Warning: Permanently added '10.128.0.75' (ECDSA) to the list of known hosts. syzkaller login: [ 65.348842][ T7156] IPVS: ftp: loaded support on port[0] = 21 [ 65.453977][ T7156] chnl_net:caif_netlink_parms(): no params data found [ 65.510785][ T7156] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.518556][ T7156] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.526938][ T7156] device bridge_slave_0 entered promiscuous mode [ 65.536736][ T7156] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.543927][ T7156] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.552716][ T7156] device bridge_slave_1 entered promiscuous mode [ 65.573444][ T7156] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.584500][ T7156] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.607342][ T7156] team0: Port device team_slave_0 added [ 65.614978][ T7156] team0: Port device team_slave_1 added [ 65.632432][ T7156] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 65.639435][ T7156] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.666791][ T7156] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 65.680538][ T7156] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 65.687677][ T7156] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.713641][ T7156] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 65.778650][ T7156] device hsr_slave_0 entered promiscuous mode [ 65.825072][ T7156] device hsr_slave_1 entered promiscuous mode [ 65.992634][ T7156] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 66.029486][ T7156] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 66.087139][ T7156] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 66.137775][ T7156] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 66.221890][ T7156] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.230114][ T7156] bridge0: port 2(bridge_slave_1) entered forwarding state [ 66.238560][ T7156] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.245768][ T7156] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.296891][ T7156] 8021q: adding VLAN 0 to HW filter on device bond0 [ 66.310909][ T2711] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 66.322024][ T2711] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.330879][ T2711] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.339633][ T2711] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 66.353510][ T7156] 8021q: adding VLAN 0 to HW filter on device team0 [ 66.365568][ T3267] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 66.376903][ T3267] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.384953][ T3267] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.405255][ T2793] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 66.415595][ T2793] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.423270][ T2793] bridge0: port 2(bridge_slave_1) entered forwarding state [ 66.438897][ T3267] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 66.449742][ T3267] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 66.469739][ T7156] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 66.480955][ T7156] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 66.497682][ T3270] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 66.506310][ T3270] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 66.517248][ T3270] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 66.527718][ T3270] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 66.537013][ T3270] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 66.546803][ T3270] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 66.555636][ T3270] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 66.573535][ T3270] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 66.587328][ T2793] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 66.596782][ T2793] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 66.611210][ T7156] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 66.632648][ T2793] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 66.642775][ T2793] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 66.666324][ T2711] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 66.675558][ T2711] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 66.684051][ T2711] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 66.692654][ T2711] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 66.702070][ T7156] device veth0_vlan entered promiscuous mode [ 66.715100][ T7156] device veth1_vlan entered promiscuous mode [ 66.738894][ T3270] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 66.747395][ T3270] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 66.757385][ T3270] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 66.767083][ T3270] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 66.779747][ T7156] device veth0_macvtap entered promiscuous mode [ 66.789871][ T7156] device veth1_macvtap entered promiscuous mode [ 66.808415][ T7156] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 66.816027][ T2711] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 66.824227][ T2711] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 66.832821][ T2711] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 66.842453][ T2711] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 66.856837][ T7156] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 66.864280][ T3270] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 66.874770][ T3270] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready executing program [ 67.052164][ T27] audit: type=1800 audit(1589518191.093:2): pid=7365 uid=0 auid=0 ses=5 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor758" name="file0" dev="sda1" ino=15715 res=0 [ 67.080739][ T7365] MINIX-fs: mounting unchecked file system, running fsck is recommended [ 67.097353][ T7365] Process accounting resumed [ 67.155394][ T7156] ================================================================== [ 67.163709][ T7156] BUG: KASAN: use-after-free in get_block+0x1202/0x1380 [ 67.170645][ T7156] Write of size 2 at addr ffff88808aced7b8 by task syz-executor758/7156 [ 67.178959][ T7156] [ 67.181323][ T7156] CPU: 1 PID: 7156 Comm: syz-executor758 Not tainted 5.7.0-rc1-next-20200415-syzkaller #0 [ 67.191207][ T7156] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 67.201711][ T7156] Call Trace: [ 67.205053][ T7156] dump_stack+0x188/0x20d [ 67.209409][ T7156] print_address_description.constprop.0.cold+0xd3/0x315 [ 67.216527][ T7156] ? get_block+0x1202/0x1380 [ 67.221129][ T7156] __kasan_report.cold+0x35/0x4d [ 67.226511][ T7156] ? get_block+0x1202/0x1380 [ 67.231119][ T7156] ? get_block+0x1202/0x1380 [ 67.235708][ T7156] kasan_report+0x33/0x50 [ 67.240045][ T7156] get_block+0x1202/0x1380 [ 67.244483][ T7156] ? block_to_path.isra.0+0x300/0x300 [ 67.249875][ T7156] ? lock_downgrade+0x840/0x840 [ 67.254739][ T7156] minix_get_block+0xe5/0x110 [ 67.259592][ T7156] __block_write_begin_int+0x490/0x1b00 [ 67.265137][ T7156] ? minix_rename+0x8c0/0x8c0 [ 67.269808][ T7156] ? remove_inode_buffers+0x1c0/0x1c0 [ 67.275175][ T7156] ? pagecache_get_page+0x204/0xa10 [ 67.280361][ T7156] ? wait_for_stable_page+0x11c/0x1e0 [ 67.285720][ T7156] ? minix_rename+0x8c0/0x8c0 [ 67.290377][ T7156] block_write_begin+0x58/0x2e0 [ 67.295217][ T7156] minix_write_begin+0x35/0xe0 [ 67.299968][ T7156] generic_perform_write+0x20a/0x4e0 [ 67.305338][ T7156] ? trace_event_raw_event_file_check_and_advance_wb_err+0x4a0/0x4a0 [ 67.313590][ T7156] ? update_time+0xc0/0xc0 [ 67.319320][ T7156] ? down_write+0xdb/0x150 [ 67.323839][ T7156] __generic_file_write_iter+0x24c/0x610 [ 67.329593][ T7156] generic_file_write_iter+0x3f3/0x630 [ 67.335139][ T7156] ? __generic_file_write_iter+0x610/0x610 [ 67.345350][ T7156] new_sync_write+0x4a2/0x700 [ 67.350111][ T7156] ? new_sync_read+0x7a0/0x7a0 [ 67.354978][ T7156] __vfs_write+0xc9/0x100 [ 67.359415][ T7156] __kernel_write+0x11c/0x3a0 [ 67.364647][ T7156] do_acct_process+0xcdc/0x10e0 [ 67.369503][ T7156] ? acct_on+0x770/0x770 [ 67.374540][ T7156] ? pin_kill+0x12e/0x7c0 [ 67.379338][ T7156] ? do_raw_spin_lock+0x129/0x2e0 [ 67.384522][ T7156] ? rwlock_bug.part.0+0x90/0x90 [ 67.389648][ T7156] acct_pin_kill+0x29/0xf0 [ 67.394068][ T7156] pin_kill+0x175/0x7c0 [ 67.398206][ T7156] ? pin_insert+0x260/0x260 [ 67.402808][ T7156] ? lock_release+0x800/0x800 [ 67.407577][ T7156] ? finish_wait+0x260/0x260 [ 67.412420][ T7156] ? mnt_pin_kill+0x6c/0x1c0 [ 67.417024][ T7156] mnt_pin_kill+0x6c/0x1c0 [ 67.421445][ T7156] cleanup_mnt+0x3c4/0x4b0 [ 67.425859][ T7156] task_work_run+0xf4/0x1b0 [ 67.430369][ T7156] do_exit+0xb53/0x2e10 [ 67.434517][ T7156] ? mm_update_next_owner+0x7a0/0x7a0 [ 67.439870][ T7156] ? up_read+0x1a8/0x750 [ 67.445320][ T7156] ? down_read_nested+0x430/0x430 [ 67.450358][ T7156] ? handle_mm_fault+0x29e/0x660 [ 67.455393][ T7156] do_group_exit+0x125/0x340 [ 67.460363][ T7156] __x64_sys_exit_group+0x3a/0x50 [ 67.466254][ T7156] do_syscall_64+0xf6/0x7d0 [ 67.470925][ T7156] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 67.476800][ T7156] RIP: 0033:0x44dc08 [ 67.480718][ T7156] Code: Bad RIP value. [ 67.484938][ T7156] RSP: 002b:00007ffceb09f7d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 67.497285][ T7156] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 000000000044dc08 [ 67.505373][ T7156] RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001 [ 67.513335][ T7156] RBP: 00000000004d3070 R08: 00000000000000e7 R09: ffffffffffffffd4 [ 67.521304][ T7156] R10: 0000000000000005 R11: 0000000000000246 R12: 0000000000000001 [ 67.529278][ T7156] R13: 00000000006ed9a0 R14: 0000000000000000 R15: 0000000000000000 [ 67.537262][ T7156] [ 67.539578][ T7156] The buggy address belongs to the page: [ 67.545204][ T7156] page:ffffea00022b3b40 refcount:0 mapcount:0 mapping:0000000081a7ee88 index:0x1 [ 67.554295][ T7156] flags: 0xfffe0000000000() [ 67.558788][ T7156] raw: 00fffe0000000000 ffffea000226a888 ffffea0002306f88 0000000000000000 [ 67.567373][ T7156] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 67.575937][ T7156] page dumped because: kasan: bad access detected [ 67.582350][ T7156] [ 67.584665][ T7156] Memory state around the buggy address: [ 67.590286][ T7156] ffff88808aced680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 67.598371][ T7156] ffff88808aced700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 67.606458][ T7156] >ffff88808aced780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 67.614503][ T7156] ^ [ 67.620397][ T7156] ffff88808aced800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 67.628463][ T7156] ffff88808aced880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 67.636528][ T7156] ================================================================== [ 67.644575][ T7156] Disabling lock debugging due to kernel taint [ 67.657547][ T7156] Kernel panic - not syncing: panic_on_warn set ... [ 67.664266][ T7156] CPU: 1 PID: 7156 Comm: syz-executor758 Tainted: G B 5.7.0-rc1-next-20200415-syzkaller #0 [ 67.675535][ T7156] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 