Warning: Permanently added '[localhost]:31564' (ED25519) to the list of known hosts. 2025/11/21 16:55:06 parsed 1 programs syzkaller login: [ 66.232374][ T5817] cgroup: Unknown subsys name 'net' [ 66.365743][ T5817] cgroup: Unknown subsys name 'cpuset' [ 66.372151][ T5817] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 68.646380][ T5817] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 71.488662][ T5826] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 71.873468][ T1362] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.876086][ T1362] ieee802154 phy1 wpan1: encryption failed: -22 [ 73.292693][ T5873] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 73.296889][ T5873] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 73.304235][ T5873] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 73.309171][ T5873] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 73.312496][ T5873] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 73.732275][ T1091] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.735383][ T1091] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.765077][ T139] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.768832][ T139] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.407259][ T5892] chnl_net:caif_netlink_parms(): no params data found [ 74.524360][ T5892] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.528154][ T5892] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.531017][ T5892] bridge_slave_0: entered allmulticast mode [ 74.539845][ T5892] bridge_slave_0: entered promiscuous mode [ 74.551584][ T5892] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.554434][ T5892] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.556617][ T5892] bridge_slave_1: entered allmulticast mode [ 74.560345][ T5892] bridge_slave_1: entered promiscuous mode [ 74.590358][ T5892] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 74.594905][ T5892] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 74.615658][ T5892] team0: Port device team_slave_0 added [ 74.620554][ T5892] team0: Port device team_slave_1 added [ 74.640370][ T5892] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 74.642461][ T5892] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 74.650160][ T5892] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 74.656569][ T5892] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 74.659782][ T5892] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 74.668927][ T5892] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 74.706167][ T5892] hsr_slave_0: entered promiscuous mode [ 74.708847][ T5892] hsr_slave_1: entered promiscuous mode [ 74.829912][ T5892] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 74.838788][ T5892] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 74.844189][ T5892] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 74.849514][ T5892] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 74.913435][ T5892] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.924895][ T5892] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.931459][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.933766][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.950239][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.952711][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.080478][ T5892] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.121301][ T5892] veth0_vlan: entered promiscuous mode [ 75.128559][ T5892] veth1_vlan: entered promiscuous mode [ 75.151009][ T5892] veth0_macvtap: entered promiscuous mode [ 75.155607][ T5892] veth1_macvtap: entered promiscuous mode [ 75.170003][ T5892] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.178400][ T5892] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.186447][ T5883] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.191239][ T5883] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.194570][ T5883] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.197164][ T5883] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.290320][ T5892] syz-executor (5892) used greatest stack depth: 19768 bytes left [ 75.322243][ T5832] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 75.396835][ T5832] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 75.480245][ T5832] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 75.529542][ T5832] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2025/11/21 16:55:18 