[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 61.577890][ T26] audit: type=1800 audit(1563588413.103:25): pid=8971 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 61.620251][ T26] audit: type=1800 audit(1563588413.103:26): pid=8971 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 61.679255][ T26] audit: type=1800 audit(1563588413.103:27): pid=8971 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.199' (ECDSA) to the list of known hosts. 2019/07/20 02:24:57 parsed 1 programs 2019/07/20 02:24:59 executed programs: 0 syzkaller login: [ 1148.352373][ T9154] IPVS: ftp: loaded support on port[0] = 21 [ 1148.353092][ T9156] IPVS: ftp: loaded support on port[0] = 21 [ 1148.366628][ T9155] IPVS: ftp: loaded support on port[0] = 21 [ 1148.367224][ T9151] IPVS: ftp: loaded support on port[0] = 21 [ 1148.447337][ T9159] IPVS: ftp: loaded support on port[0] = 21 [ 1148.475168][ T9160] IPVS: ftp: loaded support on port[0] = 21 [ 1148.796919][ T9156] chnl_net:caif_netlink_parms(): no params data found [ 1148.813052][ T9159] chnl_net:caif_netlink_parms(): no params data found [ 1148.822879][ T9154] chnl_net:caif_netlink_parms(): no params data found [ 1148.833207][ T9155] chnl_net:caif_netlink_parms(): no params data found [ 1148.846830][ T9151] chnl_net:caif_netlink_parms(): no params data found [ 1149.024423][ T9154] bridge0: port 1(bridge_slave_0) entered blocking state [ 1149.033482][ T9154] bridge0: port 1(bridge_slave_0) entered disabled state [ 1149.041521][ T9154] device bridge_slave_0 entered promiscuous mode [ 1149.050724][ T9154] bridge0: port 2(bridge_slave_1) entered blocking state [ 1149.057888][ T9154] bridge0: port 2(bridge_slave_1) entered disabled state [ 1149.066505][ T9154] device bridge_slave_1 entered promiscuous mode [ 1149.074020][ T9156] bridge0: port 1(bridge_slave_0) entered blocking state [ 1149.081569][ T9156] bridge0: port 1(bridge_slave_0) entered disabled state [ 1149.089325][ T9156] device bridge_slave_0 entered promiscuous mode [ 1149.096622][ T9155] bridge0: port 1(bridge_slave_0) entered blocking state [ 1149.104375][ T9155] bridge0: port 1(bridge_slave_0) entered disabled state [ 1149.112255][ T9155] device bridge_slave_0 entered promiscuous mode [ 1149.126133][ T9155] bridge0: port 2(bridge_slave_1) entered blocking state [ 1149.133845][ T9155] bridge0: port 2(bridge_slave_1) entered disabled state [ 1149.141621][ T9155] device bridge_slave_1 entered promiscuous mode [ 1149.183183][ T9155] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1149.197773][ T9156] bridge0: port 2(bridge_slave_1) entered blocking state [ 1149.204979][ T9156] bridge0: port 2(bridge_slave_1) entered disabled state [ 1149.212832][ T9156] device bridge_slave_1 entered promiscuous mode [ 1149.220038][ T9159] bridge0: port 1(bridge_slave_0) entered blocking state [ 1149.227126][ T9159] bridge0: port 1(bridge_slave_0) entered disabled state [ 1149.234973][ T9159] device bridge_slave_0 entered promiscuous mode [ 1149.245078][ T9159] bridge0: port 2(bridge_slave_1) entered blocking state [ 1149.252345][ T9159] bridge0: port 2(bridge_slave_1) entered disabled state [ 1149.260574][ T9159] device bridge_slave_1 entered promiscuous mode [ 1149.281351][ T9151] bridge0: port 1(bridge_slave_0) entered blocking state [ 1149.288419][ T9151] bridge0: port 1(bridge_slave_0) entered disabled state [ 1149.296926][ T9151] device bridge_slave_0 entered promiscuous mode [ 1149.305800][ T9155] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1149.334349][ T9160] chnl_net:caif_netlink_parms(): no params data found [ 1149.350433][ T9154] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1149.360066][ T9151] bridge0: port 2(bridge_slave_1) entered blocking state [ 1149.367143][ T9151] bridge0: port 2(bridge_slave_1) entered disabled state [ 1149.375031][ T9151] device bridge_slave_1 entered promiscuous mode [ 1149.391653][ T9155] team0: Port device team_slave_0 added [ 1149.408634][ T9154] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1149.434334][ T9156] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1149.446629][ T9155] team0: Port device team_slave_1 added [ 1149.458257][ T9159] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1149.475525][ T9159] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1149.494403][ T9156] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1149.526413][ T9154] team0: Port device team_slave_0 added [ 1149.535437][ T9151] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1149.561523][ T9159] team0: Port device team_slave_0 added [ 1149.576334][ T9154] team0: Port device team_slave_1 added [ 1149.584191][ T9151] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1149.617402][ T9156] team0: Port device team_slave_0 added [ 1149.624456][ T9159] team0: Port device team_slave_1 added [ 1149.635959][ T9160] bridge0: port 1(bridge_slave_0) entered blocking state [ 1149.643911][ T9160] bridge0: port 1(bridge_slave_0) entered disabled state [ 1149.660061][ T9160] device bridge_slave_0 entered promiscuous mode [ 1149.673778][ T9151] team0: Port device team_slave_0 added [ 1149.681202][ T9156] team0: Port device team_slave_1 added [ 1149.688150][ T9151] team0: Port device team_slave_1 added [ 1149.755579][ T9154] device hsr_slave_0 entered promiscuous mode [ 1149.809839][ T9154] device hsr_slave_1 entered promiscuous mode [ 1149.863084][ T9160] bridge0: port 2(bridge_slave_1) entered blocking state [ 1149.870403][ T9160] bridge0: port 2(bridge_slave_1) entered disabled state [ 1149.878189][ T9160] device bridge_slave_1 entered promiscuous mode [ 1149.922570][ T9155] device hsr_slave_0 entered promiscuous mode [ 1149.979465][ T9155] device hsr_slave_1 entered promiscuous mode [ 1150.059443][ T9155] debugfs: Directory 'hsr0' with parent '/' already present! [ 1150.134469][ T9160] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1150.146369][ T9160] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1150.192260][ T9156] device hsr_slave_0 entered promiscuous mode [ 1150.259470][ T9156] device hsr_slave_1 entered promiscuous mode [ 1150.309329][ T9156] debugfs: Directory 'hsr0' with parent '/' already present! [ 1150.352775][ T9159] device hsr_slave_0 entered promiscuous mode [ 1150.390178][ T9159] device hsr_slave_1 entered promiscuous mode [ 1150.429395][ T9159] debugfs: Directory 'hsr0' with parent '/' already present! [ 1150.491241][ T9151] device hsr_slave_0 entered promiscuous mode [ 1150.549434][ T9151] device hsr_slave_1 entered promiscuous mode [ 1150.599480][ T9151] debugfs: Directory 'hsr0' with parent '/' already present! [ 1150.640361][ T9160] team0: Port device team_slave_0 added [ 1150.648847][ T9160] team0: Port device team_slave_1 added [ 1150.732402][ T9160] device hsr_slave_0 entered promiscuous mode [ 1150.789428][ T9160] device hsr_slave_1 entered promiscuous mode [ 1150.869203][ T9160] debugfs: Directory 'hsr0' with parent '/' already present! [ 1150.971882][ T9160] bridge0: port 2(bridge_slave_1) entered blocking state [ 1150.979184][ T9160] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1151.048716][ T9156] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1151.066737][ T9151] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1151.095212][ T9155] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1151.108019][ T9154] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1151.120099][ T3572] bridge0: port 2(bridge_slave_1) entered disabled state [ 1151.148887][ T9159] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1151.171544][ T9151] 8021q: adding VLAN 0 to HW filter on device team0 [ 1151.182135][ T9156] 8021q: adding VLAN 0 to HW filter on device team0 [ 1151.188959][ T3572] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1151.200589][ T3572] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1151.208494][ T3572] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1151.216787][ T3572] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1151.224708][ T3572] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1151.232567][ T3572] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1151.247506][ T9155] 8021q: adding VLAN 0 to HW filter on device team0 [ 1151.271680][ T9160] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1151.283828][ T9154] 8021q: adding VLAN 0 to HW filter on device team0 [ 1151.297721][ T3572] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1151.305787][ T3572] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1151.313812][ T3572] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1151.322381][ T3572] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1151.331260][ T3572] bridge0: port 1(bridge_slave_0) entered blocking state [ 1151.338318][ T3572] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1151.346272][ T3572] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1151.355036][ T3572] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1151.363514][ T3572] bridge0: port 2(bridge_slave_1) entered blocking state [ 1151.370603][ T3572] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1151.378115][ T3572] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1151.386845][ T3572] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1151.394731][ T3572] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1151.402560][ T3572] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1151.411313][ T3572] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1151.419828][ T3572] bridge0: port 1(bridge_slave_0) entered blocking state [ 1151.426874][ T3572] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1151.434884][ T3572] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1151.443467][ T3572] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1151.452031][ T3572] bridge0: port 2(bridge_slave_1) entered blocking state [ 1151.459141][ T3572] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1151.467491][ T3572] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1151.475573][ T3572] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1151.485515][ T9159] 8021q: adding VLAN 0 to HW filter on device team0 [ 1151.495296][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1151.505643][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1151.514521][ T9171] bridge0: port 1(bridge_slave_0) entered blocking state [ 1151.521642][ T9171] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1151.530121][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1151.539313][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1151.555928][ T9160] 8021q: adding VLAN 0 to HW filter on device team0 [ 1151.580959][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1151.588742][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1151.597592][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1151.606784][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1151.615688][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1151.624467][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1151.633149][ T9164] bridge0: port 1(bridge_slave_0) entered blocking state [ 1151.640268][ T9164] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1151.648056][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1151.657236][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1151.665827][ T9164] bridge0: port 2(bridge_slave_1) entered blocking state [ 1151.672963][ T9164] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1151.681020][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1151.719061][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1151.728691][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1151.737233][ T9164] bridge0: port 1(bridge_slave_0) entered blocking state [ 1151.744333][ T9164] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1151.752372][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1151.761658][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1151.770225][ T9164] bridge0: port 2(bridge_slave_1) entered blocking state [ 1151.777273][ T9164] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1151.784945][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1151.793548][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1151.802625][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1151.811530][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1151.820407][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1151.828790][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1151.837868][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1151.846426][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1151.854909][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1151.863625][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1151.872451][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1151.881070][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1151.889898][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1151.898319][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1151.907166][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1151.915577][ T9164] bridge0: port 1(bridge_slave_0) entered blocking state [ 1151.922720][ T9164] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1151.931454][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1151.939662][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1151.947704][ T9164] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1151.972153][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1151.984359][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1151.993419][ T9171] bridge0: port 2(bridge_slave_1) entered blocking state [ 1152.000533][ T9171] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1152.008438][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1152.017588][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1152.026085][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1152.040843][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1152.049423][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1152.057695][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1152.067257][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1152.075750][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1152.083974][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1152.092494][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1152.107387][ T9156] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1152.122482][ T9156] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1152.143550][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1152.152693][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1152.161754][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1152.170243][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1152.178588][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1152.187392][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1152.226897][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1152.235707][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1152.244985][ T9171] bridge0: port 2(bridge_slave_1) entered blocking state [ 1152.252079][ T9171] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1152.259758][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1152.268602][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1152.277174][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1152.286096][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1152.294386][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1152.303185][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1152.311648][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1152.321111][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1152.329639][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1152.338005][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1152.346435][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1152.355022][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1152.363693][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1152.372552][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1152.384250][ T9154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1152.397985][ T9156] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1152.414321][ T9151] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1152.426683][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1152.435493][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1152.444231][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1152.453515][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1152.462210][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1152.471271][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1152.483687][ T9171] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1152.508669][ T9160] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1152.520535][ T9160] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1152.533212][ T9172] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1152.551973][ T9172] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1152.564142][ T9172] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1152.572970][ T9172] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1152.582029][ T9172] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1152.590431][ T9172] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1152.598686][ T9172] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1152.616421][ T9155] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1152.638861][ T9151] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1152.666234][ T9159] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1152.698575][ T9159] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1152.757162][ T9159] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1152.765312][ T9172] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1152.774856][ T9172] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1152.797553][ T9172] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1152.825215][ T9172] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1152.837559][ T9172] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1152.853569][ T9154] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1152.871332][ T9160] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1153.240931][ T9170] Bluetooth: Invalid header checksum [ 1153.246500][ T9170] Bluetooth: Invalid header checksum 2019/07/20 02:25:04 executed programs: 8 [ 1154.140316][ T9187] Bluetooth: Invalid header checksum [ 1154.147598][ T9187] Bluetooth: Invalid header checksum [ 1154.380579][ T836] Bluetooth: Invalid header checksum [ 1154.386061][ T836] Bluetooth: Invalid header checksum [ 1154.841902][ T836] Bluetooth: Invalid header checksum [ 1154.847273][ T836] Bluetooth: Invalid header checksum [ 1157.984302][ T9170] Bluetooth: Invalid header checksum [ 1157.990266][ T9170] Bluetooth: Invalid header checksum [ 1157.991890][ T9672] Bluetooth: Invalid header checksum 2019/07/20 02:25:09 executed programs: 106 [ 1159.209971][ T9187] Bluetooth: Invalid header checksum [ 1159.215352][ T9187] Bluetooth: Invalid header checksum [ 1159.969687][ T9170] Bluetooth: Invalid header checksum [ 1159.975056][ T9170] Bluetooth: Invalid header checksum 2019/07/20 02:25:14 executed programs: 206 [ 1164.358802][ T9170] Bluetooth: Invalid header checksum [ 1164.364588][ T9170] Bluetooth: Invalid header checksum [ 1164.799606][ T9200] Bluetooth: Invalid header checksum [ 1164.805354][ T9187] Bluetooth: Invalid header checksum [ 1164.821622][ T9200] Bluetooth: Invalid header checksum 2019/07/20 02:25:19 executed programs: 304 [ 1169.029528][ T9200] Bluetooth: Invalid header checksum [ 1169.035118][ T9200] Bluetooth: Invalid header checksum [ 1171.809751][ T9168] Bluetooth: Invalid header checksum [ 1171.815387][ T9168] Bluetooth: Invalid header checksum [ 1173.049553][ T836] Bluetooth: Invalid header checksum [ 1173.055435][ T836] Bluetooth: Invalid header checksum 2019/07/20 02:25:24 executed programs: 401 [ 1173.924484][ T9170] Bluetooth: Invalid header checksum [ 1175.923604][ T9170] Bluetooth: Invalid header checksum [ 1175.928965][ T9170] Bluetooth: Invalid header checksum [ 1176.348142][ T9200] Bluetooth: Invalid header checksum [ 1176.354013][ T9187] Bluetooth: Invalid header checksum [ 1176.569561][ T9200] Bluetooth: Invalid header checksum [ 1176.574998][ T9200] Bluetooth: Invalid header checksum [ 1176.600712][ T9170] Bluetooth: Invalid header checksum [ 1176.606085][ T9170] Bluetooth: Invalid header checksum [ 1177.869458][ T9187] Bluetooth: Invalid header checksum [ 1177.874909][ T9187] Bluetooth: Invalid header checksum [ 1177.889402][T11489] Bluetooth: Invalid header checksum 2019/07/20 02:25:30 executed programs: 497 [ 1179.229870][ T9187] Bluetooth: Invalid header checksum [ 1179.235253][ T9187] Bluetooth: Invalid header checksum [ 1179.345053][ T9187] Bluetooth: Invalid header checksum [ 1180.209958][ T9197] Bluetooth: Invalid header checksum [ 1180.215533][ T9168] Bluetooth: Invalid header checksum [ 1180.981580][ T9170] Bluetooth: Invalid header checksum [ 1180.987046][ T9170] Bluetooth: Invalid header checksum [ 1181.706080][ T9168] Bluetooth: Invalid header checksum [ 1181.711871][ T9168] Bluetooth: Invalid header checksum 2019/07/20 02:25:35 executed programs: 594 [ 1184.189951][ T9197] Bluetooth: Invalid header checksum [ 1184.195593][ T9200] Bluetooth: Invalid header checksum [ 1184.215767][T12040] ================================================================== [ 1184.224133][T12040] BUG: KASAN: use-after-free in h5_rx_3wire_hdr+0x35d/0x3c0 [ 1184.231426][T12040] Read of size 1 at addr ffff8880a161d1c8 by task syz-executor.4/12040 [ 1184.239660][T12040] [ 1184.241997][T12040] CPU: 1 PID: 12040 Comm: syz-executor.4 Not tainted 5.2.0-next-20190718 #41 [ 1184.250758][T12040] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1184.260824][T12040] Call Trace: [ 1184.264197][T12040] dump_stack+0x172/0x1f0 [ 1184.268540][T12040] ? h5_rx_3wire_hdr+0x35d/0x3c0 [ 1184.273486][T12040] print_address_description.cold+0xd4/0x306 [ 1184.279471][T12040] ? h5_rx_3wire_hdr+0x35d/0x3c0 [ 1184.284448][T12040] ? h5_rx_3wire_hdr+0x35d/0x3c0 [ 