[ 426.238801][T12388] validate_nla: 269 callbacks suppressed
[ 426.238820][T12388] netlink: 'syz-executor.5': attribute type 4 has an invalid length.
[ 426.292987][T12389] netlink: 'syz-executor.0': attribute type 4 has an invalid length.
[ 426.301992][T12390] netlink: 'syz-executor.2': attribute type 4 has an invalid length.
[ 426.310780][T12395] netlink: 'syz-executor.3': attribute type 4 has an invalid length.
[ 426.333360][T12396] netlink: 'syz-executor.1': attribute type 4 has an invalid length.
[ 426.361377][T12394] netlink: 'syz-executor.4': attribute type 4 has an invalid length.
[ 426.394481][T12402] netlink: 'syz-executor.5': attribute type 4 has an invalid length.
[ 426.446647][T12406] netlink: 'syz-executor.0': attribute type 4 has an invalid length.
[ 426.485942][T12409] netlink: 'syz-executor.4': attribute type 4 has an invalid length.
[ 426.497589][T12410] netlink: 'syz-executor.3': attribute type 4 has an invalid length.
[ 428.558001][ T55] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 428.657758][ T55] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 428.711538][ T55] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 428.783158][ T55] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
Warning: Permanently added '10.128.0.25' (ECDSA) to the list of known hosts.
[ 429.964207][ T55] device hsr_slave_0 left promiscuous mode
[ 429.972420][ T55] device hsr_slave_1 left promiscuous mode
[ 429.982000][ T55] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 429.990205][ T55] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 430.000525][ T55] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 430.008675][ T55] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 430.022072][ T55] device bridge_slave_1 left promiscuous mode
[ 430.028750][ T55] bridge0: port 2(bridge_slave_1) entered disabled state
[ 430.039704][ T55] device bridge_slave_0 left promiscuous mode
[ 430.046144][ T55] bridge0: port 1(bridge_slave_0) entered disabled state
[ 430.073084][ T55] device veth1_macvtap left promiscuous mode
[ 430.087557][ T55] device veth0_macvtap left promiscuous mode
[ 430.093731][ T55] device veth1_vlan left promiscuous mode
[ 430.110400][ T55] device veth0_vlan left promiscuous mode
[ 430.540452][ T55] team0 (unregistering): Port device team_slave_1 removed
[ 430.571836][ T55] team0 (unregistering): Port device team_slave_0 removed
[ 430.603255][ T55] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 430.631570][ T55] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 430.852983][ T55] bond0 (unregistering): Released all slaves
[ 431.263251][T12462] validate_nla: 40 callbacks suppressed
[ 431.263267][T12462] netlink: 'syz-executor245': attribute type 4 has an invalid length.
[ 431.303390][T12463] netlink: 'syz-executor245': attribute type 4 has an invalid length.
[ 431.336983][T12464] netlink: 'syz-executor245': attribute type 4 has an invalid length.
[ 431.389753][T12465] netlink: 'syz-executor245': attribute type 4 has an invalid length.
[ 431.427024][T12466] netlink: 'syz-executor245': attribute type 4 has an invalid length.
[ 431.472176][T12467] netlink: 'syz-executor245': attribute type 4 has an invalid length.
[ 431.526992][T12468] netlink: 'syz-executor245': attribute type 4 has an invalid length.
[ 431.573411][T12469] netlink: 'syz-executor245': attribute type 4 has an invalid length.
[ 431.607516][T12470] netlink: 'syz-executor245': attribute type 4 has an invalid length.
[ 431.647100][T12471] netlink: 'syz-executor245': attribute type 4 has an invalid length.
