INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.22' (ECDSA) to the list of known hosts. 2018/04/13 15:57:45 fuzzer started 2018/04/13 15:57:45 dialing manager at 10.128.0.26:45267 syzkaller login: [ 39.498735] can: request_module (can-proto-0) failed. [ 39.508484] can: request_module (can-proto-0) failed. 2018/04/13 15:57:55 kcov=true, comps=true 2018/04/13 15:58:03 executing program 0: 2018/04/13 15:58:03 executing program 1: 2018/04/13 15:58:03 executing program 7: 2018/04/13 15:58:03 executing program 2: 2018/04/13 15:58:03 executing program 3: syz_emit_ethernet(0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="0180c2100000ffffffffffff86dd60d8652b00143c00fe8000000000000000000000000000aa179fe794ecffcf0d00000000000000aa4e204e20", @ANYRES32=0x41424344, @ANYBLOB="5000000090780000"], &(0x7f00000002c0)) 2018/04/13 15:58:03 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000f18000)={0x0, 0x0, &(0x7f000076dff0)=[{&(0x7f0000c21f67)="240000000004f50000f90000000008002020faff0900060000e800603300000001ab001f", 0x24}], 0x1}, 0x0) 2018/04/13 15:58:03 executing program 5: 2018/04/13 15:58:03 executing program 6: [ 48.516207] IPVS: ftp: loaded support on port[0] = 21 [ 48.542263] IPVS: ftp: loaded support on port[0] = 21 [ 48.543461] IPVS: ftp: loaded support on port[0] = 21 [ 48.589835] IPVS: ftp: loaded support on port[0] = 21 [ 48.598877] IPVS: ftp: loaded support on port[0] = 21 [ 48.608077] IPVS: ftp: loaded support on port[0] = 21 [ 48.631821] IPVS: ftp: loaded support on port[0] = 21 [ 48.656649] IPVS: ftp: loaded support on port[0] = 21 [ 50.800216] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.806797] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.834946] device bridge_slave_0 entered promiscuous mode [ 50.847692] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.854171] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.865326] device bridge_slave_0 entered promiscuous mode [ 50.890747] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.897407] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.911235] device bridge_slave_0 entered promiscuous mode [ 50.930693] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.937136] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.945834] device bridge_slave_1 entered promiscuous mode [ 50.954686] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.961361] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.971298] device bridge_slave_0 entered promiscuous mode [ 50.982855] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.989322] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.998525] device bridge_slave_0 entered promiscuous mode [ 51.006237] ================================================================== [ 51.013777] BUG: KASAN: alloca-out-of-bounds in tick_sched_handle+0x16c/0x180 [ 51.021078] Read of size 8 at addr ffff88018a85f1a0 by task ip/4870 [ 51.027470] [ 51.029088] CPU: 0 PID: 4870 Comm: ip Not tainted 4.16.0+ #2 [ 51.034864] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 51.044200] Call Trace: [ 