Warning: Permanently added '[localhost]:8607' (ED25519) to the list of known hosts.
2025/11/21 04:41:00 parsed 1 programs
syzkaller login: [ 51.939724][ T5814] cgroup: Unknown subsys name 'net'
[ 52.089832][ T5814] cgroup: Unknown subsys name 'cpuset'
[ 52.095015][ T5814] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 54.298208][ T5814] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 57.106957][ T5823] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 58.214183][ T5847] chnl_net:caif_netlink_parms(): no params data found
[ 58.379252][ T5847] bridge0: port 1(bridge_slave_0) entered blocking state
[ 58.382168][ T5847] bridge0: port 1(bridge_slave_0) entered disabled state
[ 58.385006][ T5847] bridge_slave_0: entered allmulticast mode
[ 58.409770][ T5847] bridge_slave_0: entered promiscuous mode
[ 58.428913][ T5847] bridge0: port 2(bridge_slave_1) entered blocking state
[ 58.433452][ T5847] bridge0: port 2(bridge_slave_1) entered disabled state
[ 58.439733][ T5847] bridge_slave_1: entered allmulticast mode
[ 58.443400][ T5847] bridge_slave_1: entered promiscuous mode
[ 58.499738][ T5847] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 58.508201][ T5847] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 58.553977][ T5847] team0: Port device team_slave_0 added
[ 58.655250][ T5847] team0: Port device team_slave_1 added
[ 58.729550][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 58.732529][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 58.743922][ T5847] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 58.751407][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 58.753651][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 58.761521][ T5847] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 58.786425][ T5880] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 58.790234][ T5880] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 58.794101][ T5880] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 58.800314][ T5880] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 58.803717][ T5880] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 58.836644][ T5847] hsr_slave_0: entered promiscuous mode
[ 58.844899][ T5847] hsr_slave_1: entered promiscuous mode
[ 59.340205][ T5847] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 59.361559][ T5847] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 59.390066][ T5847] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 59.407012][ T5847] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 59.518514][ T1102] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 59.521836][ T1102] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 59.578072][ T1091] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 59.586492][ T1091] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 59.663631][ T5847] 8021q: adding VLAN 0 to HW filter on device bond0
[ 59.712438][ T5847] 8021q: adding VLAN 0 to HW filter on device team0
[ 59.734237][ T26] bridge0: port 1(bridge_slave_0) entered blocking state
[ 59.736732][ T26] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 59.744264][ T26] bridge0: port 2(bridge_slave_1) entered blocking state
[ 59.746612][ T26] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 59.761625][ T5847] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[ 59.764877][ T5847] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 59.884576][ T5847] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 59.998514][ T5847] veth0_vlan: entered promiscuous mode
[ 60.009467][ T5847] veth1_vlan: entered promiscuous mode
[ 60.039185][ T5847] veth0_macvtap: entered promiscuous mode
[ 60.044813][ T5847] veth1_macvtap: entered promiscuous mode
[ 60.062165][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 60.076390][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 60.095460][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 60.102124][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 60.105690][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 60.119183][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
