Warning: Permanently added '10.128.0.78' (ED25519) to the list of known hosts. 2024/07/22 20:14:01 ignoring optional flag "sandboxArg"="0" 2024/07/22 20:14:01 parsed 1 programs 2024/07/22 20:14:01 executed programs: 0 [ 53.816846][ T1910] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 53.873490][ T1332] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 53.886374][ T1930] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 53.887683][ T1932] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 53.902682][ T1933] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 53.912882][ T1939] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 53.919978][ T1939] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 53.920117][ T1942] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 53.927150][ T1939] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 53.934591][ T1942] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 53.941725][ T1939] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 53.947950][ T1942] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 53.954963][ T1944] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 53.962235][ T1942] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 53.969380][ T1944] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 53.975832][ T1942] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 53.982667][ T1939] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 53.990394][ T1942] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 53.996669][ T1944] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 54.003661][ T1942] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 54.010576][ T1944] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 54.017722][ T1942] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 54.024269][ T1939] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 54.031195][ T1942] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 54.045120][ T1944] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 54.045492][ T1942] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 54.059305][ T1332] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 54.059518][ T1942] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 54.066347][ T1939] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 54.074018][ T1942] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 54.087288][ T1942] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 54.095745][ T1942] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 54.103747][ T1932] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 54.110901][ T1932] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 54.118055][ T1947] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 54.126648][ T1942] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 54.134726][ T1942] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 54.695575][ T1937] chnl_net:caif_netlink_parms(): no params data found [ 54.721326][ T1935] chnl_net:caif_netlink_parms(): no params data found [ 54.735628][ T1928] chnl_net:caif_netlink_parms(): no params data found [ 54.756833][ T1922] chnl_net:caif_netlink_parms(): no params data found [ 54.781543][ T1924] chnl_net:caif_netlink_parms(): no params data found [ 54.792222][ T1931] chnl_net:caif_netlink_parms(): no params data found [ 56.093350][ T1930] Bluetooth: hci1: command tx timeout [ 56.172170][ T1930] Bluetooth: hci3: command tx timeout [ 56.178147][ T1930] Bluetooth: hci2: command tx timeout [ 56.182345][ T1942] Bluetooth: hci5: command tx timeout [ 56.183837][ T48] Bluetooth: hci4: command tx timeout [ 56.188978][ T1933] Bluetooth: hci0: command tx timeout [ 58.172131][ T1933] Bluetooth: hci1: command tx timeout [ 58.252162][ T1933] Bluetooth: hci4: command tx timeout [ 58.257547][ T1933] Bluetooth: hci0: command tx timeout [ 58.263070][ T1942] Bluetooth: hci2: command tx timeout [ 58.263145][ T48] Bluetooth: hci5: command tx timeout [ 58.269850][ T1942] Bluetooth: hci3: command tx timeout [ 60.252071][ T1942] Bluetooth: hci1: command tx timeout [ 60.332044][ T1942] Bluetooth: hci5: command tx timeout [ 60.332113][ T1933] Bluetooth: hci2: command tx timeout [ 60.337440][ T48] Bluetooth: hci4: command tx timeout [ 60.342912][ T1930] Bluetooth: hci3: command