[ 399.290496] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 399.298051] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 399.306234] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 399.314739] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 399.324419] device bridge_slave_1 left promiscuous mode [ 399.331495] bridge0: port 2(bridge_slave_1) entered disabled state [ 399.391121] device bridge_slave_0 left promiscuous mode [ 399.397450] bridge0: port 1(bridge_slave_0) entered disabled state [ 399.453567] device veth1_macvtap left promiscuous mode [ 399.459984] device veth0_macvtap left promiscuous mode [ 399.465854] device veth1_vlan left promiscuous mode [ 399.472753] device veth0_vlan left promiscuous mode [ 399.599185] device hsr_slave_1 left promiscuous mode [ 399.639274] device hsr_slave_0 left promiscuous mode [ 399.695905] team0 (unregistering): Port device team_slave_1 removed [ 399.705951] team0 (unregistering): Port device team_slave_0 removed [ 399.719075] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 399.761791] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 399.821084] bond0 (unregistering): Released all slaves Warning: Permanently added '10.128.0.188' (ECDSA) to the list of known hosts. [ 401.492641] ================================================================== [ 401.500606] BUG: KASAN: null-ptr-deref in __tcf_idr_release+0x30/0x90 [ 401.507703] Read of size 4 at addr 0000000000000010 by task syz-executor611/31831 [ 401.515702] [ 401.517434] CPU: 0 PID: 31831 Comm: syz-executor611 Not tainted 4.19.177-syzkaller #0 [ 401.525584] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 401.536131] Call Trace: [ 401.539297] dump_stack+0x123/0x171 [ 401.543524] kasan_report.cold.9+0x6d/0x2fe [ 401.549142] ? __tcf_idr_release+0x30/0x90 [ 401.553927] check_memory_region+0x13e/0x1b0 [ 401.558738] kasan_check_read+0x11/0x20 [ 401.563194] __tcf_idr_release+0x30/0x90 [ 401.567752] tcf_generic_walker+0x595/0x930 [ 401.573048] ? kasan_unpoison_shadow+0x35/0x50 [ 401.577714] ? tcf_action_dump_1+0x5a0/0x5a0 [ 401.582638] ? tcf_ife_walker+0xdd/0x1d0 [ 401.586684] ? lock_downgrade+0x860/0x860 [ 401.591076] ? kasan_check_read+0x11/0x20 [ 401.595394] tcf_ife_walker+0x113/0x1d0 [ 401.599769] tca_action_gd+0xd27/0x1480 [ 401.604484] ? tca_get_fill.constprop.37+0x4d0/0x4d0 [ 401.610503] ? __lock_acquire+0x792/0x4950 [ 401.615277] ? mark_held_locks+0x130/0x130 [ 401.619921] ? nla_parse+0x34/0x280 [ 401.623813] tc_ctl_action+0x1fe/0x3d0 [ 401.627886] ? tcf_action_add+0x320/0x320 [ 401.632304] rtnetlink_rcv_msg+0x34f/0x8f0 [ 401.637189] ? rtnetlink_put_metrics+0x490/0x490 [ 401.643177] ? find_held_lock+0x36/0x1d0 [ 401.647608] netlink_rcv_skb+0x13e/0x3d0 [ 401.652228] ? lock_downgrade+0x860/0x860 [ 401.656950] ? rtnetlink_put_metrics+0x490/0x490 [ 401.663125] ? netlink_ack+0xa70/0xa70 [ 401.667790] ? netlink_deliver_tap+0x182/0xb00 [ 401.672615] rtnetlink_rcv+0x10/0x20 [ 401.676656] netlink_unicast+0x443/0x650 [ 401.681198] ? netlink_attachskb+0x6c0/0x6c0 [ 401.685769] ? _copy_from_iter_full+0x182/0x720 [ 401.690872] ? __check_object_size+0x1ef/0x310 [ 401.695532] ? security_socket_getpeersec_dgram+0x53/0xa0 [ 401.701868] netlink_sendmsg+0x764/0xc60 [ 401.706358] ? netlink_unicast+0x650/0x650 [ 401.710936] ? apparmor_socket_sendmsg+0x1b/0x20 [ 401.716212] ? netlink_unicast+0x650/0x650 [ 401.720559] sock_sendmsg+0xb5/0xf0 [ 401.724566] ___sys_sendmsg+0x647/0x950 [ 401.728881] ? find_held_lock+0x36/0x1d0 [ 401.733199] ? copy_msghdr_from_user+0x430/0x430 [ 401.738605] ? __fget+0x278/0x400 [ 401.742495] ? kasan_check_read+0x11/0x20 [ 401.747621] ? __fget+0x295/0x400 [ 401.751815] ? expand_files.part.8+0x700/0x700 [ 401.757109] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 401.762617] ? __fget_light+0x174/0x1e0 [ 401.767009] ? find_held_lock+0x36/0x1d0 [ 401.771713] ? __fdget+0xe/0x10 [ 401.775074] __sys_sendmsg+0xd9/0x180 [ 401.781051] ? __ia32_sys_shutdown+0x70/0x70 [ 401.786184] ? __x64_sys_futex+0x1cb/0x3a0 [ 401.790419] ? up_read+0x1a/0x110 [ 401.794191] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 401.799953] __x64_sys_sendmsg+0x73/0xb0 [ 401.804566] do_syscall_64+0xd0/0x4e0 [ 401.808738] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 401.814558] RIP: 0033:0x445a49 [ 401.818487] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 