Debian GNU/Linux 9 syzkaller ttyS0 syzkaller login: [ 28.788333] audit: type=1400 audit(1591191439.248:8): avc: denied { execmem } for pid=6124 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 29.020414] IPVS: ftp: loaded support on port[0] = 21 [ 30.304773] can: request_module (can-proto-0) failed. [ 30.315292] can: request_module (can-proto-0) failed. [ 30.323329] can: request_module (can-proto-0) failed. [ 30.348717] audit: type=1400 audit(1591191440.820:9): avc: denied { create } for pid=6103 comm="syz-fuzzer" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dccp_socket permissive=1 Warning: Permanently added '10.128.1.28' (ECDSA) to the list of known hosts. 2020/06/03 13:37:28 parsed 1 programs 2020/06/03 13:37:28 executed programs: 0 [ 37.812739] audit: type=1400 audit(1591191448.284:10): avc: denied { execmem } for pid=6241 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 37.866214] IPVS: ftp: loaded support on port[0] = 21 [ 38.613378] IPVS: ftp: loaded support on port[0] = 21 [ 38.657928] chnl_net:caif_netlink_parms(): no params data found [ 38.711653] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.718386] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.726155] device bridge_slave_0 entered promiscuous mode [ 38.734424] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.741012] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.750587] IPVS: ftp: loaded support on port[0] = 21 [ 38.750692] device bridge_slave_1 entered promiscuous mode [ 38.777076] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 38.785875] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 38.810772] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 38.820826] team0: Port device team_slave_0 added [ 38.851651] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 38.859174] team0: Port device team_slave_1 added [ 38.867019] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 38.882614] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 38.905043] chnl_net:caif_netlink_parms(): no params data found [ 38.946649] device hsr_slave_0 entered promiscuous mode [ 38.964187] device hsr_slave_1 entered promiscuous mode [ 39.014389] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 39.026183] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 39.039623] IPVS: ftp: loaded support on port[0] = 21 [ 39.128088] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.135615] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.142955] device bridge_slave_0 entered promiscuous mode [ 39.151334] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.157997] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.164959] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.171380] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.187043] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.193405] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.201063] device bridge_slave_1 entered promiscuous mode [ 39.217361] chnl_net:caif_netlink_parms(): no params data found [ 39.247551] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 39.259249] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 39.281403] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 39.289299] team0: Port device team_slave_0 added [ 39.295863] IPVS: ftp: loaded support on port[0] = 21 [ 39.296932] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 39.309320] team0: Port device team_slave_1 added [ 39.316806] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 39.338872] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 39.348294] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.355828] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.362810] device bridge_slave_0 entered promiscuous mode [ 39.369868] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.376287] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.383142] device bridge_slave_1 entered promiscuous mode [ 39.400985] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 39.430864] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 39.450891] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 39.458113] team0: Port device team_slave_0 added [ 39.516737] device hsr_slave_0 entered promiscuous mode [ 39.564051] device hsr_slave_1 entered promiscuous mode [ 39.663844] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 39.671045] team0: Port device team_slave_1 added [ 39.677882] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 39.687028] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 39.694932] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 39.706039] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.713048] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.738719] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 39.772088] chnl_net:caif_netlink_parms(): no params data found [ 39.796974] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 39.826302] device hsr_slave_0 entered promiscuous mode [ 39.874015] device hsr_slave_1 entered promiscuous mode [ 39.914461] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 39.922441] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.938394] IPVS: ftp: loaded support on port[0] = 21 [ 39.947616] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 39.975032] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 39.992852] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 40.001999] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 40.021200] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 40.029685] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 40.051077] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.057754] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.066338] device bridge_slave_0 entered promiscuous mode [ 40.079037] 8021q: adding VLAN 0 to HW filter on device bond0 [ 40.087551] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.094290] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.101449] device bridge_slave_1 entered promiscuous mode [ 40.112399] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 40.119893] 8021q: adding VLAN 0 to HW filter on device team0 [ 40.132060] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 40.207991] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 40.218518] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 40.230791] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 40.246119] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 40.259232] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 40.267958] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 40.278030] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.285263] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.293223] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 40.300124] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 40.308365] chnl_net:caif_netlink_parms(): no params data found [ 40.354247] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 40.360453] 8021q: adding VLAN 0 to HW filter on device team0 [ 40.368389] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 40.378479] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 40.388239] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 40.396300] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.402809] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.410313] device bridge_slave_0 entered promiscuous mode [ 40.417355] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.423921] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.431115] device bridge_slave_1 entered promiscuous mode [ 40.438111] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 40.445841] team0: Port device team_slave_0 added [ 40.452590] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 