[   33.532411] audit: type=1800 audit(1556659890.903:33): pid=6889 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op="collect_data" cause="failed(directio)" comm="startpar" name="rc.local" dev="sda1" ino=2465 res=0
[   33.555139] audit: type=1800 audit(1556659890.903:34): pid=6889 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op="collect_data" cause="failed(directio)" comm="startpar" name="rmnologin" dev="sda1" ino=2456 res=0

Debian GNU/Linux 7 syzkaller ttyS0

syzkaller login: [   37.071841] random: sshd: uninitialized urandom read (32 bytes read)
[   37.438880] audit: type=1400 audit(1556659894.803:35): avc:  denied  { map } for  pid=7063 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1
[   37.515589] random: sshd: uninitialized urandom read (32 bytes read)
[   38.148162] random: sshd: uninitialized urandom read (32 bytes read)
[ 1219.369332] random: sshd: uninitialized urandom read (32 bytes read)
Warning: Permanently added '10.128.0.34' (ECDSA) to the list of known hosts.
[ 1224.915569] random: sshd: uninitialized urandom read (32 bytes read)
[ 1225.122808] audit: type=1400 audit(1556661082.493:36): avc:  denied  { map } for  pid=7076 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
2019/04/30 21:51:23 parsed 1 programs
[ 1226.023242] audit: type=1400 audit(1556661083.393:37): avc:  denied  { map } for  pid=7076 comm="syz-execprog" path="/sys/kernel/debug/kcov" dev="debugfs" ino=13808 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1
[ 1226.869007] random: cc1: uninitialized urandom read (8 bytes read)
2019/04/30 21:51:25 executed programs: 0
[ 1227.933277] audit: type=1400 audit(1556661085.293:38): avc:  denied  { map } for  pid=7076 comm="syz-execprog" path="/root/syzkaller-shm031940234" dev="sda1" ino=2233 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1
[ 1228.710270] IPVS: ftp: loaded support on port[0] = 21
[ 1229.039056] chnl_net:caif_netlink_parms(): no params data found
[ 1229.046799] IPVS: ftp: loaded support on port[0] = 21
[ 1229.105308] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1229.112243] bridge0: port 1(bridge_slave_0) entered disabled state
[ 1229.119448] device bridge_slave_0 entered promiscuous mode
[ 1229.129175] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1229.135668] bridge0: port 2(bridge_slave_1) entered disabled state
[ 1229.142787] device bridge_slave_1 entered promiscuous mode
[ 1229.167979] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 1229.177227] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 1229.199414] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[ 1229.206937] team0: Port device team_slave_0 added
[ 1229.212700] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[ 1229.220100] team0: Port device team_slave_1 added
[ 1229.225703] IPVS: ftp: loaded support on port[0] = 21
[ 1229.235969] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[ 1229.243485] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[ 1229.352132] device hsr_slave_0 entered promiscuous mode
[ 1229.390335] device hsr_slave_1 entered promiscuous mode
[ 1229.430807] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[ 1229.448041] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[ 1229.464378] chnl_net:caif_netlink_parms(): no params data found
[ 1229.495251] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1229.501876] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 1229.508907] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1229.515998] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 1229.558611] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1229.565539] bridge0: port 1(bridge_slave_0) entered disabled state
[ 1229.573009] device bridge_slave_0 entered promiscuous mode
[ 1229.579811] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1229.586511] bridge0: port 2(bridge_slave_1) entered disabled state
[ 1229.594287] device bridge_slave_1 entered promiscuous mode
[ 1229.604266] IPVS: ftp: loaded support on port[0] = 21
[ 1229.632735] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 1229.642169] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 1229.689505] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[ 1229.697046] team0: Port device team_slave_0 added
[ 1229.724453] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[ 1229.731902] team0: Port device team_slave_1 added
[ 1229.751067] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[ 1229.762064] chnl_net:caif_netlink_parms(): no params data found
[ 1229.778489] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[ 1229.793719] IPVS: ftp: loaded support on port[0] = 21
[ 1229.893042] device hsr_slave_0 entered promiscuous mode
[ 1229.940381] device hsr_slave_1 entered promiscuous mode
[ 1230.004363] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[ 1230.026812] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1230.033495] bridge0: port 1(bridge_slave_0) entered disabled state
[ 1230.040918] device bridge_slave_0 entered promiscuous mode
[ 1230.047465] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[ 1230.066652] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1230.074315] bridge0: port 2(bridge_slave_1) entered disabled state
[ 1230.081826] device bridge_slave_1 entered promiscuous mode
[ 1230.134254] bridge0: port 1(bridge_slave_0) entered disabled state
[ 1230.141610] bridge0: port 2(bridge_slave_1) entered disabled state
[ 1230.152898] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 1230.163915] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 1230.193169] 8021q: adding VLAN 0 to HW filter on device bond0
[ 1230.199568] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[ 1230.207057] team0: Port device team_slave_0 added
[ 1230.219192] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[ 1230.227522] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[ 1230.234926] team0: Port device team_slave_1 added
[ 1230.241128] chnl_net:caif_netlink_parms(): no params data found
[ 1230.262202] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[ 1230.271575] IPVS: ftp: loaded support on port[0] = 21
[ 1230.282407] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[ 1230.302689] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[ 1230.398160] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1230.405151] bridge0: port 1(bridge_slave_0) entered disabled state