51.046774] [ 51.048921] dump_stack+0x1b9/0x294 [ 51.052534] ? dump_stack_print_info.cold.2+0x52/0x52 [ 51.057730] ? printk+0x9e/0xba [ 51.060999] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 51.065756] ? kasan_check_write+0x14/0x20 [ 51.069987] print_address_description+0x6c/0x20b [ 51.074826] ? tick_sched_handle+0x16c/0x180 [ 51.079221] kasan_report.cold.7+0xac/0x2f5 [ 51.083529] __asan_report_load8_noabort+0x14/0x20 [ 51.088984] tick_sched_handle+0x16c/0x180 [ 51.093208] tick_sched_timer+0x45/0x130 [ 51.097256] __hrtimer_run_queues+0x3e3/0x10a0 [ 51.101822] ? tick_sched_do_timer+0x1a0/0x1a0 [ 51.106387] ? hrtimer_start_range_ns+0xd10/0xd10 [ 51.111239] ? pvclock_read_flags+0x160/0x160 [ 51.115730] ? __local_bh_enable+0xef/0x130 [ 51.120069] ? kvm_clock_read+0x25/0x30 [ 51.124045] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 51.129065] ? ktime_get_update_offsets_now+0x3a6/0x570 [ 51.134425] ? do_timer+0x50/0x50 [ 51.137873] ? rcu_nmi_exit+0xd7/0x2b0 [ 51.141757] ? do_raw_spin_lock+0xc1/0x200 [ 51.145981] hrtimer_interrupt+0x286/0x650 [ 51.150209] smp_apic_timer_interrupt+0x15d/0x710 [ 51.155052] ? smp_call_function_single_interrupt+0x650/0x650 [ 51.160919] ? _raw_spin_lock+0x32/0x40 [ 51.164893] ? _raw_spin_unlock+0x22/0x30 [ 51.169035] ? handle_edge_irq+0x330/0x870 [ 51.173268] ? task_prio+0x50/0x50 [ 51.176798] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 51.181628] apic_timer_interrupt+0xf/0x20 [ 51.185943] [ 51.188176] RIP: 0010:rtnl_newlink+0x1085/0x1a40 [ 51.192909] RSP: 0018:ffff88018a85f1c8 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13 [ 51.200606] RAX: ffff8801d4c12040 RBX: 0000000000000000 RCX: 0000000000000000 [ 51.208207] RDX: 0000000000000000 RSI: ffffffff85c67fee RDI: ffffed003150be18 [ 51.215472] RBP: ffff88018a85f5f8 R08: ffff8801d4c12040 R09: 0000000000000001 [ 51.222736] R10: fffffbfff1268bbc R11: ffffffff89345de7 R12: ffff88018a85f5d0 [ 51.230012] R13: 0000000000000005 R14: 0000000000000000 R15: 0000000000000000 [ 51.237296] ? rtnl_newlink+0x107e/0x1a40 [ 51.241442] ? rtnl_newlink+0x4e7/0x1a40 [ 51.245507] ? rtnl_link_unregister+0x370/0x370 [ 51.250174] ? kasan_check_read+0x11/0x20 [ 51.254315] ? rcu_is_watching+0x85/0x140 [ 51.258461] ? __lock_acquire+0x7f5/0x5130 [ 51.262684] ? graph_lock+0x170/0x170 [ 51.266503] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 51.272041] ? rtnl_get_link+0x164/0x350 [ 51.276094] ? rtnl_dump_all+0x5e0/0x5e0 [ 51.280136] ? rcu_is_watching+0x85/0x140 [ 51.284265] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 51.289448] ? __netlink_ns_capable+0x100/0x130 [ 51.294102] ? rtnl_link_unregister+0x370/0x370 [ 51.298751] rtnetlink_rcv_msg+0x466/0xc10 [ 51.302968] ? rtnetlink_put_metrics+0x690/0x690 [ 51.308243] netlink_rcv_skb+0x172/0x440 [ 51.312285] ? rtnetlink_put_metrics+0x690/0x690 [ 51.317035] ? netlink_ack+0xbc0/0xbc0 [ 51.320914] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 51.326086] ? netlink_skb_destructor+0x210/0x210 [ 51.330909] rtnetlink_rcv+0x1c/0x20 [ 51.334615] netlink_unicast+0x58b/0x740 [ 