Warning: Permanently added '10.128.0.12' (ED25519) to the list of known hosts. executing program [ 42.406254][ T6414] ------------[ cut here ]------------ [ 42.407487][ T6414] refcount_t: decrement hit 0; leaking memory. [ 42.409179][ T6414] WARNING: CPU: 1 PID: 6414 at lib/refcount.c:31 refcount_warn_saturate+0x1e8/0x20c [ 42.411312][ T6414] Modules linked in: [ 42.412118][ T6414] CPU: 1 UID: 0 PID: 6414 Comm: syz-executor496 Not tainted 6.13.0-rc3-syzkaller-g573067a5a685 #0 [ 42.414272][ T6414] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 42.416411][ T6414] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 42.418113][ T6414] pc : refcount_warn_saturate+0x1e8/0x20c [ 42.419369][ T6414] lr : refcount_warn_saturate+0x1e8/0x20c [ 42.420559][ T6414] sp : ffff80009d377810 [ 42.421431][ T6414] x29: ffff80009d377810 x28: dfff800000000000 x27: ffff0000da4f9080 [ 42.423203][ T6414] x26: dfff800000000000 x25: ffff700013a6ef0c x24: ffff0000cc459610 [ 42.424856][ T6414] x23: ffff0000d9dc5800 x22: ffff80009d377880 x21: 0000000000000004 [ 42.426667][ T6414] x20: ffff0000cd62864c x19: ffff800092c5f000 x18: 0000000000000008 [ 42.428483][ T6414] x17: 0000000000000000 x16: ffff800083275834 x15: 0000000000000001 [ 42.430198][ T6414] x14: 1fffe00036700aea x13: 0000000000000000 x12: 0000000000000000 [ 42.431882][ T6414] x11: 0000000000000002 x10: 0000000000ff0100 x9 : 13bfb39c82bd2b00 [ 42.433564][ T6414] x8 : 13bfb39c82bd2b00 x7 : 0000000000000001 x6 : 0000000000000001 [ 42.435415][ T6414] x5 : ffff80009d376f38 x4 : ffff80008fa8f840 x3 : ffff80008073f2fc [ 42.437057][ T6414] x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000000 [ 42.438709][ T6414] Call trace: [ 42.439416][ T6414] refcount_warn_saturate+0x1e8/0x20c (P) [ 42.440599][ T6414] ref_tracker_free+0x550/0x6ac [ 42.441702][ T6414] ax25_release+0x350/0x8ac [ 42.442701][ T6414] sock_close+0xa4/0x1e8 [ 42.443641][ T6414] __fput+0x1bc/0x75c [ 42.444518][ T6414] ____fput+0x20/0x30 [ 42.445460][ T6414] task_work_run+0x230/0x2e0 [ 42.446414][ T6414] do_exit+0x4ec/0x1ad0 [ 42.447252][ T6414] do_group_exit+0x194/0x22c [ 42.448254][ T6414] pid_child_should_wake+0x0/0x1dc [ 42.449378][ T6414] invoke_syscall+0x98/0x2b8 [ 42.450383][ T6414] el0_svc_common+0x130/0x23c [ 42.451442][ T6414] do_el0_svc+0x48/0x58 [ 42.452406][ T6414] el0_svc+0x54/0x168 [ 42.453281][ T6414] el0t_64_sync_handler+0x84/0x108 [ 42.454405][ T6414] el0t_64_sync+0x198/0x19c [ 42.455335][ T6414] irq event stamp: 960 [ 42.456187][ T6414] hardirqs last enabled at (959): [] __console_unlock+0x70/0xc4 [ 42.458106][ T6414] hardirqs last disabled at (960): [] el1_dbg+0x24/0x80 [ 42.459885][ T6414] softirqs last enabled at (926): [] ax25_cb_del+0x14c/0x198 [ 42.461978][ T6414] softirqs last disabled at (924): [] ax25_cb_del+0x30/0x198 [ 42.463949][ T6414] ---[ end trace 0000000000000000 ]--- executing program [ 42.477581][ T6415] ================================================================== [ 42.479300][ T6415] BUG: KASAN: slab-use-after-free in ax25_fillin_cb+0x39c/0x588 [ 42.480958][ T6415] Read of size 4 at addr ffff0000cc459648 by task syz-executor496/6415 [ 42.482699][ T6415] [ 42.483223][ T6415] CPU: 1 UID: 0 PID: 6415 Comm: syz-executor496 Tainted: G W 6.13.0-rc3-syzkaller-g573067a5a685 #0 [ 42.485811][ T6415] Tainted: [W]=WARN [ 42.486600][ T6415] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 42.488800][ T6415] Call trace: [ 42.489582][ T6415] show_stack+0x2c/0x3c (C) [ 42.490556][ T6415] dump_stack_lvl+0xe4/0x150 [ 42.491716][ T6415] print_report+0x198/0x538 [ 42.492852][ T6415] kasan_report+0xd8/0x138 [ 42.493772][ T6415] __asan_report_load4_noabort+0x20/0x2c [ 42.495012][ T6415] ax25_fillin_cb+0x39c/0x588 [ 42.496062][ T6415] ax25_setsockopt+0x958/0xcac [ 42.497099][ T6415] do_sock_setsockopt+0x2a0/0x4e0 [ 42.498255][ T6415] __arm64_sys_setsockopt+0x170/0x1e0 [ 42.499447][ T6415] invoke_syscall+0x98/0x2b8 [ 42.500423][ T6415] el0_svc_common+0x130/0x23c [ 42.501511][ T6415] do_el0_svc+0x48/0x58 [ 42.502361][ T6415] el0_svc+0x54/0x168 [ 42.503183][ T6415] el0t_64_sync_handler+0x84/0x108 [ 42.504337][ T6415] el0t_64_sync+0x198/0x19c [ 42.505375][ T6415] [ 42.505913][ T6415] Allocated by task 6414: [ 42.506921][ T6415] kasan_save_track+0x40/0x78 [ 42.507812][ T6415] kasan_save_alloc_info+0x40/0x50 [ 42.508911][ T6415] __kasan_kmalloc+0xac/0xc4 [ 42.509962][ T6415] __kmalloc_cache_noprof+0x2cc/0x428 [ 42.511101][ T6415] ax25_dev_device_up+0x5c/0x538 [ 42.512065][ T6415] ax25_device_event+0x4f0/0x58c [ 42.513130][ T6415] notifier_call_chain+0x1c4/0x550 [ 42.514220][ T6415] raw_notifier_call_chain+0x3c/0x50 [ 42.515348][ T6415] __dev_notify_flags+0x2c4/0x550 [ 42.516407][ T6415] dev_change_flags+0xd0/0x15c [ 42.517456][ T6415] dev_ifsioc+0x134/0x9a8 [ 42.518421][ T6415] dev_ioctl+0x4d8/0xd34 [ 42.519389][ T6415] sock_do_ioctl+0x1d4/0x2d0 [ 42.520409][ T6415] sock_ioctl+0x4ec/0x838 [ 42.521347][ T6415] __arm64_sys_ioctl+0x14c/0x1cc [ 42.522492][ T6415] invoke_syscall+0x98/0x2b8 [ 42.523539][ T6415] el0_svc_common+0x130/0x23c [ 42.524585][ T6415] do_el0_svc+0x48/0x58 [ 42.525456][ T6415] el0_svc+0x54/0x168 [ 42.526331][ T6415] el0t_64_sync_handler+0x84/0x108 [ 42.527541][ T6415] el0t_64_sync+0x198/0x19c [ 42.528600][ T6415] [ 42.529145][ T6415] Freed by task 6414: [ 42.530071][ T6415] kasan_save_track+0x40/0x78 [ 42.531170][ T6415] kasan_save_free_info+0x54/0x6c [ 42.532309][ T6415] __kasan_slab_free+0x64/0x8c [ 42.533405][ T6415] kfree+0x180/0x478 [ 42.534325][ T6415] ax25_release+0x3d4/0x8ac [ 42.535361][ T6415] sock_close+0xa4/0x1e8 [ 42.536209][ T6415] __fput+0x1bc/0x75c [ 42.537113][ T6415] ____fput+0x20/0x30 [ 42.538066][ T6415] task_work_run+0x230/0x2e0 [ 42.539338][ T6415] do_exit+0x4ec/0x1ad0 [ 42.540239][ T6415] do_group_exit+0x194/0x22c [ 42.541192][ T6415] pid_child_should_wake+0x0/0x1dc [ 42.542336][ T6415] invoke_syscall+0x98/0x2b8 [ 42.543295][ T6415] el0_svc_common+0x130/0x23c [ 42.544243][ T6415] do_el0_svc+0x48/0x58 [ 42.545139][ T6415] el0_svc+0x54/0x168 [ 42.545969][ T6415] el0t_64_sync_handler+0x84/0x108 [ 42.547078][ T6415] el0t_64_sync+0x198/0x19c [ 42.548053][ T6415] [ 42.548561][ T6415] The buggy address belongs to the object at ffff0000cc459600 [ 42.548561][ T6415] which belongs to the cache kmalloc-256 of size 256 [ 42.551524][ T6415] The buggy address is located 72 bytes inside of [ 42.551524][ T6415] freed 256-byte region [ffff0000cc459600, ffff0000cc459700) [ 42.554512][ T6415] [ 42.555062][ T6415] The buggy address belongs to the physical page: [ 42.556486][ T6415] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10c458 [ 42.558308][ T6415] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 42.560146][ T6415] flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 42.561845][ T6415] page_type: f5(slab) [ 42.562819][ T6415] raw: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122 [ 42.564769][ T6415] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 42.566528][ T6415] head: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122 [ 42.568477][ T6415] head: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 42.570301][ T6415] head: 05ffc00000000001 fffffdffc3311601 ffffffffffffffff 0000000000000000 [ 42.572084][ T6415] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 