DUID 00:04:ac:d3:e9:6f:d6:cf:30:00:cb:75:86:98:6a:d5:8e:9b forked to background, child pid 3182 [ 29.292041][ T3183] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.305058][ T3183] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.1.36' (ECDSA) to the list of known hosts. 2021/12/18 01:44:17 fuzzer started 2021/12/18 01:44:17 connecting to host at 10.128.0.169:40683 2021/12/18 01:44:17 checking machine... 2021/12/18 01:44:17 checking revisions... 2021/12/18 01:44:17 testing simple program... syzkaller login: [ 50.202652][ T3604] cgroup: Unknown subsys name 'net' [ 50.330446][ T3604] cgroup: Unknown subsys name 'rlimit' [ 51.656937][ T3606] chnl_net:caif_netlink_parms(): no params data found [ 51.699392][ T3606] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.706866][ T3606] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.714638][ T3606] device bridge_slave_0 entered promiscuous mode [ 51.723271][ T3606] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.730645][ T3606] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.738285][ T3606] device bridge_slave_1 entered promiscuous mode [ 51.757548][ T3606] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 51.768310][ T3606] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 51.790484][ T3606] team0: Port device team_slave_0 added [ 51.797537][ T3606] team0: Port device team_slave_1 added [ 51.814126][ T3606] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 51.821155][ T3606] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 51.847321][ T3606] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 51.859681][ T3606] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 51.866649][ T3606] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 51.892853][ T3606] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 51.919439][ T3606] device hsr_slave_0 entered promiscuous mode [ 51.926551][ T3606] device hsr_slave_1 entered promiscuous mode [ 52.004740][ T3606] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 52.014124][ T3606] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 52.023599][ T3606] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 52.032825][ T3606] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 52.051678][ T3606] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.058870][ T3606] bridge0: port 2(bridge_slave_1) entered forwarding state [ 52.066573][ T3606] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.073622][ T3606] bridge0: port 1(bridge_slave_0) entered forwarding state [ 52.115589][ T3606] 8021q: adding VLAN 0 to HW filter on device bond0 [ 52.127483][ T3327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 52.138398][ T3327] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.146851][ T3327] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.155619][ T3327] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 52.169772][ T3606] 8021q: adding VLAN 0 to HW filter on device team0 [ 52.180437][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 52.189670][ T20] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.196759][ T20] bridge0: port 1(bridge_slave_0) entered forwarding state [ 52.217225][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 52.225663][ T20] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.232695][ T20] bridge0: port 2(bridge_slave_1) entered forwarding state [ 52.241376][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 52.250966][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 52.262754][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 52.274786][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 52.285763][ T3327] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 52.297363][ T3606] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 52.311905][ T3327] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 52.320236][ T3327] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 52.331702][ T3606] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 52.349329][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 52.369055][ T3606] device veth0_vlan entered promiscuous mode [ 52.376702][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 52.385160][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 52.392849][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 52.405094][ T3606] device veth1_vlan entered promiscuous mode [ 52.422781][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 52.430979][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 