Warning: Permanently added '10.128.1.173' (ED25519) to the list of known hosts.
syzkaller login: [ 59.064584][ T4163] chnl_net:caif_netlink_parms(): no params data found
[ 59.112795][ T4163] bridge0: port 1(bridge_slave_0) entered blocking state
[ 59.120390][ T4163] bridge0: port 1(bridge_slave_0) entered disabled state
[ 59.128805][ T4163] device bridge_slave_0 entered promiscuous mode
[ 59.138159][ T4163] bridge0: port 2(bridge_slave_1) entered blocking state
[ 59.145401][ T4163] bridge0: port 2(bridge_slave_1) entered disabled state
[ 59.153346][ T4163] device bridge_slave_1 entered promiscuous mode
[ 59.176679][ T4163] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 59.187817][ T4163] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 59.212265][ T4163] team0: Port device team_slave_0 added
[ 59.219891][ T4163] team0: Port device team_slave_1 added
[ 59.238965][ T4163] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 59.246020][ T4163] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 59.271960][ T4163] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 59.284977][ T4163] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 59.291935][ T4163] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 59.318112][ T4163] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 59.350338][ T4163] device hsr_slave_0 entered promiscuous mode
[ 59.357377][ T4163] device hsr_slave_1 entered promiscuous mode
[ 59.454364][ T4163] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 59.465135][ T4163] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 59.474891][ T4163] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 59.484569][ T4163] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 59.507353][ T4163] bridge0: port 2(bridge_slave_1) entered blocking state
[ 59.514564][ T4163] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 59.522514][ T4163] bridge0: port 1(bridge_slave_0) entered blocking state
[ 59.529668][ T4163] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 59.577032][ T4163] 8021q: adding VLAN 0 to HW filter on device bond0
[ 59.590473][ T3061] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 59.600295][ T3061] bridge0: port 1(bridge_slave_0) entered disabled state
[ 59.609339][ T3061] bridge0: port 2(bridge_slave_1) entered disabled state
[ 59.617985][ T3061] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 59.631555][ T4163] 8021q: adding VLAN 0 to HW filter on device team0
[ 59.642366][ T3061] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 59.651657][ T3061] bridge0: port 1(bridge_slave_0) entered blocking state
[ 59.658759][ T3061] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 59.670061][ T3061] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 59.678820][ T3061] bridge0: port 2(bridge_slave_1) entered blocking state
[ 59.685933][ T3061] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 59.709532][ T3061] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 59.719665][ T3061] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 59.728470][ T3061] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 59.741043][ T3061] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 59.752707][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 59.763715][ T4163] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 59.782454][ T3061] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 59.790251][ T3061] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 59.803617][ T4163] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 59.821609][ T3061] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 59.842257][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 59.851360][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 59.859728][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 59.870638][ T4163] device veth0_vlan entered promiscuous mode
