Warning: Permanently added '10.128.1.85' (ED25519) to the list of known hosts. 2024/10/02 16:53:21 ignoring optional flag "sandboxArg"="0" 2024/10/02 16:53:21 ignoring optional flag "type"="gce" 2024/10/02 16:53:22 parsed 1 programs 2024/10/02 16:53:22 executed programs: 0 [ 62.057032][ T3851] chnl_net:caif_netlink_parms(): no params data found [ 62.094107][ T3851] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.101203][ T3851] bridge0: port 1(bridge_slave_0) entered disabled state [ 62.109650][ T3851] device bridge_slave_0 entered promiscuous mode [ 62.117870][ T3851] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.124988][ T3851] bridge0: port 2(bridge_slave_1) entered disabled state [ 62.132867][ T3851] device bridge_slave_1 entered promiscuous mode [ 62.152322][ T3851] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 62.163251][ T3851] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 62.184248][ T3851] team0: Port device team_slave_0 added [ 62.191479][ T3851] team0: Port device team_slave_1 added [ 62.208263][ T3851] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 62.215903][ T3851] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 62.241907][ T3851] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 62.253727][ T3851] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 62.260756][ T3851] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 62.287345][ T3851] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 62.314322][ T3851] device hsr_slave_0 entered promiscuous mode [ 62.320878][ T3851] device hsr_slave_1 entered promiscuous mode [ 62.740020][ T3851] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 62.752202][ T3851] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 62.762913][ T3851] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 62.773130][ T3851] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 62.796062][ T3851] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.803374][ T3851] bridge0: port 2(bridge_slave_1) entered forwarding state [ 62.811090][ T3851] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.818244][ T3851] bridge0: port 1(bridge_slave_0) entered forwarding state [ 62.871637][ T3851] 8021q: adding VLAN 0 to HW filter on device bond0 [ 62.886790][ T1210] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 62.895312][ T1210] bridge0: port 1(bridge_slave_0) entered disabled state [ 62.904222][ T1210] bridge0: port 2(bridge_slave_1) entered disabled state [ 62.912515][ T1210] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 62.928070][ T3851] 8021q: adding VLAN 0 to HW filter on device team0 [ 62.940652][ T1210] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 62.951065][ T1210] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.958280][ T1210] bridge0: port 1(bridge_slave_0) entered forwarding state [ 62.979362][ T1210] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 62.988608][ T1210] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.995826][ T1210] bridge0: port 2(bridge_slave_1) entered forwarding state [ 63.016148][ T1210] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 63.025399][ T1210] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 63.035984][ T1210] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 63.058896][ T3851] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 63.071527][ T3851] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 63.084328][ T1239] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 63.096263][ T1239] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 63.106389][ T1239] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 63.117077][ T1239] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 63.125930][ T1239] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 63.240514][ T1210] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 