[ 40.375990][ T3591] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.505727][ T3591] bridge_slave_1: left allmulticast mode [ 40.505756][ T3591] bridge_slave_1: left promiscuous mode [ 40.506016][ T3591] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.508188][ T3591] bridge_slave_0: left allmulticast mode [ 40.508203][ T3591] bridge_slave_0: left promiscuous mode [ 40.508271][ T3591] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.585345][ T3591] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 40.587188][ T3591] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 40.588004][ T3591] bond0 (unregistering): Released all slaves [ 40.729219][ T4398] 8021q: adding VLAN 0 to HW filter on device eth1 [ 40.885229][ T4398] 8021q: adding VLAN 0 to HW filter on device eth0 [ 41.033397][ T4398] 8021q: adding VLAN 0 to HW filter on device eth2 [ 41.042711][ T3591] hsr_slave_0: left promiscuous mode [ 41.054136][ T3591] hsr_slave_1: left promiscuous mode [ 41.054467][ T3591] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 41.054486][ T3591] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 41.055784][ T3591] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 41.055795][ T3591] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 41.059812][ T3591] veth1_macvtap: left promiscuous mode [ 41.059845][ T3591] veth0_macvtap: left promiscuous mode [ 41.059894][ T3591] veth1_vlan: left promiscuous mode [ 41.059933][ T3591] veth0_vlan: left promiscuous mode [ 41.156712][ T3591] team0 (unregistering): Port device team_slave_1 removed [ 41.160355][ T3591] team0 (unregistering): Port device team_slave_0 removed [ 41.327107][ T4398] 8021q: adding VLAN 0 to HW filter on device eth3 [ 41.487685][ T3591] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.586802][ T3591] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.617122][ T3591] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.696835][ T3591] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.803141][ T3591] bridge_slave_1: left allmulticast mode [ 41.803163][ T3591] bridge_slave_1: left promiscuous mode [ 41.803242][ T3591] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.804638][ T3591] bridge_slave_0: left allmulticast mode [ 41.804651][ T3591] bridge_slave_0: left promiscuous mode [ 41.804711][ T3591] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.862707][ T3591] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 41.883906][ T3591] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 41.923998][ T3591] bond0 (unregistering): Released all slaves [ 42.044631][ T4398] 8021q: adding VLAN 0 to HW filter on device eth4 [ 42.180098][ T3591] hsr_slave_0: left promiscuous mode [ 42.180344][ T3591] hsr_slave_1: left promiscuous mode [ 42.180585][ T3591] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 42.180595][ T3591] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 42.180893][ T3591] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 42.180901][ T3591] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 42.184629][ T3591] veth1_macvtap: left promiscuous mode [ 42.184654][ T3591] veth0_macvtap: left promiscuous mode [ 42.184699][ T3591] veth1_vlan: left promiscuous mode [ 42.184732][ T3591] veth0_vlan: left promiscuous mode [ 42.277468][ T3591] team0 (unregistering): Port device team_slave_1 removed [ 42.281066][ T3591] team0 (unregistering): Port device team_slave_0 removed [ 