Warning: Permanently added '10.128.0.154' (ED25519) to the list of known hosts. 2025/03/28 23:33:53 ignoring optional flag "sandboxArg"="0" 2025/03/28 23:33:53 ignoring optional flag "type"="gce" 2025/03/28 23:33:53 parsed 1 programs 2025/03/28 23:33:53 executed programs: 0 [ 59.767445][ T425] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.774528][ T425] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.782363][ T425] device bridge_slave_0 entered promiscuous mode [ 59.791444][ T425] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.798401][ T425] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.805785][ T425] device bridge_slave_1 entered promiscuous mode [ 60.023709][ T433] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.030864][ T433] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.038534][ T433] device bridge_slave_0 entered promiscuous mode [ 60.048017][ T433] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.055349][ T433] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.063027][ T433] device bridge_slave_1 entered promiscuous mode [ 60.094062][ T438] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.101718][ T438] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.109316][ T438] device bridge_slave_0 entered promiscuous mode [ 60.128243][ T436] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.135331][ T436] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.142950][ T436] device bridge_slave_0 entered promiscuous mode [ 60.149930][ T438] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.156907][ T438] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.164411][ T438] device bridge_slave_1 entered promiscuous mode [ 60.182870][ T437] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.189946][ T437] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.197741][ T437] device bridge_slave_0 entered promiscuous mode [ 60.204687][ T436] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.212068][ T436] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.219946][ T436] device bridge_slave_1 entered promiscuous mode [ 60.241817][ T437] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.249864][ T437] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.258500][ T437] device bridge_slave_1 entered promiscuous mode [ 60.329369][ T440] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.336562][ T440] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.343933][ T440] device bridge_slave_0 entered promiscuous mode [ 60.354845][ T440] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.362004][ T440] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.369913][ T440] device bridge_slave_1 entered promiscuous mode [ 60.442480][ T425] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.449681][ T425] bridge0: port 2(bridge_slave_1) entered forwarding state [ 60.457039][ T425] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.464138][ T425] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.627829][ T438] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.634774][ T438] bridge0: port 2(bridge_slave_1) entered forwarding state [ 60.641977][ T438] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.648828][ T438] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.659794][ T436] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.666665][ T436] bridge0: port 2(bridge_slave_1) entered forwarding state [ 60.673830][ T436] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.680865][ T436] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.695543][ T103] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.702984][ T103] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.711516][ T103] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.719156][ T103] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.726582][ T103] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.733971][ T103] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.756407][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 60.764267][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 60.772266][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 60.781234][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 60.789641][ T103] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.797298][ T103] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.808815][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 60.826339][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 60.836785][ T103] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.844013][ T103] bridge0: port 2(bridge_slave_1) entered forwarding state [ 60.925363][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 60.933941][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 60.966973][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 60.974583][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 60.982717][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 60.992410][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 61.001496][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 61.011187][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 61.019581][ T103] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.026591][ T103] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.034156][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 61.042653][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 61.050885][ T103] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.058091][ T103] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.065861][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 61.074838][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 61.083000][ T103] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.089917][ T103] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.097466][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 61.106078][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 61.114064][ T103] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.121072][ T103] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.128434][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 61.142928][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 61.150703][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 61.177559][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 61.187882][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 61.195891][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 61.203878][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 61.212065][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 61.220201][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 61.235052][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 61.243726][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 61.251891][ T103] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.258906][ T103] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.266640][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 61.274903][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 61.283132][ T103] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.289991][ T103] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.316817][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 61.324604][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 61.332190][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 61.340731][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 61.349314][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 61.358280][ T103] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.365251][ T103] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.372719][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 61.381281][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 61.389582][ T103] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.396592][ T103] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.404045][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 61.412023][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 61.420032][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 61.449205][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 61.458519][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 61.466801][ T103] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.473728][ T103] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.481637][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 61.490921][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 61.499330][ T103] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.506185][ T103] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.513825][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 61.522221][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 61.530617][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 61.558425][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 61.568570][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 61.578062][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 61.616838][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 