Warning: Permanently added '10.128.0.237' (ED25519) to the list of known hosts.
2023/08/22 12:13:29 ignoring optional flag "sandboxArg"="0"
2023/08/22 12:13:29 parsed 1 programs
2023/08/22 12:13:31 executed programs: 0
[ 90.220313][ T5393] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 90.232185][ T5387] syz-execprog[5387]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set
[ 90.243276][ T5387] syz-execprog[5387]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set
[ 90.294402][ T4448] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 90.302152][ T4448] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 90.310049][ T4448] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 90.317836][ T4448] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 90.325126][ T4448] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 90.452593][ T5400] chnl_net:caif_netlink_parms(): no params data found
[ 90.512939][ T5400] bridge0: port 1(bridge_slave_0) entered blocking state
[ 90.520093][ T5400] bridge0: port 1(bridge_slave_0) entered disabled state
[ 90.527547][ T5400] bridge_slave_0: entered allmulticast mode
[ 90.534510][ T5400] bridge_slave_0: entered promiscuous mode
[ 90.542994][ T5400] bridge0: port 2(bridge_slave_1) entered blocking state
[ 90.550177][ T5400] bridge0: port 2(bridge_slave_1) entered disabled state
[ 90.557409][ T5400] bridge_slave_1: entered allmulticast mode
[ 90.564257][ T5400] bridge_slave_1: entered promiscuous mode
[ 90.597199][ T5400] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 90.609441][ T5400] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 90.640212][ T5400] team0: Port device team_slave_0 added
[ 90.648552][ T5400] team0: Port device team_slave_1 added
[ 90.673580][ T5400] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 90.680730][ T5400] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 90.707017][ T5400] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 90.719264][ T5400] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 90.726209][ T5400] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 90.752203][ T5400] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 90.794126][ T5400] hsr_slave_0: entered promiscuous mode
[ 90.800577][ T5400] hsr_slave_1: entered promiscuous mode
[ 91.476061][ T5400] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 91.500031][ T5400] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 91.512335][ T5400] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 91.525303][ T5400] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 91.644442][ T5400] 8021q: adding VLAN 0 to HW filter on device bond0
[ 91.673093][ T5400] 8021q: adding VLAN 0 to HW filter on device team0
[ 91.688630][ T781] bridge0: port 1(bridge_slave_0) entered blocking state
[ 91.695825][ T781] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 91.724165][ T781] bridge0: port 2(bridge_slave_1) entered blocking state
[ 91.731503][ T781] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 91.949077][ T5400] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 92.015437][ T5400] veth0_vlan: entered promiscuous mode
[ 92.032136][ T5400] veth1_vlan: entered promiscuous mode
[ 92.074494][ T5400] veth0_macvtap: entered promiscuous mode
[ 92.086267][ T5400] veth1_macvtap: entered promiscuous mode
