[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 44.509576][ T7339] IPVS: ftp: loaded support on port[0] = 21 [ 44.965772][ T7343] can: request_module (can-proto-0) failed. [ 45.843797][ T7343] can: request_module (can-proto-0) failed. [ 45.853439][ T7343] can: request_module (can-proto-0) failed. Warning: Permanently added '10.128.10.50' (ECDSA) to the list of known hosts. 2019/12/25 15:24:52 parsed 1 programs 2019/12/25 15:24:53 executed programs: 0 [ 53.132579][ T7413] IPVS: ftp: loaded support on port[0] = 21 [ 53.156866][ T7416] IPVS: ftp: loaded support on port[0] = 21 [ 53.165543][ T7417] IPVS: ftp: loaded support on port[0] = 21 [ 53.220112][ T7420] IPVS: ftp: loaded support on port[0] = 21 [ 53.237146][ T7423] IPVS: ftp: loaded support on port[0] = 21 [ 53.250692][ T7422] IPVS: ftp: loaded support on port[0] = 21 [ 53.350374][ T7417] chnl_net:caif_netlink_parms(): no params data found [ 53.375605][ T7413] chnl_net:caif_netlink_parms(): no params data found [ 53.426767][ T7413] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.435646][ T7413] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.443368][ T7413] device bridge_slave_0 entered promiscuous mode [ 53.473659][ T7417] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.481233][ T7417] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.489212][ T7417] device bridge_slave_0 entered promiscuous mode [ 53.503664][ T7413] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.510881][ T7413] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.518932][ T7413] device bridge_slave_1 entered promiscuous mode [ 53.534639][ T7417] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.542403][ T7417] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.550136][ T7417] device bridge_slave_1 entered promiscuous mode [ 53.559305][ T7416] chnl_net:caif_netlink_parms(): no params data found [ 53.580986][ T7413] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 53.590793][ T7413] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 53.604965][ T7420] chnl_net:caif_netlink_parms(): no params data found [ 53.628229][ T7417] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 53.661399][ T7417] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 53.671100][ T7423] chnl_net:caif_netlink_parms(): no params data found [ 53.684703][ T7420] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.691920][ T7420] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.699765][ T7420] device bridge_slave_0 entered promiscuous mode [ 53.709990][ T7420] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.717050][ T7420] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.724665][ T7420] device bridge_slave_1 entered promiscuous mode [ 53.733868][ T7413] team0: Port device team_slave_0 added [ 53.743410][ T7413] team0: Port device team_slave_1 added [ 53.792038][ T7416] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.799340][ T7416] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.806800][ T7416] device bridge_slave_0 entered promiscuous mode [ 53.814857][ T7417] team0: Port device team_slave_0 added [ 53.820740][ T7416] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.830076][ T7416] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.837509][ T7416] device bridge_slave_1 entered promiscuous mode [ 53.845487][ T7420] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 53.860995][ T7422] chnl_net:caif_netlink_parms(): no params data found [ 53.871339][ T7417] team0: Port device team_slave_1 added [ 53.887940][ T7420] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 53.959910][ T7417] device hsr_slave_0 entered promiscuous mode [ 54.007852][ T7417] device hsr_slave_1 entered promiscuous mode [ 54.068843][ T7416] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 54.077469][ T7423] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.084969][ T7423] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.092632][ T7423] device bridge_slave_0 entered promiscuous mode [ 54.102913][ T7423] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.110647][ T7423] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.118130][ T7423] device bridge_slave_1 entered promiscuous mode [ 54.158802][ T7413] device hsr_slave_0 entered promiscuous mode [ 54.197855][ T7413] device hsr_slave_1 entered promiscuous mode [ 54.249301][ T7416] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 54.262377][ T7420] team0: Port device team_slave_0 added [ 54.271178][ T7420] team0: Port device team_slave_1 added [ 54.285394][ T7423] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 54.334741][ T7416] team0: Port