Warning: Permanently added '10.128.10.21' (ED25519) to the list of known hosts. 1970/01/01 00:01:00 ignoring optional flag "sandboxArg"="0" 1970/01/01 00:01:00 parsed 1 programs [ 60.606748][ T6516] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS 1970/01/01 00:01:00 executed programs: 0 [ 60.641370][ T5740] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 60.643820][ T5740] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 60.646039][ T5740] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 60.648711][ T5740] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 60.651420][ T5740] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 60.653378][ T5740] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 60.718016][ T6523] chnl_net:caif_netlink_parms(): no params data found [ 60.743584][ T6523] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.745433][ T6523] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.747278][ T6523] bridge_slave_0: entered allmulticast mode [ 60.749245][ T6523] bridge_slave_0: entered promiscuous mode [ 60.753272][ T6523] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.755120][ T6523] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.756951][ T6523] bridge_slave_1: entered allmulticast mode [ 60.758951][ T6523] bridge_slave_1: entered promiscuous mode [ 60.769707][ T6523] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 60.773464][ T6523] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 60.785657][ T6523] team0: Port device team_slave_0 added [ 60.788523][ T6523] team0: Port device team_slave_1 added [ 60.798103][ T6523] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 60.799957][ T6523] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 60.806423][ T6523] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 60.810202][ T6523] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 60.812013][ T6523] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 60.818222][ T6523] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 60.880843][ T6523] hsr_slave_0: entered promiscuous mode [ 60.919564][ T6523] hsr_slave_1: entered promiscuous mode [ 61.576499][ T6523] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 61.610730][ T6523] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 61.660970][ T6523] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 61.701102][ T6523] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 61.757587][ T6523] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.759437][ T6523] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.761683][ T6523] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.763459][ T6523] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.767413][ T6180] bridge0: port 1(bridge_slave_0) entered disabled state [ 61.770233][ T6180] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.803750][ T6523] 8021q: adding VLAN 0 to HW filter on device bond0 [ 61.813114][ T6523] 8021q: adding VLAN 0 to HW filter on device team0 [ 61.817827][ T6180] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.819643][ T6180] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.824794][ T6180] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.826558][ T6180] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.907883][ T6523] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 61.931542][ T6523] veth0_vlan: entered promiscuous mode [ 61.936024][ T6523] veth1_vlan: entered promiscuous