Warning: Permanently added '10.128.1.12' (ED25519) to the list of known hosts.
[ 50.253564][ T5045] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 50.263172][ T5045] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 50.270583][ T5045] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 50.279733][ T5045] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 50.287458][ T5045] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 50.294877][ T5045] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 50.372544][ T5043] chnl_net:caif_netlink_parms(): no params data found
[ 50.415477][ T5043] bridge0: port 1(bridge_slave_0) entered blocking state
[ 50.422782][ T5043] bridge0: port 1(bridge_slave_0) entered disabled state
[ 50.429965][ T5043] bridge_slave_0: entered allmulticast mode
[ 50.436537][ T5043] bridge_slave_0: entered promiscuous mode
[ 50.443868][ T5043] bridge0: port 2(bridge_slave_1) entered blocking state
[ 50.451031][ T5043] bridge0: port 2(bridge_slave_1) entered disabled state
[ 50.458383][ T5043] bridge_slave_1: entered allmulticast mode
[ 50.465158][ T5043] bridge_slave_1: entered promiscuous mode
[ 50.486229][ T5043] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 50.497000][ T5043] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 50.519462][ T5043] team0: Port device team_slave_0 added
[ 50.526503][ T5043] team0: Port device team_slave_1 added
[ 50.545555][ T5043] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 50.552604][ T5043] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 50.578542][ T5043] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 50.590157][ T5043] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 50.597167][ T5043] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 50.623499][ T5043] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 50.654058][ T5043] hsr_slave_0: entered promiscuous mode
[ 50.660427][ T5043] hsr_slave_1: entered promiscuous mode
[ 50.736466][ T5043] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 50.745729][ T5043] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 50.754873][ T5043] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 50.763760][ T5043] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 50.783386][ T5043] bridge0: port 2(bridge_slave_1) entered blocking state
[ 50.790555][ T5043] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 50.797922][ T5043] bridge0: port 1(bridge_slave_0) entered blocking state
[ 50.805011][ T5043] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 50.847521][ T5043] 8021q: adding VLAN 0 to HW filter on device bond0
[ 50.861584][ T923] bridge0: port 1(bridge_slave_0) entered disabled state
[ 50.869564][ T923] bridge0: port 2(bridge_slave_1) entered disabled state
[ 50.882248][ T5043] 8021q: adding VLAN 0 to HW filter on device team0
[ 50.895555][ T5055] bridge0: port 1(bridge_slave_0) entered blocking state
[ 50.902649][ T5055] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 50.911316][ T5055] bridge0: port 2(bridge_slave_1) entered blocking state
[ 50.918451][ T5055] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 50.962476][ T5043] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 50.993466][ T5043] veth0_vlan: entered promiscuous mode
[ 51.003904][ T5043] veth1_vlan: entered promiscuous mode
