Warning: Permanently added '10.128.1.94' (ED25519) to the list of known hosts.
2023/11/09 14:50:15 ignoring optional flag "sandboxArg"="0"
2023/11/09 14:50:16 parsed 1 programs
2023/11/09 14:50:17 executed programs: 0
[ 91.960754][ T5407] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 92.020024][ T5060] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 92.029254][ T5060] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 92.039357][ T5060] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 92.050481][ T5060] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 92.058727][ T5060] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 92.067218][ T5060] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 92.195508][ T5413] chnl_net:caif_netlink_parms(): no params data found
[ 92.260239][ T5413] bridge0: port 1(bridge_slave_0) entered blocking state
[ 92.267776][ T5413] bridge0: port 1(bridge_slave_0) entered disabled state
[ 92.275775][ T5413] bridge_slave_0: entered allmulticast mode
[ 92.283464][ T5413] bridge_slave_0: entered promiscuous mode
[ 92.293622][ T5413] bridge0: port 2(bridge_slave_1) entered blocking state
[ 92.301138][ T5413] bridge0: port 2(bridge_slave_1) entered disabled state
[ 92.308537][ T5413] bridge_slave_1: entered allmulticast mode
[ 92.315632][ T5413] bridge_slave_1: entered promiscuous mode
[ 92.339773][ T5413] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 92.354372][ T5413] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 92.384952][ T5413] team0: Port device team_slave_0 added
[ 92.392752][ T5413] team0: Port device team_slave_1 added
[ 92.414438][ T5413] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 92.423351][ T5413] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 92.450545][ T5413] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 92.464259][ T5413] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 92.471278][ T5413] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 92.498901][ T5413] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 92.534260][ T5413] hsr_slave_0: entered promiscuous mode
[ 92.541794][ T5413] hsr_slave_1: entered promiscuous mode
[ 93.377674][ T5413] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 93.390275][ T5413] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 93.403329][ T5413] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 93.416390][ T5413] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 93.533012][ T5413] 8021q: adding VLAN 0 to HW filter on device bond0
[ 93.563829][ T5413] 8021q: adding VLAN 0 to HW filter on device team0
[ 93.581315][ T5071] bridge0: port 1(bridge_slave_0) entered blocking state
[ 93.589013][ T5071] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 93.611692][ T5072] bridge0: port 2(bridge_slave_1) entered blocking state
[ 93.619146][ T5072] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 93.851824][ T5413] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 93.907848][ T5413] veth0_vlan: entered promiscuous mode
[ 93.923687][ T5413] veth1_vlan: entered promiscuous mode
[ 93.966578][ T5413] veth0_macvtap: entered promiscuous mode
[ 93.981164][ T5413] veth1_macvtap: entered promiscuous mode
[ 94.008731][ T5413] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 94.026889][ T5413] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 94.043927][ T5413] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 94.056255][ T5413] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 94.066266][ T5413] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 94.078283][ T5413] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 94.119755][ T4453] Bluetooth: hci0: command 0x0409 tx timeout
