Warning: Permanently added '10.128.0.64' (ECDSA) to the list of known hosts. 2021/08/25 20:49:58 parsed 1 programs 2021/08/25 20:49:59 executed programs: 0 syzkaller login: [ 414.650699][ T8468] chnl_net:caif_netlink_parms(): no params data found [ 414.723811][ T8468] bridge0: port 1(bridge_slave_0) entered blocking state [ 414.731045][ T8468] bridge0: port 1(bridge_slave_0) entered disabled state [ 414.740568][ T8468] device bridge_slave_0 entered promiscuous mode [ 414.751823][ T8468] bridge0: port 2(bridge_slave_1) entered blocking state [ 414.760341][ T8468] bridge0: port 2(bridge_slave_1) entered disabled state [ 414.770213][ T8468] device bridge_slave_1 entered promiscuous mode [ 414.802325][ T8468] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 414.813730][ T8468] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 414.848821][ T8468] team0: Port device team_slave_0 added [ 414.856175][ T8468] team0: Port device team_slave_1 added [ 414.884005][ T8468] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 414.891045][ T8468] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 414.917976][ T8468] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 414.933105][ T8468] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 414.940697][ T8468] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 414.967753][ T8468] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 415.005263][ T8468] device hsr_slave_0 entered promiscuous mode [ 415.013070][ T8468] device hsr_slave_1 entered promiscuous mode [ 415.135685][ T8468] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 415.145960][ T8468] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 415.160301][ T8468] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 415.171203][ T8468] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 415.195504][ T8468] bridge0: port 2(bridge_slave_1) entered blocking state [ 415.203087][ T8468] bridge0: port 2(bridge_slave_1) entered forwarding state [ 415.212023][ T8468] bridge0: port 1(bridge_slave_0) entered blocking state [ 415.219258][ T8468] bridge0: port 1(bridge_slave_0) entered forwarding state [ 415.263250][ T8468] 8021q: adding VLAN 0 to HW filter on device bond0 [ 415.278625][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 415.291039][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 415.299858][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 415.308810][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 415.323222][ T8468] 8021q: adding VLAN 0 to HW filter on device team0 [ 415.334502][ T8634] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 415.344840][ T8634] bridge0: port 1(bridge_slave_0) entered blocking state [ 415.352083][ T8634] bridge0: port 1(bridge_slave_0) entered forwarding state [ 415.368048][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 415.377403][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 415.384646][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 415.410058][ T8541] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 415.419900][ T8541] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 415.429588][ T8541] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 415.438788][ T8541] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 415.447685][ T8541] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 415.460713][ T8468] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 415.479313][ T8541] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 415.487154][ T8541] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 415.501336][ T8468] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 415.521640][ T8541] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 415.542193][ T8634] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 415.550664][ T8634] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 415.559042][ T8634] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 415.571339][ T8468] device veth0_vlan entered promiscuous mode [ 415.585316][ T8468] device veth1_vlan entered promiscuous mode [ 415.608904][ T8803] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 415.617889][ T8803] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 415.627834][ T8803] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 415.640618][ T8468] device veth0_macvtap entered promiscuous mode [ 415.650894][ T8468] device veth1_macvtap entered promiscuous mode [ 415.669325][ T8468] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 415.680403][ T8803] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 415.690212][ T8803] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 415.703435][ T8468] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 415.712037][ T8803] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 415.720947][ T8803] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 415.732695][ T8468] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 415.742648][ T8468] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 415.751513][ T8468] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 415.761167][ T8468] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 415.856674][ T28] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 415.864880][ T28] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 415.897015][ T8683] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 415.901701][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 415.905823][ T8683] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 415.924743][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 416.487871][ T7] Bluetooth: hci0: command 0x0409 tx timeout 2021/08/25 20:50:04 executed programs: 26 [ 418.556627][ T7] Bluetooth: hci0: command 0x041b tx timeout [ 420.637318][ T7] Bluetooth: hci0: command 0x040f tx timeout [ 422.726285][ T8502] Bluetooth: hci0: command 0x0419 tx timeout 2021/08/25 20:50:09 executed programs: 66 [ 424.806132][ T8502] Bluetooth: hci0: command 0x0405 tx timeout [ 426.876029][ T8805] Bluetooth: hci0: command 0x0405 tx timeout 2021/08/25 20:50:14 executed programs: 106 2021/08/25 20:50:19 executed programs: 146 2021/08/25 20:50:24 executed programs: 187 [ 439.757002][ T3266] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.764113][ T3266] ieee802154 phy1 wpan1: encryption failed: -22 2021/08/25 20:50:29 executed programs: 227 2021/08/25 20:50:34 executed programs: 267 2021/08/25 20:50:39 executed programs: 307 [ 457.675967][ T20] ================================================================== [ 457.684396][ T20] BUG: KASAN: use-after-free in sco_sock_timeout+0x64/0x290 [ 457.691803][ T20] Write of size 4 at addr ffff888034b46080 by task kworker/1:0/20 [ 457.699614][ T20] [ 457.701957][ T20] CPU: 1 PID: 20 Comm: kworker/1:0 Not tainted 5.14.0-rc6-syzkaller #0 [ 457.710199][ T20] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 457.720254][ T20] Workqueue: events sco_sock_timeout [ 457.725546][ T20] Call Trace: [ 457.728822][ T20] dump_stack_lvl+0xcd/0x134 [ 457.733451][ T20] print_address_description.constprop.0.cold+0x6c/0x309 [ 457.740588][ T20] ? sco_sock_timeout+0x64/0x290 [ 457.745525][ T20] ? sco_sock_timeout+0x64/0x290 [ 457.750458][ T20] kasan_report.cold+0x83/0xdf [ 457.755225][ T20] ? sco_sock_timeout+0x64/0x290 [ 457.760288][ T20] kasan_check_range+0x13d/0x180 [ 457.765597][ T20] sco_sock_timeout+0x64/0x290 [ 457.770457][ T20] process_one_work+0x98d/0x1630 [ 457.775459][ T20] ? pwq_dec_nr_in_flight+0x320/0x320 [ 457.780842][ T20] ? rwlock_bug.part.0+0x90/0x90 [ 457.785908][ T20] ? _raw_spin_lock_irq+0x41/0x50 [ 457.790982][ T20] worker_thread+0x658/0x11f0 [ 