[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 64.606936][ T26] kauditd_printk_skb: 7 callbacks suppressed [ 64.606947][ T26] audit: type=1800 audit(1567850042.190:29): pid=9802 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 64.643123][ T26] audit: type=1800 audit(1567850042.190:30): pid=9802 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.15.200' (ECDSA) to the list of known hosts. 2019/09/07 09:54:27 parsed 1 programs 2019/09/07 09:54:28 executed programs: 0 syzkaller login: [ 91.251926][ T9974] IPVS: ftp: loaded support on port[0] = 21 [ 91.297673][ T9974] chnl_net:caif_netlink_parms(): no params data found [ 91.319374][ T9974] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.326693][ T9974] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.334179][ T9974] device bridge_slave_0 entered promiscuous mode [ 91.341659][ T9974] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.348783][ T9974] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.356280][ T9974] device bridge_slave_1 entered promiscuous mode [ 91.369830][ T9974] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.380075][ T9974] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.395140][ T9974] team0: Port device team_slave_0 added [ 91.401961][ T9974] team0: Port device team_slave_1 added [ 91.467027][ T9974] device hsr_slave_0 entered promiscuous mode [ 91.525467][ T9974] device hsr_slave_1 entered promiscuous mode [ 91.580370][ T9974] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.587592][ T9974] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.594859][ T9974] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.601920][ T9974] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.625177][ T9974] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.634754][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 91.654460][ T17] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.662095][ T17] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.670260][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 91.679987][ T9974] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.689078][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 91.697504][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.704529][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.723271][ T9974] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 91.733945][ T9974] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 91.746403][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 91.754752][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.761840][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.769683][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 91.778427][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 91.786678][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 91.794774][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 91.802935][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 91.810460][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 91.824368][ T9974] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.272807][T10056] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 92.280645][T10056] #PF: supervisor instruction fetch in kernel mode [ 92.287123][T10056] #PF: error_code(0x0010) - not-present page [ 92.293075][T10056] PGD a5ef9067 P4D a5ef9067 PUD 89c27067 PMD 0 [ 92.299314][T10056] Oops: 0010 [#1] PREEMPT SMP KASAN [ 92.304505][T10056] CPU: 0 PID: 10056 Comm: syz-executor.0 Not tainted 5.3.0-rc7+ #0 [ 92.312496][T10056] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 92.322535][T10056] RIP: 0010:0x0 [ 92.325986][T10056] Code: Bad RIP value. [ 92.330030][T10056] RSP: 0018:ffff888082c9f4c8 EFLAGS: 00010246 [ 92.336081][T10056] RAX: dffffc0000000000 RBX: ffffffff882a51a0 RCX: ffffffff85b40c56 [ 92.344030][T10056] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8880920cc340 [ 92.351992][T10056] RBP: ffff888082c9f5c0 R08: ffff888097976000 R09: ffff888082c9f648 [ 92.359940][T10056] R10: ffffed1010593ed7 R11: ffff888082c9f6bf R12: ffff8880920cc340 [ 92.367902][T10056] R13: 0000000000000001 R14: ffff888082c9f598 R15: ffffffff882a51a0 [ 92.375856][T10056] FS: 0000000000000000(0000) GS:ffff8880ae800000(0063) knlGS:00000000f7f3fb40 [ 92.384782][T10056] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 92.391343][T10056] CR2: ffffffffffffffd6 CR3: 00000000974d0000 CR4: 00000000001406f0 [ 92.399292][T10056] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 92.407240][T10056] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 92.415187][T10056] Call Trace: [ 92.418483][T10056] tc_bind_tclass+0x13e/0x2f0 [ 