Warning: Permanently added '10.128.10.40' (ED25519) to the list of known hosts. 2024/06/20 03:36:32 ignoring optional flag "sandboxArg"="0" 2024/06/20 03:36:32 parsed 1 programs 2024/06/20 03:36:32 executed programs: 0 [ 41.325143][ T411] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.332280][ T411] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.339822][ T411] device bridge_slave_0 entered promiscuous mode [ 41.355445][ T414] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.362479][ T414] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.369839][ T414] device bridge_slave_0 entered promiscuous mode [ 41.376255][ T418] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.383325][ T418] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.390682][ T418] device bridge_slave_0 entered promiscuous mode [ 41.397172][ T411] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.404287][ T411] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.411612][ T411] device bridge_slave_1 entered promiscuous mode [ 41.426221][ T414] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.433059][ T414] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.440498][ T414] device bridge_slave_1 entered promiscuous mode [ 41.446863][ T418] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.453735][ T418] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.460993][ T418] device bridge_slave_1 entered promiscuous mode [ 41.509706][ T413] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.516542][ T413] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.524104][ T413] device bridge_slave_0 entered promiscuous mode [ 41.534883][ T413] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.541839][ T413] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.549386][ T413] device bridge_slave_1 entered promiscuous mode [ 41.609722][ T422] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.616561][ T422] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.624098][ T422] device bridge_slave_0 entered promiscuous mode [ 41.653574][ T422] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.660536][ T422] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.667824][ T422] device bridge_slave_1 entered promiscuous mode [ 41.696712][ T419] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.703580][ T419] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.711003][ T419] device bridge_slave_0 entered promiscuous mode [ 41.721545][ T419] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.728599][ T419] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.735972][ T419] device bridge_slave_1 entered promiscuous mode [ 41.913922][ T414] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.920777][ T414] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.927894][ T414] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.934685][ T414] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.974031][ T411] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.980881][ T411] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.987979][ T411] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.994773][ T411] bridge0: port 1(bridge_slave_0) entered forwarding state [ 42.006579][ T418] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.013534][ T418] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.020647][ T418] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.027380][ T418] bridge0: port 1(bridge_slave_0) entered forwarding state [ 42.043408][ T422] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.050254][ T422] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.057350][ T422] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.064154][ T422] bridge0: port 1(bridge_slave_0) entered forwarding state [ 42.098192][ T419] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.105045][ T419] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.112178][ T419] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.119014][ T419] bridge0: port 1(bridge_slave_0) entered forwarding state [ 42.131853][ T413] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.138701][ T413] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.145816][ T413] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.152586][ T413] bridge0: port 1(bridge_slave_0) entered forwarding state [ 42.186029][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 42.194864][ T366] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.202611][ T366] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.210657][ T366] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.217647][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 42.225865][ T366] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.232966][ T366] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.240125][ T366] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.247398][ T366] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.254554][ T366] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.261659][ T366] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.268858][ T366] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.276843][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 42.284312][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 42.312106][ T121] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 42.320805][ T121] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 42.328731][ T121] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 42.336621][ T121] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 42.379534][ T355] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 42.386912][ T355] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 42.394572][ T355] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 42.402219][ T355] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 42.409902][ T355] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 42.418043][ T355] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 42.427002][ T355] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.433839][ T355] bridge0: port 1(bridge_slave_0) entered forwarding state [ 42.441431][ T355] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 42.449643][ T355] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 42.457606][ T355] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.464466][ T355] bridge0: port 1(bridge_slave_0) entered forwarding state [ 42.471742][ T355] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 42.479908][ T355] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 42.487860][ T355] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.494695][ T355] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.508571][ T121] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 42.516780][ T121] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 42.525080][ T121] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.531925][ T121] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.539238][ T121] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 42.546524][ T121] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 42.558694][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 42.566891][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 42.601971][ T355] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 42.610336][ T355] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 42.618324][ T355] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.625164][ T355] bridge0: port 1(bridge_slave_0) entered forwarding state [ 42.633619][ T355] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 42.642201][ T355] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 42.650438][ T355] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.657249][ T355] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.664613][ T355] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 42.672805][ T355] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 42.680772][ T355] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 42.689050][ T355] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 42.697453][ T355] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 42.722672][ T121] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 42.741459][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 42.749376][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 42.757085][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 42.765364][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 42.772859][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 42.781282][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 42.789533][ T124] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.796358][ T124] bridge0: port 1(bridge_slave_0) entered forwarding state [ 42.803750][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 42.811967][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 42.820079][ T124] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.826896][ T124] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.850654][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 42.858352][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 42.867157][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 42.875795][ T124] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.882734][ T124] bridge0: port 1(bridge_slave_0) entered forwarding state [ 42.890243][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 42.898421][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 42.906674][ T124] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.913523][ T124] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.921120][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 42.929366][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 42.937616][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 42.946032][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 42.954207][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 42.962407][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 42.993047][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 43.001644][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 43.011113][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 43.019086][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 43.041306][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 43.049545][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 43.061611][ T121] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 43.089743][ T355] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 43.097943][ T355] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 43.106587][ T355] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 43.114836][ T355] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 43.123826][ T355] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 43.132221][ T355] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 43.142412][ T355] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 43.150644][ T355] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 43.171901][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 43.180299][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 43.188491][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 43.197018][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 43.205091][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 43.213526][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 43.241566][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 43.250328][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 43.258223][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 43.310289][ T23] kauditd_printk_skb: 15 callbacks suppressed [ 43.310301][ T23] audit: type=1400 audit(1718854594.790:91): avc: denied { read write } for pid=445 comm="syz-executor.3" name="fuse" dev="devtmpfs" ino=9185 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 43.345359][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 43.351468][ T23] audit: type=1400 audit(1718854594.810:92): avc: denied { open } for pid=448 comm="syz-executor.1" path="/dev/fuse" dev="devtmpfs" ino=9185 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 43.354696][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 43.377385][ T23] audit: type=1400 audit(1718854594.810:93): avc: denied { mounton } for pid=448 comm="syz-executor.1" path="/root/syzkaller-testdir2333626805/syzkaller.bnf505/0/file0" dev="sda1" ino=1953 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 43.412247][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 43.420593][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 43.428703][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 43.453017][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 43.461611][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 43.469730][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 43.477772][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 43.486232][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 43.494669][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 43.502904][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 43.510625][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 43.524798][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 43.533781][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 43.542489][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 43.551180][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 43.562341][ T23] audit: type=1400 audit(1718854595.040:94): avc: denied { mounton } for pid=411 comm="syz-executor.5" path="/dev/binderfs" dev="devtmpfs" ino=10172 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 43.585305][ T456] ================================================================== [ 43.593183][ T456] BUG: KASAN: use-after-free in fuse_copy_one+0x1c0/0x3a0 [ 43.600107][ T456] Read of size 256 at addr ffff8881da296810 by task syz-executor.3/456 [ 43.608170][ T456] [ 43.610352][ T456] CPU: 0 PID: 456 Comm: syz-executor.3 Not tainted 5.4.274-syzkaller-04911-g6f97bd951d82 #0 [ 43.620237][ T456] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 [ 43.630129][ T456] Call Trace: [ 43.633265][ T456] dump_stack+0x1d8/0x241 [ 43.637446][ T456] ? nf_ct_l4proto_log_invalid+0x258/0x258 [ 43.643072][ T456] ? printk+0xd1/0x111 [ 43.646981][ T456] ? fuse_copy_one+0x1c0/0x3a0 [ 43.651575][ T456] ? wake_up_klogd+0xb2/0xf0 [ 43.656005][ T456] ? fuse_copy_one+0x1c0/0x3a0 [ 43.660612][ T456] print_address_description+0x8c/0x600 [ 43.665985][ T456] ? panic+0x89d/0x89d [ 43.669888][ T456] ? _raw_spin_lock+0xa4/0x1b0 [ 43.674493][ T456] ? fuse_copy_one+0x1c0/0x3a0 [ 43.679089][ T456] __kasan_report+0xf3/0x120 [ 43.683517][ T456] ? fuse_copy_one+0x1c0/0x3a0 [ 43.688118][ T456] ? fuse_copy_one+0x1c0/0x3a0 [ 43.692712][ T456] kasan_report+0x30/0x60 [ 43.696881][ T456] check_memory_region+0x272/0x280 [ 43.701828][ T456] memcpy+0x25/0x50 [ 43.705473][ T456] fuse_copy_one+0x1c0/0x3a0 [ 43.709900][ T456] fuse_copy_args+0x339/0x410 [ 43.714413][ T456] fuse_dev_do_read+0xc1b/0x1190 [ 43.719189][ T456] ? queue_interrupt+0x310/0x310 [ 43.724049][ T456] fuse_dev_read+0x179/0x220 [ 43.728476][ T456] ? fuse_dev_release+0x5c0/0x5c0 [ 43.733336][ T456] ? do_futex+0x13c1/0x19f0 [ 43.737675][ T456] ? __lru_cache_add+0x206/0x2b0 [ 43.742452][ T456] ? iov_iter_init+0x82/0x160 [ 43.746961][ T456] __vfs_read+0x5cd/0x730 [ 43.751130][ T456] ? rw_verify_area+0x360/0x360 [ 43.755811][ T456] ? __fsnotify_update_child_dentry_flags+0x290/0x290 [ 43.762415][ T456] ? security_file_permission+0x1dc/0x2f0 [ 43.767968][ T456] vfs_read+0x148/0x360 [ 43.771968][ T456] ksys_read+0x199/0x2c0 [ 43.776035][ T456] ? vfs_write+0x4e0/0x4e0 [ 43.780437][ T456] ? __do_page_fault+0x725/0xbb0 [ 43.785215][ T456] do_syscall_64+0xca/0x1c0 [ 43.789551][ T456] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 43.795297][ T456] RIP: 0033:0x7f0233bf4db9 [ 43.799531][ T456] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 43.818963][ T456] RSP: 002b:00007f02337150c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 43.827214][ T456] RAX: ffffffffffffffda RBX: 00007f0233d151f0 RCX: 00007f0233bf4db9 [ 43.835016][ T456] RDX: 0000000000002020 RSI: 0000000020002140 RDI: 0000000000000003 [ 43.842831][ T456] RBP: 00007f0233c51ad0 R08: 0000000000000000 R09: 0000000000000000 [ 43.850644][ T456] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 43.858453][ T456] R13: 000000000000006e R14: 00007f0233d151f0 R15: 00007ffe28d1fb88 [ 43.866271][ T456] [ 43.868429][ T456] Allocated by task 446: [ 43.872524][ T456] __kasan_kmalloc+0x171/0x210 [ 43.877111][ T456] __d_alloc+0xae/0x6a0 [ 43.881109][ T456] d_alloc_parallel+0xec/0x1390 [ 43.885792][ T456] __lookup_slow+0x156/0x460 [ 43.890220][ T456] lookup_slow+0x53/0x70 [ 43.894300][ T456] walk_component+0x2dc/0x590 [ 43.898813][ T456] path_lookupat+0x182/0x3f0 [ 43.903238][ T456] filename_lookup+0x253/0x6e0 [ 43.907840][ T456] do_mount+0x135/0xe10 [ 43.911828][ T456] ksys_mount+0xc2/0xf0 [ 43.915820][ T456] __x64_sys_mount+0xb1/0xc0 [ 43.920246][ T456] do_syscall_64+0xca/0x1c0 [ 43.924588][ T456] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 43.930314][ T456] [ 43.932480][ T456] Freed by task 23: [ 43.936133][ T456] __kasan_slab_free+0x1b5/0x270 [ 43.940903][ T456] kfree+0x123/0x370 [ 43.944637][ T456] rcu_do_batch+0x451/0xa00 [ 43.948976][ T456] rcu_core+0x4c8/0xcb0 [ 43.952967][ T456] __do_softirq+0x23b/0x6b7 [ 43.957300][ T456] [ 43.959476][ T456] The buggy address belongs to the object at ffff8881da296800 [ 43.959476][ T456] which belongs to the cache kmalloc-rcl-512 of size 512 [ 43.973719][ T456] The buggy address is located 16 bytes inside of [ 43.973719][ T456] 512-byte region [ffff8881da296800, ffff8881da296a00) [ 43.986728][ T456] The buggy address belongs to the page: [ 43.992310][ T456] page:ffffea000768a500 refcount:1 mapcount:0 mapping:ffff8881f5c0db80 index:0x0 compound_mapcount: 0 [ 44.003047][ T456] flags: 0x8000000000010200(slab|head) [ 44.008359][ T456] raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881f5c0db80 [ 44.016853][ T456] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 44.025266][ T456] page dumped because: kasan: bad access detected [ 44.031516][ T456] page_owner tracks the page as allocated [ 44.037071][ T456] page last allocated via order 2, migratetype Reclaimable, gfp_mask 0x1d20d0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE) [ 44.055042][ T456] prep_new_page+0x18f/0x370 [ 44.059463][ T456] get_page_from_freelist+0x2d13/0x2d90 [ 44.064843][ T456] __alloc_pages_nodemask+0x393/0x840 [ 44.070052][ T456] alloc_slab_page+0x39/0x3c0 [ 44.074564][ T456] new_slab+0x97/0x440 [ 44.078470][ T456] ___slab_alloc+0x2fe/0x490 [ 44.082898][ T456] __slab_alloc+0x62/0xa0 [ 44.087059][ T456] __kmalloc+0x19b/0x2e0 [ 44.091139][ T456] __d_alloc+0xae/0x6a0 [ 44.095133][ T456] d_alloc_parallel+0xec/0x1390 [ 44.099819][ T456] __lookup_slow+0x156/0x460 [ 44.104245][ T456] lookup_slow+0x53/0x70 [ 44.108325][ T456] walk_component+0x2dc/0x590 [ 44.112837][ T456] path_lookupat+0x182/0x3f0 [ 44.117264][ T456] filename_lookup+0x253/0x6e0 [ 44.121866][ T456] do_mount+0x135/0xe10 [ 44.125857][ T456] page_owner free stack trace missing [ 44.131060][ T456] [ 44.133227][ T456] Memory state around the buggy address: [ 44.138704][ T456] ffff8881da296700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.146603][ T456] ffff8881da296780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.154499][ T456] >ffff8881da296800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 44.162392][ T456] ^ [ 44.166563][ T23] audit: type=1400 audit(1718854595.070:95): avc: denied { unmount } for pid=418 comm="syz-executor.1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 44.166827][ T456] ffff8881da296880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 44.194432][ T456] ffff8881da296900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 44.202317][ T456] ================================================================== [ 44.210216][ T456] Disabling lock debugging due to kernel taint [ 44.307638][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 44.316044][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 44.330115][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 44.338141][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 44.352250][ T365] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 44.360486][ T365] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2024/06/20 03:36:37 executed programs: 19 2024/06/20 03:36:42 executed programs: 55