Warning: Permanently added '10.128.1.185' (ED25519) to the list of known hosts. 2025/03/27 07:37:11 ignoring optional flag "sandboxArg"="0" 2025/03/27 07:37:11 ignoring optional flag "type"="gce" 2025/03/27 07:37:11 parsed 1 programs 2025/03/27 07:37:11 executed programs: 0 [ 47.481230][ T415] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.488878][ T415] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.496446][ T415] device bridge_slave_0 entered promiscuous mode [ 47.523752][ T415] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.530869][ T415] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.538372][ T415] device bridge_slave_1 entered promiscuous mode [ 47.551013][ T419] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.558124][ T419] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.565820][ T419] device bridge_slave_0 entered promiscuous mode [ 47.575218][ T419] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.583212][ T419] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.591046][ T419] device bridge_slave_1 entered promiscuous mode [ 47.725056][ T416] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.732016][ T416] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.739709][ T416] device bridge_slave_0 entered promiscuous mode [ 47.759654][ T416] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.766637][ T416] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.773984][ T416] device bridge_slave_1 entered promiscuous mode [ 47.810693][ T420] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.817598][ T420] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.825137][ T420] device bridge_slave_0 entered promiscuous mode [ 47.850932][ T420] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.858021][ T420] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.865692][ T420] device bridge_slave_1 entered promiscuous mode [ 47.927958][ T425] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.934828][ T425] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.942415][ T425] device bridge_slave_0 entered promiscuous mode [ 47.969839][ T426] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.976744][ T426] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.984478][ T426] device bridge_slave_0 entered promiscuous mode [ 47.991961][ T426] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.998973][ T426] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.006509][ T426] device bridge_slave_1 entered promiscuous mode [ 48.013070][ T425] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.020256][ T425] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.027926][ T425] device bridge_slave_1 entered promiscuous mode [ 48.063651][ T415] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.070543][ T415] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.149615][ T419] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.156484][ T419] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.163688][ T419] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.170544][ T419] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.274984][ T416] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.281929][ T416] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.289458][ T416] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.296396][ T416] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.312947][ T420] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.319993][ T420] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.327907][ T420] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.335365][ T420] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.347033][ T425] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.353890][ T425] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.361109][ T425] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.367893][ T425] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.376964][ T426] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.383890][ T426] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.391034][ T426] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.397881][ T426] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.439408][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 48.447740][ T103] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.456462][ T103] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.463539][ T103] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.471711][ T103] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.478960][ T103] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.486072][ T103] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.493241][ T103] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.500687][ T103] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.507846][ T103] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.515021][ T103] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.522560][ T103] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.562900][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 48.570803][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 48.579191][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 48.588027][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 48.597330][ T103] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.604270][ T103] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.612121][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 48.620708][ T103] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.627671][ T103] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.635406][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 48.643660][ T103] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.650534][ T103] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.658366][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 48.666710][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 48.674993][ T103] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.681837][ T103] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.705833][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 48.713220][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 48.739756][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 48.748314][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 48.757040][ T103] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.764099][ T103] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.771867][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 48.779994][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 48.787666][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 48.795727][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 48.803775][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 48.812220][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 48.820354][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 48.828851][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 