Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.92' (ECDSA) to the list of known hosts. 2020/12/21 14:34:01 parsed 1 programs 2020/12/21 14:34:01 executed programs: 0 syzkaller login: [ 73.764025][ T8502] IPVS: ftp: loaded support on port[0] = 21 [ 73.972925][ T8502] chnl_net:caif_netlink_parms(): no params data found [ 74.032470][ T8502] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.040429][ T8502] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.049317][ T8502] device bridge_slave_0 entered promiscuous mode [ 74.058973][ T8502] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.066736][ T8502] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.074466][ T8502] device bridge_slave_1 entered promiscuous mode [ 74.096603][ T8502] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 74.107859][ T8502] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 74.132864][ T8502] team0: Port device team_slave_0 added [ 74.141602][ T8502] team0: Port device team_slave_1 added [ 74.159166][ T8502] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 74.166287][ T8502] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 74.192436][ T8502] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 74.205282][ T8502] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 74.212262][ T8502] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 74.238708][ T8502] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 74.267862][ T8502] device hsr_slave_0 entered promiscuous mode [ 74.274537][ T8502] device hsr_slave_1 entered promiscuous mode [ 74.383015][ T8502] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 74.393538][ T8502] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 74.405062][ T8502] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 74.415436][ T8502] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 74.441324][ T8502] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.448550][ T8502] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.456409][ T8502] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.463480][ T8502] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.512899][ T8502] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.528706][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 74.541728][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.550934][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.559302][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 74.572965][ T8502] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.584447][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 74.593393][ T56] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.600541][ T56] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.625881][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 74.634378][ T56] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.641543][ T56] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.650744][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 74.663320][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 74.671782][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 74.684668][ T8721] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 74.699019][ T3135] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 74.711199][ T8502] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 74.731066][ T8721] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 74.738595][ T8721] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 74.753768][ T8502] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.773516][ T3135] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 74.794407][ T8721] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 74.803179][ T8721] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 74.811697][ T8721] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 74.824605][ T8502] device veth0_vlan entered promiscuous mode [ 74.837620][ T8502] device veth1_vlan entered promiscuous mode [ 74.861172][ T3135] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 74.869664][ T3135] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 74.879084][ T3135] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 74.891133][ T8502] device veth0_macvtap entered promiscuous mode [ 74.901977][ T8502] device veth1_macvtap entered promiscuous mode [ 74.921601][ T8502] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.930619][ T8721] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 74.941357][ T8721] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 74.953803][ T8502] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.961425][ T3135] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 74.970513][ T3135] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 74.982363][ T8502] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.991919][ T8502] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.000762][ T8502] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.010143][ T8502] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.120706][ T109] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.131386][ T109] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.144486][ T3135] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 75.176444][ T109] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.184675][ T109] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.194393][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 75.765702][ T5] Bluetooth: hci0: command 0x0409 tx timeout 2020/12/21 14:34:06 executed programs: 40 [ 77.845389][ T8721] Bluetooth: hci0: command 0x041b tx timeout [ 79.931754][ T3135] Bluetooth: hci0: command 0x040f tx timeout [ 82.004483][ T3135] Bluetooth: hci0: command 0x0419 tx timeout 2020/12/21 14:34:11 executed programs: 125 [ 87.324541][ T9563] BUG: sleeping function called from invalid context at arch/x86/mm/fault.c:1351 [ 87.336944][ T9563] in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 9563, name: syz-executor.0 [ 87.347750][ T9563] 2 locks held by syz-executor.0/9563: [ 87.353236][ T9563] #0: ffffffff8b78e1e0 (rcu_read_lock){....}-{1:2}, at: bpf_test_run+0x116/0xd40 [ 87.367631][ T9563] #1: ffff888018558158 (&mm->mmap_lock#2){++++}-{3:3}, at: do_user_addr_fault+0x25f/0xc60 [ 87.379965][ T9563] Preemption disabled at: [ 87.379981][ T9563] [] migrate_disable+0x5e/0x160 [ 87.403922][ T9563] CPU: 0 PID: 9563 Comm: syz-executor.0 Not tainted 5.10.0-syzkaller #0 [ 87.412279][ T9563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 87.422348][ T9563] Call Trace: [ 87.425672][ T9563] dump_stack+0x107/0x163 [ 87.430048][ T9563] ? migrate_disable+0x5e/0x160 [ 87.434908][ T9563] ___might_sleep.cold+0x21b/0x261 [ 87.440013][ T9563] do_user_addr_fault+0x29c/0xc60 [ 87.445035][ T9563] exc_page_fault+0x9e/0x180 [ 87.449621][ T9563] asm_exc_page_fault+0x1e/0x30 [ 87.454472][ T9563] RIP: 0010:bpf_prog_e48ebe87b99394c4+0x11/0x968 [ 87.460793][ T9563] Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 0f 1f 44 00 00 66 90 55 48 89 e5 31 c0 48 8b 47 28 <48> 8b 40 00 8b 80 00 01 00 00 c9 c3 cc cc cc cc cc cc cc cc cc cc [ 87.480402][ T9563] RSP: 0018:ffffc900019bfb30 EFLAGS: 00010246 [ 87.486466][ T9563] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: 0000000000000000 [ 87.494458][ T9563] RDX: ffff88801bc3b580 RSI: ffffc90000e96038 RDI: ffffc900019bfcb0 [ 87.502419][ T9563] RBP: ffffc900019bfb30 R08: 0000000000000001 R09: 0000000000000001 [ 87.510403][ T9563] R10: ffffffff8740d4b8 R11: 0000000000000000 R12: 0000000000000000 [ 87.518364][ T9563] R13: dffffc0000000000 R14: 0000000000000001 R15: ffffc90000e96000 [ 87.526348][ T9563] ? bpf_test_run+0x3a8/0xd40 [ 87.531045][ T9563] bpf_test_run+0x21c/0xd40 [ 87.535565][ T9563] ? bpf_test_finish.isra.0+0x270/0x270 [ 87.541203][ T9563] ? bpf_dispatcher_change_prog+0x2e6/0x8f0 [ 87.547115][ T9563] bpf_prog_test_run_xdp+0x2ca/0x510 [ 87.552428][ T9563] ? bpf_prog_test_run_skb+0x1c50/0x1c50 [ 87.558074][ T9563] ? __fget_files+0x2e3/0x430 [ 87.562750][ T9563] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 87.569003][ T9563] ? fput+0x2a/0x50 [ 87.572803][ T9563] ? bpf_prog_test_run_skb+0x1c50/0x1c50 [ 87.578430][ T9563] __do_sys_bpf+0x1527/0x50f0 [ 87.583118][ T9563] ? bpf_link_get_from_fd+0x110/0x110 [ 87.588520][ T9563] ? _copy_to_user+0xdc/0x150 [ 87.593194][ T9563] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 87.599427][ T9563] ? put_timespec64+0xcb/0x120 [ 87.604193][ T9563] ? ns_to_timespec64+0xc0/0xc0 [ 87.609075][ T9563] ? syscall_enter_from_user_mode+0x1d/0x50 [ 87.614985][ T9563] do_syscall_64+0x2d/0x70 [ 87.619407][ T9563] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 87.625315][ T9563] RIP: 0033:0x45e149 [ 87.629217][ T9563] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 87.648815][ T9563] RSP: 002b:00007f2f85bc0c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 87.657218][ T9563] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045e149 [ 87.665180][ T9563] RDX: 0000000000000028 RSI: 00000000200000c0 RDI: 000000000000000a [ 87.673163][ T9563] RBP: 000000000119bfc0 R08: 0000000000000000 R09: 0000000000000000 [ 87.681144][ T9563] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000119bf8c [ 87.689125][ T9563] R13: 00007fff1ddc2aaf R14: 00007f2f85bc19c0 R15: 000000000119bf8c [ 87.717990][ T9563] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 87.725812][ T9563] #PF: supervisor read access in kernel mode [ 87.731814][ T9563] #PF: error_code(0x0000) - not-present page [ 87.737799][ T9563] PGD 17f80067 P4D 17f80067 PUD 11ecf067 PMD 0 [ 87.744062][ T9563] Oops: 0000 [#1] PREEMPT SMP KASAN [ 87.749249][ T9563] CPU: 0 PID: 9563 Comm: syz-executor.0 Tainted: G W 5.10.0-syzkaller #0 [ 87.758946][ T9563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 87.768985][ T9563] RIP: 0010:bpf_prog_e48ebe87b99394c4+0x11/0x968 [ 87.775317][ T9563] Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 0f 1f 44 00 00 66 90 55 48 89 e5 31 c0 48 8b 47 28 <48> 8b 40 00 8b 80 00 01 00 00 c9 c3 cc cc cc cc cc cc cc cc cc cc [ 87.794951][ T9563] RSP: 0018:ffffc900019bfb30 EFLAGS: 00010246 [ 87.801010][ T9563] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: 0000000000000000 [ 87.808984][ T9563] RDX: ffff88801bc3b580 RSI: ffffc90000e96038 RDI: ffffc900019bfcb0 [ 87.816945][ T9563] RBP: ffffc900019bfb30 R08: 0000000000000001 R09: 0000000000000001 [ 87.824911][ T9563] R10: ffffffff8740d4b8 R11: 0000000000000000 R12: 0000000000000000 [ 87.832865][ T9563] R13: dffffc0000000000 R14: 0000000000000001 R15: ffffc90000e96000 [ 87.840836][ T9563] FS: 00007f2f85bc1700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 [ 87.849778][ T9563] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 87.856420][ T9563] CR2: 00007f14425ac000 CR3: 0000000016543000 CR4: 00000000001506f0 [ 87.864395][ T9563] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 87.872370][ T9563] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 87.880326][ T9563] Call Trace: [ 87.883610][ T9563] bpf_test_run+0x21c/0xd40 [ 87.888123][ T9563] ? bpf_test_finish.isra.0+0x270/0x270 [ 87.893669][ T9563] ? bpf_dispatcher_change_prog+0x2e6/0x8f0 [ 87.899550][ T9563] bpf_prog_test_run_xdp+0x2ca/0x510 [ 87.904824][ T9563] ? bpf_prog_test_run_skb+0x1c50/0x1c50 [ 87.910552][ T9563] ? __fget_files+0x2e3/0x430 [ 87.915242][ T9563] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 87.921473][ T9563] ? fput+0x2a/0x50 [ 87.925269][ T9563] ? bpf_prog_test_run_skb+0x1c50/0x1c50 [ 87.930989][ T9563] __do_sys_bpf+0x1527/0x50f0 [ 87.935755][ T9563] ? bpf_link_get_from_fd+0x110/0x110 [ 87.941118][ T9563] ? _copy_to_user+0xdc/0x150 [ 87.945829][ T9563] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 87.952096][ T9563] ? put_timespec64+0xcb/0x120 [ 87.956850][ T9563] ? ns_to_timespec64+0xc0/0xc0 [ 87.961782][ T9563] ? syscall_enter_from_user_mode+0x1d/0x50 [ 87.967686][ T9563] do_syscall_64+0x2d/0x70 [ 87.972089][ T9563] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 87.978015][ T9563] RIP: 0033:0x45e149 [ 87.981920][ T9563] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 88.001519][ T9563] RSP: 002b:00007f2f85bc0c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 88.009924][ T9563] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045e149 [ 88.017885][ T9563] RDX: 0000000000000028 RSI: 00000000200000c0 RDI: 000000000000000a [ 88.025843][ T9563] RBP: 000000000119bfc0 R08: 0000000000000000 R09: 0000000000000000 [ 88.033800][ T9563] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000119bf8c [ 88.041763][ T9563] R13: 00007fff1ddc2aaf R14: 00007f2f85bc19c0 R15: 000000000119bf8c [ 88.049828][ T9563] Modules linked in: [ 88.053704][ T9563] CR2: 0000000000000000 [ 88.068849][ T9563] ---[ end trace 96283af7790076fc ]--- [ 88.074409][ T9563] RIP: 0010:bpf_prog_e48ebe87b99394c4+0x11/0x968 [ 88.080756][ T9563] Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 0f 1f 44 00 00 66 90 55 48 89 e5 31 c0 48 8b 47 28 <48> 8b 40 00 8b 80 00 01 00 00 c9 c3 cc cc cc cc cc cc cc cc cc cc [ 88.101211][ T9563] RSP: 0018:ffffc900019bfb30 EFLAGS: 00010246 [ 88.107597][ T9563] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: 0000000000000000 [ 88.115936][ T9563] RDX: ffff88801bc3b580 RSI: ffffc90000e96038 RDI: ffffc900019bfcb0 [ 88.124271][ T9563] RBP: ffffc900019bfb30 R08: 0000000000000001 R09: 0000000000000001 [ 88.132597][ T9563] R10: ffffffff8740d4b8 R11: 0000000000000000 R12: 0000000000000000 [ 88.141058][ T9563] R13: dffffc0000000000 R14: 0000000000000001 R15: ffffc90000e96000 [ 88.149531][ T9563] FS: 00007f2f85bc1700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 [ 88.158784][ T9563] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 88.165992][ T9563] CR2: 00007f14425b2000 CR3: 0000000016543000 CR4: 00000000001506f0 [ 88.174456][ T9563] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 88.182448][ T9563] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 88.192076][ T9563] Kernel panic - not syncing: Fatal exception [ 88.198699][ T9563] Kernel Offset: disabled [ 88.203016][ T9563] Rebooting in 86400 seconds..