Warning: Permanently added '10.128.1.20' (ED25519) to the list of known hosts. 2024/07/29 21:50:40 ignoring optional flag "sandboxArg"="0" 2024/07/29 21:50:41 parsed 1 programs [ 47.806226][ T24] kauditd_printk_skb: 18 callbacks suppressed [ 47.806239][ T24] audit: type=1400 audit(1722289841.150:94): avc: denied { mount } for pid=342 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 2024/07/29 21:50:41 executed programs: 0 [ 47.838546][ T24] audit: type=1400 audit(1722289841.180:95): avc: denied { unlink } for pid=342 comm="syz-executor" name="swap-file" dev="sda1" ino=1930 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 47.881357][ T342] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 48.030007][ T353] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.037092][ T353] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.044652][ T353] device bridge_slave_0 entered promiscuous mode [ 48.052401][ T353] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.059769][ T353] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.067651][ T353] device bridge_slave_1 entered promiscuous mode [ 48.116649][ T356] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.123973][ T356] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.131756][ T356] device bridge_slave_0 entered promiscuous mode [ 48.138971][ T356] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.145873][ T356] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.153460][ T356] device bridge_slave_1 entered promiscuous mode [ 48.186119][ T358] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.193212][ T358] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.200401][ T358] device bridge_slave_0 entered promiscuous mode [ 48.209550][ T358] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.216416][ T358] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.223833][ T358] device bridge_slave_1 entered promiscuous mode [ 48.275431][ T359] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.282806][ T359] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.290733][ T359] device bridge_slave_0 entered promiscuous mode [ 48.300086][ T359] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.306951][ T359] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.314218][ T359] device bridge_slave_1 entered promiscuous mode [ 48.333536][ T357] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.340385][ T357] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.347845][ T357] device bridge_slave_0 entered promiscuous mode [ 48.356491][ T357] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.363452][ T357] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.370768][ T357] device bridge_slave_1 entered promiscuous mode [ 48.433975][ T353] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.441566][ T353] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.450479][ T353] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.458032][ T353] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.469847][ T356] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.477148][ T356] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.485350][ T356] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.492480][ T356] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.549502][ T358] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.556945][ T358] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.564028][ T358] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.570881][ T358] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.607226][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 48.615943][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 48.624870][ T25] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.632283][ T25] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.640269][ T25] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.647617][ T25] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.655932][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 48.663360][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 48.704920][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 48.713097][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 48.721922][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 48.731631][ T25] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.738668][ T25] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.746089][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 48.755003][ T25] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.762064][ T25] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.769500][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 48.778808][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 48.787780][ T25] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.795081][ T25] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.803246][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 48.811479][ T25] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.818369][ T25] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.826318][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 48.834444][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 48.853579][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 48.861188][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 48.869147][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 48.885228][ T353] device veth0_vlan entered promiscuous mode [ 48.895431][ T15] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 48.905764][ T15] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 48.914807][ T15] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 48.924844][ T15] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 48.932276][ T15] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 48.946305][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 48.954457][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 48.962730][ T303] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.970169][ T303] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.977473][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 48.985738][ T303] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.993178][ T303] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.000477][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 49.012729][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 49.026062][ T353] device veth1_macvtap entered promiscuous mode [ 49.037503][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 49.046648][ T303] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.055258][ T303] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.063879][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 49.072096][ T303] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.079970][ T303] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.088243][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 49.114365][ T375] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 49.122970][ T375] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 49.134896][ T375] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 49.143501][ T375] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 49.152069][ T375] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 49.160139][ T375] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 49.168200][ T375] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 49.176731][ T375] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 49.185975][ T375] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 49.194621][ T375] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 49.203416][ T375] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 49.211330][ T375] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 49.219816][ T375] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 49.227767][ T375] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 49.235895][ T375] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 49.243306][ T375] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 49.251959][ T358] device veth0_vlan entered promiscuous mode [ 49.267542][ T15] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 49.276201][ T15] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 49.285591][ T15] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 49.294229][ T15] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 49.302986][ T15] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 49.311229][ T15] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 49.326254][ T356] device veth0_vlan entered promiscuous mode [ 49.332943][ T358] device veth1_macvtap entered promiscuous mode [ 49.341755][ T15] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 49.350402][ T15] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 49.358416][ T15] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 49.366019][ T15] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 49.373950][ T15] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 49.381916][ T15] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 49.389932][ T15] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 49.398335][ T15] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 49.405689][ T15] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 49.413362][ T15] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 49.420820][ T15] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 49.431396][ T359] device veth0_vlan entered promiscuous