[ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.188' (ECDSA) to the list of known hosts. 2020/05/23 12:40:38 parsed 1 programs 2020/05/23 12:40:39 executed programs: 0 syzkaller login: [ 67.220239][ T7060] IPVS: ftp: loaded support on port[0] = 21 [ 67.322450][ T7060] chnl_net:caif_netlink_parms(): no params data found [ 67.378418][ T7060] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.386718][ T7060] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.394987][ T7060] device bridge_slave_0 entered promiscuous mode [ 67.404562][ T7060] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.412476][ T7060] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.420630][ T7060] device bridge_slave_1 entered promiscuous mode [ 67.441077][ T7060] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 67.452600][ T7060] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 67.477362][ T7060] team0: Port device team_slave_0 added [ 67.485639][ T7060] team0: Port device team_slave_1 added [ 67.502781][ T7060] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 67.510006][ T7060] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.536451][ T7060] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.548838][ T7060] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.555987][ T7060] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.582172][ T7060] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.638382][ T7060] device hsr_slave_0 entered promiscuous mode [ 67.686478][ T7060] device hsr_slave_1 entered promiscuous mode [ 67.816393][ T7060] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 67.860032][ T7060] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 67.908215][ T7060] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 67.968063][ T7060] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 68.033121][ T7060] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.040526][ T7060] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.049042][ T7060] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.056307][ T7060] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.106241][ T7060] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.120801][ T3176] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 68.133545][ T3176] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.143302][ T3176] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.153684][ T3176] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 68.171119][ T7060] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.183043][ T2799] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 68.193288][ T2799] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.200508][ T2799] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.215751][ T3176] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 68.224407][ T3176] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.232547][ T3176] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.248913][ T2769] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 68.259642][ T2769] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 68.272463][ T3176] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 68.290733][ T7060] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 68.302987][ T7060] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 68.317111][ T2769] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 68.326743][ T2769] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 68.337250][ T2769] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 68.355301][ T3176] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 68.362798][ T3176] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 68.379679][ T7060] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 68.400181][ T2769] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 68.410113][ T2769] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 68.431472][ T7060] device veth0_vlan entered promiscuous mode [ 68.439530][ T2769] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 68.448702][ T2769] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 68.459015][ T2769] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 68.470021][ T2769] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 68.483035][ T7060] device veth1_vlan entered promiscuous mode [ 68.504853][ T3176] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 68.515792][ T3176] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 68.524010][ T3176] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 68.533512][ T3176] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 68.544679][ T7060] device veth0_macvtap entered promiscuous mode [ 68.557306][ T7060] device veth1_macvtap entered promiscuous mode [ 68.575667][ T7060] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 68.583429][ T3176] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 68.593357][ T3176] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 68.603235][ T3176] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 68.614030][ T3176] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 68.627788][ T7060] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 68.635851][ T2769] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 68.644605][ T2769] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 68.887583][ T7269] ------------[ cut here ]------------ [ 68.893185][ T7269] WARNING: CPU: 1 PID: 7269 at drivers/android/binder.c:2348 binder_transaction_buffer_release+0x601/0x8a0 [ 68.904543][ T7269] Kernel panic - not syncing: panic_on_warn set ... [ 68.911240][ T7269] CPU: 1 PID: 7269 Comm: syz-executor.0 Not tainted 5.7.0-rc6-syzkaller #0 [ 68.919900][ T7269] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 68.929965][ T7269] Call Trace: [ 68.933498][ T7269] dump_stack+0x188/0x20d [ 68.937850][ T7269] ? binder_transaction_buffer_release+0x510/0x8a0 [ 68.944349][ T7269] panic+0x2e3/0x75c [ 68.948235][ T7269] ? add_taint.cold+0x16/0x16 [ 68.953029][ T7269] ? printk+0xba/0xed [ 68.957028][ T7269] ? kmsg_dump_rewind_nolock+0xd9/0xd9 [ 68.962492][ T7269] ? __warn.cold+0x14/0x35 [ 68.967019][ T7269] ? __warn+0xd5/0x1c8 [ 68.971090][ T7269] ? binder_transaction_buffer_release+0x601/0x8a0 [ 68.977660][ T7269] __warn.cold+0x2f/0x35 [ 68.982121][ T7269] ? binder_transaction_buffer_release+0x601/0x8a0 [ 68.988616][ T7269] report_bug+0x27b/0x2f0 [ 68.993016][ T7269] do_error_trap+0x12b/0x220 [ 68.997637][ T7269] ? binder_transaction_buffer_release+0x601/0x8a0 [ 69.004162][ T7269] do_invalid_op+0x32/0x40 [ 69.008566][ T7269] ? binder_transaction_buffer_release+0x601/0x8a0 [ 69.015150][ T7269] invalid_op+0x23/0x30 [ 69.019395][ T7269] RIP: 0010:binder_transaction_buffer_release+0x601/0x8a0 [ 69.026486][ T7269] Code: bb fd 31 ff 41 89 c5 89 c6 e8 bb ff 81 fb 45 85 ed 0f 85 f9 4b 01 00 48 8d 45 40 48 89 44 24 28 e9 fa fa ff ff e8 2f fe 81 fb <0f> 0b e9 87 fc ff ff e8 23 fe 81 fb 4c 8b 44 24 20 48 89 d8 45 31 [ 69.046211][ T7269] RSP: 0018:ffffc9000217f608 EFLAGS: 00010293 [ 69.052294][ T7269] RAX: ffff8880a8c2a400 RBX: 0000000000000058 RCX: 1ffff11015185523 [ 69.060249][ T7269] RDX: 0000000000000000 RSI: ffffffff85f136f1 RDI: ffff888098292848 [ 69.068214][ T7269] RBP: ffff8880a8bc8700 R08: ffff8880a8c2a400 R09: fffff5200042fee4 [ 69.076303][ T7269] R10: ffffc9000217f71f R11: fffff5200042fee3 R12: ffff888094ee23c0 [ 69.084277][ T7269] R13: 0000000000000060 R14: ffff888098292800 R15: 0000000000000060 [ 69.092292][ T7269] ? binder_transaction_buffer_release+0x601/0x8a0 [ 69.098823][ T7269] ? binder_transaction_buffer_release+0x601/0x8a0 [ 69.105424][ T7269] ? binder_update_ref_for_handle+0x490/0x490 [ 69.111621][ T7269] ? binder_translate_fd.isra.0+0x175/0x7b0 [ 69.117619][ T7269] ? trace_hardirqs_off+0x50/0x220 [ 69.122980][ T7269] ? trace_hardirqs_off+0x50/0x220 [ 69.129776][ T7269] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 69.135318][ T7269] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 69.142078][ T7269] ? binder_free_txn_fixups+0x15a/0x230 [ 69.147619][ T7269] binder_transaction+0x146d/0x6500 [ 69.152850][ T7269] ? mark_held_locks+0xe0/0xe0 [ 69.157659][ T7269] ? binder_deferred_func+0xfc0/0xfc0 [ 69.163054][ T7269] ? stack_trace_save+0x8c/0xc0 [ 69.168155][ T7269] ? find_held_lock+0x2d/0x110 [ 69.173519][ T7269] ? __might_fault+0x11f/0x1d0 [ 69.178424][ T7269] ? lock_downgrade+0x840/0x840 [ 69.183484][ T7269] ? __might_fault+0x190/0x1d0 [ 69.188261][ T7269] binder_thread_write+0x818/0x2560 [ 69.193478][ T7269] ? binder_transaction+0x6500/0x6500 [ 69.198848][ T7269] ? __might_fault+0x11f/0x1d0 [ 69.203604][ T7269] ? lock_downgrade+0x840/0x840 [ 69.208585][ T7269] ? do_raw_spin_lock+0x129/0x2e0 [ 69.213668][ T7269] ? binder_thread_read+0x3bd0/0x3bd0 [ 69.219040][ T7269] ? __might_fault+0x190/0x1d0 [ 69.223798][ T7269] binder_ioctl+0x1008/0x1862 [ 69.228472][ T7269] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 69.234971][ T7269] ? binder_thread_read+0x3bd0/0x3bd0 [ 69.240342][ T7269] ? do_vfs_ioctl+0x50c/0x1360 [ 69.245112][ T7269] ? ioctl_file_clone+0x180/0x180 [ 69.250154][ T7269] ? __fget_files+0x32f/0x500 [ 69.254861][ T7269] ? binder_thread_read+0x3bd0/0x3bd0 [ 69.260773][ T7269] compat_ptr_ioctl+0x67/0x90 [ 69.265450][ T7269] ? fiemap_check_flags+0x70/0x70 [ 69.270748][ T7269] __ia32_compat_sys_ioctl+0x23d/0x2b0 [ 69.276205][ T7269] do_fast_syscall_32+0x270/0xe90 [ 69.281257][ T7269] entry_SYSENTER_compat+0x70/0x7f [ 69.287824][ T7269] Kernel Offset: disabled [ 69.292236][ T7269] Rebooting in 86400 seconds..