[ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Serial Getty on ttyS0. [ OK ] Started Getty on tty1. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.1.17' (ECDSA) to the list of known hosts. 2020/11/09 11:10:40 fuzzer started 2020/11/09 11:10:40 connecting to host at 10.128.0.26:46183 2020/11/09 11:10:40 checking machine... 2020/11/09 11:10:40 checking revisions... 2020/11/09 11:10:40 testing simple program... syzkaller login: [ 64.583174][ T8551] IPVS: ftp: loaded support on port[0] = 21 [ 64.725855][ T8551] chnl_net:caif_netlink_parms(): no params data found [ 64.778878][ T8551] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.786681][ T8551] bridge0: port 1(bridge_slave_0) entered disabled state [ 64.796556][ T8551] device bridge_slave_0 entered promiscuous mode [ 64.805994][ T8551] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.813102][ T8551] bridge0: port 2(bridge_slave_1) entered disabled state [ 64.822020][ T8551] device bridge_slave_1 entered promiscuous mode [ 64.842896][ T8551] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 64.853726][ T8551] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 64.877300][ T8551] team0: Port device team_slave_0 added [ 64.885217][ T8551] team0: Port device team_slave_1 added [ 64.903099][ T8551] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 64.910362][ T8551] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 64.937405][ T8551] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 64.950482][ T8551] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 64.958186][ T8551] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 64.984761][ T8551] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 65.012203][ T8551] device hsr_slave_0 entered promiscuous mode [ 65.018980][ T8551] device hsr_slave_1 entered promiscuous mode [ 65.121633][ T8551] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 65.132317][ T8551] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 65.147764][ T8551] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 65.160102][ T8551] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 65.188616][ T8551] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.195811][ T8551] bridge0: port 2(bridge_slave_1) entered forwarding state [ 65.203533][ T8551] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.210716][ T8551] bridge0: port 1(bridge_slave_0) entered forwarding state [ 65.260639][ T8551] 8021q: adding VLAN 0 to HW filter on device bond0 [ 65.275282][ T3002] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 65.287736][ T3002] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.296422][ T3002] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.306963][ T3002] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 65.322862][ T8551] 8021q: adding VLAN 0 to HW filter on device team0 [ 65.338034][ T3002] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 65.347455][ T3002] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.354662][ T3002] bridge0: port 1(bridge_slave_0) entered forwarding state [ 65.376294][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 65.386971][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.394078][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 65.417116][ T8770] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 65.427305][ T8770] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 65.448254][ T8770] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 65.457339][ T8770] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 65.465823][ T8770] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 65.477404][ T8551] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 65.503721][ T8770] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 65.511763][ T8770] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 65.527290][ T8551] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 65.549197][ T8770] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 65.571456][ T3159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 65.580410][ T3159] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 65.589383][ T3159] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 65.600604][ T8551] device veth0_vlan entered promiscuous mode [ 65.614630][ T8551] device veth1_vlan entered promiscuous mode [ 65.639005][ T8770] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 65.647720][ T8770] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 65.656649][ T8770] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 65.667220][ T8551] device veth0_macvtap entered promiscuous mode [ 65.680048][ T8551] device veth1_macvtap entered promiscuous mode [ 65.698848][ T8551] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 65.707657][ T8770] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 65.718282][ T8770] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 65.730549][ T8551] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 65.738741][ T8770] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 65.747907][ T8770] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 65.760034][ T8551] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.768944][ T8551] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.778028][ T8551] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.787724][ T8551] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.862912][ T148] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.877436][ T148] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.908426][ T8770] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 65.927595][ T148] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.939457][ T148] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.948912][ T8220] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 65.967096][ T21] BUG: sleeping function called from invalid context at net/mac80211/sta_info.c:1962 [ 65.988009][ T148] [ 65.989521][ T21] in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 21, name: kworker/u4:1 [ 65.990381][ T148] ============================= [ 65.990384][ T148] [ BUG: Invalid wait context ] [ 65.990392][ T148] 5.10.0-rc2-next-20201109-syzkaller #0 Not tainted [ 65.990403][ T148] ----------------------------- [ 66.001686][ T21] INFO: lockdep is turned off. [ 66.004352][ T148] kworker/u4:4/148 is trying to lock: [ 66.004359][ T148] ffff88801ac729d0 (&local->chanctx_mtx){+.+.}-{3:3}, at: ieee80211_recalc_min_chandef+0x49/0x140 [ 66.004391][ T148] other info that might help us debug this: [ 66.004396][ T148] context-{4:4} [ 66.004402][ T148] 4 locks held by kworker/u4:4/148: [ 66.004405][ T148] #0: ffff8880305b3938 ((wq_completion)phy3){+.+.}-{0:0}, at: process_one_work+0x821/0x15a0 executing program [ 66.011200][ T21] Preemption disabled at: [ 66.015824][ T148] #1: ffffc9000114fda8 ((work_completion)(&sdata->work)){+.+.}-{0:0}, at: process_one_work+0x854/0x15a0 [ 66.015859][ T148] #2: ffff88803074cd00 (&wdev->mtx){+.+.}-{3:3}, at: ieee80211_ibss_work+0x93/0xe80 [ 66.015898][ T148] #3: [ 66.021642][ T21] [] __mutex_lock+0x10f/0x1110 [ 66.025478][ T148] ffffffff8b3386a0 (rcu_read_lock){....}-{1:2}, at: sta_info_insert_rcu+0x680/0x2ba0 [ 66.025508][ T148] stack backtrace: [ 66.025521][ T148] CPU: 0 PID: 148 Comm: kworker/u4:4 Not tainted 5.10.0-rc2-next-20201109-syzkaller #0 [ 66.025527][ T148] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 66.025540][ T148] Workqueue: phy3 ieee80211_iface_work [ 66.138334][ T148] Call Trace: [ 66.141619][ T148] dump_stack+0x107/0x163 [ 66.145956][ T148] __lock_acquire.cold+0x310/0x3a2 [ 66.151062][ T148] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 66.157156][ T148] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 66.163131][ T148] lock_acquire+0x2a3/0x8c0 [ 66.167622][ T148] ? ieee80211_recalc_min_chandef+0x49/0x140 [ 66.173586][ T148] ? lock_release+0x710/0x710 [ 66.178272][ T148] __mutex_lock+0x134/0x1110 [ 66.182844][ T148] ? ieee80211_recalc_min_chandef+0x49/0x140 [ 66.188810][ T148] ? ieee80211_recalc_min_chandef+0x49/0x140 [ 66.194770][ T148] ? mutex_lock_io_nested+0xf60/0xf60 [ 66.200122][ T148] ? ieee80211_clear_fast_rx+0x58/0x80 [ 66.205560][ T148] ? mark_held_locks+0x9f/0xe0 [ 66.210306][ T148] ieee80211_recalc_min_chandef+0x49/0x140 [ 66.216097][ T148] sta_info_move_state+0x3cf/0x8d0 [ 66.221206][ T148] sta_info_free+0x65/0x3b0 [ 66.225706][ T148] sta_info_insert_rcu+0x303/0x2ba0 [ 66.230888][ T148] ? find_held_lock+0x2d/0x110 [ 66.235634][ T148] ? rate_control_rate_init+0x32c/0x6a0 [ 66.241159][ T148] ? sta_info_free+0x3b0/0x3b0 [ 66.245918][ T148] ? __local_bh_enable_ip+0x9c/0x110 [ 66.251186][ T148] ? rate_control_rate_init+0x35f/0x6a0 [ 66.258280][ T148] ieee80211_ibss_finish_sta+0x212/0x390 [ 66.263894][ T148] ? ieee80211_ibss_build_presp+0x15f0/0x15f0 [ 66.269940][ T148] ? __local_bh_enable_ip+0x9c/0x110 [ 66.275204][ T148] ieee80211_ibss_work+0x2c7/0xe80 [ 66.280300][ T148] ? ieee80211_ibss_rx_queued_mgmt+0x1870/0x1870 [ 66.286606][ T148] ? mark_held_locks+0x9f/0xe0 [ 66.291352][ T148] ? _raw_spin_unlock_irqrestore+0x42/0x50 [ 66.297138][ T148] ? lockdep_hardirqs_on+0x79/0x100 [ 66.302315][ T148] ? _raw_spin_unlock_irqrestore+0x2f/0x50 [ 66.308102][ T148] ieee80211_iface_work+0x91f/0xa90 [ 66.313279][ T148] process_one_work+0x933/0x15a0 [ 66.318283][ T148] ? lock_release+0x710/0x710 [ 66.322938][ T148] ? pwq_dec_nr_in_flight+0x320/0x320 [ 66.328290][ T148] ? rwlock_bug.part.0+0x90/0x90 [ 66.333209][ T148] ? _raw_spin_lock_irq+0x41/0x50 [ 66.338213][ T148] worker_thread+0x64c/0x1120 [ 66.342869][ T148] ? process_one_work+0x15a0/0x15a0 [ 66.348049][ T148] kthread+0x3af/0x4a0 [ 66.352100][ T148] ? kthread_create_worker_on_cpu+0xf0/0xf0 [ 66.357972][ T148] ret_from_fork+0x1f/0x30 2020/11/09 11:10:43 building call list... [ 66.374054][ T21] CPU: 0 PID: 21 Comm: kworker/u4:1 Not tainted 5.10.0-rc2-next-20201109-syzkaller #0 [ 66.383614][ T21] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 66.393681][ T21] Workqueue: phy4 ieee80211_iface_work [ 66.399140][ T21] Call Trace: [ 66.402433][ T21] dump_stack+0x107/0x163 [ 66.406769][ T21] ? __mutex_lock+0x10f/0x1110 [ 66.411542][ T21] ___might_sleep.cold+0x1e8/0x22e [ 66.416664][ T21] sta_info_move_state+0x32/0x8d0 [ 66.421694][ T21] sta_info_free+0x65/0x3b0 [ 66.426207][ T21] sta_info_insert_rcu+0x303/0x2ba0 [ 66.431403][ T21] ? find_held_lock+0x2d/0x110 [ 66.436172][ T21] ? rate_control_rate_init+0x32c/0x6a0 [ 66.441718][ T21] ? sta_info_free+0x3b0/0x3b0 [ 66.446483][ T21] ? __local_bh_enable_ip+0x9c/0x110 [ 66.451768][ T21] ? rate_control_rate_init+0x35f/0x6a0 [ 66.457328][ T21] ieee80211_ibss_finish_sta+0x212/0x390 [ 66.462972][ T21] ? ieee80211_ibss_build_presp+0x15f0/0x15f0 [ 66.469049][ T21] ? __local_bh_enable_ip+0x9c/0x110 [ 66.474339][ T21] ieee80211_ibss_work+0x2c7/0xe80 [ 66.479457][ T21] ? ieee80211_ibss_rx_queued_mgmt+0x1870/0x1870 [ 66.485789][ T21] ? mark_held_locks+0x9f/0xe0 [ 66.490553][ T21] ? _raw_spin_unlock_irqrestore+0x42/0x50 [ 66.496358][ T21] ? lockdep_hardirqs_on+0x79/0x100 [ 66.501558][ T21] ? _raw_spin_unlock_irqrestore+0x2f/0x50 [ 66.507363][ T21] ieee80211_iface_work+0x91f/0xa90 [ 66.512563][ T21] process_one_work+0x933/0x15a0 [ 66.517502][ T21] ? lock_release+0x710/0x710 [ 66.522176][ T21] ? pwq_dec_nr_in_flight+0x320/0x320 [ 66.527551][ T21] ? rwlock_bug.part.0+0x90/0x90 [ 66.532489][ T21] ? _raw_spin_lock_irq+0x41/0x50 [ 66.537517][ T21] worker_thread+0x64c/0x1120 [ 66.542200][ T21] ? process_one_work+0x15a0/0x15a0 [ 66.547403][ T21] kthread+0x3af/0x4a0 [ 66.551476][ T21] ? kthread_create_worker_on_cpu+0xf0/0xf0 [ 66.554579][ T17] Bluetooth: hci0: command 0x0409 tx timeout [ 66.557380][ T21] ret_from_fork+0x1f/0x30 [ 66.750692][ T28] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 66.843399][ T28] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 66.918388][ T28] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 67.009408][ T28] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 68.204275][ T28] device hsr_slave_0 left promiscuous mode [ 68.214403][ T28] device hsr_slave_1 left promiscuous mode [ 68.227055][ T28] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 68.235449][ T28] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 68.243381][ T28] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 68.251343][ T28] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 68.259906][ T28] device bridge_slave_1 left promiscuous mode [ 68.266616][ T28] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.275252][ T28] device bridge_slave_0 left promiscuous mode [ 68.281430][ T28] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.291992][ T28] device veth1_macvtap left promiscuous mode [ 68.298301][ T28] device veth0_macvtap left promiscuous mode [ 68.304887][ T28] device veth1_vlan left promiscuous mode [ 68.310619][ T28] device veth0_vlan left promiscuous mode executing program [ 69.454348][ T28] team0 (unregistering): Port device team_slave_1 removed [ 69.464829][ T28] team0 (unregistering): Port device team_slave_0 removed [ 69.474092][ T28] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 69.487380][ T28] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 69.513535][ T28] bond0 (unregistering): Released all slaves [ 69.572907][ T8536] can: request_module (can-proto-0) failed. [ 70.009132][ T8536] can: request_module (can-proto-0) failed. [ 70.018843][ T8536] can: request_module (can-proto-0) failed.