48.837110][ T103] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.843958][ T103] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.851139][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 48.858720][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 48.866159][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 48.874504][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 48.883542][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 48.892010][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 48.900226][ T103] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.907104][ T103] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.935369][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 48.944056][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 48.952234][ T103] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.959226][ T103] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.966699][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 48.975576][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 48.983847][ T103] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.990884][ T103] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.998180][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 49.006048][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 49.013619][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 49.022051][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 49.030449][ T103] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.037446][ T103] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.044746][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 49.052748][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 49.060769][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 49.068838][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 49.078624][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 49.086910][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 49.095243][ T103] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.102090][ T103] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.139669][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 49.149125][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 49.157851][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 49.165881][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 49.174317][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 49.182514][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 49.190685][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 49.198994][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 49.210092][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 49.228038][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 49.236319][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 49.245013][ T103] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.251989][ T103] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.259698][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 49.267799][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 49.276308][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 49.291179][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 49.325439][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 49.333828][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 49.342614][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 49.351156][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 49.360694][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 49.372420][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 49.402521][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 49.404490][ T23] kauditd_printk_skb: 15 callbacks suppressed [ 49.404503][ T23] audit: type=1400 audit(1743061033.970:91): avc: denied { mounton } for pid=419 comm="syz-executor.0" path="/dev/binderfs" dev="devtmpfs" ino=11734 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 49.439777][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 49.449002][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 49.458160][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 49.498619][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 49.510553][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 49.513587][ T23] audit: type=1400 audit(1743061034.070:92): avc: denied { read write } for pid=450 comm="syz-executor.0" name="fuse" dev="devtmpfs" ino=9386 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 49.543067][ T23] audit: type=1400 audit(1743061034.070:93): avc: denied { open } for pid=450 comm="syz-executor.0" path="/dev/fuse" dev="devtmpfs" ino=9386 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 49.567315][ T23] audit: type=1400 audit(1743061034.070:94): avc: denied { mounton } for pid=450 comm="syz-executor.0" path="/root/syzkaller-testdir1543972849/syzkaller.9Tfb5b/0/file0" dev="sda1" ino=1947 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 49.567429][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 49.602357][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 49.611287][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 49.619566][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 49.627769][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 49.644303][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 49.652391][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 49.660950][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 49.669854][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 49.681503][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 49.690268][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 49.704685][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 49.713052][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 49.724995][ T454] ================================================================== [ 49.733097][ T454] BUG: KASAN: use-after-free in fuse_copy_one+0x1c0/0x3a0 [ 49.740100][ T454] Read of size 256 at addr ffff8881d7818010 by task syz-executor.0/454 [ 49.748156][ T454] [ 49.750329][ T454] CPU: 0 PID: 454 Comm: syz-executor.0 Not tainted 5.4.290-syzkaller-05053-g41adfeb3d639 #0 [ 49.760492][ T454] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 49.770623][ T454] Call Trace: [ 49.773724][ T454] dump_stack+0x1d8/0x241 [ 49.777886][ T454] ? nf_ct_l4proto_log_invalid+0x258/0x258 [ 49.783708][ T454] ? printk+0xd1/0x111 [ 49.787607][ T454] ? fuse_copy_one+0x1c0/0x3a0 [ 49.792201][ T454] ? wake_up_klogd+0xb2/0xf0 [ 49.796655][ T454] ? fuse_copy_one+0x1c0/0x3a0 [ 49.801231][ T454] print_address_description+0x8c/0x600 [ 49.806642][ T454] ? panic+0x89d/0x89d [ 49.810545][ T454] ? _raw_spin_lock+0xa4/0x1b0 [ 49.815207][ T454] ? fuse_copy_one+0x1c0/0x3a0 [ 49.819913][ T454] __kasan_report+0xf3/0x120 [ 49.824336][ T454] ? fuse_copy_one+0x1c0/0x3a0 [ 49.829116][ T454] ? fuse_copy_one+0x1c0/0x3a0 [ 49.833702][ T454] kasan_report+0x30/0x60 [ 49.838269][ T454] check_memory_region+0x272/0x280 [ 