Warning: Permanently added '10.128.10.19' (ECDSA) to the list of known hosts.
2020/08/03 02:22:30 parsed 1 programs
2020/08/03 02:22:30 executed programs: 0
[ 1046.315628] audit: type=1400 audit(1596421350.606:8): avc:  denied  { execmem } for  pid=6468 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
[ 1046.350099] IPVS: ftp: loaded support on port[0] = 21
[ 1046.451276] chnl_net:caif_netlink_parms(): no params data found
[ 1046.517655] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1046.524154] bridge0: port 1(bridge_slave_0) entered disabled state
[ 1046.532888] device bridge_slave_0 entered promiscuous mode
[ 1046.541651] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1046.548229] bridge0: port 2(bridge_slave_1) entered disabled state
[ 1046.555244] device bridge_slave_1 entered promiscuous mode
[ 1046.576611] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 1046.585856] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 1046.605732] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[ 1046.613333] team0: Port device team_slave_0 added
[ 1046.619534] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[ 1046.626795] team0: Port device team_slave_1 added
[ 1046.643739] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 1046.650043] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 1046.675393] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 1046.686958] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 1046.693337] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 1046.718730] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 1046.730788] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[ 1046.738372] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[ 1046.791037] device hsr_slave_0 entered promiscuous mode
[ 1046.838392] device hsr_slave_1 entered promiscuous mode
[ 1046.878787] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[ 1046.885872] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[ 1046.956551] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1046.962991] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 1046.970061] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1046.976433] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 1047.013608] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready
[ 1047.020102] 8021q: adding VLAN 0 to HW filter on device bond0
[ 1047.029606] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[ 1047.037970] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 1047.058340] bridge0: port 1(bridge_slave_0) entered disabled state
[ 1047.065515] bridge0: port 2(bridge_slave_1) entered disabled state
[ 1047.074251] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 1047.085166] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[ 1047.091444] 8021q: adding VLAN 0 to HW filter on device team0
[ 1047.100677] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 1047.108729] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1047.115080] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 1047.139177] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 1047.147146] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1047.153580] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 1047.161763] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 1047.170753] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 1047.178520] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 1047.185949] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 1047.193911] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 1047.201848] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[ 1047.207848] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 1047.221780] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready
[ 1047.229989] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 1047.236643] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 1047.247598] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 1047.262027] IPv6: ADDRCONF(NETDEV_UP): veth0_virt_wifi: link is not ready
[ 1047.271560] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 1047.308275] IPv6: ADDRCONF(NETDEV_UP): veth0_vlan: link is not ready
[ 1047.315287] IPv6: ADDRCONF(NETDEV_UP): vlan0: link is not ready
[ 1047.323365] IPv6: ADDRCONF(NETDEV_UP): vlan1: link is not ready
[ 1047.333078] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 1047.340979] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 1047.348617] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 1047.358916] device veth0_vlan entered promiscuous mode
[ 1047.367697] device veth1_vlan entered promiscuous mode
[ 1047.374364] IPv6: ADDRCONF(NETDEV_UP): macvlan0: link is not ready
[ 1047.383439] IPv6: ADDRCONF(NETDEV_UP): macvlan1: link is not ready