[ 92.113916][ T5400] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 92.133150][ T5400] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 92.150781][ T5400] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 92.162160][ T5400] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 92.172842][ T5400] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 92.182163][ T5400] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 92.268425][ T5435] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 92.276299][ T5435] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 92.322935][ T8] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 92.332080][ T8] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 92.367396][ T5045] Bluetooth: hci0: command 0x0409 tx timeout
[ 94.456889][ T4448] Bluetooth: hci0: command 0x041b tx timeout
2023/08/22 12:13:36 executed programs: 4
[ 96.527300][ T4448] Bluetooth: hci0: command 0x040f tx timeout
[ 97.249286][ T5435] ==================================================================
[ 97.257410][ T5435] BUG: KASAN: slab-use-after-free in hci_send_acl+0xdf4/0xf30
[ 97.264918][ T5435] Read of size 8 at addr ffff888069713618 by task kworker/0:4/5435
[ 97.272838][ T5435]
[ 97.275174][ T5435] CPU: 0 PID: 5435 Comm: kworker/0:4 Not tainted 6.5.0-rc6-next-20230818-syzkaller-dirty #0
[ 97.285258][ T5435] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
[ 97.295338][ T5435] Workqueue: events l2cap_info_timeout
[ 97.301104][ T5435] Call Trace:
[ 97.304504][ T5435]
[ 97.307456][ T5435] dump_stack_lvl+0xd9/0x1b0
[ 97.312078][ T5435] print_report+0xc4/0x620
[ 97.316573][ T5435] ? __virt_addr_valid+0x5e/0x2d0
[ 97.321619][ T5435] ? __phys_addr+0xc6/0x140
[ 97.326150][ T5435] kasan_report+0xda/0x110
[ 97.330588][ T5435] ? hci_send_acl+0xdf4/0xf30
[ 97.335290][ T5435] ? hci_send_acl+0xdf4/0xf30
[ 97.340011][ T5435] hci_send_acl+0xdf4/0xf30
[ 97.344549][ T5435] ? __mutex_unlock_slowpath+0x165/0x640
[ 97.350300][ T5435] ? trace_contention_end+0xd6/0x100
[ 97.355795][ T5435] ? bit_wait_timeout+0x160/0x160
[ 97.360837][ T5435] ? __mutex_lock+0x25b/0x1340
[ 97.365629][ T5435] l2cap_send_cmd+0x6dd/0x920
[ 97.370351][ T5435] l2cap_send_conn_req+0x1e5/0x260
[ 97.375571][ T5435] ? l2cap_connect+0x1280/0x1280
[ 97.380529][ T5435] ? rcu_is_watching+0x12/0xb0
[ 97.385474][ T5435] l2cap_start_connection+0x11e/0x420
[ 97.391113][ T5435] l2cap_conn_start+0x7ae/0xa40
[ 97.395974][ T5435] ? l2cap_chan_timeout+0x2f0/0x2f0
[ 97.401182][ T5435] ? rcu_is_watching+0x12/0xb0
[ 97.405948][ T5435] ? lock_acquire+0x464/0x510
[ 97.410633][ T5435] ? lock_sync+0x190/0x190
[ 97.415166][ T5435] ? reacquire_held_locks+0x4b0/0x4b0
[ 97.420835][ T5435] ? __schedule+0xee9/0x59f0
[ 97.425458][ T5435] ? spin_bug+0x1d0/0x1d0
[ 97.429807][ T5435] ? rcu_is_watching+0x12/0xb0
[ 97.434580][ T5435] process_one_work+0x887/0x15d0
[ 97.439548][ T5435] ? lock_sync+0x190/0x190
[ 97.444071][ T5435] ? init_worker_pool+0x770/0x770
[ 97.449116][ T5435] ? assign_work+0x1a0/0x240
[ 97.453717][ T5435] worker_thread+0x8bb/0x1290
[ 97.458404][ T5435] ? __kthread_parkme+0x152/0x220
[ 97.463433][ T5435] ? process_one_work+0x15d0/0x15d0
[ 97.468636][ T5435] kthread+0x33a/0x430
[ 97.472701][ T5435] ? kthread_complete_and_exit+0x40/0x40
[ 97.478420][ T5435] ret_from_fork+0x45/0x80
[ 97.482849][ T5435] ? kthread_complete_and_exit+0x40/0x40
[ 97.488596][ T5435] ret_from_fork_asm+0x11/0x20
[ 97.493387][ T5435]
[ 97.496404][ T5435]
[ 97.498726][ T5435] Allocated by task 5466:
[ 97.503049][ T5435] kasan_save_stack+0x33/0x50
[ 97.507737][ T5435] kasan_set_track+0x25/0x30
[ 97.512330][ T5435] __kasan_kmalloc+0xa2/0xb0
[ 97.516924][ T5435] hci_chan_create+0xa6/0x3a0
