[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [ 43.324256] audit: type=1800 audit(1578531636.709:33): pid=7697 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2465 res=0 Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 47.252516] kauditd_printk_skb: 1 callbacks suppressed [ 47.252533] audit: type=1400 audit(1578531640.629:35): avc: denied { map } for pid=7871 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.2' (ECDSA) to the list of known hosts. executing program [ 69.891075] audit: type=1400 audit(1578531663.269:36): avc: denied { map } for pid=7883 comm="syz-executor427" path="/root/syz-executor427932565" dev="sda1" ino=16483 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 69.937633] device bridge1 entered promiscuous mode [ 70.063538] device bridge0 entered promiscuous mode [ 70.234256] device bridge3 entered promiscuous mode [ 70.444292] device bridge2 entered promiscuous mode [ 70.933258] device bridge0 left promiscuous mode [ 71.223370] device bridge2 left promiscuous mode executing program [ 71.577342] device bridge5 entered promiscuous mode [ 71.803870] device bridge4 entered promiscuous mode [ 71.969454] device bridge7 entered promiscuous mode [ 72.313283] device bridge4 left promiscuous mode executing program [ 72.727451] device bridge9 entered promiscuous mode [ 72.964322] device bridge8 entered promiscuous mode [ 73.127839] device bridge11 entered promiscuous mode [ 73.786927] device bridge10 entered promiscuous mode [ 74.063066] device bridge8 left promiscuous mode [ 74.178872] device bridge10 left promiscuous mode executing program [ 74.573626] device bridge13 entered promiscuous mode [ 74.843770] device bridge12 entered promiscuous mode [ 75.040645] device bridge15 entered promiscuous mode [ 75.443625] device bridge14 entered promiscuous mode [ 75.875962] device bridge12 left promiscuous mode [ 75.977061] device bridge14 left promiscuous mode executing program [ 76.155853] device bridge17 entered promiscuous mode [ 76.294503] device bridge16 entered promiscuous mode [ 76.583317] device bridge16 left promiscuous mode [ 76.682818] device bridge19 entered promiscuous mode executing program [ 76.942362] device bridge21 entered promiscuous mode [ 77.235830] device bridge20 entered promiscuous mode [ 77.728074] device bridge23 entered promiscuous mode [ 78.193550] device bridge22 entered promiscuous mode [ 78.893376] device bridge20 left promiscuous mode [ 78.996045] device bridge22 left promiscuous mode executing program [ 79.196940] device bridge25 entered promiscuous mode [ 79.374257] device bridge24 entered promiscuous mode [ 79.622406] device bridge27 entered promiscuous mode [ 79.893576] device bridge26 entered promiscuous mode [ 80.402892] device bridge24 left promiscuous mode [ 80.500179] device bridge26 left promiscuous mode executing program [ 80.932535] device bridge29 entered promiscuous mode [ 81.103788] device bridge28 entered promiscuous mode [ 81.253725] device bridge31 entered promiscuous mode [ 81.404494] device bridge28 left promiscuous mode executing program [ 81.638038] device bridge33 entered promiscuous mode [ 81.986905] device bridge32 entered promiscuous mode [ 82.509715] kasan: CONFIG_KASAN_INLINE enabled [ 82.518779] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 82.620113] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 82.626403] CPU: 1 PID: 8747 Comm: syz-executor427 Not tainted 4.19.93-syzkaller #0 [ 82.634293] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 82.643670] RIP: 0010:hsr_check_carrier_and_operstate+0x42/0x6c0 [ 82.649855] Code: fa 4c 89 e7 be 04 00 00 00 e8 4a a4 ff ff 49 89 c4 48 83 c0 10 48 89 c2 48 89 45 d0 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 da 05 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b [ 82.668764] RSP: 0018:ffff88809f206bb8 EFLAGS: 00010202 [ 82.674163] RAX: dffffc0000000000 RBX: 0000000000000004 RCX: ffffffff874ae805 [ 82.681444] RDX: 0000000000000002 RSI: ffffffff874ae80f RDI: 0000000000000004 [ 82.688735] RBP: ffff88809f206bf8 R08: ffff88807e0bc600 R09: fffffbfff134206d [ 82.696030] R10: fffffbfff134206c R11: ffffffff89a10367 R12: 0000000000000000 [ 82.703310] R13: ffff88809ffa1d80 R14: dffffc0000000000 R15: 0000000000000000 [ 82.710680] FS: 00007f7255776700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 [ 82.718913] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 82.724804] CR2: 00007f89776a63e0 CR3: 000000008ec97000 CR4: 00000000001406e0 [ 82.732176] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 82.739455] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 82.746778] Call Trace: [ 82.749384] hsr_netdev_notify+0x12a/0xa40 [ 82.753642] notifier_call_chain+0xc2/0x230 [ 82.757992] raw_notifier_call_chain+0x2e/0x40 [ 82.762594] call_netdevice_notifiers_info+0x3f/0x90 [ 82.767719] netdev_state_change+0x10d/0x140 [ 