[ 1230.412364] device bridge_slave_0 entered promiscuous mode
[ 1230.426766] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[ 1230.443007] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[ 1230.449185] 8021q: adding VLAN 0 to HW filter on device team0
[ 1230.455696] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1230.464639] bridge0: port 2(bridge_slave_1) entered disabled state
[ 1230.471801] device bridge_slave_1 entered promiscuous mode
[ 1230.478063] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 1230.486262] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 1230.542335] device hsr_slave_0 entered promiscuous mode
[ 1230.580341] device hsr_slave_1 entered promiscuous mode
[ 1230.624488] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[ 1230.631359] chnl_net:caif_netlink_parms(): no params data found
[ 1230.669143] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[ 1230.677811] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 1230.690768] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 1230.716377] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[ 1230.723759] team0: Port device team_slave_0 added
[ 1230.741276] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[ 1230.749591] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[ 1230.763704] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[ 1230.771638] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[ 1230.778816] team0: Port device team_slave_1 added
[ 1230.796324] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 1230.804192] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 1230.812123] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1230.818478] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 1230.825536] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 1230.833594] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 1230.841400] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1230.847756] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 1230.859675] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[ 1230.868619] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[ 1230.898555] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 1230.908823] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[ 1230.916237] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[ 1230.945536] 8021q: adding VLAN 0 to HW filter on device bond0
[ 1230.952618] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1230.958994] bridge0: port 1(bridge_slave_0) entered disabled state
[ 1230.966279] device bridge_slave_0 entered promiscuous mode
[ 1230.973716] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 1230.982261] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1230.988621] bridge0: port 2(bridge_slave_1) entered disabled state
[ 1230.996843] device bridge_slave_1 entered promiscuous mode
[ 1231.005962] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[ 1231.053457] device hsr_slave_0 entered promiscuous mode
[ 1231.111067] device hsr_slave_1 entered promiscuous mode
[ 1231.151283] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[ 1231.160559] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[ 1231.166985] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[ 1231.184167] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 1231.199226] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 1231.209655] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[ 1231.224744] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[ 1231.239963] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 1231.247154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 1231.255058] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 1231.263189] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 1231.270424] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 1231.290553] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[ 1231.296745] 8021q: adding VLAN 0 to HW filter on device team0
[ 1231.304505] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 1231.323269] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready
[ 1231.330199] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 1231.337844] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 1231.352714] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[ 1231.362103] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 1231.370388] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 1231.378291] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 1231.388143] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1231.394529] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 1231.443404] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[ 1231.465613] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 1231.473843] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 1231.481809] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 1231.489436] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1231.495909] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 1231.504613] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[ 1231.519879] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[ 1231.527862] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[ 1231.535276] team0: Port device team_slave_0 added
[ 1231.543443] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[ 1231.551537] team0: Port device team_slave_1 added
[ 1231.557943] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready
[ 1231.565151] chnl_net:caif_netlink_parms(): no params data found
[ 1231.585995] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 1231.595062] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 1231.602962] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 1231.613583] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[ 1231.622544] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[ 1231.631245] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[ 1231.640966] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[ 1231.661423] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 1231.669170] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 1231.677064] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 1231.684790] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 1231.692468] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 1231.701270] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 1231.711721] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[ 1231.719925] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[ 1231.726122] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 1231.764056] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready
[ 1231.777281] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
[ 1231.784339] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1231.793356] bridge0: port 1(bridge_slave_0) entered disabled state
[ 1231.800660] device bridge_slave_0 entered promiscuous mode
[ 1231.862248] device hsr_slave_0 entered promiscuous mode
[ 1231.900484] device hsr_slave_1 entered promiscuous mode
[ 1231.940402] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 1231.947999] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 1231.962483] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready
[ 1231.971874] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1231.978247] bridge0: port 2(bridge_slave_1) entered disabled state
[ 1231.987594] device bridge_slave_1 entered promiscuous mode
[ 1231.994413] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[ 1232.005001] 8021q: adding VLAN 0 to HW filter on device bond0
[ 1232.011737] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 1232.019211] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 1232.028253] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[ 1232.034632] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 1232.054663] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[ 1232.065113] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[ 1232.077415] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
[ 1232.095322] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 1232.113231] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[ 1232.123896] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 1232.133627] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 1232.141211] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 1232.148245] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 1232.163037] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[ 1232.169135] 8021q: adding VLAN 0 to HW filter on device team0
[ 1232.188921] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[ 1232.200341] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[ 1232.210838] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 1232.218640] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 1232.232178] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1232.238557] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 1232.254307] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[ 1232.262527] team0: Port device team_slave_0 added
[ 1232.268250] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[ 1232.276148] team0: Port device team_slave_1 added
[ 1232.282399] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[ 1232.292417] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 1232.306312] 8021q: adding VLAN 0 to HW filter on device bond0
[ 1232.314196] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[ 1232.321986] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[ 1232.337458] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[ 1232.347263] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 1232.354252] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 1232.366149] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 1232.374921] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1232.381337] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 1232.392970] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 1232.469804] device hsr_slave_0 entered promiscuous mode
[ 1232.510433] device hsr_slave_1 entered promiscuous mode
[ 1232.532338] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[ 1232.545725] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[ 1232.553507] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[ 1232.564583] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[ 1232.574563] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[ 1232.589488] 8021q: adding VLAN 0 to HW filter on device bond0
[ 1232.596077] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 1232.603944] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 1232.610983] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 1232.621143] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[ 1232.636325] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[ 1232.644769] 8021q: adding VLAN 0 to HW filter on device team0
[ 1232.653930] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[ 1232.663776] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 1232.671751] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 1232.679261] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 1232.687380] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 1232.695478] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1232.701884] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 1232.709003] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 1232.716095] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 1232.726017] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[ 1232.736742] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[ 1232.752413] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[ 1232.764112] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[ 1232.770806] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 1232.778986] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 1232.786801] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 1232.802739] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 1232.811113] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1232.817505] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 1232.832555] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready
[ 1232.842316] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[ 1232.863969] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 1232.879797] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 1232.894328] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 1232.903487] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 1232.928167] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[ 1232.939721] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[ 1232.946512] 8021q: adding VLAN 0 to HW filter on device team0
