Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.1.29' (ECDSA) to the list of known hosts. syzkaller login: [ 55.708385][ T7050] IPVS: ftp: loaded support on port[0] = 21 [ 55.800869][ T7050] chnl_net:caif_netlink_parms(): no params data found [ 55.854934][ T7050] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.862426][ T7050] bridge0: port 1(bridge_slave_0) entered disabled state [ 55.871479][ T7050] device bridge_slave_0 entered promiscuous mode [ 55.880465][ T7050] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.888192][ T7050] bridge0: port 2(bridge_slave_1) entered disabled state [ 55.896255][ T7050] device bridge_slave_1 entered promiscuous mode [ 55.917201][ T7050] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 55.928050][ T7050] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 55.950933][ T7050] team0: Port device team_slave_0 added [ 55.958513][ T7050] team0: Port device team_slave_1 added [ 55.976533][ T7050] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 55.983484][ T7050] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 56.009504][ T7050] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 56.021843][ T7050] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 56.028950][ T7050] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 56.055027][ T7050] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 56.137481][ T7050] device hsr_slave_0 entered promiscuous mode [ 56.194158][ T7050] device hsr_slave_1 entered promiscuous mode [ 56.332559][ T7050] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 56.378107][ T7050] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 56.436584][ T7050] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 56.476560][ T7050] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 56.560397][ T7050] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.567661][ T7050] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.575815][ T7050] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.582908][ T7050] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.629342][ T7050] 8021q: adding VLAN 0 to HW filter on device bond0 [ 56.642935][ T2714] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 56.655018][ T2714] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.662913][ T2714] bridge0: port 2(bridge_slave_1) entered disabled state [ 56.672128][ T2714] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 56.686805][ T7050] 8021q: adding VLAN 0 to HW filter on device team0 [ 56.698424][ T3746] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 56.707275][ T3746] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.714425][ T3746] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.726105][ T2714] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 56.735050][ T2714] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.742090][ T2714] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.765214][ T3746] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 56.774545][ T3746] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 56.790426][ T7050] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 56.801712][ T7050] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 56.816838][ T3747] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 56.825350][ T3747] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 56.835560][ T3747] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 56.846527][ T3747] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 56.869149][ T2714] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 56.877396][ T2714] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 56.890384][ T7050] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 56.909400][ T2714] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 56.918473][ T2714] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 56.938280][ T3747] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 56.947338][ T3747] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 