[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 81.171308][ T27] audit: type=1800 audit(1578969660.796:25): pid=9374 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 81.191294][ T27] audit: type=1800 audit(1578969660.796:26): pid=9374 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 81.250592][ T27] audit: type=1800 audit(1578969660.806:27): pid=9374 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.2' (ECDSA) to the list of known hosts. 2020/01/14 02:41:09 fuzzer started 2020/01/14 02:41:11 dialing manager at 10.128.0.26:43159 2020/01/14 02:41:11 syscalls: 2860 2020/01/14 02:41:11 code coverage: enabled 2020/01/14 02:41:11 comparison tracing: enabled 2020/01/14 02:41:11 extra coverage: enabled 2020/01/14 02:41:11 setuid sandbox: enabled 2020/01/14 02:41:11 namespace sandbox: enabled 2020/01/14 02:41:11 Android sandbox: /sys/fs/selinux/policy does not exist 2020/01/14 02:41:11 fault injection: enabled 2020/01/14 02:41:11 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2020/01/14 02:41:11 net packet injection: enabled 2020/01/14 02:41:11 net device setup: enabled 2020/01/14 02:41:11 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2020/01/14 02:41:11 devlink PCI setup: PCI device 0000:00:10.0 is not available 02:41:13 executing program 0: r0 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f0000000300)={'syz', 0x0}, &(0x7f00000002c0)="f5", 0x1, 0xfffffffffffffffe) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000480)={{0x0, 0x0, 0x0, 0x0, 'syz1\x00'}, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 'syz1\x00', &(0x7f0000000180)=['\x00\x00\x00C\xc8\x00\x00'], 0x7}) keyctl$update(0x2, r0, &(0x7f0000000240)="db40951195b65329509626699071a860088261af3fd5f91a", 0x18) r1 = add_key$user(&(0x7f00000003c0)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000000)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0xffffffffffffffc9, 0x0) 02:41:13 executing program 1: mkdir(&(0x7f0000000440)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='devpts\x00', 0x0, &(0x7f0000000100)='\"A') syzkaller login: [ 93.642185][ T9541] IPVS: ftp: loaded support on port[0] = 21 02:41:13 executing program 2: r0 = openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$VFIO_SET_IOMMU(r0, 0x3b66, 0x0) r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x46802) io_setup(0x100000000000c333, &(0x7f0000000180)=0x0) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) ftruncate(r1, 0x48280) r3 = open(&(0x7f00000004c0)='./bus\x00', 0x2, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) r4 = openat$full(0xffffffffffffff9c, &(0x7f0000000380)='/dev/full\x00', 0x844, 0x0) readv(r4, &(0x7f0000001a40)=[{&(0x7f0000000580)=""/248, 0xf8}, {&(0x7f00000003c0)=""/128, 0x80}, {0x0}, {&(0x7f0000000740)=""/148, 0x94}, {&(0x7f0000000800)=""/4096, 0x1000}, {&(0x7f0000001800)=""/187, 0xbb}, {&(0x7f00000018c0)=""/254, 0xfe}, {&(0x7f0000000500)=""/54, 0x36}, {&(0x7f00000019c0)=""/61, 0x3d}], 0x9) write$P9_RATTACH(r3, &(0x7f0000000000)={0x14}, 0x14) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_submit(r2, 0x20000000000001cb, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0xf, r1, &(0x7f0000000000), 0x377140be6b5ef4c7, 0x300}]) r5 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) write$P9_RREMOVE(r5, &(0x7f0000000280)={0xfffffffffffffcd2}, 0xff7f) mount(&(0x7f0000000100)=ANY=[@ANYBLOB='@Wev/nUllb0\x00'], &(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='tracefs\x00', 0x0, 0x0) [ 93.775375][ T9543] IPVS: ftp: loaded support on port[0] = 21 [ 93.840793][ T9541] chnl_net:caif_netlink_parms(): no params data found [ 93.982691][ T9541] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.000699][ T9541] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.008715][ T9541] device bridge_slave_0 entered promiscuous mode [ 94.053096][ T9547] IPVS: ftp: loaded support on port[0] = 21 [ 94.061287][ T9541] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.068468][ T9541] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.077161][ T9541] device bridge_slave_1 entered promiscuous mode [ 94.096371][ T9543] chnl_net:caif_netlink_parms(): no params data found 02:41:13 executing program 3: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000240)=@hat={'changehat ', 0x0, 0x5e, ['/proc/thread-self/attr/current\x00', '/dev/kvm\x00']}, 0x45) [ 94.147840][ T9541] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 94.190247][ T9541] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 94.231604][ T9543] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.238878][ T9543] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.249777][ T9543] device bridge_slave_0 entered promiscuous mode [ 94.286151][ T9541] team0: Port device team_slave_0 added [ 94.293092][ T9543] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.304111][ T9543] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.313422][ T9543] device bridge_slave_1 entered promiscuous mode [ 94.349433][ T9541] team0: Port device team_slave_1 added [ 94.406086][ T9543] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 94.434575][ T9543] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link 02:41:14 executing program 4: r0 = syz_open_dev$video4linux(&(0x7f0000000240)='/dev/v4l-subdev#\x00', 0x0, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r0, 