[   50.528212][  T967] device bridge_slave_1 left promiscuous mode
[   50.535891][  T967] bridge0: port 2(bridge_slave_1) entered disabled state
[   50.546997][  T967] device bridge_slave_0 left promiscuous mode
[   50.553217][  T967] bridge0: port 1(bridge_slave_0) entered disabled state
[   50.567889][  T967] device veth1_macvtap left promiscuous mode
[   50.574452][  T967] device veth0_macvtap left promiscuous mode
[   50.580766][  T967] device veth1_vlan left promiscuous mode
[   50.587182][  T967] device veth0_vlan left promiscuous mode
[   50.681813][  T967] team0 (unregistering): Port device team_slave_1 removed
[   50.693052][  T967] team0 (unregistering): Port device team_slave_0 removed
Warning: Permanently added '10.128.10.28' (ED25519) to the list of known hosts.
2024/03/27 02:41:41 ignoring optional flag "sandboxArg"="0"
2024/03/27 02:41:41 parsed 1 programs
2024/03/27 02:41:43 executed programs: 0
[   68.417834][ T3558] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k FS
[   68.550263][ T3567] bridge0: port 1(bridge_slave_0) entered blocking state
[   68.557526][ T3567] bridge0: port 1(bridge_slave_0) entered disabled state
[   68.567458][ T3567] device bridge_slave_0 entered promiscuous mode
[   68.575019][ T3567] bridge0: port 2(bridge_slave_1) entered blocking state
[   68.582143][ T3567] bridge0: port 2(bridge_slave_1) entered disabled state
[   68.590020][ T3567] device bridge_slave_1 entered promiscuous mode
[   68.642275][ T3567] team0: Port device team_slave_0 added
[   68.649201][ T3567] team0: Port device team_slave_1 added
[   68.702926][ T3567] device hsr_slave_0 entered promiscuous mode
[   68.709771][ T3567] device hsr_slave_1 entered promiscuous mode
[   69.077062][ T3567] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   69.086263][ T3567] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   69.096720][ T3567] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   69.105982][ T3567] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   69.124159][ T3567] bridge0: port 2(bridge_slave_1) entered blocking state
[   69.131359][ T3567] bridge0: port 2(bridge_slave_1) entered forwarding state
[   69.138813][ T3567] bridge0: port 1(bridge_slave_0) entered blocking state
[   69.145908][ T3567] bridge0: port 1(bridge_slave_0) entered forwarding state
[   69.300202][ T3567] 8021q: adding VLAN 0 to HW filter on device team0
[   69.309043][  T993] bridge0: port 1(bridge_slave_0) entered disabled state
[   69.317587][  T993] bridge0: port 2(bridge_slave_1) entered disabled state
[   69.326415][  T993] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[   69.334564][  T993] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[   69.355926][  T993] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[   69.365054][  T993] bridge0: port 1(bridge_slave_0) entered blocking state
[   69.372141][  T993] bridge0: port 1(bridge_slave_0) entered forwarding state
[   69.380164][  T993] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[   69.389674][  T993] bridge0: port 2(bridge_slave_1) entered blocking state
[   69.397003][  T993] bridge0: port 2(bridge_slave_1) entered forwarding state
[   69.405087][  T993] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[   69.413654][  T993] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[   69.427485][ T3567] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[   69.439079][ T3567] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   69.451144][ T3193] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[   69.459773][ T3193] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[   69.468472][ T3193] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[   69.480121][ T3193] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[   69.775762][ T3664] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[   69.785174][ T3664] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[   69.801609][ T3567] device veth0_vlan entered promiscuous mode
[   69.809338][ T3193] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[   69.818377][ T3193] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[   69.830196][ T3567] device veth1_vlan entered promiscuous mode
[   69.838393][ T3664] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[   69.846766][ T3664] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[   69.854781][ T3664] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[   69.873123][ T3567] device veth0_macvtap entered promiscuous mode
[   69.883645][ T3193] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[   69.892385][ T3193] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[   69.901691][ T3193] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[   69.912703][ T3567] device veth1_macvtap entered promiscuous mode
[   69.922355][ T3664] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[   69.930842][ T3664] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[   69.948483][ T3193] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[   69.957411][ T3193] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[   69.966490][ T3193] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[   69.975938][ T3193] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[   69.985671][ T3567] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   69.995302][ T3567] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   70.004544][ T3567] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   70.013255][ T3567] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   70.058122][   T75] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   70.075942][   T75] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   70.083765][ T3193] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[   70.101177][   T75] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   70.110766][   T75] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   70.120208][ T3193] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[   70.178454][ T3768] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'.
[   70.211277][ T3773] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'.
[   70.234651][ T3778] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'.
[   70.271206][ T3782] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'.
[   70.300284][ T3786] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'.
