Warning: Permanently added '[localhost]:33942' (ED25519) to the list of known hosts. 2026/09/02 01:41:48 parsed 1 programs 2026/09/02 01:41:48 serving rpc on tcp://41125 syzkaller login: [ 48.783650][ T5597] cgroup: Unknown subsys name 'net' [ 48.913933][ T5597] cgroup: Unknown subsys name 'cpuset' [ 48.918422][ T5597] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 50.391932][ T5597] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 53.055457][ T5606] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 53.584292][ T56] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 53.585284][ T56] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 53.585464][ T56] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 53.586111][ T56] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 53.586329][ T56] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 54.230724][ T5630] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.230843][ T5630] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.230899][ T5630] bridge_slave_0: entered allmulticast mode [ 54.234583][ T5630] bridge_slave_0: entered promiscuous mode [ 54.252293][ T5630] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.252404][ T5630] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.252513][ T5630] bridge_slave_1: entered allmulticast mode [ 54.253215][ T5630] bridge_slave_1: entered promiscuous mode [ 54.312864][ T5630] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 54.412241][ T5630] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 54.428384][ T5630] team0: Port device team_slave_0 added [ 54.433474][ T5630] team0: Port device team_slave_1 added [ 54.518259][ T5630] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 54.519586][ T5630] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 54.519603][ T5630] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 54.530399][ T5630] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 54.530410][ T5630] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 54.530425][ T5630] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 54.545982][ T66] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 54.545992][ T66] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 54.614436][ T5630] hsr_slave_0: entered promiscuous mode [ 54.615056][ T5630] hsr_slave_1: entered promiscuous mode [ 54.653378][ T1108] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 54.653420][ T1108] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 55.030005][ T5630] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 55.039091][ T5630] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 55.040433][ T5630] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 55.050185][ T5630] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 55.050678][ T5630] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 55.058249][ T5630] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 55.070613][ T5630] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 55.077831][ T5630] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 55.182101][ T5630] 8021q: adding VLAN 0 to HW filter on device bond0 [ 55.194348][ T5630] 8021q: adding VLAN 0 to HW filter on device team0 [ 55.207507][ T66] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.207608][ T66] bridge0: port 1(bridge_slave_0) entered forwarding state [ 55.216197][ T66] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.216271][ T66] bridge0: port 2(bridge_slave_1) entered forwarding state [ 55.415249][ T5630] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 55.438198][ T5630] veth0_vlan: entered promiscuous mode [ 55.442750][ T5630] veth1_vlan: entered promiscuous mode [ 55.457796][ T5630] veth0_macvtap: entered promiscuous mode [ 55.460870][ T5630] veth1_macvtap: entered promiscuous mode [ 55.470941][ T5630] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 55.474171][ T5630] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 55.510864][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.515644][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.519305][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.523867][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 2026/09/02 01:41:57 executed programs: 0 [ 55.596882][ T56] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 55.597394][ T56] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 55.597764][ T56] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 55.600999][ T56] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 55.604694][ T56] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 55.634218][ T4991] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 55.636773][ T4991] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 55.637226][ T4991] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 55.637801][ T4991] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 55.638008][ T4991] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 55.662573][ T5729] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 55.666256][ T5643] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 55.669959][ T5643] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 55.674235][ T5643] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 55.682406][ T5643] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 55.956885][ T12] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 56.047954][ T12] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 56.129267][ T12] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 56.305545][ T5719] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.308027][ T5719] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.309747][ T5719] bridge_slave_0: entered allmulticast mode [ 56.310976][ T5719] bridge_slave_0: entered promiscuous mode [ 56.313425][ T5719] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.313533][ T5719] bridge0: port 2(bridge_slave_1) entered disabled state [ 56.313622][ T5719] bridge_slave_1: entered allmulticast mode [ 56.314996][ T5719] bridge_slave_1: entered promiscuous mode [ 56.380128][ T5719] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 56.382514][ T5719] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 56.426794][ T5721] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.429622][ T5721] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.429722][ T5721] bridge_slave_0: entered allmulticast mode [ 56.430877][ T5721] bridge_slave_0: entered promiscuous mode [ 56.434092][ T5721] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.434190][ T5721] bridge0: port 2(bridge_slave_1) entered disabled state [ 56.434495][ T5721] bridge_slave_1: entered allmulticast mode [ 56.435219][ T5721] bridge_slave_1: entered promiscuous mode [ 56.450818][ T5721] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 56.452970][ T5721] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 56.460595][ T5723] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.460674][ T5723] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.460824][ T5723] bridge_slave_0: entered allmulticast mode [ 56.461756][ T5723] bridge_slave_0: entered promiscuous mode [ 56.465355][ T5723] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.465426][ T5723] bridge0: port 2(bridge_slave_1) entered disabled state [ 56.465741][ T5723] bridge_slave_1: entered allmulticast mode [ 56.466971][ T5723] bridge_slave_1: entered promiscuous mode [ 56.481497][ T5719] team0: Port device team_slave_0 added [ 56.507909][ T5719] team0: Port device team_slave_1 added [ 