56.957225][ T3747] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 56.966882][ T3747] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 56.976763][ T7050] device veth0_vlan entered promiscuous mode [ 56.989306][ T7050] device veth1_vlan entered promiscuous mode [ 57.010713][ T2714] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 57.019647][ T2714] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 57.028479][ T2714] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 57.038244][ T2714] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 57.050190][ T7050] device veth0_macvtap entered promiscuous mode [ 57.061277][ T7050] device veth1_macvtap entered promiscuous mode [ 57.079233][ T7050] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 57.087515][ T2714] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 57.098876][ T2714] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 57.107831][ T2714] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 57.116975][ T2714] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 57.130326][ T7050] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 57.137743][ T3747] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 57.147893][ T3747] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready executing program [ 60.454924][ C0] ================================================================== [ 60.463131][ C0] BUG: KASAN: use-after-free in ip_icmp_error+0x52a/0x5a0 [ 60.470225][ C0] Read of size 1 at addr ffff8880a219afff by task swapper/0/0 [ 60.477752][ C0] [ 60.480077][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.7.0-rc6-syzkaller #0 [ 60.487936][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 60.497980][ C0] Call Trace: [ 60.501248][ C0] [ 60.504084][ C0] dump_stack+0x188/0x20d [ 60.508405][ C0] print_address_description.constprop.0.cold+0xd3/0x413 [ 60.515418][ C0] ? skb_splice_bits+0x1a0/0x1a0 [ 60.520339][ C0] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 60.526137][ C0] ? vprintk_func+0x81/0x17e [ 60.530711][ C0] ? ip_icmp_error+0x52a/0x5a0 [ 60.535470][ C0] __kasan_report.cold+0x20/0x38 [ 60.540486][ C0] ? ip_icmp_error+0x52a/0x5a0 [ 60.545230][ C0] ? ip_icmp_error+0x52a/0x5a0 [ 60.549982][ C0] kasan_report+0x33/0x50 [ 60.554756][ C0] ip_icmp_error+0x52a/0x5a0 [ 60.559343][ C0] tcp_v4_err+0x9b2/0x1d00 [ 60.563752][ C0] ? tcp_v4_do_rcv+0x8b0/0x8b0 [ 60.568601][ C0] icmp_socket_deliver+0x1e4/0x360 [ 60.573705][ C0] icmp_unreach+0x33b/0xab0 [ 60.578194][ C0] icmp_rcv+0xee6/0x15f0 [ 60.582427][ C0] ip_protocol_deliver_rcu+0x57/0x880 [ 60.587795][ C0] ip_local_deliver_finish+0x220/0x360 [ 60.593246][ C0] ip_local_deliver+0x1c8/0x4e0 [ 60.598088][ C0] ? ip_local_deliver_finish+0x360/0x360 [ 60.603706][ C0] ? ip_rcv+0x24e/0x3c0 [ 60.607853][ C0] ? ip_protocol_deliver_rcu+0x880/0x880 [ 60.613464][ C0] ? lock_downgrade+0x840/0x840 [ 60.618300][ C0] ? ip_rcv_finish_core.isra.0+0x606/0x1ec0 [ 60.624171][ C0] ip_rcv_finish+0x1da/0x2f0 [ 60.628739][ C0] ip_rcv+0xd0/0x3c0 [ 60.632636][ C0] ? ip_local_deliver+0x4e0/0x4e0 [ 60.638022][ C0] ? ip_rcv_finish_core.isra.0+0x1ec0/0x1ec0 [ 60.643995][ C0] ? ip_local_deliver+0x4e0/0x4e0 [ 60.649134][ C0] __netif_receive_skb_one_core+0x114/0x180 [ 60.655038][ C0] ? __netif_receive_skb_core+0x31c0/0x31c0 [ 60.660930][ C0] ? do_raw_spin_lock+0x129/0x2e0 [ 60.665968][ C0] ? rwlock_bug.part.0+0x90/0x90 [ 60.670896][ C0] ? rebalance_domains+0x375/0xe40 [ 60.676014][ C0] __netif_receive_skb+0x27/0x1c0 [ 60.681282][ C0] process_backlog+0x21e/0x7a0 [ 60.686039][ C0] ? net_rx_action+0x25f/0x1070 [ 60.690881][ C0] net_rx_action+0x4c2/0x1070 [ 60.695568][ C0] ? napi_busy_loop+0x9e0/0x9e0 [ 60.700503][ C0] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 60.706619][ C0] ? run_rebalance_domains+0x202/0x2c0 [ 60.712066][ C0] __do_softirq+0x26c/0x9f7 [ 60.716569][ C0] irq_exit+0x192/0x1d0 [ 60.720776][ C0] smp_apic_timer_interrupt+0x19e/0x600 [ 60.726318][ C0] apic_timer_interrupt+0xf/0x20 [ 60.731244][ C0] [ 60.734173][ C0] RIP: 0010:native_safe_halt+0xe/0x10 [ 60.739556][ C0] Code: cc cc cc cc cc cc cc cc cc cc cc cc e9 07 00 00 00 0f 00 2d d4 c3 52 00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d c4 c3 52 00 fb f4 cc 41 56 41 55 41 54 55 53 e8 93 4c 8b f9 e8 ce 81 c4 fb 0f 1f [ 60.759138][ C0] RSP: 0018:ffffffff89807d98 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 [ 60.767532][ C0] RAX: 1ffffffff132980f RBX: ffffffff89886540 RCX: 0000000000000000 [ 60.775507][ C0] RDX: dffffc0000000000 RSI: 0000000000000006 RDI: ffffffff89886e04 [ 60.783916][ C0] RBP: dffffc0000000000 R08: ffffffff89886540 R09: 0000000000000000 [ 60.791878][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: fffffbfff1310ca8 [ 60.799843][ C0] R13: 0000000000000000 R14: ffffffff8a8a4bc0 R15: 0000000000000000 [ 60.807816][ C0] default_idle+0x49/0x350 [ 60.812226][ C0] do_idle+0x393/0x690 [ 60.816469][ C0] ? rcu_read_lock_held+0x9c/0xb0 [ 60.821469][ C0] ? arch_cpu_idle_exit+0x70/0x70 [ 60.826495][ C0] ? schedule+0xe7/0x2a0 [ 60.830732][ C0] ? trace_init_perf_perm_irq_work_exit+0xe/0xe [ 60.836967][ C0] cpu_startup_entry+0x14/0x20 [ 60.841722][ C0] start_kernel+0x97d/0x9ba [ 60.846307][ C0] ? mem_encrypt_init+0x5/0x5 [ 60.850962][ C0] ? x86_family+0x3d/0x50 [ 60.855292][ C0] ? load_ucode_bsp+0x23d/0x27d [ 60.860124][ C0] secondary_startup_64+0xa4/0xb0 [ 60.865143][ C0] [ 60.867449][ C0] Allocated by task 1: [ 60.871510][ C0] save_stack+0x1b/0x40 [ 60.875670][ C0] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 60.881382][ C0] __kmalloc+0x161/0x7a0 [ 60.885733][ C0] tomoyo_realpath_from_path+0xc2/0x620 [ 60.891288][ C0] tomoyo_path_perm+0x214/0x400 [ 60.896122][ C0] security_inode_getattr+0xeb/0x150 [ 60.901385][ C0] vfs_getattr+0x22/0x60 [ 60.905607][ C0] vfs_statx+0x142/0x1e0 [ 60.909827][ C0] __do_sys_newlstat+0x96/0x120 [ 60.914695][ C0] do_syscall_64+0xf6/0x7d0 [ 60.919180][ C0] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 60.925058][ C0] [ 60.927383][ C0] Freed by task 1: [ 60.931084][ C0] save_stack+0x1b/0x40 [ 60.935225][ C0] __kasan_slab_free+0xf7/0x140 [ 60.940071][ C0] kfree+0x109/0x2b0 [ 60.943946][ C0] tomoyo_realpath_from_path+0x18f/0x620 [ 60.949745][ C0] tomoyo_path_perm+0x214/0x400 [ 60.954578][ C0] security_inode_getattr+0xeb/0x150 [ 60.960035][ C0] vfs_getattr+0x22/0x60 [ 60.964270][ C0] vfs_statx+0x142/0x1e0 [ 60.968942][ C0] __do_sys_newlstat+0x96/0x120 [ 60.973778][ C0] do_syscall_64+0xf6/0x7d0 [ 60.978276][ C0] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 60.984159][ C0] [ 60.986469][ C0] The buggy address belongs to the object at ffff8880a219a000 [ 60.986469][ C0] which belongs to the cache kmalloc-4k of size 4096 [ 61.000496][ C0] The buggy address is located 4095 bytes inside of [ 61.000496][ C0] 4096-byte region [ffff8880a219a000, ffff8880a219b000) [ 61.013928][ C0] The buggy address belongs to the page: [ 61.019562][ C0] page:ffffea0002886680 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 head:ffffea0002886680 order:1 compound_mapcount:0 [ 61.033011][ C0] flags: 0xfffe0000010200(slab|head) [ 61.038281][ C0] raw: 00fffe0000010200 ffffea00027a6a88 ffffea0002292a88 ffff8880aa002000 [ 61.046868][ C0] raw: 0000000000000000 ffff8880a219a000 0000000100000001 0000000000000000 [ 61.055639][ C0] page dumped because: kasan: bad access detected [ 61.062022][ C0] [ 61.064329][ C0] Memory state around the buggy address: [ 61.069948][ C0] ffff8880a219ae80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.078883][ C0] ffff8880a219af00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.087038][ C0] >ffff8880a219af80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.095689][ C0] ^ [ 61.104183][ C0] ffff8880a219b000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.112219][ C0] ffff8880a219b080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.120621][ C0] ================================================================== [ 61.128656][ C0] Disabling