syzkaller login: [ 64.334730][ T38] audit: type=1400 audit(1575122533.027:41): avc: denied { map } for pid=7898 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '[localhost]:7046' (ECDSA) to the list of known hosts. [ 66.095547][ T38] audit: type=1400 audit(1575122534.787:42): avc: denied { map } for pid=7908 comm="syz-fuzzer" path="/syz-fuzzer" dev="sda1" ino=16525 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 2019/11/30 14:02:14 fuzzer started 2019/11/30 14:02:15 dialing manager at 10.0.2.10:40921 2019/11/30 14:02:15 syscalls: 2533 2019/11/30 14:02:15 code coverage: enabled 2019/11/30 14:02:15 comparison tracing: enabled 2019/11/30 14:02:15 extra coverage: extra coverage is not supported by the kernel 2019/11/30 14:02:15 setuid sandbox: enabled 2019/11/30 14:02:15 namespace sandbox: enabled 2019/11/30 14:02:15 Android sandbox: /sys/fs/selinux/policy does not exist 2019/11/30 14:02:15 fault injection: enabled 2019/11/30 14:02:15 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/11/30 14:02:15 net packet injection: enabled 2019/11/30 14:02:15 net device setup: enabled 2019/11/30 14:02:15 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2019/11/30 14:02:15 devlink PCI setup: PCI device 0000:00:10.0 is not available 14:02:28 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_dev$sg(&(0x7f0000000100)='/dev/sg#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r0, r1, 0x0) [ 79.508691][ T38] audit: type=1400 audit(1575122548.207:43): avc: denied { map } for pid=7931 comm="syz-executor.0" path="/sys/kernel/debug/kcov" dev="debugfs" ino=3130 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 14:02:28 executing program 1: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x102) write$evdev(r0, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r0, 0xc0096616, 0x0) [ 79.674610][ T7932] IPVS: ftp: loaded support on port[0] = 21 [ 79.745062][ T7932] chnl_net:caif_netlink_parms(): no params data found [ 79.745992][ T7934] IPVS: ftp: loaded support on port[0] = 21 [ 79.790471][ T7932] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.798047][ T7932] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.805915][ T7932] device bridge_slave_0 entered promiscuous mode [ 79.815861][ T7932] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.823062][ T7932] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.830897][ T7932] device bridge_slave_1 entered promiscuous mode [ 79.849852][ T7932] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.864233][ T7932] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.885498][ T7932] team0: Port device team_slave_0 added [ 79.892858][ T7932] team0: Port device team_slave_1 added [ 79.970025][ T7932] device hsr_slave_0 entered promiscuous mode [ 80.008112][ T7932] device hsr_slave_1 entered promiscuous mode [ 80.080149][ T7934] chnl_net:caif_netlink_parms(): no params data found [ 80.115271][ T7934] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.122536][ T7934] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.130295][ T7934] device bridge_slave_0 entered promiscuous mode [ 80.140697][ T7934] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.148442][ T7934] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.149143][ T38] audit: type=1400 audit(1575122548.847:44): avc: denied { create } for pid=7932 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 80.179545][ T38] audit: type=1400 audit(1575122548.847:45): avc: denied { write } for pid=7932 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 80.179562][ T38] audit: type=1400 audit(1575122548.847:46): avc: denied { read } for pid=7932 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 80.228664][ T7934] device bridge_slave_1 entered promiscuous mode [ 80.240330][ T7932] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 80.313956][ T7932] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 80.369975][ T7932] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 80.460857][ T7934] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.469783][ T7932] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 80.563023][ T7934] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.585121][ T7934] team0: Port device team_slave_0 added [ 80.593228][ T7934] team0: Port device team_slave_1 added [ 80.610716][ T7932] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.617628][ T7932] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.625039][ T7932] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.632096][ T7932] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.700024][ T7934] device hsr_slave_0 entered promiscuous mode [ 80.728110][ T7934] device hsr_slave_1 entered promiscuous mode [ 80.778271][ T7934] debugfs: Directory 'hsr0' with parent '/' already present! [ 80.800170][ T148] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.818885][ T148] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.841069][ T7934] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 80.899592][ T7934] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 80.960699][ T7934] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 81.019761][ T7934] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 81.113111][ T7932] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.127464][ T3228] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 81.135657][ T3228] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 81.147592][ T7932] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.159202][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 81.168160][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 81.176823][ T28] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.183982][ T28] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.196043][ T3071] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 81.205220][ T3071] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 81.213932][ T3071] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.221668][ T3071] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.238906][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 81.248099][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 81.256396][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 81.264972][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 81.273601][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 81.282564][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 81.294433][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 81.302527][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 81.310682][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 81.325006][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 81.333841][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 81.346576][ T7934] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.354947][ T7932] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 81.372672][ T3071] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 81.381316][ T3071] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 81.390853][ T7934] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.402174][ T3071] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 81.410103][ T3071] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 81.418148][ T3071] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 81.427146][ T3071] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 81.435916][ T3071] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.443486][ T3071] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.451690][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 81.463591][ T36] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 81.472221][ T36] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 81.480744][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.487624][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.497255][ T7932] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.507585][ T38] audit: type=1400 audit(1575122550.197:47): avc: denied { associate } for pid=7932 comm="syz-executor.0" name="syz0" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1 [ 81.510189][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 