Debian GNU/Linux 9 syzkaller ttyS0 syzkaller login: [ 32.065700] audit: type=1400 audit(1589979311.999:8): avc: denied { execmem } for pid=6298 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 32.340365] IPVS: ftp: loaded support on port[0] = 21 [ 33.563583] can: request_module (can-proto-0) failed. [ 33.572679] can: request_module (can-proto-0) failed. [ 33.581960] can: request_module (can-proto-0) failed. [ 33.607312] audit: type=1400 audit(1589979313.539:9): avc: denied { create } for pid=6275 comm="syz-fuzzer" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dccp_socket permissive=1 Warning: Permanently added '10.128.15.207' (ECDSA) to the list of known hosts. 2020/05/20 12:55:20 parsed 1 programs 2020/05/20 12:55:21 executed programs: 0 [ 41.147881] audit: type=1400 audit(1589979321.093:10): avc: denied { execmem } for pid=6414 comm="syz-executor.2" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 41.436409] IPVS: ftp: loaded support on port[0] = 21 [ 42.224625] IPVS: ftp: loaded support on port[0] = 21 [ 42.282796] chnl_net:caif_netlink_parms(): no params data found [ 42.324479] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.331580] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.340923] device bridge_slave_0 entered promiscuous mode [ 42.341078] IPVS: ftp: loaded support on port[0] = 21 [ 42.349587] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.358198] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.366412] device bridge_slave_1 entered promiscuous mode [ 42.384504] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 42.395764] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 42.421445] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 42.429140] team0: Port device team_slave_0 added [ 42.461363] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 42.473600] team0: Port device team_slave_1 added [ 42.486954] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 42.493911] chnl_net:caif_netlink_parms(): no params data found [ 42.518475] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 42.539677] IPVS: ftp: loaded support on port[0] = 21 [ 42.587539] device hsr_slave_0 entered promiscuous mode [ 42.635564] device hsr_slave_1 entered promiscuous mode [ 42.686671] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 42.693726] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 42.732212] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.738682] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.745786] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.752159] bridge0: port 1(bridge_slave_0) entered forwarding state [ 42.767503] IPVS: ftp: loaded support on port[0] = 21 [ 42.773780] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.781018] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.788033] device bridge_slave_0 entered promiscuous mode [ 42.796757] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.803128] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.810132] device bridge_slave_1 entered promiscuous mode [ 42.874179] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 42.901091] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 42.944174] chnl_net:caif_netlink_parms(): no params data found [ 42.981868] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 42.989859] team0: Port device team_slave_0 added [ 42.997426] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 43.006500] team0: Port device team_slave_1 added [ 43.013914] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 43.022152] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 43.030347] chnl_net:caif_netlink_parms(): no params data found [ 43.057631] IPVS: ftp: loaded support on port[0] = 21 [ 43.108607] device hsr_slave_0 entered promiscuous mode [ 43.135409] device hsr_slave_1 entered promiscuous mode [ 43.176429] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 43.183584] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 43.220098] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.226582] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.233359] device bridge_slave_0 entered promiscuous mode [ 43.253500] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.259903] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.267967] device bridge_slave_0 entered promiscuous mode [ 43.286501] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.292846] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.300729] device bridge_slave_1 entered promiscuous mode [ 43.312971] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.319671] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.327155] device bridge_slave_1 entered promiscuous mode [ 43.367023] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 43.373100] 8021q: adding VLAN 0 to HW filter on device bond0 [ 43.392581] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.400159] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.407779] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 43.430447] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 43.444160] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 43.453252] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 43.465389] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 43.473483] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 43.493330] chnl_net:caif_netlink_parms(): no params data found [ 43.507935] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 43.520828] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 43.528023] team0: Port device team_slave_0 added [ 43.539788] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 43.546967] team0: Port device team_slave_0 added [ 43.557567] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 43.566414] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 43.573496] team0: Port device team_slave_1 added [ 43.579428] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 43.587217] team0: Port device team_slave_1 added [ 43.592561] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 43.600703] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 43.607846] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 43.619775] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 43.626069] 8021q: adding VLAN 0 to HW filter on device team0 [ 43.638179] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 43.647705] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 