Debian GNU/Linux 9 syzkaller ttyS0 syzkaller login: [ 29.963440] audit: type=1400 audit(1588544056.066:8): avc: denied { execmem } for pid=6283 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 30.220385] IPVS: ftp: loaded support on port[0] = 21 [ 31.429607] can: request_module (can-proto-0) failed. [ 31.439190] can: request_module (can-proto-0) failed. [ 31.449371] can: request_module (can-proto-0) failed. [ 31.476407] audit: type=1400 audit(1588544057.577:9): avc: denied { create } for pid=6260 comm="syz-fuzzer" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dccp_socket permissive=1 Warning: Permanently added '10.128.1.31' (ECDSA) to the list of known hosts. 2020/05/03 22:14:25 parsed 1 programs 2020/05/03 22:14:25 executed programs: 0 [ 39.132425] audit: type=1400 audit(1588544065.242:10): avc: denied { execmem } for pid=6400 comm="syz-executor.3" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 39.180367] IPVS: ftp: loaded support on port[0] = 21 [ 39.825491] IPVS: ftp: loaded support on port[0] = 21 [ 39.871006] chnl_net:caif_netlink_parms(): no params data found [ 39.910501] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.920257] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.928945] device bridge_slave_0 entered promiscuous mode [ 39.939852] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.947046] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.955373] device bridge_slave_1 entered promiscuous mode [ 39.982822] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 39.996049] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 40.023907] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 40.032091] team0: Port device team_slave_0 added [ 40.040287] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 40.048756] team0: Port device team_slave_1 added [ 40.054724] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 40.062946] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 40.072731] IPVS: ftp: loaded support on port[0] = 21 [ 40.116259] device hsr_slave_0 entered promiscuous mode [ 40.154426] device hsr_slave_1 entered promiscuous mode [ 40.194939] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 40.207463] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 40.276277] chnl_net:caif_netlink_parms(): no params data found [ 40.310096] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.317353] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.324646] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.331143] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.367531] IPVS: ftp: loaded support on port[0] = 21 [ 40.406173] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.412858] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.421636] device bridge_slave_0 entered promiscuous mode [ 40.430856] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.437723] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.444769] device bridge_slave_1 entered promiscuous mode [ 40.489552] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 40.505932] chnl_net:caif_netlink_parms(): no params data found [ 40.525679] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 40.560997] IPVS: ftp: loaded support on port[0] = 21 [ 40.602162] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.611489] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.620574] device bridge_slave_0 entered promiscuous mode [ 40.646818] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 40.654716] team0: Port device team_slave_0 added [ 40.660921] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 40.668547] team0: Port device team_slave_1 added [ 40.679244] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.685763] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.692826] device bridge_slave_1 entered promiscuous mode [ 40.727048] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 40.749401] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 40.760706] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 40.769896] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 40.787494] chnl_net:caif_netlink_parms(): no params data found [ 40.822000] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 40.829940] 8021q: adding VLAN 0 to HW filter on device bond0 [ 40.867704] device hsr_slave_0 entered promiscuous mode [ 40.904242] device hsr_slave_1 entered promiscuous mode [ 40.949445] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 40.957577] team0: Port device team_slave_0 added [ 40.970622] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 40.979060] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.996782] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.005022] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 41.015531] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 41.023854] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 41.031265] team0: Port device team_slave_1 added [ 41.048070] IPVS: ftp: loaded support on port[0] = 21 [ 41.049588] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 41.063715] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 41.071523] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 41.099712] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 41.107464] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 41.120955] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 41.128859] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 41.162095] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.170088] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.178563] device bridge_slave_0 entered promiscuous mode [ 41.247280] device hsr_slave_0 entered promiscuous mode [ 41.294022] device hsr_slave_1 entered promiscuous mode [ 41.382881] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.390993] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.399879] device bridge_slave_1 entered promiscuous mode [ 41.422808] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 41.432932] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 41.442132] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 41.448891] 8021q: adding VLAN 0 to HW filter on device team0 [ 41.458739] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 41.467429] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 41.478877] chnl_net:caif_netlink_parms(): no params data found [ 41.497225] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 41.506531] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 