81.551363][ T7934] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 81.561878][ T7934] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 81.573353][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 81.582282][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 81.591360][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 81.599722][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 81.608213][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 81.616429][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 81.624531][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 81.632814][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 81.642143][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 81.650597][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 81.659072][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 81.678903][ T7941] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 81.686243][ T7941] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 81.696502][ T7934] 8021q: adding VLAN 0 to HW filter on device batadv0 14:02:30 executing program 0: r0 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ioctl$FS_IOC_GETFSMAP(r0, 0xc05812fe, &(0x7f00000001c0)=ANY=[@ANYBLOB="53000000feffffff01030000000004000080040800000000008004080000000000000000000001"]) 14:02:30 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9, 0x0, 0x0, 0x4}, 0x0) socket$inet6(0xa, 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'vxcan1\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800200}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4044040}, 0x0) write(r2, &(0x7f0000000340), 0x41395527) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0xfffffffc, 0x3}, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}, 0x2, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$EXT4_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000480)) pipe(&(0x7f0000000100)) r3 = creat(&(0x7f0000000040)='./bus\x00', 0x0) io_setup(0x31f, 0x0) io_getevents(0x0, 0x0, 0x9, &(0x7f0000000580)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x0) fallocate(r3, 0x0, 0x0, 0x8020001) openat$uinput(0xffffffffffffff9c, &(0x7f0000000e00)='/dev/uinput\x00', 0x0, 0x0) getsockname$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x0) dup(0xffffffffffffffff) r4 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r4, &(0x7f0000000280)=ANY=[@ANYBLOB="8cff7cf908000000532c8b04272a469545204c696e757812ff000000c46f0006000000"], 0x23) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000b6dfc8)={0x500, 0x0, &(0x7f0000000140)={&(0x7f00000006c0)=ANY=[@ANYBLOB="0202000312000000000000000000000005000600000000000a0000000000000000000000000000000000ffffac1e0001000000000000000004000900a000000000000000020d6bfded2342273716fbaa28f7be830000000002000100000000000000000d0000000005000500000000000a00000000000000fe800000000000000000000000000000000000000000000037fca485c6b7060671afd8505c0cb9f65036d7976245537844266f0ed7f9d1670781721fadfd1f8c9bb126bba291a9e62c6f71d9294ef24f42a94fc7b981ab51e5f9ebedccdf8b76d4f29d4a388bbeb95d2e79c1faf98f0dd32704c3f40e2936eb9b6332ff07df27de252ac875d4eda48b05f9e1ce6f1aec3518f037e993abcc1346ee0ec067fc5cc839400f0870a107f441e587b341b5c483acbedc7d7dcbb2296c5d5d0f86b8bb1d0c1ec4d38327d3c980043a9c5a1d7160ea3713a475d1fd1b894d505a72d6c0f635a94a72ce6ced853e251af5142156c8741e4cbaae3f03bdf9761db057be27413dd890c50054cc2a7e3850fba48d01d44794acb3dbcb38b10ae0eabd6dc411efb4493a4a08f28a5b38904befa9b40b02e5b9df"], 0x90}}, 0x0) write$binfmt_misc(r5, &(0x7f00000004c0)={'syz1', "1c3aeed61022ba4bf653d517a7ad4390121d9fc551fbc051d0f9884edfa4bbf82b48673c0937c99f8907de25f29bea1b67392715394439aacb9270d9a2bdc71e68619fe8ff8876bf6d08a6e0ac7695b6dff860c94e92837a19a9a79022214d7bbce7b86d43b08379e60a0280ff790e790a2c6b3faa167cdb298e62bc197c65ae91e47d6e8cdde1e0c1db53bf3fdf63cd57acd187b4abb4"}, 0x9b) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x10005, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0x7, &(0x7f00000000c0)={0x3, 0x1ff, 0x6, 0x7ff}, 0x10) [ 81.870916][ T38] audit: type=1400 