[ 1047.395208] IPv6: ADDRCONF(NETDEV_UP): veth0_macvtap: link is not ready
[ 1047.405360] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 1047.413072] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 1047.420909] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 1047.431306] device veth0_macvtap entered promiscuous mode
[ 1047.440187] device veth1_macvtap entered promiscuous mode
[ 1047.449966] IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready
[ 1047.459672] IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready
[ 1047.469368] IPv6: ADDRCONF(NETDEV_UP): batadv_slave_0: link is not ready
[ 1047.476478] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 1047.485009] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 1047.493266] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 1047.504134] IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready
[ 1047.511457] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 1047.518186] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 1047.526023] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 1050.748942] Bluetooth: hci0: command 0x0409 tx timeout
2020/08/03 02:22:35 executed programs: 134
[ 1052.829188] Bluetooth: hci0: command 0x041b tx timeout
[ 1054.908120] Bluetooth: hci0: command 0x040f tx timeout
2020/08/03 02:22:40 executed programs: 391
[ 1056.988244] Bluetooth: hci0: command 0x0419 tx timeout
2020/08/03 02:22:45 executed programs: 645
2020/08/03 02:22:50 executed programs: 899
2020/08/03 02:22:55 executed programs: 1156
2020/08/03 02:23:00 executed programs: 1415
2020/08/03 02:23:05 executed programs: 1660
2020/08/03 02:23:10 executed programs: 1911
2020/08/03 02:23:15 executed programs: 2161
2020/08/03 02:23:20 executed programs: 2402
2020/08/03 02:23:25 executed programs: 2656
2020/08/03 02:23:30 executed programs: 2907
2020/08/03 02:23:35 executed programs: 3362
2020/08/03 02:23:40 executed programs: 3852
2020/08/03 02:23:45 executed programs: 4355
2020/08/03 02:23:50 executed programs: 4844
2020/08/03 02:23:55 executed programs: 5340
2020/08/03 02:24:00 executed programs: 5842
2020/08/03 02:24:05 executed programs: 6329
2020/08/03 02:24:10 executed programs: 6813
2020/08/03 02:24:15 executed programs: 7310
2020/08/03 02:24:20 executed programs: 7789
2020/08/03 02:24:25 executed programs: 8275
2020/08/03 02:24:30 executed programs: 8752
2020/08/03 02:24:35 executed programs: 9210
[ 1175.148265] Bluetooth: hci0: command 0x0406 tx timeout
2020/08/03 02:24:40 executed programs: 9686
2020/08/03 02:24:45 executed programs: 10166
2020/08/03 02:24:50 executed programs: 10640
2020/08/03 02:24:55 executed programs: 11136
2020/08/03 02:25:00 executed programs: 11616
2020/08/03 02:25:05 executed programs: 12054
2020/08/03 02:25:10 executed programs: 12502
2020/08/03 02:25:15 executed programs: 12977
2020/08/03 02:25:20 executed programs: 13442
2020/08/03 02:25:25 executed programs: 13965
2020/08/03 02:25:30 executed programs: 14437
2020/08/03 02:25:35 executed programs: 14886
2020/08/03 02:25:40 executed programs: 15364
2020/08/03 02:25:45 executed programs: 15827
2020/08/03 02:25:50 executed programs: 16297
2020/08/03 02:25:55 executed programs: 16796
2020/08/03 02:26:00 executed programs: 17254
2020/08/03 02:26:05 executed programs: 17710
2020/08/03 02:26:10 executed programs: 18162
2020/08/03 02:26:15 executed programs: 18611
2020/08/03 02:26:20 executed programs: 19070
2020/08/03 02:26:25 executed programs: 19558
2020/08/03 02:26:30 executed programs: 20018
2020/08/03 02:26:35 executed programs: 20464
2020/08/03 02:26:40 executed programs: 20911
2020/08/03 02:26:45 executed programs: 21356
2020/08/03 02:26:50 executed programs: 21788
2020/08/03 02:26:55 executed programs: 22280
2020/08/03 02:27:00 executed programs: 22752
2020/08/03 02:27:05 executed programs: 23199
[ 1322.830364] NOHZ: local_softirq_pending 08
[ 1322.837620] NOHZ: local_softirq_pending 08
2020/08/03 02:27:10 executed programs: 23660
2020/08/03 02:27:15 executed programs: 24113
2020/08/03 02:27:20 executed programs: 24558
2020/08/03 02:27:25 executed programs: 25062
2020/08/03 02:27:30 executed programs: 25567
2020/08/03 02:27:35 executed programs: 26036
2020/08/03 02:27:40 executed programs: 26502
2020/08/03 02:27:46 executed programs: 26945
2020/08/03 02:27:51 executed programs: 27443
2020/08/03 02:27:56 executed programs: 27947
2020/08/03 02:28:01 executed programs: 28448
2020/08/03 02:28:06 executed programs: 28939
2020/08/03 02:28:11 executed programs: 29391
2020/08/03 02:28:16 executed programs: 29833
2020/08/03 02:28:21 executed programs: 30275
2020/08/03 02:28:26 executed programs: 30754
2020/08/03 02:28:31 executed programs: 31210
2020/08/03 02:28:36 executed programs: 31658
2020/08/03 02:28:41 executed programs: 32096
2020/08/03 02:28:46 executed programs: 32597
