[ 18.565240][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 18.575688][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 18.590967][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 18.599402][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 18.607738][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 18.622422][ T373] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 19.178817][ T7] device bridge_slave_1 left promiscuous mode [ 19.185120][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.192957][ T7] device bridge_slave_0 left promiscuous mode [ 19.199301][ T7] bridge0: port 1(bridge_slave_0) entered disabled state Warning: Permanently added '10.128.0.241' (ECDSA) to the list of known hosts. 2022/12/12 19:16:57 ignoring optional flag "sandboxArg"="0" 2022/12/12 19:16:58 parsed 1 programs [ 36.343079][ T22] kauditd_printk_skb: 66 callbacks suppressed [ 36.343085][ T22] audit: type=1400 audit(1670872618.040:149): avc: denied { mounton } for pid=403 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 2022/12/12 19:16:58 executed programs: 0 [ 36.374206][ T22] audit: type=1400 audit(1670872618.040:150): avc: denied { mount } for pid=403 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 36.414565][ T22] audit: type=1400 audit(1670872618.110:151): avc: denied { mounton } for pid=408 comm="syz-executor.4" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 36.463447][ T22] audit: type=1400 audit(1670872618.110:152): avc: denied { module_request } for pid=411 comm="syz-executor.1" kmod="netdev-nr1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 36.495353][ T411] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.502544][ T411] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.509877][ T411] device bridge_slave_0 entered promiscuous mode [ 36.520218][ T411] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.527230][ T411] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.534581][ T411] device bridge_slave_1 entered promiscuous mode [ 36.602342][ T420] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.609392][ T420] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.616642][ T420] device bridge_slave_0 entered promiscuous mode [ 36.629124][ T420] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.636153][ T420] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.643596][ T420] device bridge_slave_1 entered promiscuous mode [ 36.656715][ T419] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.664051][ T419] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.671358][ T419] device bridge_slave_0 entered promiscuous mode [ 36.686226][ T417] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.693444][ T417] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.700831][ T417] device bridge_slave_0 entered promiscuous mode [ 36.729274][ T419] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.736306][ T419] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.743823][ T419] device bridge_slave_1 entered promiscuous mode [ 36.750373][ T417] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.757365][ T417] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.764730][ T417] device bridge_slave_1 entered promiscuous mode [ 36.774279][ T411] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.781327][ T411] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.788562][ T411] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.795580][ T411] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.806157][ T408] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.813462][ T408] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.820877][ T408] device bridge_slave_0 entered promiscuous mode [ 36.832333][ T412] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.839368][ T412] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.846577][ T412] device bridge_slave_0 entered promiscuous mode [ 36.855015][ T412] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.862060][ T412] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.869447][ T412] device bridge_slave_1 entered promiscuous mode [ 36.881071][ T408] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.888106][ T408] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.895456][ T408] device bridge_slave_1 entered promiscuous mode [ 36.995535][ T408] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.002598][ T408] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.009838][ T408] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.016832][ T408] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.044911][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 37.053188][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 37.062222][ T5] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.069803][ T5] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.077396][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 37.085460][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 37.109136][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 37.116606][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 37.124553][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 37.142055][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 37.150179][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.157168][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.164530][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 37.172666][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.179774][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.198746][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 37.207070][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 37.249001][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 37.256501][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 37.266526][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 37.274848][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 37.282682][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 37.291478][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 37.299848][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 37.307567][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 37.315739][ T106] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.322746][ T106] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.330327][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 37.338385][ T106] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.345393][ T106] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.352661][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 37.360554][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 37.368350][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 37.376252][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 37.384163][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 37.392282][ T106] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.399283][ T106] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.406525][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 37.414714][ T106] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.421774][ T106] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.438643][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 37.446053][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 37.453859][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 37.461484][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 37.469638][ T106] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.476632][ T106] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.484168][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 37.492456][ T106] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.499503][ T106] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.507201][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 37.518957][ T371] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 37.527001][ T371] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 37.535408][ T371] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 37.543069][ T371] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 37.569577][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 37.577513][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 37.585723][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 37.594206][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 37.602270][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 37.610444][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 37.618756][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 37.626912][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 37.635086][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.642109][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.649462][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 37.657557][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 37.665837][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 37.674033][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 37.682275][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.689308][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.697384][ T371] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 37.718591][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 37.726851][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 37.735536][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 37.743398][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 37.751305][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 37.759430][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 37.767382][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 37.775657][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 37.786550][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 37.794790][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 37.803077][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 37.811320][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 37.819589][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 37.827326][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 37.839683][ T22] audit: type=1400 audit(1670872619.530:153): avc: denied { mount } for pid=417 comm="syz-executor.3" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 37.878157][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 37.889208][ T22] audit: type=1400 audit(1670872619.590:154): avc: denied { mounton } for pid=439 comm="syz-executor.3" path="/root/syzkaller-testdir4053068848/syzkaller.r42OQc/0/file0" dev="sda1" ino=1164 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 37.890931][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 37.927681][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 37.935760][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 37.943977][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 37.952153][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 37.960153][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 37.968110][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 37.976124][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 37.984393][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 37.992951][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 38.001356][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 38.018877][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 38.026995][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 38.035250][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 38.043370][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 38.052252][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 38.060681][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 38.069201][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 38.077408][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 38.085919][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 38.093766][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 38.130666][ T378] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 38.139473][ T378] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 38.147488][ T378] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 38.155798][ T378] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 38.164083][ T378] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 38.172327][ T378] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 38.186792][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 38.195504][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 38.214642][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 38.224327][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 38.233400][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 38.241779][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 38.723373][ T22] audit: type=1400 audit(1670872620.420:155): avc: denied { unmount } for pid=411 comm="syz-executor.1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 