Warning: Permanently added '[localhost]:18623' (ED25519) to the list of known hosts.
2026/04/23 23:27:09 parsed 1 programs
syzkaller login: [ 55.906277][ T5810] cgroup: Unknown subsys name 'net'
[ 55.990080][ T5810] cgroup: Unknown subsys name 'cpuset'
[ 55.994568][ T5810] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 57.396659][ T5810] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 60.031102][ T5822] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 60.425570][ T55] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 60.430132][ T55] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 60.433057][ T55] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 60.436965][ T55] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 60.439835][ T55] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 61.159312][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 61.162290][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 61.209110][ T3572] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 61.212233][ T3572] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 61.790177][ T5885] chnl_net:caif_netlink_parms(): no params data found
[ 61.967521][ T5885] bridge0: port 1(bridge_slave_0) entered blocking state
[ 61.973306][ T5885] bridge0: port 1(bridge_slave_0) entered disabled state
[ 61.976484][ T5885] bridge_slave_0: entered allmulticast mode
[ 61.980486][ T5885] bridge_slave_0: entered promiscuous mode
[ 61.988629][ T5885] bridge0: port 2(bridge_slave_1) entered blocking state
[ 61.991468][ T5885] bridge0: port 2(bridge_slave_1) entered disabled state
[ 61.994508][ T5885] bridge_slave_1: entered allmulticast mode
[ 61.997200][ T5885] bridge_slave_1: entered promiscuous mode
[ 62.014318][ T5885] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 62.018954][ T5885] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 62.036808][ T5885] team0: Port device team_slave_0 added
[ 62.039976][ T5885] team0: Port device team_slave_1 added
[ 62.121086][ T5885] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 62.123526][ T5885] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 62.131411][ T5885] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 62.137507][ T5885] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 62.139852][ T5885] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 62.148181][ T5885] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 62.184455][ T5885] hsr_slave_0: entered promiscuous mode
[ 62.187135][ T5885] hsr_slave_1: entered promiscuous mode
[ 62.400821][ T5885] netdevsim netdevsim1 netdevsim0: renamed from eth0
[ 62.411358][ T5885] netdevsim netdevsim1 netdevsim1: renamed from eth1
[ 62.419514][ T5885] netdevsim netdevsim1 netdevsim2: renamed from eth2
[ 62.429473][ T5885] netdevsim netdevsim1 netdevsim3: renamed from eth3
[ 62.516294][ T5885] 8021q: adding VLAN 0 to HW filter on device bond0
[ 62.528762][ T5885] 8021q: adding VLAN 0 to HW filter on device team0
[ 62.536875][ T40] bridge0: port 1(bridge_slave_0) entered blocking state
[ 62.539506][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 62.554451][ T40] bridge0: port 2(bridge_slave_1) entered blocking state
[ 62.556730][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 62.577372][ T5885] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 62.671918][ T5885] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 62.701352][ T5885] veth0_vlan: entered promiscuous mode
[ 62.707889][ T5885] veth1_vlan: entered promiscuous mode
[ 62.724923][ T5885] veth0_macvtap: entered promiscuous mode
[ 62.728926][ T5885] veth1_macvtap: entered promiscuous mode
[ 62.738897][ T5885] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 62.747279][ T5885] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 62.757672][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 62.761576][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 62.766538][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 62.772539][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
