DUID 00:04:1e:62:2e:d3:28:4c:47:2c:f6:06:4a:96:1e:52:1a:b0
forked to background, child pid 3182
[ 31.452455][ T3183] 8021q: adding VLAN 0 to HW filter on device bond0
[ 31.462126][ T3183] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.10.59' (ECDSA) to the list of known hosts.
2021/12/21 23:48:49 fuzzer started
2021/12/21 23:48:49 connecting to host at 10.128.0.169:33021
2021/12/21 23:48:49 checking machine...
2021/12/21 23:48:49 checking revisions...
2021/12/21 23:48:49 testing simple program...
syzkaller login: [ 47.002047][ T3603] cgroup: Unknown subsys name 'net'
[ 47.099499][ T3603] cgroup: Unknown subsys name 'rlimit'
[ 48.478546][ T3605] chnl_net:caif_netlink_parms(): no params data found
[ 48.521133][ T3605] bridge0: port 1(bridge_slave_0) entered blocking state
[ 48.528640][ T3605] bridge0: port 1(bridge_slave_0) entered disabled state
[ 48.536560][ T3605] device bridge_slave_0 entered promiscuous mode
[ 48.545958][ T3605] bridge0: port 2(bridge_slave_1) entered blocking state
[ 48.553043][ T3605] bridge0: port 2(bridge_slave_1) entered disabled state
[ 48.560929][ T3605] device bridge_slave_1 entered promiscuous mode
[ 48.580505][ T3605] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 48.591343][ T3605] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 48.614354][ T3605] team0: Port device team_slave_0 added
[ 48.621456][ T3605] team0: Port device team_slave_1 added
[ 48.638187][ T3605] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 48.645195][ T3605] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 48.671089][ T3605] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 48.683626][ T3605] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 48.690570][ T3605] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 48.716719][ T3605] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 48.744032][ T3605] device hsr_slave_0 entered promiscuous mode
[ 48.750845][ T3605] device hsr_slave_1 entered promiscuous mode
[ 48.827345][ T3605] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 48.838673][ T3605] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 48.847605][ T3605] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 48.856545][ T3605] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 48.876285][ T3605] bridge0: port 2(bridge_slave_1) entered blocking state
[ 48.883465][ T3605] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 48.890940][ T3605] bridge0: port 1(bridge_slave_0) entered blocking state
[ 48.898062][ T3605] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 48.940367][ T3605] 8021q: adding VLAN 0 to HW filter on device bond0
[ 48.952944][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 48.963532][ T25] bridge0: port 1(bridge_slave_0) entered disabled state
[ 48.971958][ T25] bridge0: port 2(bridge_slave_1) entered disabled state
[ 48.980262][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 48.992813][ T3605] 8021q: adding VLAN 0 to HW filter on device team0
[ 49.006069][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 49.014533][ T3617] bridge0: port 1(bridge_slave_0) entered blocking state
[ 49.021576][ T3617] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 49.032362][ T3619] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 49.041780][ T3619] bridge0: port 2(bridge_slave_1) entered blocking state
[ 49.048892][ T3619] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 49.075284][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 49.084280][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 49.092624][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 49.101295][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 49.112508][ T3605] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 49.121103][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 49.141359][ T3605] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 49.149295][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 49.157023][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 49.184961][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 49.194409][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 49.202534][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 49.210276][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 49.220058][ T3605] device veth0_vlan entered promiscuous mode
[ 49.231704][ T3605] device veth1_vlan entered promiscuous mode
[ 49.250710][ T3605] device veth0_macvtap entered promiscuous mode
[ 49.259697][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 49.267789][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 49.276310][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 49.284840][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 49.295192][ T3605] device veth1_macvtap entered promiscuous mode
[ 49.312167][ T3605] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 49.319662][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 49.331316][ T3605] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 49.339722][ T924] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 49.350162][ T3605] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 49.359630][ T3605] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 49.368568][ T3605] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 49.377541][ T3605] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 49.437550][ T10] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 49.445888][ T10] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 49.459046][ T3619] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 49.471240][ T8] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 49.479536][ T8] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 49.488224][ T3619] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
2021/12/21 23:48:52 building call list...
executing program
[ 51.709701][ T3601] can: request_module (can-proto-0) failed.
[ 51.731718][ T3601] can: request_module (can-proto-0) failed.
[ 51.752306][ T3601] can: request_module (can-proto-0) failed.
[ 51.947839][ T3601] ------------[ cut here ]------------
[ 51.954494][ T3601] refcount_t: decrement hit 0; leaking memory.
