[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.10.57' (ECDSA) to the list of known hosts. 2020/08/01 18:43:33 parsed 1 programs 2020/08/01 18:43:33 executed programs: 0 syzkaller login: [ 1050.314516][ T6848] IPVS: ftp: loaded support on port[0] = 21 [ 1050.413320][ T6848] chnl_net:caif_netlink_parms(): no params data found [ 1050.465518][ T6848] bridge0: port 1(bridge_slave_0) entered blocking state [ 1050.473295][ T6848] bridge0: port 1(bridge_slave_0) entered disabled state [ 1050.484620][ T6848] device bridge_slave_0 entered promiscuous mode [ 1050.493604][ T6848] bridge0: port 2(bridge_slave_1) entered blocking state [ 1050.501369][ T6848] bridge0: port 2(bridge_slave_1) entered disabled state [ 1050.509394][ T6848] device bridge_slave_1 entered promiscuous mode [ 1050.531493][ T6848] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1050.542978][ T6848] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1050.566608][ T6848] team0: Port device team_slave_0 added [ 1050.574061][ T6848] team0: Port device team_slave_1 added [ 1050.591930][ T6848] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1050.598895][ T6848] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1050.625388][ T6848] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1050.639182][ T6848] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1050.647034][ T6848] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1050.673403][ T6848] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1050.744356][ T6848] device hsr_slave_0 entered promiscuous mode [ 1050.811365][ T6848] device hsr_slave_1 entered promiscuous mode [ 1050.936241][ T6848] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1051.004583][ T6848] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1051.073649][ T6848] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1051.143727][ T6848] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1051.217950][ T6848] bridge0: port 2(bridge_slave_1) entered blocking state [ 1051.225606][ T6848] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1051.236836][ T6848] bridge0: port 1(bridge_slave_0) entered blocking state [ 1051.244145][ T6848] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1051.290474][ T6848] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1051.306320][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1051.317251][ T2647] bridge0: port 1(bridge_slave_0) entered disabled state [ 1051.326391][ T2647] bridge0: port 2(bridge_slave_1) entered disabled state [ 1051.334688][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 1051.348064][ T6848] 8021q: adding VLAN 0 to HW filter on device team0 [ 1051.360147][ T2555] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1051.369298][ T2555] bridge0: port 1(bridge_slave_0) entered blocking state [ 1051.376447][ T2555] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1051.391002][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1051.400368][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1051.409959][ T2647] bridge0: port 2(bridge_slave_1) entered blocking state [ 1051.417158][ T2647] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1051.425037][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1051.443305][ T6818] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1051.452321][ T6818] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1051.461233][ T6818] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1051.472024][ T6818] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1051.481505][ T6818] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1051.498819][ T6818] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1051.507130][ T6818] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1051.517080][ T6818] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1051.528892][ T2555] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1051.539146][ T2555] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1051.552685][ T6848] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1051.570829][ T2555] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1051.578316][ T2555] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1051.593572][ T6848] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1051.613674][ T6818] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1051.623187][ T6818] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1051.643471][ T7058] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1051.652446][ T7058] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1051.664416][ T6818] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1051.672512][ T6818] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1051.682161][ T6848] device veth0_vlan entered promiscuous mode [ 1051.696182][ T6848] device veth1_vlan entered promiscuous mode [ 1051.718222][ T2555] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 1051.728302][ T2555] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 1051.741377][ T2555] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1051.750059][ T2555] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1051.763114][ T6848] device veth0_macvtap entered promiscuous mode [ 1051.774936][ T6848] device veth1_macvtap entered promiscuous mode [ 1051.792320][ T6848] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1051.799796][ T6818] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1051.809113][ T6818] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1051.817483][ T6818] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1051.827391][ T6818] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1051.841742][ T6848] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1051.851035][ T6978] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1051.859652][ T6978] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1054.153356][ T7168] ================================================================== [ 1054.162871][ T7168] BUG: KASAN: double-free or invalid-free in snd_seq_port_disconnect+0x4c1/0x5c0 [ 1054.171989][ T7168] [ 1054.174333][ T7168] CPU: 0 PID: 7168 Comm: syz-executor.0 Not tainted 5.8.0-rc7-syzkaller #0 [ 1054.182913][ T7168] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1054.193043][ T7168] Call Trace: [ 1054.196427][ T7168] dump_stack+0x18f/0x20d [ 1054.200839][ T7168] print_address_description.constprop.0.cold+0xae/0x436 [ 1054.207986][ T7168] ? lockdep_hardirqs_off+0x66/0xa0 [ 1054.213285][ T7168] ? vprintk_func+0x97/0x1a6 [ 1054.217886][ T7168] ? snd_seq_port_disconnect+0x4c1/0x5c0 [ 1054.223522][ T7168] kasan_report_invalid_free+0x51/0x80 [ 1054.229231][ T7168] ? snd_seq_port_disconnect+0x4c1/0x5c0 [ 1054.234866][ T7168] __kasan_slab_free+0x127/0x140 [ 1054.241027][ T7168] ? snd_seq_port_disconnect+0x4c1/0x5c0 [ 1054.247004][ T7168] kfree+0x103/0x2c0 [ 1054.251048][ T7168] snd_seq_port_disconnect+0x4c1/0x5c0 [ 1054.256521][ T7168] snd_seq_ioctl_unsubscribe_port+0x1fc/0x400 [ 1054.262590][ T7168] ? snd_seq_ioctl_running_mode+0x180/0x180 [ 1054.268570][ T7168] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 1054.274474][ T7168] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 1054.280523][ T7168] snd_seq_kernel_client_ctl+0xeb/0x130 [ 1054.286069][ T7168] snd_seq_oss_midi_close+0x36e/0x4d0 [ 1054.291459][ T7168] ? snd_seq_oss_midi_open_all+0xe0/0xe0 [ 1054.297191][ T7168] ? tomoyo_execute_permission+0x470/0x470 [ 1054.303018][ T7168] snd_seq_oss_synth_reset+0x418/0x860 [ 1054.308478][ T7168] ? snd_seq_oss_synth_cleanup+0x460/0x460 [ 1054.314349][ T7168] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 1054.320341][ T7168] snd_seq_oss_reset+0x6f/0x290 [ 1054.325188][ T7168] snd_seq_oss_ioctl+0xb7b/0xd40 [ 