[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 15.014737] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 25.745044] random: sshd: uninitialized urandom read (32 bytes read) [ 26.117240] random: sshd: uninitialized urandom read (32 bytes read) [ 26.817326] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.14' (ECDSA) to the list of known hosts. [ 32.574136] random: sshd: uninitialized urandom read (32 bytes read) 2018/08/29 06:43:59 fuzzer started [ 33.802121] random: cc1: uninitialized urandom read (8 bytes read) 2018/08/29 06:44:01 dialing manager at 10.128.0.26:42957 2018/08/29 06:44:03 syscalls: 1 2018/08/29 06:44:03 code coverage: enabled 2018/08/29 06:44:03 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2018/08/29 06:44:03 setuid sandbox: enabled 2018/08/29 06:44:03 namespace sandbox: enabled 2018/08/29 06:44:03 fault injection: CONFIG_FAULT_INJECTION is not enabled 2018/08/29 06:44:03 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/08/29 06:44:03 net packed injection: enabled 2018/08/29 06:44:03 net device setup: enabled [ 38.147345] random: crng init done 06:44:30 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r0, 0x20000003) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0x80, 0x0) sendmmsg(r2, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r3, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") 06:44:30 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000003c0)='ip6_vti0\x00', 0xe) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x800000000000059, 0x0) recvfrom(0xffffffffffffffff, &(0x7f0000000080)=""/178, 0xb2, 0x0, &(0x7f00000001c0)=@nfc_llcp={0x27, 0x0, 0x0, 0x3, 0x0, 0x0, "1fbce1ddc0c935b67c9a4d85a750e5ffc68b107a56c4b6c186af8a51544f082a0ae86b993eb33dbbc235936185c0d0e7cb304c29169c0f28ca457e30d32768", 0x18}, 0x80) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}, 0x4}, 0x1c) ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000000)) 06:44:30 executing program 7: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={"7465616d5f736c6176655f31000f00", 0x0}) sendmsg$nl_route(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x8000a0}, 0xc, &(0x7f0000000040)={&(0x7f00000000c0)=@ipv6_newaddr={0x2c, 0x14, 0x509, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_LOCAL={0x14, 0x2, @local}]}, 0x2c}}, 0x0) 06:44:30 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000140)='pagemap\x00') ioctl$TCSETS(r0, 0x5402, &(0x7f00000002c0)={0xffffffffffffffff, 0x2, 0x3, 0x1, 0x0, 0x0, 0x7fff, 0x687a, 0x69, 0x0, 0x4, 0xac}) getsockopt$packet_buf(r0, 0x107, 0x0, &(0x7f0000001440)=""/4096, &(0x7f0000000300)=0xabf) r1 = memfd_create(&(0x7f0000000040)='/dev/loop#\x00', 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) flistxattr(r0, &(0x7f0000000280)=""/19, 0x13) socket$nl_generic(0x10, 0x3, 0x10) openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x0, 0x0) r2 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x7, 0x48000) ioctl$FICLONE(r2, 0x40049409, r1) sendfile(r1, r0, &(0x7f0000000080), 0x2000005) 06:44:30 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00', 0x200002, 0x0) lgetxattr(&(0x7f0000000340)='./file0/file0\x00', &(0x7f0000000380)=@known='system.posix_acl_default\x00', &(0x7f00000003c0)=""/52, 0x34) execve(&(0x7f0000000300)='./file0\x00', &(0x7f0000000500)=[&(0x7f0000000400)='em0\x00', &(0x7f0000000440)="276c6f066b657972696e672d706f7369785f61636c5f6163636573736c6f656d31", &(0x7f00000004c0)='7@\x00'], &(0x7f0000000780)=[&(0x7f0000000540)="276c6f066b657972696e672d706f7369785f61636c5f6163636573736c6f656d31", &(0x7f0000000580)='./cgroup\x00', &(0x7f0000000600)='./cgroup\x00', &(0x7f0000000640)='selinux]:vboxnet1#proc+@\x00', &(0x7f0000000700)="276c6f066b657972696e672d706f7369785f61636c5f6163636573736c6f656d31", &(0x7f0000000740)='vboxnet1\x00']) fchdir(r0) r1 = creat(&(0x7f0000001380)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000240)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f0000000000)='threaded\x00', 0xfffffdb9) getsockopt$inet_mreqn(r2, 0x0, 0x40000, &(0x7f00000000c0)={@multicast1, @multicast1}, &(0x7f00000005c0)) pread64(0xffffffffffffffff, &(0x7f00000007c0)=""/167, 0xa7, 0x0) fallocate(r1, 0x0, 0x0, 0x784e) openat$null(0xffffffffffffff9c, &(0x7f0000000880)='/dev/null\x00', 0x208000, 0x0) openat$cgroup_ro(r1, &(0x7f0000000100)='cgroup.stat\x00', 0x0, 0x0) recvfrom$unix(0xffffffffffffffff, &(0x7f0000000040)=""/111, 0x6f, 0x0, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) socketpair$inet(0x2, 0x7, 