42.573871][ T6415] page dumped because: kasan: bad access detected [ 42.575260][ T6415] [ 42.575808][ T6415] Memory state around the buggy address: [ 42.576953][ T6415] ffff0000cc459500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.578704][ T6415] ffff0000cc459580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.580506][ T6415] >ffff0000cc459600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.582285][ T6415] ^ [ 42.583721][ T6415] ffff0000cc459680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.585418][ T6415] ffff0000cc459700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.587081][ T6415] ================================================================== [ 42.590619][ T6415] Disabling lock debugging due to kernel taint [ 42.592528][ T6415] ------------[ cut here ]------------ [ 42.593664][ T6415] refcount_t: underflow; use-after-free. [ 42.595141][ T6415] WARNING: CPU: 1 PID: 6415 at lib/refcount.c:28 refcount_warn_saturate+0x1c8/0x20c [ 42.597256][ T6415] Modules linked in: [ 42.598204][ T6415] CPU: 1 UID: 0 PID: 6415 Comm: syz-executor496 Tainted: G B W 6.13.0-rc3-syzkaller-g573067a5a685 #0 [ 42.601010][ T6415] Tainted: [B]=BAD_PAGE, [W]=WARN [ 42.602102][ T6415] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 42.604264][ T6415] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 42.605781][ T6415] pc : refcount_warn_saturate+0x1c8/0x20c [ 42.607169][ T6415] lr : refcount_warn_saturate+0x1c8/0x20c [ 42.608336][ T6415] sp : ffff80009d367970 [ 42.609202][ T6415] x29: ffff80009d367970 x28: dfff800000000000 x27: ffff0000da4ff080 [ 42.610907][ T6415] x26: ffff0000d9dc6028 x25: ffff0000cc459600 x24: 0000000000000000 [ 42.612766][ T6415] x23: ffff0000cc4596c8 x22: 1fffe0001bd4f903 x21: 0000000000000003 [ 42.614573][ T6415] x20: ffff0000cc4596c8 x19: ffff800092c5f000 x18: 0000000000000008 [ 42.616455][ T6415] x17: 0000000000000000 x16: ffff800083275834 x15: 0000000000000001 [ 42.618120][ T6415] x14: 1fffe00036700aea x13: 0000000000000000 x12: 0000000000000000 [ 42.619926][ T6415] x11: 0000000000000002 x10: 0000000000ff0100 x9 : dcf8f283ffcde100 [ 42.621669][ T6415] x8 : dcf8f283ffcde100 x7 : 0000000000000001 x6 : 0000000000000001 [ 42.623311][ T6415] x5 : ffff80009d367098 x4 : ffff80008fa8f840 x3 : ffff80008073f2fc [ 42.625104][ T6415] x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000000 [ 42.626933][ T6415] Call trace: [ 42.627685][ T6415] refcount_warn_saturate+0x1c8/0x20c (P) [ 42.628935][ T6415] ax25_release+0x72c/0x8ac [ 42.629943][ T6415] sock_close+0xa4/0x1e8 [ 42.630882][ T6415] __fput+0x1bc/0x75c [ 42.631690][ T6415] ____fput+0x20/0x30 [ 42.632460][ T6415] task_work_run+0x230/0x2e0 [ 42.633427][ T6415] do_exit+0x4ec/0x1ad0 [ 42.634323][ T6415] do_group_exit+0x194/0x22c [ 42.635333][ T6415] pid_child_should_wake+0x0/0x1dc [ 42.636565][ T6415] invoke_syscall+0x98/0x2b8 [ 42.637591][ T6415] el0_svc_common+0x130/0x23c [ 42.638644][ T6415] do_el0_svc+0x48/0x58 [ 42.639538][ T6415] el0_svc+0x54/0x168 [ 42.640481][ T6415] el0t_64_sync_handler+0x84/0x108 [ 42.641684][ T6415] el0t_64_sync+0x198/0x19c [ 42.642721][ T6415] irq event stamp: 379 [ 42.643594][ T6415] hardirqs last enabled at (379): [] finish_lock_switch+0xbc/0x1e4 [ 42.645632][ T6415] hardirqs last disabled at (378): [] __schedule+0x2bc/0x27f0 [ 42.647680][ T6415] softirqs last enabled at (336): [] lock_sock_nested+0xcc/0x11c [ 42.649697][ T6415] softirqs last disabled at (334): [] lock_sock_nested+0x74/0x11c [ 42.651729][ T6415] ---[ end trace 0000000000000000 ]--- executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program