[ 19.378131][ T26] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.385139][ T26] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.393120][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 19.401234][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 19.932435][ T84] device bridge_slave_1 left promiscuous mode [ 19.938706][ T84] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.946812][ T84] device bridge_slave_0 left promiscuous mode [ 19.953305][ T84] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.200237][ T25] kauditd_printk_skb: 65 callbacks suppressed [ 30.200250][ T25] audit: type=1400 audit(1670874052.740:148): avc: denied { read } for pid=145 comm="syslogd" name="log" dev="sda1" ino=1125 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 Warning: Permanently added '10.128.1.17' (ECDSA) to the list of known hosts. 2022/12/12 19:40:59 ignoring optional flag "sandboxArg"="0" 2022/12/12 19:40:59 parsed 1 programs 2022/12/12 19:40:59 executed programs: 0 [ 36.964457][ T25] audit: type=1400 audit(1670874059.500:149): avc: denied { mounton } for pid=408 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 36.990390][ T25] audit: type=1400 audit(1670874059.500:150): avc: denied { mount } for pid=408 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 37.037733][ T25] audit: type=1400 audit(1670874059.530:151): avc: denied { mounton } for pid=412 comm="syz-executor.2" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 37.062170][ T25] audit: type=1400 audit(1670874059.530:152): avc: denied { module_request } for pid=412 comm="syz-executor.2" kmod="netdev-nr2" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 37.127542][ T412] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.134895][ T412] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.142348][ T412] device bridge_slave_0 entered promiscuous mode [ 37.150387][ T412] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.157410][ T412] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.165023][ T412] device bridge_slave_1 entered promiscuous mode [ 37.185605][ T422] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.192658][ T422] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.200112][ T422] device bridge_slave_0 entered promiscuous mode [ 37.208674][ T422] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.215722][ T422] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.223255][ T422] device bridge_slave_1 entered promiscuous mode [ 37.237619][ T414] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.244840][ T414] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.252192][ T414] device bridge_slave_0 entered promiscuous mode [ 37.261627][ T414] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.268862][ T414] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.276161][ T414] device bridge_slave_1 entered promiscuous mode [ 37.300985][ T424] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.308320][ T424] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.315520][ T424] device bridge_slave_0 entered promiscuous mode [ 37.323533][ T424] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.330640][ T424] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.338105][ T424] device bridge_slave_1 entered promiscuous mode [ 37.392100][ T425] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.399506][ T425] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.406765][ T425] device bridge_slave_0 entered promiscuous mode [ 37.417972][ T420] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.425171][ T420] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.432565][ T420] device bridge_slave_0 entered promiscuous mode [ 37.443037][ T425] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.450119][ T425] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.457350][ T425] device bridge_slave_1 entered promiscuous mode [ 37.466408][ T420] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.473491][ T420] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.480891][ T420] device bridge_slave_1 entered promiscuous mode [ 37.534506][ T424] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.541638][ T424] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.549315][ T424] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.556320][ T424] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.574946][ T412] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.581982][ T412] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.589288][ T412] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.596306][ T412] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.646516][ T422] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.653846][ T422] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.661228][ T422] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.668260][ T422] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.689230][ T414] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.696262][ T414] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.703612][ T414] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.710804][ T414] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.727798][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 37.736284][ T380] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.743643][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 37.752344][ T380] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.759787][ T380] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.767067][ T380] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.774777][ T380] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.781944][ T380] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.789400][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 37.797823][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 37.806261][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 37.813776][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 37.831568][ T78] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 37.839465][ T78] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 37.847798][ T78] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.854901][ T78] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.862566][ T78] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 37.870997][ T78] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.878195][ T78] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.920257][ T78] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 37.928772][ T78] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 37.936566][ T78] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 37.944903][ T78] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 37.953050][ T78] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.960087][ T78] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.967368][ T78] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 37.975508][ T78] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.983060][ T78] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.990431][ T78] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 37.998682][ T78] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 38.007025][ T78] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 38.029286][ T78] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 38.036752][ T78] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 38.045214][ T78] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 38.054189][ T78] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.061301][ T78] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.069049][ T78] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 38.077135][ T78] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.084201][ T78] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.091512][ T78] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 38.099440][ T78] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 38.112643][ T78] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 38.142824][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 38.151138][ T107] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.158158][ T107] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.165493][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 38.173728][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 38.182327][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 38.190585][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 38.198920][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 38.206831][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 38.214837][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 38.222853][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 38.230911][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 38.239157][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 38.247416][ T107] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.254462][ T107] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.261799][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 38.269870][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 38.277777][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 38.285759][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 38.293756][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 38.302132][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 38.310405][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 38.318678][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 38.326993][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 38.334863][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 38.342754][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 38.350591][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 38.358687][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 38.366777][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 38.375039][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 38.383124][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 38.403364][ T25] audit: type=1400 audit(1670874060.940:153): avc: denied { mount } for pid=412 comm="syz-executor.2" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 38.430153][ T25] audit: type=1400 audit(1670874060.950:154): avc: denied { mounton } for pid=448 comm="syz-executor.2" path="/root/syzkaller-testdir3884452991/syzkaller.V3IyQ9/0/file0" dev="sda1" ino=1158 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 38.459821][ T21] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 38.468465][ T21] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 38.476757][ T21] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 38.486054][ T25] audit: type=1400 audit(1670874061.020:155): avc: denied { append } for pid=145 comm="syslogd" name="messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 38.509436][ T25] audit: type=1400 audit(1670874061.020:156): avc: denied { open } for pid=145 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 38.509591][ T21] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 38.532896][ T25] audit: type=1400 audit(1670874061.020:157): avc: denied { getattr } for pid=145 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 38.541331][ T21] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 38.571435][ T21] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 38.578888][ T21] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 38.587219][ T21] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 38.595785][ T21] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.602817][ T21] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.610527][ T21] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 38.618974][ T21] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 38.627257][ T21] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.634970][ T21] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.642373][ T21] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 38.650696][ T21] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 38.658986][ T21] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 38.666926][ T21] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 38.674848][ T21] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 38.683222][ T21] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 38.691505][ T21] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 38.699634][ T21] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 38.708138][ T21] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 38.731636][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 38.740154][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 38.748375][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 38.756743][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 38.764862][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 38.773005][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 38.781617][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 38.789611][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 38.798087][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 38.806297][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 38.814775][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 38.822947][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 38.831150][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 38.839302][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 38.857939][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 38.866188][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 38.875013][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 38.882962][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 38.890955][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 38.899194][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 38.907392][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 38.915685][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 38.924160][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 38.932441][ T107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 38.964914][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 38.973524][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 38.982348][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 38.990879][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 39.246515][ T25] audit: type=1400 audit(1670874061.780:158): avc: denied { unmount } for pid=412 comm="syz-executor.2" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 2022/12/12 19:41:04 executed programs: 25 2022/12/12 19:41:09 executed programs: 61 [ 50.150406][ T872] ================================================================== [ 50.158912][ T872] BUG: KASAN: use-after-free in fuse_copy_one+0x1e7/0x3f0 [ 50.166018][ T872] Read of size 256 at addr ffff888123f4f810 by task syz-executor.3/872 [ 50.174335][ T872] [ 50.176742][ T872] CPU: 1 PID: 872 Comm: syz-executor.3 Not tainted 5.15.82-syzkaller #0 [ 50.185040][ T872] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 50.195081][ T872] Call Trace: [ 50.198347][ T872] [ 50.201253][ T872] dump_stack_lvl+0x151/0x1b7 [ 50.206009][ T872] ? bfq_pos_tree_add_move+0x43e/0x43e [ 50.211445][ T872] ? panic+0x719/0x719 [ 50.215573][ T872] print_address_description+0x87/0x3c0 [ 50.221097][ T872] kasan_report+0x1a2/0x1f0 [ 50.225750][ T872] ? fuse_copy_one+0x1e7/0x3f0 [ 50.230502][ T872] ? fuse_copy_one+0x1e7/0x3f0 [ 50.235235][ T872] kasan_check_range+0x2aa/0x2e0 [ 50.240237][ T872] ? fuse_copy_one+0x1e7/0x3f0 [ 50.245027][ T872] memcpy+0x2d/0x70 [ 50.248893][ T872] fuse_copy_one+0x1e7/0x3f0 [ 50.253482][ T872] fuse_copy_args+0x309/0x400 [ 50.258225][ T872] ? fuse_copy_one+0x39f/0x3f0 [ 50.262975][ T872] fuse_dev_do_read+0xc9b/0x1190 [ 50.267883][ T872] ? queue_interrupt+0x390/0x390 [ 50.272883][ T872] ? memset+0x35/0x40 [ 50.276840][ T872] fuse_dev_read+0x180/0x210 [ 50.281400][ T872] ? __fsnotify_update_child_dentry_flags+0x300/0x300 [ 50.288224][ T872] ? fuse_dev_release+0x5b0/0x5b0 [ 50.293249][ T872] ? iov_iter_init+0x53/0x180 [ 50.297915][ T872] vfs_read+0xabc/0xd80 [ 50.302050][ T872] ? kernel_read+0x1f0/0x1f0 [ 50.306611][ T872] ? __fget_files+0x310/0x370 [ 50.311533][ T872] ? __fdget_pos+0x1fe/0x310 [ 50.316127][ T872] ? ksys_read+0x77/0x2c0 [ 50.320594][ T872] ksys_read+0x198/0x2c0 [ 50.324863][ T872] ? __kasan_check_write+0x14/0x20 [ 50.329962][ T872] ? vfs_write+0x1050/0x1050 [ 50.334528][ T872] ? fpregs_restore_userregs+0x1f0/0x3a0 [ 50.340140][ T872] __x64_sys_read+0x7b/0x90 [ 50.344620][ T872] do_syscall_64+0x44/0xd0 [ 50.349366][ T872] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 