[ 1232.955803] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[ 1232.964016] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 1232.971982] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 1232.979653] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 1232.987513] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1232.993885] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 1233.002488] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready
[ 1233.012757] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[ 1233.022116] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[ 1233.030731] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 1233.037718] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 1233.046951] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 1233.054609] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 1233.062712] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 1233.070452] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 1233.080693] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[ 1233.092085] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[ 1233.101630] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 1233.108915] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 1233.116817] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 1233.124599] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1233.131012] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 1233.138155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 1233.145996] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 1233.154696] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[ 1233.162147] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 1233.174672] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready
[ 1233.192214] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[ 1233.199616] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 1233.207565] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 1233.216236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 1233.228291] 8021q: adding VLAN 0 to HW filter on device bond0
[ 1233.239906] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[ 1233.248408] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready
[ 1233.258077] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 1233.271890] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
[ 1233.286002] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
2019/04/30 21:51:30 executed programs: 13
[ 1233.292686] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 1233.301389] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 1233.308868] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 1233.316024] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 1233.324700] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[ 1233.343479] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 1233.373364] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[ 1233.379478] 8021q: adding VLAN 0 to HW filter on device team0
[ 1233.387867] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 1233.399709] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
[ 1233.415099] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[ 1233.424154] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[ 1233.437285] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 1233.445694] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 1233.454097] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 1233.461970] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 1233.469485] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1233.475881] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 1233.482939] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 1233.489945] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 1233.502592] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[ 1233.518179] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[ 1233.529475] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 1233.537635] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 1233.545366] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1233.551796] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 1233.559189] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 1233.567069] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 1233.581989] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[ 1233.595458] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[ 1233.616959] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready
[ 1233.625362] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 1233.633767] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 1233.641776] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 1233.649911] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 1233.664067] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 1233.681825] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[ 1233.691314] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready
[ 1233.699511] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 1233.714449] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[ 1233.721357] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 1233.728351] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 1233.736116] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 1233.744222] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 1233.752379] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 1233.760734] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 1233.769257] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[ 1233.787490] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
[ 1233.794397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 1233.804654] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 1233.817305] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready
[ 1233.830463] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 1233.838119] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 1233.846782] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 1233.856754] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready
[ 1233.866286] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 1233.874314] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 1233.884364] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[ 1233.891026] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 1233.907193] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
[ 1233.917750] 8021q: adding VLAN 0 to HW filter on device batadv0
2019/04/30 21:51:35 executed programs: 111
2019/04/30 21:51:40 executed programs: 305
2019/04/30 21:51:45 executed programs: 488
2019/04/30 21:51:51 executed programs: 682
2019/04/30 21:51:56 executed programs: 870
2019/04/30 21:52:01 executed programs: 1157
2019/04/30 21:52:06 executed programs: 1367
2019/04/30 21:52:11 executed programs: 1537
2019/04/30 21:52:16 executed programs: 1803
2019/04/30 21:52:21 executed programs: 2060
2019/04/30 21:52:26 executed programs: 2229
2019/04/30 21:52:31 executed programs: 2461
2019/04/30 21:52:36 executed programs: 2684
2019/04/30 21:52:41 executed programs: 2905
2019/04/30 21:52:46 executed programs: 3137
2019/04/30 21:52:51 executed programs: 3280
2019/04/30 21:52:56 executed programs: 3465
2019/04/30 21:53:01 executed programs: 3647
2019/04/30 21:53:06 executed programs: 3859
2019/04/30 21:53:12 executed programs: 4065
2019/04/30 21:53:17 executed programs: 4274
2019/04/30 21:53:22 executed programs: 4444
2019/04/30 21:53:27 executed programs: 4699
2019/04/30 21:53:32 executed programs: 4902
2019/04/30 21:53:37 executed programs: 5063
2019/04/30 21:53:42 executed programs: 5223
2019/04/30 21:53:47 executed programs: 5439
2019/04/30 21:53:52 executed programs: 5633
2019/04/30 21:53:57 executed programs: 5773
2019/04/30 21:54:02 executed programs: 5980
2019/04/30 21:54:08 executed programs: 6150
2019/04/30 21:54:13 executed programs: 6351
2019/04/30 21:54:18 executed programs: 6536
2019/04/30 21:54:23 executed programs: 6653
[ 1406.505857] random: crng init done
[ 1410.864896] libceph: mon0 [::1]:6789 socket error on write
[ 1410.934955] libceph: mon0 [::1]:6789 socket error on write
[ 1411.003594] libceph: mon0 [::1]:6789 socket error on write
[ 1411.040359] libceph: mon0 [::1]:6789 socket error on write
[ 1411.140895] libceph: mon0 [::1]:6789 socket error on write
[ 1411.181885] libceph: mon0 [::1]:6789 socket error on write
[ 1411.245012] libceph: mon0 [::1]:6789 socket error on write
2019/04/30 21:54:28 executed programs: 6662
[ 1412.085536] libceph: mon0 [::1]:6789 socket error on write
[ 1412.094265] libceph: mon0 [::1]:6789 socket error on write
[ 1412.099333] libceph: mon0 [::1]:6789 socket error on write
[ 1412.145879] libceph: mon0 [::1]:6789 socket error on write
[ 1412.199561] libceph: mon0 [::1]:6789 socket error on write
[ 1412.283522] libceph: mon0 [::1]:6789 socket error on write
[ 1412.417203] syz-executor.5: page allocation failure: order:5, mode:0x14040c0(GFP_KERNEL|__GFP_COMP), nodemask=(null)
[ 1412.417243] syz-executor.3: 
[ 1412.448178] syz-executor.5: 
[ 1412.448180] syz-executor.0: page allocation failure: order:5
[ 1412.465124] syz-executor.3: 
[ 1412.490113] syz-executor.3: page allocation failure: order:5, mode:0x14040c0(GFP_KERNEL|__GFP_COMP), nodemask=(null)
[ 1412.546395] syz-executor.3: page allocation failure: order:5, mode:0x14040c0(GFP_KERNEL|__GFP_COMP), nodemask=(null)
[ 1412.557229] syz-executor.3: page allocation failure: order:5, mode:0x14040c0(GFP_KERNEL|__GFP_COMP), nodemask=(null)
[ 1412.616213] syz-executor.4: page allocation failure: order:5, mode:0x14040c0(GFP_KERNEL|__GFP_COMP), nodemask=(null)
[ 1412.654918] page allocation failure: order:5, mode:0x14040c0(GFP_KERNEL|__GFP_COMP), nodemask=(null)
[ 1412.699626] syz-executor.4: page allocation failure: order:5, mode:0x14040c0(GFP_KERNEL|__GFP_COMP), nodemask=(null)
[ 1412.751855] ==================================================================
[ 1412.759501] BUG: KASAN: use-after-free in ceph_destroy_options+0xe9/0x110
[ 1412.766447] Read of size 8 at addr ffff888087aaf290 by task syz-executor.1/10204
[ 1412.773985] 
[ 1412.775623] CPU: 1 PID: 10204 Comm: syz-executor.1 Not tainted 4.14.114 #4
[ 1412.782636] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1412.792036] Call Trace:
[ 1412.794693]  dump_stack+0x138/0x19c
[ 1412.798337]  ? ceph_destroy_options+0xe9/0x110
[ 1412.802965]  print_address_description.cold+0x7c/0x1dc
[ 1412.808254]  ? ceph_destroy_options+0xe9/0x110
[ 1412.812849]  kasan_report.cold+0xaf/0x2b5
[ 1412.817008]  __asan_report_load8_noabort+0x14/0x20
[ 1412.821952]  ceph_destroy_options+0xe9/0x110
[ 1412.826369]  ceph_mount+0xb6d/0x1709
[ 1412.830093]  ? __lockdep_init_map+0x10c/0x570
[ 1412.834607]  mount_fs+0x9d/0x2a7
[ 1412.837987]  vfs_kern_mount.part.0+0x5e/0x3d0
[ 1412.842494]  do_mount+0x417/0x27d0
[ 1412.846049]  ? copy_mount_string+0x40/0x40
[ 1412.850296]  ? memdup_user+0x58/0xa0
[ 1412.854017]  ? copy_mount_options+0x1fe/0x2f0
[ 1412.858525]  SyS_mount+0xab/0x120
[ 1412.861974]  ? copy_mnt_ns+0x8c0/0x8c0
[ 1412.865863]  do_syscall_64+0x1eb/0x630
[ 1412.869749]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[ 1412.874654]  entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 1412.879846] RIP: 0033:0x458da9
[ 1412.883031] RSP: 002b:00007f6977eedc78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 1412.890746] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000458da9
[ 1412.898015] RDX: 0000000020000100 RSI: 0000000020000200 RDI: 0000000020000040
[ 1412.905285] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
[ 1412.912552] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6977eee6d4
[ 1412.919829] R13: 00000000004c4da1 R14: 00000000004d8a08 R15: 00000000ffffffff
[ 1412.927112] 
[ 1412.928734] Allocated by task 10204:
[ 1412.932451]  save_stack_trace+0x16/0x20
[ 1412.936420]  save_stack+0x45/0xd0
[ 1412.939866]  kasan_kmalloc+0xce/0xf0
[ 1412.943580]  kmem_cache_alloc_trace+0x152/0x790
[ 1412.948331]  ceph_parse_options+0xb8/0xe90
[ 1412.952564]  ceph_mount+0x3c1/0x1709
[ 1412.956274]  mount_fs+0x9d/0x2a7
[ 1412.959637]  vfs_kern_mount.part.0+0x5e/0x3d0
[ 1412.964994]  do_mount+0x417/0x27d0
[ 1412.968556]  SyS_mount+0xab/0x120
[ 1412.972008]  do_syscall_64+0x1eb/0x630
[ 1412.975899]  entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 1412.981079] 
[ 1412.982706] Freed by task 10204:
[ 1412.986070]  save_stack_trace+0x16/0x20
[ 1412.990044]  save_stack+0x45/0xd0
[ 1412.993499]  kasan_slab_free+0x75/0xc0