92.423148][T10056] ? qdisc_class_hash_init+0x110/0x110 [ 92.428597][T10056] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 92.434814][T10056] ? ns_capable_common+0x93/0x100 [ 92.439820][T10056] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 92.445524][T10056] ? qdisc_match_from_root+0x18a/0x280 [ 92.450959][T10056] tc_ctl_tclass+0xadb/0xcd0 [ 92.455537][T10056] ? qdisc_tree_reduce_backlog+0x570/0x570 [ 92.461331][T10056] ? rtnetlink_rcv_msg+0x3d0/0xb00 [ 92.466423][T10056] ? rtnetlink_rcv_msg+0x1ea/0xb00 [ 92.471515][T10056] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 92.477739][T10056] ? qdisc_tree_reduce_backlog+0x570/0x570 [ 92.483526][T10056] rtnetlink_rcv_msg+0x463/0xb00 [ 92.488443][T10056] ? rtnetlink_put_metrics+0x580/0x580 [ 92.493881][T10056] ? netdev_core_pick_tx+0x2f0/0x2f0 [ 92.499148][T10056] ? __copy_skb_header+0x250/0x550 [ 92.504236][T10056] netlink_rcv_skb+0x177/0x450 [ 92.508982][T10056] ? rtnetlink_put_metrics+0x580/0x580 [ 92.514430][T10056] ? netlink_ack+0xb30/0xb30 [ 92.518999][T10056] ? netlink_deliver_tap+0x254/0xbf0 [ 92.524261][T10056] rtnetlink_rcv+0x1d/0x30 [ 92.528669][T10056] netlink_unicast+0x531/0x710 [ 92.533419][T10056] ? netlink_attachskb+0x7c0/0x7c0 [ 92.538508][T10056] ? _copy_from_iter_full+0x25d/0x8a0 [ 92.543875][T10056] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 92.549575][T10056] ? __check_object_size+0x3d/0x437 [ 92.554753][T10056] netlink_sendmsg+0x8a5/0xd60 [ 92.559495][T10056] ? netlink_unicast+0x710/0x710 [ 92.564424][T10056] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 92.569945][T10056] ? apparmor_socket_sendmsg+0x2a/0x30 [ 92.575410][T10056] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 92.581733][T10056] ? security_socket_sendmsg+0x8d/0xc0 [ 92.587227][T10056] ? netlink_unicast+0x710/0x710 [ 92.592248][T10056] sock_sendmsg+0xd7/0x130 [ 92.596672][T10056] ___sys_sendmsg+0x803/0x920 [ 92.601338][T10056] ? copy_msghdr_from_user+0x440/0x440 [ 92.606786][T10056] ? __fget+0xa3/0x560 [ 92.610838][T10056] ? __fget+0x384/0x560 [ 92.614974][T10056] ? ksys_dup3+0x3e0/0x3e0 [ 92.619380][T10056] ? __might_fault+0xfb/0x1e0 [ 92.624038][T10056] ? __fget_light+0x1a9/0x230 [ 92.628693][T10056] ? __fdget+0x1b/0x20 [ 92.632741][T10056] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 92.638968][T10056] __sys_sendmsg+0x105/0x1d0 [ 92.643537][T10056] ? __sys_sendmsg_sock+0xd0/0xd0 [ 92.648560][T10056] ? __ia32_sys_clock_gettime32+0x16d/0x240 [ 92.654436][T10056] ? __x64_sys_clock_gettime32+0x240/0x240 [ 92.660239][T10056] ? entry_SYSENTER_compat+0x68/0x7f [ 92.665510][T10056] __ia32_compat_sys_sendmsg+0x7a/0xb0 [ 92.671006][T10056] do_fast_syscall_32+0x27b/0xdb3 [ 92.676012][T10056] entry_SYSENTER_compat+0x70/0x7f [ 92.681100][T10056] RIP: 0023:0xf7f43a29 [ 92.685148][T10056] Code: b8 80 96 98 00 eb cc 8b 04 24 c3 8b 1c 24 c3 8b 34 24 c3 8b 3c 24 c3 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 92.704738][T10056] RSP: 002b:00000000f7f3f0cc EFLAGS: 00000296 ORIG_RAX: 0000000000000172 [ 92.713130][T10056] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020000240 [ 92.721078][T10056] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 92.729029][T10056] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 92.736986][T10056] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 92.744931][T10056] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 92.752882][T10056] Modules linked in: [ 92.756756][T10056] CR2: 0000000000000000 [ 92.762566][T10056] ---[ end trace b9c8cbba1d7b574b ]--- [ 92.768922][T10056] RIP: 0010:0x0 [ 92.772393][T10056] Code: Bad RIP value. [ 92.777191][T10056] RSP: 0018:ffff888082c9f4c8 EFLAGS: 00010246 [ 92.783245][T10056] RAX: dffffc0000000000 RBX: ffffffff882a51a0 RCX: ffffffff85b40c56 [ 92.791315][T10056] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8880920cc340 [ 92.799337][T10056] RBP: ffff888082c9f5c0 R08: ffff888097976000 R09: ffff888082c9f648 [ 92.807360][T10056] R10: ffffed1010593ed7 R11: ffff888082c9f6bf R12: ffff8880920cc340 [ 92.815359][T10056] R13: 0000000000000001 R14: ffff888082c9f598 R15: ffffffff882a51a0 [ 92.823324][T10056] FS: 0000000000000000(0000) GS:ffff8880ae900000(0063) knlGS:00000000f7f3fb40 [ 92.832319][T10056] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 92.838985][T10056] CR2: ffffffffffffffd6 CR3: 00000000974d0000 CR4: 00000000001406e0 [ 92.847029][T10056] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 92.854994][T10056] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 92.863026][T10056] Kernel panic - not syncing: Fatal exception [ 92.870508][T10056] Kernel Offset: disabled [ 92.874839][T10056] Rebooting in 86400 seconds..