[....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
Starting mcstransd:
[ 100.921216][ T27] audit: type=1400 audit(1582282103.719:37): avc: denied { watch } for pid=10636 comm="restorecond" path="/root/.ssh" dev="sda1" ino=16179 scontext=system_u:system_r:kernel_t:s0 tcontext=unconfined_u:object_r:ssh_home_t:s0 tclass=dir permissive=1
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
Debian GNU/Linux 7 syzkaller ttyS0
syzkaller login: [ 105.982501][ T27] kauditd_printk_skb: 3 callbacks suppressed
[ 105.982516][ T27] audit: type=1400 audit(1582282108.779:41): avc: denied { map } for pid=10718 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1
Warning: Permanently added '10.128.0.131' (ECDSA) to the list of known hosts.
[ 112.878416][ T27] audit: type=1400 audit(1582282115.669:42): avc: denied { map } for pid=10730 comm="syz-executor987" path="/root/syz-executor987174022" dev="sda1" ino=16483 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
[ 112.903508][T10731] IPVS: ftp: loaded support on port[0] = 21
[ 112.960376][T10731] chnl_net:caif_netlink_parms(): no params data found
[ 113.001433][T10731] bridge0: port 1(bridge_slave_0) entered blocking state
[ 113.011079][T10731] bridge0: port 1(bridge_slave_0) entered disabled state
[ 113.020413][T10731] device bridge_slave_0 entered promiscuous mode
[ 113.032350][T10731] bridge0: port 2(bridge_slave_1) entered blocking state
[ 113.042324][T10731] bridge0: port 2(bridge_slave_1) entered disabled state
[ 113.054779][T10731] device bridge_slave_1 entered promiscuous mode
[ 113.076675][T10731] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 113.091804][T10731] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 113.116031][T10731] team0: Port device team_slave_0 added
[ 113.124978][T10731] team0: Port device team_slave_1 added
[ 113.142030][T10731] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 113.150207][T10731] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 113.181339][T10731] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 113.198154][T10731] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 113.207068][T10731] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 113.239321][T10731] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 113.312709][T10731] device hsr_slave_0 entered promiscuous mode
[ 113.359742][T10731] device hsr_slave_1 entered promiscuous mode
[ 113.502617][ T27] audit: type=1400 audit(1582282116.299:43): avc: denied { create } for pid=10731 comm="syz-executor987" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[ 113.505669][T10731] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 113.535833][ T27] audit: type=1400 audit(1582282116.299:44): avc: denied { write } for pid=10731 comm="syz-executor987" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[ 113.570825][ T27] audit: type=1400 audit(1582282116.299:45): avc: denied { read } for pid=10731 comm="syz-executor987" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[ 113.612543][T10731] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 113.672140][T10731] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 113.731900][T10731] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 113.809277][T10731] bridge0: port 2(bridge_slave_1) entered blocking state
[ 113.817965][T10731] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 113.827404][T10731] bridge0: port 1(bridge_slave_0) entered blocking state
