[ 132.693636][ T1224] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.136486][ T1224] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.142835][ T1224] ieee802154 phy1 wpan1: encryption failed: -22 [ 206.444388][ T32] Bluetooth: hci0: command 0x0406 tx timeout [ 255.567091][ T1224] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.573449][ T1224] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.006494][ T1224] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.013578][ T1224] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.456625][ T1224] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.463026][ T1224] ieee802154 phy1 wpan1: encryption failed: -22 [ 436.379184][ T8] device hsr_slave_0 left promiscuous mode [ 436.386467][ T8] device hsr_slave_1 left promiscuous mode [ 436.393046][ T8] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 436.400606][ T8] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 436.410264][ T8] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 436.418094][ T8] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 436.427425][ T8] device bridge_slave_1 left promiscuous mode [ 436.433672][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 436.443594][ T8] device bridge_slave_0 left promiscuous mode [ 436.450902][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 436.461568][ T8] device veth1_macvtap left promiscuous mode [ 436.468521][ T8] device veth0_macvtap left promiscuous mode [ 436.474754][ T8] device veth1_vlan left promiscuous mode [ 436.480554][ T8] device veth0_vlan left promiscuous mode [ 436.611710][ T8] team0 (unregistering): Port device team_slave_1 removed [ 436.625633][ T8] team0 (unregistering): Port device team_slave_0 removed [ 436.637945][ T8] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 436.652014][ T8] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 436.711076][ T8] bond0 (unregistering): Released all slaves [ 437.804064][ C0] ================================================================== [ 437.812188][ C0] BUG: KASAN: use-after-free in tcp_write_timer_handler+0xb91/0xbc0 [ 437.820247][ C0] Read of size 1 at addr ffff88802053a215 by task swapper/0/0 [ 437.827694][ C0] [ 437.830010][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.19.0-rc5-syzkaller-00049-gc1084b6c5620 #0 [ 437.840586][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 437.851496][ C0] Call Trace: [ 437.854836][ C0] [ 437.857770][ C0] dump_stack_lvl+0xcd/0x134 [ 437.862452][ C0] print_address_description.constprop.0.cold+0xeb/0x495 [ 437.869508][ C0] ? tcp_write_timer_handler+0xb91/0xbc0 [ 437.875143][ C0] kasan_report.cold+0xf4/0x1c6 [ 437.880003][ C0] ? tcp_write_timer_handler+0xb91/0xbc0 [ 437.885917][ C0] tcp_write_timer_handler+0xb91/0xbc0 [ 437.891401][ C0] tcp_write_timer+0xa2/0x2b0 [ 437.896168][ C0] ? tcp_write_timer_handler+0xbc0/0xbc0 [ 437.901897][ C0] call_timer_fn+0x1a5/0x6b0 [ 437.906557][ C0] ? timer_fixup_activate+0x350/0x350 [ 437.911916][ C0] ? lock_downgrade+0x6e0/0x6e0 [ 437.916826][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 437.922078][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 437.927436][ C0] ? tcp_write_timer_handler+0xbc0/0xbc0 [ 437.933320][ C0] __run_timers.part.0+0x679/0xa80 [ 437.938435][ C0] ? call_timer_fn+0x6b0/0x6b0 [ 437.943184][ C0] ? __wake_up_locked_sync_key+0x20/0x20 [ 437.948939][ C0] ? kvm_sched_clock_read+0x14/0x40 [ 437.954325][ C0] ? sched_clock_cpu+0x69/0x2b0 [ 