DUID 00:04:00:dd:10:da:7f:85:b5:90:fb:fd:97:ac:66:d6:08:36
forked to background, child pid 3182
[ 31.867587][ T3183] 8021q: adding VLAN 0 to HW filter on device bond0
[ 31.885402][ T3183] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.1.35' (ECDSA) to the list of known hosts.
2021/12/15 03:10:57 fuzzer started
2021/12/15 03:10:57 connecting to host at 10.128.0.169:36527
2021/12/15 03:10:57 checking machine...
2021/12/15 03:10:57 checking revisions...
2021/12/15 03:10:57 testing simple program...
syzkaller login: [ 51.038738][ T3611] cgroup: Unknown subsys name 'net'
[ 51.158952][ T3611] cgroup: Unknown subsys name 'rlimit'
[ 52.488917][ T3613] chnl_net:caif_netlink_parms(): no params data found
[ 52.534195][ T3613] bridge0: port 1(bridge_slave_0) entered blocking state
[ 52.542037][ T3613] bridge0: port 1(bridge_slave_0) entered disabled state
[ 52.550154][ T3613] device bridge_slave_0 entered promiscuous mode
[ 52.560033][ T3613] bridge0: port 2(bridge_slave_1) entered blocking state
[ 52.567546][ T3613] bridge0: port 2(bridge_slave_1) entered disabled state
[ 52.575739][ T3613] device bridge_slave_1 entered promiscuous mode
[ 52.597411][ T3613] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 52.608828][ T3613] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 52.632075][ T3613] team0: Port device team_slave_0 added
[ 52.639306][ T3613] team0: Port device team_slave_1 added
[ 52.658201][ T3613] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 52.665361][ T3613] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 52.691444][ T3613] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 52.704341][ T3613] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 52.711291][ T3613] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 52.737650][ T3613] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 52.763537][ T3613] device hsr_slave_0 entered promiscuous mode
[ 52.770814][ T3613] device hsr_slave_1 entered promiscuous mode
[ 52.854011][ T3613] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 52.865974][ T3613] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 52.875192][ T3613] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 52.884790][ T3613] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 52.906394][ T3613] bridge0: port 2(bridge_slave_1) entered blocking state
[ 52.913597][ T3613] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 52.921288][ T3613] bridge0: port 1(bridge_slave_0) entered blocking state
[ 52.928693][ T3613] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 52.973376][ T3613] 8021q: adding VLAN 0 to HW filter on device bond0
[ 52.985924][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 52.996732][ T136] bridge0: port 1(bridge_slave_0) entered disabled state
[ 53.006172][ T136] bridge0: port 2(bridge_slave_1) entered disabled state
[ 53.014727][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 53.028728][ T3613] 8021q: adding VLAN 0 to HW filter on device team0
[ 53.040088][ T3268] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 53.049894][ T3268] bridge0: port 1(bridge_slave_0) entered blocking state
[ 53.057358][ T3268] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 53.072160][ T3268] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 53.080525][ T3268] bridge0: port 2(bridge_slave_1) entered blocking state
[ 53.088239][ T3268] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 53.103561][ T3623] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 53.113537][ T3623] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 53.130771][ T3613] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[ 53.142727][ T3613] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 53.155392][ T3623] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 53.164558][ T3623] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 53.173811][ T3623] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 53.184877][ T3623] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 53.200809][ T3268] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 53.209242][ T3268] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 53.224315][ T3613] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 53.241813][ T3623] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 53.260064][ T3623] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 53.268520][ T3623] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 53.276826][ T3623] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 53.287198][ T3613] device veth0_vlan entered promiscuous mode
[ 53.298685][ T3613] device veth1_vlan entered promiscuous mode
[ 53.318708][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 53.327028][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 53.335399][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 53.347308][ T3613] device veth0_macvtap entered promiscuous mode
[ 53.356801][ T3613] device veth1_macvtap entered promiscuous mode
[ 53.372751][ T3613] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 53.380251][ T3268] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 53.392460][ T3268] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 53.404925][ T3613] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 53.412847][ T3268] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 53.426686][ T3613] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 53.435856][ T3613] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 53.445111][ T3613] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 53.454565][ T3613] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 53.519514][ T1090] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 53.537563][ T1090] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 53.549828][ T3623] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 53.549968][ T944] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 53.567142][ T944] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 53.575993][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
2021/12/15 03:11:00 building call list...
[ 53.850179][ T1090] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
executing program
[ 55.710996][ T3602] can: request_module (can-proto-0) failed.
[ 55.734147][ T3602] can: request_module (can-proto-0) failed.
[ 55.755141][ T3602] can: request_module (can-proto-0) failed.
[ 55.951955][ T3602] ------------[ cut here ]------------
[ 55.957723][ T3602] refcount_t: decrement hit 0; leaking memory.
