Warning: Permanently added '10.128.0.156' (ED25519) to the list of known hosts. [ 81.253785][ T1141] cfg80211: failed to load regulatory.db 2024/10/02 23:13:26 ignoring optional flag "sandboxArg"="0" 2024/10/02 23:13:26 ignoring optional flag "type"="gce" 2024/10/02 23:13:27 parsed 1 programs 2024/10/02 23:13:28 executed programs: 0 [ 83.519383][ T5395] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 83.585193][ T4489] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 83.593449][ T4489] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 83.601223][ T4489] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 83.610140][ T4489] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 83.618758][ T4489] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 83.626405][ T4489] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 83.748186][ T5402] chnl_net:caif_netlink_parms(): no params data found [ 83.805407][ T5402] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.812756][ T5402] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.820042][ T5402] bridge_slave_0: entered allmulticast mode [ 83.827652][ T5402] bridge_slave_0: entered promiscuous mode [ 83.835673][ T5402] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.843205][ T5402] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.850451][ T5402] bridge_slave_1: entered allmulticast mode [ 83.857573][ T5402] bridge_slave_1: entered promiscuous mode [ 83.883301][ T5402] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.895091][ T5402] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.922674][ T5402] team0: Port device team_slave_0 added [ 83.931544][ T5402] team0: Port device team_slave_1 added [ 83.955213][ T5402] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.962745][ T5402] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.988834][ T5402] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.001892][ T5402] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.008857][ T5402] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.035260][ T5402] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.071125][ T5402] hsr_slave_0: entered promiscuous mode [ 84.077792][ T5402] hsr_slave_1: entered promiscuous mode [ 84.577623][ T5402] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 84.588250][ T5402] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 84.601305][ T5402] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 84.614297][ T5402] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 84.640325][ T5402] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.647566][ T5402] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.655100][ T5402] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.662385][ T5402] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.734092][ T5402] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.755120][ T35] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.765178][ T35] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.785888][ T5402] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.801315][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.808666][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.823618][ T695] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.830794][ T695] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.039795][ T5402] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.098494][ T5402] veth0_vlan: entered promiscuous mode [ 85.116766][ T5402] veth1_vlan: entered promiscuous mode [ 85.150270][ T5402] veth0_macvtap: entered promiscuous