[ 51.697499][ T26] audit: type=1800 audit(1568503444.815:21): pid=8965 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="bootlogs" dev="sda1" ino=2419 res=0
[ 51.717152][ T26] audit: type=1800 audit(1568503444.815:22): pid=8965 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="motd" dev="sda1" ino=2447 res=0
[ 51.741721][ T26] audit: type=1800 audit(1568503444.815:23): pid=8965 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="rsyslog" dev="sda1" ino=2442 res=0
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
Debian GNU/Linux 7 syzkaller ttyS0
Warning: Permanently added '10.128.0.212' (ECDSA) to the list of known hosts.
syzkaller login: [ 62.744612][ T9115] IPVS: ftp: loaded support on port[0] = 21
[ 62.778932][ T9115] chnl_net:caif_netlink_parms(): no params data found
[ 62.797814][ T9115] bridge0: port 1(bridge_slave_0) entered blocking state
[ 62.805575][ T9115] bridge0: port 1(bridge_slave_0) entered disabled state
[ 62.813059][ T9115] device bridge_slave_0 entered promiscuous mode
[ 62.820089][ T9115] bridge0: port 2(bridge_slave_1) entered blocking state
[ 62.827210][ T9115] bridge0: port 2(bridge_slave_1) entered disabled state
[ 62.834644][ T9115] device bridge_slave_1 entered promiscuous mode
[ 62.846752][ T9115] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 62.856970][ T9115] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 62.870878][ T9115] team0: Port device team_slave_0 added
[ 62.877536][ T9115] team0: Port device team_slave_1 added
[ 62.933350][ T9115] device hsr_slave_0 entered promiscuous mode
[ 62.972048][ T9115] device hsr_slave_1 entered promiscuous mode
[ 63.045843][ T9115] bridge0: port 2(bridge_slave_1) entered blocking state
[ 63.053069][ T9115] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 63.060376][ T9115] bridge0: port 1(bridge_slave_0) entered blocking state
[ 63.067446][ T9115] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 63.088649][ T9115] 8021q: adding VLAN 0 to HW filter on device bond0
[ 63.098102][ T3635] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 63.118068][ T3635] bridge0: port 1(bridge_slave_0) entered disabled state
[ 63.125622][ T3635] bridge0: port 2(bridge_slave_1) entered disabled state
[ 63.133697][ T3635] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 63.143366][ T9115] 8021q: adding VLAN 0 to HW filter on device team0
[ 63.162553][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 63.170878][ T12] bridge0: port 1(bridge_slave_0) entered blocking state
[ 63.177945][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 63.194589][ T9115] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[ 63.205221][ T9115] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 63.216651][ T3635] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 63.225298][ T3635] bridge0: port 2(bridge_slave_1) entered blocking state