[ 113.836298][T10731] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 113.901400][T10731] 8021q: adding VLAN 0 to HW filter on device bond0
[ 113.918533][ T3446] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 113.930374][ T3446] bridge0: port 1(bridge_slave_0) entered disabled state
[ 113.941284][ T3446] bridge0: port 2(bridge_slave_1) entered disabled state
[ 113.954536][ T3446] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 113.970426][T10731] 8021q: adding VLAN 0 to HW filter on device team0
[ 113.983277][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 113.995179][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 114.009266][ T2687] bridge0: port 1(bridge_slave_0) entered blocking state
[ 114.017690][ T2687] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 114.048800][ T2688] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 114.058944][ T2688] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 114.068394][ T2688] bridge0: port 2(bridge_slave_1) entered blocking state
[ 114.076069][ T2688] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 114.086879][ T2688] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 114.096285][ T2688] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 114.105863][ T2688] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 114.115425][ T2688] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 114.128511][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 114.137321][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 114.146528][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 114.162148][ T3448] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 114.172245][ T3448] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 114.187726][T10731] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 114.201746][T10731] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 114.211324][ T3451] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 114.221297][ T3451] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 114.249660][ T3451] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 114.258744][ T3451] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 114.273440][T10731] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 114.299154][ T3451] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 114.311429][ T3451] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 114.336151][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 114.346721][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 114.357586][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 114.366670][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 114.377261][T10731] device veth0_vlan entered promiscuous mode
[ 114.395655][T10731] device veth1_vlan entered promiscuous mode
[ 114.424329][ T3451] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 114.434571][ T3451] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 114.444605][ T3451] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 114.454508][ T3451] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 114.467223][T10731] device veth0_macvtap entered promiscuous mode
[ 114.481717][T10731] device veth1_macvtap entered promiscuous mode