[ 431.808490][ T55] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 431.895772][ T55] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 431.975317][ T55] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 432.043191][ T55] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 432.096011][ C0] ==================================================================
[ 432.104106][ C0] BUG: KASAN: use-after-free in tcp_retransmit_timer+0x2ef3/0x3360
[ 432.112145][ C0] Read of size 8 at addr ffff8880241a2480 by task swapper/0/0
[ 432.119611][ C0]
[ 432.121941][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.18.0-rc3-syzkaller-00016-gb253435746d9-dirty #0
[ 432.132284][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 432.142502][ C0] Call Trace:
[ 432.146062][ C0]
[ 432.149087][ C0] dump_stack_lvl+0xcd/0x134
[ 432.153813][ C0] print_address_description.constprop.0.cold+0xeb/0x467
[ 432.160932][ C0] ? tcp_retransmit_timer+0x2ef3/0x3360
[ 432.166510][ C0] kasan_report.cold+0xf4/0x1c6
[ 432.171388][ C0] ? tcp_retransmit_timer+0x2ef3/0x3360
[ 432.177049][ C0] tcp_retransmit_timer+0x2ef3/0x3360
[ 432.182448][ C0] ? tcp_mstamp_refresh+0x12/0xa0
[ 432.187500][ C0] ? tcp_delack_timer+0x320/0x320
[ 432.192550][ C0] ? ktime_get+0x38a/0x470
[ 432.197070][ C0] ? lockdep_hardirqs_on+0x79/0x100
[ 432.202360][ C0] ? __sanitizer_cov_trace_cmp4+0x1c/0x70
[ 432.208168][ C0] ? ktime_get+0x30b/0x470
[ 432.212612][ C0] tcp_write_timer_handler+0x5e6/0xbc0
[ 432.218095][ C0] tcp_write_timer+0xa2/0x2b0
[ 432.222879][ C0] ? tcp_write_timer_handler+0xbc0/0xbc0
[ 432.228541][ C0] call_timer_fn+0x1a5/0x6b0
[ 432.233150][ C0] ? timer_fixup_activate+0x350/0x350
[ 432.238551][ C0] ? lock_downgrade+0x6e0/0x6e0
[ 432.243474][ C0] ? _raw_spin_unlock_irq+0x1f/0x40
[ 432.248742][ C0] ? tcp_write_timer_handler+0xbc0/0xbc0
[ 432.254433][ C0] __run_timers.part.0+0x679/0xa80
[ 432.259739][ C0] ? call_timer_fn+0x6b0/0x6b0
[ 432.264524][ C0] ? kvm_sched_clock_read+0x14/0x40
[ 432.269912][ C0] ? sched_clock_cpu+0x15/0x1f0
[ 432.274846][ C0] run_timer_softirq+0xb3/0x1d0
[ 432.279720][ C0] __do_softirq+0x29b/0x9c2
[ 432.284245][ C0] __irq_exit_rcu+0x123/0x180
[ 432.289029][ C0] irq_exit_rcu+0x5/0x20
[ 432.293296][ C0] sysvec_apic_timer_interrupt+0x93/0xc0
[ 432.298956][ C0]
[ 432.301899][ C0]
[ 432.304837][ C0] asm_sysvec_apic_timer_interrupt+0x12/0x20
[ 432.310845][ C0] RIP: 0010:acpi_idle_do_entry+0x1c6/0x250
[ 432.316684][ C0] Code: 89 de e8 7d 8b 16 f8 84 db 75 ac e8 94 87 16 f8 e8 1f cf 1c f8 eb 0c e8 88 87 16 f8 0f 00 2d e1 71 d0 00 e8 7c 87 16 f8 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 f7 89 16 f8 48 85 db
[ 432.336379][ C0] RSP: 0018:ffffffff8ba07d60 EFLAGS: 00000293
[ 432.342490][ C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 432.350479][ C0] RDX: ffffffff8babc700 RSI: ffffffff89613d84 RDI: 0000000000000000
[ 432.358483][ C0] RBP: ffff8881457e8064 R08: 0000000000000001 R09: 0000000000000001
[ 432.366485][ C0] R10: ffffffff817e0cc8 R11: 0000000000000000 R12: 0000000000000001
