[   41.724024][  T942] bridge0: port 1(bridge_slave_0) entered disabled state
[   41.737208][  T942] device veth1_macvtap left promiscuous mode
[   41.743355][  T942] device veth0_macvtap left promiscuous mode
[   41.749556][  T942] device veth1_vlan left promiscuous mode
[   41.755369][  T942] device veth0_vlan left promiscuous mode
[   41.828620][  T942] team0 (unregistering): Port device team_slave_1 removed
[   41.842994][  T942] team0 (unregistering): Port device team_slave_0 removed
[   41.853333][  T942] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   41.864703][  T942] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   41.894798][  T942] bond0 (unregistering): Released all slaves
Warning: Permanently added '10.128.0.61' (ECDSA) to the list of known hosts.
2023/03/04 04:34:58 ignoring optional flag "sandboxArg"="0"
2023/03/04 04:34:58 parsed 1 programs
2023/03/04 04:34:58 executed programs: 0
[   53.854803][ T4389] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   53.863528][ T4389] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   53.871221][ T4389] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   53.878688][ T4389] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[   53.886089][ T4389] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   53.981424][ T5446] chnl_net:caif_netlink_parms(): no params data found
[   54.017852][ T5446] bridge0: port 1(bridge_slave_0) entered blocking state
[   54.025048][ T5446] bridge0: port 1(bridge_slave_0) entered disabled state
[   54.033610][ T5446] device bridge_slave_0 entered promiscuous mode
[   54.041447][ T5446] bridge0: port 2(bridge_slave_1) entered blocking state
[   54.049827][ T5446] bridge0: port 2(bridge_slave_1) entered disabled state
[   54.058052][ T5446] device bridge_slave_1 entered promiscuous mode
[   54.076475][ T5446] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   54.086932][ T5446] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   54.107195][ T5446] team0: Port device team_slave_0 added
[   54.114177][ T5446] team0: Port device team_slave_1 added
[   54.130192][ T5446] batman_adv: batadv0: Adding interface: batadv_slave_0
[   54.137270][ T5446] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   54.163434][ T5446] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   54.176579][ T5446] batman_adv: batadv0: Adding interface: batadv_slave_1
[   54.183505][ T5446] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   54.209766][ T5446] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   54.236511][ T5446] device hsr_slave_0 entered promiscuous mode
[   54.243106][ T5446] device hsr_slave_1 entered promiscuous mode
[   54.604493][ T5446] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   54.613837][ T5446] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   54.623673][ T5446] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   54.632138][ T5446] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   54.649586][ T5446] bridge0: port 2(bridge_slave_1) entered blocking state
[   54.656797][ T5446] bridge0: port 2(bridge_slave_1) entered forwarding state
[   54.664097][ T5446] bridge0: port 1(bridge_slave_0) entered blocking state
[   54.671194][ T5446] bridge0: port 1(bridge_slave_0) entered forwarding state
[   54.710803][ T5446] 8021q: adding VLAN 0 to HW filter on device bond0
[   54.723064][   T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[   54.731401][   T14] bridge0: port 1(bridge_slave_0) entered disabled state
[   54.739945][   T14] bridge0: port 2(bridge_slave_1) entered disabled state
[   54.747646][   T14] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[   54.758879][ T5446] 8021q: adding VLAN 0 to HW filter on device team0
[   54.768567][   T14] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[   54.777494][   T14] bridge0: port 1(bridge_slave_0) entered blocking state
[   54.784537][   T14] bridge0: port 1(bridge_slave_0) entered forwarding state
[   54.808907][  T894] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[   54.817645][  T894] bridge0: port 2(bridge_slave_1) entered blocking state
[   54.824774][  T894] bridge0: port 2(bridge_slave_1) entered forwarding state
[   54.834018][  T894] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[   54.842721][  T894] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[   54.852107][ T5446] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[   54.863070][   T14] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[   54.965264][  T894] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[   54.973718][  T894] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[   54.984282][ T5446] 8021q: adding VLAN 0 to HW filter on device batadv0
