DUID 00:04:f8:bf:f0:9c:61:e1:97:95:98:d7:6e:33:ae:fb:a4:bd
forked to background, child pid 3181
[ 41.095278][ T3182] 8021q: adding VLAN 0 to HW filter on device bond0
[ 41.109085][ T3182] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.0.42' (ECDSA) to the list of known hosts.
syzkaller login: [ 56.819067][ T3595] cgroup: Unknown subsys name 'net'
[ 56.963805][ T3595] cgroup: Unknown subsys name 'rlimit'
executing program
[ 57.133608][ T3598] ==================================================================
[ 57.141695][ T3598] BUG: KASAN: use-after-free in __lock_acquire+0x3d86/0x54a0
[ 57.149071][ T3598] Read of size 8 at addr ffff888015be3740 by task syz-executor161/3598
[ 57.157551][ T3598]
[ 57.159868][ T3598] CPU: 1 PID: 3598 Comm: syz-executor161 Not tainted 5.16.0-rc4-syzkaller #0
[ 57.168626][ T3598] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 57.178669][ T3598] Call Trace:
[ 57.181940][ T3598]
[ 57.184858][ T3598] dump_stack_lvl+0xcd/0x134
[ 57.189454][ T3598] print_address_description.constprop.0.cold+0x8d/0x320
[ 57.196473][ T3598] ? __lock_acquire+0x3d86/0x54a0
[ 57.201490][ T3598] ? __lock_acquire+0x3d86/0x54a0
[ 57.206516][ T3598] kasan_report.cold+0x83/0xdf
[ 57.211297][ T3598] ? __lock_acquire+0x3d86/0x54a0
[ 57.216314][ T3598] __lock_acquire+0x3d86/0x54a0
[ 57.221165][ T3598] ? __lock_acquire+0xbc2/0x54a0
[ 57.226097][ T3598] ? lockdep_hardirqs_on_prepare+0x400/0x400
[ 57.232073][ T3598] lock_acquire+0x1ab/0x510
[ 57.236570][ T3598] ? remove_wait_queue+0x1d/0x180
[ 57.241586][ T3598] ? lock_release+0x720/0x720
[ 57.246250][ T3598] ? lock_release+0x720/0x720
[ 57.250912][ T3598] ? _raw_spin_lock_irqsave+0x4e/0x50
[ 57.256281][ T3598] _raw_spin_lock_irqsave+0x39/0x50
[ 57.261463][ T3598] ? remove_wait_queue+0x1d/0x180
[ 57.266474][ T3598] remove_wait_queue+0x1d/0x180
[ 57.271320][ T3598] ep_remove_wait_queue+0x88/0x1a0
[ 57.276425][ T3598] ep_remove+0x106/0x9c0
[ 57.280652][ T3598] eventpoll_release_file+0xe1/0x130
[ 57.285977][ T3598] __fput+0x87b/0x9f0
[ 57.289944][ T3598] task_work_run+0xdd/0x1a0
[ 57.294429][ T3598] exit_to_user_mode_prepare+0x27e/0x290
[ 57.300052][ T3598] syscall_exit_to_user_mode+0x19/0x60
[ 57.305494][ T3598] do_syscall_64+0x42/0xb0
[ 57.309899][ T3598] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 57.315780][ T3598] RIP: 0033:0x7f3167c0def3
[ 57.320182][ T3598] Code: c7 c2 c0 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb ba 0f 1f 00 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8
[ 57.339786][ T3598] RSP: 002b:00007ffddef2e488 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
[ 57.348180][ T3598] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007f3167c0def3
[ 57.356220][ T3598] RDX: 000000000000002f RSI: 0000000020001340 RDI: 0000000000000004
[ 57.364173][ T3598] RBP: 0000000000000000 R08: 0000000000000014 R09: 00007ffddef2e4b0
[ 57.372128][ T3598] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffddef2e4ac
[ 57.380080][ T3598] R13: 00007ffddef2e4c0 R14: 00007ffddef2e500 R15: 0000000000000000
[ 57.388039][ T3598]
[ 57.391048][ T3598]
[ 57.393351][ T3598] Allocated by task 3598:
[ 57.397650][ T3598] kasan_save_stack+0x1e/0x50
[ 57.402327][ T3598] __kasan_kmalloc+0xa9/0xd0
[ 57.406904][ T3598] psi_trigger_create.part.0+0x15e/0x7f0
[ 57.412521][ T3598] cgroup_pressure_write+0x15d/0x6b0
[ 57.417786][ T3598] cgroup_file_write+0x1ec/0x780
[ 57.422703][ T3598] kernfs_fop_write_iter+0x342/0x500
[ 57.427970][ T3598] new_sync_write+0x429/0x660