tx timeout [ 60.348473][ T1932] Bluetooth: hci0: command tx timeout [ 60.372925][ T1928] 8021q: adding VLAN 0 to HW filter on device bond0 [ 60.469832][ T1935] 8021q: adding VLAN 0 to HW filter on device bond0 [ 60.571248][ T1922] 8021q: adding VLAN 0 to HW filter on device bond0 [ 60.635148][ T1931] 8021q: adding VLAN 0 to HW filter on device bond0 [ 60.654271][ T1924] 8021q: adding VLAN 0 to HW filter on device bond0 [ 60.671322][ T1937] 8021q: adding VLAN 0 to HW filter on device bond0 [ 62.332966][ T1942] Bluetooth: hci1: command tx timeout [ 62.413822][ T1942] Bluetooth: hci5: command tx timeout [ 62.419215][ T1942] Bluetooth: hci4: command tx timeout [ 62.424763][ T48] Bluetooth: hci0: command tx timeout [ 62.430153][ T48] Bluetooth: hci2: command tx timeout [ 62.431983][ T1932] Bluetooth: hci3: command tx timeout [ 64.161538][ T1928] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 64.203126][ T1924] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 64.253644][ T1935] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 64.321987][ T1922] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 64.453836][ T1937] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 64.550149][ T1931] 8021q: adding VLAN 0 to HW filter on device batadv0 2024/07/22 20:14:18 executed programs: 6 [ 71.232181][ T1035] bond0 (unregistering): Released all slaves [ 71.281103][ T1933] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 71.292261][ T1933] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 71.299371][ T1933] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 71.307885][ T1933] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 71.315186][ T1933] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 71.375309][ T1933] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 71.419438][ T1932] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 71.437027][ T1942] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 71.446038][ T1942] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 71.460265][ T1942] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 71.473615][ T1942] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 71.480861][ T1942] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 71.570133][ T4310] ================================================================== [ 71.578452][ T4310] BUG: KASAN: slab-use-after-free in device_for_each_child+0xa1/0x160 [ 71.586580][ T4310] Read of size 8 at addr ffff888174ba5308 by task kbnepd bnep0/4310 [ 71.594530][ T4310] [ 71.596835][ T4310] CPU: 1 UID: 0 PID: 4310 Comm: kbnepd bnep0 Not tainted 6.10.0-syzkaller #0 [ 71.605565][ T4310] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 71.615602][ T4310] Call Trace: [ 71.618862][ T4310] [ 71.621775][ T4310] dump_stack_lvl+0x108/0x280 [ 71.626451][ T4310] ? __pfx_dump_stack_lvl+0x10/0x10 [ 71.631635][ T4310] ? __pfx__printk+0x10/0x10 [ 71.636206][ T4310] ? srso_alias_return_thunk+0x5/0xfbef5 [ 71.641823][ T4310] ? __virt_addr_valid+0x141/0x270 [ 71.646913][ T4310] ? srso_alias_return_thunk+0x5/0xfbef5 [ 71.652527][ T4310] ? __virt_addr_valid+0x229/0x270 [ 71.657618][ T4310] print_report+0x169/0x550 [ 71.662103][ T4310] ? __virt_addr_valid+0x141/0x270 [ 71.667195][ T4310] ? srso_alias_return_thunk+0x5/0xfbef5 [ 71.672810][ T4310] ? __virt_addr_valid+0x229/0x270 [ 71.677910][ T4310] ? device_for_each_child+0xa1/0x160 [ 71.683263][ T4310] kasan_report+0x143/0x180 [ 71.687774][ T1932] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 71.687775][ T4310] ? device_for_each_child+0xa1/0x160 [ 71.687788][ T4310] ? __pfx_dev_memalloc_noio+0x10/0x10 [ 71.694890][ T1932] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 71.700014][ T4310] device_for_each_child+0xa1/0x160 [ 71.700027][ T4310] ? __pfx_device_for_each_child+0x10/0x10 [ 71.700035][ T4310] ? do_raw_spin_unlock+0x13c/0x8b0 [ 71.700045][ T4310] ? kobject_put+0x188/0x340 [ 71.707546][ T1932] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 71.712359][ T4310] pm_runtime_set_memalloc_noio+0x105/0x200 [ 71.712373][ T4310] netdev_unregister_kobject+0x158/0x230 [ 71.712384][ T4310] unregister_netdevice_many_notify+0x1701/0x1a70 [ 71.712400][ T4310] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 71.717744][ T1932] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 71.723320][ T4310] ? srso_alias_return_thunk+0x5/0xfbef5 [ 71.723336][ T4310] ? srso_alias_return_thunk+0x5/0xfbef5 [ 71.723347][ T4310] ? srso_alias_return_thunk+0x5/0xfbef5 [ 71.723355][ T4310] unregister_netdev+0x17c/0x1d0 [ 71.723365][ T4310] ? srso_alias_return_thunk+0x5/0xfbef5 [ 71.723372][ T4310] ? __pfx_unregister_netdev+0x10/0x10 [ 71.723380][ T4310] ? srso_alias_return_thunk+0x5/0xfbef5 [ 71.723387][ T4310] ? remove_wait_queue+0x33/0x130 [ 71.723396][ T4310] bnep_session+0x28f3/0x2aa0 [ 71.723404][ T4310] ? __lock_acquire+0x61d/0xc60 [ 71.723422][ T4310] ? __pfx_bnep_session+0x10/0x10 [ 71.723430][ T4310] ? srso_alias_return_thunk+0x5/0xfbef5 [ 71.723436][ T4310] ? _raw_spin_unlock_irqrestore+0xcf/0x130 [ 71.723444][ T4310] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 71.723451][ T4310] ? __pfx_woken_wake_function+0x10/0x10 [ 71.723458][ T4310] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 71.723467][ T4310] ? srso_alias_return_thunk+0x5/0xfbef5 [ 71.723473][ T4310] ? __kthread_parkme+0x80/0x140 [ 71.723482][ T4310] ? __pfx_bnep_session+0x10/0x10 [ 71.723488][ T4310] kthread+0x26a/0x2c0 [ 71.723494][ T4310] ? __pfx_bnep_session+0x10/0x10 [ 71.723500][ T4310] ? __pfx_kthread+0x10/0x10 [ 71.732058][ T1932] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 71.733255][ T4310] ret_from_fork+0x34/0x60 [ 71.733266][ T4310] ? __pfx_kthread+0x10/0x10 [ 71.733274][ T4310] ret_from_fork_asm+0x1a/0x30 [ 71.733287][ T4310] [ 71.740354][ T1932] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 71.746039][ T4310] [ 71.746042][ T4310] Allocated by task 1937: [ 71.746048][ T4310] kasan_save_track+0x3f/0x80 [ 71.746057][ T4310] __kasan_kmalloc+0x98/0xb0 [ 71.746064][ T4310] __kmalloc_noprof+0x1d5/0x440 [ 71.746071][ T4310] hci_alloc_dev_priv+0x1d/0x2010 [ 71.746078][ T4310] vhci_create_device+0xf5/0x640 [ 71.746086][ T4310] vhci_write+0x2ce/0x3c0 [ 71.753542][ T1932] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 71.758040][ T4310] vfs_write+0x6df/0xe10 [ 71.758049][ T4310] ksys_write+0x163/0x250 [ 71.758056][ T4310] do_syscall_64+0x8d/0x190 [ 71.758063][ T4310] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 71.758071][ T4310] [ 71.766069][ T1932] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 71.771676][ T4310] Freed by task 1937: [ 71.771681][ T4310] kasan_save_track+0x3f/0x80 [ 71.771690][ T4310] kasan_save_free_info+0x40/0x50 [ 71.771696][ T4310] poison_slab_object+0xe0/0x150 [ 71.771703][ T4310] __kasan_slab_free+0x37/0x60 [ 71.771709][ T4310] kfree+0x12f/0x310 [ 71.777825][ T1932] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 71.782885][ T4310] hci_release_dev+0x1345/0x14b0 [ 71.782894][ T4310] bt_host_release+0x5f/0x70 [ 71.782901][ T4310] device_release+0x94/0x140 [ 71.782908][ T4310] kobject_put+0x188/0x340 [ 71.782915][ T4310] vhci_release+0x81/0xc0 [ 71.782922][ T4310] __fput+0x1aa/0x690 [ 71.782929][ T4310] task_work_run+0x211/0x290 [ 71.788974][ T1932] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 71.793410][ T4310] do_exit+0x8b6/0x24d0 [ 71.793419][ T4310] do_group_exit+0x1ba/0x280 [ 71.793425][ T4310] __x64_sys_exit_group+0x3f/0x40 [ 71.793432][ T4310] x64_sys_call+0x26c3/0x26d0 [ 71.793439][ T4310] do_syscall_64+0x8d/0x190 [ 71.793445][ T4310] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 71.799823][ T1932] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 71.804449][ T4310] [ 71.804454][ T4310] Last potentially related work creation: [ 71.804458][ T4310] kasan_save_stack+0x3f/0x60 [ 71.804466][ T4310] __kasan_record_aux_stack+0xac/0xc0 [ 71.804472][ T4310] insert_work+0x38/0x230 [ 71.804479][ T4310] __queue_work+0x8a9/0xa80 [ 71.804487][ T4310] queue_work_on+0x123/0x1f0 [ 71.810482][ T1932] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 71.815051][ T4310] process_scheduled_works+0x8d1/0x1320 [ 71.815060][ T4310] worker_thread+0x869/0xc60 [ 71.815067][ T4310] kthread+0x26a/0x2c0 [ 71.815073][ T4310] ret_from_fork+0x34/0x60 [ 71.815080][ T4310] ret_from_fork_asm+0x1a/0x30 [ 71.815087][ T4310] [ 71.815090][ T4310] Second to last potentially related work creation: [ 72.166889][ T4310] kasan_save_stack+0x3f/0x60 [ 72.171533][ T4310] __kasan_record_aux_stack+0xac/0xc0 [ 72.176874][ T4310] insert_work+0x38/0x230 [ 72.181169][ T4310] __queue_work+0x88a/0xa80 [ 72.185639][ T4310] call_timer_fn+0x128/0x320 [ 72.190216][ T4310] __run_timer_base+0x560/0x600 [ 72.195037][ T4310] run_timer_softirq+0x79/0xd0 [ 72.199783][ T4310] handle_softirqs+0x1b9/0x570 [ 72.204510][ T4310] __irq_exit_rcu+0x45/0xe0 [ 72.208999][ T4310] sysvec_apic_timer_interrupt+0x92/0xb0 [ 72.214615][ T4310] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 72.220568][ T4310] [ 72.222868][ T4310] The buggy address belongs to the object at ffff888174ba4000 [ 72.222868][ T4310] which belongs to the cache kmalloc-8k of size 8192 [ 72.236894][ T4310] The buggy address is located 4872 bytes inside of [ 72.236894][ T4310] freed 8192-byte region [ffff888174ba4000, ffff888174ba6000) [ 72.250920][ T4310] [ 72.253211][ T4310] The buggy address belongs to the physical page: [ 72.259672][ T4310] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x174ba0 [ 72.268573][ T4310] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 72.277058][ T4310] flags: 0x100000000000040(head|node=0|zone=2) [ 72.283171][ T4310] page_type: 0xfdffffff(slab) [ 72.287808][ T4310] raw: 0100000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 72.296351][ T4310] raw: 0000000000000000 0000000000020002 00000001fdffffff 0000000000000000 [ 72.304897][ T4310] head: 0100000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 72.313524][ T4310] head: 0000000000000000 0000000000020002 00000001fdffffff 0000000000000000 [ 72.322158][ T4310] head: 0100000000000003 ffffea0005d2e801 ffffffffffffffff 0000000000000000 [ 72.330791][ T4310] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 72.339420][ T4310] page dumped because: kasan: bad access detected [ 72.345794][ T4310] page_owner tracks the page as allocated [ 72.351472][ T4310] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 1935, tgid 1935 (syz-executor.1), ts 53895679168, free_ts 53874529249 [ 72.374350][ T4310] post_alloc_hook+0x10f/0x130 [ 72.379099][ T4310] get_page_from_freelist+0x3712/0x3820 [ 72.384606][ T4310] __alloc_pages_noprof+0x256/0x670 [ 72.389851][ T4310] alloc_slab_page+0x5f/0x120 [ 72.394487][ T4310] allocate_slab+0x5d/0x290 [ 72.398964][ T4310] ___slab_alloc+0xa7f/0x11d0 [ 72.403601][ T4310] __kmalloc_noprof+0x25a/0x440 [ 72.408503][ T4310] hci_alloc_dev_priv+0x1d/0x2010 [ 72.413486][ T4310] vhci_create_device+0xf5/0x640 [ 72.418382][ T4310] vhci_write+0x2ce/0x3c0 [ 72.422674][ T4310] vfs_write+0x6df/0xe10 [ 72.426889][ T4310] ksys_write+0x163/0x250 [ 72.431178][ T4310] do_syscall_64+0x8d/0x190 [ 72.435642][ T4310] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.441498][ T4310] page last free pid 1924 tgid 1924 stack trace: [ 72.447782][ T4310] free_unref_page+0xbff/0xd50 [ 72.452507][ T4310] __put_partials+0x18e/0x1d0 [ 72.457145][ T4310] put_cpu_partial+0x151/0x1b0 [ 72.461889][ T4310] __slab_free+0x2b8/0x3a0 [ 72.466272][ T4310] qlist_free_all+0x9e/0x140 [ 72.470841][ T4310] kasan_quarantine_reduce+0x14f/0x170 [ 72.476278][ T4310] __kasan_slab_alloc+0x23/0x80 [ 72.481088][ T4310] __kmalloc_noprof+0x182/0x440 [ 72.485989][ T4310] tomoyo_supervisor+0xc62/0xfb0 [ 72.490888][ T4310] tomoyo_check_open_permission+0x679/0x960 [ 72.496741][ T4310] security_file_open+0x2c/0x80 [ 72.501550][ T4310] do_dentry_open+0x31a/0xfa0 [ 72.506192][ T4310] vfs_open+0x36/0x290 [ 72.510220][ T4310] path_openat+0x21bf/0x2870 [ 72.514785][ T4310] do_filp_open+0x22b/0x440 [ 72.519247][ T4310] do_sys_openat2+0xf6/0x180 [ 72.523810][ T4310] [ 72.526124][ T4310] Memory state around the buggy address: [ 72.531716][ T4310] ffff888174ba5200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.539741][ T4310] ffff888174ba5280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.547766][ T4310] >ffff888174ba5300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.555786][ T4310] ^ [ 72.560073][ T4310] ffff888174ba5380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.568267][ T4310] ffff888174ba5400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.576302][ T4310] ================================================================== [ 72.584649][ T4310] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 72.592084][ T4310] Kernel Offset: disabled [ 72.596377][ T4310] Rebooting in 86400 seconds..