INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.51' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 45.254204] FAULT_INJECTION: forcing a failure. [ 45.254204] name failslab, interval 1, probability 0, space 0, times 1 [ 45.265545] CPU: 1 PID: 4487 Comm: syzkaller832429 Not tainted 4.16.0+ #6 [ 45.272471] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 45.281820] Call Trace: [ 45.284413] dump_stack+0x1b9/0x294 [ 45.288054] ? dump_stack_print_info.cold.2+0x52/0x52 [ 45.293232] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 45.298256] should_fail.cold.4+0xa/0x1a [ 45.302322] ? __lock_is_held+0xb5/0x140 [ 45.306399] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 45.311523] ? graph_lock+0x170/0x170 [ 45.315328] ? rtnetlink_rcv_msg+0x466/0xc10 [ 45.319741] ? find_held_lock+0x36/0x1c0 [ 45.323810] ? __lock_is_held+0xb5/0x140 [ 45.328055] ? check_same_owner+0x320/0x320 [ 45.332380] ? rcu_note_context_switch+0x710/0x710 [ 45.337292] ? __lock_is_held+0xb5/0x140 [ 45.341338] __should_failslab+0x124/0x180 [ 45.345556] should_failslab+0x9/0x14 [ 45.349344] kmem_cache_alloc_trace+0x2cb/0x780 [ 45.353996] ? kmem_cache_alloc_trace+0x616/0x780 [ 45.358824] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 45.364004] ip6_convert_metrics.isra.67.part.68+0xa5/0x2d0 [ 45.369698] ? kasan_check_write+0x14/0x20 [ 45.373917] ? rt6_fill_node+0x1580/0x1580 [ 45.378142] ? validate_nla+0x7b0/0x7b0 [ 45.382098] ? debug_check_no_locks_freed+0x310/0x310 [ 45.387275] ip6_route_info_create+0x8a0/0x3240 [ 45.391930] ? memset+0x31/0x40 [ 45.395194] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 45.400722] ? ip6_nh_lookup_table.isra.75+0x480/0x480 [ 45.405994] ? graph_lock+0x170/0x170 [ 45.409781] ? find_held_lock+0x36/0x1c0 [ 45.413839] ip6_route_add+0x23/0xb0 [ 45.417540] inet6_rtm_newroute+0x142/0x160 [ 45.421869] ? ip6_route_multipath_add+0x1a90/0x1a90 [ 45.426966] ? __netlink_ns_capable+0x100/0x130 [ 45.431622] ? ip6_route_multipath_add+0x1a90/0x1a90 [ 45.436714] rtnetlink_rcv_msg+0x466/0xc10 [ 45.440947] ? rtnetlink_put_metrics+0x690/0x690 [ 45.445695] netlink_rcv_skb+0x172/0x440 [ 45.449738] ? rtnetlink_put_metrics+0x690/0x690 [ 45.454480] ? netlink_ack+0xbc0/0xbc0 [ 45.458352] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 45.463532] ? netlink_skb_destructor+0x210/0x210 [ 45.468372] rtnetlink_rcv+0x1c/0x20 [ 45.472068] netlink_unicast+0x58b/0x740 [ 45.476151] ? netlink_attachskb+0x970/0x970 [ 45.480554] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 45.486071] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 45.491080] ? security_netlink_send+0x88/0xb0 [ 45.495660] netlink_sendmsg+0x9f0/0xfa0 [ 45.499709] ? netlink_unicast+0x740/0x740 [ 45.503930] ? security_socket_sendmsg+0x94/0xc0 [ 45.508666] ? netlink_unicast+0x740/0x740 [ 45.512891] sock_sendmsg+0xd5/0x120 [ 45.516613] ___sys_sendmsg+0x805/0x940 [ 45.520575] ? kasan_check_read+0x11/0x20 [ 45.524709] ? rcu_is_watching+0x85/0x140 [ 45.528839] ? copy_msghdr_from_user+0x560/0x560 [ 45.533587] ? save_stack+0xa9/0xd0 [ 45.537194] ? graph_lock+0x170/0x170 [ 45.540987] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 45.546513] ? proc_fail_nth_write+0x96/0x1f0 [ 45.550990] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 45.556509] ? __fget_light+0x2ef/0x430 [ 45.560467] ? fget_raw+0x20/0x20 [ 45.563901] ? find_held_lock+0x36/0x1c0 [ 45.567956] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 45.573478] ? sockfd_lookup_light+0xc5/0x160 [ 45.577959] __sys_sendmsg+0x115/0x270 [ 45.581829] ? SyS_shutdown+0x30/0x30 [ 