[ 51.960918][ T3601] WARNING: CPU: 1 PID: 3601 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0
[ 51.970355][ T3601] Modules linked in:
[ 51.974622][ T3601] CPU: 0 PID: 3601 Comm: syz-fuzzer Not tainted 5.16.0-rc4-syzkaller #0
[ 51.982999][ T3601] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 51.993476][ T3601] RIP: 0010:refcount_warn_saturate+0xbf/0x1e0
[ 51.999576][ T3601] Code: 1d d1 db a0 09 31 ff 89 de e8 5d 6a 9b fd 84 db 75 e0 e8 74 66 9b fd 48 c7 c7 e0 0a 05 8a c6 05 b1 db a0 09 01 e8 cc 4b 27 05 <0f> 0b eb c4 e8 58 66 9b fd 0f b6 1d a0 db a0 09 31 ff 89 de e8 28
[ 52.019978][ T3601] RSP: 0018:ffffc900027bfab0 EFLAGS: 00010286
[ 52.027278][ T3601] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 52.035288][ T3601] RDX: ffff88801cc40000 RSI: ffffffff815f1e28 RDI: fffff520004f7f48
[ 52.043434][ T3601] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
[ 52.051632][ T3601] R10: ffffffff815ebbce R11: 0000000000000000 R12: 1ffff920004f7f5b
[ 52.059742][ T3601] R13: 00000000ffffffef R14: ffffffff8d2fdf54 R15: ffffc900027bfd10
[ 52.067817][ T3601] FS: 000000c00047e890(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
[ 52.076871][ T3601] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 52.083563][ T3601] CR2: 00007f6d7ae24300 CR3: 000000007dd70000 CR4: 00000000003506f0
[ 52.091532][ T3601] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 52.099556][ T3601] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 52.107560][ T3601] Call Trace:
[ 52.110829][ T3601]
[ 52.113938][ T3601] ref_tracker_free+0x4fe/0x610
[ 52.118816][ T3601] ? ref_tracker_dir_exit+0x330/0x330
[ 52.124218][ T3601] ? bpf_sk_storage_free+0x333/0x3e0
[ 52.129520][ T3601] ? lock_downgrade+0x6e0/0x6e0
[ 52.135452][ T3601] ? kfree+0x1e1/0x560
[ 52.139552][ T3601] __sk_destruct+0x4a6/0x920
[ 52.144260][ T3601] sk_destruct+0xbd/0xe0
[ 52.148734][ T3601] __sk_free+0xef/0x3d0
[ 52.152906][ T3601] sk_free+0x78/0xa0
[ 52.156834][ T3601] __mptcp_close_ssk+0x435/0x590
[ 52.161783][ T3601] __mptcp_destroy_sock+0x35f/0x830
[ 52.167017][ T3601] ? __mptcp_close_ssk+0x590/0x590
[ 52.172138][ T3601] ? __local_bh_enable_ip+0xa0/0x120
[ 52.177553][ T3601] mptcp_close+0x5f8/0x7f0
[ 52.182025][ T3601] inet_release+0x12e/0x280
[ 52.186567][ T3601] inet6_release+0x4c/0x70
[ 52.190997][ T3601] __sock_release+0xcd/0x280
[ 52.195628][ T3601] sock_close+0x18/0x20
[ 52.199790][ T3601] __fput+0x286/0x9f0
[ 52.203895][ T3601] ? __sock_release+0x280/0x280
[ 52.208762][ T3601] task_work_run+0xdd/0x1a0
[ 52.213357][ T3601] exit_to_user_mode_prepare+0x27e/0x290
[ 52.219002][ T3601] syscall_exit_to_user_mode+0x19/0x60
[ 52.224695][ T3601] do_syscall_64+0x42/0xb0
[ 52.229204][ T3601] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 52.236019][ T3601] RIP: 0033:0x4b12db
[ 52.239904][ T3601] Code: fb ff eb bd e8 46 96 fb ff e9 61 ff ff ff cc e8 fb 61 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30
[ 52.260151][ T3601] RSP: 002b:000000c0001dd4f0 EFLAGS: 00000206 ORIG_RAX: 0000000000000003
[ 52.268757][ T3601] RAX: 0000000000000000 RBX: 000000c00001e000 RCX: 00000000004b12db
[ 52.276915][ T3601] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006
[ 52.285037][ T3601] RBP: 000000c0001dd530 R08: 0000000000f0e801 R09: 00007ffc9418a080
[ 52.293001][ T3601] R10: 00007ffc9418a090 R11: 0000000000000206 R12: 000000000000000a
[ 52.301099][ T3601] R13: 0000000000000000 R14: ffffffffffffffff R15: 000000c0001379a0
[ 52.309941][ T3601]
[ 52.312958][ T3601] Kernel panic - not syncing: panic_on_warn set ...