2025/11/21 04:41:10 executed programs: 0
[ 60.312686][ T55] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 60.320018][ T55] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 60.323183][ T55] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 60.332294][ T5929] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 60.335397][ T5929] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 60.335732][ T5930] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 60.342009][ T5929] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 60.346555][ T5880] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 60.351721][ T5930] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 60.352742][ T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 60.358987][ T5930] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 60.378040][ T55] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 60.381447][ T55] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[ 60.384579][ T55] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[ 60.390479][ T55] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[ 60.393840][ T55] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[ 60.426206][ T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 60.484867][ T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 60.561787][ T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 60.629176][ T5924] chnl_net:caif_netlink_parms(): no params data found
[ 60.695205][ T5927] chnl_net:caif_netlink_parms(): no params data found
[ 60.752852][ T5924] bridge0: port 1(bridge_slave_0) entered blocking state
[ 60.755296][ T5924] bridge0: port 1(bridge_slave_0) entered disabled state
[ 60.758727][ T5924] bridge_slave_0: entered allmulticast mode
[ 60.761350][ T5924] bridge_slave_0: entered promiscuous mode
[ 60.764627][ T5924] bridge0: port 2(bridge_slave_1) entered blocking state
[ 60.767940][ T5924] bridge0: port 2(bridge_slave_1) entered disabled state
[ 60.770426][ T5924] bridge_slave_1: entered allmulticast mode
[ 60.773421][ T5924] bridge_slave_1: entered promiscuous mode
[ 60.812960][ T5931] chnl_net:caif_netlink_parms(): no params data found
[ 60.834847][ T5924] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 60.853058][ T5924] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 60.908733][ T5924] team0: Port device team_slave_0 added
[ 60.916130][ T5927] bridge0: port 1(bridge_slave_0) entered blocking state
[ 60.919015][ T5927] bridge0: port 1(bridge_slave_0) entered disabled state
[ 60.921774][ T5927] bridge_slave_0: entered allmulticast mode
[ 60.925480][ T5927] bridge_slave_0: entered promiscuous mode
[ 60.930594][ T5924] team0: Port device team_slave_1 added
[ 60.950593][ T5927] bridge0: port 2(bridge_slave_1) entered blocking state
[ 60.953291][ T5927] bridge0: port 2(bridge_slave_1) entered disabled state
[ 60.956557][ T5927] bridge_slave_1: entered allmulticast mode
[ 60.959960][ T5927] bridge_slave_1: entered promiscuous mode
[ 61.019330][ T5927] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 61.023314][ T5924] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 61.026413][ T5924] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 61.036692][ T5924] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 61.067307][ T5927] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 61.071391][ T5924] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 61.074167][ T5924] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 61.084748][ T5924] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 61.096510][ T5931] bridge0: port 1(bridge_slave_0) entered blocking state
[ 61.099272][ T5931] bridge0: port 1(bridge_slave_0) entered disabled state
[ 61.101921][ T5931] bridge_slave_0: entered allmulticast mode
[ 61.105295][ T5931] bridge_slave_0: entered promiscuous mode
