Warning: Permanently added '[localhost]:50293' (ED25519) to the list of known hosts.
2024/02/27 14:52:08 ignoring optional flag "sandboxArg"="0"
2024/02/27 14:52:08 parsed 1 programs
[ 75.336606][ T39] kauditd_printk_skb: 73 callbacks suppressed
[ 75.336616][ T39] audit: type=1400 audit(1709045528.383:206): avc: denied { getattr } for pid=5390 comm="syz-execprog" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 75.385552][ T39] audit: type=1400 audit(1709045528.433:207): avc: denied { mounton } for pid=5396 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1
[ 75.398891][ T39] audit: type=1400 audit(1709045528.433:208): avc: denied { mount } for pid=5396 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1
[ 75.409288][ T39] audit: type=1400 audit(1709045528.453:209): avc: denied { read write } for pid=5396 comm="syz-executor" name="swap-file" dev="sda1" ino=1930 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t"
[ 75.420850][ T39] audit: type=1400 audit(1709045528.453:210): avc: denied { open } for pid=5396 comm="syz-executor" path="/swap-file" dev="sda1" ino=1930 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t"
[ 75.461781][ T39] audit: type=1400 audit(1709045528.513:211): avc: denied { unlink } for pid=5396 comm="syz-executor" name="swap-file" dev="sda1" ino=1930 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t"
[ 76.082519][ T39] audit: type=1400 audit(1709045529.133:212): avc: denied { relabelto } for pid=5399 comm="mkswap" name="swap-file" dev="sda1" ino=1930 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t"
[ 76.865358][ T1350] ieee802154 phy0 wpan0: encryption failed: -22
[ 76.869657][ T1350] ieee802154 phy1 wpan1: encryption failed: -22
[ 76.921073][ T5396] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
2024/02/27 14:52:09 executed programs: 0
[ 76.990626][ T63] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 76.995285][ T63] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 77.001862][ T63] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 77.006736][ T63] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 77.011321][ T63] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 77.015600][ T63] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 77.040021][ T39] audit: type=1400 audit(1709045530.093:213): avc: denied { mounton } for pid=5406 comm="syz-executor.0" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1
[ 77.191635][ T5406] chnl_net:caif_netlink_parms(): no params data found
[ 77.275601][ T5406] bridge0: port 1(bridge_slave_0) entered blocking state
[ 77.278239][ T5406] bridge0: port 1(bridge_slave_0) entered disabled state
[ 77.281452][ T5406] bridge_slave_0: entered allmulticast mode
[ 77.284707][ T5406] bridge_slave_0: entered promiscuous mode
[ 77.289260][ T5406] bridge0: port 2(bridge_slave_1) entered blocking state
[ 77.291999][ T5406] bridge0: port 2(bridge_slave_1) entered disabled state
[ 77.294715][ T5406] bridge_slave_1: entered allmulticast mode
[ 77.297671][ T5406] bridge_slave_1: entered promiscuous mode
[ 77.349185][ T5406] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 77.354605][ T5406] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 77.398310][ T5406] team0: Port device team_slave_0 added
[ 77.402537][ T5406] team0: Port device team_slave_1 added
[ 77.445484][ T5406] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 77.448062][ T5406] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 77.457596][ T5406] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 77.463214][ T5406] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 77.465813][ T5406] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 77.475216][ T5406] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 77.530601][ T5406] hsr_slave_0: entered promiscuous mode
