DUID 00:04:bf:e1:a4:b2:b1:2b:3d:59:87:c9:47:74:aa:d6:f6:6a
forked to background, child pid 3182
[ 31.245394][ T3183] 8021q: adding VLAN 0 to HW filter on device bond0
[ 31.271262][ T3183] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.0.138' (ECDSA) to the list of known hosts.
2021/12/14 14:58:25 fuzzer started
2021/12/14 14:58:26 connecting to host at 10.128.0.169:37265
2021/12/14 14:58:26 checking machine...
2021/12/14 14:58:26 checking revisions...
2021/12/14 14:58:26 testing simple program...
syzkaller login: [ 47.397143][ T3607] cgroup: Unknown subsys name 'net'
[ 47.512469][ T3607] cgroup: Unknown subsys name 'rlimit'
[ 48.785323][ T3609] chnl_net:caif_netlink_parms(): no params data found
[ 48.830932][ T3609] bridge0: port 1(bridge_slave_0) entered blocking state
[ 48.838639][ T3609] bridge0: port 1(bridge_slave_0) entered disabled state
[ 48.846725][ T3609] device bridge_slave_0 entered promiscuous mode
[ 48.857044][ T3609] bridge0: port 2(bridge_slave_1) entered blocking state
[ 48.864201][ T3609] bridge0: port 2(bridge_slave_1) entered disabled state
[ 48.872430][ T3609] device bridge_slave_1 entered promiscuous mode
[ 48.894071][ T3609] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 48.905996][ T3609] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 48.931642][ T3609] team0: Port device team_slave_0 added
[ 48.939690][ T3609] team0: Port device team_slave_1 added
[ 48.958654][ T3609] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 48.966107][ T3609] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 48.992582][ T3609] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 49.005381][ T3609] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 49.012505][ T3609] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 49.038716][ T3609] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 49.065687][ T3609] device hsr_slave_0 entered promiscuous mode
[ 49.073075][ T3609] device hsr_slave_1 entered promiscuous mode
[ 49.158489][ T3609] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 49.169969][ T3609] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 49.180032][ T3609] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 49.188990][ T3609] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 49.211209][ T3609] bridge0: port 2(bridge_slave_1) entered blocking state
[ 49.218538][ T3609] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 49.226593][ T3609] bridge0: port 1(bridge_slave_0) entered blocking state
[ 49.233674][ T3609] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 49.283011][ T3609] 8021q: adding VLAN 0 to HW filter on device bond0
[ 49.297243][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 49.310056][ T25] bridge0: port 1(bridge_slave_0) entered disabled state
[ 49.318690][ T25] bridge0: port 2(bridge_slave_1) entered disabled state
[ 49.328135][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 49.342042][ T3609] 8021q: adding VLAN 0 to HW filter on device team0
[ 49.354535][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 49.363529][ T136] bridge0: port 1(bridge_slave_0) entered blocking state
[ 49.370637][ T136] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 49.382006][ T922] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 49.392098][ T922] bridge0: port 2(bridge_slave_1) entered blocking state
[ 49.399210][ T922] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 49.420358][ T922] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 49.429915][ T922] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 49.442381][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 49.456573][ T922] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 49.469358][ T3609] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 49.482023][ T3609] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 49.490658][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 49.516013][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 49.523689][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 49.537909][ T3609] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 49.561610][ T922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 49.602481][ T922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 49.611810][ T922] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 49.620228][ T922] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 49.632409][ T3609] device veth0_vlan entered promiscuous mode
[ 49.648214][ T3609] device veth1_vlan entered promiscuous mode
[ 49.672406][ T922] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 49.680510][ T922] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 49.689133][ T922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 49.700971][ T3609] device veth0_macvtap entered promiscuous mode
[ 49.710743][ T3609] device veth1_macvtap entered promiscuous mode
[ 49.729509][ T3609] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 49.737590][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 49.747753][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 49.760438][ T3609] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 49.768363][ T922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 49.784116][ T3609] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 49.794698][ T3609] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 49.804360][ T3609] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 49.815988][ T3609] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 49.880048][ T10] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 49.900532][ T10] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 49.910696][ T922] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 49.919055][ T10] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 49.927498][ T10] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 49.936886][ T922] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
2021/12/14 14:58:28 building call list...
[ 50.163945][ T8] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
executing program
[ 52.038865][ T3600] can: request_module (can-proto-0) failed.
[ 52.061006][ T3600] can: request_module (can-proto-0) failed.
[ 52.082295][ T3600] can: request_module (can-proto-0) failed.
[ 52.282096][ T3600] ------------[ cut here ]------------
[ 52.287909][ T3600] refcount_t: decrement hit 0; leaking memory.
