Warning: Permanently added '10.128.1.135' (ED25519) to the list of known hosts. 2024/10/27 02:03:02 ignoring optional flag "sandboxArg"="0" 2024/10/27 02:03:02 ignoring optional flag "type"="gce" 2024/10/27 02:03:03 parsed 1 programs 2024/10/27 02:03:03 executed programs: 0 [ 49.193076][ T417] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.199969][ T417] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.207356][ T417] device bridge_slave_0 entered promiscuous mode [ 49.216013][ T417] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.223037][ T417] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.230428][ T417] device bridge_slave_1 entered promiscuous mode [ 49.369159][ T420] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.376018][ T420] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.383570][ T420] device bridge_slave_0 entered promiscuous mode [ 49.396098][ T420] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.402965][ T420] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.410502][ T420] device bridge_slave_1 entered promiscuous mode [ 49.469937][ T424] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.476897][ T424] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.484193][ T424] device bridge_slave_0 entered promiscuous mode [ 49.494854][ T424] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.501721][ T424] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.509150][ T424] device bridge_slave_1 entered promiscuous mode [ 49.526244][ T421] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.533081][ T421] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.540711][ T421] device bridge_slave_0 entered promiscuous mode [ 49.565314][ T421] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.572150][ T421] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.579678][ T421] device bridge_slave_1 entered promiscuous mode [ 49.607076][ T429] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.613927][ T429] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.621497][ T429] device bridge_slave_0 entered promiscuous mode [ 49.632346][ T429] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.639249][ T429] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.646806][ T429] device bridge_slave_1 entered promiscuous mode [ 49.657482][ T425] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.664657][ T425] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.672215][ T425] device bridge_slave_0 entered promiscuous mode [ 49.700283][ T425] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.707191][ T425] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.714545][ T425] device bridge_slave_1 entered promiscuous mode [ 49.749763][ T417] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.756751][ T417] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.763911][ T417] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.770710][ T417] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.932631][ T420] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.939498][ T420] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.946661][ T420] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.953573][ T420] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.982453][ T421] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.989324][ T421] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.996439][ T421] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.003181][ T421] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.015836][ T425] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.022683][ T425] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.029870][ T425] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.036793][ T425] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.047734][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.055334][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.062364][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.069680][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.077880][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.084836][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.091926][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.099210][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.107410][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 50.114750][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 50.139913][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 50.148404][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 50.157236][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.164062][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.208035][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 50.217916][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 50.226072][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.232908][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.276415][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 50.283819][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 50.291246][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 50.300220][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 