[ 57.758029][ T11] bridge0: port 1(bridge_slave_0) entered disabled state
[ 57.783944][ T11] device veth1_macvtap left promiscuous mode
[ 57.784110][ T11] device veth0_macvtap left promiscuous mode
[ 57.784248][ T11] device veth1_vlan left promiscuous mode
[ 57.784449][ T11] device veth0_vlan left promiscuous mode
[ 58.027231][ T11] team0 (unregistering): Port device team_slave_1 removed
[ 58.038078][ T11] team0 (unregistering): Port device team_slave_0 removed
[ 58.048451][ T11] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 58.064136][ T11] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 58.113796][ T11] bond0 (unregistering): Released all slaves
Warning: Permanently added '10.128.1.160' (ECDSA) to the list of known hosts.
2022/05/14 08:27:58 parsed 1 programs
2022/05/14 08:27:58 executed programs: 0
[ 72.123556][ T4132] cgroup: Unknown subsys name 'net'
[ 72.126756][ T4132] cgroup: Unknown subsys name 'rlimit'
[ 75.339011][ T48] Bluetooth: hci0: Opcode 0x c03 failed: -110
[ 76.222104][ T41] cfg80211: failed to load regulatory.db
[ 77.429156][ T3682] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 77.429803][ T3682] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 77.430228][ T3682] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 77.431007][ T3682] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 77.431805][ T3682] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 77.432067][ T3682] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 77.515558][ T4143] chnl_net:caif_netlink_parms(): no params data found
[ 77.552241][ T4143] bridge0: port 1(bridge_slave_0) entered blocking state
[ 77.552328][ T4143] bridge0: port 1(bridge_slave_0) entered disabled state
[ 77.552921][ T4143] device bridge_slave_0 entered promiscuous mode
[ 77.554507][ T4143] bridge0: port 2(bridge_slave_1) entered blocking state
[ 77.554578][ T4143] bridge0: port 2(bridge_slave_1) entered disabled state
[ 77.555196][ T4143] device bridge_slave_1 entered promiscuous mode
[ 77.598197][ T4143] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 77.611689][ T4143] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 77.633247][ T4143] team0: Port device team_slave_0 added
[ 77.634802][ T4143] team0: Port device team_slave_1 added
[ 77.656550][ T4143] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 77.656565][ T4143] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 77.656591][ T4143] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 77.658011][ T4143] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 77.658023][ T4143] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 77.658050][ T4143] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 77.750434][ T4143] device hsr_slave_0 entered promiscuous mode
[ 77.751009][ T4143] device hsr_slave_1 entered promiscuous mode
[ 77.810100][ T4143] bridge0: port 2(bridge_slave_1) entered blocking state
[ 77.810142][ T4143] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 77.810627][ T4143] bridge0: port 1(bridge_slave_0) entered blocking state
[ 77.810672][ T4143] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 77.853740][ T4143] 8021q: adding VLAN 0 to HW filter on device bond0
[ 77.858531][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 77.873895][ T41] bridge0: port 1(bridge_slave_0) entered disabled state
[ 77.874628][ T41] bridge0: port 2(bridge_slave_1) entered disabled state
[ 77.882875][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 77.900396][ T4143] 8021q: adding VLAN 0 to HW filter on device team0
[ 77.917320][ T923] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 77.917638][ T923] bridge0: port 1(bridge_slave_0) entered blocking state
[ 77.917673][ T923] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 77.917907][ T923] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 77.918202][ T923] bridge0: port 2(bridge_slave_1) entered blocking state
[ 77.918272][ T923] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 77.930129][ T923] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 77.931271][ T923] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 77.932058][ T923] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 77.935286][ T923] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 77.940389][ T923] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 77.943793][ T4143] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 77.964240][ T923] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 77.964350][ T923] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 77.972922][ T4143] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 78.191762][ T923] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 78.204155][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 78.204848][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 78.205678][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 78.210527][ T4143] device veth0_vlan entered promiscuous mode
