Warning: Permanently added '10.128.0.191' (ECDSA) to the list of known hosts. 2020/06/17 20:04:47 parsed 1 programs 2020/06/17 20:04:48 executed programs: 0 [ 49.735433][ T27] audit: type=1400 audit(1592424288.830:10): avc: denied { execmem } for pid=6906 comm="syz-executor.3" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 49.803729][ T6908] IPVS: ftp: loaded support on port[0] = 21 [ 49.832300][ T6910] IPVS: ftp: loaded support on port[0] = 21 [ 49.855434][ T6915] IPVS: ftp: loaded support on port[0] = 21 [ 49.856507][ T6912] IPVS: ftp: loaded support on port[0] = 21 [ 49.869979][ T6914] IPVS: ftp: loaded support on port[0] = 21 [ 49.948368][ T6917] IPVS: ftp: loaded support on port[0] = 21 [ 50.198678][ T6908] chnl_net:caif_netlink_parms(): no params data found [ 50.223497][ T6912] chnl_net:caif_netlink_parms(): no params data found [ 50.254997][ T6910] chnl_net:caif_netlink_parms(): no params data found [ 50.276272][ T6915] chnl_net:caif_netlink_parms(): no params data found [ 50.347353][ T6908] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.356427][ T6908] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.365323][ T6908] device bridge_slave_0 entered promiscuous mode [ 50.377321][ T6914] chnl_net:caif_netlink_parms(): no params data found [ 50.413841][ T6908] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.421153][ T6908] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.428651][ T6908] device bridge_slave_1 entered promiscuous mode [ 50.464562][ T6915] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.473886][ T6915] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.482663][ T6915] device bridge_slave_0 entered promiscuous mode [ 50.502816][ T6908] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 50.523069][ T6915] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.531131][ T6915] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.540730][ T6915] device bridge_slave_1 entered promiscuous mode [ 50.568090][ T6908] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 50.609615][ T6910] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.617479][ T6910] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.625432][ T6910] device bridge_slave_0 entered promiscuous mode [ 50.633920][ T6912] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.641957][ T6912] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.654513][ T6912] device bridge_slave_0 entered promiscuous mode [ 50.667981][ T6912] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.675274][ T6912] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.683490][ T6912] device bridge_slave_1 entered promiscuous mode [ 50.695868][ T6914] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.705950][ T6914] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.714840][ T6914] device bridge_slave_0 entered promiscuous mode [ 50.725906][ T6914] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.734302][ T6914] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.742307][ T6914] device bridge_slave_1 entered promiscuous mode [ 50.749967][ T6910] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.757040][ T6910] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.765063][ T6910] device bridge_slave_1 entered promiscuous mode [ 50.787396][ T6915] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 50.807499][ T6908] team0: Port device team_slave_0 added [ 50.824759][ T6912] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 50.836019][ T6915] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 50.846677][ T6917] chnl_net:caif_netlink_parms(): no params data found [ 50.857120][ T6908] team0: Port device team_slave_1 added [ 50.885568][ T6910] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 50.896564][ T6912] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 50.950996][ T6908] device hsr_slave_0 entered promiscuous mode [ 51.000153][ T6908] device hsr_slave_1 entered promiscuous mode [ 51.060702][ T6914] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 51.071247][ T6910] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 51.095529][ T6915] team0: Port device team_slave_0 added [ 51.103096][ T6914] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 51.127876][ T6910] team0: Port device team_slave_0 added [ 51.138316][ T6912] team0: Port device team_slave_0 added [ 51.146135][ T6915] team0: Port device team_slave_1 added [ 51.162920][ T6910] team0: Port device team_slave_1 added [ 51.183099][ T6912] team0: Port device team_slave_1 added [ 51.222047][ T6914] team0: Port device team_slave_0 added [ 51.271218][ T6912] device hsr_slave_0 entered promiscuous mode [ 51.299333][ T6912] device hsr_slave_1 entered promiscuous mode [ 51.349039][ T6912] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 51.356772][ T6912] Cannot create hsr debugfs directory [ 51.367421][ T6914] team0: Port device team_slave_1 added [ 51.431438][ T6915] device hsr_slave_0 entered promiscuous mode [ 51.449509][ T6915] device hsr_slave_1 entered promiscuous mode [ 51.489987][ T6915] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 51.497818][ T6915] Cannot create hsr debugfs directory [ 51.504195][ T6917] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.511521][ T6917] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.519496][ T6917] device bridge_slave_0 entered promiscuous mode [ 51.531149][ T6917] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.538216][ T6917] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.546979][ T6917] device bridge_slave_1 entered promiscuous mode [ 51.611730][ T6910] device hsr_slave_0 entered promiscuous mode [ 51.639079][ T6910] device hsr_slave_1 entered promiscuous mode [ 51.688799][ T6910] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 51.697816][ T6910] Cannot create hsr debugfs directory [ 51.718395][ T6917] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 51.781590][ T6914] device hsr_slave_0 entered promiscuous mode [ 51.819217][ T6914] device hsr_slave_1 entered promiscuous mode [ 51.858681][ T6914] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 51.866260][ T6914] Cannot create hsr debugfs directory [ 51.882510][ T6917] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 51.916903][ T6908] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 51.955320][ T6908] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 52.003600][ T6908] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 52.053466][ T6917] team0: Port device team_slave_0 added [ 52.065539][ T6917] team0: Port device team_slave_1 added [ 52.072151][ T6908] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 52.126594][ T6912] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 52.174279][ T6912] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 52.245962][ T6912] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 52.315362][ T6912] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 52.411773][ T6917] device hsr_slave_0 entered promiscuous mode [ 52.468875][ T6917] device hsr_slave_1 entered promiscuous mode [ 52.508534][ T6917] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 52.516248][ T6917] Cannot create hsr debugfs directory [ 52.583601][ T6915] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 52.625629][ T6915] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 52.680817][ T6915] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 52.743026][ T6915] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 52.830949][ T6910] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 52.876994][ T6910] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 52.931161][ T6910] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 52.980556][ T6910] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 53.053009][ T6912] 8021q: adding VLAN 0 to HW filter on device bond0 [ 53.063722][ T6914] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 53.105717][ T6917] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 53.179369][ T6914] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 53.223056][ T6914] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 53.270636][ T2670] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 53.283189][ T2670] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 53.291889][ T6917] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 53.360107][ T6917] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 53.421309][ T6912] 8021q: adding VLAN 0 to HW filter on device team0 [ 53.433552][ T6914] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 53.490877][ T6917] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 53.537346][ T6908] 8021q: adding VLAN 0 to HW filter on device bond0 [ 53.546769][ T2670] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 53.556267][ T2670] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 53.565024][ T2670] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.572980][ T2670] bridge0: port 1(bridge_slave_0) entered forwarding state [ 53.619991][ T2675] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 53.627877][ T2675] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 53.637733][ T2675] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 53.646517][ T2675] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.653810][ T2675] bridge0: port 2(bridge_slave_1) entered forwarding state [ 53.662137][ T2675] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 53.670977][ T2675] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 53.679967][ T2675] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 53.689863][ T2675] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 53.698847][ T2675] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 53.707409][ T2675] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 53.725148][ T6908] 8021q: adding VLAN 0 to HW filter on device team0 [ 53.747131][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 53.754972][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 53.764979][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 53.773443][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 53.782518][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 53.791515][ T2677] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.798930][ T2677] bridge0: port 1(bridge_slave_0) entered forwarding state [ 53.816647][ T6910] 8021q: adding VLAN 0 to HW filter on device bond0 [ 53.831296][ T6915] 8021q: adding VLAN 0 to HW filter on device bond0 [ 53.852663][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 53.860834][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 53.870371][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 53.879744][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 53.889474][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 53.897879][ T2677] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.904986][ T2677] bridge0: port 2(bridge_slave_1) entered forwarding state [ 53.912775][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 53.932557][ T6912] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 53.948579][ T6912] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 53.963499][ T6915] 8021q: adding VLAN 0 to HW filter on device team0 [ 53.977894][ T2675] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 53.987300][ T2675] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 53.996334][ T2675] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 54.005323][ T2675] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 54.013507][ T2675] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 54.021523][ T2675] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 54.031065][ T2675] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 54.040092][ T2675] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 54.086296][ T6917] 8021q: adding VLAN 0 to HW filter on device bond0 [ 54.098604][ T2655] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 54.107523][ T2655] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 54.129706][ T2655] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 54.147855][ T2655] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 54.165164][ T6914] 8021q: adding VLAN 0 to HW filter on device bond0 [ 54.191966][ T6908] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 54.206800][ T6908] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 54.231942][ T6912] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 54.254064][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 54.263772][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 54.275120][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 54.283133][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 54.291015][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 54.299807][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 54.309397][ T2677] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.316432][ T2677] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.324970][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 54.334262][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 54.342891][ T2677] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.350030][ T2677] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.357774][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 54.366307][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 54.380410][ T2675] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 54.388986][ T2675] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 54.424682][ T6910] 8021q: adding VLAN 0 to HW filter on device team0 [ 54.433951][ T6917] 8021q: adding VLAN 0 to HW filter on device team0 [ 54.441934][ T2675] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 54.451757][ T2675] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 54.460336][ T2675] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 54.473713][ T2675] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 