[info] Using makefile-style concurrent boot in runlevel 2. [ 46.128909][ T25] audit: type=1800 audit(1574934399.894:21): pid=7391 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="bootlogs" dev="sda1" ino=2452 res=0 [ 46.180936][ T25] audit: type=1800 audit(1574934399.894:22): pid=7391 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="motd" dev="sda1" ino=2480 res=0 [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.223' (ECDSA) to the list of known hosts. 2019/11/28 09:46:48 fuzzer started 2019/11/28 09:46:50 dialing manager at 10.128.0.105:41717 2019/11/28 09:46:50 syscalls: 2589 2019/11/28 09:46:50 code coverage: enabled 2019/11/28 09:46:50 comparison tracing: enabled 2019/11/28 09:46:50 extra coverage: extra coverage is not supported by the kernel 2019/11/28 09:46:50 setuid sandbox: enabled 2019/11/28 09:46:50 namespace sandbox: enabled 2019/11/28 09:46:50 Android sandbox: /sys/fs/selinux/policy does not exist 2019/11/28 09:46:50 fault injection: enabled 2019/11/28 09:46:50 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/11/28 09:46:50 net packet injection: enabled 2019/11/28 09:46:50 net device setup: enabled 2019/11/28 09:46:50 concurrency sanitizer: enabled 2019/11/28 09:46:50 devlink PCI setup: PCI device 0000:00:10.0 is not available 2019/11/28 09:46:50 adding functions to KCSAN blacklist: '__hrtimer_run_queues' 09:46:52 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f00001ed000/0x4000)=nil, 0x4000, 0x0, 0x4012, r0, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000100)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x24}}, 0x10) recvmsg(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000240)=""/237, 0xed}], 0x1}, 0x0) sendmsg$nl_netfilter(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[], 0xfffffd26}}, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000000)={&(0x7f00001ee000/0x3000)=nil, 0x9000}, &(0x7f00000000c0)=0x10) 09:46:52 executing program 1: syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6(0xa, 0x802, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x1c, 0x2f, 0x3ff, 0x0, 0x0, {0xd}, [@typed={0x8, 0x3, @fd=r0}]}, 0x1c}}, 0x0) syzkaller login: [ 58.817630][ T7565] IPVS: ftp: loaded support on port[0] = 21 [ 58.922721][ T7565] chnl_net:caif_netlink_parms(): no params data found [ 58.985730][ T7568] IPVS: ftp: loaded support on port[0] = 21 [ 58.993107][ T7565] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.000178][ T7565] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.007998][ T7565] device bridge_slave_0 entered promiscuous mode [ 59.034540][ T7565] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.041611][ T7565] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.049638][ T7565] device bridge_slave_1 entered promiscuous mode 09:46:52 executing program 2: r0 = syz_open_dev$evdev(&(0x7f0000000180)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGABS20(r0, 0x80184560, 0x0) [ 59.085076][ T7565] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 59.111455][ T7565] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 59.145494][ T7568] chnl_net:caif_netlink_parms(): no params data found [ 59.160622][ T7565] team0: Port device team_slave_0 added [ 59.178439][ T7565] team0: Port device team_slave_1 added [ 59.205205][ T7568] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.212312][ T7568] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.220673][ T7568] device bridge_slave_0 entered promiscuous mode 09:46:53 executing program 3: syz_emit_ethernet(0x3a, &(0x7f0000000300)={@local, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, "50a09c", 0x16bdef5c6b5b3b01, 0xffffff11, 0x0, @dev, @local, {[@srh={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, [@empty, @mcast1, @local, @mcast1]}], @icmpv6=@ni={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "71abf1b18d58b2f5bd04426ae15899362f7fa60e1a0ddd097f075f2c9aa08975e01b8d4d925393e617cf4b87631eec37c1beee3b4c1debcaea7834b3d031ddd4974d7404be092561186086a00c43d93870f2b681a2f93c45d68dd5b80b6f90f57fb36bcf3409fa85fb894611e46fcb69d3f0ce3b46fe8e24ad577134d1b8012ce9142b8e88ad2bdbf640055d89ff7166ad52ebc38e92a13a287615eb84d3fa5599be3fdb76be56b497862bd2f5"}}}}}}, 