[ 52.385971][ T539] bridge0: port 1(bridge_slave_0) entered disabled state
[ 52.407834][ T539] device veth1_macvtap left promiscuous mode
[ 52.414747][ T539] device veth0_macvtap left promiscuous mode
[ 52.422097][ T539] device veth1_vlan left promiscuous mode
[ 52.428154][ T539] device veth0_vlan left promiscuous mode
[ 52.564344][ T539] team0 (unregistering): Port device team_slave_1 removed
[ 52.575412][ T539] team0 (unregistering): Port device team_slave_0 removed
[ 52.588069][ T539] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 52.602457][ T539] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 52.645319][ T539] bond0 (unregistering): Released all slaves
Warning: Permanently added '10.128.1.90' (ECDSA) to the list of known hosts.
2023/05/02 20:21:20 ignoring optional flag "sandboxArg"="0"
2023/05/02 20:21:20 parsed 1 programs
2023/05/02 20:21:20 executed programs: 0
[ 66.694794][ T3853] chnl_net:caif_netlink_parms(): no params data found
[ 66.728355][ T3853] bridge0: port 1(bridge_slave_0) entered blocking state
[ 66.735450][ T3853] bridge0: port 1(bridge_slave_0) entered disabled state
[ 66.743363][ T3853] device bridge_slave_0 entered promiscuous mode
[ 66.751078][ T3853] bridge0: port 2(bridge_slave_1) entered blocking state
[ 66.758160][ T3853] bridge0: port 2(bridge_slave_1) entered disabled state
[ 66.766033][ T3853] device bridge_slave_1 entered promiscuous mode
[ 66.782933][ T3853] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 66.793547][ T3853] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 66.812667][ T3853] team0: Port device team_slave_0 added
[ 66.820515][ T3853] team0: Port device team_slave_1 added
[ 66.834895][ T3853] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 66.841989][ T3853] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 66.867895][ T3853] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 66.880064][ T3853] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 66.887100][ T3853] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 66.913185][ T3853] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 66.937446][ T3853] device hsr_slave_0 entered promiscuous mode
[ 66.945341][ T3853] device hsr_slave_1 entered promiscuous mode
[ 67.349611][ T3853] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 67.360954][ T3853] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 67.371999][ T3853] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 67.381372][ T3853] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 67.403008][ T3853] bridge0: port 2(bridge_slave_1) entered blocking state
[ 67.410144][ T3853] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 67.417856][ T3853] bridge0: port 1(bridge_slave_0) entered blocking state
[ 67.425040][ T3853] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 67.477474][ T3853] 8021q: adding VLAN 0 to HW filter on device bond0
[ 67.492715][ T3514] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 67.502752][ T3514] bridge0: port 1(bridge_slave_0) entered disabled state
[ 67.511821][ T3514] bridge0: port 2(bridge_slave_1) entered disabled state
[ 67.521004][ T3514] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 67.535012][ T3853] 8021q: adding VLAN 0 to HW filter on device team0
[ 67.547508][ T3514] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 67.556997][ T3514] bridge0: port 1(bridge_slave_0) entered blocking state
[ 67.564394][ T3514] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 67.591445][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 67.600618][ T7] bridge0: port 2(bridge_slave_1) entered blocking state
