Warning: Permanently added '10.128.1.5' (ED25519) to the list of known hosts.
executing program
executing program
executing program
[ 58.185472][ T4164] IPv6: ADDRCONF(NETDEV_CHANGE): bpq0: link becomes ready
[ 58.216667][ T4166] ==================================================================
[ 58.224872][ T4166] BUG: KASAN: use-after-free in ax25_fillin_cb+0x460/0x660
[ 58.232094][ T4166] Read of size 4 at addr ffff88814c929638 by task syz-executor127/4166
[ 58.240335][ T4166]
[ 58.242673][ T4166] CPU: 1 PID: 4166 Comm: syz-executor127 Not tainted 5.15.178-syzkaller #0
[ 58.251257][ T4166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[ 58.261315][ T4166] Call Trace:
[ 58.264609][ T4166]
[ 58.267586][ T4166] dump_stack_lvl+0x1e3/0x2d0
[ 58.272306][ T4166] ? io_uring_drop_tctx_refs+0x1a0/0x1a0
[ 58.277950][ T4166] ? _printk+0xd1/0x120
[ 58.282115][ T4166] ? __wake_up_klogd+0xcc/0x100
[ 58.286964][ T4166] ? panic+0x860/0x860
[ 58.291027][ T4166] ? _raw_spin_lock_irqsave+0xdd/0x120
[ 58.296482][ T4166] ? __lock_acquire+0x1ff0/0x1ff0
[ 58.301503][ T4166] print_address_description+0x63/0x3b0
[ 58.307042][ T4166] ? ax25_fillin_cb+0x460/0x660
[ 58.311913][ T4166] kasan_report+0x16b/0x1c0
[ 58.316410][ T4166] ? ax25_fillin_cb+0x460/0x660
[ 58.321257][ T4166] ax25_fillin_cb+0x460/0x660
[ 58.325931][ T4166] ax25_setsockopt+0xab7/0xe70
[ 58.330694][ T4166] ? ax25_shutdown+0x10/0x10
[ 58.335279][ T4166] ? aa_sock_opt_perm+0x79/0x110
[ 58.340237][ T4166] ? bpf_lsm_socket_setsockopt+0x5/0x10
[ 58.345774][ T4166] ? security_socket_setsockopt+0x7d/0xa0
[ 58.351497][ T4166] ? ax25_shutdown+0x10/0x10
[ 58.356095][ T4166] __sys_setsockopt+0x57e/0x990
[ 58.360949][ T4166] ? __ia32_sys_recv+0xb0/0xb0
[ 58.365717][ T4166] ? syscall_enter_from_user_mode+0x2e/0x240
[ 58.371694][ T4166] __x64_sys_setsockopt+0xb1/0xc0
[ 58.376715][ T4166] do_syscall_64+0x3b/0xb0
[ 58.381126][ T4166] ? clear_bhb_loop+0x15/0x70
[ 58.385795][ T4166] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 58.391687][ T4166] RIP: 0033:0x7f8d65222bb9
[ 58.396110][ T4166] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 58.415709][ T4166] RSP: 002b:00007ffd70d8a438 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[ 58.424142][ T4166] RAX: ffffffffffffffda RBX: 0000400000000000 RCX: 00007f8d65222bb9
[ 58.432170][ T4166] RDX: 0000000000000019 RSI: 0000000000000101 RDI: 0000000000000004
[ 58.440148][ T4166] RBP: 0000000000000000 R08: 0000000000000010 R09: 0000000000000006
[ 58.448116][ T4166] R10: 00004000000000c0 R11: 0000000000000246 R12: 0000000000000000
[ 58.456106][ T4166] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001
[ 58.464096][ T4166]
[ 58.467109][ T4166]
[ 58.469423][ T4166] Allocated by task 4164:
[ 58.473735][ T4166] ____kasan_kmalloc+0xba/0xf0
[ 58.478495][ T4166] kmem_cache_alloc_trace+0x143/0x290
[ 58.483859][ T4166] ax25_dev_device_up+0x51/0x5a0
[ 58.489090][ T4166] ax25_device_event+0x49b/0x500
[ 58.494026][ T4166] raw_notifier_call_chain+0xd0/0x170
[ 58.499426][ T4166] __dev_notify_flags+0x304/0x610
[ 58.504453][ T4166] dev_change_flags+0xe7/0x190
[ 58.509225][ T4166] dev_ifsioc+0x147/0x10c0
[ 58.513647][ T4166] dev_ioctl+0x504/0xf60
[ 58.517880][ T4166] sock_do_ioctl+0x34f/0x5a0
[ 58.522468][ T4166] sock_ioctl+0x47f/0x770
[ 58.526791][ T4166] __se_sys_ioctl+0xf1/0x160
[ 58.531370][ T4166] do_syscall_64+0x3b/0xb0
