[[0;32m OK [0m] Reached target Login Prompts.
[[0;32m OK [0m] Reached target Multi-User System.
[[0;32m OK [0m] Reached target Graphical Interface.
Starting Update UTMP about System Runlevel Changes...
[[0;32m OK [0m] Started Update UTMP about System Runlevel Changes.
Debian GNU/Linux 9 syzkaller ttyS0
Warning: Permanently added '10.128.0.231' (ECDSA) to the list of known hosts.
2020/03/30 13:40:49 parsed 1 programs
2020/03/30 13:40:51 executed programs: 0
syzkaller login: [ 59.844542][ T7021] IPVS: ftp: loaded support on port[0] = 21
[ 59.931642][ T7021] chnl_net:caif_netlink_parms(): no params data found
[ 59.982894][ T7021] bridge0: port 1(bridge_slave_0) entered blocking state
[ 59.990393][ T7021] bridge0: port 1(bridge_slave_0) entered disabled state
[ 59.998799][ T7021] device bridge_slave_0 entered promiscuous mode
[ 60.007467][ T7021] bridge0: port 2(bridge_slave_1) entered blocking state
[ 60.015013][ T7021] bridge0: port 2(bridge_slave_1) entered disabled state
[ 60.024004][ T7021] device bridge_slave_1 entered promiscuous mode
[ 60.044868][ T7021] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 60.055703][ T7021] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 60.079253][ T7021] team0: Port device team_slave_0 added
[ 60.087551][ T7021] team0: Port device team_slave_1 added
[ 60.106797][ T7021] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 60.113899][ T7021] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 60.140899][ T7021] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 60.153789][ T7021] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 60.160748][ T7021] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 60.186857][ T7021] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 60.265701][ T7021] device hsr_slave_0 entered promiscuous mode
[ 60.322310][ T7021] device hsr_slave_1 entered promiscuous mode
[ 60.449429][ T7021] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 60.494832][ T7021] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 60.524707][ T7021] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 60.564611][ T7021] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 60.648405][ T7021] bridge0: port 2(bridge_slave_1) entered blocking state
[ 60.655783][ T7021] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 60.663735][ T7021] bridge0: port 1(bridge_slave_0) entered blocking state
[ 60.670814][ T7021] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 60.717980][ T7021] 8021q: adding VLAN 0 to HW filter on device bond0
[ 60.733943][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 60.745488][ T17] bridge0: port 1(bridge_slave_0) entered disabled state
[ 60.754186][ T17] bridge0: port 2(bridge_slave_1) entered disabled state
[ 60.764251][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 60.777237][ T7021] 8021q: adding VLAN 0 to HW filter on device team0
[ 60.788086][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 60.797929][ T12] bridge0: port 1(bridge_slave_0) entered blocking state
[ 60.805236][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 60.822212][ T2855] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 60.830623][ T2855] bridge0: port 2(bridge_slave_1) entered blocking state
[ 60.837746][ T2855] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 60.853082][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 60.863697][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 60.883228][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 60.893966][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 60.902735][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 60.914702][ T7021] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 60.935676][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 60.943870][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 60.958673][ T7021] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 60.977404][ T2855] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 60.986800][ T2855] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 61.008778][ T7021] device veth0_vlan entered promiscuous mode
[ 61.020487][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 61.029810][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 61.039559][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 61.048297][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 61.061141][ T7021] device veth1_vlan entered promiscuous mode
[ 61.083328][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 61.092987][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 61.101138][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 61.110846][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 61.124242][ T7021] device veth0_macvtap entered promiscuous mode
[ 61.134982][ T7021] device veth1_macvtap entered promiscuous mode
[ 61.153990][ T7021] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 61.163596][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 61.173229][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 61.181369][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 61.190767][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 61.203648][ T7021] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 61.213062][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 61.223860][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 62.501101][ T7382] ==================================================================