1054.330107][ T7168] ? snd_seq_oss_midi_info_user+0x140/0x140 [ 1054.336043][ T7168] ? __fget_files+0x294/0x400 [ 1054.340752][ T7168] odev_ioctl+0x4f/0x90 [ 1054.346819][ T7168] ? odev_open+0x90/0x90 [ 1054.351116][ T7168] ksys_ioctl+0x11a/0x180 [ 1054.355444][ T7168] __x64_sys_ioctl+0x6f/0xb0 [ 1054.360026][ T7168] ? lockdep_hardirqs_on+0x6a/0xe0 [ 1054.365296][ T7168] do_syscall_64+0x60/0xe0 [ 1054.369703][ T7168] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1054.375579][ T7168] RIP: 0033:0x45cc79 [ 1054.379457][ T7168] Code: 2d b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb b5 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1054.399143][ T7168] RSP: 002b:00007f8e9ed59c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1054.407552][ T7168] RAX: ffffffffffffffda RBX: 00000000000154c0 RCX: 000000000045cc79 [ 1054.415514][ T7168] RDX: 0000000000000000 RSI: 0000000000005100 RDI: 0000000000000003 [ 1054.423472][ T7168] RBP: 000000000078bfd8 R08: 0000000000000000 R09: 0000000000000000 [ 1054.431427][ T7168] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000078bfac [ 1054.439388][ T7168] R13: 00007ffc4facbfaf R14: 00007f8e9ed5a9c0 R15: 000000000078bfac [ 1054.447378][ T7168] [ 1054.449744][ T7168] Allocated by task 7167: [ 1054.454105][ T7168] save_stack+0x1b/0x40 [ 1054.458979][ T7168] __kasan_kmalloc.constprop.0+0xc2/0xd0 [ 1054.464627][ T7168] kmem_cache_alloc_trace+0x14f/0x2d0 [ 1054.470123][ T7168] snd_seq_port_connect+0x5d/0x520 [ 1054.475248][ T7168] snd_seq_ioctl_subscribe_port+0x1fc/0x400 [ 1054.481148][ T7168] snd_seq_kernel_client_ctl+0xeb/0x130 [ 1054.487141][ T7168] snd_seq_oss_midi_open+0x466/0x6e0 [ 1054.492430][ T7168] snd_seq_oss_synth_setup_midi+0x123/0x520 [ 1054.498342][ T7168] snd_seq_oss_open+0x87e/0xa10 [ 1054.503193][ T7168] odev_open+0x6c/0x90 [ 1054.507325][ T7168] soundcore_open+0x445/0x600 [ 1054.512012][ T7168] chrdev_open+0x266/0x770 [ 1054.516484][ T7168] do_dentry_open+0x501/0x1290 [ 1054.521350][ T7168] path_openat+0x1bb9/0x2750 [ 1054.525925][ T7168] do_filp_open+0x17e/0x3c0 [ 1054.530421][ T7168] do_sys_openat2+0x16f/0x3b0 [ 1054.535095][ T7168] __x64_sys_openat+0x13f/0x1f0 [ 1054.539954][ T7168] do_syscall_64+0x60/0xe0 [ 1054.544360][ T7168] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1054.550230][ T7168] [ 1054.552975][ T7168] Freed by task 7167: [ 1054.556961][ T7168] save_stack+0x1b/0x40 [ 1054.561106][ T7168] __kasan_slab_free+0xf5/0x140 [ 1054.565956][ T7168] kfree+0x103/0x2c0 [ 1054.569838][ T7168] snd_seq_port_disconnect+0x4c1/0x5c0 [ 1054.575289][ T7168] snd_seq_ioctl_unsubscribe_port+0x1fc/0x400 [ 1054.581355][ T7168] snd_seq_kernel_client_ctl+0xeb/0x130 [ 1054.586901][ T7168] snd_seq_oss_midi_close+0x36e/0x4d0 [ 1054.592254][ T7168] snd_seq_oss_synth_reset+0x418/0x860 [ 1054.597709][ T7168] snd_seq_oss_reset+0x6f/0x290 [ 1054.602538][ T7168] snd_seq_oss_ioctl+0xb7b/0xd40 [ 1054.607470][ T7168] odev_ioctl+0x4f/0x90 [ 1054.611615][ T7168] ksys_ioctl+0x11a/0x180 [ 1054.615940][ T7168] __x64_sys_ioctl+0x6f/0xb0 [ 1054.620539][ T7168] do_syscall_64+0x60/0xe0 [ 1054.624940][ T7168] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1054.630815][ T7168] [ 1054.633213][ T7168] The buggy address belongs to the object at ffff8880a4b4c500 [ 1054.633213][ T7168] which belongs to the cache kmalloc-128 of size 128 [ 1054.647280][ T7168] The buggy address is located 0 bytes inside of [ 1054.647280][ T7168] 128-byte region [ffff8880a4b4c500, ffff8880a4b4c580) [ 1054.660836][ T7168] The buggy address belongs to the page: [ 1054.666492][ T7168] page:ffffea000292d300 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 [ 1054.677058][ T7168] flags: 0xfffe0000000200(slab) [ 1054.681910][ T7168] raw: 00fffe0000000200 ffffea00029b0388 ffffea00028a04c8 ffff8880aa000700 [ 1054.691060][ T7168] raw: 0000000000000000 ffff8880a4b4c000 