[ 58.244539][ T27] audit: type=1800 audit(1558154730.298:25): pid=8754 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 58.288637][ T27] audit: type=1800 audit(1558154730.308:26): pid=8754 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 58.316832][ T27] audit: type=1800 audit(1558154730.308:27): pid=8754 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [....] startpar: service(s) returned failure: ssh ...[?25l[?1c7[FAIL8[?25h[?0c failed! Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.33' (ECDSA) to the list of known hosts. 2019/05/18 04:45:40 fuzzer started 2019/05/18 04:45:43 dialing manager at 10.128.0.26:37669 2019/05/18 04:45:43 syscalls: 1006 2019/05/18 04:45:43 code coverage: enabled 2019/05/18 04:45:43 comparison tracing: enabled 2019/05/18 04:45:43 extra coverage: extra coverage is not supported by the kernel 2019/05/18 04:45:43 setuid sandbox: enabled 2019/05/18 04:45:43 namespace sandbox: enabled 2019/05/18 04:45:43 Android sandbox: /sys/fs/selinux/policy does not exist 2019/05/18 04:45:43 fault injection: enabled 2019/05/18 04:45:43 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/05/18 04:45:43 net packet injection: enabled 2019/05/18 04:45:43 net device setup: enabled 04:45:46 executing program 0: r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x22, &(0x7f0000000000)=[@in={0x2, 0x4e23, @local}], 0x10) syzkaller login: [ 75.018555][ T8943] IPVS: ftp: loaded support on port[0] = 21 [ 75.029422][ T8943] NET: Registered protocol family 30 [ 75.034713][ T8943] Failed to register TIPC socket type 04:45:47 executing program 1: r0 = socket$unix(0x1, 0x2, 0x0) r1 = socket$unix(0x1, 0x800000000005, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) listen(r1, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) connect(r2, &(0x7f0000931ff4)=@un=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) sendmsg$unix(r2, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000100000001000000", @ANYRES64=r2], 0x18}, 0x0) close(r2) close(r0) [ 75.317403][ T8945] IPVS: ftp: loaded support on port[0] = 21 [ 75.342566][ T8945] NET: Registered protocol family 30 [ 75.347858][ T8945] Failed to register TIPC socket type 04:45:47 executing program 2: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000a34fff)='H', 0x1, 0x0, &(0x7f0000030ff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) connect$inet(r0, &(0x7f0000301000)={0x2, 0x0, @rand_addr=0x80000001}, 0x10) shutdown(r0, 0x1) sendmmsg(r0, &(0x7f00000010c0)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)="ca", 0x1}], 0x1, &(0x7f0000000140)}}, {{&(0x7f00000004c0)=@alg={0x26, 'aead\x00', 0x0, 0x0, 'gcm(seed-generic)\x00'}, 0x80, &(0x7f0000000600), 0x0, &(0x7f0000000640)=[{0x10, 0x84, 0x800}], 0x10}}], 0x2, 0x0) [ 75.633493][ T8947] IPVS: ftp: loaded support on port[0] = 21 [ 75.652743][ T8947] NET: Registered protocol family 30 [ 75.658041][ T8947] Failed to register TIPC socket type 04:45:48 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x2, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) ioctl$SIOCAX25GETINFO(r1, 0x89e9, &(0x7f0000000200)) [ 76.205900][ T8949] IPVS: ftp: loaded support on port[0] = 21 [ 76.242524][ T8949] NET: Registered protocol family 30 [ 76.247832][ T8949] Failed to register TIPC socket type 04:45:48 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) r2 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r1, &(0x7f0000000340)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x401}, 0x10) bind$llc(r2, &(0x7f0000000040)={0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1, @dev}, 0x10) connect$llc(r2, &(0x7f0000000080)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, 0x10) [ 76.835392][ T8951] IPVS: ftp: loaded support on port[0] = 21 [ 76.862603][ T8951] NET: Registered protocol family 30 [ 76.867910][ T8951] Failed to register TIPC socket type 04:45:49 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$netlink(0x10, 0x3, 0x0) setsockopt(r1, 0x10e, 0xb, &(0x7f00000004c0)="9adc01ce", 0x4) ioctl(r0, 0x101000008912, &(0x7f0000000140)="0adc1f123c123f3188b070") sendmsg(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000040)="24000000200007041dfffd946f610500020000001f00000000000800050018000400ff7e280000001100ffffba16a0aa1c0900000000000012000000000000eff24d8238cfa47e23f7efbf54", 0x4c}], 0x1}, 0x0) [ 77.556887][ T8953] IPVS: ftp: loaded support on port[0] = 21 [ 77.654434][ T8953] NET: Registered protocol family 30 [ 77.768422][ T8953] Failed to register TIPC socket type [ 77.866604][ T8943] chnl_net:caif_netlink_parms(): no params data found [ 78.170258][ T8943] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.177833][ T8943] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.260838][ T8943] device bridge_slave_0 entered promiscuous mode [ 78.369804][ T8943] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.376975][ T8943] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.480421][ T8943] device bridge_slave_1 entered promiscuous mode [ 79.099739][ T8943] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 79.342507][ T8943] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 80.002642][ T8943] team0: Port device team_slave_0 added [ 80.355698][ T8943] team0: Port device team_slave_1 added [ 81.684872][ T8943] device hsr_slave_0 entered promiscuous mode [ 82.302658][ T8943] device hsr_slave_1 entered promiscuous mode [ 84.669350][ T8943] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.170277][ T9183] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 85.239754][ T9183] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 85.440495][ T8943] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.751174][ T9183] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 85.813296][ T9183] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 85.939070][ T9183] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.946284][ T9183] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.392835][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 86.419559][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 86.585958][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 86.745782][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.752970][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.968734][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 87.179950][ T9300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 87.369577][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 87.424191][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 87.650461][ T9322] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 87.660062][ T9322] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 87.860590][ T9322] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 88.082324][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 88.109887][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 88.362021][ T9322] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 88.429081][ T9322] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 88.521160][ T8943] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 89.010000][ T8943] 8021q: adding VLAN 0 to HW filter on device batadv0 04:46:03 executing program 0: r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x22, &(0x7f0000000000)=[@in={0x2, 0x4e23, @local}], 0x10) 04:46:05 executing program 0: r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x22, &(0x7f0000000000)=[@in={0x2, 0x4e23, @local}], 0x10) 04:46:06 executing program 0: r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x22, &(0x7f0000000000)=[@in={0x2, 0x4e23, @local}], 0x10) 04:46:08 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x0, @mcast1, 0x5}, 0x1c) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000400)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x32, &(0x7f0000000040)={@mcast2={0xff, 0x3, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}, 0x800}, 0x21) 04:46:09 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x0, @mcast1, 0x5}, 0x1c) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000400)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x32, &(0x7f0000000040)={@mcast2={0xff, 0x3, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}, 0x800}, 0x21) [ 97.887096][ T9432] IPVS: ftp: loaded support on port[0] = 21 [ 98.140795][ T9433] IPVS: ftp: loaded support on port[0] = 21 [ 98.154528][ T9434] IPVS: ftp: loaded support on port[0] = 21 [ 98.393250][ T9432] NET: Registered protocol family 30 [ 98.511047][ T9433] list_add double add: new=ffffffff89544ab0, prev=ffffffff89334ac0, next=ffffffff89544ab0. [ 98.584857][ T9435] IPVS: ftp: loaded support on port[0] = 21 [ 98.849401][ T9432] Failed to register TIPC socket type [ 99.128828][ T9433] ------------[ cut here ]------------ [ 99.134354][ T9433] kernel BUG at lib/list_debug.c:29! [ 99.608429][ T9433] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 99.614543][ T9433] CPU: 1 PID: 9433 Comm: syz-executor.1 Not tainted 5.1.0+ #18 [ 99.622074][ T9433] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 99.632138][ T9433] RIP: 0010:__list_add_valid.cold+0x26/0x3c [ 99.638030][ T9433] Code: 56 ff ff ff 4c 89 