Warning: Permanently added '10.128.1.194' (ED25519) to the list of known hosts. 2024/09/16 03:03:04 ignoring optional flag "sandboxArg"="0" 2024/09/16 03:03:04 parsed 1 programs 2024/09/16 03:03:06 executed programs: 0 [ 62.321049][ T2275] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 64.408234][ T2290] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 64.437260][ T2290] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 64.491770][ T2290] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 64.503915][ T2290] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 64.515842][ T2285] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 64.526080][ T2285] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 64.536423][ T2285] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 64.546111][ T2285] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 64.634301][ T2286] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 64.686823][ T2286] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 64.743258][ T2286] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 64.763550][ T2286] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 64.954079][ T2291] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 64.997518][ T2291] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 65.067721][ T2291] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 65.087948][ T2292] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 65.116978][ T2291] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 65.136970][ T2292] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 65.177474][ T2292] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 65.236609][ T2292] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 65.257853][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.265687][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.278729][ T34] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.286602][ T34] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.368460][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.376529][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.384990][ T1082] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.393243][ T1082] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.467169][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.475034][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.499685][ T1082] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.507739][ T1082] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.740737][ T34] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.748820][ T34] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.777902][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.785765][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.815033][ T2525] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 65.916286][ T2527] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. [ 65.971185][ T2525] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 65.988221][ T2535] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. [ 65.999297][ T2525] Zero length message leads to an empty skb [ 66.033265][ T2527] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. [ 66.059088][ T1110] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.066994][ T1110] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.079552][ T2535] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. [ 66.129400][ T2545] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 66.157601][ T2545] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 66.180567][ T2547] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.2'. [ 66.228427][ T2547] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.2'. [ 