42.329310][ T4398] 8021q: adding VLAN 0 to HW filter on device eth5 [ 42.469049][ T4398] 8021q: adding VLAN 0 to HW filter on device eth6 [ 42.593943][ T4398] 8021q: adding VLAN 0 to HW filter on device eth7 Warning: Permanently added '10.128.1.175' (ED25519) to the list of known hosts. [*] Starting reproducer for read_seqbegin null-ptr-deref in exit_task_work... [+] Mounted securityfs at /sys/kernel/security. [+] Mounted smackfs at /sys/fs/smackfs. [+] NETLINK_AUDIT socket created successfully. [+] Sent AUDIT_SET command. [+] Received AUDIT_SET ack (36 bytes). [+] Closed audit_fd successfully. [+] Opened /sys/fs/smackfs/logging for writing. [+] Configured Smack log policy to 3 (DENIED | ACCEPT). [+] Closed smack_fd successfully. [+] Opened /sys/kernel/security/ima/policy for writing. [+] Written rule 'appraise func=FILE_CHECK ' to IMA policy. [ 44.968179][ T30] audit: type=1400 audit(44.960:2): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=5030 comm="syz-executor230" name="/" dev="nvme0n1p2" ino=2 [ 44.968269][ T30] audit: type=1400 audit(44.960:3): lsm=SMACK fn=smack_socket_sock_rcv_skb action=granted subject="_" object="_" requested=w pid=0 comm="swapper/0" saddr=10.128.0.169 src=44204 daddr=10.128.1.175 dest=22 netif=enp0s0 [ 44.968286][ T30] audit: type=1400 audit(44.960:4): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=5030 comm="syz-executor230" name="/" dev="sysfs" ino=1 [ 44.968366][ T30] audit: type=1400 audit(44.960:5): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=5030 comm="syz-executor230" name="kernel" dev="sysfs" ino=7 [ 44.968439][ T30] audit: type=1400 audit(44.960:6): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=5030 comm="syz-executor230" name="/" dev="securityfs" ino=1 [ 44.968454][ T30] audit: type=1400 audit(44.960:7): lsm=SMACK fn=smack_socket_sock_rcv_skb action=granted subject="_" object="_" requested=w pid=30 comm="kauditd" saddr=10.128.0.169 src=44204 daddr=10.128.1.175 dest=22 netif=enp0s0 [ 44.968468][ T30] audit: type=1400 audit(44.960:8): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=5030 comm="syz-executor230" name="/" dev="securityfs" ino=1 [ 44.968481][ T30] audit: type=1400 audit(44.960:9): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=5030 comm="syz-executor230" name="integrity" dev="securityfs" ino=1615 [+] Closed IMA policy file, policy successfully committed. [*] Starting reproduction iteration 0... [ 44.968496][ T30] audit: type=1400 audit(44.960:10): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=5030 comm="syz-executor230" name="ima" dev="securityfs" ino=1616 [+] Child: Opened ./ima_test_file (fd=3) [+] Child: Wrote 17 bytes to fd 3 [ 44.968509][ T30] audit: type=1400 audit(44.960:11): lsm=SMACK fn=smack_socket_sock_rcv_skb action=granted subject="_" object="_" requested=w pid=30 comm="kauditd" saddr=10.128.0.169 src=44204 daddr=10.128.1.175 dest=22 netif=enp0s0 [ 44.968825][ T5030] ima: policy update completed [+] Child: Opened /tmp/ima_test_file (fd=4) [+] Child: Wrote 17 bytes to fd 4 [+] Child: Opened /tmp O_TMPFILE (fd=5) [+] Child: Wrote 17 bytes to fd 5 [*] Child exiting without closing descriptors to trigger exit_task_work crash... [+] Child 5031 exited with status 0x0 [*] Starting reproduction iteration 1... [+] Child: Opened ./ima_test_file (fd=3) [+] Child: Wrote 17 bytes to fd 3 [+] Child: Opened /tmp/ima_test_file (fd=4) [+] Child: Wrote 17 bytes to fd 4 [+] Child: Opened /tmp O_TMPFILE (fd=5) [+] Child: Wrote 17 bytes to fd 5 [*] Child exiting without closing descriptors to trigger exit_task_work crash... [+] Child 5032 exited with status 0x0 [*] Starting reproduction iteration 2... [+] Child: Opened ./ima_test_file (fd=3) [+] Child: Wrote 17 bytes to fd 3 [+] Child: Opened /tmp/ima_test_file (fd=4) [+] Child: Wrote 17 bytes to fd 4 [+] Child: Opened /tmp O_TMPFILE (fd=5) [+] Child: Wrote 17 bytes to fd 5 [*] Child exiting without closing descriptors to trigger exit_task_work crash... [+] Child 5033 exited with status 0x0 [*] Starting reproduction iteration 3... [+] Child: Opened ./ima_test_file (fd=3) [+] Child: Wrote 17 bytes to fd 3 [+] Child: Opened /tmp/ima_test_file (fd=4) [+] Child: Wrote 17 bytes to fd 4 [+] Child: Opened /tmp O_TMPFILE (fd=5) [+] Child: Wrote 17 bytes to fd 5 [*] Child exiting without closing descriptors to trigger exit_task_work crash... [+] Child 5034 exited with status 0x0 [*] Starting reproduction iteration 4... [+] Child: Opened ./ima_test_file (fd=3) [+] Child: Wrote 17 bytes to fd 3 [+] Child: Opened /tmp/ima_test_file (fd=4) [+] Child: Wrote 17 bytes to fd 4 [+] Child: Opened /tmp O_TMPFILE (fd=5) [+] Child: Wrote 17 bytes to fd 5 [*] Child exiting without closing descriptors to trigger exit_task_work crash... [+] Child 5035 exited with status 0x0 [*] Starting reproduction iteration 5... [+] Child: Opened ./ima_test_file (fd=3) [+] Child: Wrote 17 bytes to fd 3 [+] Child: Opened /tmp/ima_test_file (fd=4) [+] Child: Wrote 17 bytes to fd 4 [+] Child: Opened /tmp O_TMPFILE (fd=5) [+] Child: Wrote 17 bytes to fd 5 [*] Child exiting without closing descriptors to trigger exit_task_work crash... [+] Child 5036 exited with status 0x0 [*] Starting reproduction iteration 6... [+] Child: Opened ./ima_test_file (fd=3) [+] Child: Wrote 17 bytes to fd 3 [+] Child: Opened /tmp/ima_test_file (fd=4) [+] Child: Wrote 17 bytes to fd 4 [+] Child: Opened /tmp O_TMPFILE (fd=5) [+] Child: Wrote 17 bytes to fd 5 [*] Child exiting without closing descriptors to trigger exit_task_work crash... [+] Child 5037 exited with status 0x0 [*] Starting reproduction iteration 7... [+] Child: Opened ./ima_test_file (fd=3) [+] Child: Wrote 17 bytes to fd 3 [+] Child: Opened /tmp/ima_test_file (fd=4) [+] Child: Wrote 17 bytes to fd 4 [+] Child: Opened /tmp O_TMPFILE (fd=5) [+] Child: Wrote 17 bytes to fd 5 [*] Child exiting without closing descriptors to trigger exit_task_work crash... [+] Child 5038 exited with status 0x0 [*] Starting reproduction iteration 8... [+] Child: Opened ./ima_test_file (fd=3) [+] Child: Wrote 17 bytes to fd 3 [+] Child: Opened /tmp/ima_test_file (fd=4) [+] Child: Wrote 17 bytes to fd 4 [+] Child: Opened /tmp O_TMPFILE (fd=5) [+] Child: Wrote 17 bytes to fd 5 [*] Child exiting without closing descriptors to trigger exit_task_work crash... [+] Child 5039 exited with status 0x0 [*] Starting reproduction iteration 9... [+] Child: Opened ./ima_test_file (fd=3) [+] Child: Wrote 17 bytes to fd 3 [+] Child: Opened /tmp/ima_test_file (fd=4) [+] Child: Wrote 17 bytes to fd 4 [+] Child: Opened /tmp O_TMPFILE (fd=5) [+] Child: Wrote 17 bytes to fd 5 [*] Child exiting without closing descriptors to trigger exit_task_work crash... [+] Child 5040 exited with status 0x0 [+] Main: Opened ./ima_test_file with fd 3 [+] Main: Wrote 17 bytes to fd 3 [*] Main exiting without closing fd 3 to trigger deferred fput in exit_task_work...