43.654795] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 43.737241] device hsr_slave_0 entered promiscuous mode [ 43.755165] device hsr_slave_1 entered promiscuous mode [ 43.795598] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 43.802938] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 43.816066] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 43.822727] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.829511] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.836678] device bridge_slave_0 entered promiscuous mode [ 43.844389] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.851031] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.858510] device bridge_slave_1 entered promiscuous mode [ 43.865322] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 43.873205] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 43.881489] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.887864] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.897130] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 43.939211] device hsr_slave_0 entered promiscuous mode [ 43.975275] device hsr_slave_1 entered promiscuous mode [ 44.035771] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 44.043551] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 44.052358] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.058743] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.068509] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 44.081057] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 44.094151] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 44.103364] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 44.115872] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 44.123768] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 44.134374] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 44.143490] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 44.157314] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 44.166467] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 44.225895] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 44.232965] team0: Port device team_slave_0 added [ 44.239540] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 44.247548] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 44.255637] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 44.263399] chnl_net:caif_netlink_parms(): no params data found [ 44.279422] 8021q: adding VLAN 0 to HW filter on device bond0 [ 44.286198] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 44.293275] team0: Port device team_slave_1 added [ 44.300408] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 44.309341] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 44.323738] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 44.337790] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 44.344102] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 44.352942] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 44.361258] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 44.370940] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 44.395293] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 44.402662] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 44.411314] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 44.477031] device hsr_slave_0 entered promiscuous mode [ 44.535252] device hsr_slave_1 entered promiscuous mode [ 44.584891] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 44.591828] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 44.600964] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 44.609948] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 44.620212] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 44.633261] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 44.639736] 8021q: adding VLAN 0 to HW filter on device team0 [ 44.646760] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 44.654517] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 44.664101] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 44.679069] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 44.687204] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 44.697759] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.704075] bridge0: port 1(bridge_slave_0) entered forwarding state [ 44.710914] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 44.718965] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 44.726534] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.732862] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.739763] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 44.747156] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 44.757803] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.764128] bridge0: port 1(bridge_slave_0) entered disabled state [ 44.771544] device bridge_slave_0 entered promiscuous mode [ 44.779242] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 44.785587] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 44.796444] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.802770] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.810728] device bridge_slave_1 entered promiscuous mode [ 44.824029] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 44.836742] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 44.846491] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 44.862588] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 44.870676] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 44.880918] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 44.890169] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 44.902139] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 44.917864] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 44.926077] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 44.933586] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 44.941293] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 44.951161] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 44.964384] 8021q: adding VLAN 0 to HW filter on device bond0 [ 44.977322] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 44.983962] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 44.991990] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 45.002331] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 45.012319] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 