[ 59.882896][ T4163] device veth1_vlan entered promiscuous mode
[ 59.902694][ T1277] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 59.911031][ T1277] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 59.919517][ T1277] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 59.930926][ T4163] device veth0_macvtap entered promiscuous mode
[ 59.941034][ T4163] device veth1_macvtap entered promiscuous mode
[ 59.958353][ T4163] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 59.966454][ T3061] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 59.976211][ T3061] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 59.989498][ T4163] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 59.997409][ T1277] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
executing program
[ 60.008843][ T4163] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 60.018066][ T4163] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 60.026852][ T4163] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 60.036085][ T4163] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
executing program
executing program
[ 60.083400][ T4173] IPv6: ADDRCONF(NETDEV_CHANGE): bpq0: link becomes ready
[ 60.115877][ T4175] ==================================================================
[ 60.124078][ T4175] BUG: KASAN: use-after-free in ax25_fillin_cb+0x460/0x660
[ 60.131332][ T4175] Read of size 4 at addr ffff88801a5be938 by task syz-executor331/4175
[ 60.139584][ T4175]
[ 60.142038][ T4175] CPU: 0 PID: 4175 Comm: syz-executor331 Not tainted 5.15.179-syzkaller #0
[ 60.150645][ T4175] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[ 60.160716][ T4175] Call Trace:
[ 60.164049][ T4175]
[ 60.166986][ T4175] dump_stack_lvl+0x1e3/0x2d0
[ 60.171704][ T4175] ? io_uring_drop_tctx_refs+0x1a0/0x1a0
[ 60.177348][ T4175] ? _printk+0xd1/0x120
[ 60.181512][ T4175] ? __wake_up_klogd+0xcc/0x100
[ 60.186356][ T4175] ? panic+0x860/0x860
[ 60.190418][ T4175] ? _raw_spin_lock_irqsave+0xdd/0x120
[ 60.195882][ T4175] ? __lock_acquire+0x1ff0/0x1ff0
[ 60.200918][ T4175] print_address_description+0x63/0x3b0
[ 60.206464][ T4175] ? ax25_fillin_cb+0x460/0x660
[ 60.211319][ T4175] kasan_report+0x16b/0x1c0
[ 60.215859][ T4175] ? ax25_fillin_cb+0x460/0x660
[ 60.220747][ T4175] ax25_fillin_cb+0x460/0x660
[ 60.225421][ T4175] ax25_setsockopt+0xab7/0xe70
[ 60.230185][ T4175] ? ax25_shutdown+0x10/0x10
[ 60.234782][ T4175] ? aa_sock_opt_perm+0x79/0x110
[ 60.239737][ T4175] ? bpf_lsm_socket_setsockopt+0x5/0x10
[ 60.245279][ T4175] ? security_socket_setsockopt+0x7d/0xa0
[ 60.250990][ T4175] ? ax25_shutdown+0x10/0x10
[ 60.255585][ T4175] __sys_setsockopt+0x57e/0x990
[ 60.260454][ T4175] ? __ia32_sys_recv+0xb0/0xb0
[ 60.265225][ T4175] ? syscall_enter_from_user_mode+0x2e/0x240
[ 60.271200][ T4175] __x64_sys_setsockopt+0xb1/0xc0
[ 60.276227][ T4175] do_syscall_64+0x3b/0xb0
[ 60.280656][ T4175] ? clear_bhb_loop+0x15/0x70
[ 60.285330][ T4175] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 60.291217][ T4175] RIP: 0033:0x7f2d3c83e619
[ 60.295635][ T4175] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 31 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 60.315258][ T4175] RSP: 002b:00007ffc182afff8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[ 60.323715][ T4175] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f2d3c83e619