[ 63.233806][ T3635] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 63.241533][ T3635] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 63.250560][ T3635] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 63.258774][ T3635] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 63.266851][ T3635] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 63.274973][ T3635] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 63.282468][ T3635] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
executing program
[ 63.296387][ T9115] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 168.311654][ C0] rcu: INFO: rcu_preempt self-detected stall on CPU
[ 168.319425][ C0] rcu: 0-...!: (10499 ticks this GP) idle=356/1/0x4000000000000002 softirq=8613/8613 fqs=0
[ 168.329559][ C0] (t=10501 jiffies g=6449 q=161)
[ 168.334571][ C0] rcu: rcu_preempt kthread starved for 10502 jiffies! g6449 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1
[ 168.345825][ C0] rcu: RCU grace-period kthread stack dump:
[ 168.351696][ C0] rcu_preempt I28896 10 2 0x80004000
[ 168.358013][ C0] Call Trace:
[ 168.361293][ C0] __schedule+0x877/0xc50
[ 168.365611][ C0] schedule+0x131/0x1e0
[ 168.369751][ C0] schedule_timeout+0x14f/0x240
[ 168.374586][ C0] ? run_local_timers+0x120/0x120
[ 168.379599][ C0] rcu_gp_kthread+0xef8/0x1790
[ 168.384351][ C0] kthread+0x332/0x350
[ 168.388402][ C0] ? rcu_report_qs_rsp+0x150/0x150
[ 168.393495][ C0] ? kthread_blkcg+0xe0/0xe0
[ 168.398068][ C0] ret_from_fork+0x24/0x30
[ 168.402499][ C0] NMI backtrace for cpu 0
[ 168.406820][ C0] CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.3.0-rc8+ #0
[ 168.414165][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 168.424217][ C0] Workqueue: ipv6_addrconf addrconf_dad_work
[ 168.430185][ C0] Call Trace:
[ 168.433455][ C0]
[ 168.436290][ C0] dump_stack+0x1d8/0x2f8
[ 168.440621][ C0] nmi_cpu_backtrace+0xaf/0x1a0
[ 168.445453][ C0] ? nmi_trigger_cpumask_backtrace+0x16d/0x290
[ 168.451590][ C0] ? arch_trigger_cpumask_backtrace+0x20/0x20
[ 168.457638][ C0] nmi_trigger_cpumask_backtrace+0x174/0x290
[ 168.463603][ C0] arch_trigger_cpumask_backtrace+0x10/0x20
[ 168.469483][ C0] rcu_dump_cpu_stacks+0x15a/0x220
[ 168.474592][ C0] rcu_sched_clock_irq+0xb95/0x16d0
[ 168.479772][ C0] ? trace_hardirqs_off+0x74/0x80
[ 168.484781][ C0] update_process_times+0x134/0x190
[ 168.489962][ C0] tick_sched_timer+0x263/0x420
[ 168.494807][ C0] ? tick_setup_sched_timer+0x2c0/0x2c0
[ 168.500336][ C0] __hrtimer_run_queues+0x403/0x850
[ 168.506481][ C0] hrtimer_interrupt+0x38c/0xda0
[ 168.511415][ C0] smp_apic_timer_interrupt+0x109/0x280
[ 168.516954][ C0] apic_timer_interrupt+0xf/0x20
[ 168.522020][ C0] RIP: 0010:native_queued_spin_lock_slowpath+0x92/0x9e0
[ 168.528937][ C0] Code: 84 c0 74 54 44 89 f9 80 e1 07 80 c1 03 38 c1 7c 47 4c 89 ff e8 4f f4 51 00 eb 3d 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 f3 90 <4c> 89 ff be 04 00 00 00 e8 61 c5 51 00 42 0f b6 04 2b 84 c0 74 18
