[ 57.254662][ T46] bridge0: port 1(bridge_slave_0) entered disabled state
[ 57.263640][ T46] device veth1_macvtap left promiscuous mode
[ 57.269868][ T46] device veth0_macvtap left promiscuous mode
[ 57.275880][ T46] device veth1_vlan left promiscuous mode
[ 57.281893][ T46] device veth0_vlan left promiscuous mode
[ 57.344535][ T46] team0 (unregistering): Port device team_slave_1 removed
[ 57.355095][ T46] team0 (unregistering): Port device team_slave_0 removed
[ 57.365060][ T46] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 57.376735][ T46] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 57.407383][ T46] bond0 (unregistering): Released all slaves
Warning: Permanently added '10.128.10.24' (ECDSA) to the list of known hosts.
2022/07/28 01:54:56 parsed 1 programs
2022/07/28 01:54:56 executed programs: 0
[ 71.079984][ T1239] ieee802154 phy0 wpan0: encryption failed: -22
[ 71.086304][ T1239] ieee802154 phy1 wpan1: encryption failed: -22
[ 72.203247][ T48] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 72.210471][ T48] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 72.217633][ T48] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 72.225118][ T48] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 72.232526][ T48] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 72.239686][ T48] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 72.286801][ T4071] chnl_net:caif_netlink_parms(): no params data found
[ 72.314961][ T4071] bridge0: port 1(bridge_slave_0) entered blocking state
[ 72.322114][ T4071] bridge0: port 1(bridge_slave_0) entered disabled state
[ 72.329824][ T4071] device bridge_slave_0 entered promiscuous mode
[ 72.337224][ T4071] bridge0: port 2(bridge_slave_1) entered blocking state
[ 72.344797][ T4071] bridge0: port 2(bridge_slave_1) entered disabled state
[ 72.352405][ T4071] device bridge_slave_1 entered promiscuous mode
[ 72.369176][ T4071] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 72.379671][ T4071] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 72.396779][ T4071] team0: Port device team_slave_0 added
[ 72.403465][ T4071] team0: Port device team_slave_1 added
[ 72.416385][ T4071] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 72.423374][ T4071] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 72.449402][ T4071] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 72.460837][ T4071] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 72.467766][ T4071] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 72.493882][ T4071] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 72.514677][ T4071] device hsr_slave_0 entered promiscuous mode
[ 72.521294][ T4071] device hsr_slave_1 entered promiscuous mode
[ 72.561566][ T4071] bridge0: port 2(bridge_slave_1) entered blocking state
[ 72.568627][ T4071] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 72.575889][ T4071] bridge0: port 1(bridge_slave_0) entered blocking state
[ 72.582951][ T4071] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 72.608223][ T4071] 8021q: adding VLAN 0 to HW filter on device bond0
[ 72.617978][ T2939] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 72.626007][ T2939] bridge0: port 1(bridge_slave_0) entered disabled state
[ 72.634028][ T2939] bridge0: port 2(bridge_slave_1) entered disabled state
[ 72.641574][ T2939] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 72.652975][ T4071] 8021q: adding VLAN 0 to HW filter on device team0
[ 72.661650][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 72.670067][ T26] bridge0: port 1(bridge_slave_0) entered blocking state
[ 72.677105][ T26] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 72.686652][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 72.695044][ T145] bridge0: port 2(bridge_slave_1) entered blocking state
[ 72.702123][ T145] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 72.718872][ T4071] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[ 72.729578][ T4071] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 72.742848][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 72.751556][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 72.759737][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 72.767752][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 72.775885][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 72.783717][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 72.797919][ T4071] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 72.805642][ T2939] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 72.813157][ T2939] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 72.950725][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 72.962050][ T2939] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 72.971484][ T4071] device veth0_vlan entered promiscuous mode