51.338746] ? netlink_attachskb+0x970/0x970 [ 51.343131] ? import_iovec+0x24b/0x420 [ 51.347086] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 51.352085] ? security_netlink_send+0x88/0xb0 [ 51.356655] netlink_sendmsg+0x9f0/0xfa0 [ 51.360710] ? netlink_unicast+0x740/0x740 [ 51.364939] ? security_socket_sendmsg+0x94/0xc0 [ 51.369675] ? netlink_unicast+0x740/0x740 [ 51.373896] sock_sendmsg+0xd5/0x120 [ 51.377599] ___sys_sendmsg+0x805/0x940 [ 51.381561] ? copy_msghdr_from_user+0x560/0x560 [ 51.386315] ? vm_insert_mixed_mkwrite+0x40/0x40 [ 51.391064] ? graph_lock+0x170/0x170 [ 51.394858] ? graph_lock+0x170/0x170 [ 51.398643] ? find_held_lock+0x36/0x1c0 [ 51.402696] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 51.408227] ? __fget_light+0x2ef/0x430 [ 51.412193] ? fget_raw+0x20/0x20 [ 51.415658] ? find_held_lock+0x36/0x1c0 [ 51.419718] ? lock_downgrade+0x8e0/0x8e0 [ 51.423858] ? handle_mm_fault+0x8c0/0xc70 [ 51.428093] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 51.433624] ? sockfd_lookup_light+0xc5/0x160 [ 51.438111] __sys_sendmsg+0x115/0x270 [ 51.441985] ? SyS_shutdown+0x30/0x30 [ 51.445781] ? __do_page_fault+0x441/0xe40 [ 51.450036] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 51.454891] SyS_sendmsg+0x29/0x30 [ 51.458418] ? __sys_sendmsg+0x270/0x270 [ 51.462464] do_syscall_64+0x29e/0x9d0 [ 51.466332] ? vmalloc_sync_all+0x30/0x30 [ 51.470550] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 51.475296] ? syscall_return_slowpath+0x5c0/0x5c0 [ 51.480215] ? syscall_return_slowpath+0x30f/0x5c0 [ 51.485226] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 51.490766] ? retint_user+0x18/0x18 [ 51.494467] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 51.499299] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 51.504475] RIP: 0033:0x7f786cd79320 [ 51.508166] RSP: 002b:00007ffc43839d48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 51.515860] RAX: ffffffffffffffda RBX: 00007ffc4383de40 RCX: 00007f786cd79320 [ 51.523119] RDX: 0000000000000000 RSI: 00007ffc43839d80 RDI: 0000000000000013 [ 51.530381] RBP: 00007ffc43839d80 R08: 0000000000000000 R09: 0000000000000000 [ 51.537730] R10: 0000000000000000 R11: 0000000000000246 R12: 000000005ad0d38f [ 51.544994] R13: 0000000000000000 R14: 00000000006395c0 R15: 00007ffc4383e618 [ 51.552262] [ 51.553872] The buggy address belongs to the page: [ 51.558784] page:ffffea00062a17c0 count:0 mapcount:0 mapping:0000000000000000 index:0x0 [ 51.566905] flags: 0x2fffc0000000000() [ 51.570796] raw: 02fffc0000000000 0000000000000000 0000000000000000 00000000ffffffff [ 51.578670] raw: dead000000000100 dead000000000200 0000000000000000 0000000000000000 [ 51.586539] page dumped because: kasan: bad access detected [ 51.592226] [ 51.593842] Memory state around the buggy address: [ 51.598752] ffff88018a85f080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 51.606105] ffff88018a85f100: 00 00 00 00 00 00 00 00 00 00 00 00 ca ca ca ca [ 51.613457] >ffff88018a85f180: 00 cb cb cb cb cb cb cb 00 00 00 00 00 00 00 00 [ 51.620798] ^ [ 