audit(1575122550.567:48): avc: denied { open } for pid=7951 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=perf_event permissive=1 [ 81.894810][ T38] audit: type=1400 audit(1575122550.567:49): avc: denied { kernel } for pid=7951 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=perf_event permissive=1 14:02:30 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(aes)\x00'}, 0x58) bind$alg(r0, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(aes)\x00'}, 0x58) 14:02:32 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x1d, 0x3, 0x1, &(0x7f0000005280)) 14:02:32 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) getpeername(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000580), 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x3, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip6_flowlabel\x00') socket$inet6(0xa, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x8031, 0xffffffffffffffff, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r1, &(0x7f0000000640)={'syz1\x00'}, 0x45c) ioctl$UI_DEV_CREATE(r1, 0x5501) readv(r1, &(0x7f00000004c0)=[{&(0x7f00000023c0)=""/4096, 0x18}], 0x3d3) write$uinput_user_dev(r1, &(0x7f0000000040)={'syz1\x00', {}, 0x0, [], [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000]}, 0x45c) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r2, &(0x7f0000000640)={'syz1\x00'}, 0x45c) ioctl$UI_DEV_CREATE(r2, 0x5501) readv(r2, &(0x7f00000004c0)=[{&(0x7f00000023c0)=""/4096, 0x18}], 0x3d3) write$uinput_user_dev(r2, &(0x7f0000000040)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1]}, 0x45c) perf_event_open(&(0x7f0000000380)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) 14:02:32 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x1d, 0x3, 0x1, &(0x7f0000005280)) 14:02:32 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x1d, 0x3, 0x1, &(0x7f0000005280)) [ 84.330649][ T7984] input: syz1 as /devices/virtual/input/input5 [ 84.581524][ T7984] input: syz1 as /devices/virtual/input/input7 14:02:33 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x1d, 0x3, 0x1, &(0x7f0000005280)) 14:02:33 executing program 0: socket(0x10, 0x0, 0x0) setsockopt$inet6_MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, 0x0, 0x0) setsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f00000005c0)={0x5, 0x0, 0x8}, 0x0) perf_event_open(&(0x7f00000003c0)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) signalfd(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x486) setsockopt$inet6_MRT6_ADD_MIF(0xffffffffffffffff, 0x29, 0xca, 0x0, 0x0) setsockopt$inet6_MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xc9, &(0x7f0000000180)={{0xa, 0x0, 0x0, @ipv4={[], [], @multicast1}}, {0xa, 0x4e20, 0x0, @remote}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x4]}, 0x5c) 14:02:33 executing program 1: socketpair(0x1d, 0x3, 0x1, &(0x7f0000005280)) 14:02:33 executing program 1: socketpair(0x1d, 0x3, 0x1, &(0x7f0000005280)) 14:02:33 executing program 1: socketpair(0x1d, 0x3, 0x1, &(0x7f0000005280)) [ 84.848442][ C0] hrtimer: interrupt took 25232 ns [ 238.558055][ T1113] INFO: task syz-executor.0:8005 blocked for more than 143 seconds. [ 238.565957][ T1113] Not tainted 5.4.0-syzkaller #0 [ 238.571905][ T1113] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 238.580637][ T1113] syz-executor.0 D28144 8005 7932 0x00004004 [ 238.586795][ T1113] Call Trace: [ 238.590250][ T1113] __schedule+0x8e1/0x1f30 [ 238.594474][ T1113] ? __sched_text_start+0x8/0x8 [ 238.599631][ T1113] ? lock_downgrade+0x920/0x920 [ 238.604390][ T1113] ? rwlock_bug.part.0+0x90/0x90 [ 238.609458][ T1113] schedule+0xdc/0x2b0 [ 238.613251][ T1113] schedule_preempt_disabled+0x13/0x20 [ 238.618582][ T1113] __mutex_lock+0x7ab/0x13c0 [ 238.622949][ T1113] ? perf_event_ctx_lock_nested+0x296/0x4c0 [ 238.628807][ T1113] ? mutex_trylock+0x2f0/0x2f0 [ 238.633209][ T1113] ? find_held_lock+0x35/0x130 [ 238.637667][ T1113] ? perf_event_ctx_lock_nested+0x262/0x4c0 [ 238.643892][ T1113] ? lock_downgrade+0x920/0x920 [ 238.648640][ T1113] mutex_lock_nested+0x16/0x20 [ 238.653263][ T1113] ? mutex_lock_nested+0x16/0x20 [ 238.658000][ T1113] perf_event_ctx_lock_nested+0x296/0x4c0 [ 238.663419][ T1113] ? __perf_event_read+0xe10/0xe10 [ 238.668743][ T1113] perf_event_release_kernel+0x121/0xef0 [ 238.674191][ T1113] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 238.680334][ T1113] ? __perf_event_exit_context+0x170/0x170 [ 238.686201][ T1113] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 238.692492][ T1113] perf_release+0x37/0x50 [ 238.696390][ T1113] __fput+0x2ff/0x890 [ 238.700411][ T1113] ? perf_event_release_kernel+0xef0/0xef0 [ 238.705866][ T1113] ____fput+0x16/0x20 [ 238.711570][ T1113] task_work_run+0x145/0x1c0 [ 238.716726][ T1113] exit_to_usermode_loop+0x316/0x380 [ 238.722174][ T1113] do_syscall_64+0x676/0x790 [ 238.729353][ T1113] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 238.736209][ T1113] RIP: 0033:0x413d81 [ 238.741025][ T1113] Code: 89 44 24 10 e8 40 c1 04 00 48 8b 6c 24 18 48 83 c4 20 c3 48 8b 4c 24 30 48 89 0c 24 48 8b 4c 24 38 48 89 4c 24 08 48 89 44 24 <10> e8 99 0c 00 00 48 8b 44 24 40 eb b5 48 8b 44 24 40 eb ae 48 8b [ 238.759928][ T1113] RSP: 002b:00007ffc611b1920 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 238.768466][ T1113] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 0000000000413d81 [ 238.776227][ T1113] RDX: 0000000000000000 RSI: 0000000000000c65 RDI: 0000000000000004 [ 238.784260][ T1113] RBP: 000000000071c980 R08: 00000000e1114c65 R09: 00000000e1114c69 [ 238.792478][ T1113] R10: 00007ffc611b1a50 R11: 0000000000000293 R12: 0000000000000001 [ 238.801123][ T1113] R13: 000000000071c980 R14: 0000000000722080 R15: 00007ffc611b1a30 [ 238.809253][ T1113] [ 238.809253][ T1113] Showing all locks held in the system: [ 238.817171][ T1113] 1 lock held by khungtaskd/1113: [ 238.823008][ T1113] #0: ffffffff895a4080 (rcu_read_lock){....}, at: debug_show_all_locks+0x5f/0x279 [ 238.832871][ T1113] 1 lock held by rsyslogd/7752: [ 238.837395][ T1113] #0: ffff88802b75bde0 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110 [ 238.846402][ T1113] 2 locks held by getty/7876: [ 238.851488][ T1113] #0: ffff8880265b0090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 238.860601][ T1113] #1: ffffc9000401a2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10 [ 238.870522][ T1113] 2 locks held by getty/7877: [ 238.874909][ T1113] #0: ffff88802473e090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 238.883643][ T1113] #1: ffffc900026fe2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10 [ 238.892910][ T1113] 2 locks held by getty/7878: [ 238.897455][ T1113] #0: ffff88801bff8090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 238.906771][ T1113] #1: ffffc900040162e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10 [ 238.917057][ T1113] 2 locks held by getty/7879: [ 238.922097][ T1113] #0: ffff88802c3ff090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 238.931914][ T1113] #1: ffffc900040222e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10 [ 238.941369][ T1113] 2 locks held by getty/7880: [ 238.946137][ T1113] #0: ffff88801bf55090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 238.954736][ T1113] #1: ffffc9000401e2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10 [ 238.965222][ T1113] 2 locks held by getty/7881: [ 238.971935][ T1113] #0: ffff888022c9a090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 238.982060][ T1113] #1: ffffc9000400a2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10 [ 238.991621][ T1113] 2 locks held by getty/7882: [ 238.996080][ T1113] #0: ffff88802bb5f090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 239.004876][ T1113] #1: ffffc900026f22e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10 [ 239.014028][ T1113] 1 lock held by syz-executor.0/8005: [ 239.019148][ T1113] #0: ffff888025ae78a0 (&ctx->mutex){+.+.