[ 72.977744][ T2939] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 72.985592][ T2939] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 72.995856][ T4071] device veth1_vlan entered promiscuous mode
[ 73.010472][ T2939] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 73.018392][ T2939] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 73.026442][ T2939] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 73.035762][ T4071] device veth0_macvtap entered promiscuous mode
[ 73.044586][ T4071] device veth1_macvtap entered promiscuous mode
[ 73.056032][ T4071] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 73.063641][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 73.072861][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 73.082750][ T4071] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 73.090295][ T143] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 73.120271][ T46] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 73.128083][ T46] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 73.137331][ T143] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 73.151288][ T56] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 73.159262][ T56] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 73.166689][ T143] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 74.270207][ T4264] ==================================================================
[ 74.278296][ T4264] BUG: KASAN: use-after-free in __post_watch_notification+0x204/0x8d0
[ 74.286437][ T4264] Read of size 8 at addr ffff888025dfe610 by task syz-executor.0/4264
[ 74.294569][ T4264]
[ 74.296883][ T4264] CPU: 1 PID: 4264 Comm: syz-executor.0 Not tainted 5.19.0-rc8-syzkaller-dirty #0
[ 74.306065][ T4264] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[ 74.316104][ T4264] Call Trace:
[ 74.319376][ T4264]
[ 74.322294][ T4264] dump_stack_lvl+0x1e3/0x2cb
[ 74.326965][ T4264] ? bfq_pos_tree_add_move+0x436/0x436
[ 74.332413][ T4264] ? _printk+0xcf/0x10f
[ 74.336562][ T4264] ? __wake_up_klogd+0xd6/0x100
[ 74.341403][ T4264] ? __wake_up_klogd+0xcd/0x100
[ 74.346249][ T4264] ? panic+0x76e/0x76e
[ 74.350320][ T4264] ? _printk+0xcf/0x10f
[ 74.354474][ T4264] print_address_description+0x65/0x4b0
[ 74.360017][ T4264] print_report+0xf4/0x210
[ 74.364430][ T4264] ? __post_watch_notification+0x204/0x8d0
[ 74.370249][ T4264] kasan_report+0xfb/0x130
[ 74.374665][ T4264] ? __post_watch_notification+0x204/0x8d0
[ 74.380463][ T4264] __post_watch_notification+0x204/0x8d0
[ 74.386091][ T4264] ? user_update+0x1ba/0x250
[ 74.390675][ T4264] __key_update+0x428/0x4e0
[ 74.395173][ T4264] ? __up_read+0x690/0x690
[ 74.399582][ T4264] ? key_create_or_update+0xd60/0xd60
[ 74.404944][ T4264] ? __key_link_end+0xe0/0x130
[ 74.409711][ T4264] key_create_or_update+0xa8f/0xd60
[ 74.414987][ T4264] ? key_type_put+0x20/0x20
[ 74.419478][ T4264] ? search_process_keyrings_rcu+0x260/0x260
[ 74.425449][ T4264] ? __might_fault+0xb2/0x110
[ 74.430203][ T4264] __se_sys_add_key+0x338/0x480
[ 74.435040][ T4264] ? __x64_sys_add_key+0xc0/0xc0
[ 74.439965][ T4264] ? __x64_sys_add_key+0x1c/0xc0
[ 74.444887][ T4264] do_syscall_64+0x2b/0x70
[ 74.449292][ T4264] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 74.455196][ T4264] RIP: 0033:0x7ff80ba89209
[ 74.459598][ T4264] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 74.479189][ T4264] RSP: 002b:00007ff80cc25168 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8
[ 74.487587][ T4264] RAX: ffffffffffffffda RBX: 00007ff80bb9bf60 RCX: 00007ff80ba89209
[ 74.495545][ T4264] RDX: 00000000200000c0 RSI: 0000000020000080 RDI: 0000000020000040
[ 74.503504][ T4264] RBP: 00007ff80bae3161 R08: fffffffffffffffc R09: 0000000000000000
[ 74.511460][ T4264] R10: 0000000000000048 R11: 0000000000000246 R12: 0000000000000000
[ 74.519418][ T4264] R13: 00007ffc7598cc4f R14: 00007ff80cc25300 R15: 0000000000022000
[ 74.527380][ T4264]
[ 74.530384][ T4264]
[ 74.532716][ T4264] Allocated by task 4246:
[ 74.537023][ T4264] ____kasan_kmalloc+0xdc/0x110
[ 74.541861][ T4264] kmem_cache_alloc_trace+0x94/0x310
[ 74.547128][ T4264] watch_queue_init+0x4f/0x140
[ 74.551876][ T4264] create_pipe_files+0x478/0x6e0
[ 74.556805][ T4264] __do_pipe_flags+0x46/0x200
[ 74.561482][ T4264] do_pipe2+0xd0/0x300
