Warning: Permanently added '[localhost]:14367' (ED25519) to the list of known hosts. 2025/09/24 10:35:45 parsed 1 programs syzkaller login: [ 62.200652][ T5852] cgroup: Unknown subsys name 'net' [ 62.324355][ T5852] cgroup: Unknown subsys name 'cpuset' [ 62.328732][ T5852] cgroup: Unknown subsys name 'rlimit' [ 64.680472][ T5852] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 67.780621][ T5859] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 68.053829][ T5871] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 68.056961][ T5871] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 68.060488][ T5871] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 68.064973][ T5871] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 68.069311][ T5871] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 68.355605][ T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.360505][ T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.393945][ T1157] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.396991][ T1157] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.328598][ T5916] chnl_net:caif_netlink_parms(): no params data found [ 70.412153][ T5916] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.415676][ T5916] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.418494][ T5916] bridge_slave_0: entered allmulticast mode [ 70.422412][ T5916] bridge_slave_0: entered promiscuous mode [ 70.427261][ T5916] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.429630][ T5916] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.433117][ T5916] bridge_slave_1: entered allmulticast mode [ 70.436401][ T5916] bridge_slave_1: entered promiscuous mode [ 70.464223][ T5916] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.469710][ T5916] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.497377][ T5916] team0: Port device team_slave_0 added [ 70.501726][ T5916] team0: Port device team_slave_1 added [ 70.524556][ T5916] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.526670][ T5916] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.536297][ T5916] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.543537][ T5916] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.546302][ T5916] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.556190][ T5916] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.604059][ T5916] hsr_slave_0: entered promiscuous mode [ 70.607407][ T5916] hsr_slave_1: entered promiscuous mode [ 70.731719][ T5916] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 70.737985][ T5916] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 70.742817][ T5916] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 70.747687][ T5916] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 70.771773][ T5916] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.774230][ T5916] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.777417][ T5916] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.780007][ T5916] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.827342][ T5916] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.839297][ T27] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.843943][ T27] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.855541][ T5916] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.865962][ T27] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.868537][ T27] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.876635][ T27] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.878802][ T27] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.033635][ T5916] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.073855][ T5916] veth0_vlan: entered promiscuous mode [ 71.082684][ T5916] veth1_vlan: entered promiscuous mode [ 71.109994][ T5916] veth0_macvtap: entered promiscuous mode [ 71.115684][ T5916] veth1_macvtap: entered promiscuous mode [ 71.133927][ T5916] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.145062][ T5916] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.156223][ T1362] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.158906][ T1362] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.167320][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.172258][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.175762][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.183328][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.255845][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 71.336504][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 71.394481][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 71.475189][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2025/09/24 10:35:57 executed programs: 0 [ 72.160682][ T5871] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 72.164051][ T5871] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 72.167440][ T5871] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 72.171849][ T5871] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 72.175296][ T5871] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 72.315882][ T5957] chnl_net:caif_netlink_parms(): no params data found [ 72.385769][ T5957] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.388493][ T5957] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.391668][ T5957] bridge_slave_0: entered allmulticast mode [ 72.395382][ T5957] bridge_slave_0: entered promiscuous mode [ 72.400904][ T5957] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.403695][ T5957] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.406698][ T5957] bridge_slave_1: entered allmulticast mode [ 72.410676][ T5957] bridge_slave_1: entered promiscuous mode [ 72.448792][ T5957] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.456146][ T5957] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.487873][ T5957] team0: Port device team_slave_0 added [ 72.492580][ T5957] team0: Port device team_slave_1 added [ 72.516157][ T5957] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.518743][ T5957] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 72.527049][ T5957] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.532609][ T5957] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.534751][ T5957] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 72.543114][ T5957] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.588673][ T5957] hsr_slave_0: entered promiscuous mode [ 72.592278][ T5957] hsr_slave_1: entered promiscuous mode [ 72.595101][ T5957] debugfs: 'hsr0' already exists in 'hsr' [ 72.597378][ T5957] Cannot create hsr debugfs directory [ 73.921937][ T12] bridge_slave_1: left allmulticast mode [ 73.924271][ T12] bridge_slave_1: left promiscuous mode [ 73.926835][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 73.941147][ T12] bridge_slave_0: left allmulticast mode [ 73.943208][ T12] bridge_slave_0: left promiscuous mode [ 73.945488][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.203501][ T5871] Bluetooth: hci0: command tx timeout [ 74.221864][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 74.226295][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 74.229888][ T12] bond0 (unregistering): Released all slaves [ 74.324927][ T12] hsr_slave_0: left promiscuous mode [ 74.330464][ T12] hsr_slave_1: left promiscuous mode [ 74.333386][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 74.339335][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 74.343568][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 74.346054][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 74.358832][ T12] veth1_macvtap: left promiscuous mode [ 74.361019][ T12] veth0_macvtap: left promiscuous mode [ 74.365457][ T12] veth1_vlan: left promiscuous mode [ 74.367631][ T12] veth0_vlan: left promiscuous mode [ 74.688568][ T12] team0 (unregistering): Port