Warning: Permanently added '10.128.10.43' (ECDSA) to the list of known hosts.
2021/12/15 17:34:56 fuzzer started
2021/12/15 17:34:56 connecting to host at 10.128.0.169:34975
2021/12/15 17:34:56 checking machine...
2021/12/15 17:34:56 checking revisions...
2021/12/15 17:34:56 testing simple program...
syzkaller login: [   49.797505][ T3603] cgroup: Unknown subsys name 'net'
[   49.902472][ T3603] cgroup: Unknown subsys name 'rlimit'
[   51.171565][ T3607] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   51.179927][ T3607] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   51.188137][ T3607] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   51.195824][ T3607] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   51.203453][ T3607] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[   51.211107][ T3607] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   51.294952][ T3605] chnl_net:caif_netlink_parms(): no params data found
[   51.338835][ T3605] bridge0: port 1(bridge_slave_0) entered blocking state
[   51.346365][ T3605] bridge0: port 1(bridge_slave_0) entered disabled state
[   51.354991][ T3605] device bridge_slave_0 entered promiscuous mode
[   51.364064][ T3605] bridge0: port 2(bridge_slave_1) entered blocking state
[   51.371169][ T3605] bridge0: port 2(bridge_slave_1) entered disabled state
[   51.379131][ T3605] device bridge_slave_1 entered promiscuous mode
[   51.399111][ T3605] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   51.410330][ T3605] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   51.432158][ T3605] team0: Port device team_slave_0 added
[   51.439646][ T3605] team0: Port device team_slave_1 added
[   51.458042][ T3605] batman_adv: batadv0: Adding interface: batadv_slave_0
[   51.465213][ T3605] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   51.491509][ T3605] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   51.505518][ T3605] batman_adv: batadv0: Adding interface: batadv_slave_1
[   51.512466][ T3605] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   51.538755][ T3605] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   51.564375][ T3605] device hsr_slave_0 entered promiscuous mode
[   51.571468][ T3605] device hsr_slave_1 entered promiscuous mode
[   51.649373][ T3605] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   51.659596][ T3605] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   51.669756][ T3605] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   51.678800][ T3605] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   51.699097][ T3605] bridge0: port 2(bridge_slave_1) entered blocking state
[   51.706293][ T3605] bridge0: port 2(bridge_slave_1) entered forwarding state
[   51.714038][ T3605] bridge0: port 1(bridge_slave_0) entered blocking state
[   51.721275][ T3605] bridge0: port 1(bridge_slave_0) entered forwarding state
[   51.767364][ T3605] 8021q: adding VLAN 0 to HW filter on device bond0
[   51.779677][  T140] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[   51.790663][  T140] bridge0: port 1(bridge_slave_0) entered disabled state
[   51.799422][  T140] bridge0: port 2(bridge_slave_1) entered disabled state
[   51.807274][  T140] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[   51.820174][ T3605] 8021q: adding VLAN 0 to HW filter on device team0
[   51.831345][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[   51.839904][    T5] bridge0: port 1(bridge_slave_0) entered blocking state
[   51.847079][    T5] bridge0: port 1(bridge_slave_0) entered forwarding state
[   51.858652][  T140] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[   51.867076][  T140] bridge0: port 2(bridge_slave_1) entered blocking state
[   51.874162][  T140] bridge0: port 2(bridge_slave_1) entered forwarding state
[   51.894379][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[   51.914010][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[   51.922228][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[   51.931288][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[   51.939909][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[   51.951437][ T3605] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[   51.973008][  T140] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[   51.981394][  T140] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[   51.998369][ T3605] 8021q: adding VLAN 0 to HW filter on device batadv0
[   52.022094][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[   52.044714][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[   52.053725][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[   52.061555][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[   52.072272][ T3605] device veth0_vlan entered promiscuous mode
[   52.088324][ T3605] device veth1_vlan entered promiscuous mode
[   52.108419][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[   52.117056][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[   52.125481][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[   52.137591][ T3605] device veth0_macvtap entered promiscuous mode
[   52.148418][ T3605] device veth1_macvtap entered promiscuous mode
[   52.165559][ T3605] batman_adv: batadv0: Interface activated: batadv_slave_0
[   52.173009][  T140] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[   52.182246][  T140] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[   52.194096][ T3605] batman_adv: batadv0: Interface activated: batadv_slave_1
[   52.202341][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[   52.214784][ T3605] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   52.223797][ T3605] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   52.232471][ T3605] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   52.241456][ T3605] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   52.302698][ T1035] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   52.318887][ T1035] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   52.330397][ T3615] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[   52.340326][ T1035] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   52.348977][ T1035] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   52.358338][ T3615] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
2021/12/15 17:34:59 building call list...