40.466673] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 40.475175] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 40.482848] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.489669] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.496836] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 40.505139] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 40.512889] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 40.521248] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 40.529027] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.536613] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.544182] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 40.561467] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 40.569091] team0: Port device team_slave_1 added [ 40.575892] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 40.584956] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 40.592461] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 40.662194] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 40.672362] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 40.680831] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.687636] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.701693] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 40.718675] chnl_net:caif_netlink_parms(): no params data found [ 40.730785] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 40.751899] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 40.765554] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 40.774190] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 40.781892] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 40.792199] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 40.800389] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 40.809532] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 40.867179] device hsr_slave_0 entered promiscuous mode [ 40.903670] device hsr_slave_1 entered promiscuous mode [ 40.943681] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 40.952072] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 40.962033] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 40.977256] 8021q: adding VLAN 0 to HW filter on device bond0 [ 40.993172] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 41.000283] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 41.009678] team0: Port device team_slave_0 added [ 41.017994] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 41.026829] team0: Port device team_slave_1 added [ 41.032657] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 41.040849] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 41.051384] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 41.061855] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 41.088273] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 41.096106] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 41.104987] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 41.111663] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 41.120325] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 41.131962] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 41.140012] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 41.148147] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 41.158283] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 41.166319] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 41.174677] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.181059] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.188382] device bridge_slave_0 entered promiscuous mode [ 41.196725] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 41.266361] device hsr_slave_0 entered promiscuous mode [ 41.313222] device hsr_slave_1 entered promiscuous mode [ 41.363321] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 41.370933] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 41.379874] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.386497] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.393686] device bridge_slave_1 entered promiscuous mode [ 41.408427] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 41.416334] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 41.425893] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 41.432689] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 41.440095] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 41.448130] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 41.457110] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 41.470789] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 41.479845] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 41.488041] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 41.498538] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 41.505731] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 41.512503] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 41.520187] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 41.528527] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 41.542176] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 41.549172] 8021q: adding VLAN 0 to HW filter on device team0 [ 41.558208] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 41.568635] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 41.583350] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 41.590010] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 41.598816] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 41.608597] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 41.632561] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 41.640941] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 41.651994] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 41.658276] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 41.667042] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 41.674820] team0: Port device team_slave_0 added [ 41.680346] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 41.687794] team0: Port device team_slave_1 added [ 41.694291] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 41.701498] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 41.710282] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 41.720687] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 41.733434] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 41.741101] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 41.748931] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.755367] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.765281] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 41.774681] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 41.787912] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 41.797102] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 41.804585] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 41.812189] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 41.819841] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.826228] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.833863] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 41.840559] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 41.864589] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 41.880553] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 41.890116] 8021q: adding VLAN 0 to HW filter on device bond0 [ 41.900967] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 41.922533] 8021q: adding VLAN 0 to HW filter on device bond0 [ 41.930762] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 41.939940] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 41.960287] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 