[ 82.027818][ T27] cfg80211: failed to load regulatory.db
Warning: Permanently added '10.128.0.3' (ED25519) to the list of known hosts.
2023/11/13 13:46:08 ignoring optional flag "sandboxArg"="0"
2023/11/13 13:46:09 parsed 1 programs
2023/11/13 13:46:10 executed programs: 0
[ 85.376744][ T5407] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 85.430342][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 85.438518][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 85.446296][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 85.454225][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 85.462324][ T50] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 85.469857][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 85.581867][ T5414] chnl_net:caif_netlink_parms(): no params data found
[ 85.634089][ T5414] bridge0: port 1(bridge_slave_0) entered blocking state
[ 85.641334][ T5414] bridge0: port 1(bridge_slave_0) entered disabled state
[ 85.648565][ T5414] bridge_slave_0: entered allmulticast mode
[ 85.656051][ T5414] bridge_slave_0: entered promiscuous mode
[ 85.663818][ T5414] bridge0: port 2(bridge_slave_1) entered blocking state
[ 85.671235][ T5414] bridge0: port 2(bridge_slave_1) entered disabled state
[ 85.678431][ T5414] bridge_slave_1: entered allmulticast mode
[ 85.685948][ T5414] bridge_slave_1: entered promiscuous mode
[ 85.711645][ T5414] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 85.724051][ T5414] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 85.752941][ T5414] team0: Port device team_slave_0 added
[ 85.761090][ T5414] team0: Port device team_slave_1 added
[ 85.784417][ T5414] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 85.791757][ T5414] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 85.818017][ T5414] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 85.831329][ T5414] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 85.838335][ T5414] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 85.864710][ T5414] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 85.903147][ T5414] hsr_slave_0: entered promiscuous mode
[ 85.909682][ T5414] hsr_slave_1: entered promiscuous mode
[ 86.718629][ T5414] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 86.731157][ T5414] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 86.746592][ T5414] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 86.759892][ T5414] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 86.864293][ T5414] 8021q: adding VLAN 0 to HW filter on device bond0
[ 86.893049][ T5414] 8021q: adding VLAN 0 to HW filter on device team0
[ 86.907313][ T5072] bridge0: port 1(bridge_slave_0) entered blocking state
[ 86.916222][ T5072] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 86.932986][ T781] bridge0: port 2(bridge_slave_1) entered blocking state
[ 86.940339][ T781] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 87.000872][ T5414] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 87.163599][ T5414] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 87.219794][ T5414] veth0_vlan: entered promiscuous mode
[ 87.240497][ T5414] veth1_vlan: entered promiscuous mode
[ 87.278854][ T5414] veth0_macvtap: entered promiscuous mode
[ 87.291182][ T5414] veth1_macvtap: entered promiscuous mode