50.308948][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.315796][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.323188][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 50.331801][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 50.339963][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.346812][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.372761][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 50.380315][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 50.387888][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 50.396821][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 50.404184][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 50.412626][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 50.421909][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.428791][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.436440][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 50.444893][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 50.453079][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.459945][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.467650][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 50.475747][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 50.483546][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 50.491988][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 50.500333][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.507280][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.514613][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 50.523799][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 50.532167][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.539010][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.547901][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 50.555623][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 50.563543][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 50.600899][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 50.610507][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 50.618769][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 50.628226][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 50.636576][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.643683][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.651531][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 50.660086][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 50.668468][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.675324][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.682519][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 50.690717][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 50.698619][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 50.706596][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 50.714548][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 50.721972][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 50.729357][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 50.745177][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 50.753318][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 50.761401][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 50.770068][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 50.798399][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 50.808091][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 50.816582][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.823402][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.831150][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 50.840114][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 50.848312][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.855267][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.862465][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 50.870612][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 50.902638][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 50.911600][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 50.919901][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 50.928459][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 50.936704][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 50.944834][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 50.953720][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 50.961701][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 50.969641][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 50.977748][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 50.987476][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 51.005132][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 51.031748][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 51.040588][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 51.049304][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 51.066879][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 51.075386][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 51.083743][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 51.092446][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 51.116936][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 