Warning: Permanently added '10.128.1.177' (ED25519) to the list of known hosts.
[+] Successfully opened /dev/tty63.
[+] Successfully mapped KEY_SCROLLLOCK to K_HOLD.
[+] Successfully activated VT 63.
[+] Successfully waited for VT 63.
[+] Successfully opened /dev/uinput.
[+] Successfully configured uinput bits.
[ 153.897522][ T5943] input: syz-repro as /devices/virtual/input/input5
[+] Successfully created uinput device.
[+] Successfully started threads. Racing for 10 seconds...
[ 154.158178][ T5958] ==================================================================
[ 154.158199][ T5958] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0x40/0x60
[ 154.158251][ T5958] Read of size 1 at addr ffff88803add6418 by task syz-executor294/5958
[ 154.158271][ T5958]
[ 154.158303][ T5958] CPU: 0 UID: 0 PID: 5958 Comm: syz-executor294 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
[ 154.158334][ T5958] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
[ 154.158355][ T5958] Call Trace:
[ 154.158364][ T5958]
[ 154.158374][ T5958] dump_stack_lvl+0xe8/0x150
[ 154.158409][ T5958] print_address_description+0x55/0x1e0
[ 154.158444][ T5958] ? _raw_spin_lock_irqsave+0x40/0x60
[ 154.158474][ T5958] print_report+0x58/0x70
[ 154.158517][ T5958] kasan_report+0x117/0x150
[ 154.158542][ T5958] ? __pfx___schedule+0x10/0x10
[ 154.158571][ T5958] ? _raw_spin_lock_irqsave+0x40/0x60
[ 154.158608][ T5958] __kasan_check_byte+0x2a/0x40
[ 154.158631][ T5958] lock_acquire+0x7d/0x350
[ 154.158666][ T5958] ? rcu_is_watching+0x16/0xb0
[ 154.158689][ T5958] _raw_spin_lock_irqsave+0x40/0x60
[ 154.158721][ T5958] ? rt_mutex_slowunlock+0xbf/0xa30
[ 154.158747][ T5958] rt_mutex_slowunlock+0xbf/0xa30
[ 154.158776][ T5958] ? reacquire_held_locks+0x117/0x1a0
[ 154.158811][ T5958] ? __pfx_rt_mutex_slowunlock+0x10/0x10
[ 154.158842][ T5958] ? kbd_event+0x2e8d/0x41f0
[ 154.158884][ T5958] rt_spin_unlock+0x10f/0x200
[ 154.158911][ T5958] kbd_event+0x2e8d/0x41f0
[ 154.158946][ T5958] ? blake2s_compress+0x1a80/0x1c00
[ 154.158979][ T5958] ? __pfx_kbd_event+0x10/0x10
[ 154.159012][ T5958] ? try_to_take_rt_mutex+0x842/0xb00
[ 154.159046][ T5958] ? rtlock_slowlock_locked+0xfb/0x3c20
[ 154.159073][ T5958] ? __lock_acquire+0x747/0x2de0
[ 154.159106][ T5958] ? __lock_acquire+0x747/0x2de0
[ 154.159144][ T5958] ? do_raw_spin_lock+0x12b/0x2f0
[ 154.159173][ T5958] ? lock_acquire+0x115/0x350
[ 154.159207][ T5958] input_handle_events_default+0xd4/0x1a0
[ 154.159237][ T5958] ? input_pass_values+0x8d/0x890
[ 154.159258][ T5958] input_pass_values+0x288/0x890
[ 154.159282][ T5958] ? input_handle_event+0x6fd/0xf10
[ 154.159315][ T5958] input_event_dispose+0x35f/0x700
[ 154.159348][ T5958] input_event+0x87/0xb0
[ 154.159379][ T5958] uinput_write+0x3be/0xfe0
[ 154.159412][ T5958] ? __pfx_uinput_write+0x10/0x10
[ 154.159441][ T5958] ? bpf_lsm_file_permission+0x9/0x20
