[ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.71' (ECDSA) to the list of known hosts. 2020/10/21 09:52:57 fuzzer started 2020/10/21 09:52:57 dialing manager at 10.128.0.105:43077 2020/10/21 09:52:59 syscalls: 3450 2020/10/21 09:52:59 code coverage: enabled 2020/10/21 09:52:59 comparison tracing: enabled 2020/10/21 09:52:59 extra coverage: enabled 2020/10/21 09:52:59 setuid sandbox: enabled 2020/10/21 09:52:59 namespace sandbox: enabled 2020/10/21 09:52:59 Android sandbox: /sys/fs/selinux/policy does not exist 2020/10/21 09:52:59 fault injection: enabled 2020/10/21 09:52:59 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2020/10/21 09:52:59 net packet injection: enabled 2020/10/21 09:52:59 net device setup: enabled 2020/10/21 09:52:59 concurrency sanitizer: enabled 2020/10/21 09:52:59 devlink PCI setup: PCI device 0000:00:10.0 is not available 2020/10/21 09:52:59 USB emulation: enabled 2020/10/21 09:52:59 hci packet injection: enabled 2020/10/21 09:52:59 wifi device emulation: enabled 2020/10/21 09:53:02 suppressing KCSAN reports in functions: 'do_select' 'dd_has_work' 'ext4_writepages' 'generic_write_end' 'do_sys_poll' 'blk_mq_dispatch_rq_list' 'do_nanosleep' 'wg_packet_send_staged_packets' 'xas_clear_mark' 'ext4_free_inodes_count' 'ext4_free_inode' 'blk_mq_rq_ctx_init' 'ext4_mb_find_by_goal' '__xa_clear_mark' 'wbt_done' 'kauditd_thread' 'do_signal_stop' '__ext4_new_inode' 'exit_mm' 'filemap_map_pages' 'blk_mq_sched_dispatch_requests' 09:53:22 executing program 0: socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) close(r0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000340)={0x0, 0x0}) write(r1, &(0x7f0000000000)='a', 0x1) close(r1) recvmmsg(r0, &(0x7f0000000640)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000000c0)=""/179, 0xb3}], 0x1}}], 0x1, 0x0, 0x0) 09:53:22 executing program 1: r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) close(r0) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qrtr-tun\x00', 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002040)='/dev/fuse\x00', 0x42, 0x0) mount$9p_fd(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) 09:53:22 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) listen(r0, 0xc) r1 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @loopback=0x7f000002}, 0x10) getsockopt$inet_int(r1, 0x10d, 0xa0, &(0x7f0000000080), &(0x7f00000000c0)=0x4) 09:53:22 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@can_newroute={0x14c, 0x18, 0x1, 0x0, 0x0, {}, [@CGW_MOD_SET={0x15, 0x4, {{{}, 0x0, 0x0, 0x0, 0x0, "67ded15274a8323b"}, 0x1}}, @CGW_CS_CRC8={0x11e, 0x6, {0x37, 0x0, 0x0, 0x0, 0x0, "d9180d3734209a81efca4782040dd6461b187db3d84609c60f9ccf039c651a35b18a8ad6b844ce2faf947b5a40144d3f11d8e6660162377119ba69f1b14ddbad6a1ad6a66cdf0d19b3f388e08d1f0096f0dd8d770eca6fb27cda0460505e2cd5f4382960865faa2c4d4798cdc027fdfcfafd3d5fb06d151291544d3ca522e21bd03de785cf90d23176d005c239be44198454c87a1b75b32320260166490622b8ed8eee40746e3094601dd870eaf2e818083f3b64582a9c5b1eaac6d49a58dc4531aa112cb2d316cd92026fae783022f96b5a13c324edb63fc0a87c4dfab94c10e75ecee6e25405f78c830deb59b7360c93103c5c4610830fa202655e0a23d1b5", 0x0, "565f17f09f2ff286b5f99ffd26a4a15345fa1c21"}}]}, 0x14c}}, 0x0) 09:53:22 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000000)=0x3, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x2, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1a55a97b6a240008d5a6671a000000000000ff7fff"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000004e00)=[{{0x0, 0x0, 0x0}}], 0x300, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = fcntl$dupfd(r3, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) 