[ 60.331713][ T4175] RDX: 0000000000000019 RSI: 0000000000000101 RDI: 0000000000000007
[ 60.339682][ T4175] RBP: 00007ffc182b0030 R08: 0000000000000010 R09: 0000000000000001
[ 60.347660][ T4175] R10: 0000200000000340 R11: 0000000000000246 R12: 00000000000f4240
[ 60.355907][ T4175] R13: 000000000000ea99 R14: 00007ffc182b0014 R15: 00007ffc182b0020
[ 60.363907][ T4175]
[ 60.366928][ T4175]
[ 60.369278][ T4175] Allocated by task 4173:
[ 60.373600][ T4175] ____kasan_kmalloc+0xba/0xf0
[ 60.378372][ T4175] kmem_cache_alloc_trace+0x143/0x290
[ 60.383753][ T4175] ax25_dev_device_up+0x51/0x5a0
[ 60.388686][ T4175] ax25_device_event+0x4a0/0x510
[ 60.393621][ T4175] raw_notifier_call_chain+0xd0/0x170
[ 60.399001][ T4175] __dev_notify_flags+0x1fd/0x3f0
[ 60.404027][ T4175] dev_change_flags+0xe7/0x190
[ 60.408802][ T4175] dev_ifsioc+0x147/0x10c0
[ 60.413220][ T4175] dev_ioctl+0x504/0xf60
[ 60.417466][ T4175] sock_do_ioctl+0x34f/0x5a0
[ 60.422065][ T4175] sock_ioctl+0x484/0x770
[ 60.426392][ T4175] __se_sys_ioctl+0xf1/0x160
[ 60.430985][ T4175] do_syscall_64+0x3b/0xb0
[ 60.435409][ T4175] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 60.441356][ T4175]
[ 60.443684][ T4175] Freed by task 4174:
[ 60.447674][ T4175] kasan_set_track+0x4b/0x80
[ 60.452279][ T4175] kasan_set_free_info+0x1f/0x40
[ 60.457223][ T4175] ____kasan_slab_free+0xd8/0x120
[ 60.462270][ T4175] slab_free_freelist_hook+0xdd/0x160
[ 60.467640][ T4175] kfree+0xf1/0x270
[ 60.471470][ T4175] ax25_release+0x3b3/0x840
[ 60.475992][ T4175] sock_close+0xcd/0x230
[ 60.480254][ T4175] __fput+0x3fe/0x8e0
[ 60.484252][ T4175] task_work_run+0x129/0x1a0
[ 60.488844][ T4175] exit_to_user_mode_loop+0x106/0x130
[ 60.494220][ T4175] exit_to_user_mode_prepare+0xb1/0x140
[ 60.499775][ T4175] syscall_exit_to_user_mode+0x5d/0x240
[ 60.505320][ T4175] do_syscall_64+0x47/0xb0
[ 60.509745][ T4175] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 60.515635][ T4175]
[ 60.517964][ T4175] The buggy address belongs to the object at ffff88801a5be900
[ 60.517964][ T4175] which belongs to the cache kmalloc-192 of size 192
[ 60.532009][ T4175] The buggy address is located 56 bytes inside of
[ 60.532009][ T4175] 192-byte region [ffff88801a5be900, ffff88801a5be9c0)
[ 60.545205][ T4175] The buggy address belongs to the page:
[ 60.550847][ T4175] page:ffffea0000696f80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1a5be
[ 60.561024][ T4175] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 60.568586][ T4175] raw: 00fff00000000200 dead000000000100 dead000000000122 ffff888017441a00
[ 60.577168][ T4175] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[ 60.585745][ T4175] page dumped because: kasan: bad access detected
[ 60.592165][ T4175] page_owner tracks the page as allocated
[ 60.597869][ T4175] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 2482240562, free_ts 0
[ 60.612837][ T4175] get_page_from_freelist+0x3b78/0x3d40
[ 60.618393][ T4175] __alloc_pages+0x272/0x700
[ 60.622987][ T4175] alloc_page_interleave+0x22/0x1c0
[ 60.628174][ T4175] new_slab+0xbb/0x4b0
[ 60.632241][ T4175] ___slab_alloc+0x6f6/0xe10
[ 60.636824][ T4175] __kmalloc_track_caller+0x1c7/0x300
[ 60.642191][ T4175] krealloc+0x5c/0xf0
[ 60.646184][ T4175] add_sysfs_param+0xca/0x7f0
[ 60.650853][ T4175] kernel_add_sysfs_param+0xb0/0x130
[ 60.656143][ T4175] param_sysfs_builtin+0x16a/0x1f0
[ 60.661251][ T4175] param_sysfs_init+0x66/0x70
[ 60.665924][ T4175] do_one_initcall+0x22b/0x7a0
