Warning: Permanently added '10.128.10.7' (ECDSA) to the list of known hosts.
2021/12/14 23:02:41 fuzzer started
2021/12/14 23:02:41 connecting to host at 10.128.0.169:35519
2021/12/14 23:02:41 checking machine...
2021/12/14 23:02:41 checking revisions...
2021/12/14 23:02:41 testing simple program...
syzkaller login: [   46.333673][ T3602] cgroup: Unknown subsys name 'net'
[   46.485073][ T3602] cgroup: Unknown subsys name 'rlimit'
[   47.688232][ T3607] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   47.696205][ T3607] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   47.703674][ T3607] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   47.711602][ T3607] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   47.719326][ T3607] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[   47.726772][ T3607] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   47.813375][ T3606] chnl_net:caif_netlink_parms(): no params data found
[   47.855859][ T3606] bridge0: port 1(bridge_slave_0) entered blocking state
[   47.863467][ T3606] bridge0: port 1(bridge_slave_0) entered disabled state
[   47.871514][ T3606] device bridge_slave_0 entered promiscuous mode
[   47.880444][ T3606] bridge0: port 2(bridge_slave_1) entered blocking state
[   47.887541][ T3606] bridge0: port 2(bridge_slave_1) entered disabled state
[   47.895513][ T3606] device bridge_slave_1 entered promiscuous mode
[   47.916034][ T3606] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   47.926965][ T3606] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   47.949099][ T3606] team0: Port device team_slave_0 added
[   47.956218][ T3606] team0: Port device team_slave_1 added
[   47.974229][ T3606] batman_adv: batadv0: Adding interface: batadv_slave_0
[   47.981347][ T3606] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   48.007434][ T3606] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   48.019860][ T3606] batman_adv: batadv0: Adding interface: batadv_slave_1
[   48.026800][ T3606] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   48.052943][ T3606] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   48.079234][ T3606] device hsr_slave_0 entered promiscuous mode
[   48.086332][ T3606] device hsr_slave_1 entered promiscuous mode
[   48.161687][ T3606] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   48.172235][ T3606] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   48.181076][ T3606] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   48.191162][ T3606] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   48.211091][ T3606] bridge0: port 2(bridge_slave_1) entered blocking state
[   48.218245][ T3606] bridge0: port 2(bridge_slave_1) entered forwarding state
[   48.225727][ T3606] bridge0: port 1(bridge_slave_0) entered blocking state
[   48.233021][ T3606] bridge0: port 1(bridge_slave_0) entered forwarding state
[   48.275063][ T3606] 8021q: adding VLAN 0 to HW filter on device bond0
[   48.291784][ T3606] 8021q: adding VLAN 0 to HW filter on device team0
[   48.298971][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[   48.309172][ T3616] bridge0: port 1(bridge_slave_0) entered disabled state
[   48.317260][ T3616] bridge0: port 2(bridge_slave_1) entered disabled state
[   48.326514][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[   48.340252][   T20] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[   48.349229][   T20] bridge0: port 1(bridge_slave_0) entered blocking state
[   48.356344][   T20] bridge0: port 1(bridge_slave_0) entered forwarding state
[   48.380482][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[   48.389880][ T3616] bridge0: port 2(bridge_slave_1) entered blocking state
[   48.396937][ T3616] bridge0: port 2(bridge_slave_1) entered forwarding state
[   48.405278][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[   48.414721][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[   48.423191][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[   48.434531][ T3606] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   48.445878][ T3606] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[   48.454801][   T20] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[   48.462637][   T20] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[   48.483168][ T3606] 8021q: adding VLAN 0 to HW filter on device batadv0
[   48.491658][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[   48.499954][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[   48.518254][   T20] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[   48.535249][   T20] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[   48.543780][   T20] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[   48.551591][   T20] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[   48.561923][ T3606] device veth0_vlan entered promiscuous mode
[   48.573269][ T3606] device veth1_vlan entered promiscuous mode
[   48.591903][   T20] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[   48.599982][   T20] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[   48.609014][   T20] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[   48.620299][ T3606] device veth0_macvtap entered promiscuous mode
[   48.629859][ T3606] device veth1_macvtap entered promiscuous mode
[   48.648907][ T3606] batman_adv: batadv0: Interface activated: batadv_slave_0
[   48.656625][   T20] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[   48.667261][   T20] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[   48.679752][ T3606] batman_adv: batadv0: Interface activated: batadv_slave_1
[   48.687945][  T926] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[   48.699854][ T3606] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   48.710742][ T3606] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   48.719638][ T3606] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   48.729468][ T3606] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   48.813556][   T55] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   48.824104][   T55] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   48.846102][    T7] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[   48.853689][  T947] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   48.863995][  T947] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   48.873193][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
2021/12/14 23:02:44 building call list...