61.624793][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 61.633558][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 61.641550][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 61.650451][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 61.658895][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 61.686724][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 61.696416][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 61.705592][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 61.713402][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 61.722059][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 61.761549][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 61.770446][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 61.779171][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 61.787297][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 61.795392][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 61.803395][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 61.811859][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 61.820418][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 61.829089][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 61.837670][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 61.846027][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 61.854146][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 61.862639][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 61.870579][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 61.878558][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 61.887044][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 61.931123][ T23] kauditd_printk_skb: 15 callbacks suppressed [ 61.931137][ T23] audit: type=1400 audit(1743204836.030:91): avc: denied { mounton } for pid=462 comm="syz-executor.0" path="/root/syzkaller-testdir2548789280/syzkaller.z0V23m/0/file0" dev="sda1" ino=1947 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 61.935704][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 61.973413][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 61.982345][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 61.986635][ T463] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 61.991614][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 61.999792][ T23] audit: type=1400 audit(1743204836.100:92): avc: denied { mount } for pid=462 comm="syz-executor.0" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 62.007838][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 62.029244][ T463] ext4 filesystem being mounted at /root/syzkaller-testdir2548789280/syzkaller.z0V23m/0/file0 supports timestamps until (%ptR?) (0x7fffffff) [ 62.037822][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 62.066043][ T23] audit: type=1400 audit(1743204836.160:93): avc: denied { remount } for pid=462 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 62.075161][ T468] EXT4-fs (loop0): re-mounted. Opts: (null) [ 62.094677][ T468] EXT4-fs (loop0): re-mounted. Opts: (null) [ 62.102295][ T468] EXT4-fs (loop0): re-mounted. Opts: (null) [ 62.115803][ T468] EXT4-fs (loop0): re-mounted. Opts: (null) [ 62.121612][ T468] EXT4-fs (loop0): re-mounted. Opts: (null) [ 62.125153][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 62.136460][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 62.144525][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 62.145775][ T463] EXT4-fs (loop0): re-mounted. Opts: (null) [ 62.153910][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 62.159585][ T468] EXT4-fs (loop0): re-mounted. Opts: (null) [ 62.167920][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 62.172420][ T468] EXT4-fs (loop0): re-mounted. Opts: (null) [ 62.180718][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 62.194033][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 62.196179][ T463] EXT4-fs (loop0): re-mounted. Opts: (null) [ 62.202735][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 62.208420][ T468] EXT4-fs (loop0): re-mounted. Opts: (null) [ 62.216044][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 62.230195][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 62.238750][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 62.247078][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 62.255503][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 62.263618][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 62.272148][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 62.280543][ T103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 