[ 154.159470][ T5958] ? security_file_permission+0x75/0x260
[ 154.159514][ T5958] ? rw_verify_area+0x209/0x4d0
[ 154.159545][ T5958] ? __pfx_uinput_write+0x10/0x10
[ 154.159571][ T5958] vfs_write+0x29f/0xbb0
[ 154.159605][ T5958] ? __pfx_vfs_write+0x10/0x10
[ 154.159635][ T5958] ? __fget_files+0x2a/0x420
[ 154.159664][ T5958] ? __fget_files+0x2a/0x420
[ 154.159690][ T5958] ? __fget_files+0x3a8/0x420
[ 154.159716][ T5958] ? __fget_files+0x2a/0x420
[ 154.159749][ T5958] ksys_write+0x156/0x270
[ 154.159780][ T5958] ? __pfx_ksys_write+0x10/0x10
[ 154.159817][ T5958] do_syscall_64+0x166/0x520
[ 154.159848][ T5958] ? trace_irq_disable+0x3b/0x140
[ 154.159880][ T5958] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 154.159904][ T5958] ? clear_bhb_loop+0x70/0xc0
[ 154.159930][ T5958] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 154.159953][ T5958] RIP: 0033:0x7f89c05f325e
[ 154.159986][ T5958] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 154.160006][ T5958] RSP: 002b:00007f89bf59b168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 154.160031][ T5958] RAX: ffffffffffffffda RBX: 00007f89bf59b6c0 RCX: 00007f89c05f325e
[ 154.160049][ T5958] RDX: 0000000000000030 RSI: 00007f89bf59b1d0 RDI: 0000000000000003
[ 154.160064][ T5958] RBP: 0000000100460001 R08: 0000000000000000 R09: 0000000000000000
[ 154.160079][ T5958] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 154.160094][ T5958] R13: 0000000000000000 R14: 00007fffcefcd4c0 R15: 00007fffcefcd5a8
[ 154.160121][ T5958]
[ 154.160130][ T5958]
[ 154.160135][ T5958] Allocated by task 5963:
[ 154.160147][ T5958] kasan_save_track+0x3e/0x80
[ 154.160179][ T5958] __kasan_kmalloc+0x93/0xb0
[ 154.160198][ T5958] __kmalloc_cache_noprof+0x3d5/0x680
[ 154.160231][ T5958] alloc_tty_struct+0xa6/0x7c0
[ 154.160258][ T5958] tty_init_dev+0x59/0x4d0
[ 154.160286][ T5958] tty_open+0x7e5/0xcd0
[ 154.160304][ T5958] chrdev_open+0x4dc/0x600
[ 154.160321][ T5958] do_dentry_open+0x849/0x1420
[ 154.160342][ T5958] vfs_open+0x3b/0x350
[ 154.160360][ T5958] path_openat+0x1448/0x1d60
[ 154.160390][ T5958] do_file_open+0x23e/0x4a0
[ 154.160419][ T5958] do_sys_openat2+0x115/0x200
[ 154.160441][ T5958] __x64_sys_openat+0x138/0x170
[ 154.160461][ T5958] do_syscall_64+0x166/0x520
[ 154.160497][ T5958] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 154.160518][ T5958]
[ 154.160524][ T5958] Freed by task 5683:
[ 154.160534][ T5958] kasan_save_track+0x3e/0x80
[ 154.160566][ T5958] kasan_save_free_info+0x40/0x50
[ 154.160591][ T5958] __kasan_slab_free+0x5c/0x80
[ 154.160609][ T5958] kfree+0x1c5/0x6d0
[ 154.160635][ T5958] process_scheduled_works+0xc3d/0x1630
[ 154.160663][ T5958] worker_thread+0xa47/0xfb0
[ 154.160691][ T5958] kthread+0x38b/0x470
[ 154.160711][ T5958] ret_from_fork+0x514/0xb70
[ 154.160730][ T5958] ret_from_fork_asm+0x1a/0x30
[ 154.160750][ T5958]
[ 154.160756][ T5958] Last potentially related work creation:
[ 154.160763][ T5958] kasan_save_stack+0x3e/0x60
[ 154.160793][ T5958] kasan_record_aux_stack+0xbd/0xd0
[ 154.160819][ T5958] insert_work+0x3d/0x330
[ 154.160845][ T5958] __queue_work+0xd4e/0x1130
[ 154.160873][ T5958] queue_work_on+0x106/0x1d0
[ 154.160902][ T5958] tty_release_struct+0xb8/0xd0
[ 154.160929][ T5958] tty_release+0xc6b/0x1680
[ 154.160955][ T5958] __fput+0x41f/0xa80
[ 154.160975][ T5958] fput_close_sync+0x11f/0x240
[ 154.160998][ T5958] __x64_sys_close+0x7e/0x110
[ 154.161020][ T5958] do_syscall_64+0x166/0x520
[ 154.161048][ T5958] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 154.161067][ T5958]
[ 154.161072][ T5958] The buggy address belongs to the object at ffff88803add6000
[ 154.161072][ T5958] which belongs to the cache kmalloc-cg-4k of size 4096
[ 154.161090][ T5958] The buggy address is located 1048 bytes inside of
[ 154.161090][ T5958] freed 4096-byte region [ffff88803add6000, ffff88803add7000)
[ 154.161111][ T5958]
[ 154.161117][ T5958] The buggy address belongs to the physical page:
[ 154.161143][ T5958] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803add4000 pfn:0x3add0
[ 154.161170][ T5958] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 154.161188][ T5958] flags: 0x80000000000240(workingset|head|node=0|zone=1)
[ 154.161216][ T5958] page_type: f5(slab)
[ 154.161237][ T5958] raw: 0080000000000240 ffff88813ff08500 ffffea0000e8de10 ffffea0000e29410
[ 154.161257][ T5958] raw: ffff88803add4000 0000000200040002 00000000f5000000 0000000000000000
[ 154.161278][ T5958] head: 0080000000000240 ffff88813ff08500 ffffea0000e8de10 ffffea0000e29410
[ 154.161298][ T5958] head: ffff88803add4000 0000000200040002 00000000f5000000 0000000000000000
[ 154.161318][ T5958] head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 154.161337][ T5958] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008
[ 154.161349][ T5958] page dumped because: kasan: bad access detected
[ 154.161364][ T5958] page_owner tracks the page as allocated
[ 154.161373][ T5958] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5619, tgid 5619 (syz-executor), ts 114770219331
[ 154.161409][ T5958] post_alloc_hook+0x1f9/0x250
[ 154.161439][ T5958] get_page_from_freelist+0x2591/0x2600
[ 154.161461][ T5958] __alloc_frozen_pages_noprof+0x230/0x5c0
[ 154.161481][ T5958] allocate_slab+0x7d/0x620
[ 154.161516][ T5958] refill_objects+0x2d8/0x350
[ 154.161541][ T5958] __pcs_replace_empty_main+0x339/0x690
[ 154.161566][ T5958] __kmalloc_noprof+0x54b/0x790
[ 154.161595][ T5958] __register_sysctl_table+0x6f/0x1370
[ 154.161627][ T5958] __addrconf_sysctl_register+0x31c/0x4b0
[ 154.161662][ T5958] addrconf_sysctl_register+0x168/0x1c0
[ 154.161682][ T5958] ipv6_add_dev+0xd64/0x1400
[ 154.161709][ T5958] addrconf_notify+0x771/0x1050
[ 154.161727][ T5958] notifier_call_chain+0x1a5/0x3d0
[ 154.161747][ T5958] register_netdevice+0x18c0/0x1ed0