437.959181][ C0] run_timer_softirq+0xb3/0x1d0 [ 437.964222][ C0] __do_softirq+0x29b/0x9c2 [ 437.968790][ C0] __irq_exit_rcu+0x123/0x180 [ 437.973674][ C0] irq_exit_rcu+0x5/0x20 [ 437.977909][ C0] sysvec_apic_timer_interrupt+0x93/0xc0 [ 437.983567][ C0] [ 437.986486][ C0] [ 437.989422][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 437.995428][ C0] RIP: 0010:acpi_idle_do_entry+0x1c9/0x240 [ 438.001238][ C0] Code: 89 de e8 aa 06 0e f8 84 db 75 98 e8 a1 0a 0e f8 e8 ac 57 14 f8 66 90 e8 95 0a 0e f8 0f 00 2d 1e c6 c7 00 e8 89 0a 0e f8 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 d4 06 0e f8 48 85 db [ 438.020930][ C0] RSP: 0018:ffffffff8ba07d38 EFLAGS: 00000293 [ 438.026991][ C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 438.034945][ C0] RDX: ffffffff8babc940 RSI: ffffffff896bc067 RDI: 0000000000000000 [ 438.042903][ C0] RBP: ffff888011b44864 R08: 0000000000000001 R09: 0000000000000001 [ 438.050859][ C0] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001 [ 438.059339][ C0] R13: ffff888011b44800 R14: ffff888011b44864 R15: ffff888017947004 [ 438.067318][ C0] ? acpi_idle_do_entry+0x1c7/0x240 [ 438.072517][ C0] ? acpi_idle_do_entry+0x1c7/0x240 [ 438.077757][ C0] acpi_idle_enter+0x369/0x510 [ 438.082615][ C0] cpuidle_enter_state+0x1b1/0xc80 [ 438.087799][ C0] cpuidle_enter+0x4a/0xa0 [ 438.092226][ C0] do_idle+0x3e8/0x590 [ 438.096309][ C0] ? arch_cpu_idle_exit+0x30/0x30 [ 438.101329][ C0] ? do_idle+0x336/0x590 [ 438.105621][ C0] cpu_startup_entry+0x14/0x20 [ 438.110464][ C0] rest_init+0x169/0x270 [ 438.114701][ C0] ? trace_init_perf_perm_irq_work_exit+0xe/0xe [ 438.120977][ C0] arch_call_rest_init+0xf/0x14 [ 438.125825][ C0] start_kernel+0x46e/0x48f [ 438.130316][ C0] secondary_startup_64_no_verify+0xce/0xdb [ 438.136305][ C0] [ 438.139311][ C0] [ 438.141628][ C0] Allocated by task 4070: [ 438.145958][ C0] kasan_save_stack+0x1e/0x40 [ 438.150707][ C0] __kasan_slab_alloc+0x90/0xc0 [ 438.155558][ C0] kmem_cache_alloc+0x204/0x3b0 [ 438.160403][ C0] copy_net_ns+0x125/0x760 [ 438.164845][ C0] create_new_namespaces+0x3f6/0xb20 [ 438.170203][ C0] unshare_nsproxy_namespaces+0xc1/0x1f0 [ 438.175917][ C0] ksys_unshare+0x445/0x920 [ 438.180463][ C0] __x64_sys_unshare+0x2d/0x40 [ 438.185225][ C0] do_syscall_64+0x35/0x80 [ 438.189640][ C0] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 438.195536][ C0] [ 438.197855][ C0] Freed by task 8: [ 438.201554][ C0] kasan_save_stack+0x1e/0x40 [ 438.206219][ C0] kasan_set_track+0x21/0x30 [ 438.210794][ C0] kasan_set_free_info+0x20/0x30 [ 438.215897][ C0] ____kasan_slab_free+0x166/0x1a0 [ 438.220990][ C0] slab_free_freelist_hook+0x8b/0x1c0 [ 438.226347][ C0] kmem_cache_free+0xdd/0x5a0 [ 438.231014][ C0] cleanup_net+0x8ba/0xb00 [ 438.235481][ C0] process_one_work+0x996/0x1610 [ 438.240523][ C0] worker_thread+0x665/0x1080 [ 438.245184][ C0] kthread+0x2e9/0x3a0 [ 438.249252][ C0] ret_from_fork+0x1f/0x30 [ 438.253653][ C0] [ 438.255957][ C0] Last potentially related work creation: [ 438.261649][ C0] kasan_save_stack+0x1e/0x40 [ 438.266311][ C0] __kasan_record_aux_stack+0xbe/0xd0 [ 438.271668][ C0] insert_work+0x48/0x350 [ 438.276007][ C0] __queue_work+0x62f/0x1150 [ 438.280597][ C0] call_timer_fn+0x1a5/0x6b0 [ 438.285178][ C0] __run_timers.part.0+0x4a3/0xa80 [ 438.290280][ C0] run_timer_softirq+0x152/0x1d0 [ 438.295260][ C0] __do_softirq+0x29b/0x9c2 [ 438.299787][ C0] [ 438.302107][ C0] Second to last potentially related work creation: [ 438.308673][ C0] kasan_save_stack+0x1e/0x40 [ 438.313432][ C0] __kasan_record_aux_stack+0xbe/0xd0 [ 438.318805][ C0] insert_work+0x48/0x350 [ 438.323148][ C0] __queue_work+0x62f/0x1150 [ 438.327747][ C0] call_timer_fn+0x1a5/0x6b0 [ 438.332548][ C0] __run_timers.part.0+0x4a3/0xa80 [ 438.337644][ C0] run_timer_softirq+0x152/0x1d0 [ 438.342617][ C0] __do_softirq+0x29b/0x9c2 [ 438.347208][ C0] [ 438.349521][ C0] The buggy address belongs to the object at ffff888020539b80 [ 438.349521][ C0] which belongs to the cache net_namespace of size 6784 [ 438.363920][ C0] The buggy address is located 1685 bytes inside of [ 438.363920][ C0] 6784-byte region [ffff888020539b80, ffff88802053b600) [ 438.377816][ C0] [ 438.380130][ C0] The buggy address belongs to the physical page: [ 438.386524][ C0] page:ffffea0000814e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20538 [ 438.396743][ C0] head:ffffea0000814e00 order:3 compound_mapcount:0 compound_pincount:0 [ 438.405314][ C0] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 438.413284][ C0] raw: 00fff00000010200 0000000000000000 dead000000000122 ffff8881400073c0 [ 438.421939][ C0] raw: 0000000000000000 0000000080040004 00000001ffffffff 0000000000000000 [ 438.430601][ C0] page dumped because: kasan: bad access detected [ 438.437080][ C0] page_owner tracks the page as allocated [ 438.442876][ C0] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3608, tgid 3608 (syz-executor.0), ts 50598570599, free_ts 49036316494 [ 438.464870][ C0] get_page_from_freelist+0x1290/0x3b70 [ 438.470487][ C0] __alloc_pages+0x1c7/0x510 [ 438.475066][ C0] alloc_pages+0x1aa/0x310 [ 438.479712][ C0] allocate_slab+0x26c/0x3c0 [ 438.484558][ C0] ___slab_alloc+0x9c4/0xe20 [ 438.489154][ C0] __slab_alloc.constprop.0+0x4d/0xa0 [ 438.494515][ C0] kmem_cache_alloc+0x360/0x3b0 [ 438.499466][ C0] copy_net_ns+0x125/0x760 [ 438.503879][ C0] create_new_namespaces+0x3f6/0xb20 [ 438.509157][ C0] unshare_nsproxy_namespaces+0xc1/0x1f0 [ 438.514939][ C0] ksys_unshare+0x445/0x920 [ 438.519444][ C0] __x64_sys_unshare+0x2d/0x40 [ 438.524206][ C0] do_syscall_64+0x35/0x80 [ 438.528606][ C0] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 438.534600][ C0] page last free stack trace: [ 438.539276][ C0] free_pcp_prepare+0x549/0xd20 [ 438.544121][ C0] free_unref_page+0x19/0x6a0 [ 438.548783][ C0] __unfreeze_partials+0x17c/0x1a0 [ 438.554241][ C0] qlist_free_all+0x6a/0x170 [ 438.558867][ C0] kasan_quarantine_reduce+0x180/0x200 [ 438.564412][ C0] __kasan_slab_alloc+0xa2/0xc0 [ 438.569260][ C0] __kmalloc+0x200/0x350 [ 438.574370][ C0] tomoyo_supervisor+0xce6/0xf00 [ 438.579410][ C0] tomoyo_path_permission+0x270/0x3a0 [ 438.584854][ C0] tomoyo_check_open_permission+0x33e/0x380 [ 438.590738][ C0] tomoyo_file_open+0x9d/0xc0 [ 438.595576][ C0] security_file_open+0x45/0xb0 [ 438.600482][ C0] do_dentry_open+0x349/0x11f0 [ 438.605528][ C0] path_openat+0x1c71/0x2910 [ 438.610148][ C0] do_filp_open+0x1aa/0x400 [ 438.614639][ C0] do_sys_openat2+0x16d/0x4c0 [ 438.619406][ C0] [ 438.621914][ C0] Memory state around the buggy address: [ 438.627534][ C0] ffff88802053a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 438.635592][ C0] ffff88802053a180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 438.643646][ C0] >ffff88802053a200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 438.651882][ C0] ^ [ 438.656467][ C0] ffff88802053a280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 438.664688][ C0] ffff88802053a300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 438.672842][ C0] ================================================================== [ 438.680968][ C0] Kernel panic - not syncing: panic_on_warn set ... [ 438.687649][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.19.0-rc5-syzkaller-00049-gc1084b6c5620 #0 [ 438.697440][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 438.707567][ C0] Call Trace: [ 438.710831][ C0] [ 438.713661][ C0] dump_stack_lvl+0xcd/0x134 [ 438.718298][ C0] panic+0x2d7/0x636 [ 438.722234][ C0] ? panic_print_sys_info.part.0+0x10b/0x10b [ 438.728218][ C0] ? tcp_write_timer_handler+0xb91/0xbc0 [ 438.734055][ C0] ? tcp_write_timer_handler+0xb91/0xbc0 [ 438.739708][ C0] end_report.part.0+0x3f/0x7c [ 438.744466][ C0] kasan_report.cold+0x93/0x1c6 [ 438.749306][ C0] ? tcp_write_timer_handler+0xb91/0xbc0 [ 438.754934][ C0] tcp_write_timer_handler+0xb91/0xbc0 [ 438.760409][ C0] tcp_write_timer+0xa2/0x2b0 [ 438.765285][ C0] ? tcp_write_timer_handler+0xbc0/0xbc0 [ 438.770914][ C0] call_timer_fn+0x1a5/0x6b0 [ 438.775490][ C0] ? timer_fixup_activate+0x350/0x350 [ 438.780844][ C0] ? lock_downgrade+0x6e0/0x6e0 [ 438.785946][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 438.791136][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 438.796323][ C0] ? tcp_write_timer_handler+0xbc0/0xbc0 [ 438.801946][ C0] __run_timers.part.0+0x679/0xa80 [ 438.807045][ C0] ? call_timer_fn+0x6b0/0x6b0 [ 438.811791][ C0] ? __wake_up_locked_sync_key+0x20/0x20 [ 438.817410][ C0] ? kvm_sched_clock_read+0x14/0x40 [ 438.822592][ C0] ? sched_clock_cpu+0x69/0x2b0 [ 438.827429][ C0] run_timer_softirq+0xb3/0x1d0 [ 438.832281][ C0] __do_softirq+0x29b/0x9c2 [ 438.836866][ C0] __irq_exit_rcu+0x123/0x180 [ 438.841554][ C0] irq_exit_rcu+0x5/0x20 [ 438.845896][ C0] sysvec_apic_timer_interrupt+0x93/0xc0 [ 438.851536][ C0] [ 438.854453][ C0] [ 438.857371][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 438.863359][ C0] RIP: 0010:acpi_idle_do_entry+0x1c9/0x240 [ 438.869253][ C0] Code: 89 de e8 aa 06 0e f8 84 db 75 98 e8 a1 0a 0e f8 e8 ac 57 14 f8 66 90 e8 95 0a 0e f8 0f 00 2d 1e c6 c7 00 e8 89 0a 0e f8 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 d4 06 0e f8 48 85 db [ 438.892950][ C0] RSP: 0018:ffffffff8ba07d38 EFLAGS: 00000293 [ 438.899029][ C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 438.907013][ C0] RDX: ffffffff8babc940 RSI: ffffffff896bc067 RDI: 0000000000000000 [ 438.915153][ C0] RBP: ffff888011b44864 R08: 0000000000000001 R09: 0000000000000001 [ 438.923114][ C0] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001 [ 438.931089][ C0] R13: ffff888011b44800 R14: ffff888011b44864 R15: ffff888017947004 [ 438.939051][ C0] ? acpi_idle_do_entry+0x1c7/0x240 [ 438.944257][ C0] ? acpi_idle_do_entry+0x1c7/0x240 [ 438.949455][ C0] acpi_idle_enter+0x369/0x510 [ 438.954212][ C0] cpuidle_enter_state+0x1b1/0xc80 [ 438.959317][ C0] cpuidle_enter+0x4a/0xa0 [ 438.963718][ C0] do_idle+0x3e8/0x590 [ 438.967774][ C0] ? arch_cpu_idle_exit+0x30/0x30 [ 438.972800][ C0] ? do_idle+0x336/0x590 [ 438.977026][ C0] cpu_startup_entry+0x14/0x20 [ 438.981790][ C0] rest_init+0x169/0x270 [ 438.986022][ C0] ? trace_init_perf_perm_irq_work_exit+0xe/0xe [ 438.992271][ C0] arch_call_rest_init+0xf/0x14 [ 438.997111][ C0] start_kernel+0x46e/0x48f [ 439.001605][ C0] secondary_startup_64_no_verify+0xce/0xdb [ 439.007493][ C0] [ 439.010704][ C0] Kernel Offset: disabled [ 439.015047][ C0] Rebooting in 86400 seconds..