device team_slave_0 added [ 54.349279][ T7416] team0: Port device team_slave_1 added [ 54.355949][ T7423] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 54.529582][ T7420] device hsr_slave_0 entered promiscuous mode [ 54.588386][ T7420] device hsr_slave_1 entered promiscuous mode [ 54.614734][ T7423] team0: Port device team_slave_0 added [ 54.656234][ T7422] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.667865][ T7422] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.675588][ T7422] device bridge_slave_0 entered promiscuous mode [ 54.793961][ T7416] device hsr_slave_0 entered promiscuous mode [ 54.898311][ T7416] device hsr_slave_1 entered promiscuous mode [ 54.956655][ T7423] team0: Port device team_slave_1 added [ 54.970765][ T7422] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.997742][ T7422] bridge0: port 2(bridge_slave_1) entered disabled state [ 55.005470][ T7422] device bridge_slave_1 entered promiscuous mode [ 55.250004][ T7423] device hsr_slave_0 entered promiscuous mode [ 55.278163][ T7423] device hsr_slave_1 entered promiscuous mode [ 55.488714][ T7422] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 55.507346][ T7413] 8021q: adding VLAN 0 to HW filter on device bond0 [ 55.616211][ T7422] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 55.733328][ T7413] 8021q: adding VLAN 0 to HW filter on device team0 [ 55.796380][ T7417] 8021q: adding VLAN 0 to HW filter on device bond0 [ 55.878052][ T3055] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 55.887180][ T3055] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 56.015551][ T7417] 8021q: adding VLAN 0 to HW filter on device team0 [ 56.096806][ T7416] 8021q: adding VLAN 0 to HW filter on device bond0 [ 56.143994][ T7420] 8021q: adding VLAN 0 to HW filter on device bond0 [ 56.178716][ T7422] team0: Port device team_slave_0 added [ 56.184962][ T3055] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 56.238341][ T3055] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 56.277820][ T3055] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.285038][ T3055] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.407795][ T3055] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 56.416470][ T3055] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 56.522187][ T3055] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.529321][ T3055] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.588894][ T3055] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 56.597386][ T3055] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 56.669245][ T3055] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 56.709542][ T7423] 8021q: adding VLAN 0 to HW filter on device bond0 [ 56.752536][ T7420] 8021q: adding VLAN 0 to HW filter on device team0 [ 56.771273][ T7422] team0: Port device team_slave_1 added [ 56.778587][ T7413] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 56.791404][ T7413] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 56.810093][ T7529] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 56.822162][ T7529] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 56.834299][ T7529] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 56.845591][ T7529] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 56.854464][ T7529] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 56.866351][ T7529] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 56.875221][ T7529] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 56.883622][ T7529] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 56.892334][ T7529] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 56.900694][ T7529] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 56.909108][ T7529] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 56.917761][ T7529] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 56.926017][ T7529] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.933088][ T7529] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.940832][ T7529] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 56.949353][ T7529] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 56.957622][ T7529] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.964661][ T7529] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.972136][ T7529] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 56.980849][ T7529] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 56.988451][ T7529] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 56.995947][ T7529] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 57.004103][ T7529] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 57.012300][ T7529] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 57.020409][ T7529] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 57.028029][ T7529] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 57.042514][ T7423] 8021q: adding VLAN 0 to HW filter on device team0 [ 57.057230][ T7416] 8021q: adding VLAN 0 to HW filter on device team0 [ 57.065040][ T3821] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 57.075912][ T3821] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 57.084621][ T3821] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 57.093147][ T3821] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 57.100779][ T3821] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 57.108384][ T3821] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 57.116642][ T3821] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 57.124882][ T3821] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 57.133298][ T3821] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 57.141925][ T3821] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.148996][ T3821] bridge0: port 1(bridge_slave_0) entered forwarding state [ 57.156375][ T3821] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 57.164848][ T3821] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 57.173610][ T3821] bridge0: port 2(bridge_slave_1) entered blocking state [ 57.180690][ T3821] bridge0: port 2(bridge_slave_1) entered forwarding state [ 57.188240][ T3821] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 57.196590][ T3821] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 57.204329][ T3821] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 57.217148][ T7417] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 57.217180][ T7417] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 57.237106][ T7420] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 57.259634][ T7420] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 57.329900][ T7422] device hsr_slave_0 entered promiscuous mode [ 57.408046][ T7422] device hsr_slave_1 entered promiscuous mode [ 57.447859][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 57.459206][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 57.467434][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 57.475732][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 57.484016][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 57.492823][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 57.501137][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.508207][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 57.515612][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 57.524090][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 57.532328][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 57.539512][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 57.546997][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 57.555421][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 57.563697][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 57.572184][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 57.580400][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 57.588915][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 57.597014][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 57.605474][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 57.614433][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 57.622549][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 57.630808][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 57.639520][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 57.647912][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.655043][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 57.662553][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 57.670950][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 57.679442][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 57.688142][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 57.695294][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 57.716650][ T7417] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 57.732582][ T7413] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 57.767705][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 57.775288][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 57.790973][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 57.804836][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 57.815128][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 57.829688][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 