[ 132.693636][ T1224] ieee802154 phy1 wpan1: encryption failed: -22
[ 194.136486][ T1224] ieee802154 phy0 wpan0: encryption failed: -22
[ 194.142835][ T1224] ieee802154 phy1 wpan1: encryption failed: -22
[ 206.444388][ T32] Bluetooth: hci0: command 0x0406 tx timeout
[ 255.567091][ T1224] ieee802154 phy0 wpan0: encryption failed: -22
[ 255.573449][ T1224] ieee802154 phy1 wpan1: encryption failed: -22
[ 317.006494][ T1224] ieee802154 phy0 wpan0: encryption failed: -22
[ 317.013578][ T1224] ieee802154 phy1 wpan1: encryption failed: -22
[ 378.456625][ T1224] ieee802154 phy0 wpan0: encryption failed: -22
[ 378.463026][ T1224] ieee802154 phy1 wpan1: encryption failed: -22
[ 436.379184][ T8] device hsr_slave_0 left promiscuous mode
[ 436.386467][ T8] device hsr_slave_1 left promiscuous mode
[ 436.393046][ T8] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 436.400606][ T8] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 436.410264][ T8] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 436.418094][ T8] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 436.427425][ T8] device bridge_slave_1 left promiscuous mode
[ 436.433672][ T8] bridge0: port 2(bridge_slave_1) entered disabled state
[ 436.443594][ T8] device bridge_slave_0 left promiscuous mode
[ 436.450902][ T8] bridge0: port 1(bridge_slave_0) entered disabled state
[ 436.461568][ T8] device veth1_macvtap left promiscuous mode
[ 436.468521][ T8] device veth0_macvtap left promiscuous mode
[ 436.474754][ T8] device veth1_vlan left promiscuous mode
[ 436.480554][ T8] device veth0_vlan left promiscuous mode
[ 436.611710][ T8] team0 (unregistering): Port device team_slave_1 removed
[ 436.625633][ T8] team0 (unregistering): Port device team_slave_0 removed
[ 436.637945][ T8] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 436.652014][ T8] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 436.711076][ T8] bond0 (unregistering): Released all slaves
[ 437.804064][ C0] ==================================================================
[ 437.812188][ C0] BUG: KASAN: use-after-free in tcp_write_timer_handler+0xb91/0xbc0
[ 437.820247][ C0] Read of size 1 at addr ffff88802053a215 by task swapper/0/0
[ 437.827694][ C0]
[ 437.830010][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.19.0-rc5-syzkaller-00049-gc1084b6c5620 #0
[ 437.840586][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[ 437.851496][ C0] Call Trace:
[ 437.854836][ C0]
[ 437.857770][ C0] dump_stack_lvl+0xcd/0x134
[ 437.862452][ C0] print_address_description.constprop.0.cold+0xeb/0x495
[ 437.869508][ C0] ? tcp_write_timer_handler+0xb91/0xbc0
[ 437.875143][ C0] kasan_report.cold+0xf4/0x1c6
[ 437.880003][ C0] ? tcp_write_timer_handler+0xb91/0xbc0
[ 437.885917][ C0] tcp_write_timer_handler+0xb91/0xbc0
[ 437.891401][ C0] tcp_write_timer+0xa2/0x2b0
[ 437.896168][ C0] ? tcp_write_timer_handler+0xbc0/0xbc0
[ 437.901897][ C0] call_timer_fn+0x1a5/0x6b0
[ 437.906557][ C0] ? timer_fixup_activate+0x350/0x350
[ 437.911916][ C0] ? lock_downgrade+0x6e0/0x6e0
[ 437.916826][ C0] ? _raw_spin_unlock_irq+0x1f/0x40
[ 437.922078][ C0] ? _raw_spin_unlock_irq+0x1f/0x40
[ 437.927436][ C0] ? tcp_write_timer_handler+0xbc0/0xbc0
[ 437.933320][ C0] __run_timers.part.0+0x679/0xa80
[ 437.938435][ C0] ? call_timer_fn+0x6b0/0x6b0
[ 437.943184][ C0] ? __wake_up_locked_sync_key+0x20/0x20
[ 437.948939][ C0] ? kvm_sched_clock_read+0x14/0x40
[ 437.954325][ C0] ? sched_clock_cpu+0x69/0x2b0
[ 437.959181][ C0] run_timer_softirq+0xb3/0x1d0
[ 437.964222][ C0] __do_softirq+0x29b/0x9c2
