Debian GNU/Linux 9 syzkaller ttyS0 syzkaller login: [ 31.382596] audit: type=1400 audit(1585491852.885:8): avc: denied { execmem } for pid=6295 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 31.640894] IPVS: ftp: loaded support on port[0] = 21 [ 32.847292] can: request_module (can-proto-0) failed. [ 32.858021] can: request_module (can-proto-0) failed. [ 32.866956] can: request_module (can-proto-0) failed. [ 32.893341] audit: type=1400 audit(1585491854.387:9): avc: denied { create } for pid=6274 comm="syz-fuzzer" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dccp_socket permissive=1 Warning: Permanently added '10.128.1.7' (ECDSA) to the list of known hosts. 2020/03/29 14:24:21 parsed 1 programs 2020/03/29 14:24:21 executed programs: 0 [ 40.404653] audit: type=1400 audit(1585491861.900:10): avc: denied { execmem } for pid=6413 comm="syz-executor.2" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 40.616176] IPVS: ftp: loaded support on port[0] = 21 [ 41.434097] IPVS: ftp: loaded support on port[0] = 21 [ 41.489353] chnl_net:caif_netlink_parms(): no params data found [ 41.538621] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.546521] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.553404] device bridge_slave_0 entered promiscuous mode [ 41.561784] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.561857] IPVS: ftp: loaded support on port[0] = 21 [ 41.568785] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.581197] device bridge_slave_1 entered promiscuous mode [ 41.603296] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 41.619000] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 41.663220] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 41.671747] team0: Port device team_slave_0 added [ 41.679454] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 41.687738] team0: Port device team_slave_1 added [ 41.710739] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 41.721064] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 41.730831] chnl_net:caif_netlink_parms(): no params data found [ 41.787014] IPVS: ftp: loaded support on port[0] = 21 [ 41.817470] device hsr_slave_0 entered promiscuous mode [ 41.855188] device hsr_slave_1 entered promiscuous mode [ 41.905502] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 41.914175] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 41.921953] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.929293] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.936901] device bridge_slave_0 entered promiscuous mode [ 41.992688] chnl_net:caif_netlink_parms(): no params data found [ 42.001698] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.009825] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.019008] device bridge_slave_1 entered promiscuous mode [ 42.041216] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 42.068247] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 42.086997] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 42.094106] team0: Port device team_slave_0 added [ 42.106328] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.112758] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.120033] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.126472] bridge0: port 1(bridge_slave_0) entered forwarding state [ 42.135556] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 42.142681] team0: Port device team_slave_1 added [ 42.148545] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 42.157476] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 42.195455] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.201916] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.210275] device bridge_slave_0 entered promiscuous mode [ 42.218100] IPVS: ftp: loaded support on port[0] = 21 [ 42.248982] device hsr_slave_0 entered promiscuous mode [ 42.285001] device hsr_slave_1 entered promiscuous mode [ 42.326565] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 42.333494] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.340813] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.347980] device bridge_slave_1 entered promiscuous mode [ 42.368466] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 42.376839] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 42.405178] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 42.499215] chnl_net:caif_netlink_parms(): no params data found [ 42.507295] IPVS: ftp: loaded support on port[0] = 21 [ 42.529865] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 42.538158] team0: Port device team_slave_0 added [ 42.544340] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 42.552319] team0: Port device team_slave_1 added [ 42.560079] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 42.569948] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 42.578813] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.596555] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.607196] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 42.629489] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.636072] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.643003] device bridge_slave_0 entered promiscuous mode [ 42.671860] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.679153] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.686653] device bridge_slave_1 entered promiscuous mode [ 42.726978] device hsr_slave_0 entered promiscuous mode [ 42.764783] device hsr_slave_1 entered promiscuous mode [ 42.817456] 8021q: adding VLAN 0 to HW filter on device bond0 [ 42.838463] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 42.848138] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 42.858568] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 42.867648] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 42.876031] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 42.893642] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 42.901598] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 42.961747] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 42.971991] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 42.979761] 8021q: adding VLAN 0 to HW filter on device team0 [ 43.006929] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 43.014143] team0: Port device team_slave_0 added [ 43.029326] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 43.040428] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 43.049122] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 