[ 39.773178][ T26] audit: type=1800 audit(1571261022.879:27): pid=7672 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [ 39.807020][ T26] audit: type=1800 audit(1571261022.889:28): pid=7672 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2417 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 40.705825][ T26] audit: type=1800 audit(1571261023.879:29): pid=7672 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 40.725316][ T26] audit: type=1800 audit(1571261023.889:30): pid=7672 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.123' (ECDSA) to the list of known hosts. 2019/10/16 21:47:57 parsed 1 programs 2019/10/16 21:47:59 executed programs: 0 syzkaller login: [ 1496.691609][ T7852] IPVS: ftp: loaded support on port[0] = 21 [ 1496.691614][ T7850] IPVS: ftp: loaded support on port[0] = 21 [ 1496.699549][ T7844] IPVS: ftp: loaded support on port[0] = 21 [ 1496.714697][ T7853] IPVS: ftp: loaded support on port[0] = 21 [ 1496.714733][ T7846] IPVS: ftp: loaded support on port[0] = 21 [ 1496.740446][ T7848] IPVS: ftp: loaded support on port[0] = 21 [ 1496.925038][ T7852] chnl_net:caif_netlink_parms(): no params data found [ 1497.005608][ T7846] chnl_net:caif_netlink_parms(): no params data found [ 1497.056225][ T7850] chnl_net:caif_netlink_parms(): no params data found [ 1497.088238][ T7852] bridge0: port 1(bridge_slave_0) entered blocking state [ 1497.095323][ T7852] bridge0: port 1(bridge_slave_0) entered disabled state [ 1497.103525][ T7852] device bridge_slave_0 entered promiscuous mode [ 1497.114100][ T7852] bridge0: port 2(bridge_slave_1) entered blocking state [ 1497.121225][ T7852] bridge0: port 2(bridge_slave_1) entered disabled state [ 1497.128958][ T7852] device bridge_slave_1 entered promiscuous mode [ 1497.136185][ T7853] chnl_net:caif_netlink_parms(): no params data found [ 1497.144945][ T7844] chnl_net:caif_netlink_parms(): no params data found [ 1497.185131][ T7852] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1497.200223][ T7848] chnl_net:caif_netlink_parms(): no params data found [ 1497.221399][ T7846] bridge0: port 1(bridge_slave_0) entered blocking state [ 1497.228705][ T7846] bridge0: port 1(bridge_slave_0) entered disabled state [ 1497.236186][ T7846] device bridge_slave_0 entered promiscuous mode [ 1497.244855][ T7852] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1497.271958][ T7846] bridge0: port 2(bridge_slave_1) entered blocking state [ 1497.279649][ T7846] bridge0: port 2(bridge_slave_1) entered disabled state [ 1497.287393][ T7846] device bridge_slave_1 entered promiscuous mode [ 1497.305897][ T7850] bridge0: port 1(bridge_slave_0) entered blocking state [ 1497.313065][ T7850] bridge0: port 1(bridge_slave_0) entered disabled state [ 1497.321202][ T7850] device bridge_slave_0 entered promiscuous mode [ 1497.328386][ T7844] bridge0: port 1(bridge_slave_0) entered blocking state [ 1497.335431][ T7844] bridge0: port 1(bridge_slave_0) entered disabled state [ 1497.343625][ T7844] device bridge_slave_0 entered promiscuous mode [ 1497.354448][ T7844] bridge0: port 2(bridge_slave_1) entered blocking state [ 1497.361773][ T7844] bridge0: port 2(bridge_slave_1) entered disabled state [ 1497.369339][ T7844] device bridge_slave_1 entered promiscuous mode [ 1497.389956][ T7850] bridge0: port 2(bridge_slave_1) entered blocking state [ 1497.397572][ T7850] bridge0: port 2(bridge_slave_1) entered disabled state [ 1497.405063][ T7850] device bridge_slave_1 entered promiscuous mode [ 1497.423163][ T7852] team0: Port device team_slave_0 added [ 1497.433316][ T7852] team0: Port device team_slave_1 added [ 1497.447705][ T7853] bridge0: port 1(bridge_slave_0) entered blocking state [ 1497.454860][ T7853] bridge0: port 1(bridge_slave_0) entered disabled state [ 1497.462601][ T7853] device bridge_slave_0 entered promiscuous mode [ 1497.471188][ T7846] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1497.493480][ T7848] bridge0: port 1(bridge_slave_0) entered blocking state [ 1497.501498][ T7848] bridge0: port 1(bridge_slave_0) entered disabled state [ 1497.509860][ T7848] device bridge_slave_0 entered promiscuous mode [ 1497.516935][ T7853] bridge0: port 2(bridge_slave_1) entered blocking state [ 1497.523986][ T7853] bridge0: port 2(bridge_slave_1) entered disabled state [ 1497.534263][ T7853] device bridge_slave_1 entered promiscuous mode [ 1497.542013][ T7846] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1497.556055][ T7850] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1497.571263][ T7844] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1497.581721][ T7844] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1497.590988][ T7848] bridge0: port 2(bridge_slave_1) entered blocking state [ 1497.601026][ T7848] bridge0: port 2(bridge_slave_1) entered disabled state [ 1497.608688][ T7848] device bridge_slave_1 entered promiscuous mode [ 1497.628587][ T7850] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1497.689782][ T7852] device hsr_slave_0 entered promiscuous mode [ 1497.727321][ T7852] device hsr_slave_1 entered promiscuous mode [ 1497.777422][ T7846] team0: Port device team_slave_0 added [ 1497.797516][ T7850] team0: Port device team_slave_0 added [ 1497.804577][ T7853] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1497.818387][ T7848] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1497.829375][ T7846] team0: Port device team_slave_1 added [ 1497.835933][ T7848] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1497.855395][ T7844] team0: Port device team_slave_0 added [ 1497.862704][ T7850] team0: Port device team_slave_1 added [ 1497.869721][ T7853] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1497.888374][ T7844] team0: Port device team_slave_1 added [ 1497.895035][ T7848] team0: Port device team_slave_0 added [ 1497.902304][ T7848] team0: Port device team_slave_1 added [ 1497.908953][ T7852] bridge0: port 2(bridge_slave_1) entered blocking state [ 1497.916062][ T7852] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1497.923732][ T7852] bridge0: port 1(bridge_slave_0) entered blocking state [ 1497.930798][ T7852] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1497.948709][ T7853] team0: Port device team_slave_0 added [ 1498.029222][ T7846] device hsr_slave_0 entered promiscuous mode [ 1498.067561][ T7846] device hsr_slave_1 entered promiscuous mode [ 1498.117137][ T7846] debugfs: Directory 'hsr0' with parent '/' already present! [ 1498.125700][ T7853] team0: Port device team_slave_1 added [ 1498.136561][ T7856] bridge0: port 1(bridge_slave_0) entered disabled state [ 1498.146119][ T7856] bridge0: port 2(bridge_slave_1) entered disabled state [ 1498.199402][ T7848] device hsr_slave_0 entered promiscuous mode [ 1498.237450][ T7848] device hsr_slave_1 entered promiscuous mode [ 1498.297140][ T7848] debugfs: Directory 'hsr0' with parent '/' already present! [ 1498.359498][ T7850] device hsr_slave_0 entered promiscuous mode [ 1498.397305][ T7850] device hsr_slave_1 entered promiscuous mode [ 1498.437117][ T7850] debugfs: Directory 'hsr0' with parent '/' already present! [ 1498.498593][ T7844] device hsr_slave_0 entered promiscuous mode [ 1498.547396][ T7844] device hsr_slave_1 entered promiscuous mode [ 1498.587078][ T7844] debugfs: Directory 'hsr0' with parent '/' already present! [ 1498.650161][ T7853] device hsr_slave_0 entered promiscuous mode [ 1498.717245][ T7853] device hsr_slave_1 entered promiscuous mode [ 1498.797025][ T7853] debugfs: Directory 'hsr0' with parent '/' already present! [ 1498.893677][ T7852] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1498.928290][ T7856] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1498.936499][ T7856] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1498.960103][ T7848] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1498.978270][ T7852] 8021q: adding VLAN 0 to HW filter on device team0 [ 1498.991397][ T7853] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1499.003486][ T7846] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1499.014355][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1499.023779][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1499.033134][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 1499.040240][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1499.048953][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1499.057536][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1499.065812][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 1499.072895][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1499.086194][ T7848] 8021q: adding VLAN 0 to HW filter on device team0 [ 1499.096812][ T7850] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1499.109477][ T7844] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1499.123270][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1499.131417][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1499.139172][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1499.146753][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1499.154837][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1499.163555][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1499.179368][ T7846] 8021q: adding VLAN 0 to HW filter on device team0 [ 1499.188523][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1499.198542][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1499.206838][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 1499.213924][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1499.221937][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1499.230639][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1499.238996][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 1499.246020][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1499.253593][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1499.262140][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1499.269970][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1499.278866][ T7853] 8021q: adding VLAN 0 to HW filter on device team0 [ 1499.307199][ T7854] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1499.315038][ T7854] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1499.328196][ T7854] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1499.335764][ T7854] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1499.344779][ T7854] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1499.353475][ T7854] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1499.361816][ T7854] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1499.370323][ T7854] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1499.378728][ T7854] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1499.387310][ T7854] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1499.395581][ T7854] bridge0: port 1(bridge_slave_0) entered blocking state [ 1499.402754][ T7854] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1499.410377][ T7854] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1499.419026][ T7854] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1499.427424][ T7854] bridge0: port 2(bridge_slave_1) entered blocking state [ 1499.434539][ T7854] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1499.442088][ T7854] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1499.450644][ T7854] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1499.459473][ T7854] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1499.468138][ T7854] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1499.476371][ T7854] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1499.484997][ T7854] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1499.493392][ T7854] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1499.501879][ T7854] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1499.510554][ T7854] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1499.518405][ T7854] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1499.526128][ T7854] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1499.541966][ T7848] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1499.552874][ T7848] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1499.568099][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1499.576633][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1499.585136][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1499.594745][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1499.603750][ T2835] bridge0: port 1(bridge_slave_0) entered blocking state [ 1499.610827][ T2835] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1499.618653][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1499.627240][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1499.635683][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1499.644019][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1499.652680][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1499.660996][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1499.682736][ T7850] 8021q: adding VLAN 0 to HW filter on device team0 [ 1499.693290][ T7846] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1499.710168][ T7846] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1499.718742][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1499.726600][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1499.734903][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1499.742695][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1499.751332][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1499.760776][ T2835] bridge0: port 2(bridge_slave_1) entered blocking state [ 1499.767896][ T2835] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1499.775716][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1499.784740][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1499.793349][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1499.801647][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1499.814396][ T7844] 8021q: adding VLAN 0 to HW filter on device team0 [ 1499.837272][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1499.845077][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1499.853753][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1499.864447][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1499.873299][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1499.881898][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1499.890493][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1499.899102][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1499.908031][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1499.916225][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1499.924647][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1499.944592][ T7852] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1499.955873][ T7852] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1499.963952][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1499.973273][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1499.981622][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1499.990181][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1499.998708][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 1500.005805][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1500.013398][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1500.022257][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1500.030839][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 1500.037926][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1500.046522][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1500.055246][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1500.063877][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1500.072237][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 1500.079329][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1500.087976][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1500.097476][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1500.106049][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1500.119177][ T7846] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1500.128295][ T7848] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1500.155593][ T7853] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1500.165795][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1500.178778][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1500.187494][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1500.195755][ T2835] bridge0: port 2(bridge_slave_1) entered blocking state [ 1500.202891][ T2835] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1500.210723][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1500.219945][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1500.234753][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1500.243856][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1500.253400][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1500.262499][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1500.271870][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1500.284921][ T7852] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1500.307986][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1500.315822][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1500.334654][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1500.343911][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1500.358727][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1500.368218][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1500.376612][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1500.385279][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1500.402021][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1500.413730][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1500.443043][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1500.457550][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1500.465783][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1500.474432][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1500.486516][ T7850] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1500.498637][ T7853] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1500.508666][ T7844] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1500.575571][ C0] hrtimer: interrupt took 35380 ns [ 1500.583898][ T7850] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1500.650922][ T7844] 8021q: adding VLAN 0 to HW filter on device batadv0 2019/10/16 21:48:04 executed programs: 36 2019/10/16 21:48:09 executed programs: 237 2019/10/16 21:48:14 executed programs: 438 2019/10/16 21:48:19 executed programs: 639 2019/10/16 21:48:24 executed programs: 848 2019/10/16 21:48:29 executed programs: 1060 2019/10/16 21:48:34 executed programs: 1265 2019/10/16 21:48:39 executed programs: 1466 2019/10/16 21:48:44 executed programs: 1669 2019/10/16 21:48:49 executed programs: 1878 2019/10/16 21:48:55 executed programs: 2083 2019/10/16 21:49:00 executed programs: 2281 2019/10/16 21:49:05 executed programs: 2481 2019/10/16 21:49:10 executed programs: 2681 2019/10/16 21:49:15 executed programs: 2877 2019/10/16 21:49:20 executed programs: 3074 2019/10/16 21:49:25 executed programs: 3277 2019/10/16 21:49:30 executed programs: 3487 2019/10/16 21:49:35 executed programs: 3681 2019/10/16 21:49:40 executed programs: 3873 2019/10/16 21:49:45 executed programs: 4056 2019/10/16 21:49:50 executed programs: 4245 2019/10/16 21:49:55 executed programs: 4435 2019/10/16 21:50:00 executed programs: 4629 2019/10/16 21:50:05 executed programs: 4820 2019/10/16 21:50:10 executed programs: 5012 2019/10/16 21:50:15 executed programs: 5198 2019/10/16 21:50:20 executed programs: 5386 2019/10/16 21:50:25 executed programs: 5584 2019/10/16 21:50:30 executed programs: 5780 2019/10/16 21:50:35 executed programs: 5971 [ 1655.163887][T32454] ================================================================== [ 1655.172273][T32454] BUG: KASAN: use-after-free in rxrpc_release_call+0x3f3/0x540 [ 1655.172287][T32454] Read of size 8 at addr ffff8880a8475a50 by task syz-executor.4/32454 [ 1655.172290][T32454] [ 1655.172302][T32454] CPU: 0 PID: 32454 Comm: syz-executor.4 Not tainted 5.4.0-rc3+ #0 [ 1655.172306][T32454] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1655.172310][T32454] Call Trace: [ 1655.211710][T32454] dump_stack+0x1d8/0x2f8 [ 1655.216093][T32454] print_address_description+0x75/0x5c0 [ 1655.221675][T32454] ? vprintk_func+0x158/0x170 [ 1655.226347][T32454] ? printk+0x62/0x8d [ 1655.230318][T32454] ? vprintk_emit+0x2d4/0x3a0 [ 1655.234985][T32454] __kasan_report+0x14b/0x1c0 [ 1655.239661][T32454] ? rxrpc_release_call+0x3f3/0x540 [ 1655.244856][T32454] kasan_report+0x26/0x50 [ 1655.249178][T32454] __asan_report_load8_noabort+0x14/0x20 [ 1655.254782][T32454] rxrpc_release_call+0x3f3/0x540 [ 1655.259783][T32454] rxrpc_release_calls_on_socket+0x6b7/0x7e0 [ 1655.265735][T32454] ? rxrpc_release+0x2dc/0x460 [ 1655.270473][T32454] rxrpc_release+0x2dc/0x460 [ 1655.275108][T32454] sock_close+0xe1/0x260 [ 1655.279327][T32454] ? sock_mmap+0xa0/0xa0 [ 1655.283579][T32454] __fput+0x2e4/0x740 [ 1655.287542][T32454] ____fput+0x15/0x20 [ 1655.291524][T32454] task_work_run+0x17e/0x1b0 [ 1655.296097][T32454] prepare_exit_to_usermode+0x459/0x580 [ 1655.301670][T32454] syscall_return_slowpath+0x113/0x4a0 [ 1655.307153][T32454] do_syscall_64+0x11f/0x1c0 [ 1655.311756][T32454] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1655.317620][T32454] RIP: 0033:0x413741 [ 1655.321488][T32454] Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 1655.341062][T32454] RSP: 002b:00007fff690c3300 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 1655.349444][T32454] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 0000000000413741 [ 1655.357483][T32454] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 1655.365425][T32454] RBP: 0000000000000001 R08: ffffffffffffffff R09: ffffffffffffffff [ 1655.373368][T32454] R10: 00007fff690c33e0 R11: 0000000000000293 R12: 000000000075bf20 [ 1655.381310][T32454] R13: 000000000019413d R14: 0000000000761278 R15: 000000000075bf2c [ 1655.389261][T32454] [ 1655.391563][T32454] Allocated by task 32455: [ 1655.395952][T32454] __kasan_kmalloc+0x11c/0x1b0 [ 1655.400701][T32454] kasan_kmalloc+0x9/0x10 [ 1655.405044][T32454] kmem_cache_alloc_trace+0x221/0x2f0 [ 1655.410387][T32454] rxrpc_alloc_connection+0x79/0x490 [ 1655.415639][T32454] rxrpc_connect_call+0xb30/0x2c40 [ 1655.420732][T32454] rxrpc_new_client_call+0x6d5/0xb60 [ 1655.425987][T32454] rxrpc_do_sendmsg+0xf2b/0x19b0 [ 1655.430898][T32454] rxrpc_sendmsg+0x5eb/0x8b0 [ 1655.435475][T32454] ___sys_sendmsg+0x60d/0x910 [ 1655.440133][T32454] __sys_sendmmsg+0x239/0x470 [ 1655.444780][T32454] __x64_sys_sendmmsg+0xa0/0xb0 [ 1655.449607][T32454] do_syscall_64+0xf7/0x1c0 [ 