[ 35.870023][ T27] audit: type=1800 audit(1554064448.347:27): pid=7525 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [ 35.893739][ T27] audit: type=1800 audit(1554064448.347:28): pid=7525 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2417 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 36.716580][ T27] audit: type=1800 audit(1554064449.247:29): pid=7525 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 36.743207][ T27] audit: type=1800 audit(1554064449.247:30): pid=7525 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.202' (ECDSA) to the list of known hosts. 2019/03/31 20:35:19 parsed 1 programs 2019/03/31 20:35:22 executed programs: 0 syzkaller login: [ 110.309627][ T7701] IPVS: ftp: loaded support on port[0] = 21 [ 110.317329][ T7707] IPVS: ftp: loaded support on port[0] = 21 [ 110.319938][ T7702] IPVS: ftp: loaded support on port[0] = 21 [ 110.346907][ T7706] IPVS: ftp: loaded support on port[0] = 21 [ 110.347099][ T7704] IPVS: ftp: loaded support on port[0] = 21 [ 110.376082][ T7699] IPVS: ftp: loaded support on port[0] = 21 [ 110.566702][ T7701] chnl_net:caif_netlink_parms(): no params data found [ 110.708187][ T7701] bridge0: port 1(bridge_slave_0) entered blocking state [ 110.716186][ T7701] bridge0: port 1(bridge_slave_0) entered disabled state [ 110.724043][ T7701] device bridge_slave_0 entered promiscuous mode [ 110.732307][ T7701] bridge0: port 2(bridge_slave_1) entered blocking state [ 110.739360][ T7701] bridge0: port 2(bridge_slave_1) entered disabled state [ 110.747266][ T7701] device bridge_slave_1 entered promiscuous mode [ 110.775913][ T7701] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 110.787517][ T7699] chnl_net:caif_netlink_parms(): no params data found [ 110.796478][ T7707] chnl_net:caif_netlink_parms(): no params data found [ 110.808321][ T7701] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 110.822714][ T7704] chnl_net:caif_netlink_parms(): no params data found [ 110.927563][ T7701] team0: Port device team_slave_0 added [ 110.935920][ T7701] team0: Port device team_slave_1 added [ 110.978767][ T7702] chnl_net:caif_netlink_parms(): no params data found [ 110.997495][ T7704] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.005317][ T7704] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.013500][ T7704] device bridge_slave_0 entered promiscuous mode [ 111.024755][ T7706] chnl_net:caif_netlink_parms(): no params data found [ 111.103682][ T7701] device hsr_slave_0 entered promiscuous mode [ 111.171104][ T7701] device hsr_slave_1 entered promiscuous mode [ 111.251678][ T7704] bridge0: port 2(bridge_slave_1) entered blocking state [ 111.258739][ T7704] bridge0: port 2(bridge_slave_1) entered disabled state [ 111.267230][ T7704] device bridge_slave_1 entered promiscuous mode [ 111.274506][ T7707] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.281953][ T7707] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.289499][ T7707] device bridge_slave_0 entered promiscuous mode [ 111.300811][ T7707] bridge0: port 2(bridge_slave_1) entered blocking state [ 111.307982][ T7707] bridge0: port 2(bridge_slave_1) entered disabled state [ 111.316347][ T7707] device bridge_slave_1 entered promiscuous mode [ 111.334905][ T7699] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.343101][ T7699] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.350599][ T7699] device bridge_slave_0 entered promiscuous mode [ 111.380580][ T7704] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 111.396711][ T7704] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 111.406552][ T7699] bridge0: port 2(bridge_slave_1) entered blocking state [ 111.414551][ T7699] bridge0: port 2(bridge_slave_1) entered disabled state [ 111.424170][ T7699] device bridge_slave_1 entered promiscuous mode [ 111.472605][ T7707] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 111.483282][ T7707] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 111.509214][ T7702] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.516659][ T7702] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.524441][ T7702] device bridge_slave_0 entered promiscuous mode [ 111.536805][ T7702] bridge0: port 2(bridge_slave_1) entered blocking state [ 111.543996][ T7702] bridge0: port 2(bridge_slave_1) entered disabled state [ 111.551685][ T7702] device bridge_slave_1 entered promiscuous mode [ 111.559913][ T7699] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 111.571532][ T7699] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 111.582476][ T7704] team0: Port device team_slave_0 added [ 111.594193][ T7706] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.601527][ T7706] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.609082][ T7706] device bridge_slave_0 entered promiscuous mode [ 111.617232][ T7706] bridge0: port 2(bridge_slave_1) entered blocking state [ 111.624591][ T7706] bridge0: port 2(bridge_slave_1) entered disabled state [ 111.632785][ T7706] device bridge_slave_1 entered promiscuous mode [ 111.663472][ T7704] team0: Port device team_slave_1 added [ 111.678954][ T7699] team0: Port device team_slave_0 added [ 111.686146][ T7699] team0: Port device team_slave_1 added [ 111.693614][ T7707] team0: Port device team_slave_0 added [ 111.710603][ T7702] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 111.730665][ T7706] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 111.744363][ T7707] team0: Port device team_slave_1 added [ 111.751992][ T7702] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 111.812399][ T7704] device hsr_slave_0 entered promiscuous mode [ 111.871244][ T7704] device hsr_slave_1 entered promiscuous mode [ 111.912279][ T7706] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 112.013378][ T7699] device hsr_slave_0 entered promiscuous mode [ 112.061176][ T7699] device hsr_slave_1 entered promiscuous mode [ 112.145585][ T7702] team0: Port device team_slave_0 added [ 112.192399][ T7707] device hsr_slave_0 entered promiscuous mode [ 112.241339][ T7707] device hsr_slave_1 entered promiscuous mode [ 112.298013][ T7702] team0: Port device team_slave_1 added [ 112.311574][ T7706] team0: Port device team_slave_0 added [ 112.318699][ T7706] team0: Port device team_slave_1 added [ 112.382524][ T7702] device hsr_slave_0 entered promiscuous mode [ 112.421191][ T7702] device hsr_slave_1 entered promiscuous mode [ 112.553992][ T7706] device hsr_slave_0 entered promiscuous mode [ 112.601276][ T7706] device hsr_slave_1 entered promiscuous mode [ 112.692553][ T7701] 8021q: adding VLAN 0 to HW filter on device bond0 [ 112.730582][ T7701] 8021q: adding VLAN 0 to HW filter on device team0 [ 112.752715][ T7709] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 112.761940][ T7709] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 112.771676][ T7704] 8021q: adding VLAN 0 to HW filter on device bond0 [ 112.808305][ T7699] 8021q: adding VLAN 0 to HW filter on device bond0 [ 112.822163][ T7707] 8021q: adding VLAN 0 to HW filter on device bond0 [ 112.830669][ T7709] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 112.841187][ T7709] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 112.849438][ T7709] bridge0: port 1(bridge_slave_0) entered blocking state [ 112.856599][ T7709] bridge0: port 1(bridge_slave_0) entered forwarding state [ 112.867169][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 112.875414][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 112.884265][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 112.915284][ T7704] 8021q: adding VLAN 0 to HW filter on device team0 [ 112.926211][ T3480] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 112.935389][ T3480] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 112.944274][ T3480] bridge0: port 2(bridge_slave_1) entered blocking state [ 112.951382][ T3480] bridge0: port 2(bridge_slave_1) entered forwarding state [ 112.958913][ T3480] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 112.967464][ T3480] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 112.976028][ T3480] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 