41.969761] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 41.978590] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 42.048233] device hsr_slave_0 entered promiscuous mode [ 42.083139] device hsr_slave_1 entered promiscuous mode [ 42.103604] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 42.111349] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 42.129589] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 42.138884] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 42.147196] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 42.155123] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 42.162446] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 42.169508] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 42.179925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 42.186901] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 42.194845] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 42.204214] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 42.210275] 8021q: adding VLAN 0 to HW filter on device team0 [ 42.221017] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 42.236725] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 42.244183] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 42.250964] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 42.258052] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 42.265520] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 42.278316] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 42.287775] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 42.296099] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 42.304399] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 42.311936] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.318319] bridge0: port 1(bridge_slave_0) entered forwarding state [ 42.325665] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 42.334726] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 42.342352] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.348746] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.356905] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 42.364746] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 42.370801] 8021q: adding VLAN 0 to HW filter on device team0 [ 42.379725] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 42.389197] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 42.397123] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 42.417315] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 42.436314] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 42.449708] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 42.468717] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 42.477175] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 42.485228] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 42.493582] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 42.501186] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 42.509277] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.515828] bridge0: port 1(bridge_slave_0) entered forwarding state [ 42.524921] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 42.532830] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 42.539977] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 42.547630] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 42.557941] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 42.568879] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 42.575746] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 42.583626] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 42.594515] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 42.602332] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 42.610389] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.617404] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.633403] 8021q: adding VLAN 0 to HW filter on device bond0 [ 42.643680] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 42.656447] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 42.664485] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 42.672084] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 42.680139] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 42.691167] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 42.701398] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 42.713617] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 42.723805] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 42.732250] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 42.743683] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 42.752079] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 42.760784] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 42.768945] 8021q: adding VLAN 0 to HW filter on device team0 [ 42.775822] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 42.782782] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 42.789646] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 42.797323] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 42.805018] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 42.812768] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 42.820219] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 42.830036] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 42.840206] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 42.853342] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 42.861378] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 42.869472] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 42.877396] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 42.889582] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 42.899092] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 42.906371] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 42.914359] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 42.920996] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 42.929004] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 42.936815] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.943211] bridge0: port 1(bridge_slave_0) entered forwarding state [ 42.949988] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 42.958015] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 42.965592] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 42.973345] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 42.981263] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 42.990061] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 42.998932] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 43.010536] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 43.017508] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 43.026987] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 43.035313] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.041782] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.050307] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 43.062241] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 43.069788] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 43.076852] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 43.085736] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 43.093940] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 43.101554] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 43.111301] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 43.120699] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 43.128228] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 43.142551] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 43.149813] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 