56.511624][ T5723] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 56.516426][ T5721] team0: Port device team_slave_0 added [ 56.529037][ T5723] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 56.531436][ T5721] team0: Port device team_slave_1 added [ 56.577480][ T5721] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 56.577539][ T5721] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 56.577607][ T5721] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 56.580925][ T5719] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 56.580937][ T5719] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 56.580951][ T5719] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 56.603690][ T5723] team0: Port device team_slave_0 added [ 56.608489][ T5723] team0: Port device team_slave_1 added [ 56.613035][ T5721] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 56.613095][ T5721] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 56.613141][ T5721] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 56.614860][ T5719] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 56.614870][ T5719] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 56.614885][ T5719] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 56.669908][ T5723] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 56.669965][ T5723] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 56.670427][ T5723] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 56.704218][ T5719] hsr_slave_0: entered promiscuous mode [ 56.704979][ T5719] hsr_slave_1: entered promiscuous mode [ 56.705508][ T5719] debugfs: 'hsr0' already exists in 'hsr' [ 56.705568][ T5719] Cannot create hsr debugfs directory [ 56.706150][ T5723] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 56.706158][ T5723] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 56.706173][ T5723] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 56.735707][ T5721] hsr_slave_0: entered promiscuous mode [ 56.736494][ T5721] hsr_slave_1: entered promiscuous mode [ 56.736990][ T5721] debugfs: 'hsr0' already exists in 'hsr' [ 56.737003][ T5721] Cannot create hsr debugfs directory [ 56.781433][ T5723] hsr_slave_0: entered promiscuous mode [ 56.786777][ T5723] hsr_slave_1: entered promiscuous mode [ 56.790020][ T5723] debugfs: 'hsr0' already exists in 'hsr' [ 56.792714][ T5723] Cannot create hsr debugfs directory [ 57.129926][ T5719] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 57.135415][ T5719] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 57.136503][ T5719] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 57.140975][ T5719] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 57.142632][ T5719] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 57.146351][ T5719] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 57.156675][ T5719] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 57.161718][ T5719] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 57.200079][ T5721] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 57.205572][ T5721] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 57.207791][ T5721] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 57.211150][ T5721] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 57.213125][ T5721] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 57.216762][ T5721] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 57.217135][ T5721] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 57.218712][ T5721] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 57.272368][ T5719] 8021q: adding VLAN 0 to HW filter on device bond0 [ 57.293963][ T5719] 8021q: adding VLAN 0 to HW filter on device team0 [ 57.302976][ T66] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.303060][ T66] bridge0: port 1(bridge_slave_0) entered forwarding state [ 57.320353][ T66] bridge0: port 2(bridge_slave_1) entered blocking state [ 57.320460][ T66] bridge0: port 2(bridge_slave_1) entered forwarding state [ 57.326039][ T5721] 8021q: adding VLAN 0 to HW filter on device bond0 [ 57.348930][ T5721] 8021q: adding VLAN 0 to HW filter on device team0 [ 57.359380][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.359600][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 57.372797][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 57.372897][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 57.447268][ T12] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.568817][ T5719] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 57.591224][ T5721] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 57.599315][ T5719] veth0_vlan: entered promiscuous mode [ 57.610844][ T5719] veth1_vlan: entered promiscuous mode [ 57.634292][ T5721] veth0_vlan: entered promiscuous mode [ 57.646179][ T5721] veth1_vlan: entered promiscuous mode [ 57.649409][ T5719] veth0_macvtap: entered promiscuous mode [ 57.653712][ T5719] veth1_macvtap: entered promiscuous mode [ 57.670768][ T5643] Bluetooth: hci1: command tx timeout [ 57.671758][ T4991] Bluetooth: hci0: command tx timeout [ 57.674887][ T5719] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 57.679740][ T5721] veth0_macvtap: entered promiscuous mode [ 57.690731][ T5721] veth1_macvtap: entered promiscuous mode [ 57.694828][ T5719] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 57.716744][ T5721] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 57.727251][ T5721] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 57.759956][ T5643] Bluetooth: hci2: command tx timeout [ 57.791754][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.791801][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 57.799959][ T5678] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.801537][ T5678] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.801562][ T5678] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.801588][ T5678] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.801607][ T5678] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.801626][ T5678] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.801646][ T5678] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.801665][ T5678] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.848733][ T28] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.848787][ T28] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 57.857370][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.857951][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 57.882791][ T28] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.882841][ T28] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 ** replaying previous printk message ** [ 57.921204][ C1] ================================================================== [ 57.921233][ C1] BUG: KASAN: slab-out-of-bounds in tcp_v6_send_response+0x116c/0x1e30 [ 57.921248][ C1] Read of size 8 at addr ffff8881bc3cecb8 by task kworker/u8:3/5678 [ 57.921255][ C1] [ 57.921260][ C1] CPU: 1 UID: 0 PID: 5678 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT(full) [ 57.921268][ C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 57.921273][ C1] Workqueue: krdsd rds_tcp_accept_worker [ 57.921286][ C1] Call Trace: [ 57.921290][ C1] [ 57.921293][ C1] dump_stack_lvl+0xe8/0x150 [ 57.921305][ C1] print_address_description+0x55/0x1e0 [ 57.921314][ C1] ? tcp_v6_send_response+0x116c/0x1e30 [ 57.921322][ C1] print_report+0x58/0x70 [ 57.921330][ C1] kasan_report+0x117/0x150 [ 57.921338][ C1] ? psp_reply_set_decrypted+0x23/0x250 [ 57.921347][ C1] ? tcp_v6_send_response+0x116c/0x1e30 [ 57.921355][ C1] kasan_check_range+0x264/0x2c0 [ 57.921363][ C1] tcp_v6_send_response+0x116c/0x1e30 [ 57.921389][ C1] ? __pfx_tcp_v6_send_response+0x10/0x10 [ 57.921401][ C1] ? ktime_get+0x45/0x220 [ 57.921408][ C1] ? seqcount_lockdep_reader_access+0xa9/0x100 [ 57.921415][ C1] tcp_v6_timewait_ack+0x2c6/0x4c0 [ 57.921445][ C1] tcp_v6_rcv+0x1f09/0x2d90 [ 57.921459][ C1] ? __pfx_tcp_v6_rcv+0x10/0x10 [ 57.921466][ C1] ? __pfx_nf_nat_ipv6_fn+0x10/0x10 [ 57.921475][ C1] ? __pfx_tcp_v6_rcv+0x10/0x10 [ 57.921481][ C1] ip6_protocol_deliver_rcu+0xab9/0x1680 [ 57.921492][ C1] ip6_input_finish+0x191/0x370 [ 57.921499][ C1] NF_HOOK+0x336/0x3c0 [ 57.921508][ C1] ? __pfx_ip6_input_finish+0x10/0x10 [ 57.921515][ C1] ? NF_HOOK+0x9e/0x3c0 [ 57.921524][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 57.921534][ C1] ? __pfx_ip6_input_finish+0x10/0x10 [ 57.921541][ C1] ip6_input+0x16a/0x270 [ 57.921547][ C1] ? ip6_input+0x23/0x270 [ 57.921553][ C1] NF_HOOK+0x336/0x3c0 [ 57.921563][ C1] ? __pfx_ip6_rcv_finish+0x10/0x10 [ 57.921572][ C1] ? NF_HOOK+0x9e/0x3c0 [ 57.921586][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 57.921596][ C1] ? __pfx_ip6_rcv_finish+0x10/0x10 [ 57.921607][ C1] process_backlog+0x795/0x18b0 [ 57.921617][ C1] ? process_backlog+0x3de/0x18b0 [ 57.921628][ C1] __napi_poll+0xaa/0x330 [ 57.921636][ C1] net_rx_action+0x61d/0xf50 [ 57.921646][ C1] ? __pfx_net_rx_action+0x10/0x10 [ 57.921655][ C1] ? kvm_sched_clock_read+0x11/0x20 [ 57.921665][ C1] ? __pfx_sched_clock_cpu+0x10/0x10 [ 57.921671][ C1] ? kvm_sched_clock_read+0x11/0x20 [ 57.921678][ C1] ? sched_clock+0x41/0x60 [ 57.921689][ C1] handle_softirqs+0x226/0x860 [ 57.921698][ C1] ? do_softirq+0x77/0xd0 [ 57.921707][ C1] ? __dev_queue_xmit+0x29b/0x3820 [ 57.921714][ C1] do_softirq+0x77/0xd0 [ 57.921722][ C1] [ 57.921725][ C1] [ 57.921727][ C1] __local_bh_enable_ip+0x100/0x140 [ 57.921736][ C1] ? __dev_queue_xmit+0x29b/0x3820 [ 57.921742][ C1] __dev_queue_xmit+0x1edc/0x3820 [ 57.921749][ C1] ? __lock_acquire+0x14b9/0x2e50 [ 57.921757][ C1] ? __dev_queue_xmit+0x29b/0x3820 [ 57.921765][ C1] ? __pfx___dev_queue_xmit+0x10/0x10 [ 57.921772][ C1] ? lock_acquire+0x115/0x350 [ 57.921778][ C1] ? ip6_output+0x337/0x540 [ 57.921787][ C1] ? ip6_finish_output2+0x9f8/0x1460 [ 57.921797][ C1] ? __asan_memcpy+0x40/0x70 [ 57.921806][ C1] ? ip6_finish_output2+0xc1c/0x1460 [ 57.921817][ C1] ? ip6_output+0x11e/0x540 [ 57.921825][ C1] ip6_output+0x337/0x540 [ 57.921833][ C1] ? __pfx_ip6_output+0x10/0x10 [ 57.921841][ C1] ip6_xmit+0x117f/0x1a60 [ 57.921851][ C1] ? ip6_xmit+0x273/0x1a60 [ 57.921859][ C1] ? __pfx_ip6_xmit+0x10/0x10 [ 57.921868][ C1] ? lock_acquire+0x115/0x350 [ 57.921875][ C1] ? __pfx_ip6_dst_check+0x10/0x10 [ 57.921884][ C1] inet6_csk_xmit+0x397/0x660 [ 57.921891][ C1] ? inet6_csk_xmit+0xf4/0x660 [ 57.921897][ C1] ? __pfx_inet6_csk_xmit+0x10/0x10 [ 57.921903][ C1] __tcp_transmit_skb+0x2640/0x47c0 [ 57.921915][ C1] ? __pfx___tcp_transmit_skb+0x10/0x10 [ 57.921924][ C1] ? tcp_small_queue_check+0x1b9/0x3a0 [ 57.921932][ C1] tcp_write_xmit+0x1bfa/0x6400 [ 57.921945][ C1] __tcp_push_pending_frames+0x96/0x380 [ 57.921953][ C1] __tcp_close+0x56e/0xe70 [ 57.921964][ C1] tcp_close+0x28/0x110 [ 57.921973][ C1] inet_release+0x143/0x190 [ 57.921981][ C1] sock_release+0x85/0x150 [ 57.921989][ C1] rds_tcp_accept_one+0x62c/0xd40 [ 57.921996][ C1] ? lock_acquire+0x115/0x350 [ 57.922002][ C1] ? __pfx_rds_tcp_accept_one+0x10/0x10 [ 57.922009][ C1] ? rcu_is_watching+0x16/0xb0 [ 57.922017][ C1] ? process_scheduled_works+0x97a/0x1630 [ 57.922026][ C1] rds_tcp_accept_worker+0x1d/0x70 [ 57.922036][ C1] process_scheduled_works+0xc3d/0x1630 [ 57.922048][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 57.922057][ C1] ? assign_work+0x3cf/0x5d0 [ 57.922066][ C1] worker_thread+0xa47/0xfb0 [ 57.922076][ C1] ? __kthread_parkme+0x71/0x1f0 [ 57.922087][ C1] kthread+0x38b/0x480 [ 57.922093][ C1] ? __pfx_worker_thread+0x10/0x10 [ 57.922101][ C1] ? __pfx_kthread+0x10/0x10 [ 57.922107][ C1] ret_from_fork+0x514/0xb70 [ 57.922117][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 57.922127][ C1] ? __switch_to+0xc89/0x1420 [ 57.922137][ C1] ? __pfx_kthread+0x10/0x10 [ 57.922143][ C1] ret_from_fork_asm+0x1a/0x30 [ 57.922155][ C1] [ 57.922158][ C1] [ 57.922160][ C1] The buggy address belongs to the object at ffff8881bc3ceb80 [ 57.922160][ C1] which belongs to the cache tw_sock_TCPv6 of size 304 [ 57.922166][ C1] The buggy address is located 8 bytes to the right of [ 57.922166][ C1] allocated 304-byte region [ffff8881bc3ceb80, ffff8881bc3cecb0) [ 57.922173][ C1] [ 57.922175][ C1] The buggy address belongs to the physical page: [ 57.922179][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8881bc3ce8a0 pfn:0x1bc3ce [ 57.922186][ C1] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 57.922192][ C1] memcg:ffff8881bb1a4301 [ 57.922195][ C1] flags: 0x57ff00000000240(workingset|head|node=1|zone=2|lastcpupid=0x7ff) [ 57.922202][ C1] page_type: f5(slab) [ 57.922209][ C1] raw: 057ff00000000240 ffff8881042e0640 ffff88816fedf1c8 ffff88816fedf1c8 [ 57.922215][ C1] raw: ffff8881bc3ce8a0 0000000200160006 00000000f5000000 ffff8881bb1a4301 [ 57.922221][ C1] head: 057ff00000000240 ffff8881042e0640 ffff88816fedf1c8 ffff88816fedf1c8 [ 57.922226][ C1] head: ffff8881bc3ce8a0 0000000200160006 00000000f5000000 ffff8881bb1a4301 [ 57.922232][ C1] head: 057ff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 57.922237][ C1] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 57.922240][ C1] page dumped because: kasan: bad access detected [ 57.922244][ C1] page_owner tracks the page as allocated [ 57.922247][ C1] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5678, tgid 5678 (kworker/u8:3), ts 57920184007 [ 57.922258][ C1] post_alloc_hook+0x1f9/0x250 [ 57.922268][ C1] get_page_from_freelist+0x2209/0x2280 [ 57.922274][ C1] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 57.922279][ C1] allocate_slab+0x7d/0x620 [ 57.922286][ C1] refill_objects+0x2d5/0x350 [ 57.922294][ C1] __pcs_replace_empty_main+0x2c8/0x6c0 [ 57.922300][ C1] kmem_cache_alloc_noprof+0x399/0x600 [ 57.922309][ C1] inet_twsk_alloc+0xe3/0x8d0 [ 57.922315][ C1] tcp_time_wait+0x5d/0xee0 [ 57.922321][ C1] tcp_rcv_state_process+0xba1/0x4980 [ 57.922330][ C1] tcp_v6_do_rcv+0xf3d/0x1c70 [ 57.922335][ C1] tcp_v6_rcv+0x2496/0x2d90 [ 57.922341][ C1] ip6_protocol_deliver_rcu+0xab9/0x1680 [ 57.922346][ C1] ip6_input_finish+0x191/0x370 [ 57.922352][ C1] NF_HOOK+0x336/0x3c0 [ 57.922360][ C1] ip6_input+0x16a/0x270 [ 57.922365][ C1] page last free pid 24 tgid 24 ts 57909757259 stack trace: [ 57.922370][ C1] __free_frozen_pages+0xc93/0xd90 [ 57.922378][ C1] rcu_core+0x926/0x1260 [ 57.922384][ C1] handle_softirqs+0x226/0x860 [ 57.922392][ C1] __irq_exit_rcu+0xcb/0x220 [ 57.922399][ C1] irq_exit_rcu+0x9/0x30 [ 57.922406][ C1] sysvec_call_function_single+0xa3/0xc0 [ 57.922414][ C1] asm_sysvec_call_function_single+0x1a/0x20 [ 57.922421][ C1] [ 57.922422][ C1] Memory state around the buggy address: [ 57.922446][ C1] ffff8881bc3ceb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.922451][ C1] ffff8881bc3cec00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.922455][ C1] >ffff8881bc3cec80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.922458][ C1] ^ [ 57.922462][ C1] ffff8881bc3ced00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.922466][ C1] ffff8881bc3ced80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.922469][ C1] ================================================================== [ 