[ 41.724024][ T942] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.737208][ T942] device veth1_macvtap left promiscuous mode [ 41.743355][ T942] device veth0_macvtap left promiscuous mode [ 41.749556][ T942] device veth1_vlan left promiscuous mode [ 41.755369][ T942] device veth0_vlan left promiscuous mode [ 41.828620][ T942] team0 (unregistering): Port device team_slave_1 removed [ 41.842994][ T942] team0 (unregistering): Port device team_slave_0 removed [ 41.853333][ T942] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 41.864703][ T942] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 41.894798][ T942] bond0 (unregistering): Released all slaves Warning: Permanently added '10.128.0.61' (ECDSA) to the list of known hosts. 2023/03/04 04:34:58 ignoring optional flag "sandboxArg"="0" 2023/03/04 04:34:58 parsed 1 programs 2023/03/04 04:34:58 executed programs: 0 [ 53.854803][ T4389] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 53.863528][ T4389] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 53.871221][ T4389] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 53.878688][ T4389] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 53.886089][ T4389] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 53.981424][ T5446] chnl_net:caif_netlink_parms(): no params data found [ 54.017852][ T5446] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.025048][ T5446] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.033610][ T5446] device bridge_slave_0 entered promiscuous mode [ 54.041447][ T5446] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.049827][ T5446] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.058052][ T5446] device bridge_slave_1 entered promiscuous mode [ 54.076475][ T5446] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 54.086932][ T5446] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 54.107195][ T5446] team0: Port device team_slave_0 added [ 54.114177][ T5446] team0: Port device team_slave_1 added [ 54.130192][ T5446] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 54.137270][ T5446] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 54.163434][ T5446] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 54.176579][ T5446] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 54.183505][ T5446] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 54.209766][ T5446] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 54.236511][ T5446] device hsr_slave_0 entered promiscuous mode [ 54.243106][ T5446] device hsr_slave_1 entered promiscuous mode [ 54.604493][ T5446] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 54.613837][ T5446] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 54.623673][ T5446] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 54.632138][ T5446] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 54.649586][ T5446] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.656797][ T5446] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.664097][ T5446] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.671194][ T5446] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.710803][ T5446] 8021q: adding VLAN 0 to HW filter on device bond0 [ 54.723064][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 54.731401][ T14] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.739945][ T14] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.747646][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 54.758879][ T5446] 8021q: adding VLAN 0 to HW filter on device team0 [ 54.768567][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 54.777494][ T14] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.784537][ T14] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.808907][ T894] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 54.817645][ T894] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.824774][ T894] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.834018][ T894] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 54.842721][ T894] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 54.852107][ T5446] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 54.863070][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 54.965264][ T894] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 54.973718][ T894] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 54.984282][ T5446] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 55.000283][ T894] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 55.009135][ T894] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 55.025060][ T5446] device veth0_vlan entered promiscuous mode [ 55.032281][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 55.042259][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 55.053295][ T5446] device veth1_vlan entered promiscuous mode [ 55.070401][ T894] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 55.080700][ T894] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 55.089409][ T894] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 55.105852][ T894] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 55.113864][ T894] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 55.123133][ T894] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 55.132570][ T5446] device veth0_macvtap entered promiscuous mode [ 55.142992][ T5446] device veth1_macvtap entered promiscuous mode [ 55.156749][ T5446] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 55.163986][ T894] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 55.174658][ T894] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 55.182846][ T894] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 55.192377][ T894] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 55.202821][ T5446] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 55.215297][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 55.224027][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 55.234552][ T5446] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.244246][ T5446] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.254425][ T5446] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.264072][ T5446] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.308192][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 55.327039][ T942] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 55.331584][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 55.334893][ T942] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 55.344554][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 55.361161][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 55.410643][ T5553] ================================================================== [ 55.410649][ T5553] BUG: KASAN: use-after-free in fbcon_get_font+0x2f8/0x770 [ 55.410659][ T5553] Write of size 16369 at addr ffff88806fb6c013 by task syz-executor.0/5553 [ 55.410663][ T5553] [ 55.410665][ T5553] CPU: 0 PID: 5553 Comm: syz-executor.0 Not tainted 6.2.0-rc4-syzkaller #0 [ 55.410670][ T5553] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023 [ 55.410673][ T5553] Call Trace: [ 55.410675][ T5553] [ 55.410678][ T5553] dump_stack_lvl+0x5b/0x81 [ 55.410685][ T5553] print_report+0x15e/0x45d [ 55.410691][ T5553] ? fbcon_get_font+0x2f8/0x770 [ 55.410696][ T5553] kasan_report+0xbf/0x1f0 [ 55.410702][ T5553] ? fbcon_get_font+0x2f8/0x770 [ 55.410707][ T5553] kasan_check_range+0x141/0x190 [ 55.410712][ T5553] memset+0x24/0x50 [ 55.410716][ T5553] fbcon_get_font+0x2f8/0x770 [ 55.410722][ T5553] con_font_op+0x1a8/0xd00 [ 55.410730][ T5553] ? con_write+0x30/0x30 [ 55.410738][ T5553] vt_ioctl+0x1612/0x24c0 [ 55.410743][ T5553] ? vt_waitactive+0x2e0/0x2e0 [ 55.410748][ T5553] ? tomoyo_path_number_perm+0x238/0x4b0 [ 55.410758][ T5553] tty_ioctl+0x684/0x1250 [ 55.410764][ T5553] ? tty_release+0xf40/0xf40 [ 55.410770][ T5553] ? do_futex+0x12c/0x230 [ 55.410776][ T5553] ? xfd_validate_state+0x23/0x120 [ 55.410783][ T5553] ? __fget_files+0x1bf/0x3a0 [ 55.410789][ T5553] __x64_sys_ioctl+0x123/0x190 [ 55.410795][ T5553] do_syscall_64+0x39/0xb0 [ 55.410799][ T5553] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 55.410805][ T5553] RIP: 0033:0x7fcaa448c0f9 [ 55.410810][ T5553] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 55.410813][ T5553] RSP: 002b:00007fcaa52a6168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 55.410819][ T5553] RAX: ffffffffffffffda RBX: 00007fcaa45abf80 RCX: 00007fcaa448c0f9 [ 55.410823][ T5553] RDX: 0000000020000000 RSI: 0000000000004b72 RDI: 0000000000000003 [ 55.410825][ T5553] RBP: 00007fcaa44e7ae9 R08: 0000000000000000 R09: 0000000000000000 [ 55.410828][ T5553] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 55.410831][ T5553] R13: 00007ffd4110c59f R14: 00007fcaa52a6300 R15: 0000000000022000 [ 55.410837][ T5553] [ 55.410839][ T5553] [ 55.410840][ T5553] The buggy address belongs to the physical page: [ 55.410842][ T5553] page:ffffea0001bed800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6fb60 [ 55.410847][ T5553] head:ffffea0001bed800 order:4 