[ 432.374487][ C0] R13: ffff8881457e8000 R14: ffff8881457e8064 R15: ffff888147cc1004
[ 432.382568][ C0] ? trace_hardirqs_on+0x38/0x1c0
[ 432.387702][ C0] ? acpi_idle_do_entry+0x1c4/0x250
[ 432.392933][ C0] acpi_idle_enter+0x361/0x500
[ 432.397800][ C0] cpuidle_enter_state+0x1b1/0xc80
[ 432.403022][ C0] cpuidle_enter+0x4a/0xa0
[ 432.407460][ C0] do_idle+0x3e8/0x590
[ 432.411686][ C0] ? arch_cpu_idle_exit+0x30/0x30
[ 432.416731][ C0] ? trace_init_perf_perm_irq_work_exit+0xe/0xe
[ 432.423063][ C0] ? trace_init_perf_perm_irq_work_exit+0xe/0xe
[ 432.429504][ C0] cpu_startup_entry+0x14/0x20
[ 432.434309][ C0] start_kernel+0x47f/0x4a0
[ 432.438842][ C0] secondary_startup_64_no_verify+0xc3/0xcb
[ 432.444788][ C0]
[ 432.447810][ C0]
[ 432.450137][ C0] Allocated by task 3894:
[ 432.454474][ C0] kasan_save_stack+0x1e/0x40
[ 432.459228][ C0] __kasan_slab_alloc+0x85/0xb0
[ 432.464105][ C0] kmem_cache_alloc+0x265/0x560
[ 432.468970][ C0] copy_net_ns+0x125/0x760
[ 432.473459][ C0] create_new_namespaces+0x3f6/0xb20
[ 432.478866][ C0] unshare_nsproxy_namespaces+0xc1/0x1f0
[ 432.484614][ C0] ksys_unshare+0x445/0x920
[ 432.489136][ C0] __x64_sys_unshare+0x2d/0x40
[ 432.494004][ C0] do_syscall_64+0x35/0x80
[ 432.498604][ C0] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 432.504518][ C0]
[ 432.506846][ C0] Freed by task 55:
[ 432.510651][ C0] kasan_save_stack+0x1e/0x40
[ 432.515660][ C0] kasan_set_track+0x21/0x30
[ 432.520304][ C0] kasan_set_free_info+0x20/0x30
[ 432.525617][ C0] ____kasan_slab_free+0x13d/0x180
[ 432.530747][ C0] kmem_cache_free.part.0+0xa9/0x240
[ 432.536053][ C0] cleanup_net+0x8ba/0xb00
[ 432.540502][ C0] process_one_work+0x996/0x1610
[ 432.545472][ C0] worker_thread+0x665/0x1080
[ 432.550169][ C0] kthread+0x2e9/0x3a0
[ 432.554292][ C0] ret_from_fork+0x1f/0x30
[ 432.558741][ C0]
[ 432.561064][ C0] Last potentially related work creation:
[ 432.566777][ C0] kasan_save_stack+0x1e/0x40
[ 432.571475][ C0] __kasan_record_aux_stack+0x7e/0x90
[ 432.576869][ C0] insert_work+0x48/0x350
[ 432.581289][ C0] __queue_work+0x62e/0x1140
[ 432.585902][ C0] call_timer_fn+0x1a5/0x6b0
[ 432.590515][ C0] __run_timers.part.0+0x4a3/0xa80
[ 432.595640][ C0] run_timer_softirq+0x152/0x1d0
[ 432.600686][ C0] __do_softirq+0x29b/0x9c2
[ 432.605205][ C0]
[ 432.607532][ C0] Second to last potentially related work creation:
[ 432.614116][ C0] kasan_save_stack+0x1e/0x40
[ 432.618813][ C0] __kasan_record_aux_stack+0x7e/0x90
[ 432.624211][ C0] insert_work+0x48/0x350
[ 432.628578][ C0] __queue_work+0x62e/0x1140
[ 432.633187][ C0] call_timer_fn+0x1a5/0x6b0
[ 432.637792][ C0] __run_timers.part.0+0x4a3/0xa80
[ 432.642917][ C0] run_timer_softirq+0x152/0x1d0
[ 432.647871][ C0] __do_softirq+0x29b/0x9c2
[ 432.652397][ C0]
[ 432.654730][ C0] The buggy address belongs to the object at ffff8880241a21c0
[ 432.654730][ C0] which belongs to the cache net_namespace of size 6784
[ 432.669054][ C0] The buggy address is located 704 bytes inside of
[ 432.669054][ C0] 6784-byte region [ffff8880241a21c0, ffff8880241a3c40)
[ 432.682432][ C0]
