[ 61.590761][ T26] audit: type=1800 audit(1561539555.592:29): pid=8873 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 61.634300][ T26] audit: type=1800 audit(1561539555.592:30): pid=8873 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 Starting mcstransd: [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.30' (ECDSA) to the list of known hosts. syzkaller login: [ 70.132027][ T26] kauditd_printk_skb: 5 callbacks suppressed [ 70.132042][ T26] audit: type=1400 audit(1561539564.132:36): avc: denied { map } for pid=9062 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2019/06/26 08:59:25 parsed 1 programs [ 71.112471][ T26] audit: type=1400 audit(1561539565.112:37): avc: denied { map } for pid=9062 comm="syz-execprog" path="/sys/kernel/debug/kcov" dev="debugfs" ino=16187 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 2019/06/26 08:59:27 executed programs: 0 [ 73.637626][ T9083] IPVS: ftp: loaded support on port[0] = 21 [ 73.640760][ T9089] IPVS: ftp: loaded support on port[0] = 21 [ 73.652306][ T9084] IPVS: ftp: loaded support on port[0] = 21 [ 73.669961][ T9092] IPVS: ftp: loaded support on port[0] = 21 [ 73.675115][ T9086] IPVS: ftp: loaded support on port[0] = 21 [ 73.693529][ T9091] IPVS: ftp: loaded support on port[0] = 21 [ 73.958755][ T9083] chnl_net:caif_netlink_parms(): no params data found [ 74.008018][ T9092] chnl_net:caif_netlink_parms(): no params data found [ 74.039253][ T9084] chnl_net:caif_netlink_parms(): no params data found [ 74.052484][ T9089] chnl_net:caif_netlink_parms(): no params data found [ 74.089868][ T9086] chnl_net:caif_netlink_parms(): no params data found [ 74.173461][ T9083] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.181270][ T9083] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.189463][ T9083] device bridge_slave_0 entered promiscuous mode [ 74.199413][ T9083] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.206575][ T9083] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.214269][ T9083] device bridge_slave_1 entered promiscuous mode [ 74.242197][ T9092] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.249798][ T9092] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.257538][ T9092] device bridge_slave_0 entered promiscuous mode [ 74.265335][ T9092] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.272375][ T9092] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.280295][ T9092] device bridge_slave_1 entered promiscuous mode [ 74.287307][ T9091] chnl_net:caif_netlink_parms(): no params data found [ 74.321376][ T9089] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.328810][ T9089] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.336551][ T9089] device bridge_slave_0 entered promiscuous mode [ 74.364485][ T9092] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 74.378273][ T9092] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 74.392192][ T9089] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.399443][ T9089] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.410015][ T9089] device bridge_slave_1 entered promiscuous mode [ 74.419554][ T9083] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 74.428091][ T9084] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.435270][ T9084] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.442992][ T9084] device bridge_slave_0 entered promiscuous mode [ 74.467937][ T9092] team0: Port device team_slave_0 added [ 74.473804][ T9086] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.481715][ T9086] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.489953][ T9086] device bridge_slave_0 entered promiscuous mode [ 74.503721][ T9083] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 74.512612][ T9084] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.520199][ T9084] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.528113][ T9084] device bridge_slave_1 entered promiscuous mode [ 74.536015][ T9092] team0: Port device team_slave_1 added [ 74.551771][ T9086] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.559168][ T9086] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.567415][ T9086] device bridge_slave_1 entered promiscuous mode [ 74.595812][ T9086] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 74.606223][ T9086] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 74.621089][ T9091] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.628306][ T9091] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.636108][ T9091] device bridge_slave_0 entered promiscuous mode [ 74.644512][ T9089] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 74.652945][ T9091] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.661244][ T9091] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.669600][ T9091] device bridge_slave_1 entered promiscuous mode [ 74.702936][ T9091] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 74.712630][ T9084] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 74.722614][ T9089] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 74.732223][ T9083] team0: Port device team_slave_0 added [ 74.743289][ T9083] team0: Port device team_slave_1 added [ 74.757015][ T9091] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 74.771765][ T9084] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 74.827476][ T9092] device hsr_slave_0 entered promiscuous