.537552] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 41.545861] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 41.553448] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 41.563449] device veth0_vlan entered promiscuous mode [ 41.573283] device veth1_vlan entered promiscuous mode [ 41.579136] IPv6: ADDRCONF(NETDEV_UP): macvlan0: link is not ready [ 41.588259] IPv6: ADDRCONF(NETDEV_UP): macvlan1: link is not ready [ 41.600093] IPv6: ADDRCONF(NETDEV_UP): veth0_macvtap: link is not ready [ 41.610290] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 41.618056] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 41.625633] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 41.636254] device veth0_macvtap entered promiscuous mode [ 41.645597] device veth1_macvtap entered promiscuous mode [ 41.654617] IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready [ 41.664064] IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready [ 41.675074] IPv6: ADDRCONF(NETDEV_UP): batadv_slave_0: link is not ready [ 41.683137] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 41.689875] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 41.698004] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 41.708426] IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready [ 41.715407] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 41.722105] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 41.729982] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready executing program executing program [ 41.970644] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 [ 41.970653] PGD a7a0d067 P4D a7a0d067 PUD 8cc6e067 PMD 0 [ 41.970673] Oops: 0002 [#1] PREEMPT SMP KASAN [ 41.970685] CPU: 0 PID: 6464 Comm: syz-executor088 Not tainted 4.19.133-syzkaller #0 [ 41.970691] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 41.970710] RIP: 0010:do_syscall_64+0x19c/0x620 [ 41.970721] Code: 03 00 00 e8 56 0f 69 00 9c 58 0f 1f 44 00 00 25 00 02 00 00 31 ff 48 89 c3 48 89 c6 e8 cd 10 69 00 48 85 db 0f 84 00 03 00 00 <00> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 41.970734] RSP: 0018:ffff888085b27f28 EFLAGS: 00010206 [ 41.970743] RAX: 0000000000000000 RBX: 0000000000000200 RCX: ffffffff81009993 [ 41.970755] RDX: 0000000000000200 RSI: ffff88808b772700 RDI: 0000000000000007 [ 41.970762] RBP: ffff888085b27f58 R08: 0000000000000000 R09: 0000000000000000 [ 41.970768] R10: 0000000000000007 R11: 0000000000000000 R12: 0000000000000000 [ 41.970774] R13: ffffffff88d25b58 R14: 0000000000000000 R15: 0000000000000000 [ 41.970782] FS: 0000000001803940(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000 [ 41.970788] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.970794] CR2: 0000000000000000 CR3: 00000000a0249000 CR4: 00000000001406f0 [ 41.970804] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 41.970810] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 41.970813] Call Trace: [ 41.970835] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 41.970845] RIP: 0033:0x4757f0 [ 41.970854] Code: 05 48 3d 01 f0 ff ff 0f 83 4d 02 f9 ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 3d 61 9c 26 00 00 75 14 b8 23 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 24 02 f9 ff c3 48 83 ec 08 e8 aa 60 fd ff [ 41.970860] RSP: 002b:00007ffed0576708 EFLAGS: 00000246 ORIG_RAX: 0000000000000023 [ 41.970871] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00000000004757f0 [ 41.970878] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffed0576710 [ 41.970885] RBP: 00007ffed0576740 R08: 0000000000000001 R09: 0000000001803940 [ 41.970892] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000a3ae [ 41.970898] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 41.970909] Modules linked in: [ 41.970918] CR2: 0000000000000000 [ 41.970941] kasan: CONFIG_KASAN_INLINE enabled [ 41.970945] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 41.970954] general protection fault: 0000 [#2] PREEMPT SMP KASAN [ 41.970965] CPU: 0 PID: 6464 Comm: syz-executor088 Tainted: G D 4.19.133-syzkaller #0 [ 41.970970] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 41.970983] RIP: 0010:update_vsyscall+0x0/0x370 [ 41.970995] Code: 05 b9 a0 8f 0a 89 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 41.971002] RSP: 0018:ffff8880ae607c68 EFLAGS: 00010046 [ 41.971011] RAX: dffffc0000000000 RBX: ffffffff8b905c20 RCX: ffffffff815bba7f [ 41.971018] RDX: 1ffffffff1720b90 RSI: ffffffff815bba96 RDI: ffffffff8b905c20 [ 41.971024] RBP: 0000000000000000 R08: 0000000000000001 R09: 000000003b9ac9ff [ 41.971031] R10: 0000000000000005 R11: ffffffff8ad2501b R12: 0000000000000000 [ 41.971037] R13: ffffffff8b905cb0 R14: 0000000039d57897 R15: ffffffff8b905c48 [ 41.971046] FS: 0000000001803940(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000 [ 41.971052] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.971058] CR2: 0000000000000000 CR3: 00000000a0249000 CR4: 00000000001406f0 [ 41.971064] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 41.971070] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 