[ 29.726142][ T3183] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.743356][ T3183] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller syzkaller login: [ 41.438119][ T28] kauditd_printk_skb: 37 callbacks suppressed [ 41.438135][ T28] audit: type=1400 audit(1653662620.133:73): avc: denied { transition } for pid=3431 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 41.444135][ T28] audit: type=1400 audit(1653662620.143:74): avc: denied { write } for pid=3431 comm="sh" path="pipe:[27676]" dev="pipefs" ino=27676 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1 Warning: Permanently added '10.128.0.18' (ECDSA) to the list of known hosts. 2022/05/27 14:43:50 parsed 1 programs [ 51.351052][ T28] audit: type=1400 audit(1653662630.053:75): avc: denied { getattr } for pid=3597 comm="syz-execprog" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 51.351326][ T28] audit: type=1400 audit(1653662630.053:76): avc: denied { read } for pid=3597 comm="syz-execprog" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 51.351590][ T28] audit: type=1400 audit(1653662630.053:77): avc: denied { open } for pid=3597 comm="syz-execprog" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 51.371569][ T28] audit: type=1400 audit(1653662630.073:78): avc: denied { read } for pid=3597 comm="syz-execprog" name="raw-gadget" dev="devtmpfs" ino=725 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 51.372063][ T28] audit: type=1400 audit(1653662630.073:79): avc: denied { open } for pid=3597 comm="syz-execprog" path="/dev/raw-gadget" dev="devtmpfs" ino=725 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 51.372966][ T28] audit: type=1400 audit(1653662630.073:80): avc: denied { read } for pid=3597 comm="syz-execprog" name="vhci" dev="devtmpfs" ino=1072 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 51.373399][ T28] audit: type=1400 audit(1653662630.073:81): avc: denied { open } for pid=3597 comm="syz-execprog" path="/dev/vhci" dev="devtmpfs" ino=1072 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 51.418913][ T28] audit: type=1400 audit(1653662630.123:82): avc: denied { mounton } for pid=3602 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1137 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 51.421390][ T28] audit: type=1400 audit(1653662630.123:83): avc: denied { mount } for pid=3602 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 51.426423][ T3602] cgroup: Unknown subsys name 'net' [ 51.430525][ T28] audit: type=1400 audit(1653662630.133:84): avc: denied { unmount } for pid=3602 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 51.685984][ T3602] cgroup: Unknown subsys name 'rlimit' 2022/05/27 14:43:50 executed programs: 0 [ 53.099204][ T3635] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 53.100295][ T3634] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 53.100360][ T3635] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 53.101030][ T3635] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 53.101500][ T3634] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 53.101920][ T3634] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 53.102520][ T3634] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 53.103079][ T3634] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 53.103328][ T3634] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 53.103569][ T3635] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 53.103753][ T3634] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 53.104137][ T3634] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 53.104376][ T3635] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 53.104407][ T3634] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 53.104700][ T3634] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 53.104872][ T3634] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 53.105174][ T3634] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 53.105807][ T3634] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 53.106209][ T3634] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 53.106466][ T3634] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 53.106927][ T3634] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 53.107292][ T3634] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 53.107469][ T3634] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 53.108219][ T3634] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 53.108541][ T3634] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 53.109014][ T3634] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 53.109245][ T3634] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 53.112794][ T3635] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 53.113265][ T3635] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 53.113499][ T3635] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 53.116699][ T3632] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 53.116975][ T3632] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 53.117222][ T3632] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 53.117390][ T3632] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 53.118191][ T3632] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 53.121272][ T3632] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 53.641415][ T3616] chnl_net:caif_netlink_parms(): no params data found [ 53.646999][ T3619] chnl_net:caif_netlink_parms(): no params data found [ 53.712035][ T3617] chnl_net:caif_netlink_parms(): no params data found [ 53.717847][ T3620] chnl_net:caif_netlink_parms(): no params data found [ 53.888874][ T3618] chnl_net:caif_netlink_parms(): no params data found [ 53.917706][ T3619] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.917772][ T3619] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.919093][ T3619] device bridge_slave_0 entered promiscuous mode [ 53.927639][ T3621] chnl_net:caif_netlink_parms(): no params data found [ 53.971339][ T3619] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.971411][ T3619] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.972594][ T3619] device bridge_slave_1 entered promiscuous mode [ 53.973516][ T3616] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.973569][ T3616] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.974572][ T3616] device bridge_slave_0 entered promiscuous mode [ 54.015154][ T3617] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.015220][ T3617] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.016272][ T3617] device bridge_slave_0 entered promiscuous mode [ 54.047862][ T3616] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.047910][ T3616] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.049252][ T3616] device bridge_slave_1 entered promiscuous mode [ 54.077213][ T3617] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.077248][ T3617] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.077856][ T3617] device bridge_slave_1 entered promiscuous mode [ 54.126576][ T3620] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.126641][ T3620] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.127714][ T3620] device bridge_slave_0 entered promiscuous mode [ 54.130195][ T3620] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.130261][ T3620] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.131447][ T3620] device bridge_slave_1 entered promiscuous mode [ 54.182471][ T3617] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 54.185568][ T3617] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 54.192730][ T3619] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 54.195703][ T3619] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 54.221061][ T3616] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 54.223861][ T3616] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 54.299260][ T3619] team0: Port device team_slave_0 added [ 54.309560][ T3620] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 54.344242][ T3619] team0: Port device team_slave_1 added [ 54.356099][ T3616] team0: Port device team_slave_0 added [ 54.357315][ T3620] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 54.380707][ T3617] team0: Port device team_slave_0 added [ 54.395564][ T3621] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.395640][ T3621] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.396295][ T3621] device bridge_slave_0 entered promiscuous mode [ 54.413345][ T3621] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.413410][ T3621] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.414517][ T3621] device bridge_slave_1 entered promiscuous mode [ 54.417263][ T3616] team0: Port device team_slave_1 added [ 54.444343][ T3617] team0: Port device team_slave_1 added [ 54.465283][ T3620] team0: Port device team_slave_0 added [ 54.465664][ T3618] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.465728][ T3618] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.466794][ T3618] device bridge_slave_0 entered promiscuous mode [ 54.469186][ T3620] team0: Port device team_slave_1 added [ 54.513444][ T3619] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 54.513460][ T3619] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 54.513485][ T3619] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 54.557127][ T3617] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 54.557143][ T3617] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 54.557166][ T3617] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 54.616225][ T3618] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.616290][ T3618] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.617567][ T3618] device bridge_slave_1 entered promiscuous mode [ 54.639808][ T3616] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 54.639822][ T3616] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 54.639846][ T3616] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 54.643517][ T3621] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 54.643948][ T3616] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 54.643959][ T3616] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 54.643982][ T3616] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 54.646649][ T3621] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 