Warning: Permanently added '10.128.1.30' (ED25519) to the list of known hosts. 1970/01/01 00:00:30 parsed 1 programs 1970/01/01 00:00:30 serving rpc on tcp://41001 syzkaller login: [ 31.654929][ T4343] cgroup: Unknown subsys name 'net' [ 31.920472][ T4343] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 32.211376][ T4343] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 36.069908][ T4364] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 36.071699][ T4364] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 36.073256][ T4364] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 36.074972][ T4364] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 36.076704][ T4364] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 36.079182][ T4364] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 36.179168][ T56] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 36.180844][ T56] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 36.182648][ T1591] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 36.192026][ T56] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 36.193555][ T56] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 36.195212][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 36.764787][ T4394] rxe_eth0 speed is unknown, defaulting to 1000 [ 36.766512][ T4394] rxe_eth0 speed is unknown, defaulting to 1000 [ 36.768385][ T4394] rxe_eth0 speed is unknown, defaulting to 1000 [ 36.794112][ T4394] infiniband rxe0: set active [ 36.795497][ T4394] infiniband rxe0: added rxe_eth0 [ 36.796530][ T2373] rxe_eth0 speed is unknown, defaulting to 1000 [ 36.811172][ T4394] RDS/IB: rxe0: added [ 36.812085][ T4394] smc: adding ib device rxe0 with port count 1 [ 36.813345][ T4394] smc: ib device rxe0 port 1 has pnetid [ 36.814807][ T113] rxe_eth0 speed is unknown, defaulting to 1000 [ 36.818999][ T4394] rxe_eth0 speed is unknown, defaulting to 1000 [ 36.836077][ T4394] rxe_eth0 speed is unknown, defaulting to 1000 [ 36.853420][ T4394] rxe_eth0 speed is unknown, defaulting to 1000 [ 36.869839][ T4394] rxe_eth0 speed is unknown, defaulting to 1000 [ 36.886971][ T4394] rxe_eth0 speed is unknown, defaulting to 1000 [ 36.903984][ T4394] rxe_eth0 speed is unknown, defaulting to 1000 [ 36.920621][ T4394] rxe_eth0 speed is unknown, defaulting to 1000 [ 36.937485][ T4394] rxe_eth0 speed is unknown, defaulting to 1000 [ 36.954791][ T4394] rxe_eth0 speed is unknown, defaulting to 1000 [ 36.977461][ T4394] rxe_eth0 speed is unknown, defaulting to 1000 [ 37.023590][ T4394] chnl_net:caif_netlink_parms(): no params data found [ 37.040701][ T4394] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.042045][ T4394] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.043858][ T4394] device bridge_slave_0 entered promiscuous mode [ 37.046412][ T4394] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.047761][ T4394] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.050247][ T4394] device bridge_slave_1 entered promiscuous mode [ 37.056421][ T4394] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.059199][ T4394] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 37.066094][ T4394] team0: Port device team_slave_0 added [ 37.068022][ T4394] team0: Port device team_slave_1 added [ 37.073408][ T4394] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 37.074852][ T4394] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.080446][ T4394] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 37.083286][ T4394] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 37.084799][ T4394] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.090781][ T4394] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.159400][ T4394] device hsr_slave_0 entered promiscuous mode [ 37.208118][ T4394] device hsr_slave_1 entered promiscuous mode [ 37.294701][ T4394] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 37.319821][ T4394] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 37.357945][ T4394] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 37.407653][ T4394] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 37.492095][ T4394] 8021q: adding VLAN 0 to HW filter on device bond0 [ 37.496031][ T4428] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 37.499671][ T4428] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 37.502877][ T4394] 8021q: adding VLAN 0 to HW filter on device team0 [ 37.505495][ T4428] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 37.507312][ T4428] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 37.512672][ T4428] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.514113][ T4428] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.516016][ T4428] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 37.529824][ T4428] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 37.531775][ T4428] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 37.533507][ T4428] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.534827][ T4428] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.537393][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 37.541610][ T4428] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 37.544647][ T4428] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 37.546804][ T4428] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 37.549440][ T4428] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 37.552309][ T4428] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 37.554104][ T4428] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 37.556723][ T4428] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 37.559574][ T4428] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 37.562685][ T4428] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 37.564372][ T4428] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 37.567055][ T4394] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 37.633158][ T1591] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 37.634784][ T1591] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 37.639451][ T4394] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 37.645316][ T1591] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 37.661657][ T1591] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 37.663612][ T1591] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 37.665297][ T1591] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 37.667721][ T4394] device veth0_vlan entered promiscuous mode [ 37.671892][ T4394] device veth1_vlan entered promiscuous mode [ 37.678705][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 37.680528][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 37.682389][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 37.684950][ T4394] device veth0_macvtap entered promiscuous mode [ 37.689091][ T4394] device veth1_macvtap entered promiscuous mode [ 37.700653][ T4394] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 37.702202][ T1591] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 37.704121][ T1591] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 37.706007][ T1591] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 37.714881][ T4394] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 37.716495][ T1591] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 37.719476][ T1591] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 37.727741][ T4394] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.730609][ T4394] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.732428][ T4394] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 37.734199][ T4394] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.087394][ T4440] rxe_eth0 speed is unknown, defaulting to 1000 [ 38.502713][ T4444] rxe_eth0 speed is unknown, defaulting to 1000 [ 38.659082][ T4450] rxe_eth0 speed is unknown, defaulting to 1000 [ 38.783103][ T4455] rxe_eth0 speed is unknown, defaulting to 1000 [ 39.097985][ T4459] rxe_eth0 speed is unknown, defaulting to 1000 1970/01/01 00:00:39 executed programs: 0 [ 39.336292][ T48] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 39.338354][ T48] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 39.340245][ T48] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 39.342004][ T48] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 39.343617][ T48] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 39.345266][ T48] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 39.357195][ T4463] rxe_eth0 speed is unknown, defaulting to 1000 [ 39.405184][ T4463] chnl_net:caif_netlink_parms(): no params data found [ 39.419496][ T4463] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.421085][ T4463] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.422821][ T4463] device bridge_slave_0 entered promiscuous mode [ 39.424976][ T4463] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.426460][ T4463] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.428663][ T4463] device bridge_slave_1 entered promiscuous mode [ 39.434649][ T4463] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 39.438688][ T4463] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 39.445013][ T4463] team0: Port