51.124801][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 51.133043][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 51.142146][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 51.168371][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 51.177139][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 51.186119][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 51.194279][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 51.202621][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 51.210907][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 51.221301][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 51.229580][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 51.242725][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 51.251040][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 51.264579][ T23] kauditd_printk_skb: 15 callbacks suppressed [ 51.264591][ T23] audit: type=1400 audit(1729994585.380:91): avc: denied { mounton } for pid=420 comm="syz-executor.1" path="/dev/binderfs" dev="devtmpfs" ino=1012 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 51.308912][ T23] audit: type=1400 audit(1729994585.430:92): avc: denied { sys_admin } for pid=453 comm="syz-executor.1" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 51.333143][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 51.342484][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 51.350720][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 51.358822][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 51.380881][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 51.389159][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 51.397789][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 51.406271][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 51.414268][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 51.422743][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 51.449493][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 51.458399][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 51.496020][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 51.513507][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 51.523972][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 51.532496][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 51.541033][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 51.549627][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 51.575260][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 51.583440][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 51.591903][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 51.600415][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 51.609356][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 51.617728][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2024/10/27 02:03:08 executed programs: 119 2024/10/27 02:03:13 executed programs: 486 2024/10/27 02:03:18 executed programs: 735 [ 66.415623][ T74] cfg80211: failed to load regulatory.db 2024/10/27 02:03:23 executed programs: 1106 2024/10/27 02:03:28 executed programs: 1400 2024/10/27 02:03:33 executed programs: 1769 2024/10/27 02:03:38 executed programs: 2033 2024/10/27 02:03:43 executed programs: 2402 2024/10/27 02:03:48 executed programs: 2775 2024/10/27 02:03:53 executed programs: 3153 2024/10/27 02:03:58 executed programs: 3483 2024/10/27 02:04:03 executed programs: 3756 2024/10/27 02:04:08 executed programs: 4071 2024/10/27 02:04:14 executed programs: 4379 2024/10/27 02:04:19 executed programs: 4689 2024/10/27 02:04:24 executed programs: 5063 2024/10/27 02:04:29 executed programs: 5373 2024/10/27 02:04:34 executed programs: 5624 2024/10/27 02:04:39 executed programs: 5943 2024/10/27 02:04:44 executed programs: 6259 2024/10/27 02:04:49 executed programs: 6498 2024/10/27 02:04:54 executed programs: 6870 [ 160.974905][ C1] ================================================================== [ 160.982953][ C1] BUG: KASAN: use-after-free in enqueue_timer+0xb7/0x300 [ 160.989921][ C1] Write of size 8 at addr ffff8881e404f1c8 by task udevd/535 [ 160.997106][ C1] [ 160.999302][ C1] CPU: 1 PID: 535 Comm: udevd Not tainted 5.4.283-syzkaller-04984-ge6ac8beecb16 #0 [ 161.008386][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 161.018286][ C1] Call Trace: [ 161.021401][ C1] [ 161.024118][ C1] dump_stack+0x1d8/0x241 [ 161.028350][ C1] ? nf_ct_l4proto_log_invalid+0x258/0x258 [ 161.033990][ C1] ? printk+0xd1/0x111 [ 161.037918][ C1] ? enqueue_timer+0xb7/0x300 [ 161.042414][ C1] ? wake_up_klogd+0xb2/0xf0 [ 161.046835][ C1] ? enqueue_timer+0xb7/0x300 [ 161.051347][ C1] print_address_description+0x8c/0x600 [ 161.056730][ C1] ? panic+0x89d/0x89d [ 161.060768][ C1] ? update_load_avg+0x40f/0x1210 [ 161.065603][ C1] ? enqueue_timer+0xb7/0x300 [ 161.070180][ C1] __kasan_report+0xf3/0x120 [ 161.074718][ C1] ? enqueue_timer+0xb7/0x300 [ 161.079215][ C1] kasan_report+0x30/0x60 [ 161.083471][ C1] enqueue_timer+0xb7/0x300 [ 161.088015][ C1] internal_add_timer+0x240/0x430 [ 161.093078][ C1] __mod_timer+0x6f1/0x13e0 [ 161.097391][ C1] ? mod_timer_pending+0x20/0x20 [ 161.102175][ C1] ? check_preemption_disabled+0x9f/0x320 [ 161.107717][ C1] ? round_jiffies+0x99/0xb0 [ 161.112144][ C1] ? can_stat_update+0xb15/0xbb0 [ 161.116914][ C1] ? asan.module_dtor+0x20/0x20 [ 161.121599][ C1] call_timer_fn+0x36/0x390 [ 161.125942][ C1] ? asan.module_dtor+0x20/0x20 [ 161.130681][ C1] __run_timers+0x879/0xbe0 [ 161.134971][ C1] ? enqueue_timer+0x300/0x300 [ 161.139768][ C1] ? check_preemption_disabled+0x9f/0x320 [ 161.145320][ C1] ? debug_smp_processor_id+0x20/0x20 [ 161.150526][ C1] ? lapic_next_event+0x5b/0x70 [ 161.155213][ C1] run_timer_softirq+0x63/0xf0 [ 161.159834][ C1] __do_softirq+0x23b/0x6b7 [ 161.164253][ C1] irq_exit+0x195/0x1c0 [ 161.168236][ C1] smp_apic_timer_interrupt+0x11a/0x460 [ 161.173612][ C1] apic_timer_interrupt+0xf/0x20 [ 161.178390][ C1] [ 161.181169][ C1] RIP: 0010:__sanitizer_cov_trace_const_cmp4+0x4/0x70 [ 161.187779][ C1] Code: 77 cf 89 f8 89 f6 48 c7 44 0a 08 03 00 00 00 48 89 44 0a 10 48 89 74 0a 18 4c 89 44 0a 20 49 ff c1 4c 89 09 c3 90 4c 8b 04 24 <65> 48 8b 05 e4 53 9e 7e 65 8b 0d e9 53 9e 7e f7 c1 00 01 1f 00 74 [ 161.207286][ C1] RSP: 0018:ffff8881eaf67940 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 [ 161.215616][ C1] RAX: 0000000000000000 RBX: 0000000000000109 RCX: dffffc0000000000 [ 161.223445][ C1] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 161.231238][ C1] RBP: dffffc0000000000 R08: ffffffff819ee974 R09: ffffffff819eb4b2 [ 161.239224][ C1] R10: ffff8881eacd8000 R11: 0000000000000002 R12: ffff8881eaf67c80 [ 161.247035][ C1] R13: 1ffff1103d5ecf79 R14: ffff8881edfd3330 R15: ffff8881eaf67bc8 [ 161.254850][ C1] ? follow_managed+0x1a2/0x600 [ 161.259533][ C1] ? step_into+0x3f4/0x5d0 [ 161.263875][ C1] step_into+0x3f4/0x5d0 [ 161.267955][ C1] path_openat+0xf48/0x34b0 [ 161.272292][ C1] ? stack_trace_save+0x118/0x1c0 [ 161.277155][ C1] ? do_filp_open+0x450/0x450 [ 161.281833][ C1] ? do_sys_open+0x357/0x810 [ 161.286190][ C1] ? do_syscall_64+0xca/0x1c0 [ 161.290694][ C1] ? entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 161.296597][ C1] do_filp_open+0x20b/0x450 [ 161.300956][ C1] ? vfs_tmpfile+0x2c0/0x2c0 [ 161.305362][ C1] ? _raw_spin_unlock+0x49/0x60 [ 161.310046][ C1] ? __alloc_fd+0x4c5/0x570 [ 161.314393][ C1] do_sys_open+0x39c/0x810 [ 161.318640][ C1] ? check_preemption_disabled+0x153/0x320 [ 161.324278][ C1] ? file_open_root+0x490/0x490 [ 161.328966][ C1] ? task_work_run+0x158/0x170 [ 161.333567][ C1] do_syscall_64+0xca/0x1c0 [ 161.337911][ C1] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 161.343647][ C1] RIP: 0033:0x7f3b6e49b9a4 [ 161.347897][ C1] Code: 24 20 48 8d 44 24 30 48 89 44 24 28 64 8b 04 25 18 00 00 00 85 c0 75 2c 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 60 48 8b 15 55 a4 0d 00 f7 d8 64 89 02 48 83 [ 161.367330][ C1] RSP: 002b:00007ffe2438bc10 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 161.375743][ C1] RAX: ffffffffffffffda RBX: 00005594d1058cf0 RCX: 00007f3b6e49b9a4 [ 161.383665][ C1] RDX: 0000000000080000 RSI: 00005594d1037e90 RDI: 00000000ffffff9c [ 161.391476][ C1] RBP: 00005594d1037e90 R08: 00005594d1037e90 R09: 0000000000200000 [ 161.399284][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000080000 [ 161.407106][ C1] R13: 0000000000000703 R14: 0000000000000000 R15: 0000000000000001 [ 161.414996][ C1] [ 161.417173][ C1] The buggy address belongs to the page: [ 161.422645][ C1] page:ffffea00079013c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 [ 161.431581][ C1] flags: 0x8000000000000000() [ 161.436092][ C1] raw: 8000000000000000 0000000000000000 ffffffff07900101 0000000000000000 [ 161.444594][ C1] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 161.453016][ C1] page dumped because: kasan: bad access detected [ 161.459273][ C1] page_owner tracks the page as freed [ 161.464470][ C1] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x146dc0(GFP_USER|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_COMP|__GFP_ZERO) [ 161.478619][ C1] prep_new_page+0x18f/0x370 [ 161.483046][ C1] get_page_from_freelist+0x2d13/0x2d90 [ 161.488420][ C1] __alloc_pages_nodemask+0x393/0x840 [ 161.493868][ C1] kmalloc_order_trace+0x2a/0x100 [ 161.498713][ C1] kvmalloc_node+0x7e/0xf0 [ 161.502971][ C1] alloc_netdev_mqs+0x85/0xc70 [ 161.507605][ C1] tun_set_iff+0x51f/0xdc0 [ 161.511826][ C1] __tun_chr_ioctl+0x8a9/0x1d00 [ 161.516504][ C1] do_vfs_ioctl+0x742/0x1720 [ 161.521015][ C1] __x64_sys_ioctl+0xd4/0x110 [ 161.525528][ C1] do_syscall_64+0xca/0x1c0 [ 161.529892][ C1] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 161.535593][ C1] page last free stack trace: [ 161.540119][ C1] __free_pages_ok+0x847/0x950 [ 161.544717][ C1] __free_pages+0x91/0x140 [ 161.549124][ C1] device_release+0x6b/0x190 [ 161.553533][ C1] kobject_put+0x1e6/0x2f0 [ 161.557777][ C1] netdev_run_todo+0xc44/0xdf0 [ 161.562386][ C1] tun_chr_close+0xc1/0x130 [ 161.566874][ C1] __fput+0x262/0x680 [ 161.570690][ C1] task_work_run+0x140/0x170 [ 161.575112][ C1] do_exit+0xcaf/0x2bc0 [ 161.579102][ C1] do_group_exit+0x138/0x300 [ 161.583527][ C1] get_signal+0xdb1/0x1440 [ 161.587787][ C1] do_signal+0xb0/0x11f0 [ 161.591862][ C1] exit_to_usermode_loop+0xc0/0x1a0 [ 161.596892][ C1] prepare_exit_to_usermode+0x199/0x200 [ 161.602293][ C1] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 