[ 61.109837][ T5931] bridge0: port 2(bridge_slave_1) entered blocking state
[ 61.112485][ T5931] bridge0: port 2(bridge_slave_1) entered disabled state
[ 61.115163][ T5931] bridge_slave_1: entered allmulticast mode
[ 61.119184][ T5931] bridge_slave_1: entered promiscuous mode
[ 61.173075][ T5927] team0: Port device team_slave_0 added
[ 61.177681][ T5927] team0: Port device team_slave_1 added
[ 61.182752][ T5931] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 61.217486][ T5931] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 61.271161][ T5924] hsr_slave_0: entered promiscuous mode
[ 61.273952][ T5924] hsr_slave_1: entered promiscuous mode
[ 61.277335][ T5924] debugfs: 'hsr0' already exists in 'hsr'
[ 61.279515][ T5924] Cannot create hsr debugfs directory
[ 61.283965][ T5927] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 61.287540][ T5927] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 61.296683][ T5927] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 61.303279][ T5931] team0: Port device team_slave_0 added
[ 61.308488][ T5931] team0: Port device team_slave_1 added
[ 61.312892][ T5927] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 61.315364][ T5927] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 61.324473][ T5927] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 61.375592][ T5931] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 61.378582][ T5931] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 61.389150][ T5931] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 61.416836][ T5931] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 61.419429][ T5931] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 61.428702][ T5931] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 61.482687][ T5927] hsr_slave_0: entered promiscuous mode
[ 61.485774][ T5927] hsr_slave_1: entered promiscuous mode
[ 61.489113][ T5927] debugfs: 'hsr0' already exists in 'hsr'
[ 61.491686][ T5927] Cannot create hsr debugfs directory
[ 61.580950][ T5931] hsr_slave_0: entered promiscuous mode
[ 61.583901][ T5931] hsr_slave_1: entered promiscuous mode
[ 61.587521][ T5931] debugfs: 'hsr0' already exists in 'hsr'
[ 61.589606][ T5931] Cannot create hsr debugfs directory
[ 62.366997][ T5930] Bluetooth: hci0: command tx timeout
[ 62.453813][ T13] bridge_slave_1: left allmulticast mode
[ 62.456732][ T5930] Bluetooth: hci2: command tx timeout
[ 62.457040][ T13] bridge_slave_1: left promiscuous mode
[ 62.459111][ T5930] Bluetooth: hci1: command tx timeout
[ 62.461059][ T13] bridge0: port 2(bridge_slave_1) entered disabled state
[ 62.468681][ T13] bridge_slave_0: left allmulticast mode
[ 62.470422][ T13] bridge_slave_0: left promiscuous mode
[ 62.472215][ T13] bridge0: port 1(bridge_slave_0) entered disabled state
[ 62.667431][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 62.672822][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 62.677845][ T13] bond0 (unregistering): Released all slaves
[ 62.806345][ T13] hsr_slave_0: left promiscuous mode
[ 62.813062][ T13] hsr_slave_1: left promiscuous mode
[ 62.815150][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 62.818107][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 62.821274][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 62.823577][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 62.835455][ T13] veth1_macvtap: left promiscuous mode
[ 62.838683][ T13] veth0_macvtap: left promiscuous mode
[ 62.840455][ T13] veth1_vlan: left promiscuous mode
[ 62.842083][ T13] veth0_vlan: left promiscuous mode
[ 63.014365][ T13] team0 (unregistering): Port device team_slave_1 removed
[ 63.029090][ T13] team0 (unregistering): Port device team_slave_0 removed
[ 63.309787][ T5927] netdevsim netdevsim2 netdevsim0: renamed from eth0
[ 63.321154][ T5927] netdevsim netdevsim2 netdevsim1: renamed from eth1
[ 63.330600][ T5927] netdevsim netdevsim2 netdevsim2: renamed from eth2