0x0, &(0x7f0000000480)) write$binfmt_script(r1, &(0x7f0000000280)=ANY=[@ANYBLOB='#! ./file0eyring-posix_acl_accessloem1\nR'], 0x28) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000680)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x1, 0x0, 0x10000000, 0x0, 0x2, 0x6, 0x0, 0x319, 0x40, 0x0, 0x0, 0x0, 0x38, 0x2, 0x80}, [{0x70000007, 0x0, 0x2, 0x0, 0x4, 0x7f, 0x0, 0xfffffffffffffff9}]}, 0x78) socket$inet(0x2, 0x0, 0x908a) 06:44:30 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg(r0, &(0x7f0000002000)=[{{&(0x7f0000000080)=@in={0x2, 0xc67a}, 0x80, &(0x7f0000000240), 0x0, &(0x7f000000ad00)}}, {{&(0x7f0000001c00)=@in={0x2, 0x4e23, @broadcast}, 0x80, &(0x7f0000000280), 0x0, &(0x7f00000002c0)}}], 0x2, 0x0) 06:44:30 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000140)='pagemap\x00') ioctl$TCSETS(r0, 0x5402, &(0x7f00000002c0)={0xffffffffffffffff, 0x2, 0x3, 0x1, 0xf, 0x0, 0x7fff, 0x687a, 0x69, 0x1, 0x4}) r1 = memfd_create(&(0x7f0000000040)='/dev/loop#\x00', 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) flistxattr(r0, &(0x7f0000000280)=""/19, 0x13) socket$nl_generic(0x10, 0x3, 0x10) openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x101000, 0x0) r2 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x7, 0x0) ioctl$FICLONE(r2, 0x40049409, r1) sendfile(r1, r0, &(0x7f0000000080), 0x2000005) 06:44:30 executing program 6: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6100) truncate(&(0x7f00000000c0)='./bus\x00', 0x800) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) lseek(r1, 0x0, 0x2) sendfile(r1, r2, &(0x7f0000000040), 0x8000fffffffe) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) pipe(&(0x7f0000000580)) sendmsg(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}, 0x0, 0x0, 0x3}}, 0x80, &(0x7f00000001c0), 0x0, &(0x7f0000001740)}, 0x0) creat(&(0x7f00000001c0)='./bus\x00', 0x0) [ 64.089948] IPVS: Creating netns size=2536 id=1 [ 64.173657] IPVS: Creating netns size=2536 id=2 [ 64.254747] IPVS: Creating netns size=2536 id=3 [ 64.293589] IPVS: Creating netns size=2536 id=4 [ 64.336537] IPVS: Creating netns size=2536 id=5 [ 64.385430] IPVS: Creating netns size=2536 id=6 [ 64.445290] IPVS: Creating netns size=2536 id=7 [ 64.508189] IPVS: Creating netns size=2536 id=8 [ 65.092109] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 65.151321] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 65.165024] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 65.179223] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 65.189132] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 65.200224] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 65.297808] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 65.362626] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 65.456028] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 65.484299] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 65.503168] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 65.525295] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 65.535468] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 65.550110] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 65.565246] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 65.605975] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 65.623292] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 65.630773] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 65.647155] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 65.664094] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 65.727030] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 65.749437] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 65.794971] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 65.810271] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 65.843873] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 65.870580] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 65.892439] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 65.916719] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 65.929807] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 65.942843] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 65.964269] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 65.990106] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 66.002480] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 66.012166] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 66.030317] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 