[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 29.126789] kauditd_printk_skb: 7 callbacks suppressed [ 29.126801] audit: type=1800 audit(1542639706.312:29): pid=5902 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 29.160765] audit: type=1800 audit(1542639706.312:30): pid=5902 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.24' (ECDSA) to the list of known hosts. net.ipv6.conf.syz_tun.accept_dad = 0 net.ipv6.conf.syz_tun.router_solicitations = 0 syzkaller login: [ 36.893221] IPVS: ftp: loaded support on port[0] = 21 [ 37.150619] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.157397] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.164710] device bridge_slave_0 entered promiscuous mode [ 37.184418] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.190833] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.197792] device bridge_slave_1 entered promiscuous mode [ 37.215537] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 37.233540] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 37.283201] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 37.303204] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 37.379387] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 37.386726] team0: Port device team_slave_0 added [ 37.403474] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 37.410802] team0: Port device team_slave_1 added [ 37.428240] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 37.447374] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 37.467704] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 37.487120] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready RTNETLINK answers: Operation not supported RTNETLINK answers: No buffer space available RTNETLINK answers: Operation not supported [ 37.633917] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.640366] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.647168] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.653574] bridge0: port 1(bridge_slave_0) entered forwarding state RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Operation not supported RTNETLINK answers: Invalid argument RTNETLINK answers: Invalid argument RTNETLINK answers: Invalid argument [ 38.185838] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.238725] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 38.289764] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 38.295893] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 38.305045] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 38.355640] 8021q: adding VLAN 0 to HW filter on device team0 executing program [ 38.649259] ================================================================== [ 38.649419] kasan: CONFIG_KASAN_INLINE enabled [ 38.656966] BUG: KASAN: use-after-free in tick_sched_handle+0x16c/0x180 [ 38.656988] Read of size 8 at addr ffff8881c0895a30 by task syz-executor949/6058 [ 38.661705] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 38.668384] [ 38.668402] CPU: 0 PID: 6058 Comm: syz-executor949 Not tainted 4.20.0-rc2+ #303 [ 38.679525] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 38.683295] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 38.684918] CPU: 1 PID: 2938 Comm: kworker/1:2 Not tainted 4.20.0-rc2+ #303 [ 38.692341] Call Trace: [ 38.698558] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 38.707896] [ 38.714988] Workqueue: ipv6_addrconf addrconf_dad_work [ 38.717583] dump_stack+0x244/0x39d [ 38.726915] RIP: 0010:skb_set_owner_w+0xb4/0x320 [ 38.729049] ? dump_stack_print_info.cold.1+0x20/0x20 [ 38.734322] Code: ff df 48 c1 ea 03 80 3c 02 00 0f 85 30 02 00 00 49 8d 