0x0) [ 59.306186][ T7565] device hsr_slave_0 entered promiscuous mode [ 59.354210][ T7565] device hsr_slave_1 entered promiscuous mode [ 59.403075][ T7568] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.410156][ T7568] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.433526][ T7568] device bridge_slave_1 entered promiscuous mode [ 59.469462][ T7568] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 59.488297][ T7571] IPVS: ftp: loaded support on port[0] = 21 [ 59.511164][ T7573] IPVS: ftp: loaded support on port[0] = 21 [ 59.523574][ T7568] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 59.633552][ T7568] team0: Port device team_slave_0 added [ 59.640388][ T7568] team0: Port device team_slave_1 added [ 59.735031][ T7565] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.742099][ T7565] bridge0: port 2(bridge_slave_1) entered forwarding state [ 59.749581][ T7565] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.756725][ T7565] bridge0: port 1(bridge_slave_0) entered forwarding state [ 59.854730][ T7568] device hsr_slave_0 entered promiscuous mode [ 59.893079][ T7568] device hsr_slave_1 entered promiscuous mode 09:46:53 executing program 4: set_mempolicy(0x2, &(0x7f00000000c0)=0x2, 0x8) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0x9) setsockopt$inet6_dccp_int(0xffffffffffffffff, 0x21, 0x6b494cb39e1af73c, &(0x7f0000000240)=0x9, 0x4) connect$inet6(r0, &(0x7f0000000140), 0x1c) r1 = syz_open_dev$sndpcmp(&(0x7f0000000080)='/dev/snd/pcmC#D#p\x00', 0x7, 0x2c0900) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x13, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, [], 0x0, r1}, 0x21) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) fcntl$setown(0xffffffffffffffff, 0x8, 0xffffffffffffffff) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)={0x0, 0x0}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r4 = dup2(r3, 0xffffffffffffffff) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r7 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) r8 = dup(r7) ioctl$TIOCSBRK(r8, 0x40044591) syz_kvm_setup_cpu$x86(r8, r6, &(0x7f0000028000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) r9 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_ADD(r8, 0x4c80, r9) open(&(0x7f0000000180)='./file0\x00', 0xc000, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000280), 0x13f, 0x6}}, 0x20) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) process_vm_readv(r2, &(0x7f0000000380)=[{&(0x7f0000000340)=""/61, 0x3d}], 0x1, &(0x7f0000002540)=[{&(0x7f00000003c0)=""/63, 0x7ffff002}], 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 59.922874][ T7568] debugfs: Directory 'hsr0' with parent '/' already present! [ 60.013310][ T17] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.064093][ T17] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.310104][ T7571] chnl_net:caif_netlink_parms(): no params data found [ 60.340179][ T7573] chnl_net:caif_netlink_parms(): no params data found [ 60.400298][ T7565] 8021q: adding VLAN 0 to HW filter on device bond0 [ 60.540631][ T7591] ================================================================== [ 60.548780][ T7591] BUG: KCSAN: data-race in common_perm_cond / task_dump_owner [ 60.550715][ T7624] IPVS: ftp: loaded support on port[0] = 21 [ 60.556224][ T7591] [ 60.556239][ T7591] read to 0xffff888125611acc of 4 bytes by task 7594 on cpu 1: [ 60.556254][ T7591] common_perm_cond+0x65/0x110 [ 60.556268][ T7591] apparmor_inode_getattr+0x2b/0x40 [ 60.556290][ T7591] security_inode_getattr+0x9b/0xd0 [ 60.586222][ T7571] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.587123][ T7591] vfs_getattr+0x2e/0x70 [ 60.598349][ T7591] vfs_statx+0x102/0x190 [ 60.602593][ T7591] __do_sys_newstat+0x51/0xb0 [ 60.607265][ T7591] __x64_sys_newstat+0x3a/0x50 [ 60.612026][ T7591] do_syscall_64+0xcc/0x370 [ 60.616528][ T7591] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 60.622412][ T7591] [ 60.624742][ T7591] write to 0xffff888125611acc of 4 bytes by task 7591 on cpu 0: [ 60.632376][ T7591] task_dump_owner+0x237/0x260 [ 60.637137][ T7591] pid_update_inode+0x3c/0x70 [ 60.641812][ T7591] pid_revalidate+0x91/0xd0 [ 60.646322][ T7591] lookup_fast+0x6f2/0x700 [ 60.650742][ T7591] walk_component+0x6d/0xe70 [ 60.652851][ T7571] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.655332][ T7591] link_path_walk.part.0+0x5d3/0xa90 [ 60.655355][ T7591] path_openat+0x14f/0x36e0 [ 60.672195][ T7591] do_filp_open+0x11e/0x1b0 [ 60.676725][ T7591] do_sys_open+0x3b3/0x4f0 [ 60.681138][ T7591] __x64_sys_open+0x55/0x70 [ 60.685646][ T7591] do_syscall_64+0xcc/0x370 [ 60.690152][ T7591] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 60.696033][ T7591] [ 60.698353][ T7591] Reported by Kernel Concurrency Sanitizer on: [ 60.704505][ T7591] CPU: 0 PID: 7591 Comm: ps Not tainted 5.4.0-syzkaller #0 [ 60.711686][ T7591] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 60.712842][ T7571] device bridge_slave_0 entered promiscuous mode [ 60.721736][ T7591] ================================================================== [ 60.736096][ T7591] Kernel panic - not syncing: panic_on_warn set ... [ 60.742678][ T7591] CPU: 0 PID: 7591 Comm: ps Not tainted 5.4.0-syzkaller #0 [ 60.749887][ T7591] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 60.760017][ T7591] Call Trace: [ 60.763312][ T7591] dump_stack+0x11d/0x181 [ 60.767640][ T7591] panic+0x210/0x640 [ 60.771542][ T7591] ? vprintk_func+0x8d/0x140 [ 60.776143][ T7591] kcsan_report.cold+0xc/0xd [ 60.780740][ T7591] kcsan_setup_watchpoint+0x3fe/0x460 [ 60.786118][ T7591] __tsan_unaligned_write4+0xc4/0x100 [ 60.791488][ T7591] task_dump_owner+0x237/0x260 [ 60.795668][ T7571] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.796254][ T7591] ? __rcu_read_unlock+0x66/0x3c0 [ 60.810368][ T7591] pid_update_inode+0x3c/0x70 [ 60.815045][ T7591] pid_revalidate+0x91/0xd0 [ 60.819549][ T7591] lookup_fast+0x6f2/0x700 [ 60.823969][ T7591] walk_component+0x6d/0xe70 [ 60.828562][ T7591] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 60.832802][ T7571] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.834838][ T7591] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 60.848063][ T7591] ? security_inode_permission+0xa5/0xc0 [ 60.853699][ T7591] ? inode_permission+0xa0/0x3c0 [ 60.858636][ T7591] link_path_walk.part.0+0x5d3/0xa90 [ 60.863926][ T7591] path_openat+0x14f/0x36e0 [ 60.868444][ T7591] ? __read_once_size.constprop.0+0x12/0x20 [ 60.874341][ T7591] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 60.880582][ T7591] ? __virt_addr_valid+0x126/0x190 [ 60.885688][ T7591] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 60.891934][ T7591] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 60.893051][ T7571] device bridge_slave_1 entered promiscuous mode [ 60.898169][ T7591] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 60.898185][ T7591] ? __read_once_size+0x41/0xe0 [ 60.898210][ T7591] do_filp_open+0x11e/0x1b0 [ 60.919754][ T7591] ? __alloc_fd+0x2ef/0x3b0 [ 60.924266][ T7591] do_sys_open+0x3b3/0x4f0 [ 60.928691][ T7591] __x64_sys_open+0x55/0x70 [ 60.933200][ T7591] do_syscall_64+0xcc/0x370 [ 60.937705][ T7591] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 60.943593][ T7591] RIP: 0033:0x7f9be2cfc120 [ 60.948014][ T7591] Code: 48 8b 15 1b 4d 2b 00 f7 d8 64 89 02 83 c8 ff c3 90 90 90 90 90 90 90 90 90 90 83 3d d5 a4 2b 00 00 75 10 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 5e 8c 01 00 48 89 04 24 [ 60.967619][ T7591] RSP: 002b:00007ffe849bc9d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 60.976034][ T7591] RAX: ffffffffffffffda RBX: 0000000000616760 RCX: 00007f9be2cfc120 [ 60.983999][ T7591] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007f9be31cad00 [ 60.991963][ T7591] RBP: 0000000000001000 R08: 0000000000000000 R09: 00007f9be2fc457b [ 60.999926][ T7591] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9be31c9d00 [ 61.007896][ T7591] R13: 0000000000000020 R14: 0000000000000005 R15: 0000000000000000 [ 61.013268][ T7571] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 61.026278][ T7591] Kernel Offset: disabled [ 61.030602][ T7591] Rebooting in 86400 seconds..