Warning: Permanently added '[localhost]:57943' (ED25519) to the list of known hosts.
2025/08/27 15:53:50 parsed 1 programs
syzkaller login: [ 89.711058][ T5351] cgroup: Unknown subsys name 'net'
[ 89.780655][ T5351] cgroup: Unknown subsys name 'cpuset'
[ 89.786378][ T5351] cgroup: Unknown subsys name 'rlimit'
[ 91.466840][ T5351] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 91.878677][ T10] cfg80211: failed to load regulatory.db
[ 95.510363][ T5366] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 96.565663][ T5376] chnl_net:caif_netlink_parms(): no params data found
[ 96.640265][ T5376] bridge0: port 1(bridge_slave_0) entered blocking state
[ 96.644295][ T5376] bridge0: port 1(bridge_slave_0) entered disabled state
[ 96.648405][ T5376] bridge_slave_0: entered allmulticast mode
[ 96.652419][ T5376] bridge_slave_0: entered promiscuous mode
[ 96.659066][ T5376] bridge0: port 2(bridge_slave_1) entered blocking state
[ 96.662190][ T5376] bridge0: port 2(bridge_slave_1) entered disabled state
[ 96.665148][ T5376] bridge_slave_1: entered allmulticast mode
[ 96.669910][ T5376] bridge_slave_1: entered promiscuous mode
[ 96.695914][ T5376] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 96.702584][ T5376] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 96.730162][ T5376] team0: Port device team_slave_0 added
[ 96.734798][ T5376] team0: Port device team_slave_1 added
[ 96.759053][ T5376] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 96.762226][ T5376] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 96.774255][ T5376] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 96.781301][ T5376] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 96.784203][ T5376] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 96.796153][ T5376] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 96.838250][ T5376] hsr_slave_0: entered promiscuous mode
[ 96.841684][ T5376] hsr_slave_1: entered promiscuous mode
[ 97.011519][ T5376] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 97.020613][ T5376] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 97.028347][ T5376] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 97.034832][ T5376] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 97.065904][ T5376] bridge0: port 2(bridge_slave_1) entered blocking state
[ 97.069230][ T5376] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 97.073114][ T5376] bridge0: port 1(bridge_slave_0) entered blocking state
[ 97.076206][ T5376] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 97.141287][ T5376] 8021q: adding VLAN 0 to HW filter on device bond0
[ 97.155079][ T1081] bridge0: port 1(bridge_slave_0) entered disabled state
[ 97.160724][ T1081] bridge0: port 2(bridge_slave_1) entered disabled state
[ 97.175012][ T5376] 8021q: adding VLAN 0 to HW filter on device team0
[ 97.184287][ T1081] bridge0: port 1(bridge_slave_0) entered blocking state
[ 97.187299][ T1081] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 97.205237][ T1081] bridge0: port 2(bridge_slave_1) entered blocking state
[ 97.208243][ T1081] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 97.381169][ T5376] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 97.424607][ T5376] veth0_vlan: entered promiscuous mode
[ 97.433004][ T5376] veth1_vlan: entered promiscuous mode
[ 97.466110][ T5376] veth0_macvtap: entered promiscuous mode
[ 97.473726][ T5376] veth1_macvtap: entered promiscuous mode