[   49.113008][  T947] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
executing program
[   50.982845][ T3597] can: request_module (can-proto-0) failed.
[   51.004357][ T3597] can: request_module (can-proto-0) failed.
[   51.023962][ T3597] can: request_module (can-proto-0) failed.
[   51.215477][ T3597] ------------[ cut here ]------------
[   51.221744][ T3597] refcount_t: decrement hit 0; leaking memory.
[   51.229256][ T3597] WARNING: CPU: 0 PID: 3597 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0
[   51.239174][ T3597] Modules linked in:
[   51.243076][ T3597] CPU: 1 PID: 3597 Comm: syz-fuzzer Not tainted 5.16.0-rc5-next-20211214-syzkaller #0
[   51.252854][ T3597] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   51.263131][ T3597] RIP: 0010:refcount_warn_saturate+0xbf/0x1e0
[   51.269356][ T3597] Code: 1d 06 e6 95 09 31 ff 89 de e8 4d f8 8f fd 84 db 75 e0 e8 64 f4 8f fd 48 c7 c7 a0 4d 05 8a c6 05 e6 e5 95 09 01 e8 26 ac 28 05 <0f> 0b eb c4 e8 48 f4 8f fd 0f b6 1d d5 e5 95 09 31 ff 89 de e8 18
[   51.290363][ T3597] RSP: 0018:ffffc90001affab8 EFLAGS: 00010282
[   51.296430][ T3597] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[   51.304536][ T3597] RDX: ffff888074a20000 RSI: ffffffff815f4648 RDI: fffff5200035ff49
[   51.313712][ T3597] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
[   51.321806][ T3597] R10: ffffffff815ee3ae R11: 0000000000000000 R12: 1ffff9200035ff5c
[   51.330508][ T3597] R13: 00000000ffffffef R14: ffffffff8d309554 R15: ffffc90001affd10
[   51.338515][ T3597] FS:  000000c00002e890(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
[   51.347588][ T3597] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   51.354463][ T3597] CR2: 0000000001058048 CR3: 0000000075b6f000 CR4: 00000000003506e0
[   51.362494][ T3597] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   51.370503][ T3597] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   51.378600][ T3597] Call Trace:
[   51.381879][ T3597]  <TASK>
[   51.384799][ T3597]  ref_tracker_free+0x4fe/0x610
[   51.389712][ T3597]  ? ref_tracker_dir_exit+0x330/0x330
[   51.395093][ T3597]  ? bpf_sk_storage_free+0x333/0x3e0
[   51.400439][ T3597]  ? lock_downgrade+0x6e0/0x6e0
[   51.405307][ T3597]  ? kfree+0x1ea/0x4b0
[   51.409541][ T3597]  __sk_destruct+0x3cd/0x710
[   51.414152][ T3597]  sk_destruct+0xbd/0xe0
[   51.418466][ T3597]  __sk_free+0xef/0x3d0
[   51.422637][ T3597]  sk_free+0x78/0xa0
[   51.426526][ T3597]  __mptcp_close_ssk+0x435/0x590
[   51.431725][ T3597]  __mptcp_destroy_sock+0x35f/0x830
[   51.436948][ T3597]  ? __mptcp_close_ssk+0x590/0x590
[   51.442372][ T3597]  ? __local_bh_enable_ip+0xa0/0x120
