Warning: Permanently added '10.128.1.135' (ED25519) to the list of known hosts.
[+] Starting reproducer for invalid-free in hwsim_update_pib...
[+] Opened NETLINK_GENERIC socket (fd=3)
[+] Resolved Generic Netlink family 'MAC802154_HWSIM' (id=50)
[+] Resolved Generic Netlink family 'nl802154' (id=30)
[+] Discovered 2 hwsim radio(s)
[+] Target HWSIM radio ID: 0
[+] Found network interface wpan0 (ifindex=11)
[+] Interface wpan0 successfully brought UP.
[+] Triggering scan on wpan0 via nl802154...
[+] NL802154_CMD_TRIGGER_SCAN acknowledged, scan active on wpan0.
[+] Sleeping 30ms to allow mac802154_scan_worker to run and replace PIB...
[+] Deleting HWSIM radio ID 0 (triggering double-free bug in hwsim_update_pib)...
[ 120.392168][ T6057] ==================================================================
[ 120.392189][ T6057] BUG: KASAN: double-free in kvfree_call_rcu+0x9c/0x440
[ 120.392217][ T6057] Free of addr ffff888077e0ab80 by task syz-executor416/6057
[ 120.392226][ T6057]
[ 120.392233][ T6057] CPU: 1 UID: 0 PID: 6057 Comm: syz-executor416 Not tainted syzkaller #0 PREEMPT(full)
[ 120.392247][ T6057] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
[ 120.392255][ T6057] Call Trace:
[ 120.392260][ T6057]
[ 120.392265][ T6057] dump_stack_lvl+0xe8/0x150
[ 120.392285][ T6057] print_address_description+0x55/0x1e0
[ 120.392303][ T6057] print_report+0x58/0x70
[ 120.392319][ T6057] ? kvfree_call_rcu+0x9c/0x440
[ 120.392336][ T6057] kasan_report_invalid_free+0xea/0x110
[ 120.392349][ T6057] ? kvfree_call_rcu+0x9c/0x440
[ 120.392368][ T6057] ? kvfree_call_rcu+0x9c/0x440
[ 120.392385][ T6057] check_slab_allocation+0xbc/0xe0
[ 120.392403][ T6057] ? __kfree_rcu_sheaf+0x21/0x690
[ 120.392418][ T6057] __kfree_rcu_sheaf+0x126/0x690
[ 120.392435][ T6057] kvfree_call_rcu+0x9c/0x440
[ 120.392452][ T6057] ? __local_bh_enable_ip+0xd6/0x140
[ 120.392470][ T6057] hwsim_update_pib+0x276/0x400
[ 120.392488][ T6057] ? hwsim_hw_channel+0x50/0x2b0
[ 120.392505][ T6057] hwsim_hw_channel+0x178/0x2b0
[ 120.392522][ T6057] drv_set_channel+0xfe/0x280
[ 120.392536][ T6057] mac802154_scan_cleanup_locked+0x116/0x280
[ 120.392551][ T6057] mac802154_abort_scan_locked+0xa3/0xe0
[ 120.392564][ T6057] mac802154_slave_close+0xc9/0x2e0
[ 120.392579][ T6057] ? __pfx_mac802154_slave_close+0x10/0x10
[ 120.392595][ T6057] __dev_close_many+0x361/0x6e0
[ 120.392614][ T6057] ? kernel_text_address+0xa5/0xe0
[ 120.392630][ T6057] ? __pfx___dev_close_many+0x10/0x10
[ 120.392651][ T6057] netif_close_many+0x249/0x660
[ 120.392670][ T6057] ? __pfx_hlock_conflict+0x10/0x10
[ 120.392683][ T6057] ? __pfx_netif_close_many+0x10/0x10
[ 120.392702][ T6057] ? netdev_lock_ops_close_many+0x51e/0x540
[ 120.392722][ T6057] unregister_netdevice_many_notify+0x7aa/0x1dc0
[ 120.392741][ T6057] ? __lock_acquire+0x1511/0x2de0
[ 120.392758][ T6057] ? __pfx_unregister_netdevice_many_notify+0x10/0x10
[ 120.392780][ T6057] unregister_netdevice_queue+0x2f5/0x340
[ 120.392797][ T6057] ? __pfx_unregister_netdevice_queue+0x10/0x10
