[ 42.537911][ T23] audit: type=1800 audit(1575378076.036:29): pid=7932 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.92' (ECDSA) to the list of known hosts. 2019/12/03 13:01:27 fuzzer started 2019/12/03 13:01:29 dialing manager at 10.128.0.26:45711 2019/12/03 13:01:29 syscalls: 2689 2019/12/03 13:01:29 code coverage: enabled 2019/12/03 13:01:29 comparison tracing: enabled 2019/12/03 13:01:29 extra coverage: extra coverage is not supported by the kernel 2019/12/03 13:01:29 setuid sandbox: enabled 2019/12/03 13:01:29 namespace sandbox: enabled 2019/12/03 13:01:29 Android sandbox: /sys/fs/selinux/policy does not exist 2019/12/03 13:01:29 fault injection: enabled 2019/12/03 13:01:29 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/12/03 13:01:29 net packet injection: enabled 2019/12/03 13:01:29 net device setup: enabled 2019/12/03 13:01:29 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2019/12/03 13:01:29 devlink PCI setup: PCI device 0000:00:10.0 is not available 13:01:30 executing program 0: r0 = socket$inet6(0xa, 0x80003, 0x3) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2}, 0x1c) recvfrom$inet6(r0, 0x0, 0x0, 0x30060, 0x0, 0x0) 13:01:30 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$unix(0x1, 0x10004000000002, 0x0) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) unshare(0x400) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r3, 0x84, 0x18, 0x0, 0x0) syzkaller login: [ 57.378121][ T8098] IPVS: ftp: loaded support on port[0] = 21 [ 57.525418][ T8098] chnl_net:caif_netlink_parms(): no params data found 13:01:31 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f0000000080)={'lo\x00', {0x2, 0x0, @loopback}}) [ 57.603680][ T8098] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.612920][ T8098] bridge0: port 1(bridge_slave_0) entered disabled state [ 57.621281][ T8098] device bridge_slave_0 entered promiscuous mode [ 57.638942][ T8098] bridge0: port 2(bridge_slave_1) entered blocking state [ 57.648470][ T8101] IPVS: ftp: loaded support on port[0] = 21 [ 57.655482][ T8098] bridge0: port 2(bridge_slave_1) entered disabled state [ 57.668453][ T8098] device bridge_slave_1 entered promiscuous mode [ 57.752520][ T8098] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 57.770680][ T8098] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 57.825678][ T8103] IPVS: ftp: loaded support on port[0] = 21 [ 57.840811][ T8098] team0: Port device team_slave_0 added [ 57.885563][ T8098] team0: Port device team_slave_1 added 13:01:31 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) perf_event_open(&(0x7f0000000040)={0x2, 0x5f, 0xb4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000016000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 57.942609][ T8101] chnl_net:caif_netlink_parms(): no params data found [ 58.011691][ T8098] device hsr_slave_0 entered promiscuous mode [ 58.049551][ T8098] device hsr_slave_1 entered promiscuous mode 13:01:31 executing program 4: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000100)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x0, @dev}]}, &(0x7f0000000600)=0x10) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x6d, &(0x7f0000000480)={r3, @in6={{0xa, 0x0, 0x0, @mcast1}}}, &(0x7f0000000140)=0x2d3) [ 58.141782][ T8106] IPVS: ftp: loaded support on port[0] = 21 [ 58.158748][ T8101] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.166434][ T8101] bridge0: port 1(bridge_slave_0) entered disabled state [ 58.176082][ T8101] device bridge_slave_0 entered promiscuous mode [ 58.202989][ T8098] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 58.252541][ T8101] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.269462][ T8101] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.291012][ T8101] device bridge_slave_1 entered promiscuous mode [ 58.297996][ T8098] netdevsim netdevsim0 netdevsim1: renamed from eth1 13:01:31 executing program 5: vmsplice(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000000800)="fc44d7", 0x3}], 0x1, 0x0) pipe(&(0x7f00000004c0)) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0xabb, &(0x7f0000000100)=[{&(0x7f00000000c0)="800000003804000019000300e60100006c000000010000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0x4db, 0x400}], 0x4801, 0x0) [ 58.362590][ T8098] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 58.469971][ T8098] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 58.481483][ T8108] IPVS: ftp: loaded support on port[0] = 21 [ 58.530409][ T8101] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 58.542612][ T8101] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 58.564146][ T8101] team0: Port device team_slave_0 added [ 58.578358][ T8103] chnl_net:caif_netlink_parms(): no params data found [ 58.598532][ T8101] team0: Port device team_slave_1 added [ 58.652210][ T8101] device hsr_slave_0 entered promiscuous mode [ 58.689620][ T8101] device hsr_slave_1 entered promiscuous mode [ 58.739264][ T8101] debugfs: Directory 'hsr0' with parent '/' already present! [ 58.761237][ T8112] IPVS: ftp: loaded support on port[0] = 21 [ 58.777258][ T8103] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.784571][ T8103] bridge0: port 1(bridge_slave_0) entered disabled state [ 58.792545][ T8103] device bridge_slave_0 entered promiscuous mode [ 58.803414][ T8103] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.810572][ T8103] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.818264][ T8103] device bridge_slave_1 entered promiscuous mode [ 58.874603][ T8103] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 58.885814][ T8103] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 58.919197][ T8101] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 58.982420][ T8101] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 59.052563][ T8101] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 59.122430][ T8101] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 59.206476][ T8103] team0: Port device team_slave_0 added [ 59.213766][ T8103] team0: Port device team_slave_1 added [ 59.311823][ T8103] device hsr_slave_0 entered promiscuous mode [ 59.369556][ T8103] device hsr_slave_1 entered promiscuous mode [ 59.409218][ T8103] debugfs: Directory 'hsr0' with parent '/' already present! [ 59.471032][ T8112] chnl_net:caif_netlink_parms(): no params data found [ 59.486383][ T8098] 8021q: adding VLAN 0 to HW filter on device bond0 [ 59.514975][ T8106] chnl_net:caif_netlink_parms(): no params data found [ 59.530731][ T8103] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 59.592874][ T8103] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 59.650918][ T8108] chnl_net:caif_netlink_parms(): no params data found [ 59.665092][ T3699] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 59.673794][ T3699] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 59.691344][ T8103] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 59.745311][ T8103] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 59.792455][ T8098] 8021q: adding VLAN 0 to HW filter on device team0 [ 59.807293][ T8112] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.814670][ T8112] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.822683][ T8112] device bridge_slave_0 entered promiscuous mode [ 59.849200][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 59.857705][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 59.866655][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.873856][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 59.881921][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 59.890630][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 59.898807][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.905865][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 59.913304][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 59.931751][ T8106] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.938791][ T8106] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.946810][ T8106] device bridge_slave_0 entered promiscuous mode [ 59.955740][ T8106] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.963283][ T8106] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.971018][ T8106] device bridge_slave_1 entered promiscuous mode [ 59.984319][ T8112] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.992618][ T8112] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.000265][ T8112] device bridge_slave_1 entered promiscuous mode [ 60.017280][ T8112] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 60.030033][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 60.038503][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 60.052491][ T8108] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.062907][ T8108] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.071014][ T8108] device bridge_slave_0 entered promiscuous mode [ 60.078982][ T8108] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.086243][ T8108] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.094196][ T8108] device bridge_slave_1 entered promiscuous mode [ 60.105482][ T8112] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 60.127997][ T8098] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 60.138676][ T8098] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 60.156194][ T8106] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 60.169812][ T8116] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 60.178299][ T8116] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 60.186728][ T8116] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 60.195466][ T8116] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 60.203932][ T8116] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 60.212297][ T8116] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 60.221263][ T8116] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 60.229658][ T8116] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 60.241738][ T8116] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 60.249524][ T8116] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 60.285796][ T8106] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 60.309000][ T8112] team0: Port device team_slave_0 added [ 60.320335][ T8112] team0: Port device team_slave_1 added [ 60.331174][ T8118] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 60.338552][ T8118] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 60.350411][ T8101] 8021q: adding VLAN 0 to HW