[   52.615858][ T1035] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
executing program
[   54.456188][ T3597] can: request_module (can-proto-0) failed.
[   54.479362][ T3597] can: request_module (can-proto-0) failed.
[   54.500391][ T3597] can: request_module (can-proto-0) failed.
[   54.701873][ T3597] ------------[ cut here ]------------
[   54.707893][ T3597] refcount_t: decrement hit 0; leaking memory.
[   54.714762][ T3597] WARNING: CPU: 1 PID: 3597 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0
[   54.714830][ T3597] Modules linked in:
[   54.714845][ T3597] CPU: 1 PID: 3597 Comm: syz-fuzzer Not tainted 5.16.0-rc5-next-20211214-syzkaller #0
[   54.714871][ T3597] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   54.714885][ T3597] RIP: 0010:refcount_warn_saturate+0xbf/0x1e0
[   54.754023][ T3597] Code: 1d 06 e6 95 09 31 ff 89 de e8 4d f8 8f fd 84 db 75 e0 e8 64 f4 8f fd 48 c7 c7 a0 4d 05 8a c6 05 e6 e5 95 09 01 e8 26 ac 28 05 <0f> 0b eb c4 e8 48 f4 8f fd 0f b6 1d d5 e5 95 09 31 ff 89 de e8 18
[   54.774401][ T3597] RSP: 0018:ffffc90001f7fab8 EFLAGS: 00010282
[   54.780836][ T3597] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[   54.789115][ T3597] RDX: ffff88807d7dd7c0 RSI: ffffffff815f4648 RDI: fffff520003eff49
[   54.797259][ T3597] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
[   54.805879][ T3597] R10: ffffffff815ee3ae R11: 0000000000000000 R12: 1ffff920003eff5c
[   54.814008][ T3597] R13: 00000000ffffffef R14: ffffffff8d309554 R15: ffffc90001f7fd10
[   54.821995][ T3597] FS:  000000c000030890(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
[   54.830996][ T3597] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   54.837768][ T3597] CR2: 00007fc2c7f1c300 CR3: 000000007f0e9000 CR4: 00000000003506f0
[   54.845812][ T3597] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   54.854357][ T3597] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   54.862331][ T3597] Call Trace:
[   54.865745][ T3597]  <TASK>
[   54.868679][ T3597]  ref_tracker_free+0x4fe/0x610
[   54.873633][ T3597]  ? ref_tracker_dir_exit+0x330/0x330
[   54.879017][ T3597]  ? bpf_sk_storage_free+0x333/0x3e0
[   54.884379][ T3597]  ? lock_downgrade+0x6e0/0x6e0
[   54.889260][ T3597]  ? kfree+0x1ea/0x4b0
[   54.893556][ T3597]  __sk_destruct+0x3cd/0x710
[   54.898170][ T3597]  sk_destruct+0xbd/0xe0
[   54.902409][ T3597]  __sk_free+0xef/0x3d0
[   54.906620][ T3597]  sk_free+0x78/0xa0
[   54.910531][ T3597]  __mptcp_close_ssk+0x435/0x590
[   54.915772][ T3597]  __mptcp_destroy_sock+0x35f/0x830
[   54.920986][ T3597]  ? __mptcp_close_ssk+0x590/0x590
[   54.926440][ T3597]  ? __local_bh_enable_ip+0xa0/0x120
