DUID 00:04:63:3c:db:c8:83:d4:2a:b1:e5:3f:fc:31:79:55:3b:bc
forked to background, child pid 3183
[ 29.626576][ T3184] 8021q: adding VLAN 0 to HW filter on device bond0
[ 29.641376][ T3184] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.1.50' (ECDSA) to the list of known hosts.
2021/12/14 14:09:41 fuzzer started
2021/12/14 14:09:42 connecting to host at 10.128.0.169:38089
2021/12/14 14:09:42 checking machine...
2021/12/14 14:09:42 checking revisions...
2021/12/14 14:09:42 testing simple program...
syzkaller login: [ 50.858003][ T3604] cgroup: Unknown subsys name 'net'
[ 50.968747][ T3604] cgroup: Unknown subsys name 'rlimit'
[ 52.226452][ T3608] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 52.234758][ T3608] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 52.242530][ T3608] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 52.250368][ T3608] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 52.257908][ T3608] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 52.265192][ T3608] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 52.350601][ T3606] chnl_net:caif_netlink_parms(): no params data found
[ 52.393865][ T3606] bridge0: port 1(bridge_slave_0) entered blocking state
[ 52.401285][ T3606] bridge0: port 1(bridge_slave_0) entered disabled state
[ 52.409613][ T3606] device bridge_slave_0 entered promiscuous mode
[ 52.418409][ T3606] bridge0: port 2(bridge_slave_1) entered blocking state
[ 52.425537][ T3606] bridge0: port 2(bridge_slave_1) entered disabled state
[ 52.434073][ T3606] device bridge_slave_1 entered promiscuous mode
[ 52.454508][ T3606] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 52.465386][ T3606] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 52.488146][ T3606] team0: Port device team_slave_0 added
[ 52.495378][ T3606] team0: Port device team_slave_1 added
[ 52.512030][ T3606] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 52.519047][ T3606] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 52.545100][ T3606] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 52.557726][ T3606] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 52.564844][ T3606] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 52.590776][ T3606] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 52.616454][ T3606] device hsr_slave_0 entered promiscuous mode
[ 52.623797][ T3606] device hsr_slave_1 entered promiscuous mode
[ 52.701576][ T3606] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 52.711740][ T3606] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 52.721087][ T3606] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 52.730552][ T3606] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 52.750186][ T3606] bridge0: port 2(bridge_slave_1) entered blocking state
[ 52.757319][ T3606] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 52.764904][ T3606] bridge0: port 1(bridge_slave_0) entered blocking state
[ 52.771976][ T3606] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 52.815664][ T3606] 8021q: adding VLAN 0 to HW filter on device bond0
[ 52.828852][ T926] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 52.840365][ T926] bridge0: port 1(bridge_slave_0) entered disabled state
[ 52.849836][ T926] bridge0: port 2(bridge_slave_1) entered disabled state
[ 52.857651][ T926] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 52.872026][ T3606] 8021q: adding VLAN 0 to HW filter on device team0
[ 52.882200][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 52.891318][ T3617] bridge0: port 1(bridge_slave_0) entered blocking state
[ 52.898436][ T3617] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 52.909924][ T141] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 52.918955][ T141] bridge0: port 2(bridge_slave_1) entered blocking state
[ 52.925993][ T141] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 52.950234][ T141] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 52.959339][ T141] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 52.967600][ T141] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 52.976464][ T141] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 52.985106][ T141] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 52.993422][ T3606] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 53.043499][ T3606] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 53.052004][ T926] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 53.059934][ T926] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 53.078545][ T926] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 53.095342][ T926] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 53.103693][ T926] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 53.112346][ T926] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 53.121548][ T3606] device veth0_vlan entered promiscuous mode
[ 53.133157][ T3606] device veth1_vlan entered promiscuous mode
[ 53.150654][ T141] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 53.160099][ T141] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 53.168531][ T141] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 53.179544][ T3606] device veth0_macvtap entered promiscuous mode
[ 53.188950][ T3606] device veth1_macvtap entered promiscuous mode
[ 53.203569][ T3606] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 53.211159][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 53.220501][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 53.232676][ T3606] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 53.240429][ T141] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 53.251689][ T3606] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 53.260852][ T3606] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 53.272124][ T3606] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 53.281254][ T3606] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 53.352982][ T990] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 53.369186][ T990] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 53.381093][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 53.388974][ T990] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 53.397006][ T990] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 53.408748][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
2021/12/14 14:09:44 building call list...
executing program
[ 55.523278][ T3600] can: request_module (can-proto-0) failed.
[ 55.544549][ T3600] can: request_module (can-proto-0) failed.
[ 55.565591][ T3600] can: request_module (can-proto-0) failed.
[ 55.761129][ T3600] ------------[ cut here ]------------
[ 55.766812][ T3600] refcount_t: decrement hit 0; leaking memory.