mode [ 49.448375][ T357] device veth0_vlan entered promiscuous mode [ 49.456108][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 49.464965][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 49.473681][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 49.482264][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 49.491287][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 49.500234][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 49.509916][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 49.519117][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 49.528331][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 49.536608][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 49.552566][ T24] audit: type=1400 audit(1722289842.890:96): avc: denied { mounton } for pid=353 comm="syz-executor.0" path="/dev/binderfs" dev="devtmpfs" ino=357 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 49.566319][ T357] device veth1_macvtap entered promiscuous mode [ 49.591545][ T24] audit: type=1400 audit(1722289842.930:97): avc: denied { create } for pid=379 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 49.595288][ T356] device veth1_macvtap entered promiscuous mode [ 49.614889][ T24] audit: type=1400 audit(1722289842.930:98): avc: denied { bind } for pid=379 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 49.640369][ T24] audit: type=1400 audit(1722289842.930:99): avc: denied { listen } for pid=379 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 49.660621][ T24] audit: type=1400 audit(1722289842.930:100): avc: denied { connect } for pid=379 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 49.662939][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 49.691162][ T24] audit: type=1400 audit(1722289843.000:101): avc: denied { read } for pid=76 comm="syslogd" name="log" dev="sda1" ino=1915 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 49.693408][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 49.726516][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 49.740982][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 49.750811][ T303] ================================================================== [ 49.760506][ T303] BUG: KASAN: use-after-free in _raw_spin_lock_bh+0x97/0x1b0 [ 49.760606][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 49.769346][ T303] Write of size 4 at addr ffff88810e9dad08 by task kworker/0:3/303 [ 49.769350][ T303] [ 49.769450][ T303] CPU: 0 PID: 303 Comm: kworker/0:3 Not tainted 5.10.222-syzkaller-1003210-gfd58936f3c1f #0 [ 49.769543][ T303] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 49.769562][ T303] Workqueue: vsock-loopback vsock_loopback_work [ 49.769704][ T303] Call Trace: [ 49.769725][ T303] dump_stack_lvl+0x1e2/0x24b [ 49.769738][ T303] ? bfq_pos_tree_add_move+0x43b/0x43b [ 49.769748][ T303] ? panic+0x812/0x812 [ 49.769771][ T303] print_address_description+0x81/0x3b0 [ 49.799597][ T25] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 49.810196][ T303] ? __kasan_check_write+0x14/0x20 [ 49.810209][ T303] kasan_report+0x179/0x1c0 [ 49.810223][ T303] ? _raw_spin_lock_bh+0x97/0x1b0 [ 49.810234][ T303] ? _raw_spin_lock_bh+0x97/0x1b0 [ 49.810244][ T303] kasan_check_range+0x293/0x2a0 [ 49.810255][ T303] __kasan_check_write+0x14/0x20 [ 49.810277][ T303] _raw_spin_lock_bh+0x97/0x1b0 [ 49.895678][ T303] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 49.901669][ T303] ? vsock_find_bound_socket+0x2d0/0x330 [ 49.907295][ T303] virtio_transport_recv_pkt+0x665/0x4130 [ 49.913732][ T303] ? _raw_spin_lock_irq+0x1b0/0x1b0 [ 49.918939][ T303] ? virtio_transport_release+0xc00/0xc00 [ 49.924489][ T303] ? _raw_spin_unlock_bh+0x51/0x60 [ 49.929718][ T303] ? wg_packet_decrypt_worker+0xd08/0xda0 [ 49.935472][ T303] ? __kasan_check_write+0x14/0x20 [ 49.941119][ T303] ? calc_wheel_index+0x296/0xa40 [ 49.947058][ T303] ? wg_packet_rx_poll+0x1b40/0x1b40 [ 49.952330][ T303] ? __update_load_avg_cfs_rq+0xb1/0x2f0 [ 49.958678][ T303] ? __update_load_avg_cfs_rq+0xb1/0x2f0 [ 49.964387][ T303] ? __kasan_check_write+0x14/0x20 [ 49.969349][ T303] ? __switch_to+0x5f6/0x1240 [ 49.974187][ T303] ? sched_clock+0x3a/0x40 [ 49.978975][ T303] ? __kasan_check_write+0x14/0x20 [ 49.984174][ T303] ? virtio_transport_deliver_tap_pkt+0xb0/0xb0 [ 49.990721][ T303] ? virtio_transport_deliver_tap_pkt+0x60/0xb0 [ 49.997886][ T303] vsock_loopback_work+0x37d/0x3f0 [ 50.003706][ T303] ? switch_mm_irqs_off+0x33c/0x9a0 [ 50.008996][ T303] ? vsock_loopback_send_pkt+0x120/0x120 [ 50.015251][ T303] ? read_word_at_a_time+0x12/0x20 [ 50.020646][ T303] ? strscpy+0x9c/0x260 [ 50.024865][ T303] process_one_work+0x6dc/0xbd0 [ 50.029908][ T303] worker_thread+0xaea/0x1510 [ 50.035145][ T303] ? _raw_spin_lock+0x1b0/0x1b0 [ 50.040716][ T303] ? __kasan_check_read+0x11/0x20 [ 50.045838][ T303] kthread+0x34b/0x3d0 [ 50.050244][ T303] ? worker_clr_flags+0x180/0x180 [ 50.055288][ T303] ? kthread_blkcg+0xd0/0xd0 [ 50.059780][ T303] ret_from_fork+0x1f/0x30 [ 50.067292][ T303] [ 50.069861][ T303] Allocated by task 380: [ 50.076515][ T303] ____kasan_kmalloc+0xdb/0x110 [ 50.081769][ T303] __kasan_kmalloc+0x9/0x10 [ 50.087667][ T303] kmem_cache_alloc_trace+0x18a/0x2e0 [ 50.094525][ T303] virtio_transport_do_socket_init+0x56/0x2d0 [ 50.100896][ T303] vsock_assign_transport+0x324/0x3f0 [ 50.107287][ T303] vsock_stream_connect+0x5cf/0xd30 [ 50.113392][ T303] __sys_connect+0x388/0x410 [ 50.118952][ T303] __x64_sys_connect+0x7a/0x90 [ 50.123941][ T303] do_syscall_64+0x34/0x70 [ 50.128475][ T303] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 50.134875][ T303] [ 50.138177][ T303] Freed by task 382: [ 50.142647][ T303] kasan_set_track+0x4b/0x70 [ 50.147663][ T303] kasan_set_free_info+0x23/0x40 [ 50.152963][ T303] ____kasan_slab_free+0x121/0x160 [ 50.158263][ T303] __kasan_slab_free+0x11/0x20 [ 50.163377][ T303] slab_free_freelist_hook+0xc0/0x190 [ 50.170297][ T303] kfree+0xc3/0x270 [ 50.175036][ T303] virtio_transport_destruct+0x3b/0x40 [ 50.181493][ T303] vsock_assign_transport+0x266/0x3f0 [ 50.188611][ T303] vsock_stream_connect+0x5cf/0xd30 [ 50.195918][ T303] __sys_connect+0x388/0x410 [ 50.201420][ T303] __x64_sys_connect+0x7a/0x90 [ 50.207349][ T303] do_syscall_64+0x34/0x70 [ 50.213175][ T303] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 50.219940][ T303] [ 50.222164][ T303] The buggy address belongs to the object at ffff88810e9dad00 [ 50.222164][ T303] which belongs to the cache kmalloc-64 of size 64 [ 50.239136][ T303] The buggy address is located 8 bytes inside of [ 50.239136][ T303] 64-byte region [ffff88810e9dad00, ffff88810e9dad40) [ 50.257857][ T303] The buggy address belongs to the page: [ 50.264460][ T303] page:ffffea00043a7680 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10e9da [ 50.276095][ T303] flags: 0x4000000000000200(slab) [ 50.281919][ T303] raw: 4000000000000200 dead000000000100 dead000000000122 ffff888100043800 [ 50.292342][ T303] raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 [ 50.302314][ T303] page dumped because: kasan: bad access detected [ 50.309151][ T303] page_owner tracks the page as allocated [ 50.315966][ T303] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 357, ts 49562409151, free_ts 49219541729 [ 50.332746][ T303] prep_new_page+0x166/0x180 [ 50.337155][ T303] get_page_from_freelist+0x2d8c/0x2f30 [ 50.342641][ T303] __alloc_pages_nodemask+0x435/0xaf0 [ 50.348451][ T303] new_slab+0x80/0x400 [ 50.352532][ T303] ___slab_alloc+0x302/0x4b0 [ 50.357508][ T303] __slab_alloc+0x63/0xa0 [ 50.362019][ T303] __kmalloc+0x204/0x330 [ 50.366405][ T303] resize+0xa47/0x25c0 [ 50.370735][ T303] fib_insert_alias+0xaab/0xf80 [ 50.375910][ T303] fib_table_insert+0x82c/0x1eb0 [ 50.382342][ T303] fib_add_ifaddr+0x42c/0x1a40 [ 50.387570][ T303] fib_inetaddr_event+0x159/0x310 [ 50.392911][ T303] blocking_notifier_call_chain+0xbb/0x140 [ 50.398811][ T303] __inet_insert_ifa+0x906/0xb50 [ 50.403757][ T303] inet_rtm_newaddr+0x8f5/0x16c0 [ 50.408538][ T303] rtnetlink_rcv_msg+0x955/0xc50 [ 50.413304][ T303] page last free stack trace: [ 50.418380][ T303] __free_pages_ok+0x82c/0x850 [ 50.423330][ T303] free_the_page+0x76/0x370 [ 50.428058][ T303] __free_pages+0x67/0xc0 [ 50.432554][ T303] __free_slab+0xcf/0x190 [ 50.437264][ T303] unfreeze_partials+0x15e/0x190 [ 50.442348][ T303] put_cpu_partial+0xbf/0x180 [ 50.447111][ T303] __slab_free+0x2c8/0x3a0 [ 50.451520][ T303] ___cache_free+0x111/0x130 [ 50.456546][ T303] qlink_free+0x50/0x90 [ 50.461414][ T303] qlist_free_all+0x47/0xb0 [ 50.465785][ T303] kasan_quarantine_reduce+0x15a/0x170 [ 50.472423][ T303] __kasan_slab_alloc+0x2f/0xe0 [ 50.478609][ T303] slab_post_alloc_hook+0x61/0x2f0 [ 50.485112][ T303] kmem_cache_alloc+0x168/0x2e0 [ 50.490668][ T303] __alloc_skb+0x80/0x510 [ 50.495844][ T303] rtmsg_ifinfo_build_skb+0x7f/0x180 [ 50.501086][ T303] [ 50.503296][ T303] Memory state around the buggy address: [ 50.509606][ T303] ffff88810e9dac00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 50.519584][ T303] ffff88810e9dac80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 50.528566][ T303] >ffff88810e9dad00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 50.538159][ T303] ^ [ 50.543458][ T303] ffff88810e9dad80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 50.552130][ T303] ffff88810e9dae00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 50.560604][ T303] ================================================================== [ 50.569445][ T303] Disabling lock debugging due to kernel taint