[ OK ] Started Getty on tty2. [ OK ] Started Serial Getty on ttyS0. [ OK ] Started Getty on tty1. [ OK ] Started OpenBSD Secure Shell server. [ OK ] Started getty on tty2-tty6 if dbus and logind are not available. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.234' (ECDSA) to the list of known hosts. syzkaller login: [ 56.782737][ T6829] IPVS: ftp: loaded support on port[0] = 21 [ 56.874765][ T6829] chnl_net:caif_netlink_parms(): no params data found [ 56.928997][ T6829] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.936666][ T6829] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.946423][ T6829] device bridge_slave_0 entered promiscuous mode [ 56.955078][ T6829] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.963803][ T6829] bridge0: port 2(bridge_slave_1) entered disabled state [ 56.971384][ T6829] device bridge_slave_1 entered promiscuous mode [ 56.992652][ T6829] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 57.003945][ T6829] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 57.026650][ T6829] team0: Port device team_slave_0 added [ 57.034331][ T6829] team0: Port device team_slave_1 added [ 57.052742][ T6829] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 57.059680][ T6829] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 57.087535][ T6829] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 57.100521][ T6829] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 57.108047][ T6829] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 57.134913][ T6829] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 57.161889][ T6829] device hsr_slave_0 entered promiscuous mode [ 57.168479][ T6829] device hsr_slave_1 entered promiscuous mode [ 57.263345][ T6829] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 57.277706][ T6829] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 57.286460][ T6829] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 57.299219][ T6829] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 57.324374][ T6829] bridge0: port 2(bridge_slave_1) entered blocking state [ 57.331482][ T6829] bridge0: port 2(bridge_slave_1) entered forwarding state [ 57.339339][ T6829] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.346490][ T6829] bridge0: port 1(bridge_slave_0) entered forwarding state [ 57.391156][ T6829] 8021q: adding VLAN 0 to HW filter on device bond0 [ 57.404987][ T2604] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 57.415943][ T2604] bridge0: port 1(bridge_slave_0) entered disabled state [ 57.424516][ T2604] bridge0: port 2(bridge_slave_1) entered disabled state [ 57.433833][ T2604] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 57.446412][ T6829] 8021q: adding VLAN 0 to HW filter on device team0 [ 57.458578][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 57.467756][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.474900][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 57.492313][ T2604] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 57.500723][ T2604] bridge0: port 2(bridge_slave_1) entered blocking state [ 57.507840][ T2604] bridge0: port 2(bridge_slave_1) entered forwarding state [ 57.529399][ T6829] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 57.540569][ T6829] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 57.555094][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 57.564147][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 57.572765][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 57.581226][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 57.591461][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 57.599318][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 57.618541][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 57.626101][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 57.639542][ T6829] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 57.658659][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 57.677915][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 