2026/04/23 23:27:18 executed programs: 0
[ 62.901397][ T55] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 62.905381][ T55] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 62.910214][ T55] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 62.917712][ T55] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 62.924922][ T55] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 62.938734][ T5925] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 62.942400][ T5925] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 62.950222][ T5197] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 62.954268][ T5925] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 62.956228][ T5929] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 62.957319][ T5925] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[ 62.960407][ T5929] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 62.962116][ T5925] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[ 62.968820][ T5925] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[ 62.979097][ T5925] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[ 63.017887][ T5704] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 63.126128][ T5704] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 63.192091][ T5704] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 63.315585][ T5922] chnl_net:caif_netlink_parms(): no params data found
[ 63.346515][ T5924] chnl_net:caif_netlink_parms(): no params data found
[ 63.364374][ T5921] chnl_net:caif_netlink_parms(): no params data found
[ 63.454857][ T5922] bridge0: port 1(bridge_slave_0) entered blocking state
[ 63.457237][ T5922] bridge0: port 1(bridge_slave_0) entered disabled state
[ 63.459441][ T5922] bridge_slave_0: entered allmulticast mode
[ 63.462392][ T5922] bridge_slave_0: entered promiscuous mode
[ 63.485963][ T5922] bridge0: port 2(bridge_slave_1) entered blocking state
[ 63.488472][ T5922] bridge0: port 2(bridge_slave_1) entered disabled state
[ 63.490969][ T5922] bridge_slave_1: entered allmulticast mode
[ 63.494381][ T5922] bridge_slave_1: entered promiscuous mode
[ 63.504015][ T5924] bridge0: port 1(bridge_slave_0) entered blocking state
[ 63.506974][ T5924] bridge0: port 1(bridge_slave_0) entered disabled state
[ 63.509985][ T5924] bridge_slave_0: entered allmulticast mode
[ 63.513925][ T5924] bridge_slave_0: entered promiscuous mode
[ 63.533242][ T5924] bridge0: port 2(bridge_slave_1) entered blocking state
[ 63.536216][ T5924] bridge0: port 2(bridge_slave_1) entered disabled state
[ 63.539074][ T5924] bridge_slave_1: entered allmulticast mode
[ 63.542784][ T5924] bridge_slave_1: entered promiscuous mode
[ 63.580510][ T5922] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 63.586312][ T5922] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 63.596155][ T5921] bridge0: port 1(bridge_slave_0) entered blocking state
[ 63.598190][ T5921] bridge0: port 1(bridge_slave_0) entered disabled state
[ 63.600807][ T5921] bridge_slave_0: entered allmulticast mode
[ 63.604475][ T5921] bridge_slave_0: entered promiscuous mode
[ 63.626503][ T5921] bridge0: port 2(bridge_slave_1) entered blocking state
[ 63.629464][ T5921] bridge0: port 2(bridge_slave_1) entered disabled state
[ 63.631972][ T5921] bridge_slave_1: entered allmulticast mode
[ 63.635462][ T5921] bridge_slave_1: entered promiscuous mode
[ 63.641111][ T5924] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 63.647948][ T5924] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 63.654180][ T5922] team0: Port device team_slave_0 added
[ 63.691134][ T5922] team0: Port device team_slave_1 added
[ 63.710150][ T5921] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 63.716168][ T5921] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 63.720598][ T5924] team0: Port device team_slave_0 added
