Warning: Permanently added '10.128.1.105' (ECDSA) to the list of known hosts.
syzkaller login: [   60.193669][ T3601] cgroup: Unknown subsys name 'net'
[   60.330440][ T3601] cgroup: Unknown subsys name 'rlimit'
[   61.493742][ T3605] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   61.502349][ T3605] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   61.510063][ T3602] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   61.517787][ T3605] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   61.525580][ T3605] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[   61.532746][ T3605] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   61.604570][   T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   61.612591][   T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   61.632522][ T3271] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[   61.646139][   T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
executing program
[   61.654099][   T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   61.663034][ T3271] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[   63.565025][   T14] Bluetooth: hci0: command 0x0409 tx timeout
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[   65.654405][   T14] Bluetooth: hci0: command 0x041b tx timeout
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[   67.724434][   T14] Bluetooth: hci0: command 0x040f tx timeout
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[   69.804360][   T14] Bluetooth: hci0: command 0x0419 tx timeout
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[   76.286607][  T145] cfg80211: failed to load regulatory.db
executing program
executing program
executing program
executing program
[   76.666268][    T6] ==================================================================
[   76.674360][    T6] BUG: KASAN: use-after-free in kill_fasync+0x45e/0x470
[   76.681321][    T6] Read of size 8 at addr ffff888018098d68 by task kworker/0:0/6
[   76.688936][    T6] 
[   76.691246][    T6] CPU: 0 PID: 6 Comm: kworker/0:0 Not tainted 5.19.0-rc5-syzkaller-00187-ge8a4e1c1bb69 #0
[   76.701117][    T6] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[   76.711162][    T6] Workqueue: events key_garbage_collector
[   76.716888][    T6] Call Trace:
[   76.720174][    T6]  <TASK>
[   76.723103][    T6]  dump_stack_lvl+0xcd/0x134
[   76.727725][    T6]  print_address_description.constprop.0.cold+0xeb/0x495
[   76.734766][    T6]  ? kill_fasync+0x45e/0x470
[   76.739386][    T6]  kasan_report.cold+0xf4/0x1c6
[   76.744245][    T6]  ? kill_fasync+0x45e/0x470
[   76.748841][    T6]  kill_fasync+0x45e/0x470
[   76.753267][    T6]  post_one_notification.isra.0+0x6e4/0x990
[   76.759165][    T6]  remove_watch_from_object+0x35a/0x9d0
[   76.764720][    T6]  ? __post_watch_notification+0x840/0x840
[   76.770524][    T6]  ? rwlock_bug.part.0+0x90/0x90
[   76.775461][    T6]  key_gc_unused_keys.constprop.0+0x2e5/0x600
[   76.781532][    T6]  key_garbage_collector+0x3d7/0x920
[   76.786907][    T6]  process_one_work+0x996/0x1610
[   76.791879][    T6]  ? pwq_dec_nr_in_flight+0x2a0/0x2a0
[   76.797264][    T6]  ? rwlock_bug.part.0+0x90/0x90
[   76.802200][    T6]  ? _raw_spin_lock_irq+0x41/0x50
[   76.807229][    T6]  worker_thread+0x665/0x1080
[   76.811911][    T6]  ? process_one_work+0x1610/0x1610
[   76.817108][    T6]  kthread+0x2e9/0x3a0
[   76.821177][    T6]  ? kthread_complete_and_exit+0x40/0x40
[   76.826807][    T6]  ret_from_fork+0x1f/0x30