[ 52.294439][ T3600] WARNING: CPU: 0 PID: 3600 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0
[ 52.304021][ T3600] Modules linked in:
[ 52.308303][ T3600] CPU: 0 PID: 3600 Comm: syz-fuzzer Not tainted 5.16.0-rc4-syzkaller #0
[ 52.316882][ T3600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 52.327132][ T3600] RIP: 0010:refcount_warn_saturate+0xbf/0x1e0
[ 52.333219][ T3600] Code: 1d d1 9f a1 09 31 ff 89 de e8 cd 42 9c fd 84 db 75 e0 e8 e4 3e 9c fd 48 c7 c7 60 fa 04 8a c6 05 b1 9f a1 09 01 e8 ac 44 27 05 <0f> 0b eb c4 e8 c8 3e 9c fd 0f b6 1d a0 9f a1 09 31 ff 89 de e8 98
[ 52.353294][ T3600] RSP: 0018:ffffc90002abfab0 EFLAGS: 00010286
[ 52.359677][ T3600] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 52.368001][ T3600] RDX: ffff88807dbc3a00 RSI: ffffffff815f1db8 RDI: fffff52000557f48
[ 52.376222][ T3600] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
[ 52.384213][ T3600] R10: ffffffff815ebb5e R11: 0000000000000000 R12: 1ffff92000557f5b
[ 52.392773][ T3600] R13: 00000000ffffffef R14: ffffffff8d2fcb14 R15: ffffc90002abfd10
[ 52.401037][ T3600] FS: 000000c000030890(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
[ 52.410320][ T3600] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 52.417152][ T3600] CR2: 0000000001058048 CR3: 0000000022259000 CR4: 00000000003506f0
[ 52.425124][ T3600] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 52.433459][ T3600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 52.443158][ T3600] Call Trace:
[ 52.446634][ T3600]
[ 52.449577][ T3600] ref_tracker_free+0x4fe/0x610
[ 52.454529][ T3600] ? ref_tracker_dir_exit+0x330/0x330
[ 52.460163][ T3600] ? bpf_sk_storage_free+0x333/0x3e0
[ 52.465533][ T3600] ? lock_downgrade+0x6e0/0x6e0
[ 52.470398][ T3600] ? kfree+0x1e1/0x560
[ 52.474504][ T3600] __sk_destruct+0x4a6/0x920
[ 52.479171][ T3600] sk_destruct+0xbd/0xe0
[ 52.483431][ T3600] __sk_free+0xef/0x3d0
[ 52.487669][ T3600] sk_free+0x78/0xa0
[ 52.491579][ T3600] __mptcp_close_ssk+0x435/0x590
[ 52.496590][ T3600] __mptcp_destroy_sock+0x35f/0x830
[ 52.502037][ T3600] ? __mptcp_close_ssk+0x590/0x590
[ 52.507223][ T3600] ? __local_bh_enable_ip+0xa0/0x120
[ 52.512535][ T3600] mptcp_close+0x5f8/0x7f0
[ 52.517029][ T3600] inet_release+0x12e/0x280
[ 52.521645][ T3600] inet6_release+0x4c/0x70
[ 52.526405][ T3600] __sock_release+0xcd/0x280
[ 52.531143][ T3600] sock_close+0x18/0x20
[ 52.535295][ T3600] __fput+0x286/0x9f0
[ 52.539320][ T3600] ? __sock_release+0x280/0x280
[ 52.544193][ T3600] task_work_run+0xdd/0x1a0
[ 52.548751][ T3600] exit_to_user_mode_prepare+0x27e/0x290
[ 52.554407][ T3600] syscall_exit_to_user_mode+0x19/0x60
[ 52.559935][ T3600] do_syscall_64+0x42/0xb0
[ 52.564378][ T3600] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 52.570349][ T3600] RIP: 0033:0x4b12db
[ 52.574253][ T3600] Code: fb ff eb bd e8 46 96 fb ff e9 61 ff ff ff cc e8 fb 61 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30
[ 52.594075][ T3600] RSP: 002b:000000c0002c34f0 EFLAGS: 00000206 ORIG_RAX: 0000000000000003
[ 52.602689][ T3600] RAX: 0000000000000000 RBX: 000000c00001e000 RCX: 00000000004b12db
[ 52.611498][ T3600] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006
[ 52.619553][ T3600] RBP: 000000c0002c3530 R08: 0000000000f0ae01 R09: 00007ffe8db68080
[ 52.627731][ T3600] R10: 00007ffe8db68090 R11: 0000000000000206 R12: 0000000000000080
[ 52.635754][ T3600] R13: 0000000000000000 R14: ffffffffffffffff R15: 000000c0000120a0
[ 52.643751][ T3600]
[ 52.646847][ T3600] Kernel panic - not syncing: panic_on_warn set ...
