Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.1.3' (ECDSA) to the list of known hosts. syzkaller login: [ 62.608776][ T8491] IPVS: ftp: loaded support on port[0] = 21 [ 62.706139][ T8491] chnl_net:caif_netlink_parms(): no params data found [ 62.760020][ T8491] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.767545][ T8491] bridge0: port 1(bridge_slave_0) entered disabled state [ 62.779940][ T8491] device bridge_slave_0 entered promiscuous mode [ 62.790593][ T8491] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.797748][ T8491] bridge0: port 2(bridge_slave_1) entered disabled state [ 62.807583][ T8491] device bridge_slave_1 entered promiscuous mode [ 62.831788][ T8491] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 62.843336][ T8491] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 62.874469][ T8491] team0: Port device team_slave_0 added [ 62.882772][ T8491] team0: Port device team_slave_1 added [ 62.900707][ T8491] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 62.907649][ T8491] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 62.934886][ T8491] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 62.949097][ T8491] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 62.956035][ T8491] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 62.982166][ T8491] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 63.009105][ T8491] device hsr_slave_0 entered promiscuous mode [ 63.015873][ T8491] device hsr_slave_1 entered promiscuous mode [ 63.112829][ T8491] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 63.122495][ T8491] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 63.132629][ T8491] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 63.143397][ T8491] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 63.169052][ T8491] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.176287][ T8491] bridge0: port 2(bridge_slave_1) entered forwarding state [ 63.184069][ T8491] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.191214][ T8491] bridge0: port 1(bridge_slave_0) entered forwarding state [ 63.236501][ T8491] 8021q: adding VLAN 0 to HW filter on device bond0 [ 63.250440][ T3194] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 63.261834][ T3194] bridge0: port 1(bridge_slave_0) entered disabled state [ 63.270020][ T3194] bridge0: port 2(bridge_slave_1) entered disabled state [ 63.277725][ T3194] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 63.290920][ T8491] 8021q: adding VLAN 0 to HW filter on device team0 [ 63.302356][ T3194] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 63.311091][ T3194] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.318202][ T3194] bridge0: port 1(bridge_slave_0) entered forwarding state [ 63.329486][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 63.337879][ T34] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.345109][ T34] bridge0: port 2(bridge_slave_1) entered forwarding state [ 63.369674][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 63.379482][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 63.387741][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 63.397179][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 63.408436][ T3194] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 63.421360][ T8491] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 63.438004][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 63.445535][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 63.461369][ T8491] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 63.480195][ T3002] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 63.498946][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 