[ 52.319524][ T3601] CPU: 0 PID: 3601 Comm: syz-fuzzer Not tainted 5.16.0-rc4-syzkaller #0
[ 52.327832][ T3601] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 52.337869][ T3601] Call Trace:
[ 52.341133][ T3601]
[ 52.344050][ T3601] dump_stack_lvl+0xcd/0x134
[ 52.348629][ T3601] panic+0x2b0/0x6dd
[ 52.352512][ T3601] ? __warn_printk+0xf3/0xf3
[ 52.357094][ T3601] ? __warn.cold+0x1a/0x44
[ 52.361499][ T3601] ? refcount_warn_saturate+0xbf/0x1e0
[ 52.366950][ T3601] __warn.cold+0x35/0x44
[ 52.371178][ T3601] ? wake_up_klogd.part.0+0x8e/0xd0
[ 52.376365][ T3601] ? refcount_warn_saturate+0xbf/0x1e0
[ 52.381811][ T3601] report_bug+0x1bd/0x210
[ 52.386133][ T3601] handle_bug+0x3c/0x60
[ 52.390272][ T3601] exc_invalid_op+0x14/0x40
[ 52.394762][ T3601] asm_exc_invalid_op+0x12/0x20
[ 52.399600][ T3601] RIP: 0010:refcount_warn_saturate+0xbf/0x1e0
[ 52.405651][ T3601] Code: 1d d1 db a0 09 31 ff 89 de e8 5d 6a 9b fd 84 db 75 e0 e8 74 66 9b fd 48 c7 c7 e0 0a 05 8a c6 05 b1 db a0 09 01 e8 cc 4b 27 05 <0f> 0b eb c4 e8 58 66 9b fd 0f b6 1d a0 db a0 09 31 ff 89 de e8 28
[ 52.425239][ T3601] RSP: 0018:ffffc900027bfab0 EFLAGS: 00010286
[ 52.431287][ T3601] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 52.439241][ T3601] RDX: ffff88801cc40000 RSI: ffffffff815f1e28 RDI: fffff520004f7f48
[ 52.447197][ T3601] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
[ 52.455152][ T3601] R10: ffffffff815ebbce R11: 0000000000000000 R12: 1ffff920004f7f5b
[ 52.463103][ T3601] R13: 00000000ffffffef R14: ffffffff8d2fdf54 R15: ffffc900027bfd10
[ 52.471061][ T3601] ? wake_up_klogd.part.0+0x8e/0xd0
[ 52.476251][ T3601] ? vprintk+0x88/0x90
[ 52.480311][ T3601] ref_tracker_free+0x4fe/0x610
[ 52.485151][ T3601] ? ref_tracker_dir_exit+0x330/0x330
[ 52.490508][ T3601] ? bpf_sk_storage_free+0x333/0x3e0
[ 52.495783][ T3601] ? lock_downgrade+0x6e0/0x6e0
[ 52.500619][ T3601] ? kfree+0x1e1/0x560
[ 52.504695][ T3601] __sk_destruct+0x4a6/0x920
[ 52.509275][ T3601] sk_destruct+0xbd/0xe0
[ 52.513508][ T3601] __sk_free+0xef/0x3d0
[ 52.517660][ T3601] sk_free+0x78/0xa0
[ 52.521545][ T3601] __mptcp_close_ssk+0x435/0x590
[ 52.526471][ T3601] __mptcp_destroy_sock+0x35f/0x830
[ 52.531666][ T3601] ? __mptcp_close_ssk+0x590/0x590
[ 52.536761][ T3601] ? __local_bh_enable_ip+0xa0/0x120
[ 52.542035][ T3601] mptcp_close+0x5f8/0x7f0
[ 52.546440][ T3601] inet_release+0x12e/0x280
[ 52.550941][ T3601] inet6_release+0x4c/0x70
[ 52.555348][ T3601] __sock_release+0xcd/0x280
[ 52.559929][ T3601] sock_close+0x18/0x20
[ 52.564067][ T3601] __fput+0x286/0x9f0
[ 52.568036][ T3601] ? __sock_release+0x280/0x280
[ 52.572873][ T3601] task_work_run+0xdd/0x1a0
[ 52.577365][ T3601] exit_to_user_mode_prepare+0x27e/0x290
[ 52.582986][ T3601] syscall_exit_to_user_mode+0x19/0x60
[ 52.588433][ T3601] do_syscall_64+0x42/0xb0
[ 52.592836][ T3601] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 52.598716][ T3601] RIP: 0033:0x4b12db
[ 52.602591][ T3601] Code: fb ff eb bd e8 46 96 fb ff e9 61 ff ff ff cc e8 fb 61 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30
[ 52.622498][ T3601] RSP: 002b:000000c0001dd4f0 EFLAGS: 00000206 ORIG_RAX: 0000000000000003
[ 52.630893][ T3601] RAX: 0000000000000000 RBX: 000000c00001e000 RCX: 00000000004b12db
[ 52.638852][ T3601] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006
[ 52.646807][ T3601] RBP: 000000c0001dd530 R08: 0000000000f0e801 R09: 00007ffc9418a080
[ 52.654762][ T3601] R10: 00007ffc9418a090 R11: 0000000000000206 R12: 000000000000000a
[ 52.662716][ T3601] R13: 0000000000000000 R14: ffffffffffffffff R15: 000000c0001379a0
[ 52.670679][ T3601]
[ 52.674073][ T3601] Kernel Offset: disabled
[ 52.678476][ T3601] Rebooting in 86400 seconds..