DUID 00:04:99:cf:64:81:91:3a:f8:b3:88:a8:0e:05:2a:78:8a:13
forked to background, child pid 3181
[ 31.740075][ T3182] 8021q: adding VLAN 0 to HW filter on device bond0
[ 31.755064][ T3182] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.15.204' (ECDSA) to the list of known hosts.
2021/12/15 17:34:59 fuzzer started
2021/12/15 17:34:59 connecting to host at 10.128.0.169:42529
2021/12/15 17:34:59 checking machine...
2021/12/15 17:34:59 checking revisions...
2021/12/15 17:35:00 testing simple program...
syzkaller login: [ 52.887913][ T3609] cgroup: Unknown subsys name 'net'
[ 52.989590][ T3609] cgroup: Unknown subsys name 'rlimit'
[ 54.247392][ T3614] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 54.255665][ T3614] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 54.263395][ T3614] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 54.271434][ T3614] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 54.279237][ T3614] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 54.286766][ T3614] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 54.377215][ T3612] chnl_net:caif_netlink_parms(): no params data found
[ 54.421915][ T3612] bridge0: port 1(bridge_slave_0) entered blocking state
[ 54.429609][ T3612] bridge0: port 1(bridge_slave_0) entered disabled state
[ 54.437689][ T3612] device bridge_slave_0 entered promiscuous mode
[ 54.446677][ T3612] bridge0: port 2(bridge_slave_1) entered blocking state
[ 54.454040][ T3612] bridge0: port 2(bridge_slave_1) entered disabled state
[ 54.462078][ T3612] device bridge_slave_1 entered promiscuous mode
[ 54.484039][ T3612] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 54.495659][ T3612] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 54.518363][ T3612] team0: Port device team_slave_0 added
[ 54.526213][ T3612] team0: Port device team_slave_1 added
[ 54.544416][ T3612] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 54.551500][ T3612] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 54.578217][ T3612] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 54.591872][ T3612] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 54.599064][ T3612] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 54.625215][ T3612] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 54.650583][ T3612] device hsr_slave_0 entered promiscuous mode
[ 54.658350][ T3612] device hsr_slave_1 entered promiscuous mode
[ 54.739823][ T3612] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 54.751285][ T3612] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 54.760648][ T3612] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 54.770541][ T3612] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 54.792420][ T3612] bridge0: port 2(bridge_slave_1) entered blocking state
[ 54.800025][ T3612] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 54.808219][ T3612] bridge0: port 1(bridge_slave_0) entered blocking state
[ 54.815641][ T3612] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 54.861607][ T3612] 8021q: adding VLAN 0 to HW filter on device bond0
[ 54.875120][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 54.887092][ T7] bridge0: port 1(bridge_slave_0) entered disabled state
[ 54.896128][ T7] bridge0: port 2(bridge_slave_1) entered disabled state
[ 54.905471][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 54.918957][ T3612] 8021q: adding VLAN 0 to HW filter on device team0
[ 54.930576][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 54.940066][ T20] bridge0: port 1(bridge_slave_0) entered blocking state
[ 54.947584][ T20] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 54.959048][ T3623] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 54.968013][ T3623] bridge0: port 2(bridge_slave_1) entered blocking state
[ 54.975220][ T3623] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 54.996346][ T3623] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 55.005682][ T3623] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 55.026286][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 55.035534][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 55.044677][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 55.057522][ T3612] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 55.074546][ T3623] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 55.082003][ T3623] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 55.095676][ T3612] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 55.114085][ T3623] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 55.135992][ T3622] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 55.144681][ T3622] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 55.152338][ T3622] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 55.163882][ T3612] device veth0_vlan entered promiscuous mode
[ 55.176418][ T3612] device veth1_vlan entered promiscuous mode
[ 55.197446][ T3623] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 55.205953][ T3623] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 55.215305][ T3623] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 55.226008][ T3612] device veth0_macvtap entered promiscuous mode
[ 55.235850][ T3612] device veth1_macvtap entered promiscuous mode
[ 55.252325][ T3612] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 55.261321][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 55.270805][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 55.282577][ T3612] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 55.290982][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 55.302705][ T3612] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 55.312553][ T3612] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 55.321922][ T3612] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 55.331034][ T3612] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 55.398137][ T10] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 55.407538][ T10] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 55.418514][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 55.438116][ T10] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 55.448616][ T10] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 55.457949][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
2021/12/15 17:35:02 building call list...
[ 55.695620][ T90] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
executing program
[ 57.572308][ T3610] can: request_module (can-proto-0) failed.
[ 57.596650][ T3610] can: request_module (can-proto-0) failed.
[ 57.617834][ T3610] can: request_module (can-proto-0) failed.
[ 57.814734][ T3610] ------------[ cut here ]------------
[ 57.820418][ T3610] refcount_t: decrement hit 0; leaking memory.