57.837255][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 57.849920][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 57.857368][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 57.867195][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 57.880636][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 57.890953][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 57.901847][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 57.911302][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 57.923254][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 57.941956][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 57.969868][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 57.990029][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 58.009458][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 58.021127][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 58.030901][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 58.042421][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 58.051904][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 58.069374][ T7420] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 58.073614][ T7423] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 58.114319][ T7416] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 58.132048][ T7416] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 58.165843][ T7423] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 58.186020][ T7576] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 58.196864][ T7576] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 58.216653][ T7576] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 58.225932][ T7576] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 58.239551][ T7576] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 58.251759][ T7576] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 58.270937][ T7576] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 58.290914][ T7576] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 58.310801][ T7576] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 58.330626][ T7576] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 58.367326][ T7416] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 58.391675][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 58.404029][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 58.444786][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 58.637978][ T7422] 8021q: adding VLAN 0 to HW filter on device bond0 [ 58.684925][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 58.685340][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 58.688740][ T7422] 8021q: adding VLAN 0 to HW filter on device team0 [ 58.691337][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 58.691737][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 58.692001][ T22] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.692027][ T22] bridge0: port 1(bridge_slave_0) entered forwarding state [ 58.692297][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 58.695402][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 58.695740][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 58.695965][ T22] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.696018][ T22] bridge0: port 2(bridge_slave_1) entered forwarding state [ 58.717400][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 58.725309][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 58.735876][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 58.736304][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 58.736632][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 58.743084][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 58.743477][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 58.745948][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 58.746249][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 58.752745][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 58.753074][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 58.755205][ T7422] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 58.765560][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 58.765628][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 58.776573][ T7422] 8021q: adding VLAN 0 to HW filter on device batadv0 2019/12/25 15:24:59 executed programs: 6 [ 63.827114][ T7914] ================================================================== [ 63.827139][ T7914] BUG: KASAN: use-after-free in fb_mode_is_equal+0x21c/0x2e0 [ 63.827144][ T7914] Read of size 4 at addr ffff888095c1309c by task syz-executor.0/7914 [ 63.827147][ T7914] [ 63.827155][ T7914] CPU: 0 PID: 7914 Comm: syz-executor.0 Not tainted 5.2.0-rc4-syzkaller #0 [ 63.827159][ T7914] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 63.827162][ T7914] Call Trace: [ 63.827173][ T7914] dump_stack+0x113/0x167 [ 63.827183][ T7914] print_address_description.cold.5+0x9/0x1ff [ 63.827187][ T7914] ? fb_mode_is_equal+0x21c/0x2e0 [ 63.827193][ T7914] __kasan_report.cold.6+0x1b/0x39 [ 63.827196][ T7914] ? fb_mode_is_equal+0x21c/0x2e0 [ 63.827202][ T7914] ? fb_mode_is_equal+0x21c/0x2e0 [ 63.827207][ T7914] kasan_report+0x12/0x20 [ 63.827213][ T7914] __asan_report_load4_noabort+0x14/0x20 [ 63.827217][ T7914] fb_mode_is_equal+0x21c/0x2e0 [ 63.827225][ T7914] fbcon_mode_deleted+0xe6/0x140 [ 63.827234][ T7914] fb_set_var+0x968/0xf40 [ 63.827243][ T7914] ? mark_held_locks+0x130/0x130 [ 63.827248][ T7914] ? fb_blank+0x1c0/0x1c0 [ 63.827257][ T7914] ? lock_acquire+0x173/0x3d0 [ 63.827261][ T7914] ? do_fb_ioctl+0x6a3/0x990 [ 63.827267][ T7914] ? do_fb_ioctl+0x6a3/0x990 [ 63.827287][ T7914] ? __down+0x18b/0x2b0 [ 63.827293][ T7914] ? down+0x4b/0x80 [ 63.827299][ T7914] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 63.827304][ T7914] ? down+0x4b/0x80 [ 63.827310][ T7914] ? lock_acquire+0x173/0x3d0 [ 63.827315][ T7914] ? do_fb_ioctl+0x695/0x990 [ 63.827326][ T7914] do_fb_ioctl+0x6ed/0x990 [ 63.827332][ T7914] ? fb_mmap+0x4c0/0x4c0 [ 63.827336][ T7914] ? find_held_lock+0x36/0x1d0 [ 63.827349][ T7914] ? debug_check_no_obj_freed+0x1ff/0x472 [ 63.827353][ T7914] ? lock_downgrade+0x860/0x860 [ 63.827360][ T7914] ? _raw_spin_unlock_irqrestore+0x63/0xd0 [ 63.827367][ T7914] ? find_held_lock+0x36/0x1d0 [ 63.827378][ T7914] ? tomoyo_path_number_perm+0x1e8/0x4c0 [ 63.827383][ T7914] ? lock_downgrade+0x860/0x860 [ 63.827391][ T7914] ? tomoyo_path_number_perm+0x3eb/0x4c0 [ 63.827414][ T7914] fb_ioctl+0xcb/0x150 [ 63.827421][ T7914] do_vfs_ioctl+0x196/0x10c0 [ 63.827429][ T7914] ? ioctl_preallocate+0x1c0/0x1c0 [ 63.827436][ T7914] ? __fget+0x2af/0x420 [ 63.827445][ T7914] ? ksys_dup3+0x2e0/0x2e0 [ 63.827451][ T7914] ? put_timespec64+0xa9/0x100 [ 63.827456][ T7914] ? nsecs_to_jiffies+0x20/0x20 [ 63.827464][ T7914] ? tomoyo_file_ioctl+0x14/0x20 [ 63.827472][ T7914] ksys_ioctl+0x62/0x90 [ 63.827476][ T7914] ? lockdep_hardirqs_on+0x424/0x5c0 [ 63.827482][ T7914] __x64_sys_ioctl+0x6e/0xb0 [ 63.827491][ T7914] do_syscall_64+0xd0/0x530 [ 63.827499][ T7914] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 63.827504][ T7914] RIP: 0033:0x45a919 [ 63.827510][ T7914] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 63.827513][ T7914] RSP: 002b:00007f80d38c4c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 63.827525][ T7914] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a919 [ 63.827527][ T7914] RDX: 0000000020000000 RSI: 0000000000004601 RDI: 0000000000000011 [ 63.827529][ T7914] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 63.827532][ T7914] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f80d38c56d4 [ 63.827535][ T7914] R13: 00000000004c310d R14: 00000000004d8498 R15: 00000000ffffffff [ 63.827546][ T7914] [ 63.827550][ T7914] Allocated by task 7645: [ 63.827555][ T7914] save_stack+0x21/0x90 [ 63.827559][ T7914] __kasan_kmalloc.constprop.12+0xc7/0xd0 [ 63.827562][ T7914] kasan_kmalloc+0x9/0x10 [ 63.827568][ T7914] kmem_cache_alloc_trace+0x154/0x740 [ 63.827571][ T7914] fb_add_videomode+0x22e/0x5c0 [ 63.827575][ T7914] fb_set_var+0x580/0xf40 [ 63.827579][ T7914] do_fb_ioctl+0x6ed/0x990 [ 63.827583][ T7914] fb_ioctl+0xcb/0x150 [ 63.827586][ T7914] do_vfs_ioctl+0x196/0x10c0 [ 63.827590][ T7914] ksys_ioctl+0x62/0x90 [ 63.827593][ T7914] __x64_sys_ioctl+0x6e/0xb0 [ 63.827597][ T7914] do_syscall_64+0xd0/0x530 [ 63.827601][ T7914] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 63.827603][ T7914] [ 63.827606][ T7914] Freed by task 7818: [ 63.827609][ T7914] save_stack+0x21/0x90 [ 63.827613][ T7914] __kasan_slab_free+0x102/0x150 [ 63.827615][ T7914] kasan_slab_free+0xe/0x10 [ 63.827619][ T7914] kfree+0xcf/0x220 [ 63.827622][ T7914] fb_delete_videomode+0x303/0x720 [ 63.827625][ T7914] fb_set_var+0x977/0xf40 [ 63.827628][ T7914] do_fb_ioctl+0x6ed/0x990 [ 63.827630][ T7914] fb_ioctl+0xcb/0x150 [ 63.827632][ T7914] do_vfs_ioctl+0x196/0x10c0 [ 63.827634][ T7914] ksys_ioctl+0x62/0x90 [ 63.827636][ T7914] __x64_sys_ioctl+0x6e/0xb0 [ 63.827639][ T7914] do_syscall_64+0xd0/0x530 [ 63.827642][ T7914] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 63.827643][ T7914] [ 63.827646][ T7914] The buggy address belongs to the object at ffff888095c13080 [ 63.827646][ T7914] which belongs to the cache kmalloc-96 of size 96 [ 63.827648][ T7914] The buggy