[ 67.608144][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 67.617154][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 67.626015][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 67.634578][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 67.646542][ T3853] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 67.662410][ T3853] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 67.674284][ T3514] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 67.682947][ T3514] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 67.780193][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 67.787685][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 67.797987][ T3853] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 67.816758][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 67.828602][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 67.850074][ T3853] device veth0_vlan entered promiscuous mode
[ 67.857888][ T3514] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 67.870511][ T3514] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 67.883163][ T3853] device veth1_vlan entered promiscuous mode
[ 67.893416][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 67.902476][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 67.911204][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 67.933615][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 67.942715][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 67.953362][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 67.964273][ T3853] device veth0_macvtap entered promiscuous mode
[ 67.977683][ T3853] device veth1_macvtap entered promiscuous mode
[ 67.996264][ T3853] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 68.006488][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 68.017287][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 68.026038][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 68.036256][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 68.047760][ T3853] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 68.057472][ T3514] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 68.066616][ T3514] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 68.080248][ T3853] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 68.090007][ T3853] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 68.099580][ T3853] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 68.109761][ T3853] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 68.169230][ T1238] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 68.177186][ T1238] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 68.202226][ T3514] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 68.215077][ T539] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 68.224781][ T539] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 68.235798][ T3514] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 68.267315][ T3506] Bluetooth: hci0: Unknown advertising packet type: 0x6678
[ 68.267457][ T3506] ==================================================================
[ 68.283007][ T3506] BUG: KASAN: slab-out-of-bounds in hci_le_meta_evt+0x1541/0x3bb0
[ 68.290813][ T3506] Read of size 1 at addr ffff88801aa86c0a by task kworker/u5:1/3506
[ 68.299076][ T3506]
[ 68.301445][ T3506] CPU: 1 PID: 3506 Comm: kworker/u5:1 Not tainted 5.15.110-syzkaller #0
[ 68.309999][ T3506] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
[ 68.320159][ T3506] Workqueue: hci0 hci_rx_work
[ 68.325112][ T3506] Call Trace:
[ 68.328425][ T3506]
[ 68.331358][ T3506] dump_stack_lvl+0x163/0x213
