[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.3' (ECDSA) to the list of known hosts. 2020/08/18 06:50:59 parsed 1 programs 2020/08/18 06:50:59 executed programs: 0 syzkaller login: [ 147.524102][ T6871] IPVS: ftp: loaded support on port[0] = 21 [ 147.705841][ T6871] chnl_net:caif_netlink_parms(): no params data found [ 147.753858][ T6871] bridge0: port 1(bridge_slave_0) entered blocking state [ 147.762180][ T6871] bridge0: port 1(bridge_slave_0) entered disabled state [ 147.771546][ T6871] device bridge_slave_0 entered promiscuous mode [ 147.780667][ T6871] bridge0: port 2(bridge_slave_1) entered blocking state [ 147.787724][ T6871] bridge0: port 2(bridge_slave_1) entered disabled state [ 147.795627][ T6871] device bridge_slave_1 entered promiscuous mode [ 147.814125][ T6871] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 147.824702][ T6871] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 147.844964][ T6871] team0: Port device team_slave_0 added [ 147.852273][ T6871] team0: Port device team_slave_1 added [ 147.868187][ T6871] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 147.875205][ T6871] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 147.901123][ T6871] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 147.913864][ T6871] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 147.920863][ T6871] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 147.946782][ T6871] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 147.972685][ T6871] device hsr_slave_0 entered promiscuous mode [ 147.979704][ T6871] device hsr_slave_1 entered promiscuous mode [ 148.067694][ T6871] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 148.077087][ T6871] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 148.087008][ T6871] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 148.096893][ T6871] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 148.118965][ T6871] bridge0: port 2(bridge_slave_1) entered blocking state [ 148.126099][ T6871] bridge0: port 2(bridge_slave_1) entered forwarding state [ 148.133811][ T6871] bridge0: port 1(bridge_slave_0) entered blocking state [ 148.140925][ T6871] bridge0: port 1(bridge_slave_0) entered forwarding state [ 148.184500][ T6871] 8021q: adding VLAN 0 to HW filter on device bond0 [ 148.196997][ T3887] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 148.206930][ T3887] bridge0: port 1(bridge_slave_0) entered disabled state [ 148.215162][ T3887] bridge0: port 2(bridge_slave_1) entered disabled state [ 148.223802][ T3887] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 148.236393][ T6871] 8021q: adding VLAN 0 to HW filter on device team0 [ 148.247069][ T2582] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 148.256110][ T2582] bridge0: port 1(bridge_slave_0) entered blocking state [ 148.263202][ T2582] bridge0: port 1(bridge_slave_0) entered forwarding state [ 148.280705][ T3887] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 148.289471][ T3887] bridge0: port 2(bridge_slave_1) entered blocking state [ 148.296509][ T3887] bridge0: port 2(bridge_slave_1) entered forwarding state [ 148.316867][ T6871] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 148.327285][ T6871] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 148.341564][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 148.351808][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 148.361140][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 148.370929][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 148.380000][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 148.387509][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 148.409950][ T6871] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 