[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 63.552372][ T26] audit: type=1800 audit(1558148188.225:25): pid=8815 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 63.597496][ T26] audit: type=1800 audit(1558148188.225:26): pid=8815 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 63.646744][ T26] audit: type=1800 audit(1558148188.225:27): pid=8815 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.1.20' (ECDSA) to the list of known hosts. 2019/05/18 02:56:39 fuzzer started 2019/05/18 02:56:42 dialing manager at 10.128.0.26:37669 2019/05/18 02:56:42 syscalls: 1006 2019/05/18 02:56:42 code coverage: enabled 2019/05/18 02:56:42 comparison tracing: enabled 2019/05/18 02:56:42 extra coverage: extra coverage is not supported by the kernel 2019/05/18 02:56:42 setuid sandbox: enabled 2019/05/18 02:56:42 namespace sandbox: enabled 2019/05/18 02:56:42 Android sandbox: /sys/fs/selinux/policy does not exist 2019/05/18 02:56:42 fault injection: enabled 2019/05/18 02:56:42 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/05/18 02:56:42 net packet injection: enabled 2019/05/18 02:56:42 net device setup: enabled 02:56:45 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e21, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x20) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e21, 0x0, @loopback}, 0x1c) writev(r0, &(0x7f0000000440)=[{&(0x7f00000001c0)='R', 0x1}], 0x1) syzkaller login: [ 81.117413][ T8980] IPVS: ftp: loaded support on port[0] = 21 [ 81.127970][ T8980] NET: Registered protocol family 30 [ 81.133287][ T8980] Failed to register TIPC socket type 02:56:45 executing program 1: r0 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x5}, 0x1c) recvmmsg(r0, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x300, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000080)=0x6, 0x9) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) syz_emit_ethernet(0x83, &(0x7f0000000180)={@local, @dev, [], {@ipv6={0x86dd, {0x0, 0x6, "1bfc97", 0x4d, 0x88, 0x0, @dev, @mcast2, {[], @udp={0x0, 0x4e20, 0x4d, 0x0, [], "e29607149378d33e1db1c73936c77aa3f7fac33b042bd368236862531934ecb1c373d6ea51369e92fb96cc7c6fe4e24d1fcafff87429e50b32881721afab69cc3712c37ed0"}}}}}}, 0x0) shutdown(r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") [ 81.403565][ T8982] IPVS: ftp: loaded support on port[0] = 21 [ 81.413764][ T8982] NET: Registered protocol family 30 [ 81.419218][ T8982] Failed to register TIPC socket type 02:56:46 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000000)={0x1, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000700)={0x1, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @ipv4={[], [], @remote}}}}, 0x108) getsockopt$inet6_buf(r0, 0x29, 0x30, &(0x7f0000000000)=""/40, &(0x7f0000001000)=0xfffffffffffffff9) [ 81.678389][ T8984] IPVS: ftp: loaded support on port[0] = 21 [ 81.688907][ T8984] NET: Registered protocol family 30 [ 81.694226][ T8984] Failed to register TIPC socket type 02:56:46 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'syz_tun\x00', &(0x7f0000000080)=@ethtool_ts_info={0x4d}}) [ 82.362111][ T8986] IPVS: ftp: loaded support on port[0] = 21 [ 82.390911][ T8986] NET: Registered protocol family 30 [ 82.396268][ T8986] Failed to register TIPC socket type 02:56:47 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000040)=0x3, 0x4) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f00000000c0)=0x7, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @mcast2}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000)=0x3, 0x4) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000080), 0x4) [ 83.062215][ T8988] IPVS: ftp: loaded support on port[0] = 21 [ 83.081758][ T8988] NET: Registered protocol family 30 [ 83.127628][ T8988] Failed to register TIPC socket type 02:56:48 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) bind$llc(r0, &(0x7f0000000040), 0x10) [ 83.662085][ T8990] IPVS: ftp: loaded support on port[0] = 21 [ 83.692291][ T8990] NET: Registered protocol family 30 [ 83.716924][ T8990] Failed to register TIPC socket type [ 83.934402][ T8980] chnl_net:caif_netlink_parms(): no params data found [ 84.353438][ T8980] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.453902][ T8980] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.514910][ T8980] device bridge_slave_0 entered promiscuous mode [ 84.628412][ T8980] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.635624][ T8980] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.726121][ T8980] device bridge_slave_1 entered promiscuous mode [ 85.169055][ T8980] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 85.484736][ T8980] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 