[ 437.968790][ C0] __irq_exit_rcu+0x123/0x180
[ 437.973674][ C0] irq_exit_rcu+0x5/0x20
[ 437.977909][ C0] sysvec_apic_timer_interrupt+0x93/0xc0
[ 437.983567][ C0]
[ 437.986486][ C0]
[ 437.989422][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[ 437.995428][ C0] RIP: 0010:acpi_idle_do_entry+0x1c9/0x240
[ 438.001238][ C0] Code: 89 de e8 aa 06 0e f8 84 db 75 98 e8 a1 0a 0e f8 e8 ac 57 14 f8 66 90 e8 95 0a 0e f8 0f 00 2d 1e c6 c7 00 e8 89 0a 0e f8 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 d4 06 0e f8 48 85 db
[ 438.020930][ C0] RSP: 0018:ffffffff8ba07d38 EFLAGS: 00000293
[ 438.026991][ C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 438.034945][ C0] RDX: ffffffff8babc940 RSI: ffffffff896bc067 RDI: 0000000000000000
[ 438.042903][ C0] RBP: ffff888011b44864 R08: 0000000000000001 R09: 0000000000000001
[ 438.050859][ C0] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
[ 438.059339][ C0] R13: ffff888011b44800 R14: ffff888011b44864 R15: ffff888017947004
[ 438.067318][ C0] ? acpi_idle_do_entry+0x1c7/0x240
[ 438.072517][ C0] ? acpi_idle_do_entry+0x1c7/0x240
[ 438.077757][ C0] acpi_idle_enter+0x369/0x510
[ 438.082615][ C0] cpuidle_enter_state+0x1b1/0xc80
[ 438.087799][ C0] cpuidle_enter+0x4a/0xa0
[ 438.092226][ C0] do_idle+0x3e8/0x590
[ 438.096309][ C0] ? arch_cpu_idle_exit+0x30/0x30
[ 438.101329][ C0] ? do_idle+0x336/0x590
[ 438.105621][ C0] cpu_startup_entry+0x14/0x20
[ 438.110464][ C0] rest_init+0x169/0x270
[ 438.114701][ C0] ? trace_init_perf_perm_irq_work_exit+0xe/0xe
[ 438.120977][ C0] arch_call_rest_init+0xf/0x14
[ 438.125825][ C0] start_kernel+0x46e/0x48f
[ 438.130316][ C0] secondary_startup_64_no_verify+0xce/0xdb
[ 438.136305][ C0]
[ 438.139311][ C0]
[ 438.141628][ C0] Allocated by task 4070:
[ 438.145958][ C0] kasan_save_stack+0x1e/0x40
[ 438.150707][ C0] __kasan_slab_alloc+0x90/0xc0
[ 438.155558][ C0] kmem_cache_alloc+0x204/0x3b0
[ 438.160403][ C0] copy_net_ns+0x125/0x760
[ 438.164845][ C0] create_new_namespaces+0x3f6/0xb20
[ 438.170203][ C0] unshare_nsproxy_namespaces+0xc1/0x1f0
[ 438.175917][ C0] ksys_unshare+0x445/0x920
[ 438.180463][ C0] __x64_sys_unshare+0x2d/0x40
[ 438.185225][ C0] do_syscall_64+0x35/0x80
[ 438.189640][ C0] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 438.195536][ C0]
[ 438.197855][ C0] Freed by task 8:
[ 438.201554][ C0] kasan_save_stack+0x1e/0x40
[ 438.206219][ C0] kasan_set_track+0x21/0x30
[ 438.210794][ C0] kasan_set_free_info+0x20/0x30
[ 438.215897][ C0] ____kasan_slab_free+0x166/0x1a0
[ 438.220990][ C0] slab_free_freelist_hook+0x8b/0x1c0
[ 438.226347][ C0] kmem_cache_free+0xdd/0x5a0
[ 438.231014][ C0] cleanup_net+0x8ba/0xb00
[ 438.235481][ C0] process_one_work+0x996/0x1610
[ 438.240523][ C0] worker_thread+0x665/0x1080
[ 438.245184][ C0] kthread+0x2e9/0x3a0
[ 438.249252][ C0] ret_from_fork+0x1f/0x30
[ 438.253653][ C0]
[ 438.255957][ C0] Last potentially related work creation:
[ 438.261649][ C0] kasan_save_stack+0x1e/0x40
[ 438.266311][ C0] __kasan_record_aux_stack+0xbe/0xd0
[ 438.271668][ C0] insert_work+0x48/0x350
[ 438.276007][ C0] __queue_work+0x62f/0x1150
[ 438.280597][ C0] call_timer_fn+0x1a5/0x6b0
[ 438.285178][ C0] __run_timers.part.0+0x4a3/0xa80
[ 438.290280][ C0] run_timer_softirq+0x152/0x1d0
[ 438.295260][ C0] __do_softirq+0x29b/0x9c2
[ 438.299787][ C0]
[ 438.302107][ C0] Second to last potentially related work creation:
[ 438.308673][ C0] kasan_save_stack+0x1e/0x40
[ 438.313432][ C0] __kasan_record_aux_stack+0xbe/0xd0
[ 438.318805][ C0] insert_work+0x48/0x350
