Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.195' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 63.910441][ T6882] IPVS: ftp: loaded support on port[0] = 21 executing program [ 63.954602][ T6903] IPv6: ADDRCONF(NETDEV_CHANGE): gtp0: link becomes ready [ 63.966470][ T6903] device vlan0 entered promiscuous mode executing program [ 64.018064][ T6910] IPv6: ADDRCONF(NETDEV_CHANGE): gtp1: link becomes ready [ 64.028569][ T6910] device vlan0 entered promiscuous mode [ 64.067629][ T6917] IPv6: ADDRCONF(NETDEV_CHANGE): gtp2: link becomes ready [ 64.078118][ T6917] device vlan0 entered promiscuous mode executing program executing program [ 64.137810][ T6924] IPv6: ADDRCONF(NETDEV_CHANGE): gtp3: link becomes ready [ 64.148302][ T6924] device vlan0 entered promiscuous mode executing program [ 64.187580][ T6931] IPv6: ADDRCONF(NETDEV_CHANGE): gtp4: link becomes ready [ 64.197792][ T6931] device vlan0 entered promiscuous mode [ 64.247707][ T6938] IPv6: ADDRCONF(NETDEV_CHANGE): gtp5: link becomes ready [ 64.258344][ T6938] device vlan0 entered promiscuous mode executing program [ 64.327795][ T6945] IPv6: ADDRCONF(NETDEV_CHANGE): gtp6: link becomes ready [ 64.338555][ T6945] device vlan0 entered promiscuous mode executing program [ 64.407843][ T6952] IPv6: ADDRCONF(NETDEV_CHANGE): gtp7: link becomes ready [ 64.418375][ T6952] device vlan0 entered promiscuous mode executing program [ 64.477617][ T6959] IPv6: ADDRCONF(NETDEV_CHANGE): gtp8: link becomes ready [ 64.487989][ T6959] device vlan0 entered promiscuous mode executing program [ 64.547768][ T6966] IPv6: ADDRCONF(NETDEV_CHANGE): gtp9: link becomes ready [ 64.558157][ T6966] device gtp0 entered promiscuous mode [ 64.564713][ T6966] device vlan0 entered promiscuous mode [ 64.570485][ T6966] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 64.580228][ T6966] device gtp0 left promiscuous mode executing program executing program [ 64.647784][ T6973] IPv6: ADDRCONF(NETDEV_CHANGE): gtp10: link becomes ready [ 64.662427][ T6976] IPv6: ADDRCONF(NETDEV_CHANGE): gtp11: link becomes ready [ 64.673124][ T6976] device gtp1 entered promiscuous mode [ 64.678634][ T6976] device vlan0 entered promiscuous mode [ 64.685849][ T6976] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 64.694405][ T6976] device gtp1 left promiscuous mode executing program executing program [ 64.767714][ T6983] IPv6: ADDRCONF(NETDEV_CHANGE): gtp12: link becomes ready [ 64.782594][ T6986] IPv6: ADDRCONF(NETDEV_CHANGE): gtp13: link becomes ready [ 64.793809][ T6986] device gtp2 entered promiscuous mode [ 64.799379][ T6986] device vlan0 entered promiscuous mode [ 64.806223][ T6986] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 64.814581][ T6986] device gtp2 left promiscuous mode executing program executing program [ 64.887726][ T6993] IPv6: ADDRCONF(NETDEV_CHANGE): gtp14: link becomes ready [ 64.902498][ T6996] IPv6: ADDRCONF(NETDEV_CHANGE): gtp15: link becomes ready [ 64.913067][ T6996] device gtp3 entered promiscuous mode [ 64.918706][ T6996] device vlan0 entered promiscuous mode [ 64.925737][ T6996] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 64.934593][ T6996] device