mode [ 74.884676][ T9092] device hsr_slave_1 entered promiscuous mode [ 74.935759][ T9086] team0: Port device team_slave_0 added [ 74.948952][ T9089] team0: Port device team_slave_0 added [ 74.960728][ T9089] team0: Port device team_slave_1 added [ 74.983514][ T9086] team0: Port device team_slave_1 added [ 74.990464][ T9091] team0: Port device team_slave_0 added [ 75.057330][ T9083] device hsr_slave_0 entered promiscuous mode [ 75.104800][ T9083] device hsr_slave_1 entered promiscuous mode [ 75.172174][ T9091] team0: Port device team_slave_1 added [ 75.181886][ T9084] team0: Port device team_slave_0 added [ 75.247694][ T9086] device hsr_slave_0 entered promiscuous mode [ 75.305587][ T9086] device hsr_slave_1 entered promiscuous mode [ 75.346406][ T9084] team0: Port device team_slave_1 added [ 75.416519][ T9089] device hsr_slave_0 entered promiscuous mode [ 75.455009][ T9089] device hsr_slave_1 entered promiscuous mode [ 75.557578][ T9084] device hsr_slave_0 entered promiscuous mode [ 75.614783][ T9084] device hsr_slave_1 entered promiscuous mode [ 75.737609][ T9091] device hsr_slave_0 entered promiscuous mode [ 75.774658][ T9091] device hsr_slave_1 entered promiscuous mode [ 75.922212][ T9092] 8021q: adding VLAN 0 to HW filter on device bond0 [ 75.951372][ T9086] 8021q: adding VLAN 0 to HW filter on device bond0 [ 75.970024][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 75.979854][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 75.991019][ T9092] 8021q: adding VLAN 0 to HW filter on device team0 [ 76.011982][ T9086] 8021q: adding VLAN 0 to HW filter on device team0 [ 76.033609][ T9089] 8021q: adding VLAN 0 to HW filter on device bond0 [ 76.041256][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 76.053522][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 76.062438][ T3760] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.069672][ T3760] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.079120][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 76.087145][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 76.123891][ T9089] 8021q: adding VLAN 0 to HW filter on device team0 [ 76.131288][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 76.141888][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 76.150966][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 76.159453][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.166518][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 76.176009][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 76.184955][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 76.195031][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 76.203602][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 76.212311][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.219405][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.227742][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 76.238134][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 76.246737][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 76.255450][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 76.263735][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 76.271490][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 76.279690][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 76.287657][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 76.304370][ T9100] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 76.312741][ T9100] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 76.321940][ T9100] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 76.332841][ T9100] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 76.346916][ T9083] 8021q: adding VLAN 0 to HW filter on device bond0 [ 76.358651][ T9092] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 76.381968][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 76.390650][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 76.400817][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.407955][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 76.416524][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 76.425271][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 76.433553][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.440630][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.448911][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 76.463680][ T9084] 8021q: adding VLAN 0 to HW filter on device bond0 [ 76.476292][ T9091] 8021q: adding VLAN 0 to HW filter on device bond0 [ 76.491889][ T9083] 8021q: adding VLAN 0 to HW filter on device team0 [ 76.501788][ T9100] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 76.511850][ T9100] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 76.520407][ T9100] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.527623][ T9100] bridge0: port 2(bridge_slave_1) entered forwarding state [ 76.536254][ T9100] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 76.543882][ T9100] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 76.551616][ T9100] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 76.577491][ T9091] 8021q: adding VLAN 0 to HW filter on device team0 [ 76.601337][ T9092] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 76.609022][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 