[ 114.506853][T10731] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 114.516687][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 114.525564][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 114.535993][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 114.546047][ T2687] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 114.561785][T10731] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 114.569739][ T3451] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 114.581815][ T3451] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
executing program
[ 114.769525][ C0] ==================================================================
[ 114.778987][ C0] BUG: KASAN: use-after-free in find_match+0xb39/0xc90
[ 114.786855][ C0] Read of size 8 at addr ffff88807477a320 by task syz-executor987/10731
[ 114.797305][ C0]
[ 114.799959][ C0] CPU: 0 PID: 10731 Comm: syz-executor987 Not tainted 5.6.0-rc2-syzkaller #0
[ 114.809808][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 114.822073][ C0] Call Trace:
[ 114.825971][ C0]
[ 114.829106][ C0] dump_stack+0x197/0x210
[ 114.834169][ C0] ? find_match+0xb39/0xc90
[ 114.841097][ C0] print_address_description.constprop.0.cold+0xd4/0x30b
[ 114.849388][ C0] ? find_match+0xb39/0xc90
[ 114.854524][ C0] ? find_match+0xb39/0xc90
[ 114.859526][ C0] __kasan_report.cold+0x1b/0x32
[ 114.866426][ C0] ? find_match+0xb39/0xc90
[ 114.873133][ C0] kasan_report+0x12/0x20
[ 114.878061][ C0] __asan_report_load8_noabort+0x14/0x20
[ 114.885142][ C0] find_match+0xb39/0xc90
[ 114.890958][ C0] ? rcu_read_lock_held+0x9c/0xb0
[ 114.896891][ C0] ? rcu_read_lock_held_common+0x130/0x130
[ 114.903628][ C0] __find_rr_leaf+0x14e/0x750
[ 114.908914][ C0] ? nexthop_is_blackhole+0x690/0x690
[ 114.914741][ C0] ? rcu_lockdep_current_cpu_online+0xe3/0x130
[ 114.921021][ C0] ? rcu_read_lock_held+0x9c/0xb0
[ 114.927126][ C0] ? rcu_read_lock_held_common+0x130/0x130
[ 114.933276][ C0] fib6_table_lookup+0x697/0xdb0
[ 114.938532][ C0] ? rt6_age_exceptions+0x130/0x130
[ 114.943864][ C0] ? __kasan_check_read+0x11/0x20
[ 114.949379][ C0] ip6_pol_route+0x1f6/0xa70
[ 114.954250][ C0] ? ip6_pol_route_lookup+0x12e0/0x12e0
[ 114.960320][ C0] ? csum_partial_ext+0x26/0x30
[ 114.966110][ C0] ? __skb_checksum+0x546/0x830
[ 114.970979][ C0] ip6_pol_route_input+0x65/0x80
[ 114.976238][ C0] fib6_rule_lookup+0x133/0x7d0
[ 114.981414][ C0] ? __skb_checksum_complete_head+0x2f0/0x2f0
[ 114.988244][ C0] ? skb_send_sock_locked+0x7e0/0x7e0
[ 114.995613][ C0] ? ip6_pol_route+0xa70/0xa70
[ 115.000832][ C0] ? fib6_lookup+0x340/0x340
[ 115.007824][ C0] ? nf_ip6_checksum+0x107/0x340
[ 115.013880][ C0] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[ 115.021138][ C0] ? nf_conntrack_icmpv6_error+0x3c1/0x560
[ 115.028194][ C0] ? __sanitizer_cov_trace_switch+0x49/0x80
[ 115.035249][ C0] ip6_route_input_lookup+0xb7/0xd0
[ 115.041629][ C0] ip6_route_input+0x5f0/0xa40
[ 115.046724][ C0] ? ip6_route_check_nh+0x670/0x670
[ 115.052172][ C0] ? cpuup_canceled+0x100/0x1d0
[ 115.057456][ C0] ? rcu_read_lock_held+0x9c/0xb0
[ 115.063276][ C0] ? rcu_read_lock_held_common+0x130/0x130
[ 115.069344][ C0] ip6_rcv_finish_core.isra.0+0x174/0x590
[ 115.076285][ C0] ip6_rcv_finish+0x17a/0x310
[ 115.081730][ C0] ipv6_rcv+0x10e/0x420
[ 115.086290][ C0] ? ip6_rcv_core.isra.0+0x1c30/0x1c30
[ 115.091985][ C0] ? __kasan_check_read+0x11/0x20
[ 115.098604][ C0] ? ip6_rcv_finish_core.isra.0+0x590/0x590
[ 115.105177][ C0] ? ip6_rcv_core.isra.0+0x1c30/0x1c30
[ 115.112033][ C0] __netif_receive_skb_one_core+0x113/0x1a0
[ 115.118815][ C0] ? __netif_receive_skb_core+0x30b0/0x30b0
