[info] Using makefile-style concurrent boot in runlevel 2. [ 47.866946][ T26] audit: type=1800 audit(1575554914.553:21): pid=7429 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="bootlogs" dev="sda1" ino=2452 res=0 [ 47.918325][ T26] audit: type=1800 audit(1575554914.563:22): pid=7429 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="motd" dev="sda1" ino=2480 res=0 [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.63' (ECDSA) to the list of known hosts. 2019/12/05 14:08:47 fuzzer started 2019/12/05 14:08:49 dialing manager at 10.128.0.105:33795 2019/12/05 14:09:03 syscalls: 2684 2019/12/05 14:09:03 code coverage: enabled 2019/12/05 14:09:03 comparison tracing: enabled 2019/12/05 14:09:03 extra coverage: extra coverage is not supported by the kernel 2019/12/05 14:09:03 setuid sandbox: enabled 2019/12/05 14:09:03 namespace sandbox: enabled 2019/12/05 14:09:03 Android sandbox: /sys/fs/selinux/policy does not exist 2019/12/05 14:09:03 fault injection: enabled 2019/12/05 14:09:03 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/12/05 14:09:03 net packet injection: enabled 2019/12/05 14:09:03 net device setup: enabled 2019/12/05 14:09:03 concurrency sanitizer: enabled 2019/12/05 14:09:03 devlink PCI setup: PCI device 0000:00:10.0 is not available syzkaller login: [ 82.440022][ T7599] KCSAN: could not find function: 'poll_schedule_timeout' 2019/12/05 14:09:13 adding functions to KCSAN blacklist: 'generic_fillattr' 'tomoyo_supervisor' 'do_nanosleep' 'generic_write_end' 'n_tty_receive_buf_common' '__perf_event_overflow' 'commit_echoes' 'queue_access_lock' 'blk_mq_get_request' 'ext4_has_free_clusters' 'blk_mq_dispatch_rq_list' 'do_exit' 'find_next_bit' 'pcpu_alloc' 'page_counter_try_charge' 'pipe_wait' '__snd_rawmidi_transmit_ack' 'lruvec_lru_size' 'exit_signals' 'tcp_add_backlog' '__ext4_new_inode' 'ext4_free_inode' '__tty_hangup' 'ext4_free_inodes_count' 'mem_cgroup_select_victim_node' 'xas_clear_mark' 'mod_timer' 'copy_process' 'find_get_pages_range_tag' 'add_timer' 'taskstats_exit' 'blk_mq_run_hw_queue' 'common_perm_cond' 'kauditd_thread' 'ep_poll' 'ext4_nonda_switch' 'poll_schedule_timeout' 'run_timer_softirq' 'wbt_done' 'tick_sched_do_timer' 'timer_clear_idle' 'ext4_mark_iloc_dirty' '__hrtimer_run_queues' 'tick_do_update_jiffies64' 'blk_mq_sched_dispatch_requests' 'do_signal_stop' 'rcu_gp_fqs_loop' 'rcu_gp_fqs_check_wake' '__rb_rotate_set_parents' 'audit_log_start' 'vm_area_dup' 'list_lru_count_one' 'tick_nohz_idle_stop_tick' 'wbt_issue' 'blk_stat_add' 'ktime_get_real_seconds' 'pipe_poll' 'do_syslog' 'attach_to_pi_owner' '__mark_inode_dirty' 'do_fcntl' 'dd_has_work' 'xas_find_marked' 'echo_char' 'futex_wait_queue_me' 'p9_poll_workfn' 14:11:22 executing program 0: open(&(0x7f0000000040)='.\x00', 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) r0 = syz_open_procfs(0x0, &(0x7f0000000380)='fd/4\x00\xa7$\xbf\x05l\xb8\t\xd0\x06\xae\b\x86$nV\x92M%\xfd)0m6Z\x05\xae\xa7\rM\bp\xa6Q\x871B\x973\xfe\x05\x12\xf3\xd496\xf9\x1aM6\xb2|\xc5\x05\xbc\xe71g\xe4<&\xd2\xd8g\xb6\xa2U\xae\x9a\x17F\xa5xi\xe8_\xa8R\x96d\x99\xf6_E\xd0\x8f<\xa840\xd6\x84\xd0\x17\xafP\'\xdc{\b\x94\x00Y+\x18N\xc6\x96Y\xf7\xd3`\\\xc9\x1f\a\xf9X\x125\xb9\xd6\xbf\x1a4V\x10\xa6Uq\xceN\xeb\xa8M\xb2?\xda\xfb\xb1\x9d\x94\x13O\xab\xde\xc0t\x8c\")\x05~\x0f\xb8\xf3\xf6d\xbe\xad\xee\"\xaa\x91\x05\xcb9A\x1a\x8d&\x9e\x81\xcf\x9eWvT\x8a\xbfl\x8a\x83%\xec\x94\xfd\x90\xeb\xb3\xa3\xa8\x90\x90\xdb\xc2X\xf48\xd1\x83Eu\xe5c\xd7\xb7qe\xab\xae\xef*\x9e\x95\xde\xa0\x894r[\\\xc4?