[ 120.392814][ T6057] ? __local_bh_enable_ip+0xd6/0x140
[ 120.392831][ T6057] ieee802154_remove_interfaces+0x162/0x1a0
[ 120.392848][ T6057] ieee802154_unregister_hw+0x62/0xe0
[ 120.392861][ T6057] hwsim_del+0x49c/0x500
[ 120.392878][ T6057] ? hwsim_del+0x132/0x500
[ 120.392895][ T6057] hwsim_del_radio_nl+0x110/0x150
[ 120.392912][ T6057] genl_family_rcv_msg_doit+0x233/0x340
[ 120.392930][ T6057] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[ 120.392948][ T6057] ? bpf_lsm_capable+0x9/0x20
[ 120.392976][ T6057] ? security_capable+0x7e/0x2c0
[ 120.392994][ T6057] genl_rcv_msg+0x614/0x7a0
[ 120.393010][ T6057] ? __pfx_genl_rcv_msg+0x10/0x10
[ 120.393024][ T6057] ? __pfx_hwsim_del_radio_nl+0x10/0x10
[ 120.393044][ T6057] netlink_rcv_skb+0x226/0x4a0
[ 120.393063][ T6057] ? __pfx_genl_rcv_msg+0x10/0x10
[ 120.393082][ T6057] ? __pfx_netlink_rcv_skb+0x10/0x10
[ 120.393104][ T6057] ? down_read+0x2b9/0x320
[ 120.393121][ T6057] genl_rcv+0x28/0x40
[ 120.393134][ T6057] netlink_unicast+0x8ef/0xa80
[ 120.393155][ T6057] netlink_sendmsg+0x7f0/0xb20
[ 120.393168][ T6057] ? __pfx_netlink_sendmsg+0x10/0x10
[ 120.393185][ T6057] ? aa_sock_msg_perm+0x144/0x210
[ 120.393203][ T6057] ? apparmor_socket_sendmsg+0x98/0x360
[ 120.393219][ T6057] ? __pfx_netlink_sendmsg+0x10/0x10
[ 120.393230][ T6057] sock_sendmsg_nosec+0x14e/0x190
[ 120.393247][ T6057] __sys_sendto+0x408/0x5a0
[ 120.393260][ T6057] ? __pfx___sys_sendto+0x10/0x10
[ 120.393278][ T6057] ? __task_pid_nr_ns+0x28/0x470
[ 120.393293][ T6057] __x64_sys_sendto+0xde/0x100
[ 120.393305][ T6057] do_syscall_64+0x171/0x540
[ 120.393320][ T6057] ? trace_irq_disable+0x3b/0x140
[ 120.393330][ T6057] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 120.393342][ T6057] ? clear_bhb_loop+0x70/0xc0
[ 120.393355][ T6057] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 120.393367][ T6057] RIP: 0033:0x00007f8868cf0b77
[ 120.393381][ T6057] Code: 48 89 fa 4c 89 df e8 98 1d 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 120.393391][ T6057] RSP: 002b:00007ffeb08d8fe0 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
[ 120.393405][ T6057] RAX: ffffffffffffffda RBX: 000055555ef33400 RCX: 00007f8868cf0b77
[ 120.393415][ T6057] RDX: 000000000000001c RSI: 00007ffeb08d91e0 RDI: 0000000000000003
[ 120.393423][ T6057] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[ 120.393430][ T6057] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000032
[ 120.393437][ T6057] R13: 00007ffeb08d9040 R14: 0000000000000000 R15: 0000000000000000
[ 120.393450][ T6057]
[ 120.393454][ T6057]
[ 120.393457][ T6057] Allocated by task 13:
[ 120.393462][ T6057] kasan_save_track+0x3f/0x90
[ 120.393479][ T6057] __kasan_kmalloc+0x93/0xb0
[ 120.393495][ T6057] __kmalloc_cache_noprof+0x31c/0x600
[ 120.393509][ T6057] hwsim_update_pib+0x7e/0x400
[ 120.393525][ T6057] hwsim_set_promiscuous_mode+0x196/0x2e0
[ 120.393541][ T6057] drv_set_promiscuous_mode+0x154/0x2d0
[ 120.393553][ T6057] drv_start+0x4db/0x1000
[ 120.393564][ T6057] mac802154_scan_worker+0x8e6/0xe60
