[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[   59.446080][   T26] audit: type=1800 audit(1558151159.550:25): pid=8647 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0
[   59.491559][   T26] audit: type=1800 audit(1558151159.550:26): pid=8647 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0
[   59.525644][   T26] audit: type=1800 audit(1558151159.560:27): pid=8647 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added '10.128.0.34' (ECDSA) to the list of known hosts.
2019/05/18 03:46:07 fuzzer started
2019/05/18 03:46:10 dialing manager at 10.128.0.26:37669
2019/05/18 03:46:10 syscalls: 1006
2019/05/18 03:46:10 code coverage: enabled
2019/05/18 03:46:10 comparison tracing: enabled
2019/05/18 03:46:10 extra coverage: extra coverage is not supported by the kernel
2019/05/18 03:46:10 setuid sandbox: enabled
2019/05/18 03:46:10 namespace sandbox: enabled
2019/05/18 03:46:10 Android sandbox: /sys/fs/selinux/policy does not exist
2019/05/18 03:46:10 fault injection: enabled
2019/05/18 03:46:10 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled
2019/05/18 03:46:10 net packet injection: enabled
2019/05/18 03:46:10 net device setup: enabled
03:46:14 executing program 0:
r0 = socket$inet(0x2, 0x2, 0x0)
getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x7, 0x0, &(0x7f0000000040))

syzkaller login: [   74.412545][ T8812] IPVS: ftp: loaded support on port[0] = 21
[   74.423396][ T8812] NET: Registered protocol family 30
[   74.429065][ T8812] Failed to register TIPC socket type
03:46:14 executing program 1:
r0 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @mcast2, 0x100000001}, 0x1c)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000000040)=0x3ff, 0x4)
r1 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @mcast1, 0x100000001}, 0x26)

[   74.671099][ T8814] IPVS: ftp: loaded support on port[0] = 21
[   74.681373][ T8814] NET: Registered protocol family 30
[   74.686850][ T8814] Failed to register TIPC socket type
03:46:14 executing program 2:
r0 = socket(0x10, 0x3, 0x0)
close(r0)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = socket$unix(0x1, 0x5, 0x0)
close(r2)
close(r1)
pipe(&(0x7f00000000c0))
r3 = socket$inet_udplite(0x2, 0x2, 0x88)
r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
close(r3)
close(r4)
write$binfmt_elf32(r2, &(0x7f0000000a40)=ANY=[@ANYBLOB="7f"], 0x1)
pipe(&(0x7f0000000100))
tee(r0, r4, 0x5, 0x0)

[   75.081505][ T8816] IPVS: ftp: loaded support on port[0] = 21
[   75.106456][ T8816] NET: Registered protocol family 30
[   75.111789][ T8816] Failed to register TIPC socket type
03:46:15 executing program 3:
r0 = socket$inet6_udplite(0xa, 0x2, 0x88)
ioctl(r0, 0x20000000008912, &(0x7f00000000c0)="0a5c2d0240316285717070")
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10, 0x20000000004, 0x4, 0x8}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r1, &(0x7f0000000040)}, 0x20)
bpf$MAP_LOOKUP_ELEM(0x3, &(0x7f0000000140)={r1, &(0x7f0000000040), &(0x7f0000000180)=""/181}, 0xe)

[   75.599621][ T8818] IPVS: ftp: loaded support on port[0] = 21
[   75.636383][ T8818] NET: Registered protocol family 30
[   75.641725][ T8818] Failed to register TIPC socket type
03:46:15 executing program 4:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x27}}, 0x10)
setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000140)=0x32, 0x4)
connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10)
setsockopt$sock_int(r0, 0x1, 0x5, &(0x7f0000000080), 0x4)

[   76.159213][ T8820] IPVS: ftp: loaded support on port[0] = 21
[   76.216259][ T8820] NET: Registered protocol family 30
[   76.221601][ T8820] Failed to register TIPC socket type
03:46:16 executing program 5:
r0 = socket$netlink(0x10, 0x3, 0x0)
writev(r0, &(0x7f0000000000)=[{&(0x7f0000000240)="39000000130009006900000000000000ab0080480a00000046000107000000141900040010000020000003f5000000000000ef38bf461e59d7", 0x39}], 0x1)