\xb7\xcfo\xdb\xbeR\xc5\xbc\xb34\xbe}\xf7n/4}\xbc.t\x94\x1c%\xcb\x93\xea\"Aa(\xd6FX\xd8\b\xd1\x10N{\xe8\xbc)\xc8\x1e6\xff\x95\xa3\xf3\x84\xf4\xa5\xe8f\xc2@\x1f7h\xb3\xd6\xab\x9a\x03\x95>V\\\xc4%T\x94M\xc7`\x83\xa1\xa0\xc8gn\xe3\xfe\xef[\xb3\xbd\x18R\x1b=\xab\x97$\x03\xaa\x84C\x0eWD\xeea\xf5\xb9\x82\xea\xbd5:\"\xf6f/\xa1\x8f%8\xa8\x1e\xcf\xb6\xa7\xe1\x1b1\x94\xc1G\xf9\xfc\xc77\x1c\x00'/376) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$apparmor_exec(r0, &(0x7f0000000880)={'\\C\x1b(0\x0e\x06C\xc3MY\x1d\x9b8H\xc3\x16\xb1\x9bV\\\xc4%T\x94M\xc7`\x83\xa1\xa0\xc8gn\xe3\xfe\xef[\xb3\xbd\x18R\x1b=\xab\x97$\x03\xaa\x84C\x0eWD\xeea\xf5\xb9\x82\xea\xbd5:\"\xf6f/\xa1\x8f%8\xa8\x1e\xcf\xb6\xa7\xe1\x1b1\x94\xc1G\xf9\xfc\xc77\x1c\x00]LD\xef\xf1Jg\xb9a\xe7\xe2k\xc6\x11\x8d>\x80\x9f\xddZ\xb3\xe5\xc8\x04s\xe6E\xfbQ\x0f\x82\x13\xdfP\xcc\xb3\xba\"\x18}\x04GxG\xeeN\xac\xc05`'}, 0x2c1) [ 215.833097][ T7603] IPVS: ftp: loaded support on port[0] = 21 14:11:22 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) fallocate(r4, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r4, 0xc028660f, &(0x7f0000000040)={0x0, r5}) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, 0x0) [ 215.903893][ T7603] chnl_net:caif_netlink_parms(): no params data found [ 215.945151][ T7603] bridge0: port 1(bridge_slave_0) entered blocking state [ 215.968175][ T7603] bridge0: port 1(bridge_slave_0) entered disabled state [ 215.998180][ T7603] device bridge_slave_0 entered promiscuous mode [ 216.005680][ T7603] bridge0: port 2(bridge_slave_1) entered blocking state [ 216.028127][ T7603] bridge0: port 2(bridge_slave_1) entered disabled state [ 216.036070][ T7603] device bridge_slave_1 entered promiscuous mode [ 216.068662][ T7603] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 216.080564][ T7603] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 216.095043][ T7606] IPVS: ftp: loaded support on port[0] = 21 [ 216.111519][ T7603] team0: Port device team_slave_0 added 14:11:22 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)) [ 216.120680][ T7603] team0: Port device team_slave_1 added [ 216.181169][ T7603] device hsr_slave_0 entered promiscuous mode [ 216.218794][ T7603] device hsr_slave_1 entered promiscuous mode [ 216.294519][ T7608] IPVS: ftp: loaded support on port[0] = 21 [ 216.396548][ T7603] bridge0: port 2(bridge_slave_1) entered blocking state [ 216.403644][ T7603] bridge0: port 2(bridge_slave_1) entered forwarding state [ 216.411081][ T7603] bridge0: port 1(bridge_slave_0) entered blocking state [ 216.418200][ T7603] bridge0: port 1(bridge_slave_0) entered forwarding state 14:11:23 executing program 3: syz_mount_image$gfs2(&(0x7f00000001c0)='gfs2\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000001940)={[{@nodiscard='nodiscard'}]}) [ 216.559924][ T7606] chnl_net:caif_netlink_parms(): no params data found [ 216.587271][ T7603] 8021q: adding VLAN 0 to HW filter on device bond0 [ 216.657947][ T7603] 8021q: adding VLAN 0 to HW filter on device team0 [ 216.688565][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 216.708217][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 216.728820][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 216.789852][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 216.888812][ T7608] chnl_net:caif_netlink_parms(): no params data found [ 216.899314][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 216.907638][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 216.915018][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 216.978468][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 216.987037][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 