[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 18.138956] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 24.249129] random: sshd: uninitialized urandom read (32 bytes read) [ 24.614726] random: sshd: uninitialized urandom read (32 bytes read) [ 25.461824] random: sshd: uninitialized urandom read (32 bytes read) [ 25.618986] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.51' (ECDSA) to the list of known hosts. [ 31.138477] random: sshd: uninitialized urandom read (32 bytes read) net.ipv6.conf.syz_tun.accept_dad = 0 net.ipv6.conf.syz_tun.router_solicitations = 0 [ 31.230975] IPVS: ftp: loaded support on port[0] = 21 [ 31.421136] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.427582] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.434940] device bridge_slave_0 entered promiscuous mode [ 31.450824] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.457195] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.464399] device bridge_slave_1 entered promiscuous mode [ 31.479552] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 31.495190] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 31.536340] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 31.554669] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 31.614253] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 31.621525] team0: Port device team_slave_0 added [ 31.636699] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 31.643785] team0: Port device team_slave_1 added [ 31.659649] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 31.676826] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 31.693505] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 31.710382] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready RTNETLINK answers: Operation not supported RTNETLINK answers: No buffer space available RTNETLINK answers: Operation not supported [ 31.825735] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.832174] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.839165] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.845525] bridge0: port 1(bridge_slave_0) entered forwarding state RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Invalid argument RTNETLINK answers: Invalid argument RTNETLINK answers: Invalid argument [ 32.249337] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 32.255437] 8021q: adding VLAN 0 to HW filter on device bond0 [ 32.297896] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 32.339342] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 32.347117] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 32.385683] 8021q: adding VLAN 0 to HW filter on device team0 executing program [ 32.637130] ------------[ cut here ]------------ [ 32.642018] kernel BUG at net/ipv6/route.c:1268! [ 32.646820] invalid opcode: 0000 [#1] SMP KASAN [ 32.651487] CPU: 1 PID: 4655 Comm: syz-executor088 Not tainted 4.18.0-rc7+ #36 [ 32.658825] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 32.668170] RIP: 0010:ip6_pol_route+0x9e3/0x1250 [ 32.672898] Code: 31 e4 e8 60 de 04 fc 4c 89 e0 f0 4c 0f b1 33 31 ff 49 89 c4 48 89 c6 e8 7b 12 c7 fb 4d 85 e4 0f 84 0d fa ff ff e8 3d 11 c7 fb <0f> 0b e8 36 11 c7 fb e8 91 7d b1 fb 31 ff 89 c6 88 85 e0 fd ff ff [ 32.692033] RSP: 0018:ffff8801d70f6d48 EFLAGS: 00010293 [ 32.697376] RAX: ffff8801aa042780 RBX: ffffe8ffffd5c8d8 RCX: ffffffff85b50655 [ 32.704626] RDX: 0000000000000000 RSI: ffffffff85b50663 RDI: 0000000000000007 [ 32.711875] RBP: ffff8801d70f6f78 R08: ffff8801aa042780 R09: fffff91ffffab91b [ 32.719123] R10: fffff91ffffab91b R11: ffffe8ffffd5c8df R12: ffff8801b17dbcc0 [ 32.726372] R13: 0000000000000001 R14: ffff8801b17db900 R15: 0000000000000001 [ 32.733622] FS: 00007fdca56e2700(0000) GS:ffff8801db100000(0000) knlGS:0000000000000000 [ 32.741829] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.747697] CR2: 00000000205fafd2 CR3: 00000001acbb0000 CR4: 00000000001406e0 [ 32.754946] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 32.762193] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 32.769439] Call Trace: [ 32.772018] ? ip6_pol_route_lookup+0x1120/0x1120 [ 32.776856] ? __lock_acquire+0x7fc/0x5020 [ 32.781070] ? print_usage_bug+0xc0/0xc0 [ 32.785110] ? graph_lock+0x170/0x170 [ 32.788889] ? graph_lock+0x170/0x170 [ 32.792668] ? print_usage_bug+0xc0/0xc0 [ 32.796713] ? find_held_lock+0x36/0x1c0 [ 32.800754] ip6_pol_route_output+0x54/0x70 [ 32.805057] fib6_rule_lookup+0x26e/0x700 [ 32.809191] ? ip6_pol_route_input+0x80/0x80 [ 32.813576] ? fib6_lookup+0x480/0x480 [ 32.817439] ? rcu_is_watching+0x8c/0x150 [ 32.821567] ? trace_hardirqs_on+0x10/0x10 [ 32.825779] ? rcu_report_qs_rnp+0x7a0/0x7a0 [ 32.830170] ip6_route_output_flags+0x2c5/0x350 [ 32.834820] ip6_dst_lookup_tail+0x1278/0x1da0 [ 32.839384] ? kernel_text_address+0x79/0xf0 [ 32.843773] ? unwind_get_return_address+0x61/0xa0 [ 32.848680] ? dst_output+0x180/0x180 [ 