66.039589] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 66.050352] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 66.062108] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 66.076309] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 66.086605] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 66.095804] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 66.103913] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 66.124050] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 66.131537] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 66.152578] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 66.160979] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 66.168828] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 66.177839] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 66.191401] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 66.208275] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 66.216434] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 66.224134] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 66.247191] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 66.257772] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 66.266467] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 66.276611] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 66.285653] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 66.304786] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 66.312171] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 66.319798] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 66.327236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 66.334807] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 66.342187] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 66.373553] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 66.434849] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 66.446353] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 66.455334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 66.500955] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 66.518464] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 66.526460] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 66.540975] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 66.550471] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 66.579193] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 66.599794] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 66.615894] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 66.623579] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 66.640722] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 66.658229] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 66.671587] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 66.689822] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 66.705960] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 66.714764] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 66.734392] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 66.742098] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 66.762280] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 66.772163] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 66.782663] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 66.795688] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 66.803298] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 66.810990] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 66.818718] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 66.842886] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 66.853530] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 66.861075] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 67.559160] ip (4757) used greatest stack depth: 23224 bytes left [ 69.282801] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 69.387307] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 69.420872] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 69.447582] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 69.462326] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 69.575858] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 69.582120] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 69.589703] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 69.605292] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 69.618280] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 