Warning: Permanently added '[localhost]:33480' (ED25519) to the list of known hosts. 2025/06/02 03:13:28 ignoring optional flag "sandboxArg"="0" 2025/06/02 03:13:29 parsed 1 programs [ 82.021501][ T40] audit: type=1400 audit(1748834011.132:117): avc: denied { unlink } for pid=6205 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 83.082179][ T6205] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 85.165110][ T6024] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 85.169613][ T6024] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 85.173199][ T6024] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 85.177096][ T6024] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 85.180551][ T6024] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 85.428073][ T80] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.432028][ T80] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.454238][ T1141] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.457559][ T1141] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.454632][ T40] audit: type=1401 audit(1748834015.572:118): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 86.642321][ T6294] chnl_net:caif_netlink_parms(): no params data found [ 86.763384][ T6294] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.765885][ T6294] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.768610][ T6294] bridge_slave_0: entered allmulticast mode [ 86.771893][ T6294] bridge_slave_0: entered promiscuous mode [ 86.784112][ T6294] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.786786][ T6294] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.789540][ T6294] bridge_slave_1: entered allmulticast mode [ 86.793643][ T6294] bridge_slave_1: entered promiscuous mode [ 86.829186][ T6294] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.834156][ T6294] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.869159][ T6294] team0: Port device team_slave_0 added [ 86.872829][ T835] cfg80211: failed to load regulatory.db [ 86.877459][ T6294] team0: Port device team_slave_1 added [ 86.923614][ T6294] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.925861][ T6294] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.934092][ T6294] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.938353][ T6294] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.940497][ T6294] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.948855][ T6294] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.014421][ T6294] hsr_slave_0: entered promiscuous mode [ 87.017532][ T6294] hsr_slave_1: entered promiscuous mode [ 87.542403][ T6294] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 87.547393][ T6294] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 87.551417][ T6294] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 87.555223][ T6294] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 87.600702][ T6294] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.610708][ T6294] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.616318][ T80] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.618631][ T80] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.625697][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.627977][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.746297][ T6294] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.775276][ T6294] veth0_vlan: entered promiscuous mode [ 87.780689][ T6294] veth1_vlan: entered promiscuous mode [ 87.797404][ T6294] veth0_macvtap: entered promiscuous mode [ 87.801332][ T6294] veth1_macvtap: entered promiscuous mode [ 87.812654][ T6294] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.819101][ T6294] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.824042][ T6294] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.826914][ T6294] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.829652][ T6294] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.833114][ T6294] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.926169][ T1141] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 