Warning: Permanently added '10.128.1.28' (ECDSA) to the list of known hosts.
2023/03/23 19:09:06 fuzzer started
2023/03/23 19:09:06 dialing manager at 10.128.0.169:40369
syzkaller login: [   75.526781][ T5081] cgroup: Unknown subsys name 'net'
[   75.679055][ T5081] cgroup: Unknown subsys name 'rlimit'
2023/03/23 19:09:07 syscalls: 3784
2023/03/23 19:09:07 code coverage: enabled
2023/03/23 19:09:07 comparison tracing: enabled
2023/03/23 19:09:07 extra coverage: enabled
2023/03/23 19:09:07 delay kcov mmap: enabled
2023/03/23 19:09:07 setuid sandbox: enabled
2023/03/23 19:09:07 namespace sandbox: enabled
2023/03/23 19:09:07 Android sandbox: /sys/fs/selinux/policy does not exist
2023/03/23 19:09:07 fault injection: enabled
2023/03/23 19:09:07 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled
2023/03/23 19:09:07 net packet injection: enabled
2023/03/23 19:09:07 net device setup: enabled
2023/03/23 19:09:07 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist
2023/03/23 19:09:07 devlink PCI setup: PCI device 0000:00:10.0 is not available
2023/03/23 19:09:07 NIC VF setup: PCI device 0000:00:11.0 is not available
2023/03/23 19:09:07 USB emulation: enabled
2023/03/23 19:09:07 hci packet injection: enabled
2023/03/23 19:09:07 wifi device emulation: enabled
2023/03/23 19:09:07 802.15.4 emulation: enabled
2023/03/23 19:09:07 fetching corpus: 0, signal 0/2000 (executing program)
2023/03/23 19:09:07 fetching corpus: 50, signal 54281/57625 (executing program)
2023/03/23 19:09:07 fetching corpus: 100, signal 77655/82211 (executing program)
[   76.382090][ T1215] ieee802154 phy0 wpan0: encryption failed: -22
[   76.389901][ T1215] ieee802154 phy1 wpan1: encryption failed: -22
2023/03/23 19:09:07 fetching corpus: 150, signal 94216/99860 (executing program)
2023/03/23 19:09:08 fetching corpus: 200, signal 110597/117109 (executing program)
2023/03/23 19:09:08 fetching corpus: 250, signal 123275/130637 (executing program)
2023/03/23 19:09:08 fetching corpus: 300, signal 139615/147520 (executing program)
2023/03/23 19:09:08 fetching corpus: 350, signal 146450/155084 (executing program)
2023/03/23 19:09:08 fetching corpus: 400, signal 153391/162751 (executing program)
2023/03/23 19:09:09 fetching corpus: 450, signal 159632/169680 (executing program)
2023/03/23 19:09:09 fetching corpus: 500, signal 166729/177292 (executing program)
2023/03/23 19:09:09 fetching corpus: 550, signal 174935/185846 (executing program)
2023/03/23 19:09:09 fetching corpus: 600, signal 180235/191654 (executing program)
2023/03/23 19:09:10 fetching corpus: 650, signal 185460/197311 (executing program)
2023/03/23 19:09:10 fetching corpus: 700, signal 190569/202791 (executing program)
2023/03/23 19:09:10 fetching corpus: 750, signal 199448/211598 (executing program)
2023/03/23 19:09:10 fetching corpus: 800, signal 203662/216130 (executing program)
2023/03/23 19:09:10 fetching corpus: 850, signal 208659/221363 (executing program)
2023/03/23 19:09:11 fetching corpus: 900, signal 213629/226487 (executing program)
2023/03/23 19:09:11 fetching corpus: 950, signal 221496/234026 (executing program)
2023/03/23 19:09:11 fetching corpus: 1000, signal 227085/239496 (executing program)
2023/03/23 19:09:12 fetching corpus: 1050, signal 232855/245072 (executing program)
2023/03/23 19:09:12 fetching corpus: 1100, signal 236420/248680 (executing program)
2023/03/23 19:09:12 fetching corpus: 1150, signal 242291/254213 (executing program)
2023/03/23 19:09:12 fetching corpus: 1200, signal 245394/257361 (executing program)
2023/03/23 19:09:13 fetching corpus: 1250, signal 248753/260689 (executing program)
2023/03/23 19:09:13 fetching corpus: 1300, signal 252403/264238 (executing program)