[ 62.509389][ T7382] BUG: KASAN: use-after-free in __list_add_valid+0x93/0xa0
[ 62.516702][ T7382] Read of size 8 at addr ffff8880a7d081e0 by task syz-executor.0/7382
[ 62.524849][ T7382]
[ 62.527206][ T7382] CPU: 1 PID: 7382 Comm: syz-executor.0 Not tainted 5.6.0-syzkaller #0
[ 62.535442][ T7382] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 62.545522][ T7382] Call Trace:
[ 62.548822][ T7382] dump_stack+0x188/0x20d
[ 62.553161][ T7382] ? __list_add_valid+0x93/0xa0
[ 62.558018][ T7382] ? __list_add_valid+0x93/0xa0
[ 62.562885][ T7382] print_address_description.constprop.0.cold+0xd3/0x315
[ 62.569997][ T7382] ? __list_add_valid+0x93/0xa0
[ 62.574855][ T7382] ? __list_add_valid+0x93/0xa0
[ 62.579714][ T7382] __kasan_report.cold+0x1a/0x32
[ 62.584666][ T7382] ? __list_add_valid+0x93/0xa0
[ 62.589537][ T7382] kasan_report+0xe/0x20
[ 62.593799][ T7382] __list_add_valid+0x93/0xa0
[ 62.598484][ T7382] rdma_listen+0x681/0x910
[ 62.602897][ T7382] ucma_listen+0x14d/0x1c0
[ 62.607411][ T7382] ? ucma_notify+0x190/0x190
[ 62.612019][ T7382] ? __might_fault+0x190/0x1d0
[ 62.616804][ T7382] ? _copy_from_user+0x123/0x190
[ 62.621740][ T7382] ? ucma_notify+0x190/0x190
[ 62.626606][ T7382] ucma_write+0x285/0x350
[ 62.630928][ T7382] ? ucma_open+0x270/0x270
[ 62.635358][ T7382] ? security_file_permission+0x8a/0x370
[ 62.641341][ T7382] ? ucma_open+0x270/0x270
[ 62.645754][ T7382] __vfs_write+0x76/0x100
[ 62.650162][ T7382] vfs_write+0x262/0x5c0
[ 62.654416][ T7382] ksys_write+0x1e8/0x250
[ 62.658828][ T7382] ? __ia32_sys_read+0xb0/0xb0
[ 62.663649][ T7382] ? __ia32_sys_clock_settime+0x260/0x260
[ 62.669481][ T7382] ? trace_hardirqs_off_caller+0x55/0x230
[ 62.675206][ T7382] do_syscall_64+0xf6/0x7d0
[ 62.679708][ T7382] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 62.686448][ T7382] RIP: 0033:0x45c849
[ 62.690324][ T7382] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 62.711242][ T7382] RSP: 002b:00007f0a58914c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 62.719655][ T7382] RAX: ffffffffffffffda RBX: 00007f0a589156d4 RCX: 000000000045c849
[ 62.727636][ T7382] RDX: 0000000000000010 RSI: 00000000200001c0 RDI: 0000000000000003
[ 62.735605][ T7382] RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000
[ 62.743568][ T7382] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
[ 62.751627][ T7382] R13: 0000000000000cc0 R14: 00000000004cee4e R15: 000000000076bf0c
[ 62.759598][ T7382]
[ 62.761968][ T7382] Allocated by task 7380:
[ 62.766313][ T7382] save_stack+0x1b/0x80
[ 62.770471][ T7382] __kasan_kmalloc.constprop.0+0xbf/0xd0
[ 62.776093][ T7382] kmem_cache_alloc_trace+0x153/0x7d0
[ 62.781559][ T7382] __rdma_create_id+0x5b/0x850
[ 62.786306][ T7382] ucma_create_id+0x1cb/0x580
[ 62.790973][ T7382] ucma_write+0x285/0x350
[ 62.795298][ T7382] __vfs_write+0x76/0x100
[ 62.800053][ T7382] vfs_write+0x262/0x5c0
[ 62.804273][ T7382] ksys_write+0x1e8/0x250
[ 62.808696][ T7382] do_syscall_64+0xf6/0x7d0
[ 62.813184][ T7382] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 62.819054][ T7382]
[ 62.821365][ T7382] Freed by task 7376:
[ 62.825329][ T7382] save_stack+0x1b/0x80
[ 62.829465][ T7382] __kasan_slab_free+0xf7/0x140
[ 62.834307][ T7382] kfree+0x109/0x2b0
[ 62.838181][ T7382] ucma_close+0x10b/0x300
[ 62.842485][ T7382] __fput+0x2da/0x850
[ 62.846467][ T7382] task_work_run+0x13f/0x1b0
[ 62.851078][ T7382] exit_to_usermode_loop+0x2fa/0x360
[ 62.856361][ T7382] do_syscall_64+0x6b1/0x7d0
[ 62.861060][ T7382] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 62.866941][ T7382]
[ 62.869259][ T7382] The buggy address belongs to the object at ffff8880a7d08000
[ 62.869259][ T7382] which belongs to the cache kmalloc-2k of size 2048
[ 62.883475][ T7382] The buggy address is located 480 bytes inside of
[ 62.883475][ T7382] 2048-byte region [ffff8880a7d08000, ffff8880a7d08800)
[ 62.897010][ T7382] The buggy address belongs to the page:
[ 62.902979][ T7382] page:ffffea00029f4200 refcount:1 mapcount:0 mapping:ffff8880aa000e00 index:0x0
[ 62.912065][ T7382] flags: 0xfffe0000000200(slab)
[ 62.916907][ T7382] raw: 00fffe0000000200 ffffea000292ef48 ffffea00029ecf48 ffff8880aa000e00
[ 62.925482][ T7382] raw: 0000000000000000 ffff8880a7d08000 0000000100000001 0000000000000000
[ 62.934063][ T7382] page dumped because: kasan: bad access detected
[ 62.940470][ T7382]
[ 62.942774][ T7382] Memory state around the buggy address:
[ 62.948380][ T7382] ffff8880a7d08080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 62.956415][ T7382] ffff8880a7d08100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 62.965013][ T7382] >ffff8880a7d08180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 62.973046][ T7382] ^
[ 62.980224][ T7382] ffff8880a7d08200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 62.988264][ T7382] ffff8880a7d08280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 62.996311][ T7382] ==================================================================
[ 63.004345][ T7382] Disabling lock debugging due to kernel taint
[ 63.023474][ T7382] Kernel panic - not syncing: panic_on_warn set ...