[ 63.737350][ T5922] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 63.739672][ T5922] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 63.748884][ T5922] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 63.754767][ T5924] team0: Port device team_slave_1 added
[ 63.759292][ T5921] team0: Port device team_slave_0 added
[ 63.770229][ T5922] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 63.772463][ T5922] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 63.781412][ T5922] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 63.787133][ T5921] team0: Port device team_slave_1 added
[ 63.805346][ T5924] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 63.807775][ T5924] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 63.817478][ T5924] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 63.838356][ T5924] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 63.840734][ T5924] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 63.849735][ T5924] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 63.861883][ T5921] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 63.865477][ T5921] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 63.874008][ T5921] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 63.889858][ T5921] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 63.892272][ T5921] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 63.900948][ T5921] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 63.954880][ T5922] hsr_slave_0: entered promiscuous mode
[ 63.957991][ T5922] hsr_slave_1: entered promiscuous mode
[ 63.960846][ T5922] debugfs: 'hsr0' already exists in 'hsr'
[ 63.963968][ T5922] Cannot create hsr debugfs directory
[ 63.990237][ T5921] hsr_slave_0: entered promiscuous mode
[ 63.992554][ T5921] hsr_slave_1: entered promiscuous mode
[ 63.995604][ T5921] debugfs: 'hsr0' already exists in 'hsr'
[ 63.997723][ T5921] Cannot create hsr debugfs directory
[ 64.005623][ T5924] hsr_slave_0: entered promiscuous mode
[ 64.008804][ T5924] hsr_slave_1: entered promiscuous mode
[ 64.011526][ T5924] debugfs: 'hsr0' already exists in 'hsr'
[ 64.013915][ T5924] Cannot create hsr debugfs directory
[ 64.359986][ T5922] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 64.365709][ T5922] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 64.370177][ T5922] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 64.375956][ T5922] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 64.427236][ T5922] 8021q: adding VLAN 0 to HW filter on device bond0
[ 64.439597][ T5922] 8021q: adding VLAN 0 to HW filter on device team0
[ 64.447842][ T1092] bridge0: port 1(bridge_slave_0) entered blocking state
[ 64.450490][ T1092] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 64.465772][ T1092] bridge0: port 2(bridge_slave_1) entered blocking state
[ 64.468664][ T1092] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 64.609230][ T5922] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 64.646471][ T5922] veth0_vlan: entered promiscuous mode
[ 64.655720][ T5922] veth1_vlan: entered promiscuous mode
[ 64.678200][ T5922] veth0_macvtap: entered promiscuous mode
[ 64.683479][ T5922] veth1_macvtap: entered promiscuous mode
[ 64.692802][ T5922] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 64.702102][ T5922] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 64.711168][ T5949] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 64.716517][ T5949] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 64.720809][ T5949] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 64.724766][ T5949] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 64.772256][ T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 64.783065][ T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 64.797823][ T28] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 64.800239][ T28] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 64.940802][ T5704] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 64.984692][ T5925] Bluetooth: hci0: command tx timeout