161.607999][ C1] [ 161.610167][ C1] Memory state around the buggy address: [ 161.615662][ C1] ffff8881e404f080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 161.623550][ C1] ffff8881e404f100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 161.631610][ C1] >ffff8881e404f180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 161.639506][ C1] ^ [ 161.645757][ C1] ffff8881e404f200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 161.653654][ C1] ffff8881e404f280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 161.661569][ C1] ================================================================== [ 161.669531][ C1] Disabling lock debugging due to kernel taint [ 162.014905][ C1] kasan: CONFIG_KASAN_INLINE enabled [ 162.020012][ C1] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 162.027931][ C1] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 162.034686][ C1] CPU: 1 PID: 535 Comm: udevd Tainted: G B 5.4.283-syzkaller-04984-ge6ac8beecb16 #0 [ 162.045311][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 162.055274][ C1] RIP: 0010:__run_timers+0x7b0/0xbe0 [ 162.060370][ C1] Code: 89 e7 e8 23 4f 3f 00 4d 89 2c 24 4d 85 ed 74 2e e8 a5 65 0f 00 49 83 c5 08 4c 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ef e8 f2 4e 3f 00 4d 89 65 00 eb 05 e8 77 [ 162.080193][ C1] RSP: 0000:ffff8881f6f09d60 EFLAGS: 00010802 [ 162.086095][ C1] RAX: 1bd5a00000000025 RBX: 1ffff1103c809e39 RCX: dffffc0000000000 [ 162.093994][ C1] RDX: 0000000080000101 RSI: 0000000000000008 RDI: ffff8881e404f1c8 [ 162.101996][ C1] RBP: ffff8881f6f09ec8 R08: dffffc0000000000 R09: 0000000000000003 [ 162.109804][ C1] R10: ffffffffffffffff R11: dffffc0000000001 R12: ffff8881f6f09e20 [ 162.117632][ C1] R13: dead00000000012a R14: 1ffff1103c809e38 R15: ffff8881e404f1c8 [ 162.125437][ C1] FS: 00007f3b6e370c80(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 162.134290][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 162.140701][ C1] CR2: 00007ffe70047248 CR3: 00000001ebb53000 CR4: 00000000003406a0 [ 162.148521][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 162.156321][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 162.164131][ C1] Call Trace: [ 162.167260][ C1] [ 162.169957][ C1] ? __die+0xb4/0x100 [ 162.173773][ C1] ? die+0x26/0x50 [ 162.177329][ C1] ? do_general_protection+0x266/0x3c0 [ 162.182621][ C1] ? do_trap+0x340/0x340 [ 162.186703][ C1] ? check_preemption_disabled+0x9f/0x320 [ 162.192258][ C1] ? round_jiffies+0x99/0xb0 [ 162.196683][ C1] ? general_protection+0x28/0x30 [ 162.201543][ C1] ? __run_timers+0x7b0/0xbe0 [ 162.206072][ C1] ? enqueue_timer+0x300/0x300 [ 162.210745][ C1] ? check_preemption_disabled+0x9f/0x320 [ 162.216417][ C1] ? debug_smp_processor_id+0x20/0x20 [ 162.221626][ C1] ? lapic_next_event+0x5b/0x70 [ 162.226310][ C1] run_timer_softirq+0x63/0xf0 [ 162.230998][ C1] __do_softirq+0x23b/0x6b7 [ 162.235339][ C1] irq_exit+0x195/0x1c0 [ 162.239346][ C1] smp_apic_timer_interrupt+0x11a/0x460 [ 162.244835][ C1] apic_timer_interrupt+0xf/0x20 [ 162.249652][ C1] [ 162.252432][ C1] RIP: 0033:0x7f3b6e44ba76 [ 162.256701][ C1] Code: 83 ec 38 c7 47 08 00 00 00 00 31 db 49 87 1f 48 85 db 0f 84 2d 01 00 00 f6 c3 0f 74 09 48 8d 3d bb e9 0e 00 eb 1d 48 8b 7b 08 <89> f8 c1 e8 04 83 e8 02 49 8d 44 c6 10 49 39 c7 74 0c 48 8d 3d d3 [ 162.276223][ C1] RSP: 002b:00007ffe24390110 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 [ 162.284472][ C1] RAX: 0000000000000001 RBX: 00005594d1024e70 RCX: 00007f3b6e49b5f4 [ 162.292287][ C1] RDX: 00007ffe24390240 RSI: 0000000000000000 RDI: 0000000000000031 [ 162.300088][ C1] RBP: 00007f3b6e576aa0 R08: 0000000000000000 R09: 0000000000000001 [ 162.307908][ C1] R10: 0000000000001000 R11: 0000000000000206 R12: 00007f3b6e576b00 [ 162.315712][ C1] R13: 0000000000001000 R14: 00007f3b6e576aa0 R15: 00007f3b6e576ab8 [ 162.323523][ C1] Modules linked in: [ 162.327272][ C1] ---[ end trace e7e781aeb1e9a7b9 ]--- [ 162.332554][ C1] RIP: 0010:__run_timers+0x7b0/0xbe0 [ 162.337673][ C1] Code: 89 e7 e8 23 4f 3f 00 4d 89 2c 24 4d 85 ed 74 2e e8 a5 65 0f 00 49 83 c5 08 4c 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ef e8 f2 4e 3f 00 4d 89 65 00 eb 05 e8 77 [ 162.357109][ C1] RSP: 0000:ffff8881f6f09d60 EFLAGS: 00010802 [ 162.363010][ C1] RAX: 1bd5a00000000025 RBX: 1ffff1103c809e39 RCX: dffffc0000000000 [ 162.370821][ C1] RDX: 0000000080000101 RSI: 0000000000000008 RDI: ffff8881e404f1c8 [ 162.378904][ C1] RBP: ffff8881f6f09ec8 R08: dffffc0000000000 R09: 0000000000000003 [ 162.386708][ C1] R10: ffffffffffffffff R11: dffffc0000000001 R12: ffff8881f6f09e20 [ 162.394517][ C1] R13: dead00000000012a R14: 1ffff1103c809e38 R15: ffff8881e404f1c8 [ 162.402333][ C1] FS: 00007f3b6e370c80(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 162.411092][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 162.417522][ C1] CR2: 00007ffe70047248 CR3: 00000001ebb53000 CR4: 00000000003406a0 [ 162.425333][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 162.433141][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 162.440949][ C1] Kernel panic - not syncing: Fatal exception in interrupt [ 162.448388][ C1] Kernel Offset: disabled [ 162.452632][ C1] Rebooting in 86400 seconds..