filter on device bond0 [ 60.361428][ T8108] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 60.377542][ T8108] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 60.441918][ T8112] device hsr_slave_0 entered promiscuous mode [ 60.479562][ T8112] device hsr_slave_1 entered promiscuous mode [ 60.519254][ T8112] debugfs: Directory 'hsr0' with parent '/' already present! [ 60.530050][ T8098] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 60.539878][ T8106] team0: Port device team_slave_0 added [ 60.557057][ T8116] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 60.565135][ T8116] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 60.579910][ T8106] team0: Port device team_slave_1 added [ 60.590874][ T8108] team0: Port device team_slave_0 added [ 60.598474][ T8108] team0: Port device team_slave_1 added [ 60.607327][ T8101] 8021q: adding VLAN 0 to HW filter on device team0 [ 60.651346][ T8106] device hsr_slave_0 entered promiscuous mode [ 60.700502][ T8106] device hsr_slave_1 entered promiscuous mode [ 60.740246][ T8106] debugfs: Directory 'hsr0' with parent '/' already present! [ 60.753213][ T8103] 8021q: adding VLAN 0 to HW filter on device bond0 [ 60.803782][ T8112] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 165.829068][ C1] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 165.836076][ C1] (detected by 1, t=10502 jiffies, g=6025, q=73) [ 165.842496][ C1] rcu: All QSes seen, last rcu_preempt kthread activity 10503 (4294953736-4294943233), jiffies_till_next_fqs=1, root ->qsmask 0x0 [ 165.855851][ C1] syz-executor.0 R running task 27912 8119 8098 0x0000400a [ 165.863748][ C1] Call Trace: [ 165.867022][ C1] [ 165.869868][ C1] sched_show_task+0x40f/0x560 [ 165.874630][ C1] rcu_sched_clock_irq+0x1861/0x1ad0 [ 165.879908][ C1] update_process_times+0x12d/0x180 [ 165.885093][ C1] tick_sched_timer+0x263/0x420 [ 165.889928][ C1] ? tick_setup_sched_timer+0x3d0/0x3d0 [ 165.895460][ C1] __hrtimer_run_queues+0x403/0x840 [ 165.900658][ C1] hrtimer_interrupt+0x38c/0xda0 [ 165.905600][ C1] ? debug_smp_processor_id+0x9/0x20 [ 165.910879][ C1] smp_apic_timer_interrupt+0x109/0x280 [ 165.916413][ C1] apic_timer_interrupt+0xf/0x20 [ 165.921332][ C1] [ 165.924258][ C1] RIP: 0010:__sanitizer_cov_trace_pc+0x1c/0x50 [ 165.930397][ C1] Code: cd 07 48 89 de e8 64 02 3b 00 5b 5d c3 cc 48 8b 04 24 65 48 8b 0c 25 c0 1d 02 00 65 8b 15 b8 81 8b 7e f7 c2 00 01 1f 00 75 2c <8b> 91 80 13 00 00 83 fa 02 75 21 48 8b 91 88 13 00 00 48 8b 32 48 [ 165.950002][ C1] RSP: 0018:ffffc90002637c38 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 [ 165.958409][ C1] RAX: ffffffff81487433 RBX: 0000000000000000 RCX: ffff888090194600 [ 165.966365][ C1] RDX: 0000000000000001 RSI: 00000000fffffffc RDI: ffffea0001b0dcc0 [ 165.974327][ C1] RBP: ffffc90002637c60 R08: dffffc0000000000 R09: fffffbfff12877ed [ 165.982294][ C1] R10: fffffbfff12877ed R11: 0000000000000000 R12: dffffc0000000000 [ 165.990251][ C1] R13: dffffc0000000000 R14: 00000000fffffffc R15: ffff88806c3b1428 [ 165.998222][ C1] ? mod_memcg_page_state+0x123/0x190 [ 166.003586][ C1] ? free_thread_stack+0x124/0x590 [ 166.008681][ C1] ? mod_memcg_page_state+0x123/0x190 [ 166.014038][ C1] free_thread_stack+0x168/0x590 [ 166.018965][ C1] put_task_stack+0xa3/0x130 [ 166.023543][ C1] finish_task_switch+0x3f1/0x550 [ 166.028561][ C1] __schedule+0x9a8/0xcc0 [ 166.032886][ C1] ? ___preempt_schedule+0x16/0x18 [ 166.038243][ C1] preempt_schedule+0xdb/0x120 [ 166.042992][ C1] ___preempt_schedule+0x16/0x18 [ 166.047916][ C1] ? do_group_exit+0x2a8/0x2b0 [ 166.052665][ C1] _raw_spin_unlock_irq+0x77/0x80 [ 166.057675][ C1] do_group_exit+0x2a8/0x2b0 [ 166.062258][ C1] __do_sys_exit_group+0x17/0x20 [ 166.067181][ C1] __se_sys_exit_group+0x14/0x20 [ 166.072104][ C1] __x64_sys_exit_group+0x3b/0x40 [ 166.077213][ C1] do_syscall_64+0xf7/0x1c0 [ 166.081708][ C1] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 166.087585][ C1] RIP: 0033:0x45a679 [ 166.091469][ C1] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 166.111182][ C1] RSP: 002b:00007ffe72d4ff88 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 166.119596][ C1] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 000000000045a679 [ 166.127561][ C1] RDX: 0000000000414211 RSI: fffffffffffffff7 RDI: 0000000000000000 [ 166.135521][ C1] RBP: 0000000000000000 R08: ffffffffffffffff R09: 00007ffe72d4ffe0 [ 166.143481][ C1] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000001 [ 166.151439][ C1] R13: 00007ffe72d4ffe0 R14: 0000000000000000 R15: 00007ffe72d4fff0 [ 166.159436][ C1] rcu: rcu_preempt kthread starved for 10535 jiffies! g6025 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 [ 166.170778][ C1] rcu: RCU grace-period kthread stack dump: [ 166.176654][ C1] rcu_preempt R running task 29104 10 2 0x80004000 [ 166.184539][ C1] Call Trace: [ 166.187824][ C1] __schedule+0x9a0/0xcc0 [ 166.192149][ C1] schedule+0x181/0x210 [ 166.196290][ C1] schedule_timeout+0x14f/0x240 [ 166.201225][ C1] ? run_local_timers+0x120/0x120 [ 166.206328][ C1] rcu_gp_kthread+0xed8/0x1770 [ 166.211448][ C1] kthread+0x332/0x350 [ 166.215618][ C1] ? rcu_report_qs_rsp+0x140/0x140 [ 166.220741][ C1] ? kthread_blkcg+0xe0/0xe0 [ 166.226102][ C1] ret_from_fork+0x24/0x30