[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 40.363911] audit: type=1800 audit(1547427475.635:25): pid=7865 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 40.407477] audit: type=1800 audit(1547427475.635:26): pid=7865 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 40.429020] audit: type=1800 audit(1547427475.635:27): pid=7865 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.119' (ECDSA) to the list of known hosts. syzkaller login: [ 52.804418] IPVS: ftp: loaded support on port[0] = 21 [ 52.870762] chnl_net:caif_netlink_parms(): no params data found [ 52.904180] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.911022] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.918586] device bridge_slave_0 entered promiscuous mode [ 52.925661] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.932144] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.939110] device bridge_slave_1 entered promiscuous mode [ 52.954943] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 52.964136] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 52.981275] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 52.988893] team0: Port device team_slave_0 added [ 52.995212] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 53.002664] team0: Port device team_slave_1 added [ 53.008088] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 53.015320] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 53.089242] device hsr_slave_0 entered promiscuous mode [ 53.158097] device hsr_slave_1 entered promiscuous mode [ 53.197863] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 53.204758] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 53.218075] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.224468] bridge0: port 2(bridge_slave_1) entered forwarding state [ 53.231214] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.237599] bridge0: port 1(bridge_slave_0) entered forwarding state [ 53.267205] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 53.274791] 8021q: adding VLAN 0 to HW filter on device bond0 [ 53.283097] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 53.291772] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 53.311228] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.318970] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.328542] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 53.338616] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 53.344683] 8021q: adding VLAN 0 to HW filter on device team0 [ 53.354750] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 53.362455] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.368818] bridge0: port 1(bridge_slave_0) entered forwarding state [ 53.388433] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 53.395965] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.402328] bridge0: port 2(bridge_slave_1) entered forwarding state [ 53.410567] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 53.418253] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 53.425705] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 53.435824] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 53.442958] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 53.451922] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 53.458158] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready executing program [ 53.470539] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 