[ 63.030128][ T7382] CPU: 1 PID: 7382 Comm: syz-executor.0 Tainted: G B 5.6.0-syzkaller #0
[ 63.039747][ T7382] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 63.049800][ T7382] Call Trace:
[ 63.053076][ T7382] dump_stack+0x188/0x20d
[ 63.057386][ T7382] panic+0x2e3/0x75c
[ 63.061304][ T7382] ? add_taint.cold+0x16/0x16
[ 63.066158][ T7382] ? preempt_schedule_common+0x5e/0xc0
[ 63.071607][ T7382] ? __list_add_valid+0x93/0xa0
[ 63.076466][ T7382] ? ___preempt_schedule+0x16/0x18
[ 63.081560][ T7382] ? trace_hardirqs_on+0x55/0x220
[ 63.086564][ T7382] ? __list_add_valid+0x93/0xa0
[ 63.091510][ T7382] end_report+0x43/0x49
[ 63.095670][ T7382] ? __list_add_valid+0x93/0xa0
[ 63.100515][ T7382] __kasan_report.cold+0xd/0x32
[ 63.105400][ T7382] ? __list_add_valid+0x93/0xa0
[ 63.110233][ T7382] kasan_report+0xe/0x20
[ 63.114467][ T7382] __list_add_valid+0x93/0xa0
[ 63.119152][ T7382] rdma_listen+0x681/0x910
[ 63.123575][ T7382] ucma_listen+0x14d/0x1c0
[ 63.127969][ T7382] ? ucma_notify+0x190/0x190
[ 63.132559][ T7382] ? __might_fault+0x190/0x1d0
[ 63.137303][ T7382] ? _copy_from_user+0x123/0x190
[ 63.142217][ T7382] ? ucma_notify+0x190/0x190
[ 63.146782][ T7382] ucma_write+0x285/0x350
[ 63.151097][ T7382] ? ucma_open+0x270/0x270
[ 63.155496][ T7382] ? security_file_permission+0x8a/0x370
[ 63.161132][ T7382] ? ucma_open+0x270/0x270
[ 63.165560][ T7382] __vfs_write+0x76/0x100
[ 63.169896][ T7382] vfs_write+0x262/0x5c0
[ 63.174123][ T7382] ksys_write+0x1e8/0x250
[ 63.178432][ T7382] ? __ia32_sys_read+0xb0/0xb0
[ 63.183182][ T7382] ? __ia32_sys_clock_settime+0x260/0x260
[ 63.188889][ T7382] ? trace_hardirqs_off_caller+0x55/0x230
[ 63.194604][ T7382] do_syscall_64+0xf6/0x7d0
[ 63.199094][ T7382] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 63.204961][ T7382] RIP: 0033:0x45c849
[ 63.208834][ T7382] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 63.228412][ T7382] RSP: 002b:00007f0a58914c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 63.236800][ T7382] RAX: ffffffffffffffda RBX: 00007f0a589156d4 RCX: 000000000045c849
[ 63.244758][ T7382] RDX: 0000000000000010 RSI: 00000000200001c0 RDI: 0000000000000003
[ 63.252762][ T7382] RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000
[ 63.260724][ T7382] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
[ 63.268776][ T7382] R13: 0000000000000cc0 R14: 00000000004cee4e R15: 000000000076bf0c
[ 63.278128][ T7382] Kernel Offset: disabled
[ 63.282453][ T7382] Rebooting in 86400 seconds..