1184.289488][T12040] __kasan_report.cold+0x1b/0x36 [ 1184.294436][T12040] ? h5_rx_3wire_hdr+0x35d/0x3c0 [ 1184.299383][T12040] kasan_report+0x12/0x17 [ 1184.303722][T12040] __asan_report_load1_noabort+0x14/0x20 [ 1184.309367][T12040] h5_rx_3wire_hdr+0x35d/0x3c0 [ 1184.314145][T12040] h5_recv+0x32f/0x500 [ 1184.318230][T12040] ? h5_slip_one_byte+0x1d0/0x1d0 [ 1184.323278][T12040] hci_uart_tty_receive+0x279/0x790 [ 1184.328477][T12040] ? hci_uart_write_work+0x900/0x900 [ 1184.333759][T12040] tty_ioctl+0x949/0x14f0 [ 1184.338109][T12040] ? do_tty_hangup+0x30/0x30 [ 1184.342685][T12040] ? tomoyo_path_number_perm+0x459/0x520 [ 1184.348303][T12040] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1184.354537][T12040] ? tomoyo_path_number_perm+0x263/0x520 [ 1184.360174][T12040] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 1184.365975][T12040] ? do_tty_hangup+0x30/0x30 [ 1184.370558][T12040] do_vfs_ioctl+0xdb6/0x13e0 [ 1184.375162][T12040] ? ioctl_preallocate+0x210/0x210 [ 1184.380267][T12040] ? __fget+0x384/0x560 [ 1184.384411][T12040] ? ksys_dup3+0x3e0/0x3e0 [ 1184.388813][T12040] ? nsecs_to_jiffies+0x30/0x30 [ 1184.393666][T12040] ? tomoyo_file_ioctl+0x23/0x30 [ 1184.398619][T12040] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1184.404857][T12040] ? security_file_ioctl+0x8d/0xc0 [ 1184.410187][T12040] ksys_ioctl+0xab/0xd0 [ 1184.414351][T12040] __x64_sys_ioctl+0x73/0xb0 [ 1184.418989][T12040] do_syscall_64+0xfd/0x6a0 [ 1184.423542][T12040] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1184.429522][T12040] RIP: 0033:0x459819 [ 1184.433417][T12040] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1184.453040][T12040] RSP: 002b:00007f7a3b459c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1184.461486][T12040] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459819 [ 1184.469465][T12040] RDX: 0000000020000080 RSI: 0000000000005412 RDI: 0000000000000003 [ 1184.477447][T12040] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 1184.485414][T12040] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7a3b45a6d4 [ 1184.493380][T12040] R13: 00000000004c408a R14: 00000000004d7ff0 R15: 00000000ffffffff [ 1184.501362][T12040] [ 1184.503677][T12040] Allocated by task 9200: [ 1184.507991][T12040] save_stack+0x23/0x90 [ 1184.512166][T12040] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 1184.517786][T12040] kasan_kmalloc+0x9/0x10 [ 1184.522097][T12040] __kmalloc_node_track_caller+0x4e/0x70 [ 1184.527852][T12040] __kmalloc_reserve.isra.0+0x40/0xf0 [ 1184.533249][T12040] __alloc_skb+0x10b/0x5e0 [ 1184.537668][T12040] h5_rx_pkt_start+0xce/0x270 [ 1184.542342][T12040] h5_recv+0x32f/0x500 [ 1184.546493][T12040] hci_uart_tty_receive+0x279/0x790 [ 1184.551688][T12040] tty_ldisc_receive_buf+0x15f/0x1c0 [ 1184.556968][T12040] tty_port_default_receive_buf+0x7d/0xb0 [ 1184.562737][T12040] flush_to_ldisc+0x222/0x390 [ 1184.567403][T12040] process_one_work+0x9af/0x1740 [ 1184.572328][T12040] worker_thread+0x98/0xe40 [ 1184.576844][T12040] kthread+0x361/0x430 [ 1184.580905][T12040] ret_from_fork+0x24/0x30 [ 1184.585308][T12040] [ 1184.587616][T12040] Freed by task 9200: [ 1184.591593][T12040] save_stack+0x23/0x90 [ 1184.595748][T12040] __kasan_slab_free+0x102/0x150 [ 1184.600679][T12040] kasan_slab_free+0xe/0x10 [ 1184.605160][T12040] kfree+0x10a/0x2c0 [ 1184.609047][T12040] skb_free_head+0x93/0xb0 [ 1184.613463][T12040] skb_release_data+0x42d/0x7c0 [ 1184.618308][T12040] skb_release_all+0x4d/0x60 [ 1184.622876][T12040] kfree_skb+0x101/0x3c0 [ 1184.627106][T12040] h5_reset_rx+0x4c/0x120 [ 1184.631426][T12040] h5_rx_3wire_hdr+0x2f5/0x3c0 [ 1184.636193][T12040] h5_recv+0x32f/0x500 [ 1184.640256][T12040] hci_uart_tty_receive+0x279/0x790 [ 1184.645437][T12040] tty_ldisc_receive_buf+0x15f/0x1c0 [ 1184.650719][T12040] tty_port_default_receive_buf+0x7d/0xb0 [ 1184.656448][T12040] flush_to_ldisc+0x222/0x390 [ 1184.661126][T12040] process_one_work+0x9af/0x1740 [ 1184.666072][T12040] worker_thread+0x98/0xe40 [ 1184.670578][T12040] kthread+0x361/0x430 [ 1184.674658][T12040] ret_from_fork+0x24/0x30 [ 1184.679062][T12040] [ 1184.681444][T12040] The buggy address belongs to the object at ffff8880a161d1c0 [ 1184.681444][T12040] which belongs to the cache kmalloc-8k of size 8192 [ 1184.695487][T12040] The buggy address is located 8 bytes inside of [ 1184.695487][T12040] 8192-byte region [ffff8880a161d1c0, ffff8880a161f1c0) [ 1184.708680][T12040] The buggy address belongs to the page: [ 