[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 53.370453][ T26] kauditd_printk_skb: 8 callbacks suppressed [ 53.370467][ T26] audit: type=1800 audit(1575615663.016:29): pid=7466 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2465 res=0 [ 53.399699][ T26] audit: type=1800 audit(1575615663.016:30): pid=7466 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2456 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.0' (ECDSA) to the list of known hosts. 2019/12/06 07:01:12 fuzzer started 2019/12/06 07:01:14 dialing manager at 10.128.0.105:45173 2019/12/06 07:01:25 syscalls: 2684 2019/12/06 07:01:25 code coverage: enabled 2019/12/06 07:01:25 comparison tracing: enabled 2019/12/06 07:01:25 extra coverage: extra coverage is not supported by the kernel 2019/12/06 07:01:25 setuid sandbox: enabled 2019/12/06 07:01:25 namespace sandbox: enabled 2019/12/06 07:01:25 Android sandbox: /sys/fs/selinux/policy does not exist 2019/12/06 07:01:25 fault injection: enabled 2019/12/06 07:01:25 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/12/06 07:01:25 net packet injection: enabled 2019/12/06 07:01:25 net device setup: enabled 2019/12/06 07:01:25 concurrency sanitizer: enabled 2019/12/06 07:01:25 devlink PCI setup: PCI device 0000:00:10.0 is not available syzkaller login: [ 76.735877][ T7631] KCSAN: could not find function: 'poll_schedule_timeout' 2019/12/06 07:01:37 adding functions to KCSAN blacklist: 'poll_schedule_timeout' 'dd_has_work' 'add_timer' 'blk_mq_sched_dispatch_requests' 'rcu_gp_fqs_loop' 'vm_area_dup' 'mm_update_next_owner' 'ep_poll' 'ip_finish_output2' 'ktime_get_seconds' 'wbt_issue' 'blk_mq_get_request' 'pipe_wait' 'list_lru_count_one' 'timer_clear_idle' '__hrtimer_run_queues' 'ext4_free_inodes_count' 'tick_do_update_jiffies64' 'run_timer_softirq' 'do_syslog' 'sbitmap_queue_clear' 'xas_find_marked' 'tcp_add_backlog' 'dput' '__skb_try_recv_from_queue' 'get_signal' 'lruvec_lru_size' 'tick_sched_do_timer' '__snd_rawmidi_transmit_ack' 'process_srcu' 'find_get_pages_range_tag' 'find_next_bit' 'tomoyo_supervisor' 'do_nanosleep' 'wbt_done' 'generic_fillattr' '__delete_from_page_cache' 'fsnotify' '__rb_rotate_set_parents' 'p9_poll_workfn' 'ext4_mb_good_group' 'generic_write_end' 'rcu_gp_fqs_check_wake' 'page_counter_try_charge' 'ext4_ext_insert_extent' '__dentry_kill' 'tomoyo_check_path_acl' 'blk_mq_dispatch_rq_list' 'pipe_poll' 'ext4_nonda_switch' 'ext4_direct_IO' 'futex_wait_queue_me' 'tick_nohz_idle_stop_tick' '__ppp_xmit_process' '__rb_insert_augmented' 'blk_mq_run_hw_queue' 'mod_timer' 'balance_dirty_pages' 'add_timer_on' 'kauditd_thread' 'audit_log_start' 'ext4_free_inode' '__ext4_new_inode' 'pcpu_alloc' 'xas_clear_mark' 'pid_update_inode' 'echo_char' 'taskstats_exit' 'mem_cgroup_select_victim_node' 'atime_needs_update' 'ext4_has_free_clusters' 'do_exit' 'common_perm_cond' '__mark_inode_dirty' 'copy_process' 'ext4_mark_iloc_dirty' 'sit_tunnel_xmit' [ 309.938091][ T7616] ================================================================== [ 309.946237][ T7616] BUG: KCSAN: data-race in hrtimer_wakeup / schedule_hrtimeout_range_clock [ 309.955021][ T7616] [ 309.957334][ T7616] write to 0xffffc900015cb848 of 8 bytes by interrupt on cpu 0: [ 309.964947][ T7616] hrtimer_wakeup+0x32/0x60 [ 309.969455][ T7616] __hrtimer_run_queues+0x274/0x5f0 [ 309.974835][ T7616] hrtimer_interrupt+0x22a/0x480 [ 309.979759][ T7616] smp_apic_timer_interrupt+0xdc/0x280 [ 309.985217][ T7616] apic_timer_interrupt+0xf/0x20 [ 309.990187][ T7616] native_safe_halt+0xe/0x10 [ 309.994780][ T7616] arch_cpu_idle+0xa/0x10 [ 309.999161][ T7616] default_idle_call+0x1e/0x40 [ 310.003921][ T7616] do_idle+0x1af/0x280 [ 310.007983][ T7616] cpu_startup_entry+0x1b/0x20 [ 310.012735][ T7616] rest_init+0xec/0xf6 [ 310.016795][ T7616] arch_call_rest_init+0x17/0x37 [ 310.021718][ T7616] start_kernel+0x838/0x85e [ 310.026201][ T7616] x86_64_start_reservations+0x29/0x2b [ 310.031680][ T7616] x86_64_start_kernel+0x72/0x76 [ 310.036606][ T7616] secondary_startup_64+0xa4/0xb0 [ 310.041614][ T7616] [ 310.043939][ T7616] read to 0xffffc900015cb848 of 8 bytes by task 7616 on cpu 1: [ 310.051476][ T7616] schedule_hrtimeout_range_clock+0x109/0x1e0 [ 310.057542][ T7616] schedule_hrtimeout_range+0x34/0x50 [ 310.062916][ T7616] poll_schedule_timeout.constprop.0+0x75/0xc0 [ 310.069154][ T7616] do_select+0xd7f/0x1020 [ 