[ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.231' (ECDSA) to the list of known hosts. 2020/03/30 13:40:49 parsed 1 programs 2020/03/30 13:40:51 executed programs: 0 syzkaller login: [ 59.844542][ T7021] IPVS: ftp: loaded support on port[0] = 21 [ 59.931642][ T7021] chnl_net:caif_netlink_parms(): no params data found [ 59.982894][ T7021] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.990393][ T7021] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.998799][ T7021] device bridge_slave_0 entered promiscuous mode [ 60.007467][ T7021] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.015013][ T7021] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.024004][ T7021] device bridge_slave_1 entered promiscuous mode [ 60.044868][ T7021] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 60.055703][ T7021] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 60.079253][ T7021] team0: Port device team_slave_0 added [ 60.087551][ T7021] team0: Port device team_slave_1 added [ 60.106797][ T7021] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 60.113899][ T7021] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 60.140899][ T7021] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 60.153789][ T7021] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 60.160748][ T7021] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 60.186857][ T7021] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 60.265701][ T7021] device hsr_slave_0 entered promiscuous mode [ 60.322310][ T7021] device hsr_slave_1 entered promiscuous mode [ 60.449429][ T7021] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 60.494832][ T7021] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 60.524707][ T7021] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 60.564611][ T7021] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 60.648405][ T7021] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.655783][ T7021] bridge0: port 2(bridge_slave_1) entered forwarding state [ 60.663735][ T7021] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.670814][ T7021] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.717980][ T7021] 8021q: adding VLAN 0 to HW filter on device bond0 [ 60.733943][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 60.745488][ T17] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.754186][ T17] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.764251][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 60.777237][ T7021] 8021q: adding VLAN 0 to HW filter on device team0 [ 60.788086][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 60.797929][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.805236][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.822212][ T2855] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 60.830623][ T2855] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.837746][ T2855] bridge0: port 2(bridge_slave_1) entered forwarding state [ 60.853082][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 60.863697][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 60.883228][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 60.893966][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 60.902735][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 60.914702][ T7021] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 60.935676][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 60.943870][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 60.958673][ T7021] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 60.977404][ T2855] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 60.986800][ T2855] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 61.008778][ T7021] device veth0_vlan entered promiscuous mode [ 61.020487][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 61.029810][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 61.039559][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 61.048297][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 61.061141][ T7021] device veth1_vlan entered promiscuous mode [ 61.083328][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 61.092987][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 