DUID 00:04:ac:d3:e9:6f:d6:cf:30:00:cb:75:86:98:6a:d5:8e:9b
forked to background, child pid 3182
[ 33.282535][ T3183] 8021q: adding VLAN 0 to HW filter on device bond0
[ 33.292734][ T3183] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.0.255' (ECDSA) to the list of known hosts.
2021/12/30 05:14:33 fuzzer started
2021/12/30 05:14:33 connecting to host at 10.128.0.169:34535
2021/12/30 05:14:33 checking machine...
2021/12/30 05:14:33 checking revisions...
2021/12/30 05:14:33 testing simple program...
syzkaller login: [ 49.578043][ T3606] cgroup: Unknown subsys name 'net'
[ 49.682885][ T3606] cgroup: Unknown subsys name 'rlimit'
[ 51.025980][ T3610] chnl_net:caif_netlink_parms(): no params data found
[ 51.070688][ T3610] bridge0: port 1(bridge_slave_0) entered blocking state
[ 51.078501][ T3610] bridge0: port 1(bridge_slave_0) entered disabled state
[ 51.087104][ T3610] device bridge_slave_0 entered promiscuous mode
[ 51.096406][ T3610] bridge0: port 2(bridge_slave_1) entered blocking state
[ 51.103512][ T3610] bridge0: port 2(bridge_slave_1) entered disabled state
[ 51.111418][ T3610] device bridge_slave_1 entered promiscuous mode
[ 51.131713][ T3610] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 51.143115][ T3610] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 51.166654][ T3610] team0: Port device team_slave_0 added
[ 51.174396][ T3610] team0: Port device team_slave_1 added
[ 51.192662][ T3610] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 51.199771][ T3610] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 51.225703][ T3610] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 51.238316][ T3610] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 51.245397][ T3610] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 51.271374][ T3610] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 51.298041][ T3610] device hsr_slave_0 entered promiscuous mode
[ 51.305015][ T3610] device hsr_slave_1 entered promiscuous mode
[ 51.387513][ T3610] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 51.398099][ T3610] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 51.407755][ T3610] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 51.416681][ T3610] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 51.438446][ T3610] bridge0: port 2(bridge_slave_1) entered blocking state
[ 51.445650][ T3610] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 51.453287][ T3610] bridge0: port 1(bridge_slave_0) entered blocking state
[ 51.460387][ T3610] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 51.506866][ T3610] 8021q: adding VLAN 0 to HW filter on device bond0
[ 51.519849][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 51.530113][ T5] bridge0: port 1(bridge_slave_0) entered disabled state
[ 51.539218][ T5] bridge0: port 2(bridge_slave_1) entered disabled state
[ 51.548645][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 51.561760][ T3610] 8021q: adding VLAN 0 to HW filter on device team0
[ 51.573435][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 51.582397][ T25] bridge0: port 1(bridge_slave_0) entered blocking state
[ 51.589519][ T25] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 51.600891][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 51.609837][ T5] bridge0: port 2(bridge_slave_1) entered blocking state
[ 51.616989][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 51.636947][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 51.647626][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 51.663121][ T3610] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[ 51.675776][ T3610] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 51.688786][ T3620] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 51.697255][ T3620] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 51.706696][ T3620] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 51.716504][ T3620] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 51.732498][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 51.740444][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 51.752101][ T3610] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 51.770316][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 51.790775][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 51.799287][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 51.808015][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 51.818624][ T3610] device veth0_vlan entered promiscuous mode
[ 51.830454][ T3610] device veth1_vlan entered promiscuous mode
[ 51.849757][ T3620] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 51.857920][ T3620] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 51.866569][ T3620] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 51.878870][ T3610] device veth0_macvtap entered promiscuous mode
[ 51.888738][ T3610] device veth1_macvtap entered promiscuous mode
[ 51.904949][ T3610] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 51.913227][ T3620] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 51.922571][ T3620] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 51.934557][ T3610] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 51.943050][ T3620] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 51.954612][ T3610] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 51.964389][ T3610] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 51.973366][ T3610] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 51.982414][ T3610] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 52.049158][ T44] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 52.066695][ T44] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 52.077750][ T3622] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 52.087769][ T44] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 52.096078][ T44] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 52.105235][ T3608] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
2021/12/30 05:14:36 building call list...
[ 52.347549][ T8] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
executing program
[ 54.385953][ T3598] can: request_module (can-proto-0) failed.
[ 54.408285][ T3598] can: request_module (can-proto-0) failed.
[ 54.428880][ T3598] can: request_module (can-proto-0) failed.
[ 54.624586][ T3598] ------------[ cut here ]------------
[ 54.630705][ T3598] refcount_t: decrement hit 0; leaking memory.