76.617867][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 76.630543][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 76.639559][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 76.648111][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 76.656627][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 76.664547][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 76.673037][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 76.681636][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 76.690297][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.697399][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.705119][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 76.713626][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 76.722169][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 76.730739][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 76.739246][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.746325][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 76.753833][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 76.762487][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 76.770885][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 76.779523][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 76.787490][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 76.795620][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 76.813346][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 76.825241][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 76.833544][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 76.842421][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 76.850851][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 76.859121][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 76.875463][ T9086] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 76.887073][ T9086] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 76.912777][ T9099] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 76.921799][ T9099] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 76.931363][ T9099] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 76.941403][ T9099] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 76.950204][ T9099] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 76.958531][ T9099] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 76.967320][ T9099] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 76.976046][ T9099] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 76.983724][ T9099] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 76.991617][ T9099] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 77.000267][ T9099] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 77.008978][ T9099] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.016097][ T9099] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.024668][ T9099] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 77.032341][ T9099] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 77.040278][ T9099] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 77.050716][ T9089] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 77.064872][ T26] audit: type=1400 audit(1561539571.062:38): avc: denied { associate } for pid=9092 comm="syz-executor.5" name="syz5" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1 [ 77.101242][ T9083] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 77.118788][ T9083] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 77.141732][ T9084] 8021q: adding VLAN 0 to HW filter on device team0 [ 77.165557][ T9089] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.172802][ T2993] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 77.181842][ T26] audit: type=1400 audit(1561539571.182:39): avc: denied { map_create } for pid=9108 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 [ 77.210631][ T2993] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 77.225929][ T26] audit: type=1400 audit(1561539571.212:40): avc: denied { map_read map_write } for pid=9108 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 [ 77.240652][ T2993] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 77.266640][ T2993] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 77.275554][ T2993] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 77.284866][ T2993] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 77.293377][ T2993] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.300503][ T2993] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.308575][ T2993] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 77.317432][ T2993] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 77.326075][ T2993] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 77.336800][ T9104] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 77.430563][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 77.450518][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 77.467625][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 77.479778][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 77.499354][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 77.508599][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 77.518199][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 77.526771][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 