Warning: Permanently added '10.128.0.7' (ECDSA) to the list of known hosts. 2021/09/05 16:47:58 parsed 1 programs 2021/09/05 16:47:58 executed programs: 0 syzkaller login: [ 313.175240][ T8443] chnl_net:caif_netlink_parms(): no params data found [ 313.218707][ T8443] bridge0: port 1(bridge_slave_0) entered blocking state [ 313.226160][ T8443] bridge0: port 1(bridge_slave_0) entered disabled state [ 313.226818][ T8443] device bridge_slave_0 entered promiscuous mode [ 313.243472][ T8443] bridge0: port 2(bridge_slave_1) entered blocking state [ 313.250540][ T8443] bridge0: port 2(bridge_slave_1) entered disabled state [ 313.258078][ T8443] device bridge_slave_1 entered promiscuous mode [ 313.279699][ T8443] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 313.290326][ T8443] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 313.315074][ T8443] team0: Port device team_slave_0 added [ 313.321990][ T8443] team0: Port device team_slave_1 added [ 313.340684][ T8443] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 313.348287][ T8443] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 313.374202][ T8443] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 313.386052][ T8443] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 313.393033][ T8443] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 313.419180][ T8443] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 313.447581][ T8443] device hsr_slave_0 entered promiscuous mode [ 313.454055][ T8443] device hsr_slave_1 entered promiscuous mode [ 313.529658][ T8443] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 313.538226][ T8443] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 313.547688][ T8443] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 313.557141][ T8443] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 313.575245][ T8443] bridge0: port 2(bridge_slave_1) entered blocking state [ 313.582418][ T8443] bridge0: port 2(bridge_slave_1) entered forwarding state [ 313.589671][ T8443] bridge0: port 1(bridge_slave_0) entered blocking state [ 313.596736][ T8443] bridge0: port 1(bridge_slave_0) entered forwarding state [ 313.626463][ T8443] 8021q: adding VLAN 0 to HW filter on device bond0 [ 313.637603][ T4824] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 313.646444][ T4824] bridge0: port 1(bridge_slave_0) entered disabled state [ 313.654637][ T4824] bridge0: port 2(bridge_slave_1) entered disabled state [ 313.662969][ T4824] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 313.673179][ T8443] 8021q: adding VLAN 0 to HW filter on device team0 [ 313.683233][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 313.691995][ T20] bridge0: port 1(bridge_slave_0) entered blocking state [ 313.699578][ T20] bridge0: port 1(bridge_slave_0) entered forwarding state [ 313.712533][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 313.720764][ T20] bridge0: port 2(bridge_slave_1) entered blocking state [ 313.727834][ T20] bridge0: port 2(bridge_slave_1) entered forwarding state [ 313.740160][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 313.748730][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 313.764568][ T8443] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 313.775362][ T8443] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 313.787525][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 313.795780][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 313.804259][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 313.812586][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 313.829431][ T8443] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 313.837885][ T8775] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 313.845341][ T8775] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 313.860797][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 313.876545][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 313.884645][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 