148.417714][ T3925] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 148.426210][ T3925] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 148.444701][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 148.463095][ T3925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 148.472572][ T3925] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 148.480529][ T3925] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 148.491584][ T6871] device veth0_vlan entered promiscuous mode [ 148.503528][ T6871] device veth1_vlan entered promiscuous mode [ 148.523623][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 148.532605][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 148.541237][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 148.552773][ T6871] device veth0_macvtap entered promiscuous mode [ 148.562458][ T6871] device veth1_macvtap entered promiscuous mode [ 148.578988][ T6871] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 148.586527][ T3925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 148.595449][ T3925] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 148.608437][ T6871] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 148.617305][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 148.628357][ T6871] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 148.638335][ T6871] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 148.647204][ T6871] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 148.656052][ T6871] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 149.569906][ T2582] Bluetooth: hci0: command 0x0409 tx timeout 2020/08/18 06:51:04 executed programs: 81 [ 151.648879][ T3887] Bluetooth: hci0: command 0x041b tx timeout [ 153.729175][ T2582] Bluetooth: hci0: command 0x040f tx timeout [ 155.818471][ T2582] Bluetooth: hci0: command 0x0419 tx timeout 2020/08/18 06:51:09 executed programs: 235 2020/08/18 06:51:14 executed programs: 391 2020/08/18 06:51:19 executed programs: 552 2020/08/18 06:51:24 executed programs: 753 2020/08/18 06:51:29 executed programs: 1207 2020/08/18 06:51:34 executed programs: 1661 2020/08/18 06:51:39 executed programs: 2110 2020/08/18 06:51:44 executed programs: 2558 [ 196.372345][T17756] mm ffff88808baaf740 mmap ffff8880936cc840 seqnum 0 task_size 140737488351232 [ 196.372345][T17756] get_unmapped_area ffffffff8129caa0 [ 196.372345][T17756] mmap_base 140243032055808 mmap_legacy_base 47389763112960 highest_vm_end 140732389707776 [ 196.372345][T17756] pgd ffff888098a45000 mm_users 2 mm_count 2 pgtables_bytes 65536 map_count 19 [ 196.372345][T17756] hiwater_rss 1a hiwater_vm 38f7 total_vm 3918 locked_vm 0 [ 196.372345][T17756] pinned_vm 0 data_vm 23aa exec_vm 144 stack_vm 21 [ 196.372345][T17756] start_code 400000 end_code 541f9b start_data 742ea8 end_data 74aa50 [ 196.372345][T17756] start_brk 2550000 brk 2572000 start_stack 7ffed00f1a10 [ 196.372345][T17756] arg_start 7ffed00f1e9f arg_end 7ffed00f1eb4 env_start 7ffed00f1eb4 env_end 7ffed00f1fe3 [ 196.372345][T17756] binfmt ffffffff89cdc6c0 flags cd core_state ffffc900081e7bf8 [ 196.372345][T17756] ioctx_table 0000000000000000 [ 196.372345][T17756] owner ffff888088de0000 exe_file ffff888097b26280 [ 196.463951][T17756] ------------[ cut here ]------------ [ 196.469642][T17756] kernel BUG at mm/khugepaged.c:469! [ 196.474949][T17756] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 196.481011][T17756] CPU: 0 PID: 17756 Comm: syz-executor.0 Not tainted 5.9.0-rc1-syzkaller #0 [ 196.489689][T17756] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 196.499762][T17756] RIP: 0010:__khugepaged_enter+0x306/0x3d0 [ 196.505553][T17756] Code: e4 49 81 fe c0 b3 c9 89 74 2a e8 c5 75 bb ff 44 89 e0 5b 5d 41 5c 41 5d 41 5e 