Warning: Permanently added '10.128.1.3' (ED25519) to the list of known hosts. 2024/06/16 02:35:31 ignoring optional flag "sandboxArg"="0" 2024/06/16 02:35:31 parsed 1 programs [ 1062.574006][ T5152] cgroup: Unknown subsys name 'net' [ 1062.900506][ T5152] cgroup: Unknown subsys name 'rlimit' [ 1063.931307][ T5162] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 1063.944079][ T5162] syz-executor (5162) used greatest stack depth: 19600 bytes left [ 1064.261064][ T5188] chnl_net:caif_netlink_parms(): no params data found [ 1064.332394][ T5188] bridge0: port 1(bridge_slave_0) entered blocking state [ 1064.339686][ T5188] bridge0: port 1(bridge_slave_0) entered disabled state [ 1064.346876][ T5188] bridge_slave_0: entered allmulticast mode [ 1064.354332][ T5188] bridge_slave_0: entered promiscuous mode [ 1064.363178][ T5188] bridge0: port 2(bridge_slave_1) entered blocking state [ 1064.370390][ T5188] bridge0: port 2(bridge_slave_1) entered disabled state [ 1064.378717][ T5188] bridge_slave_1: entered allmulticast mode [ 1064.385839][ T5188] bridge_slave_1: entered promiscuous mode [ 1064.415028][ T5188] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1064.427386][ T5188] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1064.462430][ T5188] team0: Port device team_slave_0 added [ 1064.469732][ T5188] team0: Port device team_slave_1 added [ 1064.492171][ T5188] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1064.500007][ T5188] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1064.526279][ T5188] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1064.539398][ T5188] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1064.546344][ T5188] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1064.572371][ T5188] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1064.609655][ T5188] hsr_slave_0: entered promiscuous mode [ 1064.615897][ T5188] hsr_slave_1: entered promiscuous mode [ 1064.722558][ T5188] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1064.733221][ T5188] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1064.742906][ T5188] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1064.752134][ T5188] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1064.777744][ T5188] bridge0: port 2(bridge_slave_1) entered blocking state [ 1064.785030][ T5188] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1064.795117][ T5188] bridge0: port 1(bridge_slave_0) entered blocking state [ 1064.802302][ T5188] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1064.855452][ T5188] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1064.872150][ T5128] bridge0: port 1(bridge_slave_0) entered disabled state [ 1064.881864][ T5128] bridge0: port 2(bridge_slave_1) entered disabled state [ 1064.896663][ T5188] 8021q: adding VLAN 0 to HW filter on device team0 [ 1064.910410][ T5195] bridge0: port 1(bridge_slave_0) entered blocking state [ 1064.917589][ T5195] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1064.931486][ T929] bridge0: port 2(bridge_slave_1) entered blocking state [ 1064.938626][ T929] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1065.071041][ T5188] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1065.108937][ T5188] veth0_vlan: entered promiscuous mode [ 1065.121293][ T5188] veth1_vlan: entered promiscuous mode [ 1065.146495][ T5188] veth0_macvtap: entered promiscuous mode [ 1065.155870][ T5188] veth1_macvtap: entered promiscuous mode [ 1065.175637][ T5188] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1065.190546][ T5188] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1065.202118][ T5188] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1065.211372][ T5188] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1065.220457][ T5188] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1065.229363][ T5188] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1065.328675][ T5188] syz-executor.0 (5188) used greatest stack depth: 18512 bytes left [ 1065.361396][ T5200] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1065.432583][ T5200] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1065.500308][ T5200] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1065.555154][ T5200] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1066.311523][ T53] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1066.319560][ T53] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1066.332249][ T53] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1066.341161][ T53] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1066.351023][ T53] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 1066.358753][ T53] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1066.368315][ T5230] ================================================================== [ 1066.376382][ T5230] BUG: KASAN: slab-use-after-free in kfree_skb_reason+0x41/0x3b0 [ 1066.384111][ T5230] Read of size 4 at addr ffff88807ac65ea4 by task syz-executor.0/5230 [ 1066.392254][ T5230] [ 1066.394572][ T5230] CPU: 1 PID: 5230 Comm: syz-executor.0 Not tainted 6.10.0-rc2-syzkaller-00761-g3ec8d7572a69 #0 [ 1066.404969][ T5230] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 1066.415021][ T5230] Call Trace: [ 1066.418286][ T5230] [ 1066.421201][ T5230] dump_stack_lvl+0x241/0x360 [ 1066.425869][ T5230] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1066.431056][ T5230] ? __pfx__printk+0x10/0x10 [ 1066.435652][ T5230] ? _printk+0xd5/0x120 [ 1066.439799][ T5230] ? __virt_addr_valid+0x183/0x520 [ 1066.444931][ T5230] ? __virt_addr_valid+0x183/0x520 [ 1066.450040][ T5230] print_report+0x169/0x550 [ 1066.454551][ T5230] ? __virt_addr_valid+0x183/0x520 [ 1066.459657][ T5230] ? __virt_addr_valid+0x183/0x520 [ 1066.464853][ T5230] ? __virt_addr_valid+0x44e/0x520 [ 1066.469944][ T5230] ? __phys_addr+0xba/0x170 [ 1066.474424][ T5230] ? kfree_skb_reason+0x41/0x3b0 [ 1066.479345][ T5230] kasan_report+0x143/0x180 [ 1066.483846][ T5230] ? kfree_skb_reason+0x41/0x3b0 [ 1066.488772][ T5230] kasan_check_range+0x282/0x290 [ 1066.493702][ T5230] kfree_skb_reason+0x41/0x3b0 [ 1066.498455][ T5230] __hci_req_sync+0x62f/0x950 [ 1066.503127][ T5230] ? __pfx___hci_req_sync+0x10/0x10 [ 1066.508318][ T5230] ? __pfx___mutex_lock+0x10/0x10 [ 1066.513331][ T5230] ? __pfx_autoremove_wake_function+0x10/0x10 [ 1066.519384][ T5230] ? __pfx_hci_scan_req+0x10/0x10 [ 1066.524390][ T5230] hci_req_sync+0xa9/0xd0 [ 1066.528712][ T5230] hci_dev_cmd+0x4c5/0xa50 [ 1066.533112][ T5230] ? security_capable+0x90/0xb0 [ 1066.537956][ T5230] ? __pfx_hci_dev_cmd+0x10/0x10 [ 1066.542880][ T5230] ? hci_sock_ioctl+0x6c4/0xa40 [ 1066.547715][ T5230] sock_do_ioctl+0x158/0x460 [ 1066.552294][ T5230] ? __pfx_sock_do_ioctl+0x10/0x10 [ 1066.557393][ T5230] sock_ioctl+0x629/0x8e0 [ 1066.561709][ T5230] ? __pfx_sock_ioctl+0x10/0x10 [ 1066.566543][ T5230] ? __fget_files+0x29/0x470 [ 1066.571121][ T5230] ? __fget_files+0x3f6/0x470 [ 1066.575784][ T5230] ? __fget_files+0x29/0x470 [ 1066.580363][ T5230] ? bpf_lsm_file_ioctl+0x9/0x10 [ 1066.585282][ T5230] ? security_file_ioctl+0x87/0xb0 [ 1066.590375][ T5230] ? __pfx_sock_ioctl+0x10/0x10 [ 1066.595209][ T5230] __se_sys_ioctl+0xfc/0x170 [ 1066.599784][ T5230] do_syscall_64+0xf3/0x230 [ 1066.604271][ T5230] ? clear_bhb_loop+0x35/0x90 [ 1066.608932][ T5230] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1066.614817][ T5230] RIP: 0033:0x7fdc4747cc0b [ 1066.619225][ T5230] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 1066.638817][ T5230] RSP: 002b:00007fff8064c980 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1066.647306][ T5230] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdc4747cc0b [ 1066.655261][ T5230] RDX: 00007fff8064c9f8 RSI: 00000000400448dd RDI: 0000000000000003 [ 1066.663212][ T5230] RBP: 0000555577f5b430 R08: 0000000000000000 R09: 0000000000000000 [ 1066.671164][ T5230] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000000 [ 1066.679117][ T5230] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001 [ 1066.687075][ T5230] [ 1066.690076][ T5230] [ 1066.692379][ T5230] Allocated by task 4489: [ 1066.696682][ T5230] kasan_save_track+0x3f/0x80 [ 1066.701343][ T5230] __kasan_slab_alloc+0x66/0x80 [ 1066.706173][ T5230] kmem_cache_alloc_noprof+0x135/0x2a0 [ 1066.711617][ T5230] skb_clone+0x20c/0x390 [ 1066.715839][ T5230] hci_cmd_work+0x29e/0x670 [ 1066.720324][ T5230] process_scheduled_works+0xa2c/0x1830 [ 1066.725851][ T5230] worker_thread+0x86d/0xd70 [ 1066.730419][ T5230] kthread+0x2f0/0x390 [ 1066.734468][ T5230] ret_from_fork+0x4b/0x80 [ 1066.738869][ T5230] ret_from_fork_asm+0x1a/0x30 [ 1066.743618][ T5230] [ 1066.745922][ T5230] Freed by task 4489: [ 1066.749878][ T5230] kasan_save_track+0x3f/0x80 [ 1066.754536][ T5230] kasan_save_free_info+0x40/0x50 [ 1066.759538][ T5230] poison_slab_object+0xe0/0x150 [ 1066.764460][ T5230] __kasan_slab_free+0x37/0x60 [ 1066.769205][ T5230] kmem_cache_free+0x145/0x350 [ 1066.773948][ T5230] hci_req_sync_complete+0xe7/0x290 [ 1066.779133][ T5230] hci_event_packet+0xc71/0x1540 [ 1066.784053][ T5230] hci_rx_work+0x3e8/0xca0 [ 1066.788453][ T5230] process_scheduled_works+0xa2c/0x1830 [ 1066.793978][ T5230] worker_thread+0x86d/0xd70 [ 1066.798549][ T5230] kthread+0x2f0/0x390 [ 1066.802597][ T5230] ret_from_fork+0x4b/0x80 [ 1066.806996][ T5230] ret_from_fork_asm+0x1a/0x30 [ 1066.811742][ T5230] [ 1066.814048][ T5230] The buggy address belongs to the object at ffff88807ac65dc0 [ 1066.814048][ T5230] which belongs to the cache skbuff_head_cache of size 240 [ 1066.828599][ T5230] The buggy address is located 228 bytes inside of [ 1066.828599][ T5230] freed 240-byte region [ffff88807ac65dc0, ffff88807ac65eb0) [ 1066.842373][ T5230] [ 1066.844676][ T5230] The buggy address belongs to the physical page: [ 1066.851071][ T5230] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7ac65 [ 1066.859814][ T5230] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 1066.867256][ T5230] page_type: 0xffffefff(slab) [ 1066.871920][ T5230] raw: 00fff00000000000 ffff888018ed5780 dead000000000122 0000000000000000 [ 1066.880483][ T5230] raw: 0000000000000000 00000000000c000c 00000001ffffefff 0000000000000000 [ 1066.889044][ T5230] page dumped because: kasan: bad access detected [ 1066.895438][ T5230] page_owner tracks the page as allocated [ 1066.901129][ T5230] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x152820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 11, tgid 11 (kworker/u8:0), ts 1066349176129, free_ts 1066307906062 [ 1066.921767][ T5230] post_alloc_hook+0x1f3/0x230 [ 1066.926520][ T5230] get_page_from_freelist+0x2e2d/0x2ee0 [ 1066.932047][ T5230] __alloc_pages_noprof+0x256/0x6c0 [ 1066.937223][ T5230] alloc_slab_page+0x5f/0x120 [ 1066.941882][ T5230] allocate_slab+0x5a/0x2e0 [ 1066.946376][ T5230] ___slab_alloc+0xcd1/0x14b0 [ 1066.951033][ T5230] __slab_alloc+0x58/0xa0 [ 1066.955339][ T5230] kmem_cache_alloc_node_noprof+0x1fe/0x320 [ 1066.961213][ T5230] __alloc_skb+0x1c3/0x440 [ 1066.965607][ T5230] ndisc_alloc_skb+0xed/0x2c0 [ 1066.970265][ T5230] ndisc_send_rs+0x27b/0x6b0 [ 1066.974922][ T5230] addrconf_dad_completed+0x76c/0xcd0 [ 1066.980280][ T5230] addrconf_dad_work+0xdc2/0x16f0 [ 1066.985288][ T5230] process_scheduled_works+0xa2c/0x1830 [ 1066.990810][ T5230] worker_thread+0x86d/0xd70 [ 1066.995378][ T5230] kthread+0x2f0/0x390 [ 1066.999428][ T5230] page last free pid 4545 tgid 4545 stack trace: [ 1067.005730][ T5230] free_unref_page+0xd22/0xea0 [ 1067.010483][ T5230] __put_partials+0xeb/0x130 [ 1067.015055][ T5230] put_cpu_partial+0x17c/0x250 [ 1067.019797][ T5230] __slab_free+0x2ea/0x3d0 [ 1067.024192][ T5230] qlist_free_all+0x9e/0x140 [ 1067.028763][ T5230] kasan_quarantine_reduce+0x14f/0x170 [ 1067.034201][ T5230] __kasan_slab_alloc+0x23/0x80 [ 1067.039032][ T5230] __kmalloc_noprof+0x1a3/0x400 [ 1067.043861][ T5230] tomoyo_realpath_from_path+0xcf/0x5e0 [ 1067.049388][ T5230] tomoyo_path_perm+0x2b7/0x740 [ 1067.054217][ T5230] security_inode_getattr+0xd8/0x130 [ 1067.059489][ T5230] vfs_getattr+0x45/0x430 [ 1067.063807][ T5230] vfs_fstatat+0xd6/0x190 [ 1067.068116][ T5230] __x64_sys_newfstatat+0x125/0x1b0 [ 1067.073296][ T5230] do_syscall_64+0xf3/0x230 [ 1067.077784][ T5230] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1067.083660][ T5230] [ 1067.085961][ T5230] Memory state around the buggy address: [ 1067.091569][ T5230] ffff88807ac65d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 1067.099607][ T5230] ffff88807ac65e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1067.107644][ T5230] >ffff88807ac65e80: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc [ 1067.115680][ T5230] ^ [ 1067.120765][ T5230] ffff88807ac65f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1067.128807][ T5230] ffff88807ac65f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1067.136843][ T5230] ================================================================== [ 1067.151492][ T5230] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1067.158698][ T5230] CPU: 1 PID: 5230 Comm: syz-executor.0 Not tainted 6.10.0-rc2-syzkaller-00761-g3ec8d7572a69 #0 [ 1067.169110][ T5230] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 1067.179162][ T5230] Call Trace: [ 1067.182427][ T5230] [ 1067.185341][ T5230] dump_stack_lvl+0x241/0x360 [ 1067.190005][ T5230] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1067.195184][ T5230] ? __pfx__printk+0x10/0x10 [ 1067.199757][ T5230] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 1067.205720][ T5230] ? vscnprintf+0x5d/0x90 [ 1067.210035][ T5230] panic+0x349/0x860 [ 1067.213919][ T5230] ? check_panic_on_warn+0x21/0xb0 [ 1067.219036][ T5230] ? __pfx_panic+0x10/0x10 [ 1067.223456][ T5230] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 1067.229425][ T5230] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 1067.235786][ T5230] check_panic_on_warn+0x86/0xb0 [ 1067.240789][ T5230] ? kfree_skb_reason+0x41/0x3b0 [ 1067.245741][ T5230] end_report+0x77/0x160 [ 1067.249978][ T5230] kasan_report+0x154/0x180 [ 1067.254537][ T5230] ? kfree_skb_reason+0x41/0x3b0 [ 1067.259478][ T5230] kasan_check_range+0x282/0x290 [ 1067.264411][ T5230] kfree_skb_reason+0x41/0x3b0 [ 1067.269165][ T5230] __hci_req_sync+0x62f/0x950 [ 1067.273838][ T5230] ? __pfx___hci_req_sync+0x10/0x10 [ 1067.279033][ T5230] ? __pfx___mutex_lock+0x10/0x10 [ 1067.284049][ T5230] ? __pfx_autoremove_wake_function+0x10/0x10 [ 1067.290107][ T5230] ? __pfx_hci_scan_req+0x10/0x10 [ 1067.295122][ T5230] hci_req_sync+0xa9/0xd0 [ 1067.299443][ T5230] hci_dev_cmd+0x4c5/0xa50 [ 1067.303853][ T5230] ? security_capable+0x90/0xb0 [ 1067.308778][ T5230] ? __pfx_hci_dev_cmd+0x10/0x10 [ 1067.313701][ T5230] ? hci_sock_ioctl+0x6c4/0xa40 [ 1067.318541][ T5230] sock_do_ioctl+0x158/0x460 [ 1067.323119][ T5230] ? __pfx_sock_do_ioctl+0x10/0x10 [ 1067.328225][ T5230] sock_ioctl+0x629/0x8e0 [ 1067.332543][ T5230] ? __pfx_sock_ioctl+0x10/0x10 [ 1067.337379][ T5230] ? __fget_files+0x29/0x470 [ 1067.341961][ T5230] ? __fget_files+0x3f6/0x470 [ 1067.346625][ T5230] ? __fget_files+0x29/0x470 [ 1067.351203][ T5230] ? bpf_lsm_file_ioctl+0x9/0x10 [ 1067.356125][ T5230] ? security_file_ioctl+0x87/0xb0 [ 1067.361217][ T5230] ? __pfx_sock_ioctl+0x10/0x10 [ 1067.366051][ T5230] __se_sys_ioctl+0xfc/0x170 [ 1067.370629][ T5230] do_syscall_64+0xf3/0x230 [ 1067.375113][ T5230] ? clear_bhb_loop+0x35/0x90 [ 1067.379777][ T5230] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1067.385652][ T5230] RIP: 0033:0x7fdc4747cc0b [ 1067.390049][ T5230] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 1067.409639][ T5230] RSP: 002b:00007fff8064c980 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1067.418052][ T5230] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdc4747cc0b [ 1067.426012][ T5230] RDX: 00007fff8064c9f8 RSI: 00000000400448dd RDI: 0000000000000003 [ 1067.433965][ T5230] RBP: 0000555577f5b430 R08: 0000000000000000 R09: 0000000000000000 [ 1067.441917][ T5230] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000000 [ 1067.449871][ T5230] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001 [ 1067.457832][ T5230] [ 1067.460946][ T5230] Kernel Offset: disabled [ 1067.465257][ T5230] Rebooting in 86400 seconds..