[ 1412.997385]  kfree+0xcc/0x270
[ 1413.000490]  ceph_destroy_options+0xdc/0x110
[ 1413.005078]  ceph_destroy_client+0x9d/0xc0
[ 1413.009312]  ceph_mount+0xb46/0x1709
[ 1413.013026]  mount_fs+0x9d/0x2a7
[ 1413.016388]  vfs_kern_mount.part.0+0x5e/0x3d0
[ 1413.020885]  do_mount+0x417/0x27d0
[ 1413.024419]  SyS_mount+0xab/0x120
[ 1413.027873]  do_syscall_64+0x1eb/0x630
[ 1413.031760]  entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 1413.036937] 
[ 1413.038559] The buggy address belongs to the object at ffff888087aaf1c0
[ 1413.038559]  which belongs to the cache kmalloc-256 of size 256
[ 1413.051221] The buggy address is located 208 bytes inside of
[ 1413.051221]  256-byte region [ffff888087aaf1c0, ffff888087aaf2c0)
[ 1413.063098] The buggy address belongs to the page:
[ 1413.068029] page:ffffea00021eabc0 count:1 mapcount:0 mapping:ffff888087aaf080 index:0x0
[ 1413.076265] flags: 0x1fffc0000000100(slab)
[ 1413.080503] raw: 01fffc0000000100 ffff888087aaf080 0000000000000000 000000010000000c
[ 1413.088393] raw: ffffea00024c4260 ffffea0001488460 ffff8880aa8007c0 0000000000000000
[ 1413.096267] page dumped because: kasan: bad access detected
[ 1413.101973] 
[ 1413.103593] Memory state around the buggy address:
[ 1413.108523]  ffff888087aaf180: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[ 1413.115877]  ffff888087aaf200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1413.123232] >ffff888087aaf280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 1413.130584]                          ^
[ 1413.134470]  ffff888087aaf300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1413.141829]  ffff888087aaf380: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
[ 1413.149200] ==================================================================
[ 1413.156552] Disabling lock debugging due to kernel taint
[ 1413.162001] ==================================================================
[ 1413.169399] BUG: KASAN: double-free or invalid-free in ceph_destroy_options+0xd4/0x110
[ 1413.177458] 
[ 1413.179100] CPU: 0 PID: 9986 Comm: syz-executor.0 Tainted: G    B           4.14.114 #4
[ 1413.187331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1413.196682] Call Trace:
[ 1413.199280]  dump_stack+0x138/0x19c
[ 1413.202913]  ? ceph_destroy_options+0xd4/0x110
[ 1413.207498]  print_address_description.cold+0x7c/0x1dc
[ 1413.212778]  ? ceph_destroy_options+0xd4/0x110
[ 1413.217363]  ? ceph_destroy_options+0xd4/0x110
[ 1413.221940]  kasan_report_double_free+0x56/0x80
[ 1413.226628]  kasan_slab_free+0xa7/0xc0
[ 1413.230509]  kfree+0xcc/0x270
[ 1413.233618]  ceph_destroy_options+0xd4/0x110
[ 1413.238025]  ceph_mount+0xb6d/0x1709
[ 1413.241747]  ? __lockdep_init_map+0x10c/0x570
[ 1413.246242]  mount_fs+0x9d/0x2a7
[ 1413.249606]  vfs_kern_mount.part.0+0x5e/0x3d0
[ 1413.254097]  do_mount+0x417/0x27d0
[ 1413.257633]  ? copy_mount_string+0x40/0x40
[ 1413.261874]  ? memdup_user+0x58/0xa0
[ 1413.265586]  ? copy_mount_options+0x1fe/0x2f0
[ 1413.270080]  SyS_mount+0xab/0x120
[ 1413.273527]  ? copy_mnt_ns+0x8c0/0x8c0
[ 1413.277410]  do_syscall_64+0x1eb/0x630
[ 1413.281291]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[ 1413.286158]  entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 1413.291342] RIP: 0033:0x458da9
[ 1413.294524] RSP: 002b:00007f3ae1dcfc78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 1413.302229] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000458da9
[ 1413.309493] RDX: 0000000020000100 RSI: 0000000020000200 RDI: 0000000020000040
[ 1413.316757] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
[ 1413.324020] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3ae1dd06d4
[ 1413.331282] R13: 00000000004c4da1 R14: 00000000004d8a08 R15: 00000000ffffffff
[ 1413.338557] 
[ 1413.340181] Allocated by task 9986:
[ 1413.343809]  save_stack_trace+0x16/0x20
[ 1413.347787]  save_stack+0x45/0xd0
[ 1413.351233]  kasan_kmalloc+0xce/0xf0
[ 1413.354939]  kmem_cache_alloc_trace+0x152/0x790
[ 1413.359604]  ceph_parse_options+0xfe/0xe90
[ 1413.363841]  ceph_mount+0x3c1/0x1709
[ 1413.367549]  mount_fs+0x9d/0x2a7
[ 1413.370906]  vfs_kern_mount.part.0+0x5e/0x3d0
[ 1413.375398]  do_mount+0x417/0x27d0
[ 1413.378935]  SyS_mount+0xab/0x120
[ 1413.382379]  do_syscall_64+0x1eb/0x630
[ 1413.386259]  entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 1413.391451] 
[ 1413.393068] Freed by task 9986:
[ 1413.396347]  save_stack_trace+0x16/0x20
[ 1413.400344]  save_stack+0x45/0xd0
[ 1413.403787]  kasan_slab_free+0x75/0xc0
[ 1413.407667]  kfree+0xcc/0x270
[ 1413.410775]  ceph_destroy_options+0xd4/0x110
[ 1413.415176]  ceph_destroy_client+0x9d/0xc0
[ 1413.419410]  ceph_mount+0xb46/0x1709
[ 1413.423125]  mount_fs+0x9d/0x2a7
[ 1413.426486]  vfs_kern_mount.part.0+0x5e/0x3d0
[ 1413.430969]  do_mount+0x417/0x27d0
[ 1413.434504]  SyS_mount+0xab/0x120
[ 1413.437957]  do_syscall_64+0x1eb/0x630
[ 1413.441840]  entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 1413.447034] 
[ 1413.448659] The buggy address belongs to the object at ffff8881cdf40e00
[ 1413.448659]  which belongs to the cache kmalloc-8192 of size 8192
[ 1413.461483] The buggy address is located 0 bytes inside of
[ 1413.461483]  8192-byte region [ffff8881cdf40e00, ffff8881cdf42e00)
[ 1413.473272] The buggy address belongs to the page:
[ 1413.478205] page:ffffea000737d000 count:1 mapcount:0 mapping:ffff8881cdf40e00 index:0x0 compound_mapcount: 0
[ 1413.488347] flags: 0x6fffc0000008100(slab|head)
[ 1413.493011] raw: 06fffc0000008100 ffff8881cdf40e00 0000000000000000 0000000100000001
[ 1413.500977] raw: ffffea0007669120 ffffea00071f5220 ffff8880aa802080 0000000000000000
[ 1413.508883] page dumped because: kasan: bad access detected
[ 1413.514582] 
[ 1413.516199] Memory state around the buggy address:
[ 1413.521124]  ffff8881cdf40d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 1413.528483]  ffff8881cdf40d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 1413.536709] >ffff8881cdf40e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1413.544056]                    ^
[ 1413.547423]  ffff8881cdf40e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1413.554776]  ffff8881cdf40f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1413.562126] ==================================================================
[ 1413.569480] Kernel panic - not syncing: panic_on_warn set ...