41 5f c3 e8 b2 75 bb ff 48 89 ef e8 ea d5 e9 ff <0f> 0b 41 bc f4 ff ff ff eb d6 e8 9b 75 bb ff 31 c9 ba 01 00 00 00 [ 196.526102][T17756] RSP: 0000:ffffc900081a7cc0 EFLAGS: 00010286 [ 196.532168][T17756] RAX: 0000000000000367 RBX: 0000000000000002 RCX: 0000000000000000 [ 196.540143][T17756] RDX: ffff888088de0000 RSI: ffffffff815dafc7 RDI: fffff52001034f37 [ 196.548101][T17756] RBP: ffff88808baaf740 R08: 0000000000000367 R09: ffff8880ae6318e7 [ 196.556073][T17756] R10: 0000000000000000 R11: 000000000009d918 R12: ffff8880a46df840 [ 196.564044][T17756] R13: ffff88808baaf79c R14: 0000000020000000 R15: ffffc900081a7df8 [ 196.572009][T17756] FS: 0000000002550940(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000 [ 196.580922][T17756] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 196.587487][T17756] CR2: 0000000020001240 CR3: 0000000098a45000 CR4: 00000000001506f0 [ 196.595448][T17756] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 196.603829][T17756] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 196.611785][T17756] Call Trace: [ 196.615068][T17756] do_huge_pmd_anonymous_page+0xaa1/0x2230 [ 196.621329][T17756] handle_mm_fault+0x369d/0x4590 [ 196.626459][T17756] ? apply_to_existing_page_range+0x40/0x40 [ 196.632342][T17756] ? vmacache_update+0xce/0x140 [ 196.637270][T17756] do_user_addr_fault+0x598/0xbf0 [ 196.642784][T17756] exc_page_fault+0xa8/0x160 [ 196.647380][T17756] ? asm_exc_page_fault+0x8/0x30 [ 196.652569][T17756] asm_exc_page_fault+0x1e/0x30 [ 196.657601][T17756] RIP: 0033:0x444481 [ 196.661848][T17756] Code: 8d 15 e3 81 0d 00 8b 0c 8a 8b 04 82 29 c8 c3 66 2e 0f 1f 84 00 00 00 00 00 48 83 fa 20 48 89 f8 73 77 f6 c2 01 74 0b 0f b6 0e <88> 0f 48 ff c6 48 ff c7 f6 c2 02 74 12 0f b7 0e 66 89 0f 48 83 c6 [ 196.681734][T17756] RSP: 002b:000000000169fbe8 EFLAGS: 00010202 [ 196.687879][T17756] RAX: 0000000020001240 RBX: 0000000000000000 RCX: 0000000000000054 [ 196.695906][T17756] RDX: 0000000000000007 RSI: 00000000011900b0 RDI: 0000000020001240 [ 196.703917][T17756] RBP: 0000000001190090 R08: 0000000000000000 R09: 0000000000000000 [ 196.712024][T17756] R10: 000000000169fcd0 R11: 0000000000000246 R12: 0000000001190098 [ 196.719982][T17756] R13: 000000000002ff4f R14: fffffffffffffffe R15: 000000000118cf4c [ 196.728158][T17756] Modules linked in: [ 196.733006][T17756] ---[ end trace 94dca7a68305aa2e ]--- [ 196.738547][T17756] RIP: 0010:__khugepaged_enter+0x306/0x3d0 [ 196.744447][T17756] Code: e4 49 81 fe c0 b3 c9 89 74 2a e8 c5 75 bb ff 44 89 e0 5b 5d 41 5c 41 5d 41 5e 41 5f c3 e8 b2 75 bb ff 48 89 ef e8 ea d5 e9 ff <0f> 0b 41 bc f4 ff ff ff eb d6 e8 9b 75 bb ff 31 c9 ba 01 00 00 00 [ 196.765415][T17756] RSP: 0000:ffffc900081a7cc0 EFLAGS: 00010286 [ 196.771730][T17756] RAX: 0000000000000367 RBX: 0000000000000002 RCX: 0000000000000000 [ 196.779879][T17756] RDX: ffff888088de0000 RSI: ffffffff815dafc7 RDI: fffff52001034f37 [ 196.788068][T17756] RBP: ffff88808baaf740 R08: 0000000000000367 R09: ffff8880ae6318e7 [ 196.796102][T17756] R10: 0000000000000000 R11: 000000000009d918 R12: ffff8880a46df840 [ 196.804254][T17756] R13: ffff88808baaf79c R14: 0000000020000000 R15: ffffc900081a7df8 [ 196.812512][T17756] FS: 0000000002550940(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000 [ 196.821522][T17756] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 196.828153][T17756] CR2: 0000000020001240 CR3: 0000000098a45000 CR4: 00000000001506f0 [ 196.837332][T17756] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 196.845566][T17756] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 196.853662][T17756] Kernel panic - not syncing: Fatal exception [ 196.861485][T17756] Kernel Offset: disabled [ 196.865813][T17756] Rebooting in 86400 seconds..