Warning: Permanently added '10.128.0.208' (ED25519) to the list of known hosts. 2024/08/16 21:10:24 ignoring optional flag "sandboxArg"="0" 2024/08/16 21:10:24 parsed 1 programs 2024/08/16 21:10:26 executed programs: 0 [ 60.971758][ T2263] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 63.160082][ T2279] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 63.179542][ T2279] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 63.194780][ T2279] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 63.204765][ T2278] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 63.218383][ T2279] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 63.227961][ T2278] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 63.275486][ T2278] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 63.286211][ T2281] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 63.303426][ T2278] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 63.364801][ T2281] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 63.393982][ T2281] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 63.452700][ T2281] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 63.705918][ T2282] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 63.716142][ T2275] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 63.742622][ T2282] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 63.755471][ T2275] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 63.782819][ T2275] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 63.794466][ T2282] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 63.822756][ T2282] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 63.852305][ T2275] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 63.916533][ T1600] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 63.924725][ T1600] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 63.936356][ T1130] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 63.944550][ T1130] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 63.992062][ T1130] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.000086][ T1130] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.027096][ T1112] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.035139][ T1112] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.055333][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.063277][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.066182][ T1130] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.078585][ T1130] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.328255][ T1600] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.336271][ T1600] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.366228][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.374314][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.481828][ T2506] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'. [ 64.518869][ T2506] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'. [ 64.546735][ T2506] Zero length message leads to an empty skb [ 64.558927][ T2507] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. [ 64.592083][ T2510] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. [ 64.638047][ T2507] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. [ 64.651934][ T1600] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.660057][ T1600] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.670323][ T2510] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. [ 64.696569][ T2518] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'. [ 64.732126][ T2525] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.2'. [ 64.756525][ T2525] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.2'. [ 64.767709][ T2524] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. [ 64.795005][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.802938][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2024/08/16 