[   76.831232][    T6]  </TASK>
[   76.834247][    T6] 
[   76.836562][    T6] Allocated by task 3928:
[   76.840881][    T6]  kasan_save_stack+0x1e/0x40
[   76.845586][    T6]  __kasan_kmalloc+0xa9/0xd0
[   76.850177][    T6]  alloc_pipe_info+0x105/0x590
[   76.854944][    T6]  create_pipe_files+0x8d/0x880
[   76.859835][    T6]  do_pipe2+0x96/0x1b0
[   76.863908][    T6]  __x64_sys_pipe2+0x50/0x70
[   76.868499][    T6]  do_syscall_64+0x35/0xb0
[   76.872918][    T6]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
[   76.878811][    T6] 
[   76.881127][    T6] Freed by task 3928:
[   76.885096][    T6]  kasan_save_stack+0x1e/0x40
[   76.889780][    T6]  kasan_set_track+0x21/0x30
[   76.895329][    T6]  kasan_set_free_info+0x20/0x30
[   76.900260][    T6]  ____kasan_slab_free+0x166/0x1a0
[   76.905386][    T6]  slab_free_freelist_hook+0x8b/0x1c0
[   76.910769][    T6]  kfree+0xd6/0x4d0
[   76.914587][    T6]  pipe_release+0x2b6/0x310
[   76.919089][    T6]  __fput+0x277/0x9d0
[   76.923066][    T6]  task_work_run+0xdd/0x1a0
[   76.927573][    T6]  exit_to_user_mode_prepare+0x23c/0x250
[   76.933212][    T6]  syscall_exit_to_user_mode+0x19/0x50
[   76.938676][    T6]  do_syscall_64+0x42/0xb0
[   76.943091][    T6]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
[   76.948984][    T6] 
[   76.951300][    T6] The buggy address belongs to the object at ffff888018098c00
[   76.951300][    T6]  which belongs to the cache kmalloc-cg-512 of size 512
[   76.965613][    T6] The buggy address is located 360 bytes inside of
[   76.965613][    T6]  512-byte region [ffff888018098c00, ffff888018098e00)
[   76.978880][    T6] 
[   76.981203][    T6] The buggy address belongs to the physical page:
[   76.987612][    T6] page:ffffea0000602600 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88801809a800 pfn:0x18098
[   76.999064][    T6] head:ffffea0000602600 order:2 compound_mapcount:0 compound_pincount:0
[   77.007384][    T6] memcg:ffff88807eda6001
[   77.011611][    T6] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[   77.019599][    T6] raw: 00fff00000010200 0000000000000000 dead000000000001 ffff888011842dc0
[   77.028614][    T6] raw: ffff88801809a800 000000008010000e 00000001ffffffff ffff88807eda6001
[   77.037184][    T6] page dumped because: kasan: bad access detected
[   77.043587][    T6] page_owner tracks the page as allocated
[   77.049301][    T6] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3186, tgid 3186 (dhcpcd), ts 33490746470, free_ts 33490054737
[   77.070228][    T6]  get_page_from_freelist+0x1290/0x3b70
[   77.075780][    T6]  __alloc_pages+0x1c7/0x510
[   77.080374][    T6]  alloc_pages+0x1aa/0x310
[   77.084786][    T6]  allocate_slab+0x26c/0x3c0
[   77.089378][    T6]  ___slab_alloc+0x9c4/0xe20
[   77.093973][    T6]  __slab_alloc.constprop.0+0x4d/0xa0
[   77.099350][    T6]  __kmalloc_node_track_caller+0x2cb/0x360
[   77.105168][    T6]  __alloc_skb+0xde/0x340
[   77.109499][    T6]  alloc_skb_with_frags+0x93/0x730
[   77.114609][    T6]  sock_alloc_send_pskb+0x793/0x920
[   77.119814][    T6]  unix_dgram_sendmsg+0x425/0x1ad0
[   77.124933][    T6]  sock_sendmsg+0xcf/0x120
[   77.129348][    T6]  sock_write_iter+0x284/0x3c0
[   77.134108][    T6]  do_iter_readv_writev+0x3d1/0x640
[   77.139308][    T6]  do_iter_write+0x182/0x700
[   77.144211][    T6]  vfs_writev+0x1aa/0x630
[   77.148570][    T6] page last free stack trace:
[   77.153238][    T6]  free_pcp_prepare+0x549/0xd20
[   77.158086][    T6]  free_unref_page+0x19/0x6a0
[   77.162760][    T6]  __stack_depot_save+0x168/0x500
[   77.167793][    T6]  ref_tracker_alloc+0x19f/0x550
[   77.172742][    T6]  fib_check_nh+0x26c/0x600
[   77.177254][    T6]  fib_create_info+0x2338/0x4ac0
[   77.182192][    T6]  fib_table_insert+0x19a/0x1bd0
[   77.187126][    T6]  inet_rtm_newroute+0x109/0x1f0
[   77.192068][    T6]  rtnetlink_rcv_msg+0x43a/0xc90
[   77.197009][    T6]  netlink_rcv_skb+0x153/0x420
[   77.201769][    T6]  netlink_unicast+0x543/0x7f0
[   77.206537][    T6]  netlink_sendmsg+0x917/0xe10
[   77.211392][    T6]  sock_sendmsg+0xcf/0x120
[   77.215804][    T6]  ____sys_sendmsg+0x6eb/0x810
[   77.220571][    T6]  ___sys_sendmsg+0xf3/0x170
[   77.225336][    T6]  __x64_sys_sendmsg+0x132/0x220
[   77.230278][    T6] 
[   77.232597][    T6] Memory state around the buggy address:
[   77.238225][    T6]  ffff888018098c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   77.246279][    T6]  ffff888018098c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   77.254337][    T6] >ffff888018098d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   77.262560][    T6]                                                           ^
[   77.270001][    T6]  ffff888018098d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   77.278054][    T6]  ffff888018098e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   77.286106][    T6] ==================================================================
[   77.302312][    T6] Kernel panic - not syncing: panic_on_warn set ...
[   77.308905][    T6] CPU: 0 PID: 6 Comm: kworker/0:0 Not tainted 5.19.0-rc5-syzkaller-00187-ge8a4e1c1bb69 #0
[   77.318783][    T6] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[   77.328909][    T6] Workqueue: events key_garbage_collector
[   77.334635][    T6] Call Trace:
[   77.337898][    T6]  <TASK>
[   77.340819][    T6]  dump_stack_lvl+0xcd/0x134
[   77.345436][    T6]  panic+0x2d7/0x636
[   77.349351][    T6]  ? panic_print_sys_info.part.0+0x10b/0x10b
[   77.355360][    T6]  ? preempt_schedule_common+0x59/0xc0
[   77.360819][    T6]  ? kill_fasync+0x45e/0x470
[   77.365400][    T6]  ? preempt_schedule_thunk+0x16/0x18
[   77.370779][    T6]  ? kill_fasync+0x45e/0x470
[   77.375367][    T6]  end_report.part.0+0x3f/0x7c
[   77.380124][    T6]  kasan_report.cold+0x93/0x1c6
[   77.384964][    T6]  ? kill_fasync+0x45e/0x470
[   77.389541][    T6]  kill_fasync+0x45e/0x470
[   77.393950][    T6]  post_one_notification.isra.0+0x6e4/0x990
[   77.399834][    T6]  remove_watch_from_object+0x35a/0x9d0
[   77.405378][    T6]  ? __post_watch_notification+0x840/0x840
[   77.411192][    T6]  ? rwlock_bug.part.0+0x90/0x90
[   77.416139][    T6]  key_gc_unused_keys.constprop.0+0x2e5/0x600
[   77.422212][    T6]  key_garbage_collector+0x3d7/0x920
[   77.427502][    T6]  process_one_work+0x996/0x1610
[   77.432462][    T6]  ? pwq_dec_nr_in_flight+0x2a0/0x2a0
[   77.437857][    T6]  ? rwlock_bug.part.0+0x90/0x90
[   77.442808][    T6]  ? _raw_spin_lock_irq+0x41/0x50
[   77.447845][    T6]  worker_thread+0x665/0x1080
[   77.452538][    T6]  ? process_one_work+0x1610/0x1610
[   77.457739][    T6]  kthread+0x2e9/0x3a0
[   77.461810][    T6]  ? kthread_complete_and_exit+0x40/0x40
[   77.467446][    T6]  ret_from_fork+0x1f/0x30
[   77.471874][    T6]  </TASK>
[   77.475049][    T6] Kernel Offset: disabled
[   77.479368][    T6] Rebooting in 86400 seconds..