[ 168.548783][ C0] RSP: 0018:ffff8880aea09088 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13
[ 168.557174][ C0] RAX: 0000000000000000 RBX: 1ffff1101421c425 RCX: ffffffff815a940f
[ 168.565257][ C0] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8880a10e2128
[ 168.573210][ C0] RBP: ffff8880aea09100 R08: dffffc0000000000 R09: ffffed101421c426
[ 168.581183][ C0] R10: ffffed101421c426 R11: 0000000000000000 R12: ffff8880a10e2130
[ 168.589137][ C0] R13: dffffc0000000000 R14: 0000000000000001 R15: ffff8880a10e2128
[ 168.597098][ C0] ? apic_timer_interrupt+0xa/0x20
[ 168.602197][ C0] ? native_queued_spin_lock_slowpath+0x9f/0x9e0
[ 168.608595][ C0] ? native_queued_spin_lock_slowpath+0x9f/0x9e0
[ 168.614927][ C0] ? trace_lock_acquire+0x159/0x1d0
[ 168.620198][ C0] do_raw_spin_lock+0x1d6/0x2d0
[ 168.625047][ C0] _raw_spin_lock+0x39/0x40
[ 168.629547][ C0] __dev_queue_xmit+0xde0/0x3020
[ 168.634466][ C0] ? _raw_spin_unlock_irqrestore+0xbc/0xe0
[ 168.640267][ C0] dev_queue_xmit+0x17/0x20
[ 168.644753][ C0] br_dev_queue_push_xmit+0x551/0x650
[ 168.650108][ C0] br_nf_dev_queue_xmit+0x312/0x1590
[ 168.655381][ C0] br_nf_post_routing+0xa5f/0xea0
[ 168.660392][ C0] ? br_nf_forward_arp+0xab0/0xab0
[ 168.665487][ C0] nf_hook_slow+0xc8/0x210
[ 168.669890][ C0] nf_hook+0x23a/0x310
[ 168.673943][ C0] ? fdb_add_hw_addr+0x220/0x220
[ 168.678866][ C0] br_forward_finish+0x7a/0xc0
[ 168.683624][ C0] ? fdb_add_hw_addr+0x220/0x220
[ 168.688546][ C0] br_nf_forward_finish+0x8f4/0xc80
[ 168.693723][ C0] ? rcu_lock_release+0x26/0x30
[ 168.698558][ C0] ? br_dev_queue_push_xmit+0x650/0x650
[ 168.704086][ C0] br_nf_forward_ip+0xed4/0x13f0
[ 168.709007][ C0] ? br_nf_pre_routing+0x1380/0x1380
[ 168.714272][ C0] nf_hook_slow+0xc8/0x210
[ 168.718675][ C0] nf_hook+0x23a/0x310
[ 168.722728][ C0] ? br_dev_queue_push_xmit+0x650/0x650
[ 168.728253][ C0] __br_forward+0x39e/0x720
[ 168.732738][ C0] ? br_dev_queue_push_xmit+0x650/0x650
[ 168.738265][ C0] br_flood+0x7af/0x840
[ 168.742410][ C0] br_handle_frame_finish+0xf37/0x1370
[ 168.747852][ C0] ? nf_hook_slow+0x17d/0x210
[ 168.752514][ C0] br_nf_hook_thresh+0x306/0x390
[ 168.757435][ C0] ? brport_get_ownership+0x80/0x80
[ 168.762615][ C0] br_nf_pre_routing_finish_ipv6+0x8ac/0xb30
[ 168.768575][ C0] ? brport_get_ownership+0x80/0x80
[ 168.773769][ C0] br_nf_pre_routing_ipv6+0x2ab/0x350
[ 168.779129][ C0] br_nf_pre_routing+0x6ca/0x1380
[ 168.784138][ C0] ? brnf_device_event+0x1f0/0x1f0
[ 168.789229][ C0] br_handle_frame+0x7d9/0xeb0
[ 168.793979][ C0] ? brport_get_ownership+0x80/0x80
[ 168.799164][ C0] ? br_pass_frame_up+0x4c0/0x4c0
[ 168.804177][ C0] __netif_receive_skb_core+0x1a7d/0x3470
[ 168.809895][ C0] __netif_receive_skb+0xc5/0x370
[ 168.814903][ C0] process_backlog+0x4d8/0x910
[ 168.819656][ C0] net_rx_action+0x5ef/0xfd0
[ 168.824236][ C0] __do_softirq+0x333/0x7c4
[ 168.828721][ C0] ? do_softirq_own_stack+0x2a/0x40
[ 168.833920][ C0] do_softirq_own_stack+0x2a/0x40
[ 168.838923][ C0]