[ 60.670684][ T4175] do_initcall_level+0x157/0x210
[ 60.675623][ T4175] do_initcalls+0x49/0x90
[ 60.679964][ T4175] kernel_init_freeable+0x425/0x5c0
[ 60.685160][ T4175] kernel_init+0x19/0x290
[ 60.689485][ T4175] page_owner free stack trace missing
[ 60.694850][ T4175]
[ 60.697178][ T4175] Memory state around the buggy address:
[ 60.702802][ T4175] ffff88801a5be800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 60.710855][ T4175] ffff88801a5be880: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 60.718916][ T4175] >ffff88801a5be900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 60.726982][ T4175] ^
[ 60.732864][ T4175] ffff88801a5be980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 60.740921][ T4175] ffff88801a5bea00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 60.748975][ T4175] ==================================================================
[ 60.757024][ T4175] Disabling lock debugging due to kernel taint
[ 60.766159][ T4175] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 60.773456][ T4175] CPU: 0 PID: 4175 Comm: syz-executor331 Tainted: G B 5.15.179-syzkaller #0
[ 60.783428][ T4175] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[ 60.793481][ T4175] Call Trace:
[ 60.796757][ T4175]
[ 60.799683][ T4175] dump_stack_lvl+0x1e3/0x2d0
[ 60.804363][ T4175] ? io_uring_drop_tctx_refs+0x1a0/0x1a0
[ 60.809995][ T4175] ? panic+0x860/0x860
[ 60.814079][ T4175] ? preempt_schedule_common+0xa6/0xd0
[ 60.819529][ T4175] ? preempt_schedule+0xd9/0xe0
[ 60.824377][ T4175] panic+0x318/0x860
[ 60.828268][ T4175] ? check_panic_on_warn+0x1d/0xa0
[ 60.833374][ T4175] ? fb_is_primary_device+0xd0/0xd0
[ 60.838569][ T4175] ? _raw_spin_unlock_irqrestore+0x128/0x130
[ 60.844547][ T4175] ? _raw_spin_unlock+0x40/0x40
[ 60.849407][ T4175] check_panic_on_warn+0x7e/0xa0
[ 60.854347][ T4175] ? ax25_fillin_cb+0x460/0x660
[ 60.859195][ T4175] end_report+0x6d/0xf0
[ 60.863343][ T4175] kasan_report+0x18e/0x1c0
[ 60.867837][ T4175] ? ax25_fillin_cb+0x460/0x660
[ 60.872683][ T4175] ax25_fillin_cb+0x460/0x660
[ 60.877357][ T4175] ax25_setsockopt+0xab7/0xe70
[ 60.882127][ T4175] ? ax25_shutdown+0x10/0x10
[ 60.886714][ T4175] ? aa_sock_opt_perm+0x79/0x110
[ 60.891679][ T4175] ? bpf_lsm_socket_setsockopt+0x5/0x10
[ 60.897312][ T4175] ? security_socket_setsockopt+0x7d/0xa0
[ 60.903025][ T4175] ? ax25_shutdown+0x10/0x10
[ 60.907610][ T4175] __sys_setsockopt+0x57e/0x990
[ 60.912458][ T4175] ? __ia32_sys_recv+0xb0/0xb0
[ 60.917219][ T4175] ? syscall_enter_from_user_mode+0x2e/0x240
[ 60.923195][ T4175] __x64_sys_setsockopt+0xb1/0xc0
[ 60.928214][ T4175] do_syscall_64+0x3b/0xb0
[ 60.932621][ T4175] ? clear_bhb_loop+0x15/0x70
[ 60.937293][ T4175] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 60.943180][ T4175] RIP: 0033:0x7f2d3c83e619
[ 60.947587][ T4175] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 31 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 60.967200][ T4175] RSP: 002b:00007ffc182afff8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[ 60.975617][ T4175] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f2d3c83e619
[ 60.983582][ T4175] RDX: 0000000000000019 RSI: 0000000000000101 RDI: 0000000000000007
[ 60.991548][ T4175] RBP: 00007ffc182b0030 R08: 0000000000000010 R09: 0000000000000001
[ 60.999516][ T4175] R10: 0000200000000340 R11: 0000000000000246 R12: 00000000000f4240
[ 61.007480][ T4175] R13: 000000000000ea99 R14: 00007ffc182b0014 R15: 00007ffc182b0020
[ 61.015452][ T4175]
[ 61.018767][ T4175] Kernel Offset: disabled
[ 61.023096][ T4175] Rebooting in 86400 seconds..