[ 432.684759][ C0] The buggy address belongs to the physical page:
[ 432.691180][ C0] page:ffffea0000906880 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x241a2
[ 432.701348][ C0] head:ffffea0000906880 order:1 compound_mapcount:0 compound_pincount:0
[ 432.709790][ C0] memcg:ffff88807868bf81
[ 432.714036][ C0] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 432.722042][ C0] raw: 00fff00000010200 ffffea0001c1cb08 ffff8880114e3f50 ffff8880114d3600
[ 432.730735][ C0] raw: 0000000000000000 ffff8880241a21c0 0000000100000001 ffff88807868bf81
[ 432.739344][ C0] page dumped because: kasan: bad access detected
[ 432.745757][ C0] page_owner tracks the page as allocated
[ 432.751504][ C0] page last allocated via order 1, migratetype Unmovable, gfp_mask 0x3420c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_HARDWALL|__GFP_THISNODE), pid 3894, tgid 3894 (syz-executor.5), ts 64670320894, free_ts 58816038556
[ 432.773072][ C0] get_page_from_freelist+0xba2/0x3e00
[ 432.778590][ C0] __alloc_pages+0x1b2/0x500
[ 432.783204][ C0] cache_grow_begin+0x75/0x350
[ 432.787999][ C0] cache_alloc_refill+0x27f/0x380
[ 432.793061][ C0] kmem_cache_alloc+0x450/0x560
[ 432.798022][ C0] copy_net_ns+0x125/0x760
[ 432.802469][ C0] create_new_namespaces+0x3f6/0xb20
[ 432.807813][ C0] unshare_nsproxy_namespaces+0xc1/0x1f0
[ 432.813464][ C0] ksys_unshare+0x445/0x920
[ 432.817983][ C0] __x64_sys_unshare+0x2d/0x40
[ 432.822772][ C0] do_syscall_64+0x35/0x80
[ 432.827216][ C0] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 432.833121][ C0] page last free stack trace:
[ 432.837792][ C0] free_pcp_prepare+0x549/0xd20
[ 432.842670][ C0] free_unref_page+0x19/0x6a0
[ 432.847372][ C0] slabs_destroy+0x89/0xc0
[ 432.851813][ C0] ___cache_free+0x34e/0x670
[ 432.856426][ C0] qlist_free_all+0x4f/0x1b0
[ 432.861091][ C0] kasan_quarantine_reduce+0x180/0x200
[ 432.866568][ C0] __kasan_slab_alloc+0x97/0xb0
[ 432.871442][ C0] kmem_cache_alloc+0x265/0x560
[ 432.876330][ C0] __alloc_file+0x21/0x270
[ 432.880868][ C0] alloc_empty_file+0x6d/0x170
[ 432.885664][ C0] path_openat+0xe4/0x2910
[ 432.890131][ C0] do_filp_open+0x1aa/0x400
[ 432.894656][ C0] do_sys_openat2+0x16d/0x4c0
[ 432.899353][ C0] __x64_sys_openat+0x13f/0x1f0
[ 432.904217][ C0] do_syscall_64+0x35/0x80
[ 432.908658][ C0] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 432.914577][ C0]
[ 432.916901][ C0] Memory state around the buggy address:
[ 432.922537][ C0] ffff8880241a2380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 432.930625][ C0] ffff8880241a2400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 432.938696][ C0] >ffff8880241a2480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 432.946943][ C0] ^
[ 432.951017][ C0] ffff8880241a2500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 432.959096][ C0] ffff8880241a2580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 432.967175][ C0] ==================================================================
[ 432.975358][ C0] Kernel panic - not syncing: panic_on_warn set ...