[ 78.216301][ T4143] device veth1_vlan entered promiscuous mode
[ 78.236085][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 78.236628][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 78.237344][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 78.244191][ T4143] device veth0_macvtap entered promiscuous mode
[ 78.247587][ T4143] device veth1_macvtap entered promiscuous mode
[ 78.264244][ T4143] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 78.264342][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 78.267167][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 78.272589][ T4143] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 78.272856][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 78.357340][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 78.357355][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 78.359369][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 78.382075][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 78.382093][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 78.383905][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 79.510029][ T14] Bluetooth: hci0: command 0x0409 tx timeout
[ 80.459139][ T48] Bluetooth: hci1: Opcode 0x1003 failed: -110
[ 80.459282][ T145] ==================================================================
[ 80.459291][ T145] BUG: KASAN: use-after-free in hci_cmd_timeout+0x24b/0x250
[ 80.459322][ T145] Read of size 2 at addr ffff88807933d408 by task kworker/1:3/145
[ 80.459340][ T145]
[ 80.459345][ T145] CPU: 1 PID: 145 Comm: kworker/1:3 Not tainted 5.18.0-rc5-next-20220506-syzkaller-dirty #0
[ 80.459370][ T145] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 80.459384][ T145] Workqueue: events hci_cmd_timeout
[ 80.459409][ T145] Call Trace:
[ 80.459415][ T145]
[ 80.459423][ T145] dump_stack_lvl+0xcd/0x134
[ 80.459460][ T145] print_address_description.constprop.0.cold+0xeb/0x495
[ 80.459501][ T145] ? hci_cmd_timeout+0x24b/0x250
[ 80.459542][ T145] kasan_report.cold+0xf4/0x1c6
[ 80.459576][ T145] ? hci_cmd_timeout+0x24b/0x250
[ 80.459598][ T145] hci_cmd_timeout+0x24b/0x250
[ 80.459620][ T145] process_one_work+0x996/0x1610
[ 80.459647][ T145] ? pwq_dec_nr_in_flight+0x2a0/0x2a0
[ 80.459671][ T145] ? rwlock_bug.part.0+0x90/0x90
[ 80.459689][ T145] ? _raw_spin_lock_irq+0x41/0x50
[ 80.459719][ T145] worker_thread+0x665/0x1080
[ 80.459748][ T145] ? __kthread_parkme+0x15f/0x220
[ 80.459778][ T145] ? process_one_work+0x1610/0x1610
[ 80.459801][ T145] kthread+0x2e9/0x3a0
[ 80.459821][ T145] ? kthread_complete_and_exit+0x40/0x40
[ 80.459842][ T145] ret_from_fork+0x1f/0x30
[ 80.459875][ T145]
[ 80.459881][ T145]
[ 80.459884][ T145] Allocated by task 3681:
[ 80.459891][ T145] kasan_save_stack+0x1e/0x40
[ 80.459919][ T145] __kasan_kmalloc+0xa9/0xd0
[ 80.459945][ T145] fib6_info_alloc+0xc1/0x210
[ 80.459967][ T145] ip6_route_net_init+0x75/0x8c0
[ 80.459995][ T145] ops_init+0xaf/0x470
[ 80.460016][ T145] setup_net+0x5d1/0xc50
[ 80.460036][ T145] copy_net_ns+0x318/0x760
[ 80.460054][ T145] create_new_namespaces+0x3f6/0xb20
[ 80.460077][ T145] unshare_nsproxy_namespaces+0xc1/0x1f0
[ 80.460100][ T145] ksys_unshare+0x445/0x920
[ 80.460123][ T145] __x64_sys_unshare+0x2d/0x40
[ 80.460147][ T145] do_syscall_64+0x35/0xb0
[ 80.460180][ T145] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 80.460210][ T145]
[ 80.460213][ T145] Freed by task 48:
[ 80.460221][ T145] kasan_save_stack+0x1e/0x40
[ 80.460249][ T145] kasan_set_track+0x21/0x30
[ 80.460278][ T145] kasan_set_free_info+0x20/0x30
[ 80.460297][ T145] ____kasan_slab_free+0x166/0x1a0
[ 80.460324][ T145] slab_free_freelist_hook+0x8b/0x1c0
[ 80.460363][ T145] kfree+0xd6/0x4d0
[ 80.460387][ T145] skb_free_head+0xac/0x110
[ 80.460410][ T145] skb_release_data+0x67a/0x810
[ 80.460439][ T145] kfree_skb_reason.part.0+0xc3/0x2f0
[ 80.460467][ T145] kfree_skb_reason+0x85/0x110
[ 80.460491][ T145] hci_dev_open_sync+0xb8c/0x2160
[ 80.460522][ T145] hci_dev_do_open+0x32/0x70
[ 80.460546][ T145] hci_power_on+0x133/0x630
[ 80.460570][ T145] process_one_work+0x996/0x1610
[ 80.460594][ T145] worker_thread+0x665/0x1080