[ 58.535777][ T4166] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 58.542187][ T4166]
[ 58.544525][ T4166] Freed by task 4165:
[ 58.548513][ T4166] kasan_set_track+0x4b/0x80
[ 58.553094][ T4166] kasan_set_free_info+0x1f/0x40
[ 58.558024][ T4166] ____kasan_slab_free+0xd8/0x120
[ 58.563039][ T4166] slab_free_freelist_hook+0xdd/0x160
[ 58.568400][ T4166] kfree+0xf1/0x270
[ 58.572197][ T4166] ax25_release+0x3b3/0x840
[ 58.576691][ T4166] sock_close+0xcd/0x230
[ 58.580926][ T4166] __fput+0x3fe/0x8e0
[ 58.584900][ T4166] task_work_run+0x129/0x1a0
[ 58.589485][ T4166] do_exit+0x6a3/0x2480
[ 58.593630][ T4166] do_group_exit+0x144/0x310
[ 58.598210][ T4166] __x64_sys_exit_group+0x3b/0x40
[ 58.603222][ T4166] do_syscall_64+0x3b/0xb0
[ 58.607625][ T4166] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 58.613511][ T4166]
[ 58.615819][ T4166] Last potentially related work creation:
[ 58.621517][ T4166] kasan_save_stack+0x36/0x60
[ 58.626185][ T4166] kasan_record_aux_stack+0xba/0x100
[ 58.631481][ T4166] insert_work+0x54/0x3e0
[ 58.635808][ T4166] __queue_work+0x963/0xd00
[ 58.640297][ T4166] queue_work_on+0x14b/0x250
[ 58.644876][ T4166] call_usermodehelper_exec+0x269/0x450
[ 58.650411][ T4166] kobject_uevent_env+0x69e/0x8d0
[ 58.655425][ T4166] device_add+0xa4f/0xfd0
[ 58.659742][ T4166] netdev_register_kobject+0x176/0x310
[ 58.665191][ T4166] register_netdevice+0x108c/0x1720
[ 58.670381][ T4166] register_netdev+0x37/0x50
[ 58.674956][ T4166] rose_proto_init+0x19c/0x7c0
[ 58.679707][ T4166] do_one_initcall+0x22b/0x7a0
[ 58.684463][ T4166] do_initcall_level+0x157/0x210
[ 58.689394][ T4166] do_initcalls+0x49/0x90
[ 58.693711][ T4166] kernel_init_freeable+0x425/0x5c0
[ 58.698897][ T4166] kernel_init+0x19/0x290
[ 58.703214][ T4166] ret_from_fork+0x1f/0x30
[ 58.707619][ T4166]
[ 58.709925][ T4166] The buggy address belongs to the object at ffff88814c929600
[ 58.709925][ T4166] which belongs to the cache kmalloc-192 of size 192
[ 58.723963][ T4166] The buggy address is located 56 bytes inside of
[ 58.723963][ T4166] 192-byte region [ffff88814c929600, ffff88814c9296c0)
[ 58.737143][ T4166] The buggy address belongs to the page:
[ 58.742769][ T4166] page:ffffea0005324a40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14c929
[ 58.753047][ T4166] flags: 0x57ff00000000200(slab|node=1|zone=2|lastcpupid=0x7ff)
[ 58.760699][ T4166] raw: 057ff00000000200 ffffea0005324600 0000000400000004 ffff888017441a00
[ 58.769276][ T4166] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[ 58.777839][ T4166] page dumped because: kasan: bad access detected
[ 58.784247][ T4166] page_owner tracks the page as allocated
[ 58.789965][ T4166] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 15427476024, free_ts 0
[ 58.804898][ T4166] get_page_from_freelist+0x3b78/0x3d40
[ 58.810438][ T4166] __alloc_pages+0x272/0x700
[ 58.815018][ T4166] alloc_page_interleave+0x22/0x1c0
[ 58.820217][ T4166] new_slab+0xbb/0x4b0
[ 58.824275][ T4166] ___slab_alloc+0x6f6/0xe10
[ 58.828855][ T4166] __kmalloc_track_caller+0x1c7/0x300
[ 58.834222][ T4166] kmemdup+0x21/0x50
[ 58.838105][ T4166] neigh_parms_alloc+0x82/0x4c0
[ 58.842940][ T4166] inetdev_init+0x129/0x4a0
[ 58.847429][ T4166] inetdev_event+0x29b/0x1490
[ 58.852091][ T4166] raw_notifier_call_chain+0xd0/0x170
[ 58.857454][ T4166] call_netdevice_notifiers+0x145/0x1b0
[ 58.862997][ T4166] register_netdevice+0x12e8/0x1720
[ 58.868184][ T4166] register_netdev+0x37/0x50