1655.454099][T32454] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1655.459972][T32454] [ 1655.462271][T32454] Freed by task 9: [ 1655.465966][T32454] __kasan_slab_free+0x12a/0x1e0 [ 1655.470871][T32454] kasan_slab_free+0xe/0x10 [ 1655.475375][T32454] kfree+0x115/0x200 [ 1655.479239][T32454] rxrpc_destroy_connection+0x1ec/0x240 [ 1655.484806][T32454] rcu_core+0x843/0x1050 [ 1655.489020][T32454] rcu_core_si+0x9/0x10 [ 1655.493174][T32454] __do_softirq+0x333/0x7c4 [ 1655.497646][T32454] [ 1655.499946][T32454] The buggy address belongs to the object at ffff8880a8475800 [ 1655.499946][T32454] which belongs to the cache kmalloc-1k of size 1024 [ 1655.513984][T32454] The buggy address is located 592 bytes inside of [ 1655.513984][T32454] 1024-byte region [ffff8880a8475800, ffff8880a8475c00) [ 1655.527328][T32454] The buggy address belongs to the page: [ 1655.532934][T32454] page:ffffea0002a11d40 refcount:1 mapcount:0 mapping:ffff8880aa400c40 index:0xffff8880a8475000 [ 1655.543758][T32454] flags: 0x1fffc0000000200(slab) [ 1655.548670][T32454] raw: 01fffc0000000200 ffffea000285a648 ffffea00029ee008 ffff8880aa400c40 [ 1655.557234][T32454] raw: ffff8880a8475000 ffff8880a8475000 0000000100000001 0000000000000000 [ 1655.565797][T32454] page dumped because: kasan: bad access detected [ 1655.572187][T32454] [ 1655.574525][T32454] Memory state around the buggy address: [ 1655.580131][T32454] ffff8880a8475900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1655.588163][T32454] ffff8880a8475980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1655.596542][T32454] >ffff8880a8475a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1655.604571][T32454] ^ [ 1655.611215][T32454] ffff8880a8475a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1655.619247][T32454] ffff8880a8475b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1655.627280][T32454] ================================================================== [ 1655.635310][T32454] Disabling lock debugging due to kernel taint [ 1655.717003][T32454] Kernel panic - not syncing: panic_on_warn set ... [ 1655.723646][T32454] CPU: 1 PID: 32454 Comm: syz-executor.4 Tainted: G B 5.4.0-rc3+ #0 [ 1655.733104][ T3900] kobject: 'loop1' (0000000006e1199f): kobject_uevent_env [ 1655.733351][T32454] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1655.750485][T32454] Call Trace: [ 1655.752255][ T3900] kobject: 'loop1' (0000000006e1199f): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 1655.753768][T32454] dump_stack+0x1d8/0x2f8 [ 1655.753864][T32454] panic+0x264/0x7a9 [ 1655.772121][T32454] ? __kasan_report+0x195/0x1c0 [ 1655.777084][T32454] ? trace_hardirqs_on+0x34/0x80 [ 1655.782033][T32454] ? __kasan_report+0x195/0x1c0 [ 1655.786887][T32454] __kasan_report+0x1bb/0x1c0 [ 1655.791567][T32454] ? rxrpc_release_call+0x3f3/0x540 [ 1655.796765][T32454] kasan_report+0x26/0x50 [ 1655.801090][T32454] __asan_report_load8_noabort+0x14/0x20 [ 1655.804261][ T3900] kobject: 'loop2' (0000000086c97d2b): kobject_uevent_env [ 1655.806746][T32454] rxrpc_release_call+0x3f3/0x540 [ 1655.806757][T32454] rxrpc_release_calls_on_socket+0x6b7/0x7e0 [ 1655.806768][T32454] ? rxrpc_release+0x2dc/0x460 [ 1655.829614][T32454] rxrpc_release+0x2dc/0x460 [ 1655.834204][T32454] sock_close+0xe1/0x260 [ 1655.835653][ T3900] kobject: 'loop2' (0000000086c97d2b): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1655.838437][T32454] ? sock_mmap+0xa0/0xa0 [ 1655.838448][T32454] __fput+0x2e4/0x740 [ 1655.838458][T32454] ____fput+0x15/0x20 [ 1655.838467][T32454] task_work_run+0x17e/0x1b0 [ 1655.838479][T32454] prepare_exit_to_usermode+0x459/0x580 [ 1655.838489][T32454] syscall_return_slowpath+0x113/0x4a0 [ 1655.838503][T32454] do_syscall_64+0x11f/0x1c0 [ 1655.865693][ T3900] kobject: 'loop1' (0000000006e1199f): kobject_uevent_env [ 1655.870901][T32454] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1655.870910][T32454] RIP: 0033:0x413741 [ 1655.870919][T32454] Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 1655.870922][T32454] RSP: 002b:00007fff690c3300 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 1655.870929][T32454] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 0000000000413741 [ 1655.870934][T32454] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 1655.870938][T32454] RBP: 0000000000000001 R08: ffffffffffffffff R09: ffffffffffffffff [ 1655.870942][T32454] R10: 00007fff690c33e0 R11: 0000000000000293 R12: 000000000075bf20 [ 1655.870946][T32454] R13: 000000000019413d R14: 0000000000761278 R15: 000000000075bf2c [ 1655.872304][T32454] Kernel Offset: disabled [ 1655.971536][T32454] Rebooting in 86400 seconds..