[   51.447747][ T3597]  mptcp_close+0x5f8/0x7f0
[   51.452240][ T3597]  inet_release+0x12e/0x280
[   51.456741][ T3597]  inet6_release+0x4c/0x70
[   51.461202][ T3597]  __sock_release+0xcd/0x280
[   51.465814][ T3597]  sock_close+0x18/0x20
[   51.470112][ T3597]  __fput+0x286/0x9f0
[   51.474110][ T3597]  ? __sock_release+0x280/0x280
[   51.479056][ T3597]  task_work_run+0xdd/0x1a0
[   51.483602][ T3597]  exit_to_user_mode_prepare+0x27e/0x290
[   51.489336][ T3597]  syscall_exit_to_user_mode+0x19/0x60
[   51.494813][ T3597]  do_syscall_64+0x42/0xb0
[   51.499358][ T3597]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[   51.505274][ T3597] RIP: 0033:0x4b12db
[   51.509249][ T3597] Code: fb ff eb bd e8 46 96 fb ff e9 61 ff ff ff cc e8 fb 61 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30
[   51.529024][ T3597] RSP: 002b:000000c0001074f0 EFLAGS: 00000206 ORIG_RAX: 0000000000000003
[   51.537430][ T3597] RAX: 0000000000000000 RBX: 000000c00001c000 RCX: 00000000004b12db
[   51.545603][ T3597] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006
[   51.553625][ T3597] RBP: 000000c000107530 R08: 0000000000f0ae01 R09: 00007ffd41bd5080
[   51.561743][ T3597] R10: 00007ffd41bd5090 R11: 0000000000000206 R12: 0000000000000081
[   51.569774][ T3597] R13: 0000000000000000 R14: ffffffffffffffff R15: 000000c0004f4000
[   51.577946][ T3597]  </TASK>
[   51.580969][ T3597] Kernel panic - not syncing: panic_on_warn set ...
[   51.587539][ T3597] CPU: 1 PID: 3597 Comm: syz-fuzzer Not tainted 5.16.0-rc5-next-20211214-syzkaller #0
[   51.597068][ T3597] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   51.607107][ T3597] Call Trace:
[   51.610377][ T3597]  <TASK>
[   51.613292][ T3597]  dump_stack_lvl+0xcd/0x134
[   51.617890][ T3597]  panic+0x2b0/0x6dd
[   51.621823][ T3597]  ? __warn_printk+0xf3/0xf3
[   51.626406][ T3597]  ? __warn.cold+0x1d1/0x2cf
[   51.630986][ T3597]  ? refcount_warn_saturate+0xbf/0x1e0
[   51.636524][ T3597]  __warn.cold+0x1ec/0x2cf
[   51.640924][ T3597]  ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70
[   51.647220][ T3597]  ? refcount_warn_saturate+0xbf/0x1e0
[   51.652684][ T3597]  report_bug+0x1bd/0x210
[   51.657102][ T3597]  handle_bug+0x3c/0x60
[   51.661250][ T3597]  exc_invalid_op+0x14/0x40
[   51.665740][ T3597]  asm_exc_invalid_op+0x12/0x20
[   51.670593][ T3597] RIP: 0010:refcount_warn_saturate+0xbf/0x1e0
[   51.676676][ T3597] Code: 1d 06 e6 95 09 31 ff 89 de e8 4d f8 8f fd 84 db 75 e0 e8 64 f4 8f fd 48 c7 c7 a0 4d 05 8a c6 05 e6 e5 95 09 01 e8 26 ac 28 05 <0f> 0b eb c4 e8 48 f4 8f fd 0f b6 1d d5 e5 95 09 31 ff 89 de e8 18
[   51.696275][ T3597] RSP: 0018:ffffc90001affab8 EFLAGS: 00010282