310.073467][ T7616] core_sys_select+0x381/0x550 [ 310.078214][ T7616] do_pselect.constprop.0+0x11d/0x160 [ 310.083581][ T7616] __x64_sys_pselect6+0x12e/0x170 [ 310.088609][ T7616] do_syscall_64+0xcc/0x370 [ 310.093113][ T7616] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 310.098992][ T7616] [ 310.101307][ T7616] Reported by Kernel Concurrency Sanitizer on: [ 310.107451][ T7616] CPU: 1 PID: 7616 Comm: syz-fuzzer Not tainted 5.4.0-syzkaller #0 [ 310.115323][ T7616] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 310.125478][ T7616] ================================================================== [ 310.133533][ T7616] Kernel panic - not syncing: panic_on_warn set ... [ 310.140133][ T7616] CPU: 1 PID: 7616 Comm: syz-fuzzer Not tainted 5.4.0-syzkaller #0 [ 310.148135][ T7616] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 310.158181][ T7616] Call Trace: [ 310.161473][ T7616] dump_stack+0x11d/0x181 [ 310.165795][ T7616] panic+0x210/0x640 [ 310.169679][ T7616] ? vprintk_func+0x8d/0x140 [ 310.174265][ T7616] kcsan_report.cold+0xc/0xd [ 310.178861][ T7616] kcsan_setup_watchpoint+0x3fe/0x460 [ 310.184244][ T7616] __tsan_read8+0xc6/0x100 [ 310.188669][ T7616] schedule_hrtimeout_range_clock+0x109/0x1e0 [ 310.194747][ T7616] ? hrtimer_active+0x1a0/0x1a0 [ 310.199669][ T7616] schedule_hrtimeout_range+0x34/0x50 [ 310.205037][ T7616] poll_schedule_timeout.constprop.0+0x75/0xc0 [ 310.211190][ T7616] do_select+0xd7f/0x1020 [ 310.215517][ T7616] ? __rcu_read_unlock+0x66/0x3c0 [ 310.220525][ T7616] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 310.226243][ T7616] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 310.232482][ T7616] ? __rcu_read_unlock+0x66/0x3c0 [ 310.237494][ T7616] ? __rcu_read_unlock+0x66/0x3c0 [ 310.242507][ T7616] ? __rcu_read_unlock+0x66/0x3c0 [ 310.247521][ T7616] ? rb_erase+0x2aa/0x990 [ 310.251851][ T7616] ? __read_once_size.constprop.0+0x12/0x20 [ 310.257760][ T7616] ? timerqueue_del+0xa1/0x100 [ 310.262535][ T7616] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 310.268795][ T7616] ? __remove_hrtimer+0x7a/0x130 [ 310.273757][ T7616] ? _raw_spin_unlock_irqrestore+0x70/0x80 [ 310.279577][ T7616] ? hrtimer_try_to_cancel+0x57/0x260 [ 310.284964][ T7616] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 310.291279][ T7616] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 310.297507][ T7616] ? hrtimer_cancel+0x3b/0x50 [ 310.302177][ T7616] ? futex_wait+0x33f/0x3f0 [ 310.306680][ T7616] ? __rcu_read_unlock+0x66/0x3c0 [ 310.311710][ T7616] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 310.317599][ T7616] core_sys_select+0x381/0x550 [ 310.322368][ T7616] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 310.328500][ T7616] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 310.334222][ T7616] ? _copy_to_user+0x84/0xb0 [ 310.338807][ T7616] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 310.344702][ T7616] ? __read_once_size+0x5a/0xe0 [ 310.349549][ T7616] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 310.355780][ T7616] ? ktime_get_ts64+0x286/0x2c0 [ 310.360622][ T7616] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 310.366345][ T7616] ? timespec64_add_safe+0xae/0xd0 [ 310.371478][ T7616] do_pselect.constprop.0+0x11d/0x160 [ 310.376849][ T7616] __x64_sys_pselect6+0x12e/0x170 [ 310.381964][ T7616] ? switch_fpu_return+0x11f/0x250 [ 310.387088][ T7616] do_syscall_64+0xcc/0x370 [ 310.391589][ T7616] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 310.397479][ T7616] RIP: 0033:0x45ac23 [ 310.401381][ T7616] Code: 48 89 44 24 08 bf 00 00 00 00 be 00 00 00 00 ba 00 00 00 00 41 ba 00 00 00 00 49 89 e0 41 b9 00 00 00 00 b8 0e 01 00 00 0f 05 <48> 8b 6c 24 10 48 83 c4 18 c3 cc cc cc b8 ba 00 00 00 0f 05 89 44 [ 310.421036][ T7616] RSP: 002b:000000c42004ff08 EFLAGS: 00000202 ORIG_RAX: 000000000000010e [ 310.429435][ T7616] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 000000000045ac23 [ 310.437402][ T7616] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 310.445477][ T7616] RBP: 000000c42004ff18 R08: 000000c42004ff08 R09: 0000000000000000 [ 310.453445][ T7616] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000042f0a0 [ 310.461416][ T7616] R13: 00000000000000f1 R14: 0000000000000011 R15: 0000000000000000 [ 310.470749][ T7616] Kernel Offset: disabled [ 310.475085][ T7616] Rebooting in 86400 seconds..