[ 1413.569480] 
[ 1413.569484] ==================================================================
[ 1413.569507] BUG: KASAN: double-free or invalid-free in ceph_destroy_options+0xd4/0x110
[ 1413.576843] CPU: 0 PID: 9986 Comm: syz-executor.0 Tainted: G    B           4.14.114 #4
[ 1413.584206] 
[ 1413.592253] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1413.611342] Call Trace:
[ 1413.613934]  dump_stack+0x138/0x19c
[ 1413.617557]  panic+0x1f2/0x438
[ 1413.620745]  ? add_taint.cold+0x16/0x16
[ 1413.624729]  ? lock_downgrade+0x6e0/0x6e0
[ 1413.628880]  ? print_shadow_for_address+0xa7/0xf4
[ 1413.633724]  ? ceph_destroy_options+0xd4/0x110
[ 1413.638298]  ? ceph_destroy_options+0xd4/0x110
[ 1413.642881]  kasan_end_report+0x47/0x4f
[ 1413.646867]  kasan_report_double_free+0x73/0x80
[ 1413.651534]  kasan_slab_free+0xa7/0xc0
[ 1413.655413]  kfree+0xcc/0x270
[ 1413.658520]  ceph_destroy_options+0xd4/0x110
[ 1413.662923]  ceph_mount+0xb6d/0x1709
[ 1413.666631]  ? __lockdep_init_map+0x10c/0x570
[ 1413.671138]  mount_fs+0x9d/0x2a7
[ 1413.674500]  vfs_kern_mount.part.0+0x5e/0x3d0
[ 1413.679000]  do_mount+0x417/0x27d0
[ 1413.682537]  ? copy_mount_string+0x40/0x40
[ 1413.686767]  ? memdup_user+0x58/0xa0
[ 1413.690471]  ? copy_mount_options+0x1fe/0x2f0
[ 1413.694961]  SyS_mount+0xab/0x120
[ 1413.698407]  ? copy_mnt_ns+0x8c0/0x8c0
[ 1413.702292]  do_syscall_64+0x1eb/0x630
[ 1413.706190]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[ 1413.711037]  entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 1413.716224] RIP: 0033:0x458da9
[ 1413.719409] RSP: 002b:00007f3ae1dcfc78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 1413.727109] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000458da9
[ 1413.734369] RDX: 0000000020000100 RSI: 0000000020000200 RDI: 0000000020000040
[ 1413.741634] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
[ 1413.748920] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3ae1dd06d4
[ 1413.756185] R13: 00000000004c4da1 R14: 00000000004d8a08 R15: 00000000ffffffff
[ 1413.763467] CPU: 1 PID: 9298 Comm: syz-executor.3 Tainted: G    B           4.14.114 #4
[ 1413.771613] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1413.780956] Call Trace:
[ 1413.783546]  dump_stack+0x138/0x19c
[ 1413.787171]  ? ceph_destroy_options+0xd4/0x110
[ 1413.791749]  print_address_description.cold+0x7c/0x1dc
[ 1413.797018]  ? ceph_destroy_options+0xd4/0x110
[ 1413.801591]  ? ceph_destroy_options+0xd4/0x110
[ 1413.806167]  kasan_report_double_free+0x56/0x80
[ 1413.810837]  kasan_slab_free+0xa7/0xc0
[ 1413.814728]  kfree+0xcc/0x270
[ 1413.817841]  ceph_destroy_options+0xd4/0x110
[ 1413.822246]  ceph_mount+0xb6d/0x1709
[ 1413.826002]  ? __lockdep_init_map+0x10c/0x570
[ 1413.830497]  mount_fs+0x9d/0x2a7
[ 1413.833858]  vfs_kern_mount.part.0+0x5e/0x3d0
[ 1413.838353]  do_mount+0x417/0x27d0
[ 1413.841887]  ? copy_mount_string+0x40/0x40
[ 1413.846117]  ? memdup_user+0x58/0xa0
[ 1413.849840]  ? copy_mount_options+0x1fe/0x2f0
[ 1413.854332]  SyS_mount+0xab/0x120
[ 1413.857776]  ? copy_mnt_ns+0x8c0/0x8c0
[ 1413.861658]  do_syscall_64+0x1eb/0x630
[ 1413.865554]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[ 1413.870393]  entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 1413.875573] RIP: 0033:0x458da9
