forked to background, child pid 3184
no interfaces have a carrier
[ 23.621716][ T3185] 8021q: adding VLAN 0 to HW filter on device bond0
[ 23.630415][ T3185] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.0.39' (ECDSA) to the list of known hosts.
2022/11/13 18:59:16 ignoring optional flag "sandboxArg"="0"
2022/11/13 18:59:16 parsed 1 programs
syzkaller login: [ 52.991407][ T3613] cgroup: Unknown subsys name 'net'
[ 53.089265][ T3613] cgroup: Unknown subsys name 'rlimit'
2022/11/13 18:59:16 executed programs: 0
[ 53.255314][ T3619] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 53.263548][ T3619] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 53.271255][ T3619] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 53.279248][ T3619] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 53.287677][ T3621] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 53.295123][ T3621] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 53.303958][ T3618] Bluetooth: hci0: HCI_REQ-0x0c1a
[ 53.399977][ T3618] chnl_net:caif_netlink_parms(): no params data found
[ 53.439884][ T3618] bridge0: port 1(bridge_slave_0) entered blocking state
[ 53.447162][ T3618] bridge0: port 1(bridge_slave_0) entered disabled state
[ 53.456130][ T3618] device bridge_slave_0 entered promiscuous mode
[ 53.465323][ T3618] bridge0: port 2(bridge_slave_1) entered blocking state
[ 53.472641][ T3618] bridge0: port 2(bridge_slave_1) entered disabled state
[ 53.480329][ T3618] device bridge_slave_1 entered promiscuous mode
[ 53.500081][ T3618] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 53.511536][ T3618] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 53.533691][ T3618] team0: Port device team_slave_0 added
[ 53.541494][ T3618] team0: Port device team_slave_1 added
[ 53.558708][ T3618] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 53.565758][ T3618] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 53.591791][ T3618] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 53.604315][ T3618] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 53.611933][ T3618] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 53.638017][ T3618] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 53.666369][ T3618] device hsr_slave_0 entered promiscuous mode
[ 53.674219][ T3618] device hsr_slave_1 entered promiscuous mode
[ 53.750596][ T3618] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 53.761825][ T3618] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 53.770571][ T3618] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 53.781262][ T3618] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 53.802788][ T3618] bridge0: port 2(bridge_slave_1) entered blocking state
[ 53.809960][ T3618] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 53.818033][ T3618] bridge0: port 1(bridge_slave_0) entered blocking state
[ 53.825115][ T3618] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 53.866925][ T3618] 8021q: adding VLAN 0 to HW filter on device bond0
[ 53.879340][ T142] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 53.889376][ T142] bridge0: port 1(bridge_slave_0) entered disabled state
[ 53.898191][ T142] bridge0: port 2(bridge_slave_1) entered disabled state
[ 53.906457][ T142] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 53.919821][ T3618] 8021q: adding VLAN 0 to HW filter on device team0
[ 53.932311][ T3270] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 53.940769][ T3270] bridge0: port 1(bridge_slave_0) entered blocking state
[ 53.947935][ T3270] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 53.962388][ T142] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 53.971047][ T142] bridge0: port 2(bridge_slave_1) entered blocking state
[ 53.978165][ T142] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 54.000795][ T3618] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[ 54.012801][ T3618] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 54.027527][ T142] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 54.036210][ T142] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 54.045152][ T142] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 54.053695][ T142] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 54.062669][ T142] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 54.070794][ T142] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 54.166384][ T3618] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 54.175650][ T32] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 54.184246][ T32] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 54.199736][ T142] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 54.217885][ T3618] device veth0_vlan entered promiscuous mode