}, at: perf_event_ctx_lock_nested+0x296/0x4c0 [ 239.028937][ T1113] 3 locks held by syz-executor.0/8007: [ 239.034517][ T1113] [ 239.036710][ T1113] ============================================= [ 239.036710][ T1113] [ 239.045408][ T1113] NMI backtrace for cpu 1 [ 239.049704][ T1113] CPU: 1 PID: 1113 Comm: khungtaskd Not tainted 5.4.0-syzkaller #0 [ 239.057279][ T1113] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 239.059653][ T1113] Call Trace: [ 239.059653][ T1113] dump_stack+0x197/0x210 [ 239.059653][ T1113] nmi_cpu_backtrace.cold+0x70/0xb2 [ 239.059653][ T1113] ? vprintk_func+0x86/0x189 [ 239.059653][ T1113] ? lapic_can_unplug_cpu.cold+0x3a/0x3a [ 239.059653][ T1113] nmi_trigger_cpumask_backtrace+0x23b/0x28b [ 239.059653][ T1113] arch_trigger_cpumask_backtrace+0x14/0x20 [ 239.059653][ T1113] watchdog+0xb11/0x10c0 [ 239.059653][ T1113] kthread+0x361/0x430 [ 239.059653][ T1113] ? reset_hung_task_detector+0x30/0x30 [ 239.059653][ T1113] ? kthread_mod_delayed_work+0x1f0/0x1f0 [ 239.059653][ T1113] ret_from_fork+0x24/0x30 [ 239.126114][ T1113] Sending NMI from CPU 1 to CPUs 0,2-3: [ 239.131937][ C0] NMI backtrace for cpu 0 skipped: idling at native_safe_halt+0xe/0x10 [ 239.131958][ C3] NMI backtrace for cpu 3 skipped: idling at native_safe_halt+0xe/0x10 [ 239.132756][ C2] NMI backtrace for cpu 2 [ 239.132760][ C2] CPU: 2 PID: 8007 Comm: syz-executor.0 Not tainted 5.4.0-syzkaller #0 [ 239.132764][ C2] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 239.132766][ C2] RIP: 0010:native_write_msr+0x6/0x30 [ 239.132773][ C2] Code: d0 c3 0f 21 d8 c3 0f 21 f0 c3 0f 0b 0f 1f 84 00 00 00 00 00 0f 0b 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 89 f9 89 f0 0f 30 <0f> 1f 44 00 00 c3 55 48 c1 e2 20 89 f6 48 89 e5 48 09 d6 31 d2 e8 [ 239.132775][ C2] RSP: 0018:ffff88802d409468 EFLAGS: 00000082 [ 239.132780][ C2] RAX: 000000001d7d25ce RBX: 0000000000000000 RCX: 00000000000006e0 [ 239.132783][ C2] RDX: 0000000000000072 RSI: 000000001d7d25ce RDI: 00000000000006e0 [ 239.132786][ C2] RBP: ffff88802d409480 R08: ffff888010758300 R09: ffff888010758b90 [ 239.132789][ C2] R10: fffffbfff146dba0 R11: ffffffff8a36dd07 R12: ffff88802d4227c0 [ 239.132792][ C2] R13: 00000000000000fa R14: 0000000000000000 R15: 0000000000000000 [ 239.132795][ C2] FS: 00007fa5470a7700(0000) GS:ffff88802d400000(0000) knlGS:0000000000000000 [ 239.132798][ C2] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 239.132801][ C2] CR2: ffffffffff600400 CR3: 000000000f336000 CR4: 00000000003406e0 [ 239.132804][ C2] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 239.132807][ C2] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 239.132825][ C2] Call Trace: [ 239.132827][ C2] [ 239.132829][ C2] ? lapic_next_deadline+0x4d/0x80 [ 239.132832][ C2] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 239.132834][ C2] clockevents_program_event+0x25c/0x370 [ 239.132836][ C2] tick_program_event+0xb4/0x130 [ 239.132838][ C2] hrtimer_interrupt+0x369/0x770 [ 239.132841][ C2] smp_apic_timer_interrupt+0x160/0x610 [ 239.132843][ C2] apic_timer_interrupt+0xf/0x20 [ 239.132846][ C2] RIP: 0010:stack_trace_consume_entry+0x10d/0x190 [ 239.132853][ C2] Code: 92 00 00 00 41 8d 44 24 01 89 43 10 48 8b 03 4e 8d 24 e0 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 80 3c 02 00 75 62 <4d> 89 2c 24 44 8b 63 10 8b 5b 08 44 89 e7 89 de e8 2e 2c 11 00 41 [ 239.132855][ C2] RSP: 0018:ffff88802d409698 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 [ 239.132860][ C2] RAX: dffffc0000000000 RBX: ffff88802d409788 RCX: ffffffff8163b292 [ 239.132864][ C2] RDX: 1ffff11005a81304 RSI: ffffffff8163b29c RDI: 0000000000000005 [ 239.132867][ C2] RBP: ffff88802d4096c0 R08: ffff888010758300 R09: ffff88802d409728 [ 239.132870][ C2] R10: ffff88802d4096f8 R11: ffff88802d409708 R12: ffff88802d409820 [ 239.132873][ C2] R13: ffffffff81b1e6ff R14: 0000000000000000 R15: 0000000000000000 [ 239.132875][ C2] ? apic_timer_interrupt+0xa/0x20 [ 239.132878][ C2] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 239.132880][ C2] ? stack_trace_consume_entry+0xc2/0x190 [ 239.132882][ C2] ? stack_trace_consume_entry+0xcc/0x190 [ 239.132885][ C2] ? stack_trace_consume_entry+0xcc/0x190 [ 239.132887][ C2] ? profile_setup.cold+0xbb/0xbb [ 239.132889][ C2] arch_stack_walk+0x71/0xf0 [ 239.132892][ C2] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 