[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 80.920177][ T27] kauditd_printk_skb: 4 callbacks suppressed [ 80.920191][ T27] audit: type=1800 audit(1581650470.811:29): pid=10072 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 80.947517][ T27] audit: type=1800 audit(1581650470.811:30): pid=10072 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.234' (ECDSA) to the list of known hosts. syzkaller login: [ 101.941368][T10229] IPVS: ftp: loaded support on port[0] = 21 [ 102.001276][T10229] chnl_net:caif_netlink_parms(): no params data found [ 102.043600][T10229] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.051259][T10229] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.059342][T10229] device bridge_slave_0 entered promiscuous mode [ 102.068838][T10229] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.075998][T10229] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.084290][T10229] device bridge_slave_1 entered promiscuous mode [ 102.103853][T10229] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.114926][T10229] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.135872][T10229] team0: Port device team_slave_0 added [ 102.143492][T10229] team0: Port device team_slave_1 added [ 102.159067][T10229] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 102.166067][T10229] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 102.193375][T10229] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 102.205899][T10229] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 102.213339][T10229] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 102.240676][T10229] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 102.299242][T10229] device hsr_slave_0 entered promiscuous mode [ 102.357227][T10229] device hsr_slave_1 entered promiscuous mode [ 102.487659][T10229] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 102.539893][T10229] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 102.589834][T10229] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 102.639283][T10229] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 102.732927][T10229] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.740275][T10229] bridge0: port 2(bridge_slave_1) entered forwarding state [ 102.748608][T10229] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.756400][T10229] bridge0: port 1(bridge_slave_0) entered forwarding state [ 102.802851][T10229] 8021q: adding VLAN 0 to HW filter on device bond0 [ 102.819199][ T2823] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 102.829810][ T2823] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.838692][ T2823] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.848471][ T2823] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 102.862095][T10229] 8021q: adding VLAN 0 to HW filter on device team0 [ 102.873636][ T2813] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 102.882452][ T2813] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.889599][ T2813] bridge0: port 1(bridge_slave_0) entered forwarding state [ 102.901890][ T2823] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 102.911704][ T2823] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.918832][ T2823] bridge0: port 2(bridge_slave_1) entered forwarding state [ 102.937792][ T2813] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 102.957525][ T2813] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 102.966190][ T2813] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 102.974909][ T2813] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 102.983404][ T2813] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 103.007063][ T2823] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 103.014738][ T2823] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 103.030778][T10229] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 103.052823][ T2813] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 