device team_slave_1 removed [ 74.717818][ T12] team0 (unregistering): Port device team_slave_0 removed [ 75.195005][ T5957] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 75.202605][ T5957] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 75.209125][ T5957] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 75.224422][ T5957] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 75.431344][ T5957] 8021q: adding VLAN 0 to HW filter on device bond0 [ 75.445352][ T5957] 8021q: adding VLAN 0 to HW filter on device team0 [ 75.463508][ T29] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.466343][ T29] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.484408][ T29] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.487248][ T29] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.674822][ T5957] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.704770][ T5957] veth0_vlan: entered promiscuous mode [ 75.712988][ T5957] veth1_vlan: entered promiscuous mode [ 75.732781][ T5957] veth0_macvtap: entered promiscuous mode [ 75.737474][ T5957] veth1_macvtap: entered promiscuous mode [ 75.750950][ T5957] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.758659][ T5957] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.768282][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.773383][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.777481][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.782881][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.843490][ T29] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.846233][ T29] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.867451][ T1090] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.870769][ T1090] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.894283][ T5999] netlink: 24 bytes leftover after parsing attributes in process `syz.0.17'. [ 75.897310][ T5999] ================================================================== [ 75.899910][ T5999] BUG: KASAN: slab-out-of-bounds in can_setup+0x209/0x280 [ 75.902236][ T5999] Read of size 4 at addr ffff888106a6ee74 by task syz.0.17/5999 [ 75.905923][ T5999] [ 75.906736][ T5999] CPU: 1 UID: 0 PID: 5999 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 75.906747][ T5999] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 75.906752][ T5999] Call Trace: [ 75.906758][ T5999] [ 75.906763][ T5999] dump_stack_lvl+0x189/0x250 [ 75.906775][ T5999] ? rcu_is_watching+0x15/0xb0 [ 75.906783][ T5999] ? __kasan_check_byte+0x12/0x40 [ 75.906795][ T5999] ? __pfx_dump_stack_lvl+0x10/0x10 [ 75.906803][ T5999] ? rcu_is_watching+0x15/0xb0 [ 75.906810][ T5999] ? lock_release+0x4b/0x3e0 [ 75.906822][ T5999] ? __virt_addr_valid+0x1c8/0x5c0 [ 75.906832][ T5999] ? __virt_addr_valid+0x4a5/0x5c0 [ 75.906848][ T5999] print_report+0xca/0x240 [ 75.906856][ T5999] ? can_setup+0x209/0x280 [ 75.906865][ T5999] kasan_report+0x118/0x150 [ 75.906875][ T5999] ? can_setup+0x209/0x280 [ 75.906885][ T5999] can_setup+0x209/0x280 [ 75.906893][ T5999] alloc_netdev_mqs+0x795/0x11b0 [ 75.906906][ T5999] ? __pfx_can_setup+0x10/0x10 [ 75.906915][ T5999] rtnl_create_link+0x31f/0xd10 [ 75.906923][ T5999] rtnl_newlink_create+0x25c/0xb00 [ 75.906933][ T5999] ? __lock_acquire+0xab9/0xd20 [ 75.906944][ T5999] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 75.906954][ T5999] ? __pfx___mutex_lock+0x10/0x10 [ 75.906964][ T5999] ? ns_capable+0x8a/0xf0 [ 75.906972][ T5999] rtnl_newlink+0x16d6/0x1c70 [ 75.907006][ T5999] ? netlink_sendmsg+0x805/0xb30 [ 75.907021][ T5999] ? __pfx_rtnl_newlink+0x10/0x10 [ 75.907033][ T5999] ? kasan_quarantine_put+0xdd/0x220 [ 75.907042][ T5999] ? lockdep_hardirqs_on+0x9c/0x150 [ 75.907051][ T5999] ? nlmon_xmit+0xb0/0x100 [ 75.907060][ T5999] ? kmem_cache_free+0x18f/0x400 [ 75.907072][ T5999] ? __local_bh_enable_ip+0x12d/0x1c0 [ 75.907079][ T5999] ? lockdep_hardirqs_on+0x9c/0x150 [ 75.907086][ T5999] ? __local_bh_enable_ip+0x12d/0x1c0 [ 75.907093][ T5999] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 75.907100][ T5999] ? __dev_queue_xmit+0x27b/0x3b50 [ 75.907111][ T5999] ? __dev_queue_xmit+0x27b/0x3b50 [ 75.907121][ T5999] ? __dev_queue_xmit+0x27b/0x3b50 [ 75.907131][ T5999] ? __dev_queue_xmit+0x1d79/0x3b50 [ 75.907143][ T5999] ? __lock_acquire+0xab9/0xd20 [ 75.907157][ T5999] ? __pfx_rtnl_newlink+0x10/0x10 [ 75.907165][ T5999] rtnetlink_rcv_msg+0x7cf/0xb70 [ 75.907173][ T5999] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 75.907181][ T5999] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 75.907188][ T5999] ? ref_tracker_free+0x63a/0x7d0 [ 75.907196][ T5999] ? __asan_memcpy+0x40/0x70 [ 75.907204][ T5999] ? __pfx_ref_tracker_free+0x10/0x10 [ 75.907210][ T5999] ? __skb_clone+0x63/0x7a0 [ 75.907221][ T5999] netlink_rcv_skb+0x208/0x470 [ 75.907230][ T5999] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 75.907239][ T5999] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 75.907248][ T5999] ? netlink_deliver_tap+0x2e/0x1b0 [ 75.907258][ T5999] netlink_unicast+0x82f/0x9e0 [ 75.907267][ T5999] ? __pfx_netlink_unicast+0x10/0x10 [ 75.907274][ T5999] ? netlink_sendmsg+0x642/0xb30 [ 75.907282][ T5999] ? skb_put+0x11b/0x210 [ 75.907291][ T5999] netlink_sendmsg+0x805/0xb30 [ 75.907301][ T5999] ? __pfx_netlink_sendmsg+0x10/0x10 [ 75.907310][ T5999] ? aa_sock_msg_perm+0xf1/0x1d0 [ 75.907318][ T5999] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 75.907327][ T5999] ? __pfx_netlink_sendmsg+0x10/0x10 [ 75.907335][ T5999] __sock_sendmsg+0x21c/0x270 [ 75.907343][ T5999] ____sys_sendmsg+0x505/0x830 [ 75.907354][ T5999] ? __pfx_____sys_sendmsg+0x10/0x10 [ 75.907365][ T5999] ? import_iovec+0x74/0xa0 [ 75.907376][ T5999] ___sys_sendmsg+0x21f/0x2a0 [ 75.907386][ T5999] ? __pfx____sys_sendmsg+0x10/0x10 [ 75.907397][ T5999] ? futex_hash_put+0x4b/0x60 [ 75.907404][ T5999] ? futex_wake+0x4b2/0x560 [ 75.907419][ T5999] ? count_memcg_event_mm+0x21/0x260 [ 75.907431][ T5999] __x64_sys_sendmsg+0x19b/0x260 [ 75.907441][ T5999] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 75.907454][ T5999] ? do_syscall_64+0xbe/0x3b0 [ 75.907463][ T5999] do_syscall_64+0xfa/0x3b0 [ 75.907471][ T5999] ? lockdep_hardirqs_on+0x9c/0x150 [ 75.907478][ T5999] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.907485][ T5999] ? exc_page_fault+0x9f/0xf0 [ 75.907492][ T5999] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.907499][ T5999] RIP: 0033:0x7f0b7658ec29 [ 75.907508][ T5999] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 75.907514][ T5999] RSP: 002b:00007fff71a7bdf8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 75.907523][ T5999] RAX: ffffffffffffffda RBX: 00007f0b767d5fa0 RCX: 00007f0b7658ec29 [ 75.907528][ T5999] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 75.907533][ T5999] RBP: 00007f0b76611e41 R08: 0000000000000000 R09: 0000000000000000 [ 75.907537][ T5999] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 75.907542][ T5999] R13: 00007f0b767d5fa0 R14: 00007f0b767d5fa0 R15: 0000000000000003 [ 75.907549][ T5999] [ 75.907552][ T5999] [ 76.060366][ T5999] Allocated by task 5999: [ 76.061644][ T5999] kasan_save_track+0x3e/0x80 [ 76.063040][ T5999] __kasan_kmalloc+0x93/0xb0 [ 76.064396][ T5999] __kvmalloc_node_noprof+0x30d/0x5f0 [ 76.066023][ T5999] alloc_netdev_mqs+0xa3/0x11b0 [ 76.067492][ T5999] rtnl_create_link+0x31f/0xd10 [ 76.068932][ T5999] rtnl_newlink_create+0x25c/0xb00 [ 76.070580][ T5999] rtnl_newlink+0x16d6/0x1c70 [ 76.072081][ T5999] rtnetlink_rcv_msg+0x7cf/0xb70 [ 76.073521][ T5999] netlink_rcv_skb+0x208/0x470 [ 76.074936][ T5999] netlink_unicast+0x82f/0x9e0 [ 76.076405][ T5999] netlink_sendmsg+0x805/0xb30 [ 76.078113][ T5999] __sock_sendmsg+0x21c/0x270 [ 76.079714][ T5999] ____sys_sendmsg+0x505/0x830 [ 76.081262][ T5999] ___sys_sendmsg+0x21f/0x2a0 [ 76.083018][ T5999] __x64_sys_sendmsg+0x19b/0x260 [ 76.084739][ T5999] do_syscall_64+0xfa/0x3b0 [ 76.086259][ T5999] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.088322][ T5999] [ 76.089212][ T5999] The buggy address belongs to the object at ffff888106a6e000 [ 76.089212][ T5999] which belongs to the cache kmalloc-cg-4k of size 4096 [ 76.094136][ T5999] The buggy address is located 244 bytes to the right of [ 76.094136][ T5999] allocated 3456-byte region [ffff888106a6e000, ffff888106a6ed80) [ 76.099065][ T5999] [ 76.099836][ T5999] The buggy address belongs to the physical page: [ 76.102019][ T5999] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106a68 [ 76.104879][ T5999] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 76.107515][ T5999] memcg:ffff88810e6ebb41 [ 76.108988][ T5999] flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff) [ 76.111461][ T5999] page_type: f5(slab) [ 76.112743][ T5999] raw: 057ff00000000040 ffff88801a44b500 ffffea00043e4000 dead000000000002 [ 76.115548][ T5999] raw: 0000000000000000 0000000080040004 00000000f5000000 ffff88810e6ebb41 [ 76.118619][ T5999] head: 057ff00000000040 ffff88801a44b500 ffffea00043e4000 dead000000000002 [ 76.121315][ T5999] head: 0000000000000000 0000000080040004 00000000f5000000 ffff88810e6ebb41 [ 76.124013][ T5999] head: 057ff00000000003 ffffea00041a9a01 00000000ffffffff 00000000ffffffff [ 76.126873][ T5999] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 76.129857][ T5999] page dumped because: kasan: bad access detected [ 76.131916][ T5999] page_owner tracks the page as allocated [ 76.133647][ T5999] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd60c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5901, tgid 5901 (syz-executor), ts 69629116017, free_ts 69616324772 [ 76.141691][ T5999] post_alloc_hook+0x240/0x2a0 [ 76.143560][ T5999] get_page_from_freelist+0x21e4/0x22c0 [ 76.145645][ T5999] __alloc_frozen_pages_noprof+0x181/0x370 [ 76.147519][ T5999] alloc_pages_mpol+0x232/0x4a0 [ 76.149201][ T5999] allocate_slab+0x8a/0x370 [ 76.150876][ T5999] ___slab_alloc+0xbeb/0x1420 [ 76.152772][ T5999] __kvmalloc_node_noprof+0x429/0x5f0 [ 76.154814][ T5999] alloc_netdev_mqs+0xa3/0x11b0 [ 76.156653][ T5999] vti6_init_net+0x104/0x370 [ 76.158420][ T5999] ops_init+0x35c/0x5c0 [ 76.160010][ T5999] setup_net+0x10c/0x320 [ 76.161599][ T5999] copy_net_ns+0x31b/0x4d0 [ 76.163287][ T5999] create_new_namespaces+0x3f3/0x720 [ 76.165249][ T5999] unshare_nsproxy_namespaces+0x11c/0x170 [ 76.167414][ T5999] ksys_unshare+0x4c8/0x8c0 [ 76.169122][ T5999] __x64_sys_unshare+0x38/0x50 [ 76.170932][ T5999] page last free pid 5901 tgid 5901 stack trace: [ 76.173317][ T5999] __free_frozen_pages+0xbc4/0xd30 [ 76.175256][ T5999] __slab_free+0x303/0x3c0 [ 76.176829][ T5999] qlist_free_all+0x97/0x140 [ 76.178305][ T5999] kasan_quarantine_reduce+0x148/0x160 [ 76.180362][ T5999] __kasan_slab_alloc+0x22/0x80 [ 76.182240][ T5999] __kmalloc_cache_noprof+0x1be/0x3d0 [ 76.184359][ T5999] ref_tracker_alloc+0x133/0x460 [ 76.186321][ T5999] netdev_queue_update_kobjects+0x1d1/0x6c0 [ 76.188626][ T5999] netdev_register_kobject+0x258/0x310 [ 76.190755][ T5999] register_netdevice+0x126c/0x1ae0 [ 76.192788][ T5999] __ip_tunnel_create+0x3e7/0x560 [ 76.194739][ T5999] ip_tunnel_init_net+0x2ba/0x800 [ 76.196731][ T5999] ops_init+0x35c/0x5c0 [ 76.198382][ T5999] setup_net+0x10c/0x320 [ 76.200050][ T5999] copy_net_ns+0x31b/0x4d0 [ 76.201781][ T5999] create_new_namespaces+0x3f3/0x720 [ 76.203877][ T5999] [ 76.204821][ T5999] Memory state around the buggy address: [ 76.206977][ T5999] ffff888106a6ed00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 76.210034][ T5999] ffff888106a6ed80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 76.212543][ T5999] >ffff888106a6ee00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 76.215442][ T5999] ^ [ 76.218318][ T5999] ffff888106a6ee80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 76.221344][ T5999] ffff888106a6ef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 76.224362][ T5999] ================================================================== [ 76.232899][ T5999] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 76.235644][ T5999] CPU: 1 UID: 0 PID: 5999 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 76.239007][ T5999] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 76.242796][ T5999] Call Trace: [ 76.244088][ T5999] [ 76.245237][ T5999] dump_stack_lvl+0x99/0x250 [ 76.247026][ T5999] ? __asan_memcpy+0x40/0x70 [ 76.248829][ T5999] ? __pfx_dump_stack_lvl+0x10/0x10 [ 76.250474][ T5999] ? __pfx__printk+0x10/0x10 [ 76.251875][ T5999] vpanic+0x281/0x750 [ 76.253151][ T5999] ? preempt_schedule+0xae/0xc0 [ 76.254832][ T5999] ? __pfx_vpanic+0x10/0x10 [ 76.256303][ T5999] ? preempt_schedule_common+0x83/0xd0 [ 76.258021][ T5999] ? preempt_schedule+0xae/0xc0 [ 76.259477][ T5999] ? __pfx_preempt_schedule+0x10/0x10 [ 76.261070][ T5999] panic+0xb9/0xc0 [ 76.262155][ T5999] ? __pfx_panic+0x10/0x10 [ 76.263523][ T5999] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 76.265304][ T5999] ? can_setup+0x209/0x280 [ 76.266662][ T5999] check_panic_on_warn+0x89/0xb0 [ 76.268119][ T5999] ? can_setup+0x209/0x280 [ 76.269409][ T5999] end_report+0x78/0x160 [ 76.270663][ T5999] kasan_report+0x129/0x150 [ 76.272024][ T5999] ? can_setup+0x209/0x280 [ 76.273431][ T5999] can_setup+0x209/0x280 [ 76.274737][ T5999] alloc_netdev_mqs+0x795/0x11b0 [ 76.276456][ T5999] ? __pfx_can_setup+0x10/0x10 [ 76.278005][ T5999] rtnl_create_link+0x31f/0xd10 [ 76.279516][ T5999] rtnl_newlink_create+0x25c/0xb00 [ 76.281171][ T5999] ? __lock_acquire+0xab9/0xd20 [ 76.282793][ T5999] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 76.284980][ T5999] ? __pfx___mutex_lock+0x10/0x10 [ 76.286619][ T5999] ? ns_capable+0x8a/0xf0 [ 76.287907][ T5999] rtnl_newlink+0x16d6/0x1c70 [ 76.289315][ T5999] ? netlink_sendmsg+0x805/0xb30 [ 76.290796][ T5999] ? __pfx_rtnl_newlink+0x10/0x10 [ 76.292311][ T5999] ? kasan_quarantine_put+0xdd/0x220 [ 76.294312][ T5999] ? lockdep_hardirqs_on+0x9c/0x150 [ 76.296321][ T5999] ? nlmon_xmit+0xb0/0x100 [ 76.298084][ T5999] ? kmem_cache_free+0x18f/0x400 [ 76.299982][ T5999] ? __local_bh_enable_ip+0x12d/0x1c0 [ 76.302014][ T5999] ? lockdep_hardirqs_on+0x9c/0x150 [ 76.303829][ T5999] ? __local_bh_enable_ip+0x12d/0x1c0 [ 76.305423][ T5999] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 76.307117][ T5999] ? __dev_queue_xmit+0x27b/0x3b50 [ 76.308687][ T5999] ? __dev_queue_xmit+0x27b/0x3b50 [ 76.310622][ T5999] ? __dev_queue_xmit+0x27b/0x3b50 [ 76.312564][ T5999] ? __dev_queue_xmit+0x1d79/0x3b50 [ 76.314561][ T5999] ? __lock_acquire+0xab9/0xd20 [ 76.316466][ T5999] ? __pfx_rtnl_newlink+0x10/0x10 [ 76.318391][ T5999] rtnetlink_rcv_msg+0x7cf/0xb70 [ 76.320296][ T5999] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 76.322262][ T5999] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 76.324369][ T5999] ? ref_tracker_free+0x63a/0x7d0 [ 76.326517][ T5999] ? __asan_memcpy+0x40/0x70 [ 76.328309][ T5999] ? __pfx_ref_tracker_free+0x10/0x10 [ 76.330349][ T5999] ? __skb_clone+0x63/0x7a0 [ 76.332128][ T5999] netlink_rcv_skb+0x208/0x470 [ 76.333966][ T5999] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 76.335765][ T5999] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 76.337662][ T5999] ? netlink_deliver_tap+0x2e/0x1b0 [ 76.339632][ T5999] netlink_unicast+0x82f/0x9e0 [ 76.341483][ T5999] ? __pfx_netlink_unicast+0x10/0x10 [ 76.343565][ T5999] ? netlink_sendmsg+0x642/0xb30 [ 76.345515][ T5999] ? skb_put+0x11b/0x210 [ 76.347152][ T5999] netlink_sendmsg+0x805/0xb30 [ 76.349028][ T5999] ? __pfx_netlink_sendmsg+0x10/0x10 [ 76.351048][ T5999] ? aa_sock_msg_perm+0xf1/0x1d0 [ 76.352885][ T5999] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 76.354967][ T5999] ? __pfx_netlink_sendmsg+0x10/0x10 [ 76.357031][ T5999] __sock_sendmsg+0x21c/0x270 [ 76.358807][ T5999] ____sys_sendmsg+0x505/0x830 [ 76.360632][ T5999] ? __pfx_____sys_sendmsg+0x10/0x10 [ 76.362634][ T5999] ? import_iovec+0x74/0xa0 [ 76.364363][ T5999] ___sys_sendmsg+0x21f/0x2a0 [ 76.366166][ T5999] ? __pfx____sys_sendmsg+0x10/0x10 [ 76.368128][ T5999] ? futex_hash_put+0x4b/0x60 [ 76.369926][ T5999] ? futex_wake+0x4b2/0x560 [ 76.371694][ T5999] ? count_memcg_event_mm+0x21/0x260 [ 76.373589][ T5999] __x64_sys_sendmsg+0x19b/0x260 [ 76.375090][ T5999] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 76.377096][ T5999] ? do_syscall_64+0xbe/0x3b0 [ 76.378855][ T5999] do_syscall_64+0xfa/0x3b0 [ 76.380590][ T5999] ? lockdep_hardirqs_on+0x9c/0x150 [ 76.382536][ T5999] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.384906][ T5999] ? exc_page_fault+0x9f/0xf0 [ 76.386681][ T5999] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.388920][ T5999] RIP: 0033:0x7f0b7658ec29 [ 76.390701][ T5999] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 76.397970][ T5999] RSP: 002b:00007fff71a7bdf8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 76.401098][ T5999] RAX: ffffffffffffffda RBX: 00007f0b767d5fa0 RCX: 00007f0b7658ec29 [ 76.403496][ T5999] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 76.406108][ T5999] RBP: 00007f0b76611e41 R08: 0000000000000000 R09: 0000000000000000 [ 76.408684][ T5999] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 76.411190][ T5999] R13: 00007f0b767d5fa0 R14: 00007f0b767d5fa0 R15: 0000000000000003 [ 76.413993][ T5999] [ 76.415576][ T5999] Kernel Offset: disabled [ 76.417092][ T5999] Rebooting in 86400 seconds.. VM DIAGNOSIS: 10:36:01 Registers: info registers vcpu 0 CPU#0 RAX=04755207d01adf00 RBX=ffffffff819683f8 RCX=04755207d01adf00 RDX=0000000000000001 RSI=ffffffff8d9bac8e RDI=ffffffff8be33f00 RBP=ffffffff8de07eb8 RSP=ffffffff8de07d80 R8 =ffff88804b032f9b R9 =1ffff110096065f3 R10=dffffc0000000000 R11=ffffed10096065f4 R12=ffffffff8fa39830 R13=0000000000000000 R14=0000000000000000 R15=1ffffffff1bd2a20 RIP=ffffffff8b7b13f3 RFL=00000282 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880b8613000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000555571da0808 CR3=00000001111aa000 CR4=000006f0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0000000000000000 0000000000000000 XMM01=2525252525252525 2525252525252525 XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000 XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 00007f0b76612e7b XMM06=0000000000000000 00007f0b76612e75 XMM07=0000000000000000 00007f0b76612e89 XMM08=0000000000000000 00007f0b76612f0f XMM09=0000000000000000 00007f0b76612fed XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000 XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000 XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000000079 RBX=0000000000000079 RCX=0000000000000000 RDX=00000000000003f8 RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90002b1e6d0 R8 =ffff888107ca8237 R9 =1ffff11020f95046 R10=dffffc0000000000 R11=ffffffff854fac30 R12=dffffc0000000000 R13=ffffffff99b02901 R14=ffffffff99df7480 R15=0000000000000000 RIP=ffffffff854facac RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000555571da0500 ffffffff 00c00000 GS =0000 ffff8881a3c13000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000200000000280 CR3=0000000027fb0000 CR4=000006f0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0000000000000000 0000000000000000 XMM01=6e61630001000a80 1200280000000088 XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000 XMM04=ff00000000000000 00000000000000ff XMM05=0000000000000000 00007f0b76612e7b XMM06=0000000000000000 00007f0b76612e75 XMM07=0000000000000000 00007f0b76612e89 XMM08=0000000000000000 00007f0b76612f0f XMM09=0000000000000000 00007f0b76612fed XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000 XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000 XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000