[   51.702332][ T3597] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[   51.710288][ T3597] RDX: ffff888074a20000 RSI: ffffffff815f4648 RDI: fffff5200035ff49
[   51.718241][ T3597] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
[   51.726196][ T3597] R10: ffffffff815ee3ae R11: 0000000000000000 R12: 1ffff9200035ff5c
[   51.734151][ T3597] R13: 00000000ffffffef R14: ffffffff8d309554 R15: ffffc90001affd10
[   51.742108][ T3597]  ? wake_up_klogd.part.0+0x8e/0xd0
[   51.747300][ T3597]  ? vprintk+0x88/0x90
[   51.751366][ T3597]  ? refcount_warn_saturate+0xbf/0x1e0
[   51.756817][ T3597]  ref_tracker_free+0x4fe/0x610
[   51.761653][ T3597]  ? ref_tracker_dir_exit+0x330/0x330
[   51.767010][ T3597]  ? bpf_sk_storage_free+0x333/0x3e0
[   51.772288][ T3597]  ? lock_downgrade+0x6e0/0x6e0
[   51.777127][ T3597]  ? kfree+0x1ea/0x4b0
[   51.781193][ T3597]  __sk_destruct+0x3cd/0x710
[   51.785779][ T3597]  sk_destruct+0xbd/0xe0
[   51.790014][ T3597]  __sk_free+0xef/0x3d0
[   51.794159][ T3597]  sk_free+0x78/0xa0
[   51.798045][ T3597]  __mptcp_close_ssk+0x435/0x590
[   51.802979][ T3597]  __mptcp_destroy_sock+0x35f/0x830
[   51.808169][ T3597]  ? __mptcp_close_ssk+0x590/0x590
[   51.813269][ T3597]  ? __local_bh_enable_ip+0xa0/0x120
[   51.818552][ T3597]  mptcp_close+0x5f8/0x7f0
[   51.822966][ T3597]  inet_release+0x12e/0x280
[   51.827458][ T3597]  inet6_release+0x4c/0x70
[   51.831869][ T3597]  __sock_release+0xcd/0x280
[   51.836454][ T3597]  sock_close+0x18/0x20
[   51.840601][ T3597]  __fput+0x286/0x9f0
[   51.844573][ T3597]  ? __sock_release+0x280/0x280
[   51.849421][ T3597]  task_work_run+0xdd/0x1a0
[   51.853915][ T3597]  exit_to_user_mode_prepare+0x27e/0x290
[   51.859540][ T3597]  syscall_exit_to_user_mode+0x19/0x60
[   51.864998][ T3597]  do_syscall_64+0x42/0xb0
[   51.869399][ T3597]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[   51.875302][ T3597] RIP: 0033:0x4b12db
[   51.879181][ T3597] Code: fb ff eb bd e8 46 96 fb ff e9 61 ff ff ff cc e8 fb 61 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30
[   51.898768][ T3597] RSP: 002b:000000c0001074f0 EFLAGS: 00000206 ORIG_RAX: 0000000000000003
[   51.907163][ T3597] RAX: 0000000000000000 RBX: 000000c00001c000 RCX: 00000000004b12db
[   51.915134][ T3597] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006
[   51.923087][ T3597] RBP: 000000c000107530 R08: 0000000000f0ae01 R09: 00007ffd41bd5080
[   51.931042][ T3597] R10: 00007ffd41bd5090 R11: 0000000000000206 R12: 0000000000000081
[   51.938996][ T3597] R13: 0000000000000000 R14: ffffffffffffffff R15: 000000c0004f4000
[   51.946959][ T3597]  </TASK>
[   51.950309][ T3597] Kernel Offset: disabled
[   51.954703][ T3597] Rebooting in 86400 seconds..