executed programs: 0 [ 75.804289][ T56] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 75.807920][ T56] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 75.811397][ T56] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 75.816385][ T56] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 75.821486][ T56] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 75.946202][ T5923] chnl_net:caif_netlink_parms(): no params data found [ 76.013950][ T5923] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.016674][ T5923] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.019734][ T5923] bridge_slave_0: entered allmulticast mode [ 76.022467][ T5923] bridge_slave_0: entered promiscuous mode [ 76.029057][ T5923] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.032146][ T5923] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.035574][ T5923] bridge_slave_1: entered allmulticast mode [ 76.040152][ T5923] bridge_slave_1: entered promiscuous mode [ 76.081218][ T5923] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 76.088455][ T5923] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 76.125363][ T5923] team0: Port device team_slave_0 added [ 76.131455][ T5923] team0: Port device team_slave_1 added [ 76.162579][ T5923] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 76.164989][ T5923] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 76.173569][ T5923] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 76.179780][ T5923] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 76.181936][ T5923] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 76.190529][ T5923] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 76.229728][ T5923] hsr_slave_0: entered promiscuous mode [ 76.232187][ T5923] hsr_slave_1: entered promiscuous mode [ 76.234354][ T5923] debugfs: 'hsr0' already exists in 'hsr' [ 76.236088][ T5923] Cannot create hsr debugfs directory [ 77.868921][ T5873] Bluetooth: hci0: command tx timeout [ 77.980934][ T5832] bridge_slave_1: left allmulticast mode [ 77.982866][ T5832] bridge_slave_1: left promiscuous mode [ 77.985908][ T5832] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.993173][ T5832] bridge_slave_0: left allmulticast mode [ 77.995680][ T5832] bridge_slave_0: left promiscuous mode [ 77.998756][ T5832] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.299766][ T5832] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 78.306235][ T5832] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 78.311903][ T5832] bond0 (unregistering): Released all slaves [ 78.395557][ T5832] hsr_slave_0: left promiscuous mode [ 78.398917][ T5832] hsr_slave_1: left promiscuous mode [ 78.400969][ T5832] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 78.403904][ T5832] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 78.408796][ T5832] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 78.411150][ T5832] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 78.429149][ T5832] veth1_macvtap: left promiscuous mode [ 78.431016][ T5832] veth0_macvtap: left promiscuous mode [ 78.432873][ T5832] veth1_vlan: left promiscuous mode [ 78.435186][ T5832] veth0_vlan: left promiscuous mode [ 78.758741][ T5832] team0 (unregistering): Port device team_slave_1 removed [ 78.782895][ T5832] team0 (unregistering): Port device team_slave_0 removed [ 79.344136][ T5923] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 79.350720][ T5923] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 79.356535][ T5923] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 79.363318][ T5923] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 79.489816][ T5923] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.516253][ T5923] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.526212][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.530221][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.546238][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.549621][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.721586][ T5923] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 79.757636][ T5923] veth0_vlan: entered promiscuous mode [ 79.766310][ T5923] veth1_vlan: entered promiscuous mode [ 79.787716][ T5923] veth0_macvtap: entered promiscuous mode [ 79.791994][ T5923] veth1_macvtap: entered promiscuous mode [ 79.803240][ T5923] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 79.812418][ T5923] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 