[ 1413.878755] RSP: 002b:00007f51762dbc78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 1413.886455] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000458da9
[ 1413.893735] RDX: 0000000020000100 RSI: 0000000020000200 RDI: 0000000020000040
[ 1413.900999] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
[ 1413.908258] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f51762dc6d4
[ 1413.915520] R13: 00000000004c4da1 R14: 00000000004d8a08 R15: 00000000ffffffff
[ 1413.922789] 
[ 1413.924412] Allocated by task 9298:
[ 1413.928037]  save_stack_trace+0x16/0x20
[ 1413.932007]  save_stack+0x45/0xd0
[ 1413.935449]  kasan_kmalloc+0xce/0xf0
[ 1413.939156]  kmem_cache_alloc_trace+0x152/0x790
[ 1413.943835]  ceph_parse_options+0xfe/0xe90
[ 1413.948062]  ceph_mount+0x3c1/0x1709
[ 1413.951765]  mount_fs+0x9d/0x2a7
[ 1413.955129]  vfs_kern_mount.part.0+0x5e/0x3d0
[ 1413.959612]  do_mount+0x417/0x27d0
[ 1413.963141]  SyS_mount+0xab/0x120
[ 1413.966585]  do_syscall_64+0x1eb/0x630
[ 1413.970464]  entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 1413.975642] 
[ 1413.977281] Freed by task 9298:
[ 1413.980553]  save_stack_trace+0x16/0x20
[ 1413.984518]  save_stack+0x45/0xd0
[ 1413.987960]  kasan_slab_free+0x75/0xc0
[ 1413.991862]  kfree+0xcc/0x270
[ 1413.994961]  ceph_destroy_options+0xd4/0x110
[ 1413.999360]  ceph_destroy_client+0x9d/0xc0
[ 1414.003589]  ceph_mount+0xb46/0x1709
[ 1414.007311]  mount_fs+0x9d/0x2a7
[ 1414.010686]  vfs_kern_mount.part.0+0x5e/0x3d0
[ 1414.015174]  do_mount+0x417/0x27d0
[ 1414.018703]  SyS_mount+0xab/0x120
[ 1414.022147]  do_syscall_64+0x1eb/0x630
[ 1414.026025]  entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 1414.031202] 
[ 1414.032827] The buggy address belongs to the object at ffff8881cf3c1b40
[ 1414.032827]  which belongs to the cache kmalloc-8192 of size 8192
[ 1414.045649] The buggy address is located 0 bytes inside of
[ 1414.045649]  8192-byte region [ffff8881cf3c1b40, ffff8881cf3c3b40)
[ 1414.057423] The buggy address belongs to the page:
[ 1414.062343] page:ffffea00073cf000 count:1 mapcount:0 mapping:ffff8881cf3c1b40 index:0x0 compound_mapcount: 0
[ 1414.072306] flags: 0x6fffc0000008100(slab|head)
[ 1414.076966] raw: 06fffc0000008100 ffff8881cf3c1b40 0000000000000000 0000000100000001
[ 1414.084844] raw: ffffea000725c120 ffffea00073cf620 ffff8880aa802080 0000000000000000
[ 1414.092710] page dumped because: kasan: bad access detected
[ 1414.098405] 
[ 1414.100019] Memory state around the buggy address:
[ 1414.104936]  ffff8881cf3c1a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 1414.112285]  ffff8881cf3c1a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 1414.119633] >ffff8881cf3c1b00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[ 1414.126979]                                            ^
[ 1414.132421]  ffff8881cf3c1b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1414.139769]  ffff8881cf3c1c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1414.147119] ==================================================================
[ 1414.913618] Shutting down cpus with NMI
[ 1414.918719] Kernel Offset: disabled
[ 1414.922347] Rebooting in 86400 seconds..