[ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.141' (ECDSA) to the list of known hosts. 2020/08/28 10:37:00 parsed 1 programs 2020/08/28 10:37:00 executed programs: 0 syzkaller login: [ 144.315765][ T6864] IPVS: ftp: loaded support on port[0] = 21 [ 144.491105][ T6864] chnl_net:caif_netlink_parms(): no params data found [ 144.550008][ T6864] bridge0: port 1(bridge_slave_0) entered blocking state [ 144.559210][ T6864] bridge0: port 1(bridge_slave_0) entered disabled state [ 144.569052][ T6864] device bridge_slave_0 entered promiscuous mode [ 144.579317][ T6864] bridge0: port 2(bridge_slave_1) entered blocking state [ 144.588372][ T6864] bridge0: port 2(bridge_slave_1) entered disabled state [ 144.599089][ T6864] device bridge_slave_1 entered promiscuous mode [ 144.622268][ T6864] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 144.635161][ T6864] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 144.659209][ T6864] team0: Port device team_slave_0 added [ 144.667458][ T6864] team0: Port device team_slave_1 added [ 144.687403][ T6864] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 144.694781][ T6864] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 144.730765][ T6864] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 144.746400][ T6864] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 144.761149][ T6864] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 144.791063][ T6864] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 144.819884][ T6864] device hsr_slave_0 entered promiscuous mode [ 144.827409][ T6864] device hsr_slave_1 entered promiscuous mode [ 144.926436][ T6864] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 144.939507][ T6864] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 144.952870][ T6864] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 144.963770][ T6864] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 144.991087][ T6864] bridge0: port 2(bridge_slave_1) entered blocking state [ 144.998954][ T6864] bridge0: port 2(bridge_slave_1) entered forwarding state [ 145.007962][ T6864] bridge0: port 1(bridge_slave_0) entered blocking state [ 145.015403][ T6864] bridge0: port 1(bridge_slave_0) entered forwarding state [ 145.064611][ T6864] 8021q: adding VLAN 0 to HW filter on device bond0 [ 145.079336][ T2541] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 145.091878][ T2541] bridge0: port 1(bridge_slave_0) entered disabled state [ 145.101060][ T2541] bridge0: port 2(bridge_slave_1) entered disabled state [ 145.109254][ T2541] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 145.122961][ T6864] 8021q: adding VLAN 0 to HW filter on device team0 [ 145.136598][ T3920] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 145.145928][ T3920] bridge0: port 1(bridge_slave_0) entered blocking state [ 145.153080][ T3920] bridge0: port 1(bridge_slave_0) entered forwarding state [ 145.173412][ T3920] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 145.184011][ T3920] bridge0: port 2(bridge_slave_1) entered blocking state [ 145.191084][ T3920] bridge0: port 2(bridge_slave_1) entered forwarding state [ 145.213836][ T3920] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 145.222455][ T3920] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 145.231206][ T3920] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 145.239662][ T3920] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 145.249758][ T3920] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 145.260101][ T6864] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 145.279359][ T2541] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 145.287278][ T2541] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 145.300570][ T6864] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 145.322211][ T2541] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 145.345283][ T3920] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 145.354450][ T3920] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 145.364094][ T3920] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 145.376203][ T6864] device veth0_vlan entered promiscuous mode [ 145.390207][ T6864] device veth1_vlan entered promiscuous mode [ 145.413409][ T2541] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 145.421899][ T2541] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 145.432552][ T2541] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 145.455661][ T6864] device veth0_macvtap entered promiscuous mode [ 145.474567][ T6864] device veth1_macvtap