54.692760][ T3619] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 54.692775][ T3619] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 54.692798][ T3619] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 54.745364][ T3617] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 54.745378][ T3617] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 54.745403][ T3617] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 54.854914][ T3620] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 54.854928][ T3620] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 54.854951][ T3620] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 54.941504][ T3620] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 54.941518][ T3620] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 54.941541][ T3620] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 54.984608][ T3618] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 55.007431][ T3621] team0: Port device team_slave_0 added [ 55.017702][ T3616] device hsr_slave_0 entered promiscuous mode [ 55.018686][ T3616] device hsr_slave_1 entered promiscuous mode [ 55.035149][ T3619] device hsr_slave_0 entered promiscuous mode [ 55.036142][ T3619] device hsr_slave_1 entered promiscuous mode [ 55.036807][ T3619] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 55.036955][ T3619] Cannot create hsr debugfs directory [ 55.055667][ T3617] device hsr_slave_0 entered promiscuous mode [ 55.056574][ T3617] device hsr_slave_1 entered promiscuous mode [ 55.064514][ T3617] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 55.064538][ T3617] Cannot create hsr debugfs directory [ 55.097796][ T3618] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 55.105426][ T3621] team0: Port device team_slave_1 added [ 55.138806][ T145] Bluetooth: hci2: command 0x0409 tx timeout [ 55.139227][ T145] Bluetooth: hci3: command 0x0409 tx timeout [ 55.180819][ T3621] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 55.180833][ T3621] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 55.180855][ T3621] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 55.228239][ T143] Bluetooth: hci0: command 0x0409 tx timeout [ 55.228284][ T143] Bluetooth: hci5: command 0x0409 tx timeout [ 55.228309][ T143] Bluetooth: hci4: command 0x0409 tx timeout [ 55.228339][ T143] Bluetooth: hci1: command 0x0409 tx timeout [ 55.246317][ T3620] device hsr_slave_0 entered promiscuous mode [ 55.263036][ T3620] device hsr_slave_1 entered promiscuous mode [ 55.267196][ T3620] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 55.267218][ T3620] Cannot create hsr debugfs directory [ 55.300636][ T3621] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 55.300651][ T3621] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 55.300675][ T3621] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 55.308868][ T3618] team0: Port device team_slave_0 added [ 55.341354][ T3618] team0: Port device team_slave_1 added [ 55.426597][ T3621] device hsr_slave_0 entered promiscuous mode [ 55.427370][ T3621] device hsr_slave_1 entered promiscuous mode [ 55.427690][ T3621] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 55.427703][ T3621] Cannot create hsr debugfs directory [ 55.431887][ T3618] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 55.431900][ T3618] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 55.431925][ T3618] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 55.436760][ T3618] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 55.436772][ T3618] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 55.436796][ T3618] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 55.594355][ T3618] device hsr_slave_0 entered promiscuous mode [ 55.595329][ T3618] device hsr_slave_1 entered promiscuous mode [ 55.595939][ T3618] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 55.595960][ T3618] Cannot create hsr debugfs directory [ 55.887740][ T3619] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 55.915908][ T3619] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 55.919049][ T3619] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 55.948173][ T3619] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 55.970146][ T3617] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 55.998599][ T3617] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 56.006686][ T3617] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 56.017220][ T3617] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 56.083365][ T3616] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 56.086481][ T3616] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 56.113778][ T3616] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 56.136850][ T3616] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 56.199164][ T3619] 8021q: adding VLAN 0 to HW filter on device bond0 [ 56.240065][ T3617] 8021q: adding VLAN 0 to HW filter on device bond0 [ 56.245571][ T3619] 8021q: adding VLAN 0 to HW filter on device team0 [ 56.274811][ T2933] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 56.277203][ T2933] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 56.284802][ T2933] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 56.286441][ T2933] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 56.287535][ T2933] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.287780][ T2933] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.289661][ T2933] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 56.298666][ T2934] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 56.299287][ T2934] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 56.299755][ T2934] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.299812][ T2934] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.302062][ T3620] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 56.313566][ T3620] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 56.348318][ T3620] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 56.359601][ T3620] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 56.371682][ T2934] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 56.372612][ T2934] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 56.410876][ T3621] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 56.428491][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 56.430192][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 56.430940][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 56.431750][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 56.434118][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 56.434740][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 56.435302][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 56.435854][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 56.436437][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 56.437047][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 56.438407][ T3621] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 56.448724][ T3619] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 56.472998][ T3617] 8021q: adding VLAN 0 to HW filter on device team0 [ 56.479974][ T2934] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 56.488937][ T3621] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 56.498375][ T3668] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 56.498555][ T3668] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 56.517738][ T3621] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 56.542813][ T2933] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 56.543518][ T2933] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 56.543984][ T2933] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.544047][ T2933] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.544482][ T2933] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 56.545085][ T2933] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 56.545510][ T2933] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.545571][ T2933] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.545995][ T2933] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 56.549900][ T3619] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 56.556947][ T28] kauditd_printk_skb: 14 callbacks suppressed [ 56.556964][ T28] audit: type=1400 audit(1653662635.253:99): avc: denied { module_request } for pid=3619 comm="syz-executor.0" kmod="netdev-xfrm0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 56.585468][ T3668] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 56.586149][ T3668] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 56.586972][ T3668] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 56.587954][ T3668] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 56.590191][ T2933] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 56.656662][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 56.657553][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 56.658542][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 56.659210][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 56.660232][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 56.660903][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 56.671861][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 56.694282][ T28] audit: type=1400 audit(1653662635.383:100): avc: denied { sys_module } for pid=3619 comm="syz-executor.0" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 56.695707][ T3618] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 56.716497][ T3616] 8021q: adding VLAN 0 to HW filter on device bond0 [ 56.731210][ T3618] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 56.737719][ T3618] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 56.753838][ T3618] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 56.782160][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 56.782330][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 56.828730][ T3617] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 56.887904][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 56.888987][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 56.921310][ T3616] 8021q: adding VLAN 0 to HW filter on device