[ 68.336038][ T3506] ? io_uring_drop_tctx_refs+0x15d/0x15d
[ 68.341857][ T3506] ? _printk+0xca/0x10a
[ 68.346057][ T3506] ? _raw_spin_lock_irqsave+0xac/0x120
[ 68.351527][ T3506] ? panic+0x584/0x584
[ 68.355784][ T3506] ? _raw_spin_lock_irqsave+0xdd/0x120
[ 68.361428][ T3506] ? process_adv_report+0xc05/0x1140
[ 68.366875][ T3506] print_address_description+0x63/0x3b0
[ 68.372444][ T3506] ? hci_le_meta_evt+0x1541/0x3bb0
[ 68.377554][ T3506] kasan_report+0x16b/0x1c0
[ 68.382151][ T3506] ? hci_le_meta_evt+0x1541/0x3bb0
[ 68.387505][ T3506] hci_le_meta_evt+0x1541/0x3bb0
[ 68.392508][ T3506] ? __lock_acquire+0x1ff0/0x1ff0
[ 68.397726][ T3506] ? hci_remote_host_features_evt+0x240/0x240
[ 68.404056][ T3506] ? __mutex_unlock_slowpath+0x218/0x750
[ 68.409703][ T3506] ? hci_event_packet+0x388/0x1390
[ 68.414822][ T3506] ? mutex_unlock+0x10/0x10
[ 68.419334][ T3506] ? mark_lock+0x98/0x340
[ 68.423675][ T3506] ? lockdep_hardirqs_on_prepare+0x438/0x7a0
[ 68.429680][ T3506] hci_event_packet+0x5eb/0x1390
[ 68.434631][ T3506] ? rcu_lock_release+0x20/0x20
[ 68.439589][ T3506] ? hci_send_to_monitor+0x21/0x440
[ 68.445135][ T3506] hci_rx_work+0x1f6/0x6e0
[ 68.449567][ T3506] process_one_work+0x799/0xe10
[ 68.454489][ T3506] ? worker_detach_from_pool+0x240/0x240
[ 68.460146][ T3506] ? _raw_spin_lock_irqsave+0x120/0x120
[ 68.465723][ T3506] worker_thread+0x8f2/0xfb0
[ 68.470341][ T3506] kthread+0x3a8/0x480
[ 68.474410][ T3506] ? rcu_lock_release+0x20/0x20
[ 68.479342][ T3506] ? kthread_blkcg+0xa0/0xa0
[ 68.483934][ T3506] ret_from_fork+0x1f/0x30
[ 68.488453][ T3506]
[ 68.491463][ T3506]
[ 68.493772][ T3506] Allocated by task 3957:
[ 68.498168][ T3506] ____kasan_kmalloc+0xba/0xf0
[ 68.503018][ T3506] __kmalloc_node_track_caller+0x195/0x390
[ 68.508822][ T3506] __alloc_skb+0xbd/0x4a0
[ 68.513235][ T3506] vhci_write+0xa2/0x3b0
[ 68.517475][ T3506] vfs_write+0x84c/0xb50
[ 68.521800][ T3506] ksys_write+0x165/0x250
[ 68.526128][ T3506] do_syscall_64+0x3d/0xb0
[ 68.530540][ T3506] entry_SYSCALL_64_after_hwframe+0x61/0xcb
[ 68.536519][ T3506]
[ 68.538838][ T3506] Last potentially related work creation:
[ 68.544722][ T3506] kasan_save_stack+0x36/0x60
[ 68.549402][ T3506] kasan_record_aux_stack+0xba/0x100
[ 68.555203][ T3506] call_rcu+0x1c4/0xa70
[ 68.559389][ T3506] process_one_work+0x799/0xe10
[ 68.564241][ T3506] worker_thread+0x8f2/0xfb0
[ 68.568830][ T3506] kthread+0x3a8/0x480
[ 68.572938][ T3506] ret_from_fork+0x1f/0x30
[ 68.577610][ T3506]
[ 68.580023][ T3506] The buggy address belongs to the object at ffff88801aa86800
[ 68.580023][ T3506] which belongs to the cache kmalloc-1k of size 1024
[ 68.594198][ T3506] The buggy address is located 10 bytes to the right of
[ 68.594198][ T3506] 1024-byte region [ffff88801aa86800, ffff88801aa86c00)
[ 68.608163][ T3506] The buggy address belongs to the page:
[ 68.613968][ T3506] page:ffffea00006aa000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1aa80
[ 68.624687][ T3506] head:ffffea00006aa000 order:3 compound_mapcount:0 compound_pincount:0
[ 68.633137][ T3506] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 68.641123][ T3506] raw: 00fff00000010200 ffffea0001cf1200 0000000400000004 ffff888010841dc0
[ 68.650016][ T3506] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
[ 68.658677][ T3506] page dumped because: kasan: bad access detected
[ 68.665259][ T3506] page_owner tracks the page as allocated
[ 68.671278][ T3506] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, ts 4964385086, free_ts 0
[ 68.689241][ T3506] get_page_from_freelist+0x322a/0x33c0
[ 68.694791][ T3506] __alloc_pages+0x272/0x700