[ 97.492765][ T5376] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 97.508422][ T5376] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 97.522322][ T1041] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 97.543680][ T1041] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 97.548758][ T1041] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 97.552705][ T1041] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 97.729897][ T1045] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 97.819649][ T1045] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 97.898855][ T1045] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 97.970544][ T1045] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 99.516532][ T5431] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 99.521426][ T5431] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 99.524837][ T5431] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 99.529747][ T5431] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 99.533206][ T5431] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 100.559088][ T1045] bridge_slave_1: left allmulticast mode
[ 100.561786][ T1045] bridge_slave_1: left promiscuous mode
[ 100.565419][ T1045] bridge0: port 2(bridge_slave_1) entered disabled state
[ 100.633714][ T1045] bridge_slave_0: left allmulticast mode
[ 100.636472][ T1045] bridge_slave_0: left promiscuous mode
[ 100.678848][ T1045] bridge0: port 1(bridge_slave_0) entered disabled state
[ 101.110447][ T1045] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 101.116621][ T1045] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 101.122365][ T1045] bond0 (unregistering): Released all slaves
[ 101.209936][ T1045] hsr_slave_0: left promiscuous mode
[ 101.212640][ T1045] hsr_slave_1: left promiscuous mode
[ 101.215636][ T1045] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 101.220587][ T1045] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 101.224401][ T1045] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 101.232302][ T1045] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 101.244126][ T1045] veth1_macvtap: left promiscuous mode
[ 101.247518][ T1045] veth0_macvtap: left promiscuous mode
[ 101.250384][ T1045] veth1_vlan: left promiscuous mode
[ 101.252702][ T1045] veth0_vlan: left promiscuous mode
[ 101.525587][ T1045] team0 (unregistering): Port device team_slave_1 removed
[ 101.556895][ T1045] team0 (unregistering): Port device team_slave_0 removed
[ 102.936927][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 102.940248][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 103.060076][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 103.073785][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
2025/08/27 15:54:07 executed programs: 0
[ 104.394440][ T4706] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 104.401101][ T4706] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 104.404514][ T4706] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 104.413899][ T4706] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 104.418258][ T4706] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 104.613777][ T5491] chnl_net:caif_netlink_parms(): no params data found
[ 104.675062][ T5491] bridge0: port 1(bridge_slave_0) entered blocking state
[ 104.678649][ T5491] bridge0: port 1(bridge_slave_0) entered disabled state
[ 104.681775][ T5491] bridge_slave_0: entered allmulticast mode
[ 104.685690][ T5491] bridge_slave_0: entered promiscuous mode
[ 104.690955][ T5491] bridge0: port 2(bridge_slave_1) entered blocking state
[ 104.694143][ T5491] bridge0: port 2(bridge_slave_1) entered disabled state
[ 104.698359][ T5491] bridge_slave_1: entered allmulticast mode
[ 104.702302][ T5491] bridge_slave_1: entered promiscuous mode