[ 64.987303][ T5925] Bluetooth: hci1: command tx timeout
[ 65.073928][ T5840] Bluetooth: hci2: command tx timeout
[ 65.956214][ T6007] ==================================================================
[ 65.959584][ T6007] BUG: KASAN: slab-use-after-free in genl_done+0x76/0x220
[ 65.962472][ T6007] Write of size 8 at addr ffff88811b796788 by task syz.0.34/6007
[ 65.966363][ T6007]
[ 65.967382][ T6007] CPU: 0 UID: 0 PID: 6007 Comm: syz.0.34 Not tainted syzkaller #0 PREEMPT(full)
[ 65.967399][ T6007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 65.967406][ T6007] Call Trace:
[ 65.967416][ T6007]
[ 65.967423][ T6007] dump_stack_lvl+0xe8/0x150
[ 65.967447][ T6007] print_address_description+0x55/0x1e0
[ 65.967464][ T6007] ? genl_done+0x76/0x220
[ 65.967481][ T6007] print_report+0x58/0x70
[ 65.967494][ T6007] kasan_report+0x117/0x150
[ 65.967509][ T6007] ? __mutex_unlock_slowpath+0x78a/0x7d0
[ 65.967528][ T6007] ? genl_done+0x76/0x220
[ 65.967546][ T6007] ? __pfx_genl_done+0x10/0x10
[ 65.967569][ T6007] genl_done+0x76/0x220
[ 65.967585][ T6007] ? netlink_dump_cleanup+0x8d/0x120
[ 65.967600][ T6007] ? __pfx_genl_done+0x10/0x10
[ 65.967643][ T6007] netlink_dump_cleanup+0x99/0x120
[ 65.967659][ T6007] netlink_dump+0xbe9/0xf40
[ 65.967675][ T6007] ? __pfx_netlink_dump+0x10/0x10
[ 65.967692][ T6007] ? genl_start+0x581/0x6c0
[ 65.967709][ T6007] __netlink_dump_start+0x5cb/0x7e0
[ 65.967724][ T6007] genl_family_rcv_msg_dumpit+0x213/0x310
[ 65.967743][ T6007] ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10
[ 65.967759][ T6007] ? genl_get_cmd+0x7f4/0x930
[ 65.967775][ T6007] ? __pfx___mutex_lock+0x10/0x10
[ 65.967790][ T6007] ? __pfx_genl_start+0x10/0x10
[ 65.967805][ T6007] ? __pfx_genl_dumpit+0x10/0x10
[ 65.967820][ T6007] ? __pfx_genl_done+0x10/0x10
[ 65.967837][ T6007] ? __lock_acquire+0x6b5/0x2cf0
[ 65.967854][ T6007] genl_rcv_msg+0x5e8/0x7a0
[ 65.967872][ T6007] ? __pfx_genl_rcv_msg+0x10/0x10
[ 65.967887][ T6007] ? __pfx_smc_pnet_dump_start+0x10/0x10
[ 65.967905][ T6007] ? __pfx_smc_pnet_dump+0x10/0x10
[ 65.967921][ T6007] ? __lock_acquire+0x6b5/0x2cf0
[ 65.967938][ T6007] netlink_rcv_skb+0x232/0x4b0
[ 65.967952][ T6007] ? __pfx_genl_rcv_msg+0x10/0x10
[ 65.967968][ T6007] ? __pfx_netlink_rcv_skb+0x10/0x10
[ 65.967986][ T6007] ? down_read+0x272/0x2e0
[ 65.968002][ T6007] ? genl_rcv+0xd/0x40
[ 65.968018][ T6007] genl_rcv+0x28/0x40
[ 65.968033][ T6007] netlink_unicast+0x80f/0x9b0
[ 65.968048][ T6007] ? __pfx_netlink_unicast+0x10/0x10
[ 65.968060][ T6007] ? netlink_sendmsg+0x650/0xb40
[ 65.968073][ T6007] ? skb_put+0x11b/0x210
[ 65.968090][ T6007] netlink_sendmsg+0x813/0xb40
[ 65.968107][ T6007] ? __pfx_netlink_sendmsg+0x10/0x10
[ 65.968122][ T6007] ? aa_sock_msg_perm+0xf1/0x1b0
[ 65.968140][ T6007] ? bpf_lsm_socket_sendmsg+0x9/0x20
[ 65.968155][ T6007] ____sys_sendmsg+0x972/0x9f0
[ 65.968176][ T6007] ? __pfx_____sys_sendmsg+0x10/0x10
[ 65.968195][ T6007] ? import_iovec+0x73/0xa0
[ 65.968208][ T6007] ___sys_sendmsg+0x2a5/0x360
[ 65.968225][ T6007] ? __pfx____sys_sendmsg+0x10/0x10
[ 65.968248][ T6007] ? __fget_files+0x2a/0x420
[ 65.968260][ T6007] ? __fget_files+0x3a0/0x420
[ 65.968272][ T6007] __x64_sys_sendmsg+0x1bd/0x2a0
[ 65.968290][ T6007] ? __pfx___x64_sys_sendmsg+0x10/0x10
[ 65.968306][ T6007] ? __se_sys_rt_sigprocmask+0x22f/0x2a0
[ 65.968325][ T6007] ? do_user_addr_fault+0xc6f/0x1340
[ 65.968344][ T6007] do_syscall_64+0x14d/0xf80
[ 65.968361][ T6007] ? trace_irq_disable+0x3b/0x150
[ 65.968377][ T6007] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 65.968390][ T6007] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 65.968403][ T6007] RIP: 0033:0x7fe33999c819