62.291587][ T23] audit: type=1400 audit(1743204836.390:94): avc: denied { mounton } for pid=438 comm="syz-executor.4" path="/dev/binderfs" dev="devtmpfs" ino=11618 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 62.364986][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 62.375446][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 62.384776][ T473] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue [ 62.397583][ T476] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 62.400314][ T473] ext4 filesystem being mounted at /root/syzkaller-testdir3900010169/syzkaller.6Rz8p8/0/file0 supports timestamps until (%ptR?) (0x7fffffff) [ 62.409555][ T476] ext4 filesystem being mounted at /root/syzkaller-testdir3258211223/syzkaller.YBQS6V/0/file0 supports timestamps until (%ptR?) (0x7fffffff) [ 62.445695][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 62.455192][ T487] EXT4-fs (loop4): re-mounted. Opts: (null) [ 62.469742][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 62.477462][ T23] audit: type=1400 audit(1743204836.570:95): avc: denied { unmount } for pid=425 comm="syz-executor.2" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 62.499736][ T487] EXT4-fs (loop4): re-mounted. Opts: (null) [ 62.508436][ T484] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 62.517285][ T491] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue [ 62.517402][ T491] ext4 filesystem being mounted at /root/syzkaller-testdir3543309606/syzkaller.N2oLfF/0/file0 supports timestamps until (%ptR?) (0x7fffffff) [ 62.527622][ T484] ext4 filesystem being mounted at /root/syzkaller-testdir638176407/syzkaller.XP6Y8r/0/file0 supports timestamps until (%ptR?) (0x7fffffff) [ 62.570443][ T473] EXT4-fs (loop4): re-mounted. Opts: (null) [ 62.577121][ T487] EXT4-fs (loop4): re-mounted. Opts: (null) [ 62.583828][ T487] EXT4-fs (loop4): re-mounted. Opts: (null) [ 62.589616][ T498] EXT4-fs (loop5): re-mounted. Opts: (null) [ 62.590056][ T498] EXT4-fs (loop5): re-mounted. Opts: (null) [ 62.601593][ T498] EXT4-fs (loop5): re-mounted. Opts: (null) [ 62.613590][ T498] EXT4-fs (loop5): re-mounted. Opts: (null) [ 62.620463][ T498] EXT4-fs (loop5): re-mounted. Opts: (null) [ 62.623639][ T487] EXT4-fs (loop4): re-mounted. Opts: (null) [ 62.635098][ T498] EXT4-fs (loop5): re-mounted. Opts: (null) [ 62.641405][ T498] EXT4-fs (loop5): re-mounted. Opts: (null) [ 62.655890][ T473] EXT4-fs (loop4): re-mounted. Opts: (null) [ 62.662418][ T487] EXT4-fs (loop4): re-mounted. Opts: (null) [ 62.675988][ T491] EXT4-fs (loop5): re-mounted. Opts: (null) [ 62.682241][ T473] EXT4-fs (loop4): re-mounted. Opts: (null) [ 62.694800][ T491] EXT4-fs (loop5): re-mounted. Opts: (null) [ 62.710269][ T500] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue [ 62.730414][ T487] EXT4-fs (loop4): re-mounted. Opts: (null) [ 62.739333][ T500] ext4 filesystem being mounted at /root/syzkaller-testdir1412220149/syzkaller.4Pph7y/0/file0 supports timestamps until (%ptR?) (0x7fffffff) [ 62.745496][ T503] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 62.762741][ T498] EXT4-fs (loop5): re-mounted. Opts: (null) [ 62.764809][ T463] EXT4-fs warning (device loop0): ext4_multi_mount_protect:325: MMP startup interrupted, failing mount [ 62.764809][ T463] [ 62.793351][ T503] ext4 filesystem being mounted at /root/syzkaller-testdir3258211223/syzkaller.YBQS6V/1/file0 supports timestamps until (%ptR?) (0x7fffffff) [ 62.815903][ T507] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 62.824879][ T507] ext4 filesystem being mounted at /root/syzkaller-testdir638176407/syzkaller.XP6Y8r/1/file0 supports timestamps until (%ptR?) (0x7fffffff) [ 62.839693][ T433] ================================================================== [ 62.847599][ T433] BUG: KASAN: use-after-free in kthread_stop+0x37/0x4a0 [ 62.854340][ T433] Write of size 4 at addr ffff8881e9354ee0 by task syz-executor.0/433 [ 62.862322][ T433] [ 62.864505][ T433] CPU: 1 PID: 433 Comm: syz-executor.0 Not tainted 5.4.290-syzkaller-05053-g41adfeb3d639 #0 [ 62.874395][ T433] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 62.884398][ T433] Call Trace: [ 62.887528][ T433] dump_stack+0x1d8/0x241 [ 62.891794][ T433] ? prepare_exit_to_usermode+0x199/0x200 [ 62.897417][ T433] ? nf_ct_l4proto_log_invalid+0x258/0x258 [ 62.903079][ T433] ? printk+0xd1/0x111 [ 62.906989][ T433] ? kthread_stop+0x37/0x4a0 [ 62.911491][ T433] print_address_description+0x8c/0x600 [ 62.917139][ T433] ? kthread_stop+0x37/0x4a0 [ 62.921557][ T433] __kasan_report+0xf3/0x120 [ 62.925994][ T433] ? kthread_stop+0x37/0x4a0 [ 62.930478][ T433] kasan_report+0x30/0x60 [ 62.934732][ T433] check_memory_region+0x272/0x280 [ 62.939670][ T433] kthread_stop+0x37/0x4a0 [ 62.944016][ T433] ext4_put_super+0x790/0xbb0 [ 62.948536][ T433] ? ext4_drop_inode+0x1f0/0x1f0 [ 62.953481][ T433] generic_shutdown_super+0x120/0x300 [ 62.958673][ T433] kill_block_super+0x7a/0xe0 [ 62.963184][ T433] deactivate_locked_super+0xa8/0x110 [ 62.968418][ T433] deactivate_super+0x1e2/0x2a0 [ 62.973083][ T433] ? vfs_submount+0xb0/0xb0 [ 62.977550][ T433] ? deactivate_locked_super+0x110/0x110 [ 62.983091][ T433] ? fast_dput+0x7a/0x280 [ 62.987263][ T433] cleanup_mnt+0x44e/0x500 [ 62.991507][ T433] task_work_run+0x140/0x170 [ 62.996377][ T433] exit_to_usermode_loop+0x190/0x1a0 [ 63.001504][ T433] prepare_exit_to_usermode+0x199/0x200 [ 63.007082][ T433] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 63.013238][ T433] RIP: 0033:0x7fcdb76e3067 [ 63.017538][ T433] Code: b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b0 ff ff ff f7 d8 64 89 02 b8 [ 63.037741][ T433] RSP: 002b:00007ffd27b81d28 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 63.045989][ T433] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fcdb76e3067 [ 63.053918][ T433] RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007ffd27b81de0 [ 63.062033][ T433] RBP: 00007ffd27b81de0 R08: 0000000000000000 R09: 0000000000000000 [ 63.069919][ T433] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd27b82ea0 [ 63.077731][ T433] R13: 00007fcdb773d56a R14: 000000000000f1ce R15: 0000000000000003 [ 63.085539][ T433] [ 63.087706][ T433] Allocated by task 2: [ 63.091620][ T433] __kasan_kmalloc+0x171/0x210 [ 63.096295][ T433] kmem_cache_alloc+0xd9/0x250 [ 63.100828][ T433] dup_task_struct+0x4f/0x600 [ 63.105345][ T433] copy_process+0x56d/0x3230 [ 63.109756][ T433] _do_fork+0x197/0x900 [ 63.113763][ T433] kernel_thread+0x16a/0x1d0 [ 63.118186][ T433] kthreadd+0x3b1/0x4f0 [ 63.122199][ T433] ret_from_fork+0x1f/0x30 [ 63.126418][ T433] [ 63.128590][ T433] Freed by task 0: [ 63.132156][ T433] __kasan_slab_free+0x1b5/0x270 [ 63.136935][ T433] kmem_cache_free+0x10b/0x2c0 [ 63.141707][ T433] rcu_do_batch+0x492/0xa00 [ 63.146096][ T433] rcu_core+0x4c8/0xcb0 [ 63.150042][ T433] __do_softirq+0x23b/0x6b7 [ 63.154466][ T433] [ 63.156715][ T433] The buggy address belongs to the object at ffff8881e9354ec0 [ 63.156715][ T433] which belongs to the cache task_struct of size 3904 [ 63.171245][ T433] The buggy address is located 32 bytes inside of [ 63.171245][ T433] 3904-byte region [ffff8881e9354ec0, ffff8881e9355e00) [ 63.184766][ T433] The buggy address belongs to the page: [ 63.190419][ T433] page:ffffea0007a4d400 refcount:1 mapcount:0 mapping:ffff8881f5cf1680 index:0x0 compound_mapcount: 0 [ 63.201174][ T433] flags: 0x8000000000010200(slab|head) [ 63.206470][ T433] raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881f5cf1680 [ 63.215089][ T433] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000 [ 63.223665][ T433] page dumped because: kasan: bad access detected [ 63.229932][ T433] page_owner tracks the page as allocated [ 63.235711][ T433] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL) [ 63.252090][ T433] prep_new_page+0x18f/0x370 [ 63.256513][ T433] get_page_from_freelist+0x2d13/0x2d90 [ 63.261900][ T433] __alloc_pages_nodemask+0x393/0x840 [ 63.267111][ T433] alloc_slab_page+0x39/0x3c0 [ 63.271611][ T433] new_slab+0x97/0x440 [ 63.275516][ T433] ___slab_alloc+0x2fe/0x490 [ 63.280491][ T433] __slab_alloc+0x62/0xa0 [ 63.284639][ T433] kmem_cache_alloc+0x109/0x250 [ 63.289333][ T433] dup_task_struct+0x4f/0x600 [ 63.293863][ T433] copy_process+0x56d/0x3230 [ 63.298282][ T433] _do_fork+0x197/0x900 [ 63.302511][ T433] kernel_thread+0x16a/0x1d0 [ 63.307532][ T433] kthreadd+0x3b1/0x4f0 [ 63.311456][ T433] ret_from_fork+0x1f/0x30 [ 63.315835][ T433] page last free stack trace: [ 63.320358][ T433] __free_pages_ok+0x847/0x950 [ 63.324951][ T433] __free_pages+0x91/0x140 [ 63.329205][ T433] __free_slab+0x221/0x2e0 [ 63.333455][ T433] unfreeze_partials+0x14e/0x180 [ 63.338234][ T433] put_cpu_partial+0x44/0x180 [ 63.342742][ T433] __slab_free+0x297/0x360 [ 63.347183][ T433] qlist_free_all+0x43/0xb0 [ 63.351517][ T433] quarantine_reduce+0x1d9/0x210 [ 63.356404][ T433] __kasan_kmalloc+0x41/0x210 [ 63.360903][ T433] kmem_cache_alloc+0xd9/0x250 [ 63.365507][ T433] sock_alloc_inode+0x17/0xb0 [ 63.370109][ T433] new_inode_pseudo+0x60/0x210 [ 63.375138][ T433] __sock_create+0x124/0x7a0 [ 63.380118][ T433] udp_sock_create4+0xd6/0x660 [ 63.384816][ T433] wg_socket_init+0x51a/0xcc0 [ 63.389313][ T433] wg_open+0x18f/0x300 [ 63.393211][ T433] [ 63.395651][ T433] Memory state around the buggy address: [ 63.401301][ T433] ffff8881e9354d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 63.409243][ T433] ffff8881e9354e00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 63.417377][ T433] >ffff8881e9354e80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 63.425396][ T433] ^ [ 63.432449][ T433] ffff8881e9354f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 63.440382][ T433] ffff8881e9354f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 63.448223][ T433] ================================================================== [ 63.457005][ T433] Disabling lock debugging due to kernel taint [ 63.466187][ T433] ------------[ cut here ]------------ [ 63.471560][ T433] refcount_t: addition on 0; use-after-free. [ 63.481004][ T473] EXT4-fs warning (device loop4): ext4_multi_mount_protect:387: Unable to create kmmpd thread for loop4. [ 63.487260][ T433] WARNING: CPU: 0 PID: 433 at lib/refcount.c:25 refcount_warn_saturate+0x132/0x1a0 [ 63.501551][ T433] Modules linked in: [ 63.505277][ T433] CPU: 0 PID: 433 Comm: syz-executor.0 Tainted: G B 5.4.290-syzkaller-05053-g41adfeb3d639 #0 [ 63.516553][ T433] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 63.526670][ T433] RIP: 0010:refcount_warn_saturate+0x132/0x1a0 [ 63.532627][ T433] Code: 04 01 48 c7 c7 20 1d fa 84 e8 ba 8b 0d ff 0f 0b eb a9 e8 c1 e9 36 ff c6 05 d6 0d 1d 04 01 48 c7 c7 a0 1d fa 84 e8 9e 8b 0d ff <0f> 0b eb 8d e8 a5 e9 36 ff c6 05 bb 0d 1d 04 01 48 c7 c7 00 1e fa [ 63.552473][ T433] RSP: 0018:ffff8881eb457c30 EFLAGS: 00010246 [ 63.558552][ T433] RAX: c0f13ac2074cae00 RBX: 0000000000000002 RCX: ffff8881edfd2f40 [ 63.566355][ T433] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 63.574165][ T433] RBP: 0000000000000002 R08: ffffffff814d6db2 R09: ffffed103edca9b8 [ 63.582063][ T433] R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000 [ 63.589886][ T433] R13: ffff8881e9354ec0 R14: dffffc0000000000 R15: ffff8881e9354ee0 [ 63.597686][ T433] FS: 00005555691e7480(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 63.606447][ T433] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 63.612886][ T433] CR2: 00007ffe00ceef98 CR3: 00000001ecdc2000 CR4: 00000000003406b0 [ 63.620949][ T433] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 63.628757][ T433] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 63.636571][ T433] Call Trace: [ 63.639709][ T433] ? __warn+0x162/0x250 [ 63.643699][ T433] ? report_bug+0x3a1/0x4e0 [ 63.648127][ T433] ? refcount_warn_saturate+0x132/0x1a0 [ 63.653568][ T433] ? refcount_warn_saturate+0x132/0x1a0 [ 63.658878][ T433] ? do_invalid_op+0x6e/0x110 [ 63.663389][ T433] ? invalid_op+0x1e/0x30 [ 63.667554][ T433] ? wake_up_klogd+0xb2/0xf0 [ 63.671994][ T433] ? refcount_warn_saturate+0x132/0x1a0 [ 63.677363][ T433] kthread_stop+0x1a5/0x4a0 [ 63.681717][ T433] ext4_put_super+0x790/0xbb0 [ 63.686245][ T433] ? ext4_drop_inode+0x1f0/0x1f0 [ 63.690999][ T433] generic_shutdown_super+0x120/0x300 [ 63.696286][ T433] kill_block_super+0x7a/0xe0 [ 63.700807][ T433] deactivate_locked_super+0xa8/0x110 [ 63.706004][ T433] deactivate_super+0x1e2/0x2a0 [ 63.710889][ T433] ? vfs_submount+0xb0/0xb0 [ 63.715312][ T433] ? deactivate_locked_super+0x110/0x110 [ 63.720802][ T433] ? fast_dput+0x7a/0x280 [ 63.724957][ T433] cleanup_mnt+0x44e/0x500 [ 63.729237][ T433] task_work_run+0x140/0x170 [ 63.733631][ T433] exit_to_usermode_loop+0x190/0x1a0 [ 63.738747][ T433] prepare_exit_to_usermode+0x199/0x200 [ 63.744212][ T433] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 63.750026][ T433] RIP: 0033:0x7fcdb76e3067 [ 63.754379][ T433] Code: b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b0 ff ff ff f7 d8 64 89 02 b8 [ 63.773835][ T433] RSP: 002b:00007ffd27b81d28 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 63.782260][ T433] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fcdb76e3067 [ 63.790258][ T433] RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007ffd27b81de0 [ 63.798292][ T433] RBP: 00007ffd27b81de0 R08: 0000000000000000 R09: 0000000000000000 [ 63.806089][ T433] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd27b82ea0 [ 63.813932][ T433] R13: 00007fcdb773d56a R14: 000000000000f1ce R15: 0000000000000003 [ 63.821844][ T433] ---[ end trace ffaaafef294221b5 ]--- [ 64.037451][ T529] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 64.048506][ T531] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue [ 64.048661][ T540] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue [ 64.057809][ T529] ext4 filesystem being mounted at /root/syzkaller-testdir3258211223/syzkaller.YBQS6V/2/file0 supports timestamps until (%ptR?) (0x7fffffff) [ 64.075387][ T531] ext4 filesystem being mounted at /root/syzkaller-testdir1412220149/syzkaller.4Pph7y/1/file0 supports timestamps until (%ptR?) (0x7fffffff) [ 64.085158][ T540] ext4 filesystem being mounted at /root/syzkaller-testdir3900010169/syzkaller.6Rz8p8/1/file0 supports timestamps until (%ptR?) (0x7fffffff) [ 64.098955][ T538] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue [ 64.148199][ T540] EXT4-fs (loop4): re-mounted. Opts: (null) [ 64.149275][ T541] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 64.160960][ T538] ext4 filesystem being mounted at /root/syzkaller-testdir3543309606/syzkaller.N2oLfF/1/file0 supports timestamps until (%ptR?) (0x7fffffff) [ 64.181229][ T541] ext4 filesystem being mounted at /root/syzkaller-testdir638176407/syzkaller.XP6Y8r/2/file0 supports timestamps until (%ptR?) (0x7fffffff) [ 64.181849][ T540] EXT4-fs (loop4): re-mounted. Opts: (null) [ 64.215970][ T561] EXT4-fs (loop4): re-mounted. Opts: (null) [ 64.222554][ T540] EXT4-fs (loop4): re-mounted. Opts: (null) [ 64.243570][ T540] EXT4-fs (loop4): re-mounted. Opts: (null) [ 64.255726][ T561] EXT4-fs (loop4): re-mounted. Opts: (null) [ 64.262362][ T540] EXT4-fs (loop4): re-mounted. Opts: (null) [ 64.276043][ T561] EXT4-fs (loop4): re-mounted. Opts: (null) [ 64.282467][ T540] EXT4-fs (loop4): re-mounted. Opts: (null) [ 64.295759][ T561] EXT4-fs (loop4): re-mounted. Opts: (null) [ 64.367394][ T564] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 64.377333][ T564] ext4 filesystem being mounted at /root/syzkaller-testdir3258211223/syzkaller.YBQS6V/4/file0 supports timestamps until (%ptR?) (0x7fffffff) [ 64.393481][ T566] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue [ 64.410445][ T566] ext4 filesystem being mounted at /root/syzkaller-testdir1412220149/syzkaller.4Pph7y/2/file0 supports timestamps until (%ptR?) (0x7fffffff) [ 64.437172][ T580] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 64.447247][ T580] ext4 filesystem being mounted at /root/syzkaller-testdir638176407/syzkaller.XP6Y8r/3/file0 supports timestamps until (%ptR?) (0x7fffffff) [ 64.473692][ T592] EXT4-fs (loop1): re-mounted. Opts: (null) [ 64.479816][ T592] EXT4-fs (loop1): re-mounted. Opts: (null) [ 64.498717][ T589] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue [ 64.499516][ T592] EXT4-fs (loop1): re-mounted. Opts: (null) [ 64.507727][ T589] ext4 filesystem being mounted at /root/syzkaller-testdir3543309606/syzkaller.N2oLfF/2/file0 supports timestamps until (%ptR?) (0x7fffffff) [ 64.514175][ T592] EXT4-fs (loop1): re-mounted. Opts: (null) [ 64.549359][ T580] EXT4-fs (loop1): re-mounted. Opts: (null) [ 64.555844][ T592] EXT4-fs (loop1): re-mounted. Opts: (null) [ 64.565822][ T580] EXT4-fs (loop1): re-mounted. Opts: (null) [ 64.572533][ T592] EXT4-fs (loop1): re-mounted. Opts: (null) [ 64.582011][ T592] EXT4-fs (loop1): re-mounted. Opts: (null) [ 64.600080][ T580] EXT4-fs (loop1): re-mounted. Opts: (null) [ 64.609245][ T598] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 64.618231][ T607] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue [ 64.627960][ T607] ext4 filesystem being mounted at /root/syzkaller-testdir1412220149/syzkaller.4Pph7y/3/file0 supports timestamps until (%ptR?) (0x7fffffff) [ 64.639459][ T598] ext4 filesystem being mounted at /root/syzkaller-testdir3258211223/syzkaller.YBQS6V/5/file0 supports timestamps until (%ptR?) (0x7fffffff) [ 64.658077][ T601] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue [ 64.667768][ T607] EXT4-fs (loop3): re-mounted. Opts: (null) 2025/03/28 23:33:58 executed programs: 23 [ 64.668221][ T601] ext4 filesystem being mounted at /root/syzkaller-testdir3900010169/syzkaller.6Rz8p8/2/file0 supports timestamps until (%ptR?) (0x7fffffff) [ 64.689026][ T607] EXT4-fs (loop3): re-mounted. Opts: (null) [ 64.702559][ T607] EXT4-fs (loop3): re-mounted. Opts: (null) [ 64.716707][ T619] EXT4-fs (loop3): re-mounted. Opts: (null) [ 64.724090][ T607] EXT4-fs (loop3): re-mounted. Opts: (null) [ 64.735838][ T619] EXT4-fs (loop3): re-mounted. Opts: (null) [ 64.742642][ T607] EXT4-fs (loop3): re-mounted. Opts: (null) [ 64.751546][ T607] EXT4-fs (loop3): re-mounted. Opts: (null) [ 64.769214][ T619] EXT4-fs (loop3): re-mounted. Opts: (null) [ 64.775849][ T607] EXT4-fs (loop3): re-mounted. Opts: (null) [ 66.545657][ T13] cfg80211: failed to load regulatory.db