[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 87.886595][ T27] audit: type=1800 audit(1577266866.803:25): pid=9094 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 87.909780][ T27] audit: type=1800 audit(1577266866.813:26): pid=9094 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 87.963000][ T27] audit: type=1800 audit(1577266866.813:27): pid=9094 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.68' (ECDSA) to the list of known hosts. 2019/12/25 09:41:17 parsed 1 programs 2019/12/25 09:41:19 executed programs: 0 syzkaller login: [ 101.199776][ T9273] IPVS: ftp: loaded support on port[0] = 21 [ 101.213429][ T9277] IPVS: ftp: loaded support on port[0] = 21 [ 101.222818][ T9275] IPVS: ftp: loaded support on port[0] = 21 [ 101.224882][ T9270] IPVS: ftp: loaded support on port[0] = 21 [ 101.237674][ T9279] IPVS: ftp: loaded support on port[0] = 21 [ 101.249476][ T9274] IPVS: ftp: loaded support on port[0] = 21 [ 101.550912][ T9275] chnl_net:caif_netlink_parms(): no params data found [ 101.604789][ T9274] chnl_net:caif_netlink_parms(): no params data found [ 101.613793][ T9279] chnl_net:caif_netlink_parms(): no params data found [ 101.694979][ T9275] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.703367][ T9275] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.713356][ T9275] device bridge_slave_0 entered promiscuous mode [ 101.726165][ T9275] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.742482][ T9275] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.750638][ T9275] device bridge_slave_1 entered promiscuous mode [ 101.813650][ T9274] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.822277][ T9274] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.832138][ T9274] device bridge_slave_0 entered promiscuous mode [ 101.845574][ T9274] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.864149][ T9274] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.873041][ T9274] device bridge_slave_1 entered promiscuous mode [ 101.905716][ T9275] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.915857][ T9273] chnl_net:caif_netlink_parms(): no params data found [ 101.934083][ T9277] chnl_net:caif_netlink_parms(): no params data found [ 101.957757][ T9275] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.982213][ T9270] chnl_net:caif_netlink_parms(): no params data found [ 102.025978][ T9274] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.066958][ T9279] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.075148][ T9279] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.085507][ T9279] device bridge_slave_0 entered promiscuous mode [ 102.117770][ T9275] team0: Port device team_slave_0 added [ 102.125636][ T9274] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.134991][ T9277] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.142461][ T9277] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.150534][ T9277] device bridge_slave_0 entered promiscuous mode [ 102.163567][ T9277] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.170809][ T9277] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.178480][ T9277] device bridge_slave_1 entered promiscuous mode [ 102.186334][ T9279] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.194057][ T9279] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.203324][ T9279] device bridge_slave_1 entered promiscuous mode [ 102.211858][ T9273] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.219319][ T9273] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.227159][ T9273] device bridge_slave_0 entered promiscuous mode [ 102.236075][ T9275] team0: Port device team_slave_1 added [ 102.286490][ T9273] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.293824][ T9273] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.302128][ T9273] device bridge_slave_1 entered promiscuous mode [ 102.323319][ T9270] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.335011][ T9270] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.342936][ T9270] device bridge_slave_0 entered promiscuous mode [ 102.354054][ T9274] team0: Port device team_slave_0 added [ 102.361657][ T9277] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.381358][ T9273] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.390664][ T9270] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.397735][ T9270] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.406410][ T9270] device bridge_slave_1 entered promiscuous mode [ 102.414542][ T9274] team0: Port device team_slave_1 added [ 102.430919][ T9279] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.445774][ T9277] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.457168][ T9273] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.493750][ T9279] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.529632][ T9277] team0: Port device team_slave_0 added [ 102.546406][ T9273] team0: Port device team_slave_0 added [ 102.582273][ T9275] device hsr_slave_0 entered promiscuous mode [ 102.629297][ T9275] device hsr_slave_1 entered promiscuous mode [ 102.680791][ T9270] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.702498][ T9277] team0: Port device team_slave_1 added [ 102.716606][ T9273] team0: Port device team_slave_1 added [ 102.741545][ T9270] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.766186][ T9279] team0: Port device team_slave_0 added [ 102.832799][ T9274] device hsr_slave_0 entered promiscuous mode [ 102.889200][ T9274] device hsr_slave_1 entered promiscuous mode [ 102.939016][ T9274] debugfs: Directory 'hsr0' with parent '/' already present! [ 102.955113][ T9279] team0: Port device team_slave_1 added [ 102.984525][ T9270] team0: Port device team_slave_0 added [ 102.998377][ T9270] team0: Port device team_slave_1 added [ 103.040949][ T9277] device hsr_slave_0 entered promiscuous mode [ 103.089281][ T9277] device hsr_slave_1 entered promiscuous mode [ 103.138903][ T9277] debugfs: Directory 'hsr0' with parent '/' already present! [ 