51.625187] ffff88018a85f200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 [ 51.632528] ffff88018a85f280: f1 f1 00 f2 f2 f2 f2 f2 f2 f2 00 00 f2 f2 f2 f2 [ 51.639870] ================================================================== [ 51.647363] Disabling lock debugging due to kernel taint [ 51.652795] Kernel panic - not syncing: panic_on_warn set ... [ 51.652795] [ 51.660141] CPU: 0 PID: 4870 Comm: ip Tainted: G B 4.16.0+ #2 [ 51.667425] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 51.676761] Call Trace: [ 51.679322] [ 51.681460] dump_stack+0x1b9/0x294 [ 51.685076] ? dump_stack_print_info.cold.2+0x52/0x52 [ 51.690253] ? lock_downgrade+0x8e0/0x8e0 [ 51.694381] ? vprintk_default+0x28/0x30 [ 51.698429] ? tick_sched_handle+0x150/0x180 [ 51.702821] panic+0x22f/0x4de [ 51.705995] ? add_taint.cold.5+0x16/0x16 [ 51.710148] ? add_taint.cold.5+0x5/0x16 [ 51.714193] ? do_raw_spin_unlock+0x9e/0x2e0 [ 51.718583] ? tick_sched_handle+0x16c/0x180 [ 51.722974] kasan_end_report+0x47/0x4f [ 51.726930] kasan_report.cold.7+0xc9/0x2f5 [ 51.731235] __asan_report_load8_noabort+0x14/0x20 [ 51.736145] tick_sched_handle+0x16c/0x180 [ 51.740368] tick_sched_timer+0x45/0x130 [ 51.744412] __hrtimer_run_queues+0x3e3/0x10a0 [ 51.748979] ? tick_sched_do_timer+0x1a0/0x1a0 [ 51.753554] ? hrtimer_start_range_ns+0xd10/0xd10 [ 51.758388] ? pvclock_read_flags+0x160/0x160 [ 51.762889] ? __local_bh_enable+0xef/0x130 [ 51.767204] ? kvm_clock_read+0x25/0x30 [ 51.771170] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 51.776180] ? ktime_get_update_offsets_now+0x3a6/0x570 [ 51.781617] ? do_timer+0x50/0x50 [ 51.785059] ? rcu_nmi_exit+0xd7/0x2b0 [ 51.788935] ? do_raw_spin_lock+0xc1/0x200 [ 51.793180] hrtimer_interrupt+0x286/0x650 [ 51.797413] smp_apic_timer_interrupt+0x15d/0x710 [ 51.802237] ? smp_call_function_single_interrupt+0x650/0x650 [ 51.808113] ? _raw_spin_lock+0x32/0x40 [ 51.812072] ? _raw_spin_unlock+0x22/0x30 [ 51.816204] ? handle_edge_irq+0x330/0x870 [ 51.820432] ? task_prio+0x50/0x50 [ 51.823957] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 51.828780] apic_timer_interrupt+0xf/0x20 [ 51.832998] [ 51.835223] RIP: 0010:rtnl_newlink+0x1085/0x1a40 [ 51.839960] RSP: 0018:ffff88018a85f1c8 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13 [ 51.847662] RAX: ffff8801d4c12040 RBX: 0000000000000000 RCX: 0000000000000000 [ 51.855005] RDX: 0000000000000000 RSI: ffffffff85c67fee RDI: ffffed003150be18 [ 51.862274] RBP: ffff88018a85f5f8 R08: ffff8801d4c12040 R09: 0000000000000001 [ 51.869524] R10: fffffbfff1268bbc R11: ffffffff89345de7 R12: ffff88018a85f5d0 [ 51.876782] R13: 0000000000000005 R14: 0000000000000000 R15: 0000000000000000 [ 51.884052] ? rtnl_newlink+0x107e/0x1a40 [ 51.888186] ? rtnl_newlink+0x4e7/0x1a40 [ 51.892240] ? rtnl_link_unregister+0x370/0x370 [ 51.896890] ? kasan_check_read+0x11/0x20 [ 51.901033] ? rcu_is_watching+0x85/0x140 [ 51.905183] ? __lock_acquire+0x7f5/0x5130 [ 51.909487] ? graph_lock+0x170/0x170 [ 51.913278] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 51.918795] ? rtnl_get_link+0x164/0x350 [ 51.922846] ? rtnl_dump_all+0x5e0/0x5e0 [ 51.926893] ? rcu_is_watching+0x85/0x140 [ 51.931298] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 51.936475] ? __netlink_ns_capable+0x100/0x130 [ 51.941157] ? rtnl_link_unregister+0x370/0x370 [ 51.945808] rtnetlink_rcv_msg+0x466/0xc10 [ 51.950038] ? rtnetlink_put_metrics+0x690/0x690 [ 51.954784] netlink_rcv_skb+0x172/0x440 [ 51.958832] ? rtnetlink_put_metrics+0x690/0x690 [ 51.963571] ? netlink_ack+0xbc0/0xbc0 [ 51.967441] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 51.972623] ? netlink_skb_destructor+0x210/0x210 [ 51.977450] rtnetlink_rcv+0x1c/0x20 [ 51.981151] netlink_unicast+0x58b/0x740 [ 51.985199] ? netlink_attachskb+0x970/0x970 [ 51.989588] ? import_iovec+0x24b/0x420 [ 51.993557] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 51.998572] ? security_netlink_send+0x88/0xb0 [ 52.003161] netlink_sendmsg+0x9f0/0xfa0 [ 52.007225] ? netlink_unicast+0x740/0x740 [ 52.011448] ? security_socket_sendmsg+0x94/0xc0 [ 52.016213] ? netlink_unicast+0x740/0x740 [ 52.020431] sock_sendmsg+0xd5/0x120 [ 52.024123] ___sys_sendmsg+0x805/0x940 [ 52.028087] ? copy_msghdr_from_user+0x560/0x560 [ 52.032832] ? vm_insert_mixed_mkwrite+0x40/0x40 [ 52.037567] ? graph_lock+0x170/0x170 [ 52.041344] ? graph_lock+0x170/0x170 [ 52.045127] ? find_held_lock+0x36/0x1c0 [ 52.049171] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 52.054688] ? __fget_light+0x2ef/0x430 [ 52.058645] ? fget_raw+0x20/0x20 [ 52.062081] ? find_held_lock+0x36/0x1c0 [ 52.066140] ? lock_downgrade+0x8e0/0x8e0 [ 52.070265] ? handle_mm_fault+0x8c0/0xc70 [ 52.074485] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 52.080012] ? sockfd_lookup_light+0xc5/0x160 [ 52.084512] __sys_sendmsg+0x115/0x270 [ 52.088397] ? SyS_shutdown+0x30/0x30 [ 52.092226] ? __do_page_fault+0x441/0xe40 [ 52.096459] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 52.101292] SyS_sendmsg+0x29/0x30 [ 52.104817] ? __sys_sendmsg+0x270/0x270 [ 52.108867] do_syscall_64+0x29e/0x9d0 [ 52.112740] ? vmalloc_sync_all+0x30/0x30 [ 52.116883] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 52.121631] ? syscall_return_slowpath+0x5c0/0x5c0 [ 52.126549] ? syscall_return_slowpath+0x30f/0x5c0 [ 52.131491] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 52.137018] ? retint_user+0x18/0x18 [ 52.140736] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 52.145562] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 52.150735] RIP: 0033:0x7f786cd79320 [ 52.154423] RSP: 002b:00007ffc43839d48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 52.162117] RAX: ffffffffffffffda RBX: 00007ffc4383de40 RCX: 00007f786cd79320 [ 52.169388] RDX: 0000000000000000 RSI: 00007ffc43839d80 RDI: 0000000000000013 [ 52.176646] RBP: 00007ffc43839d80 R08: 0000000000000000 R09: 0000000000000000 [ 52.183898] R10: 0000000000000000 R11: 0000000000000246 R12: 000000005ad0d38f [ 52.191151] R13: 0000000000000000 R14: 00000000006395c0 R15: 00007ffc4383e618 [ 52.198935] Dumping ftrace buffer: [ 52.202466] (ftrace buffer empty) [ 52.206173] Kernel Offset: disabled [ 52.209791] Rebooting in 86400 seconds..