57.922559][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 58.224126][ C1] CPU: 1 UID: 0 PID: 5678 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT(full) [ 58.226992][ C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 58.229987][ C1] Workqueue: krdsd rds_tcp_accept_worker [ 58.232043][ C1] Call Trace: [ 58.233337][ C1] [ 58.234494][ C1] vpanic+0x56d/0xa60 [ 58.236079][ C1] ? rcu_is_watching+0x16/0xb0 [ 58.237940][ C1] ? __pfx_vpanic+0x10/0x10 [ 58.239692][ C1] panic+0xc5/0xd0 [ 58.241126][ C1] ? __pfx_panic+0x10/0x10 [ 58.242766][ C1] ? tcp_v6_send_response+0x116c/0x1e30 [ 58.244753][ C1] ? tcp_v6_send_response+0x116c/0x1e30 [ 58.246721][ C1] check_panic_on_warn+0x89/0xb0 [ 58.248443][ C1] ? tcp_v6_send_response+0x116c/0x1e30 [ 58.250347][ C1] end_report+0x73/0x170 [ 58.251824][ C1] ? tcp_v6_send_response+0x116c/0x1e30 [ 58.253743][ C1] kasan_report+0x128/0x150 [ 58.255389][ C1] ? psp_reply_set_decrypted+0x23/0x250 [ 58.257379][ C1] ? tcp_v6_send_response+0x116c/0x1e30 [ 58.259458][ C1] kasan_check_range+0x264/0x2c0 [ 58.261153][ C1] tcp_v6_send_response+0x116c/0x1e30 [ 58.263099][ C1] ? __pfx_tcp_v6_send_response+0x10/0x10 [ 58.265185][ C1] ? ktime_get+0x45/0x220 [ 58.266737][ C1] ? seqcount_lockdep_reader_access+0xa9/0x100 [ 58.268900][ C1] tcp_v6_timewait_ack+0x2c6/0x4c0 [ 58.270657][ C1] tcp_v6_rcv+0x1f09/0x2d90 [ 58.272281][ C1] ? __pfx_tcp_v6_rcv+0x10/0x10 [ 58.273951][ C1] ? __pfx_nf_nat_ipv6_fn+0x10/0x10 [ 58.275877][ C1] ? __pfx_tcp_v6_rcv+0x10/0x10 [ 58.277647][ C1] ip6_protocol_deliver_rcu+0xab9/0x1680 [ 58.279559][ C1] ip6_input_finish+0x191/0x370 [ 58.281263][ C1] NF_HOOK+0x336/0x3c0 [ 58.282781][ C1] ? __pfx_ip6_input_finish+0x10/0x10 [ 58.284611][ C1] ? NF_HOOK+0x9e/0x3c0 [ 58.286051][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 58.287816][ C1] ? __pfx_ip6_input_finish+0x10/0x10 [ 58.289569][ C1] ip6_input+0x16a/0x270 [ 58.290909][ C1] ? ip6_input+0x23/0x270 [ 58.292279][ C1] NF_HOOK+0x336/0x3c0 [ 58.293573][ C1] ? __pfx_ip6_rcv_finish+0x10/0x10 [ 58.295189][ C1] ? NF_HOOK+0x9e/0x3c0 [ 58.296517][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 58.297966][ C1] ? __pfx_ip6_rcv_finish+0x10/0x10 [ 58.299627][ C1] process_backlog+0x795/0x18b0 [ 58.301315][ C1] ? process_backlog+0x3de/0x18b0 [ 58.303085][ C1] __napi_poll+0xaa/0x330 [ 58.304411][ C1] net_rx_action+0x61d/0xf50 [ 58.305840][ C1] ? __pfx_net_rx_action+0x10/0x10 [ 58.307398][ C1] ? kvm_sched_clock_read+0x11/0x20 [ 58.309010][ C1] ? __pfx_sched_clock_cpu+0x10/0x10 [ 58.310642][ C1] ? kvm_sched_clock_read+0x11/0x20 [ 58.312203][ C1] ? sched_clock+0x41/0x60 [ 58.313609][ C1] handle_softirqs+0x226/0x860 [ 58.315062][ C1] ? do_softirq+0x77/0xd0 [ 58.316665][ C1] ? __dev_queue_xmit+0x29b/0x3820 [ 58.318688][ C1] do_softirq+0x77/0xd0 [ 58.320336][ C1] [ 58.321552][ C1] [ 58.322735][ C1] __local_bh_enable_ip+0x100/0x140 [ 58.324633][ C1] ? __dev_queue_xmit+0x29b/0x3820 [ 58.326638][ C1] __dev_queue_xmit+0x1edc/0x3820 [ 58.328618][ C1] ? __lock_acquire+0x14b9/0x2e50 [ 58.330551][ C1] ? __dev_queue_xmit+0x29b/0x3820 [ 58.332492][ C1] ? __pfx___dev_queue_xmit+0x10/0x10 [ 58.334581][ C1] ? lock_acquire+0x115/0x350 [ 58.336453][ C1] ? ip6_output+0x337/0x540 [ 58.338248][ C1] ? ip6_finish_output2+0x9f8/0x1460 [ 58.340252][ C1] ? __asan_memcpy+0x40/0x70 [ 58.341882][ C1] ? ip6_finish_output2+0xc1c/0x1460 [ 58.343572][ C1] ? ip6_output+0x11e/0x540 [ 58.345118][ C1] ip6_output+0x337/0x540 [ 58.346758][ C1] ? __pfx_ip6_output+0x10/0x10 [ 58.348710][ C1] ip6_xmit+0x117f/0x1a60 [ 58.350455][ C1] ? ip6_xmit+0x273/0x1a60 [ 58.352184][ C1] ? __pfx_ip6_xmit+0x10/0x10 [ 58.354049][ C1] ? lock_acquire+0x115/0x350 [ 58.355919][ C1] ? __pfx_ip6_dst_check+0x10/0x10 [ 58.357922][ C1] inet6_csk_xmit+0x397/0x660 [ 58.359763][ C1] ? inet6_csk_xmit+0xf4/0x660 [ 58.361598][ C1] ? __pfx_inet6_csk_xmit+0x10/0x10 [ 58.363411][ C1] __tcp_transmit_skb+0x2640/0x47c0 [ 58.365318][ C1] ? __pfx___tcp_transmit_skb+0x10/0x10 [ 58.367208][ C1] ? tcp_small_queue_check+0x1b9/0x3a0 [ 58.369364][ C1] tcp_write_xmit+0x1bfa/0x6400 [ 58.371307][ C1] __tcp_push_pending_frames+0x96/0x380 [ 58.373360][ C1] __tcp_close+0x56e/0xe70 [ 58.374892][ C1] tcp_close+0x28/0x110 [ 58.376224][ C1] inet_release+0x143/0x190 [ 58.377694][ C1] sock_release+0x85/0x150 [ 58.379123][ C1] rds_tcp_accept_one+0x62c/0xd40 [ 58.380753][ C1] ? lock_acquire+0x115/0x350 [ 58.382339][ C1] ? __pfx_rds_tcp_accept_one+0x10/0x10 [ 58.384216][ C1] ? rcu_is_watching+0x16/0xb0 [ 58.385910][ C1] ? process_scheduled_works+0x97a/0x1630 [ 58.388142][ C1] rds_tcp_accept_worker+0x1d/0x70 [ 58.390179][ C1] process_scheduled_works+0xc3d/0x1630 [ 58.392337][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 58.394732][ C1] ? assign_work+0x3cf/0x5d0 [ 58.396609][ C1] worker_thread+0xa47/0xfb0 [ 58.398447][ C1] ? __kthread_parkme+0x71/0x1f0 [ 58.400410][ C1] kthread+0x38b/0x480 [ 58.402045][ C1] ? __pfx_worker_thread+0x10/0x10 [ 58.404079][ C1] ? __pfx_kthread+0x10/0x10 [ 58.405591][ C1] ret_from_fork+0x514/0xb70 [ 58.407079][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 58.408705][ C1] ? __switch_to+0xc89/0x1420 [ 58.410141][ C1] ? __pfx_kthread+0x10/0x10 [ 58.411613][ C1] ret_from_fork_asm+0x1a/0x30 [ 58.413133][ C1] [ 58.414868][ C1] Kernel Offset: disabled [ 58.416253][ C1] Rebooting in 86400 seconds.. VM DIAGNOSIS: 01:42:00 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000000 RBX=00007f336ab1a477 RCX=dffffc0000000000 RDX=0000000000000000 RSI=00007f336ab1a000 RDI=ffffffffff600000 RBP=0000000000000001 RSP=ffffc900065775b8 R8 =ffffc90006577f48 R9 =0000000000000000 R10=0000000000000000 R11=ffffffff8ed5c6e0 R12=ffff888117493c00 R13=ffffffff822b9536 R14=dffffc0000000000 R15=1ffff92000caeeca RIP=ffffffff8190ca31 RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00007f336aeacc80 ffffffff 00c00000 GS =0000 ffff88818d6df000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f1a877ee000 CR3=0000000117912000 CR4=000006f0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000 XMM02=ffffffffffffff00 ffffffffffffffff XMM03=0000000000000000 0000000000000000 XMM04=0000000000000000 0000000000000000 XMM05=0000000000002230 0000000000002230 XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000 XMM08=ffffffffffff0000 ffffffffffff0000 XMM09=00000000000060b1 0000000000003431 XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000 XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000 XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000000020 RBX=0000000000000020 RCX=0000000000000000 RDX=00000000000003f8 RSI=0000000000000100 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90000a17980 R8 =0000000000000100 R9 =0000000000000004 R10=dffffc0000000000 R11=ffffffff85713070 R12=dffffc0000000000 R13=0000000000000020 R14=ffffffff9ad2c020 R15=0000000000000000 RIP=ffffffff857130ec RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8882a8cdf000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000200000000140 CR3=000000000eb48000 CR4=000006f0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 00007f359ff5d560 XMM02=00007f359f3f25e8 00007f359f3f2618 XMM03=00007f359f3f2600 00007f359f3f25e0 XMM04=00007f359ff5d020 00007f359f3f25c0 XMM05=00007f359f3f25d0 00007f359f3f2610 XMM06=00007f359f3f25f8 00007f359f3f25c8 XMM07=00007f359f3f2600 00007f359f3f25e0 XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 0000000000000000 XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000 XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000 XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000