103.243677][ T9273] device hsr_slave_0 entered promiscuous mode [ 103.289221][ T9273] device hsr_slave_1 entered promiscuous mode [ 103.358972][ T9273] debugfs: Directory 'hsr0' with parent '/' already present! [ 103.422235][ T9279] device hsr_slave_0 entered promiscuous mode [ 103.469244][ T9279] device hsr_slave_1 entered promiscuous mode [ 103.518977][ T9279] debugfs: Directory 'hsr0' with parent '/' already present! [ 103.531851][ T9275] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 103.618284][ T9275] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 103.711633][ T9270] device hsr_slave_0 entered promiscuous mode [ 103.749223][ T9270] device hsr_slave_1 entered promiscuous mode [ 103.788897][ T9270] debugfs: Directory 'hsr0' with parent '/' already present! [ 103.801412][ T9275] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 103.851604][ T9275] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 103.937905][ T9277] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 104.000770][ T9277] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 104.041321][ T9277] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 104.085104][ T9277] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 104.121011][ T9274] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 104.164038][ T9274] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 104.231796][ T9274] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 104.297698][ T9274] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 104.403796][ T9273] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 104.468040][ T9270] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 104.502172][ T9270] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 104.574807][ T9279] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 104.633028][ T9279] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 104.691126][ T9273] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 104.732441][ T9273] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 104.782435][ T9273] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 104.851219][ T9270] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 104.897336][ T9270] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 104.940802][ T9279] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 104.987046][ T9279] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 105.209968][ T9277] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.248212][ T9273] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.277860][ T9274] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.299798][ T9277] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.311307][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 105.321056][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 105.332777][ T9275] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.352845][ T9273] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.372225][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 105.381125][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 105.389186][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 105.397833][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 105.407176][ T3043] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.414802][ T3043] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.425450][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 105.433835][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 105.443889][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 105.464277][ T9270] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.474595][ T9274] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.495091][ T9279] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.502414][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 105.514342][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 105.524376][ T3051] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.531723][ T3051] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.539508][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 105.549331][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 105.558488][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 105.567227][ T3051] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.574369][ T3051] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.582532][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 105.590707][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 105.600883][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 105.628368][ T9270] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.645190][ T3050] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 105.655020][ T3050] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 105.664783][ T3050] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 105.674279][ T3050] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.681406][ T3050] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.690273][ T3050] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 105.698079][ T3050] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 105.706085][ T3050] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 105.714754][ T3050] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 105.723592][ T3050] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.730700][ T3050] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.741755][ T3050] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 105.751337][ T3050] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 105.781633][ T9275] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.796442][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 105.806653][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 105.815815][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 105.825079][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 105.834202][ T3043] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.841327][ T3043] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.849495][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 105.858038][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 105.866536][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 105.875413][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 105.884086][ T3043] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.891201][ T3043] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.899340][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 105.908662][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 105.917209][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 105.926498][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 105.935109][ T3043] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.942298][ T3043] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.950047][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 105.960472][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 105.968214][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 105.976113][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 105.985210][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 105.994139][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 106.003794][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 106.012814][ T3043] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.020030][ T3043] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.028353][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 106.036422][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 106.045280][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 106.080648][ T9279] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.088880][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 106.104244][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 106.114039][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 106.123636][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 106.132918][ T3044] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.140859][ T3044] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.150015][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 106.158679][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 106.168514][ T3044] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 106.183404][ T9277] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 106.216273][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 106.226242][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 106.236363][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 106.245664][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 106.254969][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 106.264978][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 106.273806][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 106.282434][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 106.293392][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 106.303066][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 106.312341][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 106.321931][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 106.331342][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 106.339916][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 106.348526][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 106.357324][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 106.366161][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 106.374781][ T3051] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.381977][ T3051] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.391294][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 106.399385][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 106.407303][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 106.415460][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 106.436814][ T9270] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 106.460225][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 106.475449][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 106.484802][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 106.493893][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 106.502493][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 106.511868][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 106.520478][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 106.529544][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 106.538120][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 106.546699][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 106.555737][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 106.575387][ T9275] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 106.587192][ T9275] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 106.624915][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 106.634060][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 106.648348][ T3043] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.656952][ T3043] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.664861][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 106.673486][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 106.682770][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 106.691642][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 106.700590][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 106.709584][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 106.720456][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 106.728966][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 106.740316][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 106.748250][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 106.757537][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 106.767472][ T9274] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 106.783612][ T9273] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 106.796219][ T9273] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 106.805275][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 106.814490][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 106.823346][ T3043] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 106.872179][ T9275] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.889703][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 106.898448][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 106.907665][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 106.919583][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 106.929266][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 106.937970][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 106.946682][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 106.955175][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 106.962852][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 106.970844][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 106.978288][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 106.986091][ T3051] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 106.999831][ T9277] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.012484][ T9270] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.035810][ T9273] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.057138][ T9279] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 107.080366][ T9279] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 107.115563][ T2722] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 107.130047][ T2722] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 107.138572][ T2722] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 107.147744][ T2722] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 107.159016][ T9274] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.241523][ T2722] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 107.299513][ T2722] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 107.322639][ T9279] 8021q: adding VLAN 0 to HW filter on device batadv0 2019/12/25 09:41:27 executed programs: 6 [ 110.533573][ T9459] ================================================================== [ 110.533619][ T9459] BUG: KASAN: use-after-free in fb_mode_is_equal+0x297/0x300 [ 110.533646][ T9459] Read of size 4 at addr ffff88809493499c by task syz-executor.1/9459 [ 110.533648][ T9459] [ 110.533658][ T9459] CPU: 0 PID: 9459 Comm: syz-executor.1 Not tainted 5.5.0-rc3-syzkaller #0 [ 110.533663][ T9459] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 110.533667][ T9459] Call Trace: [ 110.533683][ T9459] dump_stack+0x197/0x210 [ 110.533692][ T9459] ? fb_mode_is_equal+0x297/0x300 [ 110.533709][ T9459] print_address_description.constprop.0.cold+0xd4/0x30b [ 110.533718][ T9459] ? fb_mode_is_equal+0x297/0x300 [ 110.533726][ T9459] ? fb_mode_is_equal+0x297/0x300 [ 110.533737][ T9459] __kasan_report.cold+0x1b/0x41 [ 110.533746][ T9459] ? cache_grow_begin.cold+0x2d/0x2f [ 110.533754][ T9459] ? fb_mode_is_equal+0x297/0x300 [ 110.533763][ T9459] kasan_report+0x12/0x20 [ 110.533779][ T9459] __asan_report_load4_noabort+0x14/0x20 [ 110.533788][ T9459] fb_mode_is_equal+0x297/0x300 [ 110.533797][ T9459] fbcon_mode_deleted+0x12c/0x190 [ 110.533806][ T9459] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 110.533816][ T9459] fb_set_var+0xab9/0xdd0 [ 110.533825][ T9459] ? fb_blank+0x1a0/0x1a0 [ 110.533834][ T9459] ? lock_acquire+0x190/0x410 [ 110.533842][ T9459] ? do_fb_ioctl+0x348/0x7d0 [ 110.533854][ T9459] ? __mutex_lock+0x458/0x13c0 [ 110.533864][ T9459] ? down+0x50/0x90 [ 110.533884][ T9459] ? mutex_trylock+0x2d0/0x2d0 [ 110.533897][ T9459] ? mark_held_locks+0xf0/0xf0 [ 110.533912][ T9459] ? lock_downgrade+0x920/0x920 [ 110.533929][ T9459] ? _raw_spin_unlock_irqrestore+0x66/0xe0 [ 110.533942][ T9459] ? down+0x50/0x90 [ 110.533958][ T9459] ? lock_acquire+0x190/0x410 [ 110.534032][ T9459] ? do_fb_ioctl+0x335/0x7d0 [ 110.534055][ T9459] do_fb_ioctl+0x390/0x7d0 [ 110.534070][ T9459] ? fb_mmap+0x520/0x520 [ 110.534083][ T9459] ? lockdep_hardirqs_on+0x421/0x5e0 [ 110.534104][ T9459] ? tomoyo_path_number_perm+0x454/0x520 [ 110.534123][ T9459] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 110.534137][ T9459] ? tomoyo_path_number_perm+0x25e/0x520 [ 110.534155][ T9459] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 110.534202][ T9459] fb_compat_ioctl+0x305/0xc50 [ 110.534220][ T9459] ? fb_release+0x150/0x150 [ 110.534234][ T9459] ? ksys_dup3+0x3e0/0x3e0 [ 110.534248][ T9459] ? get_old_timespec32+0x200/0x200 [ 110.534273][ T9459] ? tomoyo_file_ioctl+0x23/0x30 [ 110.534290][ T9459] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 110.534305][ T9459] ? security_file_ioctl+0x8d/0xc0 [ 110.534327][ T9459] __ia32_compat_sys_ioctl+0x233/0x610 [ 110.534343][ T9459] ? fb_release+0x150/0x150 [ 110.534364][ T9459] do_fast_syscall_32+0x27b/0xe16 [ 110.534386][ T9459] entry_SYSENTER_compat+0x70/0x7f [ 110.534399][ T9459] RIP: 0023:0xf7fc0a39 [ 110.534415][ T9459] Code: 00 00 00 89 d3 5b 5e 5f 5d c3 b8 80 96 98 00 eb c4 8b 04 24 c3 8b 1c 24 c3 8b 34 24 c3 8b 3c 24 c3 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 110.534423][ T9459] RSP: 002b:00000000f7fbc0cc EFLAGS: 00000296 ORIG_RAX: 0000000000000036 [ 110.534437][ T9459] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 0000000000004601 [ 110.534445][ T9459] RDX: 0000000020000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 110.534453][ T9459] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 110.534461][ T9459] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 110.534469][ T9459] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 110.534493][ T9459] [ 110.534501][ T9459] Allocated by task 9299: [ 110.534513][ T9459] save_stack+0x23/0x90 [ 110.534525][ T9459] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 110.534534][ T9459] kasan_kmalloc+0x9/0x10 [ 110.534545][ T9459] kmem_cache_alloc_trace+0x158/0x790 [ 110.534557][ T9459] fb_add_videomode+0x2fb/0x610 [ 110.534569][ T9459] fb_set_var+0x5ef/0xdd0 [ 110.534581][ T9459] do_fb_ioctl+0x390/0x7d0 [ 110.534593][ T9459] fb_compat_ioctl+0x305/0xc50 [ 110.534605][ T9459] __ia32_compat_sys_ioctl+0x233/0x610 [ 110.534617][ T9459] do_fast_syscall_32+0x27b/0xe16 [ 110.534628][ T9459] entry_SYSENTER_compat+0x70/0x7f [ 110.534631][ T9459] [ 110.534637][ T9459] Freed by task 9403: [ 110.534646][ T9459] save_stack+0x23/0x90 [ 110.534657][ T9459] __kasan_slab_free+0x102/0x150 [ 110.534673][ T9459] kasan_slab_free+0xe/0x10 [ 110.534682][ T9459] kfree+0x10a/0x2c0 [ 110.534693][ T9459] fb_delete_videomode+0x3fa/0x540 [ 110.534704][ T9459] fb_set_var+0xac8/0xdd0 [ 110.534714][ T9459] do_fb_ioctl+0x390/0x7d0 [ 110.534725][ T9459] fb_compat_ioctl+0x305/0xc50 [ 110.534736][ T9459] __ia32_compat_sys_ioctl+0x233/0x610 [ 110.534748][ T9459] do_fast_syscall_32+0x27b/0xe16 [ 110.534759][ T9459] entry_SYSENTER_compat+0x70/0x7f [ 110.534762][ T9459] [ 110.534771][ T9459] The buggy address belongs to the object at ffff888094934980 [ 110.534771][ T9459] which belongs to the cache kmalloc-96 of size 96 [ 110.534782][ T9459] The buggy address is located 28 bytes inside of [ 110.534782][ T9459] 96-byte region [ffff888094934980, ffff8880949349e0) [ 110.534786][ T9459] The buggy address belongs to the page: [ 110.534797][ T9459] page:ffffea0002524d00 refcount:1 mapcount:0 mapping:ffff8880aa400540 index:0x0 [ 110.534813][ T9459] raw: 00fffe0000000200 ffffea00025b82c8 ffffea0002548288 ffff8880aa400540 [ 110.534827][ T9459] raw: 0000000000000000 ffff888094934000 0000000100000020 0000000000000000 [ 110.534832][ T9459] page dumped because: kasan: bad access detected [ 110.534836][ T9459] [ 110.534839][ T9459] Memory state around the buggy address: [ 110.534849][ T9459] ffff888094934880: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 110.534858][ T9459] ffff888094934900: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 110.534868][ T9459] >ffff888094934980: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 110.534872][ T9459] ^ [ 110.534881][ T9459] ffff888094934a00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 110.534891][ T9459] ffff888094934a80: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 110.534896][ T9459] ================================================================== [ 110.534901][ T9459] Disabling lock debugging due to kernel taint [ 110.534910][ T9459] Kernel panic - not syncing: panic_on_warn set ... [ 110.534924][ T9459] CPU: 0 PID: 9459 Comm: syz-executor.1 Tainted: G B 5.5.0-rc3-syzkaller #0 [ 110.534931][ T9459] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 110.534935][ T9459] Call Trace: [ 110.534948][ T9459] dump_stack+0x197/0x210 [ 110.534965][ T9459] panic+0x2e3/0x75c [ 110.534977][ T9459] ? add_taint.cold+0x16/0x16 [ 110.534993][ T9459] ? trace_hardirqs_on+0x67/0x240 [ 110.535005][ T9459] ? trace_hardirqs_on+0x5e/0x240 [ 110.535018][ T9459] ? fb_mode_is_equal+0x297/0x300 [ 110.535030][ T9459] end_report+0x47/0x4f [ 110.535043][ T9459] ? fb_mode_is_equal+0x297/0x300 [ 110.535054][ T9459] __kasan_report.cold+0xe/0x41 [ 110.535065][ T9459] ? cache_grow_begin.cold+0x2d/0x2f [ 110.535077][ T9459] ? fb_mode_is_equal+0x297/0x300 [ 110.535088][ T9459] kasan_report+0x12/0x20 [ 110.535101][ T9459] __asan_report_load4_noabort+0x14/0x20 [ 110.535112][ T9459] fb_mode_is_equal+0x297/0x300 [ 110.535125][ T9459] fbcon_mode_deleted+0x12c/0x190 [ 110.535137][ T9459] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 110.535150][ T9459] fb_set_var+0xab9/0xdd0 [ 110.535162][ T9459] ? fb_blank+0x1a0/0x1a0 [ 110.535172][ T9459] ? lock_acquire+0x190/0x410 [ 110.535183][ T9459] ? do_fb_ioctl+0x348/0x7d0 [ 110.535196][ T9459] ? __mutex_lock+0x458/0x13c0 [ 110.535207][ T9459] ? down+0x50/0x90 [ 110.535220][ T9459] ? mutex_trylock+0x2d0/0x2d0 [ 110.535230][ T9459] ? mark_held_locks+0xf0/0xf0 [ 110.535241][ T9459] ? lock_downgrade+0x920/0x920 [ 110.535253][ T9459] ? _raw_spin_unlock_irqrestore+0x66/0xe0 [ 110.535264][ T9459] ? down+0x50/0x90 [ 110.535276][ T9459] ? lock_acquire+0x190/0x410 [ 110.535286][ T9459] ? do_fb_ioctl+0x335/0x7d0 [ 110.535301][ T9459] do_fb_ioctl+0x390/0x7d0 [ 110.535313][ T9459] ? fb_mmap+0x520/0x520 [ 110.535323][ T9459] ? lockdep_hardirqs_on+0x421/0x5e0 [ 110.535337][ T9459] ? tomoyo_path_number_perm+0x454/0x520 [ 110.535352][ T9459] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 110.535363][ T9459] ? tomoyo_path_number_perm+0x25e/0x520 [ 110.535377][ T9459] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 110.535402][ T9459] fb_compat_ioctl+0x305/0xc50 [ 110.535413][ T9459] ? fb_release+0x150/0x150 [ 110.535424][ T9459] ? ksys_dup3+0x3e0/0x3e0 [ 110.535435][ T9459] ? get_old_timespec32+0x200/0x200 [ 110.535450][ T9459] ? tomoyo_file_ioctl+0x23/0x30 [ 110.535462][ T9459] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 110.535472][ T9459] ? security_file_ioctl+0x8d/0xc0 [ 110.535486][ T9459] __ia32_compat_sys_ioctl+0x233/0x610 [ 110.535497][ T9459] ? fb_release+0x150/0x150 [ 110.535511][ T9459] do_fast_syscall_32+0x27b/0xe16 [ 110.535525][ T9459] entry_SYSENTER_compat+0x70/0x7f [ 110.535532][ T9459] RIP: 0023:0xf7fc0a39 [ 110.535543][ T9459] Code: 00 00 00 89 d3 5b 5e 5f 5d c3 b8 80 96 98 00 eb c4 8b 04 24 c3 8b 1c 24 c3 8b 34 24 c3 8b 3c 24 c3 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 110.535549][ T9459] RSP: 002b:00000000f7fbc0cc EFLAGS: 00000296 ORIG_RAX: 0000000000000036 [ 110.535559][ T9459] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 0000000000004601 [ 110.535573][ T9459] RDX: 0000000020000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 110.535579][ T9459] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 110.535585][ T9459] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 110.535591][ T9459] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 110.537030][ T9459] Kernel Offset: disabled [ 111.532934][ T9459] Rebooting in 86400 seconds..