77.539204][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 77.547837][ T3760] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.554940][ T3760] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.562604][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 77.572032][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 77.580486][ T3760] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.587566][ T3760] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.595380][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 77.603839][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 77.612606][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 77.621559][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 77.634039][ T9091] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 77.648241][ T9091] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 77.667363][ T9083] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.680354][ T9086] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.688678][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 77.703842][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 77.712649][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 77.721845][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 77.730451][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 77.739395][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 77.748188][ T3760] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 77.763238][ T9084] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 77.775229][ T9084] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 77.819369][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 77.841388][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 77.868128][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 77.878350][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 77.887771][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 77.924157][ T9091] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.975039][ T9084] 8021q: adding VLAN 0 to HW filter on device batadv0 2019/06/26 08:59:32 executed programs: 32 [ 79.365942][ T9297] ================================================================== [ 79.374299][ T9297] BUG: KASAN: use-after-free in sk_psock_unlink+0x3dd/0x4b0 [ 79.381587][ T9297] Read of size 4 at addr ffff88808eb0a598 by task syz-executor.0/9297 [ 79.389822][ T9297] [ 79.392160][ T9297] CPU: 1 PID: 9297 Comm: syz-executor.0 Not tainted 5.2.0-rc6+ #34 [ 79.400049][ T9297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 79.410110][ T9297] Call Trace: [ 79.413418][ T9297] dump_stack+0x172/0x1f0 [ 79.417759][ T9297] ? sk_psock_unlink+0x3dd/0x4b0 [ 79.422704][ T9297] ? tcp_check_oom+0x560/0x560 [ 79.427483][ T9297] print_address_description.cold+0x7c/0x20d [ 79.433477][ T9297] ? sk_psock_unlink+0x3dd/0x4b0 [ 79.438417][ T9297] ? sk_psock_unlink+0x3dd/0x4b0 [ 79.443358][ T9297] ? tcp_check_oom+0x560/0x560 [ 79.448128][ T9297] __kasan_report.cold+0x1b/0x40 [ 79.453072][ T9297] ? sk_psock_unlink+0x3dd/0x4b0 [ 79.458017][ T9297] kasan_report+0x12/0x20 [ 79.462355][ T9297] __asan_report_load4_noabort+0x14/0x20 [ 79.468000][ T9297] sk_psock_unlink+0x3dd/0x4b0 [ 79.472767][ T9297] ? sk_psock_link_pop+0x186/0x1f0 [ 79.477882][ T9297] ? tcp_check_oom+0x560/0x560 [ 79.482652][ T9297] tcp_bpf_remove+0x21/0x50 [ 79.487160][ T9297] tcp_bpf_close+0x130/0x390 [ 79.491759][ T9297] tls_sk_proto_close+0x18a/0x770 [ 79.496801][ T9297] ? tcp_bpf_stream_read+0x270/0x270 [ 79.502089][ T9297] ? tls_push_sg+0x680/0x680 [ 79.506682][ T9297] ? ip_mc_drop_socket+0x211/0x270 [ 79.511800][ T9297] inet_release+0xe0/0x1f0 [ 79.516223][ T9297] inet6_release+0x53/0x80 [ 79.520660][ T9297] __sock_release+0xce/0x2a0 [ 79.520683][ T9297] sock_close+0x1b/0x30 [ 79.520696][ T9297] __fput+0x2ff/0x890 [ 79.520708][ T9297] ? __sock_release+0x2a0/0x2a0 [ 79.520719][ T9297] ____fput+0x16/0x20 [ 79.520730][ T9297] task_work_run+0x145/0x1c0 [ 79.520749][ T9297] exit_to_usermode_loop+0x273/0x2c0 [ 79.520765][ T9297] do_syscall_64+0x58e/0x680 [ 79.546959][ T9297] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 79.546973][ T9297] RIP: 0033:0x413201 [ 79.546988][ T9297] Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 79.546994][ T9297] RSP: 002b:00007fff022fc060 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 79.547006][ T9297] RAX: 0000000000000000 RBX: 0000000000000006 RCX: 0000000000413201 [ 79.547012][ T9297] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005 [ 79.547019][ T9297] RBP: 0000000000000001 R08: ffffffffffffffff R09: ffffffffffffffff [ 79.547027][ T9297] R10: 00007fff022fc140 R11: 0000000000000293 R12: 0000000000761178 [ 79.547034][ T9297] R13: 00000000000135e1 R14: 000000000001360e R15: ffffffffffffffff [ 79.547052][ T9297] [ 79.547059][ T9297] Allocated by task 9303: [ 79.547075][ T9297] save_stack+0x23/0x90 [ 79.547086][ T9297] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 79.547095][ T9297] kasan_kmalloc+0x9/0x10 [ 79.547105][ T9297] kmem_cache_alloc_trace+0x151/0x750 [ 79.547122][ T9297] sock_map_alloc+0x1b9/0x3f0 [ 79.568075][ T3880] kobject: 'loop4' (0000000052988466): kobject_uevent_env [ 79.586321][ T9297] __do_sys_bpf+0x730/0x43d0 [ 79.586334][ T9297] __x64_sys_bpf+0x73/0xb0 [ 79.586349][ T9297] do_syscall_64+0xfd/0x680 [ 79.586364][ T9297] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 