7c 24 12 4c 89 63 18 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 cd 01 00 00 [ 38.737931] ? printk+0xa7/0xcf [ 38.742663] RSP: 0018:ffff8881cb9274a8 EFLAGS: 00010203 [ 38.747843] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 38.766858] RAX: dffffc0000000000 RBX: ffff8881c2cf4bc0 RCX: ffffffff86273988 [ 38.770129] print_address_description.cold.7+0x9/0x1ff [ 38.775486] RDX: 000000000000000e RSI: ffffffff8625bddf RDI: 0000000000000074 [ 38.780228] kasan_report.cold.8+0x242/0x309 [ 38.787483] RBP: ffff8881cb9274d0 R08: ffff8881cb98e280 R09: ffffed103701800c [ 38.792848] ? tick_sched_handle+0x16c/0x180 [ 38.800098] R10: ffffed103701800c R11: ffff8881b80c0063 R12: 0000000000000062 [ 38.804492] __asan_report_load8_noabort+0x14/0x20 [ 38.811746] R13: ffff8881c2cf4bd8 R14: ffff8881c2cf4c20 R15: 0000000000000020 [ 38.816141] tick_sched_handle+0x16c/0x180 [ 38.823394] FS: 0000000000000000(0000) GS:ffff8881daf00000(0000) knlGS:0000000000000000 [ 38.828321] tick_sched_timer+0x45/0x130 [ 38.835583] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.839804] __hrtimer_run_queues+0x41c/0x10d0 [ 38.848012] CR2: 00007fff57a32ff8 CR3: 00000001cb905000 CR4: 00000000001406e0 [ 38.852067] ? tick_sched_do_timer+0x1a0/0x1a0 [ 38.857947] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 38.862547] ? hrtimer_start_range_ns+0xe00/0xe00 [ 38.869797] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 38.874368] ? pvclock_read_flags+0x160/0x160 [ 38.881607] Call Trace: [ 38.886459] ? trace_hardirqs_on+0x310/0x310 [ 38.893713] ndisc_alloc_skb+0x284/0x340 [ 38.898183] ? kvm_clock_read+0x18/0x30 [ 38.900747] ndisc_send_ns+0x194/0x8e0 [ 38.905150] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 38.909215] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 38.913172] ? ktime_get_update_offsets_now+0x3b3/0x540 [ 38.917042] ? ndisc_netdev_event+0x5b0/0x5b0 [ 38.922037] ? do_timer+0x50/0x50 [ 38.926602] ? trace_hardirqs_off_caller+0x310/0x310 [ 38.931951] ? rwlock_bug.part.2+0x90/0x90 [ 38.936432] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 38.939869] ? trace_hardirqs_on+0x310/0x310 [ 38.944961] ? check_preemption_disabled+0x48/0x280 [ 38.949173] ? rcu_softirq_qs+0x20/0x20 [ 38.954691] ? addrconf_dad_work+0xab8/0x1310 [ 38.959106] hrtimer_interrupt+0x313/0x780 [ 38.964118] ? addrconf_dad_work+0xab8/0x1310 [ 38.968089] smp_apic_timer_interrupt+0x1a1/0x760 [ 38.972574] addrconf_dad_work+0xbf2/0x1310 [ 38.976793] ? smp_call_function_single_interrupt+0x650/0x650 [ 38.981273] ? addrconf_ifdown+0x1650/0x1650 [ 38.986107] ? interrupt_entry+0xb5/0xc0 [ 38.990411] ? __lock_is_held+0xb5/0x140 [ 38.996278] ? trace_hardirqs_off_caller+0xbb/0x310 [ 39.000681] process_one_work+0xc90/0x1c40 [ 39.004718] ? trace_hardirqs_off_caller+0xbb/0x310 [ 39.008787] ? mark_held_locks+0x130/0x130 [ 39.013791] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 39.018009] ? pwq_dec_nr_in_flight+0x4a0/0x4a0 [ 39.023005] ? trace_hardirqs_on_caller+0x310/0x310 [ 39.027218] ? __switch_to_asm+0x40/0x70 [ 39.032098] ? trace_hardirqs_on_caller+0x310/0x310 [ 39.036750] ? __switch_to_asm+0x34/0x70 [ 39.041750] ? task_prio+0x50/0x50 [ 39.045794] ? __switch_to_asm+0x34/0x70 [ 39.050797] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 39.054842] ? __switch_to_asm+0x40/0x70 [ 39.058399] ? check_preemption_disabled+0x48/0x280 [ 39.062439] ? __switch_to_asm+0x34/0x70 [ 39.067960] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 39.071999] ? __switch_to_asm+0x40/0x70 [ 39.076999] apic_timer_interrupt+0xf/0x20 [ 39.081040] ? __switch_to_asm+0x34/0x70 [ 39.085858] [ 39.089905] ? __switch_to_asm+0x40/0x70 [ 