[   54.931741][ T3597]  mptcp_close+0x5f8/0x7f0
[   54.937174][ T3597]  inet_release+0x12e/0x280
[   54.941686][ T3597]  inet6_release+0x4c/0x70
[   54.946392][ T3597]  __sock_release+0xcd/0x280
[   54.950987][ T3597]  sock_close+0x18/0x20
[   54.956077][ T3597]  __fput+0x286/0x9f0
[   54.960066][ T3597]  ? __sock_release+0x280/0x280
[   54.965204][ T3597]  task_work_run+0xdd/0x1a0
[   54.969718][ T3597]  exit_to_user_mode_prepare+0x27e/0x290
[   54.976320][ T3597]  syscall_exit_to_user_mode+0x19/0x60
[   54.982194][ T3597]  do_syscall_64+0x42/0xb0
[   54.986882][ T3597]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[   54.992966][ T3597] RIP: 0033:0x4b12db
[   54.997905][ T3597] Code: fb ff eb bd e8 46 96 fb ff e9 61 ff ff ff cc e8 fb 61 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30
[   55.018927][ T3597] RSP: 002b:000000c0004414f0 EFLAGS: 00000206 ORIG_RAX: 0000000000000003
[   55.027506][ T3597] RAX: 0000000000000000 RBX: 000000c000020800 RCX: 00000000004b12db
[   55.035536][ T3597] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006
[   55.043654][ T3597] RBP: 000000c000441530 R08: 0000000000f0ae01 R09: 00007fffa8bce080
[   55.051632][ T3597] R10: 00007fffa8bce090 R11: 0000000000000206 R12: 0000000000000007
[   55.059677][ T3597] R13: 0000000000000000 R14: ffffffffffffffff R15: 000000c0000a6460
[   55.067685][ T3597]  </TASK>
[   55.070695][ T3597] Kernel panic - not syncing: panic_on_warn set ...
[   55.077260][ T3597] CPU: 0 PID: 3597 Comm: syz-fuzzer Not tainted 5.16.0-rc5-next-20211214-syzkaller #0
[   55.086829][ T3597] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   55.096970][ T3597] Call Trace:
[   55.100297][ T3597]  <TASK>
[   55.103224][ T3597]  dump_stack_lvl+0xcd/0x134
[   55.107819][ T3597]  panic+0x2b0/0x6dd
[   55.111704][ T3597]  ? __warn_printk+0xf3/0xf3
[   55.116284][ T3597]  ? __warn.cold+0x1d1/0x2cf
[   55.120988][ T3597]  ? refcount_warn_saturate+0xbf/0x1e0
[   55.126454][ T3597]  __warn.cold+0x1ec/0x2cf
[   55.130872][ T3597]  ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70
[   55.137128][ T3597]  ? refcount_warn_saturate+0xbf/0x1e0
[   55.142693][ T3597]  report_bug+0x1bd/0x210
[   55.147025][ T3597]  handle_bug+0x3c/0x60
[   55.151259][ T3597]  exc_invalid_op+0x14/0x40
[   55.155750][ T3597]  asm_exc_invalid_op+0x12/0x20
[   55.160593][ T3597] RIP: 0010:refcount_warn_saturate+0xbf/0x1e0
[   55.166668][ T3597] Code: 1d 06 e6 95 09 31 ff 89 de e8 4d f8 8f fd 84 db 75 e0 e8 64 f4 8f fd 48 c7 c7 a0 4d 05 8a c6 05 e6 e5 95 09 01 e8 26 ac 28 05 <0f> 0b eb c4 e8 48 f4 8f fd 0f b6 1d d5 e5 95 09 31 ff 89 de e8 18
[   55.186476][ T3597] RSP: 0018:ffffc90001f7fab8 EFLAGS: 00010282