09:53:22 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='bbr\x00', 0x4) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window, @mss, @window, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0xfffffffffffffed3) syzkaller login: [ 54.395946][ T8451] IPVS: ftp: loaded support on port[0] = 21 [ 54.463013][ T8451] chnl_net:caif_netlink_parms(): no params data found [ 54.510578][ T8451] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.520693][ T8451] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.528381][ T8451] device bridge_slave_0 entered promiscuous mode [ 54.536093][ T8451] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.543103][ T8451] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.550648][ T8451] device bridge_slave_1 entered promiscuous mode [ 54.565193][ T8451] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 54.575588][ T8451] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 54.591376][ T8451] team0: Port device team_slave_0 added [ 54.598416][ T8451] team0: Port device team_slave_1 added [ 54.611972][ T8451] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 54.619077][ T8451] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 54.645048][ T8451] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 54.662460][ T8451] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 54.669555][ T8451] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 54.712723][ T8451] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 54.731970][ T8453] IPVS: ftp: loaded support on port[0] = 21 [ 54.740317][ T8451] device hsr_slave_0 entered promiscuous mode [ 54.746764][ T8451] device hsr_slave_1 entered promiscuous mode [ 54.804742][ T8455] ================================================================== [ 54.812843][ T8455] BUG: KCSAN: data-race in __hci_req_sync / hci_req_sync_complete [ 54.820624][ T8455] [ 54.822938][ T8455] write to 0xffff888012f3ea70 of 4 bytes by task 8466 on cpu 1: [ 54.830551][ T8455] hci_req_sync_complete+0x5c/0x110 [ 54.835736][ T8455] hci_event_packet+0x3ab1/0xfed0 [ 54.840751][ T8455] hci_rx_work+0x324/0x480 [ 54.844381][ T8453] chnl_net:caif_netlink_parms(): no params data found [ 54.845157][ T8455] process_one_work+0x3e1/0x950 [ 54.856985][ T8455] worker_thread+0x635/0xb90 [ 54.861553][ T8455] kthread+0x1fa/0x220 [ 54.865605][ T8455] ret_from_fork+0x1f/0x30 [ 54.869991][ T8455] [ 54.872303][ T8455] read to 0xffff888012f3ea70 of 4 bytes by task 8455 on cpu 0: [ 54.879832][ T8455] __hci_req_sync+0xdc/0x420 [ 54.884407][ T8455] hci_req_sync+0x71/0x90 [ 54.888725][ T8455] hci_dev_cmd+0x244/0x590 [ 54.889590][ T8453] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.893123][ T8455] hci_sock_ioctl+0x2e3/0x630 [ 54.893131][ T8455] sock_do_ioctl+0x4d/0x210 [ 54.893137][ T8455] sock_ioctl+0x36e/0x5b0 [ 54.893147][ T8455] __se_sys_ioctl+0xcb/0x140 [ 54.893155][ T8455] __x64_sys_ioctl+0x3f/0x50 [ 54.893170][ T8455] do_syscall_64+0x39/0x80 [ 54.900358][ T8453] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.904811][ T8455] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 54.904814][ T8455] [ 54.904816][ T8455] Reported by Kernel Concurrency Sanitizer on: [ 54.904826][ T8455] CPU: 0 PID: 8455 Comm: syz-executor.2 Not tainted 5.9.0-syzkaller #0 [ 54.904830][ T8455] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 54.904833][ T8455] ================================================================== [ 54.904837][ T8455] Kernel panic - not syncing: panic_on_warn set ... [ 54.904845][ T8455] CPU: 0 PID: 8455 Comm: syz-executor.2 Not