[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.86' (ECDSA) to the list of known hosts. 2021/01/28 23:12:36 parsed 1 programs 2021/01/28 23:12:36 executed programs: 0 syzkaller login: [ 414.288555][ T8441] IPVS: ftp: loaded support on port[0] = 21 [ 414.490174][ T8441] chnl_net:caif_netlink_parms(): no params data found [ 414.574930][ T8441] bridge0: port 1(bridge_slave_0) entered blocking state [ 414.583224][ T8441] bridge0: port 1(bridge_slave_0) entered disabled state [ 414.592738][ T8441] device bridge_slave_0 entered promiscuous mode [ 414.603574][ T8441] bridge0: port 2(bridge_slave_1) entered blocking state [ 414.610817][ T8441] bridge0: port 2(bridge_slave_1) entered disabled state [ 414.619636][ T8441] device bridge_slave_1 entered promiscuous mode [ 414.642677][ T8441] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 414.654783][ T8441] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 414.679763][ T8441] team0: Port device team_slave_0 added [ 414.687945][ T8441] team0: Port device team_slave_1 added [ 414.707101][ T8441] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 414.714550][ T8441] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 414.740756][ T8441] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 414.754223][ T8441] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 414.761202][ T8441] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 414.788923][ T8441] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 414.817687][ T8441] device hsr_slave_0 entered promiscuous mode [ 414.824675][ T8441] device hsr_slave_1 entered promiscuous mode [ 414.943601][ T8441] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 414.957106][ T8441] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 414.969138][ T8441] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 414.980815][ T8441] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 415.010578][ T8441] bridge0: port 2(bridge_slave_1) entered blocking state [ 415.018227][ T8441] bridge0: port 2(bridge_slave_1) entered forwarding state [ 415.026331][ T8441] bridge0: port 1(bridge_slave_0) entered blocking state [ 415.033650][ T8441] bridge0: port 1(bridge_slave_0) entered forwarding state [ 415.087757][ T8441] 8021q: adding VLAN 0 to HW filter on device bond0 [ 415.103039][ T8504] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 415.116149][ T8504] bridge0: port 1(bridge_slave_0) entered disabled state [ 415.124625][ T8504] bridge0: port 2(bridge_slave_1) entered disabled state [ 415.133432][ T8504] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 415.148322][ T8441] 8021q: adding VLAN 0 to HW filter on device team0 [ 415.160812][ T8663] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 415.169523][ T8663] bridge0: port 1(bridge_slave_0) entered blocking state [ 415.176718][ T8663] bridge0: port 1(bridge_slave_0) entered forwarding state [ 415.202128][ T8663] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 415.210589][ T8663] bridge0: port 2(bridge_slave_1) entered blocking state [ 415.217730][ T8663] bridge0: port 2(bridge_slave_1) entered forwarding state [ 415.227149][ T8663] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 415.237443][ T8663] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 415.251243][ T8504] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 415.268751][ T8441] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 415.282759][ T8441] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 415.296186][ T8504] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 415.306427][ T8504] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 415.316728][ T8504] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 415.335567][ T8418] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 415.344231][ T8418] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 415.360474][ T8441] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 415.381413][ T8418] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 415.403810][ T8418] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 415.413437][ T8418] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 415.422004][ T8418] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 415.433937][ T8441] device veth0_vlan entered promiscuous mode [ 415.447996][ T8441] device veth1_vlan entered promiscuous mode [ 415.474220][ T8504] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 415.483444][ T8504] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 415.493727][ T8504] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 