[  OK  ] Reached target Login Prompts.
[  OK  ] Reached target Multi-User System.
[  OK  ] Reached target Graphical Interface.
         Starting Update UTMP about System Runlevel Changes...
[  OK  ] Started Update UTMP about System Runlevel Changes.


Debian GNU/Linux 9 syzkaller ttyS0

Warning: Permanently added '10.128.0.236' (ECDSA) to the list of known hosts.
2020/07/09 18:56:48 fuzzer started
2020/07/09 18:56:48 dialing manager at 10.128.0.105:46001
2020/07/09 18:56:48 syscalls: 3134
2020/07/09 18:56:48 code coverage: enabled
2020/07/09 18:56:48 comparison tracing: enabled
2020/07/09 18:56:48 extra coverage: enabled
2020/07/09 18:56:48 setuid sandbox: enabled
2020/07/09 18:56:48 namespace sandbox: enabled
2020/07/09 18:56:48 Android sandbox: /sys/fs/selinux/policy does not exist
2020/07/09 18:56:48 fault injection: enabled
2020/07/09 18:56:48 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled
2020/07/09 18:56:48 net packet injection: enabled
2020/07/09 18:56:48 net device setup: enabled
2020/07/09 18:56:48 concurrency sanitizer: enabled
2020/07/09 18:56:48 devlink PCI setup: PCI device 0000:00:10.0 is not available
2020/07/09 18:56:48 USB emulation: enabled
2020/07/09 18:56:48 suppressing KCSAN reports in functions: 'blk_mq_sched_dispatch_requests' 
18:56:50 executing program 0:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0)
r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0)
r1 = openat$cgroup_procs(r0, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0)
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, <r3=>0x0}, &(0x7f0000000280)=0x5)
setreuid(0x0, r3)
writev(r1, &(0x7f00000002c0)=[{&(0x7f0000000180)='0', 0x1}], 0x1)

syzkaller login: [   32.089645][ T8644] IPVS: ftp: loaded support on port[0] = 21
[   32.150925][ T8644] chnl_net:caif_netlink_parms(): no params data found
[   32.183320][ T8644] bridge0: port 1(bridge_slave_0) entered blocking state
[   32.190428][ T8644] bridge0: port 1(bridge_slave_0) entered disabled state
18:56:50 executing program 1:
unshare(0x2a000400)
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = mq_open(&(0x7f0000000080)='eth0\xd2\x84{;\x8b\xe51Cp\x97\xc3\xbf\xed\x02\xb7\xf8\xb4\x83i;pW<\x8a\xa7\'\x9b\x92-\xe7\x94\xfb\xdcP?\x1c\xc4\x03\x17\v\xd36\xd7\xd8\xbf\x89\xb9\xcb\x86\xd2\xca\xf2I\x18\x95K\xbf\xb9s\xf9\x92;\x02\xbcIPb5=\x19\xc4\xfa\x11m\x82\xf4\x92\xe3$\x1fe\xa4\x9e\xb7;\xf7B\xad<z\xd0\x9aX\x8f\xbc\xefl\x1fp\xf7\x1b\xa9\xfb5gr\xb6', 0x42, 0x0, 0x0)
r1 = dup2(r0, r0)
mq_notify(r1, &(0x7f0000000040)={0x20000000, 0x4000000000003, 0x2, @thr={0x0, 0x0}})

[   32.198606][ T8644] device bridge_slave_0 entered promiscuous mode
[   32.223479][ T8644] bridge0: port 2(bridge_slave_1) entered blocking state
[   32.230535][ T8644] bridge0: port 2(bridge_slave_1) entered disabled state
[   32.238376][ T8644] device bridge_slave_1 entered promiscuous mode
[   32.252798][ T8644] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   32.263463][ T8644] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   32.280395][ T8644] team0: Port device team_slave_0 added
[   32.287230][ T8644] team0: Port device team_slave_1 added
[   32.308405][ T8644] batman_adv: batadv0: Adding interface: batadv_slave_0
[   32.315450][ T8644] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   32.341911][ T8644] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   32.353808][ T8644] batman_adv: batadv0: Adding interface: batadv_slave_1
18:56:50 executing program 2:
syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x1, &(0x7f0000000080)=[{&(0x7f0000000100)="25bc01000100000200f9ffffffffffffffecb86a54880a0b41000000000000004e2f98b579a782d270146d0e02063e507cca00df74614c0253ef", 0x3a, 0x400}], 0x0, &(0x7f0000000000)={[{@usrjquota_path={'usrjquota', 0x3d, './file0'}}]})