[ 80.460617][ T145] kthread+0x2e9/0x3a0
[ 80.460636][ T145] ret_from_fork+0x1f/0x30
[ 80.460662][ T145]
[ 80.460665][ T145] The buggy address belongs to the object at ffff88807933d400
[ 80.460665][ T145] which belongs to the cache kmalloc-512 of size 512
[ 80.460679][ T145] The buggy address is located 8 bytes inside of
[ 80.460679][ T145] 512-byte region [ffff88807933d400, ffff88807933d600)
[ 80.460699][ T145]
[ 80.460703][ T145] The buggy address belongs to the physical page:
[ 80.460713][ T145] page:ffffea0001e4cf00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7933c
[ 80.460738][ T145] head:ffffea0001e4cf00 order:2 compound_mapcount:0 compound_pincount:0
[ 80.460755][ T145] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 80.460784][ T145] raw: 00fff00000010200 ffffea00006b4900 dead000000000002 ffff888010c41c80
[ 80.460804][ T145] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
[ 80.460816][ T145] page dumped because: kasan: bad access detected
[ 80.460824][ T145] page_owner tracks the page as allocated
[ 80.460830][ T145] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3049, tgid 3049 (udevadm), ts 15378275467, free_ts 12707670800
[ 80.460872][ T145] get_page_from_freelist+0xba2/0x3e00
[ 80.460895][ T145] __alloc_pages+0x1b2/0x500
[ 80.460914][ T145] alloc_pages+0x1aa/0x310
[ 80.460941][ T145] allocate_slab+0x26c/0x3c0
[ 80.460964][ T145] ___slab_alloc+0x985/0xd90
[ 80.460988][ T145] __slab_alloc.constprop.0+0x4d/0xa0
[ 80.461014][ T145] __kmalloc_node_track_caller+0x2cb/0x360
[ 80.461043][ T145] __alloc_skb+0xde/0x340
[ 80.461066][ T145] alloc_uevent_skb+0x7b/0x210
[ 80.461098][ T145] kobject_uevent_env+0xc42/0x1660
[ 80.461129][ T145] kobject_synth_uevent+0x701/0x850
[ 80.461160][ T145] uevent_store+0x42/0x90
[ 80.461179][ T145] drv_attr_store+0x6d/0xa0
[ 80.461214][ T145] sysfs_kf_write+0x110/0x160
[ 80.461235][ T145] kernfs_fop_write_iter+0x3f8/0x610
[ 80.461256][ T145] new_sync_write+0x38a/0x560
[ 80.461285][ T145] page last free stack trace:
[ 80.461290][ T145] free_pcp_prepare+0x549/0xd20
[ 80.461325][ T145] free_unref_page+0x19/0x6a0
[ 80.461345][ T145] free_contig_range+0xb1/0x180
[ 80.461366][ T145] destroy_args+0xa8/0x646
[ 80.461399][ T145] debug_vm_pgtable+0x2a08/0x2a99
[ 80.461434][ T145] do_one_initcall+0x103/0x650
[ 80.461463][ T145] kernel_init_freeable+0x6b1/0x73a
[ 80.461496][ T145] kernel_init+0x1a/0x1d0
[ 80.461546][ T145] ret_from_fork+0x1f/0x30
[ 80.461574][ T145]
[ 80.461578][ T145] Memory state around the buggy address:
[ 80.461588][ T145] ffff88807933d300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 80.461605][ T145] ffff88807933d380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 80.461620][ T145] >ffff88807933d400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 80.461632][ T145] ^
[ 80.461642][ T145] ffff88807933d480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 80.461657][ T145] ffff88807933d500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 80.461669][ T145] ==================================================================
[ 80.461679][ T145] Kernel panic - not syncing: panic_on_warn set ...
[ 81.067790][ T145] CPU: 1 PID: 145 Comm: kworker/1:3 Not tainted 5.18.0-rc5-next-20220506-syzkaller-dirty #0
[ 81.077839][ T145] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 81.087886][ T145] Workqueue: events hci_cmd_timeout
[ 81.093091][ T145] Call Trace:
[ 81.096380][ T145]
[ 81.099312][ T145] dump_stack_lvl+0xcd/0x134
[ 81.104039][ T145] panic+0x2d7/0x636
[ 81.107930][ T145] ? panic_print_sys_info.part.0+0x10b/0x10b
[ 81.113994][ T145] ? mark_held_locks+0x9f/0xe0
[ 81.118762][ T145] ? hci_cmd_timeout+0x24b/0x250
[ 81.123711][ T145] ? hci_cmd_timeout+0x24b/0x250
[ 81.128639][ T145] end_report.part.0+0x3f/0x7c
[ 81.133424][ T145] kasan_report.cold+0x93/0x1c6
[ 81.138279][ T145] ? hci_cmd_timeout+0x24b/0x250
[ 81.143311][ T145] hci_cmd_timeout+0x24b/0x250
[ 81.148074][ T145] process_one_work+0x996/0x1610
[ 81.153027][ T145] ? pwq_dec_nr_in_flight+0x2a0/0x2a0
[ 81.158405][ T145] ? rwlock_bug.part.0+0x90/0x90
[ 81.163338][ T145] ? _raw_spin_lock_irq+0x41/0x50
[ 81.168360][ T145] worker_thread+0x665/0x1080
[ 81.173031][ T145] ? __kthread_parkme+0x15f/0x220
[ 81.178063][ T145] ? process_one_work+0x1610/0x1610
[ 81.183269][ T145] kthread+0x2e9/0x3a0
[ 81.187325][ T145] ? kthread_complete_and_exit+0x40/0x40
[ 81.192948][ T145] ret_from_fork+0x1f/0x30
[ 81.197376][ T145]
[ 81.200576][ T145] Kernel Offset: disabled
[ 81.204899][ T145] Rebooting in 86400 seconds..