[info] Using makefile-style concurrent boot in runlevel 2. [ 40.750706][ T26] audit: type=1800 audit(1574976801.420:21): pid=7326 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="bootlogs" dev="sda1" ino=2452 res=0 [ 40.800320][ T26] audit: type=1800 audit(1574976801.430:22): pid=7326 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="motd" dev="sda1" ino=2480 res=0 [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.183' (ECDSA) to the list of known hosts. 2019/11/28 21:33:33 fuzzer started 2019/11/28 21:33:34 dialing manager at 10.128.0.105:41717 2019/11/28 21:33:34 syscalls: 2589 2019/11/28 21:33:34 code coverage: enabled 2019/11/28 21:33:34 comparison tracing: enabled 2019/11/28 21:33:34 extra coverage: extra coverage is not supported by the kernel 2019/11/28 21:33:34 setuid sandbox: enabled 2019/11/28 21:33:34 namespace sandbox: enabled 2019/11/28 21:33:34 Android sandbox: /sys/fs/selinux/policy does not exist 2019/11/28 21:33:34 fault injection: enabled 2019/11/28 21:33:34 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/11/28 21:33:34 net packet injection: enabled 2019/11/28 21:33:34 net device setup: enabled 2019/11/28 21:33:34 concurrency sanitizer: enabled 2019/11/28 21:33:34 devlink PCI setup: PCI device 0000:00:10.0 is not available syzkaller login: [ 58.806642][ T7490] KCSAN: could not find function: 'poll_schedule_timeout' [ 66.899427][ T7490] KCSAN: could not find function: 'calc_wb_limits' 2019/11/28 21:33:47 adding functions to KCSAN blacklist: 'add_timer' 'do_syslog' 'blk_mq_run_hw_queue' '__delete_from_page_cache' '__blk_queue_split' 'run_timer_softirq' 'ext4_has_free_clusters' 'rcu_gp_fqs_loop' 'ext4_free_inodes_count' 'generic_write_end' 'p9_poll_workfn' 'ext4_free_inode' 'evict' 'ep_poll' 'blk_mq_get_request' 'ktime_get_real_seconds' '__skb_try_recv_from_queue' 'complete_signal' 'generic_update_time' 'echo_char' 'do_signal_stop' 'calc_timer_values' 'ext4_mark_iloc_dirty' 'mem_cgroup_select_victim_node' 'tick_sched_do_timer' 'tick_nohz_idle_stop_tick' '__snd_rawmidi_transmit_ack' 'dd_has_work' 'ext4_nonda_switch' 'n_tty_receive_buf_common' 'ext4_da_write_end' 'mod_timer' 'poll_schedule_timeout' 'find_get_pages_range_tag' 'ext4_mb_good_group' 'sit_tunnel_xmit' 'padata_find_next' '__splice_from_pipe' 'fanotify_handle_event' 'timer_clear_idle' 'snd_seq_check_queue' 'rds_cong_map_updated' '__hrtimer_run_queues' 'common_perm_cond' 'tick_do_update_jiffies64' 'lruvec_lru_size' '__mark_inode_dirty' 'futex_wait_queue_me' 'balance_dirty_pages' 'process_srcu' 'tomoyo_supervisor' 'generic_fillattr' 'lru_add_drain_all' 'xas_find_marked' 'do_exit' 'rcu_gp_fqs_check_wake' 'wbt_done' 'do_nanosleep' 'virtqueue_enable_cb_delayed' 'tcp_add_backlog' 'find_next_bit' 'blk_stat_add' 'relay_switch_subbuf' 'copy_process' 'enqueue_timer' 'list_lru_count_one' 'xas_clear_mark' 'page_counter_try_charge' '__ext4_new_inode' 'blk_mq_dispatch_rq_list' 'delete_from_page_cache_batch' 'kauditd_thread' 'kcm_rfree' 'exit_signals' 'vm_area_dup' 'pipe_poll' 'snd_ctl_ioctl' 'blk_mq_sched_dispatch_requests' 'audit_log_start' 'calc_wb_limits' 'taskstats_exit' 'pcpu_alloc' 21:37:24 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x4000, 0x0) fchdir(0xffffffffffffffff) write(0xffffffffffffffff, 0x0, 0x0) read(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$loop(0x0, 0x0, 0x8800) openat$cgroup_procs(0xffffffffffffffff, &(0x7f00000003c0)='cgroup.threads\x00', 0x2, 0x0) write$binfmt_aout(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$loop(0x0, 0x0, 0x2) r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$HDIO_GETGEO(0xffffffffffffffff, 0x301, &(0x7f0000000d80)) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000380)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) syz_genetlink_get_family_id$nbd(0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) sched_getaffinity(0x0, 0x0, 0x0) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)={0x2, 0xd, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x40}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 21:37:25 executing program 1: r0 = socket$inet(0x10, 0x2, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000400)) syz_open_procfs(0x0, &(0x7f0000000100)='net/arp\x00') mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r1 = socket(0x10, 0x80000000000802, 0x0) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) fcntl$addseals(r1, 0x409, 0xb) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x10000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f00000000c0)=0xbbe, 0x4) connect$inet6(r2, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r3 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r2, r3, 0x0, 0xedc0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(0xffffffffffffffff, 