2020/08/03 02:28:51 executed programs: 33100
2020/08/03 02:28:56 executed programs: 33588
2020/08/03 02:29:01 executed programs: 34094
2020/08/03 02:29:06 executed programs: 34587
2020/08/03 02:29:11 executed programs: 35085
[ 1450.769400] ==================================================================
[ 1450.777055] BUG: KASAN: use-after-free in hci_chan_del+0x13e/0x180
[ 1450.783437] Read of size 8 at addr ffff88808e7c5198 by task syz-executor.0/6469
[ 1450.790872] 
[ 1450.792500] CPU: 0 PID: 6469 Comm: syz-executor.0 Not tainted 4.19.136-syzkaller #0
[ 1450.800302] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1450.809646] Call Trace:
[ 1450.812342]  dump_stack+0x1fc/0x2fe
[ 1450.815993]  ? l2cap_conn_del+0x6b0/0x6b0
[ 1450.820135]  print_address_description.cold+0x54/0x219
[ 1450.825422]  kasan_report_error.cold+0x8a/0x1c7
[ 1450.830096]  ? hci_chan_del+0x13e/0x180
[ 1450.834071]  __asan_report_load8_noabort+0x88/0x90
[ 1450.839014]  ? hci_chan_del+0x13e/0x180
[ 1450.842977]  hci_chan_del+0x13e/0x180
[ 1450.846782]  l2cap_conn_del+0x44f/0x6b0
[ 1450.850762]  ? l2cap_conn_del+0x6b0/0x6b0
[ 1450.854967]  l2cap_disconn_cfm+0x85/0xa0
[ 1450.859022]  hci_conn_hash_flush+0x114/0x220
[ 1450.863497]  hci_dev_do_close+0x624/0xe70
[ 1450.867651]  ? hci_dev_open+0x2a0/0x2a0
[ 1450.871632]  ? hci_unregister_dev+0x62/0x7f0
[ 1450.876053]  hci_unregister_dev+0x17c/0x7f0
[ 1450.880427]  ? vhci_close_dev+0x50/0x50
[ 1450.884385]  vhci_release+0x70/0xe0
[ 1450.888016]  __fput+0x2ce/0x890
[ 1450.891289]  task_work_run+0x148/0x1c0
[ 1450.895183]  do_exit+0xbb2/0x2b70
[ 1450.898624]  ? mm_update_next_owner+0x650/0x650
[ 1450.903283]  ? vfs_write+0x393/0x540
[ 1450.907001]  ? ksys_write+0x1c8/0x2a0
[ 1450.910797]  do_group_exit+0x125/0x310
[ 1450.914672]  __x64_sys_exit_group+0x3a/0x50
[ 1450.918997]  do_syscall_64+0xf9/0x620
[ 1450.922843]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 1450.928027] RIP: 0033:0x45cc79
[ 1450.931220] Code: 00 00 00 84 00 48 05 98 16 00 00 48 89 44 24 10 48 89 04 24 48 c7 44 24 08 00 00 00 00 e8 2f 18 fc ff 64 48 8b 04 25 f8 ff ff <ff> 48 8b 40 30 48 8b 80 d0 00 00 00 48 89 04 24 e8 e2 02 fd ff 48
[ 1450.950128] RSP: 002b:00007ffed10481e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 1450.957846] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000045cc79
[ 1450.965629] RDX: 00000000004166d1 RSI: 0000000000ca85f0 RDI: 0000000000000043
[ 1450.972886] RBP: 00000000004c2903 R08: 000000000000000b R09: 0000000000000000
[ 1450.980146] R10: 0000000001b9f940 R11: 0000000000000246 R12: 0000000000000003
[ 1450.987404] R13: 00007ffed1048330 R14: 00000000001622a8 R15: 00007ffed1048340
[ 1450.994691] 
[ 1450.996302] Allocated by task 18856:
[ 1451.000004]  kmem_cache_alloc_trace+0x12f/0x380
[ 1451.004722]  sock_alloc_inode+0x5f/0x250
[ 1451.008786]  alloc_inode+0x5d/0x180
[ 1451.012402]  new_inode_pseudo+0x14/0xe0
[ 1451.016361]  sock_alloc+0x3c/0x260
[ 1451.019883]  __sock_create+0xba/0x740
[ 1451.023677]  __sys_socket+0xef/0x200
[ 1451.027378]  __x64_sys_socket+0x6f/0xb0
[ 1451.031344]  do_syscall_64+0xf9/0x620
[ 1451.035152]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 1451.040333] 
[ 1451.041943] Freed by task 0:
[ 1451.044971]  kfree+0xcc/0x210
[ 1451.048065]  rcu_process_callbacks+0xa0d/0x18b0
[ 1451.052721]  __do_softirq+0x26c/0x9a0
[ 1451.056507] 
[ 1451.058115] The buggy address belongs to the object at ffff88808e7c5180
[ 1451.058115]  which belongs to the cache kmalloc-128 of size 128
[ 1451.070770] The buggy address is located 24 bytes inside of
[ 1451.070770]  128-byte region [ffff88808e7c5180, ffff88808e7c5200)
[ 1451.082597] The buggy address belongs to the page:
[ 1451.087523] page:ffffea000239f140 count:1 mapcount:0 mapping:ffff88812c39c640 index:0x0
[ 1451.095665] flags: 0xfffe0000000100(slab)
[ 1451.099822] raw: 00fffe0000000100 ffffea000237b448 ffffea0002335188 ffff88812c39c640
[ 1451.107702] raw: 0000000000000000 ffff88808e7c5000 0000000100000015 0000000000000000
[ 1451.115570] page dumped because: kasan: bad access detected
[ 1451.121263] 
[ 1451.122872] Memory state around the buggy address:
[ 1451.127801]  ffff88808e7c5080: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[ 1451.135207]  ffff88808e7c5100: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 1451.142566] >ffff88808e7c5180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1451.149932]                             ^
[ 1451.154109]  ffff88808e7c5200: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[ 1451.161472]  ffff88808e7c5280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 1451.168818] ==================================================================
[ 1451.176171] Disabling lock debugging due to kernel taint
[ 1451.181983] Kernel panic - not syncing: panic_on_warn set ...