52.439284][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 52.450384][ T3606] device veth0_macvtap entered promiscuous mode [ 52.460629][ T3606] device veth1_macvtap entered promiscuous mode [ 52.475976][ T3606] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 52.483366][ T3327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 52.492728][ T3327] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 52.505126][ T3606] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 52.512609][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 52.522992][ T3606] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.532003][ T3606] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.541291][ T3606] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.550226][ T3606] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.611327][ T54] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 52.619760][ T54] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 52.632728][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 52.651358][ T10] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 52.660093][ T10] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 52.669627][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 2021/12/18 01:44:20 building call list... [ 52.894555][ T10] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 executing program [ 54.911616][ T3597] can: request_module (can-proto-0) failed. [ 54.933135][ T3597] can: request_module (can-proto-0) failed. [ 54.954221][ T3597] can: request_module (can-proto-0) failed. [ 55.142029][ T3597] ------------[ cut here ]------------ [ 55.147788][ T3597] refcount_t: decrement hit 0; leaking memory. [ 55.154283][ T3597] WARNING: CPU: 0 PID: 3597 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0 [ 55.164625][ T3597] Modules linked in: [ 55.168537][ T3597] CPU: 0 PID: 3597 Comm: syz-fuzzer Not tainted 5.16.0-rc4-syzkaller #0 [ 55.177365][ T3597] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 55.188085][ T3597] RIP: 0010:refcount_warn_saturate+0xbf/0x1e0 [ 55.194164][ T3597] Code: 1d 11 92 a1 09 31 ff 89 de e8 7d 30 9c fd 84 db 75 e0 e8 94 2c 9c fd 48 c7 c7 a0 00 05 8a c6 05 f1 91 a1 09 01 e8 ec 51 27 05 <0f> 0b eb c4 e8 78 2c 9c fd 0f b6 1d e0 91 a1 09 31 ff 89 de e8 48 [ 55.214185][ T3597] RSP: 0018:ffffc90001adfab0 EFLAGS: 00010286 [ 55.220522][ T3597] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 55.228616][ T3597] RDX: ffff888016f53a00 RSI: ffffffff815f1e28 RDI: fffff5200035bf48 [ 55.237369][ T3597] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000 [ 55.245509][ T3597] R10: ffffffff815ebbce R11: 0000000000000000 R12: 1ffff9200035bf5b [ 55.253572][ T3597] R13: 00000000ffffffef R14: ffffffff8d2fcfd4 R15: ffffc90001adfd10 [ 55.261729][ T3597] FS: 000000c00002e490(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 [ 55.270700][ T3597] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 55.277646][ T3597] CR2: 00007ffa4740c300 CR3: 0000000023123000 CR4: 00000000003506e0 [ 55.285843][ T3597] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 55.293805][ T3597] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 55.301951][ T3597] Call Trace: [ 55.305418][ T3597] [ 55.308360][ T3597] ref_tracker_free+0x4fe/0x610 [ 55.313227][ T3597] ? ref_tracker_dir_exit+0x330/0x330 [ 55.318640][ T3597] ? bpf_sk_storage_free+0x333/0x3e0 [ 55.323950][ T3597] ? lock_downgrade+0x6e0/0x6e0 [ 55.329170][ T3597] ? kfree+0x1e1/0x560 [ 55.333268][ T3597] __sk_destruct+0x4a6/0x920 [ 55.338893][ T3597] sk_destruct+0xbd/0xe0 [ 55.343132][ T3597] __sk_free+0xef/0x3d0 [ 55.347511][ T3597] sk_free+0x78/0xa0 [ 55.351404][ T3597] __mptcp_close_ssk+0x435/0x590 [ 55.357219][ T3597] __mptcp_destroy_sock+0x35f/0x830 [ 55.362831][ T3597] ? __mptcp_close_ssk+0x590/0x590 [ 55.368153][ T3597] ? __local_bh_enable_ip+0xa0/0x120 [ 55.373438][ T3597] mptcp_close+0x5f8/0x7f0 [ 55.378794][ T3597] inet_release+0x12e/0x280 [ 55.383292][ T3597] inet6_release+0x4c/0x70 [ 55.388155][ T3597] __sock_release+0xcd/0x280 [ 55.392743][ T3597] sock_close+0x18/0x20 [ 55.397897][ T3597] __fput+0x286/0x9f0 [ 55.401879][ T3597] ? __sock_release+0x280/0x280 [ 55.406955][ T3597] task_work_run+0xdd/0x1a0 [ 55.411460][ T3597] exit_to_user_mode_prepare+0x27e/0x290 [ 55.418061][ T3597] syscall_exit_to_user_mode+0x19/0x60 [ 55.423569][ T3597] do_syscall_64+0x42/0xb0 [ 55.428206][ T3597] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 55.434093][ T3597] RIP: 0033:0x4b12db [ 55.439124][ T3597] Code: fb ff eb bd e8 46 96 fb ff e9 61 ff ff ff cc e8 fb 61 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30 [ 55.459981][ T3597] RSP: 002b:000000c0002a14f0 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 55.468934][ T3597] RAX: 0000000000000000 RBX: 000000c00001e800 RCX: 00000000004b12db [ 55.477928][ T3597] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006 [ 55.486051][ T3597] RBP: 000000c0002a1530 R08: 0000000000f0ae01 R09: 00007ffd92fec080 [ 55.494009][ T3597] R10: 00007ffd92fec090 R11: 0000000000000206 R12: 0000000000000081 [ 55.502892][ T3597] R13: 0000000000000000 R14: ffffffffffffffff R15: 000000c0000b5360 [ 55.511085][ T3597] [ 55.514114][ T3597] Kernel panic - not syncing: panic_on_warn set ... [ 55.520677][ T3597] CPU: 1 PID: 3597 Comm: syz-fuzzer Not tainted 5.16.0-rc4-syzkaller #0 [ 55.528985][ T3597] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 55.539021][ T3597] Call Trace: [ 55.542283][ T3597] [ 55.545200][ T3597] dump_stack_lvl+0xcd/0x134 [ 55.549780][ T3597] panic+0x2b0/0x6dd [ 55.553668][ T3597] ? __warn_printk+0xf3/0xf3 [ 55.558251][ T3597] ? __warn.cold+0x1a/0x44 [ 55.562657][ T3597] ? refcount_warn_saturate+0xbf/0x1e0 [ 55.568110][ T3597] __warn.cold+0x35/0x44 [ 55.572358][ T3597] ? wake_up_klogd.part.0+0x8e/0xd0 [ 55.577560][ T3597] ? refcount_warn_saturate+0xbf/0x1e0 [ 55.583024][ T3597] report_bug+0x1bd/0x210 [ 55.587361][ T3597] handle_bug+0x3c/0x60 [ 55.591519][ T3597] exc_invalid_op+0x14/0x40 [ 55.596024][ T3597] asm_exc_invalid_op+0x12/0x20 [ 55.600876][ T3597] RIP: 0010:refcount_warn_saturate+0xbf/0x1e0 [ 55.606946][ T3597] Code: 1d 11 92 a1 09 31 ff 89 de e8 7d 30 9c fd 84 db 75 e0 e8 94 2c 9c fd 48 c7 c7 a0 00 05 8a c6 05 f1 91 a1 09 01 e8 ec 51 27 05 <0f> 0b eb c4 e8 78 2c 9c fd 0f b6 1d e0 91 a1 09 31 ff 89 de e8 48 [ 55.626558][ T3597] RSP: 0018:ffffc90001adfab0 EFLAGS: 00010286 [ 55.632621][ T3597] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 55.640592][ T3597] RDX: ffff888016f53a00 RSI: ffffffff815f1e28 RDI: fffff5200035bf48 [ 55.648560][ T3597] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000 [ 55.656527][ T3597] R10: ffffffff815ebbce R11: 0000000000000000 R12: 1ffff9200035bf5b [ 55.664493][ T3597] R13: 00000000ffffffef R14: ffffffff8d2fcfd4 R15: ffffc90001adfd10 [ 55.672469][ T3597] ? wake_up_klogd.part.0+0x8e/0xd0 [ 55.677671][ T3597] ? vprintk+0x88/0x90 [ 55.681743][ T3597] ref_tracker_free+0x4fe/0x610 [ 55.686597][ T3597] ? ref_tracker_dir_exit+0x330/0x330 [ 55.692051][ T3597] ? bpf_sk_storage_free+0x333/0x3e0 [ 55.697339][ T3597] ? lock_downgrade+0x6e0/0x6e0 [ 55.702197][ T3597] ? kfree+0x1e1/0x560 [ 55.706281][ T3597] __sk_destruct+0x4a6/0x920 [ 55.710881][ T3597] sk_destruct+0xbd/0xe0 [ 55.715127][ T3597] __sk_free+0xef/0x3d0 [ 55.719285][ T3597] sk_free+0x78/0xa0 [ 55.723181][ T3597] __mptcp_close_ssk+0x435/0x590 [ 55.728124][ T3597] __mptcp_destroy_sock+0x35f/0x830 [ 55.733320][ T3597] ? __mptcp_close_ssk+0x590/0x590 [ 55.738430][ T3597] ? __local_bh_enable_ip+0xa0/0x120 [ 55.743723][ T3597] mptcp_close+0x5f8/0x7f0 [ 55.748142][ T3597] inet_release+0x12e/0x280 [ 55.752734][ T3597] inet6_release+0x4c/0x70 [ 55.757149][ T3597] __sock_release+0xcd/0x280 [ 55.761743][ T3597] sock_close+0x18/0x20 [ 55.765900][ T3597] __fput+0x286/0x9f0 [ 55.769884][ T3597] ? __sock_release+0x280/0x280 [ 55.774744][ T3597] task_work_run+0xdd/0x1a0 [ 55.779250][ T3597] exit_to_user_mode_prepare+0x27e/0x290 [ 55.784883][ T3597] syscall_exit_to_user_mode+0x19/0x60 [ 55.790343][ T3597] do_syscall_64+0x42/0xb0 [ 55.794762][ T3597] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 55.800658][ T3597] RIP: 0033:0x4b12db [ 55.804548][ T3597] Code: fb ff eb bd e8 46 96 fb ff e9 61 ff ff ff cc e8 fb 61 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30 [ 55.824152][ T3597] RSP: 002b:000000c0002a14f0 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 55.832561][ T3597] RAX: 0000000000000000 RBX: 000000c00001e800 RCX: 00000000004b12db [ 55.840528][ T3597] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006 [ 55.848504][ T3597] RBP: 000000c0002a1530 R08: 0000000000f0ae01 R09: 00007ffd92fec080 [ 55.856470][ T3597] R10: 00007ffd92fec090 R11: 0000000000000206 R12: 0000000000000081 [ 55.864437][ T3597] R13: 0000000000000000 R14: ffffffffffffffff R15: 000000c0000b5360 [ 55.872419][ T3597] [ 55.875793][ T3597] Kernel Offset: disabled [ 55.880205][ T3597] Rebooting in 86400 seconds..