[ 44.551676] audit: type=1800 audit(1583571674.606:32): pid=7947 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2450 res=0 Starting mcstransd: [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 49.464921] kauditd_printk_skb: 2 callbacks suppressed [ 49.464934] audit: type=1400 audit(1583571679.626:35): avc: denied { map } for pid=8120 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.50' (ECDSA) to the list of known hosts. [ 505.114928] audit: type=1400 audit(1583572135.276:36): avc: denied { map } for pid=8132 comm="syz-executor794" path="/root/syz-executor794565660" dev="sda1" ino=1426 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 505.140640] IPVS: ftp: loaded support on port[0] = 21 [ 505.171786] audit: type=1400 audit(1583572135.326:37): avc: denied { create } for pid=8133 comm="syz-executor794" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 505.195889] audit: type=1400 audit(1583572135.326:38): avc: denied { write } for pid=8133 comm="syz-executor794" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 505.219919] audit: type=1400 audit(1583572135.326:39): avc: denied { read } for pid=8133 comm="syz-executor794" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 505.246699] chnl_net:caif_netlink_parms(): no params data found [ 505.297925] bridge0: port 1(bridge_slave_0) entered blocking state [ 505.304507] bridge0: port 1(bridge_slave_0) entered disabled state [ 505.311859] device bridge_slave_0 entered promiscuous mode [ 505.320096] bridge0: port 2(bridge_slave_1) entered blocking state [ 505.326669] bridge0: port 2(bridge_slave_1) entered disabled state [ 505.333710] device bridge_slave_1 entered promiscuous mode [ 505.349988] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 505.358960] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 505.376387] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 505.383779] team0: Port device team_slave_0 added [ 505.389542] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 505.396966] team0: Port device team_slave_1 added [ 505.412355] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 505.418629] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 505.444065] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 505.455901] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 505.462141] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 505.487411] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 505.498223] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 505.505829] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 505.585946] device hsr_slave_0 entered promiscuous mode [ 505.624113] device hsr_slave_1 entered promiscuous mode [ 505.664584] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 505.671660] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 505.735923] bridge0: port 2(bridge_slave_1) entered blocking state [ 505.742381] bridge0: port 2(bridge_slave_1) entered forwarding state [ 505.749346] bridge0: port 1(bridge_slave_0) entered blocking state [ 505.755715] bridge0: port 1(bridge_slave_0) entered forwarding state [ 505.792729] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 505.800860] 8021q: adding VLAN 0 to HW filter on device bond0 [ 505.809000] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 505.818030] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 505.836182] bridge0: port 1(bridge_slave_0) entered disabled state [ 505.843378] bridge0: port 2(bridge_slave_1) entered disabled state [ 505.850892] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 505.861086] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 505.867550] 8021q: adding VLAN 0 to HW filter on device team0 [ 505.876911] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 505.885225] bridge0: port 1(bridge_slave_0) entered blocking state [ 505.891602] bridge0: port 1(bridge_slave_0) entered forwarding state [ 505.901130] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 