team0 [ 56.941522][ T3621] 8021q: adding VLAN 0 to HW filter on device bond0 [ 56.941522][ T3621] 8021q: adding VLAN 0 to HW filter on device bond0 [ 56.965715][ T3663] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 56.966345][ T3663] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 56.966793][ T3663] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.966860][ T3663] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.967297][ T3663] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 56.967902][ T3663] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 56.969017][ T3663] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.969074][ T3663] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.969979][ T3663] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 56.988693][ T3663] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 56.996903][ T3621] 8021q: adding VLAN 0 to HW filter on device team0 [ 57.009568][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 57.010242][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 57.055718][ T3620] 8021q: adding VLAN 0 to HW filter on device bond0 [ 57.059533][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 57.060175][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 57.060659][ T3662] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.060724][ T3662] bridge0: port 1(bridge_slave_0) entered forwarding state [ 57.061179][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 57.061841][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 57.062310][ T3662] bridge0: port 2(bridge_slave_1) entered blocking state [ 57.062378][ T3662] bridge0: port 2(bridge_slave_1) entered forwarding state [ 57.062825][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 57.063727][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 57.064638][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 57.086944][ T3620] 8021q: adding VLAN 0 to HW filter on device team0 [ 57.109052][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 57.109730][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 57.115688][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 57.116671][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 57.117294][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 57.117891][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 57.129650][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 57.130776][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 57.131534][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 57.132388][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 57.133106][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 57.133678][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 57.134288][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 57.134863][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 57.149752][ T3618] 8021q: adding VLAN 0 to HW filter on device bond0 [ 57.169354][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 57.179006][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 57.179866][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 57.180821][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 57.181344][ T3666] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.181404][ T3666] bridge0: port 1(bridge_slave_0) entered forwarding state [ 57.181866][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 57.182529][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 57.183018][ T3666] bridge0: port 2(bridge_slave_1) entered blocking state [ 57.183084][ T3666] bridge0: port 2(bridge_slave_1) entered forwarding state [ 57.183539][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 57.184624][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 57.185356][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 57.185935][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 57.186519][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 57.195581][ T3621] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 57.196405][ T3621] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 57.228589][ T3669] Bluetooth: hci3: command 0x041b tx timeout [ 57.228886][ T3669] Bluetooth: hci2: command 0x041b tx timeout [ 57.236568][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 57.237245][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 57.239874][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 57.240443][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 57.241336][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 57.242350][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 57.243026][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 57.243178][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 57.243306][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 57.244082][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 57.244767][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 57.245337][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 57.285434][ T3618] 8021q: adding VLAN 0 to HW filter on device team0 [ 57.296667][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 