54.484739][ T6914] 8021q: adding VLAN 0 to HW filter on device team0 [ 54.520848][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 54.539667][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 54.543576][ T7872] ================================================================== [ 54.555937][ T7872] BUG: KASAN: slab-out-of-bounds in bacpy+0xe/0x10 [ 54.562435][ T7872] Read of size 6 at addr ffff8880a6f04608 by task kworker/u5:1/7872 [ 54.565805][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 54.570582][ T7872] [ 54.570593][ T7872] CPU: 1 PID: 7872 Comm: kworker/u5:1 Not tainted 5.8.0-rc1-syzkaller #0 [ 54.570597][ T7872] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 54.570607][ T7872] Workqueue: hci0 hci_rx_work [ 54.570612][ T7872] Call Trace: [ 54.570623][ T7872] dump_stack+0x134/0x187 [ 54.570633][ T7872] ? bacpy+0xe/0x10 [ 54.570645][ T7872] print_address_description.constprop.9.cold.11+0x9/0x41c [ 54.570659][ T7872] ? bacpy+0xe/0x10 [ 54.570664][ T7872] ? bacpy+0xe/0x10 [ 54.570670][ T7872] kasan_report.cold.12+0x20/0x37 [ 54.570678][ T7872] ? bacpy+0xe/0x10 [ 54.570686][ T7872] check_memory_region+0x1cc/0x1f0 [ 54.570693][ T7872] memcpy+0x23/0x60 [ 54.570700][ T7872] bacpy+0xe/0x10 [ 54.570706][ T7872] hci_event_packet+0x334a/0x985e [ 54.570725][ T7872] ? hci_cmd_complete_evt+0xb900/0xb900 [ 54.570736][ T7872] ? stack_trace_save+0x82/0xb0 [ 54.570744][ T7872] ? stack_trace_consume_entry+0x170/0x170 [ 54.570751][ T7872] ? unwind_next_frame+0x3e/0x50 [ 54.570763][ T7872] ? save_trace+0x4d/0x940 [ 54.570773][ T7872] ? __kasan_check_write+0x14/0x20 [ 54.570779][ T7872] ? lockdep_unlock+0x115/0x1b0 [ 54.570786][ T7872] ? __lock_acquire+0x2fa5/0x4110 [ 54.570806][ T7872] ? lockdep_hardirqs_on_prepare+0x590/0x590 [ 54.570811][ T7872] ? lockdep_unlock+0x115/0x1b0 [ 54.570820][ T7872] ? find_held_lock+0x36/0x1d0 [ 54.570826][ T7872] ? __kasan_check_read+0x11/0x20 [ 54.570832][ T7872] ? mark_lock+0xbf/0x630 [ 54.570843][ T7872] ? mark_held_locks+0xb8/0x130 [ 54.570850][ T7872] ? do_raw_spin_lock+0x129/0x2e0 [ 54.570862][ T7872] ? _raw_spin_unlock_irqrestore+0x7d/0xd0 [ 54.570871][ T7872] ? skb_dequeue+0x14d/0x1f0 [ 54.570879][ T7872] ? trace_hardirqs_on+0x31/0x1b0 [ 54.570892][ T7872] ? __kasan_check_read+0x11/0x20 [ 54.570902][ T7872] hci_rx_work+0x18e/0x950 [ 54.570911][ T7872] ? rcu_read_lock_any_held.part.13+0x50/0x50 [ 54.570916][ T7872] ? trace_hardirqs_on+0x31/0x1b0 [ 54.570931][ T7872] process_one_work+0x893/0x1680 [ 54.570949][ T7872] ? pwq_dec_nr_in_flight+0x2c0/0x2c0 [ 54.570954][ T7872] ? rcu_read_lock_held+0x9c/0xb0 [ 54.570973][ T7872] worker_thread+0x85/0xb60 [ 54.570979][ T7872] ? __kthread_parkme+0x37/0x1c0 [ 54.570991][ T7872] ? process_one_work+0x1680/0x1680 [ 54.570998][ T7872] kthread+0x383/0x460 [ 54.571004][ T7872] ? kthread_mod_delayed_work+0x190/0x190 [ 54.571013][ T7872] ret_from_fork+0x1f/0x30 [ 54.571030][ T7872] [ 54.571034][ T7872] Allocated by task 7868: [ 54.571040][ T7872] save_stack+0x21/0x50 [ 54.571046][ T7872] __kasan_kmalloc.constprop.18+0xc7/0xd0 [ 54.571051][ T7872] kasan_kmalloc+0x9/0x10 [ 54.571056][ T7872] __kmalloc_node_track_caller+0x4d/0x70 [ 54.571061][ T7872] __kmalloc_reserve.isra.51+0x2c/0xc0 [ 54.571066][ T7872] __alloc_skb+0xd7/0x570 [ 54.571073][ T7872] vhci_write+0xa8/0x3e0 [ 54.571079][ T7872] new_sync_write+0x392/0x680 [ 54.571083][ T7872] __vfs_write+0x94/0x110 [ 54.571087][ T7872] vfs_write+0x190/0x530 [ 54.571093][ T7872] ksys_write+0x10b/0x220 [ 54.646711][ T2677] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.648432][ T7872] __x64_sys_write+0x6e/0xb0 [ 54.648440][ T7872] do_syscall_64+0x64/0xe0 [ 54.648446][ T7872] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 54.648449][ T7872] [ 54.648452][ T7872] Freed by task 1: [ 54.648459][ T7872] save_stack+0x21/0x50 [ 54.648465][ T7872] __kasan_slab_free+0x102/0x150 [ 54.648469][ T7872] kasan_slab_free+0xe/0x10 [ 54.648473][ T7872] kfree+0x108/0x2c0 [ 54.648479][ T7872] kernfs_fop_release+0x10a/0x170 [ 54.648484][ T7872] __fput+0x2a7/0x790 [ 54.648489][ T7872] ____fput+0x9/0x10 [ 54.648494][ T7872] task_work_run+0xcc/0x160 [ 54.648501][ T7872] __prepare_exit_to_usermode+0x215/0x220 [ 54.648506][ T7872] __syscall_return_slowpath+0x5a/0x280 [ 54.648511][ T7872] do_syscall_64+0x71/0xe0 [ 54.648517][ T7872] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 54.652152][ T2677] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.657146][ T7872] [ 54.688439][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 54.692817][ T7872] The buggy address belongs to the object at ffff8880a6f04400 [ 54.692817][ T7872] which belongs to the cache kmalloc-512 