[ 68.699748][ T3506] alloc_page_interleave+0xf/0x140
[ 68.704970][ T3506] new_slab+0xbb/0x4b0
[ 68.709226][ T3506] ___slab_alloc+0x6f6/0xe10
[ 68.714344][ T3506] __kmalloc+0x1c9/0x300
[ 68.718670][ T3506] alloc_workqueue+0x122/0x1190
[ 68.723514][ T3506] nvme_core_init+0x39/0x1e4
[ 68.728126][ T3506] do_one_initcall+0x1a3/0x580
[ 68.732974][ T3506] do_initcall_level+0x125/0x1ae
[ 68.738040][ T3506] do_initcalls+0x46/0x74
[ 68.742367][ T3506] kernel_init_freeable+0x38b/0x4dd
[ 68.747560][ T3506] kernel_init+0x14/0x190
[ 68.751895][ T3506] ret_from_fork+0x1f/0x30
[ 68.756317][ T3506] page_owner free stack trace missing
[ 68.761678][ T3506]
[ 68.763999][ T3506] Memory state around the buggy address:
[ 68.769616][ T3506] ffff88801aa86b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 68.777674][ T3506] ffff88801aa86b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 68.785769][ T3506] >ffff88801aa86c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 68.793979][ T3506] ^
[ 68.798404][ T3506] ffff88801aa86c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 68.806811][ T3506] ffff88801aa86d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 68.814993][ T3506] ==================================================================
[ 68.823055][ T3506] Disabling lock debugging due to kernel taint
[ 68.829998][ T3307] Bluetooth: hci0: command 0x0409 tx timeout
[ 68.837000][ T3506] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 68.844197][ T3506] CPU: 1 PID: 3506 Comm: kworker/u5:1 Tainted: G B 5.15.110-syzkaller #0
[ 68.853985][ T3506] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
[ 68.864205][ T3506] Workqueue: hci0 hci_rx_work
[ 68.868965][ T3506] Call Trace:
[ 68.872239][ T3506]
[ 68.875177][ T3506] dump_stack_lvl+0x163/0x213
[ 68.879848][ T3506] ? io_uring_drop_tctx_refs+0x15d/0x15d
[ 68.885476][ T3506] ? panic+0x584/0x584
[ 68.889570][ T3506] ? preempt_schedule_common+0xa6/0xd0
[ 68.895294][ T3506] ? preempt_schedule+0xd9/0xe0
[ 68.900538][ T3506] ? schedule_preempt_disabled+0x20/0x20
[ 68.906280][ T3506] panic+0x228/0x584
[ 68.910176][ T3506] ? fb_is_primary_device+0xb8/0xb8
[ 68.915624][ T3506] ? _raw_spin_unlock_irqrestore+0x128/0x130
[ 68.921783][ T3506] ? _raw_spin_unlock+0x40/0x40
[ 68.926633][ T3506] check_panic_on_warn+0x54/0x70
[ 68.931617][ T3506] ? hci_le_meta_evt+0x1541/0x3bb0
[ 68.936822][ T3506] end_report+0x6d/0xf0
[ 68.940975][ T3506] kasan_report+0x18e/0x1c0
[ 68.945475][ T3506] ? hci_le_meta_evt+0x1541/0x3bb0
[ 68.950586][ T3506] hci_le_meta_evt+0x1541/0x3bb0
[ 68.955517][ T3506] ? __lock_acquire+0x1ff0/0x1ff0
[ 68.960541][ T3506] ? hci_remote_host_features_evt+0x240/0x240
[ 68.966609][ T3506] ? __mutex_unlock_slowpath+0x218/0x750
[ 68.972236][ T3506] ? hci_event_packet+0x388/0x1390
[ 68.977350][ T3506] ? mutex_unlock+0x10/0x10
[ 68.981847][ T3506] ? mark_lock+0x98/0x340
[ 68.986172][ T3506] ? lockdep_hardirqs_on_prepare+0x438/0x7a0
[ 68.992149][ T3506] hci_event_packet+0x5eb/0x1390
[ 68.997090][ T3506] ? rcu_lock_release+0x20/0x20
[ 69.001940][ T3506] ? hci_send_to_monitor+0x21/0x440
[ 69.007223][ T3506] hci_rx_work+0x1f6/0x6e0
[ 69.011635][ T3506] process_one_work+0x799/0xe10
[ 69.016491][ T3506] ? worker_detach_from_pool+0x240/0x240
[ 69.022306][ T3506] ? _raw_spin_lock_irqsave+0x120/0x120
[ 69.027932][ T3506] worker_thread+0x8f2/0xfb0
[ 69.032514][ T3506] kthread+0x3a8/0x480
[ 69.036681][ T3506] ? rcu_lock_release+0x20/0x20
[ 69.041536][ T3506] ? kthread_blkcg+0xa0/0xa0
[ 69.046127][ T3506] ret_from_fork+0x1f/0x30
[ 69.050544][ T3506]
[ 69.053822][ T3506] Kernel Offset: disabled
[ 69.058140][ T3506] Rebooting in 86400 seconds..