Warning: Permanently added '10.128.0.188' (ECDSA) to the list of known hosts. 2021/09/07 00:27:39 parsed 1 programs 2021/09/07 00:27:39 executed programs: 0 [ 1079.468026][ T8463] chnl_net:caif_netlink_parms(): no params data found [ 1079.539276][ T8463] bridge0: port 1(bridge_slave_0) entered blocking state [ 1079.549566][ T8463] bridge0: port 1(bridge_slave_0) entered disabled state [ 1079.557689][ T8463] device bridge_slave_0 entered promiscuous mode [ 1079.566781][ T8463] bridge0: port 2(bridge_slave_1) entered blocking state [ 1079.574085][ T8463] bridge0: port 2(bridge_slave_1) entered disabled state [ 1079.581996][ T8463] device bridge_slave_1 entered promiscuous mode [ 1079.611172][ T8463] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1079.622454][ T8463] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1079.652526][ T8463] team0: Port device team_slave_0 added [ 1079.660133][ T8463] team0: Port device team_slave_1 added [ 1079.684682][ T8463] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1079.691835][ T8463] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1079.717754][ T8463] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1079.730615][ T8463] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1079.737553][ T8463] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1079.763615][ T8463] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1079.800752][ T8463] device hsr_slave_0 entered promiscuous mode [ 1079.807957][ T8463] device hsr_slave_1 entered promiscuous mode [ 1079.928256][ T8463] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1079.939874][ T8463] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1079.951424][ T8463] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1079.960215][ T8463] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1079.982469][ T8463] bridge0: port 2(bridge_slave_1) entered blocking state [ 1079.989594][ T8463] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1079.997423][ T8463] bridge0: port 1(bridge_slave_0) entered blocking state [ 1080.004566][ T8463] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1080.047352][ T8463] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1080.059338][ T8438] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1080.071765][ T8438] bridge0: port 1(bridge_slave_0) entered disabled state [ 1080.081260][ T8438] bridge0: port 2(bridge_slave_1) entered disabled state [ 1080.089009][ T8438] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 1080.101693][ T8463] 8021q: adding VLAN 0 to HW filter on device team0 [ 1080.112457][ T8438] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1080.122658][ T8438] bridge0: port 1(bridge_slave_0) entered blocking state [ 1080.129746][ T8438] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1080.141981][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1080.150363][ T8796] bridge0: port 2(bridge_slave_1) entered blocking state [ 1080.157397][ T8796] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1080.177694][ T8438] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1080.186349][ T8438] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1080.198439][ T2947] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1080.210633][ T8438] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1080.223863][ T8797] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1080.234157][ T8463] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1080.252169][ T8797] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1080.259517][ T8797] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1080.273144][ T8463] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1080.292812][ T8438] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1080.311005][ T8438] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1080.319305][ T8438] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1080.327946][ T8438] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1080.337867][ T8463] device veth0_vlan entered promiscuous mode [ 1080.351590][ T8463] device veth1_vlan entered promiscuous mode [ 1080.371761][ T8438] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 1080.380697][ T8438] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 1080.388675][ T8438] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1080.400588][ T8463] device veth0_macvtap entered promiscuous mode [ 1080.410657][ T8463] device veth1_macvtap entered promiscuous mode [ 1080.428216][ T8463] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1080.435617][ T2947] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1080.445825][ T2947] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1080.457621][ T8463] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1080.466081][ T8438] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1080.475392][ T8438] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1080.486368][ T8463] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1080.495937][ T8463] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1080.504998][ T8463] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1080.514049][ T8463] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1080.610155][ T432] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1080.622493][ T432] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1080.652524][ T2947] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1080.656143][ T8566] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1080.668452][ T8566] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1080.681665][ T2947] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1081.125740][ T10] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1083.520734][ T8463] syz-executor.0 (8463) used greatest stack depth: 22048 bytes left [ 1083.748853][ T10] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1085.828381][ T8833] chnl_net:caif_netlink_parms(): no params data found [ 1085.890839][ T8833] bridge0: port 1(bridge_slave_0) entered blocking state [ 1085.898651][ T8833] bridge0: port 1(bridge_slave_0) entered disabled state [ 1085.907697][ T8833] device bridge_slave_0 entered promiscuous mode [ 1085.917701][ T8833] bridge0: port 2(bridge_slave_1) entered blocking state [ 1085.925585][ T8833] bridge0: port 2(bridge_slave_1) entered disabled state [ 1085.934698][ T8833] device bridge_slave_1 entered promiscuous mode [ 1085.966135][ T8833] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1085.977442][ T8833] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1086.013052][ T8833] team0: Port device team_slave_0 added [ 1086.021748][ T8833] team0: Port device team_slave_1 added [ 1086.049987][ T8833] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1086.058250][ T8833] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1086.085433][ T8833] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1086.101432][ T8833] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1086.108366][ T8833] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1086.135391][ T8833] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1086.173749][ T8833] device hsr_slave_0 entered promiscuous mode [ 1086.180750][ T8833] device hsr_slave_1 entered promiscuous mode [ 1086.187129][ T8833] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1086.195119][ T8833] Cannot create hsr debugfs directory [ 1086.353690][ T10] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1086.394519][ T8833] bridge0: port 2(bridge_slave_1) entered blocking state [ 1086.401593][ T8833] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1086.408851][ T8833] bridge0: port 1(bridge_slave_0) entered blocking state [ 1086.415923][ T8833] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1086.523732][ T10] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1086.568773][ T8833] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1086.584486][ T8438] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1086.593420][ T8438] bridge0: port 1(bridge_slave_0) entered disabled state [ 1086.601387][ T8438] bridge0: port 2(bridge_slave_1) entered disabled state [ 1086.610173][ T8438] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 1086.623362][ T8833] 8021q: adding VLAN 0 to HW filter on device team0 [ 1086.638849][ T2947] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1086.650401][ T2947] bridge0: port 1(bridge_slave_0) entered blocking state [ 1086.657458][ T2947] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1086.670768][ T8438] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1086.680962][ T8438] bridge0: port 2(bridge_slave_1) entered blocking state [ 1086.688001][ T8438] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1086.738584][ T8797] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1086.760449][ T8797] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1086.810269][ T8797] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1086.842997][ T8797] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1086.857262][ T8797] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1086.876498][ T8833] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1087.318129][ T8833] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1087.329770][ T8438] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1087.337195][ T8438] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1087.654272][ T8830] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1087.664232][ T8830] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1087.690367][ T8797] Bluetooth: hci0: command 0x0409 tx timeout [ 1087.767241][ T8833] device veth0_vlan entered promiscuous mode [ 1087.775199][ T8830] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1087.784135][ T8830] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1087.794994][ T8830] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1087.802750][ T8830] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1087.819160][ T8833] device veth1_vlan entered promiscuous mode [ 1087.829765][ T8830] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 1087.837554][ T8830] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 1087.859104][ T8830] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1087.867518][ T8830] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1087.968610][ T8833] device veth0_macvtap entered promiscuous mode [ 1087.980553][ T8833] device veth1_macvtap entered promiscuous mode [ 1087.997278][ T8833] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1088.007964][ T8833] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1088.022029][ T8833] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1088.107750][ T8438] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1088.115633][ T8438] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1088.125646][ T8438] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1088.134602][ T8438] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1088.224703][ T8833] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1088.235211][ T8833] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1088.246762][ T8833] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1088.255564][ T8797] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1088.264598][ T8797] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1088.507020][ T432] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1088.525995][ T432] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1088.656719][ T2947] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1088.668234][ T29] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1088.677008][ T29] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1088.686656][ T2947] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1089.126226][ T10] device hsr_slave_0 left promiscuous mode [ 1089.135200][ T10] device hsr_slave_1 left promiscuous mode [ 1089.142785][ T10] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1089.150295][ T10] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1089.159778][ T10] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1089.167169][ T10] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1089.176914][ T10] device bridge_slave_1 left promiscuous mode [ 1089.183582][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 1089.196261][ T10] device bridge_slave_0 left promiscuous mode [ 1089.203678][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 1089.221208][ T10] device veth1_macvtap left promiscuous mode [ 1089.228116][ T10] device veth0_macvtap left promiscuous mode [ 1089.234780][ T10] device veth1_vlan left promiscuous mode [ 1089.241272][ T10] device veth0_vlan left promiscuous mode [ 1092.802077][ T10] team0 (unregistering): Port device team_slave_1 removed [ 1092.816086][ T10] team0 (unregistering): Port device team_slave_0 removed [ 1092.829077][ T10] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1092.843679][ T10] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1092.897502][ T10] bond0 (unregistering): Released all slaves [ 1095.522917][ T9232] chnl_net:caif_netlink_parms(): no params data found [ 1095.692641][ T9232] bridge0: port 1(bridge_slave_0) entered blocking state [ 1095.701139][ T9232] bridge0: port 1(bridge_slave_0) entered disabled state [ 1095.709380][ T9232] device bridge_slave_0 entered promiscuous mode [ 1095.734991][ T10] device hsr_slave_0 left promiscuous mode [ 1095.741710][ T10] device hsr_slave_1 left promiscuous mode [ 1095.748097][ T10] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1095.755496][ T10] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1095.764907][ T10] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1095.772433][ T10] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1095.782097][ T10] device bridge_slave_1 left promiscuous mode [ 1095.788341][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 1095.796479][ T10] device bridge_slave_0 left promiscuous mode [ 1095.804126][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 1095.815551][ T10] device veth1_macvtap left promiscuous mode [ 1095.823154][ T10] device veth0_macvtap left promiscuous mode [ 1095.830134][ T10] device veth1_vlan left promiscuous mode [ 1095.835894][ T10] device veth0_vlan left promiscuous mode [ 1097.128383][ T4860] Bluetooth: hci0: command 0x0409 tx timeout [ 1099.207512][ T8830] Bluetooth: hci0: command 0x041b tx timeout [ 1099.308293][ T22] ================================================================== [ 1099.316569][ T22] BUG: KASAN: use-after-free in __d_alloc+0x19a/0x950 [ 1099.323397][ T22] Read of size 5 at addr ffff88807f771120 by task kdevtmpfs/22 [ 1099.330924][ T22] [ 1099.333240][ T22] CPU: 1 PID: 22 Comm: kdevtmpfs Not tainted 5.14.0-syzkaller #0 [ 1099.340955][ T22] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1099.351012][ T22] Call Trace: [ 1099.354288][ T22] dump_stack_lvl+0xcd/0x134 [ 1099.358937][ T22] print_address_description.constprop.0.cold+0x6c/0x309 [ 1099.365975][ T22] ? __d_alloc+0x19a/0x950 [ 1099.370389][ T22] ? __d_alloc+0x19a/0x950 [ 1099.374798][ T22] kasan_report.cold+0x83/0xdf [ 1099.379559][ T22] ? __d_alloc+0x19a/0x950 [ 1099.383977][ T22] kasan_check_range+0x13d/0x180 [ 1099.388946][ T22] memcpy+0x20/0x60 [ 1099.392750][ T22] __d_alloc+0x19a/0x950 [ 1099.396993][ T22] d_alloc+0x4a/0x230 [ 1099.400974][ T22] __lookup_hash+0xc8/0x180 [ 1099.405480][ T22] kern_path_locked+0x17e/0x320 [ 1099.410332][ T22] ? filename_lookup+0x80/0x80 [ 1099.415105][ T22] handle_remove+0xa2/0x5fe [ 1099.419665][ T22] ? cacheinfo_cpu_online.cold+0x3e/0x3e [ 1099.425304][ T22] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1099.431314][ T22] ? finish_task_switch.isra.0+0x232/0xa50 [ 1099.437159][ T22] ? find_held_lock+0x2d/0x110 [ 1099.441928][ T22] ? devtmpfsd+0xaa/0x2a3 [ 1099.446288][ T22] ? lock_downgrade+0x6e0/0x6e0 [ 1099.451136][ T22] ? do_raw_spin_lock+0x120/0x2b0 [ 1099.456159][ T22] ? rwlock_bug.part.0+0x90/0x90 [ 1099.461107][ T22] devtmpfsd+0x1b9/0x2a3 [ 1099.465367][ T22] ? dmar_validate_one_drhd+0x24d/0x24d [ 1099.470913][ T22] kthread+0x3e5/0x4d0 [ 1099.475036][ T22] ? set_kthread_struct+0x130/0x130 [ 1099.480674][ T22] ret_from_fork+0x1f/0x30 [ 1099.485120][ T22] [ 1099.487433][ T22] Allocated by task 22: [ 1099.491574][ T22] kasan_save_stack+0x1b/0x40 [ 1099.496272][ T22] __kasan_slab_alloc+0x83/0xb0 [ 1099.501116][ T22] kmem_cache_alloc+0x285/0x4a0 [ 1099.505962][ T22] getname_kernel+0x4e/0x370 [ 1099.510549][ T22] kern_path_locked+0x71/0x320 [ 1099.515305][ T22] handle_remove+0xa2/0x5fe [ 1099.519803][ T22] devtmpfsd+0x1b9/0x2a3 [ 1099.524041][ T22] kthread+0x3e5/0x4d0 [ 1099.528105][ T22] ret_from_fork+0x1f/0x30 [ 1099.532516][ T22] [ 1099.534830][ T22] Freed by task 22: [ 1099.538621][ T22] kasan_save_stack+0x1b/0x40 [ 1099.543295][ T22] kasan_set_track+0x1c/0x30 [ 1099.547881][ T22] kasan_set_free_info+0x20/0x30 [ 1099.552811][ T22] __kasan_slab_free+0xff/0x130 [ 1099.557653][ T22] slab_free_freelist_hook+0xe3/0x250 [ 1099.563037][ T22] kmem_cache_free+0x8a/0x5b0 [ 1099.567708][ T22] putname.part.0+0xe1/0x120 [ 1099.572297][ T22] kern_path_locked+0xc2/0x320 [ 1099.577077][ T22] handle_remove+0xa2/0x5fe [ 1099.581588][ T22] devtmpfsd+0x1b9/0x2a3 [ 1099.585826][ T22] kthread+0x3e5/0x4d0 [ 1099.589903][ T22] ret_from_fork+0x1f/0x30 [ 1099.594312][ T22] [ 1099.596620][ T22] The buggy address belongs to the object at ffff88807f771100 [ 1099.596620][ T22] which belongs to the cache names_cache of size 4096 [ 1099.610750][ T22] The buggy address is located 32 bytes inside of [ 1099.610750][ T22] 4096-byte region [ffff88807f771100, ffff88807f772100) [ 1099.624016][ T22] The buggy address belongs to the page: [ 1099.629630][ T22] page:ffffea0001fddc00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7f770 [ 1099.639769][ T22] head:ffffea0001fddc00 order:3 compound_mapcount:0 compound_pincount:0 [ 1099.648083][ T22] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 1099.656063][ T22] raw: 00fff00000010200 0000000000000000 0000000400000001 ffff8881400043c0 [ 1099.664641][ T22] raw: 