[ 65.968416][ T6007] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 65.968427][ T6007] RSP: 002b:00007fe33a8da028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 65.968442][ T6007] RAX: ffffffffffffffda RBX: 00007fe339c16090 RCX: 00007fe33999c819
[ 65.968451][ T6007] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004
[ 65.968458][ T6007] RBP: 00007fe339a32c91 R08: 0000000000000000 R09: 0000000000000000
[ 65.968466][ T6007] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 65.968472][ T6007] R13: 00007fe339c16128 R14: 00007fe339c16090 R15: 00007ffe15e728b8
[ 65.968485][ T6007]
[ 65.968489][ T6007]
[ 66.120806][ T6007] Allocated by task 6007:
[ 66.122084][ T6007] kasan_save_track+0x3e/0x80
[ 66.123859][ T6007] __kasan_kmalloc+0x93/0xb0
[ 66.125315][ T6007] __kmalloc_cache_noprof+0x31c/0x660
[ 66.127082][ T6007] genl_start+0x1c9/0x6c0
[ 66.128661][ T6007] __netlink_dump_start+0x469/0x7e0
[ 66.130507][ T6007] genl_family_rcv_msg_dumpit+0x213/0x310
[ 66.132564][ T6007] genl_rcv_msg+0x5e8/0x7a0
[ 66.134121][ T6007] netlink_rcv_skb+0x232/0x4b0
[ 66.135867][ T6007] genl_rcv+0x28/0x40
[ 66.137235][ T6007] netlink_unicast+0x80f/0x9b0
[ 66.138844][ T6007] netlink_sendmsg+0x813/0xb40
[ 66.140410][ T6007] ____sys_sendmsg+0x972/0x9f0
[ 66.142123][ T6007] ___sys_sendmsg+0x2a5/0x360
[ 66.143781][ T6007] __x64_sys_sendmsg+0x1bd/0x2a0
[ 66.145859][ T6007] do_syscall_64+0x14d/0xf80
[ 66.147468][ T6007] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 66.149302][ T6007]
[ 66.150036][ T6007] Freed by task 6006:
[ 66.151339][ T6007] kasan_save_track+0x3e/0x80
[ 66.153134][ T6007] kasan_save_free_info+0x46/0x50
[ 66.154957][ T6007] __kasan_slab_free+0x5c/0x80
[ 66.156665][ T6007] kfree+0x1c5/0x640
[ 66.158039][ T6007] genl_done+0x1c8/0x220
[ 66.159470][ T6007] netlink_dump_cleanup+0x99/0x120
[ 66.161426][ T6007] netlink_dump+0xbe9/0xf40
[ 66.163082][ T6007] netlink_recvmsg+0x690/0xa50
[ 66.165095][ T6007] sock_recvmsg+0x172/0x1b0
[ 66.166743][ T6007] sock_read_iter+0x251/0x320
[ 66.168381][ T6007] vfs_read+0x582/0xa70
[ 66.169890][ T6007] ksys_read+0x150/0x270
[ 66.171323][ T6007] do_syscall_64+0x14d/0xf80
[ 66.172793][ T6007] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 66.174844][ T6007]
[ 66.175765][ T6007] The buggy address belongs to the object at ffff88811b796700
[ 66.175765][ T6007] which belongs to the cache kmalloc-192 of size 192
[ 66.180357][ T6007] The buggy address is located 136 bytes inside of
[ 66.180357][ T6007] freed 192-byte region [ffff88811b796700, ffff88811b7967c0)
[ 66.185296][ T6007]
[ 66.186203][ T6007] The buggy address belongs to the physical page:
[ 66.188190][ T6007] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11b796
[ 66.190986][ T6007] flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
[ 66.193333][ T6007] page_type: f5(slab)
[ 66.194581][ T6007] raw: 017ff00000000000 ffff8881000413c0 dead000000000100 dead000000000122
[ 66.197412][ T6007] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
[ 66.200020][ T6007] page dumped because: kasan: bad access detected
[ 66.201951][ T6007] page_owner tracks the page as allocated
[ 66.203693][ T6007] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5922, tgid 5922 (syz-executor), ts 64892204905, free_ts 61400269257
[ 66.209960][ T6007] post_alloc_hook+0x231/0x280
[ 66.211441][ T6007] get_page_from_freelist+0x24ba/0x2540
[ 66.213308][ T6007] __alloc_frozen_pages_noprof+0x18d/0x380
[ 66.215207][ T6007] allocate_slab+0x77/0x660
[ 66.216681][ T6007] refill_objects+0x331/0x3c0
[ 66.218229][ T6007] __pcs_replace_empty_main+0x2e6/0x730
[ 66.219966][ T6007] __kmalloc_node_noprof+0x577/0x7c0
[ 66.221603][ T6007] alloc_slab_obj_exts+0xbf/0x250
[ 66.223280][ T6007] __memcg_slab_post_alloc_hook+0x5c4/0xe80
[ 66.225302][ T6007] kmem_cache_alloc_noprof+0x347/0x650
[ 66.227347][ T6007] vm_area_dup+0x2b/0x680
[ 66.228870][ T6007] dup_mmap+0x8b1/0x1d90