45.585612] ? __sb_end_write+0xac/0xe0 [ 45.589568] ? vfs_write+0x2a8/0x560 [ 45.593277] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 45.598795] ? ksys_write+0x1a6/0x250 [ 45.602592] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 45.607416] SyS_sendmsg+0x29/0x30 [ 45.610949] ? __sys_sendmsg+0x270/0x270 [ 45.614994] do_syscall_64+0x29e/0x9d0 [ 45.618871] ? vmalloc_sync_all+0x30/0x30 [ 45.623008] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 45.627855] ? syscall_return_slowpath+0x5c0/0x5c0 [ 45.632769] ? syscall_return_slowpath+0x30f/0x5c0 [ 45.637686] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 45.643053] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 45.647884] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 45.653067] RIP: 0033:0x440529 [ 45.656240] RSP: 002b:00007ffde55a8e18 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 45.663932] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000440529 [ 45.671185] RDX: 0000000000000000 RSI: 0000000020002fc8 RDI: 0000000000000003 [ 45.678438] RBP: 00000000006cb018 R08: 0000000000000001 R09: 00007ffde55a0034 [ 45.685704] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 45.692960] R13: ffffffffffffffff R14: 0000000000000000 R15: 0000000000000000 [ 45.700870] ================================================================== [ 45.708289] BUG: KASAN: null-ptr-deref in refcount_sub_and_test+0x92/0x330 [ 45.715285] Read of size 4 at addr 0000000000000044 by task syzkaller832429/4487 [ 45.722794] [ 45.724407] CPU: 1 PID: 4487 Comm: syzkaller832429 Not tainted 4.16.0+ #6 [ 45.731309] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 45.740651] Call Trace: [ 45.743229] dump_stack+0x1b9/0x294 [ 45.746851] ? dump_stack_print_info.cold.2+0x52/0x52 [ 45.752037] ? kasan_check_write+0x14/0x20 [ 45.756253] ? do_raw_spin_lock+0xc1/0x200 [ 45.760474] ? vprintk_func+0x81/0xe7 [ 45.764261] ? refcount_sub_and_test+0x92/0x330 [ 45.768915] kasan_report.cold.7+0x6d/0x2fe [ 45.773220] check_memory_region+0x13e/0x1b0 [ 45.777612] kasan_check_read+0x11/0x20 [ 45.781571] refcount_sub_and_test+0x92/0x330 [ 45.786046] ? rcu_read_lock_sched_held+0x108/0x120 [ 45.791056] ? refcount_inc_not_zero+0x2d0/0x2d0 [ 45.795801] ? kmem_cache_alloc_trace+0x616/0x780 [ 45.800637] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 45.805813] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 45.810813] ? find_next_bit+0x104/0x130 [ 45.814860] refcount_dec_and_test+0x1a/0x20 [ 45.819262] fib6_info_destroy+0x2d0/0x3c0 [ 45.823482] ip6_route_info_create+0x677/0x3240 [ 45.828140] ? memset+0x31/0x40 [ 45.831402] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 45.836927] ? ip6_nh_lookup_table.isra.75+0x480/0x480 [ 45.842195] ? graph_lock+0x170/0x170 [ 45.845979] ? find_held_lock+0x36/0x1c0 [ 45.850026] ip6_route_add+0x23/0xb0 [ 45.853724] inet6_rtm_newroute+0x142/0x160 [ 45.858028] ? ip6_route_multipath_add+0x1a90/0x1a90 [ 45.863119] ? __netlink_ns_capable+0x100/0x130 [ 45.867782] ? ip6_route_multipath_add+0x1a90/0x1a90 [ 45.872876] rtnetlink_rcv_msg+0x466/0xc10 [ 45.877104] ? rtnetlink_put_metrics+0x690/0x690 [ 45.881849] netlink_rcv_skb+0x172/0x440 [ 45.885896] ? rtnetlink_put_metrics+0x690/0x690 [ 45.890643] ? netlink_ack+0xbc0/0xbc0 [ 45.894514] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 45.899689] ? netlink_skb_destructor+0x210/0x210 [ 45.904519] rtnetlink_rcv+0x1c/0x20 [ 45.908216] netlink_unicast+0x58b/0x740 [ 45.912260] ? netlink_attachskb+0x970/0x970 [ 45.916650] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 45.922168] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 