Warning: Permanently added '10.128.0.245' (ED25519) to the list of known hosts.
2025/02/01 16:50:11 ignoring optional flag "sandboxArg"="0"
2025/02/01 16:50:11 ignoring optional flag "type"="gce"
2025/02/01 16:50:12 parsed 1 programs
2025/02/01 16:50:12 executed programs: 0
[ 104.689962][ T6137] cgroup: Unknown subsys name 'net'
[ 104.698997][ T6137] cgroup: Unknown subsys name 'cpuset'
[ 104.707092][ T6137] cgroup: Unknown subsys name 'rlimit'
[ 105.844514][ T5844] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 105.853337][ T5844] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 105.861698][ T5844] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 105.870438][ T5844] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 105.879610][ T5844] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 105.887335][ T5844] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 106.020999][ T6144] chnl_net:caif_netlink_parms(): no params data found
[ 106.097939][ T6144] bridge0: port 1(bridge_slave_0) entered blocking state
[ 106.105129][ T6144] bridge0: port 1(bridge_slave_0) entered disabled state
[ 106.112785][ T6144] bridge_slave_0: entered allmulticast mode
[ 106.120309][ T6144] bridge_slave_0: entered promiscuous mode
[ 106.128884][ T6144] bridge0: port 2(bridge_slave_1) entered blocking state
[ 106.136085][ T6144] bridge0: port 2(bridge_slave_1) entered disabled state
[ 106.143430][ T6144] bridge_slave_1: entered allmulticast mode
[ 106.151368][ T6144] bridge_slave_1: entered promiscuous mode
[ 106.185291][ T6144] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 106.198507][ T6144] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 106.235214][ T6144] team0: Port device team_slave_0 added
[ 106.244041][ T6144] team0: Port device team_slave_1 added
[ 106.275253][ T6144] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 106.282398][ T6144] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 106.309143][ T6144] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 106.321499][ T6144] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 106.329210][ T6144] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 106.356383][ T6144] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 106.397625][ T6144] hsr_slave_0: entered promiscuous mode
[ 106.404092][ T6144] hsr_slave_1: entered promiscuous mode
[ 106.528341][ T6144] bridge0: port 2(bridge_slave_1) entered blocking state
[ 106.535616][ T6144] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 106.543972][ T6144] bridge0: port 1(bridge_slave_0) entered blocking state
[ 106.551151][ T6144] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 106.619870][ T6144] 8021q: adding VLAN 0 to HW filter on device bond0
[ 106.640039][ T29] bridge0: port 1(bridge_slave_0) entered disabled state
[ 106.648132][ T29] bridge0: port 2(bridge_slave_1) entered disabled state
[ 106.667983][ T6144] 8021q: adding VLAN 0 to HW filter on device team0
[ 106.682703][ T29] bridge0: port 1(bridge_slave_0) entered blocking state
[ 106.690201][ T29] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 106.705171][ T3491] bridge0: port 2(bridge_slave_1) entered blocking state
[ 106.712369][ T3491] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 106.790450][ T6144] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 107.115800][ T6144] veth0_vlan: entered promiscuous mode
[ 107.130648][ T6144] veth1_vlan: entered promiscuous mode
[ 107.164830][ T6144] veth0_macvtap: entered promiscuous mode
[ 107.175210][ T6144] veth1_macvtap: entered promiscuous mode
[ 107.195125][ T6144] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 107.206535][ T6144] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 107.284668][ T1144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 107.300576][ T1144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 107.330584][ T1144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 107.339399][ T1144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 107.351036][ T6144] ==================================================================