[ 77.533464][ T5406] hsr_slave_1: entered promiscuous mode
[ 77.955582][ T39] audit: type=1400 audit(1709045531.003:214): avc: denied { search } for pid=4647 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 78.155554][ T5406] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 78.161291][ T5406] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 78.168166][ T5406] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 78.173969][ T5406] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 78.192308][ T5406] bridge0: port 2(bridge_slave_1) entered blocking state
[ 78.195111][ T5406] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 78.197982][ T5406] bridge0: port 1(bridge_slave_0) entered blocking state
[ 78.200674][ T5406] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 78.223240][ T5191] bridge0: port 1(bridge_slave_0) entered disabled state
[ 78.235029][ T5191] bridge0: port 2(bridge_slave_1) entered disabled state
[ 78.271013][ T5406] 8021q: adding VLAN 0 to HW filter on device bond0
[ 78.285228][ T5406] 8021q: adding VLAN 0 to HW filter on device team0
[ 78.292988][ T37] bridge0: port 1(bridge_slave_0) entered blocking state
[ 78.295695][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 78.313194][ T37] bridge0: port 2(bridge_slave_1) entered blocking state
[ 78.315976][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 78.361582][ T39] audit: type=1400 audit(1709045531.413:215): avc: denied { sys_module } for pid=5406 comm="syz-executor.0" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1
[ 78.456975][ T5406] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 78.493566][ T5406] veth0_vlan: entered promiscuous mode
[ 78.499643][ T5406] veth1_vlan: entered promiscuous mode
[ 78.522296][ T5406] veth0_macvtap: entered promiscuous mode
[ 78.530038][ T5406] veth1_macvtap: entered promiscuous mode
[ 78.543460][ T5406] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 78.551210][ T5406] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 78.560601][ T5406] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 78.564243][ T5406] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 78.567990][ T5406] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 78.571822][ T5406] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 78.622492][ T71] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 78.625574][ T71] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 78.652716][ T71] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 78.655748][ T71] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 79.110569][ T63] Bluetooth: hci0: command 0x0409 tx timeout
[ 80.781813][ T13] ==================================================================
[ 80.785526][ T13] BUG: KASAN: slab-use-after-free in drm_atomic_helper_wait_for_vblanks.part.0+0x84f/0x930
[ 80.790066][ T13] Read of size 1 at addr ffff88802378cc09 by task kworker/u16:1/13
[ 80.796989][ T13]
[ 80.798103][ T13] CPU: 2 PID: 13 Comm: kworker/u16:1 Not tainted 6.8.0-rc6-syzkaller-g45ec2f5f6ed3 #0
[ 80.802593][ T13] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 80.808996][ T13] Workqueue: events_unbound commit_work
[ 80.811563][ T13] Call Trace:
[ 80.813375][ T13]
[ 80.814880][ T13] dump_stack_lvl+0xd9/0x1b0
[ 80.817114][ T13] print_report+0xc4/0x620
[ 80.819135][ T13] ? __virt_addr_valid+0x5e/0x580
[ 80.821370][ T13] ? __phys_addr+0xc6/0x150
[ 80.823538][ T13] kasan_report+0xda/0x110
[ 80.825953][ T13] ? drm_atomic_helper_wait_for_vblanks.part.0+0x84f/0x930
[ 80.829294][ T13] ? drm_atomic_helper_wait_for_vblanks.part.0+0x84f/0x930
[ 80.834647][ T13] drm_atomic_helper_wait_for_vblanks.part.0+0x84f/0x930
[ 80.837795][ T13] ? preempt_schedule_thunk+0x1a/0x30
[ 80.841283][ T13] ? __pfx_drm_atomic_helper_wait_for_vblanks.part.0+0x10/0x10