[ 55.773480][ T3600] WARNING: CPU: 1 PID: 3600 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0
[ 55.782905][ T3600] Modules linked in:
[ 55.786844][ T3600] CPU: 1 PID: 3600 Comm: syz-fuzzer Not tainted 5.16.0-rc5-next-20211213-syzkaller #0
[ 55.796492][ T3600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 55.806590][ T3600] RIP: 0010:refcount_warn_saturate+0xbf/0x1e0
[ 55.812940][ T3600] Code: 1d 16 e1 95 09 31 ff 89 de e8 1d 10 90 fd 84 db 75 e0 e8 34 0c 90 fd 48 c7 c7 20 48 05 8a c6 05 f6 e0 95 09 01 e8 50 a0 28 05 <0f> 0b eb c4 e8 18 0c 90 fd 0f b6 1d e5 e0 95 09 31 ff 89 de e8 e8
[ 55.833083][ T3600] RSP: 0018:ffffc90001b2fab8 EFLAGS: 00010282
[ 55.840329][ T3600] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 55.849258][ T3600] RDX: ffff8880727f8000 RSI: ffffffff815f5868 RDI: fffff52000365f49
[ 55.857345][ T3600] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000001
[ 55.865417][ T3600] R10: ffffffff815ef5ce R11: 0000000000000000 R12: 1ffff92000365f5c
[ 55.873534][ T3600] R13: 00000000ffffffef R14: ffffffff8d308dd4 R15: ffffc90001b2fd10
[ 55.881595][ T3600] FS: 000000c00002ec90(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
[ 55.890574][ T3600] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 55.897146][ T3600] CR2: 0000000000efb2b0 CR3: 00000000187aa000 CR4: 00000000003506e0
[ 55.905393][ T3600] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 55.913435][ T3600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 55.921440][ T3600] Call Trace:
[ 55.924701][ T3600]
[ 55.927616][ T3600] ref_tracker_free+0x4fe/0x610
[ 55.932577][ T3600] ? ref_tracker_dir_exit+0x330/0x330
[ 55.938024][ T3600] ? bpf_sk_storage_free+0x333/0x3e0
[ 55.943324][ T3600] ? lock_downgrade+0x6e0/0x6e0
[ 55.948278][ T3600] ? kfree+0x1ea/0x4b0
[ 55.952392][ T3600] __sk_destruct+0x3cd/0x710
[ 55.957003][ T3600] sk_destruct+0xbd/0xe0
[ 55.961314][ T3600] __sk_free+0xef/0x3d0
[ 55.965490][ T3600] sk_free+0x78/0xa0
[ 55.969466][ T3600] __mptcp_close_ssk+0x435/0x590
[ 55.974422][ T3600] __mptcp_destroy_sock+0x35f/0x830
[ 55.979665][ T3600] ? __mptcp_close_ssk+0x590/0x590
[ 55.984788][ T3600] ? __local_bh_enable_ip+0xa0/0x120
[ 55.990130][ T3600] mptcp_close+0x5f8/0x7f0
[ 55.994559][ T3600] inet_release+0x12e/0x280
[ 55.999115][ T3600] inet6_release+0x4c/0x70
[ 56.003545][ T3600] __sock_release+0xcd/0x280
[ 56.008199][ T3600] sock_close+0x18/0x20
[ 56.012365][ T3600] __fput+0x286/0x9f0
[ 56.016336][ T3600] ? __sock_release+0x280/0x280
[ 56.021229][ T3600] task_work_run+0xdd/0x1a0
[ 56.025743][ T3600] exit_to_user_mode_prepare+0x27e/0x290
[ 56.031441][ T3600] syscall_exit_to_user_mode+0x19/0x60
[ 56.036912][ T3600] do_syscall_64+0x42/0xb0
[ 56.041359][ T3600] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 56.047268][ T3600] RIP: 0033:0x4b12db
[ 56.051221][ T3600] Code: fb ff eb bd e8 46 96 fb ff e9 61 ff ff ff cc e8 fb 61 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30
[ 56.070872][ T3600] RSP: 002b:000000c0002934f0 EFLAGS: 00000206 ORIG_RAX: 0000000000000003
[ 56.079337][ T3600] RAX: 0000000000000000 RBX: 000000c00001c000 RCX: 00000000004b12db
[ 56.087320][ T3600] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006
[ 56.095385][ T3600] RBP: 000000c000293530 R08: 0000000000f0ae01 R09: 00007ffd203ee080
[ 56.103395][ T3600] R10: 00007ffd203ee090 R11: 0000000000000206 R12: 000000000000000d
[ 56.111416][ T3600] R13: 0000000000000000 R14: ffffffffffffffff R15: 000000c0002b8000
[ 56.119420][ T3600]
[ 56.122425][ T3600] Kernel panic - not syncing: panic_on_warn set ...
