Warning: Permanently added '10.128.1.118' (ED25519) to the list of known hosts. 2023/10/07 01:52:47 ignoring optional flag "sandboxArg"="0" 2023/10/07 01:52:48 parsed 1 programs 2023/10/07 01:52:48 executed programs: 0 [ 46.145738][ T1914] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 46.178216][ T44] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 46.186419][ T44] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 46.194062][ T44] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 46.202088][ T44] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 46.209870][ T44] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 46.217246][ T44] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 46.354778][ T1920] chnl_net:caif_netlink_parms(): no params data found [ 47.504940][ T1920] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.276267][ T1250] Bluetooth: hci0: command 0x0409 tx timeout [ 48.350330][ T1920] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.802761][ T2323] ================================================================== [ 49.811122][ T2323] BUG: KASAN: slab-out-of-bounds in create_monitor_event+0x826/0x8d0 [ 49.819341][ T2323] Read of size 8 at addr ffff88810d66b5cf by task syz-executor.0/2323 [ 49.827468][ T2323] [ 49.829947][ T2323] CPU: 0 PID: 2323 Comm: syz-executor.0 Not tainted 6.6.0-rc1-syzkaller #0 [ 49.838502][ T2323] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 [ 49.848527][ T2323] Call Trace: [ 49.851782][ T2323] [ 49.854689][ T2323] dump_stack_lvl+0xf8/0x260 [ 49.859347][ T2323] ? nf_tcp_handle_invalid+0x300/0x300 [ 49.864790][ T2323] ? panic+0x410/0x410 [ 49.868889][ T2323] ? vprintk_emit+0x1aa/0x280 [ 49.874364][ T2323] ? _printk+0xce/0x110 [ 49.878579][ T2323] print_report+0x163/0x540 [ 49.883064][ T2323] ? create_monitor_event+0x826/0x8d0 [ 49.888409][ T2323] kasan_report+0x175/0x1b0 [ 49.892981][ T2323] ? create_monitor_event+0x826/0x8d0 [ 49.898444][ T2323] create_monitor_event+0x826/0x8d0 [ 49.903701][ T2323] send_monitor_replay+0x80/0x520 [ 49.908872][ T2323] hci_sock_bind+0x730/0xeb0 [ 49.913538][ T2323] ? hci_sock_release+0x400/0x400 [ 49.918560][ T2323] ? security_socket_bind+0x36/0x90 [ 49.923744][ T2323] __sys_bind+0x230/0x2f0 [ 49.928046][ T2323] ? __ia32_sys_socketpair+0xb0/0xb0 [ 49.933534][ T2323] ? switch_fpu_return+0xcd/0x130 [ 49.938713][ T2323] __x64_sys_bind+0x75/0x80 [ 49.943310][ T2323] do_syscall_64+0x41/0xc0 [ 49.947702][ T2323] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 49.954598][ T2323] RIP: 0033:0x7feb0087cae9 [ 49.963990][ T2323] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 49.983677][ T2323] RSP: 002b:00007feb016690c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 49.992167][ T2323] RAX: ffffffffffffffda RBX: 00007feb0099bf80 RCX: 00007feb0087cae9 [ 50.000204][ T2323] RDX: 0000000000000006 RSI: 0000000020000000 RDI: 0000000000000004 [ 50.008234][ T2323] RBP: 00007feb008c847a R08: 0000000000000000 R09: 0000000000000000 [ 50.016531][ T2323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 50.024485][ T2323] R13: 0000000000000006 R14: 00007feb0099bf80 R15: 00007fff57b31178 [ 50.032460][ T2323] [ 50.035455][ T2323] [ 50.037853][ T2323] Allocated by task 1920: [ 50.042258][ T2323] kasan_set_track+0x4f/0x70 [ 50.046997][ T2323] __kasan_kmalloc+0x98/0xb0 [ 50.051912][ T2323] __kmalloc_node_track_caller+0xab/0x1c0 [ 50.057894][ T2323] kvasprintf_const+0xff/0x280 [ 50.062894][ T2323] kobject_set_name_vargs+0x5a/0xf0 [ 50.068068][ T2323] dev_set_name+0xd0/0x120 [ 50.072718][ T2323] hci_register_dev+0x10b/0x820 [ 50.077734][ T2323] vhci_create_device+0x336/0x670 [ 50.082734][ T2323] vhci_write+0x2cc/0x3c0 [ 50.087043][ T2323] vfs_write+0x65b/0xcf0 [ 50.091260][ T2323] ksys_write+0x163/0x250 [ 50.095648][ T2323] do_syscall_64+0x41/0xc0 [ 50.100394][ T2323] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 50.106266][ T2323] [ 50.108601][ T2323] The buggy address belongs to the object at ffff88810d66b5c8 [ 50.108601][ T2323] which belongs to the cache kmalloc-8 of size 8 [ 50.122544][ T2323] The buggy address is located 2 bytes to the right of [ 50.122544][ T2323] allocated 5-byte region [ffff88810d66b5c8, ffff88810d66b5cd) [ 50.137893][ T2323] [ 50.140202][ T2323] The buggy address belongs to the physical page: [ 50.146601][ T2323] page:ffffea0004359ac0 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88810d66b7a8 pfn:0x10d66b [ 50.158211][ T2323] anon flags: 0x100000000000800(slab|node=0|zone=2) [ 50.164770][ T2323] page_type: 0xffffffff() [ 50.169180][ T2323] raw: 0100000000000800 ffff888100041280 0000000000000000 dead000000000001 [ 50.177827][ T2323] raw: ffff88810d66b7a8 0000000080660036 00000001ffffffff 0000000000000000 [ 50.186388][ T2323] page dumped because: kasan: bad access detected [ 50.192871][ T2323] page_owner tracks the page as allocated [ 50.198752][ T2323] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 2902305990, free_ts 0 [ 50.215939][ T2323] post_alloc_hook+0x26e/0x290 [ 50.221210][ T2323] get_page_from_freelist+0x3baa/0x3da0 [ 50.226825][ T2323] __alloc_pages+0x255/0x650 [ 50.231487][ T2323] alloc_page_interleave+0xf/0x130 [ 50.236652][ T2323] alloc_slab_page+0x6a/0x160 [ 50.241493][ T2323] new_slab+0x70/0x260 [ 50.245645][ T2323] ___slab_alloc+0x833/0xd50 [ 50.250226][ T2323] __kmem_cache_alloc_node+0x1a6/0x260 [ 50.256101][ T2323] __kmalloc+0x99/0x1d0 [ 50.260245][ T2323] acpi_ns_internalize_name+0x39c/0x5a0 [ 50.265886][ T2323] acpi_ns_get_node+0x145/0x370 [ 50.270733][ T2323] acpi_ns_evaluate+0x348/0x8c0 [ 50.275752][ T2323] acpi_evaluate_object+0x4d4/0x8e0 [ 50.281038][ T2323] acpi_evaluate_integer+0x112/0x290 [ 50.286580][ T2323] acpi_get_node+0xf0/0x200 [ 50.291171][ T2323] pci_acpi_scan_root+0xa2/0x570 [ 50.296188][ T2323] page_owner free stack trace missing [ 50.301622][ T2323] [ 50.303922][ T2323] Memory state around the buggy address: [ 50.309523][ T2323] ffff88810d66b480: fc fa fc fc fc fc fa fc fc fc fc fa fc fc fc fc [ 50.317553][ T2323] ffff88810d66b500: 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc 05 [ 50.325583][ T2323] >ffff88810d66b580: fc fc fc fc 05 fc fc fc fc 05 fc fc fc fc fa fc [ 50.333636][ T2323] ^ [ 50.340118][ T2323] ffff88810d66b600: fc fc fc fa fc fc fc fc fa fc fc fc fc 00 fc fc [ 50.348154][ T2323] ffff88810d66b680: fc fc 00 fc fc fc fc 00 fc fc fc fc fb fc fc fc [ 50.356249][ T1250] Bluetooth: hci0: command 0x041b tx timeout [ 50.356542][ T2323] ================================================================== [ 50.356785][ T2323] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 50.364127][ T2323] Kernel Offset: disabled