43.056494] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 43.063569] team0: Port device team_slave_1 added [ 43.070336] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 43.079559] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 43.087756] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 43.095831] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.102253] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.109739] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 43.118244] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 43.125845] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.132278] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.139959] chnl_net:caif_netlink_parms(): no params data found [ 43.153066] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 43.246808] device hsr_slave_0 entered promiscuous mode [ 43.284605] device hsr_slave_1 entered promiscuous mode [ 43.325230] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 43.361890] 8021q: adding VLAN 0 to HW filter on device bond0 [ 43.371221] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 43.378187] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 43.387296] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 43.395309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 43.406330] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 43.418604] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 43.431142] chnl_net:caif_netlink_parms(): no params data found [ 43.455624] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 43.468873] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.479709] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.488383] device bridge_slave_0 entered promiscuous mode [ 43.495383] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 43.502997] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 43.513253] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 43.522695] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 43.532022] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 43.538556] 8021q: adding VLAN 0 to HW filter on device team0 [ 43.550427] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.557896] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.565365] device bridge_slave_1 entered promiscuous mode [ 43.582736] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 43.589574] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 43.596983] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 43.605685] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 43.626606] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 43.633470] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.640099] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.647375] device bridge_slave_0 entered promiscuous mode [ 43.656012] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 43.670171] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 43.679181] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 43.687390] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.694894] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.702238] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 43.710357] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 43.719351] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 43.727699] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.734062] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.742274] device bridge_slave_1 entered promiscuous mode [ 43.750880] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 43.772813] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 43.779948] team0: Port device team_slave_0 added [ 43.794221] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 43.801330] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 43.810305] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 43.818229] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.824652] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.833045] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 43.846683] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 43.853743] team0: Port device team_slave_1 added [ 43.862138] 8021q: adding VLAN 0 to HW filter on device bond0 [ 43.871272] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 43.879202] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 43.887498] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 43.898015] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 43.912209] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 43.921349] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 43.929518] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 43.937768] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 43.946360] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 43.955718] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 43.965239] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 43.981698] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 43.990744] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 43.999355] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 44.008674] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 44.015403] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 44.029855] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 44.037290] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 44.044644] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 44.055685] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 44.061776] 8021q: adding VLAN 0 to HW filter on device team0 [ 44.071522] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 44.136401] device hsr_slave_0 entered promiscuous mode [ 44.174376] device hsr_slave_1 entered promiscuous mode [ 44.215555] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 44.223754] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 44.231923] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 44.242108] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.248533] bridge0: port 1(bridge_slave_0) entered forwarding state [ 44.255972] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 44.263538] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 44.273083] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 44.287901] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 44.295231] team0: Port device team_slave_0 added [ 44.300505] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 