[ 104.724648][ T5491] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 104.732227][ T5491] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 104.759344][ T5491] team0: Port device team_slave_0 added
[ 104.763755][ T5491] team0: Port device team_slave_1 added
[ 104.786349][ T5491] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 104.789699][ T5491] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 104.801212][ T5491] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 104.807779][ T5491] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 104.810718][ T5491] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 104.823221][ T5491] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 104.858690][ T5491] hsr_slave_0: entered promiscuous mode
[ 104.861824][ T5491] hsr_slave_1: entered promiscuous mode
[ 105.351564][ T5491] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 105.378409][ T5491] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 105.384441][ T5491] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 105.401571][ T5491] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 105.544438][ T5491] 8021q: adding VLAN 0 to HW filter on device bond0
[ 105.580523][ T5491] 8021q: adding VLAN 0 to HW filter on device team0
[ 105.604178][ T13] bridge0: port 1(bridge_slave_0) entered blocking state
[ 105.607339][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 105.648318][ T1081] bridge0: port 2(bridge_slave_1) entered blocking state
[ 105.651666][ T1081] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 106.015706][ T5491] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 106.099327][ T5491] veth0_vlan: entered promiscuous mode
[ 106.121296][ T5491] veth1_vlan: entered promiscuous mode
[ 106.170336][ T5491] veth0_macvtap: entered promiscuous mode
[ 106.175911][ T5491] veth1_macvtap: entered promiscuous mode
[ 106.215956][ T5491] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 106.236516][ T5491] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 106.262555][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 106.278152][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 106.282108][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 106.285766][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 106.413064][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 106.416393][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 106.429373][ T5431] Bluetooth: hci0: command tx timeout
[ 106.477732][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 106.481315][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 106.605029][ T5531] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 106.619760][ T5531] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 106.624885][ T5531] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 106.634299][ T5393] wlan1: authenticate with 08:02:11:00:00:00 (local address=08:02:11:00:00:01)
[ 106.646801][ T5393] wlan1: send auth to 08:02:11:00:00:00 (try 1/3)
[ 106.671699][ T5531] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 107.225711][ T5547] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 107.248460][ T1045] wlan1: authenticated
[ 107.250677][ T5547] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 107.256169][ T1045] wlan1: RX AssocResp from 08:02:11:00:00:00 (capab=0x1 status=0 aid=1)
[ 107.268470][ T1045] wlan1: associated
[ 107.271552][ T5547] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 107.289472][ T5547] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 107.824133][ T5551] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 107.831390][ T5551] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 107.838191][ T5551] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 107.843657][ T1045] wlan1: AP 08:02:11:00:00:00 tries to chanswitch to same channel, ignore