[ 74.565536][ T4264] __x64_sys_pipe2+0x56/0x60
[ 74.570118][ T4264] do_syscall_64+0x2b/0x70
[ 74.574531][ T4264] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 74.580408][ T4264]
[ 74.582717][ T4264] Freed by task 26:
[ 74.586505][ T4264] kasan_set_track+0x4c/0x70
[ 74.591079][ T4264] kasan_set_free_info+0x1f/0x40
[ 74.596000][ T4264] ____kasan_slab_free+0xd8/0x110
[ 74.601009][ T4264] slab_free_freelist_hook+0x12e/0x1a0
[ 74.606454][ T4264] kmem_cache_free_bulk+0x105/0x1d0
[ 74.611634][ T4264] kfree_rcu_work+0x35b/0x7c0
[ 74.616299][ T4264] process_one_work+0x81c/0xd10
[ 74.621136][ T4264] worker_thread+0xb14/0x1330
[ 74.625799][ T4264] kthread+0x266/0x300
[ 74.629850][ T4264] ret_from_fork+0x1f/0x30
[ 74.634252][ T4264]
[ 74.636561][ T4264] Last potentially related work creation:
[ 74.642256][ T4264] kasan_save_stack+0x3b/0x60
[ 74.646923][ T4264] __kasan_record_aux_stack+0xaf/0xc0
[ 74.652280][ T4264] kvfree_call_rcu+0x118/0x840
[ 74.657033][ T4264] free_watch+0x3c/0x130
[ 74.661261][ T4264] rcu_core+0xa0c/0x16d0
[ 74.665502][ T4264] __do_softirq+0x382/0x793
[ 74.669989][ T4264]
[ 74.672299][ T4264] Second to last potentially related work creation:
[ 74.678860][ T4264] kasan_save_stack+0x3b/0x60
[ 74.683522][ T4264] __kasan_record_aux_stack+0xaf/0xc0
[ 74.688878][ T4264] insert_work+0x54/0x3e0
[ 74.693197][ T4264] __queue_work+0x969/0xc20
[ 74.697694][ T4264] queue_work_on+0x137/0x240
[ 74.702455][ T4264] call_usermodehelper_exec+0x26d/0x430
[ 74.707982][ T4264] kobject_uevent_env+0x7df/0x8e0
[ 74.712993][ T4264] driver_register+0x399/0x3e0
[ 74.717738][ T4264] __hid_register_driver+0x126/0x170
[ 74.723007][ T4264] do_one_initcall+0xbd/0x2b0
[ 74.727690][ T4264] do_initcall_level+0x168/0x218
[ 74.732614][ T4264] do_initcalls+0x4b/0x8c
[ 74.736929][ T4264] kernel_init_freeable+0x43a/0x5c3
[ 74.742109][ T4264] kernel_init+0x19/0x2b0
[ 74.746425][ T4264] ret_from_fork+0x1f/0x30
[ 74.750838][ T4264]
[ 74.753156][ T4264] The buggy address belongs to the object at ffff888025dfe600
[ 74.753156][ T4264] which belongs to the cache kmalloc-192 of size 192
[ 74.767191][ T4264] The buggy address is located 16 bytes inside of
[ 74.767191][ T4264] 192-byte region [ffff888025dfe600, ffff888025dfe6c0)
[ 74.780361][ T4264]
[ 74.782670][ T4264] The buggy address belongs to the physical page:
[ 74.789077][ T4264] page:ffffea0000977f80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x25dfe
[ 74.799210][ T4264] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 74.806749][ T4264] raw: 00fff00000000200 dead000000000100 dead000000000122 ffff888011c41a00
[ 74.815321][ T4264] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
[ 74.823882][ T4264] page dumped because: kasan: bad access detected
[ 74.830286][ T4264] page_owner tracks the page as allocated
[ 74.835981][ T4264] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 8881199979, free_ts 0
[ 74.852542][ T4264] get_page_from_freelist+0x72b/0x7a0
[ 74.857902][ T4264] __alloc_pages+0x259/0x560
[ 74.862477][ T4264] alloc_page_interleave+0x22/0x1c0
[ 74.867658][ T4264] alloc_slab_page+0x70/0xf0
[ 74.872274][ T4264] allocate_slab+0x5e/0x520
[ 74.876759][ T4264] ___slab_alloc+0x42e/0xce0
[ 74.881336][ T4264] kmem_cache_alloc_trace+0x25c/0x310
[ 74.886690][ T4264] call_usermodehelper_setup+0x8a/0x260
[ 74.892219][ T4264] kobject_uevent_env+0x7c1/0x8e0
[ 74.897243][ T4264] driver_register+0x399/0x3e0
[ 74.902000][ T4264] __hid_register_driver+0x126/0x170
[ 74.907276][ T4264] do_one_initcall+0xbd/0x2b0
[ 74.911949][ T4264] do_initcall_level+0x168/0x218
[ 74.916887][ T4264] do_initcalls+0x4b/0x8c
[ 74.921223][ T4264] kernel_init_freeable+0x43a/0x5c3
[ 74.926407][ T4264] kernel_init+0x19/0x2b0
[ 74.930733][ T4264] page_owner free stack trace missing
[ 74.936085][ T4264]
[ 74.938393][ T4264] Memory state around the buggy address:
[ 74.944007][ T4264] ffff888025dfe500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 74.952070][ T4264] ffff888025dfe580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 74.960130][ T4264] >ffff888025dfe600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 74.968178][ T4264] ^
[ 74.972753][ T4264] ffff888025dfe680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 74.980798][ T4264] ffff888025dfe700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 74.988840][ T4264] ==================================================================
[ 75.000044][ T26] Bluetooth: hci0: command 0x0409 tx timeout
[ 75.006177][ T4264] Kernel panic - not syncing: panic_on_warn set ...