[ 80.846070][ T13] ? _raw_spin_unlock_irqrestore+0x61/0x80
[ 80.848532][ T13] ? drm_atomic_helper_commit_hw_done+0x30e/0x4a0
[ 80.851460][ T13] drm_atomic_helper_commit_tail+0xcb/0xf0
[ 80.854114][ T13] commit_tail+0x356/0x410
[ 80.856176][ T13] process_one_work+0x889/0x15e0
[ 80.858799][ T13] ? __pfx_lock_acquire+0x10/0x10
[ 80.861336][ T13] ? __pfx_process_one_work+0x10/0x10
[ 80.866771][ T13] ? assign_work+0x1a0/0x250
[ 80.869274][ T13] worker_thread+0x8b9/0x12a0
[ 80.871540][ T13] ? __pfx_worker_thread+0x10/0x10
[ 80.874027][ T13] kthread+0x2c6/0x3b0
[ 80.875984][ T13] ? _raw_spin_unlock_irq+0x23/0x50
[ 80.878475][ T13] ? __pfx_kthread+0x10/0x10
[ 80.880506][ T13] ret_from_fork+0x45/0x80
[ 80.882671][ T13] ? __pfx_kthread+0x10/0x10
[ 80.884851][ T13] ret_from_fork_asm+0x1b/0x30
[ 80.886816][ T13]
[ 80.888058][ T13]
[ 80.889047][ T13] Allocated by task 5721:
[ 80.890955][ T13] kasan_save_stack+0x33/0x60
[ 80.893244][ T13] kasan_save_track+0x14/0x30
[ 80.895449][ T13] __kasan_kmalloc+0xaa/0xb0
[ 80.897612][ T13] drm_atomic_helper_crtc_duplicate_state+0x70/0xd0
[ 80.900717][ T13] drm_atomic_get_crtc_state+0x162/0x440
[ 80.903212][ T13] page_flip_common+0x57/0x320
[ 80.905540][ T13] drm_atomic_helper_page_flip+0xb6/0x190
[ 80.908765][ T13] drm_mode_page_flip_ioctl+0x103f/0x1470
[ 80.911838][ T13] drm_ioctl_kernel+0x1ec/0x3e0
[ 80.914150][ T13] drm_ioctl+0x5d8/0xc00
[ 80.916254][ T13] __x64_sys_ioctl+0x193/0x220
[ 80.918560][ T13] do_syscall_64+0xd5/0x270
[ 80.920756][ T13] entry_SYSCALL_64_after_hwframe+0x6f/0x77
[ 80.923592][ T13]
[ 80.924676][ T13] Freed by task 5720:
[ 80.926843][ T13] kasan_save_stack+0x33/0x60
[ 80.929110][ T13] kasan_save_track+0x14/0x30
[ 80.931444][ T13] kasan_save_free_info+0x3f/0x60
[ 80.934012][ T13] __kasan_slab_free+0x121/0x1c0
[ 80.936415][ T13] kfree+0x124/0x370
[ 80.938257][ T13] drm_atomic_state_default_clear+0x3aa/0xde0
[ 80.941053][ T13] __drm_atomic_state_free+0x185/0x2b0
[ 80.943594][ T13] drm_client_modeset_commit_atomic+0x6db/0x810
[ 80.946753][ T13] drm_client_modeset_commit_locked+0x14d/0x580
[ 80.949822][ T13] drm_client_modeset_commit+0x4f/0x80
[ 80.952119][ T13] drm_fb_helper_lastclose+0xc7/0x160
[ 80.954491][ T13] drm_fbdev_generic_client_restore+0x2c/0x40
[ 80.957289][ T13] drm_client_dev_restore+0x188/0x2a0
[ 80.959673][ T13] drm_release+0x32f/0x3e0
[ 80.961609][ T13] __fput+0x270/0xb80
[ 80.963841][ T13] __fput_sync+0x47/0x50
[ 80.966532][ T13] __x64_sys_close+0x87/0x100
[ 80.969070][ T13] do_syscall_64+0xd5/0x270
[ 80.971201][ T13] entry_SYSCALL_64_after_hwframe+0x6f/0x77
[ 80.974004][ T13]
[ 80.975113][ T13] The buggy address belongs to the object at ffff88802378cc00
[ 80.975113][ T13] which belongs to the cache kmalloc-512 of size 512
[ 80.981595][ T13] The buggy address is located 9 bytes inside of
[ 80.981595][ T13] freed 512-byte region [ffff88802378cc00, ffff88802378ce00)
[ 80.988128][ T13]
[ 80.989444][ T13] The buggy address belongs to the physical page:
[ 80.992656][ T13] page:ffffea00008de300 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2378c
[ 80.997364][ T13] head:ffffea00008de300 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 81.001672][ T13] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 81.005764][ T13] page_type: 0xffffffff()
[ 81.008173][ T13] raw: 00fff00000000840 ffff888014c42c80 ffffea0000a77a00 dead000000000002
[ 81.012100][ T13] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
[ 81.015924][ T13] page dumped because: kasan: bad access detected
[ 81.018858][ T13] page_owner tracks the page as allocated
[ 81.021611][ T13] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 4665, tgid 4665 (udevd), ts 78790336769, free_ts 73008917105
[ 81.032172][ T13] post_alloc_hook+0x2d4/0x350
[ 81.034442][ T13] get_page_from_freelist+0xa28/0x3780
[ 81.037065][ T13] __alloc_pages+0x22f/0x2440