[ 63.336144][ T5927] netdevsim netdevsim2 netdevsim3: renamed from eth3
[ 63.369105][ T5931] netdevsim netdevsim1 netdevsim0: renamed from eth0
[ 63.378751][ T5931] netdevsim netdevsim1 netdevsim1: renamed from eth1
[ 63.391737][ T5931] netdevsim netdevsim1 netdevsim2: renamed from eth2
[ 63.409692][ T5931] netdevsim netdevsim1 netdevsim3: renamed from eth3
[ 63.461643][ T5924] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 63.472656][ T5927] 8021q: adding VLAN 0 to HW filter on device bond0
[ 63.475654][ T5924] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 63.482450][ T5924] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 63.525437][ T5924] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 63.554914][ T5927] 8021q: adding VLAN 0 to HW filter on device team0
[ 63.574420][ T1102] bridge0: port 1(bridge_slave_0) entered blocking state
[ 63.577328][ T1102] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 63.582543][ T1102] bridge0: port 2(bridge_slave_1) entered blocking state
[ 63.585043][ T1102] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 63.643058][ T5927] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[ 63.651266][ T5927] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 63.698784][ T5924] 8021q: adding VLAN 0 to HW filter on device bond0
[ 63.709679][ T5931] 8021q: adding VLAN 0 to HW filter on device bond0
[ 63.721276][ T5924] 8021q: adding VLAN 0 to HW filter on device team0
[ 63.738599][ T5931] 8021q: adding VLAN 0 to HW filter on device team0
[ 63.758118][ T1102] bridge0: port 1(bridge_slave_0) entered blocking state
[ 63.761110][ T1102] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 63.770906][ T1102] bridge0: port 1(bridge_slave_0) entered blocking state
[ 63.773339][ T1102] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 63.779309][ T26] bridge0: port 2(bridge_slave_1) entered blocking state
[ 63.782015][ T26] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 63.787065][ T26] bridge0: port 2(bridge_slave_1) entered blocking state
[ 63.789822][ T26] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 63.798013][ T5927] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 63.849671][ T5927] veth0_vlan: entered promiscuous mode
[ 63.869070][ T5927] veth1_vlan: entered promiscuous mode
[ 63.886802][ T5927] veth0_macvtap: entered promiscuous mode
[ 63.891114][ T5927] veth1_macvtap: entered promiscuous mode
[ 63.900857][ T5927] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 63.909111][ T5927] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 63.917963][ T5884] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 63.924123][ T5884] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 63.939700][ T5884] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 63.942381][ T5884] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 63.983450][ T5931] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 63.990246][ T5924] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 63.992470][ T29] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 63.995441][ T29] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 64.027422][ T29] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 64.033742][ T5931] veth0_vlan: entered promiscuous mode
[ 64.039204][ T5931] veth1_vlan: entered promiscuous mode
[ 64.044665][ T29] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 64.055777][ T5924] veth0_vlan: entered promiscuous mode
[ 64.073836][ T5924] veth1_vlan: entered promiscuous mode
[ 64.091668][ T5931] veth0_macvtap: entered promiscuous mode
[ 64.107954][ T5924] veth0_macvtap: entered promiscuous mode
[ 64.112086][ T5931] veth1_macvtap: entered promiscuous mode
[ 64.112765][ T6006] ==================================================================
[ 64.117487][ T6006] BUG: KASAN: slab-out-of-bounds in tcp_ioctl+0x673/0x860
[ 64.120192][ T6006] Read of size 2 at addr ffff8881114d5df6 by task syz.2.19/6006
[ 64.123908][ T6006]