[ 107.850489][ T5551] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 108.383025][ T5552] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 108.392421][ T5552] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 108.398548][ T5552] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 108.404020][ T5552] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 108.506936][ T5431] Bluetooth: hci0: command tx timeout
[ 108.938944][ T5553] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 108.944799][ T5553] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 108.953869][ T5553] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 108.960428][ T5553] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 109.500194][ T5554] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 109.510756][ T5554] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
2025/08/27 15:54:13 executed programs: 7
[ 109.521330][ T5554] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 109.527568][ T5554] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 110.060978][ T5555] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 110.069296][ T5555] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 110.075025][ T5555] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 110.082922][ T5555] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 110.586865][ T5431] Bluetooth: hci0: command tx timeout
[ 110.611072][ T1081] ==================================================================
[ 110.615004][ T1081] BUG: KASAN: slab-use-after-free in cmp_bss+0xd4d/0xe80
[ 110.617863][ T1081] Read of size 4 at addr ffff888059bc0998 by task kworker/u4:10/1081
[ 110.622200][ T1081]
[ 110.623263][ T1081] CPU: 0 UID: 0 PID: 1081 Comm: kworker/u4:10 Not tainted syzkaller #0 PREEMPT(full)
[ 110.623279][ T1081] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 110.623286][ T1081] Workqueue: events_unbound cfg80211_wiphy_work
[ 110.623308][ T1081] Call Trace:
[ 110.623316][ T1081]
[ 110.623322][ T1081] dump_stack_lvl+0x189/0x250
[ 110.623336][ T1081] ? __kasan_check_byte+0x12/0x40
[ 110.623400][ T1081] ? __pfx_dump_stack_lvl+0x10/0x10
[ 110.623412][ T1081] ? lock_release+0x4b/0x3e0
[ 110.623429][ T1081] ? __virt_addr_valid+0x4a5/0x5c0
[ 110.623445][ T1081] print_report+0xca/0x240
[ 110.623455][ T1081] ? cmp_bss+0xd4d/0xe80
[ 110.623466][ T1081] kasan_report+0x118/0x150
[ 110.623478][ T1081] ? ret_from_fork_asm+0x1a/0x30
[ 110.623492][ T1081] ? cmp_bss+0xd4d/0xe80
[ 110.623504][ T1081] cmp_bss+0xd4d/0xe80
[ 110.623516][ T1081] ? __lock_acquire+0xab9/0xd20
[ 110.623531][ T1081] __cfg80211_bss_update+0xdb/0x2120
[ 110.623543][ T1081] ? do_raw_spin_lock+0x121/0x290
[ 110.623557][ T1081] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 110.623569][ T1081] ? trace_kmalloc+0x1f/0xd0
[ 110.623582][ T1081] ? cfg80211_inform_single_bss_data+0xb90/0x1ac0
[ 110.623594][ T1081] cfg80211_inform_single_bss_data+0xba9/0x1ac0
[ 110.623614][ T1081] ? __pfx_cfg80211_inform_single_bss_data+0x10/0x10
[ 110.623629][ T1081] ? __lock_acquire+0xab9/0xd20
[ 110.623644][ T1081] ? cfg80211_inform_bss_data+0x1e8/0x3b30
[ 110.623656][ T1081] cfg80211_inform_bss_data+0x1fb/0x3b30
[ 110.623669][ T1081] ? unwind_next_frame+0xa5/0x2390
[ 110.623681][ T1081] ? unwind_next_frame+0xa5/0x2390
[ 110.623694][ T1081] ? unwind_next_frame+0xa5/0x2390
[ 110.623706][ T1081] ? unwind_next_frame+0xa5/0x2390
[ 110.623716][ T1081] ? unwind_next_frame+0x19ae/0x2390
[ 110.623728][ T1081] ? __pfx_cfg80211_inform_bss_data+0x10/0x10