415.506364][ T8441] device veth0_macvtap entered promiscuous mode [ 415.517828][ T8441] device veth1_macvtap entered promiscuous mode [ 415.540664][ T8441] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 415.548736][ T8504] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 415.558861][ T8504] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 415.573805][ T8441] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 415.582412][ T4545] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 415.592844][ T4545] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 415.607577][ T8441] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 415.617499][ T8441] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 415.626920][ T8441] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 415.636854][ T8441] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 415.745051][ T3050] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 415.755554][ T3050] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 415.778394][ T8669] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 415.798263][ T3050] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 415.806737][ T3050] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 415.819811][ T8669] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 416.322739][ T8669] Bluetooth: hci0: command 0x0409 tx timeout 2021/01/28 23:12:41 executed programs: 26 [ 418.402423][ T8669] Bluetooth: hci0: command 0x041b tx timeout [ 420.481712][ T3146] Bluetooth: hci0: command 0x040f tx timeout [ 422.561110][ T3146] Bluetooth: hci0: command 0x0419 tx timeout 2021/01/28 23:12:46 executed programs: 81 2021/01/28 23:12:52 executed programs: 141 2021/01/28 23:12:57 executed programs: 197 [ 437.975843][T11465] ------------[ cut here ]------------ [ 437.990314][T11465] WARNING: CPU: 1 PID: 11465 at fs/io_uring.c:9042 io_uring_cancel_task_requests+0xe55/0x10c0 [ 438.001513][T11465] Modules linked in: [ 438.005463][T11465] CPU: 1 PID: 11465 Comm: syz-executor.0 Not tainted 5.11.0-rc5-next-20210128-syzkaller #0 [ 438.016743][T11465] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 438.028497][T11465] RIP: 0010:io_uring_cancel_task_requests+0xe55/0x10c0 [ 438.035994][T11465] Code: 00 00 e9 1c fe ff ff 48 8b 7c 24 18 e8 f4 b4 da ff e9 f2 fc ff ff 48 8b 7c 24 18 e8 e5 b4 da ff e9 64 f2 ff ff e8 eb 16 97 ff <0f> 0b e9 ed f2 ff ff e8 df b4 da ff e9 c8 f5 ff ff 4c 89 ef e8 52 [ 438.056554][T11465] RSP: 0018:ffffc9000351f950 EFLAGS: 00010293 [ 438.063382][T11465] RAX: 0000000000000000 RBX: ffff88801a122000 RCX: 0000000000000000 [ 438.072083][T11465] RDX: ffff888144ec5400 RSI: ffffffff81dbfe65 RDI: ffff88801a1220d0 [ 438.080811][T11465] RBP: ffff88801a1220e8 R08: 0000000000000000 R09: ffff888144ec5407 [ 438.089215][T11465] R10: ffffffff81dbf0df R11: 0000000000000000 R12: ffff88801a122000 [ 438.098121][T11465] R13: ffff888144ec5400 R14: 0000000000000000 R15: ffff88801bff6018 [ 438.106692][T11465] FS: 0000000000000000(0000) GS:ffff8880b9f00000(0000) knlGS:0000000000000000 [ 438.115837][T11465] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 438.122785][T11465] CR2: 00007fb452e3bdb8 CR3: 00000000134ab000 CR4: 00000000001506e0 [ 438.131374][T11465] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 438.139481][T11465] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 438.148083][T11465] Call Trace: [ 438.152302][T11465] ? io_ring_exit_work+0x6d0/0x6d0 [ 438.157437][T11465] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 438.163553][T11465] io_uring_flush+0x47b/0x6e0 [ 438.168276][T11465] ? io_uring_cancel_task_requests+0x10c0/0x10c0 [ 438.174712][T11465] filp_close+0xb4/0x170 [ 438.178986][T11465] put_files_struct+0x1cc/0x350 [ 438.184161][T11465] exit_files+0x7e/0xa0 [ 438.188347][T11465] do_exit+0xc22/0x2ae0 [ 438.192672][T11465] ? find_held_lock+0x2d/0x110 [ 438.197479][T11465] ? mm_update_next_owner+0x7a0/0x7a0 [ 438.203790][T11465] ? get_signal+0x332/0x20f0 [ 438.208589][T11465] ? lock_downgrade+0x6d0/0x6d0 [ 438.213628][T11465] do_group_exit+0x125/0x310 [ 438.218247][T11465] get_signal+0x427/0x20f0 [ 438.222789][T11465] ? __lock_acquire+0x16b3/0x54c0 [ 438.227862][T11465] arch_do_signal_or_restart+0x2a8/0x1eb0 [ 438.233731][T11465] ? copy_siginfo_to_user32+0xa0/0xa0 [ 438.239161][T11465] ? find_held_lock+0x2d/0x110 [ 438.244314][T11465] ? ret_from_fork+0x8/0x30 [ 438.249081][T11465] ? lock_downgrade+0x6d0/0x6d0 [ 438.254198][T11465] ? do_raw_spin_lock+0x120/0x2b0 [ 438.259261][T11465] exit_to_user_mode_prepare+0x148/0x250 [ 438.265036][T11465] syscall_exit_to_user_mode+0x19/0x50 [ 438.270632][T11465] ret_from_fork+0x15/0x30 [ 438.275065][T11465] RIP: 0033:0x460be9 [ 438.278977][T11465] Code: Unable to access opcode bytes at RIP 0x460bbf. [ 438.287154][T11465] RSP: 002b:00007fb452e3bdb0 EFLAGS: 00000202 ORIG_RAX: 0000000000000038 [ 438.295941][T11465] RAX: 0000000000000000 RBX: 00007fb452e3c700 RCX: 0000000000460be9 [ 438.304114][T11465] RDX: 00007fb452e3c9d0 RSI: 00007fb452e3bdb0 RDI: 00000000003d0f00 [ 438.313334][T11465] RBP: 00007ffe49bc6710 R08: 00007fb452e3c700 R09: 00007fb452e3c700 [ 438.321579][T11465] R10: 00007fb452e3c9d0 R11: 0000000000000202 R12: 0000000000000000 [ 438.329805][T11465] R13: 00007ffe49bc65af R14: 00007fb452e3c9c0 R15: 000000000119c034 [ 438.338115][T11465] Kernel panic - not syncing: panic_on_warn set ... [ 438.344832][T11465] CPU: 1 PID: 11465 Comm: syz-executor.0 Not tainted 5.11.0-rc5-next-20210128-syzkaller #0 [ 438.355021][T11465] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 438.365186][T11465] Call Trace: [ 438.368528][T11465] dump_stack+0x107/0x163 [ 438.372874][T11465] panic+0x306/0x73d [ 438.376770][T11465] ? __warn_printk+0xf3/0xf3 [ 438.381381][T11465] ? __warn.cold+0x1a/0x44 [ 438.385827][T11465] ? io_uring_cancel_task_requests+0xe55/0x10c0 [ 438.392172][T11465] __warn.cold+0x35/0x44 [ 438.396504][T11465] ? io_uring_cancel_task_requests+0xe55/0x10c0 [ 438.402764][T11465] report_bug+0x1bd/0x210 [ 438.407144][T11465] handle_bug+0x3c/0x60 [ 438.411334][T11465] exc_invalid_op+0x14/0x40 [ 438.415837][T11465] asm_exc_invalid_op+0x12/0x20 [ 438.420706][T11465] RIP: 0010:io_uring_cancel_task_requests+0xe55/0x10c0 [ 438.427572][T11465] Code: 00 00 e9 1c fe ff ff 48 8b 7c 24 18 e8 f4 b4 da ff e9 f2 fc ff ff 48 8b 7c 24 18 e8 e5 b4 da ff e9 64 f2 ff ff e8 eb 16 97 ff <0f> 0b e9 ed f2 ff ff e8 df b4 da ff e9 c8 f5 ff ff 4c 89 ef e8 52 [ 438.447183][T11465] RSP: 0018:ffffc9000351f950 EFLAGS: 00010293 [ 438.453432][T11465] RAX: 0000000000000000 RBX: ffff88801a122000 RCX: 0000000000000000 [ 438.461512][T11465] RDX: ffff888144ec5400 RSI: ffffffff81dbfe65 RDI: ffff88801a1220d0 [ 438.469496][T11465] RBP: ffff88801a1220e8 R08: 0000000000000000 R09: ffff888144ec5407 [ 438.477504][T11465] R10: ffffffff81dbf0df R11: 0000000000000000 R12: ffff88801a122000 [ 438.485629][T11465] R13: ffff888144ec5400 R14: 0000000000000000 R15: ffff88801bff6018 [ 438.493630][T11465] ? io_uring_cancel_task_requests+0xcf/0x10c0 [ 438.499807][T11465] ? io_uring_cancel_task_requests+0xe55/0x10c0 [ 438.506122][T11465] ? io_ring_exit_work+0x6d0/0x6d0 [ 438.511307][T11465] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 438.517383][T11465] io_uring_flush+0x47b/0x6e0 [ 438.522073][T11465] ? io_uring_cancel_task_requests+0x10c0/0x10c0 [ 438.528422][T11465] filp_close+0xb4/0x170 [ 438.532673][T11465] put_files_struct+0x1cc/0x350 [ 438.537531][T11465] exit_files+0x7e/0xa0 [ 438.541702][T11465] do_exit+0xc22/0x2ae0 [ 438.545911][T11465] ? find_held_lock+0x2d/0x110 [ 438.550689][T11465] ? mm_update_next_owner+0x7a0/0x7a0 [ 438.556073][T11465] ? get_signal+0x332/0x20f0 [ 438.560698][T11465] ? lock_downgrade+0x6d0/0x6d0 [ 438.565572][T11465] do_group_exit+0x125/0x310 [ 438.570181][T11465] get_signal+0x427/0x20f0 [ 438.574600][T11465] ? __lock_acquire+0x16b3/0x54c0 [ 438.579626][T11465] arch_do_signal_or_restart+0x2a8/0x1eb0 [ 438.585358][T11465] ? copy_siginfo_to_user32+0xa0/0xa0 [ 438.590741][T11465] ? find_held_lock+0x2d/0x110 [ 438.595510][T11465] ? ret_from_fork+0x8/0x30 [ 438.600126][T11465] ? lock_downgrade+0x6d0/0x6d0 [ 438.604974][T11465] ? do_raw_spin_lock+0x120/0x2b0 [ 438.610012][T11465] exit_to_user_mode_prepare+0x148/0x250 [ 438.615654][T11465] syscall_exit_to_user_mode+0x19/0x50 [ 438.621139][T11465] ret_from_fork+0x15/0x30 [ 438.625732][T11465] RIP: 0033:0x460be9 [ 438.629624][T11465] Code: Unable to access opcode bytes at RIP 0x460bbf. [ 438.636472][T11465] RSP: 002b:00007fb452e3bdb0 EFLAGS: 00000202 ORIG_RAX: 0000000000000038 [ 438.645181][T11465] RAX: 0000000000000000 RBX: 00007fb452e3c700 RCX: 0000000000460be9 [ 438.653349][T11465] RDX: 00007fb452e3c9d0 RSI: 00007fb452e3bdb0 RDI: 00000000003d0f00 [ 438.661498][T11465] RBP: 00007ffe49bc6710 R08: 00007fb452e3c700 R09: 00007fb452e3c700 [ 438.669839][T11465] R10: 00007fb452e3c9d0 R11: 0000000000000202 R12: 0000000000000000 [ 438.678041][T11465] R13: 00007ffe49bc65af R14: 00007fb452e3c9c0 R15: 000000000119c034 [ 438.687276][T11465] Kernel Offset: disabled [ 438.691765][T11465] Rebooting in 86400 seconds..