86.169720][ T8980] team0: Port device team_slave_0 added [ 86.480799][ T8980] team0: Port device team_slave_1 added [ 87.954680][ T8980] device hsr_slave_0 entered promiscuous mode [ 88.480191][ T8980] device hsr_slave_1 entered promiscuous mode [ 90.839189][ T8980] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.399680][ T9071] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 91.458748][ T9071] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 91.699544][ T8980] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.989293][ T9071] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 92.058471][ T9071] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 92.227369][ T9071] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.234695][ T9071] bridge0: port 1(bridge_slave_0) entered forwarding state [ 92.567691][ T2910] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 92.575985][ T2910] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 92.719327][ T2910] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 92.878232][ T2910] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.885355][ T2910] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.283105][ T9349] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 93.310624][ T9349] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 93.548219][ T2910] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 93.618316][ T2910] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 93.951865][ T9349] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 93.998470][ T9349] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 94.147545][ T9349] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 94.156259][ T9349] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 94.477556][ T9349] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 94.661644][ T2910] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 94.708457][ T2910] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 94.863056][ T8980] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 95.350059][ T8980] 8021q: adding VLAN 0 to HW filter on device batadv0 02:57:05 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e21, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x20) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e21, 0x0, @loopback}, 0x1c) writev(r0, &(0x7f0000000440)=[{&(0x7f00000001c0)='R', 0x1}], 0x1) 02:57:07 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e21, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x20) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e21, 0x0, @loopback}, 0x1c) writev(r0, &(0x7f0000000440)=[{&(0x7f00000001c0)='R', 0x1}], 0x1) 02:57:09 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e21, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x20) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e21, 0x0, @loopback}, 0x1c) writev(r0, &(0x7f0000000440)=[{&(0x7f00000001c0)='R', 0x1}], 0x1) [ 105.382053][ T9483] IPVS: ftp: loaded support on port[0] = 21 [ 105.861563][ T9483] NET: Registered protocol family 30 [ 105.969208][ T9486] IPVS: ftp: loaded support on port[0] = 21 [ 106.027887][ T9485] IPVS: ftp: loaded support on port[0] = 21 [ 106.138196][ T9487] IPVS: ftp: loaded support on port[0] = 21 [ 106.312422][ T9483] Failed to register TIPC socket type [ 106.591407][ T9485] NET: Registered protocol family 30 [ 106.600989][ T9486] list_add double add: new=ffffffff89544ab0, prev=ffffffff89334ac0, next=ffffffff89544ab0. 02:57:11 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e21, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x20) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e21, 0x0, @loopback}, 0x1c) writev(r0, &(0x7f0000000440)=[{&(0x7f00000001c0)='R', 0x1}], 0x1) [ 106.843266][ T9485] Failed to register TIPC socket type [ 107.077063][ T9486] ------------[ cut here ]------------ [ 107.082590][ T9486] kernel BUG at lib/list_debug.c:29! [ 107.546677][ T9486] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 107.552807][ T9486] CPU: 1 PID: 9486 Comm: syz-executor.3 Not tainted 5.1.0+ #18 [ 107.560361][ T9486] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 107.570797][ T9486] RIP: 0010:__list_add_valid.cold+0x26/0x3c [ 107.576706][ T9486] Code: 56 ff ff ff 4c 89 e1 48 c7 c7 20 4c a3 87 e8 00 60 25 fe 0f 0b 48 89 f2 4c 89 e1 4c 89 ee 48 c7 c7 60 4d a3 87 e8 e9 5f 25 fe <0f> 0b 48 89 f1 48 c7 c7 e0 4c a3 87 4c 89 e6 e8 d5 5f 25 fe 0f 0b [ 107.596322][ T9486] RSP: 0018:ffff88806de57b88 EFLAGS: 00010282 [ 107.602399][ T9486] RAX: 0000000000000058 RBX: ffffffff89544920 RCX: 0000000000000000 [ 107.610382][ T9486] RDX: 0000000000000000 RSI: ffffffff815afbe6 RDI: ffffed100dbcaf63 [ 107.618375][ T9486] RBP: ffff88806de57ba0 R08: 0000000000000058 R09: ffffed1015d26011 [ 107.626361][ T9486] R10: ffffed1015d26010 R11: ffff8880ae930087 R12: ffffffff89544ab0 [ 107.634344][ T9486] R13: ffffffff89544ab0 R14: ffffffff89544ab0 R15: ffffffff89544a50 [ 107.642339][ T9486] FS: 0000000001803940(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 [ 107.651302][ T9486] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 107.657893][ T9486] CR2: 0000001b2cf2b000 CR3: 000000006de26000 CR4: 00000000001406e0 [ 107.665883][ T9486] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 107.673868][ T9486] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 107.681847][ T9486] Call Trace: [ 107.685152][ T9486] ? mutex_lock_nested+0x16/0x20 [ 107.690119][ T9486] proto_register+0x459/0x8e0 [ 107.694816][ T9486] ? lockdep_init_map+0x1be/0x6d0 [ 107.699865][ T9486] tipc_socket_init+0x1c/0x70 [ 107.704567][ T9486] tipc_init_net+0x32a/0x5b0 [ 107.709168][ T9486] ? tipc_exit_net+0x40/0x40 [ 107.713778][ T9486] ops_init+0xb6/0x410 [ 107.717862][ T9486] setup_net+0x2d3/0x740 [ 107.722133][ T9486] ? copy_net_ns+0x1c0/0x340 [ 107.726738][ T9486] ? ops_init+0x410/0x410 [ 107.731092][ T9486] ? kasan_check_write+0x14/0x20 [ 107.736046][ T9486] ? down_read_killable+0x51/0x220 [ 107.741184][ T9486] copy_net_ns+0x1df/0x340 [ 107.745652][ T9486] create_new_namespaces+0x400/0x7b0 [ 107.750983][ T9486] unshare_nsproxy_namespaces+0xc2/0x200 [ 107.756636][ T9486] ksys_unshare+0x440/0x980 [ 107.761259][ T9486] ? trace_hardirqs_on+0x67/0x230 [ 107.766306][ T9486] ? walk_process_tree+0x2d0/0x2d0 [ 107.771439][ T9486] ? blkcg_exit_queue+0x30/0x30 [ 107.776309][ T9486] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 107.781794][ T9486] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 107.787883][ T9486] ? do_syscall_64+0x26/0x680 [ 107.792603][ T9486] ? lockdep_hardirqs_on+0x418/0x5d0 [ 107.797911][ T9486] __x64_sys_unshare+0x31/0x40 [ 107.802699][ T9486] do_syscall_64+0x103/0x680 [ 107.807311][ T9486] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 107.813210][ T9486] RIP: 0033:0x45b897 [ 107.817121][ T9486] Code: 00 00 00 b8 63 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 ad 8d fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 10 01 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 8d 8d fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 107.836737][ T9486] RSP: 002b:00007ffce7340b68 EFLAGS: 00000206 ORIG_RAX: 0000000000000110 [ 107.845160][ T9486] RAX: ffffffffffffffda RBX: 000000000073c988 RCX: 000000000045b897 [ 107.853148][ T9486] RDX: 0000000000000000 RSI: 00007ffce7340b10 RDI: 0000000040000000 [ 107.861131][ T9486] RBP: 00000000000000f8 R08: 0000000000000000 R09: 0000000000000005 [ 107.869128][ T9486] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000414ab0 [ 107.878612][ T9486] R13: 0000000000414b40 R14: 0000000000000000 R15: 0000000000000000 [ 107.887310][ T9486] Modules linked in: 02:57:13 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e21, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x20) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e21, 0x0, @loopback}, 0x1c) writev(r0, &(0x7f0000000440)=[{&(0x7f00000001c0)='R', 0x1}], 0x1) [ 108.535412][ T3879] kobject: 'loop0' (0000000060ed25c7): kobject_uevent_env [ 108.757109][ T3879] kobject: 'loop0' (0000000060ed25c7): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 108.825522][ T9499] IPVS: ftp: loaded support on port[0] = 21 02:57:14 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e21, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x20) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e21, 0x0, @loopback}, 0x1c) writev(r0, &(0x7f0000000440)=[{&(0x7f00000001c0)='R', 0x1}], 0x1) [ 110.176004][ T3879] kobject: 'loop0' (0000000060ed25c7): kobject_uevent_env [ 110.446680][ T3879] kobject: 'loop0' (0000000060ed25c7): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 111.355282][ T3879] kobject: 'loop0' (0000000060ed25c7): kobject_uevent_env [ 111.611352][ T3879] kobject: 'loop0' (0000000060ed25c7): fill_kobj_path: path = '/devices/virtual/block/loop0' 02:57:16 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e21, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x20) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e21, 0x0, @loopback}, 0x1c) writev(r0, &(0x7f0000000440)=[{&(0x7f00000001c0)='R', 0x1}], 0x1) [ 112.752284][ T3879] kobject: 'loop0' (0000000060ed25c7): kobject_uevent_env [ 112.856101][ T3879] kobject: 'loop0' (0000000060ed25c7): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 117.056657][ T9486] ---[ end trace b969d089182df0cd ]--- [ 117.062200][ T9486] RIP: 0010:__list_add_valid.cold+0x26/0x3c