39.094140] [ 39.098194] ? __schedule+0x8d7/0x21d0 [ 39.100424] Allocated by task 3230256160: [ 39.104480] ? lock_downgrade+0x900/0x900 [ 39.118216] ? zap_class+0x640/0x640 [ 39.121928] ? zap_class+0x640/0x640 [ 39.125646] ? find_held_lock+0x36/0x1c0 [ 39.129717] ? lock_acquire+0x1ed/0x520 [ 39.133689] ? worker_thread+0x3e0/0x1390 [ 39.137845] ? kasan_check_read+0x11/0x20 [ 39.142008] ? do_raw_spin_lock+0x14f/0x350 [ 39.146390] ? kasan_check_read+0x11/0x20 [ 39.150535] ? rwlock_bug.part.2+0x90/0x90 [ 39.154772] ? trace_hardirqs_on+0x310/0x310 [ 39.159185] worker_thread+0x17f/0x1390 [ 39.163157] ? __switch_to_asm+0x34/0x70 [ 39.167232] ? __switch_to_asm+0x40/0x70 [ 39.171298] ? __switch_to_asm+0x34/0x70 [ 39.175362] ? process_one_work+0x1c40/0x1c40 [ 39.179859] ? zap_class+0x640/0x640 [ 39.183574] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 39.188334] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 39.192926] ? retint_kernel+0x2d/0x2d [ 39.196852] ? __kthread_parkme+0xce/0x1a0 [ 39.201097] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 39.206193] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 39.211323] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 39.215908] ? trace_hardirqs_on+0xbd/0x310 [ 39.220233] ? kasan_check_read+0x11/0x20 [ 39.224383] ? __kthread_parkme+0xce/0x1a0 [ 39.228633] ? trace_hardirqs_off_caller+0x310/0x310 [ 39.233733] ? trace_hardirqs_off_caller+0x310/0x310 [ 39.238841] ? _raw_spin_unlock_irqrestore+0x6d/0xd0 [ 39.243943] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 39.249476] ? __kthread_parkme+0xfb/0x1a0 [ 39.253709] ? process_one_work+0x1c40/0x1c40 [ 39.258216] kthread+0x35a/0x440 [ 39.261581] ? kthread_stop+0x900/0x900 [ 39.265552] ret_from_fork+0x3a/0x50 [ 39.269264] Modules linked in: [ 39.272484] BUG: unable to handle kernel paging request at ffffffff8caa3e08 [ 39.275518] ---[ end trace 6c1017c956f17b9c ]--- [ 39.279588] PGD 946d067 P4D 946d067 PUD 946e063 PMD 0 [ 39.279606] Thread overran stack, or stack corrupted [ 39.279622] Oops: 0000 [#2] PREEMPT SMP KASAN [ 39.284376] RIP: 0010:skb_set_owner_w+0xb4/0x320 [ 39.289643] CPU: 0 PID: 6058 Comm: syz-executor949 Tainted: G D 4.20.0-rc2+ #303 [ 39.289651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 39.289666] RIP: 0010:depot_fetch_stack+0x10/0x30 [ 39.289683] Code: 89 e8 44 96 1c fe e9 87 fd ff ff e8 8a b0 a2 fd 90 90 90 90 90 90 90 90 90 90 89 f8 c1 ef 11 25 ff ff 1f 00 81 e7 f0 3f 00 00 <48> 03 3c c5 00 fa ad 8b 8b 47 0c 48 83 c7 18 c7 46 10 00 00 00 00 [ 39.297237] Code: ff df 48 c1 ea 03 80 3c 02 00 0f 85 30 02 00 00 49 8d 7c 24 12 4c 89 63 18 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 cd 01 00 00 [ 39.299239] RSP: 0018:ffff8881dae07a38 EFLAGS: 00010006 [ 39.299250] RAX: 00000000001f8881 RBX: ffff8881c089cb84 RCX: 0000000000000000 [ 39.299257] RDX: 0000000000000000 RSI: ffff8881dae07a40 RDI: 0000000000003ff0 [ 39.299265] RBP: ffff8881dae07a68 R08: ffff8881c1da0080 R09: ffffed103b5c3ef8 [ 39.299278] R10: ffffed103b5c3ef8 R11: ffff8881dae1f7c7 R12: ffffea0007022400 [ 39.304141] RSP: 0018:ffff8881cb9274a8 EFLAGS: 00010203 [ 39.312845] R13: ffff8881c0894b80 R14: ffff8881da802380 R15: ffff8881c089cb80 [ 39.312856] FS: 000000000137f880(0000) GS:ffff8881dae00000(0000) knlGS:0000000000000000 [ 39.312865] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 39.312878] CR2: ffffffff8caa3e08 CR3: 00000001c3bee000 CR4: 00000000001406f0 [ 39.323745] RAX: dffffc0000000000 RBX: ffff8881c2cf4bc0 RCX: ffffffff86273988 [ 39.327049] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 39.346150] RDX: 000000000000000e RSI: ffffffff8625bddf RDI: 0000000000000074 [ 39.364827] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 39.364832] Call Trace: [ 39.364838] [ 39.364854] ? print_track.isra.4+0x3b/0x6f [ 39.364871] print_address_description.cold.7+0x15b/0x1ff [ 39.370463] RBP: ffff8881cb9274d0 R08: ffff8881cb98e280 R09: ffffed103701800c [ 39.377485] kasan_report.cold.8+0x242/0x309 [ 39.384927] R10: ffffed103701800c R11: ffff8881b80c0063 R12: 0000000000000062 [ 39.392002] ? tick_sched_handle+0x16c/0x180 [ 39.392018] __asan_report_load8_noabort+0x14/0x20 [ 39.392036] tick_sched_handle+0x16c/0x180 [ 39.399505] R13: ffff8881c2cf4bd8 R14: ffff8881c2cf4c20 R15: 0000000000000020 [ 39.404653] tick_sched_timer+0x45/0x130 [ 39.412124] FS: 0000000000000000(0000) GS:ffff8881daf00000(0000) knlGS:0000000000000000 [ 39.420122] __hrtimer_run_queues+0x41c/0x10d0 [ 39.420140] ? tick_sched_do_timer+0x1a0/0x1a0 [ 39.420157] ? hrtimer_start_range_ns+0xe00/0xe00 [ 39.426185] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 39.433362] ? pvclock_read_flags+0x160/0x160 [ 39.433382] ? trace_hardirqs_on+0x310/0x310 [ 39.441575] CR2: ffffffffff600400 CR3: 00000001cb905000 CR4: 00000000001406e0 [ 39.447905] ? kvm_clock_read+0x18/0x30 [ 39.455437] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 39.462417] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 39.462445] ? ktime_get_update_offsets_now+0x3b3/0x540 [ 39.462460] ? do_timer+0x50/0x50 [ 39.465716] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 39.467197] ? rwlock_bug.part.2+0x90/0x90 [ 39.471674] Kernel panic - not syncing: Fatal exception [ 39.477020] ? trace_hardirqs_on+0x310/0x310 [ 39.611060] ? rcu_softirq_qs+0x20/0x20 [ 39.615036] hrtimer_interrupt+0x313/0x780 [ 39.619276] smp_apic_timer_interrupt+0x1a1/0x760 [ 39.624128] ? smp_call_function_single_interrupt+0x650/0x650 [ 39.630012] ? interrupt_entry+0xb5/0xc0 [ 39.634072] ? trace_hardirqs_off_caller+0xbb/0x310 [ 39.639097] ? trace_hardirqs_off_caller+0xbb/0x310 [ 39.644112] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 39.648955] ? trace_hardirqs_on_caller+0x310/0x310 [ 39.653968] ? trace_hardirqs_on_caller+0x310/0x310 [ 39.658980] ? task_prio+0x50/0x50 [ 39.662523] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 39.668063] ? check_preemption_disabled+0x48/0x280 [ 39.673080] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 39.677923] apic_timer_interrupt+0xf/0x20 [ 39.682147] [ 39.684373] Modules linked in: [ 39.687605] CR2: ffffffff8caa3e08 [ 39.691062] ---[ end trace 6c1017c956f17b9d ]--- [ 39.695814] RIP: 0010:skb_set_owner_w+0xb4/0x320 [ 39.700572] Code: ff df 48 c1 ea 03 80 3c 02 00 0f 85 30 02 00 00 49 8d 7c 24 12 4c 89 63 18 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 cd 01 00 00 [ 39.719470] RSP: 0018:ffff8881cb9274a8 EFLAGS: 00010203 [ 39.724828] RAX: dffffc0000000000 RBX: ffff8881c2cf4bc0 RCX: ffffffff86273988 [ 39.732090] RDX: 000000000000000e RSI: ffffffff8625bddf RDI: 0000000000000074 [ 39.739353] RBP: ffff8881cb9274d0 R08: ffff8881cb98e280 R09: ffffed103701800c [ 39.746618] R10: ffffed103701800c R11: ffff8881b80c0063 R12: 0000000000000062 [ 39.753894] R13: ffff8881c2cf4bd8 R14: ffff8881c2cf4c20 R15: 0000000000000020 [ 39.761160] FS: 000000000137f880(0000) GS:ffff8881dae00000(0000) knlGS:0000000000000000 [ 39.769391] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 39.775276] CR2: ffffffff8caa3e08 CR3: 00000001c3bee000 CR4: 00000000001406f0 [ 39.782549] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 39.789825] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 40.684013] Shutting down cpus with NMI [ 40.688945] Kernel Offset: disabled [ 40.692572] Rebooting in 86400 seconds..