[ 110.623766][ T1081] ? unwind_next_frame+0xa5/0x2390
[ 110.623777][ T1081] ? ret_from_fork_asm+0x1a/0x30
[ 110.623791][ T1081] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 110.623805][ T1081] ? arch_stack_walk+0x11c/0x150
[ 110.623818][ T1081] ? ret_from_fork_asm+0x1a/0x30
[ 110.623833][ T1081] ? __lock_acquire+0xab9/0xd20
[ 110.623853][ T1081] cfg80211_inform_bss_frame_data+0x3d7/0x730
[ 110.623866][ T1081] ? ieee80211_bss_info_update+0x2dc/0x9e0
[ 110.623913][ T1081] ieee80211_bss_info_update+0x746/0x9e0
[ 110.623927][ T1081] ? __pfx_ieee80211_bss_info_update+0x10/0x10
[ 110.623940][ T1081] ? ieee80211_get_channel_khz+0x15b/0x8a0
[ 110.623951][ T1081] ieee80211_rx_bss_info+0x176/0x280
[ 110.623965][ T1081] ieee80211_sta_rx_queued_mgmt+0x1294/0x4470
[ 110.623983][ T1081] ? rcu_is_watching+0x15/0xb0
[ 110.623994][ T1081] ? switch_mm_irqs_off+0x5b6/0x7a0
[ 110.624008][ T1081] ? __pfx_ieee80211_sta_rx_queued_mgmt+0x10/0x10
[ 110.624024][ T1081] ? __lock_acquire+0xab9/0xd20
[ 110.624037][ T1081] ? rcu_is_watching+0x15/0xb0
[ 110.624054][ T1081] ? __lock_acquire+0xab9/0xd20
[ 110.624071][ T1081] ? __lock_acquire+0xab9/0xd20
[ 110.624087][ T1081] ? __lock_acquire+0xab9/0xd20
[ 110.624106][ T1081] ? kcov_remote_start+0x18e/0x7f0
[ 110.624124][ T1081] ieee80211_iface_work+0x652/0x12d0
[ 110.624141][ T1081] cfg80211_wiphy_work+0x2bb/0x470
[ 110.624157][ T1081] ? process_scheduled_works+0x9ef/0x17b0
[ 110.624168][ T1081] process_scheduled_works+0xae1/0x17b0
[ 110.624185][ T1081] ? __pfx_process_scheduled_works+0x10/0x10
[ 110.624199][ T1081] worker_thread+0x8a0/0xda0
[ 110.624210][ T1081] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 110.624225][ T1081] ? __kthread_parkme+0x7b/0x200
[ 110.624240][ T1081] kthread+0x70e/0x8a0
[ 110.624253][ T1081] ? __pfx_worker_thread+0x10/0x10
[ 110.624264][ T1081] ? __pfx_kthread+0x10/0x10
[ 110.624277][ T1081] ? _raw_spin_unlock_irq+0x23/0x50
[ 110.624289][ T1081] ? lockdep_hardirqs_on+0x9c/0x150
[ 110.624304][ T1081] ? __pfx_kthread+0x10/0x10
[ 110.624318][ T1081] ret_from_fork+0x3f9/0x770
[ 110.624331][ T1081] ? __pfx_ret_from_fork+0x10/0x10
[ 110.624344][ T1081] ? __pfx_kthread+0x10/0x10
[ 110.624357][ T1081] ret_from_fork_asm+0x1a/0x30
[ 110.624375][ T1081]
[ 110.624379][ T1081]
[ 110.797568][ T1081] Allocated by task 1045:
[ 110.799350][ T1081] kasan_save_track+0x3e/0x80
[ 110.801614][ T1081] __kasan_kmalloc+0x93/0xb0
[ 110.803611][ T1081] __kmalloc_noprof+0x27a/0x4f0
[ 110.805769][ T1081] cfg80211_inform_single_bss_data+0x905/0x1ac0
[ 110.808413][ T1081] cfg80211_inform_bss_data+0x1fb/0x3b30
[ 110.811413][ T1081] cfg80211_inform_bss_frame_data+0x3d7/0x730
[ 110.814797][ T1081] ieee80211_bss_info_update+0x746/0x9e0
[ 110.817572][ T1081] ieee80211_rx_bss_info+0x176/0x280
[ 110.819836][ T1081] ieee80211_rx_mgmt_beacon+0x197d/0x2cd0
[ 110.822215][ T1081] ieee80211_sta_rx_queued_mgmt+0x4ed/0x4470
[ 110.824789][ T1081] ieee80211_iface_work+0x652/0x12d0
[ 110.827063][ T1081] cfg80211_wiphy_work+0x2bb/0x470
[ 110.829417][ T1081] process_scheduled_works+0xae1/0x17b0
[ 110.832171][ T1081] worker_thread+0x8a0/0xda0
[ 110.835084][ T1081] kthread+0x70e/0x8a0
[ 110.837890][ T1081] ret_from_fork+0x3f9/0x770
[ 110.840460][ T1081] ret_from_fork_asm+0x1a/0x30
[ 110.842846][ T1081]
[ 110.843968][ T1081] Freed by task 1081:
[ 110.845778][ T1081] kasan_save_track+0x3e/0x80
[ 110.847941][ T1081] kasan_save_free_info+0x46/0x50
[ 110.850212][ T1081] __kasan_slab_free+0x5b/0x80
[ 110.852719][ T1081] kmem_cache_free_bulk+0x2d1/0x520
[ 110.855354][ T1081] kvfree_rcu_bulk+0xe5/0x1f0
[ 110.857630][ T1081] kfree_rcu_monitor+0x211/0x2a0
[ 110.859801][ T1081] process_scheduled_works+0xae1/0x17b0