63.250812][ T1210] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 63.265274][ T3851] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 63.289614][ T1210] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 63.300412][ T1210] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 63.318229][ T1210] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 63.326887][ T1210] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 63.337234][ T1210] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 63.345578][ T1210] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 63.355997][ T3851] device veth0_vlan entered promiscuous mode [ 63.368702][ T3851] device veth1_vlan entered promiscuous mode [ 63.389072][ T1210] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 63.397704][ T1210] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 63.406690][ T1210] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 63.416157][ T1210] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 63.427187][ T3851] device veth0_macvtap entered promiscuous mode [ 63.438358][ T3851] device veth1_macvtap entered promiscuous mode [ 63.455564][ T3851] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 63.465217][ T1210] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 63.473858][ T1210] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 63.482324][ T1210] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 63.493716][ T1210] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 63.508500][ T3851] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 63.517249][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 63.527955][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 63.539036][ T3851] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.549304][ T3851] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.559401][ T3851] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.568803][ T3851] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.637764][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 63.660096][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 63.682578][ T1239] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 63.685509][ T1210] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 63.690923][ T1239] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 63.708433][ T1239] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 63.800479][ T3948] loop0: detected capacity change from 0 to 4096 [ 63.855119][ T3948] ntfs: volume version 3.1. [ 63.868086][ T3948] ================================================================== [ 63.876176][ T3948] BUG: KASAN: use-after-free in ntfs_lookup_inode_by_name+0xe8d/0x3200 [ 63.884538][ T3948] Read of size 8 at addr ffff88807015555a by task syz-executor.0/3948 [ 63.892689][ T3948] [ 63.895021][ T3948] CPU: 0 PID: 3948 Comm: syz-executor.0 Not tainted 5.15.167-syzkaller #0 [ 63.903523][ T3948] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 63.913591][ T3948] Call Trace: [ 63.916875][ T3948] [ 63.919808][ T3948] dump_stack_lvl+0x1e3/0x2d0 [ 63.924498][ T3948] ? io_uring_drop_tctx_refs+0x1a0/0x1a0 [ 63.930138][ T3948] ? _printk+0xd1/0x120 [ 63.934307][ T3948] ? __wake_up_klogd+0xcc/0x100 [ 63.939164][ T3948] ? panic+0x860/0x860 [ 63.943247][ T3948] ? _raw_spin_lock_irqsave+0xdd/0x120 [ 63.948733][ T3948] print_address_description+0x63/0x3b0 [ 63.954289][ T3948] ? ntfs_lookup_inode_by_name+0xe8d/0x3200 [ 63.960192][ T3948] kasan_report+0x16b/0x1c0 [ 63.964706][ T3948] ? ntfs_lookup_inode_by_name+0xe8d/0x3200 [ 63.970618][ T3948] ntfs_lookup_inode_by_name+0xe8d/0x3200 [ 63.976372][ T3948] ? do_raw_spin_lock+0x14a/0x370 [ 63.981579][ T3948] ? rwsem_write_trylock+0x166/0x210 [ 63.986897][ T3948] check_windows_hibernation_status+0xfc/0x6f0 [ 63.993064][ T3948] ? load_and_check_logfile+0xd0/0xd0 [ 63.998444][ T3948] ? rcu_is_watching+0x11/0xa0 [ 64.003215][ T3948] ? load_system_files+0x3f7f/0x5700 [ 64.008506][ T3948] ? kfree+0x4a/0x270 [ 64.012506][ T3948] load_system_files+0x4041/0x5700 [ 64.017642][ T3948] ? ntfs_setup_allocators+0x2d0/0x2d0 [ 64.023124][ T3948] ? memset+0x1f/0x40 [ 64.027115][ T3948] ? generate_default_upcase+0x8e9/0x930 [ 64.032760][ T3948] ntfs_fill_super+0x1c7f/0x2e20 [ 64.037716][ T3948] mount_bdev+0x2c9/0x3f0 [ 64.042061][ T3948] ? ntfs_mount+0x40/0x40 [ 64.046485][ T3948] legacy_get_tree+0xeb/0x180 [ 64.051182][ T3948] ? ntfs_rl_punch_nolock+0x15b0/0x15b0 [ 64.056736][ T3948] vfs_get_tree+0x88/0x270 [ 64.061162][ T3948] do_new_mount+0x2ba/0xb40 [ 64.065681][ T3948] ? do_move_mount_old+0x160/0x160 [ 64.070796][ T3948] ? user_path_at_empty+0x12b/0x180 [ 64.076006][ T3948] __se_sys_mount+0x2d5/0x3c0 [ 64.080689][ T3948] ? __x64_sys_mount+0xc0/0xc0 [ 64.085458][ T3948] ? syscall_enter_from_user_mode+0x2e/0x240 [ 64.091447][ T3948] ? lockdep_hardirqs_on+0x94/0x130 [ 64.096654][ T3948] ? __x64_sys_mount+0x1c/0xc0 [ 64.101426][ T3948] do_syscall_64+0x3b/0xb0 [ 64.106113][ T3948] ? clear_bhb_loop+0x15/0x70 [ 64.110801][ T3948] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 64.116703][ T3948] RIP: 0033:0x7f6f6751805a [ 64.121131][ T3948] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 09 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 64.140925][ T3948] RSP: 002b:00007f6f66897ee8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 64.149433][ T3948] RAX: ffffffffffffffda RBX: 00007f6f66897f80 RCX: 00007f6f6751805a [ 64.157498][ T3948] RDX: 000000002001ec80 RSI: 000000002001ecc0 RDI: 00007f6f66897f40 [ 64.165475][ T3948] RBP: 000000002001ec80 R08: 00007f6f66897f80 R09: 0000000000000000 [ 64.173456][ T3948] R10: 0000000000000000 R11: 0000000000000246 R12: 000000002001ecc0 [ 64.181441][ T3948] R13: 00007f6f66897f40 R14: 000000000001ec6a R15: 000000002001ed00 [ 64.189534][ T3948] [ 64.192557][ T3948] [ 64.194883][ T3948] The buggy address belongs to the page: [ 64.200514][ T3948] page:ffffea0001c05540 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x70155 [ 64.210676][ T3948] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 64.217801][ T3948] raw: 00fff00000000000 ffffea0001c054c8 ffffea0001c05388 0000000000000000 [ 64.226407][ T3948] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 64.235049][ T3948] page dumped because: kasan: bad access detected [ 64.241470][ T3948] page_owner tracks the page as freed [ 64.246834][ T3948] page last allocated via order 0, migratetype Movable, gfp_mask 0x1100dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO), pid 3727, ts 54550317395, free_ts 54776365940 [ 64.262640][ T3948] get_page_from_freelist+0x322a/0x33c0 [ 64.268550][ T3948] __alloc_pages+0x272/0x700 [ 64.273154][ T3948] alloc_pages_vma+0x39a/0x800 [ 64.277928][ T3948] handle_mm_fault+0x2f49/0x5960 [ 64.282883][ T3948] exc_page_fault+0x271/0x700 [ 64.287636][ T3948] asm_exc_page_fault+0x22/0x30 [ 64.292496][ T3948] page last free stack trace: [ 64.297166][ T3948] free_unref_page_prepare+0xc34/0xcf0 [ 64.302636][ T3948] free_unref_page_list+0x1f7/0x8e0 [ 64.307836][ T3948] release_pages+0x1bb9/0x1f40 [ 64.312652][ T3948] tlb_finish_mmu+0x177/0x320 [ 64.317510][ T3948] unmap_region+0x304/0x350 [ 64.322017][ T3948] __do_munmap+0x12db/0x1740 [ 64.326612][ T3948] __vm_munmap+0x134/0x230 [ 64.331035][ T3948] __x64_sys_munmap+0x67/0x70 [ 64.335718][ T3948] do_syscall_64+0x3b/0xb0 [ 64.340144][ T3948] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 64.346044][ T3948] [ 64.348362][ T3948] Memory state around the buggy address: [ 64.354171][ T3948] ffff888070155400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 64.362402][ T3948] ffff888070155480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 64.370558][ T3948] >ffff888070155500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 