61.101138][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 61.110846][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 61.124242][ T7021] device veth0_macvtap entered promiscuous mode [ 61.134982][ T7021] device veth1_macvtap entered promiscuous mode [ 61.153990][ T7021] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 61.163596][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 61.173229][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 61.181369][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 61.190767][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 61.203648][ T7021] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 61.213062][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 61.223860][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 62.501101][ T7382] ================================================================== [ 62.509389][ T7382] BUG: KASAN: use-after-free in __list_add_valid+0x93/0xa0 [ 62.516702][ T7382] Read of size 8 at addr ffff8880a7d081e0 by task syz-executor.0/7382 [ 62.524849][ T7382] [ 62.527206][ T7382] CPU: 1 PID: 7382 Comm: syz-executor.0 Not tainted 5.6.0-syzkaller #0 [ 62.535442][ T7382] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 62.545522][ T7382] Call Trace: [ 62.548822][ T7382] dump_stack+0x188/0x20d [ 62.553161][ T7382] ? __list_add_valid+0x93/0xa0 [ 62.558018][ T7382] ? __list_add_valid+0x93/0xa0 [ 62.562885][ T7382] print_address_description.constprop.0.cold+0xd3/0x315 [ 62.569997][ T7382] ? __list_add_valid+0x93/0xa0 [ 62.574855][ T7382] ? __list_add_valid+0x93/0xa0 [ 62.579714][ T7382] __kasan_report.cold+0x1a/0x32 [ 62.584666][ T7382] ? __list_add_valid+0x93/0xa0 [ 62.589537][ T7382] kasan_report+0xe/0x20 [ 62.593799][ T7382] __list_add_valid+0x93/0xa0 [ 62.598484][ T7382] rdma_listen+0x681/0x910 [ 62.602897][ T7382] ucma_listen+0x14d/0x1c0 [ 62.607411][ T7382] ? ucma_notify+0x190/0x190 [ 62.612019][ T7382] ? __might_fault+0x190/0x1d0 [ 62.616804][ T7382] ? _copy_from_user+0x123/0x190 [ 62.621740][ T7382] ? ucma_notify+0x190/0x190 [ 62.626606][ T7382] ucma_write+0x285/0x350 [ 62.630928][ T7382] ? ucma_open+0x270/0x270 [ 62.635358][ T7382] ? security_file_permission+0x8a/0x370 [ 62.641341][ T7382] ? ucma_open+0x270/0x270 [ 62.645754][ T7382] __vfs_write+0x76/0x100 [ 62.650162][ T7382] vfs_write+0x262/0x5c0 [ 62.654416][ T7382] ksys_write+0x1e8/0x250 [ 62.658828][ T7382] ? __ia32_sys_read+0xb0/0xb0 [ 62.663649][ T7382] ? __ia32_sys_clock_settime+0x260/0x260 [ 62.669481][ T7382] ? trace_hardirqs_off_caller+0x55/0x230 [ 62.675206][ T7382] do_syscall_64+0xf6/0x7d0 [ 62.679708][ T7382] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 62.686448][ T7382] RIP: 0033:0x45c849 [ 62.690324][ T7382] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 62.711242][ T7382] RSP: 002b:00007f0a58914c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 62.719655][ T7382] RAX: ffffffffffffffda RBX: 00007f0a589156d4 RCX: 000000000045c849 [ 62.727636][ T7382] RDX: 0000000000000010 RSI: 00000000200001c0 RDI: 0000000000000003 [ 62.735605][ T7382] RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000 [ 62.743568][ T7382] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 62.751627][ T7382] R13: 0000000000000cc0 R14: 00000000004cee4e R15: 000000000076bf0c [ 62.759598][ T7382] [ 62.761968][ T7382] Allocated by task 7380: [ 62.766313][ T7382] save_stack+0x1b/0x80 [ 62.770471][ T7382] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 62.776093][ T7382] kmem_cache_alloc_trace+0x153/0x7d0 [ 62.781559][ T7382] __rdma_create_id+0x5b/0x850 [ 62.786306][ T7382] ucma_create_id+0x1cb/0x580 [ 62.790973][ T7382] ucma_write+0x285/0x350 [ 62.795298][ T7382] __vfs_write+0x76/0x100 [ 62.800053][ T7382] vfs_write+0x262/0x5c0 [ 62.804273][ T7382] ksys_write+0x1e8/0x250 [ 62.808696][ T7382] do_syscall_64+0xf6/0x7d0 [ 62.813184][ T7382] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 62.819054][ T7382] [ 62.821365][ T7382] Freed by task 7376: [ 62.825329][ T7382] save_stack+0x1b/0x80 [ 62.829465][ T7382] __kasan_slab_free+0xf7/0x140 [ 62.834307][ T7382] kfree+0x109/0x2b0 [ 62.838181][ T7382] ucma_close+0x10b/0x300 [ 62.842485][ T7382] __fput+0x2da/0x850 [ 62.846467][ T7382] task_work_run+0x13f/0x1b0 [ 62.851078][ T7382] exit_to_usermode_loop+0x2fa/0x360 [ 62.856361][ T7382] do_syscall_64+0x6b1/0x7d0 [ 62.861060][ T7382] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 62.866941][ T7382] [ 62.869259][ T7382] The buggy address belongs to the object at ffff8880a7d08000 [ 62.869259][ T7382] which belongs to the cache kmalloc-2k of size 2048 [ 62.883475][ T7382] The buggy address is located 480 bytes inside of [ 62.883475][ T7382] 2048-byte region [ffff8880a7d08000, ffff8880a7d08800) [ 62.897010][ T7382] The buggy address belongs to the page: [ 62.902979][ T7382] page:ffffea00029f4200 refcount:1 mapcount:0 mapping:ffff8880aa000e00 index:0x0 [ 62.912065][ T7382] flags: 0xfffe0000000200(slab) [ 62.916907][ T7382] raw: 00fffe0000000200 ffffea000292ef48 ffffea00029ecf48 ffff8880aa000e00 [ 62.925482][ T7382] raw: 0000000000000000 ffff8880a7d08000 0000000100000001 0000000000000000 [ 62.934063][ T7382] page dumped because: kasan: bad access detected [ 62.940470][ T7382] [ 62.942774][ T7382] Memory state around the buggy address: [ 62.948380][ T7382] ffff8880a7d08080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 62.956415][ T7382] ffff8880a7d08100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 62.965013][ T7382] >ffff8880a7d08180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 62.973046][ T7382] ^ [ 62.980224][ T7382] ffff8880a7d08200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 62.988264][ T7382] ffff8880a7d08280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 62.996311][ T7382] ================================================================== [ 63.004345][ T7382] Disabling lock debugging due to kernel taint [ 63.023474][ T7382] Kernel panic - not syncing: panic_on_warn set ... [ 63.030128][ T7382] CPU: 1 PID: 7382 Comm: syz-executor.0 Tainted: G B 5.6.0-syzkaller #0 [ 63.039747][ T7382] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 63.049800][ T7382] Call Trace: [ 63.053076][ T7382] dump_stack+0x188/0x20d [ 63.057386][ T7382] panic+0x2e3/0x75c [ 63.061304][ T7382] ? add_taint.cold+0x16/0x16 [ 63.066158][ T7382] ? preempt_schedule_common+0x5e/0xc0 [ 63.071607][ T7382] ? __list_add_valid+0x93/0xa0 [ 63.076466][ T7382] ? ___preempt_schedule+0x16/0x18 [ 63.081560][ T7382] ? trace_hardirqs_on+0x55/0x220 [ 63.086564][ T7382] ? __list_add_valid+0x93/0xa0 [ 63.091510][ T7382] end_report+0x43/0x49 [ 63.095670][ T7382] ? __list_add_valid+0x93/0xa0 [ 63.100515][ T7382] __kasan_report.cold+0xd/0x32 [ 63.105400][ T7382] ? __list_add_valid+0x93/0xa0 [ 63.110233][ T7382] kasan_report+0xe/0x20 [ 63.114467][ T7382] __list_add_valid+0x93/0xa0 [ 63.119152][ T7382] rdma_listen+0x681/0x910 [ 63.123575][ T7382] ucma_listen+0x14d/0x1c0 [ 63.127969][ T7382] ? ucma_notify+0x190/0x190 [ 63.132559][ T7382] ? __might_fault+0x190/0x1d0 [ 63.137303][ T7382] ? _copy_from_user+0x123/0x190 [ 63.142217][ T7382] ? ucma_notify+0x190/0x190 [ 63.146782][ T7382] ucma_write+0x285/0x350 [ 63.151097][ T7382] ? ucma_open+0x270/0x270 [ 63.155496][ T7382] ? security_file_permission+0x8a/0x370 [ 63.161132][ T7382] ? ucma_open+0x270/0x270 [ 63.165560][ T7382] __vfs_write+0x76/0x100 [ 63.169896][ T7382] vfs_write+0x262/0x5c0 [ 63.174123][ T7382] ksys_write+0x1e8/0x250 [ 63.178432][ T7382] ? __ia32_sys_read+0xb0/0xb0 [ 63.183182][ T7382] ? __ia32_sys_clock_settime+0x260/0x260 [ 63.188889][ T7382] ? trace_hardirqs_off_caller+0x55/0x230 [ 63.194604][ T7382] do_syscall_64+0xf6/0x7d0 [ 63.199094][ T7382] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 63.204961][ T7382] RIP: 0033:0x45c849 [ 63.208834][ T7382] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 63.228412][ T7382] RSP: 002b:00007f0a58914c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 63.236800][ T7382] RAX: ffffffffffffffda RBX: 00007f0a589156d4 RCX: 000000000045c849 [ 63.244758][ T7382] RDX: 0000000000000010 RSI: 00000000200001c0 RDI: 0000000000000003 [ 63.252762][ T7382] RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000 [ 63.260724][ T7382] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 63.268776][ T7382] R13: 0000000000000cc0 R14: 00000000004cee4e R15: 000000000076bf0c [ 63.278128][ T7382] Kernel Offset: disabled [ 63.282453][ T7382] Rebooting in 86400 seconds..