Warning: Permanently added '10.128.1.43' (ECDSA) to the list of known hosts. 2020/03/10 00:09:04 parsed 1 programs 2020/03/10 00:09:06 executed programs: 0 syzkaller login: [ 78.927410][ T9848] IPVS: ftp: loaded support on port[0] = 21 [ 78.983477][ T9848] chnl_net:caif_netlink_parms(): no params data found [ 79.031258][ T9848] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.038754][ T9848] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.046793][ T9848] device bridge_slave_0 entered promiscuous mode [ 79.055114][ T9848] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.062193][ T9848] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.070096][ T9848] device bridge_slave_1 entered promiscuous mode [ 79.088104][ T9848] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.098855][ T9848] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.118051][ T9848] team0: Port device team_slave_0 added [ 79.125969][ T9848] team0: Port device team_slave_1 added [ 79.140629][ T9848] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.147716][ T9848] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.173762][ T9848] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.186996][ T9848] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.193958][ T9848] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.220275][ T9848] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.286918][ T9848] device hsr_slave_0 entered promiscuous mode [ 79.324684][ T9848] device hsr_slave_1 entered promiscuous mode [ 79.437314][ T9848] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 79.487609][ T9848] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 79.547365][ T9848] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 79.587403][ T9848] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 79.659888][ T9848] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.667124][ T9848] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.675011][ T9848] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.682064][ T9848] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.726251][ T9848] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.739431][ T4066] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 79.750179][ T4066] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.758568][ T4066] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.767012][ T4066] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 79.780427][ T9848] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.791926][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 79.800796][ T2687] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.807908][ T2687] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.825662][ T4066] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 79.834254][ T4066] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.841377][ T4066] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.863453][ T9848] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 79.874043][ T9848] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 79.887111][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 79.895962][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 79.904253][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 79.913460][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 79.922186][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 79.930152][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 79.950818][ T9848] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 79.959774][ T4065] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 79.967582][ T4065] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 79.987414][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 79.997449][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 80.016062][ T4065] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 80.024313][ T4065] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 80.033563][ T4065] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 80.041709][ T4065] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 80.051830][ T9848] device veth0_vlan entered promiscuous mode [ 80.063459][ T9848] device veth1_vlan entered promiscuous mode [ 80.088393][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 80.097442][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 80.105706][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 80.114037][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 80.125120][ T9848] device veth0_macvtap entered promiscuous mode [ 80.134104][ T9848] device veth1_macvtap entered promiscuous mode [ 80.151439][ T9848] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.158855][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 80.168424][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 80.176601][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 80.185687][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 80.198316][ T9848] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.205831][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 80.214663][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 80.482017][ T9857] ------------[ cut here ]------------ [ 80.489022][ T9857] refcount_t: underflow; use-after-free. [ 80.495258][ T9857] WARNING: CPU: 0 PID: 9857 at lib/refcount.c:87 refcount_dec_not_one+0x1be/0x1e0 [ 80.504455][ T9857] Kernel panic - not syncing: panic_on_warn set ... [ 80.511040][ T9857] CPU: 0 PID: 9857 Comm: syz-executor.0 Not tainted 5.6.0-rc5-syzkaller #0 [ 80.519604][ T9857] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 80.529653][ T9857] Call Trace: [ 80.532926][ T9857] dump_stack+0x188/0x20d [ 80.537241][ T9857] ? refcount_dec_not_one+0x130/0x1e0 [ 80.542593][ T9857] panic+0x2e3/0x75c [ 80.546479][ T9857] ? add_taint.cold+0x16/0x16 [ 80.551174][ T9857] ? __probe_kernel_read+0x188/0x1d0 [ 80.556446][ T9857] ? __warn.cold+0x14/0x35 [ 80.560843][ T9857] ? __warn+0xd5/0x1c8 [ 80.564894][ T9857] ? refcount_dec_not_one+0x1be/0x1e0 [ 80.570247][ T9857] __warn.cold+0x2f/0x35 [ 80.574477][ T9857] ? refcount_dec_not_one+0x1be/0x1e0 [ 80.579843][ T9857] report_bug+0x27b/0x2f0 [ 80.584157][ T9857] do_error_trap+0x12b/0x220 [ 80.588724][ T9857] ? refcount_dec_not_one+0x1be/0x1e0 [ 80.594074][ T9857] do_invalid_op+0x32/0x40 [ 80.598470][ T9857] ? refcount_dec_not_one+0x1be/0x1e0 [ 80.603823][ T9857] invalid_op+0x23/0x30 [ 80.607962][ T9857] RIP: 0010:refcount_dec_not_one+0x1be/0x1e0 [ 80.613949][ T9857] Code: 1d d5 68 d2 06 31 ff 89 de e8 2e 52 e3 fd 84 db 75 82 e8 f5 50 e3 fd 48 c7 c7 00 aa 51 88 c6 05 b5 68 d2 06 01 e8 8a 63 b5 fd <0f> 0b e9 63 ff ff ff 48 89 ef e8 93 0e 20 fe e9 be fe ff ff e8 b9 [ 80.633595][ T9857] RSP: 0018:ffffc90002346f08 EFLAGS: 00010286 [ 80.639685][ T9857] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 80.647674][ T9857] RDX: 0000000000000000 RSI: ffffffff815bf4f1 RDI: fffff52000468dd3 [ 80.655626][ T9857] RBP: ffff88809722641c R08: ffff8880989e4040 R09: ffffed1015cc6659 [ 80.663577][ T9857] R10: ffffed1015cc6658 R11: ffff8880ae6332c7 R12: 00000000ffffffff [ 80.671529][ T9857] R13: ffffc90002346f30 R14: 1ffff92000468de2 R15: ffff888097226400 [ 80.679538][ T9857] ? vprintk_func+0x81/0x17e [ 80.684117][ T9857] ? refcount_dec_not_one+0x1be/0x1e0 [ 80.689477][ T9857] ? refcount_warn_saturate+0x1e0/0x1e0 [ 80.695037][ T9857] refcount_dec_and_mutex_lock+0x1c/0xe0 [ 80.700710][ T9857] __tcf_action_put+0x3f/0x130 [ 80.705463][ T9857] __tcf_idr_release+0x52/0xe0 [ 80.710209][ T9857] tcf_action_destroy+0xc6/0x150 [ 80.715148][ T9857] tcf_exts_destroy+0x42/0xc0 [ 80.719825][ T9857] tcf_exts_change+0xf4/0x150 [ 80.724490][ T9857] ? tcf_exts_destroy+0xc0/0xc0 [ 80.729338][ T9857] tcindex_set_parms+0xed8/0x1a00 [ 80.734360][ T9857] ? tcindex_alloc_perfect_hash+0x320/0x320 [ 80.740254][ T9857] ? mark_held_locks+0xe0/0xe0 [ 80.745041][ T9857] ? nla_memcpy+0xa0/0xa0 [ 80.749357][ T9857] ? tcindex_change+0x203/0x2e0 [ 80.754185][ T9857] tcindex_change+0x203/0x2e0 [ 80.758861][ T9857] ? tcindex_set_parms+0x1a00/0x1a00 [ 80.764138][ T9857] tc_new_tfilter+0xa59/0x20b0 [ 80.768890][ T9857] ? tcindex_set_parms+0x1a00/0x1a00 [ 80.774177][ T9857] ? tc_del_tfilter+0x1430/0x1430 [ 80.779193][ T9857] ? __lock_acquire+0x80b/0x3ca0 [ 80.784127][ T9857] ? apparmor_capable+0x454/0x8a0 [ 80.789159][ T9857] ? rcu_read_lock_held+0x9c/0xb0 [ 80.794171][ T9857] ? tc_del_tfilter+0x1430/0x1430 [ 80.799180][ T9857] rtnetlink_rcv_msg+0x810/0xad0 [ 80.804114][ T9857] ? rtnl_bridge_getlink+0x880/0x880 [ 80.809381][ T9857] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 80.814652][ T9857] ? __copy_skb_header+0x210/0x5b0 [ 80.819754][ T9857] ? skb_splice_bits+0x1a0/0x1a0 [ 80.824671][ T9857] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 80.830453][ T9857] ? kmem_cache_alloc+0x261/0x730 [ 80.835474][ T9857] netlink_rcv_skb+0x15a/0x410 [ 80.840217][ T9857] ? rtnl_bridge_getlink+0x880/0x880 [ 80.845482][ T9857] ? netlink_ack+0xa80/0xa80 [ 80.850060][ T9857] netlink_unicast+0x537/0x740 [ 80.854819][ T9857] ? netlink_attachskb+0x810/0x810 [ 80.859932][ T9857] ? _copy_from_iter_full+0x25c/0x870 [ 80.865291][ T9857] ? __phys_addr_symbol+0x2c/0x70 [ 80.870291][ T9857] ? __check_object_size+0x171/0x437 [ 80.875565][ T9857] netlink_sendmsg+0x882/0xe10 [ 80.880312][ T9857] ? aa_af_perm+0x260/0x260 [ 80.884794][ T9857] ? netlink_unicast+0x740/0x740 [ 80.889716][ T9857] ? netlink_unicast+0x740/0x740 [ 80.894642][ T9857] sock_sendmsg+0xcf/0x120 [ 80.899049][ T9857] ____sys_sendmsg+0x6b9/0x7d0 [ 80.903793][ T9857] ? kernel_sendmsg+0x50/0x50 [ 80.908453][ T9857] ? mark_lock+0xbc/0x1220 [ 80.912854][ T9857] ___sys_sendmsg+0x100/0x170 [ 80.917520][ T9857] ? sendmsg_copy_msghdr+0x70/0x70 [ 80.922626][ T9857] ? __fget_files+0x329/0x4f0 [ 80.927289][ T9857] ? ksys_dup3+0x3c0/0x3c0 [ 80.931694][ T9857] ? __fget_light+0x208/0x270 [ 80.936396][ T9857] __sys_sendmsg+0xec/0x1b0 [ 80.940883][ T9857] ? __sys_sendmsg_sock+0xb0/0xb0 [ 80.945886][ T9857] ? __ia32_sys_futex_time32+0x32a/0x494 [ 80.951505][ T9857] ? trace_hardirqs_off_caller+0x55/0x230 [ 80.957248][ T9857] ? do_fast_syscall_32+0xcc/0xe8f [ 80.962340][ T9857] do_fast_syscall_32+0x270/0xe8f [ 80.967350][ T9857] entry_SYSENTER_compat+0x70/0x7f [ 80.973587][ T9857] Kernel Offset: disabled [ 80.977910][ T9857] Rebooting in 86400 seconds..