DUID 00:04:ac:03:58:10:d0:76:5c:28:30:a7:8a:8b:4a:a3:06:e2
forked to background, child pid 3187
[ 24.973315][ T3188] 8021q: adding VLAN 0 to HW filter on device bond0
[ 24.982764][ T3188] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.0.218' (ECDSA) to the list of known hosts.
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
syzkaller login: [ 76.660895][ T15] cfg80211: failed to load regulatory.db
executing program
executing program
executing program
executing program
[ 78.323300][ T3711] nfsd: failed to allocate reply cache
executing program
executing program
executing program
executing program
executing program
executing program
[ 80.857873][ T3703] ==================================================================
[ 80.865999][ T3703] BUG: KASAN: use-after-free in __list_del_entry_valid+0xe8/0x110
[ 80.873856][ T3703] Read of size 8 at addr ffff8880723f35d0 by task syz-executor430/3703
[ 80.882127][ T3703]
[ 80.884461][ T3703] CPU: 0 PID: 3703 Comm: syz-executor430 Not tainted 6.0.0-rc6-next-20220921-syzkaller #0
[ 80.894378][ T3703] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2022
[ 80.904637][ T3703] Call Trace:
[ 80.907929][ T3703]
[ 80.910876][ T3703] dump_stack_lvl+0xcd/0x134
[ 80.915509][ T3703] print_report+0x15e/0x45d
[ 80.920038][ T3703] ? __phys_addr+0xc4/0x140
[ 80.924567][ T3703] ? __list_del_entry_valid+0xe8/0x110
[ 80.930066][ T3703] kasan_report+0xbb/0x1f0
[ 80.934531][ T3703] ? __list_del_entry_valid+0xe8/0x110
[ 80.940034][ T3703] __list_del_entry_valid+0xe8/0x110
[ 80.945356][ T3703] unregister_shrinker+0x83/0x2f0
[ 80.950418][ T3703] nfsd_reply_cache_shutdown+0x22/0x280
[ 80.956008][ T3703] nfsd_exit_net+0x110/0x4c0
[ 80.960630][ T3703] ? write_maxblksize+0x560/0x560
[ 80.965680][ T3703] ops_exit_list+0xb0/0x170
[ 80.970228][ T3703] setup_net+0x7fb/0xc50
[ 80.974674][ T3703] ? ops_init+0x470/0x470
[ 80.979039][ T3703] copy_net_ns+0x318/0x760
[ 80.983614][ T3703] create_new_namespaces+0x3f6/0xb20
[ 80.989035][ T3703] copy_namespaces+0x391/0x450
[ 80.993838][ T3703] copy_process+0x306e/0x71b0
[ 80.998625][ T3703] ? io_schedule_timeout+0x140/0x140
[ 81.003940][ T3703] ? lock_acquire+0x4fc/0x630
[ 81.008656][ T3703] ? __cleanup_sighand+0xb0/0xb0
[ 81.013626][ T3703] ? copy_clone_args_from_user+0x392/0x780
[ 81.019463][ T3703] kernel_clone+0xe7/0x980
[ 81.023912][ T3703] ? create_io_thread+0xe0/0xe0
[ 81.028791][ T3703] ? rcu_read_lock_sched_held+0xd/0x70
[ 81.034291][ T3703] ? guarantee_online_cpus+0x1f7/0x540
[ 81.039786][ T3703] __do_sys_clone3+0x1cd/0x2e0
[ 81.044670][ T3703] ? __do_sys_clone+0x100/0x100
[ 81.049558][ T3703] ? lock_downgrade+0x6e0/0x6e0
[ 81.054457][ T3703] ? restore_fpregs_from_fpstate+0xbd/0x1c0
[ 81.060397][ T3703] ? vtime_user_exit+0x218/0x6c0
[ 81.065351][ T3703] ? syscall_enter_from_user_mode+0x22/0xb0
[ 81.071252][ T3703] ? trace_hardirqs_on+0x2d/0x160
[ 81.076282][ T3703] do_syscall_64+0x35/0xb0
[ 81.080727][ T3703] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 81.086637][ T3703] RIP: 0033:0x7f09cb5c6009
[ 81.091083][ T3703] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 31 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 81.110739][ T3703] RSP: 002b:00007f09cb54d108 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3
[ 81.119167][ T3703] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f09cb5c6009
[ 81.127152][ T3703] RDX: 00007f09cb5c6009 RSI: 0000000000000058 RDI: 00007f09cb54d110
[ 81.135146][ T3703] RBP: 00007f09cb6474b0 R08: 0000000000000000 R09: 0000000040b86000
[ 81.143134][ T3703] R10: 00007f09cb54d110 R11: 0000000000000246 R12: 00007f09cb6474bc
[ 81.151115][ T3703] R13: 00007ffd94a3a3ff R14: 00007f09cb54d300 R15: 0000000000022000
[ 81.159101][ T3703]
[ 81.162122][ T3703]
[ 81.164452][ T3703] Allocated by task 3711:
[ 81.168801][ T3703] kasan_save_stack+0x1e/0x40
[ 81.173510][ T3703] kasan_set_track+0x21/0x30
[ 81.178115][ T3703] __kasan_kmalloc+0xa1/0xb0
[ 81.182720][ T3703] __kmalloc+0x54/0xc0
[ 81.186795][ T3703] ops_init+0xfb/0x470
[ 81.190865][ T3703] setup_net+0x5d1/0xc50
[ 81.195109][ T3703] copy_net_ns+0x318/0x760
[ 81.199523][ T3703] create_new_namespaces+0x3f6/0xb20
[ 81.204821][ T3703] copy_namespaces+0x391/0x450