57.297467][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 57.297623][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 57.297771][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 57.300231][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 57.300718][ T3662] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.300788][ T3662] bridge0: port 1(bridge_slave_0) entered forwarding state [ 57.301885][ T3662] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 57.304287][ T3616] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 57.313161][ T6] Bluetooth: hci1: command 0x041b tx timeout [ 57.313268][ T6] Bluetooth: hci4: command 0x041b tx timeout [ 57.313352][ T6] Bluetooth: hci5: command 0x041b tx timeout [ 57.313434][ T6] Bluetooth: hci0: command 0x041b tx timeout [ 57.316205][ T3620] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 57.316226][ T3620] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 57.386534][ T2933] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 57.387231][ T2933] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 57.388517][ T2933] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 57.389187][ T2933] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 57.389818][ T2933] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 57.390435][ T2933] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 57.390934][ T2933] bridge0: port 2(bridge_slave_1) entered blocking state [ 57.391002][ T2933] bridge0: port 2(bridge_slave_1) entered forwarding state [ 57.391469][ T2933] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 57.392383][ T2933] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 57.393438][ T2933] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 57.394378][ T2933] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 57.401523][ T3621] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 57.418958][ T2933] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 57.424258][ T2933] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 57.430832][ T2933] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 57.431479][ T2933] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 57.485080][ T3618] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 57.485104][ T3618] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 57.510676][ T3620] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 57.516736][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 57.517633][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 57.518664][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 57.519254][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 57.520038][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 57.520606][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 57.521200][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 57.521335][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 57.521458][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 57.522081][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 57.536677][ T3619] device veth0_vlan entered promiscuous mode [ 57.546218][ T3619] device veth1_vlan entered promiscuous mode [ 57.549320][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 57.549906][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 57.550471][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 57.550985][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 57.551553][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 57.551681][ T3666] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 57.596540][ T3618] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 57.679206][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 57.679919][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 57.680638][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 57.689883][ T3619] device veth0_macvtap entered promiscuous mode [ 57.730217][ T3619] device veth1_macvtap entered promiscuous mode [ 57.772688][ T3619] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 57.773370][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 57.774099][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 57.774712][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 57.775315][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 57.789612][ T3619] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 57.789735][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 57.790471][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 57.806823][ T3619] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.806861][ T3619] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.806891][ T3619] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.806922][ T3619] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.919366][ T11] ================================================================== [ 57.919378][ T11] BUG: KASAN: use-after-free in nf_confirm+0x575/0x5b0 [ 57.919426][ T11] Read of size 1 at addr ffff888077601304 by task kworker/u4:1/11 [ 57.919443][ T11] [ 57.919449][ T11] CPU: 1 PID: 11 Comm: kworker/u4:1 Not tainted 