79.821324][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.824819][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.827999][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.831015][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.882586][ T139] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.885007][ T139] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.911574][ T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.914078][ T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.949883][ T5873] Bluetooth: hci0: command tx timeout [ 79.959596][ T5965] ================================================================== [ 79.962416][ T5965] BUG: KASAN: slab-out-of-bounds in tcp_ioctl+0x673/0x860 [ 79.964897][ T5965] Read of size 2 at addr ffff8881097608f6 by task syz.0.17/5965 [ 79.969464][ T5965] [ 79.970197][ T5965] CPU: 0 UID: 0 PID: 5965 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 79.970210][ T5965] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 79.970216][ T5965] Call Trace: [ 79.970222][ T5965] [ 79.970226][ T5965] dump_stack_lvl+0x189/0x250 [ 79.970242][ T5965] ? __kasan_check_byte+0x12/0x40 [ 79.970253][ T5965] ? __pfx_dump_stack_lvl+0x10/0x10 [ 79.970263][ T5965] ? lock_release+0x4b/0x3e0 [ 79.970272][ T5965] ? __virt_addr_valid+0x4a5/0x5c0 [ 79.970288][ T5965] print_report+0xca/0x240 [ 79.970299][ T5965] ? tcp_ioctl+0x673/0x860 [ 79.970306][ T5965] kasan_report+0x118/0x150 [ 79.970323][ T5965] ? tcp_ioctl+0x673/0x860 [ 79.970331][ T5965] tcp_ioctl+0x673/0x860 [ 79.970350][ T5965] ? udp_bpf_ioctl+0xaa/0x1d0 [ 79.970360][ T5965] sk_ioctl+0x3c7/0x600 [ 79.970368][ T5965] ? __pfx_sk_ioctl+0x10/0x10 [ 79.970378][ T5965] ? kasan_quarantine_put+0xdd/0x220 [ 79.970391][ T5965] ? lockdep_hardirqs_on+0x9c/0x150 [ 79.970401][ T5965] inet6_ioctl+0x204/0x280 [ 79.970412][ T5965] ? __pfx_inet6_ioctl+0x10/0x10 [ 79.970423][ T5965] ? do_vfs_ioctl+0xbe8/0x1430 [ 79.970437][ T5965] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 79.970479][ T5965] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 79.970490][ T5965] ? kfree+0x19a/0x6d0 [ 79.970503][ T5965] sock_do_ioctl+0xdc/0x300 [ 79.970516][ T5965] ? __pfx_sock_do_ioctl+0x10/0x10 [ 79.970527][ T5965] ? do_futex+0x395/0x420 [ 79.970542][ T5965] sock_ioctl+0x576/0x790 [ 79.970553][ T5965] ? __pfx_sock_ioctl+0x10/0x10 [ 79.970565][ T5965] ? __pfx___se_sys_futex+0x10/0x10 [ 79.970577][ T5965] ? bpf_lsm_file_ioctl+0x9/0x20 [ 79.970588][ T5965] ? __pfx_sock_ioctl+0x10/0x10 [ 79.970598][ T5965] __se_sys_ioctl+0xfc/0x170 [ 79.970610][ T5965] do_syscall_64+0xfa/0xfa0 [ 79.970619][ T5965] ? lockdep_hardirqs_on+0x9c/0x150 [ 79.970626][ T5965] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.970634][ T5965] ? exc_page_fault+0xab/0x100 [ 79.970642][ T5965] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.970650][ T5965] RIP: 0033:0x7fe4b998f749 [ 79.970660][ T5965] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 79.970667][ T5965] RSP: 002b:00007ffd756e87d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 79.970677][ T5965] RAX: ffffffffffffffda RBX: 00007fe4b9be5fa0 RCX: 00007fe4b998f749 [ 79.970684][ T5965] RDX: 0000000000000000 RSI: 0000000000008905 RDI: 0000000000000003 [ 79.970688][ T5965] RBP: 00007fe4b9a13f91 R08: 0000000000000000 R09: 0000000000000000 [ 79.970693][ T5965] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 79.970698][ T5965] R13: 00007fe4b9be5fa0 R14: 00007fe4b9be5fa0 R15: 0000000000000003 [ 79.970707][ T5965] [ 79.970710][ T5965] [ 80.068952][ T5965] Allocated by task 5965: [ 80.070716][ T5965] kasan_save_track+0x3e/0x80 [ 80.072678][ T5965] __kasan_slab_alloc+0x6c/0x80 [ 80.074873][ T5965] kmem_cache_alloc_noprof+0x367/0x6e0 [ 80.077032][ T5965] sk_prot_alloc+0x57/0x220 [ 80.078870][ T5965] sk_alloc+0x3a/0x370 [ 80.080518][ T5965] inet6_create+0x7f0/0x1260 [ 80.082358][ T5965] __sock_create+0x4b3/0x9f0 [ 80.084458][ T5965] __sys_socket+0xd7/0x1b0 [ 80.086129][ T5965] __x64_sys_socket+0x7a/0x90 [ 80.087930][ T5965] do_syscall_64+0xfa/0xfa0 [ 80.089695][ T5965] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.091947][ T5965] [ 80.092914][ T5965] The buggy address belongs to the object at ffff888109760000 [ 80.092914][ T5965] which belongs to the cache UDPv6 of size 2176 [ 80.097909][ T5965] The buggy address is located 118 bytes to the right of [ 80.097909][ T5965] allocated 2176-byte region [ffff888109760000, ffff888109760880) [ 