88.013850][ T1141] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 88.071506][ T1141] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 88.140558][ T1141] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2025/06/02 03:13:37 executed programs: 0 [ 88.829790][ T6024] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 88.832914][ T6024] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 88.835756][ T6024] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 88.839219][ T6024] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 88.846070][ T6024] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 88.990015][ T6402] chnl_net:caif_netlink_parms(): no params data found [ 89.095665][ T6402] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.098568][ T6402] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.100862][ T6402] bridge_slave_0: entered allmulticast mode [ 89.103665][ T6402] bridge_slave_0: entered promiscuous mode [ 89.106919][ T6402] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.109278][ T6402] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.111820][ T6402] bridge_slave_1: entered allmulticast mode [ 89.115690][ T6402] bridge_slave_1: entered promiscuous mode [ 89.153058][ T6402] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.158728][ T6402] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.192308][ T6402] team0: Port device team_slave_0 added [ 89.196416][ T6402] team0: Port device team_slave_1 added [ 89.225588][ T6402] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.227816][ T6402] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.236117][ T6402] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.240463][ T6402] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.244183][ T6402] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.252447][ T6402] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.304248][ T6402] hsr_slave_0: entered promiscuous mode [ 89.306951][ T6402] hsr_slave_1: entered promiscuous mode [ 89.309659][ T6402] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 89.312489][ T6402] Cannot create hsr debugfs directory [ 90.871652][ T63] Bluetooth: hci0: command tx timeout [ 91.042615][ T1141] bridge_slave_1: left allmulticast mode [ 91.045047][ T1141] bridge_slave_1: left promiscuous mode [ 91.048039][ T1141] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.053510][ T1141] bridge_slave_0: left allmulticast mode [ 91.055920][ T1141] bridge_slave_0: left promiscuous mode [ 91.058511][ T1141] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.291477][ T1141] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 91.295752][ T1141] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 91.299710][ T1141] bond0 (unregistering): Released all slaves [ 91.463473][ T1141] hsr_slave_0: left promiscuous mode [ 91.466337][ T1141] hsr_slave_1: left promiscuous mode [ 91.469090][ T1141] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 91.472302][ T1141] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 91.475933][ T1141] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 91.479020][ T1141] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 91.494452][ T1141] veth1_macvtap: left promiscuous mode [ 91.496521][ T1141] veth0_macvtap: left promiscuous mode [ 91.498985][ T1141] veth1_vlan: left promiscuous mode [ 91.501410][ T1141] veth0_vlan: left promiscuous mode [ 91.964006][ T1141] team0 (unregistering): Port device team_slave_1 removed [ 92.012756][ T1141] team0 (unregistering): Port device team_slave_0 removed [ 92.652354][ T6402] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 92.657744][ T6402] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 92.667032][ T6402] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 92.671256][ T6402] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 92.731912][ T6402] 8021q: adding VLAN 0 to HW filter on device bond0 [ 92.746612][ T6402] 8021q: adding VLAN 0 to HW filter on device team0 [ 92.756363][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.759421][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 