[ 64.124837][ T6006] CPU: 0 UID: 0 PID: 6006 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full)
[ 64.124851][ T6006] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 64.124858][ T6006] Call Trace:
[ 64.124863][ T6006]
[ 64.124868][ T6006] dump_stack_lvl+0x189/0x250
[ 64.124885][ T6006] ? __kasan_check_byte+0x12/0x40
[ 64.124899][ T6006] ? __pfx_dump_stack_lvl+0x10/0x10
[ 64.124912][ T6006] ? lock_release+0x4b/0x3e0
[ 64.124920][ T6006] ? __virt_addr_valid+0x4a5/0x5c0
[ 64.124930][ T6006] print_report+0xca/0x240
[ 64.124938][ T6006] ? tcp_ioctl+0x673/0x860
[ 64.124945][ T6006] kasan_report+0x118/0x150
[ 64.124952][ T6006] ? stack_trace_save+0x9c/0xe0
[ 64.124961][ T6006] ? tcp_ioctl+0x673/0x860
[ 64.124968][ T6006] tcp_ioctl+0x673/0x860
[ 64.124974][ T6006] ? kasan_save_track+0x4f/0x80
[ 64.124980][ T6006] ? kasan_save_track+0x3e/0x80
[ 64.124986][ T6006] ? __kasan_save_free_info+0x46/0x50
[ 64.124994][ T6006] ? udp_bpf_ioctl+0xaa/0x1d0
[ 64.125002][ T6006] sk_ioctl+0x3c7/0x600
[ 64.125009][ T6006] ? __pfx_sk_ioctl+0x10/0x10
[ 64.125019][ T6006] inet_ioctl+0x416/0x4c0
[ 64.125027][ T6006] ? __pfx_inet_ioctl+0x10/0x10
[ 64.125034][ T6006] ? lockdep_hardirqs_on+0x9c/0x150
[ 64.125044][ T6006] ? tomoyo_path_number_perm+0x1bc/0x5a0
[ 64.125055][ T6006] ? __pfx_do_vfs_ioctl+0x10/0x10
[ 64.125067][ T6006] sock_do_ioctl+0xdc/0x300
[ 64.125077][ T6006] ? __pfx_sock_do_ioctl+0x10/0x10
[ 64.125088][ T6006] sock_ioctl+0x576/0x790
[ 64.125098][ T6006] ? __pfx_sock_ioctl+0x10/0x10
[ 64.125107][ T6006] ? __fget_files+0x3a0/0x420
[ 64.125114][ T6006] ? __fget_files+0x2a/0x420
[ 64.125121][ T6006] ? bpf_lsm_file_ioctl+0x9/0x20
[ 64.125130][ T6006] ? __pfx_sock_ioctl+0x10/0x10
[ 64.125139][ T6006] __se_sys_ioctl+0xfc/0x170
[ 64.125148][ T6006] do_syscall_64+0xfa/0xfa0
[ 64.125155][ T6006] ? lockdep_hardirqs_on+0x9c/0x150
[ 64.125161][ T6006] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 64.125168][ T6006] ? exc_page_fault+0xab/0x100
[ 64.125174][ T6006] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 64.125181][ T6006] RIP: 0033:0x7f472558f6c9
[ 64.125188][ T6006] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 64.125194][ T6006] RSP: 002b:00007f472647a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 64.125203][ T6006] RAX: ffffffffffffffda RBX: 00007f47257e5fa0 RCX: 00007f472558f6c9
[ 64.125208][ T6006] RDX: 0000000000000000 RSI: 0000000000008905 RDI: 0000000000000004
[ 64.125213][ T6006] RBP: 00007f4725611f91 R08: 0000000000000000 R09: 0000000000000000
[ 64.125217][ T6006] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 64.125221][ T6006] R13: 00007f47257e6038 R14: 00007f47257e5fa0 R15: 00007ffcbb3f8478
[ 64.125228][ T6006]
[ 64.125231][ T6006]
[ 64.125315][ T5931] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 64.128657][ T6006] The buggy address belongs to the object at ffff8881114d5d80
[ 64.128657][ T6006] which belongs to the cache UDP of size 1984
[ 64.128668][ T6006] The buggy address is located 118 bytes inside of
[ 64.128668][ T6006] allocated 1984-byte region [ffff8881114d5d80, ffff8881114d6540)
[ 64.128679][ T6006]
[ 64.128682][ T6006] The buggy address belongs to the physical page:
[ 64.128687][ T6006] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1114d0
[ 64.128694][ T6006] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 64.128699][ T6006] memcg:ffff88811112a501
[ 64.128703][ T6006] flags: 0x17ff00000000040(head|node=0|zone=2|lastcpupid=0x7ff)
[ 64.128710][ T6006] page_type: f5(slab)
[ 64.128717][ T6006] raw: 017ff00000000040 ffff888105697000 dead000000000122 0000000000000000
[ 64.128723][ T6006] raw: 0000000000000000 00000000800f000f 00000000f5000000 ffff88811112a501
[ 64.135202][ T5931] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 64.136997][ T6006] head: 017ff00000000040 ffff888105697000 dead000000000122 0000000000000000
[ 64.137008][ T6006] head: 0000000000000000 00000000800f000f 00000000f5000000 ffff88811112a501