[ 110.862154][ T1081] worker_thread+0x8a0/0xda0
[ 110.864212][ T1081] kthread+0x70e/0x8a0
[ 110.866063][ T1081] ret_from_fork+0x3f9/0x770
[ 110.868152][ T1081] ret_from_fork_asm+0x1a/0x30
[ 110.870488][ T1081]
[ 110.871859][ T1081] Last potentially related work creation:
[ 110.874371][ T1081] kasan_save_stack+0x3e/0x60
[ 110.876583][ T1081] kasan_record_aux_stack+0xbd/0xd0
[ 110.878798][ T1081] kvfree_call_rcu+0xbb/0x410
[ 110.881244][ T1081] cfg80211_update_known_bss+0x454/0x1330
[ 110.884096][ T1081] cfg80211_update_assoc_bss_entry+0x4ba/0x6a0
[ 110.887131][ T1081] cfg80211_ch_switch_notify+0x3c1/0x780
[ 110.889622][ T1081] ieee80211_sta_process_chanswitch+0xad4/0x2870
[ 110.892412][ T1081] ieee80211_rx_mgmt_beacon+0x19c7/0x2cd0
[ 110.894864][ T1081] ieee80211_sta_rx_queued_mgmt+0x4ed/0x4470
[ 110.897615][ T1081] ieee80211_iface_work+0x652/0x12d0
[ 110.900600][ T1081] cfg80211_wiphy_work+0x2bb/0x470
[ 110.904064][ T1081] process_scheduled_works+0xae1/0x17b0
[ 110.906589][ T1081] worker_thread+0x8a0/0xda0
[ 110.908604][ T1081] kthread+0x70e/0x8a0
[ 110.910498][ T1081] ret_from_fork+0x3f9/0x770
[ 110.912605][ T1081] ret_from_fork_asm+0x1a/0x30
[ 110.914798][ T1081]
[ 110.915927][ T1081] The buggy address belongs to the object at ffff888059bc0980
[ 110.915927][ T1081] which belongs to the cache kmalloc-96 of size 96
[ 110.921993][ T1081] The buggy address is located 24 bytes inside of
[ 110.921993][ T1081] freed 96-byte region [ffff888059bc0980, ffff888059bc09e0)
[ 110.927715][ T1081]
[ 110.928877][ T1081] The buggy address belongs to the physical page:
[ 110.931698][ T1081] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x59bc0
[ 110.935284][ T1081] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 110.937942][ T1081] page_type: f5(slab)
[ 110.939490][ T1081] raw: 04fff00000000000 ffff88801a441280 dead000000000100 dead000000000122
[ 110.942981][ T1081] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000
[ 110.946552][ T1081] page dumped because: kasan: bad access detected
[ 110.949195][ T1081] page_owner tracks the page as allocated
[ 110.951490][ T1081] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1041, tgid 1041 (kworker/u4:7), ts 98829953833, free_ts 98826608682
[ 110.959381][ T1081] post_alloc_hook+0x240/0x2a0
[ 110.961518][ T1081] get_page_from_freelist+0x21e4/0x22c0
[ 110.963910][ T1081] __alloc_frozen_pages_noprof+0x181/0x370
[ 110.966480][ T1081] alloc_pages_mpol+0x232/0x4a0
[ 110.968586][ T1081] allocate_slab+0x8a/0x370
[ 110.970542][ T1081] ___slab_alloc+0xbeb/0x1410
[ 110.972596][ T1081] __kmalloc_cache_noprof+0x296/0x3d0
[ 110.974829][ T1081] dst_cow_metrics_generic+0x56/0x1c0
[ 110.977000][ T1081] icmp6_dst_alloc+0x261/0x420
[ 110.978659][ T1081] mld_sendpack+0x678/0xd80
[ 110.980191][ T1081] ipv6_mc_dad_complete+0x88/0x410
[ 110.982303][ T1081] addrconf_dad_completed+0x6d5/0xd60
[ 110.984587][ T1081] addrconf_dad_work+0xc36/0x14b0
[ 110.986413][ T1081] process_scheduled_works+0xae1/0x17b0
[ 110.988598][ T1081] worker_thread+0x8a0/0xda0
[ 110.990605][ T1081] kthread+0x70e/0x8a0
[ 110.992371][ T1081] page last free pid 5408 tgid 5408 stack trace:
[ 110.994958][ T1081] __free_frozen_pages+0xbc4/0xd30
[ 110.997033][ T1081] vfree+0x25a/0x400
[ 110.998760][ T1081] kcov_close+0x28/0x50
[ 111.000691][ T1081] __fput+0x44c/0xa70
[ 111.002524][ T1081] task_work_run+0x1d4/0x260
[ 111.004352][ T1081] do_exit+0x6b5/0x2300
[ 111.006035][ T1081] do_group_exit+0x21c/0x2d0
[ 111.007957][ T1081] get_signal+0x1286/0x1340
[ 111.009735][ T1081] arch_do_signal_or_restart+0x9a/0x750
[ 111.012206][ T1081] exit_to_user_mode_loop+0x75/0x110
[ 111.014413][ T1081] do_syscall_64+0x2bd/0x3b0