[ 432.981946][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.18.0-rc3-syzkaller-00016-gb253435746d9-dirty #0
[ 432.992462][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 433.002878][ C0] Call Trace:
[ 433.006171][ C0]
[ 433.009024][ C0] dump_stack_lvl+0xcd/0x134
[ 433.013813][ C0] panic+0x2d7/0x636
[ 433.017793][ C0] ? panic_print_sys_info.part.0+0x10b/0x10b
[ 433.023799][ C0] ? tcp_retransmit_timer+0x2ef3/0x3360
[ 433.029386][ C0] ? tcp_retransmit_timer+0x2ef3/0x3360
[ 433.035051][ C0] end_report.part.0+0x3f/0x7c
[ 433.039838][ C0] kasan_report.cold+0x93/0x1c6
[ 433.044735][ C0] ? tcp_retransmit_timer+0x2ef3/0x3360
[ 433.050394][ C0] tcp_retransmit_timer+0x2ef3/0x3360
[ 433.055788][ C0] ? tcp_mstamp_refresh+0x12/0xa0
[ 433.061097][ C0] ? tcp_delack_timer+0x320/0x320
[ 433.066160][ C0] ? ktime_get+0x38a/0x470
[ 433.070601][ C0] ? lockdep_hardirqs_on+0x79/0x100
[ 433.075846][ C0] ? __sanitizer_cov_trace_cmp4+0x1c/0x70
[ 433.081596][ C0] ? ktime_get+0x30b/0x470
[ 433.086046][ C0] tcp_write_timer_handler+0x5e6/0xbc0
[ 433.091563][ C0] tcp_write_timer+0xa2/0x2b0
[ 433.096268][ C0] ? tcp_write_timer_handler+0xbc0/0xbc0
[ 433.101923][ C0] call_timer_fn+0x1a5/0x6b0
[ 433.106549][ C0] ? timer_fixup_activate+0x350/0x350
[ 433.111944][ C0] ? lock_downgrade+0x6e0/0x6e0
[ 433.116911][ C0] ? _raw_spin_unlock_irq+0x1f/0x40
[ 433.122165][ C0] ? tcp_write_timer_handler+0xbc0/0xbc0
[ 433.127831][ C0] __run_timers.part.0+0x679/0xa80
[ 433.132984][ C0] ? call_timer_fn+0x6b0/0x6b0
[ 433.137851][ C0] ? kvm_sched_clock_read+0x14/0x40
[ 433.143092][ C0] ? sched_clock_cpu+0x15/0x1f0
[ 433.147976][ C0] run_timer_softirq+0xb3/0x1d0
[ 433.152844][ C0] __do_softirq+0x29b/0x9c2
[ 433.157367][ C0] __irq_exit_rcu+0x123/0x180
[ 433.162086][ C0] irq_exit_rcu+0x5/0x20
[ 433.166377][ C0] sysvec_apic_timer_interrupt+0x93/0xc0
[ 433.172046][ C0]
[ 433.174985][ C0]
[ 433.177920][ C0] asm_sysvec_apic_timer_interrupt+0x12/0x20
[ 433.183931][ C0] RIP: 0010:acpi_idle_do_entry+0x1c6/0x250
[ 433.189851][ C0] Code: 89 de e8 7d 8b 16 f8 84 db 75 ac e8 94 87 16 f8 e8 1f cf 1c f8 eb 0c e8 88 87 16 f8 0f 00 2d e1 71 d0 00 e8 7c 87 16 f8 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 f7 89 16 f8 48 85 db
[ 433.209680][ C0] RSP: 0018:ffffffff8ba07d60 EFLAGS: 00000293
[ 433.215934][ C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 433.223920][ C0] RDX: ffffffff8babc700 RSI: ffffffff89613d84 RDI: 0000000000000000
[ 433.231904][ C0] RBP: ffff8881457e8064 R08: 0000000000000001 R09: 0000000000000001
[ 433.239885][ C0] R10: ffffffff817e0cc8 R11: 0000000000000000 R12: 0000000000000001
[ 433.247871][ C0] R13: ffff8881457e8000 R14: ffff8881457e8064 R15: ffff888147cc1004
[ 433.255861][ C0] ? trace_hardirqs_on+0x38/0x1c0
[ 433.260952][ C0] ? acpi_idle_do_entry+0x1c4/0x250
[ 433.266262][ C0] acpi_idle_enter+0x361/0x500
[ 433.271048][ C0] cpuidle_enter_state+0x1b1/0xc80
[ 433.276180][ C0] cpuidle_enter+0x4a/0xa0
[ 433.280613][ C0] do_idle+0x3e8/0x590
[ 433.284703][ C0] ? arch_cpu_idle_exit+0x30/0x30
[ 433.289754][ C0] ? trace_init_perf_perm_irq_work_exit+0xe/0xe
[ 433.296028][ C0] ? trace_init_perf_perm_irq_work_exit+0xe/0xe
[ 433.302295][ C0] cpu_startup_entry+0x14/0x20
[ 433.307091][ C0] start_kernel+0x47f/0x4a0
[ 433.311616][ C0] secondary_startup_64_no_verify+0xc3/0xcb
[ 433.317536][ C0]
[ 433.320773][ C0] Kernel Offset: disabled
[ 433.325336][ C0] Rebooting in 86400 seconds..