[ 58.872764][ T4166] rose_proto_init+0x19c/0x7c0
[ 58.877515][ T4166] do_one_initcall+0x22b/0x7a0
[ 58.882279][ T4166] page_owner free stack trace missing
[ 58.887641][ T4166]
[ 58.889958][ T4166] Memory state around the buggy address:
[ 58.895576][ T4166] ffff88814c929500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 58.903631][ T4166] ffff88814c929580: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 58.911697][ T4166] >ffff88814c929600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 58.919884][ T4166] ^
[ 58.925773][ T4166] ffff88814c929680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 58.933842][ T4166] ffff88814c929700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 58.941889][ T4166] ==================================================================
[ 58.949934][ T4166] Disabling lock debugging due to kernel taint
[ 58.956688][ T4166] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 58.963899][ T4166] CPU: 0 PID: 4166 Comm: syz-executor127 Tainted: G B 5.15.178-syzkaller #0
[ 58.973883][ T4166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[ 58.983940][ T4166] Call Trace:
[ 58.987208][ T4166]
[ 58.990127][ T4166] dump_stack_lvl+0x1e3/0x2d0
[ 58.994796][ T4166] ? io_uring_drop_tctx_refs+0x1a0/0x1a0
[ 59.000435][ T4166] ? panic+0x860/0x860
[ 59.004491][ T4166] ? preempt_schedule_common+0xa6/0xd0
[ 59.009937][ T4166] ? preempt_schedule+0xd9/0xe0
[ 59.014774][ T4166] panic+0x318/0x860
[ 59.018657][ T4166] ? check_panic_on_warn+0x1d/0xa0
[ 59.023758][ T4166] ? fb_is_primary_device+0xd0/0xd0
[ 59.028943][ T4166] ? _raw_spin_unlock_irqrestore+0x128/0x130
[ 59.034936][ T4166] ? _raw_spin_unlock+0x40/0x40
[ 59.039790][ T4166] check_panic_on_warn+0x7e/0xa0
[ 59.044725][ T4166] ? ax25_fillin_cb+0x460/0x660
[ 59.049570][ T4166] end_report+0x6d/0xf0
[ 59.053715][ T4166] kasan_report+0x18e/0x1c0
[ 59.058220][ T4166] ? ax25_fillin_cb+0x460/0x660
[ 59.063070][ T4166] ax25_fillin_cb+0x460/0x660
[ 59.067746][ T4166] ax25_setsockopt+0xab7/0xe70
[ 59.072529][ T4166] ? ax25_shutdown+0x10/0x10
[ 59.077122][ T4166] ? aa_sock_opt_perm+0x79/0x110
[ 59.082047][ T4166] ? bpf_lsm_socket_setsockopt+0x5/0x10
[ 59.087579][ T4166] ? security_socket_setsockopt+0x7d/0xa0
[ 59.093287][ T4166] ? ax25_shutdown+0x10/0x10
[ 59.097868][ T4166] __sys_setsockopt+0x57e/0x990
[ 59.102708][ T4166] ? __ia32_sys_recv+0xb0/0xb0
[ 59.107462][ T4166] ? syscall_enter_from_user_mode+0x2e/0x240
[ 59.113436][ T4166] __x64_sys_setsockopt+0xb1/0xc0
[ 59.118449][ T4166] do_syscall_64+0x3b/0xb0
[ 59.122850][ T4166] ? clear_bhb_loop+0x15/0x70
[ 59.127528][ T4166] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 59.133414][ T4166] RIP: 0033:0x7f8d65222bb9
[ 59.137832][ T4166] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 59.157421][ T4166] RSP: 002b:00007ffd70d8a438 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[ 59.165827][ T4166] RAX: ffffffffffffffda RBX: 0000400000000000 RCX: 00007f8d65222bb9
[ 59.173791][ T4166] RDX: 0000000000000019 RSI: 0000000000000101 RDI: 0000000000000004
[ 59.181753][ T4166] RBP: 0000000000000000 R08: 0000000000000010 R09: 0000000000000006
[ 59.189708][ T4166] R10: 00004000000000c0 R11: 0000000000000246 R12: 0000000000000000
[ 59.197665][ T4166] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001
[ 59.205631][ T4166]
[ 59.208870][ T4166] Kernel Offset: disabled
[ 59.213193][ T4166] Rebooting in 86400 seconds..