[ 115.127849][ C0] ? lock_acquire+0x190/0x410
[ 115.132881][ C0] ? process_backlog+0x1b5/0x780
[ 115.139309][ C0] __netif_receive_skb+0x2c/0x1d0
[ 115.144949][ C0] process_backlog+0x226/0x780
[ 115.150819][ C0] ? net_rx_action+0x27b/0x1120
[ 115.156182][ C0] ? lockdep_hardirqs_on+0x19e/0x5e0
[ 115.163917][ C0] net_rx_action+0x508/0x1120
[ 115.169230][ C0] ? napi_busy_loop+0x970/0x970
[ 115.176872][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 115.183746][ C0] ? rcu_read_lock_any_held.part.0+0x50/0x50
[ 115.190568][ C0] ? trace_hardirqs_on+0x67/0x240
[ 115.197041][ C0] __do_softirq+0x262/0x98c
[ 115.202248][ C0] ? sched_clock_cpu+0x1b/0x1b0
[ 115.208433][ C0] irq_exit+0x19b/0x1e0
[ 115.214567][ C0] smp_apic_timer_interrupt+0x1a3/0x610
[ 115.221119][ C0] apic_timer_interrupt+0xf/0x20
[ 115.226839][ C0]
[ 115.230188][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x90/0xe0
[ 115.237219][ C0] Code: 48 c7 c0 b8 b0 b3 89 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 39 48 83 3d cf 84 c3 01 00 74 24 48 89 df 57 9d <0f> 1f 44 00 00 bf 01 00 00 00 e8 91 a8 60 f9 65 8b 05 82 f2 11 78
[ 115.261762][ C0] RSP: 0018:ffffc90001f178c8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
[ 115.271906][ C0] RAX: 1ffffffff1367617 RBX: 0000000000000286 RCX: 0000000000000000
[ 115.280132][ C0] RDX: dffffc0000000000 RSI: 0000000000000006 RDI: 0000000000000286
[ 115.288333][ C0] RBP: ffffc90001f178d8 R08: ffff8880861d2100 R09: 0000000000000000
[ 115.296454][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff8bb0c108
[ 115.305582][ C0] R13: ffffffff8bb0c108 R14: ffff888081280000 R15: 0000000000000001
[ 115.313795][ C0] debug_check_no_obj_freed+0x20a/0x441
[ 115.319995][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 115.325886][ C0] __free_pages_ok+0x266/0xea0
[ 115.330884][ C0] free_compound_page+0x97/0xd0
[ 115.338533][ C0] free_transhuge_page+0x2a7/0x3b0
[ 115.343854][ C0] __put_compound_page+0x90/0xd0
[ 115.349062][ C0] release_pages+0x679/0x1ac0
[ 115.353775][ C0] ? __activate_page+0x1460/0x1460
[ 115.358918][ C0] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[ 115.365281][ C0] ? lru_add_drain_cpu+0x212/0x5c0
[ 115.370404][ C0] free_pages_and_swap_cache+0x2c3/0x3f0
[ 115.376211][ C0] tlb_flush_mmu+0x95/0x630
[ 115.380750][ C0] tlb_finish_mmu+0x98/0x3b0
[ 115.386435][ C0] exit_mmap+0x2da/0x530
[ 115.390880][ C0] ? __ia32_sys_munmap+0x80/0x80
[ 115.395833][ C0] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[ 115.402684][ C0] ? __khugepaged_exit+0xcf/0x410
[ 115.407885][ C0] mmput+0x179/0x4d0
[ 115.411774][ C0] do_exit+0xac2/0x2f50
[ 115.416133][ C0] ? mm_update_next_owner+0x7c0/0x7c0
[ 115.422513][ C0] ? up_read+0x1cd/0x810
[ 115.426764][ C0] ? down_read_non_owner+0x490/0x490
[ 115.432251][ C0] ? trace_hardirqs_on_thunk+0x1a/0x1c
[ 115.437838][ C0] ? trace_hardirqs_on_thunk+0x1a/0x1c
[ 115.443313][ C0] do_group_exit+0x135/0x360
[ 115.448048][ C0] __x64_sys_exit_group+0x44/0x50
[ 115.453610][ C0] do_syscall_64+0xfa/0x790
[ 115.458206][ C0] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 115.464234][ C0] RIP: 0033:0x442198
[ 115.468702][ C0] Code: Bad RIP value.
[ 115.473525][ C0] RSP: 002b:00007ffcb7d043a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 115.482101][ C0] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000442198
[ 115.490121][ C0] RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001