313.893037][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 313.903092][ T8443] device veth0_vlan entered promiscuous mode [ 313.914059][ T8443] device veth1_vlan entered promiscuous mode [ 313.930295][ T8775] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 313.938387][ T8775] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 313.948527][ T8775] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 313.959461][ T8443] device veth0_macvtap entered promiscuous mode [ 313.968726][ T8443] device veth1_macvtap entered promiscuous mode [ 313.983403][ T8443] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 313.990683][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 313.999956][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 314.010888][ T8443] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 314.019249][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 314.029961][ T8443] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 314.038866][ T8443] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 314.047769][ T8443] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 314.056851][ T8443] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 314.104043][ T8378] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 314.119930][ T8378] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 314.143349][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 314.155919][ T8378] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 314.164964][ T8378] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 314.174024][ T8775] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 314.344587][ T8378] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 316.772031][ T3250] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.778347][ T3250] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.177241][ T8378] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 319.411707][ T8808] chnl_net:caif_netlink_parms(): no params data found [ 319.468858][ T8808] bridge0: port 1(bridge_slave_0) entered blocking state [ 319.476505][ T8808] bridge0: port 1(bridge_slave_0) entered disabled state [ 319.485165][ T8808] device bridge_slave_0 entered promiscuous mode [ 319.493532][ T8808] bridge0: port 2(bridge_slave_1) entered blocking state [ 319.500621][ T8808] bridge0: port 2(bridge_slave_1) entered disabled state [ 319.509209][ T8808] device bridge_slave_1 entered promiscuous mode [ 319.532302][ T8808] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 319.543929][ T8808] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 319.568851][ T8808] team0: Port device team_slave_0 added [ 319.577065][ T8808] team0: Port device team_slave_1 added [ 319.597189][ T8808] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 319.604289][ T8808] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 319.631189][ T8808] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 319.643905][ T8808] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 319.650888][ T8808] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 319.677413][ T8808] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 319.705815][ T8808] device hsr_slave_0 entered promiscuous mode [ 319.712458][ T8808] device hsr_slave_1 entered promiscuous mode [ 319.718786][ T8808] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 319.726776][ T8808] Cannot create hsr debugfs directory [ 319.754916][ T8378] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 319.833732][ T8378] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 319.857444][ T8808] bridge0: port 2(bridge_slave_1) entered blocking state [ 319.864511][ T8808] bridge0: port 2(bridge_slave_1) entered forwarding state [ 319.871862][ T8808] bridge0: port 1(bridge_slave_0) entered blocking state [ 319.878908][ T8808] bridge0: port 1(bridge_slave_0) entered forwarding state [ 319.912859][ T8808] 8021q: adding VLAN 0 to HW filter on device bond0 [ 319.924924][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 