of size 512 [ 54.708519][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 54.708638][ T7872] The buggy address is located 8 bytes to the right of [ 54.708638][ T7872] 512-byte region [ffff8880a6f04400, ffff8880a6f04600) [ 54.713748][ T2677] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.718408][ T7872] The buggy address belongs to the page: [ 54.718417][ T7872] page:ffffea00029bc100 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 [ 54.718424][ T7872] flags: 0xfffe0000000200(slab) [ 54.718430][ T7872] raw: 00fffe0000000200 ffffea0002a33088 ffffea00029b1c48 ffff8880aa400a80 [ 54.718435][ T7872] raw: 0000000000000000 ffff8880a6f04000 0000000100000004 0000000000000000 [ 54.718439][ T7872] page dumped because: kasan: bad access detected [ 54.718441][ T7872] [ 54.718444][ T7872] Memory state around the buggy address: [ 54.718449][ T7872] ffff8880a6f04500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 54.718452][ T7872] ffff8880a6f04580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 54.718461][ T7872] >ffff8880a6f04600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 54.718464][ T7872] ^ [ 54.718467][ T7872] ffff8880a6f04680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 54.718471][ T7872] ffff8880a6f04700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 54.718474][ T7872] ================================================================== [ 54.718477][ T7872] Disabling lock debugging due to kernel taint [ 54.722960][ T7872] Kernel panic - not syncing: panic_on_warn set ... [ 54.727703][ T2677] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.732770][ T7872] CPU: 1 PID: 7872 Comm: kworker/u5:1 Tainted: G B 5.8.0-rc1-syzkaller #0 [ 54.732773][ T7872] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 54.732783][ T7872] Workqueue: hci0 hci_rx_work [ 54.732786][ T7872] Call Trace: [ 54.732796][ T7872] dump_stack+0x134/0x187 [ 54.732801][ T7872] ? hci_connect_cfm+0x60/0x110 [ 54.732811][ T7872] panic+0x22a/0x4e3 [ 54.732818][ T7872] ? __warn_printk+0xd6/0xd6 [ 54.762378][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 54.764531][ T7872] ? preempt_schedule_thunk+0x16/0x18 [ 54.770588][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 54.775007][ T7872] ? bacpy+0xe/0x10 [ 54.782269][ T2677] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.785878][ T7872] ? bacpy+0xe/0x10 [ 54.790466][ T2677] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.795311][ T7872] end_report+0x51/0x59 [ 54.801969][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 54.804521][ T7872] kasan_report.cold.12+0xe/0x37 [ 54.811049][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 54.814802][ T7872] ? bacpy+0xe/0x10 [ 54.817398][ T2677] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 54.821691][ T7872] check_memory_region+0x1cc/0x1f0 [ 54.821697][ T7872] memcpy+0x23/0x60 [ 54.821702][ T7872] bacpy+0xe/0x10 [ 54.821706][ T7872] hci_event_packet+0x334a/0x985e [ 54.821713][ T7872] ? hci_cmd_complete_evt+0xb900/0xb900 [ 54.821718][ T7872] ? stack_trace_save+0x82/0xb0 [ 54.821723][ T7872] ? stack_trace_consume_entry+0x170/0x170 [ 54.821729][ T7872] ? unwind_next_frame+0x3e/0x50 [ 54.821737][ T7872] ? save_trace+0x4d/0x940 [ 54.821742][ T7872] ? __kasan_check_write+0x14/0x20 [ 54.821746][ T7872] ? lockdep_unlock+0x115/0x1b0 [ 54.821750][ T7872] ? __lock_acquire+0x2fa5/0x4110 [ 54.821759][ T7872] ? lockdep_hardirqs_on_prepare+0x590/0x590 [ 54.821762][ T7872] ? lockdep_unlock+0x115/0x1b0 [ 54.821767][ T7872] ? find_held_lock+0x36/0x1d0 [ 54.821772][ T7872] ? __kasan_check_read+0x11/0x20 [ 54.821775][ T7872] ? mark_lock+0xbf/0x630 [ 54.821782][ T7872] ? mark_held_locks+0xb8/0x130 [ 54.821786][ T7872] ? do_raw_spin_lock+0x129/0x2e0 [ 54.821793][ T7872] ? _raw_spin_unlock_irqrestore+0x7d/0xd0 [ 54.821799][ T7872] ? skb_dequeue+0x14d/0x1f0 [ 54.821804][ T7872] ? trace_hardirqs_on+0x31/0x1b0 [ 54.821810][ T7872] ? __kasan_check_read+0x11/0x20 [ 54.821814][ T7872] hci_rx_work+0x18e/0x950 [ 54.821820][ T7872] ? rcu_read_lock_any_held.part.13+0x50/0x50 [ 54.821823][ T7872] ? trace_hardirqs_on+0x31/0x1b0 [ 54.821831][ T7872] process_one_work+0x893/0x1680 [ 54.821838][ T7872] ? pwq_dec_nr_in_flight+0x2c0/0x2c0 [ 54.821841][ T7872] ? rcu_read_lock_held+0x9c/0xb0 [ 54.821848][ T7872] worker_thread+0x85/0xb60 [ 54.821853][ T7872] ? __kthread_parkme+0x37/0x1c0 [ 54.821860][ T7872] ? process_one_work+0x1680/0x1680 [ 54.821864][ T7872] kthread+0x383/0x460 [ 54.821868][ T7872] ? kthread_mod_delayed_work+0x190/0x190 [ 54.821876][ T7872] ret_from_fork+0x1f/0x30 [ 54.823245][ T7872] Kernel Offset: disabled [ 55.458727][ T7872] Rebooting in 86400 seconds..