44.309273] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 44.319018] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 44.326595] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 44.333402] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 44.341487] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 44.349203] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.355611] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.365122] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 44.372335] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 44.379957] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 44.387218] team0: Port device team_slave_1 added [ 44.392947] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 44.400688] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 44.415945] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 44.425421] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 44.433155] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 44.450023] 8021q: adding VLAN 0 to HW filter on device bond0 [ 44.457434] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 44.466195] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 44.474248] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 44.481101] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 44.488033] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 44.495880] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 44.506407] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 44.520565] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 44.541898] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 44.549394] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 44.557622] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 44.567248] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 44.576595] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 44.587781] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 44.626337] device hsr_slave_0 entered promiscuous mode [ 44.664196] device hsr_slave_1 entered promiscuous mode [ 44.714675] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 44.721647] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 44.729100] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 44.737952] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 44.745736] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 44.753126] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 44.762735] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 44.773223] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 44.783392] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 44.790956] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 44.800994] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 44.809618] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 44.817393] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 44.825001] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 44.832363] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 44.839300] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 44.851540] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 44.862964] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 44.869480] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 44.882738] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 44.892908] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 44.900870] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 44.931910] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 44.938530] 8021q: adding VLAN 0 to HW filter on device team0 [ 44.949508] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 44.957244] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 44.968931] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 44.985640] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 44.992684] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 45.002069] 8021q: adding VLAN 0 to HW filter on device bond0 [ 45.012271] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 45.024574] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 45.031516] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 45.059956] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 45.071609] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 45.098548] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 45.111254] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 45.134573] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.140967] bridge0: port 1(bridge_slave_0) entered forwarding state [ 45.166442] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 45.175698] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 45.188489] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 45.194715] 8021q: adding VLAN 0 to HW filter on device team0 [ 45.202600] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 45.221773] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 45.229490] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 45.241572] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 45.249616] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.256045] bridge0: port 2(bridge_slave_1) entered forwarding state [ 45.264300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 45.271238] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 45.278916] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 45.287704] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 45.303184] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 45.312622] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 45.327575] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 45.337019] 8021q: adding VLAN 0 to HW filter on device bond0 [ 45.344706] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 45.352446] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 45.366720] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready 2020/03/29 14:24:26 executed programs: 12 [ 45.379672] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.386123] bridge0: port 1(bridge_slave_0) entered forwarding state [ 45.400054] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 45.409442] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 45.419343] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 45.429938] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 45.439409] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 