[ 37.462297][ T26] audit: type=1800 audit(1553085194.438:27): pid=7586 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [ 37.498777][ T26] audit: type=1800 audit(1553085194.438:28): pid=7586 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2417 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 38.413411][ T26] audit: type=1800 audit(1553085195.438:29): pid=7586 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 38.433996][ T26] audit: type=1800 audit(1553085195.448:30): pid=7586 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.151' (ECDSA) to the list of known hosts. 2019/03/20 12:33:53 parsed 1 programs 2019/03/20 12:33:56 executed programs: 0 syzkaller login: [ 79.488119][ T7762] IPVS: ftp: loaded support on port[0] = 21 [ 79.499739][ T7764] IPVS: ftp: loaded support on port[0] = 21 [ 79.500266][ T7760] IPVS: ftp: loaded support on port[0] = 21 [ 79.522660][ T7758] IPVS: ftp: loaded support on port[0] = 21 [ 79.524400][ T7766] IPVS: ftp: loaded support on port[0] = 21 [ 79.549235][ T7767] IPVS: ftp: loaded support on port[0] = 21 [ 79.821849][ T7762] chnl_net:caif_netlink_parms(): no params data found [ 79.898328][ T7767] chnl_net:caif_netlink_parms(): no params data found [ 79.907770][ T7760] chnl_net:caif_netlink_parms(): no params data found [ 80.009203][ T7762] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.017625][ T7762] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.026864][ T7762] device bridge_slave_0 entered promiscuous mode [ 80.034874][ T7764] chnl_net:caif_netlink_parms(): no params data found [ 80.062739][ T7766] chnl_net:caif_netlink_parms(): no params data found [ 80.078717][ T7762] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.086832][ T7762] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.094495][ T7762] device bridge_slave_1 entered promiscuous mode [ 80.111056][ T7758] chnl_net:caif_netlink_parms(): no params data found [ 80.167360][ T7767] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.174495][ T7767] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.182785][ T7767] device bridge_slave_0 entered promiscuous mode [ 80.204509][ T7762] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 80.217573][ T7760] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.224698][ T7760] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.234101][ T7760] device bridge_slave_0 entered promiscuous mode [ 80.259935][ T7767] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.267405][ T7767] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.275123][ T7767] device bridge_slave_1 entered promiscuous mode [ 80.283723][ T7762] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 80.297921][ T7760] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.305001][ T7760] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.314080][ T7760] device bridge_slave_1 entered promiscuous mode [ 80.332704][ T7758] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.340275][ T7758] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.348488][ T7758] device bridge_slave_0 entered promiscuous mode [ 80.380540][ T7758] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.389072][ T7758] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.397470][ T7758] device bridge_slave_1 entered promiscuous mode [ 80.421858][ T7767] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 80.433019][ T7767] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 80.458846][ T7766] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.466687][ T7766] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.474655][ T7766] device bridge_slave_0 entered promiscuous mode [ 80.490307][ T7762] team0: Port device team_slave_0 added [ 80.497064][ T7764] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.504167][ T7764] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.512128][ T7764] device bridge_slave_0 entered promiscuous mode [ 80.524855][ T7764] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.532219][ T7764] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.548677][ T7764] device bridge_slave_1 entered promiscuous mode [ 80.559152][ T7760] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 80.567731][ T7766] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.574812][ T7766] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.582887][ T7766] device bridge_slave_1 entered promiscuous mode [ 80.591838][ T7758] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 80.601615][ T7762] team0: Port device team_slave_1 added [ 80.608722][ T7767] team0: Port device team_slave_0 added [ 80.621456][ T7760] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 80.649971][ T7758] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 80.661640][ T7767] team0: Port device team_slave_1 added [ 80.679623][ T7766] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 80.703540][ T7764] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 80.731096][ T7766] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 80.778659][ T7762] device hsr_slave_0 entered promiscuous mode [ 80.815810][ T7762] device hsr_slave_1 entered promiscuous mode [ 80.872677][ T7764] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 80.882134][ T7760] team0: Port device team_slave_0 added [ 80.928085][ T7767] device hsr_slave_0 entered promiscuous mode [ 80.975815][ T7767] device hsr_slave_1 entered promiscuous mode [ 81.061186][ T7758] team0: Port device team_slave_0 added [ 81.074724][ T7758] team0: Port device team_slave_1 added [ 81.082537][ T7760] team0: Port device team_slave_1 added [ 