112.985001][ T3480] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 112.993979][ T3480] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 113.012100][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 113.020722][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 113.031886][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 113.040227][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 113.048740][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 113.056964][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 113.065533][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 113.073355][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 113.095049][ T7701] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 113.118023][ T7702] 8021q: adding VLAN 0 to HW filter on device bond0 [ 113.129074][ T7699] 8021q: adding VLAN 0 to HW filter on device team0 [ 113.138661][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 113.148321][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 113.157288][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 113.164391][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 113.175176][ T7706] 8021q: adding VLAN 0 to HW filter on device bond0 [ 113.191571][ T7707] 8021q: adding VLAN 0 to HW filter on device team0 [ 113.212629][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 113.220497][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 113.228405][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 113.236505][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 113.244902][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 113.252686][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 113.261552][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 113.269783][ T22] bridge0: port 1(bridge_slave_0) entered blocking state [ 113.278189][ T22] bridge0: port 1(bridge_slave_0) entered forwarding state [ 113.285871][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 113.294567][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 113.302944][ T22] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.309976][ T22] bridge0: port 2(bridge_slave_1) entered forwarding state [ 113.317620][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 113.326493][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 113.335187][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 113.343552][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 113.352058][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 113.360455][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 113.369413][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 113.377539][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 113.399625][ T7702] 8021q: adding VLAN 0 to HW filter on device team0 [ 113.407060][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 113.416186][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 113.424810][ T7715] bridge0: port 1(bridge_slave_0) entered blocking state [ 113.431929][ T7715] bridge0: port 1(bridge_slave_0) entered forwarding state [ 113.439665][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 113.448384][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 113.456749][ T7715] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.463894][ T7715] bridge0: port 2(bridge_slave_1) entered forwarding state [ 113.472159][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 113.487391][ T7701] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 113.507544][ T7706] 8021q: adding VLAN 0 to HW filter on device team0 [ 113.516789][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 113.533054][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 113.541454][ T7715] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.548500][ T7715] bridge0: port 2(bridge_slave_1) entered forwarding state [ 113.556352][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 113.565101][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 113.572941][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 