45.451187] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 45.459776] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 45.467859] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.474252] bridge0: port 2(bridge_slave_1) entered forwarding state [ 45.484742] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 45.492691] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 45.505384] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 45.513065] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 45.522242] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 45.532301] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 45.540052] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 45.548145] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 45.555401] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 45.562709] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 45.571397] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 45.580786] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 45.587145] 8021q: adding VLAN 0 to HW filter on device team0 [ 45.595392] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 45.603782] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 45.611486] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 45.625579] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 45.634176] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 45.641914] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 45.653230] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 45.666284] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 45.675084] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 45.683788] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 45.691966] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 45.701317] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 45.718439] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 45.727069] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 45.741362] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.747863] bridge0: port 1(bridge_slave_0) entered forwarding state [ 45.756378] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 45.769992] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 45.782753] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 45.808192] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 45.819266] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 45.829230] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 45.848379] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 45.864169] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 45.873002] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 45.890230] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 45.900864] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 45.915446] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 45.922610] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 45.930858] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 45.954295] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.960726] bridge0: port 2(bridge_slave_1) entered forwarding state [ 45.970372] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 45.981616] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 45.990136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 45.998080] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 46.005792] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 46.015507] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 46.023100] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 46.031616] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 46.038483] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 46.046873] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 46.052905] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 46.063865] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 46.072742] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 46.082380] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 46.090491] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 46.098571] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 46.106637] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 46.119837] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 46.129769] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 46.140696] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 46.148749] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 46.157290] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 46.166340] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 46.174782] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 46.185310] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 46.192888] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 46.202422] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 46.212333] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 46.220982] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 46.231991] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 46.240957] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 46.250622] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 46.257750] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 46.271152] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 46.283971] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 46.293134] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 46.300510] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 46.307616] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 46.322574] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 47.226347] l2tp_core: tunl 4: sockfd_lookup(fd=3) returned -9 [ 48.981802] l2tp_core: tunl 4: sockfd_lookup(fd=3) returned -9 [ 49.111327] l2tp_core: tunl 4: sockfd_lookup(fd=3) returned -9 2020/03/29 14:24:31 executed programs: 141 [ 53.181533] l2tp_core: tunl 4: sockfd_lookup(fd=3) returned -9 2020/03/29 14:24:36 executed programs: 361 2020/03/29 14:24:41 executed programs: 581 2020/03/29 14:24:46 executed programs: 799 [ 69.706554] l2tp_core: tunl 4: sockfd_lookup(fd=3) returned -9 2020/03/29 14:24:52 executed programs: 1021 2020/03/29 14:24:57 executed programs: 1241 2020/03/29 14:25:02 executed programs: 1463 [ 82.678796] ================================================================== [ 82.686360] BUG: KASAN: use-after-free in inet_shutdown+0x287/0x300 [ 82.693199] Read of size 4 at addr ffff8880819cb600 by task