[ 57.827813][ T3610] WARNING: CPU: 0 PID: 3610 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0
[ 57.837816][ T3610] Modules linked in:
[ 57.842076][ T3610] CPU: 0 PID: 3610 Comm: syz-fuzzer Not tainted 5.16.0-rc5-next-20211214-syzkaller #0
[ 57.851737][ T3610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 57.862174][ T3610] RIP: 0010:refcount_warn_saturate+0xbf/0x1e0
[ 57.868434][ T3610] Code: 1d 06 e6 95 09 31 ff 89 de e8 4d f8 8f fd 84 db 75 e0 e8 64 f4 8f fd 48 c7 c7 a0 4d 05 8a c6 05 e6 e5 95 09 01 e8 26 ac 28 05 <0f> 0b eb c4 e8 48 f4 8f fd 0f b6 1d d5 e5 95 09 31 ff 89 de e8 18
[ 57.888927][ T3610] RSP: 0018:ffffc900020afab8 EFLAGS: 00010282
[ 57.895364][ T3610] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 57.903680][ T3610] RDX: ffff88807568ba80 RSI: ffffffff815f4648 RDI: fffff52000415f49
[ 57.911651][ T3610] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
[ 57.920449][ T3610] R10: ffffffff815ee3ae R11: 0000000000000000 R12: 1ffff92000415f5c
[ 57.929502][ T3610] R13: 00000000ffffffef R14: ffffffff8d309554 R15: ffffc900020afd10
[ 57.937772][ T3610] FS: 000000c0001d7890(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
[ 57.947492][ T3610] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 57.954221][ T3610] CR2: 00007f04b4072300 CR3: 00000000220c3000 CR4: 00000000003506e0
[ 57.962212][ T3610] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 57.970538][ T3610] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 57.978667][ T3610] Call Trace:
[ 57.981951][ T3610]
[ 57.984936][ T3610] ref_tracker_free+0x4fe/0x610
[ 57.989808][ T3610] ? ref_tracker_dir_exit+0x330/0x330
[ 57.995308][ T3610] ? bpf_sk_storage_free+0x333/0x3e0
[ 58.000615][ T3610] ? lock_downgrade+0x6e0/0x6e0
[ 58.005529][ T3610] ? kfree+0x1ea/0x4b0
[ 58.009714][ T3610] __sk_destruct+0x3cd/0x710
[ 58.014355][ T3610] sk_destruct+0xbd/0xe0
[ 58.018730][ T3610] __sk_free+0xef/0x3d0
[ 58.023069][ T3610] sk_free+0x78/0xa0
[ 58.026984][ T3610] __mptcp_close_ssk+0x435/0x590
[ 58.031935][ T3610] __mptcp_destroy_sock+0x35f/0x830
[ 58.037186][ T3610] ? __mptcp_close_ssk+0x590/0x590
[ 58.042316][ T3610] ? __local_bh_enable_ip+0xa0/0x120
[ 58.047670][ T3610] mptcp_close+0x5f8/0x7f0
[ 58.052192][ T3610] inet_release+0x12e/0x280
[ 58.057049][ T3610] inet6_release+0x4c/0x70
[ 58.061493][ T3610] __sock_release+0xcd/0x280
[ 58.066203][ T3610] sock_close+0x18/0x20
[ 58.070388][ T3610] __fput+0x286/0x9f0
[ 58.074631][ T3610] ? __sock_release+0x280/0x280
[ 58.079527][ T3610] task_work_run+0xdd/0x1a0
[ 58.084521][ T3610] exit_to_user_mode_prepare+0x27e/0x290
[ 58.090188][ T3610] syscall_exit_to_user_mode+0x19/0x60
[ 58.095942][ T3610] do_syscall_64+0x42/0xb0
[ 58.100563][ T3610] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 58.106979][ T3610] RIP: 0033:0x4b12db
[ 58.110987][ T3610] Code: fb ff eb bd e8 46 96 fb ff e9 61 ff ff ff cc e8 fb 61 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30
[ 58.131523][ T3610] RSP: 002b:000000c0002c14f0 EFLAGS: 00000206 ORIG_RAX: 0000000000000003
[ 58.140253][ T3610] RAX: 0000000000000000 RBX: 000000c000020800 RCX: 00000000004b12db
[ 58.148670][ T3610] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006
[ 58.156908][ T3610] RBP: 000000c0002c1530 R08: 0000000000f0ae01 R09: 00007ffcb73eb080
[ 58.165013][ T3610] R10: 00007ffcb73eb090 R11: 0000000000000206 R12: 0000000000000080
[ 58.173824][ T3610] R13: 0000000000000000 R14: ffffffffffffffff R15: 000000c00030c000
[ 58.181917][ T3610]
[ 58.185081][ T3610] Kernel panic - not syncing: panic_on_warn set ...