45.927166] ? security_netlink_send+0x88/0xb0 [ 45.931731] netlink_sendmsg+0x9f0/0xfa0 [ 45.935778] ? netlink_unicast+0x740/0x740 [ 45.939998] ? security_socket_sendmsg+0x94/0xc0 [ 45.944738] ? netlink_unicast+0x740/0x740 [ 45.948958] sock_sendmsg+0xd5/0x120 [ 45.952657] ___sys_sendmsg+0x805/0x940 [ 45.956613] ? kasan_check_read+0x11/0x20 [ 45.960746] ? rcu_is_watching+0x85/0x140 [ 45.964879] ? copy_msghdr_from_user+0x560/0x560 [ 45.969619] ? save_stack+0xa9/0xd0 [ 45.973228] ? graph_lock+0x170/0x170 [ 45.977014] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 45.982546] ? proc_fail_nth_write+0x96/0x1f0 [ 45.987032] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 45.992563] ? __fget_light+0x2ef/0x430 [ 45.997009] ? fget_raw+0x20/0x20 [ 46.000449] ? find_held_lock+0x36/0x1c0 [ 46.004503] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 46.010021] ? sockfd_lookup_light+0xc5/0x160 [ 46.014501] __sys_sendmsg+0x115/0x270 [ 46.018371] ? SyS_shutdown+0x30/0x30 [ 46.022160] ? __sb_end_write+0xac/0xe0 [ 46.026117] ? vfs_write+0x2a8/0x560 [ 46.029826] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 46.035347] ? ksys_write+0x1a6/0x250 [ 46.039138] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 46.043973] SyS_sendmsg+0x29/0x30 [ 46.047497] ? __sys_sendmsg+0x270/0x270 [ 46.051551] do_syscall_64+0x29e/0x9d0 [ 46.055433] ? vmalloc_sync_all+0x30/0x30 [ 46.059578] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 46.064422] ? syscall_return_slowpath+0x5c0/0x5c0 [ 46.069358] ? syscall_return_slowpath+0x30f/0x5c0 [ 46.074290] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 46.079735] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 46.084566] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 46.089741] RIP: 0033:0x440529 [ 46.092913] RSP: 002b:00007ffde55a8e18 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 46.100604] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000440529 [ 46.107853] RDX: 0000000000000000 RSI: 0000000020002fc8 RDI: 0000000000000003 [ 46.115104] RBP: 00000000006cb018 R08: 0000000000000001 R09: 00007ffde55a0034 [ 46.122355] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 46.129607] R13: ffffffffffffffff R14: 0000000000000000 R15: 0000000000000000 [ 46.136865] ================================================================== [ 46.144197] Disabling lock debugging due to kernel taint [ 46.149820] Kernel panic - not syncing: panic_on_warn set ... [ 46.149820] [ 46.157191] CPU: 1 PID: 4487 Comm: syzkaller832429 Tainted: G B 4.16.0+ #6 [ 46.165486] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 46.174820] Call Trace: [ 46.177394] dump_stack+0x1b9/0x294 [ 46.181003] ? dump_stack_print_info.cold.2+0x52/0x52 [ 46.186177] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 46.190917] ? refcount_inc_not_zero+0x280/0x2d0 [ 46.195651] panic+0x22f/0x4de [ 46.198824] ? add_taint.cold.5+0x16/0x16 [ 46.202954] ? do_raw_spin_unlock+0x9e/0x2e0 [ 46.207343] ? do_raw_spin_unlock+0x9e/0x2e0 [ 46.211734] ? refcount_sub_and_test+0x92/0x330 [ 46.216388] kasan_end_report+0x47/0x4f [ 46.220345] kasan_report.cold.7+0x76/0x2fe [ 46.224650] check_memory_region+0x13e/0x1b0 [ 46.229038] kasan_check_read+0x11/0x20 [ 46.233001] refcount_sub_and_test+0x92/0x330 [ 46.237476] ? rcu_read_lock_sched_held+0x108/0x120 [ 46.242487] ? refcount_inc_not_zero+0x2d0/0x2d0 [ 46.247225] ? kmem_cache_alloc_trace+0x616/0x780 [ 46.252064] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 46.257236] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 46.262233] ? find_next_bit+0x104/0x130 [ 46.266275] refcount_dec_and_test+0x1a/0x20 [ 46.270668] fib6_info_destroy+0x2d0/0x3c0 [ 46.274883] ip6_route_info_create+0x677/0x3240 [ 46.279531] ? memset+0x31/0x40 [ 46.282792] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 46.288409] ? ip6_nh_lookup_table.isra.75+0x480/0x480 [ 46.293672] ? graph_lock+0x170/0x170 [ 46.297453] ? find_held_lock+0x36/0x1c0 [ 46.301496] ip6_route_add+0x23/0xb0 [ 46.305191] inet6_rtm_newroute+0x142/0x160 [ 46.309495] ? ip6_route_multipath_add+0x1a90/0x1a90 [ 46.314599] ? __netlink_ns_capable+0x100/0x130 [ 46.319259] ? ip6_route_multipath_add+0x1a90/0x1a90 [ 46.324346] rtnetlink_rcv_msg+0x466/0xc10 [ 46.328575] ? rtnetlink_put_metrics+0x690/0x690 [ 46.333315] netlink_rcv_skb+0x172/0x440 [ 46.337356] ? rtnetlink_put_metrics+0x690/0x690 [ 46.342102] ? netlink_ack+0xbc0/0xbc0 [ 46.345970] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 46.351139] ? netlink_skb_destructor+0x210/0x210 [ 46.355969] rtnetlink_rcv+0x1c/0x20 [ 46.359664] netlink_unicast+0x58b/0x740 [ 46.363707] ? netlink_attachskb+0x970/0x970 [ 46.368096] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 46.373616] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 46.378614] ? security_netlink_send+0x88/0xb0 [ 46.383175] netlink_sendmsg+0x9f0/0xfa0 [ 46.387218] ? netlink_unicast+0x740/0x740 [ 46.391446] ? security_socket_sendmsg+0x94/0xc0 [ 46.396195] ? netlink_unicast+0x740/0x740 [ 46.400414] sock_sendmsg+0xd5/0x120 [ 46.404109] ___sys_sendmsg+0x805/0x940 [ 46.408067] ? kasan_check_read+0x11/0x20 [ 46.412194] ? rcu_is_watching+0x85/0x140 [ 46.416322] ? copy_msghdr_from_user+0x560/0x560 [ 46.421057] ? save_stack+0xa9/0xd0 [ 46.424666] ? graph_lock+0x170/0x170 [ 46.428462] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 46.433984] ? proc_fail_nth_write+0x96/0x1f0 [ 46.438465] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 46.444000] ? __fget_light+0x2ef/0x430 [ 46.447967] ? fget_raw+0x20/0x20 [ 46.451399] ? find_held_lock+0x36/0x1c0 [ 46.455450] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 46.460970] ? sockfd_lookup_light+0xc5/0x160 [ 46.465449] __sys_sendmsg+0x115/0x270 [ 46.469331] ? SyS_shutdown+0x30/0x30 [ 46.473112] ? __sb_end_write+0xac/0xe0 [ 46.477071] ? vfs_write+0x2a8/0x560 [ 46.480769] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 46.486300] ? ksys_write+0x1a6/0x250 [ 46.490086] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 46.494912] SyS_sendmsg+0x29/0x30 [ 46.498435] ? __sys_sendmsg+0x270/0x270 [ 46.502486] do_syscall_64+0x29e/0x9d0 [ 46.506356] ? vmalloc_sync_all+0x30/0x30 [ 46.510504] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 46.515329] ? syscall_return_slowpath+0x5c0/0x5c0 [ 46.520241] ? syscall_return_slowpath+0x30f/0x5c0 [ 46.525154] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 46.530501] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 46.535328] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 46.540514] RIP: 0033:0x440529 [ 46.543685] RSP: 002b:00007ffde55a8e18 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 46.551375] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000440529 [ 46.558627] RDX: 0000000000000000 RSI: 0000000020002fc8 RDI: 0000000000000003 [ 46.565892] RBP: 00000000006cb018 R08: 0000000000000001 R09: 00007ffde55a0034 [ 46.573227] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 46.580477] R13: ffffffffffffffff R14: 0000000000000000 R15: 0000000000000000 [ 46.588267] Dumping ftrace buffer: [ 46.591788] (ftrace buffer empty) [ 46.595489] Kernel Offset: disabled [ 46.599095] Rebooting in 86400 seconds..