[ 115.499109][ C0] RBP: 00000000004c8790 R08: 00000000000000e7 R09: ffffffffffffffd0
[ 115.507083][ C0] R10: 0000000001bbbbbb R11: 0000000000000246 R12: 0000000000000001
[ 115.515328][ C0] R13: 00000000006dba60 R14: 0000000000000000 R15: 0000000000000000
[ 115.523354][ C0]
[ 115.526637][ C0] Allocated by task 10731:
[ 115.531145][ C0] save_stack+0x23/0x90
[ 115.535362][ C0] __kasan_kmalloc.constprop.0+0xcf/0xe0
[ 115.541088][ C0] kasan_kmalloc+0x9/0x10
[ 115.545435][ C0] __kmalloc_node+0x4e/0x70
[ 115.553842][ C0] kvmalloc_node+0x68/0x100
[ 115.558431][ C0] alloc_netdev_mqs+0x98/0xe40
[ 115.563194][ C0] vti6_init_net+0x244/0x810
[ 115.568265][ C0] ops_init+0xb3/0x420
[ 115.572667][ C0] setup_net+0x2d5/0x8b0
[ 115.577868][ C0] copy_net_ns+0x29e/0x5a0
[ 115.582302][ C0] create_new_namespaces+0x403/0xb50
[ 115.587576][ C0] unshare_nsproxy_namespaces+0xc2/0x200
[ 115.594262][ C0] ksys_unshare+0x444/0x980
[ 115.598876][ C0] __x64_sys_unshare+0x31/0x40
[ 115.603724][ C0] do_syscall_64+0xfa/0x790
[ 115.608214][ C0] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 115.614287][ C0]
[ 115.616862][ C0] Freed by task 10731:
[ 115.620927][ C0] save_stack+0x23/0x90
[ 115.625163][ C0] __kasan_slab_free+0x102/0x150
[ 115.630094][ C0] kasan_slab_free+0xe/0x10
[ 115.636244][ C0] kfree+0x10a/0x2c0
[ 115.640220][ C0] __netdev_name_node_alt_destroy+0x1ff/0x2a0
[ 115.646381][ C0] netdev_name_node_alt_destroy+0x57/0x80
[ 115.654688][ C0] rtnl_linkprop.isra.0+0x575/0x6f0
[ 115.660375][ C0] rtnl_dellinkprop+0x46/0x60
[ 115.665169][ C0] rtnetlink_rcv_msg+0x45e/0xaf0
[ 115.670303][ C0] netlink_rcv_skb+0x177/0x450
[ 115.675087][ C0] rtnetlink_rcv+0x1d/0x30
[ 115.680496][ C0] netlink_unicast+0x59e/0x7e0
[ 115.685273][ C0] netlink_sendmsg+0x91c/0xea0
[ 115.690031][ C0] sock_sendmsg+0xd7/0x130
[ 115.695445][ C0] ____sys_sendmsg+0x753/0x880
[ 115.700208][ C0] ___sys_sendmsg+0x100/0x170
[ 115.705399][ C0] __sys_sendmsg+0x105/0x1d0
[ 115.710031][ C0] __x64_sys_sendmsg+0x78/0xb0
[ 115.714872][ C0] do_syscall_64+0xfa/0x790
[ 115.722192][ C0] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 115.728161][ C0]
[ 115.730574][ C0] The buggy address belongs to the object at ffff88807477a000
[ 115.730574][ C0] which belongs to the cache kmalloc-4k of size 4096
[ 115.744757][ C0] The buggy address is located 800 bytes inside of
[ 115.744757][ C0] 4096-byte region [ffff88807477a000, ffff88807477b000)
[ 115.758985][ C0] The buggy address belongs to the page:
[ 115.764623][ C0] page:ffffea0001d1de80 refcount:1 mapcount:0 mapping:ffff8880aa402000 index:0x0 compound_mapcount: 0
[ 115.777283][ C0] flags: 0xfffe0000010200(slab|head)
[ 115.782625][ C0] raw: 00fffe0000010200 ffffea0001d1de08 ffffea000270ae08 ffff8880aa402000
[ 115.791205][ C0] raw: 0000000000000000 ffff88807477a000 0000000100000001 0000000000000000
[ 115.800723][ C0] page dumped because: kasan: bad access detected
[ 115.807174][ C0]
[ 115.809485][ C0] Memory state around the buggy address:
[ 115.815100][ C0] ffff88807477a200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 115.824907][ C0] ffff88807477a280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 115.833228][ C0] >ffff88807477a300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 115.841298][ C0] ^
[ 115.846523][ C0] ffff88807477a380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 115.854738][ C0] ffff88807477a400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 115.862961][ C0] ==================================================================