[ 54.637415][ T3598] WARNING: CPU: 1 PID: 3598 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0
[ 54.647414][ T3598] Modules linked in:
[ 54.651307][ T3598] CPU: 1 PID: 3598 Comm: syz-fuzzer Not tainted 5.16.0-rc4-syzkaller #0
[ 54.659979][ T3598] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 54.670445][ T3598] RIP: 0010:refcount_warn_saturate+0xbf/0x1e0
[ 54.677296][ T3598] Code: 1d d1 d6 a0 09 31 ff 89 de e8 5d 65 9b fd 84 db 75 e0 e8 74 61 9b fd 48 c7 c7 20 0b 05 8a c6 05 b1 d6 a0 09 01 e8 cc 56 27 05 <0f> 0b eb c4 e8 58 61 9b fd 0f b6 1d a0 d6 a0 09 31 ff 89 de e8 28
[ 54.698303][ T3598] RSP: 0018:ffffc90001a9fab0 EFLAGS: 00010286
[ 54.704406][ T3598] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 54.712434][ T3598] RDX: ffff88807d603a00 RSI: ffffffff815f1e28 RDI: fffff52000353f48
[ 54.720496][ T3598] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
[ 54.728701][ T3598] R10: ffffffff815ebbce R11: 0000000000000000 R12: 1ffff92000353f5b
[ 54.736762][ T3598] R13: 00000000ffffffef R14: ffffffff8d2fdf54 R15: ffffc90001a9fd10
[ 54.744777][ T3598] FS: 000000c000030490(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
[ 54.753903][ T3598] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 54.760559][ T3598] CR2: 00007fa90d0b7300 CR3: 0000000074ce6000 CR4: 00000000003506f0
[ 54.769142][ T3598] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 54.777521][ T3598] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 54.785830][ T3598] Call Trace:
[ 54.789124][ T3598]
[ 54.792138][ T3598] ref_tracker_free+0x4fe/0x610
[ 54.797386][ T3598] ? ref_tracker_dir_exit+0x330/0x330
[ 54.802838][ T3598] ? bpf_sk_storage_free+0x333/0x3e0
[ 54.808311][ T3598] ? lock_downgrade+0x6e0/0x6e0
[ 54.813192][ T3598] ? kfree+0x1e1/0x560
[ 54.817722][ T3598] __sk_destruct+0x4a6/0x920
[ 54.822330][ T3598] sk_destruct+0xbd/0xe0
[ 54.826770][ T3598] __sk_free+0xef/0x3d0
[ 54.830945][ T3598] sk_free+0x78/0xa0
[ 54.834829][ T3598] __mptcp_close_ssk+0x435/0x590
[ 54.839849][ T3598] __mptcp_destroy_sock+0x35f/0x830
[ 54.845124][ T3598] ? __mptcp_close_ssk+0x590/0x590
[ 54.850295][ T3598] ? __local_bh_enable_ip+0xa0/0x120
[ 54.855984][ T3598] mptcp_close+0x5f8/0x7f0
[ 54.860795][ T3598] inet_release+0x12e/0x280
[ 54.865807][ T3598] inet6_release+0x4c/0x70
[ 54.870277][ T3598] __sock_release+0xcd/0x280
[ 54.875686][ T3598] sock_close+0x18/0x20
[ 54.876127][ T8] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 54.879885][ T3598] __fput+0x286/0x9f0
[ 54.894849][ T3598] ? __sock_release+0x280/0x280
[ 54.900012][ T3598] task_work_run+0xdd/0x1a0
[ 54.904541][ T3598] exit_to_user_mode_prepare+0x27e/0x290
[ 54.910317][ T3598] syscall_exit_to_user_mode+0x19/0x60
[ 54.915988][ T3598] do_syscall_64+0x42/0xb0
[ 54.920401][ T3598] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 54.926448][ T3598] RIP: 0033:0x4b12db
[ 54.930350][ T3598] Code: fb ff eb bd e8 46 96 fb ff e9 61 ff ff ff cc e8 fb 61 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30
[ 54.950295][ T3598] RSP: 002b:000000c0002d94f0 EFLAGS: 00000206 ORIG_RAX: 0000000000000003
[ 54.958883][ T3598] RAX: 0000000000000000 RBX: 000000c00001e000 RCX: 00000000004b12db
[ 54.966927][ T3598] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006
[ 54.974890][ T3598] RBP: 000000c0002d9530 R08: 0000000000f0e801 R09: 00007fff91990080
[ 54.983086][ T3598] R10: 00007fff91990090 R11: 0000000000000206 R12: 0000000000000081
[ 54.991136][ T3598] R13: 0000000000000000 R14: ffffffffffffffff R15: 000000c000326000
[ 55.000025][ T3598]
[ 55.003152][ T3598] Kernel panic - not syncing: panic_on_warn set ...