entered promiscuous mode [ 145.488173][ T2541] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 145.509425][ T6864] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 145.518218][ T3920] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 145.528766][ T3920] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 145.541576][ T6864] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 145.549672][ T2541] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 145.560048][ T2541] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 145.571564][ T6864] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 145.582067][ T6864] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 145.591289][ T6864] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 145.600947][ T6864] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 146.324180][ T2736] Bluetooth: hci0: command 0x0409 tx timeout 2020/08/28 10:37:05 executed programs: 60 [ 148.402676][ T3920] Bluetooth: hci0: command 0x041b tx timeout [ 150.482545][ T2736] Bluetooth: hci0: command 0x040f tx timeout [ 152.563342][ T2541] Bluetooth: hci0: command 0x0419 tx timeout 2020/08/28 10:37:10 executed programs: 202 2020/08/28 10:37:15 executed programs: 347 2020/08/28 10:37:20 executed programs: 501 2020/08/28 10:37:25 executed programs: 649 2020/08/28 10:37:30 executed programs: 803 2020/08/28 10:37:35 executed programs: 954 [ 179.398113][T10584] ------------[ cut here ]------------ [ 179.403643][T10584] ODEBUG: free active (active state 1) object type: rcu_head hint: 0x0 [ 179.412336][T10584] WARNING: CPU: 0 PID: 10584 at lib/debugobjects.c:485 debug_print_object+0x160/0x250 [ 179.421884][T10584] Kernel panic - not syncing: panic_on_warn set ... [ 179.428486][T10584] CPU: 0 PID: 10584 Comm: syz-executor.0 Not tainted 5.9.0-rc1-syzkaller #0 [ 179.437159][T10584] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 179.447316][T10584] Call Trace: [ 179.450603][T10584] dump_stack+0x18f/0x20d [ 179.454935][T10584] panic+0x2e3/0x75c [ 179.458834][T10584] ? __warn_printk+0xf3/0xf3 [ 179.463451][T10584] ? console_unlock+0x7f0/0xf30 [ 179.468310][T10584] ? __warn.cold+0x5/0x4a [ 179.472624][T10584] ? __warn+0xd6/0x1f2 [ 179.476715][T10584] ? debug_print_object+0x160/0x250 [ 179.481932][T10584] __warn.cold+0x20/0x4a [ 179.486162][T10584] ? debug_print_object+0x160/0x250 [ 179.491353][T10584] report_bug+0x1bd/0x210 [ 179.495733][T10584] handle_bug+0x38/0x90 [ 179.499883][T10584] ? __warn_printk+0xc6/0xf3 [ 179.504490][T10584] exc_invalid_op+0x14/0x40 [ 179.509000][T10584] asm_exc_invalid_op+0x12/0x20 [ 179.513879][T10584] RIP: 0010:debug_print_object+0x160/0x250 [ 179.519751][T10584] Code: dd e0 26 94 88 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 bf 00 00 00 48 8b 14 dd e0 26 94 88 48 c7 c7 40 1c 94 88 e8 e2 3a a6 fd <0f> 0b 83 05 a3 85 13 07 01 48 83 c4 20 5b 5d 41 5c 41 5d c3 48 89 [ 179.539517][T10584] RSP: 0018:ffffc90005727dd0 EFLAGS: 00010082 [ 179.545790][T10584] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 [ 179.554552][T10584] RDX: ffff88809c1ca0c0 RSI: ffffffff815dafc7 RDI: fffff52000ae4fac [ 179.563192][T10584] RBP: 0000000000000001 R08: 0000000000000001 R09: ffff8880ae620f8b [ 179.571165][T10584] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff89bd6780 [ 179.579244][T10584] R13: 0000000000000000 R14: dead000000000100 R15: dffffc0000000000 [ 179.587395][T10584] ? vprintk_func+0x97/0x1a6 [ 179.591992][T10584] debug_check_no_obj_freed+0x301/0x41c [ 179.597540][T10584] kmem_cache_free.part.0+0x16d/0x1f0 [ 179.603031][T10584] task_work_run+0xdd/0x190 [ 179.607560][T10584] exit_to_user_mode_prepare+0x195/0x1c0 [ 179.613550][T10584] syscall_exit_to_user_mode+0x59/0x2b0 [ 179.619092][T10584] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 179.624978][T10584] RIP: 0033:0x416f01 [ 179.628852][T10584] Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 179.648432][T10584] RSP: 002b:00007fff7cdda780 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 179.656823][T10584] RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000416f01 [ 179.664772][T10584] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 0000000000000003 [ 179.672739][T10584] RBP: 0000000000000000 R08: 0000000001190358 R09: 0000000000000000 [ 179.680705][T10584] R10: 00007fff7cdda860 R11: 0000000000000293 R12: 0000000001190360 [ 179.688671][T10584] R13: 0000000000000000 R14: ffffffffffffffff R15: 000000000118cf4c [ 179.698778][T10584] Kernel Offset: disabled [ 179.703306][T10584] Rebooting in 86400 seconds..