[ 111.016398][ T1081] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 111.018918][ T1081]
[ 111.020003][ T1081] Memory state around the buggy address:
[ 111.022302][ T1081] ffff888059bc0880: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 111.025534][ T1081] ffff888059bc0900: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[ 111.028966][ T1081] >ffff888059bc0980: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 111.032450][ T1081] ^
[ 111.034627][ T1081] ffff888059bc0a00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 111.038906][ T1081] ffff888059bc0a80: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
[ 111.042796][ T1081] ==================================================================
[ 111.046373][ T1081] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 111.049459][ T1081] CPU: 0 UID: 0 PID: 1081 Comm: kworker/u4:10 Not tainted syzkaller #0 PREEMPT(full)
[ 111.053731][ T1081] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 111.058449][ T1081] Workqueue: events_unbound cfg80211_wiphy_work
[ 111.061099][ T1081] Call Trace:
[ 111.062451][ T1081]
[ 111.063709][ T1081] dump_stack_lvl+0x99/0x250
[ 111.065774][ T1081] ? __asan_memcpy+0x40/0x70
[ 111.068052][ T1081] ? __pfx_dump_stack_lvl+0x10/0x10
[ 111.070719][ T1081] ? __pfx__printk+0x10/0x10
[ 111.073079][ T1081] vpanic+0x281/0x750
[ 111.074846][ T1081] ? __pfx_vpanic+0x10/0x10
[ 111.076772][ T1081] ? irqentry_exit+0x74/0x90
[ 111.078741][ T1081] panic+0xb9/0xc0
[ 111.080461][ T1081] ? __pfx_panic+0x10/0x10
[ 111.082395][ T1081] ? _raw_spin_unlock_irqrestore+0xa8/0x110
[ 111.085035][ T1081] ? _raw_spin_unlock_irqrestore+0xad/0x110
[ 111.087510][ T1081] ? cmp_bss+0xd4d/0xe80
[ 111.089541][ T1081] check_panic_on_warn+0x89/0xb0
[ 111.091836][ T1081] ? cmp_bss+0xd4d/0xe80
[ 111.093677][ T1081] end_report+0x78/0x160
[ 111.095548][ T1081] kasan_report+0x129/0x150
[ 111.097525][ T1081] ? ret_from_fork_asm+0x1a/0x30
[ 111.099532][ T1081] ? cmp_bss+0xd4d/0xe80
[ 111.101405][ T1081] cmp_bss+0xd4d/0xe80
[ 111.103287][ T1081] ? __lock_acquire+0xab9/0xd20
[ 111.105586][ T1081] __cfg80211_bss_update+0xdb/0x2120
[ 111.107967][ T1081] ? do_raw_spin_lock+0x121/0x290
[ 111.110149][ T1081] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 111.112452][ T1081] ? trace_kmalloc+0x1f/0xd0
[ 111.114483][ T1081] ? cfg80211_inform_single_bss_data+0xb90/0x1ac0
[ 111.117211][ T1081] cfg80211_inform_single_bss_data+0xba9/0x1ac0
[ 111.119923][ T1081] ? __pfx_cfg80211_inform_single_bss_data+0x10/0x10
[ 111.122848][ T1081] ? __lock_acquire+0xab9/0xd20
[ 111.124945][ T1081] ? cfg80211_inform_bss_data+0x1e8/0x3b30
[ 111.127406][ T1081] cfg80211_inform_bss_data+0x1fb/0x3b30
[ 111.129744][ T1081] ? unwind_next_frame+0xa5/0x2390
[ 111.132063][ T1081] ? unwind_next_frame+0xa5/0x2390
[ 111.134299][ T1081] ? unwind_next_frame+0xa5/0x2390
[ 111.136484][ T1081] ? unwind_next_frame+0xa5/0x2390
[ 111.138608][ T1081] ? unwind_next_frame+0x19ae/0x2390
[ 111.140885][ T1081] ? __pfx_cfg80211_inform_bss_data+0x10/0x10
[ 111.143613][ T1081] ? unwind_next_frame+0xa5/0x2390
[ 111.145864][ T1081] ? ret_from_fork_asm+0x1a/0x30
[ 111.147998][ T1081] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 111.150563][ T1081] ? arch_stack_walk+0x11c/0x150
[ 111.152686][ T1081] ? ret_from_fork_asm+0x1a/0x30
[ 111.154958][ T1081] ? __lock_acquire+0xab9/0xd20
[ 111.157353][ T1081] cfg80211_inform_bss_frame_data+0x3d7/0x730
[ 111.160267][ T1081] ? ieee80211_bss_info_update+0x2dc/0x9e0
[ 111.162613][ T1081] ieee80211_bss_info_update+0x746/0x9e0
[ 111.165032][ T1081] ? __pfx_ieee80211_bss_info_update+0x10/0x10
[ 111.167503][ T1081] ? ieee80211_get_channel_khz+0x15b/0x8a0