[ 107.359208][ T6144] BUG: KASAN: slab-use-after-free in binder_add_device+0x5f/0xa0
[ 107.366990][ T6144] Write of size 8 at addr ffff8880320db008 by task syz-executor.0/6144
[ 107.375210][ T6144]
[ 107.377536][ T6144] CPU: 0 UID: 0 PID: 6144 Comm: syz-executor.0 Not tainted 6.13.0-next-20250131-syzkaller-10663-gdf4b2bbff898-dirty #0
[ 107.377547][ T6144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[ 107.377559][ T6144] Call Trace:
[ 107.377565][ T6144]
[ 107.377570][ T6144] dump_stack_lvl+0x241/0x360
[ 107.377585][ T6144] ? __pfx_dump_stack_lvl+0x10/0x10
[ 107.377595][ T6144] ? __pfx__printk+0x10/0x10
[ 107.377605][ T6144] ? _printk+0xd5/0x120
[ 107.377613][ T6144] ? __virt_addr_valid+0x183/0x530
[ 107.377626][ T6144] ? __virt_addr_valid+0x183/0x530
[ 107.377639][ T6144] print_report+0x169/0x550
[ 107.377653][ T6144] ? __virt_addr_valid+0x183/0x530
[ 107.377665][ T6144] ? __virt_addr_valid+0x183/0x530
[ 107.377677][ T6144] ? __virt_addr_valid+0x45f/0x530
[ 107.377689][ T6144] ? __phys_addr+0xba/0x170
[ 107.377701][ T6144] ? binder_add_device+0x5f/0xa0
[ 107.377710][ T6144] kasan_report+0x143/0x180
[ 107.377719][ T6144] ? binder_add_device+0x5f/0xa0
[ 107.377730][ T6144] binder_add_device+0x5f/0xa0
[ 107.377739][ T6144] binderfs_binder_device_create+0x7bf/0x9c0
[ 107.377756][ T6144] binderfs_fill_super+0x944/0xd90
[ 107.377771][ T6144] ? __pfx_binderfs_fill_super+0x10/0x10
[ 107.377790][ T6144] ? shrinker_register+0x160/0x230
[ 107.377802][ T6144] ? sget_fc+0x909/0x9c0
[ 107.377814][ T6144] ? __pfx_set_anon_super_fc+0x10/0x10
[ 107.377826][ T6144] ? __pfx_binderfs_fill_super+0x10/0x10
[ 107.377839][ T6144] get_tree_nodev+0xb7/0x140
[ 107.377851][ T6144] vfs_get_tree+0x90/0x2b0
[ 107.377863][ T6144] do_new_mount+0x2be/0xb40
[ 107.377875][ T6144] ? __pfx_do_new_mount+0x10/0x10
[ 107.377886][ T6144] __se_sys_mount+0x2d6/0x3c0
[ 107.377896][ T6144] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 107.377910][ T6144] ? __pfx___se_sys_mount+0x10/0x10
[ 107.377919][ T6144] ? do_syscall_64+0x100/0x230
[ 107.377931][ T6144] ? __x64_sys_mount+0x20/0xc0
[ 107.377940][ T6144] do_syscall_64+0xf3/0x230
[ 107.377951][ T6144] ? clear_bhb_loop+0x35/0x90
[ 107.377965][ T6144] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 107.377977][ T6144] RIP: 0033:0x7f195687ad4a
[ 107.377991][ T6144] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 09 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[ 107.377998][ T6144] RSP: 002b:00007ffc2d37ff48 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 107.378009][ T6144] RAX: ffffffffffffffda RBX: 00007f19568d4244 RCX: 00007f195687ad4a
[ 107.378016][ T6144] RDX: 00007f19568de25f RSI: 00007f19568d4244 RDI: 00007f19568de25f
[ 107.378022][ T6144] RBP: 00007ffc2d380030 R08: 0000000000000000 R09: 0000000000000000
[ 107.378028][ T6144] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc2d380618
[ 107.378034][ T6144] R13: 00007ffc2d380618 R14: 0000000000000001 R15: 00000000fffffff1
[ 107.378044][ T6144]
[ 107.378047][ T6144]
[ 107.653589][ T6144] Allocated by task 5842:
[ 107.657904][ T6144] kasan_save_track+0x3f/0x80
[ 107.662792][ T6144] __kasan_kmalloc+0x98/0xb0
[ 107.667694][ T6144] __kmalloc_cache_noprof+0x243/0x390
[ 107.673064][ T6144] binderfs_binder_device_create+0x16c/0x9c0
[ 107.679036][ T6144] binderfs_fill_super+0x944/0xd90
[ 107.684230][ T6144] get_tree_nodev+0xb7/0x140
[ 107.688821][ T6144] vfs_get_tree+0x90/0x2b0
[ 107.693317][ T6144] do_new_mount+0x2be/0xb40
[ 107.697900][ T6144] __se_sys_mount+0x2d6/0x3c0
[ 107.702579][ T6144] do_syscall_64+0xf3/0x230
[ 107.707072][ T6144] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 107.712967][ T6144]
[ 107.715279][ T6144] Freed by task 5842:
[ 107.719244][ T6144] kasan_save_track+0x3f/0x80
[ 107.723914][ T6144] kasan_save_free_info+0x40/0x50
[ 107.728929][ T6144] __kasan_slab_free+0x59/0x70
