[ 37.595770] audit: type=1800 audit(1548907560.470:27): pid=7632 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [ 37.622847] audit: type=1800 audit(1548907560.470:28): pid=7632 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2417 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 38.298465] audit: type=1800 audit(1548907561.230:29): pid=7632 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 38.318940] audit: type=1800 audit(1548907561.230:30): pid=7632 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.72' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program syzkaller login: [ 49.668529] Bluetooth: hci1: Frame reassembly failed (-84) [ 49.682750] Bluetooth: hci0: Frame reassembly failed (-84) [ 49.693168] Bluetooth: hci2: Frame reassembly failed (-84) [ 49.702207] Bluetooth: hci4: Frame reassembly failed (-84) [ 49.708969] Bluetooth: hci3: Frame reassembly failed (-84) [ 49.716120] Bluetooth: hci5: Frame reassembly failed (-84) [ 51.726907] Bluetooth: hci0: command 0x1003 tx timeout [ 51.726913] Bluetooth: hci1: command 0x1003 tx timeout [ 51.727232] Bluetooth: hci1: sending frame failed (-49) [ 51.732586] Bluetooth: hci0: sending frame failed (-49) [ 51.806263] Bluetooth: hci2: command 0x1003 tx timeout [ 51.806278] Bluetooth: hci5: command 0x1003 tx timeout [ 51.811789] Bluetooth: hci2: sending frame failed (-49) [ 51.817289] Bluetooth: hci5: sending frame failed (-49) [ 51.827952] Bluetooth: hci3: command 0x1003 tx timeout [ 51.833543] Bluetooth: hci4: command 0x1003 tx timeout [ 51.833603] Bluetooth: hci3: sending frame failed (-49) [ 51.840177] Bluetooth: hci4: sending frame failed (-49) [ 53.806239] Bluetooth: hci0: command 0x1001 tx timeout [ 53.806245] Bluetooth: hci1: command 0x1001 tx timeout [ 53.806327] Bluetooth: hci1: sending frame failed (-49) [ 53.811663] Bluetooth: hci0: sending frame failed (-49) [ 53.886276] Bluetooth: hci4: command 0x1001 tx timeout [ 53.886282] Bluetooth: hci3: command 0x1001 tx timeout [ 53.886374] Bluetooth: hci3: sending frame failed (-49) [ 53.891707] Bluetooth: hci4: sending frame failed (-49) [ 53.897011] Bluetooth: hci2: command 0x1001 tx timeout [ 53.902704] Bluetooth: hci5: command 0x1001 tx timeout [ 53.918326] Bluetooth: hci2: sending frame failed (-49) [ 53.924046] Bluetooth: hci5: sending frame failed (-49) [ 55.886281] Bluetooth: hci0: command 0x1009 tx timeout [ 55.886288] Bluetooth: hci1: command 0x1009 tx timeout [ 55.966291] Bluetooth: hci2: command 0x1009 tx timeout [ 55.966297] Bluetooth: hci5: command 0x1009 tx timeout [ 55.966333] Bluetooth: hci3: command 0x1009 tx timeout [ 55.971656] Bluetooth: hci4: command 0x1009 tx timeout executing program executing program executing program executing program executing program executing program [ 60.163904] Bluetooth: hci2: Frame reassembly failed (-84) [ 60.164017] BUG: unable to handle kernel paging request at ffffffffffffffd6 [ 60.169942] Bluetooth: hci3: Frame reassembly failed (-84) [ 60.176652] #PF error: [normal kernel read fault] [ 60.176659] PGD 9874067 P4D 9874067 PUD 9876067 PMD 0 [ 60.176682] Oops: 0000 [#1] PREEMPT SMP KASAN [ 60.176704] CPU: 1 PID: 44 Comm: kworker/u4:2 Not