[ 120.393575][ T6057] process_scheduled_works+0xc3d/0x1630
[ 120.393592][ T6057] worker_thread+0xa47/0xfb0
[ 120.393602][ T6057] kthread+0x38b/0x480
[ 120.393614][ T6057] ret_from_fork+0x514/0xb70
[ 120.393627][ T6057] ret_from_fork_asm+0x1a/0x30
[ 120.393638][ T6057]
[ 120.393641][ T6057] Last potentially related work creation:
[ 120.393645][ T6057] kasan_save_stack+0x3e/0x60
[ 120.393660][ T6057] __kasan_record_aux_stack+0xc5/0xe0
[ 120.393673][ T6057] __kfree_rcu_sheaf+0x136/0x690
[ 120.393690][ T6057] kvfree_call_rcu+0x9c/0x440
[ 120.393707][ T6057] hwsim_del+0x476/0x500
[ 120.393722][ T6057] hwsim_del_radio_nl+0x110/0x150
[ 120.393737][ T6057] genl_family_rcv_msg_doit+0x233/0x340
[ 120.393751][ T6057] genl_rcv_msg+0x614/0x7a0
[ 120.393764][ T6057] netlink_rcv_skb+0x226/0x4a0
[ 120.393780][ T6057] genl_rcv+0x28/0x40
[ 120.393792][ T6057] netlink_unicast+0x8ef/0xa80
[ 120.393807][ T6057] netlink_sendmsg+0x7f0/0xb20
[ 120.393817][ T6057] sock_sendmsg_nosec+0x14e/0x190
[ 120.393832][ T6057] __sys_sendto+0x408/0x5a0
[ 120.393842][ T6057] __x64_sys_sendto+0xde/0x100
[ 120.393851][ T6057] do_syscall_64+0x171/0x540
[ 120.393865][ T6057] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 120.393876][ T6057]
[ 120.393878][ T6057] The buggy address belongs to the object at ffff888077e0ab80
[ 120.393878][ T6057] which belongs to the cache kmalloc-64 of size 64
[ 120.393888][ T6057] The buggy address is located 0 bytes inside of
[ 120.393888][ T6057] 56-byte region [ffff888077e0ab80, ffff888077e0abb8)
[ 120.393899][ T6057]
[ 120.393902][ T6057] The buggy address belongs to the physical page:
[ 120.393908][ T6057] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888077e0a000 pfn:0x77e0a
[ 120.393920][ T6057] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
[ 120.393931][ T6057] page_type: f5(slab)
[ 120.393943][ T6057] raw: 00fff00000000200 ffff88813ff308c0 ffffea0001ee43d0 ffffea000086b9d0
[ 120.393953][ T6057] raw: ffff888077e0a000 0000000000200019 00000000f5000000 0000000000000000
[ 120.393959][ T6057] page dumped because: kasan: bad access detected
[ 120.393965][ T6057] page_owner tracks the page as allocated
[ 120.393969][ T6057] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5010, tgid 5010 (udevd), ts 50265114608
[ 120.393988][ T6057] post_alloc_hook+0x1f9/0x250
[ 120.394001][ T6057] prep_new_page+0x22/0xb0
[ 120.394015][ T6057] get_page_from_freelist+0x22a1/0x22e0
[ 120.394031][ T6057] __alloc_frozen_pages_noprof+0x211/0x450
[ 120.394046][ T6057] allocate_slab+0x7d/0x5e0
[ 120.394057][ T6057] refill_objects+0x2d5/0x350
[ 120.394067][ T6057] __pcs_replace_empty_main+0x2c8/0x6c0
[ 120.394078][ T6057] __kmalloc_noprof+0x476/0x710
[ 120.394091][ T6057] tomoyo_encode+0x2ad/0x570
[ 120.394107][ T6057] tomoyo_realpath_from_path+0x5fd/0x640
[ 120.394124][ T6057] tomoyo_check_open_permission+0x229/0x470
[ 120.394138][ T6057] security_file_open+0xa9/0x240
[ 120.394150][ T6057] do_dentry_open+0x495/0x1360
[ 120.394162][ T6057] vfs_open_consume+0x4a/0x350
