Warning: Permanently added '10.128.10.40' (ECDSA) to the list of known hosts. 2023/04/07 07:57:37 ignoring optional flag "sandboxArg"="0" 2023/04/07 07:57:38 parsed 1 programs 2023/04/07 07:57:38 executed programs: 0 [ 67.626688][ T4401] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 67.635529][ T4401] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 67.644391][ T4401] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 67.652997][ T4401] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 67.660984][ T4401] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 67.668999][ T4401] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 67.799066][ T5492] chnl_net:caif_netlink_parms(): no params data found [ 67.854202][ T5492] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.862120][ T5492] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.869791][ T5492] bridge_slave_0: entered allmulticast mode [ 67.876871][ T5492] bridge_slave_0: entered promiscuous mode [ 67.885411][ T5492] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.893057][ T5492] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.900562][ T5492] bridge_slave_1: entered allmulticast mode [ 67.907660][ T5492] bridge_slave_1: entered promiscuous mode [ 67.933270][ T5492] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 67.944815][ T5492] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 67.972902][ T5492] team0: Port device team_slave_0 added [ 67.980868][ T5492] team0: Port device team_slave_1 added [ 68.004377][ T5492] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 68.011356][ T5492] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 68.038111][ T5492] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 68.051147][ T5492] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 68.059944][ T5492] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 68.086205][ T5492] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 68.122758][ T5492] hsr_slave_0: entered promiscuous mode [ 68.130311][ T5492] hsr_slave_1: entered promiscuous mode [ 68.610620][ T5492] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 68.628079][ T5492] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 68.638192][ T5492] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 68.649238][ T5492] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 68.671603][ T5492] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.678776][ T5492] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.686406][ T5492] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.693652][ T5492] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.750369][ T5492] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.765984][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 68.775963][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.784098][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.792565][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 68.806171][ T5492] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.823560][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 68.833009][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 68.842184][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.849425][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.858112][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 68.868548][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 68.877468][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.884668][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.914471][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 68.946221][ T5090] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 68.957319][ T5090] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 68.969410][ T5090] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 68.982043][ T5090] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 68.991778][ T5090] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 69.002052][ T5090] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 69.020180][ T5090] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 69.047644][ T5492] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 69.064909][ T5492] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 69.072821][ T5090] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 69.082034][ T5090] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 69.092000][ T5090] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 69.234468][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 69.241978][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 69.254026][ T5492] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.271929][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 69.281748][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 69.301555][ T5492] veth0_vlan: entered promiscuous mode [ 69.307767][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 69.316419][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 69.326147][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 69.334626][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 69.346562][ T5492] veth1_vlan: entered promiscuous mode [ 69.366814][ T5090] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 69.376075][ T5090] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 69.384705][ T5090] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 69.394516][ T5090] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 69.405107][ T5492] veth0_macvtap: entered promiscuous mode [ 69.417101][ T5492] veth1_macvtap: entered promiscuous mode [ 69.434116][ T5492] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 69.441545][ T5090] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 69.451001][ T5090] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 69.459332][ T5090] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 69.468806][ T5090] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 69.480089][ T5492] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 69.488410][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 69.497626][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 69.508870][ T5492] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.518382][ T5492] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.527475][ T5492] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.537107][ T5492] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.585627][ T282] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.594223][ T282] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.603354][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 69.624784][ T282] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.632775][ T282] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.644850][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 69.684066][ T4401] Bluetooth: hci0: command 0x0409 tx timeout [ 69.741105][ T5588] loop0: detected capacity change from 0 to 8192 [ 69.757964][ T5588] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 69.777896][ T5588] REISERFS (device loop0): found reiserfs format "3.6" with non-standard journal [ 69.790680][ T5588] REISERFS (device loop0): using ordered data mode [ 69.797784][ T5588] reiserfs: using flush barriers [ 69.805925][ T5588] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 69.824652][ T5588] REISERFS (device loop0): checking transaction log (loop0) [ 69.912285][ T5588] REISERFS (device loop0): Using r5 hash to sort names [ 69.922496][ T5588] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. [ 69.955026][ T5588] ================================================================== [ 69.963210][ T5588] BUG: KASAN: use-after-free in strlen+0x58/0x70 [ 69.969531][ T5588] Read of size 1 at addr ffff88806dc729cc by task syz-executor.0/5588 [ 69.977658][ T5588] [ 69.979961][ T5588] CPU: 1 PID: 5588 Comm: syz-executor.0 Not tainted 6.3.0-rc5-syzkaller #0 [ 69.988949][ T5588] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 [ 69.999170][ T5588] Call Trace: [ 70.002435][ T5588] [ 70.005351][ T5588] dump_stack_lvl+0x12e/0x1d0 [ 70.010095][ T5588] ? nf_tcp_handle_invalid+0x4e0/0x4e0 [ 70.015551][ T5588] ? panic+0x510/0x510 [ 70.019591][ T5588] ? _printk+0xab/0xf0 [ 70.023635][ T5588] print_report+0x163/0x510 [ 70.028110][ T5588] ? strlen+0x58/0x70 [ 70.032152][ T5588] kasan_report+0x108/0x140 [ 70.036887][ T5588] ? strlen+0x58/0x70 [ 70.040928][ T5588] strlen+0x58/0x70 [ 70.044711][ T5588] set_de_name_and_namelen+0x37b/0x610 [ 70.050230][ T5588] search_by_entry_key+0x5ab/0xc00 [ 70.055439][ T5588] reiserfs_readdir_inode+0x23a/0x1300 [ 70.060954][ T5588] ? lockdep_lock+0x108/0x290 [ 70.065619][ T5588] ? lockdep_unlock+0x14a/0x2e0 [ 70.070438][ T5588] ? lockdep_lock+0x290/0x290 [ 70.075086][ T5588] ? mark_lock+0x29d/0x340 [ 70.079473][ T5588] ? __lock_acquire+0x125b/0x1f80 [ 70.085963][ T5588] ? reiserfs_dir_fsync+0xf0/0xf0 [ 70.091400][ T5588] ? read_lock_is_recursive+0x20/0x20 [ 70.096830][ T5588] ? __lock_acquire+0x1f80/0x1f80 [ 70.101833][ T5588] ? mutex_lock_io_nested+0x60/0x60 [ 70.107000][ T5588] ? __down_read_common+0x184/0x2c0 [ 70.112189][ T5588] ? iterate_dir+0xae/0x500 [ 70.116677][ T5588] ? reiserfs_sync_file+0x200/0x200 [ 70.121933][ T5588] iterate_dir+0x1fe/0x500 [ 70.126327][ T5588] __se_sys_getdents64+0x1ce/0x420 [ 70.131513][ T5588] ? __x64_sys_getdents64+0x80/0x80 [ 70.136682][ T5588] ? filldir+0x5b0/0x5b0 [ 70.140982][ T5588] ? syscall_enter_from_user_mode+0x32/0x230 [ 70.146935][ T5588] ? lockdep_hardirqs_on+0x90/0x130 [ 70.152188][ T5588] ? syscall_enter_from_user_mode+0x32/0x230 [ 70.158149][ T5588] do_syscall_64+0x41/0xc0 [ 70.162545][ T5588] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 70.168601][ T5588] RIP: 0033:0x7fc028e8c0d9 [ 70.173018][ T5588] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 70.193126][ T5588] RSP: 002b:00007fc029b82168 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9 [ 70.202379][ T5588] RAX: ffffffffffffffda RBX: 00007fc028fabf80 RCX: 00007fc028e8c0d9 [ 70.210506][ T5588] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 70.219000][ T5588] RBP: 00007fc028ee7ae9 R08: 0000000000000000 R09: 0000000000000000 [ 70.227582][ T5588] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 70.235545][ T5588] R13: 00007ffc2d2dd82f R14: 00007fc029b82300 R15: 0000000000022000 [ 70.243584][ T5588] [ 70.246601][ T5588] [ 70.248907][ T5588] The buggy address belongs