tainted 5.0.0-rc4+ #52 [ 60.176711] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 60.176730] Workqueue: events_unbound flush_to_ldisc [ 60.182431] kobject: 'rfkill14' (00000000bfbcb75a): kobject_add_internal: parent: 'hci1', set: 'devices' [ 60.187180] RIP: 0010:h4_recv_buf+0x1ea/0xda0 [ 60.187193] Code: b6 14 10 48 89 c8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 d7 0a 00 00 48 ba 00 00 00 00 00 fc ff df 48 8b 45 d0 4c 8d 60 70 <0f> b7 58 2a 4c 89 e0 48 c1 e8 03 0f b6 04 10 84 c0 74 08 3c 03 0f [ 60.187200] RSP: 0018:ffff8880a971f6c0 EFLAGS: 00010246 [ 60.187210] RAX: ffffffffffffffac RBX: 0000000000000000 RCX: ffffffffffffffd6 [ 60.187217] RDX: dffffc0000000000 RSI: ffffffff858a4252 RDI: 0000000000000005 [ 60.187227] RBP: ffff8880a971f748 R08: ffff8880a96a8440 R09: 0000000000000007 [ 60.192583] Bluetooth: hci0: Frame reassembly failed (-84) [ 60.196955] R10: ffffed1015ce5b8f R11: ffff8880ae72dc7b R12: 000000000000001c [ 60.196963] R13: ffff88808d515300 R14: ffff88808f5516a0 R15: 0000000000000006 [ 60.196974] FS: 0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000 [ 60.196983] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 60.196990] CR2: ffffffffffffffd6 CR3: 000000009f4dd000 CR4: 00000000001406e0 [ 60.197002] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 60.197011] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 60.209334] kobject: 'rfkill14' (00000000bfbcb75a): kobject_uevent_env [ 60.213159] Call Trace: [ 60.213179] ? __lock_is_held+0xb6/0x140 [ 60.213196] ll_recv+0xe4/0x200 [ 60.213211] hci_uart_tty_receive+0x22b/0x530 [ 60.221384] kobject: 'rfkill14' (00000000bfbcb75a): fill_kobj_path: path = '/devices/virtual/bluetooth/hci1/rfkill14' [ 60.227899] ? hci_uart_write_work+0x710/0x710 [ 60.227916] tty_ldisc_receive_buf+0x164/0x1c0 [ 60.227929] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 60.227945] tty_port_default_receive_buf+0x114/0x190 [ 60.232748] Bluetooth: hci1: Frame reassembly failed (-84) [ 60.251308] ? do_raw_spin_unlock+0xa0/0x330 [ 60.251325] ? tty_port_lower_dtr_rts+0x90/0x90 [ 60.251339] ? process_one_work+0xbf1/0x1ce0 [ 60.251357] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 60.258486] kobject: 'hci5' (00000000c836c64c): kobject_add_internal: parent: 'bluetooth', set: 'devices' [ 60.263961] flush_to_ldisc+0x3b2/0x590 [ 60.263981] ? tty_insert_flip_string_flags+0x1b0/0x1b0 [ 60.263996] ? __lock_is_held+0xb6/0x140 [ 60.273905] kobject: 'hci4' (000000009cd0fe35): kobject_add_internal: parent: 'bluetooth', set: 'devices' [ 60.278511] process_one_work+0xd0c/0x1ce0 [ 60.278525] ? preempt_notifier_register+0x200/0x200 [ 60.278539] ? __switch_to_asm+0x34/0x70 [ 60.278556] ? pwq_dec_nr_in_flight+0x4a0/0x4a0 [ 60.278572] ? __schedule+0x89f/0x1e60 [ 60.284421] kobject: 'hci4' (000000009cd0fe35): kobject_uevent_env [ 60.291442] ? pci_mmcfg_check_reserved+0x170/0x170 [ 60.291462] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 60.291481] ? worker_thread+0x3b7/0x14a0 [ 60.291495] ? find_held_lock+0x35/0x120 [ 60.299982] kobject: 'hci5' (00000000c836c64c): kobject_uevent_env [ 60.306953] ? lock_acquire+0x1db/0x570 [ 60.306967] ? worker_thread+0x3cd/0x14a0 [ 60.306984] ? kasan_check_read+0x11/0x20 [ 60.307008] ? do_raw_spin_lock+0x156/0x360 [ 60.307021] ? lock_release+0xc40/0xc40 [ 60.312991] kobject: 'hci4' (000000009cd0fe35): fill_kobj_path: path = '/devices/virtual/bluetooth/hci4' [ 60.320137] ? rwlock_bug.part.0+0x90/0x90 [ 60.320150] ? trace_hardirqs_on_caller+0x310/0x310 [ 60.320188] worker_thread+0x143/0x14a0 [ 60.320208] ? process_one_work+0x1ce0/0x1ce0 [ 60.320221] ? __kthread_parkme+0xc3/0x1b0 [ 60.327633] kobject: 'hci5' (00000000c836c64c): fill_kobj_path: path = '/devices/virtual/bluetooth/hci5' [ 60.334736] ? lock_acquire+0x1db/0x570 [ 60.334752] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 60.334765] ? lockdep_hardirqs_on+0x415/0x5d0 [ 60.334779] ? trace_hardirqs_on+0xbd/0x310 [ 60.342981] kobject: 'rfkill15' (00000000b8a46595): kobject_add_internal: parent: 'hci5', set: 'devices' [ 60.344076] ? __kthread_parkme+0xc3/0x1b0 [ 60.344091] ? trace_hardirqs_off_caller+0x300/0x300 [ 60.344104] ? do_raw_spin_trylock+0x270/0x270 [ 60.344117] ? schedule+0x108/0x350 [ 60.349626] kobject: 'rfkill15' (00000000b8a46595): kobject_uevent_env [ 60.351415] ? do_raw_spin_trylock+0x270/0x270 [ 60.351434] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 60.351445] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 60.351458] ? __kthread_parkme+0xfb/0x1b0 [ 60.356028] kobject: 'rfkill15' (00000000b8a46595): fill_kobj_path: path = '/devices/virtual/bluetooth/hci5/rfkill15' [ 60.366655] kthread+0x357/0x430 [ 60.366677] ? process_one_work+0x1ce0/0x1ce0 [ 60.366689] ? kthread_stop+0x920/0x920 [ 60.366703] ret_from_fork+0x3a/0x50 [ 60.366715] Modules linked in: [ 60.366725] CR2: ffffffffffffffd6 [ 60.373336] kobject: 'rfkill16' (000000009b981596): kobject_add_internal: parent: 'hci4', set: 'devices' [ 60.375851] ---[ end trace f5cb30d1921cf755 ]--- [ 60.375869] RIP: 0010:h4_recv_buf+0x1ea/0xda0 [ 60.375881] Code: b6 14 10 48 89 c8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 d7 0a 00 00 48 ba 00 00 00 00 00 fc ff df 48 8b 45 d0 4c 8d 60 70 <0f> b7 58 2a 4c 89 e0 48 c1 e8 03 0f b6 04 10 84 c0 74 08 3c 03 0f [ 60.375890] RSP: 0018:ffff8880a971f6c0 EFLAGS: 00010246 [ 60.381554] Bluetooth: hci5: Frame reassembly failed (-84) [ 60.386573] RAX: ffffffffffffffac RBX: 0000000000000000 RCX: ffffffffffffffd6 [ 60.386581] RDX: dffffc0000000000 RSI: ffffffff858a4252 RDI: 0000000000000005 [ 60.386589] RBP: ffff8880a971f748 R08: ffff8880a96a8440 R09: 0000000000000007 [ 60.386598] R10: ffffed1015ce5b8f R11: ffff8880ae72dc7b R12: 000000000000001c [ 60.386605] R13: ffff88808d515300 R14: ffff88808f5516a0 R15: 0000000000000006 [ 60.386615] FS: 0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000 [ 60.386624] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 60.386633] CR2: ffffffffffffffd6 CR3: 000000009f4dd000 CR4: 00000000001406e0 [ 60.392721] kobject: 'rfkill16' (000000009b981596): kobject_uevent_env [ 60.396765] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 60.396773] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 60.396780] Kernel panic - not syncing: Fatal exception [ 60.397917] Kernel Offset: disabled [ 60.799576] Rebooting in 86400 seconds..