64.378709][ T3948] ^ [ 64.385742][ T3948] ffff888070155580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 64.393804][ T3948] ffff888070155600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 64.401864][ T3948] ================================================================== [ 64.410060][ T3948] Disabling lock debugging due to kernel taint [ 64.417364][ T3587] Bluetooth: hci0: command 0x0409 tx timeout [ 64.432236][ T3948] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 64.439450][ T3948] CPU: 0 PID: 3948 Comm: syz-executor.0 Tainted: G B 5.15.167-syzkaller #0 [ 64.449433][ T3948] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 64.459585][ T3948] Call Trace: [ 64.462953][ T3948] [ 64.465880][ T3948] dump_stack_lvl+0x1e3/0x2d0 [ 64.470565][ T3948] ? io_uring_drop_tctx_refs+0x1a0/0x1a0 [ 64.476397][ T3948] ? panic+0x860/0x860 [ 64.480484][ T3948] ? preempt_schedule_common+0xa6/0xd0 [ 64.486039][ T3948] ? preempt_schedule+0xd9/0xe0 [ 64.491081][ T3948] panic+0x318/0x860 [ 64.495001][ T3948] ? check_panic_on_warn+0x1d/0xa0 [ 64.500228][ T3948] ? fb_is_primary_device+0xd0/0xd0 [ 64.505525][ T3948] ? _raw_spin_unlock_irqrestore+0x128/0x130 [ 64.511513][ T3948] ? _raw_spin_unlock+0x40/0x40 [ 64.516421][ T3948] check_panic_on_warn+0x7e/0xa0 [ 64.521368][ T3948] ? ntfs_lookup_inode_by_name+0xe8d/0x3200 [ 64.527276][ T3948] end_report+0x6d/0xf0 [ 64.531442][ T3948] kasan_report+0x18e/0x1c0 [ 64.536038][ T3948] ? ntfs_lookup_inode_by_name+0xe8d/0x3200 [ 64.542027][ T3948] ntfs_lookup_inode_by_name+0xe8d/0x3200 [ 64.547754][ T3948] ? do_raw_spin_lock+0x14a/0x370 [ 64.552784][ T3948] ? rwsem_write_trylock+0x166/0x210 [ 64.558081][ T3948] check_windows_hibernation_status+0xfc/0x6f0 [ 64.564331][ T3948] ? load_and_check_logfile+0xd0/0xd0 [ 64.569712][ T3948] ? rcu_is_watching+0x11/0xa0 [ 64.574482][ T3948] ? load_system_files+0x3f7f/0x5700 [ 64.579867][ T3948] ? kfree+0x4a/0x270 [ 64.583863][ T3948] load_system_files+0x4041/0x5700 [ 64.588988][ T3948] ? ntfs_setup_allocators+0x2d0/0x2d0 [ 64.594455][ T3948] ? memset+0x1f/0x40 [ 64.598437][ T3948] ? generate_default_upcase+0x8e9/0x930 [ 64.604079][ T3948] ntfs_fill_super+0x1c7f/0x2e20 [ 64.609030][ T3948] mount_bdev+0x2c9/0x3f0 [ 64.613366][ T3948] ? ntfs_mount+0x40/0x40 [ 64.617708][ T3948] legacy_get_tree+0xeb/0x180 [ 64.622387][ T3948] ? ntfs_rl_punch_nolock+0x15b0/0x15b0 [ 64.627940][ T3948] vfs_get_tree+0x88/0x270 [ 64.632362][ T3948] do_new_mount+0x2ba/0xb40 [ 64.636867][ T3948] ? do_move_mount_old+0x160/0x160 [ 64.641985][ T3948] ? user_path_at_empty+0x12b/0x180 [ 64.647188][ T3948] __se_sys_mount+0x2d5/0x3c0 [ 64.651885][ T3948] ? __x64_sys_mount+0xc0/0xc0 [ 64.656706][ T3948] ? syscall_enter_from_user_mode+0x2e/0x240 [ 64.662801][ T3948] ? lockdep_hardirqs_on+0x94/0x130 [ 64.668073][ T3948] ? __x64_sys_mount+0x1c/0xc0 [ 64.672970][ T3948] do_syscall_64+0x3b/0xb0 [ 64.677395][ T3948] ? clear_bhb_loop+0x15/0x70 [ 64.682079][ T3948] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 64.687980][ T3948] RIP: 0033:0x7f6f6751805a [ 64.692490][ T3948] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 09 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 64.712449][ T3948] RSP: 002b:00007f6f66897ee8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 64.720955][ T3948] RAX: ffffffffffffffda RBX: 00007f6f66897f80 RCX: 00007f6f6751805a [ 64.728943][ T3948] RDX: 000000002001ec80 RSI: 000000002001ecc0 RDI: 00007f6f66897f40 [ 64.736921][ T3948] RBP: 000000002001ec80 R08: 00007f6f66897f80 R09: 0000000000000000 [ 64.744939][ T3948] R10: 0000000000000000 R11: 0000000000000246 R12: 000000002001ecc0 [ 64.752916][ T3948] R13: 00007f6f66897f40 R14: 000000000001ec6a R15: 000000002001ed00 [ 64.761164][ T3948] [ 64.764456][ T3948] Kernel Offset: disabled [ 64.768974][ T3948] Rebooting in 86400 seconds..