[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 54.616684][ T27] audit: type=1800 audit(1564288663.784:25): pid=8530 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 54.661059][ T27] audit: type=1800 audit(1564288663.784:26): pid=8530 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 54.693730][ T27] audit: type=1800 audit(1564288663.784:27): pid=8530 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.1.51' (ECDSA) to the list of known hosts. syzkaller login: [ 62.815004][ T8684] IPVS: ftp: loaded support on port[0] = 21 [ 62.870038][ T8684] chnl_net:caif_netlink_parms(): no params data found [ 62.898026][ T8684] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.905647][ T8684] bridge0: port 1(bridge_slave_0) entered disabled state [ 62.913648][ T8684] device bridge_slave_0 entered promiscuous mode [ 62.921709][ T8684] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.928779][ T8684] bridge0: port 2(bridge_slave_1) entered disabled state [ 62.936554][ T8684] device bridge_slave_1 entered promiscuous mode [ 62.952368][ T8684] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 62.962694][ T8684] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 62.980064][ T8684] team0: Port device team_slave_0 added [ 62.987432][ T8684] team0: Port device team_slave_1 added [ 63.053015][ T8684] device hsr_slave_0 entered promiscuous mode [ 63.101442][ T8684] device hsr_slave_1 entered promiscuous mode [ 63.148958][ T8684] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.156178][ T8684] bridge0: port 2(bridge_slave_1) entered forwarding state [ 63.163958][ T8684] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.171064][ T8684] bridge0: port 1(bridge_slave_0) entered forwarding state [ 63.206236][ T8684] 8021q: adding VLAN 0 to HW filter on device bond0 [ 63.217117][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 63.227291][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 63.235888][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 63.243920][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 63.256137][ T8684] 8021q: adding VLAN 0 to HW filter on device team0 [ 63.266088][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 63.274803][ T22] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.281897][ T22] bridge0: port 1(bridge_slave_0) entered forwarding state [ 63.302741][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 63.311253][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.318319][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 63.326633][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 63.335155][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 63.343633][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready executing program [ 63.353969][ T8686] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 63.362193][ T8686] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 63.374082][ T8684] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 63.393952][ T8684] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 63.430590][ T8684] Started in network mode [ 63.435606][ T8684] Own node identity ac14141, cluster identity 4711 [ 63.443454][ T8684] New replicast peer: 172.20.20.0 [ 63.448780][ T8684] check_preemption_disabled: 3 callbacks suppressed [ 63.448790][ T8684] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor034/8684 [ 63.465007][ T8684] caller is dst_cache_get+0x3d/0xb0 [ 63.470188][ T8684] CPU: 0 PID: 8684 Comm: syz-executor034 Not tainted 5.2.0+ #67 [ 63.477811][ T8684] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 63.487849][ T8684] Call Trace: [ 63.491128][ T8684] dump_stack+0x172/0x1f0 [ 63.495443][ T8684] debug_smp_processor_id.cold+0x87/0x9d [ 63.501060][ T8684] dst_cache_get+0x3d/0xb0 [ 63.505468][ T8684] tipc_udp_xmit.isra.0+0xc4/0xb80 [ 63.510565][ T8684] ? kasan_kmalloc+0x9/0x10 [ 63.515052][ T8684] ? tipc_udp_addr2str+0x170/0x170 [ 63.520142][ T8684] ? __copy_skb_header+0x2e8/0x550 [ 63.525230][ T8684] ? __skb_checksum_complete+0x3f0/0x3f0 [ 63.530843][ T8684] ? netdev_alloc_frag+0x1b0/0x1b0 [ 63.535935][ T8684] ? skb_copy_header+0x21/0x2b0 [ 63.540778][ T8684] ? __pskb_copy_fclone+0x516/0xc90 [ 63.545960][ T8684] tipc_udp_send_msg+0x29a/0x490 [ 63.550899][ T8684] tipc_bearer_xmit_skb+0x17e/0x370 [ 63.556180][ T8684] tipc_enable_bearer+0xacf/0xd30 [ 63.561188][ T8684] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 63.567066][ T8684] ? tipc_bearer_xmit_skb+0x370/0x370 [ 63.572420][ T8684] ? nla_memcpy+0xb0/0xb0 [ 63.576745][ T8684] __tipc_nl_bearer_enable+0x2de/0x3a0 [ 63.582182][ T8684] ? __tipc_nl_bearer_enable+0x2de/0x3a0 [ 63.587796][ T8684] ? tipc_nl_bearer_disable+0x40/0x40 [ 63.593154][ T8684] ? nla_memcpy+0xb0/0xb0 [ 63.597480][ T8684] ? lock_acquire+0x190/0x410 [ 63.602142][ T8684] tipc_nl_bearer_enable+0x23/0x40 [ 63.607231][ T8684] genl_family_rcv_msg+0x74b/0xf90 [ 63.612327][ T8684] ? genl_unregister_family+0x7b0/0x7b0 [ 63.617940][ T8684] ? __kasan_check_read+0x11/0x20 [ 63.622940][ T8684] ? __lock_acquire+0x1702/0x4c30 [ 63.627958][ T8684] ? __dev_queue_xmit+0xbb5/0x3650 [ 63.633063][ T8684] genl_rcv_msg+0xca/0x16c [ 63.637458][ T8684] netlink_rcv_skb+0x177/0x450 [ 63.642200][ T8684] ? genl_family_rcv_msg+0xf90/0xf90 [ 63.647464][ T8684] ? netlink_ack+0xb30/0xb30 [ 63.652033][ T8684] ? __kasan_check_write+0x14/0x20 [ 63.657126][ T8684] ? netlink_deliver_tap+0x254/0xbf0 [ 63.662398][ T8684] genl_rcv+0x29/0x40 [ 63.666364][ T8684] netlink_unicast+0x531/0x710 [ 63.671128][ T8684] ? netlink_attachskb+0x7c0/0x7c0 [ 63.676218][ T8684] ? _copy_from_iter_full+0x25d/0x8a0 [ 63.681588][ T8684] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 63.687304][ T8684] ? __check_object_size+0x3d/0x43c [ 63.692484][ T8684] netlink_sendmsg+0x8a5/0xd60 [ 63.697247][ T8684] ? netlink_unicast+0x710/0x710 [ 63.702165][ T8684] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 63.707702][ T8684] ? apparmor_socket_sendmsg+0x2a/0x30 [ 63.713140][ T8684] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 63.719369][ T8684] ? security_socket_sendmsg+0x8d/0xc0 [ 63.724816][ T8684] ? netlink_unicast+0x710/0x710 [ 63.729745][ T8684] sock_sendmsg+0xd7/0x130 [ 63.734244][ T8684] ___sys_sendmsg+0x803/0x920 [ 63.738916][ T8684] ? copy_msghdr_from_user+0x440/0x440 [ 63.744356][ T8684] ? lock_downgrade+0x920/0x920 [ 63.749187][ T8684] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 63.754972][ T8684] ? lockdep_hardirqs_on+0x418/0x5d0 [ 63.760246][ T8684] ? __kasan_check_read+0x11/0x20 [ 63.765271][ T8684] ? mark_lock+0xc0/0x11e0 [ 63.769664][ T8684] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 63.775451][ T8684] ? __kasan_check_read+0x11/0x20 [ 63.780452][ T8684] ? __lock_acquire+0x1702/0x4c30 [ 63.785455][ T8684] ? debug_object_deactivate+0x320/0x320 [ 63.791091][ T8684] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 63.797324][ T8684] ? __fget_light+0x1a9/0x230 [ 63.801980][ T8684] ? __fdget+0x1b/0x20 [ 63.806036][ T8684] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 63.812259][ T8684] __sys_sendmsg+0x105/0x1d0 [ 63.816840][ T8684] ? __sys_sendmsg_sock+0xd0/0xd0 [ 63.821855][ T8684] ? lockdep_hardirqs_on+0x418/0x5d0 [ 63.827126][ T8684] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 63.832823][ T8684] ? do_syscall_64+0x26/0x6a0 [ 63.837486][ T8684] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 63.843539][ T8684] ? do_syscall_64+0x26/0x6a0 [ 63.848198][ T8684] __x64_sys_sendmsg+0x78/0xb0 [ 63.852954][ T8684] do_syscall_64+0xfd/0x6a0 [ 63.857459][ T8684] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 63.863339][ T8684] RIP: 0033:0x4458d9 [ 63.867212][ T8684] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 9b d4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 63.886810][ T8684] RSP: 002b:00007ffd6f9ecbe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 63.895212][ T8684] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004458d9 [ 63.903162][ T8684] RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000003 [ 63.911126][ T8684] RBP: 00007ffd6f9ecc00 R08: 0000000000000000 R09: 0000000001bbbbbb [ 63.919421][ T8684] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 63.927384][ T8684] R13: 0000000000403290 R14: 0000000000000000 R15: 0000000000000000 [ 63.940309][ T8684] Enabled bearer , priority 10