[ 54.225318][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 54.235024][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 54.243068][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 54.254603][ T3618] device veth1_vlan entered promiscuous mode
[ 54.263037][ T142] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 54.283042][ T32] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 54.291717][ T32] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 54.303266][ T3618] device veth0_macvtap entered promiscuous mode
[ 54.312426][ T3618] device veth1_macvtap entered promiscuous mode
[ 54.327069][ T3618] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 54.335048][ T142] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 54.344852][ T142] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 54.355458][ T3618] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 54.363539][ T3270] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 54.375577][ T3618] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 54.386033][ T3618] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 54.395063][ T3618] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 54.403858][ T3618] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 54.463657][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 54.480460][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 54.492027][ T3270] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 54.505391][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 54.513853][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 54.522939][ T142] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 54.572022][ T3636] loop0: detected capacity change from 0 to 2048
[ 54.797407][ T3640] loop0: detected capacity change from 0 to 2048
[ 54.856520][ T3644] loop0: detected capacity change from 0 to 2048
[ 55.078593][ T3648] loop0: detected capacity change from 0 to 2048
[ 55.148035][ T3652] loop0: detected capacity change from 0 to 2048
[ 55.217086][ T3656] loop0: detected capacity change from 0 to 2048
[ 55.218560][ T3614] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2
[ 55.285841][ T3660] loop0: detected capacity change from 0 to 2048
[ 55.295771][ T3614] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2
[ 55.331869][ T3621] Bluetooth: hci0: command 0x0409 tx timeout
[ 55.363208][ T3664] loop0: detected capacity change from 0 to 2048
[ 55.592999][ T3668] loop0: detected capacity change from 0 to 2048
[ 55.797969][ T3672] loop0: detected capacity change from 0 to 2048
[ 56.033641][ T3676] loop0: detected capacity change from 0 to 2048
[ 56.102488][ T3680] loop0: detected capacity change from 0 to 2048
[ 56.315787][ T3684] loop0: detected capacity change from 0 to 2048
[ 56.544219][ T3689] loop0: detected capacity change from 0 to 2048
[ 56.603478][ T3693] loop0: detected capacity change from 0 to 2048
[ 56.802980][ T3697] loop0: detected capacity change from 0 to 2048
[ 57.018593][ T3701] loop0: detected capacity change from 0 to 2048
[ 57.089121][ T3618] ==================================================================
[ 57.097232][ T3618] BUG: KASAN: use-after-free in crc_itu_t+0xce/0xe0
[ 57.103841][ T3618] Read of size 1 at addr ffff88806fc65000 by task syz-executor.0/3618
[ 57.111973][ T3618]
[ 57.114278][ T3618] CPU: 1 PID: 3618 Comm: syz-executor.0 Not tainted 6.1.0-rc4-syzkaller-00362-gfef7fd48922d #0
[ 57.124580][ T3618] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 57.134622][ T3618] Call Trace:
[ 57.137903][ T3618]
[ 57.140822][ T3618] dump_stack_lvl+0xcd/0x134
[ 57.145405][ T3618] print_report+0x15e/0x45d
[ 57.149898][ T3618] ? __phys_addr+0xc4/0x140
[ 57.154407][ T3618] ? crc_itu_t+0xce/0xe0
[ 57.158641][ T3618] kasan_report+0xbb/0x1f0
[ 57.163046][ T3618] ? crc_itu_t+0xce/0xe0
[ 57.167279][ T3618] crc_itu_t+0xce/0xe0
[ 57.171344][ T3618] udf_finalize_lvid+0xe0/0x1d0
[ 57.176180][ T3618] ? udf_mount+0x40/0x40
[ 57.180404][ T3618] ? get_nr_dirty_inodes+0x11a/0x1b0
[ 57.185683][ T3618] udf_sync_fs+0xe6/0x150
[ 57.190002][ T3618] ? udf_finalize_lvid+0x1d0/0x1d0