[ 75.012771][ T4264] CPU: 0 PID: 4264 Comm: syz-executor.0 Not tainted 5.19.0-rc8-syzkaller-dirty #0
[ 75.021973][ T4264] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[ 75.032029][ T4264] Call Trace:
[ 75.035292][ T4264]
[ 75.038210][ T4264] dump_stack_lvl+0x1e3/0x2cb
[ 75.042901][ T4264] ? bfq_pos_tree_add_move+0x436/0x436
[ 75.048352][ T4264] ? panic+0x76e/0x76e
[ 75.052406][ T4264] ? preempt_schedule_common+0xb7/0xe0
[ 75.057845][ T4264] ? preempt_schedule+0xd9/0xe0
[ 75.062694][ T4264] ? vscnprintf+0x59/0x80
[ 75.067027][ T4264] panic+0x312/0x76e
[ 75.070909][ T4264] ? fb_is_primary_device+0xcc/0xcc
[ 75.076089][ T4264] ? _raw_spin_unlock_irqrestore+0x128/0x130
[ 75.082142][ T4264] ? __post_watch_notification+0x204/0x8d0
[ 75.087935][ T4264] end_report+0x91/0xa0
[ 75.092074][ T4264] kasan_report+0x108/0x130
[ 75.096560][ T4264] ? __post_watch_notification+0x204/0x8d0
[ 75.102353][ T4264] __post_watch_notification+0x204/0x8d0
[ 75.108010][ T4264] ? user_update+0x1ba/0x250
[ 75.112593][ T4264] __key_update+0x428/0x4e0
[ 75.117089][ T4264] ? __up_read+0x690/0x690
[ 75.121487][ T4264] ? key_create_or_update+0xd60/0xd60
[ 75.126842][ T4264] ? __key_link_end+0xe0/0x130
[ 75.131603][ T4264] key_create_or_update+0xa8f/0xd60
[ 75.136790][ T4264] ? key_type_put+0x20/0x20
[ 75.141284][ T4264] ? search_process_keyrings_rcu+0x260/0x260
[ 75.147259][ T4264] ? __might_fault+0xb2/0x110
[ 75.151930][ T4264] __se_sys_add_key+0x338/0x480
[ 75.156782][ T4264] ? __x64_sys_add_key+0xc0/0xc0
[ 75.161725][ T4264] ? __x64_sys_add_key+0x1c/0xc0
[ 75.166667][ T4264] do_syscall_64+0x2b/0x70
[ 75.171071][ T4264] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 75.176949][ T4264] RIP: 0033:0x7ff80ba89209
[ 75.181350][ T4264] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 75.201046][ T4264] RSP: 002b:00007ff80cc25168 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8
[ 75.209450][ T4264] RAX: ffffffffffffffda RBX: 00007ff80bb9bf60 RCX: 00007ff80ba89209
[ 75.217443][ T4264] RDX: 00000000200000c0 RSI: 0000000020000080 RDI: 0000000020000040
[ 75.225401][ T4264] RBP: 00007ff80bae3161 R08: fffffffffffffffc R09: 0000000000000000
[ 75.233356][ T4264] R10: 0000000000000048 R11: 0000000000000246 R12: 0000000000000000
[ 75.241314][ T4264] R13: 00007ffc7598cc4f R14: 00007ff80cc25300 R15: 0000000000022000
[ 75.249327][ T4264]
[ 75.252513][ T4264] Kernel Offset: disabled
[ 75.256829][ T4264] Rebooting in 86400 seconds..