[ 52.653442][ T3600] CPU: 1 PID: 3600 Comm: syz-fuzzer Not tainted 5.16.0-rc4-syzkaller #0
[ 52.661760][ T3600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 52.671804][ T3600] Call Trace:
[ 52.675074][ T3600]
[ 52.677996][ T3600] dump_stack_lvl+0xcd/0x134
[ 52.682594][ T3600] panic+0x2b0/0x6dd
[ 52.686491][ T3600] ? __warn_printk+0xf3/0xf3
[ 52.691090][ T3600] ? __warn.cold+0x1a/0x44
[ 52.695516][ T3600] ? refcount_warn_saturate+0xbf/0x1e0
[ 52.700989][ T3600] __warn.cold+0x35/0x44
[ 52.705235][ T3600] ? wake_up_klogd.part.0+0x8e/0xd0
[ 52.710443][ T3600] ? refcount_warn_saturate+0xbf/0x1e0
[ 52.715913][ T3600] report_bug+0x1bd/0x210
[ 52.720255][ T3600] handle_bug+0x3c/0x60
[ 52.724419][ T3600] exc_invalid_op+0x14/0x40
[ 52.728927][ T3600] asm_exc_invalid_op+0x12/0x20
[ 52.733776][ T3600] RIP: 0010:refcount_warn_saturate+0xbf/0x1e0
[ 52.739850][ T3600] Code: 1d d1 9f a1 09 31 ff 89 de e8 cd 42 9c fd 84 db 75 e0 e8 e4 3e 9c fd 48 c7 c7 60 fa 04 8a c6 05 b1 9f a1 09 01 e8 ac 44 27 05 <0f> 0b eb c4 e8 c8 3e 9c fd 0f b6 1d a0 9f a1 09 31 ff 89 de e8 98
[ 52.759543][ T3600] RSP: 0018:ffffc90002abfab0 EFLAGS: 00010286
[ 52.765614][ T3600] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 52.773589][ T3600] RDX: ffff88807dbc3a00 RSI: ffffffff815f1db8 RDI: fffff52000557f48
[ 52.781656][ T3600] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
[ 52.789628][ T3600] R10: ffffffff815ebb5e R11: 0000000000000000 R12: 1ffff92000557f5b
[ 52.797703][ T3600] R13: 00000000ffffffef R14: ffffffff8d2fcb14 R15: ffffc90002abfd10
[ 52.805678][ T3600] ? wake_up_klogd.part.0+0x8e/0xd0
[ 52.810888][ T3600] ? vprintk+0x88/0x90
[ 52.814964][ T3600] ref_tracker_free+0x4fe/0x610
[ 52.819904][ T3600] ? ref_tracker_dir_exit+0x330/0x330
[ 52.825280][ T3600] ? bpf_sk_storage_free+0x333/0x3e0
[ 52.830572][ T3600] ? lock_downgrade+0x6e0/0x6e0
[ 52.835428][ T3600] ? kfree+0x1e1/0x560
[ 52.839520][ T3600] __sk_destruct+0x4a6/0x920
[ 52.844124][ T3600] sk_destruct+0xbd/0xe0
[ 52.848368][ T3600] __sk_free+0xef/0x3d0
[ 52.852530][ T3600] sk_free+0x78/0xa0
[ 52.856434][ T3600] __mptcp_close_ssk+0x435/0x590
[ 52.861378][ T3600] __mptcp_destroy_sock+0x35f/0x830
[ 52.866582][ T3600] ? __mptcp_close_ssk+0x590/0x590
[ 52.871696][ T3600] ? __local_bh_enable_ip+0xa0/0x120
[ 52.876988][ T3600] mptcp_close+0x5f8/0x7f0
[ 52.881412][ T3600] inet_release+0x12e/0x280
[ 52.885923][ T3600] inet6_release+0x4c/0x70
[ 52.890343][ T3600] __sock_release+0xcd/0x280
[ 52.894948][ T3600] sock_close+0x18/0x20
[ 52.899111][ T3600] __fput+0x286/0x9f0
[ 52.903101][ T3600] ? __sock_release+0x280/0x280
[ 52.907968][ T3600] task_work_run+0xdd/0x1a0
[ 52.912479][ T3600] exit_to_user_mode_prepare+0x27e/0x290
[ 52.918121][ T3600] syscall_exit_to_user_mode+0x19/0x60
[ 52.924796][ T3600] do_syscall_64+0x42/0xb0
[ 52.929216][ T3600] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 52.935112][ T3600] RIP: 0033:0x4b12db
[ 52.939005][ T3600] Code: fb ff eb bd e8 46 96 fb ff e9 61 ff ff ff cc e8 fb 61 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30
[ 52.958613][ T3600] RSP: 002b:000000c0002c34f0 EFLAGS: 00000206 ORIG_RAX: 0000000000000003
[ 52.967034][ T3600] RAX: 0000000000000000 RBX: 000000c00001e000 RCX: 00000000004b12db
[ 52.975007][ T3600] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006
[ 52.982978][ T3600] RBP: 000000c0002c3530 R08: 0000000000f0ae01 R09: 00007ffe8db68080
[ 52.990949][ T3600] R10: 00007ffe8db68090 R11: 0000000000000206 R12: 0000000000000080
[ 52.998919][ T3600] R13: 0000000000000000 R14: ffffffffffffffff R15: 000000c0000120a0
[ 53.006904][ T3600]
[ 53.010356][ T3600] Kernel Offset: disabled
[ 53.014776][ T3600] Rebooting in 86400 seconds..