0xc040564a, &(0x7f0000000080)={0x1}) [ 94.525471][ T9541] device hsr_slave_0 entered promiscuous mode [ 94.602569][ T9541] device hsr_slave_1 entered promiscuous mode [ 94.692391][ T9550] IPVS: ftp: loaded support on port[0] = 21 [ 94.692481][ T9547] chnl_net:caif_netlink_parms(): no params data found [ 94.726592][ T9543] team0: Port device team_slave_0 added 02:41:14 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0x15) ioctl$TCSETSF(r1, 0x80044704, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "6aa4c2b619d43e0a1200000000000000ca37b6"}) [ 94.769006][ T9543] team0: Port device team_slave_1 added [ 94.798551][ T9552] IPVS: ftp: loaded support on port[0] = 21 [ 94.963490][ T9543] device hsr_slave_0 entered promiscuous mode [ 95.030378][ T9543] device hsr_slave_1 entered promiscuous mode [ 95.090196][ T9543] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 95.098071][ T9543] Cannot create hsr debugfs directory [ 95.152875][ T9547] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.160151][ T9547] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.167949][ T9547] device bridge_slave_0 entered promiscuous mode [ 95.206883][ T9554] IPVS: ftp: loaded support on port[0] = 21 [ 95.227731][ T9541] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 95.273089][ T9547] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.280387][ T9547] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.288315][ T9547] device bridge_slave_1 entered promiscuous mode [ 95.313580][ T9547] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 95.328927][ T9547] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 95.344466][ T9541] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 95.414707][ T9541] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 95.476190][ T9541] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 95.546773][ T9550] chnl_net:caif_netlink_parms(): no params data found [ 95.568886][ T9547] team0: Port device team_slave_0 added [ 95.594286][ T9547] team0: Port device team_slave_1 added [ 95.652703][ T9550] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.661840][ T9550] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.670213][ T9550] device bridge_slave_0 entered promiscuous mode [ 95.683272][ T9550] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.690649][ T9550] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.698720][ T9550] device bridge_slave_1 entered promiscuous mode [ 95.753554][ T9547] device hsr_slave_0 entered promiscuous mode [ 95.820510][ T9547] device hsr_slave_1 entered promiscuous mode [ 95.860142][ T9547] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 95.868095][ T9547] Cannot create hsr debugfs directory [ 95.895083][ T9550] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 95.941854][ T9550] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 95.965392][ T9543] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 96.026596][ T9543] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 96.105200][ T9552] chnl_net:caif_netlink_parms(): no params data found [ 96.123262][ T9543] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 96.175225][ T9543] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 96.243213][ T9550] team0: Port device team_slave_0 added [ 96.254204][ T9550] team0: Port device team_slave_1 added [ 96.339905][ T9552] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.347802][ T9552] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.356084][ T9552] device bridge_slave_0 entered promiscuous mode [ 96.366175][ T9552] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.373501][ T9552] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.381697][ T9552] device bridge_slave_1 entered promiscuous mode [ 96.406475][ T9552] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 96.428910][ T9554] chnl_net:caif_netlink_parms(): no params data found [ 96.441305][ T9552] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 96.467678][ T9541] 8021q: adding VLAN 0 to HW filter on device bond0 [ 96.513429][ T9550] device hsr_slave_0 entered promiscuous mode [ 96.570550][ T9550] device hsr_slave_1 entered promiscuous mode [ 96.610180][ T9550] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 96.618045][ T9550] Cannot create hsr debugfs directory [ 96.670380][ T9552] team0: Port device team_slave_0 added [ 96.715086][ T9552] team0: Port device team_slave_1 added [ 96.747040][ T9541] 8021q: adding VLAN 0 to HW filter on device team0 [ 96.761501][ T9547] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 96.811758][ T9554] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.818955][ T9554] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.827161][ T9554] device bridge_slave_0 entered promiscuous mode [ 96.838306][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 96.847614][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 96.912296][ T9552] device hsr_slave_0 entered promiscuous mode [ 96.961173][ T9552] device hsr_slave_1 entered promiscuous mode [ 97.010229][ T9552] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 97.017956][ T9552] Cannot create hsr debugfs directory [ 97.033062][ T9547] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 97.082389][ T9554] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.089679][ T9554] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.097846][ T9554] device bridge_slave_1 entered promiscuous mode [ 97.118320][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 97.127205][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 97.139292][ T2806] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.146676][ T2806] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.164744][ T9547] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 97.237656][ T9547] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 97.283294][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 97.292703][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 97.301590][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 97.311682][ T2806] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.319381][ T2806] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.333629][ T2747] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 97.352374][ T9554] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 97.365856][ T9554] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 97.384590][ T9543] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.424899][ T9550] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 97.488520][ T9550] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 97.542751][ T2810] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 97.552790][ T2810] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 97.562329][ T2810] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 97.571565][ T2810] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 97.580190][ T2810] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 97.594610][ T2810] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 97.617726][ T9543] 8021q: adding VLAN 0 to HW filter on device team0 [ 97.625940][ T9550] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 97.685666][ T2810] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 97.696307][ T2810] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 97.705190][ T2810] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 97.713254][ T2810] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 97.724979][ T9554] team0: Port device team_slave_0 added [ 97.737098][ T9554] team0: Port device team_slave_1 added [ 97.751611][ T9550] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 97.806780][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 97.815396][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 97.834520][ T9541] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 97.861952][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 97.875007][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 97.884265][ T2806] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.891593][ T2806] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.899470][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 97.908740][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 97.917904][ T2806] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.925411][ T2806] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.933374][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 97.973504][ T3029] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 97.982309][ T3029] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 98.053373][ T9554] device hsr_slave_0 entered promiscuous mode [ 98.110527][ T9554] device hsr_slave_1 entered promiscuous mode [ 98.150382][ T9554] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 98.158108][ T9554] Cannot create hsr debugfs directory [ 98.190858][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 98.200554][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 98.209334][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 98.218583][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 98.227117][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 98.251233][ T9552] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 98.307387][ T9552] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 98.363254][ T9552] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 98.438662][ T9541] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 98.448813][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 98.461932][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 98.474018][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 98.482869][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 98.504740][ T9552] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 98.579539][ T9543] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 98.591937][ T9543] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 98.618451][ T2747] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 98.628042][ T2747] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 98.676775][ T2743] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 98.685974][ T2743] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 98.703097][ T9547] 8021q: adding VLAN 0 to HW filter on device bond0 [ 98.720376][ T2747] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 98.727867][ T2747] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 98.747904][ T9541] device veth0_vlan entered promiscuous mode [ 98.763805][ T9543] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 