[ 52.385971][ T539] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.407834][ T539] device veth1_macvtap left promiscuous mode [ 52.414747][ T539] device veth0_macvtap left promiscuous mode [ 52.422097][ T539] device veth1_vlan left promiscuous mode [ 52.428154][ T539] device veth0_vlan left promiscuous mode [ 52.564344][ T539] team0 (unregistering): Port device team_slave_1 removed [ 52.575412][ T539] team0 (unregistering): Port device team_slave_0 removed [ 52.588069][ T539] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 52.602457][ T539] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 52.645319][ T539] bond0 (unregistering): Released all slaves Warning: Permanently added '10.128.1.90' (ECDSA) to the list of known hosts. 2023/05/02 20:21:20 ignoring optional flag "sandboxArg"="0" 2023/05/02 20:21:20 parsed 1 programs 2023/05/02 20:21:20 executed programs: 0 [ 66.694794][ T3853] chnl_net:caif_netlink_parms(): no params data found [ 66.728355][ T3853] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.735450][ T3853] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.743363][ T3853] device bridge_slave_0 entered promiscuous mode [ 66.751078][ T3853] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.758160][ T3853] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.766033][ T3853] device bridge_slave_1 entered promiscuous mode [ 66.782933][ T3853] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.793547][ T3853] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.812667][ T3853] team0: Port device team_slave_0 added [ 66.820515][ T3853] team0: Port device team_slave_1 added [ 66.834895][ T3853] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.841989][ T3853] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.867895][ T3853] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.880064][ T3853] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.887100][ T3853] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.913185][ T3853] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.937446][ T3853] device hsr_slave_0 entered promiscuous mode [ 66.945341][ T3853] device hsr_slave_1 entered promiscuous mode [ 67.349611][ T3853] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 67.360954][ T3853] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 67.371999][ T3853] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 67.381372][ T3853] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 67.403008][ T3853] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.410144][ T3853] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.417856][ T3853] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.425040][ T3853] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.477474][ T3853] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.492715][ T3514] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 67.502752][ T3514] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.511821][ T3514] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.521004][ T3514] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 67.535012][ T3853] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.547508][ T3514] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 67.556997][ T3514] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.564394][ T3514] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.591445][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 67.600618][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.608144][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.617154][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 67.626015][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 67.634578][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 67.646542][ T3853] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 67.662410][ T3853] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 67.674284][ T3514] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 67.682947][ T3514] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 67.780193][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 67.787685][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 67.797987][ T3853] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.816758][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 67.828602][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 67.850074][ T3853] device veth0_vlan entered promiscuous mode [ 67.857888][ T3514] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 67.870511][ T3514] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 67.883163][ T3853] device veth1_vlan entered promiscuous mode [ 67.893416][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 67.902476][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 