41.971073] Call Trace: [ 41.971078] [ 41.971091] timekeeping_update+0x264/0x4a0 [ 41.971106] timekeeping_advance+0x663/0x9b0 [ 41.971118] ? tick_do_update_jiffies64.part.0+0x188/0x290 [ 41.971132] ? getboottime64+0x60/0x60 [ 41.971144] ? lock_downgrade+0x720/0x720 [ 41.971155] ? lock_acquire+0x170/0x3c0 [ 41.971172] ? tick_sched_timer+0x220/0x290 [ 41.971186] tick_do_update_jiffies64.part.0+0x188/0x290 [ 41.971198] tick_sched_timer+0x220/0x290 [ 41.971210] __hrtimer_run_queues+0x3f6/0xe60 [ 41.971221] ? tick_nohz_restart_sched_tick+0x310/0x310 [ 41.971234] ? retrigger_next_event+0x220/0x220 [ 41.971245] ? kvm_clock_get_cycles+0x14/0x30 [ 41.971256] ? ktime_get_update_offsets_now+0x2ec/0x460 [ 41.971268] hrtimer_interrupt+0x32a/0x930 [ 41.971280] ? sched_clock_cpu+0x18/0x1b0 [ 41.971293] ? check_preemption_disabled+0x41/0x280 [ 41.971303] smp_apic_timer_interrupt+0x10c/0x550 [ 41.971313] apic_timer_interrupt+0xf/0x20 [ 41.971318] [ 41.971330] RIP: 0010:oops_end+0x74/0xe0 [ 41.971340] Code: 01 75 18 48 83 3d c3 c4 ac 07 00 74 4c 48 c7 c7 cc b7 d0 8a e8 bd 65 2c 00 66 90 48 83 3d cb c3 ac 07 00 74 36 48 89 df 57 9d <0f> 1f 44 00 00 e8 72 0b 18 00 be 02 00 00 00 48 c7 c7 e0 b7 d0 8a [ 41.971345] RSP: 0018:ffff888085b27c58 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13 [ 41.971354] RAX: 0000000000000001 RBX: 0000000000000282 RCX: ffffffff813d9d24 [ 41.971360] RDX: 0000000000000000 RSI: ffffffff813d9cf1 RDI: 0000000000000282 [ 41.971372] RBP: ffff888085b27e78 R08: 0000000000000001 R09: 0000000000000000 [ 41.971378] R10: 0000000000000005 R11: ffffffff8ad2501b R12: 0000000000000009 [ 41.971384] R13: 0000000000000000 R14: 0000000000000000 R15: dffffc0000000000 [ 41.971398] ? add_taint+0x54/0x60 [ 41.971406] ? add_taint+0x21/0x60 [ 41.971421] no_context+0x75a/0x940 [ 41.971434] ? force_sig_info_fault.constprop.0+0x320/0x320 [ 41.971446] ? lock_downgrade+0x720/0x720 [ 41.971458] __bad_area_nosemaphore+0x2de/0x400 [ 41.971469] ? up_read+0x17/0x110 [ 41.971480] __do_page_fault+0xa53/0xde0 [ 41.971494] ? trace_hardirqs_off_caller+0x69/0x210 [ 41.971504] ? spurious_fault+0x840/0x840 [ 41.971515] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 41.971528] page_fault+0x1e/0x30 [ 41.971539] RIP: 0010:do_syscall_64+0x19c/0x620 [ 41.971549] Code: 03 00 00 e8 56 0f 69 00 9c 58 0f 1f 44 00 00 25 00 02 00 00 31 ff 48 89 c3 48 89 c6 e8 cd 10 69 00 48 85 db 0f 84 00 03 00 00 <00> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 41.971555] RSP: 0018:ffff888085b27f28 EFLAGS: 00010206 [ 41.971562] RAX: 0000000000000000 RBX: 0000000000000200 RCX: ffffffff81009993 [ 41.971568] RDX: 0000000000000200 RSI: ffff88808b772700 RDI: 0000000000000007 [ 41.971574] RBP: ffff888085b27f58 R08: 0000000000000000 R09: 0000000000000000 [ 41.971579] R10: 0000000000000007 R11: 0000000000000000 R12: 0000000000000000 [ 41.971585] R13: ffffffff88d25b58 R14: 0000000000000000 R15: 0000000000000000 [ 41.971599] ? do_syscall_64+0x193/0x620 [ 41.971611] ? do_syscall_64+0x193/0x620 [ 41.971623] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 41.971630] RIP: 0033:0x4757f0 [ 41.971640] Code: 05 48 3d 01 f0 ff ff 0f 83 4d 02 f9 ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 3d 61 9c 26 00 00 75 14 b8 23 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 24 02 f9 ff c3 48 83 ec 08 e8 aa 60 fd ff [ 41.971645] RSP: 002b:00007ffed0576708 EFLAGS: 00000246 ORIG_RAX: 0000000000000023 [ 41.971654] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00000000004757f0 [ 41.971659] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffed0576710 [ 41.971665] RBP: 00007ffed0576740 R08: 0000000000000001 R09: 0000000001803940 [ 41.971671] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000a3ae [ 41.971677] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 41.971686] Modules linked in: [ 41.971698] ---[ end trace 980d15824d2f4748 ]--- [ 41.971709] RIP: 0010:do_syscall_64+0x19c/0x620 [ 41.971718] Code: 03 00 00 e8 56 0f 69 00 9c 58 0f 1f 44 00 00 25 00 02 00 00 31 ff 48 89 c3 48 89 c6 e8 cd 10 69 00 48 85 db 0f 84 00 03 00 00 <00> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 41.971724] RSP: 0018:ffff888085b27f28 EFLAGS: 00010206 [ 41.971731] RAX: 0000000000000000 RBX: 0000000000000200 RCX: ffffffff81009993 [ 41.971737] RDX: 0000000000000200 RSI: ffff88808b772700 RDI: 0000000000000007 [ 41.971743] RBP: ffff888085b27f58 R08: 0000000000000000 R09: 0000000000000000 [ 41.971757] R10: 0000000000000007 R11: 0000000000000000 R12: 0000000000000000 [ 41.971764] R13: ffffffff88d25b58 R14: 0000000000000000 R15: 0000000000000000 [ 41.971772] FS: 0000000001803940(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000 [ 41.971779] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.971784] CR2: 0000000000000000 CR3: 00000000a0249000 CR4: 00000000001406f0 [ 41.971792] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 41.971798] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 41.971803] Kernel panic - not syncing: Fatal exception in interrupt [ 41.972906] Kernel Offset: disabled [ 42.801119] Rebooting in 86400 seconds..