gtp3 left promiscuous mode executing program executing program [ 64.987753][ T7003] IPv6: ADDRCONF(NETDEV_CHANGE): gtp16: link becomes ready [ 65.003442][ T7006] IPv6: ADDRCONF(NETDEV_CHANGE): gtp17: link becomes ready [ 65.013628][ T7006] device gtp4 entered promiscuous mode [ 65.019170][ T7006] device vlan0 entered promiscuous mode [ 65.024951][ C1] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN [ 65.024969][ C1] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] [ 65.024980][ C1] CPU: 1 PID: 7006 Comm: syz-executor740 Not tainted 5.9.0-rc6-next-20200924-syzkaller #0 [ 65.024987][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 65.025007][ C1] RIP: 0010:skb_release_data+0x232/0x910 [ 65.025018][ C1] Code: 48 c1 e8 03 42 80 3c 30 00 0f 85 ea 05 00 00 48 8b 0c 24 49 63 c4 48 c1 e0 04 48 8b 6c 08 30 48 8d 7d 08 48 89 f8 48 c1 e8 03 <42> 80 3c 30 00 0f 85 ba 05 00 00 48 8b 5d 08 31 ff 49 89 dd 41 83 [ 65.025025][ C1] RSP: 0018:ffffc90000da8aa8 EFLAGS: 00010202 [ 65.025037][ C1] RAX: 0000000000000001 RBX: 0000000000000003 RCX: ffff8880973b4cc0 [ 65.025045][ C1] RDX: ffff8880a6a04300 RSI: ffffffff86553775 RDI: 0000000000000008 [ 65.025053][ C1] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8bb4b74f [ 65.025060][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 65.025068][ C1] R13: ffff8880973b4cc0 R14: dffffc0000000000 R15: ffff8880973b4cf0 [ 65.025076][ C1] FS: 00000000012da880(0000) GS:ffff8880ae500000(0000) knlGS:0000000000000000 [ 65.025084][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 65.025091][ C1] CR2: 00000000200004c0 CR3: 00000000a7011000 CR4: 00000000001506e0 [ 65.025104][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 65.025111][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 65.025115][ C1] Call Trace: [ 65.025120][ C1] [ 65.025136][ C1] kfree_skb+0x133/0x3f0 [ 65.025152][ C1] validate_xmit_skb+0x9d9/0xf00 [ 65.025165][ C1] ? lock_is_held_type+0xbb/0xf0 [ 65.025180][ C1] __dev_queue_xmit+0x98a/0x2d30 [ 65.025194][ C1] ? skb_dequeue+0x125/0x180 [ 65.025206][ C1] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 65.025222][ C1] ? mark_held_locks+0x9f/0xe0 [ 65.025234][ C1] ? lock_downgrade+0x830/0x830 [ 65.025249][ C1] ? _raw_spin_unlock_irqrestore+0x6f/0x90 [ 65.025258][ C1] ? lockdep_hardirqs_on+0x53/0x100 [ 65.025268][ C1] ? _raw_spin_unlock_irqrestore+0x5c/0x90 [ 65.025281][ C1] garp_join_timer+0xb9/0xf0 [ 65.025293][ C1] ? garp_request_leave+0x290/0x290 [ 65.025312][ C1] call_timer_fn+0x1a5/0x6b0 [ 65.025324][ C1] ? add_timer_on+0x4a0/0x4a0 [ 65.025345][ C1] ? _raw_spin_unlock_irq+0x1f/0x80 [ 65.025358][ C1] ? garp_request_leave+0x290/0x290 [ 65.025370][ C1] __run_timers.part.0+0x67c/0xa50 [ 65.025385][ C1] ? call_timer_fn+0x6b0/0x6b0 [ 65.025399][ C1] ? lapic_next_event+0x4d/0x80 [ 65.025413][ C1] ? mark_held_locks+0x9f/0xe0 [ 65.025424][ C1] ? hrtimer_interrupt+0x6f4/0x940 [ 65.025437][ C1] run_timer_softirq+0xb3/0x1d0 [ 65.025451][ C1] __do_softirq+0x203/0xab6 [ 65.025467][ C1] asm_call_on_stack+0xf/0x20 [ 65.025472][ C1] [ 65.025487][ C1] do_softirq_own_stack+0x9d/0xd0 [ 65.025500][ C1] irq_exit_rcu+0x235/0x280 [ 65.025513][ C1] sysvec_apic_timer_interrupt+0x51/0xf0 [ 65.025527][ C1] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 65.025542][ C1] RIP: 0010:console_unlock+0xa31/0xd20 [ 65.025555][ C1] Code: 3c 8a 48 c1 e8 03 42 80 3c 38 00 0f 85 87 02 00 00 48 83 3d 48 4f df 08 00 0f 84 9e 01 00 00 e8 05 8f 17 00 48 8b 3c 24 57 9d <0f> 1f 44 00 00 8b 5c 24 3c 31 ff 89 de e8 4d 8b 17 00 85 db 0f 84 [ 65.025562][ C1] RSP: 0018:ffffc90005596df0 EFLAGS: 00000293 [ 65.025574][ C1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff815a9cb7 [ 65.025583][ C1] RDX: ffff8880a6a04300 RSI: ffffffff815da26b RDI: 0000000000000293 [ 65.025590][ C1] RBP: ffffffff84dfd5e0 R08: 0000000000000001 R09: ffffffff8d71a9e7 [ 65.025598][ C1] R10: fffffbfff1ae353c R11: 0000000000000000 R12: 0000000000000000 [ 65.025605][ C1] R13: ffffffff8b0e0f10 R14: 0000000000000200 R15: dffffc0000000000 [ 65.025629][ C1] ? netconsole_netdev_event+0x2b0/0x2b0 [ 65.025642][ C1] ? mark_lock+0xf7/0x2420 [ 65.025655][ C1] ? console_unlock+0xa2b/0xd20 [ 65.025674][ C1] ? syslog_print+0x570/0x570 [ 65.025687][ C1] ? lock_release+0x890/0x890 [ 65.025705][ C1] ? vprintk_func+0x8d/0x1e0 [ 65.025720][ C1] vprintk_emit+0x2a6/0x6e0 [ 65.025735][ C1] vprintk_func+0x8d/0x1e0 [ 65.025748][ C1] printk+0xba/0xed [ 65.025761][ C1] ? record_print_text.cold+0x16/0x16 [ 65.025777][ C1] ? __dev_open+0x1c6/0x470 [ 65.025793][ C1] ? __dev_set_promiscuity.cold+0x30e/0x35f [ 65.025806][ C1] __dev_set_promiscuity.cold+0x55/0x35f [ 65.025821][ C1] __dev_change_flags+0x3af/0x660 [ 65.025835][ C1] ? dev_set_allmulti+0x30/0x30 [ 65.025852][ C1] rtnl_configure_link+0xee/0x230 [ 65.025866][ C1] __rtnl_newlink+0x10b6/0x1750 [ 65.025881][ C1] ? lock_downgrade+0x830/0x830 [ 65.025893][ C1] ? rtnl_setlink+0x3b0/0x3b0 [ 65.025916][ C1] ? unwind_next_frame+0xe3b/0x1f90 [ 65.025930][ C1] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 65.025945][ C1] ? is_bpf_text_address+0xcb/0x160 [ 65.025957][ C1] ? kernel_text_address+0xbd/0xf0 [ 65.025968][ C1] ? __kernel_text_address+0x9/0x30 [ 65.025981][ C1] ? unwind_get_return_address+0x51/0x90 [ 65.025994][ C1] ? create_prof_cpu_mask+0x20/0x20 [ 65.026006][ C1] ? arch_stack_walk+0x93/0xe0 [ 65.026023][ C1] ? stack_trace_save+0x8c/0xc0 [ 65.026037][ C1] ? stack_trace_consume_entry+0x160/0x160 [ 65.026070][ C1] ? lock_is_held_type+0xbb/0xf0 [ 65.026086][ C1] ? rcu_read_lock_sched_held+0x3a/0xb0 [ 65.026099][ C1] ? trace_kmalloc+0xbe/0xf0 [ 65.026113][ C1] ? kmem_cache_alloc_trace+0x1b9/0x480 [ 65.026127][ C1] rtnl_newlink+0x64/0xa0 [ 65.026138][ C1] ? __rtnl_newlink+0x1750/0x1750 [ 65.026148][ C1] rtnetlink_rcv_msg+0x44e/0xad0 [ 65.026160][ C1] ? rtnetlink_put_metrics+0x510/0x510 [ 65.026173][ C1] ? lock_acquire+0x1f2/0xaa0 [ 65.026188][ C1] ? netlink_deliver_tap+0x146/0xb70 [ 65.026202][ C1] netlink_rcv_skb+0x15a/0x430 [ 65.026225][ C1] ? rtnetlink_put_metrics+0x510/0x510 [ 65.026237][ C1] ? netlink_ack+0xa10/0xa10 [ 65.026253][ C1] netlink_unicast+0x533/0x7d0 [ 65.026267][ C1] ? netlink_attachskb+0x810/0x810 [ 65.026282][ C1] ? __phys_addr_symbol+0x2c/0x70 [ 65.026295][ C1] ? __check_object_size+0x171/0x3f0 [ 65.026314][ C1] netlink_sendmsg+0x856/0xd90 [ 65.026328][ C1] ? netlink_unicast+0x7d0/0x7d0 [ 65.026344][ C1] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 65.026355][ C1] ? netlink_unicast+0x7d0/0x7d0 [ 65.026369][ C1] sock_sendmsg+0xcf/0x120 [ 65.026383][ C1] ____sys_sendmsg+0x6e8/0x810 [ 65.026397][ C1] ? kernel_sendmsg+0x50/0x50 [ 65.026407][ C1] ? do_recvmmsg+0x700/0x700 [ 65.026422][ C1] ? lockdep_hardirqs_on_prepare+0x530/0x530 [ 65.026434][ C1] ? lock_downgrade+0x830/0x830 [ 65.026448][ C1] ? lockdep_hardirqs_on_prepare+0x530/0x530 [ 65.026461][ C1] ___sys_sendmsg+0xf3/0x170 [ 65.026471][ C1] ? sendmsg_copy_msghdr+0x160/0x160 [ 65.026484][ C1] ? lock_downgrade+0x830/0x830 [ 65.026510][ C1] ? _copy_to_user+0xdc/0x150 [ 65.026524][ C1] ? move_addr_to_user+0x157/0x220 [ 65.026536][ C1] ? __fget_light+0x215/0x280 [ 65.026550][ C1] __sys_sendmsg+0xe5/0x1b0 [ 65.026561][ C1] ? __sys_sendmsg_sock+0xb0/0xb0 [ 65.026578][ C1] ? check_preemption_disabled+0x50/0x130 [ 65.026590][ C1] ? syscall_enter_from_user_mode+0x1d/0x60 [ 65.026606][ C1] do_syscall_64+0x2d/0x70 [ 65.026619][ C1] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 65.026628][ C1] RIP: 0033:0x441929 [ 65.026642][ C1] Code: e8 5c ad 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 bb 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 65.026649][ C1] RSP: 002b:00007ffef9b4a3f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 65.026663][ C1] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441929 [ 65.026671][ C1] RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000005 [ 65.026680][ C1] RBP: 00007ffef9b4a400 R08: 0000000100000000 R09: 0000000100000000 [ 65.026688][ C1] R10: 0000000100000000 R11: 0000000000000246 R12: 000000000000fde0 [ 65.026696][ C1] R13: 0000000000402800 R14: 0000000000000000 R15: 0000000000000000 [ 65.026706][ C1] Modules linked in: [ 65.026724][ C1] ---[ end trace 5f20bbd0d5710271 ]--- [ 65.026740][ C1] RIP: 0010:skb_release_data+0x232/0x910 [ 65.026753][ C1] Code: 48 c1 e8 03 42 80 3c 30 00 0f 85 ea 05 00 00 48 8b 0c 24 49 63 c4 48 c1 e0 04 48 8b 6c 08 30 48 8d 7d 08 48 89 f8 48 c1 e8 03 <42> 80 3c 30 00 0f 85 ba 05 00 00 48 8b 5d 08 31 ff 49 89 dd 41 83 [ 65.026761][ C1] RSP: 0018:ffffc90000da8aa8 EFLAGS: 00010202 [ 65.026785][ C1] RAX: 0000000000000001 RBX: 0000000000000003 RCX: ffff8880973b4cc0 [ 65.026793][ C1] RDX: ffff8880a6a04300 RSI: ffffffff86553775 RDI: 0000000000000008 [ 65.026801][ C1] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8bb4b74f [ 65.026808][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 65.026817][ C1] R13: ffff8880973b4cc0 R14: dffffc0000000000 R15: ffff8880973b4cf0 [ 65.026828][ C1] FS: 00000000012da880(0000) GS:ffff8880ae500000(0000) knlGS:0000000000000000 [ 65.026838][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 65.026846][ C1] CR2: 00000000200004c0 CR3: 00000000a7011000 CR4: 00000000001506e0 [ 65.026857][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 65.026864][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 65.026871][ C1] Kernel panic - not syncing: Fatal exception in interrupt [ 65.027936][ C1] Kernel Offset: disabled [ 65.962858][ C1] Rebooting in 86400 seconds..