tainted 5.9.0-syzkaller #0 [ 54.904849][ T8455] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 54.904851][ T8455] Call Trace: [ 54.904864][ T8455] dump_stack+0x116/0x15d [ 54.904874][ T8455] panic+0x1e7/0x5fa [ 54.904891][ T8455] ? vprintk_emit+0x2f2/0x370 [ 54.914774][ T8453] device bridge_slave_0 entered promiscuous mode [ 54.918222][ T8455] kcsan_report+0x67b/0x680 [ 54.924525][ T8453] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.927175][ T8455] ? kcsan_setup_watchpoint+0x46a/0x4d0 [ 54.934433][ T8453] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.940075][ T8455] ? __hci_req_sync+0xdc/0x420 [ 54.943050][ T8453] device bridge_slave_1 entered promiscuous mode [ 54.948490][ T8455] ? hci_req_sync+0x71/0x90 [ 54.948500][ T8455] ? hci_dev_cmd+0x244/0x590 [ 54.948508][ T8455] ? hci_sock_ioctl+0x2e3/0x630 [ 54.948517][ T8455] ? sock_do_ioctl+0x4d/0x210 [ 54.948523][ T8455] ? sock_ioctl+0x36e/0x5b0 [ 54.948533][ T8455] ? __se_sys_ioctl+0xcb/0x140 [ 54.948542][ T8455] ? __x64_sys_ioctl+0x3f/0x50 [ 54.948551][ T8455] ? do_syscall_64+0x39/0x80 [ 54.948561][ T8455] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 54.948578][ T8455] ? __queue_work+0x7ca/0xa90 [ 54.968951][ T8453] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 54.974848][ T8455] kcsan_setup_watchpoint+0x46a/0x4d0 [ 54.974862][ T8455] __hci_req_sync+0xdc/0x420 [ 54.974873][ T8455] ? __srcu_read_unlock+0x1f/0x40 [ 54.974890][ T8455] ? hci_encrypt_req+0x70/0x70 [ 54.984597][ T8453] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 54.989854][ T8455] hci_req_sync+0x71/0x90 [ 55.010894][ T8453] team0: Port device team_slave_0 added [ 55.011312][ T8455] hci_dev_cmd+0x244/0x590 [ 55.017700][ T8453] team0: Port device team_slave_1 added [ 55.022293][ T8455] hci_sock_ioctl+0x2e3/0x630 [ 55.049460][ T8453] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 55.051003][ T8455] sock_do_ioctl+0x4d/0x210 [ 55.058668][ T8453] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 55.061775][ T8455] ? emulate_vsyscall+0x5c4/0xc90 [ 55.067409][ T8453] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 55.071155][ T8455] ? __rcu_read_unlock+0x51/0x220 [ 55.089301][ T8453] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 55.089743][ T8455] ? sock_poll+0x1a0/0x1a0 [ 55.102485][ T8453] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 55.104987][ T8455] sock_ioctl+0x36e/0x5b0 [ 55.105001][ T8455] ? tomoyo_file_ioctl+0x1c/0x20 [ 55.105009][ T8455] ? sock_poll+0x1a0/0x1a0 [ 55.105019][ T8455] __se_sys_ioctl+0xcb/0x140 [ 55.105034][ T8455] __x64_sys_ioctl+0x3f/0x50 [ 55.286328][ T8455] do_syscall_64+0x39/0x80 [ 55.290720][ T8455] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 55.296599][ T8455] RIP: 0033:0x45dcc7 [ 55.300474][ T8455] Code: 48 83 c4 08 48 89 d8 5b 5d c3 66 0f 1f 84 00 00 00 00 00 48 89 e8 48 f7 d8 48 39 c3 0f 92 c0 eb 92 66 90 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 6d b5 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 55.320062][ T8455] RSP: 002b:00007ffc5cf85cc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 55.328466][ T8455] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045dcc7 [ 55.336411][ T8455] RDX: 00007ffc5cf85ce0 RSI: 00000000400448dd RDI: 0000000000000003 [ 55.344981][ T8455] RBP: 00007ffc5cf85ce0 R08: 0000000000000000 R09: 00007f63908fb700 [ 55.352924][ T8455] R10: 00007f63908fb9d0 R11: 0000000000000246 R12: 00000000019d7914 [ 55.360868][ T8455] R13: 00007ffc5cf86008 R14: 0000000000000000 R15: 0000000000000000 [ 55.369448][ T8455] Kernel Offset: disabled [ 55.373759][ T8455] Rebooting in 86400 seconds..