45.026410] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 45.034333] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 45.044728] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 45.053586] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 45.063500] 8021q: adding VLAN 0 to HW filter on device bond0 [ 45.073173] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 45.081150] team0: Port device team_slave_0 added [ 45.088524] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 45.095950] team0: Port device team_slave_1 added [ 45.101069] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 45.108811] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 45.116605] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 45.123921] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 45.132975] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 45.139309] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 45.148218] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 45.157275] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 45.163352] 8021q: adding VLAN 0 to HW filter on device team0 [ 45.170304] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 45.179479] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 45.198867] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 45.206692] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 45.213420] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 45.226260] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 45.238218] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 45.246451] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 45.253947] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.260330] bridge0: port 1(bridge_slave_0) entered forwarding state [ 45.329296] device hsr_slave_0 entered promiscuous mode [ 45.364872] device hsr_slave_1 entered promiscuous mode [ 45.415119] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 45.440804] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 45.449060] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 45.451172] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 45.451530] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 45.451802] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 45.452042] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.452076] bridge0: port 2(bridge_slave_1) entered forwarding state [ 45.452563] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 45.457134] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 45.457493] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 45.457752] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 45.462207] 8021q: adding VLAN 0 to HW filter on device bond0 [ 45.463981] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 45.469361] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 45.474192] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 45.570838] 8021q: adding VLAN 0 to HW filter on device team0 [ 45.577063] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 45.583940] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 45.595823] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 45.604430] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 45.606716] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 45.607915] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 45.609894] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 45.609899] 8021q: adding VLAN 0 to HW filter on device team0 [ 45.611705] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 45.613613] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 45.621103] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 45.625299] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 45.625752] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 45.626062] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 45.626346] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.626376] bridge0: port 1(bridge_slave_0) entered forwarding state [ 45.626625] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 45.626895] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 45.627180] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 45.627440] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 45.627658] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.627681] bridge0: port 1(bridge_slave_0) entered forwarding state [ 45.627922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 45.628196] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 45.628416] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.628440] bridge0: port 2(bridge_slave_1) entered forwarding state [ 45.628779] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 45.629062] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 45.800043] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 45.818848] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 45.820567] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 45.822199] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 45.823879] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 45.824502] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 45.824810] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 45.867129] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.873477] bridge0: port 2(bridge_slave_1) entered forwarding state [ 45.881539] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 45.881987] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 45.882371] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 45.882734] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 45.883109] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 45.884934] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 45.929058] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 45.940400] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 45.942597] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 45.942708] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 45.942995] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 45.943302] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 45.943566] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 45.943842] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 45.944096] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 45.944484] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 45.950202] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 