319.933755][ T20] bridge0: port 1(bridge_slave_0) entered disabled state [ 319.941105][ T20] bridge0: port 2(bridge_slave_1) entered disabled state [ 319.949604][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 319.960867][ T8808] 8021q: adding VLAN 0 to HW filter on device team0 [ 319.975413][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 319.983907][ T157] bridge0: port 1(bridge_slave_0) entered blocking state [ 319.990930][ T157] bridge0: port 1(bridge_slave_0) entered forwarding state [ 320.009322][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 320.020303][ T20] bridge0: port 2(bridge_slave_1) entered blocking state [ 320.027424][ T20] bridge0: port 2(bridge_slave_1) entered forwarding state [ 320.087037][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 320.096083][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 320.120686][ T8808] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 320.141986][ T8808] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 320.172387][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 320.180272][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 320.217998][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 320.371988][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 320.401107][ T8774] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 320.413631][ T8774] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 320.425386][ T8808] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 320.532749][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 320.541145][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 320.583840][ T8808] device veth0_vlan entered promiscuous mode [ 320.591735][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 320.592148][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 320.608362][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 320.616487][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 320.658958][ T8808] device veth1_vlan entered promiscuous mode [ 320.677525][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 320.686585][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 320.694514][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 320.704032][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 320.716586][ T8808] device veth0_macvtap entered promiscuous mode [ 320.726352][ T8808] device veth1_macvtap entered promiscuous mode [ 320.740371][ T8808] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 320.750979][ T8808] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 320.762194][ T8808] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 320.769441][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 320.778105][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 320.786335][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 320.795174][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 320.827290][ T8808] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 320.837927][ T8808] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 320.849605][ T8808] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 320.857916][ T8775] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 320.866588][ T8775] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 320.967095][ T8] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 320.979439][ T8] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 320.991112][ T157] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 321.006797][ T8] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 321.016680][ T8] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 321.049843][ T8775] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 321.336459][ T8378] device hsr_slave_0 left promiscuous mode [ 321.343076][ T8378] device hsr_slave_1 left promiscuous mode [ 321.349509][ T8378] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 321.357239][ T8378] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 