Warning: Permanently added '10.128.0.229' (ECDSA) to the list of known hosts. 2020/08/04 07:25:34 parsed 1 programs 2020/08/04 07:25:34 executed programs: 0 [ 42.104476][ T6822] IPVS: ftp: loaded support on port[0] = 21 [ 42.185445][ T6822] chnl_net:caif_netlink_parms(): no params data found [ 42.229419][ T6822] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.237918][ T6822] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.246530][ T6822] device bridge_slave_0 entered promiscuous mode [ 42.255427][ T6822] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.262510][ T6822] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.270905][ T6822] device bridge_slave_1 entered promiscuous mode [ 42.288754][ T6822] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 42.299779][ T6822] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 42.320416][ T6822] team0: Port device team_slave_0 added [ 42.327452][ T6822] team0: Port device team_slave_1 added [ 42.343104][ T6822] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 42.350147][ T6822] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 42.377269][ T6822] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 42.389773][ T6822] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 42.397468][ T6822] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 42.423999][ T6822] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 42.526944][ T6822] device hsr_slave_0 entered promiscuous mode [ 42.575370][ T6822] device hsr_slave_1 entered promiscuous mode [ 42.704547][ T6822] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 42.766793][ T6822] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 42.838016][ T6822] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 42.886642][ T6822] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 42.957172][ T6822] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.964460][ T6822] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.972108][ T6822] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.979231][ T6822] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.018169][ T6822] 8021q: adding VLAN 0 to HW filter on device bond0 [ 43.030903][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 43.041113][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.049487][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.057519][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 43.070157][ T6822] 8021q: adding VLAN 0 to HW filter on device team0 [ 43.080592][ T2493] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 43.089820][ T2493] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.097461][ T2493] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.110105][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 43.119229][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.126870][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.146869][ T2493] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 43.155871][ T2493] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 43.171240][ T6822] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 43.182439][ T6822] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 43.195704][ T2493] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 43.203866][ T2493] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 43.212386][ T2493] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 43.220870][ T2493] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 43.245589][ T6822] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 43.253463][ T7032] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 43.263261][ T7032] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 43.284428][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 43.293089][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 43.305261][ T2493] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 43.313452][ T2493] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 43.325497][ T6822] device veth0_vlan entered promiscuous mode [ 43.334022][ T2493] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 43.341705][ T2493] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 43.352288][ T6822] device veth1_vlan entered promiscuous mode [ 43.371188][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 43.380051][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 43.388216][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 43.398364][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 43.408753][ T6822] device veth0_macvtap entered promiscuous mode [ 43.418747][ T6822] device veth1_macvtap entered promiscuous mode [ 43.433100][ T6822] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 43.440746][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 43.449953][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 43.458119][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 43.467646][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 43.479923][ T6822] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 43.488564][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 43.498262][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 46.822502][ T5] Bluetooth: hci0: command 0x0409 tx timeout 2020/08/04 07:25:39 executed programs: 10 [ 47.427700][ T7096] ================================================================== [ 47.427736][ T7096] BUG: KASAN: use-after-free in vc_do_resize+0xe2e/0x1d00 [ 47.427742][ T7096] Read of size 2 at addr ffff8880a68d4182 by task syz-executor.0/7096 [ 47.427744][ T7096] [ 47.427752][ T7096] CPU: 0 PID: 7096 Comm: syz-executor.0 Not tainted 5.8.0-syzkaller #0 [ 47.427756][ T7096] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 47.427758][ T7096] Call Trace: [ 47.427766][ T7096] dump_stack+0x1f0/0x31e [ 47.427776][ T7096] print_address_description+0x66/0x5a0 [ 47.427783][ T7096] ? vprintk_emit+0x342/0x3c0 [ 47.427790][ T7096] ? printk+0x62/0x83 [ 47.427796][ T7096] ? vprintk_emit+0x339/0x3c0 [ 47.427804][ T7096] kasan_report+0x132/0x1d0 [ 47.427810][ T7096] ? vc_do_resize+0xe2e/0x1d00 [ 47.427818][ T7096] check_memory_region+0x2b5/0x2f0 [ 47.427823][ T7096] ? vc_do_resize+0xe2e/0x1d00 [ 47.427830][ T7096] memcpy+0x25/0x60 [ 47.427836][ T7096] vc_do_resize+0xe2e/0x1d00 [ 47.427851][ T7096] ? fb_match_mode+0x59b/0x6e0 [ 47.427860][ T7096] fbcon_modechanged+0x710/0xd90 [ 47.427869][ T7096] fb_set_var+0x825/0xcc0 [ 47.427888][ T7096] do_fb_ioctl+0x502/0x6f0 [ 47.427902][ T7096] ? fb_write+0x540/0x540 [ 47.427909][ T7096] __se_sys_ioctl+0xf9/0x160 [ 47.427917][ T7096] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 47.427923][ T7096] do_syscall_64+0x73/0xe0 [ 47.427930][ T7096] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 47.427935][ T7096] RIP: 0033:0x45cce9 [ 47.427943][ T7096] Code: 2d b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb b5 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 47.427946][ T7096] RSP: 002b:00007f4d4b387c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 47.427953][ T7096] RAX: ffffffffffffffda RBX: 000000000000d540 RCX: 000000000045cce9 [ 47.427956][ T7096] RDX: 0000000020000000 RSI: 0000000000004601 RDI: 0000000000000003 [ 47.427959][ T7096] RBP: 000000000078bf40 R08: 0000000000000000 R09: 0000000000000000 [ 47.427963][ T7096] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000078bf0c [ 47.427966][ T7096] R13: 00007ffe2502b86f R14: 00007f4d4b3889c0 R15: 000000000078bf0c [ 47.427975][ T7096] [ 47.427978][ T7096] Allocated by task 1: [ 47.427985][ T7096] __kasan_kmalloc+0x103/0x140 [ 47.427990][ T7096] __kmalloc+0x24b/0x330 [ 47.427996][ T7096] tomoyo_encode2+0x25a/0x560 [ 47.428001][ T7096] tomoyo_realpath_from_path+0x5d6/0x630 [ 47.428005][ T7096] tomoyo_path_perm+0x17d/0x740 [ 47.428011][ T7096] security_inode_getattr+0xc0/0x140 [ 47.428016][ T7096] vfs_statx+0x118/0x380 [ 47.428021][ T7096] __x64_sys_newlstat+0x81/0xd0 [ 47.428025][ T7096] do_syscall_64+0x73/0xe0 [ 47.428031][ T7096] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 47.428033][ T7096] [ 47.428035][ T7096] Freed by task 1: [ 47.428040][ T7096] __kasan_slab_free+0x114/0x170 [ 47.428045][ T7096] kfree+0x10a/0x220 [ 47.428050][ T7096] tomoyo_path_perm+0x59b/0x740 [ 47.428057][ T7096] security_inode_getattr+0xc0/0x140 [ 47.428064][ T7096] vfs_statx+0x118/0x380 [ 47.428071][ T7096] __x64_sys_newlstat+0x81/0xd0 [ 47.428077][ T7096] do_syscall_64+0x73/0xe0 [ 47.428085][ T7096] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 47.428088][ T7096] [ 47.428095][ T7096] The buggy address belongs to the object at ffff8880a68d4180 [ 47.428095][ T7096] which belongs to the cache kmalloc-32 of size 32 [ 47.428110][ T7096] The buggy address is located 2 bytes inside of [ 47.428110][ T7096] 32-byte region [ffff8880a68d4180, ffff8880a68d41a0) [ 47.428114][ T7096] The buggy address belongs to the page: [ 47.428126][ T7096] page:ffffea00029a3500 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880a68d4fc1 [ 47.428133][ T7096] flags: 0xfffe0000000200(slab) [ 47.428144][ T7096] raw: 00fffe0000000200 ffffea00027b9488 ffffea00024ebc08 ffff8880aa4001c0 [ 47.428153][ T7096] raw: ffff8880a68d4fc1 ffff8880a68d4000 000000010000003f 0000000000000000 [ 47.428157][ T7096] page dumped because: kasan: bad access detected [ 47.428159][ T7096] [ 47.428161][ T7096] Memory state around the buggy address: [ 47.428165][ T7096] ffff8880a68d4080: 00 00 01 fc fc fc fc fc 00 04 fc fc fc fc fc fc [ 47.428169][ T7096] ffff8880a68d4100: 00 04 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 47.428173][ T7096] >ffff8880a68d4180: fb fb fb fb fc fc fc fc 00 00 01 fc fc fc fc fc [ 47.428176][ T7096] ^ [ 47.428180][ T7096] ffff8880a68d4200: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 47.428184][ T7096] ffff8880a68d4280: 00 00 01 fc fc fc fc fc 00 00 00 fc fc fc fc fc [ 47.428187][ T7096] ================================================================== [ 47.428189][ T7096] Disabling lock debugging due to kernel taint [ 47.428192][ T7096] Kernel panic - not syncing: panic_on_warn set ... [ 47.428198][ T7096] CPU: 0 PID: 7096 Comm: syz-executor.0 Tainted: G B 5.8.0-syzkaller #0 [ 47.428201][ T7096] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 47.428202][ T7096] Call Trace: [ 47.428208][ T7096] dump_stack+0x1f0/0x31e [ 47.428215][ T7096] panic+0x264/0x7a0 [ 47.428221][ T7096] ? trace_hardirqs_on+0x30/0x80 [ 47.428228][ T7096] kasan_report+0x1c9/0x1d0 [ 47.428233][ T7096] ? vc_do_resize+0xe2e/0x1d00 [ 47.428239][ T7096] check_memory_region+0x2b5/0x2f0 [ 47.428244][ T7096] ? vc_do_resize+0xe2e/0x1d00 [ 47.428248][ T7096] memcpy+0x25/0x60 [ 47.428253][ T7096] vc_do_resize+0xe2e/0x1d00 [ 47.428262][ T7096] ? fb_match_mode+0x59b/0x6e0 [ 47.428268][ T7096] fbcon_modechanged+0x710/0xd90 [ 47.428274][ T7096] fb_set_var+0x825/0xcc0 [ 47.428284][ T7096] do_fb_ioctl+0x502/0x6f0 [ 47.428293][ T7096] ? fb_write+0x540/0x540 [ 47.428297][ T7096] __se_sys_ioctl+0xf9/0x160 [ 47.428303][ T7096] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 47.428308][ T7096] do_syscall_64+0x73/0xe0 [ 47.428313][ T7096] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 47.428317][ T7096] RIP: 0033:0x45cce9 [ 47.428321][ T7096] Code: 2d b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb b5 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 47.428324][ T7096] RSP: 002b:00007f4d4b387c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 47.428329][ T7096] RAX: ffffffffffffffda RBX: 000000000000d540 RCX: 000000000045cce9 [ 47.428332][ T7096] RDX: 0000000020000000 RSI: 0000000000004601 RDI: 0000000000000003 [ 47.428334][ T7096] RBP: 000000000078bf40 R08: 0000000000000000 R09: 0000000000000000 [ 47.428337][ T7096] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000078bf0c [ 47.428340][ T7096] R13: 00007ffe2502b86f R14: 00007f4d4b3889c0 R15: 000000000078bf0c [ 47.429694][ T7096] Kernel Offset: disabled [ 48.076214][ T7096] Rebooting in 86400 seconds..