457.795672][ T20] ? process_one_work+0x1630/0x1630 [ 457.800870][ T20] kthread+0x3e5/0x4d0 [ 457.805108][ T20] ? set_kthread_struct+0x130/0x130 [ 457.810304][ T20] ret_from_fork+0x1f/0x30 [ 457.814807][ T20] [ 457.817128][ T20] Allocated by task 4872: [ 457.821439][ T20] kasan_save_stack+0x1b/0x40 [ 457.826113][ T20] __kasan_kmalloc+0x9b/0xd0 [ 457.830783][ T20] sk_prot_alloc+0x110/0x290 [ 457.835433][ T20] sk_alloc+0x32/0xbc0 [ 457.839580][ T20] __netlink_create+0x63/0x2f0 [ 457.844376][ T20] netlink_create+0x3ad/0x5e0 [ 457.849054][ T20] __sock_create+0x353/0x790 [ 457.853654][ T20] __sys_socket+0xef/0x200 [ 457.858149][ T20] __x64_sys_socket+0x6f/0xb0 [ 457.863014][ T20] do_syscall_64+0x35/0xb0 [ 457.867509][ T20] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 457.873405][ T20] [ 457.875738][ T20] Freed by task 0: [ 457.879455][ T20] kasan_save_stack+0x1b/0x40 [ 457.884126][ T20] kasan_set_track+0x1c/0x30 [ 457.888709][ T20] kasan_set_free_info+0x20/0x30 [ 457.893653][ T20] __kasan_slab_free+0xfb/0x130 [ 457.898504][ T20] slab_free_freelist_hook+0xdf/0x240 [ 457.903955][ T20] kfree+0xe4/0x540 [ 457.907763][ T20] __sk_destruct+0x6a8/0x900 [ 457.912784][ T20] sk_destruct+0xbd/0xe0 [ 457.917017][ T20] __sk_free+0xef/0x3d0 [ 457.921166][ T20] sk_free+0x78/0xa0 [ 457.925050][ T20] deferred_put_nlk_sk+0x151/0x2f0 [ 457.930163][ T20] rcu_core+0x7ab/0x1380 [ 457.934677][ T20] __do_softirq+0x29b/0x9c2 [ 457.939175][ T20] [ 457.941501][ T20] Last potentially related work creation: [ 457.947199][ T20] kasan_save_stack+0x1b/0x40 [ 457.951875][ T20] kasan_record_aux_stack+0xe5/0x110 [ 457.957159][ T20] call_rcu+0xb1/0x750 [ 457.961336][ T20] netlink_release+0xdd4/0x1dd0 [ 457.966183][ T20] __sock_release+0xcd/0x280 [ 457.970767][ T20] sock_close+0x18/0x20 [ 457.975017][ T20] __fput+0x288/0x920 [ 457.979211][ T20] task_work_run+0xdd/0x1a0 [ 457.983736][ T20] do_exit+0xbd4/0x2a60 [ 457.988242][ T20] do_group_exit+0x125/0x310 [ 457.992849][ T20] __x64_sys_exit_group+0x3a/0x50 [ 457.998670][ T20] do_syscall_64+0x35/0xb0 [ 458.003377][ T20] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 458.009271][ T20] [ 458.011585][ T20] Second to last potentially related work creation: [ 458.018150][ T20] kasan_save_stack+0x1b/0x40 [ 458.022834][ T20] kasan_record_aux_stack+0xe5/0x110 [ 458.028117][ T20] call_rcu+0xb1/0x750 [ 458.032178][ T20] netlink_release+0xdd4/0x1dd0 [ 458.037023][ T20] __sock_release+0xcd/0x280 [ 458.041605][ T20] sock_close+0x18/0x20 [ 458.045759][ T20] __fput+0x288/0x920 [ 458.049740][ T20] task_work_run+0xdd/0x1a0 [ 458.054253][ T20] do_exit+0xbd4/0x2a60 [ 458.058494][ T20] do_group_exit+0x125/0x310 [ 458.063095][ T20] __x64_sys_exit_group+0x3a/0x50 [ 458.068113][ T20] do_syscall_64+0x35/0xb0 [ 458.072884][ T20] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 458.078884][ T20] [ 458.081195][ T20] The buggy address belongs to the object at ffff888034b46000 [ 458.081195][ T20] which belongs to the cache kmalloc-2k of size 2048 [ 458.095411][ T20] The buggy address is located 128 bytes inside of [ 458.095411][ T20] 2048-byte region [ffff888034b46000, ffff888034b46800) [ 458.109110][ T20] The buggy address belongs to the page: [ 458.114725][ T20] page:ffffea0000d2d000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34b40 [ 458.125085][ T20] head:ffffea0000d2d000 order:3 compound_mapcount:0 compound_pincount:0 [ 458.133399][ T20] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 458.141553][ T20] raw: 00fff00000010200 ffffea0000c37a00 0000000200000002 ffff888010c42000 [ 458.150138][ T20] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000 [ 458.158708][ T20] page dumped because: kasan: bad access detected [ 458.165104][ T20] page_owner tracks the page as allocated [ 458.170804][ T20] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 