103.063651][ T2813] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 103.085701][ T2823] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 103.095398][ T2823] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 103.105138][ T2823] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 103.113517][ T2823] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 103.123137][T10229] device veth0_vlan entered promiscuous mode [ 103.136283][T10229] device veth1_vlan entered promiscuous mode [ 103.159006][ T2823] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 103.168083][ T2823] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 103.176457][ T2823] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 103.185322][ T2823] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 103.197777][T10229] device veth0_macvtap entered promiscuous mode [ 103.208254][T10229] device veth1_macvtap entered promiscuous mode [ 103.228809][T10229] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 103.236902][ T2823] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 103.244948][ T2823] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 103.253146][ T2823] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 103.262108][ T2823] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 103.274237][T10229] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 103.281989][ T2813] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 103.290852][ T2813] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready executing program [ 103.777180][ C1] ================================================================== [ 103.785547][ C1] BUG: KASAN: use-after-free in mld_in_v1_mode+0x203/0x230 [ 103.792737][ C1] Read of size 8 at addr ffff88809886c588 by task swapper/1/0 [ 103.800181][ C1] [ 103.802502][ C1] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.6.0-rc1-syzkaller #0 [ 103.810488][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 103.821239][ C1] Call Trace: [ 103.824524][ C1] [ 103.827399][ C1] dump_stack+0x197/0x210 [ 103.831846][ C1] ? mld_in_v1_mode+0x203/0x230 [ 103.836783][ C1] print_address_description.constprop.0.cold+0xd4/0x30b [ 103.843975][ C1] ? mld_in_v1_mode+0x203/0x230 [ 103.848975][ C1] ? mld_in_v1_mode+0x203/0x230 [ 103.853946][ C1] __kasan_report.cold+0x1b/0x32 [ 103.859011][ C1] ? mld_in_v1_mode+0x203/0x230 [ 103.863894][ C1] kasan_report+0x12/0x20 [ 103.868216][ C1] __asan_report_load8_noabort+0x14/0x20 [ 103.873846][ C1] mld_in_v1_mode+0x203/0x230 [ 103.878530][ C1] mld_dad_timer_expire+0x24/0x230 [ 103.883640][ C1] call_timer_fn+0x1ac/0x780 [ 103.888242][ C1] ? mld_send_initial_cr.part.0+0x160/0x160 [ 103.894170][ C1] ? msleep_interruptible+0x150/0x150 [ 103.899897][ C1] ? run_timer_softirq+0x6b1/0x1790 [ 103.905112][ C1] ? trace_hardirqs_on+0x67/0x240 [ 103.910152][ C1] ? mld_send_initial_cr.part.0+0x160/0x160 [ 103.916115][ C1] ? mld_send_initial_cr.part.0+0x160/0x160 [ 103.922546][ C1] run_timer_softirq+0x6c3/0x1790 [ 103.927579][ C1] ? add_timer+0x930/0x930 [ 103.931998][ C1] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 103.938160][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 103.943723][ C1] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 103.949738][ C1] ? trace_hardirqs_on+0x67/0x240 [ 103.954980][ C1] __do_softirq+0x262/0x98c [ 103.959663][ C1] ? sched_clock_cpu+0x1b/0x1b0 [ 103.964531][ C1] irq_exit+0x19b/0x1e0 [ 103.968952][ C1] smp_apic_timer_interrupt+0x1a3/0x610 [ 103.974596][ C1] apic_timer_interrupt+0xf/0x20 [ 103.979728][ C1] [ 103.982982][ C1] RIP: 0010:native_safe_halt+0xe/0x10 [ 103.988788][ C1] Code: 68 73 c5 f9 eb 8a cc cc cc cc cc cc e9 07 00 00 00 0f 00 2d 94 be 59 00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d 84 be 59 00 fb f4 cc 55 48 89 e5 41 57 41 56 41 55 41 54 53 e8 de 2a 74 f9 e8 09 [ 104.008852][ C1] RSP: 0018:ffffc90000d3fd68 