69.628925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 69.649903] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 69.669309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 69.677407] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 69.691352] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 69.705000] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 69.714854] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 69.721565] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 69.736953] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 69.743870] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 69.858087] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 69.924853] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 69.940683] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 70.054004] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 70.060143] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 70.077468] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 70.125675] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 70.131820] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 70.141924] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 70.152523] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 70.160673] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 70.167985] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 06:44:38 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x40000, 0x24) ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x7ff, 0x13, 0x2, 0x10, "b1e1ddc693f227e9307f3ac65554f1c21d50753f0db975fb723548817b4fbd6562450c1c62d20c2afef78ea0d4aa57055789184135e2b58db0f64cf287a37298", "a65c80382b870d8179c17ab71b33bd91d6c519528817cd469051751e2142299a", [0x0, 0x6]}) ioctl$TIOCMGET(r1, 0x5415, &(0x7f0000000440)) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x27, &(0x7f00000002c0)={@multicast2, @multicast2}, 0xc) getsockopt$inet_mreqsrc(r1, 0x0, 0x25, &(0x7f0000000480)={@loopback, @broadcast, @multicast2}, &(0x7f0000000580)=0xc) r2 = perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x857, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) sendto$unix(r2, &(0x7f0000000300)="809162f654096e69fbe92fa2a4847e84c9c298210b93ce0300a0afadbae5b76699b22ce187a1d1aeae2fe07c084dec012516624c216b36b3d8b790121e2fb236effdf914e1cb5fb8477b07ce0d8e", 0x4e, 0x800, &(0x7f0000000380)=@file={0x1, './bus\x00'}, 0x6e) ioctl$int_in(r3, 0x5421, &(0x7f0000000040)=0x8ad) r4 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r4, 0x8912, &(0x7f0000000040)="0a5cc80700315f85714070") unshare(0x10100) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000000)={0x0, 0x0, 0x0, 0xfffffffffffffffd}) setsockopt$inet6_tcp_int(r3, 0x6, 0x19, &(0x7f000074fffc)=0x3, 0x572) r5 = dup(r3) setsockopt$inet6_tcp_int(r5, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f0000000080)=0x412, 0x4) socketpair$inet(0x2, 0x2, 0x200000000000, &(0x7f00000000c0)) setns(r1, 0x8004) ioctl$sock_inet_SIOCDELRT(r5, 0x890c, &(0x7f00000001c0)={0x2, {0x2, 0x4e21}, {0x2, 0x4e23}, {0x2, 0x4e20, @loopback}, 0xa56cc5f933fdfe1, 0xfffffffffffff974, 0x1000, 0x1e, 0x8e5, 0x0, 0xffffffffffffff00, 0x100002, 0x5}) bind$inet6(r3, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) socketpair$inet6_udp(0xa, 0x2, 0x0, &(0x7f0000000400)) sendto$inet6(r3, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x4e22, 0x9, @mcast1}, 0x1c) r6 = open(&(0x7f0000000500)='./file0\x00', 0x141042, 0x1) ftruncate(r6, 0x7fff) sendfile(r5, r6, &(0x7f0000d83ff8), 0x8000fffffffe) [ 71.359281] ================================================================== [ 71.366906] BUG: KASAN: slab-out-of-bounds in ip6_xmit+0x1838/0x1b80 [ 71.373398] Read of size 8 at addr ffff8801c530f658 by task syz-executor1/5924 [ 71.380761] [ 71.382394] CPU: 0 PID: 5924 Comm: syz-executor1 Not tainted 4.9.124-g09eb2ba #35 [ 71.390007] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 71.399358] ffff8801a5b9f530 ffffffff81eb95e9 ffffea000714c3c0 ffff8801c530f658 [ 71.407416] 0000000000000000 ffff8801c530f658 0000000000000040 ffff8801a5b9f568 [ 71.415477] ffffffff8156c35e ffff8801c530f658 0000000000000008 0000000000000000 [ 71.423560] Call Trace: [ 71.426143] [] dump_stack+0xc1/0x128 [ 71.431504] [] print_address_description+0x6c/0x234 [ 71.438165] [] kasan_report.cold.6+0x242/0x2fe [ 71.444395] [] ? ip6_xmit+0x1838/0x1b80 [ 71.450016] [] __asan_report_load8_noabort+0x14/0x20 [ 71.456788] [] ip6_xmit+0x1838/0x1b80 [ 71.462264] [] ? kasan_slab_free+0x72/0xc0 [ 