[   70.328341][ T3789] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'.
[   70.360952][ T3794] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'.
[   70.401664][ T3801] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'.
[   70.441551][ T3807] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'.
[   70.483019][ T3813] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'.
[   70.915958][    C0] ==================================================================
[   70.924231][    C0] BUG: KASAN: use-after-free in ip_skb_dst_mtu+0xa1d/0xba0
[   70.931624][    C0] Read of size 1 at addr ffff88804a04e012 by task udevd/2641
[   70.939039][    C0] 
[   70.941383][    C0] CPU: 0 PID: 2641 Comm: udevd Not tainted 5.15.153-syzkaller #0
[   70.949543][    C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
[   70.959608][    C0] Call Trace:
[   70.962905][    C0]  <IRQ>
[   70.965773][    C0]  dump_stack_lvl+0x8e/0xdd
[   70.970302][    C0]  print_address_description.constprop.0.cold+0x6c/0x309
[   70.977362][    C0]  ? ip_skb_dst_mtu+0xa1d/0xba0
[   70.982252][    C0]  ? ip_skb_dst_mtu+0xa1d/0xba0
[   70.987349][    C0]  kasan_report.cold+0x83/0xdf
[   70.992243][    C0]  ? ip_skb_dst_mtu+0xa1d/0xba0
[   70.997130][    C0]  ip_skb_dst_mtu+0xa1d/0xba0
[   71.001969][    C0]  ? ip_finish_output2+0x1aa0/0x1aa0
[   71.007289][    C0]  ? nf_nat_ipv4_out+0xbe/0x4f0
[   71.012161][    C0]  __ip_finish_output.part.0+0x23/0x350
[   71.017758][    C0]  ip_output+0x365/0x710
[   71.022044][    C0]  ? ip_finish_output+0x2d0/0x2d0
[   71.027205][    C0]  ? ip_route_output_key_hash_rcu+0x2ca0/0x2ca0
[   71.033476][    C0]  ? _raw_spin_lock+0x27/0x40
[   71.038207][    C0]  ? dput+0x36c/0xa60
[   71.042314][    C0]  ? wait_for_partner+0xd4/0x3b0
[   71.047304][    C0]  ? __ip_finish_output.part.0+0x350/0x350
[   71.053154][    C0]  ? entry_SYSCALL_64_after_hwframe+0x61/0xcb
[   71.059345][    C0]  ip_local_out+0xaf/0x150
[   71.063833][    C0]  ipvlan_process_v4_outbound+0x41d/0x520
[   71.069762][    C0]  ? ipvlan_route_v6_outbound+0x4f0/0x4f0
[   71.075620][    C0]  ? __sanitizer_cov_trace_switch+0x45/0x70
[   71.081647][    C0]  ? ipvlan_get_L3_hdr+0x81/0xa10
[   71.086710][    C0]  ipvlan_queue_xmit+0xbaa/0xfb0
[   71.091848][    C0]  ? ipvlan_handle_mode_l3+0x140/0x140
[   71.097519][    C0]  ? validate_xmit_xfrm+0x43f/0x10c0
[   71.102803][    C0]  ? netif_skb_features+0x39d/0xd00
[   71.108222][    C0]  ipvlan_start_xmit+0x45/0x140
[   71.113242][    C0]  dev_hard_start_xmit+0x1c5/0x6f0
[   71.118571][    C0]  sch_direct_xmit+0x19f/0xbe0
[   71.123486][    C0]  ? ktime_get+0x115/0x360
[   71.127989][    C0]  ? ktime_get+0x291/0x360
[   71.132393][    C0]  ? dev_watchdog+0xbf0/0xbf0
[   71.137145][    C0]  ? qdisc_dequeue_head+0x22f/0x330
[   71.142601][    C0]  ? tbf_dequeue+0x9d8/0xdf0
[   71.147176][    C0]  __qdisc_run+0x4a0/0x15a0
[   71.151680][    C0]  ? lock_acquire+0x11a/0x250
[   71.156735][    C0]  net_tx_action+0x65f/0x930
[   71.161523][    C0]  __do_softirq+0x1fd/0x5e5
[   71.166295][    C0]  irq_exit_rcu+0xde/0x120
[   71.170801][    C0]  sysvec_apic_timer_interrupt+0x6f/0x90
[   71.176598][    C0]  </IRQ>
[   71.179604][    C0]  <TASK>
[   71.182531][    C0]  asm_sysvec_apic_timer_interrupt+0x16/0x20
[   71.188609][    C0] RIP: 0010:rb_next+0xd2/0x140
[   71.193457][    C0] Code: e3 48 83 e3 fc 75 cb 48 83 c4 08 5b 5d 41 5c 41 5d c3 48 89 d0 48 8d 78 10 48 89 fa 48 c1 ea 03 80 3c 1a 00 75 26 48 8b 50 10 <48> 85 d2 75 e3 48 83 c4 08 5b 5d 41 5c 41 5d c3 48 83 c4 08 48 89