321.365415][ T8378] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 321.372912][ T8378] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 321.380500][ T8378] device bridge_slave_1 left promiscuous mode [ 321.387584][ T8378] bridge0: port 2(bridge_slave_1) entered disabled state [ 321.395558][ T8378] device bridge_slave_0 left promiscuous mode [ 321.401996][ T8378] bridge0: port 1(bridge_slave_0) entered disabled state [ 321.410978][ T8378] device veth1_macvtap left promiscuous mode [ 321.417993][ T8378] device veth0_macvtap left promiscuous mode [ 321.424127][ T8378] device veth1_vlan left promiscuous mode [ 321.429900][ T8378] device veth0_vlan left promiscuous mode [ 322.333515][ T8378] team0 (unregistering): Port device team_slave_1 removed [ 322.343393][ T8378] team0 (unregistering): Port device team_slave_0 removed [ 322.353652][ T8378] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 322.365213][ T8378] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 322.395823][ T8378] bond0 (unregistering): Released all slaves [ 323.497045][ T9207] chnl_net:caif_netlink_parms(): no params data found [ 323.571408][ T9207] bridge0: port 1(bridge_slave_0) entered blocking state [ 323.578638][ T9207] bridge0: port 1(bridge_slave_0) entered disabled state [ 323.586819][ T9207] device bridge_slave_0 entered promiscuous mode [ 323.615274][ T9207] bridge0: port 2(bridge_slave_1) entered blocking state [ 323.622545][ T9207] bridge0: port 2(bridge_slave_1) entered disabled state [ 323.629998][ T9207] device bridge_slave_1 entered promiscuous mode [ 323.674724][ T9207] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 323.686549][ T9207] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 323.745925][ T9207] team0: Port device team_slave_0 added [ 323.753495][ T9207] team0: Port device team_slave_1 added [ 323.774222][ T9207] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 323.781813][ T9207] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 323.808532][ T9207] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 323.825370][ T8378] device hsr_slave_0 left promiscuous mode [ 323.834383][ T8378] device hsr_slave_1 left promiscuous mode [ 323.840530][ T8378] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 323.848547][ T8378] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 323.856613][ T8378] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 323.864049][ T8378] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 323.872590][ T8378] device bridge_slave_1 left promiscuous mode [ 323.878699][ T8378] bridge0: port 2(bridge_slave_1) entered disabled state [ 323.888781][ T8378] device bridge_slave_0 left promiscuous mode [ 323.895642][ T8378] bridge0: port 1(bridge_slave_0) entered disabled state [ 323.905024][ T8378] device veth1_macvtap left promiscuous mode [ 323.911704][ T8378] device veth0_macvtap left promiscuous mode [ 323.917723][ T8378] device veth1_vlan left promiscuous mode [ 323.923542][ T8378] device veth0_vlan left promiscuous mode [ 324.765552][ T22] ================================================================== [ 324.773617][ T22] BUG: KASAN: use-after-free in __d_alloc+0x19a/0x950 [ 324.780443][ T22] Read of size 5 at addr ffff8880139ed520 by task kdevtmpfs/22 [ 324.787962][ T22] [ 324.790266][ T22] CPU: 0 PID: 22 Comm: kdevtmpfs Not tainted 5.14.0-syzkaller #0 [ 324.797959][ T22] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 324.807990][ T22] Call Trace: [ 324.811256][ T22] dump_stack_lvl+0xcd/0x134 [ 324.815933][ T22] print_address_description.constprop.0.cold+0x6c/0x309 [ 324.822979][ T22] ? __d_alloc+0x19a/0x950 [ 324.827393][ T22] ? __d_alloc+0x19a/0x950 [ 324.831979][ T22] kasan_report.cold+0x83/0xdf [ 324.836740][ T22] ? __d_alloc+0x19a/0x950 [ 324.841143][ T22] kasan_check_range+0x13d/0x180 [ 324.846147][ T22] memcpy+0x20/0x60 [ 324.849968][ T22] __d_alloc+0x19a/0x950 [ 324.854191][ T22] d_alloc+0x4a/0x230 [ 