[ 107.733745][ T6144] kfree+0x196/0x430
[ 107.737631][ T6144] evict+0x4e8/0x9a0
[ 107.741526][ T6144] __dentry_kill+0x20d/0x630
[ 107.746102][ T6144] shrink_kill+0xa9/0x2c0
[ 107.750519][ T6144] shrink_dentry_list+0x2c0/0x5b0
[ 107.756138][ T6144] shrink_dcache_parent+0xcb/0x3b0
[ 107.761255][ T6144] do_one_tree+0x23/0xe0
[ 107.765575][ T6144] shrink_dcache_for_umount+0xb4/0x180
[ 107.771072][ T6144] generic_shutdown_super+0x6a/0x2d0
[ 107.776352][ T6144] kill_litter_super+0x76/0xb0
[ 107.781149][ T6144] binderfs_kill_super+0x44/0x90
[ 107.786089][ T6144] deactivate_locked_super+0xc4/0x130
[ 107.791454][ T6144] cleanup_mnt+0x41f/0x4b0
[ 107.795863][ T6144] task_work_run+0x24f/0x310
[ 107.800517][ T6144] do_exit+0xa2a/0x28e0
[ 107.804673][ T6144] do_group_exit+0x207/0x2c0
[ 107.809342][ T6144] get_signal+0x16b2/0x1750
[ 107.814028][ T6144] arch_do_signal_or_restart+0x96/0x860
[ 107.819766][ T6144] syscall_exit_to_user_mode+0xce/0x340
[ 107.825362][ T6144] do_syscall_64+0x100/0x230
[ 107.829961][ T6144] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 107.836126][ T6144]
[ 107.838462][ T6144] The buggy address belongs to the object at ffff8880320db000
[ 107.838462][ T6144] which belongs to the cache kmalloc-512 of size 512
[ 107.852770][ T6144] The buggy address is located 8 bytes inside of
[ 107.852770][ T6144] freed 512-byte region [ffff8880320db000, ffff8880320db200)
[ 107.866403][ T6144]
[ 107.868725][ T6144] The buggy address belongs to the physical page:
[ 107.875148][ T6144] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x320d8
[ 107.883932][ T6144] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 107.892872][ T6144] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 107.900865][ T6144] page_type: f5(slab)
[ 107.904844][ T6144] raw: 00fff00000000040 ffff88801ac41c80 0000000000000000 dead000000000001
[ 107.913418][ T6144] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 107.922008][ T6144] head: 00fff00000000040 ffff88801ac41c80 0000000000000000 dead000000000001
[ 107.930679][ T6144] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 107.939344][ T6144] head: 00fff00000000002 ffffea0000c83601 ffffffffffffffff 0000000000000000
[ 107.948013][ T6144] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 107.956670][ T6144] page dumped because: kasan: bad access detected
[ 107.963082][ T6144] page_owner tracks the page as allocated
[ 107.968785][ T6144] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5214, tgid 5214 (udevd), ts 51909729576, free_ts 51741429751
[ 107.989528][ T6144] post_alloc_hook+0x1f4/0x240
[ 107.994288][ T6144] get_page_from_freelist+0x365c/0x37a0
[ 107.999829][ T6144] __alloc_frozen_pages_noprof+0x292/0x710
[ 108.005650][ T6144] alloc_pages_mpol+0x311/0x660
[ 108.010571][ T6144] allocate_slab+0x8f/0x3a0
[ 108.015070][ T6144] ___slab_alloc+0xc27/0x14a0
[ 108.019743][ T6144] __slab_alloc+0x58/0xa0
[ 108.024106][ T6144] __kmalloc_cache_noprof+0x27b/0x390
[ 108.029468][ T6144] kernfs_fop_open+0x3e0/0xd10
[ 108.034215][ T6144] do_dentry_open+0xdec/0x1960
[ 108.038970][ T6144] vfs_open+0x3b/0x370
[ 108.043024][ T6144] path_openat+0x2c81/0x3590
[ 108.047603][ T6144] do_filp_open+0x27f/0x4e0
[ 108.052100][ T6144] do_sys_openat2+0x13e/0x1d0
[ 108.056767][ T6144] __x64_sys_openat+0x247/0x2a0
[ 108.061689][ T6144] do_syscall_64+0xf3/0x230
[ 108.066181][ T6144] page last free pid 5211 tgid 5211 stack trace:
[ 108.072495][ T6144] free_frozen_pages+0xe0d/0x10e0
[ 108.077515][ T6144] __put_partials+0x160/0x1c0
[ 108.082191][ T6144] put_cpu_partial+0x17c/0x250
[ 108.086941][ T6144] __slab_free+0x290/0x380
[ 108.091344][ T6144] qlist_free_all+0x9a/0x140
[ 108.095930][ T6144] kasan_quarantine_reduce+0x14f/0x170
[ 108.101395][ T6144] __kasan_slab_alloc+0x23/0x80
[ 108.106240][ T6144] __kmalloc_noprof+0x236/0x4c0
[ 108.111116][ T6144] tomoyo_realpath_from_path+0xcf/0x5e0
[ 108.116681][ T6144] tomoyo_path_perm+0x2b7/0x740
[ 108.121542][ T6144] security_inode_getattr+0x130/0x330
