[info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.202' (ECDSA) to the list of known hosts. 2019/09/23 14:05:06 fuzzer started 2019/09/23 14:05:08 dialing manager at 10.128.0.105:39633 2019/09/23 14:05:08 syscalls: 2425 2019/09/23 14:05:08 code coverage: CONFIG_KCOV is not enabled 2019/09/23 14:05:08 comparison tracing: CONFIG_KCOV is not enabled 2019/09/23 14:05:08 extra coverage: CONFIG_KCOV is not enabled 2019/09/23 14:05:08 setuid sandbox: enabled 2019/09/23 14:05:08 namespace sandbox: enabled 2019/09/23 14:05:08 Android sandbox: /sys/fs/selinux/policy does not exist 2019/09/23 14:05:08 fault injection: kernel does not have systematic fault injection support 2019/09/23 14:05:08 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/09/23 14:05:08 net packet injection: enabled 2019/09/23 14:05:08 net device setup: enabled 14:05:08 executing program 0: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x4, &(0x7f0000006ff4)={@empty, @loopback, 0xd5}, 0xc) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x6, 0x4) sendto$inet(r0, &(0x7f0000004000), 0x33f, 0x0, &(0x7f0000002000)={0x2, 0x4e23}, 0x10) 14:05:08 executing program 2: clone(0x200, &(0x7f0000c34000), &(0x7f0000ad8ffc), &(0x7f0000676000), &(0x7f00003ed000)) mknod(&(0x7f0000433000)='./file0\x00', 0x1001, 0x0) execve(&(0x7f0000000200)='./file0\x00', &(0x7f0000000280), &(0x7f00000001c0)) syz_open_procfs(0x0, &(0x7f0000000240)='auxv\x00') execve(&(0x7f0000000080)='./file0\x00', &(0x7f00000001c0), &(0x7f0000000200)) creat(&(0x7f0000000000)='./file0\x00', 0x0) 14:05:08 executing program 5: syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000cceff5)='/dev/loop#\x00', 0x0, 0x0) unshare(0x400) ioctl$LOOP_GET_STATUS(r0, 0x80081272, &(0x7f0000000000)) 14:05:08 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x17, 0x40000000}, 0x2c) bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x5, &(0x7f0000346fc8)=@framed={{}, [@alu={0x201a7ffa, 0x0, 0x201a7fd7, 0xa, 0x0, 0xffffffc0}]}, &(0x7f0000000000)='GPL\x00', 0x6, 0x2ed, &(0x7f00001a7f05)=""/251}, 0x22) 14:05:08 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000004ffb)='task\x00') getdents64(r0, &(0x7f0000000180)=""/75, 0x1e) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x31, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000271fb8)=""/72, 0x48) 14:05:08 executing program 4: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f0000000200)='loginuid\x00') write$cgroup_pid(r1, &(0x7f0000000240), 0xa) syzkaller login: [ 48.584577] IPv6: ADDRCONF(NETDEV_CHANGE): nr0: link becomes ready [ 48.592810] IPv6: ADDRCONF(NETDEV_CHANGE): nr1: link becomes ready [ 48.599525] IPv6: ADDRCONF(NETDEV_CHANGE): nr3: link becomes ready [ 48.606576] IPv6: ADDRCONF(NETDEV_CHANGE): nr4: link becomes ready [ 48.613322] IPv6: ADDRCONF(NETDEV_CHANGE): nr5: link becomes ready [ 48.619889] IPv6: ADDRCONF(NETDEV_CHANGE): nr2: link becomes ready [ 48.629239] IPVS: Creating netns size=2712 id=1 [ 48.634581] IPVS: ftp: loaded support on port[0] = 21 [ 48.645934] IPVS: Creating netns size=2712 id=2 [ 48.650665] IPVS: ftp: loaded support on port[0] = 21 [ 48.667813] chnl_net:caif_netlink_parms(): no params data found [ 48.675948] IPVS: Creating netns size=2712 id=3 [ 48.676563] kobject: 'ip6gretap0' (ffff88012a62c538): kobject_add_internal: parent: 'net', set: 'devices' [ 48.676771] kobject: 'ip6gretap0' (ffff88012a62c538): kobject_uevent_env [ 48.676778] kobject: 'ip6gretap0' (ffff88012a62c538): fill_kobj_path: path = '/devices/virtual/net/ip6gretap0' [ 48.676801] kobject: 'queues' (ffff8800b110b208): kobject_add_internal: parent: 'ip6gretap0', set: '' [ 48.676805] kobject: 'queues' (ffff8800b110b208): kobject_uevent_env [ 48.676806] kobject: 'queues' (ffff8800b110b208): kobject_uevent_env: filter function caused the event to drop! [ 48.676808] kobject: 'rx-0' (ffff8800b13ad210): kobject_add_internal: parent: 'queues', set: 'queues' [ 48.676821] kobject: 'rx-0' (ffff8800b13ad210): kobject_uevent_env [ 48.676823] kobject: 'rx-0' (ffff8800b13ad210): fill_kobj_path: path = '/devices/virtual/net/ip6gretap0/queues/rx-0' [ 48.676841] kobject: 'tx-0' (ffff88012b1c7e18): kobject_add_internal: parent: 'queues', set: 'queues' [ 48.676874] kobject: 'tx-0' (ffff88012b1c7e18): kobject_uevent_env [ 48.676876] kobject: 'tx-0' (ffff88012b1c7e18): fill_kobj_path: path = '/devices/virtual/net/ip6gretap0/queues/tx-0' [ 48.677010] kobject: 'batman_adv' (ffff8800b52b8b00): kobject_add_internal: parent: 'ip6gretap0', set: '' [ 48.677029] kobject: 'batman_adv' (ffff8800b52b8b00): kobject_cleanup, parent ffff88012a62c538 [ 48.677030] kobject: 'batman_adv' (ffff8800b52b8b00): auto cleanup kobject_del [ 48.677039] kobject: 'batman_adv' (ffff8800b52b8b00): calling ktype release [ 48.677040] kobject: (ffff8800b52b8b00): dynamic_kobj_release [ 48.677041] kobject: 'batman_adv': free name [ 48.677731] ------------[ cut here ]------------ [ 48.677743] WARNING: CPU: 0 PID: 5761 at net/batman-adv/main.c:750 batadv_tvlv_container_remove+0x7b/0x80() [ 48.677759] Kernel panic - not syncing: panic_on_warn set ... [ 48.677759] [ 48.677763] CPU: 0 PID: 5761 Comm: syz-executor.1 Not tainted 4.4.194 #0 [ 48.677764] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 48.677768] 0000000000000082 ffff8800b22af870 ffffffff818a6f22 0000000000000000 [ 48.677771] ffffffff82e96378 ffffffff8300ac2f ffff8800b22af8e8 ffffffff8126f9bc [ 48.677773] ffff880000000008 ffff8800b22af8f8 ffff8800b22af898 ffffffff81274e1f [ 48.677774] Call Trace: [ 48.677780] [] dump_stack+0xa1/0xdf [ 48.677787] [] panic+0xd2/0x225 [ 48.677790] [] ? printk+0x48/0x4a [ 48.677793] [] warn_slowpath_common.cold+0x16/0x16 [ 48.677800] [] warn_slowpath_null+0x15/0x20 [ 48.677802] [] batadv_tvlv_container_remove+0x7b/0x80 [ 48.677804] [] batadv_tvlv_container_register+0xb3/0x120 [ 48.677807] [] batadv_dat_tvlv_container_update+0x26/0x40 [ 48.677809] [] batadv_dat_init+0x6a/0x80 [ 48.677812] [] batadv_mesh_init+0x239/0x290 [ 48.677815] [] batadv_softif_init_late+0x271/0x2c0 [ 48.677819] [] register_netdevice+0xfa/0x450 [ 48.677822] [] rtnl_newlink+0x8a5/0x910 [ 48.677823] [] ? rtnl_newlink+0x17d/0x910 [ 48.677826] [] rtnetlink_rcv_msg+0x170/0x1e0 [ 48.677830] [] ? trace_hardirqs_on+0xd/0x10 [ 48.677833] [] ? mutex_lock_nested+0x30a/0x5a0 [ 48.677835] [] ? rtnetlink_rcv+0x17/0x30 [ 48.677836] [] ? rtnetlink_rcv+0x30/0x30 [ 48.677839] [] netlink_rcv_skb+0x31/0xc0 [ 48.677841] [] rtnetlink_rcv+0x26/0x30 [ 48.677842] [] netlink_unicast+0x168/0x210 [ 48.677844] [] netlink_sendmsg+0x1f1/0x390 [ 48.677847] [] sock_sendmsg+0x35/0x40 [ 48.677849] [] SYSC_sendto+0xed/0x160 [ 48.677851] [] ? sock_alloc_file+0x8c/0x120 [ 48.677856] [] ? fd_install+0x22/0x30 [ 48.677861] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 48.677862] [] SyS_sendto+0x9/0x10 [ 48.677866] [] entry_SYSCALL_64_fastpath+0x1c/0x7c [ 48.682173] Kernel Offset: disabled [ 49.078852] Rebooting in 86400 seconds..