[ 81.209593][ T3703] copy_process+0x306e/0x71b0
[ 81.214278][ T3703] kernel_clone+0xe7/0x980
[ 81.218704][ T3703] __do_sys_clone3+0x1cd/0x2e0
[ 81.223484][ T3703] do_syscall_64+0x35/0xb0
[ 81.227917][ T3703] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 81.233828][ T3703]
[ 81.236146][ T3703] Freed by task 3711:
[ 81.240126][ T3703] kasan_save_stack+0x1e/0x40
[ 81.244821][ T3703] kasan_set_track+0x21/0x30
[ 81.249424][ T3703] kasan_save_free_info+0x2a/0x40
[ 81.254482][ T3703] ____kasan_slab_free+0x160/0x1c0
[ 81.259606][ T3703] slab_free_freelist_hook+0x8b/0x1c0
[ 81.264986][ T3703] __kmem_cache_free+0xab/0x3b0
[ 81.269848][ T3703] ops_init+0xcd/0x470
[ 81.273923][ T3703] setup_net+0x5d1/0xc50
[ 81.278166][ T3703] copy_net_ns+0x318/0x760
[ 81.282585][ T3703] create_new_namespaces+0x3f6/0xb20
[ 81.287881][ T3703] copy_namespaces+0x391/0x450
[ 81.292652][ T3703] copy_process+0x306e/0x71b0
[ 81.297346][ T3703] kernel_clone+0xe7/0x980
[ 81.301768][ T3703] __do_sys_clone3+0x1cd/0x2e0
[ 81.306542][ T3703] do_syscall_64+0x35/0xb0
[ 81.310972][ T3703] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 81.316881][ T3703]
[ 81.319202][ T3703] The buggy address belongs to the object at ffff8880723f3000
[ 81.319202][ T3703] which belongs to the cache kmalloc-2k of size 2048
[ 81.333264][ T3703] The buggy address is located 1488 bytes inside of
[ 81.333264][ T3703] 2048-byte region [ffff8880723f3000, ffff8880723f3800)
[ 81.346726][ T3703]
[ 81.349049][ T3703] The buggy address belongs to the physical page:
[ 81.355487][ T3703] page:ffffea0001c8fc00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x723f0
[ 81.365644][ T3703] head:ffffea0001c8fc00 order:3 compound_mapcount:0 compound_pincount:0
[ 81.373972][ T3703] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 81.381964][ T3703] raw: 00fff00000010200 ffff888011842000 dead000000080008 0000000000000000
[ 81.390553][ T3703] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[ 81.399136][ T3703] page dumped because: kasan: bad access detected
[ 81.405542][ T3703] page_owner tracks the page as allocated
[ 81.411247][ T3703] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 3703, tgid 3698 (syz-executor430), ts 78307521969, free_ts 76038545603
[ 81.430797][ T3703] get_page_from_freelist+0x1092/0x2d20
[ 81.436355][ T3703] __alloc_pages+0x1c7/0x5a0
[ 81.440952][ T3703] alloc_pages+0x1a6/0x270
[ 81.445382][ T3703] allocate_slab+0x213/0x300
[ 81.449986][ T3703] ___slab_alloc+0xac1/0x1430
[ 81.454669][ T3703] __slab_alloc.constprop.0+0x4d/0xa0
[ 81.460052][ T3703] __kmem_cache_alloc_node+0x18a/0x3d0
[ 81.465542][ T3703] kmalloc_trace+0x22/0x60
[ 81.469970][ T3703] cfctrl_create+0x86/0x320
[ 81.474488][ T3703] cfcnfg_create+0xb3/0x550
[ 81.479003][ T3703] caif_init_net+0x166/0x310
[ 81.483604][ T3703] ops_init+0xaf/0x470
[ 81.487674][ T3703] setup_net+0x5d1/0xc50
[ 81.491918][ T3703] copy_net_ns+0x318/0x760
[ 81.496341][ T3703] create_new_namespaces+0x3f6/0xb20
[ 81.501638][ T3703] copy_namespaces+0x391/0x450
[ 81.506419][ T3703] page last free stack trace:
[ 81.511083][ T3703] free_pcp_prepare+0x65c/0xd90
[ 81.515963][ T3703] free_unref_page+0x19/0x4d0
[ 81.520637][ T3703] pcpu_free_pages.constprop.0+0x172/0x290
[ 81.526459][ T3703] pcpu_balance_workfn+0x203/0xec0
[ 81.531585][ T3703] process_one_work+0x9bf/0x1710
[ 81.536528][ T3703] worker_thread+0x665/0x1080
[ 81.541224][ T3703] kthread+0x2e4/0x3a0
[ 81.545294][ T3703] ret_from_fork+0x1f/0x30
[ 81.549722][ T3703]
[ 81.552044][ T3703] Memory state around the buggy address:
[ 81.557674][ T3703] ffff8880723f3480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 81.565737][ T3703] ffff8880723f3500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 81.573801][ T3703] >ffff8880723f3580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 81.581855][ T3703] ^
[ 81.588533][ T3703] ffff8880723f3600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 81.596615][ T3703] ffff8880723f3680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
executing program
[ 81.604693][ T3703] ==================================================================
executing program
executing program
[ 82.619159][ T3703] Kernel panic - not syncing: panic_on_warn set ...