71.468143] [] ? kfree+0xfb/0x310 [ 71.473239] [] ? skb_free_head+0x8b/0xb0 [ 71.478941] [] ? pskb_expand_head+0x45f/0x930 [ 71.485082] [] ? ip6_finish_output2+0x1d00/0x1d00 [ 71.491573] [] ? trace_hardirqs_on+0x10/0x10 [ 71.497645] [] ? __lock_is_held+0xa2/0xf0 [ 71.503444] [] ? ipv4_dst_check+0x111/0x160 [ 71.509426] [] ? __sk_dst_check+0x114/0x240 [ 71.515403] [] inet6_csk_xmit+0x27c/0x4d0 [ 71.521211] [] ? inet6_csk_xmit+0xff/0x4d0 [ 71.527092] [] ? inet6_csk_update_pmtu+0x160/0x160 [ 71.533669] [] ? check_preemption_disabled+0x3b/0x170 [ 71.540504] [] l2tp_xmit_skb+0xc45/0xf30 [ 71.546216] [] pppol2tp_sendmsg+0x4e0/0x790 [ 71.552179] [] ? selinux_socket_sendmsg+0x3f/0x50 [ 71.558662] [] ? pppol2tp_release+0x2e0/0x2e0 [ 71.564800] [] sock_sendmsg+0xcc/0x110 [ 71.570333] [] ___sys_sendmsg+0x47a/0x840 [ 71.576123] [] ? copy_msghdr_from_user+0x560/0x560 [ 71.582698] [] ? check_preemption_disabled+0x3b/0x170 [ 71.589533] [] ? __fget+0x20a/0x3b0 [ 71.594807] [] ? __fget+0x231/0x3b0 [ 71.600080] [] ? __fget+0x47/0x3b0 [ 71.605267] [] __sys_sendmmsg+0x23c/0x3d0 [ 71.611063] [] ? SyS_sendmsg+0x50/0x50 [ 71.616594] [] ? security_socket_connect+0x8f/0xc0 [ 71.623148] [] ? fput+0xd2/0x140 [ 71.628144] [] ? SYSC_connect+0x22a/0x300 [ 71.633922] [] ? SYSC_bind+0x280/0x280 [ 71.639437] [] ? compat_SyS_futex+0x1e1/0x2f0 [ 71.645568] [] ? compat_SyS_get_robust_list+0x310/0x310 [ 71.652569] [] ? SyS_socket+0x121/0x1b0 [ 71.658198] [] ? move_addr_to_kernel+0x50/0x50 [ 71.664435] [] compat_SyS_sendmmsg+0x32/0x40 [ 71.670470] [] ? compat_SyS_sendmsg+0x40/0x40 [ 71.676592] [] do_fast_syscall_32+0x2f7/0x870 [ 71.682713] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 71.689355] [] entry_SYSENTER_compat+0x90/0xa2 [ 71.695557] [ 71.697159] Allocated by task 0: [ 71.700493] (stack is not available) [ 71.704213] [ 71.705830] Freed by task 0: [ 71.708837] (stack is not available) [ 71.712521] [ 71.714124] The buggy address belongs to the object at ffff8801c530f640 [ 71.714124] which belongs to the cache ip_dst_cache of size 216 [ 71.726840] The buggy address is located 24 bytes inside of [ 71.726840] 216-byte region [ffff8801c530f640, ffff8801c530f718) [ 71.738595] The buggy address belongs to the page: [ 71.743497] page:ffffea000714c3c0 count:1 mapcount:0 mapping: (null) index:0xffff8801c530f140 [ 71.753053] flags: 0x8000000000000080(slab) [ 71.757344] page dumped because: kasan: bad access detected [ 71.763030] [ 71.764647] Memory state around the buggy address: [ 71.769563] ffff8801c530f500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 71.776895] ffff8801c530f580: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc [ 71.784229] >ffff8801c530f600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 71.791561] ^ [ 71.797773] ffff8801c530f680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc 06:44:38 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) socketpair$inet(0x2, 0x800, 0x6, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_netdev_private(r1, 0x89f1, &(0x7f0000000180)="5d354901ab57a2343ef62693e1bbf9df86de25947d889dd3913dfabe26982ade42c6ba1e0ed41abca47950ace5a950d670918b6c") r2 = memfd_create(&(0x7f0000000100)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b436bad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0xfffffffffffffffc) write(r2, &(0x7f0000000080)="e8", 0x1) symlink(&(0x7f00000001c0)='./bus/file0\x00', &(0x7f0000000200)='./bus/file0\x00') mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) ioctl$sock_inet_tcp_SIOCOUTQNSD(r2, 0x894b, &(0x7f0000000000)) sendfile(r2, r2, &(0x7f0000317000), 0xff8) unlink(&(0x7f0000000040)='./bus/file0\x00') 06:44:38 executing program 0: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x0, 0xffffffffffffffff}, 0x4) r1 = socket(0x200000000000011, 0x4000000000080002, 0x8) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000001c0)={'sit0\x00', 0x0}) bind$packet(r1, &(0x7f0000000040)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendto$inet6(r1, &(0x7f0000000200)="45000003b6f5af93cd3b2336d644d8a62b18e02816e85c107192622708f4c1720900f2f955085323c2fe5630e08644d75a08f6e623a27d020084e7360384eb8792f9be0900cbe01ba85000101f82fd9475f9d8cea59b06e0909077c8cad8f10a981ec8c405e2108afea9eff924d0e15ffa50656a40c97dc30300d43eb8410ac1887e5e1b5cb2d253ea2a9c", 0x8b, 0x0, 0x0, 0x0) lremovexattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)=@random={'security.', 'sit0\x00'}) 06:44:38 executing program 7: fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setpipe(r1, 