compound_mapcount:0 subpages_mapcount:0 compound_pincount:0 [ 55.410850][ T5553] flags: 0xfff00000010000(head|node=0|zone=1|lastcpupid=0x7ff) [ 55.410858][ T5553] raw: 00fff00000010000 0000000000000000 dead000000000122 0000000000000000 [ 55.410862][ T5553] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 55.410864][ T5553] page dumped because: kasan: bad access detected [ 55.410866][ T5553] page_owner tracks the page as allocated [ 55.410868][ T5553] page last allocated via order 4, migratetype Unmovable, gfp_mask 0x140cc0(GFP_USER|__GFP_COMP), pid 5553, tgid 5552 (syz-executor.0), ts 55410633843, free_ts 6323370375 [ 55.410875][ T5553] get_page_from_freelist+0x119c/0x2ce0 [ 55.410880][ T5553] __alloc_pages+0x1cb/0x5b0 [ 55.410884][ T5553] __kmalloc_large_node+0x85/0x160 [ 55.410888][ T5553] kmalloc_large+0x1c/0x70 [ 55.410892][ T5553] con_font_op+0xf3/0xd00 [ 55.410896][ T5553] vt_ioctl+0x1612/0x24c0 [ 55.410899][ T5553] tty_ioctl+0x684/0x1250 [ 55.410903][ T5553] __x64_sys_ioctl+0x123/0x190 [ 55.410906][ T5553] do_syscall_64+0x39/0xb0 [ 55.410909][ T5553] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 55.410913][ T5553] page last free stack trace: [ 55.410915][ T5553] free_pcp_prepare+0x66a/0xc20 [ 55.410918][ T5553] free_unref_page+0x1d/0x490 [ 55.410922][ T5553] free_contig_range+0xb5/0x180 [ 55.410925][ T5553] destroy_args+0x7e/0x509 [ 55.410930][ T5553] debug_vm_pgtable+0x1ef5/0x1f79 [ 55.410934][ T5553] do_one_initcall+0xf8/0x560 [ 55.410940][ T5553] kernel_init_freeable+0x5df/0x639 [ 55.410944][ T5553] kernel_init+0x18/0x130 [ 55.410948][ T5553] ret_from_fork+0x1f/0x30 [ 55.410952][ T5553] [ 55.410953][ T5553] Memory state around the buggy address: [ 55.410956][ T5553] ffff88806fb6ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 55.410959][ T5553] ffff88806fb6ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 55.410961][ T5553] >ffff88806fb70000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 55.410963][ T5553] ^ [ 55.410965][ T5553] ffff88806fb70080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 55.410968][ T5553] ffff88806fb70100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 55.410970][ T5553] ================================================================== [ 55.410973][ T5553] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 55.410976][ T5553] CPU: 0 PID: 5553 Comm: syz-executor.0 Not tainted 6.2.0-rc4-syzkaller #0 [ 55.410980][ T5553] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023 [ 55.410982][ T5553] Call Trace: [ 55.410984][ T5553] [ 55.410986][ T5553] dump_stack_lvl+0x5b/0x81 [ 55.410991][ T5553] panic+0x21d/0x457 [ 55.410997][ T5553] ? panic_print_sys_info.part.0+0x6e/0x6e [ 55.411003][ T5553] ? mark_held_locks+0x9f/0xe0 [ 55.411010][ T5553] check_panic_on_warn.cold+0x14/0x2b [ 55.411015][ T5553] end_report.part.0+0x36/0x73 [ 55.411019][ T5553] ? fbcon_get_font+0x2f8/0x770 [ 55.411022][ T5553] kasan_report.cold+0xa/0xf [ 55.411027][ T5553] ? fbcon_get_font+0x2f8/0x770 [ 55.411032][ T5553] kasan_check_range+0x141/0x190 [ 55.411036][ T5553] memset+0x24/0x50 [ 55.411040][ T5553] fbcon_get_font+0x2f8/0x770 [ 55.411046][ T5553] con_font_op+0x1a8/0xd00 [ 55.411052][ T5553] ? con_write+0x30/0x30 [ 55.411059][ T5553] vt_ioctl+0x1612/0x24c0 [ 55.411064][ T5553] ? vt_waitactive+0x2e0/0x2e0 [ 55.411069][ T5553] ? tomoyo_path_number_perm+0x238/0x4b0 [ 55.411077][ T5553] tty_ioctl+0x684/0x1250 [ 55.411082][ T5553] ? tty_release+0xf40/0xf40 [ 55.411087][ T5553] ? do_futex+0x12c/0x230 [ 55.411091][ T5553] ? xfd_validate_state+0x23/0x120 [ 55.411097][ T5553] ? __fget_files+0x1bf/0x3a0 [ 55.411102][ T5553] __x64_sys_ioctl+0x123/0x190 [ 55.411106][ T5553] do_syscall_64+0x39/0xb0 [ 55.411110][ T5553] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 55.411114][ T5553] RIP: 0033:0x7fcaa448c0f9 [ 55.411118][ T5553] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 55.411121][ T5553] RSP: 002b:00007fcaa52a6168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 55.411125][ T5553] RAX: ffffffffffffffda RBX: 00007fcaa45abf80 RCX: 00007fcaa448c0f9 [ 55.411128][ T5553] RDX: 0000000020000000 RSI: 0000000000004b72 RDI: 0000000000000003 [ 55.411130][ T5553] RBP: 00007fcaa44e7ae9 R08: 0000000000000000 R09: 0000000000000000 [ 55.411132][ T5553] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 55.411134][ T5553] R13: 00007ffd4110c59f R14: 00007fcaa52a6300 R15: 0000000000022000 [ 55.411139][ T5553] [ 55.412208][ T5553] Kernel Offset: disabled [ 56.102951][ T5553] Rebooting in 86400 seconds..