mode [ 61.950829][ T6523] veth0_macvtap: entered promiscuous mode [ 61.953875][ T6523] veth1_macvtap: entered promiscuous mode [ 61.961785][ T6523] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 61.966956][ T6523] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 61.972053][ T6523] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.974287][ T6523] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.976348][ T6523] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.978548][ T6523] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.012346][ T507] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 62.017282][ T507] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 62.027199][ T10] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 62.029203][ T10] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 62.568361][ T6668] FAULT_INJECTION: forcing a failure. [ 62.568361][ T6668] name failslab, interval 1, probability 0, space 0, times 0 [ 62.571820][ T6668] CPU: 1 PID: 6668 Comm: syz-executor.0 Not tainted 6.8.0-rc7-syzkaller-00135-g707081b61156 #0 [ 62.574411][ T6668] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 [ 62.577007][ T6668] Call trace: [ 62.577901][ T6668] dump_backtrace+0x1b8/0x1e4 [ 62.579100][ T6668] show_stack+0x2c/0x3c [ 62.580232][ T6668] dump_stack_lvl+0xd0/0x124 [ 62.581444][ T6668] dump_stack+0x1c/0x28 [ 62.582453][ T6668] should_fail_ex+0x3b0/0x50c [ 62.583768][ T6668] __should_failslab+0xc8/0x128 [ 62.584992][ T6668] should_failslab+0x10/0x28 [ 62.586164][ T6668] kmem_cache_alloc_node+0x88/0x4c0 [ 62.587472][ T6668] __alloc_skb+0x19c/0x3d8 [ 62.588615][ T6668] kcm_sendmsg+0x6c4/0x2124 [ 62.589838][ T6668] sock_sendmsg+0x220/0x2c0 [ 62.591029][ T6668] splice_to_socket+0x7cc/0xd58 [ 62.592304][ T6668] direct_splice_actor+0xec/0x1d8 [ 62.593636][ T6668] splice_direct_to_actor+0x438/0xa0c [ 62.595053][ T6668] do_splice_direct+0x1e4/0x304 [ 62.596301][ T6668] do_sendfile+0x460/0xb3c [ 62.597490][ T6668] __arm64_sys_sendfile64+0x160/0x3b4 [ 62.598827][ T6668] invoke_syscall+0x98/0x2b8 [ 62.599968][ T6668] el0_svc_common+0x130/0x23c [ 62.601219][ T6668] do_el0_svc+0x48/0x58 [ 62.602326][ T6668] el0_svc+0x54/0x168 [ 62.603401][ T6668] el0t_64_sync_handler+0x84/0xfc [ 62.604696][ T6668] el0t_64_sync+0x190/0x194 [ 62.670389][ T6666] ================================================================== [ 62.672424][ T6666] BUG: KASAN: slab-use-after-free in kcm_release+0x170/0x4c8 [ 62.674305][ T6666] Read of size 8 at addr ffff0000c90a1640 by task syz-executor.0/6666 [ 62.676242][ T6666] [ 62.676827][ T6666] CPU: 1 PID: 6666 Comm: syz-executor.0 Not tainted 6.8.0-rc7-syzkaller-00135-g707081b61156 #0 [ 62.679355][ T6666] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 [ 62.682048][ T6666] Call trace: [ 62.682937][ T6666] dump_backtrace+0x1b8/0x1e4 [ 62.684163][ T6666] show_stack+0x2c/0x3c [ 62.685261][ T6666] dump_stack_lvl+0xd0/0x124 [ 62.686458][ T6666] print_report+0x178/0x518 [ 62.687663][ T6666] kasan_report+0xd8/0x138 [ 62.688826][ T6666] __asan_report_load8_noabort+0x20/0x2c [ 62.690289][ T6666] kcm_release+0x170/0x4c8 [ 62.691469][ T6666] sock_close+0xa4/0x1e8 [ 62.692543][ T6666] __fput+0x30c/0x738 [ 62.693567][ T6666] __fput_sync+0x60/0x9c [ 62.694653][ T6666] __arm64_sys_close+0x150/0x1e0 [ 62.695932][ T6666] invoke_syscall+0x98/0x2b8 [ 62.697136][ T6666] el0_svc_common+0x130/0x23c [ 62.698325][ T6666] do_el0_svc+0x48/0x58 [ 62.699400][ T6666] el0_svc+0x54/0x168 [ 62.700391][ T6666] el0t_64_sync_handler+0x84/0xfc [ 62.701768][ T6666] el0t_64_sync+0x190/0x194 [ 62.702967][ T6666] [ 62.703545][ T6666] Allocated by task 6668: [ 62.704622][ T6666] kasan_save_track+0x40/0x78 [ 62.705846][ T6666] kasan_save_alloc_info+0x40/0x50 [ 62.707150][ T6666] __kasan_slab_alloc+0x74/0x8c [ 62.708353][ T6666] kmem_cache_alloc_node+0x204/0x4c0 [ 62.709650][ T6666] __alloc_skb+0x19c/0x3d8 [ 62.710753][ T6666] kcm_sendmsg+0x1d3c/0x2124 [ 62.711912][ T6666] sock_sendmsg+0x220/0x2c0 [ 62.713033][ T6666] splice_to_socket+0x7cc/0xd58 [ 62.714329][ T6666] direct_splice_actor+0xec/0x1d8 [ 62.715670][ T6666] splice_direct_to_actor+0x438/0xa0c [ 62.717057][ T6666] do_splice_direct+0x1e4/0x304 [ 62.718305][ T6666] do_sendfile+0x460/0xb3c [ 62.719460][ T6666] __arm64_sys_sendfile64+0x160/0x3b4 [ 62.720888][ T6666] invoke_syscall+0x98/0x2b8 [ 62.722088][ T6666] el0_svc_common+0x130/0x23c [ 62.723285][ T6666] do_el0_svc+0x48/0x58 [ 62.724405][ T6666] el0_svc+0x54/0x168 [ 62.725378][ T6666] el0t_64_sync_handler+0x84/0xfc [ 62.726661][ T6666] el0t_64_sync+0x190/0x194 [ 62.727780][ T6666] [ 62.728379][ T6666] Freed by task 6666: [ 62.729355][ T6666] kasan_save_track+0x40/0x78 [ 62.730566][ T6666] kasan_save_free_info+0x54/0x6c [ 62.731895][ T6666] poison_slab_object+0x124/0x18c [ 62.733112][ T6666] __kasan_slab_free+0x3c/0x70 [ 62.734323][ T6666] kmem_cache_free+0x15c/0x3d4 [ 62.735553][ T6666] kfree_skbmem+0x10c/0x19c [ 62.736720][ T6666] kfree_skb_reason+0x240/0x6f4 [ 62.737916][ T6666] kcm_release+0x104/0x4c8 [ 62.739065][ T6666] sock_close+0xa4/0x1e8 [ 62.740159][ T6666] __fput+0x30c/0x738 [ 62.741142][ T6666] __fput_sync+0x60/0x9c [ 62.742211][ T6666] __arm64_sys_close+0x150/0x1e0 [ 62.743498][ T6666] invoke_syscall+0x98/0x2b8 [ 62.744697][ T6666] el0_svc_common+0x130/0x23c [ 62.745862][ T6666] do_el0_svc+0x48/0x58 [ 62.746950][ T6666] el0_svc+0x54/0x168 [ 62.748041][ T6666] el0t_64_sync_handler+0x84/0xfc [ 62.749326][ T6666] el0t_64_sync+0x190/0x194 [ 62.750479][ T6666] [ 62.751086][ T6666] The buggy address belongs to the object at ffff0000c90a1640 [ 62.751086][ T6666] which belongs to the cache skbuff_head_cache of size 240 [ 62.754850][ T6666] The buggy address is located 0 bytes inside of [ 62.754850][ T6666] freed 240-byte region [ffff0000c90a1640, ffff0000c90a1730) [ 62.758412][ T6666] [ 62.758992][ T6666] The buggy address belongs to the physical page: [ 62.760590][ T6666] page:000000006fbdc080 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1090a1 [ 62.763084][ T6666] anon flags: 0x5ffc00000000800(slab|node=0|zone=2|lastcpupid=0x7ff) [ 62.765162][ T6666] page_type: 0xffffffff() [ 62.766296][ T6666] raw: 05ffc00000000800 ffff0000c1bb5640 fffffdffc34b5b40 dead000000000005 [ 62.768418][ T6666] raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 [ 62.770744][ T6666] page dumped because: kasan: bad access detected [ 62.772350][ T6666] [ 62.772929][ T6666] Memory state around the buggy address: [ 62.774361][ T6666] ffff0000c90a1500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 62.776484][ T6666] ffff0000c90a1580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc [ 62.778585][ T6666] >ffff0000c90a1600: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 62.780589][ T6666] ^ [ 62.782181][ T6666] ffff0000c90a1680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 62.784304][ T6666] ffff0000c90a1700: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc [ 62.786267][ T6666] ================================================================== [ 62.788535][ T5740] Bluetooth: hci0: command 0x0409 tx timeout [ 62.796983][ T6666] Disabling lock debugging due to kernel taint [ 62.798692][ T6666] Unable to handle kernel paging request at virtual address e0dc4075c0000341 [ 62.801923][ T6666] KASAN: maybe wild-memory-access in range [0x06e603ae00001a08-0x06e603ae00001a0f] [ 62.804289][ T6666] Mem abort info: [ 62.805253][ T6666] ESR = 0x0000000096000004 [ 62.806416][ T6666] EC = 0x25: DABT (current EL), IL = 32 bits [ 62.807951][ T6666] SET = 0, FnV = 0 [ 62.808920][ T6666] EA = 0, S1PTW = 0 [ 62.810695][ T6666] FSC = 0x04: level 0 translation fault [ 62.812206][ T6666] Data abort info: [ 62.813118][ T6666] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 62.814712][ T6666] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 62.816279][ T6666] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 62.817919][ T6666] [e0dc4075c0000341] address between user and kernel address ranges [ 62.820584][ T6666] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 62.822565][ T6666] Modules linked in: [ 62.823580][ T6666] CPU: 1 PID: 6666 Comm: syz-executor.0 Tainted: G B 6.8.0-rc7-syzkaller-00135-g707081b61156 #0 [ 62.826652][ T6666] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 [ 62.829228][ T6666] pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 62.831392][ T6666] pc : kcm_release+0x1bc/0x4c8 [ 62.832715][ T6666] lr : kcm_release+0x1b4/0x4c8 [ 62.834018][ T6666] sp : ffff800097947bc0 [ 62.835109][ T6666] x29: ffff800097947be0 x28: 1fffe00019114201 x27: 1fffe00019114203 [ 62.837299][ T6666] x26: dfff800000000000 x25: ffff0000cde52808 x24: 06e603ae00001a0a [ 62.839531][ T6666] x23: ffff0000c90a1640 x22: ffff0000c88a1018 x21: ffff0000c88a1008 [ 62.841649][ T6666] x20: ffff0000c88a0d80 x19: ffff0000cde52800 x18: 1fffe00036804396 [ 62.843811][ T6666] x17: 0000000000000000 x16: ffff8000809fd7b4 x15: ffff6000192142c8 [ 62.845931][ T6666] x14: 1fffe000192142c8 x13: 00000000000000fa x12: fffffffffffffffe [ 62.848034][ T6666] x11: ffff6000192142c8 x10: 1fffe000192142c9 x9 : ffff800093486880 [ 62.850267][ T6666] x8 : 00dcc075c0000341 x7 : 0000000000000000 x6 : 0000000000000001 [ 62.852387][ T6666] x5 : ffff8000979473b8 x4 : 0000000000000000 x3 : ffff80008a176148 [ 62.854594][ T6666] x2 : 0000000000000001 x1 : 0000000000000008 x0 : 0000000000000000 [ 62.856792][ T6666] Call trace: [ 62.857661][ T6666] kcm_release+0x1bc/0x4c8 [ 62.858854][ T6666] sock_close+0xa4/0x1e8 [ 62.859995][ T6666] __fput+0x30c/0x738 [ 62.861093][ T6666] __fput_sync+0x60/0x9c [ 62.862260][ T6666] __arm64_sys_close+0x150/0x1e0 [ 62.863605][ T6666] invoke_syscall+0x98/0x2b8 [ 62.864846][ T6666] el0_svc_common+0x130/0x23c [ 62.866055][ T6666] do_el0_svc+0x48/0x58 [ 62.867201][ T6666] el0_svc+0x54/0x168 [ 62.868301][ T6666] el0t_64_sync_handler+0x84/0xfc [ 62.869632][ T6666] el0t_64_sync+0x190/0x194 [ 62.870862][ T6666] Code: aa1903e0 9776b49f d343ff08 f9000338 (387a6908) [ 62.872717][ T6666] ---[ end trace 0000000000000000 ]--- [ 63.259413][ T6666] Kernel panic - not syncing: Oops: Fatal exception [ 63.261003][ T6666] SMP: stopping secondary CPUs [ 63.262258][ T6666] Kernel Offset: disabled [ 63.263393][ T6666] CPU features: 0x0,00000081,c0080094,42017203 [ 63.265023][ T6666] Memory Limit: none [ 63.642389][ T6666] Rebooting in 86400 seconds..