[ 115.871011][ C0] Disabling lock debugging due to kernel taint
[ 115.877388][ C0] Kernel panic - not syncing: panic_on_warn set ...
[ 115.884010][ C0] CPU: 0 PID: 10731 Comm: syz-executor987 Tainted: G B 5.6.0-rc2-syzkaller #0
[ 115.894685][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 115.905457][ C0] Call Trace:
[ 115.908732][ C0]
[ 115.911755][ C0] dump_stack+0x197/0x210
[ 115.917902][ C0] panic+0x2e3/0x75c
[ 115.921874][ C0] ? add_taint.cold+0x16/0x16
[ 115.926783][ C0] ? trace_hardirqs_on+0x5e/0x240
[ 115.931993][ C0] ? trace_hardirqs_on+0x5e/0x240
[ 115.937184][ C0] ? find_match+0xb39/0xc90
[ 115.941684][ C0] end_report+0x47/0x4f
[ 115.946047][ C0] ? find_match+0xb39/0xc90
[ 115.950561][ C0] __kasan_report.cold+0xe/0x32
[ 115.955576][ C0] ? find_match+0xb39/0xc90
[ 115.960115][ C0] kasan_report+0x12/0x20
[ 115.964425][ C0] __asan_report_load8_noabort+0x14/0x20
[ 115.972231][ C0] find_match+0xb39/0xc90
[ 115.976641][ C0] ? rcu_read_lock_held+0x9c/0xb0
[ 115.981676][ C0] ? rcu_read_lock_held_common+0x130/0x130
[ 115.987496][ C0] __find_rr_leaf+0x14e/0x750
[ 115.992201][ C0] ? nexthop_is_blackhole+0x690/0x690
[ 115.997668][ C0] ? rcu_lockdep_current_cpu_online+0xe3/0x130
[ 116.003983][ C0] ? rcu_read_lock_held+0x9c/0xb0
[ 116.009391][ C0] ? rcu_read_lock_held_common+0x130/0x130
[ 116.016410][ C0] fib6_table_lookup+0x697/0xdb0
[ 116.021525][ C0] ? rt6_age_exceptions+0x130/0x130
[ 116.026823][ C0] ? __kasan_check_read+0x11/0x20
[ 116.032023][ C0] ip6_pol_route+0x1f6/0xa70
[ 116.036623][ C0] ? ip6_pol_route_lookup+0x12e0/0x12e0
[ 116.042254][ C0] ? csum_partial_ext+0x26/0x30
[ 116.047207][ C0] ? __skb_checksum+0x546/0x830
[ 116.052268][ C0] ip6_pol_route_input+0x65/0x80
[ 116.058177][ C0] fib6_rule_lookup+0x133/0x7d0
[ 116.063425][ C0] ? __skb_checksum_complete_head+0x2f0/0x2f0
[ 116.069600][ C0] ? skb_send_sock_locked+0x7e0/0x7e0
[ 116.075921][ C0] ? ip6_pol_route+0xa70/0xa70
[ 116.080709][ C0] ? fib6_lookup+0x340/0x340
[ 116.085300][ C0] ? nf_ip6_checksum+0x107/0x340
[ 116.091043][ C0] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[ 116.097373][ C0] ? nf_conntrack_icmpv6_error+0x3c1/0x560
[ 116.103791][ C0] ? __sanitizer_cov_trace_switch+0x49/0x80
[ 116.110819][ C0] ip6_route_input_lookup+0xb7/0xd0
[ 116.116106][ C0] ip6_route_input+0x5f0/0xa40
[ 116.121031][ C0] ? ip6_route_check_nh+0x670/0x670
[ 116.126234][ C0] ? cpuup_canceled+0x100/0x1d0
[ 116.132072][ C0] ? rcu_read_lock_held+0x9c/0xb0
[ 116.137688][ C0] ? rcu_read_lock_held_common+0x130/0x130
[ 116.143933][ C0] ip6_rcv_finish_core.isra.0+0x174/0x590
[ 116.149770][ C0] ip6_rcv_finish+0x17a/0x310
[ 116.154688][ C0] ipv6_rcv+0x10e/0x420
[ 116.159891][ C0] ? ip6_rcv_core.isra.0+0x1c30/0x1c30
[ 116.165534][ C0] ? __kasan_check_read+0x11/0x20
[ 116.170623][ C0] ? ip6_rcv_finish_core.isra.0+0x590/0x590
[ 116.176515][ C0] ? ip6_rcv_core.isra.0+0x1c30/0x1c30
[ 116.181957][ C0] __netif_receive_skb_one_core+0x113/0x1a0
[ 116.187937][ C0] ? __netif_receive_skb_core+0x30b0/0x30b0
[ 116.194367][ C0] ? lock_acquire+0x190/0x410
[ 116.199039][ C0] ? process_backlog+0x1b5/0x780
[ 116.204061][ C0] __netif_receive_skb+0x2c/0x1d0
[ 116.209245][ C0] process_backlog+0x226/0x780
[ 116.213995][ C0] ? net_rx_action+0x27b/0x1120
[ 116.218829][ C0] ? lockdep_hardirqs_on+0x19e/0x5e0
[ 116.224186][ C0] net_rx_action+0x508/0x1120