41.515379] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.522856] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.531801] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 41.565644] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 41.573343] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 41.582601] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 41.591279] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.597875] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.611455] 8021q: adding VLAN 0 to HW filter on device bond0 [ 41.637133] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 41.658204] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 41.666352] team0: Port device team_slave_0 added [ 41.672564] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 41.681453] team0: Port device team_slave_1 added [ 41.688565] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 41.697695] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 41.705242] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 41.730485] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.738389] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.747933] device bridge_slave_0 entered promiscuous mode [ 41.755969] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 41.762883] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 41.772782] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 41.782688] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 41.808859] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 41.817999] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 41.825923] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 41.833181] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.841481] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.849803] device bridge_slave_1 entered promiscuous mode [ 41.875347] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 41.888702] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 41.895892] 8021q: adding VLAN 0 to HW filter on device team0 [ 41.903991] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 41.947154] device hsr_slave_0 entered promiscuous mode [ 41.983943] device hsr_slave_1 entered promiscuous mode [ 42.034991] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 42.043079] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 42.052345] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 42.063403] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 42.071828] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 42.084145] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 42.100081] chnl_net:caif_netlink_parms(): no params data found [ 42.109612] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 42.119626] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 42.127107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 42.135995] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 42.144133] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 42.153388] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 42.161886] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.168783] bridge0: port 1(bridge_slave_0) entered forwarding state [ 42.176424] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 42.193022] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 42.201303] team0: Port device team_slave_0 added [ 42.207810] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 42.216215] team0: Port device team_slave_1 added [ 42.232368] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 42.242491] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 42.255418] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 42.265250] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 42.273299] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 42.282404] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 42.290813] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 42.299598] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.306344] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.317703] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 42.328004] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 42.337538] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 42.348273] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 42.363036] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 42.371799] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 42.379724] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 42.389079] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 42.396168] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 42.436725] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 42.446931] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.455499] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.463338] device bridge_slave_0 entered promiscuous mode [ 42.515999] device hsr_slave_0 entered promiscuous mode [ 42.544933] device hsr_slave_1 entered promiscuous mode [ 42.585182] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 42.592555] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 42.602299] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 42.612693] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 42.620329] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.627473] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.636046] device bridge_slave_1 entered promiscuous mode [ 42.653198] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 42.661914] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 42.671966] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 42.682140] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 42.691991] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 42.701185] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 42.712793] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 42.724796] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 42.736047] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 42.744642] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 42.753014] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 42.760952] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 42.769969] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 42.790977] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 42.799291] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 42.810154] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 42.824431] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 42.831947] team0: Port device team_slave_0 added [ 42.840291] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 