[ 120.394174][ T6057] path_openat+0x16fc/0x20f0
[ 120.394191][ T6057] do_file_open+0x23e/0x4a0
[ 120.394200][ T6057] page last free pid 16 tgid 16 ts 50082662316 stack trace:
[ 120.394208][ T6057] __free_frozen_pages+0xd1a/0xe10
[ 120.394221][ T6057] rcu_core+0x92e/0x1230
[ 120.394238][ T6057] handle_softirqs+0x265/0x8d0
[ 120.394253][ T6057] run_ksoftirqd+0x36/0x60
[ 120.394262][ T6057] smpboot_thread_fn+0x5f8/0xb30
[ 120.394274][ T6057] kthread+0x38b/0x480
[ 120.394287][ T6057] ret_from_fork+0x514/0xb70
[ 120.394298][ T6057] ret_from_fork_asm+0x1a/0x30
[ 120.394309][ T6057]
[ 120.394312][ T6057] Memory state around the buggy address:
[ 120.394318][ T6057] ffff888077e0aa80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 120.394326][ T6057] ffff888077e0ab00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 120.394333][ T6057] >ffff888077e0ab80: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
[ 120.394339][ T6057] ^
[ 120.394345][ T6057] ffff888077e0ac00: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
[ 120.394352][ T6057] ffff888077e0ac80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 120.394358][ T6057] ==================================================================
[ 120.394365][ T6057] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 121.321632][ T6057] CPU: 1 UID: 0 PID: 6057 Comm: syz-executor416 Not tainted syzkaller #0 PREEMPT(full)
[ 121.331341][ T6057] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
[ 121.341385][ T6057] Call Trace:
[ 121.344657][ T6057]
[ 121.347610][ T6057] vpanic+0x26f/0x710
[ 121.351591][ T6057] panic+0xc5/0xd0
[ 121.355345][ T6057] ? __pfx_panic+0x10/0x10
[ 121.359857][ T6057] ? rcu_is_watching+0x16/0xb0
[ 121.364642][ T6057] check_panic_on_warn+0x89/0xb0
[ 121.369598][ T6057] end_report+0x73/0x170
[ 121.373850][ T6057] ? kvfree_call_rcu+0x9c/0x440
[ 121.378727][ T6057] kasan_report_invalid_free+0xfa/0x110
[ 121.384285][ T6057] ? kvfree_call_rcu+0x9c/0x440
[ 121.389242][ T6057] ? kvfree_call_rcu+0x9c/0x440
[ 121.394114][ T6057] check_slab_allocation+0xbc/0xe0
[ 121.399230][ T6057] ? __kfree_rcu_sheaf+0x21/0x690
[ 121.404256][ T6057] __kfree_rcu_sheaf+0x126/0x690
[ 121.409189][ T6057] kvfree_call_rcu+0x9c/0x440
[ 121.413860][ T6057] ? __local_bh_enable_ip+0xd6/0x140
[ 121.419136][ T6057] hwsim_update_pib+0x276/0x400
[ 121.423984][ T6057] ? hwsim_hw_channel+0x50/0x2b0
[ 121.428912][ T6057] hwsim_hw_channel+0x178/0x2b0
[ 121.433752][ T6057] drv_set_channel+0xfe/0x280
[ 121.438506][ T6057] mac802154_scan_cleanup_locked+0x116/0x280
[ 121.444479][ T6057] mac802154_abort_scan_locked+0xa3/0xe0
[ 121.450191][ T6057] mac802154_slave_close+0xc9/0x2e0
[ 121.455382][ T6057] ? __pfx_mac802154_slave_close+0x10/0x10
[ 121.461224][ T6057] __dev_close_many+0x361/0x6e0
[ 121.466123][ T6057] ? kernel_text_address+0xa5/0xe0
[ 121.471271][ T6057] ? __pfx___dev_close_many+0x10/0x10
[ 121.476664][ T6057] netif_close_many+0x249/0x660
[ 121.481539][ T6057] ? __pfx_hlock_conflict+0x10/0x10
[ 121.486743][ T6057] ? __pfx_netif_close_many+0x10/0x10