[ 64.137017][ T6006] head: 017ff00000000003 ffffea0004453401 00000000ffffffff 00000000ffffffff
[ 64.137026][ T6006] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 64.137032][ T6006] page dumped because: kasan: bad access detected
[ 64.137038][ T6006] page_owner tracks the page as allocated
[ 64.137043][ T6006] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5847, tgid 5847 (syz-executor), ts 60144423433, free_ts 60089454561
[ 64.265520][ T6006] post_alloc_hook+0x240/0x2a0
[ 64.266997][ T6006] get_page_from_freelist+0x2365/0x2440
[ 64.268691][ T6006] __alloc_frozen_pages_noprof+0x181/0x370
[ 64.270469][ T6006] alloc_pages_mpol+0x232/0x4a0
[ 64.271975][ T6006] allocate_slab+0x96/0x350
[ 64.273361][ T6006] ___slab_alloc+0xf56/0x1990
[ 64.274816][ T6006] __slab_alloc+0x65/0x100
[ 64.276192][ T6006] kmem_cache_alloc_noprof+0x3f9/0x6e0
[ 64.277879][ T6006] sk_prot_alloc+0x57/0x220
[ 64.279273][ T6006] sk_alloc+0x3a/0x370
[ 64.280536][ T6006] inet_create+0x7a0/0x1000
[ 64.281950][ T6006] __sock_create+0x4b3/0x9f0
[ 64.283401][ T6006] udp_sock_create4+0xbe/0x4b0
[ 64.284890][ T6006] wg_socket_init+0x4e5/0xa60
[ 64.286348][ T6006] wg_open+0x24f/0x420
[ 64.287626][ T6006] __dev_open+0x470/0x880
[ 64.288954][ T6006] page last free pid 5847 tgid 5847 stack trace:
[ 64.290880][ T6006] __free_frozen_pages+0xbc4/0xd30
[ 64.292453][ T6006] __put_partials+0x146/0x170
[ 64.293924][ T6006] put_cpu_partial+0x1f2/0x2e0
[ 64.295384][ T6006] __slab_free+0x2b9/0x390
[ 64.296757][ T6006] qlist_free_all+0x97/0x140
[ 64.298172][ T6006] kasan_quarantine_reduce+0x148/0x160
[ 64.299854][ T6006] __kasan_slab_alloc+0x22/0x80
[ 64.301341][ T6006] __kmalloc_noprof+0x3c3/0x7f0
[ 64.302840][ T6006] fib_create_info+0x172d/0x3210
[ 64.304362][ T6006] fib_table_insert+0xc6/0x1b50
[ 64.305871][ T6006] fib_magic+0x2c4/0x390
[ 64.307184][ T6006] fib_add_ifaddr+0x144/0x5f0
[ 64.308645][ T6006] fib_netdev_event+0x382/0x490
[ 64.310142][ T6006] notifier_call_chain+0x1b6/0x3e0
[ 64.311712][ T6006] __dev_notify_flags+0x18d/0x2e0
[ 64.313314][ T6006] netif_change_flags+0xe8/0x1a0
[ 64.314847][ T6006]
[ 64.315590][ T6006] Memory state around the buggy address:
[ 64.317312][ T6006] ffff8881114d5c80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[ 64.319779][ T6006] ffff8881114d5d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 64.322241][ T6006] >ffff8881114d5d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 64.324688][ T6006] ^
[ 64.327095][ T6006] ffff8881114d5e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 64.329543][ T6006] ffff8881114d5e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 64.331986][ T6006] ==================================================================
[ 64.341110][ T6006] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 64.343389][ T6006] CPU: 0 UID: 0 PID: 6006 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full)
[ 64.346161][ T6006] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 64.349255][ T6006] Call Trace:
[ 64.350305][ T6006]
[ 64.351224][ T6006] dump_stack_lvl+0x99/0x250
[ 64.352691][ T6006] ? __asan_memcpy+0x40/0x70
[ 64.354152][ T6006] ? __pfx_dump_stack_lvl+0x10/0x10
[ 64.355775][ T6006] ? __pfx__printk+0x10/0x10
[ 64.357207][ T6006] vpanic+0x237/0x6d0
[ 64.358455][ T6006] ? __pfx_vpanic+0x10/0x10
[ 64.359866][ T6006] ? preempt_schedule+0xae/0xc0
[ 64.361375][ T6006] ? __pfx_preempt_schedule+0x10/0x10
[ 64.363051][ T6006] panic+0xb9/0xc0
[ 64.364261][ T6006] ? __pfx_panic+0x10/0x10
[ 64.365694][ T6006] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 64.367513][ T6006] ? tcp_ioctl+0x673/0x860
[ 64.368921][ T6006] check_panic_on_warn+0x89/0xb0
[ 64.370462][ T6006] ? tcp_ioctl+0x673/0x860
[ 64.371895][ T6006] end_report+0x78/0x160
[ 64.373291][ T6006] kasan_report+0x129/0x150
[ 64.374783][ T6006] ? stack_trace_save+0x9c/0xe0
[ 64.376353][ T6006] ? tcp_ioctl+0x673/0x860
[ 64.378006][ T6006] tcp_ioctl+0x673/0x860
[ 64.379658][ T6006] ? kasan_save_track+0x4f/0x80