49.843240][ T454] memcpy+0x25/0x50 [ 49.846881][ T454] fuse_copy_one+0x1c0/0x3a0 [ 49.851399][ T454] fuse_copy_args+0x339/0x410 [ 49.856011][ T454] fuse_dev_do_read+0xc1b/0x1190 [ 49.860879][ T454] ? queue_interrupt+0x310/0x310 [ 49.865667][ T454] fuse_dev_read+0x179/0x220 [ 49.870189][ T454] ? fuse_dev_release+0x5c0/0x5c0 [ 49.875214][ T454] ? do_futex+0x13c1/0x19f0 [ 49.879679][ T454] ? __lru_cache_add+0x206/0x2b0 [ 49.884408][ T454] ? iov_iter_init+0x82/0x160 [ 49.889096][ T454] __vfs_read+0x5cd/0x730 [ 49.893267][ T454] ? rw_verify_area+0x360/0x360 [ 49.897948][ T454] ? __fsnotify_update_child_dentry_flags+0x290/0x290 [ 49.904564][ T454] ? security_file_permission+0x1dc/0x2f0 [ 49.910102][ T454] vfs_read+0x148/0x360 [ 49.914098][ T454] ksys_read+0x199/0x2c0 [ 49.918173][ T454] ? vfs_write+0x4e0/0x4e0 [ 49.922424][ T454] ? __do_page_fault+0x725/0xbb0 [ 49.927228][ T454] do_syscall_64+0xca/0x1c0 [ 49.931547][ T454] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 49.937396][ T454] RIP: 0033:0x7f9d82c0bdb9 [ 49.941643][ T454] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 49.961521][ T454] RSP: 002b:00007f9d8272c0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 49.969937][ T454] RAX: ffffffffffffffda RBX: 00007f9d82d2c1f0 RCX: 00007f9d82c0bdb9 [ 49.977839][ T454] RDX: 0000000000002020 RSI: 0000000020002140 RDI: 0000000000000003 [ 49.985827][ T454] RBP: 00007f9d82c68ad0 R08: 0000000000000000 R09: 0000000000000000 [ 49.993969][ T454] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 50.002206][ T454] R13: 000000000000006e R14: 00007f9d82d2c1f0 R15: 00007ffcaad3a5a8 [ 50.010069][ T454] [ 50.012233][ T454] Allocated by task 451: [ 50.016408][ T454] __kasan_kmalloc+0x171/0x210 [ 50.021001][ T454] __d_alloc+0xae/0x6a0 [ 50.025171][ T454] d_alloc_parallel+0xec/0x1390 [ 50.029968][ T454] __lookup_slow+0x156/0x460 [ 50.034477][ T454] lookup_slow+0x53/0x70 [ 50.038580][ T454] walk_component+0x2dc/0x590 [ 50.043157][ T454] path_lookupat+0x182/0x3f0 [ 50.047583][ T454] filename_lookup+0x253/0x6e0 [ 50.052181][ T454] do_mount+0x135/0xe10 [ 50.056178][ T454] ksys_mount+0xc2/0xf0 [ 50.060253][ T454] __x64_sys_mount+0xb1/0xc0 [ 50.064828][ T454] do_syscall_64+0xca/0x1c0 [ 50.069300][ T454] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 50.075309][ T454] [ 50.077504][ T454] Freed by task 10: [ 50.081216][ T454] __kasan_slab_free+0x1b5/0x270 [ 50.086117][ T454] kfree+0x123/0x370 [ 50.089913][ T454] rcu_do_batch+0x451/0xa00 [ 50.094256][ T454] rcu_core+0x4c8/0xcb0 [ 50.098421][ T454] __do_softirq+0x23b/0x6b7 [ 50.102763][ T454] [ 50.105117][ T454] The buggy address belongs to the object at ffff8881d7818000 [ 50.105117][ T454] which belongs to the cache kmalloc-rcl-512 of size 512 [ 50.119754][ T454] The buggy address is located 16 bytes inside of [ 50.119754][ T454] 512-byte region [ffff8881d7818000, ffff8881d7818200) [ 50.133156][ T454] The buggy address belongs to the page: [ 50.138758][ T454] page:ffffea00075e0600 refcount:1 mapcount:0 mapping:ffff8881f5c0db80 index:0x0 compound_mapcount: 0 [ 50.150183][ T454] flags: 0x8000000000010200(slab|head) [ 50.155820][ T454] raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881f5c0db80 [ 50.164353][ T454] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 50.172852][ T454] page dumped because: kasan: bad access detected [ 50.179123][ T454] page_owner tracks the page as allocated [ 50.184822][ T454] page last allocated via order 2, migratetype Reclaimable, gfp_mask 0x1d20d0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE) [ 50.202983][ T454] prep_new_page+0x18f/0x370 [ 50.207399][ T454] get_page_from_freelist+0x2d13/0x2d90 [ 50.212876][ T454] __alloc_pages_nodemask+0x393/0x840 [ 50.218174][ T454] alloc_slab_page+0x39/0x3c0 [ 50.222796][ T454] new_slab+0x97/0x440 [ 50.226687][ T454] ___slab_alloc+0x2fe/0x490 [ 50.231106][ T454] __slab_alloc+0x62/0xa0 [ 50.235453][ T454] __kmalloc+0x19b/0x2e0 [ 50.239881][ T454] __d_alloc+0xae/0x6a0 [ 50.243993][ T454] d_alloc_parallel+0xec/0x1390 [ 50.249250][ T454] __lookup_slow+0x156/0x460 [ 50.253943][ T454] lookup_slow+0x53/0x70 [ 50.258279][ T454] walk_component+0x2dc/0x590 [ 50.262928][ T454] path_lookupat+0x182/0x3f0 [ 50.267323][ T454] filename_lookup+0x253/0x6e0 [ 50.271923][ T454] do_mount+0x135/0xe10 [ 50.275909][ T454] page_owner free stack trace missing [ 50.281604][ T454] [ 50.283831][ T454] Memory state around the buggy address: [ 50.289299][ T454] ffff8881d7817f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 50.297393][ T454] ffff8881d7817f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 50.305281][ T454] >ffff8881d7818000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.313257][ T454] ^ [ 50.317913][ T454] ffff8881d7818080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.325775][ T454] ffff8881d7818100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.333739][ T454] ================================================================== [ 50.341827][ T454] Disabling lock debugging due to kernel taint [ 50.366812][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 50.376232][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 50.385400][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 50.393392][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 50.401796][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 50.410152][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 50.418722][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 50.427323][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 50.436053][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 50.444408][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 50.452876][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 50.453053][ T23] audit: type=1400 audit(1743061035.010:95): avc: denied { unmount } for pid=419 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 50.461649][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 50.489874][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 50.498158][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 50.506144][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 50.514536][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 50.572786][ T449] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 50.585632][ T449] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 50.609227][ T449] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 50.617801][ T449] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 50.626672][ T449] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 50.635091][ T449] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 50.657696][ T449] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 50.666855][ T449] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 50.675383][ T449] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 50.684453][ T449] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2025/03/27 07:37:16 executed programs: 15 2025/03/27 07:37:21 executed programs: 50