0000000100000010 0000000000000000 [ 1054.701216][ T7168] page dumped because: kasan: bad access detected [ 1054.707617][ T7168] [ 1054.709935][ T7168] Memory state around the buggy address: [ 1054.715559][ T7168] ffff8880a4b4c400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1054.723709][ T7168] ffff8880a4b4c480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1054.731749][ T7168] >ffff8880a4b4c500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1054.739806][ T7168] ^ [ 1054.743882][ T7168] ffff8880a4b4c580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1054.752337][ T7168] ffff8880a4b4c600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1054.760405][ T7168] ================================================================== [ 1054.768451][ T7168] Disabling lock debugging due to kernel taint [ 1054.774592][ T7168] Kernel panic - not syncing: panic_on_warn set ... [ 1054.781155][ T7168] CPU: 0 PID: 7168 Comm: syz-executor.0 Tainted: G B 5.8.0-rc7-syzkaller #0 [ 1054.791177][ T7168] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1054.801222][ T7168] Call Trace: [ 1054.804613][ T7168] dump_stack+0x18f/0x20d [ 1054.809095][ T7168] panic+0x2e3/0x75c [ 1054.812997][ T7168] ? __warn_printk+0xf3/0xf3 [ 1054.817579][ T7168] ? _raw_spin_unlock_irqrestore+0x5b/0xe0 [ 1054.823375][ T7168] ? snd_seq_port_disconnect+0x4c1/0x5c0 [ 1054.828986][ T7168] end_report+0x4d/0x53 [ 1054.833147][ T7168] kasan_report_invalid_free+0x6d/0x80 [ 1054.838632][ T7168] ? snd_seq_port_disconnect+0x4c1/0x5c0 [ 1054.844383][ T7168] __kasan_slab_free+0x127/0x140 [ 1054.849321][ T7168] ? snd_seq_port_disconnect+0x4c1/0x5c0 [ 1054.854943][ T7168] kfree+0x103/0x2c0 [ 1054.858845][ T7168] snd_seq_port_disconnect+0x4c1/0x5c0 [ 1054.864417][ T7168] snd_seq_ioctl_unsubscribe_port+0x1fc/0x400 [ 1054.870476][ T7168] ? snd_seq_ioctl_running_mode+0x180/0x180 [ 1054.876354][ T7168] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 1054.882150][ T7168] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 1054.888110][ T7168] snd_seq_kernel_client_ctl+0xeb/0x130 [ 1054.893641][ T7168] snd_seq_oss_midi_close+0x36e/0x4d0 [ 1054.899026][ T7168] ? snd_seq_oss_midi_open_all+0xe0/0xe0 [ 1054.904642][ T7168] ? tomoyo_execute_permission+0x470/0x470 [ 1054.910431][ T7168] snd_seq_oss_synth_reset+0x418/0x860 [ 1054.915882][ T7168] ? snd_seq_oss_synth_cleanup+0x460/0x460 [ 1054.921690][ T7168] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 1054.927560][ T7168] snd_seq_oss_reset+0x6f/0x290 [ 1054.932397][ T7168] snd_seq_oss_ioctl+0xb7b/0xd40 [ 1054.937326][ T7168] ? snd_seq_oss_midi_info_user+0x140/0x140 [ 1054.943221][ T7168] ? __fget_files+0x294/0x400 [ 1054.947905][ T7168] odev_ioctl+0x4f/0x90 [ 1054.952056][ T7168] ? odev_open+0x90/0x90 [ 1054.956304][ T7168] ksys_ioctl+0x11a/0x180 [ 1054.960631][ T7168] __x64_sys_ioctl+0x6f/0xb0 [ 1054.965247][ T7168] ? lockdep_hardirqs_on+0x6a/0xe0 [ 1054.970357][ T7168] do_syscall_64+0x60/0xe0 [ 1054.974795][ T7168] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1054.980750][ T7168] RIP: 0033:0x45cc79 [ 1054.984623][ T7168] Code: 2d b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb b5 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1055.004216][ T7168] RSP: 002b:00007f8e9ed59c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1055.012622][ T7168] RAX: ffffffffffffffda RBX: 00000000000154c0 RCX: 000000000045cc79 [ 1055.020575][ T7168] RDX: 0000000000000000 RSI: 0000000000005100 RDI: 0000000000000003 [ 1055.028526][ T7168] RBP: 000000000078bfd8 R08: 0000000000000000 R09: 0000000000000000 [ 1055.038138][ T7168] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000078bfac [ 1055.046450][ T7168] R13: 00007ffc4facbfaf R14: 00007f8e9ed5a9c0 R15: 000000000078bfac [ 1055.055568][ T7168] Kernel Offset: disabled [ 1055.059892][ T7168] Rebooting in 86400 seconds..