[ 121.492127][ T6057] ? netdev_lock_ops_close_many+0x51e/0x540
[ 121.498191][ T6057] unregister_netdevice_many_notify+0x7aa/0x1dc0
[ 121.504540][ T6057] ? __lock_acquire+0x1511/0x2de0
[ 121.509559][ T6057] ? __pfx_unregister_netdevice_many_notify+0x10/0x10
[ 121.516321][ T6057] unregister_netdevice_queue+0x2f5/0x340
[ 121.522036][ T6057] ? __pfx_unregister_netdevice_queue+0x10/0x10
[ 121.528291][ T6057] ? __local_bh_enable_ip+0xd6/0x140
[ 121.533572][ T6057] ieee802154_remove_interfaces+0x162/0x1a0
[ 121.539464][ T6057] ieee802154_unregister_hw+0x62/0xe0
[ 121.544832][ T6057] hwsim_del+0x49c/0x500
[ 121.549087][ T6057] ? hwsim_del+0x132/0x500
[ 121.553853][ T6057] hwsim_del_radio_nl+0x110/0x150
[ 121.558891][ T6057] genl_family_rcv_msg_doit+0x233/0x340
[ 121.564434][ T6057] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[ 121.570499][ T6057] ? bpf_lsm_capable+0x9/0x20
[ 121.575191][ T6057] ? security_capable+0x7e/0x2c0
[ 121.580147][ T6057] genl_rcv_msg+0x614/0x7a0
[ 121.584659][ T6057] ? __pfx_genl_rcv_msg+0x10/0x10
[ 121.589695][ T6057] ? __pfx_hwsim_del_radio_nl+0x10/0x10
[ 121.595358][ T6057] netlink_rcv_skb+0x226/0x4a0
[ 121.600252][ T6057] ? __pfx_genl_rcv_msg+0x10/0x10
[ 121.605297][ T6057] ? __pfx_netlink_rcv_skb+0x10/0x10
[ 121.610608][ T6057] ? down_read+0x2b9/0x320
[ 121.615030][ T6057] genl_rcv+0x28/0x40
[ 121.619025][ T6057] netlink_unicast+0x8ef/0xa80
[ 121.623807][ T6057] netlink_sendmsg+0x7f0/0xb20
[ 121.628571][ T6057] ? __pfx_netlink_sendmsg+0x10/0x10
[ 121.633956][ T6057] ? aa_sock_msg_perm+0x144/0x210
[ 121.639172][ T6057] ? apparmor_socket_sendmsg+0x98/0x360
[ 121.644735][ T6057] ? __pfx_netlink_sendmsg+0x10/0x10
[ 121.650018][ T6057] sock_sendmsg_nosec+0x14e/0x190
[ 121.655128][ T6057] __sys_sendto+0x408/0x5a0
[ 121.659710][ T6057] ? __pfx___sys_sendto+0x10/0x10
[ 121.664739][ T6057] ? __task_pid_nr_ns+0x28/0x470
[ 121.669670][ T6057] __x64_sys_sendto+0xde/0x100
[ 121.674422][ T6057] do_syscall_64+0x171/0x540
[ 121.679093][ T6057] ? trace_irq_disable+0x3b/0x140
[ 121.684232][ T6057] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 121.690394][ T6057] ? clear_bhb_loop+0x70/0xc0
[ 121.695189][ T6057] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 121.701072][ T6057] RIP: 0033:0x00007f8868cf0b77
[ 121.705831][ T6057] Code: 48 89 fa 4c 89 df e8 98 1d 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 121.725513][ T6057] RSP: 002b:00007ffeb08d8fe0 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
[ 121.733916][ T6057] RAX: ffffffffffffffda RBX: 000055555ef33400 RCX: 00007f8868cf0b77
[ 121.741877][ T6057] RDX: 000000000000001c RSI: 00007ffeb08d91e0 RDI: 0000000000000003
[ 121.749923][ T6057] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[ 121.757897][ T6057] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000032
[ 121.765855][ T6057] R13: 00007ffeb08d9040 R14: 0000000000000000 R15: 0000000000000000
[ 121.773820][ T6057]
[ 121.777164][ T6057] Kernel Offset: disabled
[ 121.781493][ T6057] Rebooting in 86400 seconds..