[ 168.841845][ C0] do_softirq+0xfd/0x190
[ 168.846068][ C0] ? local_bh_enable+0x9/0x30
[ 168.850725][ C0] __local_bh_enable_ip+0x194/0x240
[ 168.855904][ C0] local_bh_enable+0x1f/0x30
[ 168.860499][ C0] ip6_finish_output2+0x109f/0x13d0
[ 168.865769][ C0] __ip6_finish_output+0x693/0x910
[ 168.870861][ C0] ip6_finish_output+0x52/0x1e0
[ 168.875690][ C0] ? ip6_output+0x25a/0x390
[ 168.880174][ C0] ip6_output+0x26f/0x390
[ 168.884492][ C0] ndisc_send_skb+0xa35/0xe40
[ 168.889161][ C0] ndisc_send_ns+0x5ce/0x7b0
[ 168.893737][ C0] addrconf_dad_work+0xe40/0x1c20
[ 168.898750][ C0] process_one_work+0x7ef/0x10e0
[ 168.903688][ C0] worker_thread+0xc01/0x1630
[ 168.908355][ C0] kthread+0x332/0x350
[ 168.912404][ C0] ? rcu_lock_release+0x30/0x30
[ 168.917235][ C0] ? kthread_blkcg+0xe0/0xe0
[ 168.921809][ C0] ret_from_fork+0x24/0x30
[ 168.926218][ C0] Sending NMI from CPU 0 to CPUs 1:
[ 168.931834][ C1] NMI backtrace for cpu 1
[ 168.931837][ C1] CPU: 1 PID: 9115 Comm: syz-executor160 Not tainted 5.3.0-rc8+ #0
[ 168.931840][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 168.931842][ C1] RIP: 0010:__list_del_entry_valid+0x28/0x100
[ 168.931848][ C1] Code: 1f 00 55 48 89 e5 41 57 41 56 41 54 53 49 89 fe 49 bc 00 00 00 00 00 fc ff df 48 83 c7 08 48 89 f8 48 c1 e8 03 42 80 3c 20 00 <74> 05 e8 41 c3 58 fe 4d 8b 7e 08 4c 89 f0 48 c1 e8 03 42 80 3c 20
[ 168.931850][ C1] RSP: 0018:ffff8880aeb09678 EFLAGS: 00000246
[ 168.931854][ C1] RAX: 1ffff1101421c468 RBX: ffff8880a10e2338 RCX: ffff8880a2a10100
[ 168.931857][ C1] RDX: 0000000000000502 RSI: 0000000000000000 RDI: ffff8880a10e2340
[ 168.931859][ C1] RBP: ffff8880aeb09698 R08: ffffffff860c5d6a R09: 0000000000000000
[ 168.931862][ C1] R10: fffffbfff117be8d R11: 0000000000000000 R12: dffffc0000000000
[ 168.931864][ C1] R13: ffff8880a10e2040 R14: ffff8880a10e2338 R15: 0000000000000000
[ 168.931867][ C1] FS: 0000555557118880(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000
[ 168.931869][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 168.931872][ C1] CR2: 00000000004c7408 CR3: 000000000886d000 CR4: 00000000001406e0
[ 168.931874][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 168.931877][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 168.931878][ C1] Call Trace:
[ 168.931879][ C1]
[ 168.931881][ C1] hhf_dequeue+0x487/0xaa0
[ 168.931883][ C1] ? hhf_enqueue+0x19dc/0x2110
[ 168.931885][ C1] __qdisc_run+0x217/0x1b30
[ 168.931886][ C1] ? dev_queue_xmit+0x17/0x20
[ 168.931888][ C1] __dev_queue_xmit+0x1161/0x3020
[ 168.931890][ C1] dev_queue_xmit+0x17/0x20
[ 168.931892][ C1] neigh_resolve_output+0x60c/0x6b0
[ 168.931894][ C1] ip6_finish_output2+0x102c/0x13d0
[ 168.931896][ C1] __ip6_finish_output+0x693/0x910
[ 168.931897][ C1] ip6_finish_output+0x52/0x1e0
[ 168.931899][ C1] ? ip6_output+0x25a/0x390
[ 168.931901][ C1] ip6_output+0x26f/0x390
[ 168.931903][ C1] mld_sendpack+0x770/0xb90
[ 168.931905][ C1] mld_ifc_timer_expire+0x820/0xb70