0x407, 0x6) write$cgroup_pid(r1, &(0x7f00000002c0), 0x12) ftruncate(r1, 0x800007) write$binfmt_script(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="2321202e2f627573202e2f6367726f75702e63707500202e2f6367726f75702e63707500202e2f6367726f75702e637075000a4ff4775ab2675a1208cf4c0a7c690f84d3c5c8c333ea4ccd709b1e0077367c6606e836697c6c768cd5ff02c84698497f9bb6f34e785d2ddec3ac6856b4166131a1567f5afeaee84fb60e95cb"], 0x7f) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000180)={'syz1'}, 0x4) r2 = open(&(0x7f0000000000)='./bus\x00', 0x4000, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x3f, &(0x7f0000000100)=@fragment={0x16, 0x0, 0x200, 0x8000000000000000, 0x0, 0x9}, 0x8) sendfile(r1, r2, &(0x7f0000d83ff8), 0x8000fffffffe) ioctl$EVIOCGEFFECTS(r2, 0x80044584, &(0x7f00000001c0)=""/97) fsync(r1) [ 71.805212] ffff8801c530f700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 71.812545] ================================================================== [ 71.819882] Disabling lock debugging due to kernel taint [ 71.825369] Kernel panic - not syncing: panic_on_warn set ... [ 71.825369] [ 71.832731] CPU: 0 PID: 5924 Comm: syz-executor1 Tainted: G B 4.9.124-g09eb2ba #35 [ 71.841563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 71.850910] ffff8801a5b9f490 ffffffff81eb95e9 ffffffff843c828b 00000000ffffffff 06:44:38 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000140)='pagemap\x00') ioctl$TCSETS(r0, 0x5402, &(0x7f00000002c0)={0xffffffffffffffff, 0x2, 0x3, 0x1, 0x0, 0x0, 0x7fff, 0x687a, 0x69, 0x0, 0x4, 0xac}) getsockopt$packet_buf(r0, 0x107, 0x0, &(0x7f0000001440)=""/4096, &(0x7f0000000300)=0xabf) r1 = memfd_create(&(0x7f0000000040)='/dev/loop#\x00', 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) flistxattr(r0, &(0x7f0000000280)=""/19, 0x13) socket$nl_generic(0x10, 0x3, 0x10) openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x0, 0x0) r2 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x7, 0x48000) ioctl$FICLONE(r2, 0x40049409, r1) sendfile(r1, r0, &(0x7f0000000080), 0x2000005) [ 71.858970] 0000000000000000 0000000000000000 0000000000000040 ffff8801a5b9f550 [ 71.867033] ffffffff81423eb5 0000000041b58ab3 ffffffff843bb8e8 ffffffff81423cf6 [ 71.875096] Call Trace: [ 71.877681] [] dump_stack+0xc1/0x128 [ 71.883041] [] panic+0x1bf/0x3bc [ 71.888033] [] ? add_taint.cold.6+0x16/0x16 [ 71.893986] [] kasan_end_report+0x47/0x4f [ 71.899771] [] kasan_report.cold.6+0x76/0x2fe [ 71.905906] [] ? ip6_xmit+0x1838/0x1b80 [ 71.911505] [] __asan_report_load8_noabort+0x14/0x20 [ 71.918233] [] ip6_xmit+0x1838/0x1b80 [ 71.923657] [] ? kasan_slab_free+0x72/0xc0 [ 71.929536] [] ? kfree+0xfb/0x310 [ 71.934617] [] ? skb_free_head+0x8b/0xb0 [ 71.940303] [] ? pskb_expand_head+0x45f/0x930 [ 71.946423] [] ? ip6_finish_output2+0x1d00/0x1d00 [ 71.952895] [] ? trace_hardirqs_on+0x10/0x10 [ 71.958930] [] ? __lock_is_held+0xa2/0xf0 [ 71.964711] [] ? ipv4_dst_check+0x111/0x160 [ 71.970677] [] ? __sk_dst_check+0x114/0x240 [ 71.976627] [] inet6_csk_xmit+0x27c/0x4d0 [ 71.982418] [] ? inet6_csk_xmit+0xff/0x4d0 [ 71.988279] [] ? inet6_csk_update_pmtu+0x160/0x160 [ 71.994847] [] ? check_preemption_disabled+0x3b/0x170 [ 72.001692] [] l2tp_xmit_skb+0xc45/0xf30 [ 72.007375] [] pppol2tp_sendmsg+0x4e0/0x790 [ 72.013323] [] ? selinux_socket_sendmsg+0x3f/0x50 [ 72.019793] [] ? pppol2tp_release+0x2e0/0x2e0 [ 72.025930] [] sock_sendmsg+0xcc/0x110 [ 72.031443] [] ___sys_sendmsg+0x47a/0x840 [ 72.037214] [] ? copy_msghdr_from_user+0x560/0x560 [ 72.043790] [] ? check_preemption_disabled+0x3b/0x170 [ 72.050602] [] ? __fget+0x20a/0x3b0 [ 72.055871] [] ? __fget+0x231/0x3b0 [ 72.061134] [] ? __fget+0x47/0x3b0 [ 72.066297] [] __sys_sendmmsg+0x23c/0x3d0 [ 72.072069] [] ? SyS_sendmsg+0x50/0x50 [ 72.077583] [] ? security_socket_connect+0x8f/0xc0 [ 72.084158] [] ? fput+0xd2/0x140 [ 72.089159] [] ? SYSC_connect+0x22a/0x300 [ 72.094933] [] ? SYSC_bind+0x280/0x280 [ 72.100453] [] ? compat_SyS_futex+0x1e1/0x2f0 [ 72.106575] [] ? compat_SyS_get_robust_list+0x310/0x310 [ 72.113579] [] ? SyS_socket+0x121/0x1b0 [ 72.119184] [] ? move_addr_to_kernel+0x50/0x50 [ 72.125393] [] compat_SyS_sendmmsg+0x32/0x40 [ 72.131429] [] ? compat_SyS_sendmsg+0x40/0x40 [ 72.137550] [] do_fast_syscall_32+0x2f7/0x870 [ 72.143672] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 72.150312] [] entry_SYSENTER_compat+0x90/0xa2 [ 72.156907] Dumping ftrace buffer: [ 72.160424] (ftrace buffer empty) [ 72.164109] Kernel Offset: disabled [ 72.167709] Rebooting in 86400 seconds..