[ 111.169795][ T1081] ieee80211_rx_bss_info+0x176/0x280
[ 111.172052][ T1081] ieee80211_sta_rx_queued_mgmt+0x1294/0x4470
[ 111.174542][ T1081] ? rcu_is_watching+0x15/0xb0
[ 111.176604][ T1081] ? switch_mm_irqs_off+0x5b6/0x7a0
[ 111.178851][ T1081] ? __pfx_ieee80211_sta_rx_queued_mgmt+0x10/0x10
[ 111.181686][ T1081] ? __lock_acquire+0xab9/0xd20
[ 111.183795][ T1081] ? rcu_is_watching+0x15/0xb0
[ 111.185839][ T1081] ? __lock_acquire+0xab9/0xd20
[ 111.188012][ T1081] ? __lock_acquire+0xab9/0xd20
[ 111.190310][ T1081] ? __lock_acquire+0xab9/0xd20
[ 111.192617][ T1081] ? kcov_remote_start+0x18e/0x7f0
[ 111.194914][ T1081] ieee80211_iface_work+0x652/0x12d0
[ 111.197321][ T1081] cfg80211_wiphy_work+0x2bb/0x470
[ 111.199603][ T1081] ? process_scheduled_works+0x9ef/0x17b0
[ 111.202183][ T1081] process_scheduled_works+0xae1/0x17b0
[ 111.204741][ T1081] ? __pfx_process_scheduled_works+0x10/0x10
[ 111.207576][ T1081] worker_thread+0x8a0/0xda0
[ 111.209835][ T1081] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 111.212638][ T1081] ? __kthread_parkme+0x7b/0x200
[ 111.214882][ T1081] kthread+0x70e/0x8a0
[ 111.216681][ T1081] ? __pfx_worker_thread+0x10/0x10
[ 111.218924][ T1081] ? __pfx_kthread+0x10/0x10
[ 111.221281][ T1081] ? _raw_spin_unlock_irq+0x23/0x50
[ 111.223976][ T1081] ? lockdep_hardirqs_on+0x9c/0x150
[ 111.226606][ T1081] ? __pfx_kthread+0x10/0x10
[ 111.228683][ T1081] ret_from_fork+0x3f9/0x770
[ 111.230742][ T1081] ? __pfx_ret_from_fork+0x10/0x10
[ 111.232964][ T1081] ? __pfx_kthread+0x10/0x10
[ 111.234905][ T1081] ret_from_fork_asm+0x1a/0x30
[ 111.237029][ T1081]
[ 111.238724][ T1081] Kernel Offset: disabled
[ 111.240569][ T1081] Rebooting in 86400 seconds..
VM DIAGNOSIS:
15:54:14 Registers:
info registers vcpu 0
CPU#0
RAX=0000000000000069 RBX=0000000000000069 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc9000282e450
R8 =ffff888033df8237 R9 =1ffff110067bf046 R10=dffffc0000000000 R11=ffffffff8550c280
R12=dffffc0000000000 R13=ffffffff99b058e1 R14=ffffffff99dfa820 R15=0000000000000000
RIP=ffffffff8550c2fc RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff88808d210000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007fe362974980 CR3=000000004596e000 CR4=00352ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001fa0
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000
Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 145c07a3145c07a3 145c07a3145c07a3
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 cd0f7eedcd0f7eed cd0f7eedcd0f7eed
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 213f34da213f34da 213f34da213f34da
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 b888f2d8b3de4060 1ee091cb1d3172fd
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 d1032011d3b69ca8 7b560cba686c31d9
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 bf3b9e4a80140504 f7fc326803c11838
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 c1f2dfe3d611be2e c64630b198839824
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 e8eeb4b740bb86d1 5236a4d49e0747be
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ff39beb0e3d85aef 384a72f57781bb32
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 83a685d98e0df65c f4f39f29423b77c0
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 3b92eb46c420f521 d872f73531fcc3a8
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 d4dc842ed4dc842e d4dc842ed4dc842e
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 9344d9fa9344d9fa 9344d9fa9344d9fa
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 9983f2e19983f2e1 9983f2e19983f2e1
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000