42.860102] 8021q: adding VLAN 0 to HW filter on device bond0 [ 42.868112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 42.880367] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 42.890096] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 42.897366] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 42.907559] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 42.917864] team0: Port device team_slave_1 added [ 42.927207] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 42.935960] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 42.949198] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 42.959959] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 42.968745] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 42.980506] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 42.987995] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 42.997623] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 43.012931] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 43.021429] 8021q: adding VLAN 0 to HW filter on device team0 [ 43.030376] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 43.049446] 8021q: adding VLAN 0 to HW filter on device bond0 [ 43.060384] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 43.067760] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 43.079391] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 43.117517] device hsr_slave_0 entered promiscuous mode [ 43.144003] device hsr_slave_1 entered promiscuous mode [ 43.174641] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 43.181980] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 43.196012] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 43.203911] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 43.212029] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 43.222494] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.229211] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.238749] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 43.261577] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 43.274502] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 43.281798] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 43.290273] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 43.299834] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 43.307915] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.314466] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.328626] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 43.338346] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 43.349188] 8021q: adding VLAN 0 to HW filter on device team0 [ 43.360011] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 43.371641] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 43.395399] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 43.403480] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 43.413186] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 43.427760] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 43.438751] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 43.449719] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 43.458754] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 43.467686] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 43.476422] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.483145] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.491124] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 43.500236] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 43.508474] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.515393] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.522475] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 43.532035] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 43.542183] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 43.574513] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 43.583005] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 43.602948] 8021q: adding VLAN 0 to HW filter on device bond0 [ 43.616929] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 43.632793] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 43.643025] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 43.665501] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 43.677299] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 43.698932] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 43.707165] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 43.719560] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 43.736179] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 43.746713] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 43.756479] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 43.767507] 8021q: adding VLAN 0 to HW filter on device bond0 [ 43.777996] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 43.787832] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 43.797430] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 43.808764] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 43.822072] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 43.839226] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 43.856304] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 43.864675] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 43.872364] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 43.887674] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 43.897459] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 43.914274] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 43.922488] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 43.935604] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 43.941654] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 43.959410] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 43.969691] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 43.978048] 8021q: adding VLAN 0 to HW filter on device team0 [ 43.986114] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 43.994055] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 44.001585] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 44.010562] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 44.021673] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 44.034359] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 44.043003] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 44.052518] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 44.059870] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 