2023/03/23 19:09:13 fetching corpus: 1350, signal 255360/267154 (executing program)
2023/03/23 19:09:13 fetching corpus: 1400, signal 257756/269566 (executing program)
2023/03/23 19:09:13 fetching corpus: 1450, signal 260895/272601 (executing program)
2023/03/23 19:09:14 fetching corpus: 1500, signal 263482/275100 (executing program)
2023/03/23 19:09:14 fetching corpus: 1550, signal 265496/277112 (executing program)
2023/03/23 19:09:14 fetching corpus: 1600, signal 270488/281510 (executing program)
2023/03/23 19:09:14 fetching corpus: 1650, signal 273430/284118 (executing program)
2023/03/23 19:09:15 fetching corpus: 1700, signal 279266/288957 (executing program)
2023/03/23 19:09:15 fetching corpus: 1750, signal 282191/291471 (executing program)
2023/03/23 19:09:15 fetching corpus: 1800, signal 285726/294465 (executing program)
2023/03/23 19:09:15 fetching corpus: 1850, signal 287743/296224 (executing program)
2023/03/23 19:09:16 fetching corpus: 1900, signal 290349/298410 (executing program)
2023/03/23 19:09:16 fetching corpus: 1950, signal 292809/300470 (executing program)
2023/03/23 19:09:16 fetching corpus: 2000, signal 294769/302104 (executing program)
2023/03/23 19:09:16 fetching corpus: 2050, signal 298041/304731 (executing program)
2023/03/23 19:09:16 fetching corpus: 2100, signal 300715/306853 (executing program)
2023/03/23 19:09:17 fetching corpus: 2150, signal 302871/308621 (executing program)
2023/03/23 19:09:17 fetching corpus: 2200, signal 305676/310790 (executing program)
[   86.248137][ T5075] ==================================================================
[   86.256247][ T5075] BUG: KASAN: stack-out-of-bounds in vma_merge+0x1a90/0x1fd0
[   86.263682][ T5075] Read of size 8 at addr ffffc900039afa60 by task syz-fuzzer/5075
[   86.271529][ T5075] 
[   86.273873][ T5075] CPU: 0 PID: 5075 Comm: syz-fuzzer Not tainted 6.3.0-rc3-next-20230323-syzkaller #0
[   86.283372][ T5075] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
[   86.293454][ T5075] Call Trace:
[   86.296742][ T5075]  <TASK>
[   86.299680][ T5075]  dump_stack_lvl+0xd9/0x150
[   86.304298][ T5075]  print_address_description.constprop.0+0x2c/0x3c0
[   86.310907][ T5075]  ? vma_merge+0x1a90/0x1fd0
[   86.315511][ T5075]  kasan_report+0x11c/0x130
[   86.320033][ T5075]  ? vma_merge+0x1a90/0x1fd0
[   86.324644][ T5075]  vma_merge+0x1a90/0x1fd0
[   86.329120][ T5075]  ? vma_shrink+0x5c0/0x5c0
[   86.333647][ T5075]  ? print_usage_bug.part.0+0x660/0x660
[   86.339223][ T5075]  ? lock_sync+0x190/0x190
[   86.343668][ T5075]  ? rcu_is_watching+0x12/0xb0
[   86.348464][ T5075]  ? do_raw_spin_lock+0x124/0x2b0
[   86.353540][ T5075]  madvise_update_vma+0x23f/0xd40
[   86.358675][ T5075]  ? anon_vma_name_alloc+0xe0/0xe0
[   86.363859][ T5075]  madvise_vma_behavior+0x7f6/0x20e0
[   86.369181][ T5075]  ? madvise_vma_anon_name+0xf0/0xf0
[   86.374510][ T5075]  ? find_vma_prev+0xe4/0x160
[   86.379229][ T5075]  ? vm_unmapped_area+0x650/0x650
[   86.384287][ T5075]  ? trace_lock_acquire+0x12d/0x180
[   86.389514][ T5075]  madvise_walk_vmas+0x1c7/0x2b0
[   86.394490][ T5075]  ? madvise_vma_anon_name+0xf0/0xf0
[   86.399811][ T5075]  ? __remove_memory+0x40/0x40
[   86.404599][ T5075]  ? down_write_killable_nested+0x250/0x250
[   86.410529][ T5075]  ? __ia32_sys_get_robust_list+0x400/0x400
[   86.416460][ T5075]  do_madvise.part.0+0x193/0x470
[   86.421431][ T5075]  ? madvise_pageout+0x560/0x560
[   86.426408][ T5075]  ? restore_fpregs_from_fpstate+0xc1/0x1c0
[   86.432326][ T5075]  ? rcu_is_watching+0x12/0xb0
[   86.437121][ T5075]  __x64_sys_madvise+0x117/0x150
[   86.442104][ T5075]  do_syscall_64+0x39/0xb0