mode [ 85.165555][ T5402] veth1_macvtap: entered promiscuous mode [ 85.189875][ T5402] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.206716][ T5402] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.224213][ T5402] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.235830][ T5402] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.245834][ T5402] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.256187][ T5402] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.330974][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.350776][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.376171][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.385578][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.652871][ T4489] Bluetooth: hci0: command tx timeout [ 87.732429][ T4489] Bluetooth: hci0: command 0x041b tx timeout 2024/10/02 23:13:34 executed programs: 4 [ 89.812202][ T4489] Bluetooth: hci0: command 0x041b tx timeout [ 91.894122][ T54] Bluetooth: hci0: command 0x041b tx timeout [ 93.982003][ T4489] Bluetooth: hci0: command 0x041b tx timeout 2024/10/02 23:13:39 executed programs: 11 [ 96.052004][ T4489] Bluetooth: hci0: command 0x041b tx timeout 2024/10/02 23:13:44 executed programs: 17 2024/10/02 23:13:49 executed programs: 23 2024/10/02 23:13:54 executed programs: 29 2024/10/02 23:14:00 executed programs: 35 2024/10/02 23:14:05 executed programs: 41 2024/10/02 23:14:10 executed programs: 47 2024/10/02 23:14:15 executed programs: 53 [ 132.454110][ T1238] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.460681][ T1238] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.733344][ T5112] ================================================================== [ 133.741443][ T5112] BUG: KASAN: slab-use-after-free in sco_sock_timeout+0x8b/0x270 [ 133.749224][ T5112] Write of size 4 at addr ffff8881442d6080 by task kworker/1:3/5112 [ 133.757215][ T5112] [ 133.759558][ T5112] CPU: 1 UID: 0 PID: 5112 Comm: kworker/1:3 Not tainted 6.12.0-rc1-syzkaller-gf23aa4c0761a-dirty #0 [ 133.770379][ T5112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 133.780472][ T5112] Workqueue: events sco_sock_timeout [ 133.785809][ T5112] Call Trace: [ 133.789174][ T5112] [ 133.792118][ T5112] dump_stack_lvl+0x241/0x360 [ 133.796902][ T5112] ? __pfx_dump_stack_lvl+0x10/0x10 [ 133.802109][ T5112] ? __pfx__printk+0x10/0x10 [ 133.806703][ T5112] ? _printk+0xd5/0x120 [ 133.810863][ T5112] ? __virt_addr_valid+0x183/0x530 [ 133.815997][ T5112] ? srso_alias_return_thunk+0x5/0xfbef5 [ 133.821682][ T5112] print_report+0x169/0x550 [ 133.826817][ T5112] ? __virt_addr_valid+0x183/0x530 [ 133.831936][ T5112] ? srso_alias_return_thunk+0x5/0xfbef5 [ 133.837592][ T5112] ? __virt_addr_valid+0x45f/0x530 [ 133.842705][ T5112] ? srso_alias_return_thunk+0x5/0xfbef5 [ 133.848428][ T5112] ? __phys_addr+0xba/0x170 [ 133.852979][ T5112] ? sco_sock_timeout+0x8b/0x270 [ 133.858066][ T5112] kasan_report+0x143/0x180 [ 133.862698][ T5112] ? __pfx_lock_acquire+0x10/0x10 [ 133.867747][ T5112] ? sco_sock_timeout+0x8b/0x270 [ 133.872795][ T5112] kasan_check_range+0x282/0x290 [ 133.877766][ T5112] sco_sock_timeout+0x8b/0x270 [ 133.882569][ T5112] ? process_scheduled_works+0x976/0x1850 [ 133.888323][ T5112] process_scheduled_works+0xa65/0x1850 [ 133.893909][ T5112] ? __pfx_process_scheduled_works+0x10/0x10 [ 133.899917][ T5112] ? assign_work+0x364/0x3d0 [ 133.904570][ T5112] worker_thread+0x870/0xd30 [ 133.909201][ T5112] ? __kthread_parkme+0x169/0x1d0 [ 133.914253][ T5112] ? __pfx_worker_thread+0x10/0x10 [ 133.919584][ T5112] kthread+0x2f2/0x390 [ 133.923694][ T5112] ? __pfx_worker_thread+0x10/0x10 [ 133.928845][ T5112] ? __pfx_kthread+0x10/0x10 [ 133.933474][ T5112] ret_from_fork+0x4d/0x80 [ 133.937941][ T5112] ? __pfx_kthread+0x10/0x10 [ 133.942557][ T5112] ret_from_fork_asm+0x1a/0x30 [ 133.947387][ T5112] [ 133.950408][ T5112] [ 133.952729][ T5112] Allocated by task 5785: [ 133.957141][ T5112] kasan_save_track+0x3f/0x80 [ 133.961837][ T5112] __kasan_kmalloc+0x98/0xb0 [ 133.966442][ T5112] __kmalloc_noprof+0x1fc/0x400 [ 133.971297][ T5112] sk_prot_alloc+0xe0/0x210 [ 133.975804][ T5112] sk_alloc+0x38/0x370 [ 133.979877][ T5112] bt_sock_alloc+0x3c/0x340 [ 133.984393][ T5112] sco_sock_create+0xbb/0x390 [ 133.989091][ T5112] bt_sock_create+0x163/0x230 [ 133.993813][ T5112] __sock_create+0x492/0x920 [ 133.998405][ T5112] __sys_socket+0x150/0x3c0 [ 134.002906][ T5112] __x64_sys_socket+0x7a/0x90 [ 134.007586][ T5112] do_syscall_64+0xf3/0x230 [ 134.012106][ T5112] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.018011][ T5112] [ 134.020324][ T5112] Freed by task 5786: [ 134.024306][ T5112] kasan_save_track+0x3f/0x80 [ 134.029013][ T5112] kasan_save_free_info+0x40/0x50 [ 134.034048][ T5112] __kasan_slab_free+0x59/0x70 [ 134.038820][ T5112] kfree+0x1a0/0x440 [ 134.042731][ T5112] __sk_destruct+0x479/0x5f0 [ 134.047373][ T5112] sco_sock_release+0x25e/0x320 [ 134.052235][ T5112] sock_close+0xbe/0x240 [ 134.056480][ T5112] __fput+0x241/0x880 [ 134.060461][ T5112] task_work_run+0x251/0x310 [ 134.065053][ T5112] get_signal+0x15e8/0x1740 [ 134.069559][ T5112] arch_do_signal_or_restart+0x96/0x860 [ 134.075108][ T5112] syscall_exit_to_user_mode+0xc9/0x370 [ 134.080750][ T5112] do_syscall_64+0x100/0x230 [ 134.085362][ T5112] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.091290][ T5112] [ 134.093613][ T5112] The buggy address belongs to the object at ffff8881442d6000 [ 134.093613][ T5112] which belongs to the cache kmalloc-2k of size 2048 [ 134.107728][ T5112] The buggy address is located 128 bytes inside of [ 134.107728][ T5112] freed 2048-byte region [ffff8881442d6000, ffff8881442d6800) [ 134.121717][ T5112] [ 134.124044][ T5112] The buggy address belongs to the physical page: [ 134.130454][ T5112] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1442d0 [ 134.139341][ T5112] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 134.147855][ T5112] anon flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff) [ 134.155980][ T5112] page_type: f5(slab) [ 134.159986][ T5112] raw: 057ff00000000040 ffff888015442000 0000000000000000 dead000000000001 [ 134.168622][ T5112] raw: 0000000000000000 0000000000080008 00000001f5000000 0000000000000000 [ 134.177420][ T5112] head: 057ff00000000040 ffff888015442000 0000000000000000 dead000000000001 [ 134.186097][ T5112] head: 0000000000000000 0000000000080008 00000001f5000000 0000000000000000 [ 134.194772][ T5112] head: 057ff00000000003 ffffea000510b401 ffffffffffffffff 0000000000000000 [ 134.203451][ T5112] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 134.212131][ T5112] page dumped because: kasan: bad access detected [ 134.218537][ T5112] page_owner tracks the page as allocated [ 134.224265][ T5112] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 2464151042, free_ts 0 [ 134.243979][ T5112] post_alloc_hook+0x1f3/0x230 [ 134.248759][ T5112] get_page_from_freelist+0x3045/0x3190 [ 134.254334][ T5112] __alloc_pages_noprof+0x256/0x6c0 [ 134.259549][ T5112] alloc_pages_mpol_noprof+0x3e8/0x680 [ 134.265014][ T5112] alloc_slab_page+0x6a/0x120 [ 134.269698][ T5112] allocate_slab+0x5a/0x2f0 [ 134.274242][ T5112] ___slab_alloc+0xcd1/0x14b0 [ 134.278937][ T5112] __slab_alloc+0x58/0xa0 [ 134.283278][ T5112] __kmalloc_cache_noprof+0x1d5/0x2c0 [ 134.288650][ T5112] acpi_ds_create_walk_state+0x103/0x2a0 [ 134.294321][ T5112] acpi_ps_execute_method+0x245/0x880 [ 134.299704][ T5112] acpi_ns_evaluate+0x5df/0xa40 [ 134.304550][ T5112] acpi_evaluate_object+0x59b/0xaf0 [ 134.309753][ T5112] acpi_get_phys_id+0xa5/0xd00 [ 134.314540][ T5112] acpi_get_cpuid+0x28/0x1f0 [ 134.319168][ T5112] processor_physically_present+0x29a/0x380 [ 134.325237][ T5112] page_owner free stack trace missing [ 134.330636][ T5112] [ 134.332977][ T5112] Memory state around the buggy address: [ 134.338622][ T5112] ffff8881442d5f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 134.346733][ T5112] ffff8881442d6000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 134.354835][ T5112] >ffff8881442d6080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 134.362919][ T5112] ^ [ 134.367013][ T5112] ffff8881442d6100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 134.375109][ T5112] ffff8881442d6180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 134.383177][ T5112] ================================================================== [ 134.392121][ T5112] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 134.399339][ T5112] CPU: 1 UID: 0 PID: 5112 Comm: kworker/1:3 Not tainted 6.12.0-rc1-syzkaller-gf23aa4c0761a-dirty #0 [ 134.410131][ T5112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 134.420208][ T5112] Workqueue: events sco_sock_timeout [ 134.425538][ T5112] Call Trace: [ 134.428820][ T5112] [ 134.431746][ T5112] dump_stack_lvl+0x241/0x360 [ 134.436484][ T5112] ? __pfx_dump_stack_lvl+0x10/0x10 [ 134.441701][ T5112] ? __pfx__printk+0x10/0x10 [ 134.446479][ T5112] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 134.452485][ T5112] ? srso_alias_return_thunk+0x5/0xfbef5 [ 134.458136][ T5112] ? vscnprintf+0x5d/0x90 [ 134.462481][ T5112] panic+0x349/0x880 [ 134.466470][ T5112] ? check_panic_on_warn+0x21/0xb0 [ 134.471617][ T5112] ? __pfx_panic+0x10/0x10 [ 134.476042][ T5112] ? _raw_spin_unlock_irqrestore+0xd8/0x140 [ 134.481968][ T5112] ? srso_alias_return_thunk+0x5/0xfbef5 [ 134.487623][ T5112] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 134.493536][ T5112] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 134.500004][ T5112] check_panic_on_warn+0x86/0xb0 [ 134.504951][ T5112] ? sco_sock_timeout+0x8b/0x270 [ 134.509949][ T5112] end_report+0x77/0x160 [ 134.514214][ T5112] kasan_report+0x154/0x180 [ 134.518796][ T5112] ? __pfx_lock_acquire+0x10/0x10 [ 134.523870][ T5112] ? sco_sock_timeout+0x8b/0x270 [ 134.528915][ T5112] kasan_check_range+0x282/0x290 [ 134.533867][ T5112] sco_sock_timeout+0x8b/0x270 [ 134.538653][ T5112] ? process_scheduled_works+0x976/0x1850 [ 134.544396][ T5112] process_scheduled_works+0xa65/0x1850 [ 134.549976][ T5112] ? __pfx_process_scheduled_works+0x10/0x10 [ 134.555972][ T5112] ? assign_work+0x364/0x3d0 [ 134.560576][ T5112] worker_thread+0x870/0xd30 [ 134.565189][ T5112] ? __kthread_parkme+0x169/0x1d0 [ 134.570230][ T5112] ? __pfx_worker_thread+0x10/0x10 [ 134.575361][ T5112] kthread+0x2f2/0x390 [ 134.579442][ T5112] ? __pfx_worker_thread+0x10/0x10 [ 134.584568][ T5112] ? __pfx_kthread+0x10/0x10 [ 134.589164][ T5112] ret_from_fork+0x4d/0x80 [ 134.593597][ T5112] ? __pfx_kthread+0x10/0x10 [ 134.598190][ T5112] ret_from_fork_asm+0x1a/0x30 [ 134.602973][ T5112] [ 134.606287][ T5112] Kernel Offset: disabled [ 134.610623][ T5112] Rebooting in 86400 seconds..