67.911204][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 67.933615][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 67.942715][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 67.953362][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 67.964273][ T3853] device veth0_macvtap entered promiscuous mode [ 67.977683][ T3853] device veth1_macvtap entered promiscuous mode [ 67.996264][ T3853] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 68.006488][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 68.017287][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 68.026038][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 68.036256][ T3517] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 68.047760][ T3853] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 68.057472][ T3514] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 68.066616][ T3514] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 68.080248][ T3853] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.090007][ T3853] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.099580][ T3853] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.109761][ T3853] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.169230][ T1238] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.177186][ T1238] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.202226][ T3514] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 68.215077][ T539] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.224781][ T539] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.235798][ T3514] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 68.267315][ T3506] Bluetooth: hci0: Unknown advertising packet type: 0x6678 [ 68.267457][ T3506] ================================================================== [ 68.283007][ T3506] BUG: KASAN: slab-out-of-bounds in hci_le_meta_evt+0x1541/0x3bb0 [ 68.290813][ T3506] Read of size 1 at addr ffff88801aa86c0a by task kworker/u5:1/3506 [ 68.299076][ T3506] [ 68.301445][ T3506] CPU: 1 PID: 3506 Comm: kworker/u5:1 Not tainted 5.15.110-syzkaller #0 [ 68.309999][ T3506] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 [ 68.320159][ T3506] Workqueue: hci0 hci_rx_work [ 68.325112][ T3506] Call Trace: [ 68.328425][ T3506] [ 68.331358][ T3506] dump_stack_lvl+0x163/0x213 [ 68.336038][ T3506] ? io_uring_drop_tctx_refs+0x15d/0x15d [ 68.341857][ T3506] ? _printk+0xca/0x10a [ 68.346057][ T3506] ? _raw_spin_lock_irqsave+0xac/0x120 [ 68.351527][ T3506] ? panic+0x584/0x584 [ 68.355784][ T3506] ? _raw_spin_lock_irqsave+0xdd/0x120 [ 68.361428][ T3506] ? process_adv_report+0xc05/0x1140 [ 68.366875][ T3506] print_address_description+0x63/0x3b0 [ 68.372444][ T3506] ? hci_le_meta_evt+0x1541/0x3bb0 [ 68.377554][ T3506] kasan_report+0x16b/0x1c0 [ 68.382151][ T3506] ? hci_le_meta_evt+0x1541/0x3bb0 [ 68.387505][ T3506] hci_le_meta_evt+0x1541/0x3bb0 [ 68.392508][ T3506] ? __lock_acquire+0x1ff0/0x1ff0 [ 68.397726][ T3506] ? hci_remote_host_features_evt+0x240/0x240 [ 68.404056][ T3506] ? __mutex_unlock_slowpath+0x218/0x750 [ 68.409703][ T3506] ? hci_event_packet+0x388/0x1390 [ 68.414822][ T3506] ? mutex_unlock+0x10/0x10 [ 68.419334][ T3506] ? mark_lock+0x98/0x340 [ 68.423675][ T3506] ? lockdep_hardirqs_on_prepare+0x438/0x7a0 [ 68.429680][ T3506] hci_event_packet+0x5eb/0x1390 [ 68.434631][ T3506] ? rcu_lock_release+0x20/0x20 [ 68.439589][ T3506] ? hci_send_to_monitor+0x21/0x440 [ 68.445135][ T3506] hci_rx_work+0x1f6/0x6e0 [ 68.449567][ T3506] process_one_work+0x799/0xe10 [ 68.454489][ T3506] ? worker_detach_from_pool+0x240/0x240 [ 68.460146][ T3506] ? _raw_spin_lock_irqsave+0x120/0x120 [ 68.465723][ T3506] worker_thread+0x8f2/0xfb0 [ 68.470341][ T3506] kthread+0x3a8/0x480 [ 68.474410][ T3506] ? rcu_lock_release+0x20/0x20 [ 68.479342][ T3506] ? kthread_blkcg+0xa0/0xa0 [ 68.483934][ T3506] ret_from_fork+0x1f/0x30 [ 68.488453][ T3506] [ 68.491463][ T3506] [ 68.493772][ T3506] Allocated by task 3957: [ 68.498168][ T3506] ____kasan_kmalloc+0xba/0xf0 [ 68.503018][ T3506] __kmalloc_node_track_caller+0x195/0x390 [ 68.508822][ T3506] __alloc_skb+0xbd/0x4a0 [ 68.513235][ T3506] vhci_write+0xa2/0x3b0 [ 68.517475][ T3506] vfs_write+0x84c/0xb50 [ 68.521800][ T3506] ksys_write+0x165/0x250 [ 68.526128][ T3506] do_syscall_64+0x3d/0xb0 [ 68.530540][ T3506] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 68.536519][ T3506] [ 68.538838][ T3506] Last potentially related work creation: [ 68.544722][ T3506] kasan_save_stack+0x36/0x60 [ 68.549402][ T3506] kasan_record_aux_stack+0xba/0x100 [ 68.555203][ T3506] call_rcu+0x1c4/0xa70 [ 68.559389][ T3506] process_one_work+0x799/0xe10 [ 68.564241][ T3506] worker_thread+0x8f2/0xfb0 [ 68.568830][ T3506] kthread+0x3a8/0x480 [ 68.572938][ T3506] ret_from_fork+0x1f/0x30 [ 68.577610][ T3506] [ 68.580023][ T3506] The buggy address belongs to the object at ffff88801aa86800 [ 68.580023][ T3506] which belongs to the cache kmalloc-1k of size 1024 [ 68.594198][ T3506] The buggy address is located 10 bytes to the right of [ 68.594198][ T3506] 1024-byte region [ffff88801aa86800, ffff88801aa86c00) [ 68.608163][ T3506] The buggy address belongs to the page: [ 68.613968][ T3506] page:ffffea00006aa000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1aa80 [ 68.624687][ T3506] head:ffffea00006aa000 order:3 compound_mapcount:0 compound_pincount:0 [ 68.633137][ T3506] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 68.641123][ T3506] raw: 00fff00000010200 ffffea0001cf1200 0000000400000004 ffff888010841dc0 [ 68.650016][ T3506] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 68.658677][ T3506] page dumped because: kasan: bad access detected [ 68.665259][ T3506] page_owner tracks the page as allocated [ 68.671278][ T3506] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, ts 4964385086, free_ts 0 [ 68.689241][ T3506] get_page_from_freelist+0x322a/0x33c0 [ 68.694791][ T3506] __alloc_pages+0x272/0x700 [ 68.699748][ T3506] alloc_page_interleave+0xf/0x140 [ 68.704970][ T3506] new_slab+0xbb/0x4b0 [ 68.709226][ T3506] ___slab_alloc+0x6f6/0xe10 [ 68.714344][ T3506] __kmalloc+0x1c9/0x300 [ 68.718670][ T3506] alloc_workqueue+0x122/0x1190 [ 68.723514][ T3506] nvme_core_init+0x39/0x1e4 [ 68.728126][ T3506] do_one_initcall+0x1a3/0x580 [ 68.732974][ T3506] do_initcall_level+0x125/0x1ae [ 68.738040][ T3506] do_initcalls+0x46/0x74 [ 68.742367][ T3506] kernel_init_freeable+0x38b/0x4dd [ 68.747560][ T3506] kernel_init+0x14/0x190 [ 68.751895][ T3506] ret_from_fork+0x1f/0x30 [ 68.756317][ T3506] page_owner free stack trace missing [ 68.761678][ T3506] [ 68.763999][ T3506] Memory state around the buggy address: [ 68.769616][ T3506] ffff88801aa86b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 68.777674][ T3506] ffff88801aa86b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 68.785769][ T3506] >ffff88801aa86c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 68.793979][ T3506] ^ [ 68.798404][ T3506] ffff88801aa86c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 68.806811][ T3506] ffff88801aa86d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 68.814993][ T3506] ================================================================== [ 68.823055][ T3506] Disabling lock debugging due to kernel taint [ 68.829998][ T3307] Bluetooth: hci0: command 0x0409 tx timeout [ 68.837000][ T3506] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 68.844197][ T3506] CPU: 1 PID: 3506 Comm: kworker/u5:1 Tainted: G B 5.15.110-syzkaller #0 [ 68.853985][ T3506] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 [ 68.864205][ T3506] Workqueue: hci0 hci_rx_work [ 68.868965][ T3506] Call Trace: [ 68.872239][ T3506] [ 68.875177][ T3506] dump_stack_lvl+0x163/0x213 [ 68.879848][ T3506] ? io_uring_drop_tctx_refs+0x15d/0x15d [ 68.885476][ T3506] ? panic+0x584/0x584 [ 68.889570][ T3506] ? preempt_schedule_common+0xa6/0xd0 [ 68.895294][ T3506] ? preempt_schedule+0xd9/0xe0 [ 68.900538][ T3506] ? schedule_preempt_disabled+0x20/0x20 [ 68.906280][ T3506] panic+0x228/0x584 [ 68.910176][ T3506] ? fb_is_primary_device+0xb8/0xb8 [ 68.915624][ T3506] ? _raw_spin_unlock_irqrestore+0x128/0x130 [ 68.921783][ T3506] ? _raw_spin_unlock+0x40/0x40 [ 68.926633][ T3506] check_panic_on_warn+0x54/0x70 [ 68.931617][ T3506] ? hci_le_meta_evt+0x1541/0x3bb0 [ 68.936822][ T3506] end_report+0x6d/0xf0 [ 68.940975][ T3506] kasan_report+0x18e/0x1c0 [ 68.945475][ T3506] ? hci_le_meta_evt+0x1541/0x3bb0 [ 68.950586][ T3506] hci_le_meta_evt+0x1541/0x3bb0 [ 68.955517][ T3506] ? __lock_acquire+0x1ff0/0x1ff0 [ 68.960541][ T3506] ? hci_remote_host_features_evt+0x240/0x240 [ 68.966609][ T3506] ? __mutex_unlock_slowpath+0x218/0x750 [ 68.972236][ T3506] ? hci_event_packet+0x388/0x1390 [ 68.977350][ T3506] ? mutex_unlock+0x10/0x10 [ 68.981847][ T3506] ? mark_lock+0x98/0x340 [ 68.986172][ T3506] ? lockdep_hardirqs_on_prepare+0x438/0x7a0 [ 68.992149][ T3506] hci_event_packet+0x5eb/0x1390 [ 68.997090][ T3506] ? rcu_lock_release+0x20/0x20 [ 69.001940][ T3506] ? hci_send_to_monitor+0x21/0x440 [ 69.007223][ T3506] hci_rx_work+0x1f6/0x6e0 [ 69.011635][ T3506] process_one_work+0x799/0xe10 [ 69.016491][ T3506] ? worker_detach_from_pool+0x240/0x240 [ 69.022306][ T3506] ? _raw_spin_lock_irqsave+0x120/0x120 [ 69.027932][ T3506] worker_thread+0x8f2/0xfb0 [ 69.032514][ T3506] kthread+0x3a8/0x480 [ 69.036681][ T3506] ? rcu_lock_release+0x20/0x20 [ 69.041536][ T3506] ? kthread_blkcg+0xa0/0xa0 [ 69.046127][ T3506] ret_from_fork+0x1f/0x30 [ 69.050544][ T3506] [ 69.053822][ T3506] Kernel Offset: disabled [ 69.058140][ T3506] Rebooting in 86400 seconds..