50.355241][ T872] RIP: 0033:0x7f6cfaf77639 [ 50.359640][ T872] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 50.379669][ T872] RSP: 002b:00007f6cfaa88168 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 50.388145][ T872] RAX: ffffffffffffffda RBX: 00007f6cfb0981f0 RCX: 00007f6cfaf77639 [ 50.396089][ T872] RDX: 0000000000002020 RSI: 0000000020002140 RDI: 0000000000000003 [ 50.404041][ T872] RBP: 00007f6cfafd2ae9 R08: 0000000000000000 R09: 0000000000000000 [ 50.411994][ T872] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 50.419950][ T872] R13: 00007fff8017085f R14: 00007f6cfaa88300 R15: 0000000000022000 [ 50.427896][ T872] [ 50.430912][ T872] [ 50.433213][ T872] Allocated by task 859: [ 50.437508][ T872] ____kasan_kmalloc+0xdc/0x110 [ 50.442345][ T872] __kasan_kmalloc+0x9/0x10 [ 50.446854][ T872] __kmalloc+0x203/0x350 [ 50.451083][ T872] __d_alloc+0xab/0x6b0 [ 50.455242][ T872] d_alloc_parallel+0xe0/0x12b0 [ 50.460082][ T872] __lookup_slow+0x14e/0x400 [ 50.464764][ T872] lookup_slow+0x5a/0x80 [ 50.468999][ T872] walk_component+0x425/0x5a0 [ 50.473662][ T872] path_lookupat+0x18d/0x460 [ 50.478332][ T872] filename_lookup+0x277/0x640 [ 50.483618][ T872] user_path_at_empty+0x44/0x1b0 [ 50.488557][ T872] __se_sys_mount+0x293/0x3c0 [ 50.493367][ T872] __x64_sys_mount+0xbf/0xd0 [ 50.498022][ T872] do_syscall_64+0x44/0xd0 [ 50.502408][ T872] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 50.508360][ T872] [ 50.510666][ T872] Freed by task 78: [ 50.514443][ T872] kasan_set_track+0x4c/0x80 [ 50.519025][ T872] kasan_set_free_info+0x23/0x40 [ 50.523943][ T872] ____kasan_slab_free+0x126/0x160 [ 50.529025][ T872] __kasan_slab_free+0x11/0x20 [ 50.533765][ T872] slab_free_freelist_hook+0xc9/0x1a0 [ 50.539104][ T872] kmem_cache_free_bulk+0x3dc/0x700 [ 50.545331][ T872] kfree_rcu_work+0x2cb/0x6c0 [ 50.549991][ T872] process_one_work+0x6db/0xc00 [ 50.554825][ T872] worker_thread+0xb3e/0x1340 [ 50.560035][ T872] kthread+0x41c/0x500 [ 50.564974][ T872] ret_from_fork+0x1f/0x30 [ 50.569612][ T872] [ 50.571952][ T872] Last potentially related work creation: [ 50.577647][ T872] kasan_save_stack+0x36/0x60 [ 50.582322][ T872] kasan_record_aux_stack+0xca/0xf0 [ 50.587629][ T872] kvfree_call_rcu+0xb2/0x7f0 [ 50.592294][ T872] __d_move+0xb68/0x1a80 [ 50.596533][ T872] __d_unalias+0x1cc/0x220 [ 50.601021][ T872] d_splice_alias+0x22f/0x3b0 [ 50.605761][ T872] fuse_lookup+0x2b4/0x5f0 [ 50.610153][ T872] __lookup_slow+0x2b3/0x400 [ 50.614725][ T872] lookup_slow+0x5a/0x80 [ 50.618955][ T872] walk_component+0x425/0x5a0 [ 50.624330][ T872] link_path_walk+0x682/0xde0 [ 50.628995][ T872] filename_parentat+0x27e/0x6b0 [ 50.633917][ T872] filename_create+0xef/0x4f0 [ 50.638578][ T872] do_mkdirat+0xc2/0x420 [ 50.642819][ T872] __x64_sys_mkdir+0x6e/0x80 [ 50.647396][ T872] do_syscall_64+0x44/0xd0 [ 50.651797][ T872] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 50.657774][ T872] [ 50.660188][ T872] The buggy address belongs to the object at ffff888123f4f800 [ 50.660188][ T872] which belongs to the cache kmalloc-rcl-512 of size 512 [ 50.674656][ T872] The buggy address is located 16 bytes inside of [ 50.674656][ T872] 512-byte region [ffff888123f4f800, ffff888123f4fa00) [ 50.688087][ T872] The buggy address belongs to the page: [ 50.693694][ T872] page:ffffea00048fd300 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x123f4c [ 50.703940][ T872] head:ffffea00048fd300 order:2 compound_mapcount:0 compound_pincount:0 [ 50.712322][ T872] flags: 0x8000000000010200(slab|head|zone=2) [ 50.718377][ T872] raw: 8000000000010200 0000000000000000 dead000000000122 ffff888100042dc0 [ 50.726952][ T872] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 50.735611][ T872] page dumped because: kasan: bad access detected [ 50.742077][ T872] page_owner tracks the page as allocated [ 50.747769][ T872] page last allocated via order 2, migratetype Reclaimable, gfp_mask 0x1d20d0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 805, ts 49025847105, free_ts 0 [ 50.769265][ T872] get_page_from_freelist+0x58e/0x5a0 [ 50.774708][ T872] __alloc_pages+0x3bd/0x850 [ 50.779276][ T872] allocate_slab+0x66/0x510 [ 50.783761][ T872] ___slab_alloc+0x2e2/0x6f0 [ 50.788329][ T872] __slab_alloc+0x4a/0x90 [ 50.792631][ T872] __kmalloc+0x25b/0x350 [ 50.796931][ T872] __d_alloc+0xab/0x6b0 [ 50.801059][ T872] d_alloc_parallel+0xe0/0x12b0 [ 50.805884][ T872] __lookup_slow+0x14e/0x400 [ 50.810446][ T872] lookup_slow+0x5a/0x80 [ 50.814659][ T872] walk_component+0x425/0x5a0 [ 50.819491][ T872] path_lookupat+0x18d/0x460 [ 50.824150][ T872] filename_lookup+0x277/0x640 [ 50.828882][ T872] user_path_at_empty+0x44/0x1b0 [ 50.834066][ T872] vfs_statx+0x104/0x6a0 [ 50.838299][ T872] __se_sys_newfstatat+0xc8/0x780 [ 50.843387][ T872] page_owner free stack trace missing [ 50.848736][ T872] [ 50.851046][ T872] Memory state around the buggy address: [ 50.856835][ T872] ffff888123f4f700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 50.865178][ T872] ffff888123f4f780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 50.873300][ T872] >ffff888123f4f800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.881340][ T872] ^ [ 50.885906][ T872] ffff888123f4f880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.894031][ T872] ffff888123f4f900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.902059][ T872] ================================================================== [ 50.910101][ T872] Disabling lock debugging due to kernel taint 2022/12/12 19:41:15 executed programs: 96 2022/12/12 19:41:20 executed programs: 132