45.952270] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 45.962533] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 45.965401] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 45.966091] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 45.966660] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 45.966989] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 45.967235] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 45.967450] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 45.967675] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 45.967968] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 45.968274] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 45.968493] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 45.972391] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 45.972590] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 45.972867] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 45.977995] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 45.990722] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 45.991393] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 45.991792] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 45.992141] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 45.992689] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 45.993547] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 45.993563] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 45.997748] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 46.000030] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 46.001109] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 46.001125] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 46.003006] 8021q: adding VLAN 0 to HW filter on device bond0 [ 46.261079] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 46.261418] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 46.261640] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 46.261872] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 46.262084] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 46.267668] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 46.268638] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 46.272273] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 46.275259] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 46.275275] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 46.278901] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 46.295612] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 46.297671] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 46.297750] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 46.297806] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 46.297867] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 46.302071] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 46.414047] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 46.430289] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 46.431407] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 46.439426] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 46.458347] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 46.460310] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 46.460315] 8021q: adding VLAN 0 to HW filter on device team0 [ 46.462110] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 46.463828] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 46.465426] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 46.465476] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 46.465520] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 46.465725] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 46.465924] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 46.466108] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 46.466274] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.466292] bridge0: port 1(bridge_slave_0) entered forwarding state [ 46.467276] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 46.467467] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 46.467624] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.467641] bridge0: port 2(bridge_slave_1) entered forwarding state [ 46.468435] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 46.472383] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 46.472702] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 46.476778] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 46.476823] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 46.483548] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 46.640640] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 46.641065] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 46.641396] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 46.650045] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 46.650806] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 46.651178] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 46.653558] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready 2020/05/20 12:55:26 executed programs: 11 [ 46.653737] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 46.654052] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 46.658958] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 46.660236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 46.660526] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 46.663608] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 46.755016] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 46.786007] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 46.813749] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 46.813824] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 46.813887] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 46.821137] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 48.577246] ================================================================== [ 48.577272] BUG: KASAN: slab-out-of-bounds in fbcon_get_font+0x21c/0x570 [ 48.577276] Read of size 5 at addr ffff8880a859774c by task syz-executor.1/7522 [ 48.577279] [ 48.577285] CPU: 0 PID: 7522 Comm: syz-executor.1 Not tainted 4.14.181-syzkaller #0 [ 48.577288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 48.577290] Call Trace: [ 48.577299] dump_stack+0xf7/0x13b [ 48.577305] ? fbcon_get_font+0x21c/0x570 [ 48.577313] print_address_description.cold.7+0x9/0x1c9 [ 