address is located 28 bytes inside of [ 63.827648][ T7914] 96-byte region [ffff888095c13080, ffff888095c130e0) [ 63.827650][ T7914] The buggy address belongs to the page: [ 63.827653][ T7914] page:ffffea00025704c0 refcount:1 mapcount:0 mapping:ffff8880aa4004c0 index:0x0 [ 63.827657][ T7914] flags: 0xfffe0000000200(slab) [ 63.827662][ T7914] raw: 00fffe0000000200 ffffea000260c5c8 ffffea0002373988 ffff8880aa4004c0 [ 63.827665][ T7914] raw: 0000000000000000 ffff888095c13000 0000000100000020 0000000000000000 [ 63.827667][ T7914] page dumped because: kasan: bad access detected [ 63.827668][ T7914] [ 63.827670][ T7914] Memory state around the buggy address: [ 63.827672][ T7914] ffff888095c12f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 63.827674][ T7914] ffff888095c13000: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 63.827676][ T7914] >ffff888095c13080: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 63.827678][ T7914] ^ [ 63.827680][ T7914] ffff888095c13100: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 63.827682][ T7914] ffff888095c13180: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 63.827684][ T7914] ================================================================== [ 63.827685][ T7914] Disabling lock debugging due to kernel taint [ 63.827773][ T7914] Kernel panic - not syncing: panic_on_warn set ... [ 63.827778][ T7914] CPU: 0 PID: 7914 Comm: syz-executor.0 Tainted: G B 5.2.0-rc4-syzkaller #0 [ 63.827781][ T7914] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 63.827784][ T7914] Call Trace: [ 63.827790][ T7914] dump_stack+0x113/0x167 [ 63.827794][ T7914] ? fb_mode_is_equal+0x130/0x2e0 [ 63.827800][ T7914] panic+0x212/0x4cb [ 63.827804][ T7914] ? __warn_printk+0xd6/0xd6 [ 63.827811][ T7914] ? do_raw_spin_unlock+0x54/0x260 [ 63.827817][ T7914] ? fb_mode_is_equal+0x21c/0x2e0 [ 63.827821][ T7914] end_report+0x47/0x4f [ 63.827825][ T7914] __kasan_report.cold.6+0xe/0x39 [ 63.827828][ T7914] ? fb_mode_is_equal+0x21c/0x2e0 [ 63.827834][ T7914] ? fb_mode_is_equal+0x21c/0x2e0 [ 63.827838][ T7914] kasan_report+0x12/0x20 [ 63.827842][ T7914] __asan_report_load4_noabort+0x14/0x20 [ 63.827846][ T7914] fb_mode_is_equal+0x21c/0x2e0 [ 63.827850][ T7914] fbcon_mode_deleted+0xe6/0x140 [ 63.827856][ T7914] fb_set_var+0x968/0xf40 [ 63.827860][ T7914] ? mark_held_locks+0x130/0x130 [ 63.827865][ T7914] ? fb_blank+0x1c0/0x1c0 [ 63.827871][ T7914] ? lock_acquire+0x173/0x3d0 [ 63.827875][ T7914] ? do_fb_ioctl+0x6a3/0x990 [ 63.827879][ T7914] ? do_fb_ioctl+0x6a3/0x990 [ 63.827891][ T7914] ? __down+0x18b/0x2b0 [ 63.827896][ T7914] ? down+0x4b/0x80 [ 63.827900][ T7914] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 63.827904][ T7914] ? down+0x4b/0x80 [ 63.827908][ T7914] ? lock_acquire+0x173/0x3d0 [ 63.827912][ T7914] ? do_fb_ioctl+0x695/0x990 [ 63.827920][ T7914] do_fb_ioctl+0x6ed/0x990 [ 63.827924][ T7914] ? fb_mmap+0x4c0/0x4c0 [ 63.827928][ T7914] ? find_held_lock+0x36/0x1d0 [ 63.827936][ T7914] ? debug_check_no_obj_freed+0x1ff/0x472 [ 63.827939][ T7914] ? lock_downgrade+0x860/0x860 [ 63.827944][ T7914] ? _raw_spin_unlock_irqrestore+0x63/0xd0 [ 63.827949][ T7914] ? find_held_lock+0x36/0x1d0 [ 63.827957][ T7914] ? tomoyo_path_number_perm+0x1e8/0x4c0 [ 63.827960][ T7914] ? lock_downgrade+0x860/0x860 [ 63.827964][ T7914] ? tomoyo_path_number_perm+0x3eb/0x4c0 [ 63.827974][ T7914] fb_ioctl+0xcb/0x150 [ 63.827977][ T7914] do_vfs_ioctl+0x196/0x10c0 [ 63.827980][ T7914] ? ioctl_preallocate+0x1c0/0x1c0 [ 63.827984][ T7914] ? __fget+0x2af/0x420 [ 63.827988][ T7914] ? ksys_dup3+0x2e0/0x2e0 [ 63.827991][ T7914] ? put_timespec64+0xa9/0x100 [ 63.827994][ T7914] ? nsecs_to_jiffies+0x20/0x20 [ 63.828001][ T7914] ? tomoyo_file_ioctl+0x14/0x20 [ 63.828006][ T7914] ksys_ioctl+0x62/0x90 [ 63.828009][ T7914] ? lockdep_hardirqs_on+0x424/0x5c0 [ 63.828013][ T7914] __x64_sys_ioctl+0x6e/0xb0 [ 63.828018][ T7914] do_syscall_64+0xd0/0x530 [ 63.828023][ T7914] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 63.828026][ T7914] RIP: 0033:0x45a919 [ 63.828029][ T7914] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 63.828032][ T7914] RSP: 002b:00007f80d38c4c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 63.828036][ T7914] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a919 [ 63.828038][ T7914] RDX: 0000000020000000 RSI: 0000000000004601 RDI: 0000000000000011 [ 63.828040][ T7914] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 63.828042][ T7914] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f80d38c56d4 [ 63.828045][ T7914] R13: 00000000004c310d R14: 00000000004d8498 R15: 00000000ffffffff [ 63.829702][ T7914] Kernel Offset: disabled