[   76.787407][ T8822] IPVS: ftp: loaded support on port[0] = 21
[   76.841952][ T8822] NET: Registered protocol family 30
[   76.888284][ T8822] Failed to register TIPC socket type
[   77.054467][ T8812] chnl_net:caif_netlink_parms(): no params data found
[   77.504858][ T8812] bridge0: port 1(bridge_slave_0) entered blocking state
[   77.592179][ T8812] bridge0: port 1(bridge_slave_0) entered disabled state
[   77.683087][ T8812] device bridge_slave_0 entered promiscuous mode
[   77.767605][ T8812] bridge0: port 2(bridge_slave_1) entered blocking state
[   77.932196][ T8812] bridge0: port 2(bridge_slave_1) entered disabled state
[   77.941444][ T8812] device bridge_slave_1 entered promiscuous mode
[   78.503757][ T8812] bond0: Enslaving bond_slave_0 as an active interface with an up link
[   78.850726][ T8812] bond0: Enslaving bond_slave_1 as an active interface with an up link
[   79.486529][ T8812] team0: Port device team_slave_0 added
[   79.814717][ T8812] team0: Port device team_slave_1 added
[   81.279578][ T8812] device hsr_slave_0 entered promiscuous mode
[   81.757452][ T8812] device hsr_slave_1 entered promiscuous mode
[   83.987264][ T8812] 8021q: adding VLAN 0 to HW filter on device bond0
[   84.543947][ T3538] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[   84.630356][ T3538] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[   84.838149][ T8812] 8021q: adding VLAN 0 to HW filter on device team0
[   85.155277][ T3538] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[   85.227762][ T3538] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[   85.383741][ T3538] bridge0: port 1(bridge_slave_0) entered blocking state
[   85.391038][ T3538] bridge0: port 1(bridge_slave_0) entered forwarding state
[   85.702568][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[   85.756656][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[   85.893827][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[   86.053504][   T12] bridge0: port 2(bridge_slave_1) entered blocking state
[   86.060634][   T12] bridge0: port 2(bridge_slave_1) entered forwarding state
[   86.295014][ T3511] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[   86.467521][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[   86.608683][ T3511] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[   86.693217][ T3511] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[   86.915256][ T3538] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[   86.952927][ T3538] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[   86.961738][ T3538] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[   87.411710][ T3511] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[   87.424916][ T3511] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[   87.553807][ T3511] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[   87.792609][ T3511] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[   87.954244][ T8812] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[   88.384565][ T8812] 8021q: adding VLAN 0 to HW filter on device batadv0
03:46:32 executing program 0:
r0 = socket$inet(0x2, 0x2, 0x0)
getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x7, 0x0, &(0x7f0000000040))

03:46:33 executing program 0:
r0 = socket$inet(0x2, 0x2, 0x0)
getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x7, 0x0, &(0x7f0000000040))

03:46:35 executing program 0:
r0 = socket$inet(0x2, 0x2, 0x0)
getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x7, 0x0, &(0x7f0000000040))

03:46:37 executing program 0:
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000040)={0x2, 0x3, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0x2, 0x0, 0x0, @empty={[0xb1291b5011010004, 0xffffff7f]}}}]}, 0x38}}, 0x0)