[ 56.128985][ T3600] CPU: 1 PID: 3600 Comm: syz-fuzzer Not tainted 5.16.0-rc5-next-20211213-syzkaller #0
[ 56.138504][ T3600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 56.148537][ T3600] Call Trace:
[ 56.151796][ T3600]
[ 56.154707][ T3600] dump_stack_lvl+0xcd/0x134
[ 56.159287][ T3600] panic+0x2b0/0x6dd
[ 56.163164][ T3600] ? __warn_printk+0xf3/0xf3
[ 56.167743][ T3600] ? __warn.cold+0x16c/0x2b5
[ 56.172318][ T3600] ? refcount_warn_saturate+0xbf/0x1e0
[ 56.177766][ T3600] __warn.cold+0x187/0x2b5
[ 56.182165][ T3600] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70
[ 56.188397][ T3600] ? refcount_warn_saturate+0xbf/0x1e0
[ 56.193844][ T3600] report_bug+0x1bd/0x210
[ 56.198160][ T3600] handle_bug+0x3c/0x60
[ 56.202299][ T3600] exc_invalid_op+0x14/0x40
[ 56.206786][ T3600] asm_exc_invalid_op+0x12/0x20
[ 56.211624][ T3600] RIP: 0010:refcount_warn_saturate+0xbf/0x1e0
[ 56.217677][ T3600] Code: 1d 16 e1 95 09 31 ff 89 de e8 1d 10 90 fd 84 db 75 e0 e8 34 0c 90 fd 48 c7 c7 20 48 05 8a c6 05 f6 e0 95 09 01 e8 50 a0 28 05 <0f> 0b eb c4 e8 18 0c 90 fd 0f b6 1d e5 e0 95 09 31 ff 89 de e8 e8
[ 56.237262][ T3600] RSP: 0018:ffffc90001b2fab8 EFLAGS: 00010282
[ 56.243305][ T3600] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 56.251254][ T3600] RDX: ffff8880727f8000 RSI: ffffffff815f5868 RDI: fffff52000365f49
[ 56.259205][ T3600] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000001
[ 56.267153][ T3600] R10: ffffffff815ef5ce R11: 0000000000000000 R12: 1ffff92000365f5c
[ 56.275150][ T3600] R13: 00000000ffffffef R14: ffffffff8d308dd4 R15: ffffc90001b2fd10
[ 56.283111][ T3600] ? wake_up_klogd.part.0+0x8e/0xd0
[ 56.288302][ T3600] ? vprintk+0x88/0x90
[ 56.292359][ T3600] ? refcount_warn_saturate+0xbf/0x1e0
[ 56.297805][ T3600] ref_tracker_free+0x4fe/0x610
[ 56.302643][ T3600] ? ref_tracker_dir_exit+0x330/0x330
[ 56.307998][ T3600] ? bpf_sk_storage_free+0x333/0x3e0
[ 56.313272][ T3600] ? lock_downgrade+0x6e0/0x6e0
[ 56.318115][ T3600] ? kfree+0x1ea/0x4b0
[ 56.322181][ T3600] __sk_destruct+0x3cd/0x710
[ 56.326850][ T3600] sk_destruct+0xbd/0xe0
[ 56.331079][ T3600] __sk_free+0xef/0x3d0
[ 56.335219][ T3600] sk_free+0x78/0xa0
[ 56.339100][ T3600] __mptcp_close_ssk+0x435/0x590
[ 56.344029][ T3600] __mptcp_destroy_sock+0x35f/0x830
[ 56.349214][ T3600] ? __mptcp_close_ssk+0x590/0x590
[ 56.354404][ T3600] ? __local_bh_enable_ip+0xa0/0x120
[ 56.359680][ T3600] mptcp_close+0x5f8/0x7f0
[ 56.364087][ T3600] inet_release+0x12e/0x280
[ 56.368578][ T3600] inet6_release+0x4c/0x70
[ 56.372989][ T3600] __sock_release+0xcd/0x280
[ 56.377572][ T3600] sock_close+0x18/0x20
[ 56.381723][ T3600] __fput+0x286/0x9f0
[ 56.385698][ T3600] ? __sock_release+0x280/0x280
[ 56.390544][ T3600] task_work_run+0xdd/0x1a0
[ 56.395047][ T3600] exit_to_user_mode_prepare+0x27e/0x290
[ 56.400677][ T3600] syscall_exit_to_user_mode+0x19/0x60
[ 56.406221][ T3600] do_syscall_64+0x42/0xb0
[ 56.410629][ T3600] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 56.416520][ T3600] RIP: 0033:0x4b12db
[ 56.420403][ T3600] Code: fb ff eb bd e8 46 96 fb ff e9 61 ff ff ff cc e8 fb 61 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30
[ 56.439992][ T3600] RSP: 002b:000000c0002934f0 EFLAGS: 00000206 ORIG_RAX: 0000000000000003
[ 56.448385][ T3600] RAX: 0000000000000000 RBX: 000000c00001c000 RCX: 00000000004b12db
[ 56.456335][ T3600] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006
[ 56.464287][ T3600] RBP: 000000c000293530 R08: 0000000000f0ae01 R09: 00007ffd203ee080
[ 56.472241][ T3600] R10: 00007ffd203ee090 R11: 0000000000000206 R12: 000000000000000d
[ 56.480193][ T3600] R13: 0000000000000000 R14: ffffffffffffffff R15: 000000c0002b8000
[ 56.488175][ T3600]
[ 56.491571][ T3600] Kernel Offset: disabled
[ 56.495971][ T3600] Rebooting in 86400 seconds..