216.994093][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 217.039138][ T7606] bridge0: port 1(bridge_slave_0) entered blocking state [ 217.046365][ T7606] bridge0: port 1(bridge_slave_0) entered disabled state [ 217.078784][ T7606] device bridge_slave_0 entered promiscuous mode [ 217.117581][ T7603] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 217.158549][ T7603] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 217.195621][ T7635] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 217.209159][ T7635] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 217.217725][ T7635] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 217.268898][ T7635] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 217.277435][ T7635] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 217.309159][ T7635] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 217.317687][ T7635] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 217.348967][ T7635] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 217.357565][ T7635] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready 14:11:24 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x11, 0xa, 0x300) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)) socket$kcm(0x2, 0x1000000000000002, 0x0) socket$kcm(0x29, 0x5, 0x0) socket$kcm(0x29, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00<#\xfbW*\x1f\x02\x94\xe6\xf3x\xb4\x1a\xd5KM\x9d\x9a\x1fc\xf8xZ\xd1\x88\xa7\xe1\xc8\x88u\xe0[\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+:G\x1bJ\x7f\xa2\xf3\xfd\xf6\xe04\xd8\x04\xe5\xf0\xdfK\x1d\xeeH;\x15v$\xc5\x9c\x01\x00\xe8\x9ej5|\x00\x00\x00', 0x2761, 0x0) socket$kcm(0x2, 0x1000000000000002, 0x0) socket$kcm(0x10, 0x400000003, 0x10) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$kcm(r1, &(0x7f0000003d00)={&(0x7f0000000380)=@in={0x2, 0x4e23, @multicast1}, 0x80, 0x0}, 0xfd00) write$cgroup_subtree(r1, &(0x7f0000000280)={[{0x0, 'memory'}]}, 0xfdef) [ 217.408828][ T7606] bridge0: port 2(bridge_slave_1) entered blocking state [ 217.415895][ T7606] bridge0: port 2(bridge_slave_1) entered disabled state [ 217.435634][ T7606] device bridge_slave_1 entered promiscuous mode [ 217.474071][ T7638] IPVS: ftp: loaded support on port[0] = 21 [ 217.509377][ T7635] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 217.517469][ T7635] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 217.581166][ T7606] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 217.609382][ T7606] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 217.669704][ T7608] bridge0: port 1(bridge_slave_0) entered blocking state [ 217.676890][ T7608] bridge0: port 1(bridge_slave_0) entered disabled state [ 217.720313][ T7608] device bridge_slave_0 entered promiscuous mode [ 217.778252][ T7608] bridge0: port 2(bridge_slave_1) entered blocking state [ 217.785436][ T7608] bridge0: port 2(bridge_slave_1) entered disabled state [ 217.817874][ T7608] device bridge_slave_1 entered promiscuous mode [ 217.844120][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 217.855789][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 217.881703][ T7603] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 217.883597][ T7644] IPVS: ftp: loaded support on port[0] = 21 [ 217.899372][ T7606] team0: Port device team_slave_0 added [ 217.939232][ T7606] team0: Port device team_slave_1 added [ 217.946946][ T7608] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 217.985394][ T7608] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link 14:11:24 executing program 5: r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000180)) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='[d::],0::6:\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='ceph\x00', 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) getgid() getpid() mount$fuseblk(0x0, 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) chown(0x0, 0x0, 0x0) socket(0x10, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) chown(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), 0x0) chown(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) open(0x0, 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, 0x0, 0x0) write$P9_RLCREATE(0xffffffffffffffff, 0x0, 0x0) fadvise64(0xffffffffffffffff, 0x0, 0x0, 0x4) bpf$MAP_CREATE(0x0, 0x0, 0x0) gettid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) setreuid(0x0, 0x0) sendmsg$unix(0xffffffffffffffff, 0x0, 0x0) socket(0x10, 0x0, 0x0) getpid() timer_create(0x9, 0x0, 0x0) setgid(0x0) socket(0x1, 0x0, 0x0) chown(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) socket(0x10, 0x0, 0x0) chown(0x0, 0x0, 0x0) tkill(r0, 0x1002000000013) [ 218.006100][ T7638] chnl_net:caif_netlink_parms(): no params data found [ 218.100507][ T7606] device hsr_slave_0 entered promiscuous mode [ 218.148574][ T7606] device hsr_slave_1 entered promiscuous mode [ 218.218125][ T7606] debugfs: Directory 'hsr0' with parent '/' already present! [ 218.234182][ T7608] team0: Port device team_slave_0 added [ 218.248886][ T7656] IPVS: ftp: loaded support on port[0] = 21 [ 218.278416][ T7608] team0: Port device team_slave_1 added [ 218.380596][ T7638] bridge0: port 1(bridge_slave_0) entered blocking state [ 218.387692][ T7638] bridge0: port 1(bridge_slave_0) entered disabled state [ 218.406110][ T7638] device bridge_slave_0 entered promiscuous mode [ 218.530517][ T7608] device hsr_slave_0 entered promiscuous mode [ 218.568451][ T7608] device hsr_slave_1 entered promiscuous mode [ 218.598104][ T7608] debugfs: Directory 'hsr0' with parent '/' already present! [ 218.620481][ T7638] bridge0: port 2(bridge_slave_1) entered blocking state [ 218.630919][ T7638] bridge0: port 2(bridge_slave_1) entered disabled state [ 218.656583][ T7638] device bridge_slave_1 entered promiscuous mode [ 218.681988][ T7644] chnl_net:caif_netlink_parms(): no params data found 14:11:25 executing program 0: open(&(0x7f0000000040)='.\x00', 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) r0 = syz_open_procfs(0x0, &(0x7f0000000380)='fd/4\x00\xa7$\xbf\x05l\xb8\t\xd0\x06\xae\b\x86$nV\x92M%\xfd)0m6Z\x05\xae\xa7\rM\bp\xa6Q\x871B\x973\xfe\x05\x12\xf3\xd496\xf9\x1aM6\xb2|\xc5\x05\xbc\xe71g\xe4<&\xd2\xd8g\xb6\xa2U\xae\x9a\x17F\xa5xi\xe8_\xa8R\x96d\x99\xf6_E\xd0\x8f<\xa840\xd6\x84\xd0\x17\xafP\'\xdc{\b\x94\x00Y+\x18N\xc6\x96Y\xf7\xd3`\\\xc9\x1f\a\xf9X\x125\xb9\xd6\xbf\x1a4V\x10\xa6Uq\xceN\xeb\xa8M\xb2?\xda\xfb\xb1\x9d\x94\x13O\xab\xde\xc0t\x8c\")\x05~\x0f\xb8\xf3\xf6d\xbe\xad\xee\"\xaa\x91\x05\xcb9A\x1a\x8d&\x9e\x81\xcf\x9eWvT\x8a\xbfl\x8a\x83%\xec\x94\xfd\x90\xeb\xb3\xa3\xa8\x90\x90\xdb\xc2X\xf48\xd1\x83Eu\xe5c\xd7\xb7qe\xab\xae\xef*\x9e\x95\xde\xa0\x894r[\\\xc4?