44.067746] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 44.077249] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 44.084082] 8021q: adding VLAN 0 to HW filter on device team0 [ 44.094761] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 44.102142] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 44.110154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 44.118884] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 44.126885] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.133288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 44.141151] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 44.149170] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 44.160622] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 44.167868] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 44.179304] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 44.187585] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.194143] bridge0: port 1(bridge_slave_0) entered forwarding state [ 44.202136] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 44.209701] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 44.217684] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 44.227021] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 44.239807] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 44.246659] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 44.254865] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 44.262750] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 44.274721] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.282323] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.290048] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 44.298271] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 44.306549] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.313034] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.323816] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 44.335532] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 44.346829] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 44.355478] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 44.365965] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 44.373578] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 44.382090] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 44.391592] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 44.401385] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 44.410453] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 44.417540] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 44.426900] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 44.435175] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 44.442788] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 44.450189] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 44.457736] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 44.468550] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 44.480808] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 44.490362] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 44.500750] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 44.510146] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 44.519641] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 44.528925] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 44.538853] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 44.547043] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 44.555116] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 44.562750] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 44.571653] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 44.581650] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 44.589595] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 44.603158] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 44.611581] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 44.624325] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 44.631226] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 44.639258] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 44.648352] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 44.656973] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 44.665098] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 44.676184] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 44.691262] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 44.702540] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 44.715141] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 44.721233] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 2020/05/03 22:14:30 executed programs: 16 [ 44.746303] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 44.768879] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 44.780191] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 44.793244] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 44.800001] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 44.810547] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 44.824290] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 44.830857] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 44.838214] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 44.853873] 8021q: adding VLAN 0 to HW filter on device batadv0 2020/05/03 22:14:35 executed programs: 178 [ 53.209343] l2tp_core: tunl 4: sockfd_lookup(fd=3) returned -9 2020/05/03 22:14:40 executed programs: 399 [ 56.297756] l2tp_core: tunl 4: sockfd_lookup(fd=3) returned -9 [ 58.058215] l2tp_core: tunl 4: sockfd_lookup(fd=3) returned -9 2020/05/03 22:14:45 executed programs: 623 2020/05/03 22:14:50 executed programs: 839 2020/05/03 22:14:55 executed programs: 1058 2020/05/03 22:15:00 executed programs: 1276 2020/05/03 22:15:06 executed programs: 1492 2020/05/03 22:15:11 executed programs: 1702 2020/05/03 22:15:16 executed programs: 1918 2020/05/03 22:15:21 executed programs: 2134 [ 94.940831] l2tp_core: tunl 4: sockfd_lookup(fd=3) returned -9 2020/05/03 22:15:26 executed programs: 2353 2020/05/03 22:15:31 executed programs: 2572 2020/05/03 22:15:36 executed programs: 2790 [ 110.968094] l2tp_core: tunl 4: sockfd_lookup(fd=3) returned -9 [ 112.772577] l2tp_core: tunl 4: sockfd_lookup(fd=3) returned -9 [ 113.007362] ================================================================== [ 113.014940] BUG: KASAN: use-after-free in inet_shutdown+0x287/0x300 [ 113.021349] Read of size 4 at addr ffff88807bcf2100 by task syz-executor.4/31193 [ 113.028885] [ 113.030514] CPU: 