[ 154.161778][ T5958] register_netdev+0x40/0x60
[ 154.161807][ T5958] ip6_tnl_init_net+0x259/0x3b0
[ 154.161830][ T5958] page last free pid 5618 tgid 5618 ts 114636921269 stack trace:
[ 154.161846][ T5958] __free_frozen_pages+0xf8e/0x1070
[ 154.161876][ T5958] __slab_free+0x250/0x2a0
[ 154.161894][ T5958] qlist_free_all+0x99/0x100
[ 154.161924][ T5958] kasan_quarantine_reduce+0x148/0x160
[ 154.161955][ T5958] __kasan_slab_alloc+0x22/0x80
[ 154.161974][ T5958] __kmalloc_noprof+0x3b9/0x790
[ 154.162005][ T5958] ops_init+0x7b/0x5d0
[ 154.162028][ T5958] setup_net+0x118/0x350
[ 154.162049][ T5958] copy_net_ns+0x53b/0x780
[ 154.162069][ T5958] create_new_namespaces+0x3f0/0x6b0
[ 154.162098][ T5958] unshare_nsproxy_namespaces+0x149/0x190
[ 154.162128][ T5958] ksys_unshare+0x5d8/0x970
[ 154.162159][ T5958] __x64_sys_unshare+0x38/0x50
[ 154.162191][ T5958] do_syscall_64+0x166/0x520
[ 154.162221][ T5958] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 154.162242][ T5958]
[ 154.162248][ T5958] Memory state around the buggy address:
[ 154.162260][ T5958] ffff88803add6300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 154.162275][ T5958] ffff88803add6380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 154.162289][ T5958] >ffff88803add6400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 154.162301][ T5958] ^
[ 154.162313][ T5958] ffff88803add6480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 154.162335][ T5958] ffff88803add6500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 154.162346][ T5958] ==================================================================
[ 154.162370][ T5958] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 155.148312][ T5958] CPU: 0 UID: 0 PID: 5958 Comm: syz-executor294 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
[ 155.159143][ T5958] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
[ 155.169618][ T5958] Call Trace:
[ 155.173029][ T5958]
[ 155.176005][ T5958] vpanic+0x56d/0xa60
[ 155.180087][ T5958] ? __pfx_vpanic+0x10/0x10
[ 155.184833][ T5958] panic+0xc5/0xd0
[ 155.188785][ T5958] ? __pfx_panic+0x10/0x10
[ 155.193343][ T5958] ? _raw_spin_lock_irqsave+0x40/0x60
[ 155.199143][ T5958] ? rcu_is_watching+0x16/0xb0
[ 155.204052][ T5958] ? _raw_spin_lock_irqsave+0x40/0x60
[ 155.210011][ T5958] ? _raw_spin_lock_irqsave+0x40/0x60
[ 155.215529][ T5958] check_panic_on_warn+0x89/0xb0
[ 155.220594][ T5958] ? _raw_spin_lock_irqsave+0x40/0x60
[ 155.226037][ T5958] end_report+0x73/0x170
[ 155.230338][ T5958] ? _raw_spin_lock_irqsave+0x40/0x60
[ 155.235957][ T5958] kasan_report+0x128/0x150
[ 155.240510][ T5958] ? __pfx___schedule+0x10/0x10
[ 155.245518][ T5958] ? _raw_spin_lock_irqsave+0x40/0x60
[ 155.251217][ T5958] __kasan_check_byte+0x2a/0x40
[ 155.256135][ T5958] lock_acquire+0x7d/0x350
[ 155.260613][ T5958] ? rcu_is_watching+0x16/0xb0
[ 155.266172][ T5958] _raw_spin_lock_irqsave+0x40/0x60