505.908929] bridge0: port 2(bridge_slave_1) entered blocking state [ 505.915336] bridge0: port 2(bridge_slave_1) entered forwarding state [ 505.932893] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 505.940596] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 505.951349] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 505.961329] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 505.972063] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 505.981273] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 505.987579] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 506.001554] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 506.009223] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 506.016013] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 506.027041] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 506.039858] IPv6: ADDRCONF(NETDEV_UP): veth0_virt_wifi: link is not ready [ 506.049802] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 506.088250] IPv6: ADDRCONF(NETDEV_UP): veth0_vlan: link is not ready [ 506.095625] IPv6: ADDRCONF(NETDEV_UP): vlan0: link is not ready [ 506.102152] IPv6: ADDRCONF(NETDEV_UP): vlan1: link is not ready [ 506.112782] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 506.120386] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 506.127326] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 506.136046] device veth0_vlan entered promiscuous mode [ 506.145818] device veth1_vlan entered promiscuous mode [ 506.151722] IPv6: ADDRCONF(NETDEV_UP): macvlan0: link is not ready [ 506.160381] IPv6: ADDRCONF(NETDEV_UP): macvlan1: link is not ready [ 506.171895] IPv6: ADDRCONF(NETDEV_UP): veth0_macvtap: link is not ready [ 506.181707] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 506.189197] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 506.197055] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 506.206826] device veth0_macvtap entered promiscuous mode [ 506.212939] IPv6: ADDRCONF(NETDEV_UP): macvtap0: link is not ready [ 506.221971] device veth1_macvtap entered promiscuous mode [ 506.230954] IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready [ 506.238835] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 506.248611] IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready [ 506.258172] IPv6: ADDRCONF(NETDEV_UP): batadv_slave_0: link is not ready [ 506.265388] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 506.272087] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 506.280103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 506.290164] IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready [ 506.297124] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 506.303669] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 506.311973] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready executing program executing program executing program executing program executing program executing program [ 506.419972] tunl0: Master is either lo or non-ether device [ 506.431190] gre0: Master is either lo or non-ether device [ 506.455974] ip_vti0: Master is either lo or non-ether device executing program executing program executing program executing program [ 506.466477] ip6_vti0: Master is either lo or non-ether device [ 506.478319] sit0: Master is either lo or non-ether device [ 506.488626] ip6tnl0: Master is either lo or non-ether device [ 506.499230] ip6gre0: Master is either lo or non-ether device executing program executing program [ 506.741751] vcan0: Master is either lo or non-ether device executing program executing program executing program executing program [ 506.971483] nlmon0: Master is either lo or non-ether device executing program [ 507.203213] caif0: Master is either lo or non-ether device executing program executing program [ 507.316135] syz-executor794 (8206) used greatest stack depth: 23096 bytes left [ 507.347841] vxcan0: Master is either lo or non-ether device executing program [ 507.597639] vxcan1: Master is either lo or non-ether device executing program executing program executing program executing program [ 508.615569] xfrm0: Master is either lo or non-ether device executing program executing program [ 509.059963] bridge0: port 1(bridge_slave_0) entered disabled state [ 509.067906] bridge_slave_0: Device is already in use. [ 509.280758] bridge0: port 1(bridge_slave_0) entered disabled state [ 509.288644] device bridge_slave_0 left promiscuous mode [ 509.294577] bridge0: port 1(bridge_slave_0) entered disabled state executing program executing program [ 509.646877] bridge0: port 2(bridge_slave_1) entered disabled state [ 509.659083] bridge_slave_1: Device is already in use. [ 509.872550] bridge0: port 2(bridge_slave_1) entered disabled state [ 509.880299] device bridge_slave_1 left promiscuous mode [ 509.885917] bridge0: port 2(bridge_slave_1) entered disabled state executing program executing program [ 510.235484] bond_slave_0: Device is already in use. [ 510.387219] bond0: Releasing backup interface bond_slave_0 executing program executing program [ 510.713739] bond_slave_1: Device is already in use. [ 510.872638] bond0: Releasing backup interface bond_slave_1 executing program executing program [ 511.223193] team_slave_0: Device is already in use. [ 511.436477] team0: Port device team_slave_0 removed executing program executing program [ 511.769366] team_slave_1: Device is already in use. [ 511.976137] team0: Port device team_slave_1 removed executing program executing program [ 512.288791] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 512.299395] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 512.310064] batman_adv: batadv0: Interface deactivated: batadv_slave_0 executing program [ 512.507677] batman_adv: batadv0: Removing interface: batadv_slave_0 executing program [ 512.846117] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 512.858200] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 512.869416] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 513.070214] batman_adv: batadv0: Removing interface: batadv_slave_1 executing program executing program [ 513.401981] hsr_slave_0: Device is already in use. [ 513.615421] device hsr_slave_0 left promiscuous mode executing program executing program [ 513.925432] hsr_slave_1: Device is already in use. [ 514.136798] device hsr_slave_1 left promiscuous mode executing program executing program executing program executing program [ 514.783222] veth1_vlan: Device is already in use. executing program [ 515.048022] ------------[ cut here ]------------ [ 515.059794] WARNING: CPU: 1 PID: 8508 at drivers/net/ipvlan/ipvlan_main.c:65 ipvlan_unregister_nf_hook.cold+0x11/0x1d [ 515.070564] Kernel panic - not syncing: panic_on_warn set ... [ 515.070564] [ 515.077935] CPU: 1 PID: 8508 Comm: syz-executor794 Not tainted 4.19.108-syzkaller #0 [ 515.085814] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 515.095175] Call Trace: [ 515.097831] dump_stack+0x188/0x20d [ 515.101474] panic+0x26a/0x50e [ 515.104797] ? __warn_printk+0xf3/0xf3 [ 515.108800] ? ipvlan_unregister_nf_hook.cold+0x11/0x1d [ 515.114181] ? __probe_kernel_read+0x16c/0x1b0 [ 515.118770] ? __warn.cold+0x5/0x46 [ 515.122404] ? __warn+0xe4/0x1c0 [ 515.125780] ? ipvlan_unregister_nf_hook.cold+0x11/0x1d [ 515.131153] __warn.cold+0x20/0x46 [ 515.134702] ? ipvlan_unregister_nf_hook.cold+0x11/0x1d [ 515.140075] report_bug+0x262/0x2a0 [ 515.143712] do_error_trap+0x1d7/0x310 [ 515.147608] ? math_error+0x310/0x310 [ 515.151423] ? irq_work_queue+0x2b/0x80 [ 515.155402] ? wake_up_klogd+0x8c/0xc0 [ 515.159318] ? vprintk_emit+0x1d0/0x6e0 [ 515.163303] ? trace_hardirqs_off_caller+0x55/0x210 [ 515.168332] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 515.173244] invalid_op+0x14/0x20 [ 515.176715] RIP: 0010:ipvlan_unregister_nf_hook.cold+0x11/0x1d [ 515.182688] Code: 