401.840216] RSP: 002b:00007fef7adce318 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 401.849561] RAX: ffffffffffffffda RBX: 00000000004ca428 RCX: 0000000000445a49 [ 401.858163] RDX: 0000000000000000 RSI: 0000000020000300 RDI: 0000000000000003 [ 401.866130] RBP: 00000000004ca420 R08: 000000000000000c R09: 0000000000000000 [ 401.874817] R10: 0000000000000001 R11: 0000000000000246 R12: 00000000004ca42c [ 401.883113] R13: 00007fffaf80716f R14: 00007fef7adce400 R15: 0000000000022000 [ 401.892519] ================================================================== [ 401.901311] Disabling lock debugging due to kernel taint [ 401.908874] Kernel panic - not syncing: panic_on_warn set ... [ 401.908874] [ 401.916343] CPU: 1 PID: 31831 Comm: syz-executor611 Tainted: G B 4.19.177-syzkaller #0 [ 401.926972] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 401.937419] Call Trace: [ 401.940398] dump_stack+0x123/0x171 [ 401.944696] panic+0x1cd/0x375 [ 401.948011] ? __warn_printk+0xd6/0xd6 [ 401.952836] ? ___preempt_schedule+0x16/0x18 [ 401.958148] kasan_end_report+0x47/0x4f [ 401.963266] kasan_report.cold.9+0x76/0x2fe [ 401.968596] ? __tcf_idr_release+0x30/0x90 [ 401.973577] check_memory_region+0x13e/0x1b0 [ 401.978350] kasan_check_read+0x11/0x20 [ 401.982843] __tcf_idr_release+0x30/0x90 [ 401.987244] tcf_generic_walker+0x595/0x930 [ 401.992130] ? kasan_unpoison_shadow+0x35/0x50 [ 401.997139] ? tcf_action_dump_1+0x5a0/0x5a0 [ 402.002579] ? tcf_ife_walker+0xdd/0x1d0 [ 402.006881] ? lock_downgrade+0x860/0x860 [ 402.012085] ? kasan_check_read+0x11/0x20 [ 402.016668] tcf_ife_walker+0x113/0x1d0 [ 402.021053] tca_action_gd+0xd27/0x1480 [ 402.025662] ? tca_get_fill.constprop.37+0x4d0/0x4d0 [ 402.031297] ? __lock_acquire+0x792/0x4950 [ 402.036137] ? mark_held_locks+0x130/0x130 [ 402.041641] ? nla_parse+0x34/0x280 [ 402.045650] tc_ctl_action+0x1fe/0x3d0 [ 402.049829] ? tcf_action_add+0x320/0x320 [ 402.054088] rtnetlink_rcv_msg+0x34f/0x8f0 [ 402.059440] ? rtnetlink_put_metrics+0x490/0x490 [ 402.065182] ? find_held_lock+0x36/0x1d0 [ 402.069327] netlink_rcv_skb+0x13e/0x3d0 [ 402.074001] ? lock_downgrade+0x860/0x860 [ 402.078963] ? rtnetlink_put_metrics+0x490/0x490 [ 402.084251] ? netlink_ack+0xa70/0xa70 [ 402.090563] ? netlink_deliver_tap+0x182/0xb00 [ 402.095567] rtnetlink_rcv+0x10/0x20 [ 402.099715] netlink_unicast+0x443/0x650 [ 402.104016] ? netlink_attachskb+0x6c0/0x6c0 [ 402.108662] ? _copy_from_iter_full+0x182/0x720 [ 402.113586] ? __check_object_size+0x1ef/0x310 [ 402.118588] ? security_socket_getpeersec_dgram+0x53/0xa0 [ 402.124480] netlink_sendmsg+0x764/0xc60 [ 402.128861] ? netlink_unicast+0x650/0x650 [ 402.133559] ? apparmor_socket_sendmsg+0x1b/0x20 [ 402.139581] ? netlink_unicast+0x650/0x650 [ 402.143973] sock_sendmsg+0xb5/0xf0 [ 402.147612] ___sys_sendmsg+0x647/0x950 [ 402.151668] ? find_held_lock+0x36/0x1d0 [ 402.155986] ? copy_msghdr_from_user+0x430/0x430 [ 402.164860] ? __fget+0x278/0x400 [ 402.169529] ? kasan_check_read+0x11/0x20 [ 402.174068] ? __fget+0x295/0x400 [ 402.177963] ? expand_files.part.8+0x700/0x700 [ 402.182915] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 402.188798] ? __fget_light+0x174/0x1e0 [ 402.193284] ? find_held_lock+0x36/0x1d0 [ 402.197694] ? __fdget+0xe/0x10 [ 402.201318] __sys_sendmsg+0xd9/0x180 [ 402.205321] ? __ia32_sys_shutdown+0x70/0x70 [ 402.210101] ? __x64_sys_futex+0x1cb/0x3a0 [ 402.214580] ? up_read+0x1a/0x110 [ 402.218037] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 402.223835] __x64_sys_sendmsg+0x73/0xb0 [ 402.228149] do_syscall_64+0xd0/0x4e0 [ 402.232165] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 402.237785] RIP: 0033:0x445a49 [ 402.241488] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 402.262018] RSP: 002b:00007fef7adce318 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 402.270862] RAX: ffffffffffffffda RBX: 00000000004ca428 RCX: 0000000000445a49 [ 402.278613] RDX: 0000000000000000 RSI: 0000000020000300 RDI: 0000000000000003 [ 402.286213] RBP: 00000000004ca420 R08: 000000000000000c R09: 0000000000000000 [ 402.293768] R10: 0000000000000001 R11: 0000000000000246 R12: 00000000004ca42c [ 402.301113] R13: 00007fffaf80716f R14: 00007fef7adce400 R15: 0000000000022000 [ 402.311148] Kernel Offset: disabled [ 402.314769] Rebooting in 86400 seconds..