Warning: Permanently added '10.128.0.190' (ED25519) to the list of known hosts. 2024/07/05 01:50:43 parsed 1 programs 2024/07/05 01:50:43 executed programs: 0 [ 59.986462][ T23] kauditd_printk_skb: 11 callbacks suppressed [ 59.986481][ T23] audit: type=1400 audit(1720144243.900:87): avc: denied { mounton } for pid=434 comm="syz-executor.0" path="/syzcgroup/unified" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 59.995104][ T438] cgroup1: Unknown subsys name 'perf_event' [ 60.017676][ T434] cgroup1: Unknown subsys name 'perf_event' [ 60.024812][ T439] cgroup1: Unknown subsys name 'perf_event' [ 60.029682][ T436] cgroup1: Unknown subsys name 'perf_event' [ 60.034031][ T439] cgroup1: Unknown subsys name 'net_cls' [ 60.040194][ T434] cgroup1: Unknown subsys name 'net_cls' [ 60.046557][ T440] cgroup1: Unknown subsys name 'perf_event' [ 60.051243][ T436] cgroup1: Unknown subsys name 'net_cls' [ 60.057593][ T441] cgroup1: Unknown subsys name 'perf_event' [ 60.069599][ T440] cgroup1: Unknown subsys name 'net_cls' [ 60.075608][ T23] audit: type=1400 audit(1720144243.900:88): avc: denied { mounton } for pid=438 comm="syz-executor.5" path="/syzcgroup/cpu" dev="sda1" ino=1931 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 60.077929][ T441] cgroup1: Unknown subsys name 'net_cls' [ 60.125858][ T438] cgroup1: Unknown subsys name 'net_cls' [ 60.346603][ T439] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.353992][ T439] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.361971][ T439] device bridge_slave_0 entered promiscuous mode [ 60.372060][ T436] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.379719][ T436] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.387402][ T436] device bridge_slave_0 entered promiscuous mode [ 60.396833][ T436] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.403994][ T436] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.412567][ T436] device bridge_slave_1 entered promiscuous mode [ 60.423359][ T439] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.430414][ T439] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.437993][ T439] device bridge_slave_1 entered promiscuous mode [ 60.473147][ T440] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.480559][ T440] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.488081][ T440] device bridge_slave_0 entered promiscuous mode [ 60.507411][ T434] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.514447][ T434] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.522106][ T434] device bridge_slave_0 entered promiscuous mode [ 60.540560][ T440] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.547932][ T440] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.555640][ T440] device bridge_slave_1 entered promiscuous mode [ 60.567532][ T434] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.574648][ T434] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.582512][ T434] device bridge_slave_1 entered promiscuous mode [ 60.640251][ T441] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.647251][ T441] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.654903][ T441] device bridge_slave_0 entered promiscuous mode [ 60.673729][ T438] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.681220][ T438] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.688815][ T438] device bridge_slave_0 entered promiscuous mode [ 60.699720][ T438] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.706607][ T438] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.714254][ T438] device bridge_slave_1 entered promiscuous mode [ 60.728857][ T441] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.735898][ T441] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.743497][ T441] device bridge_slave_1 entered promiscuous mode [ 60.953968][ T438] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.961095][ T438] bridge0: port 2(bridge_slave_1) entered forwarding state [ 60.968237][ T438] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.975123][ T438] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.988467][ T439] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.995817][ T439] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.003100][ T439] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.010598][ T439] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.028677][ T436] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.035539][ T436] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.042856][ T436] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.049696][ T436] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.089281][ T440] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.096715][ T440] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.104123][ T440] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.111696][ T440] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.122499][ T441] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.129478][ T441] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.136949][ T441] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.143989][ T441] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.171873][ T434] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.178750][ T434] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.186183][ T434] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.193032][ T434] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.247291][ T373] bridge0: port 1(bridge_slave_0) entered disabled state [ 61.254453][ T373] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.262584][ T373] bridge0: port 1(bridge_slave_0) entered disabled state [ 61.270137][ T373] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.277731][ T373] bridge0: port 1(bridge_slave_0) entered disabled state [ 61.284928][ T373] bridge0: port 1(bridge_slave_0) entered disabled state [ 61.292684][ T373] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.301756][ T373] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.309576][ T373] bridge0: port 1(bridge_slave_0) entered disabled state [ 61.317157][ T373] bridge0: port 1(bridge_slave_0) entered disabled state [ 61.324311][ T373] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.331962][ T373] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.340595][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 61.348244][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 61.386309][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 61.395300][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 61.403861][ T373] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.411336][ T373] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.419849][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 61.429573][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 61.438376][ T373] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.445971][ T373] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.453533][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 61.461448][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 61.469461][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 61.478134][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 61.486738][ T373] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.493676][ T373] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.501158][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 61.508729][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 61.516731][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 61.525129][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 61.533372][ T373] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.540320][ T373] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.547879][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 61.557214][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 61.567054][ T373] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.575798][ T373] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.595392][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 61.604219][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 61.614198][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 61.621919][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 61.629981][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 61.638348][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 61.673941][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 61.685054][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 61.694818][ T24] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.702210][ T24] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.710507][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 61.718010][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 61.725797][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 61.733892][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 61.743138][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 61.751895][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 61.760328][ T24] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.767200][ T24] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.776348][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 61.786489][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 61.805630][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 61.813333][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 61.821844][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 61.831738][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 61.840468][ T373] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.847726][ T373] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.856443][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 61.865014][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 61.874440][ T373] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.883441][ T373] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.898080][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 61.907583][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 61.916742][ T18] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.925453][ T18] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.933685][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 61.943567][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 61.953292][ T18] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.961128][ T18] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.990958][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 61.999782][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 62.008599][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 62.018020][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 62.026970][ T18] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.034996][ T18] bridge0: port 2(bridge_slave_1) entered forwarding state [ 62.076558][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 62.086842][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 62.095168][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 62.104413][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 62.114128][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 62.123201][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 62.131920][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 62.140239][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 62.149593][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 62.158197][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 62.167101][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 62.175936][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 62.202413][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 62.232227][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 62.241831][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 62.251344][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 62.261182][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 62.269770][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 62.278568][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 62.294912][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 62.303616][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 62.323511][ T379] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 62.332512][ T379] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 62.346423][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 62.367864][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 62.376127][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 62.384562][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 62.393743][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 62.402505][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 62.427076][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 62.435947][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 62.445276][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 62.454158][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 62.473788][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 62.482468][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 62.524989][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 62.540918][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 62.551124][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 62.561746][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 62.580732][ T23] audit: type=1400 audit(1720144246.490:89): avc: denied { map_create } for pid=463 comm="syz-executor.2" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 62.615394][ T379] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 62.624725][ T23] audit: type=1400 audit(1720144246.520:90): avc: denied { map_read map_write } for pid=463 comm="syz-executor.2" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 62.646820][ T379] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 62.655870][ T379] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 62.664149][ T379] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 62.683138][ T379] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 62.695159][ T379] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 62.704196][ T379] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 62.712814][ T379] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 62.744494][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 62.753650][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 62.762896][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 62.771815][ T373] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 63.152211][ T502] ================================================================== [ 63.160409][ T502] BUG: KASAN: out-of-bounds in enqueue_timer+0xb7/0x300 [ 63.167255][ T502] Write of size 8 at addr ffff8881d7d071c8 by task syz-executor.2/502 [ 63.175492][ T502] [ 63.177674][ T502] CPU: 1 PID: 502 Comm: syz-executor.2 Not tainted 5.4.276-syzkaller-04917-g58de09405d1e #0 [ 63.187860][ T502] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 63.198013][ T502] Call Trace: [ 63.201180][ T502] dump_stack+0x1d8/0x241 [ 63.205303][ T502] ? nf_ct_l4proto_log_invalid+0x258/0x258 [ 63.211204][ T502] ? printk+0xd1/0x111 [ 63.215303][ T502] ? enqueue_timer+0xb7/0x300 [ 63.219913][ T502] ? wake_up_klogd+0xb2/0xf0 [ 63.224702][ T502] ? enqueue_timer+0xb7/0x300 [ 63.229384][ T502] print_address_description+0x8c/0x600 [ 63.234933][ T502] ? panic+0x89d/0x89d [ 63.239061][ T502] ? enqueue_timer+0xb7/0x300 [ 63.243511][ T502] __kasan_report+0xf3/0x120 [ 63.248111][ T502] ? enqueue_timer+0xb7/0x300 [ 63.252723][ T502] kasan_report+0x30/0x60 [ 63.257062][ T502] enqueue_timer+0xb7/0x300 [ 63.261406][ T502] internal_add_timer+0x240/0x430 [ 63.266357][ T502] __mod_timer+0x6f1/0x13e0 [ 63.271284][ T502] ? mod_timer_pending+0x20/0x20 [ 63.276429][ T502] ? selinux_tun_dev_alloc_security+0x4d/0x130 [ 63.283047][ T502] ? selinux_tun_dev_alloc_security+0x5e/0x130 [ 63.289278][ T502] ? init_timer_key+0x2d/0x1f0 [ 63.294162][ T502] tun_net_init+0x287/0x540 [ 63.298533][ T502] register_netdevice+0x1c0/0x12a0 [ 63.303533][ T502] ? memset+0x1f/0x40 [ 63.307450][ T502] ? netdev_update_lockdep_key+0x10/0x10 [ 63.313035][ T502] ? alloc_netdev_mqs+0x99d/0xc70 [ 63.317969][ T502] tun_set_iff+0x7f7/0xdc0 [ 63.322340][ T502] __tun_chr_ioctl+0x8a9/0x1d00 [ 63.327189][ T502] ? tun_flow_create+0x250/0x250 [ 63.332125][ T502] ? tun_chr_poll+0x670/0x670 [ 63.337008][ T502] do_vfs_ioctl+0x742/0x1720 [ 63.341432][ T502] ? ioctl_preallocate+0x250/0x250 [ 63.346382][ T502] ? __fget+0x407/0x490 [ 63.350486][ T502] ? fget_many+0x20/0x20 [ 63.354671][ T502] ? switch_fpu_return+0x1d4/0x410 [ 63.359701][ T502] ? security_file_ioctl+0x7d/0xa0 [ 63.364653][ T502] __x64_sys_ioctl+0xd4/0x110 [ 63.369509][ T502] do_syscall_64+0xca/0x1c0 [ 63.373854][ T502] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 63.379586][ T502] RIP: 0033:0x454b09 [ 63.383418][ T502] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b4 ff ff ff f7 d8 64 89 01 48 [ 63.403905][ T502] RSP: 002b:00007f7ed57cd0f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 63.412379][ T502] RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 0000000000454b09 [ 63.420356][ T502] RDX: 0000000020000300 RSI: 00000000400454ca RDI: 0000000000000003 [ 63.428250][ T502] RBP: 00000000000005b8 R08: 0000000000000000 R09: 0000000000000000 [ 63.436388][ T502] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004e4b40 [ 63.444551][ T502] R13: 00007f7ed57cd674 R14: 000000000054bf00 R15: 00000000004fb940 [ 63.452793][ T502] [ 63.455162][ T502] The buggy address belongs to the page: [ 63.460617][ T502] page:ffffea00075f41c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8881ebb7ab00 [ 63.471135][ T502] flags: 0x8000000000000000() [ 63.475923][ T502] raw: 8000000000000000 dead000000000100 dead000000000122 0000000000000000 [ 63.484735][ T502] raw: ffff8881ebb7ab00 0000000000000000 00000001ffffffff 0000000000000000 [ 63.493343][ T502] page dumped because: kasan: bad access detected [ 63.499857][ T502] page_owner tracks the page as allocated [ 63.505409][ T502] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2cc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_NOWARN) [ 63.517127][ T502] prep_new_page+0x18f/0x370 [ 63.521741][ T502] get_page_from_freelist+0x2d13/0x2d90 [ 63.527324][ T502] __alloc_pages_nodemask+0x393/0x840 [ 63.532710][ T502] pcpu_populate_chunk+0x1bb/0xd00 [ 63.537749][ T502] pcpu_alloc+0x79e/0x1050 [ 63.542163][ T502] array_map_alloc+0x38c/0x6d0 [ 63.547231][ T502] __se_sys_bpf+0x3291/0xbcb0 [ 63.551758][ T502] do_syscall_64+0xca/0x1c0 [ 63.556291][ T502] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 63.562453][ T502] page last free stack trace: [ 63.567383][ T502] free_unref_page_prepare+0x297/0x380 [ 63.573622][ T502] __free_pages+0xaf/0x140 [ 63.578123][ T502] pcpu_balance_workfn+0x940/0x1450 [ 63.583224][ T502] process_one_work+0x765/0xd20 [ 63.587905][ T502] worker_thread+0xaef/0x1470 [ 63.593009][ T502] kthread+0x2da/0x360 [ 63.597085][ T502] ret_from_fork+0x1f/0x30 [ 63.601700][ T502] [ 63.604050][ T502] Memory state around the buggy address: [ 63.609631][ T502] ffff8881d7d07080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.617516][ T502] ffff8881d7d07100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.625855][ T502] >ffff8881d7d07180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.634104][ T502] ^ [ 63.640698][ T502] ffff8881d7d07200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.648723][ T502] ffff8881d7d07280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.656866][ T502] ================================================================== [ 63.665588][ T502] Disabling lock debugging due to kernel taint [ 64.838583][ T609] ------------[ cut here ]------------ [ 64.844181][ T609] kernel BUG at include/linux/swapops.h:195! [ 64.850262][ T609] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 64.856742][ T609] CPU: 1 PID: 609 Comm: syz-executor.4 Tainted: G B 5.4.276-syzkaller-04917-g58de09405d1e #0 [ 64.868398][ T609] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 64.880438][ T609] RIP: 0010:unmap_page_range+0x2606/0x2620 [ 64.888095][ T609] Code: 00 00 00 65 48 8b 04 25 28 00 00 00 48 3b 84 24 a0 01 00 00 75 1d 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 9a 59 d9 ff <0f> 0b e8 93 59 d9 ff 0f 0b e8 dc 0e b0 ff 66 66 2e 0f 1f 84 00 00 [ 64.908936][ T609] RSP: 0018:ffff8881e823f5a0 EFLAGS: 00010293 [ 64.915086][ T609] RAX: ffffffff818adf66 RBX: 0000000000000000 RCX: ffff8881e86d6e40 [ 64.923059][ T609] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 64.931992][ T609] RBP: ffff8881e823f790 R08: ffffffff818acc02 R09: fffffb1df842b671 [ 64.942093][ T609] R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000 [ 64.950843][ T609] R13: fffff8efc215b380 R14: 1ffff1103d4e8e38 R15: ffff8881ef526268 [ 64.959318][ T609] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 64.968388][ T609] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 64.975964][ T609] CR2: 000000000054c000 CR3: 00000001d9130000 CR4: 00000000003406a0 [ 64.984034][ T609] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 64.992332][ T609] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 65.000519][ T609] Call Trace: [ 65.003851][ T609] ? __die+0xb4/0x100 [ 65.007976][ T609] ? die+0x26/0x50 [ 65.011610][ T609] ? do_trap+0x1e7/0x340 [ 65.015963][ T609] ? unmap_page_range+0x2606/0x2620 [ 65.021271][ T609] ? unmap_page_range+0x2606/0x2620 [ 65.026632][ T609] ? do_invalid_op+0xfb/0x110 [ 65.031432][ T609] ? unmap_page_range+0x2606/0x2620 [ 65.037048][ T609] ? invalid_op+0x1e/0x30 [ 65.041580][ T609] ? unmap_page_range+0x12a2/0x2620 [ 65.046602][ T609] ? unmap_page_range+0x2606/0x2620 [ 65.052461][ T609] ? unmap_page_range+0x2606/0x2620 [ 65.057950][ T609] ? copy_page_range+0x26f0/0x26f0 [ 65.064473][ T609] ? lru_add_page_tail+0x770/0x770 [ 65.069734][ T609] unmap_vmas+0x355/0x4b0 [ 65.073957][ T609] ? cputime_adjust+0x34/0x270 [ 65.079016][ T609] ? unmap_page_range+0x2620/0x2620 [ 65.084309][ T609] ? tlb_gather_mmu+0x273/0x340 [ 65.089310][ T609] exit_mmap+0x2bc/0x520 [ 65.094110][ T609] ? vm_brk+0x20/0x20 [ 65.097962][ T609] ? mutex_unlock+0x18/0x40 [ 65.102638][ T609] ? uprobe_clear_state+0x297/0x300 [ 65.109060][ T609] ? mm_update_next_owner+0x4f7/0x5d0 [ 65.114502][ T609] __mmput+0x8e/0x2c0 [ 65.118746][ T609] do_exit+0xc08/0x2bc0 [ 65.122996][ T609] ? put_task_struct+0x80/0x80 [ 65.127775][ T609] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 65.133128][ T609] ? _raw_spin_lock_irqsave+0x210/0x210 [ 65.138681][ T609] ? _raw_spin_lock_irqsave+0x210/0x210 [ 65.144483][ T609] do_group_exit+0x138/0x300 [ 65.148927][ T609] get_signal+0xdb1/0x1440 [ 65.153381][ T609] do_signal+0xb0/0x11f0 [ 65.157886][ T609] ? ioctl_preallocate+0x250/0x250 [ 65.162921][ T609] ? check_preemption_disabled+0x9f/0x320 [ 65.168482][ T609] ? signal_fault+0x1e0/0x1e0 [ 65.172996][ T609] ? __fget+0x407/0x490 [ 65.177077][ T609] ? task_work_add+0x100/0x120 [ 65.181753][ T609] ? fput_many+0x165/0x1b0 [ 65.186744][ T609] exit_to_usermode_loop+0xc0/0x1a0 [ 65.191875][ T609] prepare_exit_to_usermode+0x199/0x200 [ 65.197337][ T609] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 65.203377][ T609] RIP: 0033:0x454b09 [ 65.207074][ T609] Code: Bad RIP value. [ 65.210980][ T609] RSP: 002b:00007f0d158f00f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 65.219796][ T609] RAX: fffffffffffffff4 RBX: 00000000ffffffff RCX: 0000000000454b09 [ 65.228318][ T609] RDX: 0000000020000300 RSI: 00000000400454ca RDI: 0000000000000003 [ 65.236496][ T609] RBP: 00000000000005b8 R08: 0000000000000000 R09: 0000000000000000 [ 65.245044][ T609] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004e4b40 [ 65.252857][ T609] R13: 00007f0d158f0674 R14: 000000000054bf00 R15: 00000000004fb940 [ 65.261002][ T609] Modules linked in: [ 65.264897][ T609] ---[ end trace 05f44a1ec5cffe5a ]--- [ 65.270183][ T609] RIP: 0010:unmap_page_range+0x2606/0x2620 [ 65.276298][ T609] Code: 00 00 00 65 48 8b 04 25 28 00 00 00 48 3b 84 24 a0 01 00 00 75 1d 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 9a 59 d9 ff <0f> 0b e8 93 59 d9 ff 0f 0b e8 dc 0e b0 ff 66 66 2e 0f 1f 84 00 00 [ 65.296680][ T609] RSP: 0018:ffff8881e823f5a0 EFLAGS: 00010293 [ 65.305409][ T609] RAX: ffffffff818adf66 RBX: 0000000000000000 RCX: ffff8881e86d6e40 [ 65.313262][ T609] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 65.321112][ T609] RBP: ffff8881e823f790 R08: ffffffff818acc02 R09: fffffb1df842b671 [ 65.329382][ T609] R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000 [ 65.337667][ T609] R13: fffff8efc215b380 R14: 1ffff1103d4e8e38 R15: ffff8881ef526268 [ 65.345576][ T609] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 65.356122][ T609] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 65.363003][ T609] CR2: 0000000000454adf CR3: 00000001d9130000 CR4: 00000000003406a0 [ 65.371715][ T609] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 65.379840][ T609] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 65.387819][ T609] Kernel panic - not syncing: Fatal exception [ 65.394012][ T609] Kernel Offset: disabled [ 65.398230][ T609] Rebooting in 86400 seconds..