[   86.446540][ T5075]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   86.452489][ T5075] RIP: 0033:0x46b557
[   86.456400][ T5075] Code: 8b 24 24 48 8b 6c 24 10 48 83 c4 18 c3 cc cc cc cc cc cc 48 8b 7c 24 08 48 8b 74 24 10 8b 54 24 18 48 c7 c0 1c 00 00 00 0f 05 <89> 44 24 20 c3 cc cc cc cc 48 8b 7c 24 08 8b 74 24 10 8b 54 24 14
[   86.476031][ T5075] RSP: 002b:000000c000069ea0 EFLAGS: 00000206 ORIG_RAX: 000000000000001c
[   86.484462][ T5075] RAX: ffffffffffffffda RBX: 000000000000e000 RCX: 000000000046b557
[   86.492456][ T5075] RDX: 000000000000000f RSI: 0000000000200000 RDI: 000000c003800000
[   86.500456][ T5075] RBP: 000000c000069ee0 R08: 0000000000200000 R09: 000080c00380dfff
[   86.508451][ T5075] R10: 00000000010e0740 R11: 0000000000000206 R12: 00000000010e06c0
[   86.516444][ T5075] R13: 0000000000000003 R14: 000000c000006820 R15: 00000000010e0700
[   86.524441][ T5075]  </TASK>
[   86.527471][ T5075] 
[   86.529801][ T5075] The buggy address belongs to stack of task syz-fuzzer/5075
[   86.537176][ T5075]  and is located at offset 112 in frame:
[   86.542902][ T5075]  vma_merge+0x0/0x1fd0
[   86.547083][ T5075] 
[   86.549444][ T5075] This frame has 1 object:
[   86.553865][ T5075]  [32, 96) 'vp'
[   86.553880][ T5075] 
[   86.559750][ T5075] The buggy address belongs to the virtual mapping at
[   86.559750][ T5075]  [ffffc900039a8000, ffffc900039b1000) created by:
[   86.559750][ T5075]  kernel_clone+0xeb/0x890
[   86.577225][ T5075] 
[   86.579568][ T5075] The buggy address belongs to the physical page:
[   86.585984][ T5075] page:ffffea0001e28340 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78a0d
[   86.596148][ T5075] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[   86.603272][ T5075] page_type: 0xffffffff()
[   86.607610][ T5075] raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000
[   86.616217][ T5075] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   86.624829][ T5075] page dumped because: kasan: bad access detected
[   86.631257][ T5075] page_owner tracks the page as allocated
[   86.636980][ T5075] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_ZERO), pid 5029, tgid 5029 (dhcpcd-run-hook), ts 70495336723, free_ts 68923502132
[   86.656455][ T5075]  get_page_from_freelist+0xf75/0x2aa0
[   86.661945][ T5075]  __alloc_pages+0x1cb/0x4a0
[   86.666563][ T5075]  alloc_pages+0x1aa/0x270
[   86.671007][ T5075]  __vmalloc_node_range+0xb55/0x1380
[   86.676310][ T5075]  copy_process+0x133f/0x76b0
[   86.681019][ T5075]  kernel_clone+0xeb/0x890
[   86.685460][ T5075]  __do_sys_clone+0xba/0x100
[   86.690079][ T5075]  do_syscall_64+0x39/0xb0
[   86.694531][ T5075]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   86.700469][ T5075] page last free stack trace:
[   86.705153][ T5075]  free_unref_page_prepare+0x4d8/0xb80
[   86.710748][ T5075]  free_unref_page_list+0xe3/0xa70
[   86.715881][ T5075]  release_pages+0xcd7/0x1380
[   86.720580][ T5075]  tlb_batch_pages_flush+0xa8/0x1a0
[   86.725804][ T5075]  tlb_finish_mmu+0x14b/0x7e0
[   86.730511][ T5075]  exit_mmap+0x2b2/0x930
[   86.734780][ T5075]  __mmput+0x13a/0x540
[   86.738866][ T5075]  mmput+0x60/0x70
[   86.742620][ T5075]  do_exit+0x9d7/0x29f0
[   86.746804][ T5075]  do_group_exit+0xd4/0x2a0
[   86.751374][ T5075]  __x64_sys_exit_group+0x3e/0x50
[   86.756420][ T5075]  do_syscall_64+0x39/0xb0
[   86.760858][ T5075]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   86.766795][ T5075] 
[   86.769132][ T5075] Memory state around the buggy address:
[   86.774773][ T5075]  ffffc900039af900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   86.782882][ T5075]  ffffc900039af980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1