[ 64.381547][ T6006] ? kasan_save_track+0x3e/0x80
[ 64.383449][ T6006] ? __kasan_save_free_info+0x46/0x50
[ 64.385522][ T6006] ? udp_bpf_ioctl+0xaa/0x1d0
[ 64.387364][ T6006] sk_ioctl+0x3c7/0x600
[ 64.388991][ T6006] ? __pfx_sk_ioctl+0x10/0x10
[ 64.390850][ T6006] inet_ioctl+0x416/0x4c0
[ 64.392542][ T6006] ? __pfx_inet_ioctl+0x10/0x10
[ 64.394468][ T6006] ? lockdep_hardirqs_on+0x9c/0x150
[ 64.396498][ T6006] ? tomoyo_path_number_perm+0x1bc/0x5a0
[ 64.398693][ T6006] ? __pfx_do_vfs_ioctl+0x10/0x10
[ 64.400660][ T6006] sock_do_ioctl+0xdc/0x300
[ 64.402438][ T6006] ? __pfx_sock_do_ioctl+0x10/0x10
[ 64.404443][ T6006] sock_ioctl+0x576/0x790
[ 64.406139][ T6006] ? __pfx_sock_ioctl+0x10/0x10
[ 64.408047][ T6006] ? __fget_files+0x3a0/0x420
[ 64.409870][ T6006] ? __fget_files+0x2a/0x420
[ 64.411704][ T6006] ? bpf_lsm_file_ioctl+0x9/0x20
[ 64.413632][ T6006] ? __pfx_sock_ioctl+0x10/0x10
[ 64.415470][ T6006] __se_sys_ioctl+0xfc/0x170
[ 64.417278][ T6006] do_syscall_64+0xfa/0xfa0
[ 64.418833][ T6006] ? lockdep_hardirqs_on+0x9c/0x150
[ 64.420550][ T6006] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 64.422507][ T6006] ? exc_page_fault+0xab/0x100
[ 64.424122][ T6006] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 64.426015][ T6006] RIP: 0033:0x7f472558f6c9
[ 64.427558][ T6006] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 64.434085][ T6006] RSP: 002b:00007f472647a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 64.436917][ T6006] RAX: ffffffffffffffda RBX: 00007f47257e5fa0 RCX: 00007f472558f6c9
[ 64.439362][ T6006] RDX: 0000000000000000 RSI: 0000000000008905 RDI: 0000000000000004
[ 64.441812][ T6006] RBP: 00007f4725611f91 R08: 0000000000000000 R09: 0000000000000000
[ 64.444228][ T6006] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 64.446676][ T6006] R13: 00007f47257e6038 R14: 00007f47257e5fa0 R15: 00007ffcbb3f8478
[ 64.449121][ T6006]
[ 64.450843][ T6006] Kernel Offset: disabled
[ 64.452186][ T6006] Rebooting in 86400 seconds..
VM DIAGNOSIS:
04:41:14 Registers:
info registers vcpu 0
CPU#0
RAX=0000000000000072 RBX=0000000000000072 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90003697230
R8 =ffff88816b550237 R9 =1ffff1102d6aa046 R10=dffffc0000000000 R11=ffffffff85153300
R12=dffffc0000000000 R13=ffffffff997dc92d R14=ffffffff99aeff60 R15=0000000000000000
RIP=ffffffff8515337c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f472647a6c0 ffffffff 00c00000
GS =0000 ffff88818eb38000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=0000001b2f163fff CR3=0000000113664000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007f47257b7498 00007f47257b7470 XMM03=00007f47257b74a8 00007f47257b74a0
XMM04=00007f472631d100 00007f47257b7460 XMM05=00007f47257b7478 00007f47257b74c0
XMM06=00007f47257b74b8 00007f47257b74b0 XMM07=00007f47257b74a8 00007f47257b74a0
XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 00007f47256131cf
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1
CPU#1
RAX=ffff88823b400000 RBX=0000000000000c01 RCX=00000000000820b0 RDX=000000002f4fbf4d
RSI=0000000000000001 RDI=000000008b455eef RBP=00000000a5f0820b RSP=ffffc90003997828
R8 =000000008bfa1edd R9 =00000000d6b43065 R10=0000000000000009 R11=ffffffff81ac3190
R12=ffff88823b4820b0 R13=0000000000000009 R14=ffffc90003997890 R15=ffff88811313d230
RIP=ffffffff84c1d09b RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 000055555d39e500 ffffffff 00c00000
GS =0000 ffff8882a9f38000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000048000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=000055556d548588 CR3=0000000174296000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000ff0000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=00ff000000000000 0000000000000000 XMM05=0000000000000000 ff00ff0000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 00007fa87b41306b
XMM08=0000000000000000 00007fa87b4130f1 XMM09=0000000000000000 00007fa87b4131cf
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000