0000000000000000 0000000080070007 00000001ffffffff 0000000000000000 [ 1099.673209][ T22] page dumped because: kasan: bad access detected [ 1099.679611][ T22] page_owner tracks the page as allocated [ 1099.685316][ T22] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4964, ts 27456293742, free_ts 27438178061 [ 1099.704418][ T22] get_page_from_freelist+0xa72/0x2f80 [ 1099.709916][ T22] __alloc_pages+0x1b2/0x500 [ 1099.714504][ T22] alloc_pages+0x1a7/0x300 [ 1099.718916][ T22] allocate_slab+0x32e/0x4b0 [ 1099.723504][ T22] ___slab_alloc+0x473/0x7b0 [ 1099.728091][ T22] __slab_alloc.constprop.0+0xa7/0xf0 [ 1099.733461][ T22] kmem_cache_alloc+0x3e1/0x4a0 [ 1099.738313][ T22] getname_flags.part.0+0x50/0x4f0 [ 1099.743422][ T22] getname+0x8e/0xd0 [ 1099.747316][ T22] do_sys_openat2+0xf5/0x4d0 [ 1099.751954][ T22] __x64_sys_open+0x119/0x1c0 [ 1099.756628][ T22] do_syscall_64+0x35/0xb0 [ 1099.761089][ T22] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1099.767009][ T22] page last free stack trace: [ 1099.771666][ T22] free_pcp_prepare+0x2c5/0x780 [ 1099.776510][ T22] free_unref_page+0x19/0x690 [ 1099.781194][ T22] unfreeze_partials+0x16c/0x1b0 [ 1099.786128][ T22] put_cpu_partial+0x13d/0x230 [ 1099.790886][ T22] qlist_free_all+0x5a/0xc0 [ 1099.795384][ T22] kasan_quarantine_reduce+0x180/0x200 [ 1099.800841][ T22] __kasan_slab_alloc+0x95/0xb0 [ 1099.805690][ T22] kmem_cache_alloc+0x1be/0x4a0 [ 1099.810548][ T22] shmem_alloc_inode+0x18/0x40 [ 1099.815406][ T22] alloc_inode+0x61/0x230 [ 1099.819742][ T22] new_inode+0x27/0x2f0 [ 1099.823902][ T22] shmem_get_inode+0x195/0xc20 [ 1099.828668][ T22] shmem_mknod+0x5a/0x1f0 [ 1099.833001][ T22] lookup_open.isra.0+0xfe4/0x13d0 [ 1099.838114][ T22] path_openat+0x9a5/0x2740 [ 1099.842619][ T22] do_filp_open+0x1aa/0x400 [ 1099.847126][ T22] [ 1099.849453][ T22] Memory state around the buggy address: [ 1099.855077][ T22] ffff88807f771000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1099.863136][ T22] ffff88807f771080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1099.871200][ T22] >ffff88807f771100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1099.879247][ T22] ^ [ 1099.884365][ T22] ffff88807f771180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1099.892451][ T22] ffff88807f771200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1099.900514][ T22] ================================================================== [ 1099.908563][ T22] Disabling lock debugging due to kernel taint [ 1099.920285][ T22] Kernel panic - not syncing: panic_on_warn set ... [ 1099.926879][ T22] CPU: 1 PID: 22 Comm: kdevtmpfs Tainted: G B 5.14.0-syzkaller #0 [ 1099.935995][ T22] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1099.946045][ T22] Call Trace: [ 1099.949319][ T22] dump_stack_lvl+0xcd/0x134 [ 1099.953910][ T22] panic+0x2b0/0x6dd [ 1099.957859][ T22] ? __warn_printk+0xf3/0xf3 [ 1099.962440][ T22] ? preempt_schedule_common+0x59/0xc0 [ 1099.967903][ T22] ? __d_alloc+0x19a/0x950 [ 1099.972313][ T22] ? preempt_schedule_thunk+0x16/0x18 [ 1099.977682][ T22] ? trace_hardirqs_on+0x38/0x1c0 [ 1099.982739][ T22] ? trace_hardirqs_on+0x51/0x1c0 [ 1099.987760][ T22] ? __d_alloc+0x19a/0x950 [ 1099.992182][ T22] ? __d_alloc+0x19a/0x950 [ 1099.996591][ T22] end_report.cold+0x63/0x6f [ 1100.001174][ T22] kasan_report.cold+0x71/0xdf [ 1100.005929][ T22] ? __d_alloc+0x19a/0x950 [ 1100.010342][ T22] kasan_check_range+0x13d/0x180 [ 1100.015278][ T22] memcpy+0x20/0x60 [ 1100.019080][ T22] __d_alloc+0x19a/0x950 [ 1100.023316][ T22] d_alloc+0x4a/0x230 [ 1100.027289][ T22] __lookup_hash+0xc8/0x180 [ 1100.031803][ T22] kern_path_locked+0x17e/0x320 [ 1100.036653][ T22] ? filename_lookup+0x80/0x80 [ 1100.041413][ T22] handle_remove+0xa2/0x5fe [ 1100.045916][ T22] ? cacheinfo_cpu_online.cold+0x3e/0x3e [ 1100.051546][ T22] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1100.057521][ T22] ? finish_task_switch.isra.0+0x232/0xa50 [ 1100.063327][ T22] ? find_held_lock+0x2d/0x110 [ 1100.068093][ T22] ? devtmpfsd+0xaa/0x2a3 [ 1100.072422][ T22] ? lock_downgrade+0x6e0/0x6e0 [ 1100.077266][ T22] ? do_raw_spin_lock+0x120/0x2b0 [ 1100.082288][ T22] ? rwlock_bug.part.0+0x90/0x90 [ 1100.087227][ T22] devtmpfsd+0x1b9/0x2a3 [ 1100.091469][ T22] ? dmar_validate_one_drhd+0x24d/0x24d [ 1100.097009][ T22] kthread+0x3e5/0x4d0 [ 1100.101072][ T22] ? set_kthread_struct+0x130/0x130 [ 1100.106270][ T22] ret_from_fork+0x1f/0x30 [ 1100.111949][ T22] Kernel Offset: disabled [ 1100.116332][ T22] Rebooting in 86400 seconds..