[   55.000283][  T894] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[   55.009135][  T894] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[   55.025060][ T5446] device veth0_vlan entered promiscuous mode
[   55.032281][   T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[   55.042259][   T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[   55.053295][ T5446] device veth1_vlan entered promiscuous mode
[   55.070401][  T894] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[   55.080700][  T894] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[   55.089409][  T894] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[   55.105852][  T894] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[   55.113864][  T894] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[   55.123133][  T894] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[   55.132570][ T5446] device veth0_macvtap entered promiscuous mode
[   55.142992][ T5446] device veth1_macvtap entered promiscuous mode
[   55.156749][ T5446] batman_adv: batadv0: Interface activated: batadv_slave_0
[   55.163986][  T894] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[   55.174658][  T894] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[   55.182846][  T894] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[   55.192377][  T894] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[   55.202821][ T5446] batman_adv: batadv0: Interface activated: batadv_slave_1
[   55.215297][   T14] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[   55.224027][   T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[   55.234552][ T5446] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   55.244246][ T5446] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   55.254425][ T5446] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   55.264072][ T5446] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   55.308192][    T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   55.327039][  T942] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   55.331584][    T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   55.334893][  T942] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   55.344554][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[   55.361161][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[   55.410643][ T5553] ==================================================================
[   55.410649][ T5553] BUG: KASAN: use-after-free in fbcon_get_font+0x2f8/0x770
[   55.410659][ T5553] Write of size 16369 at addr ffff88806fb6c013 by task syz-executor.0/5553
[   55.410663][ T5553] 
[   55.410665][ T5553] CPU: 0 PID: 5553 Comm: syz-executor.0 Not tainted 6.2.0-rc4-syzkaller #0
[   55.410670][ T5553] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023
[   55.410673][ T5553] Call Trace:
[   55.410675][ T5553]  <TASK>
[   55.410678][ T5553]  dump_stack_lvl+0x5b/0x81
[   55.410685][ T5553]  print_report+0x15e/0x45d
[   55.410691][ T5553]  ? fbcon_get_font+0x2f8/0x770
[   55.410696][ T5553]  kasan_report+0xbf/0x1f0
[   55.410702][ T5553]  ? fbcon_get_font+0x2f8/0x770
[   55.410707][ T5553]  kasan_check_range+0x141/0x190
[   55.410712][ T5553]  memset+0x24/0x50
[   55.410716][ T5553]  fbcon_get_font+0x2f8/0x770
[   55.410722][ T5553]  con_font_op+0x1a8/0xd00
[   55.410730][ T5553]  ? con_write+0x30/0x30
[   55.410738][ T5553]  vt_ioctl+0x1612/0x24c0
[   55.410743][ T5553]  ? vt_waitactive+0x2e0/0x2e0
[   55.410748][ T5553]  ? tomoyo_path_number_perm+0x238/0x4b0
[   55.410758][ T5553]  tty_ioctl+0x684/0x1250
[   55.410764][ T5553]  ? tty_release+0xf40/0xf40
[   55.410770][ T5553]  ? do_futex+0x12c/0x230
[   55.410776][ T5553]  ? xfd_validate_state+0x23/0x120
[   55.410783][ T5553]  ? __fget_files+0x1bf/0x3a0
[   55.410789][ T5553]  __x64_sys_ioctl+0x123/0x190
[   55.410795][ T5553]  do_syscall_64+0x39/0xb0
[   55.410799][ T5553]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   55.410805][ T5553] RIP: 0033:0x7fcaa448c0f9
[   55.410810][ T5553] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   55.410813][ T5553] RSP: 002b:00007fcaa52a6168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[   55.410819][ T5553] RAX: ffffffffffffffda RBX: 00007fcaa45abf80 RCX: 00007fcaa448c0f9
[   55.410823][ T5553] RDX: 0000000020000000 RSI: 0000000000004b72 RDI: 0000000000000003
[   55.410825][ T5553] RBP: 00007fcaa44e7ae9 R08: 0000000000000000 R09: 0000000000000000
[   55.410828][ T5553] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   55.410831][ T5553] R13: 00007ffd4110c59f R14: 00007fcaa52a6300 R15: 0000000000022000
[   55.410837][ T5553]  </TASK>
[   55.410839][ T5553] 
[   55.410840][ T5553] The buggy address belongs to the physical page:
[   55.410842][ T5553] page:ffffea0001bed800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6fb60