81.093706][ T7766] team0: Port device team_slave_0 added [ 81.108850][ T7764] team0: Port device team_slave_0 added [ 81.117506][ T7766] team0: Port device team_slave_1 added [ 81.138947][ T7764] team0: Port device team_slave_1 added [ 81.188345][ T7760] device hsr_slave_0 entered promiscuous mode [ 81.235798][ T7760] device hsr_slave_1 entered promiscuous mode [ 81.388027][ T7764] device hsr_slave_0 entered promiscuous mode [ 81.445825][ T7764] device hsr_slave_1 entered promiscuous mode [ 81.528128][ T7758] device hsr_slave_0 entered promiscuous mode [ 81.565814][ T7758] device hsr_slave_1 entered promiscuous mode [ 81.668397][ T7766] device hsr_slave_0 entered promiscuous mode [ 81.705788][ T7766] device hsr_slave_1 entered promiscuous mode [ 81.881708][ T7762] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.912230][ T3288] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 81.921699][ T3288] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 81.931601][ T7762] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.962885][ T7767] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.970091][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 81.980188][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 81.989302][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.996954][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.005021][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 82.015489][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 82.023960][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.031145][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.039880][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 82.048921][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 82.059061][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 82.087131][ T7766] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.101957][ T7760] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.115911][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 82.124730][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 82.133903][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 82.161377][ T7767] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.182727][ T7758] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.190057][ T3288] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 82.200008][ T3288] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 82.209120][ T3288] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 82.217219][ T3288] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 82.224962][ T3288] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 82.233345][ T3288] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 82.248478][ T7760] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.258967][ T7764] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.272331][ T7766] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.284552][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 82.293557][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 82.302636][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 82.311954][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 82.320400][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.327525][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.335275][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 82.343018][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 82.352655][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 82.360963][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 82.369811][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 82.401867][ T7764] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.409321][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 82.421829][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 82.430860][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.437968][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.446389][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 82.454966][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 82.463711][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 82.472219][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 82.481006][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 82.490738][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 82.499610][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.506762][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.514347][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 82.523303][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 82.531718][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.538854][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.547208][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 82.554968][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 82.563186][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 82.572190][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 82.582074][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.589185][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.597343][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 82.605063][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 82.615571][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 82.623569][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 82.632183][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 82.641146][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 82.650242][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 