[ 46.722789] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 46.736262] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 46.748046] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 46.760311] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 46.771759] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 46.785365] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 46.799824] IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready [ 46.809163] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 46.818150] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 46.828179] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 400.758852] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 400.771071] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 400.783117] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 400.791569] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 400.804340] device bridge_slave_1 left promiscuous mode [ 400.812153] bridge0: port 2(bridge_slave_1) entered disabled state [ 400.847267] device bridge_slave_0 left promiscuous mode [ 400.853543] bridge0: port 1(bridge_slave_0) entered disabled state [ 400.908214] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 400.917375] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 400.926048] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 400.934621] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 400.943545] device bridge_slave_1 left promiscuous mode [ 400.951129] bridge0: port 2(bridge_slave_1) entered disabled state [ 400.994406] device bridge_slave_0 left promiscuous mode [ 401.001228] bridge0: port 1(bridge_slave_0) entered disabled state [ 401.057713] device veth1_macvtap left promiscuous mode [ 401.065019] device veth0_macvtap left promiscuous mode [ 401.072742] device veth1_vlan left promiscuous mode [ 401.079144] device veth0_vlan left promiscuous mode [ 401.086028] device veth1_macvtap left promiscuous mode [ 401.092883] device veth0_macvtap left promiscuous mode [ 401.099018] device veth1_vlan left promiscuous mode [ 401.104860] device veth0_vlan left promiscuous mode [ 401.287624] device hsr_slave_1 left promiscuous mode [ 401.327863] device hsr_slave_0 left promiscuous mode [ 401.372806] team0 (unregistering): Port device team_slave_1 removed [ 401.385257] team0 (unregistering): Port device team_slave_0 removed [ 401.397246] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 401.427043] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 401.486658] bond0 (unregistering): Released all slaves [ 401.588307] device hsr_slave_1 left promiscuous mode [ 401.636140] device hsr_slave_0 left promiscuous mode [ 401.680693] team0 (unregistering): Port device team_slave_1 removed [ 401.696586] team0 (unregistering): Port device team_slave_0 removed [ 401.709439] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 401.748359] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 401.805538] bond0 (unregistering): Released all slaves Warning: Permanently added '10.128.0.92' (ECDSA) to the list of known hosts. [ 403.121741] ================================================================== [ 403.131367] BUG: KASAN: null-ptr-deref in __tcf_idr_release+0x30/0x90 [ 403.140102] Read of size 4 at addr 0000000000000010 by task syz-executor374/19922 [ 403.150547] [ 403.152370] CPU: 1 PID: 19922 Comm: syz-executor374 Not tainted 4.19.183-syzkaller #0 [ 403.162028] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 403.174683] Call Trace: [ 403.178526] dump_stack+0x123/0x171 [ 403.184560] kasan_report.cold.9+0x6d/0x2fe [ 403.191836] ? __tcf_idr_release+0x30/0x90 [ 403.196883] check_memory_region+0x13e/0x1b0 [ 403.203505] kasan_check_read+0x11/0x20 [ 403.210285] __tcf_idr_release+0x30/0x90 [ 403.215166] tcf_generic_walker+0x595/0x930 [ 403.220803] ? kasan_unpoison_shadow+0x35/0x50 [ 403.226709] ? tcf_action_dump_1+0x5a0/0x5a0 [ 403.232198] ? tcf_ife_walker+0xdd/0x1d0 [ 403.237761] ? lock_downgrade+0x860/0x860 [ 403.243595] ? kasan_check_read+0x11/0x20 [ 403.250236] tcf_ife_walker+0x113/0x1d0 [ 403.255086] tca_action_gd+0xd27/0x1480 [ 403.260617] ? tca_get_fill.constprop.37+0x4d0/0x4d0 [ 403.267338] ? __lock_acquire+0x792/0x4950 [ 403.272769] ? mark_held_locks+0x130/0x130 [ 403.278261] ? nla_parse+0x34/0x280 [ 403.282783] tc_ctl_action+0x1fe/0x3d0 [ 403.288824] ? tcf_action_add+0x320/0x320 [ 403.293953] rtnetlink_rcv_msg+0x34f/0x8f0 [ 403.298924] ? rtnetlink_put_metrics+0x490/0x490 [ 403.304920] ? find_held_lock+0x36/0x1d0 [ 403.309479] netlink_rcv_skb+0x13e/0x3d0 [ 403.315178] ? lock_downgrade+0x860/0x860 [ 403.319995] ? rtnetlink_put_metrics+0x490/0x490 [ 403.325321] ? netlink_ack+0xa70/0xa70 [ 403.331300] ? netlink_deliver_tap+0x182/0xb00 [ 403.337031] rtnetlink_rcv+0x10/0x20 [ 403.341376] netlink_unicast+0x443/0x650 [ 403.346054] ? netlink_attachskb+0x6c0/0x6c0 [ 403.352519] ? _copy_from_iter_full+0x182/0x720 [ 403.359050] ? __check_object_size+0x1ef/0x310 [ 403.364695] ? security_socket_getpeersec_dgram+0x53/0xa0 [ 403.371340] netlink_sendmsg+0x764/0xc60 [ 403.377631] ? netlink_unicast+0x650/0x650 [ 403.383166] ? apparmor_socket_sendmsg+0x1b/0x20 [ 403.388787] ? netlink_unicast+0x650/0x650 [ 403.395969] sock_sendmsg+0xb5/0xf0 [ 403.399969] ___sys_sendmsg+0x647/0x950 [ 403.404413] ? find_held_lock+0x36/0x1d0 [ 403.409955] ? copy_msghdr_from_user+0x430/0x430 [ 403.415344] ? __fget+0x278/0x400 [ 403.419623] ? kasan_check_read+0x11/0x20 [ 403.424639] ? __fget+0x295/0x400 [ 403.429088] ? expand_files.part.8+0x700/0x700 [ 403.434843] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 403.442501] ? __fget_light+0x174/0x1e0 [ 403.451850] ? find_held_lock+0x36/0x1d0 [ 403.457027] ? __fdget+0xe/0x10 [ 403.460925] __sys_sendmsg+0xd9/0x180 [ 403.465290] ? __ia32_sys_shutdown+0x70/0x70 [ 403.470248] ? __x64_sys_futex+0x1cb/0x3a0 [ 403.477073] ? up_read+0x1a/0x110 [ 403.482170] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 403.488711] __x64_sys_sendmsg+0x73/0xb0 [ 403.494312] do_syscall_64+0xd0/0x4e0 [ 403.498757] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 403.504854] RIP: 0033:0x445a49 [ 403.509106] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 403.530644] RSP: 002b:00007fdd1fd11318 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 403.540343] RAX: ffffffffffffffda RBX: 00000000004ca428 RCX: 0000000000445a49 [ 403.548594] RDX: 0000000000000000 RSI: 0000000020000300 RDI: 0000000000000003 [ 403.557700] RBP: 00000000004ca420 R08: 000000000000000c R09: 0000000000000000 [ 403.566593] R10: 0000000000000001 R11: 0000000000000246 R12: 00000000004ca42c [ 403.575092] R13: 00007ffe8cc058df R14: 00007fdd1fd11400 R15: 0000000000022000 [ 403.583994] ================================================================== [ 403.593843] Disabling lock debugging due to kernel taint [ 403.605139] kasan: CONFIG_KASAN_INLINE enabled [ 403.610728] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 403.620783] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 403.630236] CPU: 0 PID: 19922 Comm: syz-executor374 Tainted: G B 4.19.183-syzkaller #0 [ 403.641478] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 403.653740] RIP: 0010:__tcf_idr_release+0x41/0x90 [ 403.660041] Code: 89 f3 74 44 84 d2 74 40 4c 8d 6f 20 be 04 00 00 00 4c 89 ef e8 c0 2e 26 fc 4c 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 14 02 4c 89 e8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 30 41 [ 403.684819] RSP: 0018:ffff8881de8f7070 EFLAGS: 00010202 [ 403.693060] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 403.701600] RDX: 0000000000000002 RSI: 0000000000000004 RDI: ffffffff8a18a9a0 [ 403.709865] RBP: ffff8881de8f7088 R08: fffffbfff10c565d R09: fffffbfff10c565c [ 403.718647] R10: fffffbfff10c565c R11: ffffffff8862b2e3 R12: fffffffffffffff0 [ 403.726395] R13: 0000000000000010 R14: ffff8881de8f71b0 R15: ffff8881de8f7170 [ 403.734626] FS: 00007fdd1fd11700(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000 [ 403.743504] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 403.749952] CR2: 00007fe8e3b3e000 CR3: 00000001e077c005 CR4: 00000000001606f0 [ 403.758138] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 403.767423] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 403.775479] Call Trace: [ 403.778678] tcf_generic_walker+0x595/0x930 [ 