[ 94.180945][ T5071] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 94.190916][ T5071] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 94.235889][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 94.245985][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 95.206386][ T5482] ==================================================================
[ 95.215824][ T5482] BUG: KASAN: slab-use-after-free in nfc_alloc_send_skb+0x189/0x1c0
[ 95.225338][ T5482] Read of size 4 at addr ffff88802737f548 by task syz-executor.0/5482
[ 95.234378][ T5482]
[ 95.236807][ T5482] CPU: 1 PID: 5482 Comm: syz-executor.0 Not tainted 6.6.0-syzkaller-14263-gaea6bf908d73-dirty #0
[ 95.248281][ T5482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
[ 95.259311][ T5482] Call Trace:
[ 95.262618][ T5482]
[ 95.265863][ T5482] dump_stack_lvl+0x1e7/0x2d0
[ 95.270752][ T5482] ? nf_tcp_handle_invalid+0x650/0x650
[ 95.276338][ T5482] ? panic+0x850/0x850
[ 95.280448][ T5482] ? _printk+0xd5/0x120
[ 95.284831][ T5482] print_report+0x163/0x540
[ 95.289735][ T5482] ? __virt_addr_valid+0x22f/0x2e0
[ 95.295579][ T5482] ? __phys_addr+0xba/0x170
[ 95.300381][ T5482] ? nfc_alloc_send_skb+0x189/0x1c0
[ 95.305700][ T5482] kasan_report+0x142/0x170
[ 95.310430][ T5482] ? nfc_alloc_send_skb+0x189/0x1c0
[ 95.316608][ T5482] nfc_alloc_send_skb+0x189/0x1c0
[ 95.322217][ T5482] nfc_llcp_send_ui_frame+0x2ac/0x670
[ 95.327929][ T5482] ? nfc_llcp_send_i_frame+0x4f0/0x4f0
[ 95.333697][ T5482] ? llcp_sock_sendmsg+0x1fc/0x390
[ 95.339228][ T5482] ? nfc_llcp_getsockopt+0x560/0x560
[ 95.345260][ T5482] ____sys_sendmsg+0x592/0x890
[ 95.351205][ T5482] ? __sys_sendmsg_sock+0x30/0x30
[ 95.357836][ T5482] ? __fget_files+0x3fe/0x480
[ 95.363005][ T5482] __sys_sendmmsg+0x3b2/0x730
[ 95.368339][ T5482] ? __ia32_sys_sendmsg+0x90/0x90
[ 95.374029][ T5482] ? __might_sleep+0xc0/0xc0
[ 95.378996][ T5482] ? __might_fault+0xa5/0x120
[ 95.384667][ T5482] ? __lock_acquire+0x7f70/0x7f70
[ 95.390260][ T5482] ? __might_fault+0xa5/0x120
[ 95.395246][ T5482] ? print_irqtrace_events+0x220/0x220
[ 95.401717][ T5482] ? syscall_enter_from_user_mode+0x32/0x230
[ 95.407916][ T5482] __x64_sys_sendmmsg+0xa0/0xb0
[ 95.413460][ T5482] do_syscall_64+0x44/0x110
[ 95.418171][ T5482] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 95.424194][ T5482] RIP: 0033:0x7fad9aa7cae9
[ 95.428807][ T5482] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[ 95.453479][ T5482] RSP: 002b:00007fad9b7af0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
[ 95.463076][ T5482] RAX: ffffffffffffffda RBX: 00007fad9ab9bf80 RCX: 00007fad9aa7cae9
[ 95.471160][ T5482] RDX: 0000000000000001 RSI: 00000000200013c0 RDI: 0000000000000004
[ 95.479162][ T5482] RBP: 00007fad9aac847a R08: 0000000000000000 R09: 0000000000000000
[ 95.487334][ T5482] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.495677][ T5482] R13: 000000000000000b R14: 00007fad9ab9bf80 R15: 00007ffe55d42cc8
[ 95.503851][ T5482]
[ 95.507061][ T5482]
[ 95.509670][ T5482] Allocated by task 5482:
[ 95.519224][ T5482] kasan_set_track+0x4f/0x70
[ 95.523929][ T5482] __kasan_kmalloc+0x98/0xb0
[ 95.528728][ T5482] nfc_allocate_device+0x12f/0x520
[ 95.534249][ T5482] nci_allocate_device+0x1e2/0x360
[ 95.539493][ T5482] virtual_ncidev_open+0x75/0x1b0
[ 95.545322][ T5482] misc_open+0x30b/0x380
[ 95.549785][ T5482] chrdev_open+0x5ab/0x630
[ 95.554745][ T5482] do_dentry_open+0x8fd/0x1590
[ 95.560063][ T5482] path_openat+0x2845/0x3280
[ 95.564961][ T5482] do_filp_open+0x234/0x490