57.686835][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 57.695154][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 57.705586][ T6829] device veth0_vlan entered promiscuous mode [ 57.718435][ T6829] device veth1_vlan entered promiscuous mode [ 57.739206][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 57.748450][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 57.756851][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 57.767902][ T6829] device veth0_macvtap entered promiscuous mode [ 57.778253][ T6829] device veth1_macvtap entered promiscuous mode [ 57.797391][ T6829] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 57.804979][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 57.816052][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 57.827770][ T6829] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 57.836475][ T7035] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 57.848800][ T6829] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 57.857977][ T6829] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.866766][ T6829] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.875533][ T6829] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 executing program executing program executing program executing program [ 57.964785][ T7050] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 57.972117][ T7050] IPv6: NLM_F_CREATE should be set when creating new route [ 57.979308][ T7050] IPv6: NLM_F_CREATE should be set when creating new route [ 57.986630][ T7050] general protection fault, probably for non-canonical address 0xdffffc0000000010: 0000 [#1] PREEMPT SMP KASAN [ 57.998362][ T7050] KASAN: null-ptr-deref in range [0x0000000000000080-0x0000000000000087] [ 58.006744][ T7050] CPU: 1 PID: 7050 Comm: syz-executor648 Not tainted 5.9.0-rc1-syzkaller #0 [ 58.015382][ T7050] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 58.025420][ T7050] RIP: 0010:rt6_fill_node+0x1396/0x2940 [ 58.030950][ T7050] Code: 3c 02 00 0f 85 ef 14 00 00 4d 8b 6d 10 e8 f2 1c 87 fa 49 8d bd 80 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 10 15 00 00 4d 8b ad 80 00 00 00 e8 34 4b 06 01 [ 58.050527][ T7050] RSP: 0018:ffffc900063672b0 EFLAGS: 00010202 [ 58.056567][ T7050] RAX: dffffc0000000000 RBX: ffff8880a88bd800 RCX: ffffffff86ed2456 [ 58.064513][ T7050] RDX: 0000000000000010 RSI: ffffffff86ed248e RDI: 0000000000000080 [ 58.072457][ T7050] RBP: ffffc900063673e8 R08: 0000000000000001 R09: ffff8880a88bd847 [ 58.080424][ T7050] R10: 0000000000000001 R11: 0000000000000000 R12: ffff8880a8ded940 [ 58.088370][ T7050] R13: 0000000000000000 R14: ffff8880a899ea00 R15: 0000000000000000 [ 58.096329][ T7050] FS: 00000000010e3880(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000 [ 58.105243][ T7050] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 58.111799][ T7050] CR2: 0000000020000300 CR3: 00000000a8efa000 CR4: 00000000001506e0 [ 58.119747][ T7050] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 58.127706][ T7050] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 58.135648][ T7050] Call Trace: [ 58.138929][ T7050] ? __find_rr_leaf+0xd10/0xd10 [ 58.143763][ T7050] ? kmem_cache_alloc_node_trace+0x39f/0x400 [ 58.149727][ T7050] ? kasan_unpoison_shadow+0x33/0x40 [ 58.154985][ T7050] ? __phys_addr+0x9a/0x110 [ 58.159461][ T7050] ? memset+0x20/0x40 [ 58.163426][ T7050] inet6_rt_notify+0x14c/0x2b0 [ 58.168164][ T7050] fib6_add+0x2840/0x3ed0 [ 58.172475][ T7050] ? fib6_update_sernum_stub+0x80/0x80 [ 58.177915][ T7050] ? do_raw_spin_lock+0x120/0x2b0 [ 58.182940][ T7050] ip6_route_add+0x8b/0x150 [ 58.187430][ T7050] inet6_rtm_newroute+0x152/0x160 [ 58.192426][ T7050] ? ip6_route_multipath_add+0x1ee0/0x1ee0 [ 58.198205][ T7050] ? rtnetlink_rcv_msg+0x3f9/0xad0 [ 58.203295][ T7050] ? lock_is_held_type+0xbb/0xf0 [ 58.208206][ T7050] ? ip6_route_multipath_add+0x1ee0/0x1ee0 [ 58.213998][ T7050] rtnetlink_rcv_msg+0x44e/0xad0 [ 58.218912][ T7050] ? rtnetlink_put_metrics+0x510/0x510 [ 58.224360][ T7050] ? lock_acquire+0x1f1/0xad0 [ 58.229021][ T7050] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 58.234282][ T7050] netlink_rcv_skb+0x15a/0x430 [ 58.239020][ T7050] ? rtnetlink_put_metrics+0x510/0x510 [ 58.244450][ T7050] ? netlink_ack+0xa10/0xa10 [ 58.249024][ T7050] netlink_unicast+0x533/0x7d0 [ 58.253764][ T7050] ? netlink_attachskb+0x810/0x810 [ 58.258848][ T7050] ? _copy_from_iter_full+0x247/0x890 [ 58.264192][ T7050] ? __phys_addr+0x9a/0x110 [ 58.268685][ T7050] ? __phys_addr_symbol+0x2c/0x70 [ 58.273681][ T7050] ? __check_object_size+0x171/0x3e4 [ 58.278940][ T7050] netlink_sendmsg+0x856/0xd90 [ 58.283684][ T7050] ? netlink_unicast+0x7d0/0x7d0 [ 58.288601][ T7050] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 58.293860][ T7050] ? netlink_unicast+0x7d0/0x7d0 [ 58.298771][ T7050] sock_sendmsg+0xcf/0x120 [ 58.303168][ T7050] ____sys_sendmsg+0x6e8/0x810 [ 58.307907][ T7050] ? kernel_sendmsg+0x50/0x50 [ 58.312556][ T7050] ? do_recvmmsg+0x6d0/0x6d0 [ 58.317119][ T7050] ? __might_fault+0xef/0x1d0 [ 58.321776][ T7050] ? find_held_lock+0x2d/0x110 [ 58.326521][ T7050] ? __might_fault+0x11f/0x1d0 [ 58.331260][ T7050] ___sys_sendmsg+0xf3/0x170 [ 58.335823][ T7050] ? sendmsg_copy_msghdr+0x160/0x160 [ 58.341103][ T7050] ? __might_fault+0x190/0x1d0 [ 58.345867][ T7050] ? _copy_to_user+0x126/0x160 [ 58.350606][ T7050] ? sock_do_ioctl+0x168/0x2d0 [ 58.355342][ T7050] ? compat_ifr_data_ioctl+0x150/0x150 [ 58.360786][ T7050] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 58.366671][ T7050] ? __fget_light+0x215/0x280 [ 58.371337][ T7050] __sys_sendmsg+0xe5/0x1b0 [ 58.375835][ T7050] ? __sys_sendmsg_sock+0xb0/0xb0 [ 58.380835][ T7050] ? trace_hardirqs_on+0x5f/0x220 [ 58.385852][ T7050] ? lockdep_hardirqs_on+0x76/0xf0 [ 58.390939][ T7050] do_syscall_64+0x2d/0x70 [ 58.395332][ T7050] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 58.401197][ T7050] RIP: 0033:0x443ef9 [ 58.405078][ T7050] Code: e8 8c 07 03 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 bb 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 58.424657][ T7050] RSP: 002b:00007fff25138308 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 58.433040][ T7050] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000443ef9 [ 58.440985][ T7050] RDX: 0000000000000000 RSI: 0000000020000300 RDI: 0000000000000003 [ 58.448929][ T7050] RBP: 00007fff25138310 R08: 0000000000000000 R09: 0000000000000000 [ 58.456873][ T7050] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000e25f [ 58.464816][ T7050] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 58.472782][ T7050] Modules linked in: [ 58.476726][ T7050] ---[ end trace 46e9e8854602a8a3 ]--- [ 58.482209][ T7050] RIP: 0010:rt6_fill_node+0x1396/0x2940 [ 58.487755][ T7050] Code: 3c 02 00 0f 85 ef 14 00 00 4d 8b 6d 10 e8 f2 1c 87 fa 49 8d bd 80 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 10 15 00 00 4d 8b ad 80 00 00 00 e8 34 4b 06 01 [ 58.507392][ T7050] RSP: 0018:ffffc900063672b0 EFLAGS: 00010202 [ 58.513486][ T7050] RAX: dffffc0000000000 RBX: ffff8880a88bd800 RCX: ffffffff86ed2456 [ 58.521484][ T7050] RDX: 0000000000000010 RSI: ffffffff86ed248e RDI: 0000000000000080 [ 58.529463][ T7050] RBP: ffffc900063673e8 R08: 0000000000000001 R09: ffff8880a88bd847 [ 58.537482][ T7050] R10: 0000000000000001 R11: 0000000000000000 R12: ffff8880a8ded940 [ 58.545491][ T7050] R13: 0000000000000000 R14: ffff8880a899ea00 R15: 0000000000000000 [ 58.553492][ T7050] FS: 00000000010e3880(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000 [ 58.562455][ T7050] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 58.569026][ T7050] CR2: 0000000020000300 CR3: 00000000a8efa000 CR4: 00000000001506e0 [ 58.577024][ T7050] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 58.585024][ T7050] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 58.593077][ T7050] Kernel panic - not syncing: Fatal exception in interrupt [ 58.601335][ T7050] Kernel Offset: disabled [ 58.605739][ T7050] Rebooting in 86400 seconds..