324.858155][ T22] __lookup_hash+0xc8/0x180 [ 324.862646][ T22] kern_path_locked+0x17e/0x320 [ 324.867476][ T22] ? filename_lookup+0x80/0x80 [ 324.872230][ T22] ? rcu_read_lock_sched_held+0xd/0x70 [ 324.877718][ T22] ? rcu_read_lock_sched_held+0xd/0x70 [ 324.883168][ T22] handle_remove+0xa2/0x5fe [ 324.887718][ T22] ? lock_downgrade+0x6e0/0x6e0 [ 324.892714][ T22] ? cacheinfo_cpu_online.cold+0x3e/0x3e [ 324.898367][ T22] ? finish_task_switch.isra.0+0x232/0xa50 [ 324.904237][ T22] ? trace_hardirqs_on+0x5b/0x1c0 [ 324.909318][ T22] ? finish_task_switch.isra.0+0x232/0xa50 [ 324.915142][ T22] ? __switch_to+0x5cc/0x1060 [ 324.919867][ T22] ? rcu_read_lock_sched_held+0xd/0x70 [ 324.925319][ T22] ? lock_acquire+0x442/0x510 [ 324.930013][ T22] ? rcu_read_lock_sched_held+0xd/0x70 [ 324.935466][ T22] ? lock_release+0x522/0x720 [ 324.940141][ T22] ? devtmpfsd+0xaa/0x2a3 [ 324.944512][ T22] ? lock_downgrade+0x6e0/0x6e0 [ 324.949346][ T22] ? do_raw_spin_lock+0x120/0x2b0 [ 324.954471][ T22] ? rwlock_bug.part.0+0x90/0x90 [ 324.959393][ T22] devtmpfsd+0x1b9/0x2a3 [ 324.963621][ T22] ? dmar_validate_one_drhd+0x24d/0x24d [ 324.969147][ T22] kthread+0x3e5/0x4d0 [ 324.973264][ T22] ? set_kthread_struct+0x130/0x130 [ 324.978443][ T22] ret_from_fork+0x1f/0x30 [ 324.982859][ T22] [ 324.985176][ T22] Allocated by task 22: [ 324.989312][ T22] kasan_save_stack+0x1b/0x40 [ 324.993970][ T22] __kasan_slab_alloc+0x83/0xb0 [ 324.998801][ T22] kmem_cache_alloc+0x285/0x4a0 [ 325.003715][ T22] getname_kernel+0x4e/0x370 [ 325.008281][ T22] kern_path_locked+0x71/0x320 [ 325.013024][ T22] handle_remove+0xa2/0x5fe [ 325.017506][ T22] devtmpfsd+0x1b9/0x2a3 [ 325.021727][ T22] kthread+0x3e5/0x4d0 [ 325.025774][ T22] ret_from_fork+0x1f/0x30 [ 325.030169][ T22] [ 325.032469][ T22] Freed by task 22: [ 325.036251][ T22] kasan_save_stack+0x1b/0x40 [ 325.040914][ T22] kasan_set_track+0x1c/0x30 [ 325.045487][ T22] kasan_set_free_info+0x20/0x30 [ 325.050405][ T22] __kasan_slab_free+0xff/0x130 [ 325.055233][ T22] slab_free_freelist_hook+0xe3/0x250 [ 325.060585][ T22] kmem_cache_free+0x8a/0x5b0 [ 325.065242][ T22] putname.part.0+0xe1/0x120 [ 325.069901][ T22] kern_path_locked+0xc2/0x320 [ 325.074651][ T22] handle_remove+0xa2/0x5fe [ 325.079134][ T22] devtmpfsd+0x1b9/0x2a3 [ 325.083358][ T22] kthread+0x3e5/0x4d0 [ 325.087521][ T22] ret_from_fork+0x1f/0x30 [ 325.091926][ T22] [ 325.094232][ T22] The buggy address belongs to the object at ffff8880139ed500 [ 325.094232][ T22] which belongs to the cache names_cache of size 4096 [ 325.108360][ T22] The buggy address is located 32 bytes inside of [ 325.108360][ T22] 4096-byte region [ffff8880139ed500, ffff8880139ee500) [ 325.121750][ T22] The buggy address belongs to the page: [ 325.127371][ T22] page:ffffea00004e7a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880139eb300 pfn:0x139e8 [ 325.138807][ T22] head:ffffea00004e7a00 order:3 compound_mapcount:0 compound_pincount:0 [ 325.147110][ T22] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 325.155076][ T22] raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888010dc63c0 [ 325.163695][ T22] raw: ffff8880139eb300 0000000080070006 00000001ffffffff 0000000000000000 [ 325.172303][ T22] page dumped because: kasan: bad access detected [ 325.178699][ T22] page_owner tracks the page as allocated [ 325.184392][ T22] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6378, ts 51264701859, free_ts 51224474186 [ 325.203472][ T22] get_page_from_freelist+0xa72/0x2f80 [ 325.208949][ T22] __alloc_pages+0x1b2/0x500 [ 325.213521][ T22] alloc_pages+0x1a7/0x300 [ 325.217963][ T22] allocate_slab+0x32e/0x4b0 [ 325.222535][ T22] ___slab_alloc+0x473/0x7b0 [ 325.227106][ T22] __slab_alloc.constprop.0+0xa7/0xf0 [ 325.232457][ T22] kmem_cache_alloc+0x3e1/0x4a0 [ 325.237305][ T22] getname_flags.part.0+0x50/0x4f0 [ 325.242420][ T22] getname+0x8e/0xd0 [ 325.246293][ T22] do_sys_openat2+0xf5/0x4d0 [ 325.250900][ T22] __x64_sys_open+0x119/0x1c0 [ 325.255571][ T22] do_syscall_64+0x35/0xb0 [ 325.260018][ T22] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 325.265923][ T22] page last free stack trace: [ 325.270581][ T22] free_pcp_prepare+0x2c5/0x780 [ 325.275411][ T22] free_unref_page+0x19/0x690 [ 325.280065][ T22] unfreeze_partials+0x16c/0x1b0 [ 325.284984][ T22] put_cpu_partial+0x13d/0x230 [ 325.289728][ T22] qlist_free_all+0x5a/0xc0 [ 325.294216][ T22] kasan_quarantine_reduce+0x180/0x200 [ 325.299652][ T22] __kasan_slab_alloc+0x95/0xb0 [ 325.304481][ T22] kmem_cache_alloc+0x285/0x4a0 [ 325.309310][ T22] getname_flags.part.0+0x50/0x4f0 [ 325.314405][ T22] getname_flags+0x9a/0xe0 [ 325.318801][ T22] user_path_at_empty+0x2b/0x90 [ 325.323644][ T22] vfs_statx+0x142/0x390 [ 325.327869][ T22] __do_sys_newlstat+0x91/0x110 [ 325.332697][ T22] do_syscall_64+0x35/0xb0 [ 325.337101][ T22] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 325.342975][ T22] [ 325.345275][ T22] Memory state around the buggy address: [ 325.350884][ T22] ffff8880139ed400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 325.358931][ T22] ffff8880139ed480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 325.366977][ T22] >ffff8880139ed500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 325.375017][ T22] ^ [ 325.380099][ T22] ffff8880139ed580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 325.388135][ T22] ffff8880139ed600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 325.396514][ T22] ================================================================== [ 325.400906][ T20] Bluetooth: hci0: command 0x0409 tx timeout [ 325.405083][ T22] Kernel panic - not syncing: panic_on_warn set ... [ 325.417077][ T22] CPU: 0 PID: 22 Comm: kdevtmpfs Tainted: G B 5.14.0-syzkaller #0 [ 325.426186][ T22] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 325.436234][ T22] Call Trace: [ 325.439510][ T22] dump_stack_lvl+0xcd/0x134 [ 325.444107][ T22] panic+0x2b0/0x6dd [ 325.448029][ T22] ? __warn_printk+0xf3/0xf3 [ 325.452623][ T22] ? preempt_schedule_common+0x59/0xc0 [ 325.458092][ T22] ? __d_alloc+0x19a/0x950 [ 325.462506][ T22] ? preempt_schedule_thunk+0x16/0x18 [ 325.467877][ T22] ? trace_hardirqs_on+0x38/0x1c0 [ 325.472905][ T22] ? trace_hardirqs_on+0x51/0x1c0 [ 325.477926][ T22] ? __d_alloc+0x19a/0x950 [ 325.482352][ T22] ? __d_alloc+0x19a/0x950 [ 325.486760][ T22] end_report.cold+0x63/0x6f [ 325.491350][ T22] kasan_report.cold+0x71/0xdf [ 325.496117][ T22] ? __d_alloc+0x19a/0x950 [ 325.500610][ T22] kasan_check_range+0x13d/0x180 [ 325.505557][ T22] memcpy+0x20/0x60 [ 325.509361][ T22] __d_alloc+0x19a/0x950 [ 325.513599][ T22] d_alloc+0x4a/0x230 [ 325.517576][ T22] __lookup_hash+0xc8/0x180 [ 325.522075][ T22] kern_path_locked+0x17e/0x320 [ 325.526929][ T22] ? filename_lookup+0x80/0x80 [ 325.531687][ T22] ? rcu_read_lock_sched_held+0xd/0x70 [ 325.537138][ T22] ? rcu_read_lock_sched_held+0xd/0x70 [ 325.542589][ T22] handle_remove+0xa2/0x5fe [ 325.547090][ T22] ? lock_downgrade+0x6e0/0x6e0 [ 325.551934][ T22] ? cacheinfo_cpu_online.cold+0x3e/0x3e [ 325.557608][ T22] ? finish_task_switch.isra.0+0x232/0xa50 [ 325.563408][ T22] ? trace_hardirqs_on+0x5b/0x1c0 [ 325.568431][ T22] ? finish_task_switch.isra.0+0x232/0xa50 [ 325.574229][ T22] ? __switch_to+0x5cc/0x1060 [ 325.578899][ T22] ? rcu_read_lock_sched_held+0xd/0x70 [ 325.584347][ T22] ? lock_acquire+0x442/0x510 [ 325.589030][ T22] ? rcu_read_lock_sched_held+0xd/0x70 [ 325.594504][ T22] ? lock_release+0x522/0x720 [ 325.599174][ T22] ? devtmpfsd+0xaa/0x2a3 [ 325.603514][ T22] ? lock_downgrade+0x6e0/0x6e0 [ 325.608355][ T22] ? do_raw_spin_lock+0x120/0x2b0 [ 325.613371][ T22] ? rwlock_bug.part.0+0x90/0x90 [ 325.618317][ T22] devtmpfsd+0x1b9/0x2a3 [ 325.622559][ T22] ? dmar_validate_one_drhd+0x24d/0x24d [ 325.628097][ T22] kthread+0x3e5/0x4d0 [ 325.632159][ T22] ? set_kthread_struct+0x130/0x130 [ 325.637353][ T22] ret_from_fork+0x1f/0x30 [ 325.643113][ T22] Kernel Offset: disabled [ 325.647420][ T22] Rebooting in 86400 seconds..