[ 37.939629] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 38.042453] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 39.166174] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready [ 39.172619] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.180235] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.189809] IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready [ 39.196070] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.203266] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.210424] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 39.217131] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready Warning: Permanently added '10.128.0.66' (ED25519) to the list of known hosts. 2024/11/29 05:52:34 ignoring optional flag "sandboxArg"="0" 2024/11/29 05:52:35 parsed 1 programs [ 60.044637] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 60.367501] IPVS: ftp: loaded support on port[0] = 21 [ 60.405062] IPVS: ftp: loaded support on port[0] = 21 [ 60.441425] IPVS: ftp: loaded support on port[0] = 21 [ 60.479329] IPVS: ftp: loaded support on port[0] = 21 [ 60.527831] IPVS: ftp: loaded support on port[0] = 21 [ 60.892764] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 61.044603] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 62.161871] IPVS: ftp: loaded support on port[0] = 21 [ 62.195058] IPVS: ftp: loaded support on port[0] = 21 [ 62.213840] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready [ 62.220537] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 62.227636] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 62.230077] IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready [ 62.240671] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 62.247721] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 62.254995] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 62.262969] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 62.290336] IPVS: ftp: loaded support on port[0] = 21 [ 62.316877] IPVS: ftp: loaded support on port[0] = 21 2024/11/29 05:52:39 executed programs: 0 [ 62.419690] IPVS: ftp: loaded support on port[0] = 21 [ 62.843602] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 62.981584] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 64.067554] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready [ 64.075048] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.082295] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.084562] IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready [ 64.095088] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 64.101944] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.109161] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.115825] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 64.247308] ================================================================== [ 64.254725] BUG: KASAN: use-after-free in diWrite+0x90e/0x12a0 [ 64.260902] Write of size 32 at addr ffff8801e23cb0c0 by task syz.2.15/4732 [ 64.268086] [ 64.269702] CPU: 0 PID: 4732 Comm: syz.2.15 Not tainted 4.19.0-syzkaller #0 [ 64.276890] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 64.286322] Call Trace: [ 64.288889] dump_stack+0x10c/0x17a [ 64.292487] print_address_description.cold.6+0x9/0x244 [ 64.297827] kasan_report.cold.7+0x242/0x305 [ 64.302221] ? diWrite+0x90e/0x12a0 [ 64.305824] check_memory_region+0x13c/0x1b0 [ 64.310296] memcpy+0x37/0x50 [ 64.313467] diWrite+0x90e/0x12a0 [ 64.316894] txCommit+0x55f/0x4020 [ 64.320554] ? _raw_spin_unlock+0x22/0x30 [ 64.324696] ? dtDeleteEntry+0x9a0/0x9a0 [ 64.328740] ? txAbort+0x5e0/0x5e0 [ 64.332254] ? new_slab+0x782/0x7d0 [ 64.335853] ? __mark_inode_dirty+0xdd/0xae0 [ 64.340409] jfs_readdir+0x23b2/0x3af0 [ 64.344274] ? dtDelete+0x2d00/0x2d00 [ 64.348067] ? kasan_check_write+0x14/0x20 [ 64.352274] ? __mutex_lock+0x623/0xd80 [ 64.356225] ? __fdget_pos+0xa7/0xd0 [ 64.359912] ? lock_acquire+0x177/0x310 [ 64.363861] ? iterate_dir+0x353/0x5f0 [ 64.367815] iterate_dir+0x1b0/0x5f0 [ 64.371516] ksys_getdents64+0x102/0x1d0 [ 64.375565] ? lock_downgrade+0x590/0x590 [ 64.379702] ? __ia32_sys_getdents+0xa0/0xa0 [ 64.384089] ? filldir+0x450/0x450 [ 64.387624] ? vtime_user_exit+0xe9/0x190 [ 64.391750] __x64_sys_getdents64+0x6e/0xb0 [ 64.396059] do_syscall_64+0xd0/0x340 [ 64.399846] ? prepare_exit_to_usermode+0xec/0x130 [ 64.404848] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 64.410046] RIP: 0033:0x7fbfe53f3819 [ 64.413757] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 64.432741] RSP: 002b:00007fbfe4e74038 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9 [ 64.440601] RAX: ffffffffffffffda RBX: 