Warning: Permanently added '10.128.15.197' (ECDSA) to the list of known hosts. syzkaller login: [ 67.768702][ T8471] IPVS: ftp: loaded support on port[0] = 21 [ 67.851113][ T8471] chnl_net:caif_netlink_parms(): no params data found [ 67.902185][ T8471] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.909631][ T8471] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.918071][ T8471] device bridge_slave_0 entered promiscuous mode [ 67.926834][ T8471] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.935181][ T8471] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.943892][ T8471] device bridge_slave_1 entered promiscuous mode [ 67.963836][ T8471] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 67.975448][ T8471] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 67.998370][ T8471] team0: Port device team_slave_0 added [ 68.005682][ T8471] team0: Port device team_slave_1 added [ 68.023204][ T8471] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 68.030137][ T8471] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 68.057128][ T8471] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 68.071009][ T8471] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 68.078870][ T8471] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 68.105206][ T8471] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 68.132043][ T8471] device hsr_slave_0 entered promiscuous mode [ 68.138771][ T8471] device hsr_slave_1 entered promiscuous mode [ 68.242521][ T8471] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 68.253154][ T8471] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 68.264303][ T8471] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 68.274403][ T8471] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 68.298306][ T8471] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.305501][ T8471] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.313349][ T8471] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.320455][ T8471] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.365905][ T8471] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.380475][ T3204] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 68.392005][ T3204] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.400203][ T3204] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.408880][ T3204] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 68.423174][ T8471] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.435802][ T3863] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 68.444311][ T3863] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.451540][ T3863] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.463831][ T3001] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 68.472772][ T3001] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.479804][ T3001] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.503681][ T3001] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 68.513023][ T3001] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 68.532078][ T8471] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 68.543486][ T8471] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 68.557019][ T3001] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 68.565763][ T3001] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 68.574841][ T3001] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 68.584006][ T3001] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 68.607729][ T8471] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 68.615071][ T3001] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 68.624565][ T3001] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 68.643731][ T3001] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 68.663947][ T35] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 68.672390][ T35] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 68.680050][ T35] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 68.693379][ T8471] device veth0_vlan entered promiscuous mode [ 68.706146][ T8471] device veth1_vlan entered promiscuous mode [ 68.730545][ T3001] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 68.739315][ T3001] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 68.748291][ T3001] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 68.760516][ T8471] device veth0_macvtap entered promiscuous mode [ 68.769917][ T8471] device veth1_macvtap entered promiscuous mode executing program [ 68.788479][ T8471] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 68.796021][ T35] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 68.806092][ T35] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 68.818288][ T8471] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 68.826133][ T35] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 68.838094][ T8471] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.847777][ T8471] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.856830][ T8471] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.866639][ T8471] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.906249][ T8471] ================================================================== [ 68.914412][ T8471] BUG: KASAN: use-after-free in skb_segment+0x14ba/0x37a0 [ 68.921529][ T8471] Read of size 2324 at addr ffff88801a8ff2f7 by task syz-executor061/8471 [ 68.930031][ T8471] [ 68.932340][ T8471] CPU: 0 PID: 8471 Comm: syz-executor061 Not tainted 5.11.0-rc3-syzkaller #0 [ 68.941080][ T8471] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 68.951117][ T8471] Call Trace: [ 68.954387][ T8471] dump_stack+0x107/0x163 [ 68.958703][ T8471] ? skb_segment+0x14ba/0x37a0 [ 68.963455][ T8471] ? skb_segment+0x14ba/0x37a0 [ 68.968202][ T8471] print_address_description.constprop.0.cold+0x5b/0x2f8 [ 68.975214][ T8471] ? skb_segment+0x14ba/0x37a0 [ 68.979958][ T8471] ? skb_segment+0x14ba/0x37a0 [ 68.984706][ T8471] kasan_report.cold+0x79/0xd5 [ 68.989458][ T8471] ? skb_segment+0x14ba/0x37a0 [ 68.994208][ T8471] check_memory_region+0x13d/0x180 [ 68.999306][ T8471] memcpy+0x20/0x60 [ 69.003100][ T8471] skb_segment+0x14ba/0x37a0 [ 69.007704][ T8471] ? pskb_extract+0x2b0/0x2b0 [ 69.012370][ T8471] ? __skb_checksum+0x890/0x890 [ 69.017202][ T8471] ? skb_send_sock_locked+0x730/0x730 [ 69.022572][ T8471] ? reqsk_fastopen_remove+0x620/0x620 [ 69.028023][ T8471] udp4_ufo_fragment+0x4ae/0x700 [ 69.032951][ T8471] ? skb_udp_tunnel_segment+0x1e70/0x1e70 [ 69.038654][ T8471] inet_gso_segment+0x502/0x1110 [ 69.043582][ T8471] skb_mac_gso_segment+0x26e/0x530 [ 69.048704][ T8471] ? inet_sk_set_state+0x90/0x90 [ 69.053628][ T8471] ? skb_network_protocol+0x560/0x560 [ 69.058990][ T8471] __skb_gso_segment+0x330/0x6e0 [ 69.063917][ T8471] validate_xmit_skb+0x69e/0xee0 [ 69.068860][ T8471] __dev_queue_xmit+0x988/0x2dd0 [ 69.073788][ T8471] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 69.079059][ T8471] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 69.085293][ T8471] ? __sanitizer_cov_trace_cmp4+0x1c/0x70 [ 69.090999][ T8471] ? virtio_net_hdr_to_skb.constprop.0+0x423/0xa70 [ 69.097488][ T8471] ? __sanitizer_cov_trace_const_cmp2+0x22/0x80 [ 69.103733][ T8471] ? packet_parse_headers+0x11d/0x490 [ 69.109088][ T8471] ? prb_fill_curr_block+0x5d0/0x5d0 [ 69.114362][ T8471] packet_sendmsg+0x2406/0x52a0 [ 69.119227][ T8471] ? aa_sk_perm+0x316/0xaa0 [ 69.123772][ T8471] ? packet_cached_dev_get+0x250/0x250 [ 69.129231][ T8471] ? aa_af_perm+0x230/0x230 [ 69.133728][ T8471] ? find_held_lock+0x2d/0x110 [ 69.138493][ T8471] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 69.144739][ T8471] ? packet_cached_dev_get+0x250/0x250 [ 69.150190][ T8471] sock_sendmsg+0xcf/0x120 [ 69.154595][ T8471] __sys_sendto+0x21c/0x320 [ 69.159086][ T8471] ? __ia32_sys_getpeername+0xb0/0xb0 [ 69.164461][ T8471] ? packet_do_bind+0x454/0xc00 [ 69.169323][ T8471] ? __sys_bind+0x111/0x250 [ 69.173812][ T8471] ? __ia32_sys_socketpair+0xf0/0xf0 [ 69.179090][ T8471] ? __sys_socket+0x16d/0x200 [ 69.183771][ T8471] __x64_sys_sendto+0xdd/0x1b0 [ 69.188544][ T8471] ? lockdep_hardirqs_on+0x79/0x100 [ 69.193763][ T8471] ? syscall_enter_from_user_mode+0x1d/0x50 [ 69.199660][ T8471] do_syscall_64+0x2d/0x70 [ 69.204070][ T8471] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 69.209951][ T8471] RIP: 0033:0x4436e9 [ 69.213833][ T8471] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb 0d fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 69.233437][ T8471] RSP: 002b:00007fffe7591c98 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 69.241838][ T8471] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004436e9 [ 69.249794][ T8471] RDX: 000000000000fc13 RSI: 0000000020000280 RDI: 0000000000000003 [ 69.257763][ T8471] RBP: 00007fffe7591cb0 R08: 0000000000000000 R09: 000000000000002f [ 69.265751][ T8471] R10: 0000000000000800 R11: 0000000000000246 R12: 00007fffe7591cc0 [ 69.273706][ T8471] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 69.281672][ T8471] [ 69.283976][ T8471] Allocated by task 6431: [ 69.288280][ T8471] kasan_save_stack+0x1b/0x40 [ 69.292942][ T8471] ____kasan_kmalloc.constprop.0+0x82/0xa0 [ 69.298733][ T8471] kmem_cache_alloc+0x1c6/0x440 [ 69.303568][ T8471] getname_flags.part.0+0x50/0x4f0 [ 69.308696][ T8471] getname+0x8e/0xd0 [ 69.312582][ T8471] do_sys_openat2+0xf5/0x420 [ 69.317171][ T8471] __x64_sys_open+0x119/0x1c0 [ 69.321839][ T8471] do_syscall_64+0x2d/0x70 [ 69.326241][ T8471] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 69.332127][ T8471] [ 69.334584][ T8471] Freed by task 6431: [ 69.338553][ T8471] kasan_save_stack+0x1b/0x40 [ 69.343226][ T8471] kasan_set_track+0x1c/0x30 [ 69.347809][ T8471] kasan_set_free_info+0x20/0x30 [ 69.352754][ T8471] ____kasan_slab_free+0xe1/0x110 [ 69.357770][ T8471] slab_free_freelist_hook+0x5d/0x150 [ 69.363127][ T8471] kmem_cache_free+0x82/0x350 [ 69.367809][ T8471] putname+0xe1/0x120 [ 69.371792][ T8471] do_sys_openat2+0x153/0x420 [ 69.376468][ T8471] __x64_sys_open+0x119/0x1c0 [ 69.381185][ T8471] do_syscall_64+0x2d/0x70 [ 69.385612][ T8471] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 69.391529][ T8471] [ 69.393973][ T8471] The buggy address belongs to the object at ffff88801a8fe600 [ 69.393973][ T8471] which belongs to the cache names_cache of size 4096 [ 69.408098][ T8471] The buggy address is located 3319 bytes inside of [ 69.408098][ T8471] 4096-byte region [ffff88801a8fe600, ffff88801a8ff600) [ 69.421533][ T8471] The buggy address belongs to the page: [ 69.427152][ T8471] page:0000000036b7a58f refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1a8f8 [ 69.437286][ T8471] head:0000000036b7a58f order:3 compound_mapcount:0 compound_pincount:0 [ 69.445593][ T8471] flags: 0xfff00000010200(slab|head) [ 69.450867][ T8471] raw: 00fff00000010200 0000000000000000 0000000500000001 ffff8880101be140 [ 69.459445][ T8471] raw: 0000000000000000 0000000000070007 00000001ffffffff 0000000000000000 [ 69.468015][ T8471] page dumped because: kasan: bad access detected [ 69.474411][ T8471] [ 69.476723][ T8471] Memory state around the buggy address: [ 69.482336][ T8471] ffff88801a8ff180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 69.490384][ T8471] ffff88801a8ff200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 69.498472][ T8471] >ffff88801a8ff280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 69.506533][ T8471] ^ [ 69.514230][ T8471] ffff88801a8ff300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 69.522301][ T8471] ffff88801a8ff380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 69.530342][ T8471] ================================================================== [ 69.538382][ T8471] Disabling lock debugging due to kernel taint [ 69.544583][ T8471] Kernel panic - not syncing: panic_on_warn set ... [ 69.551164][ T8471] CPU: 0 PID: 8471 Comm: syz-executor061 Tainted: G B 5.11.0-rc3-syzkaller #0 [ 69.561322][ T8471] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 69.571407][ T8471] Call Trace: [ 69.574693][ T8471] dump_stack+0x107/0x163 [ 69.579034][ T8471] ? skb_segment+0x1460/0x37a0 [ 69.583787][ T8471] panic+0x306/0x73d [ 69.587667][ T8471] ? __warn_printk+0xf3/0xf3 [ 69.592250][ T8471] ? skb_segment+0x14ba/0x37a0 [ 69.596996][ T8471] ? trace_hardirqs_on+0x38/0x1c0 [ 69.602001][ T8471] ? trace_hardirqs_on+0x51/0x1c0 [ 69.607007][ T8471] ? skb_segment+0x14ba/0x37a0 [ 69.611748][ T8471] ? skb_segment+0x14ba/0x37a0 [ 69.616491][ T8471] end_report+0x58/0x5e [ 69.620628][ T8471] kasan_report.cold+0x67/0xd5 [ 69.625409][ T8471] ? skb_segment+0x14ba/0x37a0 [ 69.630160][ T8471] check_memory_region+0x13d/0x180 [ 69.635269][ T8471] memcpy+0x20/0x60 [ 69.639061][ T8471] skb_segment+0x14ba/0x37a0 [ 69.643657][ T8471] ? pskb_extract+0x2b0/0x2b0 [ 69.648322][ T8471] ? __skb_checksum+0x890/0x890 [ 69.653153][ T8471] ? skb_send_sock_locked+0x730/0x730 [ 69.658521][ T8471] ? reqsk_fastopen_remove+0x620/0x620 [ 69.663986][ T8471] udp4_ufo_fragment+0x4ae/0x700 [ 69.668905][ T8471] ? skb_udp_tunnel_segment+0x1e70/0x1e70 [ 69.674603][ T8471] inet_gso_segment+0x502/0x1110 [ 69.679527][ T8471] skb_mac_gso_segment+0x26e/0x530 [ 69.684623][ T8471] ? inet_sk_set_state+0x90/0x90 [ 69.689556][ T8471] ? skb_network_protocol+0x560/0x560 [ 69.694913][ T8471] __skb_gso_segment+0x330/0x6e0 [ 69.699863][ T8471] validate_xmit_skb+0x69e/0xee0 [ 69.704783][ T8471] __dev_queue_xmit+0x988/0x2dd0 [ 69.709720][ T8471] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 69.714985][ T8471] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 69.721206][ T8471] ? __sanitizer_cov_trace_cmp4+0x1c/0x70 [ 69.726921][ T8471] ? virtio_net_hdr_to_skb.constprop.0+0x423/0xa70 [ 69.733421][ T8471] ? __sanitizer_cov_trace_const_cmp2+0x22/0x80 [ 69.739644][ T8471] ? packet_parse_headers+0x11d/0x490 [ 69.744997][ T8471] ? prb_fill_curr_block+0x5d0/0x5d0 [ 69.750263][ T8471] packet_sendmsg+0x2406/0x52a0 [ 69.755098][ T8471] ? aa_sk_perm+0x316/0xaa0 [ 69.759611][ T8471] ? packet_cached_dev_get+0x250/0x250 [ 69.765068][ T8471] ? aa_af_perm+0x230/0x230 [ 69.769569][ T8471] ? find_held_lock+0x2d/0x110 [ 69.774325][ T8471] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 69.780557][ T8471] ? packet_cached_dev_get+0x250/0x250 [ 69.786001][ T8471] sock_sendmsg+0xcf/0x120 [ 69.790398][ T8471] __sys_sendto+0x21c/0x320 [ 69.794880][ T8471] ? __ia32_sys_getpeername+0xb0/0xb0 [ 69.800257][ T8471] ? packet_do_bind+0x454/0xc00 [ 69.805094][ T8471] ? __sys_bind+0x111/0x250 [ 69.809575][ T8471] ? __ia32_sys_socketpair+0xf0/0xf0 [ 69.814839][ T8471] ? __sys_socket+0x16d/0x200 [ 69.819496][ T8471] __x64_sys_sendto+0xdd/0x1b0 [ 69.824240][ T8471] ? lockdep_hardirqs_on+0x79/0x100 [ 69.829423][ T8471] ? syscall_enter_from_user_mode+0x1d/0x50 [ 69.835296][ T8471] do_syscall_64+0x2d/0x70 [ 69.839692][ T8471] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 69.845566][ T8471] RIP: 0033:0x4436e9 [ 69.849444][ T8471] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb 0d fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 69.869030][ T8471] RSP: 002b:00007fffe7591c98 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 69.877428][ T8471] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004436e9 [ 69.885380][ T8471] RDX: 000000000000fc13 RSI: 0000000020000280 RDI: 0000000000000003 [ 69.893330][ T8471] RBP: 00007fffe7591cb0 R08: 0000000000000000 R09: 000000000000002f [ 69.901281][ T8471] R10: 0000000000000800 R11: 0000000000000246 R12: 00007fffe7591cc0 [ 69.909229][ T8471] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 69.917761][ T8471] Kernel Offset: disabled [ 69.922077][ T8471] Rebooting in 86400 seconds..