[ 58.191694][ T3610] CPU: 0 PID: 3610 Comm: syz-fuzzer Not tainted 5.16.0-rc5-next-20211214-syzkaller #0
[ 58.201225][ T3610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 58.211466][ T3610] Call Trace:
[ 58.215194][ T3610]
[ 58.218211][ T3610] dump_stack_lvl+0xcd/0x134
[ 58.222817][ T3610] panic+0x2b0/0x6dd
[ 58.226719][ T3610] ? __warn_printk+0xf3/0xf3
[ 58.231407][ T3610] ? __warn.cold+0x1d1/0x2cf
[ 58.236002][ T3610] ? refcount_warn_saturate+0xbf/0x1e0
[ 58.241475][ T3610] __warn.cold+0x1ec/0x2cf
[ 58.245938][ T3610] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70
[ 58.252194][ T3610] ? refcount_warn_saturate+0xbf/0x1e0
[ 58.257679][ T3610] report_bug+0x1bd/0x210
[ 58.262020][ T3610] handle_bug+0x3c/0x60
[ 58.266361][ T3610] exc_invalid_op+0x14/0x40
[ 58.270872][ T3610] asm_exc_invalid_op+0x12/0x20
[ 58.275939][ T3610] RIP: 0010:refcount_warn_saturate+0xbf/0x1e0
[ 58.282320][ T3610] Code: 1d 06 e6 95 09 31 ff 89 de e8 4d f8 8f fd 84 db 75 e0 e8 64 f4 8f fd 48 c7 c7 a0 4d 05 8a c6 05 e6 e5 95 09 01 e8 26 ac 28 05 <0f> 0b eb c4 e8 48 f4 8f fd 0f b6 1d d5 e5 95 09 31 ff 89 de e8 18
[ 58.302363][ T3610] RSP: 0018:ffffc900020afab8 EFLAGS: 00010282
[ 58.308526][ T3610] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 58.316719][ T3610] RDX: ffff88807568ba80 RSI: ffffffff815f4648 RDI: fffff52000415f49
[ 58.324797][ T3610] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
[ 58.332771][ T3610] R10: ffffffff815ee3ae R11: 0000000000000000 R12: 1ffff92000415f5c
[ 58.340786][ T3610] R13: 00000000ffffffef R14: ffffffff8d309554 R15: ffffc900020afd10
[ 58.348780][ T3610] ? wake_up_klogd.part.0+0x8e/0xd0
[ 58.354173][ T3610] ? vprintk+0x88/0x90
[ 58.358352][ T3610] ? refcount_warn_saturate+0xbf/0x1e0
[ 58.363848][ T3610] ref_tracker_free+0x4fe/0x610
[ 58.368878][ T3610] ? ref_tracker_dir_exit+0x330/0x330
[ 58.374428][ T3610] ? bpf_sk_storage_free+0x333/0x3e0
[ 58.379831][ T3610] ? lock_downgrade+0x6e0/0x6e0
[ 58.384696][ T3610] ? kfree+0x1ea/0x4b0
[ 58.388968][ T3610] __sk_destruct+0x3cd/0x710
[ 58.393573][ T3610] sk_destruct+0xbd/0xe0
[ 58.397829][ T3610] __sk_free+0xef/0x3d0
[ 58.402086][ T3610] sk_free+0x78/0xa0
[ 58.405992][ T3610] __mptcp_close_ssk+0x435/0x590
[ 58.410953][ T3610] __mptcp_destroy_sock+0x35f/0x830
[ 58.416161][ T3610] ? __mptcp_close_ssk+0x590/0x590
[ 58.421287][ T3610] ? __local_bh_enable_ip+0xa0/0x120
[ 58.426602][ T3610] mptcp_close+0x5f8/0x7f0
[ 58.431045][ T3610] inet_release+0x12e/0x280
[ 58.435563][ T3610] inet6_release+0x4c/0x70
[ 58.439991][ T3610] __sock_release+0xcd/0x280
[ 58.444602][ T3610] sock_close+0x18/0x20
[ 58.448773][ T3610] __fput+0x286/0x9f0
[ 58.452770][ T3610] ? __sock_release+0x280/0x280
[ 58.457730][ T3610] task_work_run+0xdd/0x1a0
[ 58.462246][ T3610] exit_to_user_mode_prepare+0x27e/0x290
[ 58.467892][ T3610] syscall_exit_to_user_mode+0x19/0x60
[ 58.473887][ T3610] do_syscall_64+0x42/0xb0
[ 58.478311][ T3610] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 58.484224][ T3610] RIP: 0033:0x4b12db
[ 58.488118][ T3610] Code: fb ff eb bd e8 46 96 fb ff e9 61 ff ff ff cc e8 fb 61 fb ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30
[ 58.507729][ T3610] RSP: 002b:000000c0002c14f0 EFLAGS: 00000206 ORIG_RAX: 0000000000000003
[ 58.516241][ T3610] RAX: 0000000000000000 RBX: 000000c000020800 RCX: 00000000004b12db
[ 58.524403][ T3610] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006
[ 58.532382][ T3610] RBP: 000000c0002c1530 R08: 0000000000f0ae01 R09: 00007ffcb73eb080
[ 58.540354][ T3610] R10: 00007ffcb73eb090 R11: 0000000000000206 R12: 0000000000000080
[ 58.548331][ T3610] R13: 0000000000000000 R14: ffffffffffffffff R15: 000000c00030c000
[ 58.556494][ T3610]
[ 58.559961][ T3610] Kernel Offset: disabled
[ 58.564534][ T3610] Rebooting in 86400 seconds..