21:10:31 executed programs: 88 [ 69.484917][ T3352] __nla_validate_parse: 724 callbacks suppressed [ 69.484934][ T3352] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. [ 69.513778][ T3351] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. [ 69.532123][ T3354] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.2'. [ 69.544218][ T3350] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 69.557851][ T3355] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'. [ 69.568542][ T3352] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. [ 69.579186][ T3351] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. [ 69.589433][ T3354] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.2'. [ 69.600114][ T3350] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 69.625829][ T3355] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'. [ 69.740477][ T3373] ================================================================== [ 69.748932][ T3373] BUG: KASAN: slab-use-after-free in taprio_dump+0x79c/0xc30 [ 69.756338][ T3373] Read of size 4 at addr ffff88811dd6e0c0 by task syz-executor.1/3373 [ 69.764498][ T3373] [ 69.766847][ T3373] CPU: 0 UID: 0 PID: 3373 Comm: syz-executor.1 Not tainted 6.11.0-rc3-syzkaller #0 [ 69.776147][ T3373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 69.786309][ T3373] Call Trace: [ 69.789602][ T3373] [ 69.792541][ T3373] dump_stack_lvl+0x231/0x330 [ 69.797323][ T3373] ? __pfx_dump_stack_lvl+0x10/0x10 [ 69.802549][ T3373] ? __pfx__printk+0x10/0x10 [ 69.807161][ T3373] ? lock_acquire+0xc2/0x3a0 [ 69.811767][ T3373] ? __pfx_lock_acquire+0x10/0x10 [ 69.816821][ T3373] ? _printk+0xd5/0x120 [ 69.821096][ T3373] ? __virt_addr_valid+0x169/0x380 [ 69.826239][ T3373] print_report+0x169/0x550 [ 69.830779][ T3373] ? __virt_addr_valid+0x169/0x380 [ 69.836001][ T3373] ? __virt_addr_valid+0x2c1/0x380 [ 69.841148][ T3373] ? __phys_addr+0x90/0x130 [ 69.845675][ T3373] ? taprio_dump+0x79c/0xc30 [ 69.850283][ T3373] kasan_report+0x143/0x180 [ 69.855067][ T3373] ? mqprio_qopt_reconstruct+0x74/0x4b0 [ 69.860640][ T3373] ? taprio_dump+0x79c/0xc30 [ 69.865354][ T3373] taprio_dump+0x79c/0xc30 [ 69.869787][ T3373] ? __alloc_skb+0x1f3/0x440 [ 69.874404][ T3373] ? qdisc_notify+0x11b/0x4b0 [ 69.879117][ T3373] ? __pfx_taprio_dump+0x10/0x10 [ 69.884084][ T3373] ? __asan_memcpy+0x40/0x70 [ 69.888703][ T3373] ? nla_put+0x131/0x1e0 [ 69.892960][ T3373] tc_fill_qdisc+0x677/0x1120 [ 69.897681][ T3373] ? __kmalloc_node_track_caller_noprof+0x21f/0x460 [ 69.904295][ T3373] ? __pfx_tc_fill_qdisc+0x10/0x10 [ 69.909429][ T3373] ? __build_skb_around+0x22d/0x380 [ 69.914653][ T3373] ? __pfx___alloc_skb+0x10/0x10 [ 69.919619][ T3373] qdisc_notify+0x2ec/0x4b0 [ 69.924153][ T3373] tc_modify_qdisc+0x1852/0x1a40 [ 69.929126][ T3373] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 69.935312][ T3373] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 69.940620][ T3373] ? security_capable+0x90/0xb0 [ 69.945574][ T3373] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 69.950887][ T3373] rtnetlink_rcv_msg+0x9ef/0xbb0 [ 69.955853][ T3373] ? __lock_acquire+0x61d/0xc60 [ 69.960726][ T3373] ? rtnetlink_rcv_msg+0x1aa/0xbb0 [ 69.965955][ T3373] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 69.971442][ T3373] ? __netlink_lookup+0xb3/0x4e0 [ 69.976407][ T3373] ? __pfx_lock_release+0x10/0x10 [ 69.981540][ T3373] netlink_rcv_skb+0x1e3/0x430 [ 69.986327][ T3373] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 69.991822][ T3373] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 69.997303][ T3373] ? netlink_deliver_tap+0x30/0x120 [ 70.002615][ T3373] netlink_unicast+0x7c6/0x960 [ 70.007447][ T3373] ? __pfx_netlink_unicast+0x10/0x10 [ 70.012856][ T3373] ? __check_object_size+0x47c/0x8c0 [ 70.018164][ T3373] netlink_sendmsg+0x88e/0xc40 [ 70.022954][ T3373] ? __pfx_netlink_sendmsg+0x10/0x10 [ 70.028441][ T3373] ? cgroup_rstat_updated+0x114/0x980 [ 70.033836][ T3373] ? security_socket_sendmsg+0x87/0xb0 [ 70.039325][ T3373] ? __pfx_netlink_sendmsg+0x10/0x10 [ 70.044644][ T3373] __sock_sendmsg+0x221/0x270 [ 70.049344][ T3373] ____sys_sendmsg+0x525/0x7d0 [ 70.054135][ T3373] ? try_to_wake_up+0x80f/0x1500 [ 70.059093][ T3373] ? __pfx_____sys_sendmsg+0x10/0x10 [ 70.064451][ T3373] ___sys_sendmsg+0x27a/0x310 [ 70.069251][ T3373] ? __pfx____sys_sendmsg+0x10/0x10 [ 70.074522][ T3373] ? __fget_files+0x33/0x350 [ 70.079224][ T3373] __sys_sendmmsg+0x2a9/0x500 [ 70.084016][ T3373] ? __pfx___sys_sendmmsg+0x10/0x10 [ 70.089366][ T3373] ? __rseq_handle_notify_resume+0x2fe/0x1250 [ 70.095551][ T3373] __x64_sys_sendmmsg+0xa0/0xb0 [ 70.100429][ T3373] do_syscall_64+0x8d/0x190 [ 70.104959][ T3373] ? clear_bhb_loop+0x35/0x90 [ 70.109747][ T3373] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.115669][ T3373] RIP: 0033:0x7f657a61dda9 [ 70.120199][ T3373] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 70.139907][ T3373] RSP: 002b:00007f657a19f0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 70.148377][ T3373] RAX: ffffffffffffffda RBX: 00007f657a74bf80 RCX: 00007f657a61dda9 [ 70.156376][ T3373] RDX: 0492492492492856 RSI: 0000000020000140 RDI: 0000000000000003 [ 70.164581][ T3373] RBP: 00007f657a66a47a R08: 0000000000000000 R09: 0000000000000000 [ 70.172825][ T3373] R10: 0000000000001400 R11: 0000000000000246 R12: 0000000000000000 [ 70.180812][ T3373] R13: 0000000000000006 R14: 00007f657a74bf80 R15: 00007f657a86fa48 [ 70.188803][ T3373] [ 70.192221][ T3373] [ 70.194558][ T3373] Allocated by task 3362: [ 70.198989][ T3373] kasan_save_track+0x3f/0x80 [ 70.203764][ T3373] __kasan_kmalloc+0x98/0xb0 [ 70.208476][ T3373] __kmalloc_cache_noprof+0x19e/0x360 [ 70.213864][ T3373] taprio_change+0xf31/0x3df0 [ 70.218644][ T3373] tc_modify_qdisc+0x16b2/0x1a40 [ 70.223869][ T3373] rtnetlink_rcv_msg+0x9ef/0xbb0 [ 70.229371][ T3373] netlink_rcv_skb+0x1e3/0x430 [ 70.234427][ T3373] netlink_unicast+0x7c6/0x960 [ 70.239222][ T3373] netlink_sendmsg+0x88e/0xc40 [ 70.244301][ T3373] __sock_sendmsg+0x221/0x270 [ 70.248998][ T3373] ____sys_sendmsg+0x525/0x7d0 [ 70.253794][ T3373] ___sys_sendmsg+0x27a/0x310 [ 70.258496][ T3373] __sys_sendmmsg+0x2a9/0x500 [ 70.263817][ T3373] __x64_sys_sendmmsg+0xa0/0xb0 [ 70.269157][ T3373] do_syscall_64+0x8d/0x190 [ 70.273767][ T3373] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.279768][ T3373] [ 70.282102][ T3373] Freed by task 15: [ 70.285983][ T3373] kasan_save_track+0x3f/0x80 [ 70.290682][ T3373] kasan_save_free_info+0x40/0x50 [ 70.295820][ T3373] poison_slab_object+0xe0/0x150 [ 70.300775][ T3373] __kasan_slab_free+0x37/0x60 [ 70.305904][ T3373] kfree+0x12f/0x310 [ 70.309998][ T3373] rcu_core+0xc3c/0x1470 [ 70.314342][ T3373] handle_softirqs+0x1b7/0x570 [ 70.319204][ T3373] run_ksoftirqd+0x28/0x40 [ 70.323812][ T3373] smpboot_thread_fn+0x460/0x8e0 [ 70.328859][ T3373] kthread+0x290/0x300 [ 70.333036][ T3373] ret_from_fork+0x4b/0x80 [ 70.337506][ T3373] ret_from_fork_asm+0x1a/0x30 [ 70.342474][ T3373] [ 70.344810][ T3373] Last potentially related work creation: [ 70.350618][ T3373] kasan_save_stack+0x3f/0x60 [ 70.355345][ T3373] __kasan_record_aux_stack+0xac/0xc0 [ 70.360768][ T3373] call_rcu+0x159/0x8e0 [ 70.364939][ T3373] taprio_change+0x229f/0x3df0 [ 70.369734][ T3373] tc_modify_qdisc+0x16b2/0x1a40 [ 70.374690][ T3373] rtnetlink_rcv_msg+0x9ef/0xbb0 [ 70.379663][ T3373] netlink_rcv_skb+0x1e3/0x430 [ 70.384804][ T3373] netlink_unicast+0x7c6/0x960 [ 70.389772][ T3373] netlink_sendmsg+0x88e/0xc40 [ 70.394651][ T3373] __sock_sendmsg+0x221/0x270 [ 70.399345][ T3373] ____sys_sendmsg+0x525/0x7d0 [ 70.404139][ T3373] ___sys_sendmsg+0x27a/0x310 [ 70.408865][ T3373] __sys_sendmmsg+0x2a9/0x500 [ 70.413580][ T3373] __x64_sys_sendmmsg+0xa0/0xb0 [ 70.418575][ T3373] do_syscall_64+0x8d/0x190 [ 70.423191][ T3373] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.429104][ T3373] [ 70.431615][ T3373] The buggy address belongs to the object at ffff88811dd6e000 [ 70.431615][ T3373] which belongs to the cache kmalloc-512 of size 512 [ 70.445767][ T3373] The buggy address is located 192 bytes inside of [ 70.445767][ T3373] freed 512-byte region [ffff88811dd6e000, ffff88811dd6e200) [ 70.459576][ T3373] [ 70.461909][ T3373] The buggy address belongs to the physical page: [ 70.468336][ T3373] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11dd6c [ 70.477216][ T3373] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 70.485736][ T3373] anon flags: 0x200000000000040(head|node=0|zone=2) [ 70.492342][ T3373] page_type: 0xfdffffff(slab) [ 70.497039][ T3373] raw: 0200000000000040 ffff888100041c80 0000000000000000 dead000000000001 [ 70.505636][ T3373] raw: 0000000000000000 0000000000100010 00000001fdffffff 0000000000000000 [ 70.514240][ T3373] head: 0200000000000040 ffff888100041c80 0000000000000000 dead000000000001 [ 70.522923][ T3373] head: 0000000000000000 0000000000100010 00000001fdffffff 0000000000000000 [ 70.531704][ T3373] head: 0200000000000002 ffffea0004775b01 ffffffffffffffff 0000000000000000 [ 70.540472][ T3373] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000 [ 70.549408][ T3373] page dumped because: kasan: bad access detected [ 70.555842][ T3373] page_owner tracks the page as allocated [ 70.561633][ T3373] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 34, tgid 34 (kworker/u8:2), ts 39000463209, free_ts 38876239330 [ 70.582660][ T3373] post_alloc_hook+0x10f/0x130 [ 70.587446][ T3373] get_page_from_freelist+0x37f4/0x3920 [ 70.593176][ T3373] __alloc_pages_noprof+0x256/0x670 [ 70.598753][ T3373] alloc_slab_page+0x5f/0x120 [ 70.603901][ T3373] allocate_slab+0x5d/0x290 [ 70.608525][ T3373] ___slab_alloc+0xa7f/0x11d0 [ 70.613581][ T3373] __kmalloc_noprof+0x25a/0x440 [ 70.618551][ T3373] ieee80211_new_chanctx+0x113/0x490 [ 70.624554][ T3373] _ieee80211_link_use_channel+0xc9c/0x1540 [ 70.630815][ T3373] __ieee80211_sta_join_ibss+0x734/0x16f0 [ 70.636652][ T3373] ieee80211_sta_create_ibss+0x395/0x630 [ 70.642311][ T3373] ieee80211_ibss_work+0xceb/0x1380 [ 70.647525][ T3373] cfg80211_wiphy_work+0x331/0x580 [ 70.652676][ T3373] process_scheduled_works+0x9a7/0x15f0 [ 70.658252][ T3373] worker_thread+0xa60/0xf30 [ 70.662864][ T3373] kthread+0x290/0x300 [ 70.666949][ T3373] page last free pid 1977 tgid 1977 stack trace: [ 70.673281][ T3373] free_unref_page+0xbc0/0xd00 [ 70.678152][ T3373] __put_partials+0x18e/0x1d0 [ 70.682939][ T3373] put_cpu_partial+0x151/0x1b0 [ 70.687725][ T3373] __slab_free+0x2b8/0x3a0 [ 70.692250][ T3373] qlist_free_all+0x9e/0x140 [ 70.696871][ T3373] kasan_quarantine_reduce+0x14f/0x170 [ 70.702344][ T3373] __kasan_slab_alloc+0x23/0x80 [ 70.707220][ T3373] kmem_cache_alloc_noprof+0x12b/0x350 [ 70.712712][ T3373] getname_flags+0xb7/0x540 [ 70.717255][ T3373] vfs_fstatat+0xdd/0x120 [ 70.721629][ T3373] __se_sys_newfstatat+0xd1/0x760 [ 70.726677][ T3373] do_syscall_64+0x8d/0x190 [ 70.731369][ T3373] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.737286][ T3373] [ 70.739615][ T3373] Memory state around the buggy address: [ 70.745249][ T3373] ffff88811dd6df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 70.753322][ T3373] ffff88811dd6e000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 70.761569][ T3373] >ffff88811dd6e080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 70.769812][ T3373] ^ [ 70.775971][ T3373] ffff88811dd6e100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 70.784221][ T3373] ffff88811dd6e180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 70.792288][ T3373] ================================================================== [ 70.802869][ T3373] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 70.810531][ T3373] Kernel Offset: disabled [ 70.814951][ T3373] Rebooting in 86400 seconds..