[ 87.320188][ T5414] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 87.339250][ T5414] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 87.353607][ T5414] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 87.365467][ T5414] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 87.374214][ T5414] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 87.384631][ T5414] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 87.475811][ T27] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 87.483692][ T27] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 87.534010][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 87.543858][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 87.547530][ T5061] Bluetooth: hci0: command 0x0409 tx timeout
[ 88.481262][ T5482] ==================================================================
[ 88.489387][ T5482] BUG: KASAN: slab-use-after-free in nfc_alloc_send_skb+0x189/0x1c0
[ 88.498031][ T5482] Read of size 4 at addr ffff888020c66548 by task syz-executor.0/5482
[ 88.506213][ T5482]
[ 88.508551][ T5482] CPU: 0 PID: 5482 Comm: syz-executor.0 Not tainted 6.7.0-rc1-syzkaller-gb85ea95d0864-dirty #0
[ 88.518915][ T5482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
[ 88.529081][ T5482] Call Trace:
[ 88.532441][ T5482]
[ 88.535360][ T5482] dump_stack_lvl+0x1e7/0x2d0
[ 88.540054][ T5482] ? nf_tcp_handle_invalid+0x650/0x650
[ 88.545502][ T5482] ? panic+0x850/0x850
[ 88.549738][ T5482] ? _printk+0xd5/0x120
[ 88.554003][ T5482] print_report+0x163/0x540
[ 88.558537][ T5482] ? __virt_addr_valid+0x22f/0x2e0
[ 88.563733][ T5482] ? __phys_addr+0xba/0x170
[ 88.568221][ T5482] ? nfc_alloc_send_skb+0x189/0x1c0
[ 88.573503][ T5482] kasan_report+0x142/0x170
[ 88.578107][ T5482] ? nfc_alloc_send_skb+0x189/0x1c0
[ 88.583523][ T5482] nfc_alloc_send_skb+0x189/0x1c0
[ 88.588555][ T5482] nfc_llcp_send_ui_frame+0x2ac/0x670
[ 88.593919][ T5482] ? nfc_llcp_send_i_frame+0x4f0/0x4f0
[ 88.599368][ T5482] ? llcp_sock_sendmsg+0x238/0x3b0
[ 88.604639][ T5482] ? nfc_llcp_getsockopt+0x560/0x560
[ 88.610086][ T5482] ____sys_sendmsg+0x592/0x890
[ 88.614929][ T5482] ? __sys_sendmsg_sock+0x30/0x30
[ 88.620200][ T5482] ? __fget_files+0x3fe/0x480
[ 88.624875][ T5482] __sys_sendmmsg+0x3b2/0x730
[ 88.629582][ T5482] ? __ia32_sys_sendmsg+0x90/0x90
[ 88.634609][ T5482] ? __might_sleep+0xc0/0xc0
[ 88.639189][ T5482] ? __might_fault+0xa5/0x120
[ 88.643857][ T5482] ? __lock_acquire+0x7f70/0x7f70
[ 88.648884][ T5482] ? __might_fault+0xa5/0x120
[ 88.653589][ T5482] ? print_irqtrace_events+0x220/0x220
[ 88.659123][ T5482] ? syscall_enter_from_user_mode+0x32/0x230
[ 88.665102][ T5482] __x64_sys_sendmmsg+0xa0/0xb0
[ 88.670030][ T5482] do_syscall_64+0x44/0x110
[ 88.674612][ T5482] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 88.680508][ T5482] RIP: 0033:0x7fc24e27cae9
[ 88.684914][ T5482] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[ 88.704784][ T5482] RSP: 002b:00007fc24efbd0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
[ 88.713213][ T5482] RAX: ffffffffffffffda RBX: 00007fc24e39bf80 RCX: 00007fc24e27cae9
[ 88.721644][ T5482] RDX: 0000000000000001 RSI: 00000000200013c0 RDI: 0000000000000004
[ 88.729631][ T5482] RBP: 00007fc24e2c847a R08: 0000000000000000 R09: 0000000000000000
[ 88.737601][ T5482] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 88.745561][ T5482] R13: 000000000000000b R14: 00007fc24e39bf80 R15: 00007ffff6582e38
[ 88.753551][ T5482]
[ 88.756653][ T5482]
[ 88.758960][ T5482] Allocated by task 5482:
[ 88.763267][ T5482] kasan_set_track+0x4f/0x70
[ 88.767855][ T5482] __kasan_kmalloc+0x98/0xb0
[ 88.772442][ T5482] nfc_allocate_device+0x12f/0x520
[ 88.777553][ T5482] nci_allocate_device+0x1e2/0x360
[ 88.782656][ T5482] virtual_ncidev_open+0x75/0x1b0
[ 88.787698][ T5482] misc_open+0x30b/0x380
[ 88.791926][ T5482] chrdev_open+0x5ab/0x630
[ 88.796328][ T5482] do_dentry_open+0x8fd/0x1590
[ 88.801083][ T5482] path_openat+0x2845/0x3280