5.18.0-syzkaller-09901-g7f50d4dfe816 #0 [ 57.919471][ T11] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 57.919485][ T11] Workqueue: wg-kex-wg2 wg_packet_handshake_send_worker [ 57.919512][ T11] Call Trace: [ 57.919519][ T11] [ 57.919526][ T11] dump_stack_lvl+0xcd/0x134 [ 57.919549][ T11] print_address_description.constprop.0.cold+0xeb/0x467 [ 57.919580][ T11] ? nf_confirm+0x575/0x5b0 [ 57.919598][ T11] kasan_report.cold+0xf4/0x1c6 [ 57.919624][ T11] ? nf_confirm+0x575/0x5b0 [ 57.919643][ T11] nf_confirm+0x575/0x5b0 [ 57.919663][ T11] ipv4_confirm+0x17a/0x390 [ 57.919682][ T11] nf_hook_slow+0xc5/0x1f0 [ 57.919702][ T11] nf_hook+0x1cb/0x5b0 [ 57.919721][ T11] ? __ip_finish_output+0x650/0x650 [ 57.919741][ T11] ? dst_output+0x170/0x170 [ 57.919760][ T11] ? __ip_finish_output+0x650/0x650 [ 57.919780][ T11] ? __sanitizer_cov_trace_const_cmp2+0x22/0x80 [ 57.919805][ T11] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 57.919829][ T11] ? xfrm_lookup_with_ifid+0xa6b/0x2240 [ 57.919856][ T11] ip_output+0x21f/0x310 [ 57.919876][ T11] ? __ip_finish_output+0x650/0x650 [ 57.919897][ T11] ip_local_out+0xaf/0x1a0 [ 57.919917][ T11] iptunnel_xmit+0x67a/0xa40 [ 57.919943][ T11] send4+0x426/0xe60 [ 57.919965][ T11] ? lock_release+0x780/0x780 [ 57.919990][ T11] ? wg_receive+0xb0/0xb0 [ 57.920011][ T11] ? rcu_read_lock_sched_held+0x3a/0x70 [ 57.920039][ T11] wg_socket_send_skb_to_peer+0x192/0x220 [ 57.920063][ T11] wg_socket_send_buffer_to_peer+0x11e/0x170 [ 57.920094][ T11] wg_packet_send_handshake_initiation+0x212/0x340 [ 57.920119][ T11] ? wg_prev_queue_dequeue+0x260/0x260 [ 57.920145][ T11] ? do_raw_spin_lock+0x120/0x2a0 [ 57.920172][ T11] wg_packet_handshake_send_worker+0x18/0x30 [ 57.920196][ T11] process_one_work+0x996/0x1610 [ 57.920219][ T11] ? pwq_dec_nr_in_flight+0x2a0/0x2a0 [ 57.920243][ T11] ? rwlock_bug.part.0+0x90/0x90 [ 57.920268][ T11] ? _raw_spin_lock_irq+0x41/0x50 [ 57.920295][ T11] worker_thread+0x665/0x1080 [ 57.920319][ T11] ? process_one_work+0x1610/0x1610 [ 57.920341][ T11] kthread+0x2e9/0x3a0 [ 57.920359][ T11] ? kthread_complete_and_exit+0x40/0x40 [ 57.920381][ T11] ret_from_fork+0x1f/0x30 [ 57.920406][ T11] [ 57.920412][ T11] [ 57.920416][ T11] Allocated by task 11: [ 57.920424][ T11] kasan_save_stack+0x1e/0x40 [ 57.920446][ T11] __kasan_kmalloc+0xa6/0xd0 [ 57.920465][ T11] __kmalloc_track_caller+0x206/0x4d0 [ 57.920486][ T11] krealloc+0x87/0xf0 [ 57.920504][ T11] nf_ct_ext_add+0x19f/0x3d0 [ 57.920523][ T11] init_conntrack.constprop.0+0x563/0x1270 [ 57.920546][ T11] nf_conntrack_in+0xc86/0x1790 [ 57.920567][ T11] ipv4_conntrack_local+0x113/0x260 [ 57.920585][ T11] nf_hook_slow+0xc5/0x1f0 [ 57.920602][ T11] nf_hook+0x1cb/0x5b0 [ 57.920618][ T11] __ip_local_out+0x262/0x520 [ 57.920635][ T11] ip_local_out+0x26/0x1a0 [ 57.920652][ T11] iptunnel_xmit+0x67a/0xa40 [ 57.920675][ T11] send4+0x426/0xe60 [ 57.920692][ T11] wg_socket_send_skb_to_peer+0x192/0x220 [ 57.920714][ T11] wg_socket_send_buffer_to_peer+0x11e/0x170 [ 57.920734][ T11] wg_packet_send_handshake_initiation+0x212/0x340 [ 57.920754][ T11] wg_packet_handshake_send_worker+0x18/0x30 [ 57.920775][ T11] process_one_work+0x996/0x1610 [ 57.920792][ T11] worker_thread+0x665/0x1080 [ 57.920808][ T11] kthread+0x2e9/0x3a0 [ 57.920823][ T11] ret_from_fork+0x1f/0x30 [ 57.920842][ T11] [ 57.920845][ T11] Freed by task 11: [ 57.920852][ T11] kasan_save_stack+0x1e/0x40 [ 57.920870][ T11] kasan_set_track+0x21/0x30 [ 57.920888][ T11] kasan_set_free_info+0x20/0x30 [ 57.920909][ T11] ____kasan_slab_free+0x13d/0x180 [ 57.920927][ T11] kfree+0x113/0x310 [ 57.920941][ T11] nf_conntrack_free+0x100/0x630 [ 57.920960][ T11] nf_ct_destroy+0x1be/0x320 [ 57.920979][ T11] __nf_ct_resolve_clash+0x624/0x785 [ 57.920998][ T11] nf_ct_resolve_clash+0x14a/0xa23 [ 57.921016][ T11] __nf_conntrack_confirm.cold+0x16/0x23e [ 57.921035][ T11] nf_confirm+0x4ce/0x5b0 [ 57.921051][ T11] ipv4_confirm+0x17a/0x390 [ 57.921072][ T11] nf_hook_slow+0xc5/0x1f0 [ 57.921087][ T11] nf_hook+0x1cb/0x5b0 [ 57.921103][ T11] ip_output+0x21f/0x310 [ 57.921119][ T11] ip_local_out+0xaf/0x1a0 [ 57.921136][ T11] iptunnel_xmit+0x67a/0xa40 [ 57.921158][ T11] send4+0x426/0xe60 [ 57.921176][ T11] wg_socket_send_skb_to_peer+0x192/0x220 [ 57.921198][ T11] wg_socket_send_buffer_to_peer+0x11e/0x170 [ 57.921220][ T11] wg_packet_send_handshake_initiation+0x212/0x340 [ 57.921243][ T11] wg_packet_handshake_send_worker+0x18/0x30 [ 57.921265][ T11] process_one_work+0x996/0x1610 [ 57.921284][ T11] worker_thread+0x665/0x1080 [ 57.921303][ T11] kthread+0x2e9/0x3a0 [ 57.921318][ T11] ret_from_fork+0x1f/0x30 [ 57.921338][ T11] [ 57.921341][ T11] The buggy address belongs to the object at ffff888077601300 [ 57.921341][ T11] which belongs to the cache kmalloc-128 of size 128 [ 57.921355][ T11] The buggy address is located 4 bytes inside of [ 57.921355][ T11] 128-byte region [ffff888077601300, ffff888077601380) [ 57.921372][ T11] [ 57.921375][ T11] The buggy address belongs to the physical page: [ 57.921381][ T11] page:ffffea0001dd8040 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x77601 [ 57.921402][ T11] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 57.921430][ T11] raw: 00fff00000000200 ffffea0000835c48 ffffea0001deea08 ffff888010c40400 [ 57.921447][ T11] raw: 0000000000000000 ffff888077601000 0000000100000010 0000000000000000 [ 57.921457][ T11] page dumped because: kasan: bad access detected [ 57.921464][ T11] page_owner tracks the page as allocated [ 57.921469][ T11] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x242220(__GFP_HIGH|__GFP_ATOMIC|__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE), pid 3666, tgid 3666 (kworker/1:6), ts 57609466095, free_ts 56551019221 [ 57.921506][ T11] get_page_from_freelist+0xbb3/0x3b80 [ 57.921526][ T11] __alloc_pages+0x1c7/0x510 [ 57.921543][ T11] cache_grow_begin+0x75/0x350 [ 57.921562][ T11] cache_alloc_refill+0x27f/0x380 [ 57.921580][ T11] kmem_cache_alloc_trace+0x380/0x4a0 [ 57.921601][ T11] __hw_addr_add_ex+0x22d/0x7e0 [ 57.921625][ T11] dev_mc_add+0xbd/0x110 [ 57.921646][ T11] igmp6_group_added+0x4f0/0x5b0 [ 57.921667][ T11] __ipv6_dev_mc_inc+0x847/0xec0 [ 57.921687][ T11] addrconf_dad_work+0xc5f/0x12d0 [ 57.921711][ T11] process_one_work+0x996/0x1610 [ 57.921730][ T11] worker_thread+0x665/0x1080 [ 57.921748][ T11] kthread+0x2e9/0x3a0 [ 57.921764][ T11] ret_from_fork+0x1f/0x30 [ 57.921784][ T11] page last free stack trace: [ 57.921789][ T11] free_pcp_prepare+0x549/0xd20 [ 57.921812][ T11] free_unref_page+0x19/0x6a0 [ 57.921835][ T11] slabs_destroy+0x89/0xc0 [ 57.921854][ T11] ___cache_free+0x34e/0x670 [ 57.921872][ T11] qlist_free_all+0x4f/0x1b0 [ 57.921895][ T11] kasan_quarantine_reduce+0x180/0x200 [ 57.921920][ T11] __kasan_slab_alloc+0x97/0xb0 [ 57.921941][ T11] kmem_cache_alloc_node+0x2ea/0x590 [ 57.921961][ T11] __alloc_skb+0x215/0x340 [ 57.921983][ T11] netlink_sendmsg+0x9a2/0xe10 [ 57.922006][ T11] sock_sendmsg+0xcf/0x120 [ 57.922027][ T11] __sys_sendto+0x21a/0x320 [ 57.922049][ T11] __x64_sys_sendto+0xdd/0x1b0 [ 57.922078][ T11] do_syscall_64+0x35/0xb0 [ 57.922097][ T11] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 57.922118][ T11] [ 57.922121][ T11] Memory state around the buggy address: [ 57.922130][ T11] ffff888077601200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.922143][ T11] ffff888077601280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.922157][ T11] >ffff888077601300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 57.922167][ T11] ^ [ 57.922176][ T11] ffff888077601380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.922189][ T11] ffff888077601400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 57.922199][ T11] ================================================================== [ 57.922207][ T11] Kernel panic - not syncing: panic_on_warn set ... [ 57.922218][ T11] CPU: 1 PID: 11 Comm: kworker/u4:1 Not tainted 5.18.0-syzkaller-09901-g7f50d4dfe816 #0 [ 57.922240][ T11] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 57.922253][ T11] Workqueue: wg-kex-wg2 wg_packet_handshake_send_worker [ 57.922278][ T11] Call Trace: [ 57.922284][ T11] [ 57.922292][ T11] dump_stack_lvl+0xcd/0x134 [ 57.922314][ T11] panic+0x2d7/0x636 [ 57.922339][ T11] ? panic_print_sys_info.part.0+0x10b/0x10b [ 57.922367][ T11] ? mark_held_locks+0x9f/0xe0 [ 57.922392][ T11] ? nf_confirm+0x575/0x5b0 [ 57.922412][ T11] ? nf_confirm+0x575/0x5b0 [ 57.922431][ T11] end_report.part.0+0x3f/0x7c [ 57.922457][ T11] kasan_report.cold+0x93/0x1c6 [ 57.922483][ T11] ? nf_confirm+0x575/0x5b0 [ 57.922503][ T11] nf_confirm+0x575/0x5b0 [ 57.922522][ T11] ipv4_confirm+0x17a/0x390 [ 57.922542][ T11] nf_hook_slow+0xc5/0x1f0 [ 57.922562][ T11] nf_hook+0x1cb/0x5b0 [ 57.922581][ T11] ? __ip_finish_output+0x650/0x650 [ 57.922602][ T11] ? dst_output+0x170/0x170 [ 57.922622][ T11] ? __ip_finish_output+0x650/0x650 [ 57.922642][ T11] ? __sanitizer_cov_trace_const_cmp2+0x22/0x80 [ 57.922668][ T11] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 57.922692][ T11] ? xfrm_lookup_with_ifid+0xa6b/0x2240 [ 57.922719][ T11] ip_output+0x21f/0x310 [ 57.922739][ T11] ? __ip_finish_output+0x650/0x650 [ 57.922761][ T11] ip_local_out+0xaf/0x1a0 [ 57.922781][ T11] iptunnel_xmit+0x67a/0xa40 [ 57.922808][ T11] send4+0x426/0xe60 [ 57.922829][ T11] ? lock_release+0x780/0x780 [ 57.922853][ T11] ? wg_receive+0xb0/0xb0 [ 57.922875][ T11] ? rcu_read_lock_sched_held+0x3a/0x70 [ 57.922903][ T11] wg_socket_send_skb_to_peer+0x192/0x220 [ 57.922928][ T11] wg_socket_send_buffer_to_peer+0x11e/0x170 [ 57.922954][ T11] wg_packet_send_handshake_initiation+0x212/0x340 [ 57.922980][ T11] ? wg_prev_queue_dequeue+0x260/0x260 [ 57.923005][ T11] ? do_raw_spin_lock+0x120/0x2a0 [ 57.923033][ T11] wg_packet_handshake_send_worker+0x18/0x30 [ 57.923059][ T11] process_one_work+0x996/0x1610 [ 57.923087][ T11] ? pwq_dec_nr_in_flight+0x2a0/0x2a0 [ 57.923111][ T11] ? rwlock_bug.part.0+0x90/0x90 [ 57.923137][ T11] ? _raw_spin_lock_irq+0x41/0x50 [ 57.923164][ T11] worker_thread+0x665/0x1080 [ 57.923188][ T11] ? process_one_work+0x1610/0x1610 [ 57.923211][ T11] kthread+0x2e9/0x3a0 [ 57.923229][ T11] ? kthread_complete_and_exit+0x40/0x40 [ 57.923251][ T11] ret_from_fork+0x1f/0x30 [ 57.923277][ T11] [ 57.923448][ T11] Kernel Offset: disabled