[ 168.931907][ C1] ? mld_gq_timer_expire+0x80/0x80
[ 168.931908][ C1] call_timer_fn+0x95/0x170
[ 168.931910][ C1] ? mld_gq_timer_expire+0x80/0x80
[ 168.931912][ C1] __run_timers+0x79e/0x970
[ 168.931914][ C1] ? check_preemption_disabled+0x47/0x2a0
[ 168.931916][ C1] ? check_preemption_disabled+0x47/0x2a0
[ 168.931918][ C1] run_timer_softirq+0x4a/0x90
[ 168.931919][ C1] __do_softirq+0x333/0x7c4
[ 168.931921][ C1] ? irq_exit+0x227/0x230
[ 168.931923][ C1] irq_exit+0x227/0x230
[ 168.931925][ C1] smp_apic_timer_interrupt+0x113/0x280
[ 168.931926][ C1] apic_timer_interrupt+0xf/0x20
[ 168.931928][ C1]
[ 168.931930][ C1] RIP: 0010:lock_release+0x4c7/0x780
[ 168.931935][ C1] Code: 48 c1 e8 03 80 3c 10 00 74 0c 48 c7 c7 80 87 8a 88 e8 5d 52 53 00 48 83 3d 75 51 31 07 00 0f 84 8c 02 00 00 48 8b 7d 88 57 9d <0f> 1f 44 00 00 65 48 8b 04 25 28 00 00 00 48 3b 45 d0 0f 85 70 02
[ 168.931937][ C1] RSP: 0018:ffff888099b9fb50 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
[ 168.931941][ C1] RAX: 1ffffffff11150f0 RBX: dffffc0000000000 RCX: ffffffff815939e7
[ 168.931944][ C1] RDX: dffffc0000000000 RSI: 0000000000000008 RDI: 0000000000000286
[ 168.931946][ C1] RBP: ffff888099b9fbd0 R08: dffffc0000000000 R09: fffffbfff117be8d
[ 168.931949][ C1] R10: fffffbfff117be8d R11: 0000000000000000 R12: ffff8880a2a10100
[ 168.931951][ C1] R13: ffffffff81bdf659 R14: ffff8880a2a1098c R15: ffffffff888d63c0
[ 168.931953][ C1] ? rcu_lock_release+0x9/0x30
[ 168.931955][ C1] ? trace_lock_release+0x117/0x1a0
[ 168.931957][ C1] ? namespace_unlock+0x379/0x410
[ 168.931958][ C1] ? cpumask_next+0x38/0x60
[ 168.931960][ C1] rcu_lock_release+0x26/0x30
[ 168.931962][ C1] mntput_no_expire+0x464/0xca0
[ 168.931964][ C1] ? rcu_exp_sel_wait_wake+0x1810/0x1810
[ 168.931965][ C1] ? namespace_unlock+0x379/0x410
[ 168.931967][ C1] namespace_unlock+0x379/0x410
[ 168.931969][ C1] ? free_nsproxy+0x4a/0x1b0
[ 168.931971][ C1] put_mnt_ns+0xe4/0x200
[ 168.931972][ C1] free_nsproxy+0x4a/0x1b0
[ 168.931974][ C1] exit_task_namespaces+0xc6/0xe0
[ 168.931976][ C1] do_exit+0x5e3/0x21a0
[ 168.931977][ C1] do_group_exit+0x15c/0x2b0
[ 168.931985][ C1] __do_sys_exit_group+0x17/0x20
[ 168.931987][ C1] __se_sys_exit_group+0x14/0x20
[ 168.931989][ C1] __x64_sys_exit_group+0x3b/0x40
[ 168.931991][ C1] do_syscall_64+0xfe/0x140
[ 168.931993][ C1] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 168.931994][ C1] RIP: 0033:0x440838
[ 168.931996][ C1] Code: Bad RIP value.
[ 168.931998][ C1] RSP: 002b:00007ffc197804b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 168.932002][ C1] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000440838
[ 168.932004][ C1] RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001
[ 168.932007][ C1] RBP: 00000000004c73d0 R08: 00000000000000e7 R09: ffffffffffffffd0
[ 168.932009][ C1] R10: 0000000001bbbbbb R11: 0000000000000246 R12: 0000000000000001
[ 168.932012][ C1] R13: 00000000006da5e0 R14: 0000000000000000 R15: 0000000000000000