[   71.213406][    C0] RSP: 0018:ffffc90002c57d68 EFLAGS: 00000246
[   71.219572][    C0] RAX: ffff888016c343e0 RBX: dffffc0000000000 RCX: ffffffff81d17877
[   71.227545][    C0] RDX: 0000000000000000 RSI: ffffffff81d17ddd RDI: ffff888016c343f0
[   71.235510][    C0] RBP: ffff888016c325b0 R08: 0000000000000000 R09: ffff888016c32577
[   71.243728][    C0] R10: 0000000000000000 R11: ffffffff8a1e2e70 R12: 0000000000000001
[   71.252213][    C0] R13: dffffc0000000000 R14: ffffc90002c57e98 R15: fffffbfff16675b1
[   71.260354][    C0]  ? kernfs_dir_pos+0x327/0x440
[   71.265209][    C0]  ? kernfs_fop_readdir+0x44d/0x960
[   71.270517][    C0]  kernfs_fop_readdir+0x457/0x960
[   71.275742][    C0]  iterate_dir+0x576/0x700
[   71.280176][    C0]  __x64_sys_getdents64+0x13a/0x2a0
[   71.285489][    C0]  ? __ia32_sys_getdents+0x2a0/0x2a0
[   71.290850][    C0]  ? compat_fillonedir+0x3f0/0x3f0
[   71.296130][    C0]  ? vtime_user_exit+0xde/0x180
[   71.301064][    C0]  ? trace_user_exit.constprop.0+0x111/0x120
[   71.307195][    C0]  do_syscall_64+0x35/0xb0
[   71.311624][    C0]  entry_SYSCALL_64_after_hwframe+0x61/0xcb
[   71.317520][    C0] RIP: 0033:0x7fba21276910
[   71.322039][    C0] Code: 87 43 04 ff c8 7e 08 48 89 ef e8 4d 0e fc ff 4c 89 e0 5b 5d 41 5c c3 b8 ff ff ff 7f 48 39 c2 48 0f 47 d0 b8 d9 00 00 00 0f 05 <48> 3d 00 f0 ff ff 76 10 48 8b 15 e9 74 0f 00 f7 d8 64 89 02 48 83
[   71.342174][    C0] RSP: 002b:00007ffd60992428 EFLAGS: 00000293 ORIG_RAX: 00000000000000d9
[   71.351034][    C0] RAX: ffffffffffffffda RBX: 000055995a595a70 RCX: 00007fba21276910
[   71.359086][    C0] RDX: 0000000000008000 RSI: 000055995a595aa0 RDI: 000000000000000d
[   71.367137][    C0] RBP: 000055995a595a74 R08: 000055995a595a70 R09: 0000000002000000
[   71.375827][    C0] R10: 0000000000000812 R11: 0000000000000293 R12: 000055995a569380
[   71.384007][    C0] R13: fffffffffffffe60 R14: 0000000000000002 R15: 000055995a595aa0
[   71.392079][    C0]  </TASK>
[   71.395088][    C0] 
[   71.397488][    C0] Allocated by task 3877:
[   71.402059][    C0]  kasan_save_stack+0x1b/0x40
[   71.406835][    C0]  __kasan_kmalloc+0x7c/0x90
[   71.411571][    C0]  sk_prot_alloc+0x110/0x290
[   71.416258][    C0]  sk_alloc+0x30/0x4d0
[   71.420557][    C0]  packet_create+0x11d/0xb20
[   71.425408][    C0]  __sock_create+0x2c5/0x540
[   71.430161][    C0]  __sys_socket+0xef/0x200
[   71.434652][    C0]  __x64_sys_socket+0x6f/0xb0
[   71.439321][    C0]  do_syscall_64+0x35/0xb0
[   71.443725][    C0]  entry_SYSCALL_64_after_hwframe+0x61/0xcb
[   71.449614][    C0] 
[   71.451937][    C0] Freed by task 2641:
[   71.456019][    C0]  kasan_save_stack+0x1b/0x40
[   71.460799][    C0]  kasan_set_track+0x1c/0x30
[   71.465467][    C0]  kasan_set_free_info+0x20/0x30
[   71.470492][    C0]  __kasan_slab_free+0xe0/0x110
[   71.475396][    C0]  kfree+0xd0/0x4e0
[   71.479205][    C0]  __sk_destruct+0x5ce/0x820
[   71.483892][    C0]  sk_destruct+0xbd/0xe0
[   71.488143][    C0]  __sk_free+0xef/0x3d0
[   71.492284][    C0]  sock_wfree+0x129/0x230
[   71.496947][    C0]  ip_defrag+0x12c/0x2600
[   71.501266][    C0]  ipv4_conntrack_defrag+0x488/0x5c0
[   71.506734][    C0]  nf_hook_slow+0xc5/0x1f0
[   71.511225][    C0]  __ip_local_out+0x366/0x620
[   71.515979][    C0]  ip_local_out+0x26/0x150
[   71.520473][    C0]  ipvlan_process_v4_outbound+0x41d/0x520
[   71.526187][    C0]  ipvlan_queue_xmit+0xbaa/0xfb0
[   71.531205][    C0]  ipvlan_start_xmit+0x45/0x140
[   71.536139][    C0]  dev_hard_start_xmit+0x1c5/0x6f0
[   71.541300][    C0]  sch_direct_xmit+0x19f/0xbe0
