Debian GNU/Linux 9 syzkaller ttyS0

Warning: Permanently added '10.128.10.40' (ECDSA) to the list of known hosts.
executing program
executing program
executing program
executing program
executing program
executing program
syzkaller login: [   27.861778] syz-executor200 (8033) used greatest stack depth: 24928 bytes left
executing program
executing program
executing program
executing program
executing program
[   28.229440] ==================================================================
[   28.236939] BUG: KASAN: use-after-free in netdevice_event_work_handler+0x1c1/0x1d0
[   28.244647] Read of size 8 at addr ffff8880968e28c0 by task kworker/u4:15/8137
[   28.251998] 
[   28.253626] CPU: 0 PID: 8137 Comm: kworker/u4:15 Not tainted 4.14.299-syzkaller #0
[   28.261332] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[   28.270868] Workqueue: gid-cache-wq netdevice_event_work_handler
[   28.277008] Call Trace:
[   28.279598]  dump_stack+0x1b2/0x281
[   28.283230]  print_address_description.cold+0x54/0x1d3
[   28.288518]  kasan_report_error.cold+0x8a/0x191
[   28.293186]  ? netdevice_event_work_handler+0x1c1/0x1d0
[   28.298548]  __asan_report_load8_noabort+0x68/0x70
[   28.303480]  ? netdevice_event_work_handler+0x1c1/0x1d0
[   28.308848]  netdevice_event_work_handler+0x1c1/0x1d0
[   28.314047]  ? rcu_lockdep_current_cpu_online+0xed/0x140
[   28.319504]  process_one_work+0x793/0x14a0
[   28.323746]  ? work_busy+0x320/0x320
[   28.327467]  worker_thread+0x5cc/0xff0
[   28.331361]  ? rescuer_thread+0xc80/0xc80
[   28.335509]  kthread+0x30d/0x420
[   28.338877]  ? kthread_create_on_node+0xd0/0xd0
[   28.343551]  ret_from_fork+0x24/0x30
[   28.347272] 
[   28.348890] Allocated by task 8034:
[   28.352519]  kasan_kmalloc+0xeb/0x160
[   28.356323]  __kmalloc_node+0x4c/0x70
[   28.360120]  kvmalloc_node+0x46/0xd0
[   28.363827]  alloc_netdev_mqs+0x76/0xb70
[   28.367884]  rtnl_create_link+0x1ab/0x890
[   28.372026]  rtnl_newlink+0xe7a/0x1830
[   28.375910]  rtnetlink_rcv_msg+0x3be/0xb10
[   28.380138]  netlink_rcv_skb+0x125/0x390
[   28.384195]  netlink_unicast+0x437/0x610
[   28.388253]  netlink_sendmsg+0x648/0xbc0
[   28.392314]  sock_sendmsg+0xb5/0x100
[   28.396027]  ___sys_sendmsg+0x6c8/0x800
[   28.400000]  __sys_sendmsg+0xa3/0x120
[   28.403800]  SyS_sendmsg+0x27/0x40
[   28.407337]  do_syscall_64+0x1d5/0x640
[   28.411224]  entry_SYSCALL_64_after_hwframe+0x5e/0xd3
[   28.416404] 
[   28.418024] Freed by task 8034:
[   28.421299]  kasan_slab_free+0xc3/0x1a0
[   28.425274]  kfree+0xc9/0x250
[   28.428377]  kvfree+0x45/0x50
[   28.431478]  device_release+0x15f/0x1a0
[   28.435447]  kobject_put+0x251/0x550
[   28.439155]  put_device+0x1c/0x30
[   28.442608]  free_netdev+0x26f/0x360
[   28.446319]  rtnl_newlink+0x14cd/0x1830
[   28.450295]  rtnetlink_rcv_msg+0x3be/0xb10
[   28.454527]  netlink_rcv_skb+0x125/0x390
[   28.458586]  netlink_unicast+0x437/0x610
[   28.462653]  netlink_sendmsg+0x648/0xbc0
[   28.466712]  sock_sendmsg+0xb5/0x100
[   28.470425]  ___sys_sendmsg+0x6c8/0x800
[   28.474399]  __sys_sendmsg+0xa3/0x120
[   28.478197]  SyS_sendmsg+0x27/0x40
[   28.481735]  do_syscall_64+0x1d5/0x640
[   28.485635]  entry_SYSCALL_64_after_hwframe+0x5e/0xd3
[   28.490820] 
[   28.492447] The buggy address belongs to the object at ffff8880968e2380
[   28.492447]  which belongs to the cache kmalloc-4096 of size 4096
[   28.505278] The buggy address is located 1344 bytes inside of
[   28.505278]  4096-byte region [ffff8880968e2380, ffff8880968e3380)
[   28.517321] The buggy address belongs to the page:
[   28.522341] page:ffffea00025a3880 count:1 mapcount:0 mapping:ffff8880968e2380 index:0x0 compound_mapcount: 0
[   28.532417] flags: 0xfff00000008100(slab|head)
[   28.537013] raw: 00fff00000008100 ffff8880968e2380 0000000000000000 0000000100000001
[   28.544980] raw: ffffea000260eea0 ffffea00025a3920 ffff88813fe74dc0 0000000000000000
[   28.552853] page dumped because: kasan: bad access detected
[   28.558596] 
[   28.560213] Memory state around the buggy address:
[   28.565150]  ffff8880968e2780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   28.572537]  ffff8880968e2800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   28.579896] >ffff8880968e2880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   28.587253]                                            ^
[   28.592697]  ffff8880968e2900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   28.600048]  ffff8880968e2980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   28.607396] ==================================================================
[   28.614745] Disabling lock debugging due to kernel taint
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program