[ 66.230189][ T6007] copy_mm+0x13b/0x4a0
[ 66.231421][ T6007] copy_process+0x18b6/0x3cd0
[ 66.233080][ T6007] kernel_clone+0x248/0x8e0
[ 66.234566][ T6007] __x64_sys_clone+0x1b6/0x230
[ 66.236188][ T6007] page last free pid 10 tgid 10 stack trace:
[ 66.238393][ T6007] __free_frozen_pages+0xbc7/0xd30
[ 66.240089][ T6007] kasan_depopulate_vmalloc_pte+0x6d/0x90
[ 66.241893][ T6007] __apply_to_page_range+0xbdc/0x1420
[ 66.243905][ T6007] __kasan_release_vmalloc+0xa2/0xd0
[ 66.245592][ T6007] purge_vmap_node+0x220/0x960
[ 66.247130][ T6007] __purge_vmap_area_lazy+0x779/0xb70
[ 66.248972][ T6007] drain_vmap_area_work+0x27/0x40
[ 66.250701][ T6007] process_scheduled_works+0xb6e/0x18c0
[ 66.252642][ T6007] worker_thread+0xa53/0xfc0
[ 66.254403][ T6007] kthread+0x388/0x470
[ 66.256105][ T6007] ret_from_fork+0x51e/0xb90
[ 66.257860][ T6007] ret_from_fork_asm+0x1a/0x30
[ 66.259733][ T6007]
[ 66.260644][ T6007] Memory state around the buggy address:
[ 66.262708][ T6007] ffff88811b796680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 66.265372][ T6007] ffff88811b796700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 66.268196][ T6007] >ffff88811b796780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 66.271089][ T6007] ^
[ 66.272576][ T6007] ffff88811b796800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 66.275660][ T6007] ffff88811b796880: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
[ 66.278670][ T6007] ==================================================================
[ 66.292245][ T6007] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 66.294844][ T6007] CPU: 0 UID: 0 PID: 6007 Comm: syz.0.34 Not tainted syzkaller #0 PREEMPT(full)
[ 66.297869][ T6007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 66.301045][ T6007] Call Trace:
[ 66.302366][ T6007]
[ 66.303478][ T6007] vpanic+0x56c/0xa60
[ 66.305042][ T6007] ? __pfx_vpanic+0x10/0x10
[ 66.306852][ T6007] panic+0xc5/0xd0
[ 66.308130][ T6007] ? __pfx_panic+0x10/0x10
[ 66.309551][ T6007] ? preempt_schedule_thunk+0x16/0x30
[ 66.311280][ T6007] ? genl_done+0x76/0x220
[ 66.312675][ T6007] ? preempt_schedule_thunk+0x16/0x30
[ 66.314387][ T6007] ? genl_done+0x76/0x220
[ 66.315956][ T6007] check_panic_on_warn+0x89/0xb0
[ 66.317593][ T6007] ? genl_done+0x76/0x220
[ 66.319017][ T6007] end_report+0x73/0x180
[ 66.320379][ T6007] ? genl_done+0x76/0x220
[ 66.322042][ T6007] kasan_report+0x128/0x150
[ 66.323871][ T6007] ? __mutex_unlock_slowpath+0x78a/0x7d0
[ 66.325885][ T6007] ? genl_done+0x76/0x220
[ 66.327240][ T6007] ? __pfx_genl_done+0x10/0x10
[ 66.328759][ T6007] genl_done+0x76/0x220
[ 66.330332][ T6007] ? netlink_dump_cleanup+0x8d/0x120
[ 66.332312][ T6007] ? __pfx_genl_done+0x10/0x10
[ 66.334084][ T6007] netlink_dump_cleanup+0x99/0x120
[ 66.335824][ T6007] netlink_dump+0xbe9/0xf40
[ 66.337278][ T6007] ? __pfx_netlink_dump+0x10/0x10
[ 66.339094][ T6007] ? genl_start+0x581/0x6c0
[ 66.340543][ T6007] __netlink_dump_start+0x5cb/0x7e0
[ 66.342353][ T6007] genl_family_rcv_msg_dumpit+0x213/0x310
[ 66.344451][ T6007] ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10
[ 66.346798][ T6007] ? genl_get_cmd+0x7f4/0x930
[ 66.348292][ T6007] ? __pfx___mutex_lock+0x10/0x10
[ 66.349895][ T6007] ? __pfx_genl_start+0x10/0x10
[ 66.351434][ T6007] ? __pfx_genl_dumpit+0x10/0x10
[ 66.353104][ T6007] ? __pfx_genl_done+0x10/0x10
[ 66.354858][ T6007] ? __lock_acquire+0x6b5/0x2cf0
[ 66.356872][ T6007] genl_rcv_msg+0x5e8/0x7a0
[ 66.358350][ T6007] ? __pfx_genl_rcv_msg+0x10/0x10
[ 66.359944][ T6007] ? __pfx_smc_pnet_dump_start+0x10/0x10
[ 66.361702][ T6007] ? __pfx_smc_pnet_dump+0x10/0x10
[ 66.363477][ T6007] ? __lock_acquire+0x6b5/0x2cf0
[ 66.365181][ T6007] netlink_rcv_skb+0x232/0x4b0
[ 66.366749][ T6007] ? __pfx_genl_rcv_msg+0x10/0x10
[ 66.368352][ T6007] ? __pfx_netlink_rcv_skb+0x10/0x10
[ 66.370073][ T6007] ? down_read+0x272/0x2e0
[ 66.371599][ T6007] ? genl_rcv+0xd/0x40