device team_slave_0 added [ 39.446953][ T4463] team0: Port device team_slave_1 added [ 39.452865][ T4463] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 39.454256][ T4463] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 39.460097][ T4463] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 39.462960][ T4463] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 39.464375][ T4463] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 39.469894][ T4463] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 39.519057][ T4463] device hsr_slave_0 entered promiscuous mode [ 39.558109][ T4463] device hsr_slave_1 entered promiscuous mode [ 39.598007][ T4463] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 39.599602][ T4463] Cannot create hsr debugfs directory [ 39.709778][ T4463] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.358180][ T48] Bluetooth: hci0: command 0x0409 tx timeout [ 43.308984][ T4463] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 43.389108][ T4463] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 43.437953][ T48] Bluetooth: hci0: command 0x041b tx timeout [ 43.509929][ T4463] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 43.770507][ T4463] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 43.859727][ T4463] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 43.908993][ T4463] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 44.000602][ T4463] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 44.116953][ T4463] 8021q: adding VLAN 0 to HW filter on device bond0 [ 44.120765][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 44.122607][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 44.125201][ T4463] 8021q: adding VLAN 0 to HW filter on device team0 [ 44.127745][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 44.130502][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 44.132343][ T4446] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.133842][ T4446] bridge0: port 1(bridge_slave_0) entered forwarding state [ 44.135662][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 44.170714][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 44.172627][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 44.174564][ T4446] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.176123][ T4446] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.178913][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 44.181744][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 44.184566][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 44.186616][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 44.188526][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 44.191343][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 44.193619][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 44.196364][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 44.199208][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 44.202125][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 44.203927][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 44.206496][ T4463] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 44.296023][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 44.297651][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 44.302852][ T4463] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 44.310630][ T4428] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 44.312611][ T4428] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 44.323624][ T1591] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 44.325545][ T1591] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 44.328739][ T1591] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 44.330770][ T1591] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 44.332655][ T4463] device veth0_vlan entered promiscuous mode [ 44.336384][ T4463] device veth1_vlan entered promiscuous mode [ 44.343949][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 44.345657][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 44.347443][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 44.349939][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 44.359811][ T4463] device veth0_macvtap entered promiscuous mode [ 44.362205][ T4463] device veth1_macvtap entered promiscuous mode [ 44.367435][ T4463] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 44.370472][ T4463] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 44.373040][ T4463] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 44.374520][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 