113.580506][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 113.588999][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 113.618104][ T7704] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 113.641952][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 113.654680][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 113.664125][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 113.673566][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 113.682343][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 113.690578][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 113.697660][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 113.705721][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 113.714306][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 113.722670][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.729705][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 113.737811][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 113.746527][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 113.755101][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 113.763537][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 113.770574][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 113.778273][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 113.786544][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 113.794784][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 113.803425][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 113.812437][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.819460][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 113.830737][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 113.838848][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 113.846978][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 113.865927][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 113.874701][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 113.886848][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 113.895835][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 113.935166][ T7707] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 113.965181][ T7707] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 113.978416][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 113.988925][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 113.997523][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 114.005943][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 114.015046][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 114.015356][ C0] hrtimer: interrupt took 28795 ns [ 114.024058][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 114.036570][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 114.045428][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 114.054335][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 114.068477][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 114.077806][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 114.087204][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 114.096209][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 114.105571][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 114.114408][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 114.123102][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 114.134856][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 114.144509][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 114.165460][ T7704] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 114.175275][ T7699] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 114.187140][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 114.195755][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 114.204996][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 114.213901][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 114.223174][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 114.232075][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 114.240652][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 114.249631][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 114.258272][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 114.266934][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 114.276923][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 114.288588][ T7702] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 114.300657][ T7702] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 114.328923][ T7706] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 114.352644][ T7706] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 114.370811][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 114.380189][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 114.388923][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 114.397784][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 114.406671][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 114.415617][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 114.424788][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 114.442697][ T7699] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 114.452874][ T7715] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 114.478882][ T7707] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 114.601074][ T7706] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 114.633764][ T7702] 8021q: adding VLAN 0 to HW filter on device batadv0 2019/03/31 20:35:27 executed programs: 16 [ 118.201726][ C1] ================================================================== [ 118.210132][ C1] BUG: KASAN: use-after-free in ccid_hc_tx_delete+0xde/0x100 [ 118.217510][ C1] Read of size 8 at addr ffff88809fc95740 by task syz-execprog/7679 [ 118.225665][ C1] [ 118.228004][ C1] CPU: 1 PID: 7679 Comm: syz-execprog Not tainted 5.1.0-rc2+ #45 [ 118.235717][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 118.245772][ C1] Call Trace: [ 118.249060][ C1] [ 118.251924][ C1] dump_stack+0x172/0x1f0 [ 118.256263][ C1] ? ccid_hc_tx_delete+0xde/0x100 [ 118.261296][ C1] print_address_description.cold+0x7c/0x20d [ 118.267278][ C1] ? ccid_hc_tx_delete+0xde/0x100 [ 118.272310][ C1] ? ccid_hc_tx_delete+0xde/0x100 [ 118.277341][ C1] kasan_report.cold+0x1b/0x40 [ 118.282118][ C1] ? ccid_hc_tx_delete+0xde/0x100 [ 118.287149][ C1] __asan_report_load8_noabort+0x14/0x20 [ 118.292787][ C1] ccid_hc_tx_delete+0xde/0x100 [ 118.297646][ C1] dccp_sk_destruct+0x3f/0x90 [ 118.302331][ C1] ? dccp_init_sock+0x3f0/0x3f0 [ 118.307196][ C1] __sk_destruct+0x55/0x6d0 [ 118.311706][ C1] ? proto_unregister+0x4e0/0x4e0 [ 118.316949][ C1] rcu_core+0x928/0x1390 [ 118.321203][ C1] ? rcu_check_gp_start_stall+0x250/0x250 [ 118.326924][ C1] ? sched_clock+0x2e/0x50 [ 118.331359][ C1] __do_softirq+0x266/0x95a [ 118.335872][ C1] ? sched_clock_cpu+0x1b/0x1b0 [ 118.340735][ C1] irq_exit+0x180/0x1d0 [ 118.344904][ C1] smp_apic_timer_interrupt+0x14a/0x570 [ 118.350463][ C1] apic_timer_interrupt+0xf/0x20 [ 118.355821][ C1] [ 118.358803][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0x95/0xe0 [ 118.365234][ C1] Code: 48 c7 c0 f0 96 92 88 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 39 48 83 3d 42 0b 83 01 00 74 24 48 89 df 57 9d <0f> 1f 44 00 00 bf 01 00 00 00 e8 bc 34 3e fa 65 8b 05 c5 61 f2 78 [ 118.384853][ C1] RSP: 0018:ffff88808ed3f8a8 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13 [ 118.393268][ C1] RAX: 1ffffffff11252de RBX: 0000000000000282 RCX: 0000000000000000 [ 118.401242][ C1] RDX: dffffc0000000000 RSI: 0000000000000006 RDI: 0000000000000282 [ 118.409214][ C1] RBP: ffff88808ed3f8b8 R08: ffff888091318640 R09: 0000000000000000 [ 118.417198][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880ae925d00 [ 118.425688][ C1] R13: ffff88808ed3fac0 R14: 0000000000025d00 R15: ffff8880ae925d80 [ 118.433687][ C1] hrtimer_start_range_ns+0x66b/0xc80 [ 118.439077][ C1] ? __hrtimer_get_remaining+0x1a0/0x1a0 [ 118.444733][ C1] ? kasan_check_read+0x11/0x20 [ 118.449593][ C1] ? do_raw_spin_unlock+0x57/0x270 [ 118.454712][ C1] futex_wait_queue_me+0x262/0x600 [ 118.459828][ C1] ? handle_futex_death.part.0+0x1f0/0x1f0 [ 118.465655][ C1] ? lock_pi_update_atomic+0x120/0x120 [ 118.471122][ C1] futex_wait+0x228/0x5e0 [ 118.475468][ C1] ? futex_wait_setup+0x390/0x390 [ 118.480504][ C1] ? clock_was_set_work+0x30/0x30 [ 118.485536][ C1] ? __might_fault+0x12b/0x1e0 [ 118.490329][ C1] do_futex+0x170/0x1df0 [ 118.494583][ C1] ? find_held_lock+0x35/0x130 [ 118.499349][ C1] ? __might_fault+0x12b/0x1e0 [ 118.504153][ C1] ? exit_robust_list+0x2c0/0x2c0 [ 118.509188][ C1] ? __x64_sys_futex+0x4c2/0x590 [ 118.514134][ C1] ? ktime_get+0x105/0x300 [ 118.518551][ C1] ? __x64_sys_futex+0x4c2/0x590 [ 118.523493][ C1] ? ktime_get+0x105/0x300 [ 118.528175][ C1] ? lockdep_hardirqs_on+0x418/0x5d0 [ 118.533467][ C1] ? trace_hardirqs_on+0x67/0x230 [ 118.538504][ C1] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 118.544226][ C1] ? ktime_get+0x208/0x300 [ 118.548652][ C1] __x64_sys_futex+0x3f7/0x590 [ 118.553432][ C1] ? do_futex+0x1df0/0x1df0 [ 118.557941][ C1] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 118.563416][ C1] ? do_syscall_64+0x26/0x610 [ 118.568097][ C1] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 118.574165][ C1] ? do_syscall_64+0x26/0x610 [ 118.578847][ C1] ? lockdep_hardirqs_on+0x418/0x5d0 [ 118.584141][ C1] ? trace_hardirqs_on+0x67/0x230 [ 118.589172][ C1] do_syscall_64+0x103/0x610 [ 118.593773][ C1] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 118.599668][ C1] RIP: 0033:0x4592c3 [ 118.603566][ C1] Code: cc cc cc cc cc cc cc 48 8b 7c 24 08 8b 74 24 10 8b 54 24 14 4c 8b 54 24 18 4c 8b 44 24 20 44 8b 4c 24 28 b8 ca 00 00 00 0f 05 <89> 44 24 30 c3 cc cc cc cc cc cc cc cc 8b 7c 24 08 48 8b 74 24 10 [ 118.623169][ C1] RSP: 002b:000000c420037e80 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 118.631584][ C1] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004592c3 [ 118.639557][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000133e798 [ 118.647532][ C1] RBP: 000000c420037ec8 R08: 0000000000000000 R09: 0000000000000000 [ 118.655517][ C1] R10: 000000c420037eb8 R11: 0000000000000246 R12: 000000000042e590 [ 118.663494][ C1] R13: 00000000000000f1 R14: 0000000000000011 R15: 0000000000000000 [ 118.671476][ C1] [ 118.673804][ C1] Allocated by task 8038: [ 118.678141][ C1] save_stack+0x45/0xd0 [ 118.682300][ C1] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 118.687939][ C1] kasan_slab_alloc+0xf/0x20 [ 118.692536][ C1] kmem_cache_alloc+0x11a/0x6f0 [ 118.697393][ C1] ccid_new+0x256/0x3f0 [ 118.701555][ C1] dccp_hdlr_ccid+0x27/0x150 [ 118.706153][ C1] __dccp_feat_activate+0x17a/0x270 [ 118.711361][ C1] dccp_feat_activate_values+0x33a/0x766 [ 118.717005][ C1] dccp_rcv_state_process+0x116f/0x1935 [ 118.722550][ C1] dccp_v6_do_rcv+0x269/0xbf0 [ 118.727407][ C1] __release_sock+0x12e/0x3a0 [ 118.732084][ C1] release_sock+0x59/0x1c0 [ 118.736502][ C1] __inet_stream_connect+0x59f/0xea0 [ 118.741786][ C1] inet_stream_connect+0x58/0xa0 [ 118.746723][ C1] __sys_connect+0x266/0x330 [ 118.751314][ C1] __ia32_sys_connect+0x72/0xb0 [ 118.756166][ C1] do_fast_syscall_32+0x281/0xc98 [ 118.761203][ C1] entry_SYSENTER_compat+0x70/0x7f [ 118.766305][ C1] [ 118.768635][ C1] Freed by task 8044: [ 118.772621][ C1] save_stack+0x45/0xd0 [ 118.776781][ C1] __kasan_slab_free+0x102/0x150 [ 118.781720][ C1] kasan_slab_free+0xe/0x10 [ 118.786226][ C1] kmem_cache_free+0x86/0x260 [ 118.790997][ C1] ccid_hc_tx_delete+0xc1/0x100 [ 118.795850][ C1] dccp_hdlr_ccid+0x7d/0x150 [ 118.800448][ C1] __dccp_feat_activate+0x17a/0x270 [ 118.805650][ C1] dccp_feat_activate_values+0x33a/0x766 [ 118.811284][ C1] dccp_create_openreq_child+0x40c/0x570 [ 118.816922][ C1] dccp_v6_request_recv_sock+0x214/0x1e80 [ 118.822646][ C1] dccp_check_req+0x35c/0x6f0 [ 118.827325][ C1] dccp_v6_rcv+0x6d7/0x191e [ 118.831835][ C1] ip6_protocol_deliver_rcu+0x303/0x16c0 [ 118.837468][ C1] ip6_input_finish+0x84/0x170 [ 118.842240][ C1] ip6_input+0xe4/0x3f0 [ 118.846409][ C1] ip6_rcv_finish+0x1e7/0x320 [ 118.851092][ C1] ipv6_rcv+0x10e/0x420 [ 118.855257][ C1] __netif_receive_skb_one_core+0x115/0x1a0 [ 118.861156][ C1] __netif_receive_skb+0x2c/0x1c0 [ 118.866183][ C1] process_backlog+0x206/0x750 [ 118.866201][ C1] net_rx_action+0x4fa/0x1070 [ 118.866221][ C1] __do_softirq+0x266/0x95a [ 118.866226][ C1] [ 118.866236][ C1] The buggy address belongs to the object at ffff88809fc95740 [ 118.866236][ C1] which belongs to the cache ccid2_hc_tx_sock of size 1240 [ 118.866245][ C1] The buggy address is located 0 bytes inside of [ 118.866245][ C1] 1240-byte region [ffff88809fc95740, ffff88809fc95c18) [ 118.866249][ C1] The buggy address belongs to the page: [ 118.866259][ C1] page:ffffea00027f2500 count:1 mapcount:0 mapping:ffff88809b2dd3c0 index:0x0 compound_mapcount: 0 [ 118.866270][ C1] flags: 0x1fffc0000010200(slab|head) [ 118.866285][ C1] raw: 01fffc0000010200 ffffea00027e4308 ffffea00027d3388 ffff88809b2dd3c0 [ 118.871343][ T3876] kobject: 'loop5' (000000006e17bd55): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 118.875843][ C1] raw: 0000000000000000 ffff88809fc94140 0000000100000005 0000000000000000 [ 118.875850][ C1] page dumped because: kasan: bad access detected [ 118.875853][ C1] [ 118.875857][ C1] Memory state around the buggy address: [ 118.875869][ C1] ffff88809fc95600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 118.875878][ C1] ffff88809fc95680: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc [ 118.875888][ C1] >ffff88809fc95700: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 118.875894][ C1] ^ [ 118.875904][ C1] ffff88809fc95780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 118.875920][ C1] ffff88809fc95800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 118.882962][ T3876] kobject: 'loop2' (000000008153800f): kobject_uevent_env [ 118.897271][ C1] ================================================================== [ 118.897277][ C1] Disabling lock debugging due to kernel taint [ 118.897335][ C1] Kernel panic - not syncing: panic_on_warn set ... [ 118.930609][ T3876] kobject: 'loop2' (000000008153800f): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 118.932107][ C1] CPU: 1 PID: 7679 Comm: syz-execprog Tainted: G B 5.1.0-rc2+ #45 [ 118.932114][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 118.932118][ C1] Call Trace: [ 118.932123][ C1] [ 118.932142][ C1] dump_stack+0x172/0x1f0 [ 118.932163][ C1] panic+0x2cb/0x65c [ 118.941279][ T3876] kobject: 'loop1' (0000000040e75601): kobject_uevent_env [ 118.950857][ C1] ? __warn_printk+0xf3/0xf3 [ 118.950869][ C1] ? retint_kernel+0x2d/0x2d [ 118.950886][ C1] ? trace_hardirqs_on+0x5e/0x230 [ 118.950902][ C1] ? ccid_hc_tx_delete+0xde/0x100 [ 118.950920][ C1] end_report+0x47/0x4f [ 118.961274][ T3876] kobject: 'loop1' (0000000040e75601): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 118.965879][ C1] ? ccid_hc_tx_delete+0xde/0x100 [ 118.965891][ C1] kasan_report.cold+0xe/0x40 [ 118.965905][ C1] ? ccid_hc_tx_delete+0xde/0x100 [ 118.965924][ C1] __asan_report_load8_noabort+0x14/0x20 [ 118.968613][ T3876] kobject: 'loop2' (000000008153800f): kobject_uevent_env [ 118.973855][ C1] ccid_hc_tx_delete+0xde/0x100 [ 118.973868][ C1] dccp_sk_destruct+0x3f/0x90 [ 118.973879][ C1] ? dccp_init_sock+0x3f0/0x3f0 [ 118.973891][ C1] __sk_destruct+0x55/0x6d0 [ 118.973902][ C1] ? proto_unregister+0x4e0/0x4e0 [ 118.973916][ C1] rcu_core+0x928/0x1390 [ 118.973935][ C1] ? rcu_check_gp_start_stall+0x250/0x250 [ 119.006129][ T3876] kobject: 'loop2' (000000008153800f): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 119.012249][ C1] ? sched_clock+0x2e/0x50 [ 119.012269][ C1] __do_softirq+0x266/0x95a [ 119.012282][ C1] ? sched_clock_cpu+0x1b/0x1b0 [ 119.012303][ C1] irq_exit+0x180/0x1d0 [ 119.021086][ T3876] kobject: 'loop5' (000000006e17bd55): kobject_uevent_env [ 119.027447][ C1] smp_apic_timer_interrupt+0x14a/0x570 [ 119.027462][ C1] apic_timer_interrupt+0xf/0x20 [ 119.027474][ C1] [ 119.035618][ T3876] kobject: 'loop5' (000000006e17bd55): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 119.041655][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0x95/0xe0 [ 119.041669][ C1] Code: 48 c7 c0 f0 96 92 88 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 39 48 83 3d 42 0b 83 01 00 74 24 48 89 df 57 9d <0f> 1f 44 00 00 bf 01 00 00 00 e8 bc 34 3e fa 65 8b 05 c5 61 f2 78 [ 119.041676][ C1] RSP: 0018:ffff88808ed3f8a8 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13 [ 119.041687][ C1] RAX: 1ffffffff11252de RBX: 0000000000000282 RCX: 0000000000000000 [ 119.041702][ C1] RDX: dffffc0000000000 RSI: 0000000000000006 RDI: 0000000000000282 [ 119.053767][ T3876] kobject: 'loop0' (00000000a1cb38da): kobject_uevent_env [ 119.059090][ C1] RBP: ffff88808ed3f8b8 R08: ffff888091318640 R09: 0000000000000000 [ 119.059098][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880ae925d00 [ 119.059105][ C1] R13: ffff88808ed3fac0 R14: 0000000000025d00 R15: ffff8880ae925d80 [ 119.059128][ C1] hrtimer_start_range_ns+0x66b/0xc80 [ 119.068936][ T3876] kobject: 'loop0' (00000000a1cb38da): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 119.078260][ C1] ? __hrtimer_get_remaining+0x1a0/0x1a0 [ 119.078276][ C1] ? kasan_check_read+0x11/0x20 [ 119.078289][ C1] ? do_raw_spin_unlock+0x57/0x270 [ 119.078310][ C1] futex_wait_queue_me+0x262/0x600 [ 119.109564][ T3876] kobject: 'loop3' (00000000018eb106): kobject_uevent_env [ 119.113849][ C1] ? handle_futex_death.part.0+0x1f0/0x1f0 [ 119.113864][ C1] ? lock_pi_update_atomic+0x120/0x120 [ 119.113889][ C1] futex_wait+0x228/0x5e0 [ 119.200519][ T3876] kobject: 'loop3' (00000000018eb106): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 119.204423][ C1] ? futex_wait_setup+0x390/0x390 [ 119.204445][ C1] ? clock_was_set_work+0x30/0x30 [ 119.269680][ T3876] kobject: 'loop4' (000000001f624e65): kobject_uevent_env [ 119.278888][ C1] ? __might_fault+0x12b/0x1e0 [ 119.278913][ C1] do_futex+0x170/0x1df0 [ 119.278933][ C1] ? find_held_lock+0x35/0x130 [ 119.372598][ T3876] kobject: 'loop4' (000000001f624e65): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 119.377423][ C1] ? __might_fault+0x12b/0x1e0 [ 119.377443][ C1] ? exit_robust_list+0x2c0/0x2c0 [ 119.377456][ C1] ? __x64_sys_futex+0x4c2/0x590 [ 119.377473][ C1] ? ktime_get+0x105/0x300 [ 119.463984][ C1] ? __x64_sys_futex+0x4c2/0x590 [ 119.468924][ C1] ? ktime_get+0x105/0x300 [ 119.473346][ C1] ? lockdep_hardirqs_on+0x418/0x5d0 [ 119.478638][ C1] ? trace_hardirqs_on+0x67/0x230 [ 119.483671][ C1] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 119.489397][ C1] ? ktime_get+0x208/0x300 [ 119.493823][ C1] __x64_sys_futex+0x3f7/0x590 [ 119.498604][ C1] ? do_futex+0x1df0/0x1df0 [ 119.503107][ C1] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 119.508570][ C1] ? do_syscall_64+0x26/0x610 [ 119.513249][ C1] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 119.519314][ C1] ? do_syscall_64+0x26/0x610 [ 119.523243][ T3876] kobject: 'loop4' (000000001f624e65): kobject_uevent_env [ 119.523999][ C1] ? lockdep_hardirqs_on+0x418/0x5d0 [ 119.536359][ C1] ? trace_hardirqs_on+0x67/0x230 [ 119.541397][ C1] do_syscall_64+0x103/0x610 [ 119.541573][ T3876] kobject: 'loop4' (000000001f624e65): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 119.545988][ C1] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 119.545999][ C1] RIP: 0033:0x4592c3 [ 119.546013][ C1] Code: cc cc cc cc cc cc cc 48 8b 7c 24 08 8b 74 24 10 8b 54 24 14 4c 8b 54 24 18 4c 8b 44 24 20 44 8b 4c 24 28 b8 ca 00 00 00 0f 05 <89> 44 24 30 c3 cc cc cc cc cc cc cc cc 8b 7c 24 08 48 8b 74 24 10 [ 119.546020][ C1] RSP: 002b:000000c420037e80 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 119.546031][ C1] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004592c3 [ 119.546047][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000133e798 [ 119.609835][ C1] RBP: 000000c420037ec8 R08: 0000000000000000 R09: 0000000000000000 [ 119.617819][ C1] R10: 000000c420037eb8 R11: 0000000000000246 R12: 000000000042e590 [ 119.625798][ C1] R13: 00000000000000f1 R14: 0000000000000011 R15: 0000000000000000 [ 119.634454][ C1] Kernel Offset: disabled [ 119.638767][ C1] Rebooting in 86400 seconds..