[ 66.372902][ T6007] genl_rcv+0x28/0x40
[ 66.374238][ T6007] netlink_unicast+0x80f/0x9b0
[ 66.375705][ T6007] ? __pfx_netlink_unicast+0x10/0x10
[ 66.377308][ T6007] ? netlink_sendmsg+0x650/0xb40
[ 66.378963][ T6007] ? skb_put+0x11b/0x210
[ 66.380249][ T6007] netlink_sendmsg+0x813/0xb40
[ 66.381712][ T6007] ? __pfx_netlink_sendmsg+0x10/0x10
[ 66.383353][ T6007] ? aa_sock_msg_perm+0xf1/0x1b0
[ 66.384992][ T6007] ? bpf_lsm_socket_sendmsg+0x9/0x20
[ 66.386678][ T6007] ____sys_sendmsg+0x972/0x9f0
[ 66.388107][ T6007] ? __pfx_____sys_sendmsg+0x10/0x10
[ 66.389792][ T6007] ? import_iovec+0x73/0xa0
[ 66.391263][ T6007] ___sys_sendmsg+0x2a5/0x360
[ 66.392704][ T6007] ? __pfx____sys_sendmsg+0x10/0x10
[ 66.394255][ T6007] ? __fget_files+0x2a/0x420
[ 66.395657][ T6007] ? __fget_files+0x3a0/0x420
[ 66.397215][ T6007] __x64_sys_sendmsg+0x1bd/0x2a0
[ 66.399115][ T6007] ? __pfx___x64_sys_sendmsg+0x10/0x10
[ 66.401246][ T6007] ? __se_sys_rt_sigprocmask+0x22f/0x2a0
[ 66.403380][ T6007] ? do_user_addr_fault+0xc6f/0x1340
[ 66.405104][ T6007] do_syscall_64+0x14d/0xf80
[ 66.406673][ T6007] ? trace_irq_disable+0x3b/0x150
[ 66.408330][ T6007] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 66.410180][ T6007] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 66.411967][ T6007] RIP: 0033:0x7fe33999c819
[ 66.413348][ T6007] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 66.419519][ T6007] RSP: 002b:00007fe33a8da028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 66.422333][ T6007] RAX: ffffffffffffffda RBX: 00007fe339c16090 RCX: 00007fe33999c819
[ 66.424965][ T6007] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004
[ 66.427265][ T6007] RBP: 00007fe339a32c91 R08: 0000000000000000 R09: 0000000000000000
[ 66.429523][ T6007] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 66.431962][ T6007] R13: 00007fe339c16128 R14: 00007fe339c16090 R15: 00007ffe15e728b8
[ 66.434767][ T6007]
[ 66.436591][ T6007] Kernel Offset: disabled
[ 66.437901][ T6007] Rebooting in 86400 seconds..
VM DIAGNOSIS:
23:27:22 Registers:
info registers vcpu 0
CPU#0
RAX=1ffffffff34b9960 RBX=00000000000003fd RCX=0000000000000000 RDX=00000000000003fd
RSI=0000000000000000 RDI=0000000000000020 RBP=ffffffff9a5ccb90 RSP=ffffc900036a6a90
R8 =ffff888109930237 R9 =1ffff11021326046 R10=dffffc0000000000 R11=ffffffff853ecbc0
R12=dffffc0000000000 R13=0000000000000000 R14=ffffffff9a5cc900 R15=0000000000000000
RIP=ffffffff853ecc37 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007fe33a8da6c0 ffffffff 00c00000
GS =0000 ffff88818de62000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007fe33a8d9ff8 CR3=0000000175578000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=2525252525252525 2525252525252525
XMM02=00007fe339bec5e8 00007fe339bec618 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 00000000000000ff XMM05=00007fe339bec5d0 00007fe339bec610
XMM06=00007fe339bec5f8 00007fe339bec5c8 XMM07=00007fe339bec600 00007fe339bec5e0
XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1
CPU#1
RAX=000000000003d69f RBX=ffffffff819a857a RCX=0000000080000001 RDX=0000000000000001
RSI=ffffffff8defca20 RDI=ffffffff8c27f880 RBP=ffffc90000197f10 RSP=ffffc90000197e20
R8 =ffff88823c63399b R9 =1ffff110478c6733 R10=dffffc0000000000 R11=ffffed10478c6734
R12=0000000000000001 R13=1ffff1102c095000 R14=0000000000000001 R15=1ffff1102c095000
RIP=ffffffff8bac3e9f RFL=00000206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8882a9462000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000048000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007fe33a74da08 CR3=00000001b77a0000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=ffffffffffffff00 ffffffffffffffff
XMM02=ffffffffffffffff ffffffffffff0000 XMM03=ffffffffffffff00 ffffffffffff0000
XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 000000524f525245 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000