[ 116.229018][ C0] ? napi_busy_loop+0x970/0x970
[ 116.233942][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 116.239467][ C0] ? rcu_read_lock_any_held.part.0+0x50/0x50
[ 116.248151][ C0] ? trace_hardirqs_on+0x67/0x240
[ 116.253170][ C0] __do_softirq+0x262/0x98c
[ 116.257657][ C0] ? sched_clock_cpu+0x1b/0x1b0
[ 116.264242][ C0] irq_exit+0x19b/0x1e0
[ 116.268568][ C0] smp_apic_timer_interrupt+0x1a3/0x610
[ 116.274113][ C0] apic_timer_interrupt+0xf/0x20
[ 116.279027][ C0]
[ 116.281952][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x90/0xe0
[ 116.288356][ C0] Code: 48 c7 c0 b8 b0 b3 89 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 39 48 83 3d cf 84 c3 01 00 74 24 48 89 df 57 9d <0f> 1f 44 00 00 bf 01 00 00 00 e8 91 a8 60 f9 65 8b 05 82 f2 11 78
[ 116.308094][ C0] RSP: 0018:ffffc90001f178c8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
[ 116.316925][ C0] RAX: 1ffffffff1367617 RBX: 0000000000000286 RCX: 0000000000000000
[ 116.324884][ C0] RDX: dffffc0000000000 RSI: 0000000000000006 RDI: 0000000000000286
[ 116.332959][ C0] RBP: ffffc90001f178d8 R08: ffff8880861d2100 R09: 0000000000000000
[ 116.340917][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff8bb0c108
[ 116.348872][ C0] R13: ffffffff8bb0c108 R14: ffff888081280000 R15: 0000000000000001
[ 116.356878][ C0] debug_check_no_obj_freed+0x20a/0x441
[ 116.362420][ C0] ? rcu_read_lock_sched_held+0x9c/0xd0
[ 116.368017][ C0] __free_pages_ok+0x266/0xea0
[ 116.373215][ C0] free_compound_page+0x97/0xd0
[ 116.379437][ C0] free_transhuge_page+0x2a7/0x3b0
[ 116.384630][ C0] __put_compound_page+0x90/0xd0
[ 116.389730][ C0] release_pages+0x679/0x1ac0
[ 116.394969][ C0] ? __activate_page+0x1460/0x1460
[ 116.400251][ C0] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[ 116.407234][ C0] ? lru_add_drain_cpu+0x212/0x5c0
[ 116.414942][ C0] free_pages_and_swap_cache+0x2c3/0x3f0
[ 116.420659][ C0] tlb_flush_mmu+0x95/0x630
[ 116.425680][ C0] tlb_finish_mmu+0x98/0x3b0
[ 116.430480][ C0] exit_mmap+0x2da/0x530
[ 116.435186][ C0] ? __ia32_sys_munmap+0x80/0x80
[ 116.440122][ C0] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[ 116.446556][ C0] ? __khugepaged_exit+0xcf/0x410
[ 116.451687][ C0] mmput+0x179/0x4d0
[ 116.455665][ C0] do_exit+0xac2/0x2f50
[ 116.459970][ C0] ? mm_update_next_owner+0x7c0/0x7c0
[ 116.465330][ C0] ? up_read+0x1cd/0x810
[ 116.469617][ C0] ? down_read_non_owner+0x490/0x490
[ 116.474992][ C0] ? trace_hardirqs_on_thunk+0x1a/0x1c
[ 116.480561][ C0] ? trace_hardirqs_on_thunk+0x1a/0x1c
[ 116.486038][ C0] do_group_exit+0x135/0x360
[ 116.490752][ C0] __x64_sys_exit_group+0x44/0x50
[ 116.495778][ C0] do_syscall_64+0xfa/0x790
[ 116.500756][ C0] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 116.506642][ C0] RIP: 0033:0x442198
[ 116.510532][ C0] Code: Bad RIP value.
[ 116.514577][ C0] RSP: 002b:00007ffcb7d043a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 116.522977][ C0] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000442198
[ 116.531152][ C0] RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001
[ 116.539119][ C0] RBP: 00000000004c8790 R08: 00000000000000e7 R09: ffffffffffffffd0
[ 116.547139][ C0] R10: 0000000001bbbbbb R11: 0000000000000246 R12: 0000000000000001
[ 116.555384][ C0] R13: 00000000006dba60 R14: 0000000000000000 R15: 0000000000000000
[ 116.566784][ C0] Kernel Offset: disabled
[ 116.571956][ C0] Rebooting in 86400 seconds..