[   32.360737][ T8644] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   32.386740][ T8644] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   32.401276][ T8791] IPVS: ftp: loaded support on port[0] = 21
[   32.434520][ T8644] device hsr_slave_0 entered promiscuous mode
[   32.472244][ T8644] device hsr_slave_1 entered promiscuous mode
[   32.537041][ T8811] IPVS: ftp: loaded support on port[0] = 21
[   32.637382][ T8791] chnl_net:caif_netlink_parms(): no params data found
[   32.656020][ T8811] chnl_net:caif_netlink_parms(): no params data found
[   32.675470][ T8644] netdevsim netdevsim0 netdevsim0: renamed from eth0
18:56:50 executing program 3:
unshare(0x20040600)
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r0, 0xc0406618, 0x0)

[   32.723728][ T8644] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   32.795801][ T8644] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   32.834385][ T8644] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   32.886610][ T8791] bridge0: port 1(bridge_slave_0) entered blocking state
[   32.893815][ T8791] bridge0: port 1(bridge_slave_0) entered disabled state
[   32.901260][ T8791] device bridge_slave_0 entered promiscuous mode
[   32.912330][ T8630] ==================================================================
[   32.919172][ T8811] bridge0: port 1(bridge_slave_0) entered blocking state
[   32.920415][ T8630] BUG: KCSAN: data-race in tomoyo_domain_quota_is_ok / tomoyo_merge_path_acl
[   32.929694][ T8811] bridge0: port 1(bridge_slave_0) entered disabled state
[   32.936110][ T8630] 
[   32.936120][ T8630] write to 0xffff888105ca2ada of 2 bytes by task 8627 on cpu 1:
[   32.936135][ T8630]  tomoyo_merge_path_acl+0x4f/0x80
[   32.936151][ T8630]  tomoyo_update_domain+0x337/0x3a0
[   32.943685][ T8811] device bridge_slave_0 entered promiscuous mode
[   32.945502][ T8630]  tomoyo_write_file+0x210/0x910
[   32.954186][ T8811] bridge0: port 2(bridge_slave_1) entered blocking state
[   32.958262][ T8630]  tomoyo_supervisor+0xac5/0xb30
[   32.963541][ T8811] bridge0: port 2(bridge_slave_1) entered disabled state
[   32.969934][ T8630]  tomoyo_check_open_permission+0x2d0/0x370
[   32.975334][ T8811] device bridge_slave_1 entered promiscuous mode
[   32.981821][ T8630]  tomoyo_file_open+0xd0/0xe0
[   32.981831][ T8630]  security_file_open+0x3f/0x90
[   32.981846][ T8630]  do_dentry_open+0x27c/0x8e0
[   32.996454][ T8811] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   32.999714][ T8630]  vfs_open+0x43/0x50
[   33.007222][ T8811] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   33.010692][ T8630]  path_openat+0x185f/0x20e0
[   33.024641][ T8811] team0: Port device team_slave_0 added
[   33.029322][ T8630]  do_filp_open+0xbd/0x1d0
[   33.034676][ T8811] team0: Port device team_slave_1 added
[   33.042261][ T8630]  do_sys_openat2+0x33c/0x4a0
[   33.042269][ T8630]  __x64_sys_openat+0xef/0x110
[   33.042283][ T8630]  do_syscall_64+0x51/0xb0
[   33.055210][ T8811] batman_adv: batadv0: Adding interface: batadv_slave_0
[   33.056783][ T8630]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   33.062734][ T8811] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   33.067217][ T8630] 
[   33.071964][ T8811] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   33.076353][ T8630] read to 0xffff888105ca2ada of 2 bytes by task 8630 on cpu 0:
[   33.084578][ T8811] batman_adv: batadv0: Adding interface: batadv_slave_1
[   33.089172][ T8630]  tomoyo_domain_quota_is_ok+0xd7/0x2d0