0xc0096616, &(0x7f0000000240)={0x4, [0x0, 0x0, 0x0, 0x0]}) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f00000001c0)=0xfffffffffffffffe, 0x4) request_key(&(0x7f0000000300)='cifs.spnego\x00', &(0x7f0000000380)={'syz', 0x3}, &(0x7f00000003c0)='\x00', 0xfffffffffffffffa) sendmsg(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000140)="24000000220007031dfffd946f610500000000000543000000000000421ba3a20400ff7e280000001100ff5613d3475bb65f64000000000004000000000000eff24d8238cfa47e23f7efbf54", 0x4c}], 0x1}, 0x0) [ 284.367624][ T7494] IPVS: ftp: loaded support on port[0] = 21 [ 284.467561][ T7494] chnl_net:caif_netlink_parms(): no params data found [ 284.533387][ T7494] bridge0: port 1(bridge_slave_0) entered blocking state [ 284.540611][ T7494] bridge0: port 1(bridge_slave_0) entered disabled state [ 284.561107][ T7494] device bridge_slave_0 entered promiscuous mode [ 284.569104][ T7494] bridge0: port 2(bridge_slave_1) entered blocking state [ 284.576630][ T7494] bridge0: port 2(bridge_slave_1) entered disabled state [ 284.584660][ T7494] device bridge_slave_1 entered promiscuous mode [ 284.602526][ T7494] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 284.613152][ T7494] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link 21:37:25 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000000580)={0x81, 0x0, [0x3]}) [ 284.630722][ T7497] IPVS: ftp: loaded support on port[0] = 21 [ 284.632500][ T7494] team0: Port device team_slave_0 added [ 284.643776][ T7494] team0: Port device team_slave_1 added [ 284.674438][ T7498] ================================================================== [ 284.682586][ T7498] BUG: KCSAN: data-race in pipe_wait / put_pipe_info [ 284.689287][ T7498] [ 284.691600][ T7498] read to 0xffff8880b00a694c of 4 bytes by task 7479 on cpu 0: [ 284.699160][ T7498] pipe_wait+0xd7/0x140 [ 284.703296][ T7498] pipe_read+0x3b1/0x5e0 [ 284.707557][ T7498] new_sync_read+0x389/0x4f0 [ 284.712131][ T7498] __vfs_read+0xb1/0xc0 [ 284.716263][ T7498] vfs_read+0x143/0x2c0 [ 284.720399][ T7498] ksys_read+0xd5/0x1b0 [ 284.724549][ T7498] __x64_sys_read+0x4c/0x60 [ 284.729047][ T7498] do_syscall_64+0xcc/0x370 [ 284.733541][ T7498] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 284.739415][ T7498] [ 284.741816][ T7498] write to 0xffff8880b00a694c of 4 bytes by task 7498 on cpu 1: [ 284.749467][ T7498] put_pipe_info+0x4d/0xb0 [ 284.753867][ T7498] pipe_release+0x152/0x1b0 [ 284.758352][ T7498] __fput+0x1e1/0x520 [ 284.762312][ T7498] ____fput+0x1f/0x30 [ 284.766273][ T7498] task_work_run+0xf6/0x130 [ 284.770758][ T7498] exit_to_usermode_loop+0x2b4/0x2c0 [ 284.776024][ T7498] do_syscall_64+0x353/0x370 [ 284.780593][ T7498] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 284.786465][ T7498] [ 284.788768][ T7498] Reported by Kernel Concurrency Sanitizer on: [ 284.794906][ T7498] CPU: 1 PID: 7498 Comm: syz-executor.2 Not tainted 5.4.0-syzkaller #0 [ 284.803122][ T7498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 284.813160][ T7498] ================================================================== [ 284.821212][ T7498] Kernel panic - not syncing: panic_on_warn set ... [ 284.827778][ T7498] CPU: 1 PID: 7498 Comm: syz-executor.2 Not tainted 5.4.0-syzkaller #0 [ 284.836008][ T7498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 284.846055][ T7498] Call Trace: [ 284.849345][ T7498] dump_stack+0x11d/0x181 [ 284.853665][ T7498] panic+0x210/0x640 [ 284.857546][ T7498] ? vprintk_func+0x8d/0x140 [ 284.862125][ T7498] kcsan_report.cold+0xc/0xd [ 284.866704][ T7498] kcsan_setup_watchpoint+0x3fe/0x460 [ 284.872058][ T7498] __tsan_unaligned_write4+0xc4/0x100 [ 284.877426][ T7498] put_pipe_info+0x4d/0xb0 [ 284.881837][ T7498] pipe_release+0x152/0x1b0 [ 284.886324][ T7498] __fput+0x1e1/0x520 [ 284.890298][ T7498] ? put_pipe_info+0xb0/0xb0 [ 284.894887][ T7498] ____fput+0x1f/0x30 [ 284.898868][ T7498] task_work_run+0xf6/0x130 [ 284.903360][ T7498] exit_to_usermode_loop+0x2b4/0x2c0 [ 284.908650][ T7498] do_syscall_64+0x353/0x370 [ 284.913254][ T7498] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 284.919140][ T7498] RIP: 0033:0x401900 [ 284.923029][ T7498] Code: Bad RIP value. [ 284.927090][ T7498] RSP: 002b:00007ffe5ada58e0 EFLAGS: 00000200 ORIG_RAX: 000000000000003b [ 284.935537][ T7498] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 284.943497][ T7498] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 284.951594][ T7498] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 284.959551][ T7498] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 284.967504][ T7498] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 284.976759][ T7498] Kernel Offset: disabled [ 284.981087][ T7498] Rebooting in 86400 seconds..