[ 155.272138][ T5958] ? rt_mutex_slowunlock+0xbf/0xa30
[ 155.277670][ T5958] rt_mutex_slowunlock+0xbf/0xa30
[ 155.282924][ T5958] ? reacquire_held_locks+0x117/0x1a0
[ 155.288541][ T5958] ? __pfx_rt_mutex_slowunlock+0x10/0x10
[ 155.294323][ T5958] ? kbd_event+0x2e8d/0x41f0
[ 155.299097][ T5958] rt_spin_unlock+0x10f/0x200
[ 155.303833][ T5958] kbd_event+0x2e8d/0x41f0
[ 155.308391][ T5958] ? blake2s_compress+0x1a80/0x1c00
[ 155.313719][ T5958] ? __pfx_kbd_event+0x10/0x10
[ 155.319437][ T5958] ? try_to_take_rt_mutex+0x842/0xb00
[ 155.325142][ T5958] ? rtlock_slowlock_locked+0xfb/0x3c20
[ 155.331363][ T5958] ? __lock_acquire+0x747/0x2de0
[ 155.336572][ T5958] ? __lock_acquire+0x747/0x2de0
[ 155.341685][ T5958] ? do_raw_spin_lock+0x12b/0x2f0
[ 155.347032][ T5958] ? lock_acquire+0x115/0x350
[ 155.352285][ T5958] input_handle_events_default+0xd4/0x1a0
[ 155.358150][ T5958] ? input_pass_values+0x8d/0x890
[ 155.363227][ T5958] input_pass_values+0x288/0x890
[ 155.368212][ T5958] ? input_handle_event+0x6fd/0xf10
[ 155.373608][ T5958] input_event_dispose+0x35f/0x700
[ 155.378882][ T5958] input_event+0x87/0xb0
[ 155.383537][ T5958] uinput_write+0x3be/0xfe0
[ 155.388114][ T5958] ? __pfx_uinput_write+0x10/0x10
[ 155.393270][ T5958] ? bpf_lsm_file_permission+0x9/0x20
[ 155.398815][ T5958] ? security_file_permission+0x75/0x260
[ 155.404606][ T5958] ? rw_verify_area+0x209/0x4d0
[ 155.409535][ T5958] ? __pfx_uinput_write+0x10/0x10
[ 155.414645][ T5958] vfs_write+0x29f/0xbb0
[ 155.419057][ T5958] ? __pfx_vfs_write+0x10/0x10
[ 155.423888][ T5958] ? __fget_files+0x2a/0x420
[ 155.428704][ T5958] ? __fget_files+0x2a/0x420
[ 155.433406][ T5958] ? __fget_files+0x3a8/0x420
[ 155.438422][ T5958] ? __fget_files+0x2a/0x420
[ 155.443157][ T5958] ksys_write+0x156/0x270
[ 155.447667][ T5958] ? __pfx_ksys_write+0x10/0x10
[ 155.452681][ T5958] do_syscall_64+0x166/0x520
[ 155.457443][ T5958] ? trace_irq_disable+0x3b/0x140
[ 155.462526][ T5958] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 155.468658][ T5958] ? clear_bhb_loop+0x70/0xc0
[ 155.473396][ T5958] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 155.479422][ T5958] RIP: 0033:0x7f89c05f325e
[ 155.483881][ T5958] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 155.504087][ T5958] RSP: 002b:00007f89bf59b168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 155.512659][ T5958] RAX: ffffffffffffffda RBX: 00007f89bf59b6c0 RCX: 00007f89c05f325e
[ 155.520946][ T5958] RDX: 0000000000000030 RSI: 00007f89bf59b1d0 RDI: 0000000000000003
[ 155.528965][ T5958] RBP: 0000000100460001 R08: 0000000000000000 R09: 0000000000000000
[ 155.537245][ T5958] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 155.545610][ T5958] R13: 0000000000000000 R14: 00007fffcefcd4c0 R15: 00007fffcefcd5a8
[ 155.553913][ T5958]
[ 155.558500][ T5958] Kernel Offset: disabled
[ 155.562870][ T5958] Rebooting in 86400 seconds..