[ 438.323148][ C0] __queue_work+0x62f/0x1150
[ 438.327747][ C0] call_timer_fn+0x1a5/0x6b0
[ 438.332548][ C0] __run_timers.part.0+0x4a3/0xa80
[ 438.337644][ C0] run_timer_softirq+0x152/0x1d0
[ 438.342617][ C0] __do_softirq+0x29b/0x9c2
[ 438.347208][ C0]
[ 438.349521][ C0] The buggy address belongs to the object at ffff888020539b80
[ 438.349521][ C0] which belongs to the cache net_namespace of size 6784
[ 438.363920][ C0] The buggy address is located 1685 bytes inside of
[ 438.363920][ C0] 6784-byte region [ffff888020539b80, ffff88802053b600)
[ 438.377816][ C0]
[ 438.380130][ C0] The buggy address belongs to the physical page:
[ 438.386524][ C0] page:ffffea0000814e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20538
[ 438.396743][ C0] head:ffffea0000814e00 order:3 compound_mapcount:0 compound_pincount:0
[ 438.405314][ C0] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 438.413284][ C0] raw: 00fff00000010200 0000000000000000 dead000000000122 ffff8881400073c0
[ 438.421939][ C0] raw: 0000000000000000 0000000080040004 00000001ffffffff 0000000000000000
[ 438.430601][ C0] page dumped because: kasan: bad access detected
[ 438.437080][ C0] page_owner tracks the page as allocated
[ 438.442876][ C0] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3608, tgid 3608 (syz-executor.0), ts 50598570599, free_ts 49036316494
[ 438.464870][ C0] get_page_from_freelist+0x1290/0x3b70
[ 438.470487][ C0] __alloc_pages+0x1c7/0x510
[ 438.475066][ C0] alloc_pages+0x1aa/0x310
[ 438.479712][ C0] allocate_slab+0x26c/0x3c0
[ 438.484558][ C0] ___slab_alloc+0x9c4/0xe20
[ 438.489154][ C0] __slab_alloc.constprop.0+0x4d/0xa0
[ 438.494515][ C0] kmem_cache_alloc+0x360/0x3b0
[ 438.499466][ C0] copy_net_ns+0x125/0x760
[ 438.503879][ C0] create_new_namespaces+0x3f6/0xb20
[ 438.509157][ C0] unshare_nsproxy_namespaces+0xc1/0x1f0
[ 438.514939][ C0] ksys_unshare+0x445/0x920
[ 438.519444][ C0] __x64_sys_unshare+0x2d/0x40
[ 438.524206][ C0] do_syscall_64+0x35/0x80
[ 438.528606][ C0] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 438.534600][ C0] page last free stack trace:
[ 438.539276][ C0] free_pcp_prepare+0x549/0xd20
[ 438.544121][ C0] free_unref_page+0x19/0x6a0
[ 438.548783][ C0] __unfreeze_partials+0x17c/0x1a0
[ 438.554241][ C0] qlist_free_all+0x6a/0x170
[ 438.558867][ C0] kasan_quarantine_reduce+0x180/0x200
[ 438.564412][ C0] __kasan_slab_alloc+0xa2/0xc0
[ 438.569260][ C0] __kmalloc+0x200/0x350
[ 438.574370][ C0] tomoyo_supervisor+0xce6/0xf00
[ 438.579410][ C0] tomoyo_path_permission+0x270/0x3a0
[ 438.584854][ C0] tomoyo_check_open_permission+0x33e/0x380
[ 438.590738][ C0] tomoyo_file_open+0x9d/0xc0
[ 438.595576][ C0] security_file_open+0x45/0xb0
[ 438.600482][ C0] do_dentry_open+0x349/0x11f0
[ 438.605528][ C0] path_openat+0x1c71/0x2910
[ 438.610148][ C0] do_filp_open+0x1aa/0x400
[ 438.614639][ C0] do_sys_openat2+0x16d/0x4c0
[ 438.619406][ C0]
[ 438.621914][ C0] Memory state around the buggy address:
[ 438.627534][ C0] ffff88802053a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 438.635592][ C0] ffff88802053a180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 438.643646][ C0] >ffff88802053a200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 438.651882][ C0] ^
[ 438.656467][ C0] ffff88802053a280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 438.664688][ C0] ffff88802053a300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 438.672842][ C0] ==================================================================
[ 438.680968][ C0] Kernel panic - not syncing: panic_on_warn set ...