[ 108.126919][ T6144] vfs_getattr+0x2a/0x3a0
[ 108.131245][ T6144] vfs_statx+0x18c/0x490
[ 108.135476][ T6144] vfs_fstatat+0xe5/0x130
[ 108.139901][ T6144] __x64_sys_newfstatat+0x11d/0x1a0
[ 108.145088][ T6144] do_syscall_64+0xf3/0x230
[ 108.149586][ T6144]
[ 108.151896][ T6144] Memory state around the buggy address:
[ 108.157594][ T6144] ffff8880320daf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 108.165729][ T6144] ffff8880320daf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 108.173862][ T6144] >ffff8880320db000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 108.181998][ T6144] ^
[ 108.186319][ T6144] ffff8880320db080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 108.194555][ T6144] ffff8880320db100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 108.202651][ T6144] ==================================================================
[ 108.218700][ T6144] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 108.225947][ T6144] CPU: 1 UID: 0 PID: 6144 Comm: syz-executor.0 Not tainted 6.13.0-next-20250131-syzkaller-10663-gdf4b2bbff898-dirty #0
[ 108.238375][ T6144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[ 108.248449][ T6144] Call Trace:
[ 108.251742][ T6144]
[ 108.254774][ T6144] dump_stack_lvl+0x241/0x360
[ 108.259476][ T6144] ? __pfx_dump_stack_lvl+0x10/0x10
[ 108.264695][ T6144] ? __pfx__printk+0x10/0x10
[ 108.269316][ T6144] ? preempt_schedule+0xe1/0xf0
[ 108.274192][ T6144] ? vscnprintf+0x5d/0x90
[ 108.278547][ T6144] panic+0x349/0x880
[ 108.282460][ T6144] ? check_panic_on_warn+0x21/0xb0
[ 108.287593][ T6144] ? __pfx_panic+0x10/0x10
[ 108.292173][ T6144] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 108.298162][ T6144] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 108.304477][ T6144] ? print_report+0x502/0x550
[ 108.309157][ T6144] check_panic_on_warn+0x86/0xb0
[ 108.314136][ T6144] ? binder_add_device+0x5f/0xa0
[ 108.319265][ T6144] end_report+0x77/0x160
[ 108.323543][ T6144] kasan_report+0x154/0x180
[ 108.328220][ T6144] ? binder_add_device+0x5f/0xa0
[ 108.333273][ T6144] binder_add_device+0x5f/0xa0
[ 108.338060][ T6144] binderfs_binder_device_create+0x7bf/0x9c0
[ 108.344061][ T6144] binderfs_fill_super+0x944/0xd90
[ 108.349171][ T6144] ? __pfx_binderfs_fill_super+0x10/0x10
[ 108.354805][ T6144] ? shrinker_register+0x160/0x230
[ 108.359912][ T6144] ? sget_fc+0x909/0x9c0
[ 108.364153][ T6144] ? __pfx_set_anon_super_fc+0x10/0x10
[ 108.369650][ T6144] ? __pfx_binderfs_fill_super+0x10/0x10
[ 108.375315][ T6144] get_tree_nodev+0xb7/0x140
[ 108.379927][ T6144] vfs_get_tree+0x90/0x2b0
[ 108.384344][ T6144] do_new_mount+0x2be/0xb40
[ 108.388858][ T6144] ? __pfx_do_new_mount+0x10/0x10
[ 108.393897][ T6144] __se_sys_mount+0x2d6/0x3c0
[ 108.398570][ T6144] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 108.404569][ T6144] ? __pfx___se_sys_mount+0x10/0x10
[ 108.409760][ T6144] ? do_syscall_64+0x100/0x230
[ 108.414519][ T6144] ? __x64_sys_mount+0x20/0xc0
[ 108.419299][ T6144] do_syscall_64+0xf3/0x230
[ 108.423811][ T6144] ? clear_bhb_loop+0x35/0x90
[ 108.428489][ T6144] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 108.434473][ T6144] RIP: 0033:0x7f195687ad4a
[ 108.438888][ T6144] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 09 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[ 108.458597][ T6144] RSP: 002b:00007ffc2d37ff48 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 108.467385][ T6144] RAX: ffffffffffffffda RBX: 00007f19568d4244 RCX: 00007f195687ad4a
[ 108.475554][ T6144] RDX: 00007f19568de25f RSI: 00007f19568d4244 RDI: 00007f19568de25f
[ 108.483635][ T6144] RBP: 00007ffc2d380030 R08: 0000000000000000 R09: 0000000000000000
[ 108.491787][ T6144] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc2d380618
[ 108.500024][ T6144] R13: 00007ffc2d380618 R14: 0000000000000001 R15: 00000000fffffff1
[ 108.508102][ T6144]
[ 108.511674][ T6144] Kernel Offset: disabled
[ 108.516127][ T6144] Rebooting in 86400 seconds..