80.103246][ T5965] [ 80.104176][ T5965] The buggy address belongs to the physical page: [ 80.106606][ T5965] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109760 [ 80.109867][ T5965] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 80.113149][ T5965] memcg:ffff888112b82901 [ 80.114989][ T5965] flags: 0x17ff00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 80.117253][ T5965] page_type: f5(slab) [ 80.118784][ T5965] raw: 017ff00000000040 ffff88817159e000 dead000000000122 0000000000000000 [ 80.121909][ T5965] raw: 0000000000000000 00000000800e000e 00000000f5000000 ffff888112b82901 [ 80.125211][ T5965] head: 017ff00000000040 ffff88817159e000 dead000000000122 0000000000000000 [ 80.128220][ T5965] head: 0000000000000000 00000000800e000e 00000000f5000000 ffff888112b82901 [ 80.131463][ T5965] head: 017ff00000000003 ffffea000425d801 00000000ffffffff 00000000ffffffff [ 80.134728][ T5965] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 80.137937][ T5965] page dumped because: kasan: bad access detected [ 80.140379][ T5965] page_owner tracks the page as allocated [ 80.142527][ T5965] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5556, tgid 5556 (dhcpcd), ts 39360973378, free_ts 39270063669 [ 80.150295][ T5965] post_alloc_hook+0x240/0x2a0 [ 80.152186][ T5965] get_page_from_freelist+0x2365/0x2440 [ 80.154378][ T5965] __alloc_frozen_pages_noprof+0x181/0x370 [ 80.156545][ T5965] alloc_pages_mpol+0x232/0x4a0 [ 80.158441][ T5965] allocate_slab+0x96/0x350 [ 80.160171][ T5965] ___slab_alloc+0xf56/0x1990 [ 80.161928][ T5965] __slab_alloc+0x65/0x100 [ 80.163856][ T5965] kmem_cache_alloc_noprof+0x3f9/0x6e0 [ 80.165934][ T5965] sk_prot_alloc+0x57/0x220 [ 80.167630][ T5965] sk_alloc+0x3a/0x370 [ 80.169046][ T5965] inet6_create+0x7f0/0x1260 [ 80.170447][ T5965] __sock_create+0x4b3/0x9f0 [ 80.171833][ T5965] __sys_socket+0xd7/0x1b0 [ 80.173286][ T5965] __x64_sys_socket+0x7a/0x90 [ 80.175119][ T5965] do_syscall_64+0xfa/0xfa0 [ 80.176920][ T5965] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.179381][ T5965] page last free pid 5554 tgid 5554 stack trace: [ 80.181832][ T5965] __free_frozen_pages+0xbc4/0xd30 [ 80.183979][ T5965] __put_partials+0x146/0x170 [ 80.185833][ T5965] put_cpu_partial+0x1f2/0x2e0 [ 80.187717][ T5965] __slab_free+0x2b9/0x390 [ 80.189402][ T5965] qlist_free_all+0x97/0x140 [ 80.191180][ T5965] kasan_quarantine_reduce+0x148/0x160 [ 80.193294][ T5965] __kasan_slab_alloc+0x22/0x80 [ 80.195154][ T5965] kmem_cache_alloc_noprof+0x367/0x6e0 [ 80.197217][ T5965] getname_flags+0xb8/0x540 [ 80.198719][ T5965] do_sys_openat2+0xbc/0x1c0 [ 80.200097][ T5965] __x64_sys_openat+0x138/0x170 [ 80.201534][ T5965] do_syscall_64+0xfa/0xfa0 [ 80.202836][ T5965] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.204794][ T5965] [ 80.205535][ T5965] Memory state around the buggy address: [ 80.207185][ T5965] ffff888109760780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 80.209651][ T5965] ffff888109760800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 80.211939][ T5965] >ffff888109760880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 80.214223][ T5965] ^ [ 80.216487][ T5965] ffff888109760900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 80.219042][ T5965] ffff888109760980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 80.221358][ T5965] ================================================================== [ 80.238090][ T5965] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 80.241017][ T5965] CPU: 0 UID: 0 PID: 5965 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 80.243715][ T5965] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 80.246889][ T5965] Call Trace: [ 80.247915][ T5965] [ 80.248805][ T5965] dump_stack_lvl+0x99/0x250 [ 80.250198][ T5965] ? __asan_memcpy+0x40/0x70 [ 80.251549][ T5965] ? __pfx_dump_stack_lvl+0x10/0x10 [ 80.253068][ T5965] ? __pfx__printk+0x10/0x10 [ 80.254533][ T5965] vpanic+0x237/0x6d0 [ 80.256109][ T5965] ? __pfx_vpanic+0x10/0x10 [ 80.257615][ T5965] ? preempt_schedule+0xae/0xc0 [ 80.259777][ T5965] ? __pfx_preempt_schedule+0x10/0x10 [ 80.261460][ T5965] panic+0xb9/0xc0 [ 80.262869][ T5965] ? __pfx_panic+0x10/0x10 [ 80.264216][ T5965] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 80.265970][ T5965] ? tcp_ioctl+0x673/0x860 [ 80.267298][ T5965] check_panic_on_warn+0x89/0xb0 [ 80.268760][ T5965] ? tcp_ioctl+0x673/0x860 [ 80.270096][ T5965] end_report+0x78/0x160 [ 80.271512][ T5965] kasan_report+0x129/0x150 [ 80.272849][ T5965] ? tcp_ioctl+0x673/0x860 [ 80.274175][ T5965] tcp_ioctl+0x673/0x860 [ 80.275480][ T5965] ? udp_bpf_ioctl+0xaa/0x1d0 [ 80.276908][ T5965] sk_ioctl+0x3c7/0x600 [ 80.278168][ T5965] ? __pfx_sk_ioctl+0x10/0x10 [ 80.279566][ T5965] ? kasan_quarantine_put+0xdd/0x220 [ 80.281140][ T5965] ? lockdep_hardirqs_on+0x9c/0x150 [ 80.282673][ T5965] inet6_ioctl+0x204/0x280 [ 80.284318][ T5965] ? __pfx_inet6_ioctl+0x10/0x10 [ 80.285800][ T5965] ? do_vfs_ioctl+0xbe8/0x1430 [ 80.287234][ T5965] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 80.288968][ T5965] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 80.290462][ T5965] ? kfree+0x19a/0x6d0 [ 80.291666][ T5965] sock_do_ioctl+0xdc/0x300 [ 80.293015][ T5965] ? __pfx_sock_do_ioctl+0x10/0x10 [ 80.294545][ T5965] ? do_futex+0x395/0x420 [ 80.295827][ T5965] sock_ioctl+0x576/0x790 [ 80.297081][ T5965] ? __pfx_sock_ioctl+0x10/0x10 [ 80.298467][ T5965] ? __pfx___se_sys_futex+0x10/0x10 [ 80.299899][ T5965] ? bpf_lsm_file_ioctl+0x9/0x20 [ 80.301387][ T5965] ? __pfx_sock_ioctl+0x10/0x10 [ 80.302784][ T5965] __se_sys_ioctl+0xfc/0x170 [ 80.304147][ T5965] do_syscall_64+0xfa/0xfa0 [ 80.305521][ T5965] ? lockdep_hardirqs_on+0x9c/0x150 [ 80.307016][ T5965] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.308776][ T5965] ? exc_page_fault+0xab/0x100 [ 80.310171][ T5965] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.311876][ T5965] RIP: 0033:0x7fe4b998f749 [ 80.313179][ T5965] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 80.318797][ T5965] RSP: 002b:00007ffd756e87d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 80.321199][ T5965] RAX: ffffffffffffffda RBX: 00007fe4b9be5fa0 RCX: 00007fe4b998f749 [ 80.323594][ T5965] RDX: 0000000000000000 RSI: 0000000000008905 RDI: 0000000000000003 [ 80.325878][ T5965] RBP: 00007fe4b9a13f91 R08: 0000000000000000 R09: 0000000000000000 [ 80.328098][ T5965] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 80.330330][ T5965] R13: 00007fe4b9be5fa0 R14: 00007fe4b9be5fa0 R15: 0000000000000003 [ 80.332618][ T5965] [ 80.334164][ T5965] Kernel Offset: disabled [ 80.335434][ T5965] Rebooting in 86400 seconds.. VM DIAGNOSIS: 16:55:22 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000036 RBX=0000000000000036 RCX=0000000000000000 RDX=00000000000003f8 RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90003b872d0 R8 =ffff88816b440237 R9 =1ffff1102d688046 R10=dffffc0000000000 R11=ffffffff85153300 R12=dffffc0000000000 R13=ffffffff997dc93a R14=ffffffff99aeff60 R15=0000000000000000 RIP=ffffffff8515337c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 000055558283e500 ffffffff 00c00000 GS =0000 ffff88818eb38000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000001b2ee63fff CR3=00000001ba522000 CR4=000006f0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000 XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000 XMM04=ff00000000000000 00000000000000ff XMM05=0000000000000000 0000000000000000 XMM06=0000000000000000 000000524f525245 XMM07=0000000000000000 0000000000000000 XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 00007fe4b9a151cf XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000 XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000 XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=e6e340886b8e9500 RBX=ffffffff81967e77 RCX=e6e340886b8e9500 RDX=0000000000000001 RSI=ffffffff8d70f195 RDI=ffffffff8bbf0e60 RBP=ffffc90000197f10 RSP=ffffc90000197de0 R8 =ffff88823c632f5b R9 =1ffff110478c65eb R10=dffffc0000000000 R11=ffffed10478c65ec R12=ffffffff8f7cee70 R13=0000000000000001 R14=0000000000000001 R15=1ffff1102c1d3000 RIP=ffffffff8b46ddd3 RFL=00000286 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8882a9f38000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=000055558283e808 CR3=0000000113830000 CR4=000006f0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0000000000000000 0000000000000000 XMM01=ffffffffffffff00 ffffffffffffffff XMM02=ffffffffffffffff ffffffffffffff00 XMM03=ffffffffffffff00 ffffffffffffff00 XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 0000000000000000 XMM06=0000000000000000 000000524f525245 XMM07=0000000000000000 0000000000000000 XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 00007fe4b9a151cf XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000 XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000 XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000