e1 48 c7 c7 20 4c a3 87 e8 00 60 25 fe 0f 0b 48 89 f2 4c 89 e1 4c 89 ee 48 c7 c7 60 4d a3 87 e8 e9 5f 25 fe <0f> 0b 48 89 f1 48 c7 c7 e0 4c a3 87 4c 89 e6 e8 d5 5f 25 fe 0f 0b [ 99.657632][ T9433] RSP: 0000:ffff88806c95fb88 EFLAGS: 00010282 [ 99.663697][ T9433] RAX: 0000000000000058 RBX: ffffffff89544920 RCX: 0000000000000000 [ 99.671668][ T9433] RDX: 0000000000000000 RSI: ffffffff815afbe6 RDI: ffffed100d92bf63 [ 99.679641][ T9433] RBP: ffff88806c95fba0 R08: 0000000000000058 R09: ffffed1015d26011 [ 99.687633][ T9433] R10: ffffed1015d26010 R11: ffff8880ae930087 R12: ffffffff89544ab0 [ 99.695606][ T9433] R13: ffffffff89544ab0 R14: ffffffff89544ab0 R15: ffffffff89544a50 [ 99.703579][ T9433] FS: 0000000000b82940(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 [ 99.712510][ T9433] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 99.719100][ T9433] CR2: 000000000214259f CR3: 000000008d080000 CR4: 00000000001406e0 [ 99.727067][ T9433] Call Trace: [ 99.730358][ T9433] ? mutex_lock_nested+0x16/0x20 [ 99.735302][ T9433] proto_register+0x459/0x8e0 [ 99.744930][ T9433] ? lockdep_init_map+0x1be/0x6d0 [ 99.749959][ T9433] tipc_socket_init+0x1c/0x70 [ 99.754638][ T9433] tipc_init_net+0x32a/0x5b0 [ 99.759228][ T9433] ? tipc_exit_net+0x40/0x40 [ 99.763816][ T9433] ops_init+0xb6/0x410 [ 99.767916][ T9433] setup_net+0x2d3/0x740 [ 99.772160][ T9433] ? copy_net_ns+0x1c0/0x340 [ 99.777181][ T9433] ? ops_init+0x410/0x410 [ 99.781517][ T9433] ? kasan_check_write+0x14/0x20 [ 99.786459][ T9433] ? down_read_killable+0x51/0x220 [ 99.791585][ T9433] copy_net_ns+0x1df/0x340 [ 99.796014][ T9433] create_new_namespaces+0x400/0x7b0 [ 99.801311][ T9433] unshare_nsproxy_namespaces+0xc2/0x200 [ 99.806950][ T9433] ksys_unshare+0x440/0x980 [ 99.811456][ T9433] ? trace_hardirqs_on+0x67/0x230 [ 99.816482][ T9433] ? walk_process_tree+0x2d0/0x2d0 [ 99.821599][ T9433] ? blkcg_exit_queue+0x30/0x30 [ 99.826455][ T9433] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 99.831946][ T9433] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 99.838013][ T9433] ? do_syscall_64+0x26/0x680 [ 99.842695][ T9433] ? lockdep_hardirqs_on+0x418/0x5d0 [ 99.847987][ T9433] __x64_sys_unshare+0x31/0x40 [ 99.852755][ T9433] do_syscall_64+0x103/0x680 [ 99.857349][ T9433] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 99.863238][ T9433] RIP: 0033:0x45b897 [ 99.867149][ T9433] Code: 00 00 00 b8 63 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 ad 8d fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 10 01 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 8d 8d fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 99.887263][ T9433] RSP: 002b:00007ffcc109bba8 EFLAGS: 00000206 ORIG_RAX: 0000000000000110 [ 99.895674][ T9433] RAX: ffffffffffffffda RBX: 000000000073c988 RCX: 000000000045b897 [ 99.903642][ T9433] RDX: 0000000000000000 RSI: 00007ffcc109bb50 RDI: 0000000040000000 [ 99.911609][ T9433] RBP: 00000000000000f8 R08: 0000000000000000 R09: 0000000000000005 [ 99.919593][ T9433] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000414ab0 [ 99.927559][ T9433] R13: 0000000000414b40 R14: 0000000000000000 R15: 0000000000000000 [ 99.935536][ T9433] Modules linked in: 04:46:12 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x0, @mcast1, 0x5}, 0x1c) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000400)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x32, &(0x7f0000000040)={@mcast2={0xff, 0x3, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}, 0x800}, 0x21) [ 100.175620][ T3879] kobject: 'loop0' (00000000716cee16): kobject_uevent_env [ 100.528436][ T3879] kobject: 'loop0' (00000000716cee16): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 101.552632][ T9463] IPVS: ftp: loaded support on port[0] = 21 04:46:13 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x0, @mcast1, 0x5}, 0x1c) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000400)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x32, &(0x7f0000000040)={@mcast2={0xff, 0x3, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}, 0x800}, 0x21) [ 101.705457][ T3879] kobject: 'loop0' (00000000716cee16): kobject_uevent_env [ 101.759957][ T3879] kobject: 'loop0' (00000000716cee16): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 102.852556][ T3879] kobject: 'loop0' (00000000716cee16): kobject_uevent_env [ 102.968441][ T3879] kobject: 'loop0' (00000000716cee16): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 109.068429][ T9433] ---[ end trace 522690d124a7028c ]--- [ 109.073941][ T9433] RIP: 0010:__list_add_valid.cold+0x26/0x3c