239.132894][ C2] stack_trace_save+0xac/0xe0 [ 239.132896][ C2] ? stack_trace_consume_entry+0x190/0x190 [ 239.132898][ C2] save_stack+0x23/0x90 [ 239.132900][ C2] ? save_stack+0x23/0x90 [ 239.132902][ C2] ? __kasan_check_read+0x11/0x20 [ 239.132905][ C2] ? __lock_acquire+0x16f2/0x4a00 [ 239.132907][ C2] ? __kasan_check_read+0x11/0x20 [ 239.132909][ C2] ? mark_lock+0xc2/0x1220 [ 239.132911][ C2] ? perf_trace_lock_acquire+0xf5/0x530 [ 239.132913][ C2] ? __kasan_check_read+0x11/0x20 [ 239.132916][ C2] ? __kasan_check_read+0x11/0x20 [ 239.132918][ C2] ? __lock_acquire+0x16f2/0x4a00 [ 239.132920][ C2] ? clockevents_program_event+0x15a/0x370 [ 239.132923][ C2] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 239.132925][ C2] ? debug_smp_processor_id+0x33/0x18a [ 239.132928][ C2] ? __kasan_check_read+0x11/0x20 [ 239.132930][ C2] ? mark_lock+0xc2/0x1220 [ 239.132932][ C2] ? should_fail+0x1de/0x852 [ 239.132934][ C2] ? mark_held_locks+0xa4/0xf0 [ 239.132936][ C2] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 239.132939][ C2] ? kmem_cache_alloc_node+0x22e/0x740 [ 239.132941][ C2] ? __alloc_skb+0xd5/0x5e0 [ 239.132943][ C2] ? kmem_cache_alloc_node+0x22e/0x740 [ 239.132946][ C2] ? kasan_unpoison_shadow+0x35/0x50 [ 239.132948][ C2] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 239.132950][ C2] kasan_slab_alloc+0xf/0x20 [ 239.132952][ C2] kmem_cache_alloc_node+0x138/0x740 [ 239.132955][ C2] ? ipv6_get_lladdr+0x308/0x490 [ 239.132957][ C2] __alloc_skb+0xd5/0x5e0 [ 239.132959][ C2] ? __kmalloc_reserve.isra.0+0xf0/0xf0 [ 239.132961][ C2] ? __kasan_check_read+0x11/0x20 [ 239.132964][ C2] ndisc_alloc_skb+0x13c/0x340 [ 239.132966][ C2] ndisc_send_rs+0x39b/0x720 [ 239.132968][ C2] addrconf_rs_timer+0x30f/0x6e0 [ 239.132970][ C2] ? ipv6_get_lladdr+0x490/0x490 [ 239.132972][ C2] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 239.132975][ C2] call_timer_fn+0x1ac/0x780 [ 239.132977][ C2] ? ipv6_get_lladdr+0x490/0x490 [ 239.132979][ C2] ? msleep_interruptible+0x150/0x150 [ 239.132981][ C2] ? run_timer_softirq+0x6b1/0x1790 [ 239.132983][ C2] ? trace_hardirqs_on+0x67/0x240 [ 239.132986][ C2] ? ipv6_get_lladdr+0x490/0x490 [ 239.132988][ C2] ? ipv6_get_lladdr+0x490/0x490 [ 239.132990][ C2] run_timer_softirq+0x6c3/0x1790 [ 239.132992][ C2] ? add_timer+0x930/0x930 [ 239.132995][ C2] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 239.132997][ C2] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 239.132999][ C2] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 239.133001][ C2] __do_softirq+0x262/0x98c [ 239.133004][ C2] ? sched_clock_cpu+0x14e/0x1b0 [ 239.133006][ C2] irq_exit+0x19b/0x1e0 [ 239.133008][ C2] smp_apic_timer_interrupt+0x1a3/0x610 [ 239.133010][ C2] apic_timer_interrupt+0xf/0x20 [ 239.133012][ C2] [ 239.133014][ C2] RIP: 0010:_raw_spin_unlock_irq+0x4f/0x80 [ 239.133021][ C2] Code: c0 68 34 53 89 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 33 48 83 3d 12 2a 99 01 00 74 20 fb 66 0f 1f 44 00 00 01 00 00 00 e8 e7 6b 96 f9 65 8b 05 18 14 48 78 85 c0 74 06 41 [ 239.133024][ C2] RSP: 0018:ffff888072ce78a0 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 [ 239.133029][ C2] RAX: 1ffffffff12a668d RBX: ffff888010758300 RCX: 0000000000000006 [ 239.133032][ C2] RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff888010758b94 [ 239.133035][ C2] RBP: ffff888072ce78a8 R08: 1ffffffff15d29b8 R09: fffffbfff15d29b9 [ 239.133038][ C2] R10: fffffbfff15d29b8 R11: ffffffff8ae94dc7 R12: ffff88802d437380 [ 239.133041][ C2] R13: ffff88802c4bc3c0 R14: ffff888023fc0bc0 R15: 0000000000000000 [ 239.133044][ C2] finish_task_switch+0x147/0x750 [ 239.133046][ C2] ? finish_task_switch+0x119/0x750 [ 239.133048][ C2] __schedule+0x8e9/0x1f30 [ 239.133050][ C2] ? __sched_text_start+0x8/0x8 [ 239.133052][ C2] preempt_schedule_irq+0xb5/0x160 [ 239.133054][ C2] retint_kernel+0x1b/0x2b [ 239.133057][ C2] RIP: 0010:smp_call_function_single+0x410/0x480 [ 239.133064][ C2] Code: 41 89 c5 e9 b7 fd ff ff e8 6d 25 0b 00 0f 0b e9 e6 fc ff ff e8 61 25 0b 00 0f 0b e9 41 fd ff ff e8 55 25 0b 00 e8 