[ 97.521693][ T5435] l2cap_conn_add.part.0+0x1a/0xdf0
[ 97.526980][ T5435] l2cap_chan_connect+0x15b9/0x2140
[ 97.532174][ T5435] lowpan_control_write+0x3d6/0x730
[ 97.537371][ T5435] full_proxy_write+0x124/0x190
[ 97.542220][ T5435] vfs_write+0x2a4/0xe40
[ 97.546460][ T5435] ksys_write+0x12f/0x250
[ 97.550870][ T5435] do_syscall_64+0x38/0xb0
[ 97.555284][ T5435] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 97.561179][ T5435]
[ 97.563489][ T5435] Freed by task 5045:
[ 97.567549][ T5435] kasan_save_stack+0x33/0x50
[ 97.572237][ T5435] kasan_set_track+0x25/0x30
[ 97.576829][ T5435] kasan_save_free_info+0x2b/0x40
[ 97.581847][ T5435] ____kasan_slab_free+0x15b/0x1b0
[ 97.587149][ T5435] slab_free_freelist_hook+0x114/0x1e0
[ 97.592694][ T5435] __kmem_cache_free+0xb8/0x2f0
[ 97.597546][ T5435] hci_chan_list_flush+0x81/0xf0
[ 97.602477][ T5435] hci_conn_del+0x1fc/0xd10
[ 97.606998][ T5435] hci_abort_conn_sync+0xacb/0xe20
[ 97.612110][ T5435] abort_conn_sync+0x18e/0x3a0
[ 97.616879][ T5435] hci_cmd_sync_work+0x1a4/0x3c0
[ 97.621809][ T5435] process_one_work+0x887/0x15d0
[ 97.626746][ T5435] worker_thread+0x8bb/0x1290
[ 97.631419][ T5435] kthread+0x33a/0x430
[ 97.635487][ T5435] ret_from_fork+0x45/0x80
[ 97.639897][ T5435] ret_from_fork_asm+0x11/0x20
[ 97.644676][ T5435]
[ 97.646994][ T5435] The buggy address belongs to the object at ffff888069713600
[ 97.646994][ T5435] which belongs to the cache kmalloc-128 of size 128
[ 97.661820][ T5435] The buggy address is located 24 bytes inside of
[ 97.661820][ T5435] freed 128-byte region [ffff888069713600, ffff888069713680)
[ 97.675529][ T5435]
[ 97.677841][ T5435] The buggy address belongs to the physical page:
[ 97.684244][ T5435] page:ffffea0001a5c4c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x69713
[ 97.694478][ T5435] flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 97.702193][ T5435] page_type: 0xffffffff()
[ 97.706634][ T5435] raw: 00fff00000000800 ffff888012c418c0 dead000000000122 0000000000000000
[ 97.715223][ T5435] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
[ 97.723878][ T5435] page dumped because: kasan: bad access detected
[ 97.730274][ T5435] page_owner tracks the page as allocated
[ 97.735970][ T5435] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5400, tgid 5400 (syz-executor.0), ts 92397723620, free_ts 92397302327
[ 97.754586][ T5435] post_alloc_hook+0x2cf/0x340
[ 97.759360][ T5435] get_page_from_freelist+0x10d7/0x31b0
[ 97.764901][ T5435] __alloc_pages+0x1d0/0x4a0
[ 97.769485][ T5435] allocate_slab+0xa1/0x380
[ 97.773991][ T5435] ___slab_alloc+0x8be/0x1570
[ 97.778667][ T5435] __slab_alloc.constprop.0+0x56/0xa0
[ 97.784039][ T5435] __kmem_cache_alloc_node+0x137/0x350
[ 97.789587][ T5435] __kmalloc_node+0x52/0x110
[ 97.794172][ T5435] memcg_alloc_slab_cgroups+0xa9/0x170
[ 97.799639][ T5435] memcg_slab_post_alloc_hook+0xaa/0x390
[ 97.805273][ T5435] kmem_cache_alloc+0x1a7/0x3b0
[ 97.810126][ T5435] prepare_creds+0x43/0x7b0
[ 97.814632][ T5435] copy_creds+0xa7/0xe50
[ 97.818889][ T5435] copy_process+0xeb6/0x7400
[ 97.824517][ T5435] kernel_clone+0xfd/0x930
[ 97.828933][ T5435] __do_sys_clone+0xba/0x100
[ 97.833525][ T5435] page last free stack trace:
[ 97.838185][ T5435] free_unref_page_prepare+0x476/0xa40
[ 97.843645][ T5435] free_unref_page+0x33/0x3b0
[ 97.848324][ T5435] vfree+0x181/0x7a0
[ 97.852220][ T5435] __do_replace+0x7bf/0x9c0
[ 97.856723][ T5435] do_ip6t_set_ctl+0x93a/0xbd0
[ 97.861496][ T5435] nf_setsockopt+0x87/0xe0
[ 97.865908][ T5435] ipv6_setsockopt+0x12b/0x190