\xb7\xcfo\xdb\xbeR\xc5\xbc\xb34\xbe}\xf7n/4}\xbc.t\x94\x1c%\xcb\x93\xea\"Aa(\xd6FX\xd8\b\xd1\x10N{\xe8\xbc)\xc8\x1e6\xff\x95\xa3\xf3\x84\xf4\xa5\xe8f\xc2@\x1f7h\xb3\xd6\xab\x9a\x03\x95>V\\\xc4%T\x94M\xc7`\x83\xa1\xa0\xc8gn\xe3\xfe\xef[\xb3\xbd\x18R\x1b=\xab\x97$\x03\xaa\x84C\x0eWD\xeea\xf5\xb9\x82\xea\xbd5:\"\xf6f/\xa1\x8f%8\xa8\x1e\xcf\xb6\xa7\xe1\x1b1\x94\xc1G\xf9\xfc\xc77\x1c\x00'/376) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$apparmor_exec(r0, &(0x7f0000000880)={'\\C\x1b(0\x0e\x06C\xc3MY\x1d\x9b8H\xc3\x16\xb1\x9bV\\\xc4%T\x94M\xc7`\x83\xa1\xa0\xc8gn\xe3\xfe\xef[\xb3\xbd\x18R\x1b=\xab\x97$\x03\xaa\x84C\x0eWD\xeea\xf5\xb9\x82\xea\xbd5:\"\xf6f/\xa1\x8f%8\xa8\x1e\xcf\xb6\xa7\xe1\x1b1\x94\xc1G\xf9\xfc\xc77\x1c\x00]LD\xef\xf1Jg\xb9a\xe7\xe2k\xc6\x11\x8d>\x80\x9f\xddZ\xb3\xe5\xc8\x04s\xe6E\xfbQ\x0f\x82\x13\xdfP\xcc\xb3\xba\"\x18}\x04GxG\xeeN\xac\xc05`'}, 0x2c1) [ 218.888200][ T7638] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 218.949719][ T7644] bridge0: port 1(bridge_slave_0) entered blocking state [ 218.956789][ T7644] bridge0: port 1(bridge_slave_0) entered disabled state [ 219.008673][ T7644] device bridge_slave_0 entered promiscuous mode [ 219.092804][ T7638] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 219.122451][ T7644] bridge0: port 2(bridge_slave_1) entered blocking state [ 219.134990][ T7644] bridge0: port 2(bridge_slave_1) entered disabled state [ 219.172402][ T7644] device bridge_slave_1 entered promiscuous mode [ 219.216969][ T7638] team0: Port device team_slave_0 added [ 219.257998][ T7656] chnl_net:caif_netlink_parms(): no params data found [ 219.361115][ T7638] team0: Port device team_slave_1 added 14:11:26 executing program 0: open(&(0x7f0000000040)='.\x00', 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) r0 = syz_open_procfs(0x0, &(0x7f0000000380)='fd/4\x00\xa7$\xbf\x05l\xb8\t\xd0\x06\xae\b\x86$nV\x92M%\xfd)0m6Z\x05\xae\xa7\rM\bp\xa6Q\x871B\x973\xfe\x05\x12\xf3\xd496\xf9\x1aM6\xb2|\xc5\x05\xbc\xe71g\xe4<&\xd2\xd8g\xb6\xa2U\xae\x9a\x17F\xa5xi\xe8_\xa8R\x96d\x99\xf6_E\xd0\x8f<\xa840\xd6\x84\xd0\x17\xafP\'\xdc{\b\x94\x00Y+\x18N\xc6\x96Y\xf7\xd3`\\\xc9\x1f\a\xf9X\x125\xb9\xd6\xbf\x1a4V\x10\xa6Uq\xceN\xeb\xa8M\xb2?\xda\xfb\xb1\x9d\x94\x13O\xab\xde\xc0t\x8c\")\x05~\x0f\xb8\xf3\xf6d\xbe\xad\xee\"\xaa\x91\x05\xcb9A\x1a\x8d&\x9e\x81\xcf\x9eWvT\x8a\xbfl\x8a\x83%\xec\x94\xfd\x90\xeb\xb3\xa3\xa8\x90\x90\xdb\xc2X\xf48\xd1\x83Eu\xe5c\xd7\xb7qe\xab\xae\xef*\x9e\x95\xde\xa0\x894r[\\\xc4?\xb7\xcfo\xdb\xbeR\xc5\xbc\xb34\xbe}\xf7n/4}\xbc.t\x94\x1c%\xcb\x93\xea\"Aa(\xd6FX\xd8\b\xd1\x10N{\xe8\xbc)\xc8\x1e6\xff\x95\xa3\xf3\x84\xf4\xa5\xe8f\xc2@\x1f7h\xb3\xd6\xab\x9a\x03\x95>V\\\xc4%T\x94M\xc7`\x83\xa1\xa0\xc8gn\xe3\xfe\xef[\xb3\xbd\x18R\x1b=\xab\x97$\x03\xaa\x84C\x0eWD\xeea\xf5\xb9\x82\xea\xbd5:\"\xf6f/\xa1\x8f%8\xa8\x1e\xcf\xb6\xa7\xe1\x1b1\x94\xc1G\xf9\xfc\xc77\x1c\x00'/376) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$apparmor_exec(r0, &(0x7f0000000880)={'\\C\x1b(0\x0e\x06C\xc3MY\x1d\x9b8H\xc3\x16\xb1\x9bV\\\xc4%T\x94M\xc7`\x83\xa1\xa0\xc8gn\xe3\xfe\xef[\xb3\xbd\x18R\x1b=\xab\x97$\x03\xaa\x84C\x0eWD\xeea\xf5\xb9\x82\xea\xbd5:\"\xf6f/\xa1\x8f%8\xa8\x1e\xcf\xb6\xa7\xe1\x1b1\x94\xc1G\xf9\xfc\xc77\x1c\x00]LD\xef\xf1Jg\xb9a\xe7\xe2k\xc6\x11\x8d>\x80\x9f\xddZ\xb3\xe5\xc8\x04s\xe6E\xfbQ\x0f\x82\x13\xdfP\xcc\xb3\xba\"\x18}\x04GxG\xeeN\xac\xc05`'}, 0x2c1) [ 219.402808][ T7608] 8021q: adding VLAN 0 to HW filter on device bond0 [ 219.564222][ T7606] 8021q: adding VLAN 0 to HW filter on device bond0 [ 219.616479][ T7644] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 219.637558][ T7608] 8021q: adding VLAN 0 to HW filter on device team0 [ 219.673666][ T7638] device hsr_slave_0 entered promiscuous mode [ 219.697048][ T7638] device hsr_slave_1 entered promiscuous mode [ 219.728129][ T7638] debugfs: Directory 'hsr0' with parent '/' already present! [ 219.742865][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 219.743380][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 219.743813][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 