[ 51.023711][ T5043] veth0_macvtap: entered promiscuous mode
[ 51.032495][ T5043] veth1_macvtap: entered promiscuous mode
[ 51.048181][ T5043] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 51.059567][ T5043] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 51.070638][ T5043] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 51.079572][ T5043] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 51.088857][ T5043] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 51.097989][ T5043] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
executing program
[ 51.143591][ T5055] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 51.156423][ T79] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 51.159762][ T5055] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 51.165008][ T79] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 51.299498][ T5058] loop0: detected capacity change from 0 to 40427
[ 51.318303][ T5058] F2FS-fs (loop0): Found nat_bits in checkpoint
[ 51.354594][ T5058] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5
[ 51.363513][ T28] audit: type=1800 audit(1705280081.158:2): pid=5058 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor184" name="bus" dev="loop0" ino=10 res=0 errno=0
[ 51.385834][ T28] audit: type=1800 audit(1705280081.168:3): pid=5058 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor184" name="bus" dev="loop0" ino=10 res=0 errno=0
[ 51.388333][ T5058] syz-executor184: attempt to access beyond end of device
[ 51.388333][ T5058] loop0: rw=524288, sector=77824, nr_sectors = 8 limit=40427
[ 51.408089][ T28] audit: type=1800 audit(1705280081.168:4): pid=5058 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor184" name="bus" dev="loop0" ino=10 res=0 errno=0
[ 51.426310][ T5058] syz-executor184: attempt to access beyond end of device
[ 51.426310][ T5058] loop0: rw=0, sector=77824, nr_sectors = 8 limit=40427
[ 51.442675][ T28] audit: type=1800 audit(1705280081.208:5): pid=5064 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor184" name="bus" dev="loop0" ino=10 res=0 errno=0
[ 51.476280][ T5064] syz-executor184: attempt to access beyond end of device
[ 51.476280][ T5064] loop0: rw=0, sector=77824, nr_sectors = 8 limit=40427
[ 51.490683][ T5058] ==================================================================
[ 51.490718][ T5064] syz-executor184: attempt to access beyond end of device
[ 51.490718][ T5064] loop0: rw=0, sector=77824, nr_sectors = 8 limit=40427
[ 51.498785][ T5058] BUG: KASAN: slab-use-after-free in f2fs_filemap_fault+0xd1/0x2c0
[ 51.498827][ T5058] Read of size 8 at addr ffff88807bb22680 by task syz-executor184/5058
[ 51.498840][ T5058]
[ 51.498845][ T5058] CPU: 0 PID: 5058 Comm: syz-executor184 Not tainted 6.7.0-syzkaller-09928-g052d534373b7 #0
[ 51.498861][ T5058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
[ 51.498870][ T5058] Call Trace:
[ 51.498876][ T5058]
[ 51.498882][ T5058] dump_stack_lvl+0x1e7/0x2d0
[ 51.498907][ T5058] ? tcp_gro_dev_warn+0x260/0x260
[ 51.498923][ T5058] ? panic+0x850/0x850
[ 51.498943][ T5058] ? _printk+0xd5/0x120
[ 51.498962][ T5058] ? __virt_addr_valid+0x17e/0x480
[ 51.498981][ T5058] print_report+0x163/0x540
[ 51.499002][ T5058] ? __virt_addr_valid+0x17e/0x480
[ 51.499020][ T5058] ? __virt_addr_valid+0x3d1/0x480
[ 51.499044][ T5058] ? __phys_addr+0xba/0x170