82.772141] ? arch_local_irq_restore+0x60/0x60 [ 82.776826] ? dev_change_flags+0x106/0x150 [ 82.781160] do_setlink+0x2c78/0x3670 [ 82.784991] ? rtnl_getlink+0x6b0/0x6b0 [ 82.789015] ? br_changelink+0x141f/0x17a0 [ 82.793361] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 82.798568] ? br_fill_info+0x1390/0x1390 [ 82.802732] ? memset+0x32/0x40 [ 82.806470] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 82.812022] ? nla_parse+0x1fc/0x2f0 [ 82.815759] rtnl_newlink+0xbad/0x1600 [ 82.819665] ? rtnl_link_unregister+0x250/0x250 [ 82.824358] ? __lock_acquire+0x6ee/0x49c0 [ 82.828605] ? cpuacct_charge+0x1db/0x360 [ 82.832777] ? __update_load_avg_se+0x5ec/0xa10 [ 82.837551] ? __lock_is_held+0xb6/0x140 [ 82.841636] ? mark_held_locks+0x100/0x100 [ 82.845901] ? kasan_check_write+0x14/0x20 [ 82.850236] ? finish_task_switch+0x1db/0x7c0 [ 82.854773] ? switch_mm_irqs_off+0x7fa/0x1360 [ 82.859387] ? __mutex_lock+0xa67/0x1300 [ 82.863484] ? find_held_lock+0x35/0x130 [ 82.867592] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 82.873153] ? rtnl_link_unregister+0x250/0x250 [ 82.878013] rtnetlink_rcv_msg+0x463/0xb00 [ 82.882268] ? rtnetlink_put_metrics+0x560/0x560 [ 82.887048] ? netlink_deliver_tap+0x22d/0xc20 [ 82.891736] ? find_held_lock+0x35/0x130 [ 82.895815] netlink_rcv_skb+0x17d/0x460 [ 82.899890] ? rtnetlink_put_metrics+0x560/0x560 [ 82.904889] ? netlink_ack+0xb30/0xb30 [ 82.908789] ? kasan_check_read+0x11/0x20 [ 82.912963] ? netlink_deliver_tap+0x254/0xc20 [ 82.917589] rtnetlink_rcv+0x1d/0x30 [ 82.921324] netlink_unicast+0x53a/0x730 [ 82.925435] ? netlink_attachskb+0x770/0x770 [ 82.930488] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 82.936069] netlink_sendmsg+0x8ae/0xd70 [ 82.940153] ? netlink_unicast+0x730/0x730 [ 82.944406] ? selinux_socket_sendmsg+0x36/0x40 [ 82.949088] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 82.954645] ? security_socket_sendmsg+0x8d/0xc0 [ 82.959419] ? netlink_unicast+0x730/0x730 [ 82.963673] sock_sendmsg+0xd7/0x130 [ 82.967405] ___sys_sendmsg+0x803/0x920 [ 82.971404] ? copy_msghdr_from_user+0x430/0x430 [ 82.976288] ? lock_downgrade+0x880/0x880 [ 82.980457] ? kasan_check_read+0x11/0x20 [ 82.984630] ? __fget+0x367/0x540 [ 82.988098] ? iterate_fd+0x360/0x360 [ 82.991920] ? __fget_light+0x1a9/0x230 [ 82.995923] ? __fdget+0x1b/0x20 [ 82.999303] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 83.004981] __sys_sendmsg+0x105/0x1d0 [ 83.008879] ? __ia32_sys_shutdown+0x80/0x80 [ 83.013301] ? find_held_lock+0x35/0x130 [ 83.017377] ? calculate_sigpending+0x87/0xa0 [ 83.021994] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 83.026772] ? do_syscall_64+0x26/0x620 [ 83.030758] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 83.036225] ? do_syscall_64+0x26/0x620 [ 83.040823] __x64_sys_sendmsg+0x78/0xb0 [ 83.046730] do_syscall_64+0xfd/0x620 [ 83.050546] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 83.055742] RIP: 0033:0x446d89 [ 83.058945] Code: e8 5c b3 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 0b 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 83.077943] RSP: 002b:00007f7255775db8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 83.085664] RAX: ffffffffffffffda RBX: 00000000006dbc98 RCX: 0000000000446d89 [ 83.092947] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000009 [ 83.100225] RBP: 00000000006dbc90 R08: 0000000000000002 R09: 0000000000000000 [ 83.107505] R10: 0000000000000004 R11: 0000000000000246 R12: 00000000006dbc9c [ 83.114787] R13: 00007fff224794bf R14: 00007f72557769c0 R15: 20c49ba5e353f7cf [ 83.122091] Modules linked in: [ 83.372567] ---[ end trace 9c01e0bf656b717f ]--- [ 83.379263] RIP: 0010:hsr_check_carrier_and_operstate+0x42/0x6c0 [ 83.390284] Code: fa 4c 89 e7 be 04 00 00 00 e8 4a a4 ff ff 49 89 c4 48 83 c0 10 48 89 c2 48 89 45 d0 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 da 05 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b [ 83.410406] RSP: 0018:ffff88809f206bb8 EFLAGS: 00010202 [ 83.415849] RAX: dffffc0000000000 RBX: 0000000000000004 RCX: ffffffff874ae805 [ 83.423461] RDX: 0000000000000002 RSI: ffffffff874ae80f RDI: 0000000000000004 [ 83.430761] RBP: ffff88809f206bf8 R08: ffff88807e0bc600 R09: fffffbfff134206d [ 83.438168] R10: fffffbfff134206c R11: ffffffff89a10367 R12: 0000000000000000 [ 83.445545] R13: ffff88809ffa1d80 R14: dffffc0000000000 R15: 0000000000000000 [ 83.452939] FS: 00007f7255776700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 [ 83.461226] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 83.467315] CR2: 00007faa73d2d9b8 CR3: 000000008ec97000 CR4: 00000000001406e0 [ 83.474739] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 83.482036] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 83.489445] Kernel panic - not syncing: Fatal exception [ 83.496408] Kernel Offset: disabled [ 83.500046] Rebooting in 86400 seconds..