[ 57.432733][ T3598] vfs_write+0x7cd/0xae0
[ 57.436958][ T3598] ksys_write+0x12d/0x250
[ 57.441274][ T3598] do_syscall_64+0x35/0xb0
[ 57.445696][ T3598] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 57.451568][ T3598]
[ 57.453871][ T3598] Freed by task 3598:
[ 57.457824][ T3598] kasan_save_stack+0x1e/0x50
[ 57.462574][ T3598] kasan_set_track+0x21/0x30
[ 57.467146][ T3598] kasan_set_free_info+0x20/0x30
[ 57.472062][ T3598] __kasan_slab_free+0xff/0x130
[ 57.477067][ T3598] slab_free_freelist_hook+0x8b/0x1c0
[ 57.482509][ T3598] kfree+0xf6/0x560
[ 57.486303][ T3598] cgroup_pressure_write+0x18d/0x6b0
[ 57.491571][ T3598] cgroup_file_write+0x1ec/0x780
[ 57.496488][ T3598] kernfs_fop_write_iter+0x342/0x500
[ 57.501755][ T3598] new_sync_write+0x429/0x660
[ 57.506418][ T3598] vfs_write+0x7cd/0xae0
[ 57.510645][ T3598] ksys_write+0x12d/0x250
[ 57.514955][ T3598] do_syscall_64+0x35/0xb0
[ 57.519350][ T3598] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 57.525221][ T3598]
[ 57.527522][ T3598] The buggy address belongs to the object at ffff888015be3700
[ 57.527522][ T3598] which belongs to the cache kmalloc-192 of size 192
[ 57.541560][ T3598] The buggy address is located 64 bytes inside of
[ 57.541560][ T3598] 192-byte region [ffff888015be3700, ffff888015be37c0)
[ 57.554905][ T3598] The buggy address belongs to the page:
[ 57.560515][ T3598] page:ffffea000056f8c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x15be3
[ 57.570647][ T3598] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 57.578183][ T3598] raw: 00fff00000000200 0000000000000000 dead000000000001 ffff888010c41a00
[ 57.586756][ T3598] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[ 57.595318][ T3598] page dumped because: kasan: bad access detected
[ 57.601730][ T3598] page_owner tracks the page as allocated
[ 57.607419][ T3598] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 1983850449, free_ts 0
[ 57.622264][ T3598] get_page_from_freelist+0xa72/0x2f50
[ 57.627711][ T3598] __alloc_pages+0x1b2/0x500
[ 57.632281][ T3598] alloc_page_interleave+0x1e/0x200
[ 57.637466][ T3598] alloc_pages+0x29f/0x300
[ 57.641864][ T3598] new_slab+0x32d/0x4a0
[ 57.646001][ T3598] ___slab_alloc+0x918/0xfe0
[ 57.650746][ T3598] __slab_alloc.constprop.0+0x4d/0xa0
[ 57.656101][ T3598] kmem_cache_alloc_trace+0x289/0x2c0
[ 57.661457][ T3598] call_usermodehelper_setup+0x97/0x340
[ 57.666984][ T3598] kobject_uevent_env+0xf73/0x1650
[ 57.672081][ T3598] param_sysfs_init+0x146/0x43b
[ 57.676936][ T3598] do_one_initcall+0x103/0x650
[ 57.681682][ T3598] kernel_init_freeable+0x6b1/0x73a
[ 57.687033][ T3598] kernel_init+0x1a/0x1d0
[ 57.691349][ T3598] ret_from_fork+0x1f/0x30
[ 57.695755][ T3598] page_owner free stack trace missing
[ 57.701105][ T3598]
[ 57.703536][ T3598] Memory state around the buggy address:
[ 57.709152][ T3598] ffff888015be3600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 57.717188][ T3598] ffff888015be3680: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
[ 57.725225][ T3598] >ffff888015be3700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 57.733271][ T3598] ^
[ 57.739596][ T3598] ffff888015be3780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 57.747651][ T3598] ffff888015be3800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 57.755707][ T3598] ==================================================================
[ 57.763749][ T3598] Disabling lock debugging due to kernel taint
[ 57.769881][ T3598] Kernel panic - not syncing: panic_on_warn set ...