403.783167] ? kasan_unpoison_shadow+0x35/0x50 [ 403.788264] ? tcf_action_dump_1+0x5a0/0x5a0 [ 403.792926] ? tcf_ife_walker+0xdd/0x1d0 [ 403.797227] ? lock_downgrade+0x860/0x860 [ 403.802550] ? kasan_check_read+0x11/0x20 [ 403.807971] tcf_ife_walker+0x113/0x1d0 [ 403.812452] tca_action_gd+0xd27/0x1480 [ 403.817804] ? tca_get_fill.constprop.37+0x4d0/0x4d0 [ 403.824074] ? __lock_acquire+0x792/0x4950 [ 403.833144] ? mark_held_locks+0x130/0x130 [ 403.837485] ? nla_parse+0x34/0x280 [ 403.843377] tc_ctl_action+0x1fe/0x3d0 [ 403.847519] ? tcf_action_add+0x320/0x320 [ 403.851793] rtnetlink_rcv_msg+0x34f/0x8f0 [ 403.856297] ? rtnetlink_put_metrics+0x490/0x490 [ 403.861395] ? find_held_lock+0x36/0x1d0 [ 403.866699] netlink_rcv_skb+0x13e/0x3d0 [ 403.871389] ? lock_downgrade+0x860/0x860 [ 403.876158] ? rtnetlink_put_metrics+0x490/0x490 [ 403.882103] ? netlink_ack+0xa70/0xa70 [ 403.886339] ? netlink_deliver_tap+0x182/0xb00 [ 403.891537] rtnetlink_rcv+0x10/0x20 [ 403.895320] netlink_unicast+0x443/0x650 [ 403.899855] ? netlink_attachskb+0x6c0/0x6c0 [ 403.904601] ? _copy_from_iter_full+0x182/0x720 [ 403.909700] ? __check_object_size+0x1ef/0x310 [ 403.914354] ? security_socket_getpeersec_dgram+0x53/0xa0 [ 403.920404] netlink_sendmsg+0x764/0xc60 [ 403.925149] ? netlink_unicast+0x650/0x650 [ 403.930031] ? apparmor_socket_sendmsg+0x1b/0x20 [ 403.935377] ? netlink_unicast+0x650/0x650 [ 403.939764] sock_sendmsg+0xb5/0xf0 [ 403.943666] ___sys_sendmsg+0x647/0x950 [ 403.948015] ? find_held_lock+0x36/0x1d0 [ 403.952664] ? copy_msghdr_from_user+0x430/0x430 [ 403.957684] ? __fget+0x278/0x400 [ 403.962015] ? kasan_check_read+0x11/0x20 [ 403.967024] ? __fget+0x295/0x400 [ 403.971144] ? expand_files.part.8+0x700/0x700 [ 403.976368] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 403.981631] ? __fget_light+0x174/0x1e0 [ 403.986056] ? find_held_lock+0x36/0x1d0 [ 403.990750] ? __fdget+0xe/0x10 [ 403.996538] __sys_sendmsg+0xd9/0x180 [ 404.001214] ? __ia32_sys_shutdown+0x70/0x70 [ 404.006213] ? __x64_sys_futex+0x1cb/0x3a0 [ 404.011690] ? up_read+0x1a/0x110 [ 404.016610] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 404.025198] __x64_sys_sendmsg+0x73/0xb0 [ 404.032314] do_syscall_64+0xd0/0x4e0 [ 404.040005] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 404.047622] RIP: 0033:0x445a49 [ 404.052108] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 404.077920] RSP: 002b:00007fdd1fd11318 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 404.089951] RAX: ffffffffffffffda RBX: 00000000004ca428 RCX: 0000000000445a49 [ 404.098084] RDX: 0000000000000000 RSI: 0000000020000300 RDI: 0000000000000003 [ 404.108075] RBP: 00000000004ca420 R08: 000000000000000c R09: 0000000000000000 [ 404.117598] R10: 0000000000000001 R11: 0000000000000246 R12: 00000000004ca42c [ 404.126001] R13: 00007ffe8cc058df R14: 00007fdd1fd11400 R15: 0000000000022000 [ 404.136074] Modules linked in: [ 404.142434] ---[ end trace 78e434d3e8c6eb49 ]--- [ 404.147769] RIP: 0010:__tcf_idr_release+0x41/0x90 [ 404.155579] Code: 89 f3 74 44 84 d2 74 40 4c 8d 6f 20 be 04 00 00 00 4c 89 ef e8 c0 2e 26 fc 4c 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 14 02 4c 89 e8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 30 41 [ 404.184368] RSP: 0018:ffff8881de8f7070 EFLAGS: 00010202 [ 404.190138] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 404.199522] RDX: 0000000000000002 RSI: 0000000000000004 RDI: ffffffff8a18a9a0 [ 404.209496] RBP: ffff8881de8f7088 R08: fffffbfff10c565d R09: fffffbfff10c565c [ 404.218092] R10: fffffbfff10c565c R11: ffffffff8862b2e3 R12: fffffffffffffff0 [ 404.226417] R13: 0000000000000010 R14: ffff8881de8f71b0 R15: ffff8881de8f7170 [ 404.238289] FS: 00007fdd1fd11700(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000 [ 404.249663] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 404.257863] CR2: 00007fe8e3b3e000 CR3: 00000001e077c004 CR4: 00000000001606f0 [ 404.268160] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 404.277828] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 404.288634] Kernel panic - not syncing: Fatal exception [ 404.295646] Kernel Offset: disabled [ 404.300283] Rebooting in 86400 seconds..