a9 ae 96 ff ba fd ff ff e8 46 25 0b 00 0f 0b 48 8b 3c 24 e8 bb 52 48 00 e9 [ 239.133066][ C2] RSP: 0018:ffff888072ce7ac0 EFLAGS: 00010246 ORIG_RAX: ffffffffffffff13 [ 239.133072][ C2] RAX: 0000000000040000 RBX: 1ffff1100e59cf5c RCX: ffffc9000408c000 [ 239.133075][ C2] RDX: 00000000000034da RSI: ffffffff8169b8cb RDI: 0000000000000005 [ 239.133078][ C2] RBP: ffff888072ce7b90 R08: ffff888010758300 R09: fffffbfff15d29b9 [ 239.133081][ C2] R10: fffffbfff15d29b8 R11: ffffffff8ae94dc7 R12: 0000000000000000 [ 239.133084][ C2] R13: 0000000000000000 R14: 0000000000000001 R15: ffffffff818d85c0 [ 239.133086][ C2] ? __perf_event_enable+0x930/0x930 [ 239.133089][ C2] ? smp_call_function_single+0x40b/0x480 [ 239.133091][ C2] ? perf_duration_warn+0x40/0x40 [ 239.133093][ C2] ? generic_exec_single+0x4c0/0x4c0 [ 239.133096][ C2] ? __do_sys_perf_event_open+0x174c/0x2c70 [ 239.133098][ C2] ? __perf_event_enable+0x930/0x930 [ 239.133100][ C2] task_function_call+0xe9/0x180 [ 239.133103][ C2] ? perf_event_addr_filters_exec+0x310/0x310 [ 239.133105][ C2] ? __do_sys_perf_event_open+0x174c/0x2c70 [ 239.133108][ C2] ? __perf_event_enable+0x930/0x930 [ 239.133110][ C2] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 239.133113][ C2] ? exclusive_event_installable+0x257/0x320 [ 239.133115][ C2] perf_install_in_context+0x308/0x5a0 [ 239.133118][ C2] ? list_add_event+0xed0/0xed0 [ 239.133120][ C2] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 239.133123][ C2] ? __perf_event_header_size.isra.0+0x166/0x1c0 [ 239.133125][ C2] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 239.133128][ C2] __do_sys_perf_event_open+0x1cbc/0x2c70 [ 239.133130][ C2] ? perf_event_set_output+0x4e0/0x4e0 [ 239.133133][ C2] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 239.133135][ C2] ? put_timespec64+0xda/0x140 [ 239.133137][ C2] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 239.133140][ C2] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 239.133142][ C2] ? do_syscall_64+0x26/0x790 [ 239.133144][ C2] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 239.133146][ C2] ? do_syscall_64+0x26/0x790 [ 239.133149][ C2] __x64_sys_perf_event_open+0xbe/0x150 [ 239.133151][ C2] do_syscall_64+0xfa/0x790 [ 239.133153][ C2] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 239.133155][ C2] RIP: 0033:0x45a759 [ 239.133162][ C2] Code: bd b1 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 8b b1 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 239.133164][ C2] RSP: 002b:00007fa5470a6c88 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 239.133170][ C2] RAX: ffffffffffffffda RBX: 000000000071bf00 RCX: 000000000045a759 [ 239.133173][ C2] RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 000000002001d000 [ 239.133176][ C2] RBP: 0000000000000005 R08: 0000000000000000 R09: 0000000000000000 [ 239.133179][ C2] R10: ffffffffffffffff R11: 0000000000000246 R12: 00007fa5470a76d4 [ 239.133182][ C2] R13: 00000000004aec2b R14: 00000000006f1ca8 R15: 00000000ffffffff [ 239.133234][ T1113] Kernel panic - not syncing: hung_task: blocked tasks [ 239.141619][ T1113] CPU: 1 PID: 1113 Comm: khungtaskd Not tainted 5.4.0-syzkaller #0 [ 239.141619][ T1113] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 239.141619][ T1113] Call Trace: [ 239.141619][ T1113] dump_stack+0x197/0x210 [ 239.141619][ T1113] panic+0x2e3/0x75c [ 239.141619][ T1113] ? add_taint.cold+0x16/0x16 [ 239.141619][ T1113] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 239.141619][ T1113] ? printk_safe_flush+0xf2/0x140 [ 239.141619][ T1113] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 239.141619][ T1113] ? nmi_trigger_cpumask_backtrace+0x224/0x28b [ 239.141619][ T1113] ? nmi_trigger_cpumask_backtrace+0x21b/0x28b [ 239.141619][ T1113] watchdog+0xb22/0x10c0 [ 239.141619][ T1113] kthread+0x361/0x430 [ 239.141619][ T1113] ? reset_hung_task_detector+0x30/0x30 [ 239.141619][ T1113] ? kthread_mod_delayed_work+0x1f0/0x1f0 [ 239.141619][ T1113] ret_from_fork+0x24/0x30 [ 239.141619][ T1113] Kernel Offset: disabled [ 239.141619][ T1113] Rebooting in 86400 seconds..