67.685649][ T7156] Call Trace: [ 67.689157][ T7156] dump_stack+0x188/0x20d [ 67.693593][ T7156] panic+0x2e3/0x75c [ 67.697484][ T7156] ? add_taint.cold+0x16/0x16 [ 67.702174][ T7156] ? preempt_schedule_common+0x5e/0xc0 [ 67.707635][ T7156] ? get_block+0x1202/0x1380 [ 67.712327][ T7156] ? preempt_schedule_thunk+0x16/0x18 [ 67.718214][ T7156] ? trace_hardirqs_on+0x55/0x220 [ 67.723224][ T7156] ? get_block+0x1202/0x1380 [ 67.727932][ T7156] end_report+0x4d/0x53 [ 67.732525][ T7156] __kasan_report.cold+0xd/0x4d [ 67.737390][ T7156] ? get_block+0x1202/0x1380 [ 67.741979][ T7156] ? get_block+0x1202/0x1380 [ 67.746556][ T7156] kasan_report+0x33/0x50 [ 67.751188][ T7156] get_block+0x1202/0x1380 [ 67.755663][ T7156] ? block_to_path.isra.0+0x300/0x300 [ 67.761317][ T7156] ? lock_downgrade+0x840/0x840 [ 67.766171][ T7156] minix_get_block+0xe5/0x110 [ 67.770847][ T7156] __block_write_begin_int+0x490/0x1b00 [ 67.776380][ T7156] ? minix_rename+0x8c0/0x8c0 [ 67.781043][ T7156] ? remove_inode_buffers+0x1c0/0x1c0 [ 67.786424][ T7156] ? pagecache_get_page+0x204/0xa10 [ 67.791622][ T7156] ? wait_for_stable_page+0x11c/0x1e0 [ 67.796984][ T7156] ? minix_rename+0x8c0/0x8c0 [ 67.801656][ T7156] block_write_begin+0x58/0x2e0 [ 67.806491][ T7156] minix_write_begin+0x35/0xe0 [ 67.811246][ T7156] generic_perform_write+0x20a/0x4e0 [ 67.816889][ T7156] ? trace_event_raw_event_file_check_and_advance_wb_err+0x4a0/0x4a0 [ 67.825044][ T7156] ? update_time+0xc0/0xc0 [ 67.829446][ T7156] ? down_write+0xdb/0x150 [ 67.833843][ T7156] __generic_file_write_iter+0x24c/0x610 [ 67.839476][ T7156] generic_file_write_iter+0x3f3/0x630 [ 67.844955][ T7156] ? __generic_file_write_iter+0x610/0x610 [ 67.850762][ T7156] new_sync_write+0x4a2/0x700 [ 67.855448][ T7156] ? new_sync_read+0x7a0/0x7a0 [ 67.860215][ T7156] __vfs_write+0xc9/0x100 [ 67.865041][ T7156] __kernel_write+0x11c/0x3a0 [ 67.869717][ T7156] do_acct_process+0xcdc/0x10e0 [ 67.874569][ T7156] ? acct_on+0x770/0x770 [ 67.878791][ T7156] ? pin_kill+0x12e/0x7c0 [ 67.883171][ T7156] ? do_raw_spin_lock+0x129/0x2e0 [ 67.888450][ T7156] ? rwlock_bug.part.0+0x90/0x90 [ 67.893374][ T7156] acct_pin_kill+0x29/0xf0 [ 67.897903][ T7156] pin_kill+0x175/0x7c0 [ 67.902169][ T7156] ? pin_insert+0x260/0x260 [ 67.906656][ T7156] ? lock_release+0x800/0x800 [ 67.911725][ T7156] ? finish_wait+0x260/0x260 [ 67.916345][ T7156] ? mnt_pin_kill+0x6c/0x1c0 [ 67.920912][ T7156] mnt_pin_kill+0x6c/0x1c0 [ 67.925317][ T7156] cleanup_mnt+0x3c4/0x4b0 [ 67.929725][ T7156] task_work_run+0xf4/0x1b0 [ 67.934213][ T7156] do_exit+0xb53/0x2e10 [ 67.938603][ T7156] ? mm_update_next_owner+0x7a0/0x7a0 [ 67.944105][ T7156] ? up_read+0x1a8/0x750 [ 67.948385][ T7156] ? down_read_nested+0x430/0x430 [ 67.953413][ T7156] ? handle_mm_fault+0x29e/0x660 [ 67.958745][ T7156] do_group_exit+0x125/0x340 [ 67.963348][ T7156] __x64_sys_exit_group+0x3a/0x50 [ 67.968356][ T7156] do_syscall_64+0xf6/0x7d0 [ 67.972841][ T7156] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 67.978711][ T7156] RIP: 0033:0x44dc08 [ 67.982602][ T7156] Code: Bad RIP value. [ 67.986654][ T7156] RSP: 002b:00007ffceb09f7d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 67.995059][ T7156] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 000000000044dc08 [ 68.003877][ T7156] RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001 [ 68.011828][ T7156] RBP: 00000000004d3070 R08: 00000000000000e7 R09: ffffffffffffffd4 [ 68.019776][ T7156] R10: 0000000000000005 R11: 0000000000000246 R12: 0000000000000001 [ 68.027750][ T7156] R13: 00000000006ed9a0 R14: 0000000000000000 R15: 0000000000000000 [ 68.037349][ T7156] Kernel Offset: disabled [ 68.041683][ T7156] Rebooting in 86400 seconds..