[ 95.570222][ T5482] do_sys_openat2+0x13e/0x1d0
[ 95.575013][ T5482] __x64_sys_openat+0x247/0x290
[ 95.580418][ T5482] do_syscall_64+0x44/0x110
[ 95.584952][ T5482] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 95.590874][ T5482]
[ 95.593311][ T5482] Freed by task 5481:
[ 95.597401][ T5482] kasan_set_track+0x4f/0x70
[ 95.602380][ T5482] kasan_save_free_info+0x28/0x40
[ 95.607700][ T5482] ____kasan_slab_free+0xd6/0x120
[ 95.612763][ T5482] __kmem_cache_free+0x263/0x3a0
[ 95.617866][ T5482] device_release+0x95/0x1c0
[ 95.622852][ T5482] kobject_put+0x1ee/0x430
[ 95.627381][ T5482] nci_free_device+0x38/0x50
[ 95.631983][ T5482] virtual_ncidev_close+0x70/0x90
[ 95.637212][ T5482] __fput+0x3cc/0xa10
[ 95.641306][ T5482] __se_sys_close+0x15f/0x220
[ 95.646104][ T5482] do_syscall_64+0x44/0x110
[ 95.650632][ T5482] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 95.656727][ T5482]
[ 95.659588][ T5482] The buggy address belongs to the object at ffff88802737f000
[ 95.659588][ T5482] which belongs to the cache kmalloc-2k of size 2048
[ 95.674809][ T5482] The buggy address is located 1352 bytes inside of
[ 95.674809][ T5482] freed 2048-byte region [ffff88802737f000, ffff88802737f800)
[ 95.689149][ T5482]
[ 95.691487][ T5482] The buggy address belongs to the physical page:
[ 95.698961][ T5482] page:ffffea00009cde00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x27378
[ 95.709614][ T5482] head:ffffea00009cde00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 95.718642][ T5482] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 95.726717][ T5482] page_type: 0xffffffff()
[ 95.731066][ T5482] raw: 00fff00000000840 ffff888012c42000 dead000000000122 0000000000000000
[ 95.739717][ T5482] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
[ 95.748401][ T5482] page dumped because: kasan: bad access detected
[ 95.755237][ T5482] page_owner tracks the page as allocated
[ 95.761065][ T5482] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5413, tgid 5413 (syz-executor.0), ts 94299244443, free_ts 94201068477
[ 95.784883][ T5482] post_alloc_hook+0x1e6/0x210
[ 95.789856][ T5482] get_page_from_freelist+0x339a/0x3530
[ 95.795696][ T5482] __alloc_pages+0x255/0x670
[ 95.800400][ T5482] alloc_pages_mpol+0x3de/0x640
[ 95.805274][ T5482] alloc_slab_page+0x6a/0x160
[ 95.810323][ T5482] new_slab+0x84/0x2f0
[ 95.814412][ T5482] ___slab_alloc+0xc85/0x1310
[ 95.819113][ T5482] __kmem_cache_alloc_node+0x21d/0x300
[ 95.826081][ T5482] __kmalloc+0xa8/0x230
[ 95.830876][ T5482] ip6t_alloc_initial_table+0x71/0x610
[ 95.836708][ T5482] ip6table_mangle_table_init+0x1c/0x60
[ 95.842647][ T5482] xt_find_table_lock+0x2d0/0x3b0
[ 95.848049][ T5482] xt_request_find_table_lock+0x26/0x100
[ 95.854402][ T5482] do_ip6t_get_ctl+0x89c/0x1810
[ 95.859285][ T5482] nf_getsockopt+0x292/0x2c0
[ 95.864030][ T5482] ipv6_getsockopt+0x25d/0x380
[ 95.868993][ T5482] page last free stack trace:
[ 95.873857][ T5482] free_unref_page_prepare+0x92a/0xa50
[ 95.879433][ T5482] free_unref_page+0x37/0x3f0
[ 95.884238][ T5482] __unfreeze_partials+0x1dc/0x220
[ 95.889467][ T5482] put_cpu_partial+0x17b/0x250
[ 95.894354][ T5482] __slab_free+0x2b6/0x390
[ 95.898976][ T5482] qlist_free_all+0x75/0xe0
[ 95.904027][ T5482] kasan_quarantine_reduce+0x14b/0x160
[ 95.909775][ T5482] __kasan_slab_alloc+0x23/0x70
[ 95.914919][ T5482] slab_post_alloc_hook+0x6c/0x3c0
[ 95.920060][ T5482] kmem_cache_alloc_node+0x1ad/0x3a0
[ 95.925471][ T5482] __alloc_skb+0x181/0x420
[ 95.929917][ T5482] netlink_sendmsg+0x6fc/0xd70
[ 95.934709][ T5482] ____sys_sendmsg+0x592/0x890
[ 95.939753][ T5482] __sys_sendmsg+0x2b0/0x3a0