[ 55.964880][ T3602] WARNING: CPU: 1 PID: 3602 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0
[ 55.974915][ T3602] Modules linked in:
[ 55.978812][ T3602] CPU: 1 PID: 3602 Comm: syz-fuzzer Not tainted 5.16.0-rc4-syzkaller #0
[ 55.987437][ T3602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 55.997907][ T3602] RIP: 0010:refcount_warn_saturate+0xbf/0x1e0
[ 56.004426][ T3602] Code: 1d d1 9f a1 09 31 ff 89 de e8 cd 42 9c fd 84 db 75 e0 e8 e4 3e 9c fd 48 c7 c7 60 fa 04 8a c6 05 b1 9f a1 09 01 e8 ac 44 27 05 <0f> 0b eb c4 e8 c8 3e 9c fd 0f b6 1d a0 9f a1 09 31 ff 89 de e8 98
[ 56.025095][ T3602] RSP: 0018:ffffc900029efab0 EFLAGS: 00010286
[ 56.031161][ T3602] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 56.039897][ T3602] RDX: ffff88801a1e8000 RSI: ffffffff815f1db8 RDI: fffff5200053df48
[ 56.048471][ T3602] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
[ 56.057488][ T3602] R10: ffffffff815ebb5e R11: 0000000000000000 R12: 1ffff9200053df5b
[ 56.065824][ T3602] R13: 00000000ffffffef R14: ffffffff8d2fcb14 R15: ffffc900029efd10
[ 56.074255][ T3602] FS: 0000000001867c10(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
[ 56.083914][ T3602] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 56.090493][ T3602] CR2: 00007f649728a300 CR3: 0000000070d2e000 CR4: 00000000003506e0
[ 56.098633][ T3602] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 56.107392][ T3602] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 56.115555][ T3602] Call Trace:
[ 56.118845][ T3602]
[ 56.122094][ T3602] ref_tracker_free+0x4fe/0x610
[ 56.126973][ T3602] ? ref_tracker_dir_exit+0x330/0x330
[ 56.132719][ T3602] ? bpf_sk_storage_free+0x333/0x3e0
[ 56.138008][ T3602] ? lock_downgrade+0x6e0/0x6e0
[ 56.143291][ T3602] ? kfree+0x1e1/0x560
[ 56.147392][ T3602] __sk_destruct+0x4a6/0x920
[ 56.152245][ T3602] sk_destruct+0xbd/0xe0
[ 56.156521][ T3602] __sk_free+0xef/0x3d0
[ 56.160670][ T3602] sk_free+0x78/0xa0
[ 56.164617][ T3602] __mptcp_close_ssk+0x435/0x590
[ 56.169572][ T3602] __mptcp_destroy_sock+0x35f/0x830
[ 56.175174][ T3602] ? __mptcp_close_ssk+0x590/0x590
[ 56.180399][ T3602] ? __local_bh_enable_ip+0xa0/0x120
[ 56.185781][ T3602] mptcp_close+0x5f8/0x7f0
[ 56.190224][ T3602] inet_release+0x12e/0x280
[ 56.194931][ T3602] inet6_release+0x4c/0x70
[ 56.199362][ T3602] __sock_release+0xcd/0x280
[ 56.203992][ T3602] sock_close+0x18/0x20
[ 56.208158][ T3602] __fput+0x286/0x9f0
[ 56.212208][ T3602] ? __sock_release+0x280/0x280
[ 56.217080][ T3602] task_work_run+0xdd/0x1a0
[ 56.221636][ T3602] exit_to_user_mode_prepare+0x27e/0x290
[ 56.227298][ T3602] syscall_exit_to_user_mode+0x19/0x60
[ 56.232831][ T3602] do_syscall_64+0x42/0xb0
[ 56.237268][ T3602] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 56.243242][ T3602] RIP: 0033:0x4b12db
[ 56.247152][ T3602] Code: fb ff eb bd e8 46 96 fb ff e9 61 ff ff ff cc e8 fb 61 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30
[ 56.267070][ T3602] RSP: 002b:000000c0003074f0 EFLAGS: 00000206 ORIG_RAX: 0000000000000003
[ 56.275557][ T3602] RAX: 0000000000000000 RBX: 000000c00001e800 RCX: 00000000004b12db
[ 56.283614][ T3602] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006
[ 56.291821][ T3602] RBP: 000000c000307530 R08: 0000000000f0ae01 R09: 00007ffc4bdaa080
[ 56.299803][ T3602] R10: 00007ffc4bdaa090 R11: 0000000000000206 R12: 0000000000000080
[ 56.307917][ T3602] R13: 0000000000000000 R14: ffffffffffffffff R15: 000000c0001a8000
[ 56.315938][ T3602]
[ 56.318951][ T3602] Kernel panic - not syncing: panic_on_warn set ...