53.480827] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 53.497472] ================================================================== [ 53.504936] BUG: KASAN: use-after-free in tick_sched_handle+0x16f/0x190 [ 53.507638] kasan: CONFIG_KASAN_INLINE enabled [ 53.511673] Read of size 8 at addr ffff88808886b030 by task syz-executor774/8016 [ 53.523741] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 53.531088] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 53.537309] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.0.0-rc1+ #24 [ 53.543774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 53.553110] RIP: 0010:__bfs+0x2ce/0x7a0 [ 53.557062] Code: 49 01 00 00 49 8d 7f 10 4c 89 f8 4c 8b 1d 0a d8 ee 09 48 89 f9 48 2d 20 47 32 8b 44 8b 15 5a d6 61 09 48 c1 e9 03 48 c1 f8 06 <42> 80 3c 21 00 0f 85 2c 03 00 00 49 8b 77 10 4c 8d 46 2c 4c 89 c1 [ 53.575951] RSP: 0018:ffff8880ae7069b0 EFLAGS: 00010003 [ 53.581293] RAX: 0000000001d336e3 RBX: ffffed1015ce0d4f RCX: 0000000000000002 [ 53.588547] RDX: 1ffff11015ce0d4b RSI: 0000000000000001 RDI: 0000000000000010 [ 53.595900] RBP: ffff8880ae706ae0 R08: 0000000000000001 R09: 1ffff11015ce0d4f [ 53.603239] R10: 000000000000a31d R11: 0000000000001bba R12: dffffc0000000000 [ 53.610490] R13: ffffffff8b302450 R14: ffff8880ae706ab8 R15: 0000000000000000 [ 53.617745] FS: 0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000 [ 53.625963] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 53.631934] CR2: 000055821f2250d0 CR3: 000000009ab3c000 CR4: 00000000001406e0 [ 53.639368] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 53.646625] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 53.653872] Call Trace: [ 53.656515] [ 53.658658] ? noop_count+0x40/0x40 [ 53.662368] ? lock_pin_lock+0x3a0/0x3a0 [ 53.666420] check_usage_forwards+0x164/0x3e0 [ 53.670902] ? check_usage_backwards+0x3e0/0x3e0 [ 53.675637] ? secondary_startup_64+0xa4/0xb0 [ 53.680126] ? save_stack_trace+0x1a/0x20 [ 53.684346] ? save_trace+0xe0/0x290 [ 53.688042] mark_lock+0x519/0x1cd0 [ 53.691647] ? check_usage_backwards+0x3e0/0x3e0 [ 53.696502] ? print_usage_bug+0xd0/0xd0 [ 53.700545] ? print_usage_bug+0xd0/0xd0 [ 53.704591] ? lockdep_hardirqs_on+0x19b/0x5d0 [ 53.709155] __lock_acquire+0x139c/0x4a30 [ 53.713278] ? mark_held_locks+0xb1/0x100 [ 53.717447] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 53.722638] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 53.727731] ? mark_held_locks+0x100/0x100 [ 53.731954] ? trace_hardirqs_off_caller+0x300/0x300 [ 53.737069] ? do_raw_spin_trylock+0x270/0x270 [ 53.741649] ? mark_held_locks+0xb1/0x100 [ 53.745783] ? debug_object_active_state+0x33b/0x500 [ 53.750870] ? __call_rcu.constprop.0+0x3b4/0x920 [ 53.755814] ? __call_rcu.constprop.0+0x3b4/0x920 [ 53.760635] ? lockdep_hardirqs_on+0x19b/0x5d0 [ 53.765219] ? trace_hardirqs_on+0xbd/0x310 [ 53.769524] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 53.775017] ? call_rcu+0xb/0x10 [ 53.778374] ? trace_hardirqs_off_caller+0x300/0x300 [ 53.783586] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 53.789104] ? check_preemption_disabled+0x48/0x290 [ 53.794097] ? mark_held_locks+0x100/0x100 [ 53.798320] lock_acquire+0x1db/0x570 [ 53.802099] ? __dev_queue_xmit+0x17e0/0x3a60 [ 53.806569] ? lock_release+0xc40/0xc40 [ 53.810518] ? rcu_lockdep_current_cpu_online+0x1aa/0x220 [ 53.816095] _raw_spin_lock+0x2f/0x40 [ 53.819876] ? __dev_queue_xmit+0x17e0/0x3a60 [ 53.824356] __dev_queue_xmit+0x17e0/0x3a60 [ 53.828677] ? mark_held_locks+0x100/0x100 [ 53.832892] ? netdev_pick_tx+0x300/0x300 [ 53.837028] ? trace_hardirqs_off_caller+0x2b0/0x300 [ 53.842120] ? do_raw_write_trylock+0x270/0x270 [ 53.846774] ? add_lock_to_list.isra.0+0x450/0x450 [ 53.851681] ? __local_bh_enable_ip+0x15a/0x270 [ 53.856350] ? print_usage_bug+0xd0/0xd0 [ 53.860469] ? _raw_write_unlock_bh+0x31/0x40 [ 53.864958] ? find_held_lock+0x35/0x120 [ 53.869103] ? mark_held_locks+0xb1/0x100 [ 53.873232] ? neigh_resolve_output+0x455/0xb30 [ 53.877881] ? neigh_resolve_output+0x455/0xb30 [ 53.882537] ? lockdep_hardirqs_on+0x19b/0x5d0 [ 53.887100] ? trace_hardirqs_on+0xbd/0x310 [ 53.891480] ? memcpy+0x46/0x50 [ 53.894742] dev_queue_xmit+0x18/0x20 [ 53.898518] ? dev_queue_xmit+0x18/0x20 [ 53.902472] neigh_resolve_output+0x6a0/0xb30 [ 53.906949] ? __neigh_event_send+0x1310/0x1310 [ 53.911605] ip6_finish_output2+0xc56/0x28e0 [ 53.915997] ? ip6_forward_finish+0x580/0x580 [ 53.920471] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 53.925723] ? rcu_read_unlock_special+0x380/0x380 [ 53.930639] ? ip6_mtu+0x160/0x520 [ 53.934162] ? kasan_check_read+0x11/0x20 [ 53.938290] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 53.943550] ip6_finish_output+0x577/0xc30 [ 53.947887] ? ip6_finish_output+0x577/0xc30 [ 53.952272] ip6_output+0x23c/0xa00 [ 53.955891] ? ip6_finish_output+0xc30/0xc30 [ 53.960389] ? ip6_mc_leave_src+0x230/0x230 [ 53.964690] ? ip6_fragment+0x3780/0x3780 [ 53.968814] ? ip6_mtu_from_fib6+0x750/0x750 [ 53.973199] mld_sendpack+0xa44/0xfd0 [ 53.976975] ? nf_hook.constprop.0+0x850/0x850 [ 53.981550] ? trace_hardirqs_on+0xbd/0x310 [ 53.986070] ? _raw_read_unlock_bh+0x31/0x40 [ 53.990506] ? mld_ifc_timer_expire+0x437/0x8a0 [ 53.995263] ? __local_bh_enable_ip+0x15a/0x270 [ 53.999914] mld_ifc_timer_expire+0x449/0x8a0 [ 54.004392] call_timer_fn+0x254/0x900 [ 54.008258] ? mld_dad_timer_expire+0x1c0/0x1c0 [ 54.012902] ? process_timeout+0x40/0x40 [ 54.017061] ? _raw_spin_unlock_irq+0x28/0x90 [ 54.021543] ? _raw_spin_unlock_irq+0x28/0x90 [ 54.026022] ? lockdep_hardirqs_on+0x19b/0x5d0 [ 54.030582] ? trace_hardirqs_on+0xbd/0x310 [ 54.034889] ? kasan_check_read+0x11/0x20 [ 54.039019] ? trace_hardirqs_off_caller+0x300/0x300 [ 54.044102] ? mld_dad_timer_expire+0x1c0/0x1c0 [ 54.048759] ? mld_dad_timer_expire+0x1c0/0x1c0 [ 54.053427] __run_timers+0x6fc/0xd50 [ 54.057230] ? __bpf_trace_timer_expire_entry+0x30/0x30 [ 54.062569] ? find_held_lock+0x35/0x120 [ 54.066612] ? clockevents_program_event+0x15f/0x380 [ 54.071710] ? pvclock_read_flags+0x160/0x160 [ 54.076185] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 54.081697] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 54.087214] ? check_preemption_disabled+0x48/0x290 [ 54.092208] ? rcu_lockdep_current_cpu_online+0x1aa/0x220 [ 54.097888] ? rcu_pm_notify+0xd0/0xd0 [ 54.101756] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 54.107487] ? check_preemption_disabled+0x48/0x290 [ 54.112484] run_timer_softirq+0x52/0xb0 [ 54.116525] ? rcu_read_lock_sched_held+0x110/0x130 [ 54.121541] __do_softirq+0x30b/0xb11 [ 54.125327] ? __irqentry_text_end+0x1f96d2/0x1f96d2 [ 54.130442] ? kvm_clock_read+0x18/0x30 [ 54.134396] ? kvm_sched_clock_read+0x9/0x20 [ 54.138780] ? sched_clock+0x2e/0x50 [ 54.142468] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 54.148013] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 54.153535] ? check_preemption_disabled+0x48/0x290 [ 54.158531] irq_exit+0x180/0x1d0 [ 54.161962] smp_apic_timer_interrupt+0x1b7/0x760 [ 54.166786] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 54.171624] ? smp_call_function_single_interrupt+0x640/0x640 [ 54.177489] ? trace_hardirqs_off+0x310/0x310 [ 54.181980] ? task_prio+0x50/0x50 [ 54.185502] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 54.191021] ? check_preemption_disabled+0x48/0x290 [ 54.196022] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 54.200846] apic_timer_interrupt+0xf/0x20 [ 54.205051] [ 54.207266] RIP: 0010:native_safe_halt+0x2/0x10 [ 54.211911] Code: ff ff ff 48 89 c7 48 89 45 d8 e8 69 dd d1 f9 48 8b 45 d8 e9 ce fe ff ff 48 89 df e8 58 dd d1 f9 eb 82 90 90 90 90 90 90 fb f4 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 f4 c3 90 90 90 90 90 90 [ 54.230948] RSP: 0018:ffff8880a94a7cd0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13 [ 54.238753] RAX: 1ffffffff1325019 RBX: 1ffff11015294f9d RCX: 0000000000000000 [ 54.246117] RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff8880a9496bbc [ 54.253370] RBP: ffff8880a94a7d90 R08: ffff8880a9496340 R09: 0000000000000000 [ 54.260699] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 [ 54.267951] R13: ffff8880a94a7d68 R14: 0000000000000000 R15: ffffffff899280b8 [ 54.275209] ? default_idle+0xb5/0x490 [ 54.279072] ? rcu_dynticks_eqs_enter+0x4f/0x80 [ 54.283716] ? __sched_text_end+0x4/0x4 [ 54.287666] ? rcu_idle_enter+0x408/0x530 [ 54.291805] ? rcu_eqs_special_set+0x1c0/0x1c0 [ 54.296448] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 54.301968] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 54.307484] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 54.313011] arch_cpu_idle+0x10/0x20 [ 54.316720] default_idle_call+0x36/0x90 [ 54.320769] do_idle+0x386/0x5d0 [ 54.324125] ? start_secondary+0x380/0x620 [ 54.328344] ? arch_cpu_idle_exit+0x80/0x80 [ 54.332645] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 54.337724] ? complete+0x61/0x80 [ 54.341157] cpu_startup_entry+0x1b/0x20 [ 54.345198] start_secondary+0x435/0x620 [ 54.349318] ? set_cpu_sibling_map+0x1850/0x1850 [ 54.354064] secondary_startup_64+0xa4/0xb0 [ 54.358364] Modules linked in: [ 54.361544] ---[ end trace 1f6a270ad6cc3a4f ]--- [ 54.366279] RIP: 0010:__bfs+0x2ce/0x7a0 [ 54.370232] Code: 49 01 00 00 49 8d 7f 10 4c 89 f8 4c 8b 1d 0a d8 ee 09 48 89 f9 48 2d 20 47 32 8b 44 8b 15 5a d6 61 09 48 c1 e9 03 48 c1 f8 06 <42> 80 3c 21 00 0f 85 2c 03 00 00 49 8b 77 10 4c 8d 46 2c 4c 89 c1 [ 54.389209] RSP: 0018:ffff8880ae7069b0 EFLAGS: 00010003 [ 54.394551] RAX: 0000000001d336e3 RBX: ffffed1015ce0d4f RCX: 0000000000000002 [ 54.401862] RDX: 1ffff11015ce0d4b RSI: 0000000000000001 RDI: 0000000000000010 [ 54.409113] RBP: ffff8880ae706ae0 R08: 0000000000000001 R09: 1ffff11015ce0d4f [ 54.416359] R10: 000000000000a31d R11: 0000000000001bba R12: dffffc0000000000 [ 54.423603] R13: ffffffff8b302450 R14: ffff8880ae706ab8 R15: 0000000000000000 [ 54.430851] FS: 0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000 [ 54.439056] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 54.444912] CR2: 000055821f2250d0 CR3: 000000009ab3c000 CR4: 00000000001406e0 [ 54.452175] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 54.459420] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 54.466758] Kernel panic - not syncing: Fatal exception in interrupt [ 55.656246] Shutting down cpus with NMI [ 55.661201] Kernel Offset: disabled [ 55.664825] Rebooting in 86400 seconds..