79.586368][ T9297] [ 79.586374][ T9297] Freed by task 22: [ 79.586388][ T9297] save_stack+0x23/0x90 [ 79.586397][ T9297] __kasan_slab_free+0x102/0x150 [ 79.586408][ T9297] kasan_slab_free+0xe/0x10 [ 79.586418][ T9297] kfree+0xcf/0x220 [ 79.586432][ T9297] sock_map_free+0x22a/0x310 [ 79.586443][ T9297] bpf_map_free_deferred+0xb4/0xe0 [ 79.586456][ T9297] process_one_work+0x989/0x1790 [ 79.586465][ T9297] worker_thread+0x98/0xe40 [ 79.586476][ T9297] kthread+0x354/0x420 [ 79.586486][ T9297] ret_from_fork+0x24/0x30 [ 79.586490][ T9297] [ 79.586501][ T9297] The buggy address belongs to the object at ffff88808eb0a580 [ 79.586501][ T9297] which belongs to the cache kmalloc-512 of size 512 [ 79.586510][ T9297] The buggy address is located 24 bytes inside of [ 79.586510][ T9297] 512-byte region [ffff88808eb0a580, ffff88808eb0a780) [ 79.586514][ T9297] The buggy address belongs to the page: [ 79.586527][ T9297] page:ffffea00023ac280 refcount:1 mapcount:0 mapping:ffff8880aa400940 index:0xffff88808eb0aa80 [ 79.586539][ T9297] flags: 0x1fffc0000000200(slab) [ 79.586555][ T9297] raw: 01fffc0000000200 ffffea0002825488 ffffea00025a7308 ffff8880aa400940 [ 79.586567][ T9297] raw: ffff88808eb0aa80 ffff88808eb0a080 0000000100000005 0000000000000000 [ 79.586572][ T9297] page dumped because: kasan: bad access detected [ 79.586575][ T9297] [ 79.586578][ T9297] Memory state around the buggy address: [ 79.586588][ T9297] ffff88808eb0a480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 79.586596][ T9297] ffff88808eb0a500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 79.586606][ T9297] >ffff88808eb0a580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 79.586610][ T9297] ^ [ 79.586618][ T9297] ffff88808eb0a600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 79.586626][ T9297] ffff88808eb0a680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 79.586630][ T9297] ================================================================== [ 79.586634][ T9297] Disabling lock debugging due to kernel taint [ 79.627297][ T9297] Kernel panic - not syncing: panic_on_warn set ... [ 79.651581][ T3880] kobject: 'loop4' (0000000052988466): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 79.655794][ T9297] CPU: 1 PID: 9297 Comm: syz-executor.0 Tainted: G B 5.2.0-rc6+ #34 [ 79.655801][ T9297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 79.655806][ T9297] Call Trace: [ 79.655829][ T9297] dump_stack+0x172/0x1f0 [ 79.655846][ T9297] ? tcp_check_oom+0x560/0x560 [ 79.655865][ T9297] panic+0x2cb/0x744 [ 79.663199][ T3880] kobject: 'loop2' (000000002bcfed7d): kobject_uevent_env [ 79.665888][ T9297] ? __warn_printk+0xf3/0xf3 [ 79.665904][ T9297] ? sk_psock_unlink+0x3dd/0x4b0 [ 79.665919][ T9297] ? tcp_check_oom+0x560/0x560 [ 79.665933][ T9297] ? preempt_schedule+0x4b/0x60 [ 79.665953][ T9297] ? ___preempt_schedule+0x16/0x18 [ 79.675356][ T3880] kobject: 'loop2' (000000002bcfed7d): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 79.677607][ T9297] ? trace_hardirqs_on+0x5e/0x220 [ 79.677626][ T9297] ? sk_psock_unlink+0x3dd/0x4b0 [ 79.685593][ T3880] kobject: 'loop4' (0000000052988466): kobject_uevent_env [ 79.686508][ T9297] ? tcp_check_oom+0x560/0x560 [ 79.686527][ T9297] end_report+0x47/0x4f [ 79.692408][ T3880] kobject: 'loop4' (0000000052988466): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 79.694694][ T9297] ? sk_psock_unlink+0x3dd/0x4b0 [ 79.694706][ T9297] __kasan_report.cold+0xe/0x40 [ 79.694717][ T9297] ? sk_psock_unlink+0x3dd/0x4b0 [ 79.694729][ T9297] kasan_report+0x12/0x20 [ 79.694742][ T9297] __asan_report_load4_noabort+0x14/0x20 [ 79.694754][ T9297] sk_psock_unlink+0x3dd/0x4b0 [ 79.694766][ T9297] ? sk_psock_link_pop+0x186/0x1f0 [ 79.694779][ T9297] ? tcp_check_oom+0x560/0x560 [ 79.694791][ T9297] tcp_bpf_remove+0x21/0x50 [ 79.694800][ T9297] tcp_bpf_close+0x130/0x390 [ 79.694814][ T9297] tls_sk_proto_close+0x18a/0x770 [ 79.694824][ T9297] ? tcp_bpf_stream_read+0x270/0x270 [ 79.694834][ T9297] ? tls_push_sg+0x680/0x680 [ 79.694847][ T9297] ? ip_mc_drop_socket+0x211/0x270 [ 79.694861][ T9297] inet_release+0xe0/0x1f0 [ 79.694877][ T9297] inet6_release+0x53/0x80 [ 79.694891][ T9297] __sock_release+0xce/0x2a0 [ 79.694903][ T9297] sock_close+0x1b/0x30 [ 79.694917][ T9297] __fput+0x2ff/0x890 [ 79.694929][ T9297] ? __sock_release+0x2a0/0x2a0 [ 79.694943][ T9297] ____fput+0x16/0x20 [ 79.694955][ T9297] task_work_run+0x145/0x1c0 [ 79.694973][ T9297] exit_to_usermode_loop+0x273/0x2c0 [ 79.694987][ T9297] do_syscall_64+0x58e/0x680 [ 79.695003][ T9297] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 79.695013][ T9297] RIP: 0033:0x413201 [ 79.695025][ T9297] Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 79.695031][ T9297] RSP: 002b:00007fff022fc060 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 79.695042][ T9297] RAX: 0000000000000000 RBX: 0000000000000006 RCX: 0000000000413201 [ 79.695048][ T9297] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005 [ 79.695055][ T9297] RBP: 0000000000000001 R08: ffffffffffffffff R09: ffffffffffffffff [ 79.695063][ T9297] R10: 00007fff022fc140 R11: 0000000000000293 R12: 0000000000761178 [ 79.695069][ T9297] R13: 00000000000135e1 R14: 000000000001360e R15: ffffffffffffffff [ 79.696183][ T9297] Kernel Offset: disabled [ 80.214920][ T9297] Rebooting in 86400 seconds..