syz-executor.5/20000 [ 82.700728] [ 82.702359] CPU: 1 PID: 20000 Comm: syz-executor.5 Not tainted 4.14.174-syzkaller #0 [ 82.710238] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 82.719594] Call Trace: [ 82.722182] dump_stack+0xf7/0x13b [ 82.725724] ? inet_shutdown+0x287/0x300 [ 82.730830] print_address_description.cold.7+0x9/0x1c9 [ 82.736204] ? inet_shutdown+0x287/0x300 [ 82.740271] kasan_report.cold.8+0x11a/0x2d3 [ 82.744773] __asan_report_load4_noabort+0x14/0x20 [ 82.749705] inet_shutdown+0x287/0x300 [ 82.753598] pppol2tp_session_close+0x91/0xc0 [ 82.758097] l2tp_tunnel_closeall+0x1df/0x2f0 [ 82.762599] l2tp_udp_encap_destroy+0x79/0xb0 [ 82.767243] udpv6_destroy_sock+0x89/0xb0 [ 82.771403] sk_common_release+0x5e/0x2c0 [ 82.775559] udp_lib_close+0x9/0x10 [ 82.779194] inet_release+0xd9/0x1c0 [ 82.783028] inet6_release+0x46/0x60 [ 82.787305] __sock_release+0xc2/0x2a0 [ 82.791543] sock_close+0x10/0x20 [ 82.795002] __fput+0x232/0x750 [ 82.798314] ? _raw_spin_unlock_irq+0x27/0x80 [ 82.802817] ____fput+0x9/0x10 [ 82.806014] task_work_run+0xe5/0x170 [ 82.809821] exit_to_usermode_loop+0x16a/0x1b0 [ 82.814420] do_syscall_64+0x416/0x5b0 [ 82.818308] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 82.823853] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 82.829047] RIP: 0033:0x4144b1 [ 82.832244] RSP: 002b:00007ffe0b25b3d0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 82.840912] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00000000004144b1 [ 82.848278] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000004 [ 82.855578] RBP: 0000000000000000 R08: ffffffffffffffff R09: ffffffffffffffff [ 82.862853] R10: 00007ffe0b25b4b0 R11: 0000000000000293 R12: 000000000075bfc8 [ 82.870132] R13: 0000000000014315 R14: 0000000000760858 R15: 000000000075bfd4 [ 82.877413] [ 82.879042] Allocated by task 20028: [ 82.882758] save_stack_trace+0x16/0x20 [ 82.886741] save_stack+0x43/0xd0 [ 82.890197] kasan_kmalloc+0xc7/0xe0 [ 82.893923] kasan_slab_alloc+0x12/0x20 [ 82.897914] kmem_cache_alloc+0x12e/0x790 [ 82.902298] sock_alloc_inode+0x18/0x230 [ 82.906475] alloc_inode+0x56/0x150 [ 82.910117] new_inode_pseudo+0xc/0xd0 [ 82.914089] sock_alloc+0x3c/0x280 [ 82.917612] __sock_create+0x7a/0x540 [ 82.921408] SyS_socket+0xc6/0x1a0 [ 82.924934] do_syscall_64+0x1c7/0x5b0 [ 82.928804] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 82.933982] [ 82.935592] Freed by task 20004: [ 82.938973] save_stack_trace+0x16/0x20 [ 82.942959] save_stack+0x43/0xd0 [ 82.946422] kasan_slab_free+0x71/0xc0 [ 82.950361] kmem_cache_free+0x80/0x2d0 [ 82.954369] sock_destroy_inode+0x50/0x60 [ 82.958502] destroy_inode+0xb3/0x100 [ 82.962283] evict+0x36f/0x590 [ 82.965453] iput+0x3ac/0x810 [ 82.968548] dentry_unlink_inode+0x23e/0x2f0 [ 82.973162] __dentry_kill+0x2d2/0x540 [ 82.977045] dput.part.27+0x49a/0x610 [ 82.980838] dput+0xe/0x20 [ 82.983665] __fput+0x3f7/0x750 [ 82.986935] ____fput+0x9/0x10 [ 82.990133] task_work_run+0xe5/0x170 [ 82.994178] exit_to_usermode_loop+0x16a/0x1b0 [ 82.998739] do_syscall_64+0x416/0x5b0 [ 83.002659] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 83.007882] [ 83.009488] The buggy address belongs to the object at ffff8880819cb600 [ 83.009488] which belongs to the cache sock_inode_cache of size 992 [ 83.022603] The buggy address is located 0 bytes inside of [ 83.022603] 992-byte region [ffff8880819cb600, ffff8880819cb9e0) [ 83.034571] The buggy address belongs to the page: [ 83.039514] page:ffffea00020672c0 count:1 mapcount:0 mapping:ffff8880819cb180 index:0xffff8880819cbffd [ 83.049014] flags: 0xfffe0000000100(slab) [ 83.053155] raw: 00fffe0000000100 ffff8880819cb180 ffff8880819cbffd 0000000100000003 [ 83.061017] raw: ffffea0002067920 ffffea00020679a0 ffff88821b7d2240 0000000000000000 [ 83.068956] page dumped because: kasan: bad access detected [ 83.074650] [ 83.076268] Memory state around the buggy address: [ 83.081184] ffff8880819cb500: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 83.088535] ffff8880819cb580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 83.095890] >ffff8880819cb600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 83.103232] ^ [ 83.106572] ffff8880819cb680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 83.113978] ffff8880819cb700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 83.121334] ================================================================== [ 83.128706] Disabling lock debugging due to kernel taint [ 83.162937] Kernel panic - not syncing: panic_on_warn set ... [ 83.162937] [ 83.170355] CPU: 1 PID: 20000 Comm: syz-executor.5 Tainted: G B 4.14.174-syzkaller #0 [ 83.179473] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 83.188826] Call Trace: [ 83.191411] dump_stack+0xf7/0x13b [ 83.194947] ? inet_shutdown+0x287/0x300 [ 83.199117] panic+0x1b0/0x358 [ 83.202311] ? add_taint.cold.5+0x11/0x11 [ 83.206461] ? ___preempt_schedule+0x16/0x18 [ 83.210906] ? inet_shutdown+0x287/0x300 [ 83.215134] kasan_end_report+0x47/0x4f [ 83.219107] kasan_report.cold.8+0x76/0x2d3 [ 83.223434] __asan_report_load4_noabort+0x14/0x20 [ 83.228360] inet_shutdown+0x287/0x300 [ 83.232260] pppol2tp_session_close+0x91/0xc0 [ 83.236757] l2tp_tunnel_closeall+0x1df/0x2f0 [ 83.241249] l2tp_udp_encap_destroy+0x79/0xb0 [ 83.245741] udpv6_destroy_sock+0x89/0xb0 [ 83.249883] sk_common_release+0x5e/0x2c0 [ 83.254021] udp_lib_close+0x9/0x10 [ 83.257623] inet_release+0xd9/0x1c0 [ 83.261457] inet6_release+0x46/0x60 [ 83.265151] __sock_release+0xc2/0x2a0 [ 83.269058] sock_close+0x10/0x20 [ 83.272493] __fput+0x232/0x750 [ 83.275748] ? _raw_spin_unlock_irq+0x27/0x80 [ 83.280236] ____fput+0x9/0x10 [ 83.283420] task_work_run+0xe5/0x170 [ 83.287199] exit_to_usermode_loop+0x16a/0x1b0 [ 83.291758] do_syscall_64+0x416/0x5b0 [ 83.295721] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 83.300552] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 83.305730] RIP: 0033:0x4144b1 [ 83.308910] RSP: 002b:00007ffe0b25b3d0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 83.316605] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00000000004144b1 [ 83.323855] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000004 [ 83.331106] RBP: 0000000000000000 R08: ffffffffffffffff R09: ffffffffffffffff [ 83.338353] R10: 00007ffe0b25b4b0 R11: 0000000000000293 R12: 000000000075bfc8 [ 83.345622] R13: 0000000000014315 R14: 0000000000760858 R15: 000000000075bfd4 [ 83.354600] Kernel Offset: disabled [ 83.358272] Rebooting in 86400 seconds..