43.159635] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 43.168713] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 43.187083] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 43.194520] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 43.201175] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 43.217024] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 43.230698] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 43.249538] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 43.261351] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready 2020/06/03 13:37:33 executed programs: 15 [ 43.269623] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 43.281199] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 43.294008] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 43.306347] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 43.316301] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 43.331281] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 43.341258] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 43.349065] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 43.357242] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 43.365267] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 43.376288] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 43.384144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 43.399124] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 43.408062] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 43.414512] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 43.421146] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 43.431794] 8021q: adding VLAN 0 to HW filter on device batadv0 2020/06/03 13:37:38 executed programs: 260 2020/06/03 13:37:43 executed programs: 570 2020/06/03 13:37:48 executed programs: 869 2020/06/03 13:37:53 executed programs: 1186 2020/06/03 13:37:58 executed programs: 1493 2020/06/03 13:38:03 executed programs: 1798 2020/06/03 13:38:08 executed programs: 2112 2020/06/03 13:38:13 executed programs: 2410 2020/06/03 13:38:18 executed programs: 2720 2020/06/03 13:38:23 executed programs: 3032 2020/06/03 13:38:28 executed programs: 3337 2020/06/03 13:38:33 executed programs: 3638 2020/06/03 13:38:38 executed programs: 3946 2020/06/03 13:38:44 executed programs: 4245 [ 114.678647] ================================================================== [ 114.686194] BUG: KASAN: use-after-free in rxrpc_free_skb+0x222/0x2e0 [ 114.692682] Read of size 4 at addr ffff88808917e6a4 by task kworker/0:3/6747 [ 114.699860] [ 114.701490] CPU: 0 PID: 6747 Comm: kworker/0:3 Not tainted 4.14.183-syzkaller #0 [ 114.709032] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 114.718473] Workqueue: krxrpcd rxrpc_process_call [ 114.723322] Call Trace: [ 114.725898] dump_stack+0xf7/0x13b [ 114.729431] ? rxrpc_free_skb+0x222/0x2e0 [ 114.733561] print_address_description.cold.7+0x9/0x1c9 [ 114.738923] ? rxrpc_free_skb+0x222/0x2e0 [ 114.743061] kasan_report.cold.8+0x11a/0x2d3 [ 114.747449] ? rxrpc_process_call+0xc03/0xffd [ 114.751918] __asan_report_load4_noabort+0x14/0x20 [ 114.756821] rxrpc_free_skb+0x222/0x2e0 [ 114.760782] ? trace_hardirqs_on+0xd/0x10 [ 114.764928] rxrpc_process_call+0xc03/0xffd [ 114.769244] process_one_work+0x79e/0x16c0 [ 114.773462] ? pwq_dec_nr_in_flight+0x2b0/0x2b0 [ 114.778104] worker_thread+0xcc/0xee0 [ 114.781880] kthread+0x338/0x400 [ 114.785253] ? process_one_work+0x16c0/0x16c0 [ 114.789727] ? kthread_create_on_node+0xa0/0xa0 [ 114.794371] ret_from_fork+0x24/0x30 [ 114.798070] [ 114.799673] Allocated by task 28560: [ 114.803373] save_stack_trace+0x16/0x20 [ 114.807327] save_stack+0x43/0xd0 [ 114.810752] kasan_kmalloc+0xc7/0xe0 [ 114.814435] kasan_slab_alloc+0x12/0x20 [ 114.818382] kmem_cache_alloc_node+0x144/0x790 [ 114.822951] __alloc_skb+0x92/0x500 [ 114.826568] alloc_skb_with_frags+0x75/0x490 [ 114.830948] sock_alloc_send_pskb+0x53a/0x710 [ 114.835438] sock_alloc_send_skb+0x13/0x20 [ 114.839733] rxrpc_send_data+0x12ce/0x2980 [ 114.843944] rxrpc_do_sendmsg+0x846/0x1247 [ 114.848156] rxrpc_sendmsg+0x448/0x590 [ 114.852015] sock_sendmsg+0xb5/0xf0 [ 114.855612] ___sys_sendmsg+0x282/0x920 [ 114.859556] __sys_sendmmsg+0x126/0x300 [ 114.863507] SyS_sendmmsg+0xd/0x20 [ 114.867046] do_syscall_64+0x1c7/0x5b0 [ 114.870914] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 114.876073] [ 114.877684] Freed by task 28540: [ 114.881023] save_stack_trace+0x16/0x20 [ 114.884976] save_stack+0x43/0xd0 [ 114.888406] kasan_slab_free+0x71/0xc0 [ 114.892263] kmem_cache_free+0x80/0x2d0 [ 114.896210] kfree_skbmem+0x88/0xf0 [ 114.899818] kfree_skb+0x92/0x2b0 [ 114.903256] rxrpc_free_skb+0xab/0x2e0 [ 114.907151] rxrpc_release_call+0x474/0x970 [ 114.911449] rxrpc_release_calls_on_socket+0x4e0/0xab0 [ 114.916701] rxrpc_release+0x259/0x500 [ 114.920577] __sock_release+0xc2/0x2a0 [ 114.924444] sock_close+0x10/0x20 [ 114.927913] __fput+0x232/0x750 [ 114.931179] ____fput+0x9/0x10 [ 114.934344] task_work_run+0xe5/0x170 [ 114.938724] exit_to_usermode_loop+0x16a/0x1b0 [ 114.943283] do_syscall_64+0x416/0x5b0 [ 114.947149] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 114.952313] [ 114.953930] The buggy address belongs to the object at ffff88808917e5c0 [ 114.953930] which belongs to the cache skbuff_head_cache of size 232 [ 114.967093] The buggy address is located 228 bytes inside of [ 114.967093] 232-byte region [ffff88808917e5c0, ffff88808917e6a8) [ 114.978965] The buggy address belongs to the page: [ 114.983874] page:ffffea0002245f80 count:1 mapcount:0 mapping:ffff88808917e0c0 index:0xffff88808917ec00 [ 114.993305] flags: 0x1fffc0000000100(slab) [ 114.997538] raw: 01fffc0000000100 ffff88808917e0c0 ffff88808917ec00 0000000100000009 [ 115.005401] raw: ffffea00023e1020 ffffea00023bf520 ffff88821b75e540 0000000000000000 [ 115.013264] page dumped because: kasan: bad access detected [ 115.018960] [ 115.020560] Memory state around the buggy address: [ 115.025464] ffff88808917e580: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 115.032800] ffff88808917e600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 115.040137] >ffff88808917e680: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc [ 115.047471] ^ [ 115.051855] ffff88808917e700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 115.061191] ffff88808917e780: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc [ 115.068545] ================================================================== [ 115.075878] Disabling lock debugging due to kernel taint [ 115.088127] Kernel panic - not syncing: panic_on_warn set ... [ 115.088127] [ 115.095507] CPU: 0 PID: 6747 Comm: kworker/0:3 Tainted: G B 4.14.183-syzkaller #0 [ 115.104326] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 115.113672] Workqueue: krxrpcd rxrpc_process_call [ 115.118502] Call Trace: [ 115.121089] dump_stack+0xf7/0x13b [ 115.124620] ? rxrpc_free_skb+0x222/0x2e0 [ 115.128765] panic+0x1b0/0x358 [ 115.131944] ? add_taint.cold.5+0x11/0x11 [ 115.136080] ? ___preempt_schedule+0x16/0x18 [ 115.140477] ? rxrpc_free_skb+0x222/0x2e0 [ 115.144615] kasan_end_report+0x47/0x4f [ 115.148577] kasan_report.cold.8+0x76/0x2d3 [ 115.152883] ? rxrpc_process_call+0xc03/0xffd [ 115.157367] __asan_report_load4_noabort+0x14/0x20 [ 115.162269] rxrpc_free_skb+0x222/0x2e0 [ 115.166221] ? trace_hardirqs_on+0xd/0x10 [ 115.170357] rxrpc_process_call+0xc03/0xffd [ 115.174712] process_one_work+0x79e/0x16c0 [ 115.178925] ? pwq_dec_nr_in_flight+0x2b0/0x2b0 [ 115.183581] worker_thread+0xcc/0xee0 [ 115.187381] kthread+0x338/0x400 [ 115.190729] ? process_one_work+0x16c0/0x16c0 [ 115.195215] ? kthread_create_on_node+0xa0/0xa0 [ 115.199856] ret_from_fork+0x24/0x30 [ 115.204926] Kernel Offset: disabled [ 115.208557] Rebooting in 86400 seconds..