32.852457] ? graph_lock+0x170/0x170 [ 32.856238] ? graph_lock+0x170/0x170 [ 32.860028] ? __lock_acquire+0x7fc/0x5020 [ 32.864243] ? save_stack+0xa9/0xd0 [ 32.867849] ? __lock_is_held+0xb5/0x140 [ 32.871893] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 32.877411] ? __sk_dst_check+0x1ef/0x410 [ 32.881539] ip6_dst_lookup_flow+0xc8/0x270 [ 32.885842] ? ip6_dst_lookup+0x60/0x60 [ 32.889798] inet6_csk_route_socket+0x8cb/0x1030 [ 32.894531] ? ip6_dst_check+0x421/0xaf0 [ 32.898572] ? inet6_csk_route_req+0x820/0x820 [ 32.903135] ? skb_free_head+0x99/0xc0 [ 32.907011] ? trace_hardirqs_on_caller+0x19e/0x5c0 [ 32.912022] ? trace_hardirqs_on+0xd/0x10 [ 32.916164] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 32.921681] ? graph_lock+0x170/0x170 [ 32.925464] ? kasan_check_write+0x14/0x20 [ 32.929679] ? pskb_expand_head+0x6b3/0x10e0 [ 32.934068] ? rcu_read_lock_sched_held+0x108/0x120 [ 32.939063] ? kmem_cache_alloc_node_trace+0x34e/0x770 [ 32.944325] inet6_csk_xmit+0x118/0x630 [ 32.948278] ? inet6_csk_xmit+0x118/0x630 [ 32.952409] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 32.957934] ? inet6_csk_update_pmtu+0x190/0x190 [ 32.962681] ? __sk_dst_check+0x1ef/0x410 [ 32.966808] ? sock_alloc_send_skb+0x40/0x40 [ 32.971200] l2tp_xmit_skb+0x1406/0x17c0 [ 32.975245] ? l2tp_session_create+0xb60/0xb60 [ 32.979807] ? iov_iter_advance+0x14e0/0x14e0 [ 32.984284] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 32.989798] ? _copy_from_user+0xdf/0x150 [ 32.993926] ? pppol2tp_sendmsg+0x45a/0x6c0 [ 32.998226] pppol2tp_sendmsg+0x4ae/0x6c0 [ 33.002355] ? move_addr_to_kernel.part.20+0x100/0x100 [ 33.007612] ? pppol2tp_getsockopt+0x950/0x950 [ 33.012174] sock_sendmsg+0xd5/0x120 [ 33.015867] ___sys_sendmsg+0x51d/0x930 [ 33.019821] ? graph_lock+0x170/0x170 [ 33.023602] ? copy_msghdr_from_user+0x580/0x580 [ 33.028336] ? __schedule+0x884/0x1ec0 [ 33.032202] ? find_held_lock+0x36/0x1c0 [ 33.036243] ? lock_downgrade+0x8f0/0x8f0 [ 33.040374] ? rcu_note_context_switch+0x730/0x730 [ 33.045291] ? check_same_owner+0x340/0x340 [ 33.049594] __sys_sendmmsg+0x240/0x6f0 [ 33.053548] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 33.057850] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 33.063365] ? fput+0x130/0x1a0 [ 33.066628] ? __sys_connect+0x1d1/0x4c0 [ 33.070668] ? __ia32_sys_accept+0xb0/0xb0 [ 33.074888] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 33.079448] __x64_sys_sendmmsg+0x9d/0x100 [ 33.083663] do_syscall_64+0x1b9/0x820 [ 33.087529] ? finish_task_switch+0x1d3/0x870 [ 33.092007] ? syscall_return_slowpath+0x5e0/0x5e0 [ 33.096921] ? syscall_return_slowpath+0x31d/0x5e0 [ 33.101832] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 33.107176] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 33.112000] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 33.117181] RIP: 0033:0x447ac9 [ 33.120345] Code: e8 9c b9 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b 07 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 33.139464] RSP: 002b:00007fdca56e1ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 33.147150] RAX: ffffffffffffffda RBX: 00000000006ddc48 RCX: 0000000000447ac9 [ 33.154399] RDX: 00000000000003e8 RSI: 0000000020005fc0 RDI: 0000000000000004 [ 33.161645] RBP: 00000000006ddc40 R08: 0000000000000000 R09: 0000000000000000 [ 33.168893] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006ddc4c [ 33.176140] R13: 00007ffce402a4ef R14: 00007fdca56e29c0 R15: 0000000000000000 [ 33.183391] Modules linked in: [ 33.186562] Dumping ftrace buffer: [ 33.190075] (ftrace buffer empty) [ 33.193815] ---[ end trace da3db20b2cb03b7f ]--- [ 33.198604] RIP: 0010:ip6_pol_route+0x9e3/0x1250 [ 33.203379] Code: 31 e4 e8 60 de 04 fc 4c 89 e0 f0 4c 0f b1 33 31 ff 49 89 c4 48 89 c6 e8 7b 12 c7 fb 4d 85 e4 0f 84 0d fa ff ff e8 3d 11 c7 fb <0f> 0b e8 36 11 c7 fb e8 91 7d b1 fb 31 ff 89 c6 88 85 e0 fd ff ff [ 33.222628] RSP: 0018:ffff8801d70f6d48 EFLAGS: 00010293 [ 33.228012] RAX: ffff8801aa042780 RBX: ffffe8ffffd5c8d8 RCX: ffffffff85b50655 [ 33.235307] RDX: 0000000000000000 RSI: ffffffff85b50663 RDI: 0000000000000007 [ 33.242592] RBP: ffff8801d70f6f78 R08: ffff8801aa042780 R09: fffff91ffffab91b [ 33.249867] R10: fffff91ffffab91b R11: ffffe8ffffd5c8df R12: ffff8801b17dbcc0 [ 33.257149] R13: 0000000000000001 R14: ffff8801b17db900 R15: 0000000000000001 [ 33.264439] FS: 00007fdca56e2700(0000) GS:ffff8801db100000(0000) knlGS:0000000000000000 [ 33.272666] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.278562] CR2: 00000000205fafd2 CR3: 00000001acbb0000 CR4: 00000000001406e0 [ 33.285836] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 33.293111] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 33.300389] Kernel panic - not syncing: Fatal exception in interrupt [ 33.307263] Dumping ftrace buffer: [ 33.310781] (ftrace buffer empty) [ 33.314477] Kernel Offset: disabled [ 33.318088] Rebooting in 86400 seconds..