[ 88.805661][ T5482] do_filp_open+0x234/0x490
[ 88.810176][ T5482] do_sys_openat2+0x13e/0x1d0
[ 88.814862][ T5482] __x64_sys_openat+0x247/0x290
[ 88.819734][ T5482] do_syscall_64+0x44/0x110
[ 88.824331][ T5482] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 88.830223][ T5482]
[ 88.832623][ T5482] Freed by task 5481:
[ 88.836594][ T5482] kasan_set_track+0x4f/0x70
[ 88.841168][ T5482] kasan_save_free_info+0x28/0x40
[ 88.846185][ T5482] ____kasan_slab_free+0xd6/0x120
[ 88.851236][ T5482] __kmem_cache_free+0x263/0x3a0
[ 88.856334][ T5482] device_release+0x95/0x1c0
[ 88.860906][ T5482] kobject_put+0x1ee/0x430
[ 88.865304][ T5482] nci_free_device+0x38/0x50
[ 88.869980][ T5482] virtual_ncidev_close+0x70/0x90
[ 88.875010][ T5482] __fput+0x3cc/0xa10
[ 88.878980][ T5482] __se_sys_close+0x15f/0x220
[ 88.883837][ T5482] do_syscall_64+0x44/0x110
[ 88.888353][ T5482] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 88.894355][ T5482]
[ 88.896669][ T5482] The buggy address belongs to the object at ffff888020c66000
[ 88.896669][ T5482] which belongs to the cache kmalloc-2k of size 2048
[ 88.910969][ T5482] The buggy address is located 1352 bytes inside of
[ 88.910969][ T5482] freed 2048-byte region [ffff888020c66000, ffff888020c66800)
[ 88.924937][ T5482]
[ 88.927254][ T5482] The buggy address belongs to the physical page:
[ 88.933650][ T5482] page:ffffea0000831800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20c60
[ 88.943800][ T5482] head:ffffea0000831800 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 88.952843][ T5482] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 88.960841][ T5482] page_type: 0xffffffff()
[ 88.965225][ T5482] raw: 00fff00000000840 ffff888012c42000 dead000000000122 0000000000000000
[ 88.973984][ T5482] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
[ 88.982650][ T5482] page dumped because: kasan: bad access detected
[ 88.989148][ T5482] page_owner tracks the page as allocated
[ 88.994941][ T5482] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 8, tgid 8 (kworker/0:0), ts 87575041484, free_ts 86099705668
[ 89.017446][ T5482] post_alloc_hook+0x1e6/0x210
[ 89.022211][ T5482] get_page_from_freelist+0x339a/0x3530
[ 89.027790][ T5482] __alloc_pages+0x255/0x670
[ 89.032367][ T5482] alloc_pages_mpol+0x3de/0x640
[ 89.037296][ T5482] alloc_slab_page+0x6a/0x160
[ 89.041992][ T5482] new_slab+0x84/0x2f0
[ 89.046050][ T5482] ___slab_alloc+0xc85/0x1310
[ 89.050898][ T5482] __kmem_cache_alloc_node+0x21d/0x300
[ 89.056484][ T5482] __kmalloc_node_track_caller+0xa5/0x230
[ 89.062293][ T5482] kmalloc_reserve+0xf3/0x260
[ 89.067142][ T5482] __alloc_skb+0x1b1/0x420
[ 89.071633][ T5482] alloc_skb_with_frags+0xc3/0x780
[ 89.076908][ T5482] sock_alloc_send_pskb+0x919/0xa50
[ 89.082102][ T5482] mld_newpack+0x1c9/0xa90
[ 89.086504][ T5482] add_grec+0x148d/0x1990
[ 89.090840][ T5482] mld_ifc_work+0x6bf/0xb20
[ 89.095348][ T5482] page last free stack trace:
[ 89.100008][ T5482] free_unref_page_prepare+0x92a/0xa50
[ 89.105456][ T5482] free_unref_page+0x37/0x3f0
[ 89.110120][ T5482] __unfreeze_partials+0x1dc/0x220
[ 89.115223][ T5482] put_cpu_partial+0x17b/0x250
[ 89.119986][ T5482] __slab_free+0x2b6/0x390
[ 89.124479][ T5482] qlist_free_all+0x75/0xe0
[ 89.128970][ T5482] kasan_quarantine_reduce+0x14b/0x160
[ 89.134413][ T5482] __kasan_slab_alloc+0x23/0x70
[ 89.139424][ T5482] slab_post_alloc_hook+0x6c/0x3c0
[ 89.144525][ T5482] kmem_cache_alloc_lru+0x100/0x2c0
[ 89.149709][ T5482] __d_alloc+0x31/0x710
[ 89.153872][ T5482] d_alloc_parallel+0xe1/0x1590
[ 89.158736][ T5482] __lookup_slow+0x117/0x3e0