[ 57.195114][ T3618] sync_filesystem.part.0+0x75/0x1d0
[ 57.200398][ T3618] sync_filesystem+0x8b/0xc0
[ 57.204991][ T3618] generic_shutdown_super+0x70/0x410
[ 57.210266][ T3618] kill_block_super+0x97/0xf0
[ 57.214939][ T3618] deactivate_locked_super+0x94/0x160
[ 57.220306][ T3618] deactivate_super+0xad/0xd0
[ 57.224984][ T3618] cleanup_mnt+0x2ae/0x3d0
[ 57.229398][ T3618] task_work_run+0x16b/0x270
[ 57.233989][ T3618] ? task_work_cancel+0x30/0x30
[ 57.238841][ T3618] exit_to_user_mode_prepare+0x23c/0x250
[ 57.244472][ T3618] syscall_exit_to_user_mode+0x19/0x50
[ 57.249922][ T3618] do_syscall_64+0x42/0xb0
[ 57.254336][ T3618] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 57.260225][ T3618] RIP: 0033:0x7f931308caa7
[ 57.264625][ T3618] Code: ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 57.284231][ T3618] RSP: 002b:00007ffe2e15aa58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[ 57.292633][ T3618] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f931308caa7
[ 57.300671][ T3618] RDX: 00007ffe2e15ab2a RSI: 000000000000000a RDI: 00007ffe2e15ab20
[ 57.308668][ T3618] RBP: 00007ffe2e15ab20 R08: 00000000ffffffff R09: 00007ffe2e15a8f0
[ 57.316640][ T3618] R10: 00005555565a38b3 R11: 0000000000000246 R12: 00007f93130e5826
[ 57.324604][ T3618] R13: 00007ffe2e15bbe0 R14: 00005555565a3810 R15: 00007ffe2e15bc20
[ 57.332568][ T3618]
[ 57.335568][ T3618]
[ 57.337869][ T3618] The buggy address belongs to the physical page:
[ 57.344263][ T3618] page:ffffea0001bf1940 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x6fc65
[ 57.354397][ T3618] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 57.361490][ T3618] raw: 00fff00000000000 ffffea0001baab88 ffffea0001c0c7c8 0000000000000000
[ 57.370316][ T3618] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
[ 57.378887][ T3618] page dumped because: kasan: bad access detected
[ 57.385279][ T3618] page_owner tracks the page as freed
[ 57.390626][ T3618] page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 3698, tgid 3696 (syz-executor.0), ts 56838748097, free_ts 56942519569
[ 57.408508][ T3618] get_page_from_freelist+0x10b5/0x2d50
[ 57.414056][ T3618] __alloc_pages+0x1c7/0x5a0
[ 57.418633][ T3618] __folio_alloc+0x12/0x40
[ 57.423045][ T3618] vma_alloc_folio+0xf9/0x780
[ 57.427716][ T3618] shmem_alloc_folio+0x107/0x1d0
[ 57.432650][ T3618] shmem_alloc_and_acct_folio+0x15e/0x5d0
[ 57.438372][ T3618] shmem_get_folio_gfp+0xb49/0x1a60
[ 57.443558][ T3618] shmem_write_begin+0x146/0x380
[ 57.448479][ T3618] generic_perform_write+0x252/0x570
[ 57.453754][ T3618] __generic_file_write_iter+0x2aa/0x4d0
[ 57.459376][ T3618] generic_file_write_iter+0xdf/0x350
[ 57.464741][ T3618] vfs_write+0x9e9/0xdd0
[ 57.468975][ T3618] ksys_write+0x127/0x250
[ 57.473292][ T3618] do_syscall_64+0x35/0xb0
[ 57.477700][ T3618] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 57.483583][ T3618] page last free stack trace:
[ 57.488235][ T3618] free_pcp_prepare+0x65c/0xd90
[ 57.493085][ T3618] free_unref_page_list+0x172/0xc40
[ 57.498268][ T3618] release_pages+0xc86/0x1360
[ 57.502930][ T3618] __pagevec_release+0x77/0x100
[ 57.507764][ T3618] shmem_undo_range+0x8eb/0x12a0
[ 57.512691][ T3618] shmem_evict_inode+0x3c6/0xc30
[ 57.517610][ T3618] evict+0x2ed/0x6b0
[ 57.521491][ T3618] iput.part.0+0x59b/0x880
[ 57.525892][ T3618] iput+0x58/0x70
[ 57.529504][ T3618] dentry_unlink_inode+0x2b1/0x460
[ 57.534624][ T3618] __dentry_kill+0x3c0/0x640
[ 57.539204][ T3618] dput+0x806/0xdb0
[ 57.542993][ T3618] __fput+0x3cc/0xa90
[ 57.546962][ T3618] task_work_run+0x16b/0x270
[ 57.551549][ T3618] exit_to_user_mode_prepare+0x23c/0x250
[ 57.557167][ T3618] syscall_exit_to_user_mode+0x19/0x50
[ 57.562610][ T3618]
[ 57.564915][ T3618] Memory state around the buggy address:
[ 57.570525][ T3618] ffff88806fc64f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 57.578673][ T3618] ffff88806fc64f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 57.586733][ T3618] >ffff88806fc65000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 57.594874][ T3618] ^
[ 57.598926][ T3618] ffff88806fc65080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 57.606981][ T3618] ffff88806fc65100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 57.615032][ T3618] ==================================================================
[ 57.624906][ T3621] Bluetooth: hci0: command 0x041b tx timeout
[ 57.636584][ T3618] Kernel panic - not syncing: panic_on_warn set ...