to the physical page: [ 70.255382][ T5588] page:ffffea0001b71c80 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x6dc72 [ 70.265529][ T5588] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 70.272611][ T5588] raw: 00fff00000000000 ffffea0001b71cc8 ffffea0001b71c48 0000000000000000 [ 70.281169][ T5588] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 70.290040][ T5588] page dumped because: kasan: bad access detected [ 70.296899][ T5588] page_owner tracks the page as freed [ 70.302321][ T5588] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 5443, tgid 5443 (syz-execprog), ts 67396589360, free_ts 69776130053 [ 70.320996][ T5588] get_page_from_freelist+0x31e9/0x3360 [ 70.326523][ T5588] __alloc_pages+0x255/0x670 [ 70.331100][ T5588] __folio_alloc+0x13/0x30 [ 70.335492][ T5588] vma_alloc_folio+0x308/0x680 [ 70.340315][ T5588] handle_mm_fault+0x2afa/0x3d50 [ 70.345242][ T5588] exc_page_fault+0x5a4/0x7b0 [ 70.349897][ T5588] asm_exc_page_fault+0x26/0x30 [ 70.354737][ T5588] page last free stack trace: [ 70.359403][ T5588] free_unref_page_prepare+0xe2f/0xe70 [ 70.364864][ T5588] free_unref_page_list+0x596/0x830 [ 70.370052][ T5588] release_pages+0x1a07/0x1bc0 [ 70.374810][ T5588] tlb_flush_mmu+0xe9/0x1e0 [ 70.379315][ T5588] tlb_finish_mmu+0xb6/0x1c0 [ 70.383886][ T5588] zap_page_range_single+0x3a0/0x460 [ 70.389184][ T5588] do_madvise+0x82d/0x3420 [ 70.393589][ T5588] __x64_sys_madvise+0xa0/0xb0 [ 70.398341][ T5588] do_syscall_64+0x41/0xc0 [ 70.402733][ T5588] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 70.408602][ T5588] [ 70.410923][ T5588] Memory state around the buggy address: [ 70.416530][ T5588] ffff88806dc72880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 70.424671][ T5588] ffff88806dc72900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 70.432821][ T5588] >ffff88806dc72980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 70.440948][ T5588] ^ [ 70.447439][ T5588] ffff88806dc72a00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 70.455481][ T5588] ffff88806dc72a80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 70.463704][ T5588] ================================================================== [ 70.489252][ T5588] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 70.496496][ T5588] CPU: 1 PID: 5588 Comm: syz-executor.0 Not tainted 6.3.0-rc5-syzkaller #0 [ 70.505061][ T5588] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 [ 70.515188][ T5588] Call Trace: [ 70.518572][ T5588] [ 70.521489][ T5588] dump_stack_lvl+0x12e/0x1d0 [ 70.526402][ T5588] ? nf_tcp_handle_invalid+0x4e0/0x4e0 [ 70.531849][ T5588] ? panic+0x510/0x510 [ 70.535988][ T5588] ? lock_release+0xbf/0x9a0 [ 70.540558][ T5588] panic+0x1f2/0x510 [ 70.544429][ T5588] ? memcpy_page_flushcache+0xe0/0xe0 [ 70.549777][ T5588] ? _raw_spin_unlock_irqrestore+0x114/0x120 [ 70.555730][ T5588] ? _raw_spin_unlock+0x40/0x40 [ 70.560577][ T5588] ? print_report+0x4cf/0x510 [ 70.565313][ T5588] check_panic_on_warn+0x58/0x70 [ 70.570246][ T5588] ? strlen+0x58/0x70 [ 70.574285][ T5588] end_report+0x63/0x110 [ 70.578515][ T5588] kasan_report+0x115/0x140 [ 70.583238][ T5588] ? strlen+0x58/0x70 [ 70.587203][ T5588] strlen+0x58/0x70 [ 70.591159][ T5588] set_de_name_and_namelen+0x37b/0x610 [ 70.596593][ T5588] search_by_entry_key+0x5ab/0xc00 [ 70.601687][ T5588] reiserfs_readdir_inode+0x23a/0x1300 [ 70.607128][ T5588] ? lockdep_lock+0x108/0x290 [ 70.611780][ T5588] ? lockdep_unlock+0x14a/0x2e0 [ 70.616604][ T5588] ? lockdep_lock+0x290/0x290 [ 70.621257][ T5588] ? mark_lock+0x29d/0x340 [ 70.625647][ T5588] ? __lock_acquire+0x125b/0x1f80 [ 70.630741][ T5588] ? reiserfs_dir_fsync+0xf0/0xf0 [ 70.635744][ T5588] ? read_lock_is_recursive+0x20/0x20 [ 70.641173][ T5588] ? __lock_acquire+0x1f80/0x1f80 [ 70.646257][ T5588] ? mutex_lock_io_nested+0x60/0x60 [ 70.651517][ T5588] ? __down_read_common+0x184/0x2c0 [ 70.656690][ T5588] ? iterate_dir+0xae/0x500 [ 70.661182][ T5588] ? reiserfs_sync_file+0x200/0x200 [ 70.666349][ T5588] iterate_dir+0x1fe/0x500 [ 70.670740][ T5588] __se_sys_getdents64+0x1ce/0x420 [ 70.675833][ T5588] ? __x64_sys_getdents64+0x80/0x80 [ 70.681004][ T5588] ? filldir+0x5b0/0x5b0 [ 70.685394][ T5588] ? syscall_enter_from_user_mode+0x32/0x230 [ 70.691677][ T5588] ? lockdep_hardirqs_on+0x90/0x130 [ 70.697559][ T5588] ? syscall_enter_from_user_mode+0x32/0x230 [ 70.703601][ T5588] do_syscall_64+0x41/0xc0 [ 70.708165][ T5588] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 70.714035][ T5588] RIP: 0033:0x7fc028e8c0d9 [ 70.718527][ T5588] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 70.738466][ T5588] RSP: 002b:00007fc029b82168 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9 [ 70.746849][ T5588] RAX: ffffffffffffffda RBX: 00007fc028fabf80 RCX: 00007fc028e8c0d9 [ 70.754894][ T5588] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 70.763381][ T5588] RBP: 00007fc028ee7ae9 R08: 0000000000000000 R09: 0000000000000000 [ 70.771423][ T5588] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 70.779464][ T5588] R13: 00007ffc2d2dd82f R14: 00007fc029b82300 R15: 0000000000022000 [ 70.787504][ T5588] [ 70.790768][ T5588] Kernel Offset: disabled [ 70.795202][ T5588] Rebooting in 86400 seconds..