[ 1451.181983] 
[ 1451.189369] CPU: 0 PID: 6469 Comm: syz-executor.0 Tainted: G    B             4.19.136-syzkaller #0
[ 1451.198556] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1451.208041] Call Trace:
[ 1451.210640]  dump_stack+0x1fc/0x2fe
[ 1451.214278]  ? l2cap_conn_del+0x6b0/0x6b0
[ 1451.218427]  panic+0x26a/0x50e
[ 1451.221643]  ? __warn_printk+0xf3/0xf3
[ 1451.225514]  ? l2cap_conn_del+0x6b0/0x6b0
[ 1451.229647]  ? preempt_schedule_common+0x45/0xc0
[ 1451.234402]  ? ___preempt_schedule+0x16/0x18
[ 1451.238798]  ? trace_hardirqs_on+0x55/0x210
[ 1451.243117]  ? l2cap_conn_del+0x6b0/0x6b0
[ 1451.247245]  kasan_end_report+0x43/0x49
[ 1451.251203]  kasan_report_error.cold+0xa7/0x1c7
[ 1451.255860]  ? hci_chan_del+0x13e/0x180
[ 1451.259819]  __asan_report_load8_noabort+0x88/0x90
[ 1451.265806]  ? hci_chan_del+0x13e/0x180
[ 1451.269763]  hci_chan_del+0x13e/0x180
[ 1451.273548]  l2cap_conn_del+0x44f/0x6b0
[ 1451.277508]  ? l2cap_conn_del+0x6b0/0x6b0
[ 1451.281651]  l2cap_disconn_cfm+0x85/0xa0
[ 1451.285694]  hci_conn_hash_flush+0x114/0x220
[ 1451.290093]  hci_dev_do_close+0x624/0xe70
[ 1451.294229]  ? hci_dev_open+0x2a0/0x2a0
[ 1451.298199]  ? hci_unregister_dev+0x62/0x7f0
[ 1451.302615]  hci_unregister_dev+0x17c/0x7f0
[ 1451.306936]  ? vhci_close_dev+0x50/0x50
[ 1451.310904]  vhci_release+0x70/0xe0
[ 1451.314518]  __fput+0x2ce/0x890
[ 1451.317784]  task_work_run+0x148/0x1c0
[ 1451.321655]  do_exit+0xbb2/0x2b70
[ 1451.325100]  ? mm_update_next_owner+0x650/0x650
[ 1451.329762]  ? vfs_write+0x393/0x540
[ 1451.333526]  ? ksys_write+0x1c8/0x2a0
[ 1451.337334]  do_group_exit+0x125/0x310
[ 1451.341206]  __x64_sys_exit_group+0x3a/0x50
[ 1451.345518]  do_syscall_64+0xf9/0x620
[ 1451.349307]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 1451.354491] RIP: 0033:0x45cc79
[ 1451.357679] Code: 00 00 00 84 00 48 05 98 16 00 00 48 89 44 24 10 48 89 04 24 48 c7 44 24 08 00 00 00 00 e8 2f 18 fc ff 64 48 8b 04 25 f8 ff ff <ff> 48 8b 40 30 48 8b 80 d0 00 00 00 48 89 04 24 e8 e2 02 fd ff 48
[ 1451.376583] RSP: 002b:00007ffed10481e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 1451.384301] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000045cc79
[ 1451.391569] RDX: 00000000004166d1 RSI: 0000000000ca85f0 RDI: 0000000000000043
[ 1451.398873] RBP: 00000000004c2903 R08: 000000000000000b R09: 0000000000000000
[ 1451.406139] R10: 0000000001b9f940 R11: 0000000000000246 R12: 0000000000000003
[ 1451.413411] R13: 00007ffed1048330 R14: 00000000001622a8 R15: 00007ffed1048340
[ 1451.421975] Kernel Offset: disabled
[ 1451.425745] Rebooting in 86400 seconds..