00007fbfe55aafa0 RCX: 00007fbfe53f3819 [ 64.447851] RDX: 0000000000001000 RSI: 00000000200038c0 RDI: 0000000000000005 [ 64.455200] RBP: 00007fbfe546675e R08: 0000000000000000 R09: 0000000000000000 [ 64.462481] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 64.469776] R13: 0000000000000000 R14: 00007fbfe55aafa0 R15: 00007ffd1a2f4258 [ 64.477026] [ 64.478740] Allocated by task 21: [ 64.482172] kasan_kmalloc.part.1+0x62/0xf0 [ 64.486468] kasan_kmalloc+0xaf/0xc0 [ 64.490179] kasan_slab_alloc+0x11/0x20 [ 64.494128] kmem_cache_alloc_node+0xe2/0x240 [ 64.498597] __alloc_skb+0xa7/0x580 [ 64.502223] inet_netconf_notify_devconf+0x83/0x140 [ 64.507231] __devinet_sysctl_unregister.isra.8+0x75/0xa0 [ 64.512824] devinet_sysctl_unregister+0x8d/0xe0 [ 64.517554] inetdev_event+0x61a/0x1030 [ 64.521507] notifier_call_chain+0xce/0x150 [ 64.525938] raw_notifier_call_chain+0x11/0x20 [ 64.530520] call_netdevice_notifiers+0x7b/0xa0 [ 64.535280] rollback_registered_many+0x7b2/0xcb0 [ 64.540102] unregister_netdevice_many+0x3e/0x1f0 [ 64.544919] ip6gre_exit_batch_net+0x2d2/0x3f0 [ 64.549477] ops_exit_list.isra.3+0xd9/0x130 [ 64.553860] cleanup_net+0x363/0x840 [ 64.557635] process_one_work+0x78b/0x1330 [ 64.561854] worker_thread+0x375/0x9e0 [ 64.565720] kthread+0x2f2/0x3b0 [ 64.569072] ret_from_fork+0x35/0x40 [ 64.572760] [ 64.574442] Freed by task 21: [ 64.577538] __kasan_slab_free+0x167/0x240 [ 64.581758] kasan_slab_free+0xe/0x10 [ 64.585547] kmem_cache_free+0xc7/0x240 [ 64.589523] kfree_skbmem+0x89/0xf0 [ 64.593212] consume_skb+0xb7/0x1d0 [ 64.597040] netlink_broadcast_filtered+0x288/0x910 [ 64.602036] netlink_broadcast+0xe/0x10 [ 64.605991] nlmsg_notify+0x107/0x140 [ 64.609853] rtnl_notify+0x86/0xe0 [ 64.613364] inet_netconf_notify_devconf+0xcb/0x140 [ 64.618374] __devinet_sysctl_unregister.isra.8+0x75/0xa0 [ 64.623980] devinet_sysctl_unregister+0x8d/0xe0 [ 64.628824] inetdev_event+0x61a/0x1030 [ 64.632773] notifier_call_chain+0xce/0x150 [ 64.637077] raw_notifier_call_chain+0x11/0x20 [ 64.641782] call_netdevice_notifiers+0x7b/0xa0 [ 64.646432] rollback_registered_many+0x7b2/0xcb0 [ 64.651271] unregister_netdevice_many+0x3e/0x1f0 [ 64.656099] ip6gre_exit_batch_net+0x2d2/0x3f0 [ 64.660665] ops_exit_list.isra.3+0xd9/0x130 [ 64.665067] cleanup_net+0x363/0x840 [ 64.669056] process_one_work+0x78b/0x1330 [ 64.673301] worker_thread+0x375/0x9e0 [ 64.677177] kthread+0x2f2/0x3b0 [ 64.680608] ret_from_fork+0x35/0x40 [ 64.684297] [ 64.685986] The buggy address belongs to the object at ffff8801e23cb000 [ 64.685986] which belongs to the cache skbuff_head_cache of size 232 [ 64.699135] The buggy address is located 192 bytes inside of [ 64.699135] 232-byte region [ffff8801e23cb000, ffff8801e23cb0e8) [ 64.711254] The buggy address belongs to the page: [ 64.716290] page:ffffea000788f2c0 count:1 mapcount:0 mapping:ffff8801f42dca00 index:0x0 [ 64.724441] flags: 0x100000000000100(slab) [ 64.728679] raw: 0100000000000100 ffffea000788f0c0 0000000700000007 ffff8801f42dca00 [ 64.736627] raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 [ 64.744567] page dumped because: kasan: bad access detected [ 64.750346] page allocated via order 0, migratetype Unmovable, gfp_mask 0x6012c0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY) [ 64.761250] get_page_from_freelist+0x2c01/0x4060 [ 64.766085] __alloc_pages_nodemask+0x390/0x2300 [ 64.770832] alloc_pages_current+0xfd/0x290 [ 64.775137] new_slab+0x458/0x7d0 [ 64.778566] ___slab_alloc+0x600/0x890 [ 64.782427] __slab_alloc+0x2f/0x60 [ 64.786026] kmem_cache_alloc_node+0xb6/0x240 [ 64.790585] __alloc_skb+0xa7/0x580 [ 64.794197] netlink_sendmsg+0x961/0xc00 [ 64.798254] sock_sendmsg+0xae/0xf0 [ 64.801953] ___sys_sendmsg+0x649/0x950 [ 64.805899] __sys_sendmsg+0xd9/0x180 [ 64.809678] __x64_sys_sendmsg+0x73/0xb0 [ 64.813717] do_syscall_64+0xd0/0x340 [ 64.817517] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 64.822765] [ 64.824364] Memory state around the buggy address: [ 64.829271] ffff8801e23caf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.836873] ffff8801e23cb000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 64.844328] >ffff8801e23cb080: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc [ 64.851966] ^ [ 64.857403] ffff8801e23cb100: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 64.864795] ffff8801e23cb180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 64.872220] ================================================================== [ 64.879563] Disabling lock debugging due to kernel taint [ 64.885417] Kernel panic - not syncing: panic_on_warn set ... [ 64.885417] [ 64.893102] Kernel Offset: disabled [ 64.896862] Rebooting in 86400 seconds..