[ 89.163418][ T5482] lookup_slow+0x53/0x70
[ 89.167661][ T5482] link_path_walk+0x9c8/0xe70
[ 89.172330][ T5482] path_openat+0x25d/0x3280
[ 89.176832][ T5482]
[ 89.179141][ T5482] Memory state around the buggy address:
[ 89.184845][ T5482] ffff888020c66400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 89.193159][ T5482] ffff888020c66480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 89.201206][ T5482] >ffff888020c66500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 89.209253][ T5482] ^
[ 89.215648][ T5482] ffff888020c66580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 89.223699][ T5482] ffff888020c66600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 89.231752][ T5482] ==================================================================
[ 89.275810][ T5482] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 89.283133][ T5482] CPU: 0 PID: 5482 Comm: syz-executor.0 Not tainted 6.7.0-rc1-syzkaller-gb85ea95d0864-dirty #0
[ 89.293562][ T5482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
[ 89.303810][ T5482] Call Trace:
[ 89.307105][ T5482]
[ 89.310101][ T5482] dump_stack_lvl+0x1e7/0x2d0
[ 89.314801][ T5482] ? nf_tcp_handle_invalid+0x650/0x650
[ 89.320392][ T5482] ? panic+0x850/0x850
[ 89.324513][ T5482] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0
[ 89.330560][ T5482] ? vscnprintf+0x5d/0x80
[ 89.335176][ T5482] panic+0x349/0x850
[ 89.339102][ T5482] ? check_panic_on_warn+0x21/0xa0
[ 89.344242][ T5482] ? __memcpy_flushcache+0x2b0/0x2b0
[ 89.349655][ T5482] ? _raw_spin_unlock_irqrestore+0x12c/0x140
[ 89.356186][ T5482] ? _raw_spin_unlock+0x40/0x40
[ 89.361044][ T5482] check_panic_on_warn+0x82/0xa0
[ 89.366059][ T5482] ? nfc_alloc_send_skb+0x189/0x1c0
[ 89.371337][ T5482] end_report+0x6e/0x130
[ 89.375584][ T5482] kasan_report+0x153/0x170
[ 89.380094][ T5482] ? nfc_alloc_send_skb+0x189/0x1c0
[ 89.385286][ T5482] nfc_alloc_send_skb+0x189/0x1c0
[ 89.390303][ T5482] nfc_llcp_send_ui_frame+0x2ac/0x670
[ 89.395900][ T5482] ? nfc_llcp_send_i_frame+0x4f0/0x4f0
[ 89.401433][ T5482] ? llcp_sock_sendmsg+0x238/0x3b0
[ 89.406540][ T5482] ? nfc_llcp_getsockopt+0x560/0x560
[ 89.411813][ T5482] ____sys_sendmsg+0x592/0x890
[ 89.416567][ T5482] ? __sys_sendmsg_sock+0x30/0x30
[ 89.421747][ T5482] ? __fget_files+0x3fe/0x480
[ 89.426418][ T5482] __sys_sendmmsg+0x3b2/0x730
[ 89.431168][ T5482] ? __ia32_sys_sendmsg+0x90/0x90
[ 89.436203][ T5482] ? __might_sleep+0xc0/0xc0
[ 89.440781][ T5482] ? __might_fault+0xa5/0x120
[ 89.445443][ T5482] ? __lock_acquire+0x7f70/0x7f70
[ 89.450544][ T5482] ? __might_fault+0xa5/0x120
[ 89.455220][ T5482] ? print_irqtrace_events+0x220/0x220
[ 89.460751][ T5482] ? syscall_enter_from_user_mode+0x32/0x230
[ 89.466745][ T5482] __x64_sys_sendmmsg+0xa0/0xb0
[ 89.471586][ T5482] do_syscall_64+0x44/0x110
[ 89.476165][ T5482] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 89.482138][ T5482] RIP: 0033:0x7fc24e27cae9
[ 89.486541][ T5482] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[ 89.506308][ T5482] RSP: 002b:00007fc24efbd0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
[ 89.514716][ T5482] RAX: ffffffffffffffda RBX: 00007fc24e39bf80 RCX: 00007fc24e27cae9
[ 89.522681][ T5482] RDX: 0000000000000001 RSI: 00000000200013c0 RDI: 0000000000000004
[ 89.530637][ T5482] RBP: 00007fc24e2c847a R08: 0000000000000000 R09: 0000000000000000
[ 89.538698][ T5482] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 89.546679][ T5482] R13: 000000000000000b R14: 00007fc24e39bf80 R15: 00007ffff6582e38
[ 89.554746][ T5482]
[ 89.557951][ T5482] Kernel Offset: disabled
[ 89.562432][ T5482] Rebooting in 86400 seconds..