8634, ts 417197903424, free_ts 417180376519 [ 458.190093][ T20] get_page_from_freelist+0xa72/0x2f80 [ 458.195583][ T20] __alloc_pages+0x1b2/0x500 [ 458.200168][ T20] alloc_pages+0x18c/0x2a0 [ 458.204634][ T20] allocate_slab+0x32e/0x4b0 [ 458.209217][ T20] ___slab_alloc+0x473/0x7b0 [ 458.213799][ T20] __slab_alloc.constprop.0+0xa7/0xf0 [ 458.219255][ T20] __kmalloc_node_track_caller+0x2e3/0x360 [ 458.225163][ T20] __alloc_skb+0xde/0x340 [ 458.229512][ T20] alloc_skb_with_frags+0x93/0x620 [ 458.234619][ T20] sock_alloc_send_pskb+0x783/0x910 [ 458.239812][ T20] mld_newpack+0x1df/0x770 [ 458.244307][ T20] add_grhead+0x265/0x330 [ 458.248736][ T20] add_grec+0x1053/0x14e0 [ 458.253061][ T20] mld_send_initial_cr.part.0+0xf6/0x230 [ 458.258689][ T20] ipv6_mc_dad_complete+0x1d0/0x690 [ 458.264152][ T20] addrconf_dad_completed+0xa20/0xd60 [ 458.269572][ T20] page last free stack trace: [ 458.274229][ T20] free_pcp_prepare+0x2c5/0x780 [ 458.279137][ T20] free_unref_page+0x19/0x690 [ 458.283824][ T20] unfreeze_partials+0x16c/0x1b0 [ 458.288844][ T20] put_cpu_partial+0x13d/0x230 [ 458.293600][ T20] qlist_free_all+0x5a/0xc0 [ 458.298121][ T20] kasan_quarantine_reduce+0x180/0x200 [ 458.303575][ T20] __kasan_slab_alloc+0x8e/0xa0 [ 458.308610][ T20] kmem_cache_alloc+0x285/0x4a0 [ 458.313454][ T20] getname_flags.part.0+0x50/0x4f0 [ 458.318560][ T20] user_path_at_empty+0xa1/0x100 [ 458.323925][ T20] vfs_statx+0x142/0x390 [ 458.328165][ T20] __do_sys_newlstat+0x91/0x110 [ 458.333258][ T20] do_syscall_64+0x35/0xb0 [ 458.337667][ T20] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 458.343564][ T20] [ 458.345878][ T20] Memory state around the buggy address: [ 458.351496][ T20] ffff888034b45f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 458.359656][ T20] ffff888034b46000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 458.367884][ T20] >ffff888034b46080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 458.375933][ T20] ^ [ 458.379990][ T20] ffff888034b46100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 458.388048][ T20] ffff888034b46180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 458.396181][ T20] ================================================================== [ 458.404312][ T20] Disabling lock debugging due to kernel taint [ 458.410528][ T20] Kernel panic - not syncing: panic_on_warn set ... [ 458.417111][ T20] CPU: 1 PID: 20 Comm: kworker/1:0 Tainted: G B 5.14.0-rc6-syzkaller #0 [ 458.427356][ T20] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 458.437490][ T20] Workqueue: events sco_sock_timeout [ 458.442793][ T20] Call Trace: [ 458.446063][ T20] dump_stack_lvl+0xcd/0x134 [ 458.450662][ T20] panic+0x306/0x73d [ 458.454593][ T20] ? __warn_printk+0xf3/0xf3 [ 458.459174][ T20] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 458.465327][ T20] ? trace_hardirqs_on+0x38/0x1c0 [ 458.470505][ T20] ? trace_hardirqs_on+0x51/0x1c0 [ 458.475523][ T20] ? sco_sock_timeout+0x64/0x290 [ 458.481040][ T20] ? sco_sock_timeout+0x64/0x290 [ 458.485969][ T20] end_report.cold+0x5a/0x5a [ 458.490564][ T20] kasan_report.cold+0x71/0xdf [ 458.495320][ T20] ? sco_sock_timeout+0x64/0x290 [ 458.500252][ T20] kasan_check_range+0x13d/0x180 [ 458.505189][ T20] sco_sock_timeout+0x64/0x290 [ 458.509946][ T20] process_one_work+0x98d/0x1630 [ 458.514980][ T20] ? pwq_dec_nr_in_flight+0x320/0x320 [ 458.520458][ T20] ? rwlock_bug.part.0+0x90/0x90 [ 458.525402][ T20] ? _raw_spin_lock_irq+0x41/0x50 [ 458.530423][ T20] worker_thread+0x658/0x11f0 [ 458.535110][ T20] ? process_one_work+0x1630/0x1630 [ 458.540403][ T20] kthread+0x3e5/0x4d0 [ 458.545244][ T20] ? set_kthread_struct+0x130/0x130 [ 458.550436][ T20] ret_from_fork+0x1f/0x30 [ 458.556415][ T20] Kernel Offset: disabled [ 458.560733][ T20] Rebooting in 86400 seconds..