0 PID: 31193 Comm: syz-executor.4 Not tainted 4.14.178-syzkaller #0 [ 113.038391] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 113.047751] Call Trace: [ 113.050348] dump_stack+0xf7/0x13b [ 113.053926] ? inet_shutdown+0x287/0x300 [ 113.058034] print_address_description.cold.7+0x9/0x1c9 [ 113.063439] ? inet_shutdown+0x287/0x300 [ 113.067525] kasan_report.cold.8+0x11a/0x2d3 [ 113.071939] __asan_report_load4_noabort+0x14/0x20 [ 113.076887] inet_shutdown+0x287/0x300 [ 113.080772] pppol2tp_session_close+0x91/0xc0 [ 113.085278] l2tp_tunnel_closeall+0x1df/0x2f0 [ 113.089811] l2tp_udp_encap_destroy+0x79/0xb0 [ 113.094310] udpv6_destroy_sock+0x89/0xb0 [ 113.098466] sk_common_release+0x5e/0x2c0 [ 113.102619] udp_lib_close+0x9/0x10 [ 113.106247] inet_release+0xd9/0x1c0 [ 113.109945] inet6_release+0x46/0x60 [ 113.113654] __sock_release+0xc2/0x2a0 [ 113.117535] sock_close+0x10/0x20 [ 113.121092] __fput+0x232/0x750 [ 113.124372] ? _raw_spin_unlock_irq+0x27/0x80 [ 113.128861] ____fput+0x9/0x10 [ 113.132033] task_work_run+0xe5/0x170 [ 113.135811] exit_to_usermode_loop+0x16a/0x1b0 [ 113.140394] do_syscall_64+0x416/0x5b0 [ 113.144283] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 113.149112] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 113.154435] RIP: 0033:0x4144b1 [ 113.157611] RSP: 002b:00007ffe3bd426d0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 113.165328] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00000000004144b1 [ 113.172578] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000004 [ 113.179850] RBP: 0000000000000000 R08: ffffffffffffffff R09: ffffffffffffffff [ 113.187280] R10: 00007ffe3bd427b0 R11: 0000000000000293 R12: 000000000075c070 [ 113.194585] R13: 000000000001b9ad R14: 0000000000760858 R15: 000000000075c07c [ 113.201859] [ 113.203483] Allocated by task 31241: [ 113.207199] save_stack_trace+0x16/0x20 [ 113.211153] save_stack+0x43/0xd0 [ 113.215035] kasan_kmalloc+0xc7/0xe0 [ 113.218724] kasan_slab_alloc+0x12/0x20 [ 113.222680] kmem_cache_alloc+0x12e/0x790 [ 113.226805] sock_alloc_inode+0x18/0x230 [ 113.230862] alloc_inode+0x56/0x150 [ 113.234462] new_inode_pseudo+0xc/0xd0 [ 113.238327] sock_alloc+0x3c/0x280 [ 113.241888] __sock_create+0x7a/0x540 [ 113.245680] SyS_socket+0xc6/0x1a0 [ 113.249372] do_syscall_64+0x1c7/0x5b0 [ 113.253233] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 113.258414] [ 113.260031] Freed by task 31198: [ 113.263393] save_stack_trace+0x16/0x20 [ 113.267351] save_stack+0x43/0xd0 [ 113.270783] kasan_slab_free+0x71/0xc0 [ 113.274658] kmem_cache_free+0x80/0x2d0 [ 113.278635] sock_destroy_inode+0x50/0x60 [ 113.282779] destroy_inode+0xb3/0x100 [ 113.286582] evict+0x36f/0x590 [ 113.289756] iput+0x3ac/0x810 [ 113.292837] dentry_unlink_inode+0x23e/0x2f0 [ 113.297306] __dentry_kill+0x2d2/0x540 [ 113.301203] dput.part.27+0x49a/0x610 [ 113.304983] dput+0xe/0x20 [ 113.307812] __fput+0x3f7/0x750 [ 113.311063] ____fput+0x9/0x10 [ 113.314246] task_work_run+0xe5/0x170 [ 113.318040] exit_to_usermode_loop+0x16a/0x1b0 [ 113.322597] do_syscall_64+0x416/0x5b0 [ 113.326482] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 113.331665] [ 113.333382] The buggy address belongs to the object at ffff88807bcf2100 [ 113.333382] which belongs to the cache sock_inode_cache of size 1000 [ 113.346897] The buggy address is located 0 bytes inside of [ 113.346897] 1000-byte region [ffff88807bcf2100, ffff88807bcf24e8) [ 113.359411] The buggy address belongs to the page: [ 113.364488] page:ffffea0001ef3c80 count:1 mapcount:0 mapping:ffff88807bcf2100 index:0xffff88807bcf2ffd [ 113.374055] flags: 0xfffe0000000100(slab) [ 113.378211] raw: 00fffe0000000100 ffff88807bcf2100 ffff88807bcf2ffd 0000000100000003 [ 113.386114] raw: ffffea0001ef6fe0 ffffea0002251560 ffff88821b7d2540 0000000000000000 [ 113.394085] page dumped because: kasan: bad access detected [ 113.399794] [ 113.401401] Memory state around the buggy address: [ 113.406311] ffff88807bcf2000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 113.413864] ffff88807bcf2080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 113.421338] >ffff88807bcf2100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 113.428692] ^ [ 113.432059] ffff88807bcf2180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 113.439572] ffff88807bcf2200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 113.446926] ================================================================== [ 113.454286] Disabling lock debugging due to kernel taint [ 113.595341] Kernel panic - not syncing: panic_on_warn set ... [ 113.595341] [ 113.603004] CPU: 0 PID: 31193 Comm: syz-executor.4 Tainted: G B 4.14.178-syzkaller #0 [ 113.612249] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 113.621603] Call Trace: [ 113.624190] dump_stack+0xf7/0x13b [ 113.627728] ? inet_shutdown+0x287/0x300 [ 113.631805] panic+0x1b0/0x358 [ 113.634996] ? add_taint.cold.5+0x11/0x11 [ 113.639149] ? ___preempt_schedule+0x16/0x18 [ 113.643560] ? inet_shutdown+0x287/0x300 [ 113.647626] kasan_end_report+0x47/0x4f [ 113.651575] kasan_report.cold.8+0x76/0x2d3 [ 113.655897] __asan_report_load4_noabort+0x14/0x20 [ 113.660817] inet_shutdown+0x287/0x300 [ 113.664679] pppol2tp_session_close+0x91/0xc0 [ 113.669163] l2tp_tunnel_closeall+0x1df/0x2f0 [ 113.673642] l2tp_udp_encap_destroy+0x79/0xb0 [ 113.678113] udpv6_destroy_sock+0x89/0xb0 [ 113.682270] sk_common_release+0x5e/0x2c0 [ 113.686542] udp_lib_close+0x9/0x10 [ 113.690286] inet_release+0xd9/0x1c0 [ 113.693988] inet6_release+0x46/0x60 [ 113.697685] __sock_release+0xc2/0x2a0 [ 113.701567] sock_close+0x10/0x20 [ 113.705017] __fput+0x232/0x750 [ 113.708301] ? _raw_spin_unlock_irq+0x27/0x80 [ 113.712814] ____fput+0x9/0x10 [ 113.716021] task_work_run+0xe5/0x170 [ 113.719822] exit_to_usermode_loop+0x16a/0x1b0 [ 113.724393] do_syscall_64+0x416/0x5b0 [ 113.728280] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 113.733245] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 113.738437] RIP: 0033:0x4144b1 [ 113.741620] RSP: 002b:00007ffe3bd426d0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 113.749301] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00000000004144b1 [ 113.756543] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000004 [ 113.763805] RBP: 0000000000000000 R08: ffffffffffffffff R09: ffffffffffffffff [ 113.771067] R10: 00007ffe3bd427b0 R11: 0000000000000293 R12: 000000000075c070 [ 113.778310] R13: 000000000001b9ad R14: 0000000000760858 R15: 000000000075c07c [ 113.787014] Kernel Offset: disabled [ 113.790638] Rebooting in 86400 seconds..