44.376238][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 44.378417][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 44.380343][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 44.382899][ T4463] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 44.385020][ T4463] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 44.387508][ T4463] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 44.389621][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 44.391577][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 44.399854][ T4463] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.401316][ T4463] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.402860][ T4463] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.404360][ T4463] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.435009][ T1591] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 44.436560][ T1591] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 44.439367][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 44.446892][ T1591] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 44.448640][ T1591] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 44.450327][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 44.457591][ T11] device hsr_slave_0 left promiscuous mode [ 44.491277][ T4480] block device autoloading is deprecated and will be removed. [ 44.506898][ T4480] md/raid1:md0: active with 1 out of 1027 mirrors [ 44.508290][ T11] device hsr_slave_1 left promiscuous mode [ 44.509568][ T4480] md0: detected capacity change from 0 to 5884 [ 44.511528][ T4480] ================================================================================ [ 44.513307][ T4480] UBSAN: array-index-out-of-bounds in drivers/md/md.c:1390:20 [ 44.514633][ T4480] index 1027 is out of range for type 'mdp_disk_t[27]' (aka 'struct mdp_device_descriptor_s[27]') [ 44.516776][ T4480] CPU: 1 PID: 4480 Comm: syz.0.17 Not tainted syzkaller #0 [ 44.518147][ T4480] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 44.520022][ T4480] Call trace: [ 44.520686][ T4480] dump_backtrace+0x1c4/0x1f0 [ 44.521651][ T4480] show_stack+0x2c/0x3c [ 44.522570][ T4480] __dump_stack+0x30/0x40 [ 44.523526][ T4480] dump_stack_lvl+0xf4/0x15c [ 44.524475][ T4480] dump_stack+0x1c/0x5c [ 44.525337][ T4480] ubsan_epilogue+0x14/0x48 [ 44.526331][ T4480] __ubsan_handle_out_of_bounds+0xd0/0xf8 [ 44.527438][ T4480] super_90_validate+0x110c/0x15b8 [ 44.528531][ T4480] add_bound_rdev+0x128/0x494 [ 44.529494][ T4480] md_add_new_disk+0xc0c/0x1484 [ 44.530433][ T4480] md_ioctl+0x2158/0x25cc [ 44.531354][ T4480] blkdev_ioctl+0x654/0xb74 [ 44.532346][ T4480] __arm64_sys_ioctl+0x14c/0x1c8 [ 44.533420][ T4480] invoke_syscall+0x98/0x290 [ 44.534448][ T4480] el0_svc_common+0x13c/0x258 [ 44.535488][ T4480] do_el0_svc+0x5c/0x134 [ 44.536496][ T4480] el0_svc+0x58/0x12c [ 44.537432][ T4480] el0t_64_sync_handler+0x84/0xf0 [ 44.538614][ T4480] el0t_64_sync+0x18c/0x190 [ 44.541464][ T4480] ================================================================================ [ 44.543264][ T4480] ================================================================== [ 44.544824][ T4480] BUG: KASAN: slab-out-of-bounds in super_90_validate+0x1128/0x15b8 [ 44.546263][ T4480] Read of size 4 at addr ffff0000c3d2b390 by task syz.0.17/4480 [ 44.547702][ T4480] [ 44.548153][ T4480] CPU: 1 PID: 4480 Comm: syz.0.17 Not tainted syzkaller #0 [ 44.549728][ T4480] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 44.551813][ T4480] Call trace: [ 44.552422][ T4480] dump_backtrace+0x1c4/0x1f0 [ 44.553288][ T4480] show_stack+0x2c/0x3c [ 44.554146][ T4480] __dump_stack+0x30/0x40 [ 44.555112][ T4480] dump_stack_lvl+0xf4/0x15c [ 44.556151][ T4480] print_address_description+0x88/0x218 [ 44.557386][ T4480] print_report+0x50/0x68 [ 44.558395][ T4480] kasan_report+0xa8/0xfc [ 44.559376][ T4480] __asan_report_load4_noabort+0x2c/0x38 [ 44.560641][ T4480] super_90_validate+0x1128/0x15b8 [ 44.561790][ T4480] add_bound_rdev+0x128/0x494 [ 44.562845][ T4480] md_add_new_disk+0xc0c/0x1484 [ 44.564002][ T4480] md_ioctl+0x2158/0x25cc [ 44.565022][ T4480] blkdev_ioctl+0x654/0xb74 [ 44.566058][ T4480] __arm64_sys_ioctl+0x14c/0x1c8 [ 44.567176][ T4480] invoke_syscall+0x98/0x290 [ 44.568111][ T4480] el0_svc_common+0x13c/0x258 [ 44.569010][ T4480] do_el0_svc+0x5c/0x134 [ 44.569887][ T4480] el0_svc+0x58/0x12c [ 44.570729][ T4480] el0t_64_sync_handler+0x84/0xf0 [ 44.571899][ T4480] el0t_64_sync+0x18c/0x190 [ 44.572959][ T4480] [ 44.573468][ T4480] Allocated by task 4444: [ 44.574481][ T4480] kasan_set_track+0x4c/0x80 [ 44.575555][ T4480] kasan_save_alloc_info+0x24/0x30 [ 44.576761][ T4480] __kasan_kmalloc+0xa0/0xb8 [ 44.577849][ T4480] __kmalloc_node_track_caller+0xcc/0x174 [ 44.579215][ T4480] kmemdup+0x5c/0x98 [ 44.580043][ T4480] __devinet_sysctl_register+0xc0/0xdac [ 44.581078][ T4480] devinet_sysctl_register+0x14c/0x1c0 [ 44.582085][ T4480] inetdev_init+0x268/0x4a0 [ 44.582969][ T4480] inetdev_event+0xef4/0x12dc [ 44.583855][ T4480] raw_notifier_call_chain+0xd8/0x168 [ 44.584939][ T4480] call_netdevice_notifiers+0x110/0x198 [ 44.586053][ T4480] register_netdevice+0x11c4/0x1650 [ 44.587034][ T4480] __ip_tunnel_create+0x2a8/0x3b4 [ 44.588077][ T4480] ip_tunnel_init_net+0x23c/0x638 [ 44.589152][ T4480] erspan_init_net+0x38/0x48 [ 44.590110][ T4480] ops_init+0x2b0/0x53c [ 44.590997][ T4480] setup_net+0x494/0xb6c [ 44.591919][ T4480] copy_net_ns+0x2b8/0x578 [ 44.592969][ T4480] create_new_namespaces+0x30c/0x604 [ 44.594132][ T4480] unshare_nsproxy_namespaces+0x108/0x160 [ 44.595394][ T4480] ksys_unshare+0x3f0/0x70c [ 44.596384][ T4480] __arm64_sys_unshare+0x3c/0x50 [ 44.597480][ T4480] invoke_syscall+0x98/0x290 [ 44.598553][ T4480] el0_svc_common+0x13c/0x258 [ 44.599601][ T4480] do_el0_svc+0x5c/0x134 [ 44.600583][ T4480] el0_svc+0x58/0x12c [ 44.601421][ T4480] el0t_64_sync_handler+0x84/0xf0 [ 44.602476][ T4480] el0t_64_sync+0x18c/0x190 [ 44.603387][ T4480] [ 44.603868][ T4480] Freed by task 11: [ 44.604652][ T4480] kasan_set_track+0x4c/0x80 [ 44.605597][ T4480] kasan_save_free_info+0x38/0x5c [ 44.606666][ T4480] ____kasan_slab_free+0x148/0x1b0 [ 44.607800][ T4480] __kasan_slab_free+0x18/0x28 [ 44.608792][ T4480] slab_free_freelist_hook+0x16c/0x1e8 [ 44.610012][ T4480] __kmem_cache_free+0xbc/0x21c [ 44.611077][ T4480] kfree+0xd0/0x1a8 [ 44.611915][ T4480] inetdev_event+0x554/0x12dc [ 44.612980][ T4480] raw_notifier_call_chain+0xd8/0x168 [ 44.614212][ T4480] unregister_netdevice_many_notify+0xf18/0x1900 [ 44.615441][ T4480] unregister_netdevice_many+0x28/0x38 [ 44.616487][ T4480] ip_tunnel_delete_nets+0x2d8/0x334 [ 44.617491][ T4480] erspan_exit_batch_net+0x30/0x40 [ 44.618514][ T4480] cleanup_net+0x650/0xa90 [ 44.619442][ T4480] process_one_work+0x7e4/0x13bc [ 44.620494][ T4480] worker_thread+0x8cc/0xfe8 [ 44.621464][ T4480] kthread+0x254/0x2e0 [ 44.622265][ T4480] ret_from_fork+0x10/0x20 [ 44.623185][ T4480] [ 44.623671][ T4480] The buggy address belongs to the object at ffff0000c3d2a000 [ 44.623671][ T4480] which belongs to the cache kmalloc-cg-4k of size 4096 [ 44.626655][ T4480] The buggy address is located 912 bytes to the right of [ 44.626655][ T4480] 4096-byte region [ffff0000c3d2a000, ffff0000c3d2b000) [ 44.629499][ T4480] [ 44.629952][ T4480] The buggy address belongs to the physical page: [ 44.631185][ T4480] page:00000000e9c07508 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103d28 [ 44.633303][ T4480] head:00000000e9c07508 order:3 compound_mapcount:0 compound_pincount:0 [ 44.634952][ T4480] memcg:ffff0000eee95101 [ 44.635792][ T4480] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 44.637441][ T4480] raw: 05ffc00000010200 0000000000000000 dead000000000122 ffff0000c0003500 [ 44.638999][ T4480] raw: 0000000000000000 0000000000040004 00000001ffffffff ffff0000eee95101 [ 44.640648][ T4480] page dumped because: kasan: bad access detected [ 44.641833][ T4480] [ 44.642289][ T4480] Memory state around the buggy address: [ 44.643436][ T4480] ffff0000c3d2b280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.644982][ T4480] ffff0000c3d2b300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.646462][ T4480] >ffff0000c3d2b380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.647965][ T4480] ^ [ 44.648918][ T4480] ffff0000c3d2b400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.650599][ T4480] ffff0000c3d2b480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.652150][ T4480] ================================================================== [ 44.654469][ T4480] Disabling lock debugging due to kernel taint [ 44.687877][ T11] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 44.689247][ T11] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 44.690883][ T11] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 44.692295][ T11] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 44.694938][ T11] device bridge_slave_1 left promiscuous mode [ 44.696146][ T11] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.728803][ T11] device bridge_slave_0 left promiscuous mode [ 44.730037][ T11] bridge0: port 1(bridge_slave_0) entered disabled state