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13 [ 104.018819][ C1] RAX: 1ffffffff136761a RBX: ffff8880a99fc340 RCX: 0000000000000000 [ 104.028256][ C1] RDX: dffffc0000000000 RSI: 0000000000000006 RDI: ffff8880a99fcbd4 [ 104.036914][ C1] RBP: ffffc90000d3fd98 R08: ffff8880a99fc340 R09: 0000000000000000 [ 104.045085][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000 [ 104.053149][ C1] R13: ffffffff8aa5a1c0 R14: 0000000000000000 R15: 0000000000000001 [ 104.061259][ C1] ? default_idle+0x4e/0x360 [ 104.066713][ C1] arch_cpu_idle+0xa/0x10 [ 104.071037][ C1] default_idle_call+0x84/0xb0 [ 104.075837][ C1] do_idle+0x3c8/0x6e0 [ 104.080022][ C1] ? arch_cpu_idle_exit+0x80/0x80 [ 104.085233][ C1] ? _raw_spin_unlock_irqrestore+0x9f/0xe0 [ 104.092326][ C1] ? complete+0x61/0x80 [ 104.096586][ C1] cpu_startup_entry+0x1b/0x20 [ 104.101375][ C1] start_secondary+0x2f4/0x410 [ 104.106152][ C1] ? set_cpu_sibling_map+0x2140/0x2140 [ 104.112297][ C1] secondary_startup_64+0xa4/0xb0 [ 104.118021][ C1] [ 104.120339][ C1] Allocated by task 10229: [ 104.125774][ C1] save_stack+0x23/0x90 [ 104.130370][ C1] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 104.136392][ C1] kasan_kmalloc+0x9/0x10 [ 104.140860][ C1] __kmalloc_node+0x4e/0x70 [ 104.145368][ C1] kvmalloc_node+0x68/0x100 [ 104.149893][ C1] alloc_netdev_mqs+0x98/0xe40 [ 104.154654][ C1] rtnl_create_link+0x22d/0xaf0 [ 104.159555][ C1] __rtnl_newlink+0xf9f/0x1790 [ 104.164318][ C1] rtnl_newlink+0x69/0xa0 [ 104.168657][ C1] rtnetlink_rcv_msg+0x45e/0xaf0 [ 104.174302][ C1] netlink_rcv_skb+0x177/0x450 [ 104.179285][ C1] rtnetlink_rcv+0x1d/0x30 [ 104.183870][ C1] netlink_unicast+0x59e/0x7e0 [ 104.188628][ C1] netlink_sendmsg+0x91c/0xea0 [ 104.193391][ C1] sock_sendmsg+0xd7/0x130 [ 104.197974][ C1] __sys_sendto+0x262/0x380 [ 104.202602][ C1] __ia32_compat_sys_socketcall+0x530/0x710 [ 104.208766][ C1] do_fast_syscall_32+0x27b/0xe16 [ 104.213916][ C1] entry_SYSENTER_compat+0x70/0x7f [ 104.219106][ C1] [ 104.221432][ C1] Freed by task 10229: [ 104.225598][ C1] save_stack+0x23/0x90 [ 104.230072][ C1] __kasan_slab_free+0x102/0x150 [ 104.235120][ C1] kasan_slab_free+0xe/0x10 [ 104.239789][ C1] kfree+0x10a/0x2c0 [ 104.243690][ C1] __netdev_name_node_alt_destroy+0x1ff/0x2a0 [ 104.249818][ C1] netdev_name_node_alt_destroy+0x57/0x80 [ 104.256631][ C1] rtnl_linkprop.isra.0+0x575/0x6f0 [ 104.262363][ C1] rtnl_dellinkprop+0x46/0x60 [ 104.267245][ C1] rtnetlink_rcv_msg+0x45e/0xaf0 [ 104.272313][ C1] netlink_rcv_skb+0x177/0x450 [ 104.277066][ C1] rtnetlink_rcv+0x1d/0x30 [ 104.281483][ C1] netlink_unicast+0x59e/0x7e0 [ 104.286290][ C1] netlink_sendmsg+0x91c/0xea0 [ 104.291282][ C1] sock_sendmsg+0xd7/0x130 [ 104.295808][ C1] ____sys_sendmsg+0x753/0x880 [ 104.300690][ C1] ___sys_sendmsg+0x100/0x170 [ 104.305364][ C1] __sys_sendmsg+0x105/0x1d0 [ 104.310045][ C1] __ia32_compat_sys_sendmsg+0x7a/0xb0 [ 104.315530][ C1] do_fast_syscall_32+0x27b/0xe16 [ 104.320651][ C1] entry_SYSENTER_compat+0x70/0x7f [ 104.325922][ C1] [ 104.328269][ C1] The buggy address belongs to the object at ffff88809886c000 [ 104.328269][ C1] which belongs to the cache kmalloc-4k of size 4096 [ 104.342496][ C1] The buggy address is located 1416 bytes inside of [ 104.342496][ C1] 4096-byte region [ffff88809886c000, ffff88809886d000) [ 104.356119][ C1] The buggy address belongs to the page: [ 104.361768][ C1] page:ffffea0002621b00 refcount:1 mapcount:0 mapping:ffff8880aa402000 index:0x0 compound_mapcount: 0 [ 104.372793][ C1] flags: 0xfffe0000010200(slab|head) [ 104.378074][ C1] raw: 00fffe0000010200 ffffea0002610d08 ffffea0002607608 ffff8880aa402000 [ 104.386983][ C1] raw: 0000000000000000 ffff88809886c000 0000000100000001 0000000000000000 [ 104.395566][ C1] page dumped because: kasan: bad access detected [ 104.402499][ C1] [ 104.404820][ C1] Memory state around the buggy address: [ 104.410434][ C1] ffff88809886c480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 104.419780][ C1] ffff88809886c500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 104.429395][ C1] >ffff88809886c580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 104.437755][ C1] ^ [ 104.442082][ C1] ffff88809886c600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 104.450380][ C1] ffff88809886c680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 104.458432][ C1] ================================================================== [ 104.466610][ C1] Disabling lock debugging due to kernel taint [ 104.473400][ C1] Kernel panic - not syncing: panic_on_warn set ... [ 104.480262][ C1] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G B 5.6.0-rc1-syzkaller #0 [ 104.489878][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 104.500424][ C1] Call Trace: [ 104.503964][ C1] [ 104.506979][ C1] dump_stack+0x197/0x210 [ 104.511356][ C1] panic+0x2e3/0x75c [ 104.515372][ C1] ? add_taint.cold+0x16/0x16 [ 104.521430][ C1] ? trace_hardirqs_on+0x5e/0x240 [ 104.527024][ C1] ? trace_hardirqs_on+0x5e/0x240 [ 104.533708][ C1] ? mld_in_v1_mode+0x203/0x230 [ 104.538945][ C1] end_report+0x47/0x4f [ 104.543091][ C1] ? mld_in_v1_mode+0x203/0x230 [ 104.548561][ C1] __kasan_report.cold+0xe/0x32 [ 104.553413][ C1] ? mld_in_v1_mode+0x203/0x230 [ 104.558370][ C1] kasan_report+0x12/0x20 [ 104.562755][ C1] __asan_report_load8_noabort+0x14/0x20 [ 104.569303][ C1] mld_in_v1_mode+0x203/0x230 [ 104.575936][ C1] mld_dad_timer_expire+0x24/0x230 [ 104.581188][ C1] call_timer_fn+0x1ac/0x780 [ 104.585865][ C1] ? mld_send_initial_cr.part.0+0x160/0x160 [ 104.591859][ C1] ? msleep_interruptible+0x150/0x150 [ 104.597315][ C1] ? run_timer_softirq+0x6b1/0x1790 [ 104.602952][ C1] ? trace_hardirqs_on+0x67/0x240 [ 104.607998][ C1] ? mld_send_initial_cr.part.0+0x160/0x160 [ 104.613897][ C1] ? mld_send_initial_cr.part.0+0x160/0x160 [ 104.619795][ C1] run_timer_softirq+0x6c3/0x1790 [ 104.624832][ C1] ? add_timer+0x930/0x930 [ 104.630642][ C1] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 104.636806][ C1] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 104.643671][ C1] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 104.649730][ C1] ? trace_hardirqs_on+0x67/0x240 [ 104.654805][ C1] __do_softirq+0x262/0x98c [ 104.659304][ C1] ? sched_clock_cpu+0x1b/0x1b0 [ 104.664160][ C1] irq_exit+0x19b/0x1e0 [ 104.668435][ C1] smp_apic_timer_interrupt+0x1a3/0x610 [ 104.673998][ C1] apic_timer_interrupt+0xf/0x20 [ 104.678927][ C1] [ 104.681863][ C1] RIP: 0010:native_safe_halt+0xe/0x10 [ 104.687248][ C1] Code: 68 73 c5 f9 eb 8a cc cc cc cc cc cc e9 07 00 00 00 0f 00 2d 94 be 59 00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d 84 be 59 00 fb f4 cc 55 48 89 e5 41 57 41 56 41 55 41 54 53 e8 de 2a 74 f9 e8 09 [ 104.707244][ C1] RSP: 0018:ffffc90000d3fd68 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13 [ 104.715652][ C1] RAX: 1ffffffff136761a RBX: ffff8880a99fc340 RCX: 0000000000000000 [ 104.723620][ C1] RDX: dffffc0000000000 RSI: 0000000000000006 RDI: ffff8880a99fcbd4 [ 104.731591][ C1] RBP: ffffc90000d3fd98 R08: ffff8880a99fc340 R09: 0000000000000000 [ 104.739836][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000 [ 104.747801][ C1] R13: ffffffff8aa5a1c0 R14: 0000000000000000 R15: 0000000000000001 [ 104.756309][ C1] ? default_idle+0x4e/0x360 [ 104.760989][ C1] arch_cpu_idle+0xa/0x10 [ 104.765592][ C1] default_idle_call+0x84/0xb0 [ 104.770706][ C1] do_idle+0x3c8/0x6e0 [ 104.774794][ C1] ? arch_cpu_idle_exit+0x80/0x80 [ 104.779819][ C1] ? _raw_spin_unlock_irqrestore+0x9f/0xe0 [ 104.786246][ C1] ? complete+0x61/0x80 [ 104.790475][ C1] cpu_startup_entry+0x1b/0x20 [ 104.795332][ C1] start_secondary+0x2f4/0x410 [ 104.800101][ C1] ? set_cpu_sibling_map+0x2140/0x2140 [ 104.805952][ C1] secondary_startup_64+0xa4/0xb0 [ 104.812570][ C1] Kernel Offset: disabled [ 104.816920][ C1] Rebooting in 86400 seconds..