1184.714324][T12040] page:ffffea0002858700 refcount:1 mapcount:0 mapping:ffff8880aa4021c0 index:0x0 compound_mapcount: 0 [ 1184.725431][T12040] flags: 0x1fffc0000010200(slab|head) [ 1184.730801][T12040] raw: 01fffc0000010200 ffffea0002850508 ffffea000262ed08 ffff8880aa4021c0 [ 1184.739387][T12040] raw: 0000000000000000 ffff8880a161d1c0 0000000100000001 0000000000000000 [ 1184.747979][T12040] page dumped because: kasan: bad access detected [ 1184.754377][T12040] [ 1184.756693][T12040] Memory state around the buggy address: [ 1184.762431][T12040] ffff8880a161d080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1184.770480][T12040] ffff8880a161d100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1184.778537][T12040] >ffff8880a161d180: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 1184.786584][T12040] ^ [ 1184.793023][T12040] ffff8880a161d200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1184.801100][T12040] ffff8880a161d280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1184.809236][T12040] ================================================================== [ 1184.817289][T12040] Disabling lock debugging due to kernel taint [ 1184.830958][ T9197] Bluetooth: Invalid header checksum [ 1184.839430][T12040] Kernel panic - not syncing: panic_on_warn set ... [ 1184.846039][T12040] CPU: 0 PID: 12040 Comm: syz-executor.4 Tainted: G B 5.2.0-next-20190718 #41 [ 1184.856180][T12040] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1184.866233][T12040] Call Trace: [ 1184.869528][T12040] dump_stack+0x172/0x1f0 [ 1184.871230][ T3902] kobject: 'loop2' (00000000b932723b): kobject_uevent_env [ 1184.873868][T12040] panic+0x2dc/0x755 [ 1184.883443][ T3902] kobject: 'loop2' (00000000b932723b): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1184.884847][T12040] ? add_taint.cold+0x16/0x16 [ 1184.884870][T12040] ? h5_rx_3wire_hdr+0x35d/0x3c0 [ 1184.904583][T12040] ? preempt_schedule+0x4b/0x60 [ 1184.909468][T12040] ? ___preempt_schedule+0x16/0x18 [ 1184.914583][T12040] ? trace_hardirqs_on+0x5e/0x240 [ 1184.919611][T12040] ? h5_rx_3wire_hdr+0x35d/0x3c0 [ 1184.924545][T12040] end_report+0x47/0x4f [ 1184.928701][T12040] ? h5_rx_3wire_hdr+0x35d/0x3c0 [ 1184.933642][T12040] __kasan_report.cold+0xe/0x36 [ 1184.938501][T12040] ? h5_rx_3wire_hdr+0x35d/0x3c0 [ 1184.943475][T12040] kasan_report+0x12/0x17 [ 1184.947808][T12040] __asan_report_load1_noabort+0x14/0x20 [ 1184.953622][T12040] h5_rx_3wire_hdr+0x35d/0x3c0 [ 1184.958377][T12040] h5_recv+0x32f/0x500 [ 1184.962433][T12040] ? h5_slip_one_byte+0x1d0/0x1d0 [ 1184.967457][T12040] hci_uart_tty_receive+0x279/0x790 [ 1184.972634][T12040] ? hci_uart_write_work+0x900/0x900 [ 1184.978038][T12040] tty_ioctl+0x949/0x14f0 [ 1184.982343][T12040] ? do_tty_hangup+0x30/0x30 [ 1184.986915][T12040] ? tomoyo_path_number_perm+0x459/0x520 [ 1184.992546][T12040] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1184.998857][T12040] ? tomoyo_path_number_perm+0x263/0x520 [ 1185.004472][T12040] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 1185.010291][T12040] ? do_tty_hangup+0x30/0x30 [ 1185.014859][T12040] do_vfs_ioctl+0xdb6/0x13e0 [ 1185.019444][T12040] ? ioctl_preallocate+0x210/0x210 [ 1185.024923][T12040] ? __fget+0x384/0x560 [ 1185.029079][T12040] ? ksys_dup3+0x3e0/0x3e0 [ 1185.033584][T12040] ? nsecs_to_jiffies+0x30/0x30 [ 1185.038439][T12040] ? tomoyo_file_ioctl+0x23/0x30 [ 1185.043364][T12040] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1185.049590][T12040] ? security_file_ioctl+0x8d/0xc0 [ 1185.054681][T12040] ksys_ioctl+0xab/0xd0 [ 1185.058815][T12040] __x64_sys_ioctl+0x73/0xb0 [ 1185.063383][T12040] do_syscall_64+0xfd/0x6a0 [ 1185.067872][T12040] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1185.073765][T12040] RIP: 0033:0x459819 [ 1185.077643][T12040] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1185.097226][T12040] RSP: 002b:00007f7a3b459c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1185.105615][T12040] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459819 [ 1185.113567][T12040] RDX: 0000000020000080 RSI: 0000000000005412 RDI: 0000000000000003 [ 1185.121518][T12040] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 1185.129470][T12040] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7a3b45a6d4 [ 1185.137439][T12040] R13: 00000000004c408a R14: 00000000004d7ff0 R15: 00000000ffffffff [ 1185.162552][T12040] Kernel Offset: disabled [ 1185.166922][T12040] Rebooting in 86400 seconds..