[   33.115010][ T8811] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   33.117306][ T8630]  tomoyo_supervisor+0x1f4/0xb30
[   33.127787][ T8811] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   33.135288][ T8630]  tomoyo_path_number_perm+0x227/0x2d0
[   33.135302][ T8630]  tomoyo_path_mkdir+0x50/0x70
[   33.199110][ T8630]  security_path_mkdir+0x95/0xf0
[   33.204024][ T8630]  do_mkdirat+0xf7/0x220
[   33.208243][ T8630]  __x64_sys_mkdirat+0x3e/0x50
[   33.212981][ T8630]  do_syscall_64+0x51/0xb0
[   33.217375][ T8630]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   33.223235][ T8630] 
[   33.225536][ T8630] Reported by Kernel Concurrency Sanitizer on:
[   33.231671][ T8630] CPU: 0 PID: 8630 Comm: syz-fuzzer Not tainted 5.8.0-rc4-syzkaller #0
[   33.239882][ T8630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   33.249914][ T8630] ==================================================================
[   33.257950][ T8630] Kernel panic - not syncing: panic_on_warn set ...
[   33.264515][ T8630] CPU: 0 PID: 8630 Comm: syz-fuzzer Not tainted 5.8.0-rc4-syzkaller #0
[   33.273069][ T8630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   33.283097][ T8630] Call Trace:
[   33.286366][ T8630]  dump_stack+0x10f/0x19d
[   33.290670][ T8630]  panic+0x207/0x64a
[   33.294542][ T8630]  ? vprintk_emit+0x44a/0x4f0
[   33.299200][ T8630]  kcsan_report+0x684/0x690
[   33.303680][ T8630]  ? kcsan_setup_watchpoint+0x453/0x4d0
[   33.309200][ T8630]  ? tomoyo_domain_quota_is_ok+0xd7/0x2d0
[   33.314894][ T8630]  ? tomoyo_supervisor+0x1f4/0xb30
[   33.319988][ T8630]  ? tomoyo_path_number_perm+0x227/0x2d0
[   33.325594][ T8630]  ? tomoyo_path_mkdir+0x50/0x70
[   33.330506][ T8630]  ? security_path_mkdir+0x95/0xf0
[   33.335592][ T8630]  ? do_mkdirat+0xf7/0x220
[   33.339988][ T8630]  ? __x64_sys_mkdirat+0x3e/0x50
[   33.344912][ T8630]  ? do_syscall_64+0x51/0xb0
[   33.349476][ T8630]  ? entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   33.355524][ T8630]  ? tomoyo_profile+0x17/0x30
[   33.360178][ T8630]  ? tomoyo_profile+0x17/0x30
[   33.364831][ T8630]  kcsan_setup_watchpoint+0x453/0x4d0
[   33.370265][ T8630]  ? tomoyo_profile+0x17/0x30
[   33.374920][ T8630]  tomoyo_domain_quota_is_ok+0xd7/0x2d0
[   33.380454][ T8630]  tomoyo_supervisor+0x1f4/0xb30
[   33.385377][ T8630]  ? snprintf+0x6f/0x90
[   33.389511][ T8630]  tomoyo_path_number_perm+0x227/0x2d0
[   33.394950][ T8630]  tomoyo_path_mkdir+0x50/0x70
[   33.399692][ T8630]  security_path_mkdir+0x95/0xf0
[   33.404607][ T8630]  do_mkdirat+0xf7/0x220
[   33.408827][ T8630]  __x64_sys_mkdirat+0x3e/0x50
[   33.413584][ T8630]  do_syscall_64+0x51/0xb0
[   33.417979][ T8630]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   33.423845][ T8630] RIP: 0033:0x4b3cdb
[   33.427750][ T8630] Code: Bad RIP value.
[   33.431874][ T8630] RSP: 002b:000000c000305800 EFLAGS: 00000202 ORIG_RAX: 0000000000000102
[   33.440259][ T8630] RAX: ffffffffffffffda RBX: 000000c00002c000 RCX: 00000000004b3cdb
[   33.448218][ T8630] RDX: 00000000000001c0 RSI: 000000c000026d40 RDI: ffffffffffffff9c
[   33.456163][ T8630] RBP: 000000c000305858 R08: 0000000000870a01 R09: 0000000000000001
[   33.464110][ T8630] R10: 000000c000026d40 R11: 0000000000000202 R12: ffffffffffffffff
[   33.472054][ T8630] R13: 000000000000006b R14: 000000000000006a R15: 0000000000000100
[   33.481351][ T8630] Kernel Offset: disabled
[   33.485714][ T8630] Rebooting in 86400 seconds..