24 e8 10 c2 53 fd 48 8b 04 24 e9 cc f7 ff ff e8 02 c2 53 fd e9 a5 f7 ff ff e8 58 fb 1d fd 48 c7 c7 40 a2 d4 87 e8 85 19 09 fd <0f> 0b e9 08 d5 ff ff 90 90 90 90 90 53 48 89 fb e8 37 fb 1d fd 48 [ 515.201590] RSP: 0018:ffff888085036ff0 EFLAGS: 00010282 [ 515.206954] RAX: 0000000000000024 RBX: 0000000000000000 RCX: 0000000000000000 [ 515.214221] RDX: 0000000000000000 RSI: ffffffff8152d2f1 RDI: ffffed1010a06df0 [ 515.221476] RBP: ffff8880905e8040 R08: 0000000000000024 R09: ffffed1015ce5079 [ 515.228727] R10: ffffed1015ce5078 R11: ffff8880ae7283c7 R12: ffff8880a95dc680 [ 515.235977] R13: ffff888091f53240 R14: 0000000000000001 R15: 0000000000001002 [ 515.243245] ? vprintk_func+0x81/0x17e [ 515.247148] ipvlan_set_port_mode+0x538/0x650 [ 515.251631] ipvlan_link_new+0x68d/0xc40 [ 515.255681] ? ipvlan_nl_changelink+0x3a0/0x3a0 [ 515.260395] rtnl_newlink+0xf03/0x1440 [ 515.264278] ? __lock_acquire+0x6ee/0x49c0 [ 515.268498] ? rtnl_link_unregister+0x230/0x230 [ 515.273149] ? find_held_lock+0x2d/0x110 [ 515.277196] ? is_bpf_text_address+0xa9/0x160 [ 515.281678] ? __lock_acquire+0x6ee/0x49c0 [ 515.285905] ? mark_held_locks+0xf0/0xf0 [ 515.290039] ? mark_held_locks+0xf0/0xf0 [ 515.294115] ? __read_once_size_nocheck.constprop.0+0x10/0x10 [ 515.299998] ? __lock_acquire+0x6ee/0x49c0 [ 515.304226] ? unwind_next_frame+0xd01/0x18a0 [ 515.308748] ? __save_stack_trace+0x59/0xf0 [ 515.313062] ? mark_held_locks+0xf0/0xf0 [ 515.317154] ? __lock_acquire+0x6ee/0x49c0 [ 515.321379] ? mark_held_locks+0xf0/0xf0 [ 515.325425] ? __lock_acquire+0x6ee/0x49c0 [ 515.329648] ? mark_held_locks+0xf0/0xf0 [ 515.333693] ? lock_downgrade+0x740/0x740 [ 515.337892] ? check_preemption_disabled+0x41/0x280 [ 515.342947] ? mutex_trylock+0x1a0/0x1a0 [ 515.347009] ? find_held_lock+0x2d/0x110 [ 515.351085] ? rtnetlink_rcv_msg+0x3c3/0xaf0 [ 515.355501] ? rtnl_link_unregister+0x230/0x230 [ 515.360164] rtnetlink_rcv_msg+0x453/0xaf0 [ 515.364386] ? rtnetlink_put_metrics+0x520/0x520 [ 515.369141] ? find_held_lock+0x2d/0x110 [ 515.373257] netlink_rcv_skb+0x160/0x410 [ 515.377309] ? rtnetlink_put_metrics+0x520/0x520 [ 515.382049] ? netlink_ack+0xa60/0xa60 [ 515.385925] netlink_unicast+0x4d7/0x6a0 [ 515.390011] ? netlink_attachskb+0x710/0x710 [ 515.394425] netlink_sendmsg+0x80b/0xcd0 [ 515.398495] ? netlink_unicast+0x6a0/0x6a0 [ 515.402755] ? move_addr_to_kernel.part.0+0x110/0x110 [ 515.407942] ? netlink_unicast+0x6a0/0x6a0 [ 515.412213] sock_sendmsg+0xcf/0x120 [ 515.415917] ___sys_sendmsg+0x803/0x920 [ 515.419898] ? copy_msghdr_from_user+0x410/0x410 [ 515.424639] ? rcu_read_lock_sched_held+0x10a/0x130 [ 515.429639] ? kmem_cache_alloc+0x31b/0x710 [ 515.433955] ? find_held_lock+0x2d/0x110 [ 515.438013] ? __might_fault+0x11f/0x1d0 [ 515.442150] ? lock_downgrade+0x740/0x740 [ 515.446288] ? __might_fault+0x192/0x1d0 [ 515.450336] ? _copy_to_user+0xb8/0x100 [ 515.454316] ? move_addr_to_user+0xa8/0x1e0 [ 515.458634] ? __fget_light+0x1a2/0x230 [ 515.462603] __sys_sendmsg+0xec/0x1b0 [ 515.466390] ? __ia32_sys_shutdown+0x70/0x70 [ 515.470876] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 515.475616] ? trace_hardirqs_off_caller+0x55/0x210 [ 515.480615] ? do_syscall_64+0x21/0x620 [ 515.484585] do_syscall_64+0xf9/0x620 [ 515.488375] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 515.493552] RIP: 0033:0x445659 [ 515.496731] Code: e8 9c 0b 03 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 515.515619] RSP: 002b:00007ffe6bf60ba8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 515.523308] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000445659 [ 515.530568] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000005 [ 515.537826] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 515.545080] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000030 [ 515.552335] R13: 0000000000406460 R14: 0000000000000000 R15: 0000000000000000 [ 515.561093] Kernel Offset: disabled [ 515.564721] Rebooting in 86400 seconds..