92.767123][ T80] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.769511][ T80] bridge0: port 2(bridge_slave_1) entered forwarding state [ 92.952627][ T63] Bluetooth: hci0: command tx timeout [ 93.002005][ T6402] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 93.027074][ T6402] veth0_vlan: entered promiscuous mode [ 93.032365][ T6402] veth1_vlan: entered promiscuous mode [ 93.048623][ T6402] veth0_macvtap: entered promiscuous mode [ 93.056989][ T6402] veth1_macvtap: entered promiscuous mode [ 93.090789][ T6402] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.099820][ T6402] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.116638][ T6402] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.120316][ T6402] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.124634][ T6402] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.128125][ T6402] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.169185][ T46] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.171745][ T46] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.199446][ T46] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.202038][ T46] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.229123][ T6500] INFO: trying to register non-static key. [ 93.231483][ T6500] The code is fine but needs lockdep annotation, or maybe [ 93.235179][ T6500] you didn't initialize this object before use? [ 93.237534][ T6500] turning off the locking correctness validator. [ 93.239712][ T6500] CPU: 3 UID: 0 PID: 6500 Comm: syz.0.16 Not tainted 6.15.0-syzkaller-gcd2e103d57e5-dirty #0 PREEMPT(full) [ 93.239726][ T6500] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 93.239733][ T6500] Call Trace: [ 93.239737][ T6500] [ 93.239742][ T6500] dump_stack_lvl+0x116/0x1f0 [ 93.239759][ T6500] register_lock_class+0x4a3/0x4c0 [ 93.239774][ T6500] __lock_acquire+0xa6/0x1c90 [ 93.239789][ T6500] lock_acquire+0x179/0x350 [ 93.239801][ T6500] ? futex_hash_prctl+0x2fc/0x770 [ 93.239813][ T6500] ? __pfx___might_resched+0x10/0x10 [ 93.239824][ T6500] __mutex_lock+0x199/0xb90 [ 93.239837][ T6500] ? futex_hash_prctl+0x2fc/0x770 [ 93.239849][ T6500] ? __page_table_check_ptes_set+0x1ae/0x420 [ 93.239862][ T6500] ? futex_hash_prctl+0x2fc/0x770 [ 93.239873][ T6500] ? find_held_lock+0x2b/0x80 [ 93.239882][ T6500] ? __pfx___mutex_lock+0x10/0x10 [ 93.239894][ T6500] ? __handle_mm_fault+0x27cd/0x53d0 [ 93.239915][ T6500] ? futex_hash_prctl+0x2fc/0x770 [ 93.239926][ T6500] futex_hash_prctl+0x2fc/0x770 [ 93.239938][ T6500] ? __pfx_futex_hash_prctl+0x10/0x10 [ 93.239952][ T6500] ? cap_task_prctl+0x2af/0xa80 [ 93.239965][ T6500] ? static_key_count+0x5a/0x70 [ 93.239980][ T6500] ? security_task_prctl+0x11c/0x160 [ 93.239992][ T6500] __do_sys_prctl+0x171f/0x24c0 [ 93.240007][ T6500] ? __pfx___do_sys_prctl+0x10/0x10 [ 93.240022][ T6500] do_syscall_64+0xcd/0x4c0 [ 93.240036][ T6500] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.240046][ T6500] RIP: 0033:0x7f516c98e969 [ 93.240055][ T6500] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 93.240064][ T6500] RSP: 002b:00007f516d8a5038 EFLAGS: 00000246 ORIG_RAX: 000000000000009d [ 93.240075][ T6500] RAX: ffffffffffffffda RBX: 00007f516cbb5fa0 RCX: 00007f516c98e969 [ 93.240081][ T6500] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 000000000000004e [ 93.240086][ T6500] RBP: 00007f516ca10ab1 R08: 0000000000000000 R09: 0000000000000000 [ 93.240092][ T6500] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.240097][ T6500] R13: 0000000000000001 R14: 00007f516cbb5fa0 R15: 00007ffc88069c38 [ 93.240106][ T6500] 2025/06/02 03:13:42 executed programs: 30 [ 94.248954][ T6658] ================================================================== [ 94.251512][ T6658] BUG: KASAN: slab-out-of-bounds in do_raw_spin_lock+0x26f/0x2b0 [ 94.253958][ T6658] Read of size 4 at addr ffff88802c556a4c by task syz.0.69/6658 [ 94.256283][ T6658] [ 94.257093][ T6658] CPU: 2 UID: 0 PID: 6658 Comm: syz.0.69 Not tainted 6.15.0-syzkaller-gcd2e103d57e5-dirty #0 PREEMPT(full) [ 94.257107][ T6658] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 94.257114][ T6658] Call Trace: [ 94.257119][ T6658] [ 94.257123][ T6658] dump_stack_lvl+0x116/0x1f0 [ 94.257139][ T6658] print_report+0xcd/0x680 [ 94.257152][ T6658] ? __virt_addr_valid+0x81/0x610 [ 94.257168][ T6658] ? __phys_addr+0xe8/0x180 [ 94.257183][ T6658] ? do_raw_spin_lock+0x26f/0x2b0 [ 94.257197][ T6658] kasan_report+0xe0/0x110 [ 94.257209][ T6658] ? do_raw_spin_lock+0x26f/0x2b0 [ 94.257224][ T6658] do_raw_spin_lock+0x26f/0x2b0 [ 94.257239][ T6658] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 94.257256][ T6658] __futex_pivot_hash+0x1dd/0x540 [ 94.257268][ T6658] futex_hash_allocate+0xad1/0xf00 [ 94.257279][ T6658] ? lock_release+0x201/0x2f0 [ 94.257291][ T6658] ? __pfx_futex_hash_allocate+0x10/0x10 [ 94.257304][ T6658] futex_hash_prctl+0x306/0x770 [ 94.257317][ T6658] ? __pfx_futex_hash_prctl+0x10/0x10 [ 94.257328][ T6658] ? lock_release+0x201/0x2f0 [ 94.257342][ T6658] ? cap_task_prctl+0x2af/0xa80 [ 94.257355][ T6658] ? static_key_count+0x5a/0x70 [ 94.257371][ T6658] ? security_task_prctl+0x11c/0x160 [ 94.257383][ T6658] __do_sys_prctl+0x171f/0x24c0 [ 94.257399][ T6658] ? __pfx___do_sys_prctl+0x10/0x10 [ 94.257415][ T6658] do_syscall_64+0xcd/0x4c0 [ 94.257428][ T6658] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.257439][ T6658] RIP: 0033:0x7f516c98e969 [ 94.257447][ T6658] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 94.257457][ T6658] RSP: 002b:00007f516d8a5038 EFLAGS: 00000246 ORIG_RAX: 000000000000009d [ 94.257467][ T6658] RAX: ffffffffffffffda RBX: 00007f516cbb5fa0 RCX: 00007f516c98e969 [ 94.257474][ T6658] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 000000000000004e [ 94.257479][ T6658] RBP: 00007f516ca10ab1 R08: 0000000000000000 R09: 0000000000000000 [ 94.257485][ T6658] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.257491][ T6658] R13: 0000000000000001 R14: 00007f516cbb5fa0 R15: 00007ffc88069c38 [ 94.257499][ T6658] [ 94.257503][ T6658] [ 94.326640][ T6658] Allocated by task 6659: [ 94.328036][ T6658] kasan_save_stack+0x33/0x60 [ 94.329543][ T6658] kasan_save_track+0x14/0x30 [ 94.331030][ T6658] __kasan_kmalloc+0xaa/0xb0 [ 94.332503][ T6658] __kvmalloc_node_noprof+0x279/0x620 [ 94.334232][ T6658] futex_hash_allocate+0x49d/0xf00 [ 94.335848][ T6658] futex_hash_prctl+0x306/0x770 [ 94.337472][ T6658] __do_sys_prctl+0x171f/0x24c0 [ 94.339123][ T6658] do_syscall_64+0xcd/0x4c0 [ 94.340717][ T6658] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.342663][ T6658] [ 94.343533][ T6658] The buggy address belongs to the object at ffff88802c556a00 [ 94.343533][ T6658] which belongs to the cache kmalloc-cg-64 of size 64 [ 94.347980][ T6658] The buggy address is located 12 bytes to the right of [ 94.347980][ T6658] allocated 64-byte region [ffff88802c556a00, ffff88802c556a40) [ 94.352520][ T6658] [ 94.353393][ T6658] The buggy address belongs to the physical page: [ 94.355437][ T6658] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802c556800 pfn:0x2c556 [ 94.359663][ T6658] memcg:ffff88803384a001 [ 94.361526][ T6658] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 94.364189][ T6658] page_type: f5(slab) [ 94.365825][ T6658] raw: 00fff00000000000 ffff88801b849a40 ffffea0001490700 0000000000000004 [ 94.368843][ T6658] raw: ffff88802c556800 000000008020001f 00000000f5000000 ffff88803384a001 [ 94.371455][ T6658] page dumped because: kasan: bad access detected [ 94.373412][ T6658] page_owner tracks the page as allocated [ 94.375182][ T6658] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 6291, tgid 6291 (syz-executor), ts 86425019932, free_ts 86420409418 [ 94.381066][ T6658] post_alloc_hook+0x1c0/0x230 [ 94.382626][ T6658] get_page_from_freelist+0x1321/0x3890 [ 94.384689][ T6658] __alloc_frozen_pages_noprof+0x261/0x23f0 [ 94.387241][ T6658] alloc_pages_mpol+0x1fb/0x550 [ 94.389321][ T6658] new_slab+0x23b/0x330 [ 94.391000][ T6658] ___slab_alloc+0xd9c/0x1940 [ 94.392779][ T6658] __slab_alloc.constprop.0+0x56/0xb0 [ 94.394799][ T6658] __kvmalloc_node_noprof+0x3af/0x620 [ 94.396795][ T6658] alloc_netdev_mqs+0xfbe/0x1570 [ 94.398689][ T6658] __ip_tunnel_create+0x3ad/0x6e0 [ 94.400647][ T6658] ip_tunnel_init_net+0x22f/0x7d0 [ 94.402839][ T6658] ops_init+0x1df/0x5f0 [ 94.404688][ T6658] setup_net+0x1ff/0x510 [ 94.406533][ T6658] copy_net_ns+0x2a6/0x5f0 [ 94.408447][ T6658] create_new_namespaces+0x3ea/0xa90 [ 94.410682][ T6658] unshare_nsproxy_namespaces+0xc0/0x1f0 [ 94.413017][ T6658] page last free pid 46 tgid 46 stack trace: [ 94.415520][ T6658] __free_frozen_pages+0x7fe/0x1180 [ 94.417724][ T6658] vfree+0x1fd/0xb50 [ 94.419426][ T6658] __ebt_unregister_table+0x821/0xdf0 [ 94.421754][ T6658] ebt_unregister_table+0x34/0x40 [ 94.424092][ T6658] ops_undo_list+0x2eb/0xab0 [ 94.426150][ T6658] cleanup_net+0x408/0x890 [ 94.427986][ T6658] process_one_work+0x9cf/0x1b70 [ 94.430025][ T6658] worker_thread+0x6c8/0xf10 [ 94.431999][ T6658] kthread+0x3c5/0x780 [ 94.433743][ T6658] ret_from_fork+0x5d7/0x6f0 [ 94.435731][ T6658] ret_from_fork_asm+0x1a/0x30 [ 94.437901][ T6658] [ 94.439029][ T6658] Memory state around the buggy address: [ 94.441320][ T6658] ffff88802c556900: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 94.444585][ T6658] ffff88802c556980: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 94.447902][ T6658] >ffff88802c556a00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 94.451170][ T6658] ^ [ 94.453799][ T6658] ffff88802c556a80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 94.456957][ T6658] ffff88802c556b00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 94.460276][ T6658] ================================================================== [ 94.463837][ T6658] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 94.466733][ T6658] CPU: 2 UID: 0 PID: 6658 Comm: syz.0.69 Not tainted 6.15.0-syzkaller-gcd2e103d57e5-dirty #0 PREEMPT(full) [ 94.471252][ T6658] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 94.474870][ T6658] Call Trace: [ 94.476009][ T6658] [ 94.477059][ T6658] dump_stack_lvl+0x3d/0x1f0 [ 94.478644][ T6658] panic+0x71c/0x800 [ 94.480021][ T6658] ? __pfx_panic+0x10/0x10 [ 94.481497][ T6658] ? rcu_is_watching+0x12/0xc0 [ 94.483057][ T6658] ? do_raw_spin_lock+0x26f/0x2b0 [ 94.484653][ T6658] ? check_panic_on_warn+0x1f/0xb0 [ 94.486212][ T6658] ? do_raw_spin_lock+0x26f/0x2b0 [ 94.487921][ T6658] check_panic_on_warn+0xab/0xb0 [ 94.490004][ T6658] end_report+0x107/0x170 [ 94.491775][ T6658] kasan_report+0xee/0x110 [ 94.493484][ T6658] ? do_raw_spin_lock+0x26f/0x2b0 [ 94.495087][ T6658] do_raw_spin_lock+0x26f/0x2b0 [ 94.496636][ T6658] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 94.498468][ T6658] __futex_pivot_hash+0x1dd/0x540 [ 94.500040][ T6658] futex_hash_allocate+0xad1/0xf00 [ 94.501650][ T6658] ? lock_release+0x201/0x2f0 [ 94.503141][ T6658] ? __pfx_futex_hash_allocate+0x10/0x10 [ 94.504900][ T6658] futex_hash_prctl+0x306/0x770 [ 94.506579][ T6658] ? __pfx_futex_hash_prctl+0x10/0x10 [ 94.508811][ T6658] ? lock_release+0x201/0x2f0 [ 94.510773][ T6658] ? cap_task_prctl+0x2af/0xa80 [ 94.512701][ T6658] ? static_key_count+0x5a/0x70 [ 94.514286][ T6658] ? security_task_prctl+0x11c/0x160 [ 94.515966][ T6658] __do_sys_prctl+0x171f/0x24c0 [ 94.517563][ T6658] ? __pfx___do_sys_prctl+0x10/0x10 [ 94.519201][ T6658] do_syscall_64+0xcd/0x4c0 [ 94.520642][ T6658] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.522500][ T6658] RIP: 0033:0x7f516c98e969 [ 94.523914][ T6658] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 94.529964][ T6658] RSP: 002b:00007f516d8a5038 EFLAGS: 00000246 ORIG_RAX: 000000000000009d [ 94.532519][ T6658] RAX: ffffffffffffffda RBX: 00007f516cbb5fa0 RCX: 00007f516c98e969 [ 94.534991][ T6658] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 000000000000004e [ 94.537500][ T6658] RBP: 00007f516ca10ab1 R08: 0000000000000000 R09: 0000000000000000 [ 94.539963][ T6658] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.542441][ T6658] R13: 0000000000000001 R14: 00007f516cbb5fa0 R15: 00007ffc88069c38 [ 94.544905][ T6658] [ 94.546489][ T6658] Kernel Offset: disabled [ 94.547941][ T6658] Rebooting in 86400 seconds..