[ 56.325516][ T3602] CPU: 0 PID: 3602 Comm: syz-fuzzer Not tainted 5.16.0-rc4-syzkaller #0
[ 56.333826][ T3602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 56.344300][ T3602] Call Trace:
[ 56.347588][ T3602]
[ 56.350521][ T3602] dump_stack_lvl+0xcd/0x134
[ 56.355118][ T3602] panic+0x2b0/0x6dd
[ 56.359012][ T3602] ? __warn_printk+0xf3/0xf3
[ 56.363611][ T3602] ? __warn.cold+0x1a/0x44
[ 56.368030][ T3602] ? refcount_warn_saturate+0xbf/0x1e0
[ 56.373490][ T3602] __warn.cold+0x35/0x44
[ 56.377835][ T3602] ? wake_up_klogd.part.0+0x8e/0xd0
[ 56.383035][ T3602] ? refcount_warn_saturate+0xbf/0x1e0
[ 56.388483][ T3602] report_bug+0x1bd/0x210
[ 56.392805][ T3602] handle_bug+0x3c/0x60
[ 56.397133][ T3602] exc_invalid_op+0x14/0x40
[ 56.401655][ T3602] asm_exc_invalid_op+0x12/0x20
[ 56.406504][ T3602] RIP: 0010:refcount_warn_saturate+0xbf/0x1e0
[ 56.412759][ T3602] Code: 1d d1 9f a1 09 31 ff 89 de e8 cd 42 9c fd 84 db 75 e0 e8 e4 3e 9c fd 48 c7 c7 60 fa 04 8a c6 05 b1 9f a1 09 01 e8 ac 44 27 05 <0f> 0b eb c4 e8 c8 3e 9c fd 0f b6 1d a0 9f a1 09 31 ff 89 de e8 98
[ 56.432368][ T3602] RSP: 0018:ffffc900029efab0 EFLAGS: 00010286
[ 56.438439][ T3602] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 56.446404][ T3602] RDX: ffff88801a1e8000 RSI: ffffffff815f1db8 RDI: fffff5200053df48
[ 56.454367][ T3602] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
[ 56.462328][ T3602] R10: ffffffff815ebb5e R11: 0000000000000000 R12: 1ffff9200053df5b
[ 56.470298][ T3602] R13: 00000000ffffffef R14: ffffffff8d2fcb14 R15: ffffc900029efd10
[ 56.478268][ T3602] ? wake_up_klogd.part.0+0x8e/0xd0
[ 56.483472][ T3602] ? vprintk+0x88/0x90
[ 56.487545][ T3602] ref_tracker_free+0x4fe/0x610
[ 56.492394][ T3602] ? ref_tracker_dir_exit+0x330/0x330
[ 56.497761][ T3602] ? bpf_sk_storage_free+0x333/0x3e0
[ 56.503063][ T3602] ? lock_downgrade+0x6e0/0x6e0
[ 56.507909][ T3602] ? kfree+0x1e1/0x560
[ 56.511990][ T3602] __sk_destruct+0x4a6/0x920
[ 56.516582][ T3602] sk_destruct+0xbd/0xe0
[ 56.520821][ T3602] __sk_free+0xef/0x3d0
[ 56.524975][ T3602] sk_free+0x78/0xa0
[ 56.529042][ T3602] __mptcp_close_ssk+0x435/0x590
[ 56.533981][ T3602] __mptcp_destroy_sock+0x35f/0x830
[ 56.539347][ T3602] ? __mptcp_close_ssk+0x590/0x590
[ 56.544455][ T3602] ? __local_bh_enable_ip+0xa0/0x120
[ 56.549754][ T3602] mptcp_close+0x5f8/0x7f0
[ 56.554169][ T3602] inet_release+0x12e/0x280
[ 56.558671][ T3602] inet6_release+0x4c/0x70
[ 56.563087][ T3602] __sock_release+0xcd/0x280
[ 56.568111][ T3602] sock_close+0x18/0x20
[ 56.572435][ T3602] __fput+0x286/0x9f0
[ 56.576408][ T3602] ? __sock_release+0x280/0x280
[ 56.581265][ T3602] task_work_run+0xdd/0x1a0
[ 56.585770][ T3602] exit_to_user_mode_prepare+0x27e/0x290
[ 56.591399][ T3602] syscall_exit_to_user_mode+0x19/0x60
[ 56.596851][ T3602] do_syscall_64+0x42/0xb0
[ 56.601264][ T3602] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 56.607150][ T3602] RIP: 0033:0x4b12db
[ 56.611037][ T3602] Code: fb ff eb bd e8 46 96 fb ff e9 61 ff ff ff cc e8 fb 61 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30
[ 56.630635][ T3602] RSP: 002b:000000c0003074f0 EFLAGS: 00000206 ORIG_RAX: 0000000000000003
[ 56.639134][ T3602] RAX: 0000000000000000 RBX: 000000c00001e800 RCX: 00000000004b12db
[ 56.647198][ T3602] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006
[ 56.655328][ T3602] RBP: 000000c000307530 R08: 0000000000f0ae01 R09: 00007ffc4bdaa080
[ 56.663291][ T3602] R10: 00007ffc4bdaa090 R11: 0000000000000206 R12: 0000000000000080
[ 56.671251][ T3602] R13: 0000000000000000 R14: ffffffffffffffff R15: 000000c0001a8000
[ 56.679228][ T3602]
[ 56.683105][ T3602] Kernel Offset: disabled
[ 56.687516][ T3602] Rebooting in 86400 seconds..