[ 82.625799][ T3703] CPU: 0 PID: 3703 Comm: syz-executor430 Not tainted 6.0.0-rc6-next-20220921-syzkaller #0
[ 82.635814][ T3703] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2022
[ 82.645895][ T3703] Call Trace:
[ 82.649183][ T3703]
[ 82.652127][ T3703] dump_stack_lvl+0xcd/0x134
[ 82.656760][ T3703] panic+0x2c8/0x622
[ 82.660690][ T3703] ? panic_print_sys_info.part.0+0x110/0x110
[ 82.666710][ T3703] ? preempt_schedule_common+0x59/0xc0
[ 82.672195][ T3703] ? preempt_schedule_thunk+0x16/0x18
[ 82.677599][ T3703] end_report.part.0+0x3f/0x7c
[ 82.682376][ T3703] ? __list_del_entry_valid+0xe8/0x110
[ 82.687925][ T3703] kasan_report.cold+0xa/0xf
[ 82.692516][ T3703] ? __list_del_entry_valid+0xe8/0x110
[ 82.697983][ T3703] __list_del_entry_valid+0xe8/0x110
[ 82.703360][ T3703] unregister_shrinker+0x83/0x2f0
[ 82.708385][ T3703] nfsd_reply_cache_shutdown+0x22/0x280
[ 82.713943][ T3703] nfsd_exit_net+0x110/0x4c0
[ 82.718532][ T3703] ? write_maxblksize+0x560/0x560
[ 82.723563][ T3703] ops_exit_list+0xb0/0x170
[ 82.728072][ T3703] setup_net+0x7fb/0xc50
[ 82.732327][ T3703] ? ops_init+0x470/0x470
[ 82.736686][ T3703] copy_net_ns+0x318/0x760
[ 82.741128][ T3703] create_new_namespaces+0x3f6/0xb20
[ 82.746444][ T3703] copy_namespaces+0x391/0x450
[ 82.751236][ T3703] copy_process+0x306e/0x71b0
[ 82.755935][ T3703] ? io_schedule_timeout+0x140/0x140
[ 82.761240][ T3703] ? lock_acquire+0x4fc/0x630
[ 82.765948][ T3703] ? __cleanup_sighand+0xb0/0xb0
[ 82.770916][ T3703] ? copy_clone_args_from_user+0x392/0x780
[ 82.776758][ T3703] kernel_clone+0xe7/0x980
[ 82.781215][ T3703] ? create_io_thread+0xe0/0xe0
[ 82.786096][ T3703] ? rcu_read_lock_sched_held+0xd/0x70
[ 82.791597][ T3703] ? guarantee_online_cpus+0x1f7/0x540
[ 82.797088][ T3703] __do_sys_clone3+0x1cd/0x2e0
[ 82.801890][ T3703] ? __do_sys_clone+0x100/0x100
[ 82.806774][ T3703] ? lock_downgrade+0x6e0/0x6e0
[ 82.811658][ T3703] ? restore_fpregs_from_fpstate+0xbd/0x1c0
[ 82.817586][ T3703] ? vtime_user_exit+0x218/0x6c0
[ 82.822557][ T3703] ? syscall_enter_from_user_mode+0x22/0xb0
[ 82.828475][ T3703] ? trace_hardirqs_on+0x2d/0x160
[ 82.833522][ T3703] do_syscall_64+0x35/0xb0
[ 82.838009][ T3703] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 82.844049][ T3703] RIP: 0033:0x7f09cb5c6009
[ 82.848482][ T3703] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 31 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 82.868117][ T3703] RSP: 002b:00007f09cb54d108 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3
[ 82.876549][ T3703] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f09cb5c6009
[ 82.884535][ T3703] RDX: 00007f09cb5c6009 RSI: 0000000000000058 RDI: 00007f09cb54d110
[ 82.892519][ T3703] RBP: 00007f09cb6474b0 R08: 0000000000000000 R09: 0000000040b86000
[ 82.900507][ T3703] R10: 00007f09cb54d110 R11: 0000000000000246 R12: 00007f09cb6474bc
[ 82.908492][ T3703] R13: 00007ffd94a3a3ff R14: 00007f09cb54d300 R15: 0000000000022000
[ 82.916494][ T3703]
[ 82.919584][ T3703] Kernel Offset: disabled
[ 82.923905][ T3703] Rebooting in 86400 seconds..