48.577318] ? fbcon_get_font+0x21c/0x570 [ 48.577324] kasan_report.cold.8+0x11a/0x2d3 [ 48.577331] check_memory_region+0x13e/0x1b0 [ 48.577336] memcpy+0x23/0x50 [ 48.577342] fbcon_get_font+0x21c/0x570 [ 48.577352] con_font_op+0x75c/0x1020 [ 48.577360] ? _raw_spin_unlock_irqrestore+0x53/0xd0 [ 48.577367] ? con_write+0x80/0x80 [ 48.577381] ? selinux_capable+0x1b/0x20 [ 48.577386] ? security_capable+0x6f/0xa0 [ 48.577395] ? ns_capable_common+0xa8/0x110 [ 48.577402] vt_ioctl+0xfa8/0x21f0 [ 48.577408] ? find_held_lock+0x36/0x1d0 [ 48.577413] ? complete_change_console+0x300/0x300 [ 48.577422] ? avc_has_extended_perms+0x477/0x1100 [ 48.577427] ? lock_downgrade+0x7f0/0x7f0 [ 48.577443] ? do_futex+0x591/0x17f0 [ 48.577451] tty_ioctl+0x434/0x1260 [ 48.577455] ? avc_ss_reset+0xd0/0xd0 [ 48.577461] ? tty_vhangup+0x20/0x20 [ 48.577466] ? __lock_acquire+0x6a4/0x4500 [ 48.577472] ? trace_hardirqs_on+0x10/0x10 [ 48.577477] ? trace_hardirqs_off+0x10/0x10 [ 48.577496] ? __might_sleep+0x93/0xb0 [ 48.577508] do_vfs_ioctl+0x180/0xfb0 [ 48.577513] ? __fget+0x1ad/0x2f0 [ 48.577520] ? ioctl_preallocate+0x1a0/0x1a0 [ 48.577529] ? __fget+0x1ca/0x2f0 [ 48.577538] ? security_file_ioctl+0x6a/0xa0 [ 48.577542] ? SyS_clock_settime+0x1a0/0x1a0 [ 48.577546] ? security_file_ioctl+0x6a/0xa0 [ 48.577551] SyS_ioctl+0x74/0x80 [ 48.577557] ? do_vfs_ioctl+0xfb0/0xfb0 [ 48.577564] do_syscall_64+0x1c7/0x5b0 [ 48.577569] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 48.577577] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 48.577582] RIP: 0033:0x45a909 [ 48.577586] RSP: 002b:00007ff25b181c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 48.577592] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a909 [ 48.577595] RDX: 0000000020000140 RSI: 0000000000004b60 RDI: 0000000000000003 [ 48.577598] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 48.577602] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff25b1826d4 [ 48.577604] R13: 00000000004c7019 R14: 00000000004dd688 R15: 00000000ffffffff [ 48.577616] [ 48.577619] Allocated by task 7513: [ 48.577625] save_stack_trace+0x16/0x20 [ 48.577629] save_stack+0x43/0xd0 [ 48.577632] kasan_kmalloc+0xc7/0xe0 [ 48.577636] __kmalloc+0x15b/0x7b0 [ 48.577640] fbcon_set_font+0x2c9/0x840 [ 48.577644] con_font_op+0xb6f/0x1020 [ 48.577647] vt_ioctl+0xfa8/0x21f0 [ 48.577651] tty_ioctl+0x434/0x1260 [ 48.577655] do_vfs_ioctl+0x180/0xfb0 [ 48.577659] SyS_ioctl+0x74/0x80 [ 48.577662] do_syscall_64+0x1c7/0x5b0 [ 48.577666] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 48.577668] [ 48.577671] Freed by task 0: [ 48.577673] (stack is not available) [ 48.577674] [ 48.577678] The buggy address belongs to the object at ffff8880a8597340 [ 48.577678] which belongs to the cache kmalloc-2048 of size 2048 [ 48.577681] The buggy address is located 1036 bytes inside of [ 48.577681] 2048-byte region [ffff8880a8597340, ffff8880a8597b40) [ 48.577684] The buggy address belongs to the page: [ 48.577688] page:ffffea0002a16580 count:1 mapcount:0 mapping:ffff8880a8596240 index:0x0 compound_mapcount: 0 [ 48.577695] flags: 0xfffe0000008100(slab|head) [ 48.577702] raw: 00fffe0000008100 ffff8880a8596240 0000000000000000 0000000100000003 [ 48.577706] raw: ffffea0002121da0 ffffea00021c25a0 ffff8880aa800c40 0000000000000000 [ 48.577709] page dumped because: kasan: bad access detected [ 48.577711] [ 48.577713] Memory state around the buggy address: [ 48.577717] ffff8880a8597600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 48.577721] ffff8880a8597680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 48.577725] >ffff8880a8597700: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc [ 48.577727] ^ [ 48.577731] ffff8880a8597780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.577734] ffff8880a8597800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.577736] ================================================================== [ 48.577738] Disabling lock debugging due to kernel taint [ 48.577755] Kernel panic - not syncing: panic_on_warn set ... [ 48.577755] [ 48.577759] CPU: 0 PID: 7522 Comm: syz-executor.1 Tainted: G B 4.14.181-syzkaller #0 [ 48.577761] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 48.577763] Call Trace: [ 48.577768] dump_stack+0xf7/0x13b [ 48.577772] ? fbcon_get_font+0x21c/0x570 [ 48.577776] panic+0x1b0/0x358 [ 48.577780] ? add_taint.cold.5+0x11/0x11 [ 48.577786] ? fbcon_get_font+0x21c/0x570 [ 48.577790] kasan_end_report+0x47/0x4f [ 48.577794] kasan_report.cold.8+0x76/0x2d3 [ 48.577798] check_memory_region+0x13e/0x1b0 [ 48.577802] memcpy+0x23/0x50 [ 48.577805] fbcon_get_font+0x21c/0x570 [ 48.577811] con_font_op+0x75c/0x1020 [ 48.577815] ? _raw_spin_unlock_irqrestore+0x53/0xd0 [ 48.577819] ? con_write+0x80/0x80 [ 48.577825] ? selinux_capable+0x1b/0x20 [ 48.577828] ? security_capable+0x6f/0xa0 [ 48.577841] ? ns_capable_common+0xa8/0x110 [ 48.577846] vt_ioctl+0xfa8/0x21f0 [ 48.577849] ? find_held_lock+0x36/0x1d0 [ 48.577853] ? complete_change_console+0x300/0x300 [ 48.577859] ? avc_has_extended_perms+0x477/0x1100 [ 48.577863] ? lock_downgrade+0x7f0/0x7f0 [ 48.577875] ? do_futex+0x591/0x17f0 [ 48.577880] tty_ioctl+0x434/0x1260 [ 48.577884] ? avc_ss_reset+0xd0/0xd0 [ 48.577888] ? tty_vhangup+0x20/0x20 [ 48.577892] ? __lock_acquire+0x6a4/0x4500 [ 48.577896] ? trace_hardirqs_on+0x10/0x10 [ 48.577900] ? trace_hardirqs_off+0x10/0x10 [ 48.577912] ? __might_sleep+0x93/0xb0 [ 48.577917] do_vfs_ioctl+0x180/0xfb0 [ 48.577921] ? __fget+0x1ad/0x2f0 [ 48.577926] ? ioctl_preallocate+0x1a0/0x1a0 [ 48.577931] ? __fget+0x1ca/0x2f0 [ 48.577936] ? security_file_ioctl+0x6a/0xa0 [ 48.577939] ? SyS_clock_settime+0x1a0/0x1a0 [ 48.577942] ? security_file_ioctl+0x6a/0xa0 [ 48.577947] SyS_ioctl+0x74/0x80 [ 48.577951] ? do_vfs_ioctl+0xfb0/0xfb0 [ 48.577954] do_syscall_64+0x1c7/0x5b0 [ 48.577958] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 48.577963] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 48.577967] RIP: 0033:0x45a909 [ 48.577969] RSP: 002b:00007ff25b181c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 48.577973] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a909 [ 48.577976] RDX: 0000000020000140 RSI: 0000000000004b60 RDI: 0000000000000003 [ 48.577978] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 48.577980] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff25b1826d4 [ 48.577983] R13: 00000000004c7019 R14: 00000000004dd688 R15: 00000000ffffffff [ 48.579071] Kernel Offset: disabled