219.744169][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 219.749374][ T7644] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 219.759164][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 219.759534][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 219.759989][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 219.760001][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 219.760624][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 219.761064][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 219.761503][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 219.761515][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 219.762022][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 219.809821][ T7656] bridge0: port 1(bridge_slave_0) entered blocking state [ 219.809834][ T7656] bridge0: port 1(bridge_slave_0) entered disabled state [ 219.810508][ T7656] device bridge_slave_0 entered promiscuous mode [ 219.811399][ T7656] bridge0: port 2(bridge_slave_1) entered blocking state [ 219.811412][ T7656] bridge0: port 2(bridge_slave_1) entered disabled state [ 219.812062][ T7656] device bridge_slave_1 entered promiscuous mode [ 219.821814][ T7606] 8021q: adding VLAN 0 to HW filter on device team0 [ 219.825494][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 219.826093][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 219.826569][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 219.826581][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 219.829343][ T7644] team0: Port device team_slave_0 added [ 219.830413][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 219.830988][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 219.840928][ T7644] team0: Port device team_slave_1 added [ 219.904501][ T7656] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 219.906050][ T7656] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 219.923100][ T7635] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 219.923699][ T7635] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 219.924420][ T7635] bridge0: port 2(bridge_slave_1) entered blocking state [ 219.924435][ T7635] bridge0: port 2(bridge_slave_1) entered forwarding state [ 219.925008][ T7635] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 219.925874][ T7635] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 219.926815][ T7635] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 219.927463][ T7635] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 219.932198][ T7635] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 219.952347][ T7635] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 219.952902][ T7635] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 219.954082][ T7635] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 219.954629][ T7635] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 220.004154][ T7635] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 220.004950][ T7635] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 220.017080][ T7656] team0: Port device team_slave_0 added [ 220.099863][ T7656] team0: Port device team_slave_1 added [ 220.104321][ T7608] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 220.104333][ T7608] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 220.133909][ T7606] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 220.133925][ T7606] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 220.250623][ T7644] device hsr_slave_0 entered promiscuous mode [ 220.278397][ T7644] device hsr_slave_1 entered promiscuous mode [ 220.302201][ T7705] ================================================================== [ 220.302241][ T7705] BUG: KCSAN: data-race in __fput / pid_update_inode [ 220.302243][ T7705] [ 220.302259][ T7705] read to 0xffff8881252a0ac8 of 2 bytes by task 7701 on cpu 1: [ 220.302271][ T7705] __fput+0xca/0x520 [ 220.302283][ T7705] ____fput+0x1f/0x30 [ 220.302298][ T7705] task_work_run+0xf6/0x130 [ 220.302315][ T7705] exit_to_usermode_loop+0x2b4/0x2c0 [ 220.302329][ T7705] do_syscall_64+0x353/0x370 [ 220.302344][ T7705] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 220.302346][ T7705] [ 220.302358][ T7705] write to 0xffff8881252a0ac8 of 2 bytes by task 7705 on cpu 0: [ 220.302370][ T7705] pid_update_inode+0x51/0x70 [ 220.302381][ T7705] pid_revalidate+0x91/0xd0 [ 220.302397][ T7705] lookup_fast+0x618/0x700 [ 220.302412][ T7705] path_openat+0x2ac/0x36e0 [ 220.302429][ T7705] do_filp_open+0x11e/0x1b0 [ 220.302444][ T7705] do_sys_open+0x3b3/0x4f0 [ 220.302458][ T7705] __x64_sys_open+0x55/0x70 [ 220.302472][ T7705] do_syscall_64+0xcc/0x370 [ 220.302484][ T7705] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 220.302487][ T7705] [ 220.302491][ T7705] Reported by Kernel Concurrency Sanitizer on: [ 220.302507][ T7705] CPU: 0 PID: 7705 Comm: ps Not tainted 5.4.0-syzkaller #0 [ 220.302516][ T7705] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 220.302527][ T7705] ================================================================== [ 220.302536][ T7705] Kernel panic - not syncing: panic_on_warn set ... [ 220.302549][ T7705] CPU: 0 PID: 7705 Comm: ps Not tainted 5.4.0-syzkaller #0 [ 220.302556][ T7705] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 220.302560][ T7705] Call Trace: [ 220.302577][ T7705] dump_stack+0x11d/0x181 [ 220.302594][ T7705] panic+0x210/0x640 [ 220.302614][ T7705] ? vprintk_func+0x8d/0x140 [ 220.302636][ T7705] kcsan_report.cold+0xc/0xd [ 220.302657][ T7705] kcsan_setup_watchpoint+0x3fe/0x460 [ 220.302678][ T7705] __tsan_unaligned_write2+0xc4/0x100 [ 220.302695][ T7705] pid_update_inode+0x51/0x70 [ 220.302712][ T7705] pid_revalidate+0x91/0xd0 [ 220.302732][ T7705] lookup_fast+0x618/0x700 [ 220.302757][ T7705] path_openat+0x2ac/0x36e0 [ 220.302781][ T7705] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 220.302797][ T7705] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 220.302811][ T7705] ? __read_once_size+0x41/0xe0 [ 220.302833][ T7705] do_filp_open+0x11e/0x1b0 [ 220.302855][ T7705] ? __alloc_fd+0x2ef/0x3b0 [ 220.302884][ T7705] do_sys_open+0x3b3/0x4f0 [ 220.302909][ T7705] __x64_sys_open+0x55/0x70 [ 220.302925][ T7705] do_syscall_64+0xcc/0x370 [ 220.302942][ T7705] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 220.302954][ T7705] RIP: 0033:0x7fe7bfb63120 [ 220.302975][ T7705] Code: 48 8b 15 1b 4d 2b 00 f7 d8 64 89 02 83 c8 ff c3 90 90 90 90 90 90 90 90 90 90 83 3d d5 a4 2b 00 00 75 10 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 5e 8c 01 00 48 89 04 24 [ 220.302983][ T7705] RSP: 002b:00007ffe231301a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 220.302997][ T7705] RAX: ffffffffffffffda RBX: 0000000000616760 RCX: 00007fe7bfb63120 [ 220.303005][ T7705] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007fe7c0031d00 [ 220.303013][ T7705] RBP: 0000000000001000 R08: 0000000000000000 R09: 00007fe7bfe2ba10 [ 220.303022][ T7705] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe7c0030d00 [ 220.303031][ T7705] R13: 0000000001baf1c0 R14: 0000000000000005 R15: 0000000000000000 [ 220.304468][ T7705] Kernel Offset: disabled [ 220.998011][ T7705] Rebooting in 86400 seconds..