66.247872][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.255753][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2024/09/16 03:03:11 executed programs: 77 [ 70.824919][ T3355] __nla_validate_parse: 706 callbacks suppressed [ 70.824935][ T3355] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. [ 70.859460][ T3359] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. [ 70.881407][ T3360] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.2'. [ 70.896668][ T3357] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 70.907048][ T3362] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'. [ 70.918327][ T3355] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. [ 70.942901][ T3359] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. [ 70.955707][ T3360] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.2'. [ 70.967671][ T3362] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'. [ 71.000973][ T3357] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 72.205420][ T3564] ================================================================== [ 72.213536][ T3564] BUG: KASAN: slab-use-after-free in taprio_dump+0x79c/0xc30 [ 72.221120][ T3564] Read of size 4 at addr ffff8881151684c0 by task syz-executor.1/3564 [ 72.229273][ T3564] [ 72.231615][ T3564] CPU: 0 UID: 0 PID: 3564 Comm: syz-executor.1 Not tainted 6.11.0-syzkaller #0 [ 72.240546][ T3564] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 [ 72.250679][ T3564] Call Trace: [ 72.253942][ T3564] [ 72.256858][ T3564] dump_stack_lvl+0x231/0x330 [ 72.261664][ T3564] ? __pfx_dump_stack_lvl+0x10/0x10 [ 72.266855][ T3564] ? __pfx__printk+0x10/0x10 [ 72.271428][ T3564] ? lock_acquire+0xc2/0x3a0 [ 72.276089][ T3564] ? __pfx_lock_acquire+0x10/0x10 [ 72.281094][ T3564] ? _printk+0xd5/0x120 [ 72.285416][ T3564] ? __virt_addr_valid+0x169/0x380 [ 72.290513][ T3564] print_report+0x169/0x550 [ 72.295016][ T3564] ? __virt_addr_valid+0x169/0x380 [ 72.300200][ T3564] ? __virt_addr_valid+0x2c1/0x380 [ 72.305311][ T3564] ? __phys_addr+0x90/0x130 [ 72.309812][ T3564] ? taprio_dump+0x79c/0xc30 [ 72.314390][ T3564] kasan_report+0x143/0x180 [ 72.318879][ T3564] ? mqprio_qopt_reconstruct+0x74/0x4b0 [ 72.324495][ T3564] ? taprio_dump+0x79c/0xc30 [ 72.329078][ T3564] taprio_dump+0x79c/0xc30 [ 72.333486][ T3564] ? __pfx_taprio_dump+0x10/0x10 [ 72.338413][ T3564] ? __pfx___schedule+0x10/0x10 [ 72.343249][ T3564] ? __asan_memcpy+0x40/0x70 [ 72.347822][ T3564] ? nla_put+0x131/0x1e0 [ 72.352045][ T3564] tc_fill_qdisc+0x677/0x1120 [ 72.356706][ T3564] ? __kmalloc_node_track_caller_noprof+0x21f/0x460 [ 72.363370][ T3564] ? __pfx_tc_fill_qdisc+0x10/0x10 [ 72.368462][ T3564] ? __build_skb_around+0x22d/0x380 [ 72.373644][ T3564] ? __pfx___alloc_skb+0x10/0x10 [ 72.378562][ T3564] qdisc_notify+0x2ec/0x4b0 [ 72.383051][ T3564] tc_modify_qdisc+0x1852/0x1a40 [ 72.387975][ T3564] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 72.394125][ T3564] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 72.399402][ T3564] ? security_capable+0x90/0xb0 [ 72.404252][ T3564] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 72.409522][ T3564] rtnetlink_rcv_msg+0x9ef/0xbb0 [ 72.414542][ T3564] ? __lock_acquire+0x61d/0xc60 [ 72.419381][ T3564] ? rtnetlink_rcv_msg+0x1aa/0xbb0 [ 72.424479][ T3564] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 72.430022][ T3564] ? __netlink_lookup+0xb3/0x4e0 [ 72.435054][ T3564] ? __pfx_lock_release+0x10/0x10 [ 72.440065][ T3564] netlink_rcv_skb+0x1e3/0x430 [ 72.444820][ T3564] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 72.450268][ T3564] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 72.455631][ T3564] ? netlink_deliver_tap+0x30/0x120 [ 72.461337][ T3564] netlink_unicast+0x7c6/0x960 [ 72.466085][ T3564] ? __pfx_netlink_unicast+0x10/0x10 [ 72.471353][ T3564] ? __check_object_size+0x47c/0x8c0 [ 72.476623][ T3564] netlink_sendmsg+0x88e/0xc40 [ 72.481375][ T3564] ? __pfx_netlink_sendmsg+0x10/0x10 [ 72.486646][ T3564] ? security_socket_sendmsg+0x87/0xb0 [ 72.492087][ T3564] ? __pfx_netlink_sendmsg+0x10/0x10 [ 72.497356][ T3564] __sock_sendmsg+0x221/0x270 [ 72.502014][ T3564] ____sys_sendmsg+0x525/0x7d0 [ 72.506773][ T3564] ? __pfx___schedule+0x10/0x10 [ 72.511611][ T3564] ? __pfx_____sys_sendmsg+0x10/0x10 [ 72.516883][ T3564] ___sys_sendmsg+0x27a/0x310 [ 72.521551][ T3564] ? __pfx____sys_sendmsg+0x10/0x10 [ 72.526749][ T3564] ? __fget_files+0x33/0x350 [ 72.531328][ T3564] __sys_sendmmsg+0x2a9/0x500 [ 72.536023][ T3564] ? __pfx___sys_sendmmsg+0x10/0x10 [ 72.541212][ T3564] ? do_futex+0x33b/0x560 [ 72.545534][ T3564] ? __rseq_handle_notify_resume+0x2fe/0x1250 [ 72.551609][ T3564] __x64_sys_sendmmsg+0xa0/0xb0 [ 72.556448][ T3564] do_syscall_64+0x8d/0x190 [ 72.560935][ T3564] ? clear_bhb_loop+0x35/0x90 [ 72.565603][ T3564] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.571496][ T3564] RIP: 0033:0x7f8dca06dda9 [ 72.575905][ T3564] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 72.595515][ T3564] RSP: 002b:00007f8dc9bef0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 72.603937][ T3564] RAX: ffffffffffffffda RBX: 00007f8dca19bf80 RCX: 00007f8dca06dda9 [ 72.611901][ T3564] RDX: 0492492492492856 RSI: 0000000020000140 RDI: 0000000000000003 [ 72.619948][ T3564] RBP: 00007f8dca0ba47a R08: 0000000000000000 R09: 0000000000000000 [ 72.628344][ T3564] R10: 0000000000001400 R11: 0000000000000246 R12: 0000000000000000 [ 72.636310][ T3564] R13: 0000000000000006 R14: 00007f8dca19bf80 R15: 00007f8dca2bfa48 [ 72.644286][ T3564] [ 72.647294][ T3564] [ 72.649602][ T3564] Allocated by task 3552: [ 72.653915][ T3564] kasan_save_track+0x3f/0x80 [ 72.658589][ T3564] __kasan_kmalloc+0x98/0xb0 [ 72.663163][ T3564] __kmalloc_cache_noprof+0x19e/0x360 [ 72.668520][ T3564] taprio_change+0xf31/0x3df0 [ 72.673187][ T3564] tc_modify_qdisc+0x16b2/0x1a40 [ 72.678112][ T3564] rtnetlink_rcv_msg+0x9ef/0xbb0 [ 72.683034][ T3564] netlink_rcv_skb+0x1e3/0x430 [ 72.687879][ T3564] netlink_unicast+0x7c6/0x960 [ 72.692628][ T3564] netlink_sendmsg+0x88e/0xc40 [ 72.697374][ T3564] __sock_sendmsg+0x221/0x270 [ 72.702209][ T3564] ____sys_sendmsg+0x525/0x7d0 [ 72.706963][ T3564] ___sys_sendmsg+0x27a/0x310 [ 72.711714][ T3564] __sys_sendmmsg+0x2a9/0x500 [ 72.716376][ T3564] __x64_sys_sendmmsg+0xa0/0xb0 [ 72.721214][ T3564] do_syscall_64+0x8d/0x190 [ 72.725712][ T3564] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.731592][ T3564] [ 72.733902][ T3564] Freed by task 2292: [ 72.737859][ T3564] kasan_save_track+0x3f/0x80 [ 72.742561][ T3564] kasan_save_free_info+0x40/0x50 [ 72.747580][ T3564] poison_slab_object+0xe0/0x150 [ 72.752687][ T3564] __kasan_slab_free+0x37/0x60 [ 72.757435][ T3564] kfree+0x12f/0x310 [ 72.761320][ T3564] rcu_core+0xc3c/0x1470 [ 72.765572][ T3564] handle_softirqs+0x1b7/0x570 [ 72.770328][ T3564] do_softirq+0x112/0x1d0 [ 72.774727][ T3564] __local_bh_enable_ip+0x69/0x70 [ 72.779742][ T3564] xt_replace_table+0x33e/0x760 [ 72.784584][ T3564] __do_replace+0x1ae/0xa30 [ 72.789073][ T3564] do_ip6t_set_ctl+0xecd/0x1220 [ 72.793916][ T3564] nf_setsockopt+0x295/0x2c0 [ 72.798598][ T3564] do_sock_setsockopt+0x167/0x1a0 [ 72.803632][ T3564] __sys_setsockopt+0x1ae/0x250 [ 72.808478][ T3564] __x64_sys_setsockopt+0xb5/0xd0 [ 72.813492][ T3564] do_syscall_64+0x8d/0x190 [ 72.817981][ T3564] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.823864][ T3564] [ 72.826172][ T3564] Last potentially related work creation: [ 72.831882][ T3564] kasan_save_stack+0x3f/0x60 [ 72.836561][ T3564] __kasan_record_aux_stack+0xac/0xc0 [ 72.841978][ T3564] call_rcu+0x159/0x8e0 [ 72.846131][ T3564] taprio_change+0x229f/0x3df0 [ 72.850895][ T3564] tc_modify_qdisc+0x16b2/0x1a40 [ 72.855823][ T3564] rtnetlink_rcv_msg+0x9ef/0xbb0 [ 72.860832][ T3564] netlink_rcv_skb+0x1e3/0x430 [ 72.865584][ T3564] netlink_unicast+0x7c6/0x960 [ 72.870337][ T3564] netlink_sendmsg+0x88e/0xc40 [ 72.875094][ T3564] __sock_sendmsg+0x221/0x270 [ 72.879751][ T3564] ____sys_sendmsg+0x525/0x7d0 [ 72.884498][ T3564] ___sys_sendmsg+0x27a/0x310 [ 72.889172][ T3564] __sys_sendmmsg+0x2a9/0x500 [ 72.893834][ T3564] __x64_sys_sendmmsg+0xa0/0xb0 [ 72.898756][ T3564] do_syscall_64+0x8d/0x190 [ 72.903259][ T3564] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.909153][ T3564] [ 72.911469][ T3564] The buggy address belongs to the object at ffff888115168400 [ 72.911469][ T3564] which belongs to the cache kmalloc-512 of size 512 [ 72.925505][ T3564] The buggy address is located 192 bytes inside of [ 72.925505][ T3564] freed 512-byte region [ffff888115168400, ffff888115168600) [ 72.939282][ T3564] [ 72.941593][ T3564] The buggy address belongs to the physical page: [ 72.948003][ T3564] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115168 [ 72.956945][ T3564] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 72.965513][ T3564] flags: 0x200000000000040(head|node=0|zone=2) [ 72.971652][ T3564] page_type: 0xfdffffff(slab) [ 72.976309][ T3564] raw: 0200000000000040 ffff888100041c80 dead000000000100 dead000000000122 [ 72.984876][ T3564] raw: 0000000000000000 0000000000100010 00000001fdffffff 0000000000000000 [ 72.993981][ T3564] head: 0200000000000040 ffff888100041c80 dead000000000100 dead000000000122 [ 73.002648][ T3564] head: 0000000000000000 0000000000100010 00000001fdffffff 0000000000000000 [ 73.011393][ T3564] head: 0200000000000002 ffffea0004545a01 ffffffffffffffff 0000000000000000 [ 73.020048][ T3564] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000 [ 73.028695][ T3564] page dumped because: kasan: bad access detected [ 73.035187][ T3564] page_owner tracks the page as allocated [ 73.040883][ T3564] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1675, tgid 1675 (acpid), ts 7843430572, free_ts 0 [ 73.059903][ T3564] post_alloc_hook+0x10f/0x130 [ 73.064662][ T3564] get_page_from_freelist+0x37f4/0x3920 [ 73.070196][ T3564] __alloc_pages_noprof+0x256/0x670 [ 73.075378][ T3564] alloc_slab_page+0x5f/0x120 [ 73.080045][ T3564] allocate_slab+0x5d/0x290 [ 73.084621][ T3564] ___slab_alloc+0xa7f/0x11d0 [ 73.089374][ T3564] __kmalloc_noprof+0x25a/0x440 [ 73.094211][ T3564] tomoyo_init_log+0x196e/0x1e70 [ 73.099144][ T3564] tomoyo_supervisor+0x369/0x11a0 [ 73.104186][ T3564] tomoyo_path_number_perm+0x56f/0x790 [ 73.109713][ T3564] security_path_chmod+0xe6/0x140 [ 73.114756][ T3564] chmod_common+0x1c9/0x4c0 [ 73.119262][ T3564] __x64_sys_fchmod+0xf8/0x160 [ 73.124032][ T3564] do_syscall_64+0x8d/0x190 [ 73.128528][ T3564] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 73.134443][ T3564] page_owner free stack trace missing [ 73.139803][ T3564] [ 73.142120][ T3564] Memory state around the buggy address: [ 73.147761][ T3564] ffff888115168380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 73.155811][ T3564] ffff888115168400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 73.163946][ T3564] >ffff888115168480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 73.171987][ T3564] ^ [ 73.178383][ T3564] ffff888115168500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 73.186434][ T3564] ffff888115168580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 73.194487][ T3564] ================================================================== [ 73.203262][ T3564] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 73.210739][ T3564] Kernel Offset: disabled [ 73.215152][ T3564] Rebooting in 86400 seconds..