[ 97.870669][ T5435] tcp_setsockopt+0x9d/0x100
[ 97.875254][ T5435] __sys_setsockopt+0x2cd/0x5b0
[ 97.880114][ T5435] __x64_sys_setsockopt+0xbd/0x150
[ 97.885221][ T5435] do_syscall_64+0x38/0xb0
[ 97.889647][ T5435] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 97.895544][ T5435]
[ 97.897861][ T5435] Memory state around the buggy address:
[ 97.903480][ T5435] ffff888069713500: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
[ 97.911537][ T5435] ffff888069713580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 97.919597][ T5435] >ffff888069713600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 97.927649][ T5435] ^
[ 97.932487][ T5435] ffff888069713680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 97.940541][ T5435] ffff888069713700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 97.948590][ T5435] ==================================================================
[ 97.987476][ T5435] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 97.994716][ T5435] CPU: 0 PID: 5435 Comm: kworker/0:4 Not tainted 6.5.0-rc6-next-20230818-syzkaller-dirty #0
[ 98.004799][ T5435] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
[ 98.014869][ T5435] Workqueue: events l2cap_info_timeout
[ 98.020360][ T5435] Call Trace:
[ 98.023650][ T5435]
[ 98.026584][ T5435] dump_stack_lvl+0xd9/0x1b0
[ 98.031199][ T5435] panic+0x6a6/0x750
[ 98.035122][ T5435] ? panic_smp_self_stop+0xa0/0xa0
[ 98.040251][ T5435] ? trace_irq_enable.constprop.0+0xd0/0x100
[ 98.046253][ T5435] ? preempt_schedule_thunk+0x1a/0x30
[ 98.051650][ T5435] ? preempt_schedule_common+0x45/0xc0
[ 98.057138][ T5435] check_panic_on_warn+0xab/0xb0
[ 98.062106][ T5435] end_report+0x108/0x150
[ 98.066450][ T5435] kasan_report+0xea/0x110
[ 98.070884][ T5435] ? hci_send_acl+0xdf4/0xf30
[ 98.075595][ T5435] ? hci_send_acl+0xdf4/0xf30
[ 98.080567][ T5435] hci_send_acl+0xdf4/0xf30
[ 98.085097][ T5435] ? __mutex_unlock_slowpath+0x165/0x640
[ 98.090759][ T5435] ? trace_contention_end+0xd6/0x100
[ 98.096067][ T5435] ? bit_wait_timeout+0x160/0x160
[ 98.101122][ T5435] ? __mutex_lock+0x25b/0x1340
[ 98.105899][ T5435] l2cap_send_cmd+0x6dd/0x920
[ 98.110579][ T5435] l2cap_send_conn_req+0x1e5/0x260
[ 98.116051][ T5435] ? l2cap_connect+0x1280/0x1280
[ 98.120991][ T5435] ? rcu_is_watching+0x12/0xb0
[ 98.125762][ T5435] l2cap_start_connection+0x11e/0x420
[ 98.131143][ T5435] l2cap_conn_start+0x7ae/0xa40
[ 98.136006][ T5435] ? l2cap_chan_timeout+0x2f0/0x2f0
[ 98.141207][ T5435] ? rcu_is_watching+0x12/0xb0
[ 98.145969][ T5435] ? lock_acquire+0x464/0x510
[ 98.150666][ T5435] ? lock_sync+0x190/0x190
[ 98.155105][ T5435] ? reacquire_held_locks+0x4b0/0x4b0
[ 98.160490][ T5435] ? __schedule+0xee9/0x59f0
[ 98.165094][ T5435] ? spin_bug+0x1d0/0x1d0
[ 98.169448][ T5435] ? rcu_is_watching+0x12/0xb0
[ 98.174229][ T5435] process_one_work+0x887/0x15d0
[ 98.179230][ T5435] ? lock_sync+0x190/0x190
[ 98.183657][ T5435] ? init_worker_pool+0x770/0x770
[ 98.188689][ T5435] ? assign_work+0x1a0/0x240
[ 98.193278][ T5435] worker_thread+0x8bb/0x1290
[ 98.197966][ T5435] ? __kthread_parkme+0x152/0x220
[ 98.202990][ T5435] ? process_one_work+0x15d0/0x15d0
[ 98.208366][ T5435] kthread+0x33a/0x430
[ 98.212471][ T5435] ? kthread_complete_and_exit+0x40/0x40
[ 98.218582][ T5435] ret_from_fork+0x45/0x80
[ 98.223101][ T5435] ? kthread_complete_and_exit+0x40/0x40
[ 98.228831][ T5435] ret_from_fork_asm+0x11/0x20
[ 98.233690][ T5435]
[ 98.236912][ T5435] Kernel Offset: disabled
[ 98.241312][ T5435] Rebooting in 86400 seconds..