98.775855][ T2743] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 98.785503][ T2743] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 98.797502][ T2743] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 98.814328][ T2743] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 98.831651][ T9547] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.848976][ T2747] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 98.857311][ T2747] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 98.866037][ T2747] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 98.876867][ T2747] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 98.885932][ T2747] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.893769][ T2747] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.907538][ T9541] device veth1_vlan entered promiscuous mode [ 98.932585][ T9550] 8021q: adding VLAN 0 to HW filter on device bond0 [ 98.942786][ T2742] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 98.951807][ T2742] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 98.959820][ T2742] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 98.971504][ T2742] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 98.981196][ T2742] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.988402][ T2742] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.024324][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 99.035095][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 99.045658][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 99.054914][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 99.088037][ T9550] 8021q: adding VLAN 0 to HW filter on device team0 [ 99.113656][ T3029] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 99.123983][ T3029] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 99.133302][ T3029] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 99.144056][ T3029] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 99.154418][ T3029] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 99.163344][ T3029] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 99.173070][ T3029] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 99.182842][ T3029] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.190248][ T3029] bridge0: port 1(bridge_slave_0) entered forwarding state [ 99.201307][ T9554] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 99.262781][ T9554] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 99.322362][ T9554] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 99.367276][ T9554] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 99.413336][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 99.422004][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 99.430960][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 99.439857][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 99.449370][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 99.458386][ T2806] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 99.467825][ T2806] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.475402][ T2806] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.521101][ T2810] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 99.538165][ T2810] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 99.547344][ T2810] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 99.558319][ T2810] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready 02:41:19 executing program 0: r0 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f0000000300)={'syz', 0x0}, &(0x7f00000002c0)="f5", 0x1, 0xfffffffffffffffe) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000480)={{0x0, 0x0, 0x0, 0x0, 'syz1\x00'}, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 'syz1\x00', &(0x7f0000000180)=['\x00\x00\x00C\xc8\x00\x00'], 0x7}) keyctl$update(0x2, r0, &(0x7f0000000240)="db40951195b65329509626699071a860088261af3fd5f91a", 0x18) r1 = add_key$user(&(0x7f00000003c0)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000000)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0xffffffffffffffc9, 0x0) [ 99.567390][ T2810] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 99.577602][ T2810] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 99.586028][ T2810] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 99.610030][ T9541] ------------[ cut here ]------------ [ 99.615543][ T9541] kernel BUG at fs/namei.c:684! [ 99.620132][ T3029] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 99.630037][ T9541] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 99.636250][ T9541] CPU: 0 PID: 9541 Comm: syz-executor.0 Not tainted 5.5.0-rc5-next-20200113-syzkaller #0 [ 99.636762][ T9547] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 99.646249][ T9541] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 99.646266][ T9541] RIP: 0010:unlazy_walk+0x306/0x3b0 [ 99.646279][ T9541] Code: ff ff ff e8 6c 3f a1 ff e8 e7 d8 b3 ff 48 c7 c6 74 6c c1 81 48 c7 c7 00 f7 ba 89 e8 e4 97 99 ff e9 d8 fe ff ff e8 ca d8 b3 ff <0f> 0b e8 c3 d8 b3 ff 0f 0b e8 bc d8 b3 ff e8 27 86 a0 ff 31 ff 89 [ 99.646285][ T9541] RSP: 0018:ffffc90001f47ba0 EFLAGS: 00010293 [ 99.646295][ T9541] RAX: ffff88808cdee240 RBX: ffffc90001f47c60 RCX: ffffffff81c16a16 [ 99.646308][ T9541] RDX: 0000000000000000 RSI: ffffffff81c16ca6 RDI: 0000000000000005 [ 99.658191][ T9547] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 99.667429][ T9541] RBP: ffffc90001f47bd0 R08: ffff88808cdee240 R09: ffff88808cdeead8 [ 99.667437][ T9541] R10: fffffbfff1549b88 R11: ffffffff8aa4dc47 R12: 0000000000000009 [ 99.667444][ T9541] R13: ffffc90001f47c68 R14: ffff88808e2d69e0 R15: 0000000000000000 [ 99.667453][ T9541] FS: 0000000001e42940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 [ 99.667460][ T9541] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 99.667475][ T9541] CR2: 00007ffc0fa8fefc CR3: 000000007d5ac000 CR4: 00000000001406f0 [ 99.689368][ T9547] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 99.693090][ T9541] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 99.693097][ T9541] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 99.693103][ T9541] Call Trace: [ 99.693124][ T9541] path_mountpoint.isra.0+0x1d5/0x340 [ 99.693144][ T9541] filename_mountpoint+0x181/0x380 [ 99.725103][ T9547] device veth0_vlan entered promiscuous mode [ 99.731735][ T9541] ? filename_parentat.isra.0+0x400/0x400 [ 99.731750][ T9541] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 99.731768][ T9541] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 99.731793][ T9541] ? strncpy_from_user+0x2b4/0x400 [ 99.746077][ T9547] device veth1_vlan entered promiscuous mode [ 99.748217][ T9541] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 99.774056][ T9543] device veth0_vlan entered promiscuous mode [ 99.780647][ T9541] ? getname_flags+0x277/0x5b0 [ 99.780662][ T9541] user_path_mountpoint_at+0x3a/0x50 [ 99.780686][ T9541] ksys_umount+0x164/0xef0 [ 99.795614][ T9543] device veth1_vlan entered promiscuous mode [ 99.797473][ T9541] ? up_read+0x1cd/0x810 [ 99.885932][ T9541] ? __detach_mounts+0x290/0x290 [ 99.891170][ T9541] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 99.896623][ T9541] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 99.902170][ T9541] ? do_syscall_64+0x26/0x790 [ 99.906862][ T9541] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 99.913309][ T9541] ? do_syscall_64+0x26/0x790 [ 99.918578][ T9541] ? lockdep_hardirqs_on+0x421/0x5e0 [ 99.924550][ T9541] __x64_sys_umount+0x54/0x80 [ 99.929368][ T9541] do_syscall_64+0xfa/0x790 [ 99.934026][ T9541] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 99.940054][ T9541] RIP: 0033:0x45d977 [ 99.944130][ T9541] Code: 64 89 04 25 d0 02 00 00 58 5f ff d0 48 89 c7 e8 2f be ff ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 4d 8c fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 99.964136][ T9541] RSP: 002b:00007ffc0fa90608 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 99.973062][ T9541] RAX: ffffffffffffffda RBX: 00000000000184c4 RCX: 000000000045d977 [ 99.981277][ T9541] RDX: 0000000000403720 RSI: 0000000000000002 RDI: 00007ffc0fa906b0 [ 99.989653][ T9541] RBP: 0000000000000002 R08: 0000000000000000 R09: 000000000000000e [ 99.997998][ T9541] R10: 000000000000000a R11: 0000000000000202 R12: 00007ffc0fa91740 [ 100.006285][ T9541] R13: 0000000001e43940 R14: 0000000000000000 R15: 00007ffc0fa91740 [ 100.014687][ T9541] Modules linked in: [ 100.029747][ T9541] ---[ end trace 5ec929d5eaa8aeb8 ]--- [ 100.035306][ T9541] RIP: 0010:unlazy_walk+0x306/0x3b0 [ 100.040575][ T9541] Code: ff ff ff e8 6c 3f a1 ff e8 e7 d8 b3 ff 48 c7 c6 74 6c c1 81 48 c7 c7 00 f7 ba 89 e8 e4 97 99 ff e9 d8 fe ff ff e8 ca d8 b3 ff <0f> 0b e8 c3 d8 b3 ff 0f 0b e8 bc d8 b3 ff e8 27 86 a0 ff 31 ff 89 [ 100.050129][ T3029] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 100.068364][ T9541] RSP: 0018:ffffc90001f47ba0 EFLAGS: 00010293 [ 100.075722][ T9541] RAX: ffff88808cdee240 RBX: ffffc90001f47c60 RCX: ffffffff81c16a16 [ 100.081849][ T3029] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 100.084840][ T9541] RDX: 0000000000000000 RSI: ffffffff81c16ca6 RDI: 0000000000000005 [ 100.095273][ T3029] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 100.101300][ T9541] RBP: ffffc90001f47bd0 R08: ffff88808cdee240 R09: ffff88808cdeead8 [ 100.109648][ T3029] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 100.117451][ T9541] R10: fffffbfff1549b88 R11: ffffffff8aa4dc47 R12: 0000000000000009 [ 100.128224][ T3029] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 100.134580][ T9541] R13: ffffc90001f47c68 R14: ffff88808e2d69e0 R15: 0000000000000000 [ 100.143471][ T3029] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 100.149706][ T9541] FS: 0000000001e42940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 [ 100.157389][ T3029] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 100.175550][ T9541] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 100.182849][ T9541] CR2: 00007ffc0fa8fefc CR3: 000000007d5ac000 CR4: 00000000001406f0 [ 100.191462][ T9541] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 100.192004][ T3029] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 100.199799][ T9541] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 100.210865][ T3029] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 100.217173][ T9541] Kernel panic - not syncing: Fatal exception [ 100.225473][ T3029] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 100.232546][ T9541] Kernel Offset: disabled [ 100.246798][ T9541] Rebooting in 86400 seconds..