[ 57.643205][ T3618] CPU: 0 PID: 3618 Comm: syz-executor.0 Not tainted 6.1.0-rc4-syzkaller-00362-gfef7fd48922d #0
[ 57.653522][ T3618] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 57.663563][ T3618] Call Trace:
[ 57.666825][ T3618]
[ 57.669736][ T3618] dump_stack_lvl+0xcd/0x134
[ 57.674323][ T3618] panic+0x2c8/0x622
[ 57.678212][ T3618] ? panic_print_sys_info.part.0+0x110/0x110
[ 57.684189][ T3618] ? preempt_schedule_common+0x59/0xc0
[ 57.689634][ T3618] ? preempt_schedule_thunk+0x16/0x18
[ 57.695003][ T3618] end_report.part.0+0x3f/0x7c
[ 57.699755][ T3618] ? crc_itu_t+0xce/0xe0
[ 57.703989][ T3618] kasan_report.cold+0xa/0xf
[ 57.708568][ T3618] ? crc_itu_t+0xce/0xe0
[ 57.712803][ T3618] crc_itu_t+0xce/0xe0
[ 57.716863][ T3618] udf_finalize_lvid+0xe0/0x1d0
[ 57.721718][ T3618] ? udf_mount+0x40/0x40
[ 57.725945][ T3618] ? get_nr_dirty_inodes+0x11a/0x1b0
[ 57.731236][ T3618] udf_sync_fs+0xe6/0x150
[ 57.735608][ T3618] ? udf_finalize_lvid+0x1d0/0x1d0
[ 57.740715][ T3618] sync_filesystem.part.0+0x75/0x1d0
[ 57.746007][ T3618] sync_filesystem+0x8b/0xc0
[ 57.750608][ T3618] generic_shutdown_super+0x70/0x410
[ 57.755900][ T3618] kill_block_super+0x97/0xf0
[ 57.760569][ T3618] deactivate_locked_super+0x94/0x160
[ 57.765941][ T3618] deactivate_super+0xad/0xd0
[ 57.770607][ T3618] cleanup_mnt+0x2ae/0x3d0
[ 57.775025][ T3618] task_work_run+0x16b/0x270
[ 57.779611][ T3618] ? task_work_cancel+0x30/0x30
[ 57.784468][ T3618] exit_to_user_mode_prepare+0x23c/0x250
[ 57.790094][ T3618] syscall_exit_to_user_mode+0x19/0x50
[ 57.795553][ T3618] do_syscall_64+0x42/0xb0
[ 57.799966][ T3618] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 57.805872][ T3618] RIP: 0033:0x7f931308caa7
[ 57.810286][ T3618] Code: ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 57.829899][ T3618] RSP: 002b:00007ffe2e15aa58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[ 57.838318][ T3618] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f931308caa7
[ 57.846288][ T3618] RDX: 00007ffe2e15ab2a RSI: 000000000000000a RDI: 00007ffe2e15ab20
[ 57.854264][ T3618] RBP: 00007ffe2e15ab20 R08: 00000000ffffffff R09: 00007ffe2e15a8f0
[ 57.862223][ T3618] R10: 00005555565a38b3 R11: 0000000000000246 R12: 00007f93130e5826
[ 57.870202][ T3618] R13: 00007ffe2e15bbe0 R14: 00005555565a3810 R15: 00007ffe2e15bc20
[ 57.878181][ T3618]
[ 57.881930][ T3618] Kernel Offset: disabled
[ 57.886288][ T3618] Rebooting in 86400 seconds..