lock debugging due to kernel taint [ 61.134843][ C0] Kernel panic - not syncing: panic_on_warn set ... [ 61.141428][ C0] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G B 5.7.0-rc6-syzkaller #0 [ 61.150800][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 61.160941][ C0] Call Trace: [ 61.164220][ C0] [ 61.167072][ C0] dump_stack+0x188/0x20d [ 61.171402][ C0] panic+0x2e3/0x75c [ 61.175274][ C0] ? add_taint.cold+0x16/0x16 [ 61.179958][ C0] ? ip_icmp_error+0x52a/0x5a0 [ 61.185057][ C0] ? trace_hardirqs_on+0x55/0x220 [ 61.190153][ C0] ? ip_icmp_error+0x52a/0x5a0 [ 61.194940][ C0] end_report+0x4d/0x53 [ 61.199164][ C0] __kasan_report.cold+0xd/0x38 [ 61.204007][ C0] ? ip_icmp_error+0x52a/0x5a0 [ 61.209372][ C0] ? ip_icmp_error+0x52a/0x5a0 [ 61.214118][ C0] kasan_report+0x33/0x50 [ 61.218871][ C0] ip_icmp_error+0x52a/0x5a0 [ 61.223454][ C0] tcp_v4_err+0x9b2/0x1d00 [ 61.227853][ C0] ? tcp_v4_do_rcv+0x8b0/0x8b0 [ 61.232871][ C0] icmp_socket_deliver+0x1e4/0x360 [ 61.237977][ C0] icmp_unreach+0x33b/0xab0 [ 61.242471][ C0] icmp_rcv+0xee6/0x15f0 [ 61.246703][ C0] ip_protocol_deliver_rcu+0x57/0x880 [ 61.252048][ C0] ip_local_deliver_finish+0x220/0x360 [ 61.257487][ C0] ip_local_deliver+0x1c8/0x4e0 [ 61.262502][ C0] ? ip_local_deliver_finish+0x360/0x360 [ 61.268125][ C0] ? ip_rcv+0x24e/0x3c0 [ 61.272358][ C0] ? ip_protocol_deliver_rcu+0x880/0x880 [ 61.278157][ C0] ? lock_downgrade+0x840/0x840 [ 61.282983][ C0] ? ip_rcv_finish_core.isra.0+0x606/0x1ec0 [ 61.288865][ C0] ip_rcv_finish+0x1da/0x2f0 [ 61.293437][ C0] ip_rcv+0xd0/0x3c0 [ 61.297337][ C0] ? ip_local_deliver+0x4e0/0x4e0 [ 61.302335][ C0] ? ip_rcv_finish_core.isra.0+0x1ec0/0x1ec0 [ 61.308389][ C0] ? ip_local_deliver+0x4e0/0x4e0 [ 61.313394][ C0] __netif_receive_skb_one_core+0x114/0x180 [ 61.319351][ C0] ? __netif_receive_skb_core+0x31c0/0x31c0 [ 61.325219][ C0] ? do_raw_spin_lock+0x129/0x2e0 [ 61.330544][ C0] ? rwlock_bug.part.0+0x90/0x90 [ 61.335457][ C0] ? rebalance_domains+0x375/0xe40 [ 61.341494][ C0] __netif_receive_skb+0x27/0x1c0 [ 61.346614][ C0] process_backlog+0x21e/0x7a0 [ 61.351388][ C0] ? net_rx_action+0x25f/0x1070 [ 61.356231][ C0] net_rx_action+0x4c2/0x1070 [ 61.360892][ C0] ? napi_busy_loop+0x9e0/0x9e0 [ 61.365724][ C0] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 61.371681][ C0] ? run_rebalance_domains+0x202/0x2c0 [ 61.377221][ C0] __do_softirq+0x26c/0x9f7 [ 61.381718][ C0] irq_exit+0x192/0x1d0 [ 61.385862][ C0] smp_apic_timer_interrupt+0x19e/0x600 [ 61.391388][ C0] apic_timer_interrupt+0xf/0x20 [ 61.396490][ C0] [ 61.399417][ C0] RIP: 0010:native_safe_halt+0xe/0x10 [ 61.404794][ C0] Code: cc cc cc cc cc cc cc cc cc cc cc cc e9 07 00 00 00 0f 00 2d d4 c3 52 00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d c4 c3 52 00 fb f4 cc 41 56 41 55 41 54 55 53 e8 93 4c 8b f9 e8 ce 81 c4 fb 0f 1f [ 61.424383][ C0] RSP: 0018:ffffffff89807d98 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 [ 61.432834][ C0] RAX: 1ffffffff132980f RBX: ffffffff89886540 RCX: 0000000000000000 [ 61.441783][ C0] RDX: dffffc0000000000 RSI: 0000000000000006 RDI: ffffffff89886e04 [ 61.450061][ C0] RBP: dffffc0000000000 R08: ffffffff89886540 R09: 0000000000000000 [ 61.458101][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: fffffbfff1310ca8 [ 61.466236][ C0] R13: 0000000000000000 R14: ffffffff8a8a4bc0 R15: 0000000000000000 [ 61.474607][ C0] default_idle+0x49/0x350 [ 61.479110][ C0] do_idle+0x393/0x690 [ 61.483215][ C0] ? rcu_read_lock_held+0x9c/0xb0 [ 61.488418][ C0] ? arch_cpu_idle_exit+0x70/0x70 [ 61.493447][ C0] ? schedule+0xe7/0x2a0 [ 61.497770][ C0] ? trace_init_perf_perm_irq_work_exit+0xe/0xe [ 61.504125][ C0] cpu_startup_entry+0x14/0x20 [ 61.509960][ C0] start_kernel+0x97d/0x9ba [ 61.514458][ C0] ? mem_encrypt_init+0x5/0x5 [ 61.519128][ C0] ? x86_family+0x3d/0x50 [ 61.523743][ C0] ? load_ucode_bsp+0x23d/0x27d [ 61.528776][ C0] secondary_startup_64+0xa4/0xb0 [ 61.534848][ C0] Kernel Offset: disabled [ 61.539186][ C0] Rebooting in 86400 seconds..