[ 55.009725][ T3598] CPU: 1 PID: 3598 Comm: syz-fuzzer Not tainted 5.16.0-rc4-syzkaller #0
[ 55.018030][ T3598] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 55.028077][ T3598] Call Trace:
[ 55.031347][ T3598]
[ 55.034268][ T3598] dump_stack_lvl+0xcd/0x134
[ 55.038859][ T3598] panic+0x2b0/0x6dd
[ 55.042753][ T3598] ? __warn_printk+0xf3/0xf3
[ 55.047347][ T3598] ? __warn.cold+0x1a/0x44
[ 55.051755][ T3598] ? refcount_warn_saturate+0xbf/0x1e0
[ 55.057206][ T3598] __warn.cold+0x35/0x44
[ 55.061436][ T3598] ? wake_up_klogd.part.0+0x8e/0xd0
[ 55.066622][ T3598] ? refcount_warn_saturate+0xbf/0x1e0
[ 55.072069][ T3598] report_bug+0x1bd/0x210
[ 55.076391][ T3598] handle_bug+0x3c/0x60
[ 55.080533][ T3598] exc_invalid_op+0x14/0x40
[ 55.085022][ T3598] asm_exc_invalid_op+0x12/0x20
[ 55.089878][ T3598] RIP: 0010:refcount_warn_saturate+0xbf/0x1e0
[ 55.095929][ T3598] Code: 1d d1 d6 a0 09 31 ff 89 de e8 5d 65 9b fd 84 db 75 e0 e8 74 61 9b fd 48 c7 c7 20 0b 05 8a c6 05 b1 d6 a0 09 01 e8 cc 56 27 05 <0f> 0b eb c4 e8 58 61 9b fd 0f b6 1d a0 d6 a0 09 31 ff 89 de e8 28
[ 55.115522][ T3598] RSP: 0018:ffffc90001a9fab0 EFLAGS: 00010286
[ 55.121576][ T3598] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 55.129529][ T3598] RDX: ffff88807d603a00 RSI: ffffffff815f1e28 RDI: fffff52000353f48
[ 55.137486][ T3598] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
[ 55.145439][ T3598] R10: ffffffff815ebbce R11: 0000000000000000 R12: 1ffff92000353f5b
[ 55.153392][ T3598] R13: 00000000ffffffef R14: ffffffff8d2fdf54 R15: ffffc90001a9fd10
[ 55.161364][ T3598] ? wake_up_klogd.part.0+0x8e/0xd0
[ 55.166564][ T3598] ? vprintk+0x88/0x90
[ 55.170625][ T3598] ref_tracker_free+0x4fe/0x610
[ 55.175465][ T3598] ? ref_tracker_dir_exit+0x330/0x330
[ 55.180826][ T3598] ? bpf_sk_storage_free+0x333/0x3e0
[ 55.186104][ T3598] ? lock_downgrade+0x6e0/0x6e0
[ 55.190944][ T3598] ? kfree+0x1e1/0x560
[ 55.195008][ T3598] __sk_destruct+0x4a6/0x920
[ 55.199604][ T3598] sk_destruct+0xbd/0xe0
[ 55.203838][ T3598] __sk_free+0xef/0x3d0
[ 55.207984][ T3598] sk_free+0x78/0xa0
[ 55.211866][ T3598] __mptcp_close_ssk+0x435/0x590
[ 55.216796][ T3598] __mptcp_destroy_sock+0x35f/0x830
[ 55.221997][ T3598] ? __mptcp_close_ssk+0x590/0x590
[ 55.227109][ T3598] ? __local_bh_enable_ip+0xa0/0x120
[ 55.232392][ T3598] mptcp_close+0x5f8/0x7f0
[ 55.236804][ T3598] inet_release+0x12e/0x280
[ 55.241303][ T3598] inet6_release+0x4c/0x70
[ 55.245716][ T3598] __sock_release+0xcd/0x280
[ 55.250308][ T3598] sock_close+0x18/0x20
[ 55.254447][ T3598] __fput+0x286/0x9f0
[ 55.258417][ T3598] ? __sock_release+0x280/0x280
[ 55.263254][ T3598] task_work_run+0xdd/0x1a0
[ 55.267748][ T3598] exit_to_user_mode_prepare+0x27e/0x290
[ 55.273368][ T3598] syscall_exit_to_user_mode+0x19/0x60
[ 55.278812][ T3598] do_syscall_64+0x42/0xb0
[ 55.283210][ T3598] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 55.289095][ T3598] RIP: 0033:0x4b12db
[ 55.292971][ T3598] Code: fb ff eb bd e8 46 96 fb ff e9 61 ff ff ff cc e8 fb 61 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30
[ 55.312565][ T3598] RSP: 002b:000000c0002d94f0 EFLAGS: 00000206 ORIG_RAX: 0000000000000003
[ 55.320963][ T3598] RAX: 0000000000000000 RBX: 000000c00001e000 RCX: 00000000004b12db
[ 55.328917][ T3598] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006
[ 55.336869][ T3598] RBP: 000000c0002d9530 R08: 0000000000f0e801 R09: 00007fff91990080
[ 55.344823][ T3598] R10: 00007fff91990090 R11: 0000000000000206 R12: 0000000000000081
[ 55.352778][ T3598] R13: 0000000000000000 R14: ffffffffffffffff R15: 000000c000326000
[ 55.360750][ T3598]
[ 55.364156][ T3598] Kernel Offset: disabled
[ 55.368569][ T3598] Rebooting in 86400 seconds..