[   97.957364][ T9307] IPVS: ftp: loaded support on port[0] = 21
[   97.978638][ T9310] IPVS: ftp: loaded support on port[0] = 21
[   98.083116][ T9308] IPVS: ftp: loaded support on port[0] = 21
[   98.445904][ T9307] NET: Registered protocol family 30
[   98.449091][ T9312] IPVS: ftp: loaded support on port[0] = 21
[   98.582606][ T9310] list_add double add: new=ffffffff89544ab0, prev=ffffffff89334ac0, next=ffffffff89544ab0.
[   98.782756][ T9314] IPVS: ftp: loaded support on port[0] = 21
[   98.842064][ T9307] Failed to register TIPC socket type
[   99.042465][ T9310] ------------[ cut here ]------------
[   99.047982][ T9310] kernel BUG at lib/list_debug.c:29!
[   99.532115][ T9310] invalid opcode: 0000 [#1] PREEMPT SMP KASAN
[   99.538265][ T9310] CPU: 0 PID: 9310 Comm: syz-executor.3 Not tainted 5.1.0+ #18
[   99.545799][ T9310] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   99.555874][ T9310] RIP: 0010:__list_add_valid.cold+0x26/0x3c
[   99.561773][ T9310] Code: 56 ff ff ff 4c 89 e1 48 c7 c7 20 4c a3 87 e8 00 60 25 fe 0f 0b 48 89 f2 4c 89 e1 4c 89 ee 48 c7 c7 60 4d a3 87 e8 e9 5f 25 fe <0f> 0b 48 89 f1 48 c7 c7 e0 4c a3 87 4c 89 e6 e8 d5 5f 25 fe 0f 0b
[   99.581385][ T9310] RSP: 0018:ffff88807a8cfb88 EFLAGS: 00010282
[   99.587459][ T9310] RAX: 0000000000000058 RBX: ffffffff89544920 RCX: 0000000000000000
[   99.595433][ T9310] RDX: 0000000000000000 RSI: ffffffff815afbe6 RDI: ffffed100f519f63
[   99.603407][ T9310] RBP: ffff88807a8cfba0 R08: 0000000000000058 R09: ffffed1015d06011
[   99.611384][ T9310] R10: ffffed1015d06010 R11: ffff8880ae830087 R12: ffffffff89544ab0
[   99.619362][ T9310] R13: ffffffff89544ab0 R14: ffffffff89544ab0 R15: ffffffff89544a50
[   99.627348][ T9310] FS:  00000000024b0940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
[   99.636278][ T9310] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   99.642861][ T9310] CR2: 0000000020000040 CR3: 000000007ae35000 CR4: 00000000001406f0
[   99.650835][ T9310] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   99.658809][ T9310] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   99.666779][ T9310] Call Trace:
[   99.670075][ T9310]  ? mutex_lock_nested+0x16/0x20
[   99.675021][ T9310]  proto_register+0x459/0x8e0
[   99.679698][ T9310]  ? lockdep_init_map+0x1be/0x6d0
[   99.684732][ T9310]  tipc_socket_init+0x1c/0x70
[   99.689414][ T9310]  tipc_init_net+0x32a/0x5b0
[   99.694002][ T9310]  ? tipc_exit_net+0x40/0x40
[   99.698596][ T9310]  ops_init+0xb6/0x410
[   99.702667][ T9310]  setup_net+0x2d3/0x740
[   99.706910][ T9310]  ? copy_net_ns+0x1c0/0x340
[   99.711502][ T9310]  ? ops_init+0x410/0x410
[   99.715834][ T9310]  ? kasan_check_write+0x14/0x20
[   99.720779][ T9310]  ? down_read_killable+0x51/0x220
[   99.725899][ T9310]  copy_net_ns+0x1df/0x340
[   99.730321][ T9310]  create_new_namespaces+0x400/0x7b0
[   99.735612][ T9310]  unshare_nsproxy_namespaces+0xc2/0x200
[   99.741252][ T9310]  ksys_unshare+0x440/0x980
[   99.745757][ T9310]  ? trace_hardirqs_on+0x67/0x230
[   99.750797][ T9310]  ? walk_process_tree+0x2d0/0x2d0
[   99.755915][ T9310]  ? blkcg_exit_queue+0x30/0x30
[   99.760773][ T9310]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   99.766250][ T9310]  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   99.772318][ T9310]  ? do_syscall_64+0x26/0x680
[   99.776997][ T9310]  ? lockdep_hardirqs_on+0x418/0x5d0
[   99.782316][ T9310]  __x64_sys_unshare+0x31/0x40
[   99.787089][ T9310]  do_syscall_64+0x103/0x680
[   99.791688][ T9310]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   99.797576][ T9310] RIP: 0033:0x45b897
[   99.801475][ T9310] Code: 00 00 00 b8 63 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 ad 8d fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 10 01 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 8d 8d fb ff c3 66 2e 0f 1f 84 00 00 00 00
[   99.821081][ T9310] RSP: 002b:00007ffde92d2698 EFLAGS: 00000206 ORIG_RAX: 0000000000000110
[   99.829498][ T9310] RAX: ffffffffffffffda RBX: 000000000073c988 RCX: 000000000045b897
[   99.837474][ T9310] RDX: 0000000000000000 RSI: 00007ffde92d2640 RDI: 0000000040000000
[   99.845454][ T9310] RBP: 00000000000000f8 R08: 0000000000000000 R09: 0000000000000005
[   99.853432][ T9310] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000414ab0
[   99.861409][ T9310] R13: 0000000000414b40 R14: 0000000000000000 R15: 0000000000000000
[   99.869389][ T9310] Modules linked in:
03:46:40 executing program 0:
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000040)={0x2, 0x3, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0x2, 0x0, 0x0, @empty={[0xb1291b5011010004, 0xffffff7f]}}}]}, 0x38}}, 0x0)

[  100.254441][ T3880] kobject: 'loop0' (000000002e3d31f1): kobject_uevent_env
[  100.261634][ T3880] kobject: 'loop0' (000000002e3d31f1): fill_kobj_path: path = '/devices/virtual/block/loop0'
03:46:41 executing program 0:
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000040)={0x2, 0x3, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0x2, 0x0, 0x0, @empty={[0xb1291b5011010004, 0xffffff7f]}}}]}, 0x38}}, 0x0)

[  101.489118][ T3880] kobject: 'loop0' (000000002e3d31f1): kobject_uevent_env
[  102.172525][ T3880] kobject: 'loop0' (000000002e3d31f1): fill_kobj_path: path = '/devices/virtual/block/loop0'
03:46:43 executing program 0:
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000040)={0x2, 0x3, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0x2, 0x0, 0x0, @empty={[0xb1291b5011010004, 0xffffff7f]}}}]}, 0x38}}, 0x0)

[  103.237647][ T3880] kobject: 'loop0' (000000002e3d31f1): kobject_uevent_env
[  103.322100][ T3880] kobject: 'loop0' (000000002e3d31f1): fill_kobj_path: path = '/devices/virtual/block/loop0'
[  104.062701][ T3880] kobject: 'loop0' (000000002e3d31f1): kobject_uevent_env
[  104.070073][ T3880] kobject: 'loop0' (000000002e3d31f1): fill_kobj_path: path = '/devices/virtual/block/loop0'