[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.10.39' (ECDSA) to the list of known hosts. 2020/05/21 13:56:40 parsed 1 programs 2020/05/21 13:56:41 executed programs: 0 syzkaller login: [ 79.939640][ T7176] IPVS: ftp: loaded support on port[0] = 21 [ 80.030371][ T7176] chnl_net:caif_netlink_parms(): no params data found [ 80.078277][ T7176] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.085822][ T7176] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.093508][ T7176] device bridge_slave_0 entered promiscuous mode [ 80.102545][ T7176] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.110061][ T7176] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.118074][ T7176] device bridge_slave_1 entered promiscuous mode [ 80.136268][ T7176] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.146885][ T7176] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.168447][ T7176] team0: Port device team_slave_0 added [ 80.175547][ T7176] team0: Port device team_slave_1 added [ 80.193041][ T7176] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.200026][ T7176] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 80.226805][ T7176] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.239364][ T7176] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.246795][ T7176] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 80.273260][ T7176] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.347082][ T7176] device hsr_slave_0 entered promiscuous mode [ 80.384557][ T7176] device hsr_slave_1 entered promiscuous mode [ 80.523334][ T7176] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 80.566712][ T7176] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 80.616824][ T7176] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 80.656393][ T7176] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 80.738529][ T7176] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.745685][ T7176] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.753178][ T7176] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.760295][ T7176] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.801176][ T7176] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.813701][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 80.823412][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.831854][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.840945][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 80.854460][ T7176] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.864908][ T2729] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 80.873295][ T2729] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.880391][ T2729] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.890980][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 80.900198][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.907278][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.925875][ T2729] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 80.943274][ T7176] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 80.954094][ T7176] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 80.968801][ T2718] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 80.976790][ T2718] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 80.985350][ T2718] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 80.993695][ T2718] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 81.002909][ T2718] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 81.024894][ T7176] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.032268][ T2713] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 81.040060][ T2713] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 81.057865][ T2718] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 81.067123][ T2718] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 81.092464][ T7176] device veth0_vlan entered promiscuous mode [ 81.099540][ T2718] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 81.108276][ T2718] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 81.117169][ T2718] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 81.125081][ T2718] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 81.138417][ T7176] device veth1_vlan entered promiscuous mode [ 81.160413][ T7176] device veth0_macvtap entered promiscuous mode [ 81.168087][ T2718] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 81.176579][ T2718] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 81.184979][ T2718] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 81.193274][ T2718] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 81.202987][ T2718] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 81.213707][ T7176] device veth1_macvtap entered promiscuous mode [ 81.230714][ T7176] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.238530][ T2713] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 81.246854][ T2713] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 81.255534][ T2713] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 81.267901][ T7176] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.275673][ T2729] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 81.284730][ T2729] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 81.450542][ T7386] tipc: Started in network mode [ 81.455771][ T7386] tipc: Own node identity ff020000000000000000000000000001, cluster identity 4711 [ 81.465587][ T7386] tipc: Enabling of bearer rejected, failed to enable media [ 81.478824][ T7386] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor.0/7386 [ 81.488618][ T7386] caller is dst_cache_get+0x3a/0xb0 [ 81.493824][ T7386] CPU: 0 PID: 7386 Comm: syz-executor.0 Not tainted 5.7.0-rc1-next-20200415-syzkaller #0 [ 81.503614][ T7386] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 81.513823][ T7386] Call Trace: [ 81.517091][ T7386] dump_stack+0x188/0x20d [ 81.521396][ T7386] debug_smp_processor_id.cold+0x88/0x9b [ 81.526998][ T7386] dst_cache_get+0x3a/0xb0 [ 81.531385][ T7386] ? lock_downgrade+0x840/0x840 [ 81.536207][ T7386] tipc_udp_xmit.isra.0+0xb9/0xad0 [ 81.541292][ T7386] ? tipc_udp_addr2str+0x160/0x160 [ 81.546373][ T7386] ? tipc_crypto_xmit+0xb3e/0x2c70 [ 81.551465][ T7386] ? rcu_read_lock_held+0x9c/0xb0 [ 81.556481][ T7386] ? rcu_read_lock_held_common+0x130/0x130 [ 81.562261][ T7386] tipc_udp_send_msg+0x3e6/0x490 [ 81.567386][ T7386] tipc_bearer_xmit_skb+0x1de/0x3f0 [ 81.572552][ T7386] ? tipc_bearer_mtu+0x4d0/0x4d0 [ 81.577459][ T7386] ? tipc_disc_create+0x705/0xa90 [ 81.582470][ T7386] tipc_enable_bearer+0xb2f/0xd60 [ 81.587466][ T7386] ? tipc_bearer_xmit_skb+0x3f0/0x3f0 [ 81.592807][ T7386] ? __nla_validate_parse+0x2af/0x1cd0 [ 81.598253][ T7386] ? __tipc_nl_bearer_enable+0x2bf/0x390 [ 81.603856][ T7386] __tipc_nl_bearer_enable+0x2bf/0x390 [ 81.609289][ T7386] ? tipc_nl_bearer_disable+0x30/0x30 [ 81.614631][ T7386] ? mutex_trylock+0x2c0/0x2c0 [ 81.619474][ T7386] ? nla_memcpy+0xa0/0xa0 [ 81.623795][ T7386] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 81.629747][ T7386] ? __nla_parse+0x2e/0x60 [ 81.634139][ T7386] ? genl_family_rcv_msg_attrs_parse+0x1bd/0x320 [ 81.640458][ T7386] tipc_nl_bearer_enable+0x1e/0x30 [ 81.645551][ T7386] genl_rcv_msg+0x627/0xdf0 [ 81.650030][ T7386] ? genl_family_rcv_msg_attrs_parse+0x320/0x320 [ 81.656326][ T7386] ? __dev_queue_xmit+0xbf2/0x3070 [ 81.661415][ T7386] ? lock_release+0x800/0x800 [ 81.666083][ T7386] ? skb_splice_bits+0x1a0/0x1a0 [ 81.671011][ T7386] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 81.676786][ T7386] netlink_rcv_skb+0x15a/0x410 [ 81.681520][ T7386] ? genl_family_rcv_msg_attrs_parse+0x320/0x320 [ 81.687817][ T7386] ? netlink_ack+0xa10/0xa10 [ 81.692382][ T7386] genl_rcv+0x24/0x40 [ 81.696334][ T7386] netlink_unicast+0x537/0x740 [ 81.701070][ T7386] ? netlink_attachskb+0x810/0x810 [ 81.706150][ T7386] ? _copy_from_iter_full+0x25c/0x870 [ 81.711493][ T7386] ? __phys_addr_symbol+0x2c/0x70 [ 81.716500][ T7386] ? __check_object_size+0x171/0x437 [ 81.721755][ T7386] netlink_sendmsg+0x882/0xe10 [ 81.726494][ T7386] ? aa_af_perm+0x260/0x260 [ 81.730975][ T7386] ? netlink_unicast+0x740/0x740 [ 81.735887][ T7386] ? netlink_unicast+0x740/0x740 [ 81.740804][ T7386] sock_sendmsg+0xcf/0x120 [ 81.745210][ T7386] ____sys_sendmsg+0x6bf/0x7e0 [ 81.749967][ T7386] ? kernel_sendmsg+0x50/0x50 [ 81.754624][ T7386] ___sys_sendmsg+0x100/0x170 [ 81.759272][ T7386] ? sendmsg_copy_msghdr+0x70/0x70 [ 81.764374][ T7386] ? __fget_files+0x32f/0x500 [ 81.769054][ T7386] ? do_dup2+0x520/0x520 [ 81.773279][ T7386] ? __fget_light+0x20e/0x270 [ 81.777946][ T7386] __sys_sendmsg+0xec/0x1b0 [ 81.782430][ T7386] ? __sys_sendmsg_sock+0xb0/0xb0 [ 81.787443][ T7386] ? __x64_sys_futex+0x380/0x4f0 [ 81.792366][ T7386] ? trace_hardirqs_off_caller+0x55/0x230 [ 81.798073][ T7386] ? do_syscall_64+0x21/0x7d0 [ 81.802734][ T7386] do_syscall_64+0xf6/0x7d0 [ 81.807208][ T7386] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 81.813087][ T7386] RIP: 0033:0x45ca29 [ 81.816954][ T7386] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 81.836527][ T7386] RSP: 002b:00007fb0b5662c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 81.844907][ T7386] RAX: ffffffffffffffda RBX: 0000000000500640 RCX: 000000000045ca29 [ 81.852852][ T7386] RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003 [ 81.860795][ T7386] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 81.868741][ T7386] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 81.876685][ T7386] R13: 00000000000009e0 R14: 00000000004ccb11 R15: 00007fb0b56636d4 [ 81.889869][ T7386] tipc: Enabled bearer , priority 10