82.670913][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 82.680614][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 82.689579][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 82.699261][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 82.709658][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 82.718390][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 82.726750][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.733815][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.743075][ T7758] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.751300][ T7762] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 82.779088][ T7775] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 82.787483][ T7775] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 82.799827][ T7775] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 82.808713][ T7775] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.815823][ T7775] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.824548][ T7775] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 82.839390][ T7775] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 82.848375][ T7775] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 82.856836][ T7775] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 82.865520][ T7775] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 82.873857][ T7775] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 82.882434][ T7775] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 82.891055][ T7775] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 82.899936][ T7775] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 82.908437][ T7775] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 82.917012][ T7775] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 82.925039][ T7775] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 82.939961][ T7767] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 82.951817][ T7767] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 82.978899][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 82.989842][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 83.003746][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 83.012241][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 83.022240][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 83.030890][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 83.039926][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 83.049085][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.056206][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.064538][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 83.094322][ T7767] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.103803][ T3288] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 83.112859][ T3288] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 83.121859][ T3288] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.129012][ T3288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.136888][ T3288] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 83.145710][ T3288] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 83.154273][ T3288] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 83.163277][ T3288] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 83.173440][ T3288] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 83.181641][ T3288] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 83.190884][ T3288] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 83.224221][ T7766] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 83.241559][ T7766] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 83.258870][ T7762] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.272829][ T3282] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 83.282129][ T3282] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 83.291306][ T3282] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 83.300280][ T3282] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 83.308758][ T3282] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 83.317433][ T3282] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 83.326213][ T3282] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 83.334579][ T3282] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 83.343978][ T3282] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 83.361999][ T7764] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 83.373351][ T7764] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 83.395388][ T3282] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 83.404207][ T3282] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 83.414480][ T3282] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.421651][ T3282] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.453266][ T3282] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 83.471093][ T3282] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 83.479692][ T3282] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 83.500481][ T3282] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 83.583548][ T7758] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 83.600569][ T7758] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 83.613329][ T3288] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 83.622984][ T3288] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 83.632929][ T3288] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 83.649769][ T3288] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 83.659522][ T3288] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 83.669285][ T3288] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 83.679660][ T3288] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 83.688893][ T3288] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 83.699079][ T3288] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 83.708302][ T3288] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 83.718821][ T7766] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.739864][ T7764] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.754223][ T7760] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.773802][ T7758] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.012803][ T7823] ================================================================== [ 84.021133][ T7823] BUG: KASAN: use-after-free in tipc_sk_filter_rcv+0x2166/0x34f0 [ 84.028953][ T7823] Read of size 4 at addr ffff88809938e9f4 by task syz-executor.5/7823 [ 84.037104][ T7823] [ 84.039444][ T7823] CPU: 0 PID: 7823 Comm: syz-executor.5 Not tainted 5.1.0-rc1-next-20190320 #7 [ 84.048393][ T7823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 84.058477][ T7823] Call Trace: [ 84.061784][ T7823] dump_stack+0x172/0x1f0 [ 84.066128][ T7823] ? tipc_sk_filter_rcv+0x2166/0x34f0 [ 84.071522][ T7823] print_address_description.cold+0x7c/0x20d [ 84.077568][ T7823] ? tipc_sk_filter_rcv+0x2166/0x34f0 [ 84.082954][ T7823] ? tipc_sk_filter_rcv+0x2166/0x34f0 [ 84.088350][ T7823] kasan_report.cold+0x1b/0x40 [ 84.093129][ T7823] ? tipc_sk_filter_rcv+0x2166/0x34f0 [ 84.098523][ T7823] __asan_report_load4_noabort+0x14/0x20 [ 84.104174][ T7823] tipc_sk_filter_rcv+0x2166/0x34f0 [ 84.109387][ T7823] ? debug_check_no_obj_freed+0x211/0x444 [ 84.115125][ T7823] ? kasan_check_write+0x14/0x20 [ 84.120089][ T7823] ? tipc_sk_overlimit2+0xa0/0xa0 [ 84.125142][ T7823] ? __lock_acquire+0x548/0x3fb0 [ 84.130101][ T7823] ? __release_sock+0xca/0x3a0 [ 84.134881][ T7823] tipc_sk_backlog_rcv+0xeb/0x1e0 [ 84.139911][ T7823] ? tipc_sk_mcast_rcv+0x1020/0x1020 [ 84.145215][ T7823] ? __local_bh_enable_ip+0x15a/0x270 [ 84.150600][ T7823] ? lockdep_hardirqs_on+0x418/0x5d0 [ 84.155888][ T7823] ? __release_sock+0xca/0x3a0 [ 84.160677][ T7823] ? trace_hardirqs_on+0x67/0x230 [ 84.165835][ T7823] ? __release_sock+0xca/0x3a0 [ 84.170604][ T7823] ? __local_bh_enable_ip+0x15a/0x270 [ 84.175985][ T7823] __release_sock+0x12e/0x3a0 [ 84.180700][ T7823] release_sock+0x59/0x1c0 [ 84.185108][ T7823] tipc_setsockopt+0x496/0xb60 [ 84.189884][ T7823] ? tipc_sk_finish_conn+0x640/0x640 [ 84.195267][ T7823] ? apparmor_socket_setsockopt+0x22/0x30 [ 84.200998][ T7823] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 84.208057][ T7823] ? security_socket_setsockopt+0x93/0xc0 [ 84.213789][ T7823] __sys_setsockopt+0x180/0x280 [ 84.218634][ T7823] ? kernel_accept+0x310/0x310 [ 84.223414][ T7823] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 84.228897][ T7823] ? do_syscall_64+0x26/0x610 [ 84.233611][ T7823] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 84.239676][ T7823] ? do_syscall_64+0x26/0x610 [ 84.244355][ T7823] __x64_sys_setsockopt+0xbe/0x150 [ 84.249480][ T7823] do_syscall_64+0x103/0x610 [ 84.254059][ T7823] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 84.259952][ T7823] RIP: 0033:0x458079 [ 84.263845][ T7823] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 84.283444][ T7823] RSP: 002b:00007fe91098cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 84.291958][ T7823] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000458079 [ 84.299927][ T7823] RDX: 0000000000000087 RSI: 000000000000010f RDI: 0000000000000006 [ 84.307908][ T7823] RBP: 000000000073bf00 R08: 00000000000004bd R09: 0000000000000000 [ 84.315923][ T7823] R10: 0000000020000180 R11: 0000000000000246 R12: 00007fe91098d6d4 [ 84.323930][ T7823] R13: 00000000004c619f R14: 00000000004db210 R15: 00000000ffffffff [ 84.331907][ T7823] [ 84.334218][ T7823] Allocated by task 7: [ 84.338286][ T7823] save_stack+0x45/0xd0 [ 84.342460][ T7823] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 84.348094][ T7823] kasan_kmalloc+0x9/0x10 [ 84.352459][ T7823] __kmalloc_node_track_caller+0x4e/0x70 [ 84.358087][ T7823] __kmalloc_reserve.isra.0+0x40/0xf0 [ 84.363457][ T7823] __alloc_skb+0x10b/0x5e0 [ 84.367880][ T7823] tipc_buf_acquire+0x2f/0x100 [ 84.372660][ T7823] tipc_msg_create+0x38/0x270 [ 84.377342][ T7823] tipc_topsrv_kern_evt+0x2a7/0x580 [ 84.382600][ T7823] tipc_conn_send_to_sock+0x43e/0x5f0 [ 84.388094][ T7823] tipc_conn_send_work+0x65/0x80 [ 84.393150][ T7823] process_one_work+0x98e/0x1790 [ 84.398088][ T7823] worker_thread+0x98/0xe40 [ 84.402578][ T7823] kthread+0x357/0x430 [ 84.406657][ T7823] ret_from_fork+0x3a/0x50 [ 84.411058][ T7823] [ 84.413362][ T7823] Freed by task 7823: [ 84.417358][ T7823] save_stack+0x45/0xd0 [ 84.421534][ T7823] __kasan_slab_free+0x102/0x150 [ 84.426486][ T7823] kasan_slab_free+0xe/0x10 [ 84.430992][ T7823] kfree+0xcf/0x230 [ 84.434797][ T7823] skb_free_head+0x93/0xb0 [ 84.439214][ T7823] skb_release_data+0x576/0x7a0 [ 84.445117][ T7823] skb_release_all+0x4d/0x60 [ 84.449693][ T7823] kfree_skb+0xe8/0x390 [ 84.453833][ T7823] tipc_sk_filter_rcv+0x1e6a/0x34f0 [ 84.459039][ T7823] tipc_sk_backlog_rcv+0xeb/0x1e0 [ 84.464073][ T7823] __release_sock+0x12e/0x3a0 [ 84.469011][ T7823] release_sock+0x59/0x1c0 [ 84.473424][ T7823] tipc_setsockopt+0x496/0xb60 [ 84.478203][ T7823] __sys_setsockopt+0x180/0x280 [ 84.483042][ T7823] __x64_sys_setsockopt+0xbe/0x150 [ 84.488157][ T7823] do_syscall_64+0x103/0x610 [ 84.492751][ T7823] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 84.498635][ T7823] [ 84.500957][ T7823] The buggy address belongs to the object at ffff88809938e940 [ 84.500957][ T7823] which belongs to the cache kmalloc-1k of size 1024 [ 84.515013][ T7823] The buggy address is located 180 bytes inside of [ 84.515013][ T7823] 1024-byte region [ffff88809938e940, ffff88809938ed40) [ 84.528376][ T7823] The buggy address belongs to the page: [ 84.534037][ T7823] page:ffffea000264e380 count:1 mapcount:0 mapping:ffff88812c3f0ac0 index:0x0 compound_mapcount: 0 [ 84.544721][ T7823] flags: 0x1fffc0000010200(slab|head) [ 84.550087][ T7823] raw: 01fffc0000010200 ffffea0002625588 ffffea0002942408 ffff88812c3f0ac0 [ 84.558668][ T7823] raw: 0000000000000000 ffff88809938e040 0000000100000007 0000000000000000 [ 84.567252][ T7823] page dumped because: kasan: bad access detected [ 84.573664][ T7823] [ 84.575986][ T7823] Memory state around the buggy address: [ 84.581633][ T7823] ffff88809938e880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 84.589689][ T7823] ffff88809938e900: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 84.597742][ T7823] >ffff88809938e980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb 2019/03/20 12:34:01 executed programs: 20 [ 84.605818][ T7823] ^ [ 84.619198][ T7823] ffff88809938ea00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 84.627272][ T7823] ffff88809938ea80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 84.635337][ T7823] ================================================================== [ 84.643417][ T7823] Disabling lock debugging due to kernel taint [ 84.662772][ T7823] Kernel panic - not syncing: panic_on_warn set ... [ 84.669190][ T3878] kobject: 'loop4' (00000000068bffef): kobject_uevent_env [ 84.669422][ T7823] CPU: 1 PID: 7823 Comm: syz-executor.5 Tainted: G B 5.1.0-rc1-next-20190320 #7 [ 84.684786][ T3878] kobject: 'loop4' (00000000068bffef): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 84.687139][ T7823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 84.687144][ T7823] Call Trace: [ 84.687165][ T7823] dump_stack+0x172/0x1f0 [ 84.687183][ T7823] panic+0x2cb/0x65c [ 84.687198][ T7823] ? __warn_printk+0xf3/0xf3 [ 84.687223][ T7823] ? tipc_sk_filter_rcv+0x2166/0x34f0 [ 84.730358][ T7823] ? preempt_schedule+0x4b/0x60 [ 84.735228][ T7823] ? ___preempt_schedule+0x16/0x18 [ 84.740364][ T7823] ? trace_hardirqs_on+0x5e/0x230 [ 84.745406][ T7823] ? tipc_sk_filter_rcv+0x2166/0x34f0 [ 84.746152][ T3878] kobject: 'loop1' (00000000fa7d1c28): kobject_uevent_env [ 84.750812][ T7823] end_report+0x47/0x4f [ 84.762081][ T7823] ? tipc_sk_filter_rcv+0x2166/0x34f0 [ 84.767477][ T7823] kasan_report.cold+0xe/0x40 [ 84.768814][ T3878] kobject: 'loop1' (00000000fa7d1c28): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 84.772169][ T7823] ? tipc_sk_filter_rcv+0x2166/0x34f0 [ 84.772186][ T7823] __asan_report_load4_noabort+0x14/0x20 [ 84.772207][ T7823] tipc_sk_filter_rcv+0x2166/0x34f0 [ 84.798416][ T3878] kobject: 'loop4' (00000000068bffef): kobject_uevent_env [ 84.798715][ T7823] ? debug_check_no_obj_freed+0x211/0x444 [ 84.811471][ T3878] kobject: 'loop4' (00000000068bffef): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 84.811546][ T7823] ? kasan_check_write+0x14/0x20 [ 84.811574][ T7823] ? tipc_sk_overlimit2+0xa0/0xa0 [ 84.827721][ T3878] kobject: 'loop4' (00000000068bffef): kobject_uevent_env [ 84.831695][ T7823] ? __lock_acquire+0x548/0x3fb0 [ 84.831714][ T7823] ? __release_sock+0xca/0x3a0 [ 84.831740][ T7823] tipc_sk_backlog_rcv+0xeb/0x1e0 [ 84.838988][ T3878] kobject: 'loop4' (00000000068bffef): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 84.843793][ T7823] ? tipc_sk_mcast_rcv+0x1020/0x1020 [ 84.843808][ T7823] ? __local_bh_enable_ip+0x15a/0x270 [ 84.843830][ T7823] ? lockdep_hardirqs_on+0x418/0x5d0 [ 84.879679][ T7823] ? __release_sock+0xca/0x3a0 [ 84.884455][ T7823] ? trace_hardirqs_on+0x67/0x230 [ 84.889494][ T7823] ? __release_sock+0xca/0x3a0 [ 84.894261][ T7823] ? __local_bh_enable_ip+0x15a/0x270 [ 84.899632][ T7823] __release_sock+0x12e/0x3a0 [ 84.904308][ T7823] release_sock+0x59/0x1c0 [ 84.908736][ T7823] tipc_setsockopt+0x496/0xb60 [ 84.913495][ T7823] ? tipc_sk_finish_conn+0x640/0x640 [ 84.918781][ T7823] ? apparmor_socket_setsockopt+0x22/0x30 [ 84.924500][ T7823] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 84.930765][ T7823] ? security_socket_setsockopt+0x93/0xc0 [ 84.936491][ T7823] __sys_setsockopt+0x180/0x280 [ 84.941352][ T7823] ? kernel_accept+0x310/0x310 [ 84.946126][ T7823] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 84.951584][ T7823] ? do_syscall_64+0x26/0x610 [ 84.956257][ T7823] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 84.962319][ T7823] ? do_syscall_64+0x26/0x610 [ 84.966995][ T7823] __x64_sys_setsockopt+0xbe/0x150 [ 84.972109][ T7823] do_syscall_64+0x103/0x610 [ 84.976695][ T7823] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 84.982574][ T7823] RIP: 0033:0x458079 [ 84.986461][ T7823] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 85.006062][ T7823] RSP: 002b:00007fe91098cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 85.014486][ T7823] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000458079 [ 85.022459][ T7823] RDX: 0000000000000087 RSI: 000000000000010f RDI: 0000000000000006 [ 85.030684][ T7823] RBP: 000000000073bf00 R08: 00000000000004bd R09: 0000000000000000 [ 85.038663][ T7823] R10: 0000000020000180 R11: 0000000000000246 R12: 00007fe91098d6d4 [ 85.046633][ T7823] R13: 00000000004c619f R14: 00000000004db210 R15: 00000000ffffffff [ 85.055493][ T7823] Kernel Offset: disabled [ 85.059830][ T7823] Rebooting in 86400 seconds..