[   71.546380][    C0]  __qdisc_run+0x4a0/0x15a0
[   71.551170][    C0]  net_tx_action+0x65f/0x930
[   71.555860][    C0]  __do_softirq+0x1fd/0x5e5
[   71.560401][    C0] 
[   71.562728][    C0] The buggy address belongs to the object at ffff88804a04e000
[   71.562728][    C0]  which belongs to the cache kmalloc-4k of size 4096
[   71.577035][    C0] The buggy address is located 18 bytes inside of
[   71.577035][    C0]  4096-byte region [ffff88804a04e000, ffff88804a04f000)
[   71.590763][    C0] The buggy address belongs to the page:
[   71.596525][    C0] page:ffffea0001281200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4a048
[   71.606752][    C0] head:ffffea0001281200 order:3 compound_mapcount:0 compound_pincount:0
[   71.615101][    C0] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[   71.623377][    C0] raw: 00fff00000010200 ffffea0001fb8200 0000000200000002 ffff88800d842140
[   71.631958][    C0] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
[   71.640531][    C0] page dumped because: kasan: bad access detected
[   71.646951][    C0] page_owner tracks the page as allocated
[   71.652646][    C0] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 3182, ts 61004505555, free_ts 60980410060
[   71.672599][    C0]  get_page_from_freelist+0x12d1/0x2d40
[   71.678232][    C0]  __alloc_pages+0x1b2/0x440
[   71.682844][    C0]  alloc_pages+0x16f/0x3d0
[   71.687244][    C0]  allocate_slab+0x2eb/0x430
[   71.691988][    C0]  ___slab_alloc+0xa4b/0xfe0
[   71.696663][    C0]  __kmalloc_node_track_caller+0x18e/0x490
[   71.702974][    C0]  __alloc_skb+0xde/0x340
[   71.707378][    C0]  nsim_dev_trap_report_work+0x2b2/0xbe0
[   71.713273][    C0]  process_one_work+0x8d5/0x12b0
[   71.718373][    C0]  worker_thread+0x552/0xf40
[   71.723255][    C0]  kthread+0x350/0x420
[   71.727586][    C0]  ret_from_fork+0x1f/0x30
[   71.732171][    C0] page last free stack trace:
[   71.737468][    C0]  free_pcp_prepare+0x379/0x850
[   71.742312][    C0]  free_unref_page+0x19/0x4b0
[   71.746993][    C0]  __unfreeze_partials+0x2b9/0x2d0
[   71.752098][    C0]  qlist_free_all+0x68/0x110
[   71.756786][    C0]  kasan_quarantine_reduce+0x180/0x1f0
[   71.762340][    C0]  __kasan_slab_alloc+0x73/0x80
[   71.767216][    C0]  kmem_cache_alloc+0x223/0x370
[   71.772065][    C0]  getname_flags.part.0+0x50/0x4f0
[   71.777189][    C0]  getname_flags+0x9a/0xe0
[   71.781594][    C0]  user_path_at_empty+0x2b/0x60
[   71.786435][    C0]  vfs_statx+0x142/0x390
[   71.790661][    C0]  __do_sys_newfstatat+0x96/0x120
[   71.795671][    C0]  do_syscall_64+0x35/0xb0
[   71.800292][    C0]  entry_SYSCALL_64_after_hwframe+0x61/0xcb
[   71.806286][    C0] 
[   71.808766][    C0] Memory state around the buggy address:
[   71.814579][    C0]  ffff88804a04df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   71.823291][    C0]  ffff88804a04df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   71.831513][    C0] >ffff88804a04e000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   71.839739][    C0]                          ^
[   71.844541][    C0]  ffff88804a04e080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   71.854058][    C0]  ffff88804a04e100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   71.863545][    C0] ==================================================================
[   71.871856][    C0] Disabling lock debugging due to kernel taint
[   71.878381][    C0] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   71.886238][    C0] Kernel Offset: disabled
[   71.890550][    C0] Rebooting in 86400 seconds..