[   55.410847][ T5553] head:ffffea0001bed800 order:4 compound_mapcount:0 subpages_mapcount:0 compound_pincount:0
[   55.410850][ T5553] flags: 0xfff00000010000(head|node=0|zone=1|lastcpupid=0x7ff)
[   55.410858][ T5553] raw: 00fff00000010000 0000000000000000 dead000000000122 0000000000000000
[   55.410862][ T5553] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   55.410864][ T5553] page dumped because: kasan: bad access detected
[   55.410866][ T5553] page_owner tracks the page as allocated
[   55.410868][ T5553] page last allocated via order 4, migratetype Unmovable, gfp_mask 0x140cc0(GFP_USER|__GFP_COMP), pid 5553, tgid 5552 (syz-executor.0), ts 55410633843, free_ts 6323370375
[   55.410875][ T5553]  get_page_from_freelist+0x119c/0x2ce0
[   55.410880][ T5553]  __alloc_pages+0x1cb/0x5b0
[   55.410884][ T5553]  __kmalloc_large_node+0x85/0x160
[   55.410888][ T5553]  kmalloc_large+0x1c/0x70
[   55.410892][ T5553]  con_font_op+0xf3/0xd00
[   55.410896][ T5553]  vt_ioctl+0x1612/0x24c0
[   55.410899][ T5553]  tty_ioctl+0x684/0x1250
[   55.410903][ T5553]  __x64_sys_ioctl+0x123/0x190
[   55.410906][ T5553]  do_syscall_64+0x39/0xb0
[   55.410909][ T5553]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   55.410913][ T5553] page last free stack trace:
[   55.410915][ T5553]  free_pcp_prepare+0x66a/0xc20
[   55.410918][ T5553]  free_unref_page+0x1d/0x490
[   55.410922][ T5553]  free_contig_range+0xb5/0x180
[   55.410925][ T5553]  destroy_args+0x7e/0x509
[   55.410930][ T5553]  debug_vm_pgtable+0x1ef5/0x1f79
[   55.410934][ T5553]  do_one_initcall+0xf8/0x560
[   55.410940][ T5553]  kernel_init_freeable+0x5df/0x639
[   55.410944][ T5553]  kernel_init+0x18/0x130
[   55.410948][ T5553]  ret_from_fork+0x1f/0x30
[   55.410952][ T5553] 
[   55.410953][ T5553] Memory state around the buggy address:
[   55.410956][ T5553]  ffff88806fb6ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   55.410959][ T5553]  ffff88806fb6ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   55.410961][ T5553] >ffff88806fb70000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   55.410963][ T5553]                    ^
[   55.410965][ T5553]  ffff88806fb70080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   55.410968][ T5553]  ffff88806fb70100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   55.410970][ T5553] ==================================================================
[   55.410973][ T5553] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   55.410976][ T5553] CPU: 0 PID: 5553 Comm: syz-executor.0 Not tainted 6.2.0-rc4-syzkaller #0
[   55.410980][ T5553] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023
[   55.410982][ T5553] Call Trace:
[   55.410984][ T5553]  <TASK>
[   55.410986][ T5553]  dump_stack_lvl+0x5b/0x81
[   55.410991][ T5553]  panic+0x21d/0x457
[   55.410997][ T5553]  ? panic_print_sys_info.part.0+0x6e/0x6e
[   55.411003][ T5553]  ? mark_held_locks+0x9f/0xe0
[   55.411010][ T5553]  check_panic_on_warn.cold+0x14/0x2b
[   55.411015][ T5553]  end_report.part.0+0x36/0x73
[   55.411019][ T5553]  ? fbcon_get_font+0x2f8/0x770
[   55.411022][ T5553]  kasan_report.cold+0xa/0xf
[   55.411027][ T5553]  ? fbcon_get_font+0x2f8/0x770
[   55.411032][ T5553]  kasan_check_range+0x141/0x190
[   55.411036][ T5553]  memset+0x24/0x50
[   55.411040][ T5553]  fbcon_get_font+0x2f8/0x770
[   55.411046][ T5553]  con_font_op+0x1a8/0xd00
[   55.411052][ T5553]  ? con_write+0x30/0x30
[   55.411059][ T5553]  vt_ioctl+0x1612/0x24c0
[   55.411064][ T5553]  ? vt_waitactive+0x2e0/0x2e0
[   55.411069][ T5553]  ? tomoyo_path_number_perm+0x238/0x4b0
[   55.411077][ T5553]  tty_ioctl+0x684/0x1250
[   55.411082][ T5553]  ? tty_release+0xf40/0xf40
[   55.411087][ T5553]  ? do_futex+0x12c/0x230
[   55.411091][ T5553]  ? xfd_validate_state+0x23/0x120
[   55.411097][ T5553]  ? __fget_files+0x1bf/0x3a0
[   55.411102][ T5553]  __x64_sys_ioctl+0x123/0x190
[   55.411106][ T5553]  do_syscall_64+0x39/0xb0
[   55.411110][ T5553]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   55.411114][ T5553] RIP: 0033:0x7fcaa448c0f9
[   55.411118][ T5553] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   55.411121][ T5553] RSP: 002b:00007fcaa52a6168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[   55.411125][ T5553] RAX: ffffffffffffffda RBX: 00007fcaa45abf80 RCX: 00007fcaa448c0f9
[   55.411128][ T5553] RDX: 0000000020000000 RSI: 0000000000004b72 RDI: 0000000000000003
[   55.411130][ T5553] RBP: 00007fcaa44e7ae9 R08: 0000000000000000 R09: 0000000000000000
[   55.411132][ T5553] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   55.411134][ T5553] R13: 00007ffd4110c59f R14: 00007fcaa52a6300 R15: 0000000000022000
[   55.411139][ T5553]  </TASK>
[   55.412208][ T5553] Kernel Offset: disabled
[   56.102951][ T5553] Rebooting in 86400 seconds..