63.507139][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 63.515239][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 63.525813][ T8491] device veth0_vlan entered promiscuous mode [ 63.540102][ T8491] device veth1_vlan entered promiscuous mode [ 63.561200][ T3002] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 63.569325][ T3002] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 63.577278][ T3002] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 63.589701][ T8491] device veth0_macvtap entered promiscuous mode [ 63.600717][ T8491] device veth1_macvtap entered promiscuous mode [ 63.617866][ T8491] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 63.625792][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 63.635516][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 63.647492][ T8491] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 63.655857][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready executing program [ 63.666575][ T8491] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.679359][ T8491] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.688673][ T8491] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.697343][ T8491] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.742925][ T8491] ================================================================== [ 63.751128][ T8491] BUG: KASAN: use-after-free in ipvlan_queue_xmit+0x1588/0x18a0 [ 63.758734][ T8491] Read of size 4 at addr ffff8880145eafff by task syz-executor516/8491 [ 63.766938][ T8491] [ 63.769248][ T8491] CPU: 1 PID: 8491 Comm: syz-executor516 Not tainted 5.10.0-syzkaller #0 [ 63.777652][ T8491] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 63.787686][ T8491] Call Trace: [ 63.790957][ T8491] dump_stack+0x107/0x163 [ 63.795306][ T8491] ? ipvlan_queue_xmit+0x1588/0x18a0 [ 63.800566][ T8491] ? ipvlan_queue_xmit+0x1588/0x18a0 [ 63.805827][ T8491] print_address_description.constprop.0.cold+0xae/0x4c8 [ 63.812837][ T8491] ? _raw_spin_lock_irqsave+0x4e/0x50 [ 63.818201][ T8491] ? vprintk_func+0x95/0x1e0 [ 63.822770][ T8491] ? ipvlan_queue_xmit+0x1588/0x18a0 [ 63.828110][ T8491] ? ipvlan_queue_xmit+0x1588/0x18a0 [ 63.833397][ T8491] kasan_report.cold+0x1f/0x37 [ 63.838151][ T8491] ? ipvlan_queue_xmit+0x1588/0x18a0 [ 63.843418][ T8491] ipvlan_queue_xmit+0x1588/0x18a0 [ 63.848573][ T8491] ? ipvlan_handle_mode_l3+0x140/0x140 [ 63.854032][ T8491] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 63.859912][ T8491] ? find_held_lock+0x2d/0x110 [ 63.864655][ T8491] ? skb_crc32c_csum_help+0x70/0x70 [ 63.869855][ T8491] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 63.875834][ T8491] ? __might_fault+0xd3/0x180 [ 63.880494][ T8491] ? validate_xmit_xfrm+0x460/0x1040 [ 63.885757][ T8491] ? netif_skb_features+0x55f/0xaa0 [ 63.890940][ T8491] ipvlan_start_xmit+0x45/0x190 [ 63.895772][ T8491] __dev_direct_xmit+0x527/0x730 [ 63.900689][ T8491] ? validate_xmit_skb_list+0x120/0x120 [ 63.906225][ T8491] ? netdev_pick_tx+0x150/0xb50 [ 63.911054][ T8491] ? prb_fill_curr_block+0x5d0/0x5d0 [ 63.916319][ T8491] packet_direct_xmit+0x1a5/0x280 [ 63.921334][ T8491] packet_sendmsg+0x2413/0x52b0 [ 63.926178][ T8491] ? aa_sk_perm+0x316/0xaa0 [ 63.930659][ T8491] ? packet_cached_dev_get+0x250/0x250 [ 63.936104][ T8491] ? aa_af_perm+0x230/0x230 [ 63.940602][ T8491] ? find_held_lock+0x2d/0x110 [ 63.945356][ T8491] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 63.950618][ T8491] ? packet_cached_dev_get+0x250/0x250 [ 63.956054][ T8491] sock_sendmsg+0xcf/0x120 [ 63.960464][ T8491] __sys_sendto+0x21c/0x320 [ 63.965065][ T8491] ? __ia32_sys_getpeername+0xb0/0xb0 [ 63.970416][ T8491] ? packet_do_bind+0x454/0xc00 [ 63.975262][ T8491] ? __sys_bind+0x111/0x250 [ 63.979746][ T8491] ? __ia32_sys_socketpair+0xf0/0xf0 [ 63.985013][ T8491] ? __sys_socket+0x16d/0x200 [ 63.989674][ T8491] __x64_sys_sendto+0xdd/0x1b0 [ 63.994423][ T8491] ? lockdep_hardirqs_on+0x79/0x100 [ 63.999613][ T8491] ? syscall_enter_from_user_mode+0x1d/0x50 [ 64.005491][ T8491] do_syscall_64+0x2d/0x70 [ 64.009901][ T8491] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 64.015783][ T8491] RIP: 0033:0x444ce9 [ 64.019658][ T8491] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db 0b fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 64.039237][ T8491] RSP: 002b:00007fffef7f1428 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 64.047627][ T8491] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000444ce9 [ 64.055573][ T8491] RDX: 000000000000000e RSI: 0000000020000000 RDI: 0000000000000004 [ 64.063521][ T8491] RBP: 00007fffef7f1460 R08: 0000000000000000 R09: ffffffffffffff09 [ 64.071471][ T8491] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffef7f1490 [ 64.079421][ T8491] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 64.087377][ T8491] [ 64.089696][ T8491] Allocated by task 8394: [ 64.094002][ T8491] kasan_save_stack+0x1b/0x40 [ 64.098653][ T8491] __kasan_kmalloc.constprop.0+0xc2/0xd0 [ 64.104264][ T8491] kmem_cache_alloc+0x1c6/0x440 [ 64.109097][ T8491] getname_flags.part.0+0x50/0x4f0 [ 64.114183][ T8491] getname+0x8e/0xd0 [ 64.118054][ T8491] do_sys_openat2+0xf5/0x420 [ 64.122630][ T8491] __x64_sys_open+0x119/0x1c0 [ 64.127282][ T8491] do_syscall_64+0x2d/0x70 [ 64.131675][ T8491] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 64.137536][ T8491] [ 64.139840][ T8491] Freed by task 8394: [ 64.143798][ T8491] kasan_save_stack+0x1b/0x40 [ 64.148450][ T8491] kasan_set_track+0x1c/0x30 [ 64.153013][ T8491] kasan_set_free_info+0x1b/0x30 [ 64.157922][ T8491] __kasan_slab_free+0x102/0x140 [ 64.162843][ T8491] slab_free_freelist_hook+0x5d/0x150 [ 64.168191][ T8491] kmem_cache_free+0x82/0x350 [ 64.172839][ T8491] putname+0xe1/0x120 [ 64.176795][ T8491] do_sys_openat2+0x153/0x420 [ 64.181449][ T8491] __x64_sys_open+0x119/0x1c0 [ 64.186109][ T8491] do_syscall_64+0x2d/0x70 [ 64.190503][ T8491] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 64.196367][ T8491] [ 64.198672][ T8491] The buggy address belongs to the object at ffff8880145ea200 [ 64.198672][ T8491] which belongs to the cache names_cache of size 4096 [ 64.212793][ T8491] The buggy address is located 3583 bytes inside of [ 64.212793][ T8491] 4096-byte region [ffff8880145ea200, ffff8880145eb200) [ 64.226210][ T8491] The buggy address belongs to the page: [ 64.231823][ T8491] page:0000000009c3b4bf refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x145e8 [ 64.241944][ T8491] head:0000000009c3b4bf order:3 compound_mapcount:0 compound_pincount:0 [ 64.250240][ T8491] flags: 0xfff00000010200(slab|head) [ 64.255505][ T8491] raw: 00fff00000010200 dead000000000100 dead000000000122 ffff8880101c5280 [ 64.264065][ T8491] raw: 0000000000000000 0000000000070007 00000001ffffffff 0000000000000000 [ 64.272619][ T8491] page dumped because: kasan: bad access detected [ 64.279002][ T8491] [ 64.281349][ T8491] Memory state around the buggy address: [ 64.286955][ T8491] ffff8880145eae80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 64.295004][ T8491] ffff8880145eaf00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 64.303045][ T8491] >ffff8880145eaf80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 64.311082][ T8491] ^ [ 64.319036][ T8491] ffff8880145eb000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 64.327079][ T8491] ffff8880145eb080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 64.335815][ T8491] ================================================================== [ 64.343848][ T8491] Disabling lock debugging due to kernel taint [ 64.350055][ T8491] Kernel panic - not syncing: panic_on_warn set ... [ 64.356644][ T8491] CPU: 1 PID: 8491 Comm: syz-executor516 Tainted: G B 5.10.0-syzkaller #0 [ 64.366435][ T8491] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.376483][ T8491] Call Trace: [ 64.379774][ T8491] dump_stack+0x107/0x163 [ 64.384109][ T8491] ? ipvlan_queue_xmit+0x14d0/0x18a0 [ 64.389381][ T8491] panic+0x306/0x73d [ 64.393255][ T8491] ? __warn_printk+0xf3/0xf3 [ 64.397814][ T8491] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 64.403941][ T8491] ? trace_hardirqs_on+0x51/0x1c0 [ 64.408938][ T8491] ? ipvlan_queue_xmit+0x1588/0x18a0 [ 64.414195][ T8491] ? ipvlan_queue_xmit+0x1588/0x18a0 [ 64.419451][ T8491] end_report+0x58/0x5e [ 64.423616][ T8491] kasan_report.cold+0xd/0x37 [ 64.428267][ T8491] ? ipvlan_queue_xmit+0x1588/0x18a0 [ 64.433523][ T8491] ipvlan_queue_xmit+0x1588/0x18a0 [ 64.438607][ T8491] ? ipvlan_handle_mode_l3+0x140/0x140 [ 64.444039][ T8491] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 64.449904][ T8491] ? find_held_lock+0x2d/0x110 [ 64.454675][ T8491] ? skb_crc32c_csum_help+0x70/0x70 [ 64.459878][ T8491] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 64.465950][ T8491] ? __might_fault+0xd3/0x180 [ 64.470604][ T8491] ? validate_xmit_xfrm+0x460/0x1040 [ 64.475858][ T8491] ? netif_skb_features+0x55f/0xaa0 [ 64.481052][ T8491] ipvlan_start_xmit+0x45/0x190 [ 64.485874][ T8491] __dev_direct_xmit+0x527/0x730 [ 64.490782][ T8491] ? validate_xmit_skb_list+0x120/0x120 [ 64.496299][ T8491] ? netdev_pick_tx+0x150/0xb50 [ 64.501122][ T8491] ? prb_fill_curr_block+0x5d0/0x5d0 [ 64.506380][ T8491] packet_direct_xmit+0x1a5/0x280 [ 64.511403][ T8491] packet_sendmsg+0x2413/0x52b0 [ 64.516240][ T8491] ? aa_sk_perm+0x316/0xaa0 [ 64.520716][ T8491] ? packet_cached_dev_get+0x250/0x250 [ 64.526144][ T8491] ? aa_af_perm+0x230/0x230 [ 64.530619][ T8491] ? find_held_lock+0x2d/0x110 [ 64.535357][ T8491] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 64.540611][ T8491] ? packet_cached_dev_get+0x250/0x250 [ 64.546042][ T8491] sock_sendmsg+0xcf/0x120 [ 64.550432][ T8491] __sys_sendto+0x21c/0x320 [ 64.554910][ T8491] ? __ia32_sys_getpeername+0xb0/0xb0 [ 64.560251][ T8491] ? packet_do_bind+0x454/0xc00 [ 64.565073][ T8491] ? __sys_bind+0x111/0x250 [ 64.569547][ T8491] ? __ia32_sys_socketpair+0xf0/0xf0 [ 64.574814][ T8491] ? __sys_socket+0x16d/0x200 [ 64.579483][ T8491] __x64_sys_sendto+0xdd/0x1b0 [ 64.584228][ T8491] ? lockdep_hardirqs_on+0x79/0x100 [ 64.589399][ T8491] ? syscall_enter_from_user_mode+0x1d/0x50 [ 64.595264][ T8491] do_syscall_64+0x2d/0x70 [ 64.599652][ T8491] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 64.605511][ T8491] RIP: 0033:0x444ce9 [ 64.609401][ T8491] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db 0b fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 64.628976][ T8491] RSP: 002b:00007fffef7f1428 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 64.637360][ T8491] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000444ce9 [ 64.645302][ T8491] RDX: 000000000000000e RSI: 0000000020000000 RDI: 0000000000000004 [ 64.653262][ T8491] RBP: 00007fffef7f1460 R08: 0000000000000000 R09: ffffffffffffff09 [ 64.661216][ T8491] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffef7f1490 [ 64.669159][ T8491] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 64.677798][ T8491] Kernel Offset: disabled [ 64.682101][ T8491] Rebooting in 86400 seconds..