[ 438.687649][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.19.0-rc5-syzkaller-00049-gc1084b6c5620 #0
[ 438.697440][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[ 438.707567][ C0] Call Trace:
[ 438.710831][ C0]
[ 438.713661][ C0] dump_stack_lvl+0xcd/0x134
[ 438.718298][ C0] panic+0x2d7/0x636
[ 438.722234][ C0] ? panic_print_sys_info.part.0+0x10b/0x10b
[ 438.728218][ C0] ? tcp_write_timer_handler+0xb91/0xbc0
[ 438.734055][ C0] ? tcp_write_timer_handler+0xb91/0xbc0
[ 438.739708][ C0] end_report.part.0+0x3f/0x7c
[ 438.744466][ C0] kasan_report.cold+0x93/0x1c6
[ 438.749306][ C0] ? tcp_write_timer_handler+0xb91/0xbc0
[ 438.754934][ C0] tcp_write_timer_handler+0xb91/0xbc0
[ 438.760409][ C0] tcp_write_timer+0xa2/0x2b0
[ 438.765285][ C0] ? tcp_write_timer_handler+0xbc0/0xbc0
[ 438.770914][ C0] call_timer_fn+0x1a5/0x6b0
[ 438.775490][ C0] ? timer_fixup_activate+0x350/0x350
[ 438.780844][ C0] ? lock_downgrade+0x6e0/0x6e0
[ 438.785946][ C0] ? _raw_spin_unlock_irq+0x1f/0x40
[ 438.791136][ C0] ? _raw_spin_unlock_irq+0x1f/0x40
[ 438.796323][ C0] ? tcp_write_timer_handler+0xbc0/0xbc0
[ 438.801946][ C0] __run_timers.part.0+0x679/0xa80
[ 438.807045][ C0] ? call_timer_fn+0x6b0/0x6b0
[ 438.811791][ C0] ? __wake_up_locked_sync_key+0x20/0x20
[ 438.817410][ C0] ? kvm_sched_clock_read+0x14/0x40
[ 438.822592][ C0] ? sched_clock_cpu+0x69/0x2b0
[ 438.827429][ C0] run_timer_softirq+0xb3/0x1d0
[ 438.832281][ C0] __do_softirq+0x29b/0x9c2
[ 438.836866][ C0] __irq_exit_rcu+0x123/0x180
[ 438.841554][ C0] irq_exit_rcu+0x5/0x20
[ 438.845896][ C0] sysvec_apic_timer_interrupt+0x93/0xc0
[ 438.851536][ C0]
[ 438.854453][ C0]
[ 438.857371][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[ 438.863359][ C0] RIP: 0010:acpi_idle_do_entry+0x1c9/0x240
[ 438.869253][ C0] Code: 89 de e8 aa 06 0e f8 84 db 75 98 e8 a1 0a 0e f8 e8 ac 57 14 f8 66 90 e8 95 0a 0e f8 0f 00 2d 1e c6 c7 00 e8 89 0a 0e f8 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 d4 06 0e f8 48 85 db
[ 438.892950][ C0] RSP: 0018:ffffffff8ba07d38 EFLAGS: 00000293
[ 438.899029][ C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 438.907013][ C0] RDX: ffffffff8babc940 RSI: ffffffff896bc067 RDI: 0000000000000000
[ 438.915153][ C0] RBP: ffff888011b44864 R08: 0000000000000001 R09: 0000000000000001
[ 438.923114][ C0] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
[ 438.931089][ C0] R13: ffff888011b44800 R14: ffff888011b44864 R15: ffff888017947004
[ 438.939051][ C0] ? acpi_idle_do_entry+0x1c7/0x240
[ 438.944257][ C0] ? acpi_idle_do_entry+0x1c7/0x240
[ 438.949455][ C0] acpi_idle_enter+0x369/0x510
[ 438.954212][ C0] cpuidle_enter_state+0x1b1/0xc80
[ 438.959317][ C0] cpuidle_enter+0x4a/0xa0
[ 438.963718][ C0] do_idle+0x3e8/0x590
[ 438.967774][ C0] ? arch_cpu_idle_exit+0x30/0x30
[ 438.972800][ C0] ? do_idle+0x336/0x590
[ 438.977026][ C0] cpu_startup_entry+0x14/0x20
[ 438.981790][ C0] rest_init+0x169/0x270
[ 438.986022][ C0] ? trace_init_perf_perm_irq_work_exit+0xe/0xe
[ 438.992271][ C0] arch_call_rest_init+0xf/0x14
[ 438.997111][ C0] start_kernel+0x46e/0x48f
[ 439.001605][ C0] secondary_startup_64_no_verify+0xce/0xdb
[ 439.007493][ C0]
[ 439.010704][ C0] Kernel Offset: disabled
[ 439.015047][ C0] Rebooting in 86400 seconds..