[   55.192531][ T3597] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[   55.200487][ T3597] RDX: ffff88807d7dd7c0 RSI: ffffffff815f4648 RDI: fffff520003eff49
[   55.208445][ T3597] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
[   55.216570][ T3597] R10: ffffffff815ee3ae R11: 0000000000000000 R12: 1ffff920003eff5c
[   55.224538][ T3597] R13: 00000000ffffffef R14: ffffffff8d309554 R15: ffffc90001f7fd10
[   55.232506][ T3597]  ? wake_up_klogd.part.0+0x8e/0xd0
[   55.237709][ T3597]  ? vprintk+0x88/0x90
[   55.241775][ T3597]  ? refcount_warn_saturate+0xbf/0x1e0
[   55.247228][ T3597]  ref_tracker_free+0x4fe/0x610
[   55.252067][ T3597]  ? ref_tracker_dir_exit+0x330/0x330
[   55.257423][ T3597]  ? bpf_sk_storage_free+0x333/0x3e0
[   55.262704][ T3597]  ? lock_downgrade+0x6e0/0x6e0
[   55.267545][ T3597]  ? kfree+0x1ea/0x4b0
[   55.271616][ T3597]  __sk_destruct+0x3cd/0x710
[   55.276200][ T3597]  sk_destruct+0xbd/0xe0
[   55.280437][ T3597]  __sk_free+0xef/0x3d0
[   55.284589][ T3597]  sk_free+0x78/0xa0
[   55.288489][ T3597]  __mptcp_close_ssk+0x435/0x590
[   55.293455][ T3597]  __mptcp_destroy_sock+0x35f/0x830
[   55.298756][ T3597]  ? __mptcp_close_ssk+0x590/0x590
[   55.303861][ T3597]  ? __local_bh_enable_ip+0xa0/0x120
[   55.309149][ T3597]  mptcp_close+0x5f8/0x7f0
[   55.313568][ T3597]  inet_release+0x12e/0x280
[   55.318089][ T3597]  inet6_release+0x4c/0x70
[   55.322496][ T3597]  __sock_release+0xcd/0x280
[   55.327081][ T3597]  sock_close+0x18/0x20
[   55.331229][ T3597]  __fput+0x286/0x9f0
[   55.335208][ T3597]  ? __sock_release+0x280/0x280
[   55.340059][ T3597]  task_work_run+0xdd/0x1a0
[   55.344557][ T3597]  exit_to_user_mode_prepare+0x27e/0x290
[   55.350182][ T3597]  syscall_exit_to_user_mode+0x19/0x60
[   55.355635][ T3597]  do_syscall_64+0x42/0xb0
[   55.360042][ T3597]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[   55.365928][ T3597] RIP: 0033:0x4b12db
[   55.369808][ T3597] Code: fb ff eb bd e8 46 96 fb ff e9 61 ff ff ff cc e8 fb 61 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30
[   55.389407][ T3597] RSP: 002b:000000c0004414f0 EFLAGS: 00000206 ORIG_RAX: 0000000000000003
[   55.397812][ T3597] RAX: 0000000000000000 RBX: 000000c000020800 RCX: 00000000004b12db
[   55.405873][ T3597] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006
[   55.413839][ T3597] RBP: 000000c000441530 R08: 0000000000f0ae01 R09: 00007fffa8bce080
[   55.421816][ T3597] R10: 00007fffa8bce090 R11: 0000000000000206 R12: 0000000000000007
[   55.429774][ T3597] R13: 0000000000000000 R14: ffffffffffffffff R15: 000000c0000a6460
[   55.437743][ T3597]  </TASK>
[   55.441127][ T3597] Kernel Offset: disabled
[   55.445533][ T3597] Rebooting in 86400 seconds..