[ 95.944461][ T5482] do_syscall_64+0x44/0x110
[ 95.949272][ T5482] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 95.956068][ T5482]
[ 95.958414][ T5482] Memory state around the buggy address:
[ 95.964149][ T5482] ffff88802737f400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 95.972229][ T5482] ffff88802737f480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 95.980576][ T5482] >ffff88802737f500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 95.988829][ T5482] ^
[ 95.995366][ T5482] ffff88802737f580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 96.004839][ T5482] ffff88802737f600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 96.013187][ T5482] ==================================================================
[ 96.050855][ T5482] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 96.058194][ T5482] CPU: 1 PID: 5482 Comm: syz-executor.0 Not tainted 6.6.0-syzkaller-14263-gaea6bf908d73-dirty #0
[ 96.068705][ T5482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
[ 96.078875][ T5482] Call Trace:
[ 96.082332][ T5482]
[ 96.085367][ T5482] dump_stack_lvl+0x1e7/0x2d0
[ 96.090081][ T5482] ? nf_tcp_handle_invalid+0x650/0x650
[ 96.095850][ T5482] ? panic+0x850/0x850
[ 96.100053][ T5482] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0
[ 96.106770][ T5482] ? vscnprintf+0x5d/0x80
[ 96.111396][ T5482] panic+0x349/0x850
[ 96.115609][ T5482] ? check_panic_on_warn+0x21/0xa0
[ 96.120760][ T5482] ? __memcpy_flushcache+0x2b0/0x2b0
[ 96.126096][ T5482] ? _raw_spin_unlock_irqrestore+0x12c/0x140
[ 96.132132][ T5482] ? _raw_spin_unlock+0x40/0x40
[ 96.137449][ T5482] check_panic_on_warn+0x82/0xa0
[ 96.143131][ T5482] ? nfc_alloc_send_skb+0x189/0x1c0
[ 96.148343][ T5482] end_report+0x6e/0x130
[ 96.152703][ T5482] kasan_report+0x153/0x170
[ 96.157392][ T5482] ? nfc_alloc_send_skb+0x189/0x1c0
[ 96.163043][ T5482] nfc_alloc_send_skb+0x189/0x1c0
[ 96.168115][ T5482] nfc_llcp_send_ui_frame+0x2ac/0x670
[ 96.174535][ T5482] ? nfc_llcp_send_i_frame+0x4f0/0x4f0
[ 96.179992][ T5482] ? llcp_sock_sendmsg+0x1fc/0x390
[ 96.185313][ T5482] ? nfc_llcp_getsockopt+0x560/0x560
[ 96.190618][ T5482] ____sys_sendmsg+0x592/0x890
[ 96.195669][ T5482] ? __sys_sendmsg_sock+0x30/0x30
[ 96.201482][ T5482] ? __fget_files+0x3fe/0x480
[ 96.206161][ T5482] __sys_sendmmsg+0x3b2/0x730
[ 96.210946][ T5482] ? __ia32_sys_sendmsg+0x90/0x90
[ 96.216024][ T5482] ? __might_sleep+0xc0/0xc0
[ 96.221219][ T5482] ? __might_fault+0xa5/0x120
[ 96.226198][ T5482] ? __lock_acquire+0x7f70/0x7f70
[ 96.231964][ T5482] ? __might_fault+0xa5/0x120
[ 96.236657][ T5482] ? print_irqtrace_events+0x220/0x220
[ 96.242303][ T5482] ? syscall_enter_from_user_mode+0x32/0x230
[ 96.248315][ T5482] __x64_sys_sendmmsg+0xa0/0xb0
[ 96.253515][ T5482] do_syscall_64+0x44/0x110
[ 96.258123][ T5482] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 96.264216][ T5482] RIP: 0033:0x7fad9aa7cae9
[ 96.268889][ T5482] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[ 96.289834][ T5482] RSP: 002b:00007fad9b7af0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
[ 96.298660][ T5482] RAX: ffffffffffffffda RBX: 00007fad9ab9bf80 RCX: 00007fad9aa7cae9
[ 96.307008][ T5482] RDX: 0000000000000001 RSI: 00000000200013c0 RDI: 0000000000000004
[ 96.315348][ T5482] RBP: 00007fad9aac847a R08: 0000000000000000 R09: 0000000000000000
[ 96.325876][ T5482] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 96.334055][ T5482] R13: 000000000000000b R14: 00007fad9ab9bf80 R15: 00007ffe55d42cc8
[ 96.342760][ T5482]
[ 96.346136][ T5482] Kernel Offset: disabled
[ 96.350993][ T5482] Rebooting in 86400 seconds..