[   86.790957][ T5075] >ffffc900039afa00: f1 f1 00 00 00 00 00 00 00 00 f3 f3 f3 f3 00 00
[   86.799111][ T5075]                                                        ^
[   86.806313][ T5075]  ffffc900039afa80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   86.814386][ T5075]  ffffc900039afb00: 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00
[   86.822458][ T5075] ==================================================================
[   86.832559][ T5075] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   86.839826][ T5075] CPU: 0 PID: 5075 Comm: syz-fuzzer Not tainted 6.3.0-rc3-next-20230323-syzkaller #0
[   86.849326][ T5075] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
[   86.859442][ T5075] Call Trace:
[   86.862745][ T5075]  <TASK>
[   86.865698][ T5075]  dump_stack_lvl+0xd9/0x150
[   86.870348][ T5075]  panic+0x688/0x730
[   86.874294][ T5075]  ? panic_smp_self_stop+0x90/0x90
[   86.879465][ T5075]  ? preempt_schedule_thunk+0x1a/0x20
[   86.884893][ T5075]  ? preempt_schedule_common+0x45/0xb0
[   86.890411][ T5075]  check_panic_on_warn+0xb1/0xc0
[   86.895405][ T5075]  end_report+0xe9/0x120
[   86.899688][ T5075]  ? vma_merge+0x1a90/0x1fd0
[   86.904340][ T5075]  kasan_report+0xf9/0x130
[   86.908804][ T5075]  ? vma_merge+0x1a90/0x1fd0
[   86.913440][ T5075]  vma_merge+0x1a90/0x1fd0
[   86.917893][ T5075]  ? vma_shrink+0x5c0/0x5c0
[   86.922432][ T5075]  ? print_usage_bug.part.0+0x660/0x660
[   86.928018][ T5075]  ? lock_sync+0x190/0x190
[   86.932473][ T5075]  ? rcu_is_watching+0x12/0xb0
[   86.937292][ T5075]  ? do_raw_spin_lock+0x124/0x2b0
[   86.942362][ T5075]  madvise_update_vma+0x23f/0xd40
[   86.947468][ T5075]  ? anon_vma_name_alloc+0xe0/0xe0
[   86.952645][ T5075]  madvise_vma_behavior+0x7f6/0x20e0
[   86.957981][ T5075]  ? madvise_vma_anon_name+0xf0/0xf0
[   86.963318][ T5075]  ? find_vma_prev+0xe4/0x160
[   86.968031][ T5075]  ? vm_unmapped_area+0x650/0x650
[   86.973097][ T5075]  ? trace_lock_acquire+0x12d/0x180
[   86.978390][ T5075]  madvise_walk_vmas+0x1c7/0x2b0
[   86.983385][ T5075]  ? madvise_vma_anon_name+0xf0/0xf0
[   86.988813][ T5075]  ? __remove_memory+0x40/0x40
[   86.993627][ T5075]  ? down_write_killable_nested+0x250/0x250
[   86.999576][ T5075]  ? __ia32_sys_get_robust_list+0x400/0x400
[   87.005545][ T5075]  do_madvise.part.0+0x193/0x470
[   87.010547][ T5075]  ? madvise_pageout+0x560/0x560
[   87.015534][ T5075]  ? restore_fpregs_from_fpstate+0xc1/0x1c0
[   87.021469][ T5075]  ? rcu_is_watching+0x12/0xb0
[   87.026290][ T5075]  __x64_sys_madvise+0x117/0x150
[   87.031282][ T5075]  do_syscall_64+0x39/0xb0
[   87.035741][ T5075]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   87.041687][ T5075] RIP: 0033:0x46b557
[   87.045606][ T5075] Code: 8b 24 24 48 8b 6c 24 10 48 83 c4 18 c3 cc cc cc cc cc cc 48 8b 7c 24 08 48 8b 74 24 10 8b 54 24 18 48 c7 c0 1c 00 00 00 0f 05 <89> 44 24 20 c3 cc cc cc cc 48 8b 7c 24 08 8b 74 24 10 8b 54 24 14
[   87.065245][ T5075] RSP: 002b:000000c000069ea0 EFLAGS: 00000206 ORIG_RAX: 000000000000001c
[   87.073716][ T5075] RAX: ffffffffffffffda RBX: 000000000000e000 RCX: 000000000046b557
[   87.081742][ T5075] RDX: 000000000000000f RSI: 0000000000200000 RDI: 000000c003800000
[   87.089752][ T5075] RBP: 000000c000069ee0 R08: 0000000000200000 R09: 000080c00380dfff
[   87.097754][ T5075] R10: 00000000010e0740 R11: 0000000000000206 R12: 00000000010e06c0
[   87.105759][ T5075] R13: 0000000000000003 R14: 000000c000006820 R15: 00000000010e0700
[   87.113769][ T5075]  </TASK>
[   87.117042][ T5075] Kernel Offset: disabled
[   87.121377][ T5075] Rebooting in 86400 seconds..