[ 81.039249][ T13] new_slab+0xcc/0x3a0
[ 81.041407][ T13] ___slab_alloc+0x4af/0x19a0
[ 81.043683][ T13] __slab_alloc.constprop.0+0x56/0xb0
[ 81.046475][ T13] kmalloc_trace+0x30b/0x340
[ 81.049146][ T13] kernfs_fop_open+0x28b/0xd40
[ 81.051756][ T13] do_dentry_open+0x8da/0x18c0
[ 81.054469][ T13] path_openat+0x1e00/0x29a0
[ 81.056627][ T13] do_filp_open+0x1de/0x440
[ 81.058736][ T13] do_sys_openat2+0x17a/0x1e0
[ 81.060943][ T13] __x64_sys_openat+0x175/0x210
[ 81.063235][ T13] do_syscall_64+0xd5/0x270
[ 81.065357][ T13] entry_SYSCALL_64_after_hwframe+0x6f/0x77
[ 81.068201][ T13] page last free pid 5331 tgid 5331 stack trace:
[ 81.071115][ T13] free_unref_page_prepare+0x527/0xb10
[ 81.073728][ T13] free_unref_page+0x33/0x3c0
[ 81.076132][ T13] __folio_put+0xc3/0x110
[ 81.078374][ T13] anon_pipe_buf_release+0x3fa/0x4b0
[ 81.081121][ T13] pipe_read+0x64a/0x1410
[ 81.083192][ T13] vfs_read+0xa01/0xb80
[ 81.085082][ T13] ksys_read+0x1f8/0x260
[ 81.087016][ T13] do_syscall_64+0xd5/0x270
[ 81.088878][ T13] entry_SYSCALL_64_after_hwframe+0x6f/0x77
[ 81.091589][ T13]
[ 81.092697][ T13] Memory state around the buggy address:
[ 81.095384][ T13] ffff88802378cb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 81.099308][ T13] ffff88802378cb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 81.103129][ T13] >ffff88802378cc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 81.106885][ T13] ^
[ 81.108882][ T13] ffff88802378cc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 81.112555][ T13] ffff88802378cd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 81.117012][ T13] ==================================================================
[ 81.122533][ T13] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 81.125840][ T13] CPU: 2 PID: 13 Comm: kworker/u16:1 Not tainted 6.8.0-rc6-syzkaller-g45ec2f5f6ed3 #0
[ 81.129995][ T13] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 81.134369][ T13] Workqueue: events_unbound commit_work
[ 81.137058][ T13] Call Trace:
[ 81.138727][ T13]
[ 81.139924][ T13] dump_stack_lvl+0xd9/0x1b0
[ 81.141704][ T13] panic+0x6ee/0x7a0
[ 81.143107][ T13] ? __pfx_panic+0x10/0x10
[ 81.145161][ T13] ? irqentry_exit+0x3b/0x90
[ 81.147197][ T13] ? lockdep_hardirqs_on+0x7d/0x110
[ 81.149092][ T13] ? preempt_schedule_thunk+0x1a/0x30
[ 81.151259][ T13] ? preempt_schedule_common+0x45/0xd0
[ 81.153412][ T13] ? check_panic_on_warn+0x1f/0xb0
[ 81.155258][ T13] check_panic_on_warn+0xab/0xb0
[ 81.157205][ T13] end_report+0x108/0x150
[ 81.158800][ T13] kasan_report+0xea/0x110
[ 81.160591][ T13] ? drm_atomic_helper_wait_for_vblanks.part.0+0x84f/0x930
[ 81.163540][ T13] ? drm_atomic_helper_wait_for_vblanks.part.0+0x84f/0x930
[ 81.166534][ T13] drm_atomic_helper_wait_for_vblanks.part.0+0x84f/0x930
[ 81.169579][ T13] ? preempt_schedule_thunk+0x1a/0x30
[ 81.171919][ T13] ? __pfx_drm_atomic_helper_wait_for_vblanks.part.0+0x10/0x10
[ 81.175060][ T13] ? _raw_spin_unlock_irqrestore+0x61/0x80
[ 81.177634][ T13] ? drm_atomic_helper_commit_hw_done+0x30e/0x4a0
[ 81.180440][ T13] drm_atomic_helper_commit_tail+0xcb/0xf0
[ 81.183027][ T13] commit_tail+0x356/0x410
[ 81.184865][ T13] process_one_work+0x889/0x15e0
[ 81.187020][ T13] ? __pfx_lock_acquire+0x10/0x10
[ 81.189227][ T13] ? __pfx_process_one_work+0x10/0x10
[ 81.191545][ T13] ? assign_work+0x1a0/0x250
[ 81.193405][ T13] worker_thread+0x8b9/0x12a0
[ 81.195090][ T13] ? __pfx_worker_thread+0x10/0x10
[ 81.196983][ T13] kthread+0x2c6/0x3b0
[ 81.198454][ T13] ? _raw_spin_unlock_irq+0x23/0x50
[ 81.200384][ T13] ? __pfx_kthread+0x10/0x10
[ 81.202086][ T13] ret_from_fork+0x45/0x80
[ 81.203788][ T13] ? __pfx_kthread+0x10/0x10
[ 81.205680][ T13] ret_from_fork_asm+0x1b/0x30
[ 81.207460][ T13]
[ 81.210986][ T13] Kernel Offset: disabled
[ 81.212669][ T13] Rebooting in 86400 seconds..