[ 51.499062][ T5058] ? f2fs_filemap_fault+0xd1/0x2c0
[ 51.499080][ T5058] kasan_report+0x142/0x170
[ 51.499102][ T5058] ? f2fs_filemap_fault+0xd1/0x2c0
[ 51.499124][ T5058] f2fs_filemap_fault+0xd1/0x2c0
[ 51.499143][ T5058] __do_fault+0x131/0x450
[ 51.499165][ T5058] __handle_mm_fault+0x23b7/0x72b0
[ 51.499197][ T5058] ? handle_mm_fault+0x770/0x770
[ 51.499216][ T5058] ? rcu_is_watching+0x15/0xb0
[ 51.499238][ T5058] ? lock_acquire+0xe3/0x530
[ 51.516993][ T5064] syz-executor184: attempt to access beyond end of device
[ 51.516993][ T5064] loop0: rw=0, sector=77824, nr_sectors = 8 limit=40427
[ 51.520972][ T5058] ? read_lock_is_recursive+0x20/0x20
[ 51.529639][ T5064] syz-executor184: attempt to access beyond end of device
[ 51.529639][ T5064] loop0: rw=0, sector=77824, nr_sectors = 8 limit=40427
[ 51.531528][ T5058] ? rcu_is_watching+0x15/0xb0
[ 51.543188][ T5064] syz-executor184: attempt to access beyond end of device
[ 51.543188][ T5064] loop0: rw=0, sector=77824, nr_sectors = 8 limit=40427
[ 51.552227][ T5058] ? lock_release+0xbf/0x9c0
[ 51.552252][ T5058] ? mtree_range_walk+0x6fd/0x8d0
[ 51.552275][ T5058] ? __lock_acquire+0x1fd0/0x1fd0
[ 51.556633][ T5064] syz-executor184: attempt to access beyond end of device
[ 51.556633][ T5064] loop0: rw=0, sector=77824, nr_sectors = 8 limit=40427
[ 51.558553][ T5058] ? lock_vma_under_rcu+0x2f9/0x730
[ 51.558585][ T5058] ? lock_vma_under_rcu+0x18a/0x730
[ 51.563364][ T5064] syz-executor184: attempt to access beyond end of device
[ 51.563364][ T5064] loop0: rw=0, sector=77824, nr_sectors = 8 limit=40427
[ 51.568786][ T5058] ? mmap_write_unlock+0x160/0x160
[ 51.568809][ T5058] handle_mm_fault+0x27e/0x770
[ 51.568830][ T5058] exc_page_fault+0x456/0x870
[ 51.568852][ T5058] asm_exc_page_fault+0x26/0x30
[ 51.568873][ T5058] RIP: 0033:0x7f808e742b50
[ 51.568889][ T5058] Code: 20 bf 02 00 00 00 e8 9f 24 04 00 48 83 f8 ff 0f 84 08 fa ff ff 48 89 05 e6 65 0c 00 e9 fc f9 ff ff 66 0f 1f 84 00 00 00 00 00 04 25 40 00 00 20 66 32 66 73 c6 04 25 44 00 00 20 00 e9 0f fa
[ 51.568902][ T5058] RSP: 002b:00007f808e735170 EFLAGS: 00010246
[ 51.575232][ T5064] syz-executor184: attempt to access beyond end of device
[ 51.575232][ T5064] loop0: rw=0, sector=77824, nr_sectors = 8 limit=40427
[ 51.577162][ T5058]
[ 51.577169][ T5058] RAX: 0000000000000000 RBX: 00007f808e80b6e8 RCX: 00007f808e784fe9
[ 51.577181][ T5058] RDX: 86d0f56bab720225 RSI: 0000000000000000 RDI: 00007f808e7355a0
[ 51.831827][ T5058] RBP: 00007f808e80b6e0 R08: 0000000000000000 R09: 00007f808e7356c0
[ 51.839792][ T5058] R10: 00007f808e80b6e0 R11: 0000000000000246 R12: 00007f808e80b6ec
[ 51.847756][ T5058] R13: 0000000000000000 R14: 00007fff41e6fc30 R15: 00007fff41e6fd18
[ 51.855737][ T5058]
[ 51.858744][ T5058]
[ 51.861054][ T5058] Allocated by task 5058:
[ 51.865361][ T5058] kasan_save_track+0x3f/0x70
[ 51.870030][ T5058] __kasan_slab_alloc+0x66/0x70
[ 51.874871][ T5058] kmem_cache_alloc+0x16f/0x340
[ 51.879713][ T5058] vm_area_alloc+0x24/0x1d0
[ 51.884205][ T5058] mmap_region+0xbd8/0x1f90
[ 51.888696][ T5058] do_mmap+0x76b/0xde0
[ 51.892753][ T5058] vm_mmap_pgoff+0x1e2/0x420
[ 51.897329][ T5058] ksys_mmap_pgoff+0x4ff/0x6d0
[ 51.902086][ T5058] do_syscall_64+0xf5/0x230
[ 51.906574][ T5058] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 51.912456][ T5058]
[ 51.914768][ T5058] Freed by task 5064:
[ 51.918728][ T5058] kasan_save_track+0x3f/0x70
[ 51.923441][ T5058] kasan_save_free_info+0x4e/0x60
[ 51.928459][ T5058] poison_slab_object+0xa6/0xe0
[ 51.933296][ T5058] __kasan_slab_free+0x34/0x60
[ 51.938047][ T5058] kmem_cache_free+0x102/0x2a0
[ 51.942806][ T5058] rcu_core+0xad8/0x17c0
[ 51.947034][ T5058] __do_softirq+0x2b8/0x939
[ 51.951528][ T5058]
[ 51.953833][ T5058] Last potentially related work creation:
[ 51.959536][ T5058] kasan_save_stack+0x3f/0x60
[ 51.964205][ T5058] __kasan_record_aux_stack+0xae/0x100
[ 51.969657][ T5058] call_rcu+0x167/0xa80
[ 51.973802][ T5058] do_vmi_align_munmap+0x159d/0x1930
[ 51.979070][ T5058] do_vmi_munmap+0x24d/0x2d0
[ 51.983644][ T5058] mmap_region+0x677/0x1f90
[ 51.988137][ T5058] do_mmap+0x76b/0xde0
[ 51.992196][ T5058] vm_mmap_pgoff+0x1e2/0x420
[ 51.996772][ T5058] ksys_mmap_pgoff+0x4ff/0x6d0
[ 52.001523][ T5058] do_syscall_64+0xf5/0x230
[ 52.006028][ T5058] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 52.012340][ T5058]
[ 52.014649][ T5058] The buggy address belongs to the object at ffff88807bb22660
[ 52.014649][ T5058] which belongs to the cache vm_area_struct of size 192
[ 52.028951][ T5058] The buggy address is located 32 bytes inside of
[ 52.028951][ T5058] freed 192-byte region [ffff88807bb22660, ffff88807bb22720)
[ 52.042651][ T5058]
[ 52.044969][ T5058] The buggy address belongs to the physical page:
[ 52.051364][ T5058] page:ffffea0001eec880 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7bb22
[ 52.061502][ T5058] flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 52.069028][ T5058] page_type: 0xffffffff()
[ 52.073343][ T5058] raw: 00fff00000000800 ffff8880142a1b40 dead000000000122 0000000000000000
[ 52.081940][ T5058] raw: 0000000000000000 00000000800f000f 00000001ffffffff 0000000000000000
[ 52.090503][ T5058] page dumped because: kasan: bad access detected
[ 52.096901][ T5058] page_owner tracks the page as allocated
[ 52.102597][ T5058] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 5039, tgid 5039 (sshd), ts 50202976366, free_ts 44674399535
[ 52.120207][ T5058] post_alloc_hook+0x1e6/0x210
[ 52.124964][ T5058] get_page_from_freelist+0x33ea/0x3570
[ 52.130497][ T5058] __alloc_pages+0x255/0x680
[ 52.135074][ T5058] alloc_slab_page+0x5f/0x160
[ 52.139734][ T5058] new_slab+0x84/0x2f0
[ 52.143802][ T5058] ___slab_alloc+0xd17/0x13d0
[ 52.148463][ T5058] kmem_cache_alloc+0x249/0x340
[ 52.153303][ T5058] vm_area_dup+0x27/0x280
[ 52.157706][ T5058] copy_mm+0xd90/0x21b0
[ 52.161843][ T5058] copy_process+0x1d6f/0x3fb0
[ 52.166677][ T5058] kernel_clone+0x222/0x840
[ 52.171168][ T5058] __x64_sys_clone+0x258/0x2a0
[ 52.175919][ T5058] do_syscall_64+0xf5/0x230
[ 52.180481][ T5058] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 52.186367][ T5058] page last free pid 5037 tgid 5037 stack trace:
[ 52.192674][ T5058] free_unref_page_prepare+0x959/0xa80
[ 52.198125][ T5058] free_unref_page+0x37/0x3f0
[ 52.202786][ T5058] pipe_read+0x6ee/0x13e0
[ 52.207100][ T5058] vfs_read+0x662/0x900
[ 52.211238][ T5058] ksys_read+0x1a0/0x2c0
[ 52.215464][ T5058] do_syscall_64+0xf5/0x230
[ 52.219950][ T5058] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 52.226182][ T5058]
[ 52.228492][ T5058] Memory state around the buggy address:
[ 52.234107][ T5058] ffff88807bb22580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 52.242151][ T5058] ffff88807bb22600: 00 00 fc fc fc fc fc fc fc fc fc fc fa fb fb fb
[ 52.250720][ T5058] >ffff88807bb22680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 52.258759][ T5058] ^
[ 52.262809][ T5058] ffff88807bb22700: fb fb fb fb fc fc fc fc fc fc fc fc fc fc 00 00
[ 52.270855][ T5058] ffff88807bb22780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 52.278898][ T5058] ==================================================================
[ 52.305736][ T5058] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 52.312970][ T5058] CPU: 1 PID: 5058 Comm: syz-executor184 Not tainted 6.7.0-syzkaller-09928-g052d534373b7 #0
[ 52.323050][ T5058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
[ 52.333119][ T5058] Call Trace:
[ 52.336427][ T5058]
[ 52.339346][ T5058] dump_stack_lvl+0x1e7/0x2d0
[ 52.344019][ T5058] ? tcp_gro_dev_warn+0x260/0x260
[ 52.349044][ T5058] ? panic+0x850/0x850
[ 52.353102][ T5058] ? rcu_is_watching+0x15/0xb0
[ 52.357880][ T5058] ? vscnprintf+0x5d/0x80
[ 52.362203][ T5058] panic+0x349/0x850
[ 52.366087][ T5058] ? check_panic_on_warn+0x21/0xa0
[ 52.371185][ T5058] ? __memcpy_flushcache+0x2b0/0x2b0
[ 52.376471][ T5058] ? _raw_spin_unlock_irqrestore+0x12c/0x140
[ 52.382442][ T5058] ? _raw_spin_unlock+0x40/0x40
[ 52.387282][ T5058] ? print_report+0x4fb/0x540
[ 52.391952][ T5058] check_panic_on_warn+0x82/0xa0
[ 52.396908][ T5058] ? f2fs_filemap_fault+0xd1/0x2c0
[ 52.402006][ T5058] end_report+0x6e/0x140
[ 52.406237][ T5058] kasan_report+0x153/0x170
[ 52.410732][ T5058] ? f2fs_filemap_fault+0xd1/0x2c0
[ 52.415833][ T5058] f2fs_filemap_fault+0xd1/0x2c0
[ 52.420761][ T5058] __do_fault+0x131/0x450
[ 52.425082][ T5058] __handle_mm_fault+0x23b7/0x72b0
[ 52.430187][ T5058] ? handle_mm_fault+0x770/0x770
[ 52.435116][ T5058] ? rcu_is_watching+0x15/0xb0
[ 52.439873][ T5058] ? lock_acquire+0xe3/0x530
[ 52.444453][ T5058] ? read_lock_is_recursive+0x20/0x20
[ 52.449816][ T5058] ? rcu_is_watching+0x15/0xb0
[ 52.454571][ T5058] ? lock_release+0xbf/0x9c0
[ 52.459150][ T5058] ? mtree_range_walk+0x6fd/0x8d0
[ 52.464169][ T5058] ? __lock_acquire+0x1fd0/0x1fd0
[ 52.469180][ T5058] ? lock_vma_under_rcu+0x2f9/0x730
[ 52.474372][ T5058] ? lock_vma_under_rcu+0x18a/0x730
[ 52.479562][ T5058] ? mmap_write_unlock+0x160/0x160
[ 52.484660][ T5058] handle_mm_fault+0x27e/0x770
[ 52.489416][ T5058] exc_page_fault+0x456/0x870
[ 52.494086][ T5058] asm_exc_page_fault+0x26/0x30
[ 52.499016][ T5058] RIP: 0033:0x7f808e742b50
[ 52.503428][ T5058] Code: 20 bf 02 00 00 00 e8 9f 24 04 00 48 83 f8 ff 0f 84 08 fa ff ff 48 89 05 e6 65 0c 00 e9 fc f9 ff ff 66 0f 1f 84 00 00 00 00 00 04 25 40 00 00 20 66 32 66 73 c6 04 25 44 00 00 20 00 e9 0f fa
[ 52.523025][ T5058] RSP: 002b:00007f808e735170 EFLAGS: 00010246
[ 52.529170][ T5058] RAX: 0000000000000000 RBX: 00007f808e80b6e8 RCX: 00007f808e784fe9
[ 52.537130][ T5058] RDX: 86d0f56bab720225 RSI: 0000000000000000 RDI: 00007f808e7355a0
[ 52.545091][ T5058] RBP: 00007f808e80b6e0 R08: 0000000000000000 R09: 00007f808e7356c0
[ 52.553262][ T5058] R10: 00007f808e80b6e0 R11: 0000000000000246 R12: 00007f808e80b6ec
[ 52.561223][ T5058] R13: 0000000000000000 R14: 00007fff41e6fc30 R15: 00007fff41e6fd18
[ 52.569571][ T5058]
[ 52.572667][ T5058] Kernel Offset: disabled
[ 52.576993][ T5058] Rebooting in 86400 seconds..