Warning: Permanently added '10.128.1.132' (ED25519) to the list of known hosts. 2025/01/02 09:04:10 ignoring optional flag "sandboxArg"="0" 2025/01/02 09:04:10 parsed 1 programs [ 149.445299][ T5853] cgroup: Unknown subsys name 'net' [ 149.581366][ T5853] cgroup: Unknown subsys name 'cpuset' [ 149.590182][ T5853] cgroup: Unknown subsys name 'rlimit' [ 151.407858][ T5853] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 154.169660][ T1134] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 154.191651][ T1134] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 154.226586][ T1167] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 154.235783][ T1167] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 154.341998][ T5861] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 156.547983][ T5910] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 156.556370][ T5910] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 156.565486][ T5910] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 156.573693][ T5910] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 156.581980][ T5910] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 156.590719][ T5910] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 157.941271][ T5928] chnl_net:caif_netlink_parms(): no params data found [ 158.026988][ T5928] bridge0: port 1(bridge_slave_0) entered blocking state [ 158.037460][ T5928] bridge0: port 1(bridge_slave_0) entered disabled state [ 158.044637][ T5928] bridge_slave_0: entered allmulticast mode [ 158.051855][ T5928] bridge_slave_0: entered promiscuous mode [ 158.062736][ T5928] bridge0: port 2(bridge_slave_1) entered blocking state [ 158.071883][ T5928] bridge0: port 2(bridge_slave_1) entered disabled state [ 158.083529][ T5928] bridge_slave_1: entered allmulticast mode [ 158.091118][ T5928] bridge_slave_1: entered promiscuous mode [ 158.120234][ T5928] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 158.131336][ T5928] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 158.159728][ T5928] team0: Port device team_slave_0 added [ 158.168800][ T5928] team0: Port device team_slave_1 added [ 158.195537][ T5928] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 158.202643][ T5928] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 158.228964][ T5928] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 158.242135][ T5928] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 158.249274][ T5928] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 158.275649][ T5928] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 158.318726][ T5928] hsr_slave_0: entered promiscuous mode [ 158.325092][ T5928] hsr_slave_1: entered promiscuous mode [ 158.434194][ T5928] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 158.444822][ T5928] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 158.454458][ T5928] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 158.463485][ T5928] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 158.489792][ T5928] bridge0: port 2(bridge_slave_1) entered blocking state [ 158.497001][ T5928] bridge0: port 2(bridge_slave_1) entered forwarding state [ 158.505154][ T5928] bridge0: port 1(bridge_slave_0) entered blocking state [ 158.512442][ T5928] bridge0: port 1(bridge_slave_0) entered forwarding state [ 158.564875][ T5928] 8021q: adding VLAN 0 to HW filter on device bond0 [ 158.584955][ T1134] bridge0: port 1(bridge_slave_0) entered disabled state [ 158.594062][ T1134] bridge0: port 2(bridge_slave_1) entered disabled state [ 158.613129][ T5928] 8021q: adding VLAN 0 to HW filter on device team0 [ 158.626756][ T52] bridge0: port 1(bridge_slave_0) entered blocking state [ 158.634008][ T52] bridge0: port 1(bridge_slave_0) entered forwarding state [ 158.649584][ T1134] bridge0: port 2(bridge_slave_1) entered blocking state [ 158.656723][ T1134] bridge0: port 2(bridge_slave_1) entered forwarding state [ 158.812489][ T5928] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 158.850823][ T5928] veth0_vlan: entered promiscuous mode [ 158.862411][ T5928] veth1_vlan: entered promiscuous mode [ 158.889725][ T5928] veth0_macvtap: entered promiscuous mode [ 158.900169][ T5928] veth1_macvtap: entered promiscuous mode [ 158.918438][ T5928] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 158.931045][ T5928] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 158.942624][ T5928] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 158.952397][ T5928] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 158.962596][ T5928] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 158.971592][ T5928] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 159.104769][ T1167] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 159.163894][ T1167] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 159.229194][ T1167] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 159.355224][ T1167] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2025/01/02 09:04:25 executed programs: 0 [ 159.705594][ T5910] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 159.714580][ T5910] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 159.723094][ T5910] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 159.731908][ T5910] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 159.741024][ T5910] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 159.748694][ T5910] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 159.877346][ T5947] chnl_net:caif_netlink_parms(): no params data found [ 159.932785][ T5947] bridge0: port 1(bridge_slave_0) entered blocking state [ 159.940432][ T5947] bridge0: port 1(bridge_slave_0) entered disabled state [ 159.947950][ T5947] bridge_slave_0: entered allmulticast mode [ 159.954753][ T5947] bridge_slave_0: entered promiscuous mode [ 159.966768][ T5947] bridge0: port 2(bridge_slave_1) entered blocking state [ 159.974678][ T5947] bridge0: port 2(bridge_slave_1) entered disabled state [ 159.982322][ T5947] bridge_slave_1: entered allmulticast mode [ 159.989659][ T5947] bridge_slave_1: entered promiscuous mode [ 160.018073][ T5947] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 160.030287][ T5947] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 160.062858][ T5947] team0: Port device team_slave_0 added [ 160.070764][ T5947] team0: Port device team_slave_1 added [ 160.092933][ T5947] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 160.101274][ T5947] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 160.128871][ T5947] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 160.142793][ T5947] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 160.150433][ T5947] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 160.176647][ T5947] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 160.214032][ T5947] hsr_slave_0: entered promiscuous mode [ 160.220429][ T5947] hsr_slave_1: entered promiscuous mode [ 160.226604][ T5947] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 160.235178][ T5947] Cannot create hsr debugfs directory [ 161.778724][ T5910] Bluetooth: hci0: command tx timeout [ 162.329245][ T1167] bridge_slave_1: left allmulticast mode [ 162.335126][ T1167] bridge_slave_1: left promiscuous mode [ 162.342907][ T1167] bridge0: port 2(bridge_slave_1) entered disabled state [ 162.354350][ T1167] bridge_slave_0: left allmulticast mode [ 162.360790][ T1167] bridge_slave_0: left promiscuous mode [ 162.366467][ T1167] bridge0: port 1(bridge_slave_0) entered disabled state [ 162.620434][ T1167] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 162.631616][ T1167] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 162.643122][ T1167] bond0 (unregistering): Released all slaves [ 162.733805][ T1167] hsr_slave_0: left promiscuous mode [ 162.740057][ T1167] hsr_slave_1: left promiscuous mode [ 162.746165][ T1167] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 162.757292][ T1167] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 162.769523][ T1167] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 162.776971][ T1167] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 162.800200][ T1167] veth1_macvtap: left promiscuous mode [ 162.806177][ T1167] veth0_macvtap: left promiscuous mode [ 162.815360][ T1167] veth1_vlan: left promiscuous mode [ 162.820978][ T1167] veth0_vlan: left promiscuous mode [ 163.250126][ T1167] team0 (unregistering): Port device team_slave_1 removed [ 163.281886][ T1167] team0 (unregistering): Port device team_slave_0 removed [ 163.744487][ T5947] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 163.759650][ T5947] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 163.771602][ T5947] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 163.785402][ T5947] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 163.867930][ T5910] Bluetooth: hci0: command tx timeout [ 163.920164][ T5947] 8021q: adding VLAN 0 to HW filter on device bond0 [ 163.989287][ T5947] 8021q: adding VLAN 0 to HW filter on device team0 [ 164.003250][ T1134] bridge0: port 1(bridge_slave_0) entered blocking state [ 164.010398][ T1134] bridge0: port 1(bridge_slave_0) entered forwarding state [ 164.031470][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 164.038739][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 164.224860][ T5947] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 164.261861][ T5947] veth0_vlan: entered promiscuous mode [ 164.276382][ T5947] veth1_vlan: entered promiscuous mode [ 164.311106][ T5947] veth0_macvtap: entered promiscuous mode [ 164.320756][ T5947] veth1_macvtap: entered promiscuous mode [ 164.343234][ T5947] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 164.357917][ T5947] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 164.371436][ T5947] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 164.380446][ T5947] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 164.389731][ T5947] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 164.399810][ T5947] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 164.471401][ T52] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 164.497657][ T52] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 164.529893][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 164.541039][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2025/01/02 09:04:30 executed programs: 5 [ 165.937378][ T5910] Bluetooth: hci0: command tx timeout [ 168.027491][ T5910] Bluetooth: hci0: command tx timeout 2025/01/02 09:04:35 executed programs: 229 2025/01/02 09:04:40 executed programs: 469 [ 177.445293][ T5146] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 177.454561][ T5146] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 177.463495][ T5146] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 177.472639][ T5146] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 177.481175][ T5146] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 177.489053][ T5146] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 177.613403][ T52] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.658327][ T6592] chnl_net:caif_netlink_parms(): no params data found [ 177.684563][ T52] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.764656][ T52] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.781318][ T6592] bridge0: port 1(bridge_slave_0) entered blocking state [ 177.789502][ T6592] bridge0: port 1(bridge_slave_0) entered disabled state [ 177.796698][ T6592] bridge_slave_0: entered allmulticast mode [ 177.804257][ T6592] bridge_slave_0: entered promiscuous mode [ 177.824058][ T52] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.839100][ T6592] bridge0: port 2(bridge_slave_1) entered blocking state [ 177.846246][ T6592] bridge0: port 2(bridge_slave_1) entered disabled state [ 177.853561][ T6592] bridge_slave_1: entered allmulticast mode [ 177.860992][ T6592] bridge_slave_1: entered promiscuous mode [ 177.890007][ T6592] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 177.904830][ T6592] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 177.935177][ T6592] team0: Port device team_slave_0 added [ 177.951316][ T6592] team0: Port device team_slave_1 added [ 177.987070][ T6592] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 177.996298][ T6592] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 178.022890][ T6592] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 178.036896][ T6592] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 178.044621][ T6592] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 178.070861][ T6592] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 178.118166][ T52] bridge_slave_1: left allmulticast mode [ 178.124119][ T52] bridge_slave_1: left promiscuous mode [ 178.132908][ T52] bridge0: port 2(bridge_slave_1) entered disabled state [ 178.142506][ T52] bridge_slave_0: left allmulticast mode [ 178.148560][ T52] bridge_slave_0: left promiscuous mode [ 178.154289][ T52] bridge0: port 1(bridge_slave_0) entered disabled state [ 178.400811][ T52] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 178.412335][ T52] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 178.422892][ T52] bond0 (unregistering): Released all slaves [ 178.466278][ T6592] hsr_slave_0: entered promiscuous mode [ 178.473873][ T6592] hsr_slave_1: entered promiscuous mode [ 178.783235][ T52] hsr_slave_0: left promiscuous mode [ 178.794297][ T52] hsr_slave_1: left promiscuous mode [ 178.800392][ T52] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 178.807901][ T52] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 178.815914][ T52] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 178.824753][ T52] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 178.845881][ T52] veth1_macvtap: left promiscuous mode [ 178.851943][ T52] veth0_macvtap: left promiscuous mode [ 178.858223][ T52] veth1_vlan: left promiscuous mode [ 178.863607][ T52] veth0_vlan: left promiscuous mode [ 179.194032][ T52] team0 (unregistering): Port device team_slave_1 removed [ 179.233146][ T52] team0 (unregistering): Port device team_slave_0 removed [ 179.547482][ T5910] Bluetooth: hci1: command tx timeout [ 179.837111][ T6592] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 179.855326][ T6592] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 179.867506][ T6592] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 179.882086][ T6592] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 179.972901][ T6592] 8021q: adding VLAN 0 to HW filter on device bond0 [ 180.001549][ T6592] 8021q: adding VLAN 0 to HW filter on device team0 [ 180.016933][ T1134] bridge0: port 1(bridge_slave_0) entered blocking state [ 180.024456][ T1134] bridge0: port 1(bridge_slave_0) entered forwarding state [ 180.041067][ T1134] bridge0: port 2(bridge_slave_1) entered blocking state [ 180.048234][ T1134] bridge0: port 2(bridge_slave_1) entered forwarding state [ 180.272733][ T6592] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 180.329372][ T6592] veth0_vlan: entered promiscuous mode [ 180.345521][ T6592] veth1_vlan: entered promiscuous mode [ 180.382599][ T6592] veth0_macvtap: entered promiscuous mode [ 180.392544][ T6592] veth1_macvtap: entered promiscuous mode [ 180.412785][ T6592] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 180.430799][ T6592] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 180.444075][ T6592] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 180.453177][ T6592] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 180.462959][ T6592] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 180.472923][ T6592] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 180.545740][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 180.556841][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 180.592892][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 180.603467][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2025/01/02 09:04:46 executed programs: 602 [ 180.672066][ T6652] ================================================================== [ 180.680193][ T6652] BUG: KASAN: slab-use-after-free in force_devcd_write+0x31f/0x350 [ 180.688157][ T6652] Read of size 8 at addr ffff88807f243800 by task syz.0.616/6652 [ 180.695919][ T6652] [ 180.698311][ T6652] CPU: 1 UID: 0 PID: 6652 Comm: syz.0.616 Not tainted 6.13.0-rc5-syzkaller-00006-g56e6a3499e14 #0 [ 180.709034][ T6652] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 180.719154][ T6652] Call Trace: [ 180.722462][ T6652] <TASK> [ 180.725426][ T6652] dump_stack_lvl+0x116/0x1f0 [ 180.730180][ T6652] print_report+0xc3/0x620 [ 180.734661][ T6652] ? __virt_addr_valid+0x5e/0x590 [ 180.739756][ T6652] ? __phys_addr+0xc6/0x150 [ 180.744332][ T6652] kasan_report+0xd9/0x110 [ 180.748831][ T6652] ? force_devcd_write+0x31f/0x350 [ 180.754013][ T6652] ? force_devcd_write+0x31f/0x350 [ 180.759187][ T6652] force_devcd_write+0x31f/0x350 [ 180.764190][ T6652] ? __pfx_force_devcd_write+0x10/0x10 [ 180.769721][ T6652] ? debugfs_file_get+0x21c/0x5c0 [ 180.774821][ T6652] ? __pfx_debugfs_file_get+0x10/0x10 [ 180.780250][ T6652] ? rcu_is_watching+0x12/0xc0 [ 180.785085][ T6652] ? trace_lock_acquire+0x14e/0x1f0 [ 180.790355][ T6652] full_proxy_write+0xfb/0x1b0 [ 180.795184][ T6652] ? __pfx_full_proxy_write+0x10/0x10 [ 180.800617][ T6652] vfs_write+0x24c/0x1150 [ 180.805020][ T6652] ? __pfx_vfs_write+0x10/0x10 [ 180.809863][ T6652] ? do_futex+0x123/0x350 [ 180.814253][ T6652] ? __pfx_do_futex+0x10/0x10 [ 180.818993][ T6652] ? __x64_sys_futex+0x1e1/0x4c0 [ 180.823986][ T6652] ? __x64_sys_futex+0x1ea/0x4c0 [ 180.828986][ T6652] ksys_write+0x12b/0x250 [ 180.833363][ T6652] ? __pfx_ksys_write+0x10/0x10 [ 180.838267][ T6652] do_syscall_64+0xcd/0x250 [ 180.842833][ T6652] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 180.848781][ T6652] RIP: 0033:0x7fd577b85d29 [ 180.853246][ T6652] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 180.872915][ T6652] RSP: 002b:00007ffe42738418 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 180.881393][ T6652] RAX: ffffffffffffffda RBX: 00007fd577d75fa0 RCX: 00007fd577b85d29 [ 180.889411][ T6652] RDX: 000000000000000e RSI: 0000000000000000 RDI: 0000000000000003 [ 180.897455][ T6652] RBP: 00007fd577c01b08 R08: 0000000000000000 R09: 0000000000000000 [ 180.905470][ T6652] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 180.913497][ T6652] R13: 00007fd577d75fa0 R14: 00007fd577d75fa0 R15: 00000000000018c7 [ 180.921518][ T6652] </TASK> [ 180.924572][ T6652] [ 180.926926][ T6652] Allocated by task 5947: [ 180.931284][ T6652] kasan_save_stack+0x33/0x60 [ 180.936012][ T6652] kasan_save_track+0x14/0x30 [ 180.940742][ T6652] __kasan_kmalloc+0xaa/0xb0 [ 180.945387][ T6652] vhci_open+0x4c/0x430 [ 180.949588][ T6652] misc_open+0x35a/0x420 [ 180.953883][ T6652] chrdev_open+0x237/0x6a0 [ 180.958348][ T6652] do_dentry_open+0xf59/0x1ea0 [ 180.963156][ T6652] vfs_open+0x82/0x3f0 [ 180.967280][ T6652] path_openat+0x1e6a/0x2d60 [ 180.971922][ T6652] do_filp_open+0x20c/0x470 [ 180.976485][ T6652] do_sys_openat2+0x17a/0x1e0 [ 180.981219][ T6652] __x64_sys_openat+0x175/0x210 [ 180.986104][ T6652] do_syscall_64+0xcd/0x250 [ 180.990633][ T6652] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 180.996554][ T6652] [ 180.998885][ T6652] Freed by task 5947: [ 181.002872][ T6652] kasan_save_stack+0x33/0x60 [ 181.007580][ T6652] kasan_save_track+0x14/0x30 [ 181.012288][ T6652] kasan_save_free_info+0x3b/0x60 [ 181.017332][ T6652] __kasan_slab_free+0x51/0x70 [ 181.022123][ T6652] kfree+0x14f/0x4b0 [ 181.026038][ T6652] vhci_release+0xbb/0xf0 [ 181.030382][ T6652] __fput+0x3f8/0xb60 [ 181.034388][ T6652] task_work_run+0x14e/0x250 [ 181.039005][ T6652] do_exit+0xad8/0x2d70 [ 181.043226][ T6652] do_group_exit+0xd3/0x2a0 [ 181.047763][ T6652] get_signal+0x2576/0x2610 [ 181.052292][ T6652] arch_do_signal_or_restart+0x90/0x7e0 [ 181.057865][ T6652] syscall_exit_to_user_mode+0x150/0x2a0 [ 181.063609][ T6652] do_syscall_64+0xda/0x250 [ 181.068136][ T6652] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 181.074055][ T6652] [ 181.076383][ T6652] The buggy address belongs to the object at ffff88807f243800 [ 181.076383][ T6652] which belongs to the cache kmalloc-1k of size 1024 [ 181.090482][ T6652] The buggy address is located 0 bytes inside of [ 181.090482][ T6652] freed 1024-byte region [ffff88807f243800, ffff88807f243c00) [ 181.104227][ T6652] [ 181.106561][ T6652] The buggy address belongs to the physical page: [ 181.112989][ T6652] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7f240 [ 181.121775][ T6652] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 181.130289][ T6652] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 181.137976][ T6652] page_type: f5(slab) [ 181.141999][ T6652] raw: 00fff00000000040 ffff88801ac41dc0 dead000000000100 dead000000000122 [ 181.150612][ T6652] raw: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000 [ 181.159219][ T6652] head: 00fff00000000040 ffff88801ac41dc0 dead000000000100 dead000000000122 [ 181.167913][ T6652] head: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000 [ 181.176644][ T6652] head: 00fff00000000003 ffffea0001fc9001 ffffffffffffffff 0000000000000000 [ 181.185334][ T6652] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 181.194016][ T6652] page dumped because: kasan: bad access detected [ 181.200445][ T6652] page_owner tracks the page as allocated [ 181.206171][ T6652] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5644, tgid 5644 (dhcpcd-run-hook), ts 59346578182, free_ts 59183308615 [ 181.227821][ T6652] post_alloc_hook+0x2d1/0x350 [ 181.232620][ T6652] get_page_from_freelist+0xfce/0x2f80 [ 181.238110][ T6652] __alloc_pages_noprof+0x223/0x25b0 [ 181.243427][ T6652] alloc_pages_mpol_noprof+0x2c9/0x610 [ 181.248928][ T6652] new_slab+0x2c9/0x410 [ 181.253109][ T6652] ___slab_alloc+0xce2/0x1650 [ 181.257809][ T6652] __slab_alloc.constprop.0+0x56/0xb0 [ 181.263207][ T6652] __kmalloc_noprof+0x2de/0x4f0 [ 181.268084][ T6652] load_elf_phdrs+0x103/0x210 [ 181.272782][ T6652] load_elf_binary+0x1f8/0x4ed0 [ 181.277669][ T6652] bprm_execve+0x703/0x19b0 [ 181.282238][ T6652] do_execveat_common.isra.0+0x4f1/0x630 [ 181.287904][ T6652] __x64_sys_execve+0x8c/0xb0 [ 181.292610][ T6652] do_syscall_64+0xcd/0x250 [ 181.297167][ T6652] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 181.303108][ T6652] page last free pid 5638 tgid 5638 stack trace: [ 181.309446][ T6652] free_unref_page+0x661/0x1080 [ 181.314332][ T6652] __put_partials+0x14c/0x170 [ 181.319044][ T6652] qlist_free_all+0x4e/0x120 [ 181.323703][ T6652] kasan_quarantine_reduce+0x195/0x1e0 [ 181.329204][ T6652] __kasan_slab_alloc+0x69/0x90 [ 181.334089][ T6652] kmem_cache_alloc_noprof+0x1c8/0x3b0 [ 181.339591][ T6652] vm_area_alloc+0x1f/0x1c0 [ 181.344125][ T6652] __mmap_region+0x1091/0x2760 [ 181.348934][ T6652] mmap_region+0x127/0x320 [ 181.353381][ T6652] do_mmap+0xc00/0xfc0 [ 181.357482][ T6652] vm_mmap_pgoff+0x1ba/0x360 [ 181.362114][ T6652] ksys_mmap_pgoff+0x32c/0x5c0 [ 181.366923][ T6652] __x64_sys_mmap+0x125/0x190 [ 181.371627][ T6652] do_syscall_64+0xcd/0x250 [ 181.376156][ T6652] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 181.382077][ T6652] [ 181.384408][ T6652] Memory state around the buggy address: [ 181.390048][ T6652] ffff88807f243700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 181.398123][ T6652] ffff88807f243780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 181.406231][ T6652] >ffff88807f243800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 181.414314][ T6652] ^ [ 181.418389][ T6652] ffff88807f243880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 181.426459][ T6652] ffff88807f243900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 181.434537][ T6652] ================================================================== [ 181.466107][ T6652] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 181.473361][ T6652] CPU: 0 UID: 0 PID: 6652 Comm: syz.0.616 Not tainted 6.13.0-rc5-syzkaller-00006-g56e6a3499e14 #0 [ 181.483996][ T6652] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 181.494081][ T6652] Call Trace: [ 181.497373][ T6652] <TASK> [ 181.500316][ T6652] dump_stack_lvl+0x3d/0x1f0 [ 181.504939][ T6652] panic+0x71d/0x800 [ 181.508865][ T6652] ? __pfx_panic+0x10/0x10 [ 181.513314][ T6652] ? preempt_schedule_thunk+0x1a/0x30 [ 181.518707][ T6652] ? preempt_schedule_common+0x44/0xc0 [ 181.524210][ T6652] ? check_panic_on_warn+0x1f/0xb0 [ 181.529354][ T6652] check_panic_on_warn+0xab/0xb0 [ 181.534323][ T6652] end_report+0x117/0x180 [ 181.538683][ T6652] kasan_report+0xe9/0x110 [ 181.543135][ T6652] ? force_devcd_write+0x31f/0x350 [ 181.548358][ T6652] ? force_devcd_write+0x31f/0x350 [ 181.553496][ T6652] force_devcd_write+0x31f/0x350 [ 181.558464][ T6652] ? __pfx_force_devcd_write+0x10/0x10 [ 181.563977][ T6652] ? debugfs_file_get+0x21c/0x5c0 [ 181.569059][ T6652] ? __pfx_debugfs_file_get+0x10/0x10 [ 181.574461][ T6652] ? rcu_is_watching+0x12/0xc0 [ 181.579254][ T6652] ? trace_lock_acquire+0x14e/0x1f0 [ 181.584488][ T6652] full_proxy_write+0xfb/0x1b0 [ 181.589284][ T6652] ? __pfx_full_proxy_write+0x10/0x10 [ 181.594687][ T6652] vfs_write+0x24c/0x1150 [ 181.599068][ T6652] ? __pfx_vfs_write+0x10/0x10 [ 181.603856][ T6652] ? do_futex+0x123/0x350 [ 181.608222][ T6652] ? __pfx_do_futex+0x10/0x10 [ 181.612945][ T6652] ? __x64_sys_futex+0x1e1/0x4c0 [ 181.617919][ T6652] ? __x64_sys_futex+0x1ea/0x4c0 [ 181.622893][ T6652] ksys_write+0x12b/0x250 [ 181.627249][ T6652] ? __pfx_ksys_write+0x10/0x10 [ 181.632130][ T6652] do_syscall_64+0xcd/0x250 [ 181.636664][ T6652] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 181.642591][ T6652] RIP: 0033:0x7fd577b85d29 [ 181.647024][ T6652] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 181.666663][ T6652] RSP: 002b:00007ffe42738418 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 181.675107][ T6652] RAX: ffffffffffffffda RBX: 00007fd577d75fa0 RCX: 00007fd577b85d29 [ 181.683101][ T6652] RDX: 000000000000000e RSI: 0000000000000000 RDI: 0000000000000003 [ 181.691092][ T6652] RBP: 00007fd577c01b08 R08: 0000000000000000 R09: 0000000000000000 [ 181.699079][ T6652] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 181.707067][ T6652] R13: 00007fd577d75fa0 R14: 00007fd577d75fa0 R15: 00000000000018c7 [ 181.715067][ T6652] </TASK> [ 181.718441][ T6652] Kernel Offset: disabled [ 181.722778][ T6652] Rebooting in 86400 seconds..