[ 57.776442][ T3598] CPU: 1 PID: 3598 Comm: syz-executor161 Tainted: G B 5.16.0-rc4-syzkaller #0
[ 57.786577][ T3598] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 57.796628][ T3598] Call Trace:
[ 57.799894][ T3598]
[ 57.802812][ T3598] dump_stack_lvl+0xcd/0x134
[ 57.807389][ T3598] panic+0x2b0/0x6dd
[ 57.811268][ T3598] ? __warn_printk+0xf3/0xf3
[ 57.815840][ T3598] ? __lock_acquire+0x3d86/0x54a0
[ 57.820849][ T3598] ? __lock_acquire+0x3d86/0x54a0
[ 57.825860][ T3598] ? __lock_acquire+0x3d86/0x54a0
[ 57.830870][ T3598] end_report.cold+0x63/0x6f
[ 57.835801][ T3598] kasan_report.cold+0x71/0xdf
[ 57.840544][ T3598] ? __lock_acquire+0x3d86/0x54a0
[ 57.845556][ T3598] __lock_acquire+0x3d86/0x54a0
[ 57.850391][ T3598] ? __lock_acquire+0xbc2/0x54a0
[ 57.855318][ T3598] ? lockdep_hardirqs_on_prepare+0x400/0x400
[ 57.861288][ T3598] lock_acquire+0x1ab/0x510
[ 57.865781][ T3598] ? remove_wait_queue+0x1d/0x180
[ 57.870786][ T3598] ? lock_release+0x720/0x720
[ 57.875455][ T3598] ? lock_release+0x720/0x720
[ 57.880122][ T3598] ? _raw_spin_lock_irqsave+0x4e/0x50
[ 57.885476][ T3598] _raw_spin_lock_irqsave+0x39/0x50
[ 57.890659][ T3598] ? remove_wait_queue+0x1d/0x180
[ 57.895664][ T3598] remove_wait_queue+0x1d/0x180
[ 57.900598][ T3598] ep_remove_wait_queue+0x88/0x1a0
[ 57.905714][ T3598] ep_remove+0x106/0x9c0
[ 57.909938][ T3598] eventpoll_release_file+0xe1/0x130
[ 57.915205][ T3598] __fput+0x87b/0x9f0
[ 57.919174][ T3598] task_work_run+0xdd/0x1a0
[ 57.923678][ T3598] exit_to_user_mode_prepare+0x27e/0x290
[ 57.929297][ T3598] syscall_exit_to_user_mode+0x19/0x60
[ 57.934744][ T3598] do_syscall_64+0x42/0xb0
[ 57.939142][ T3598] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 57.945019][ T3598] RIP: 0033:0x7f3167c0def3
[ 57.949421][ T3598] Code: c7 c2 c0 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb ba 0f 1f 00 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8
[ 57.969092][ T3598] RSP: 002b:00007ffddef2e488 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
[ 57.977587][ T3598] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007f3167c0def3
[ 57.985548][ T3598] RDX: 000000000000002f RSI: 0000000020001340 RDI: 0000000000000004
[ 57.993502][ T3598] RBP: 0000000000000000 R08: 0000000000000014 R09: 00007ffddef2e4b0
[ 58.001457][ T3598] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffddef2e4ac
[ 58.009427][ T3598] R13: 00007ffddef2e4c0 R14: 00007ffddef2e500 R15: 0000000000000000
[ 58.017385][ T3598]
[ 58.020633][ T3598] Kernel Offset: disabled
[ 58.024999][ T3598] Rebooting in 86400 seconds..