38.755419][ T22] audit: type=1400 audit(1670872620.450:156): avc: denied { append } for pid=141 comm="syslogd" name="messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 38.777746][ T22] audit: type=1400 audit(1670872620.450:157): avc: denied { open } for pid=141 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 38.800713][ T22] audit: type=1400 audit(1670872620.450:158): avc: denied { getattr } for pid=141 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 38.956291][ T483] ================================================================== [ 38.964404][ T483] BUG: KASAN: use-after-free in fuse_copy_one+0x1e7/0x3f0 [ 38.971499][ T483] Read of size 256 at addr ffff888120407410 by task syz-executor.1/483 [ 38.979710][ T483] [ 38.982017][ T483] CPU: 0 PID: 483 Comm: syz-executor.1 Not tainted 5.10.158-syzkaller #0 [ 38.990402][ T483] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 39.000449][ T483] Call Trace: [ 39.003728][ T483] dump_stack+0x19c/0x1e2 [ 39.008041][ T483] print_address_description+0x7e/0x6a0 [ 39.013566][ T483] ? printk+0x76/0x96 [ 39.017539][ T483] ? wake_up_klogd+0xb8/0xf0 [ 39.022105][ T483] kasan_report+0x16f/0x210 [ 39.026578][ T483] ? fuse_copy_one+0x1e7/0x3f0 [ 39.031311][ T483] ? fuse_copy_one+0x1e7/0x3f0 [ 39.036063][ T483] check_memory_region+0x2aa/0x2e0 [ 39.041150][ T483] ? fuse_copy_one+0x1e7/0x3f0 [ 39.045909][ T483] memcpy+0x2d/0x70 [ 39.049692][ T483] fuse_copy_one+0x1e7/0x3f0 [ 39.054266][ T483] fuse_copy_args+0x309/0x400 [ 39.058917][ T483] ? fuse_copy_one+0x39f/0x3f0 [ 39.063647][ T483] fuse_dev_do_read+0xc44/0x11c0 [ 39.068557][ T483] fuse_dev_read+0x11b/0x190 [ 39.073125][ T483] vfs_read+0x915/0xb30 [ 39.077253][ T483] ksys_read+0x157/0x260 [ 39.081462][ T483] __x64_sys_read+0x7b/0x90 [ 39.085934][ T483] do_syscall_64+0x34/0x70 [ 39.090333][ T483] entry_SYSCALL_64_after_hwframe+0x61/0xc6 [ 39.096200][ T483] RIP: 0033:0x7f669dc7f639 [ 39.101104][ T483] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 39.120690][ T483] RSP: 002b:00007f669d790168 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 39.129101][ T483] RAX: ffffffffffffffda RBX: 00007f669dda01f0 RCX: 00007f669dc7f639 [ 39.137051][ T483] RDX: 0000000000002020 RSI: 0000000020002140 RDI: 0000000000000003 [ 39.145002][ T483] RBP: 00007f669dcdaae9 R08: 0000000000000000 R09: 0000000000000000 [ 39.152955][ T483] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 39.160931][ T483] R13: 00007ffedd795a9f R14: 00007f669d790300 R15: 0000000000022000 [ 39.168880][ T483] [ 39.171178][ T483] Allocated by task 478: [ 39.175415][ T483] __kasan_kmalloc+0x11a/0x150 [ 39.180153][ T483] kasan_kmalloc+0x9/0x10 [ 39.184454][ T483] __kmalloc+0x17d/0x300 [ 39.188674][ T483] __d_alloc+0xab/0x6b0 [ 39.192811][ T483] d_alloc_parallel+0x83/0x14a0 [ 39.197626][ T483] __lookup_slow+0xf0/0x370 [ 39.202097][ T483] lookup_slow+0x5a/0x80 [ 39.206314][ T483] walk_component+0x3ce/0x540 [ 39.210957][ T483] path_lookupat+0x18e/0x720 [ 39.215512][ T483] filename_lookup+0x1ce/0x650 [ 39.220349][ T483] user_path_at_empty+0x40/0x50 [ 39.225168][ T483] __se_sys_mount+0x28c/0x310 [ 39.229813][ T483] __x64_sys_mount+0xbf/0xd0 [ 39.234375][ T483] do_syscall_64+0x34/0x70 [ 39.238769][ T483] entry_SYSCALL_64_after_hwframe+0x61/0xc6 [ 39.244623][ T483] [ 39.246929][ T483] Freed by task 378: [ 39.250815][ T483] kasan_set_track+0x4c/0x80 [ 39.255370][ T483] kasan_set_free_info+0x1b/0x30 [ 39.260273][ T483] __kasan_slab_free+0x11c/0x150 [ 39.265176][ T483] kasan_slab_free+0xe/0x10 [ 39.269646][ T483] slab_free_freelist_hook+0x7f/0x150 [ 39.274983][ T483] kmem_cache_free_bulk+0x3f0/0x590 [ 39.280146][ T483] kfree_rcu_work+0x26b/0x680 [ 39.284795][ T483] process_one_work+0x711/0xce0 [ 39.289614][ T483] worker_thread+0xb17/0x1540 [ 39.294272][ T483] kthread+0x365/0x400 [ 39.298308][ T483] ret_from_fork+0x1f/0x30 [ 39.302689][ T483] [ 39.304989][ T483] The buggy address belongs to the object at ffff888120407400 [ 39.304989][ T483] which belongs to the cache kmalloc-rcl-512 of size 512 [ 39.319354][ T483] The buggy address is located 16 bytes inside of [ 39.319354][ T483] 512-byte region [ffff888120407400, ffff888120407600) [ 39.332502][ T483] The buggy address belongs to the page: [ 39.338102][ T483] page:00000000d3d8010a refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x120404 [ 39.348317][ T483] head:00000000d3d8010a order:2 compound_mapcount:0 compound_pincount:0 [ 39.356641][ T483] flags: 0x8000000000010200(slab|head) [ 39.362081][ T483] raw: 8000000000010200 dead000000000100 dead000000000122 ffff888100042dc0 [ 39.370660][ T483] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 39.379209][ T483] page dumped because: kasan: bad access detected [ 39.385601][ T483] page_owner tracks the page as allocated [ 39.391312][ T483] page last allocated via order 2, migratetype Reclaimable, gfp_mask 0x1d20d0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE) [ 39.409426][ T483] prep_new_page+0x14e/0x160 [ 39.413990][ T483] get_page_from_freelist+0x598/0x5d0 [ 39.419328][ T483] __alloc_pages_nodemask+0x2b6/0x740 [ 39.424677][ T483] allocate_slab+0x72/0x580 [ 39.429148][ T483] ___slab_alloc+0x131/0x2e0 [ 39.433705][ T483] __slab_alloc+0x63/0xa0 [ 39.438001][ T483] __kmalloc+0x10a/0x300 [ 39.442297][ T483] __d_alloc+0xab/0x6b0 [ 39.446418][ T483] d_alloc_parallel+0x83/0x14a0 [ 39.451233][ T483] __lookup_slow+0xf0/0x370 [ 39.455702][ T483] lookup_slow+0x5a/0x80 [ 39.459926][ T483] walk_component+0x3ce/0x540 [ 39.464570][ T483] path_lookupat+0x18e/0x720 [ 39.469131][ T483] filename_lookup+0x1ce/0x650 [ 39.473865][ T483] user_path_at_empty+0x40/0x50 [ 39.478682][ T483] __se_sys_mount+0x28c/0x310 [ 39.483328][ T483] page_owner free stack trace missing [ 39.488670][ T483] [ 39.490973][ T483] Memory state around the buggy address: [ 39.496576][ T483] ffff888120407300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.504613][ T483] ffff888120407380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.512652][ T483] >ffff888120407400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 39.520708][ T483] ^ [ 39.525273][ T483] ffff888120407480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 39.533310][ T483] ffff888120407500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 39.541339][ T483] ================================================================== [ 39.549394][ T483] Disabling lock debugging due to kernel taint 2022/12/12 19:17:03 executed programs: 26 2022/12/12 19:17:08 executed programs: 62