Warning: Permanently added '[localhost]:58380' (ED25519) to the list of known hosts.
2026/10/30 12:42:19 parsed 1 programs
2026/10/30 12:42:19 serving rpc on tcp://42519
syzkaller login: [ 45.621424][ T5608] cgroup: Unknown subsys name 'net'
[ 45.738617][ T5608] cgroup: Unknown subsys name 'cpuset'
[ 45.743175][ T5608] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 47.441027][ T5608] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 50.130032][ T5620] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 50.234780][ T5623] rxe_eth0 speed is unknown, defaulting to 1000
[ 50.240922][ T5623] rxe_eth0 speed is unknown, defaulting to 1000
[ 50.241636][ T5623] rxe_eth0 speed is unknown, defaulting to 1000
[ 50.503245][ T5623] infiniband rxe0: set active
[ 50.503263][ T5623] infiniband rxe0: added rxe_eth0
[ 50.530961][ T97] rxe_eth0 speed is unknown, defaulting to 1000
[ 50.540760][ T5646] rxe_eth0 speed is unknown, defaulting to 1000
[ 50.545931][ T5623] smbdirect: ib_dev[rxe0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000
[ 50.545952][ T5623] smbdirect: ib_dev[rxe0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32
[ 50.545973][ T5623] smbdirect: ib_dev[rxe0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005
[ 50.609387][ T5623] RDS/IB: rxe0: added
[ 50.609593][ T5623] smc: adding ib device rxe0 with port count 1
[ 50.609648][ T5623] smc: ib device rxe0 port 1 has no pnetid
[ 50.610237][ T97] rxe_eth0 speed is unknown, defaulting to 1000
[ 50.746505][ T5649] rxe_eth0 speed is unknown, defaulting to 1000
[ 50.869690][ T5007] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 50.870184][ T5007] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 50.870613][ T5007] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 50.871559][ T5007] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 50.872192][ T5007] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 50.916966][ T5623] rxe_eth0 speed is unknown, defaulting to 1000
[ 51.012133][ T5658] rxe_eth0 speed is unknown, defaulting to 1000
[ 51.159604][ T5623] rxe_eth0 speed is unknown, defaulting to 1000
[ 51.400035][ T5667] rxe_eth0 speed is unknown, defaulting to 1000
[ 51.536964][ T5675] rxe_eth0 speed is unknown, defaulting to 1000
[ 51.584376][ T5623] bridge0: port 1(bridge_slave_0) entered blocking state
[ 51.584903][ T5623] bridge0: port 1(bridge_slave_0) entered disabled state
[ 51.584976][ T5623] bridge_slave_0: entered allmulticast mode
[ 51.593695][ T5623] bridge_slave_0: entered promiscuous mode
[ 51.604771][ T5623] bridge0: port 2(bridge_slave_1) entered blocking state
[ 51.604871][ T5623] bridge0: port 2(bridge_slave_1) entered disabled state
[ 51.604928][ T5623] bridge_slave_1: entered allmulticast mode
[ 51.605728][ T5623] bridge_slave_1: entered promiscuous mode
[ 51.629085][ T5623] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 51.630721][ T5623] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 51.661416][ T5623] team0: Port device team_slave_0 added
[ 51.662683][ T5623] team0: Port device team_slave_1 added
[ 51.688600][ T5623] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 51.688610][ T5623] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 51.688619][ T5623] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 51.691215][ T5623] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 51.691222][ T5623] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 51.691231][ T5623] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 51.732446][ T5623] hsr_slave_0: entered promiscuous mode
[ 51.733591][ T5623] hsr_slave_1: entered promiscuous mode
[ 51.949514][ T5693] br_netfilter no longer supported in user namespaces
[ 52.011753][ T5693] rxe_eth0 speed is unknown, defaulting to 1000
[ 52.142903][ T5623] netdevsim netdevsim1 netdevsim0: renamed from eth0
[ 52.154375][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 52.154893][ T5623] netdevsim netdevsim1 netdevsim1: renamed from eth1
[ 52.160453][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 52.162605][ T5623] netdevsim netdevsim1 netdevsim2: renamed from eth2
[ 52.167378][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 52.168084][ T5623] netdevsim netdevsim1 netdevsim3: renamed from eth3
[ 52.177464][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 52.225050][ T5697] rxe_eth0 speed is unknown, defaulting to 1000
[ 52.272436][ T5623] 8021q: adding VLAN 0 to HW filter on device bond0
[ 52.292706][ T5623] 8021q: adding VLAN 0 to HW filter on device team0
[ 52.303241][ T1598] bridge0: port 1(bridge_slave_0) entered blocking state
[ 52.303307][ T1598] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 52.312593][ T1598] bridge0: port 2(bridge_slave_1) entered blocking state
[ 52.312676][ T1598] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 52.448699][ T5712] rxe_eth0 speed is unknown, defaulting to 1000
[ 52.654278][ T5623] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 52.764339][ T5623] veth0_vlan: entered promiscuous mode
[ 52.776956][ T5623] veth1_vlan: entered promiscuous mode
[ 52.919602][ T5623] veth0_macvtap: entered promiscuous mode
[ 52.940947][ T5623] veth1_macvtap: entered promiscuous mode
[ 52.947921][ T5731] rxe_eth0 speed is unknown, defaulting to 1000
[ 52.969552][ T5623] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 52.981944][ T5623] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 53.001743][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 53.002254][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 53.002335][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 53.055743][ T5686] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 53.091134][ T5736] rxe_eth0 speed is unknown, defaulting to 1000
[ 53.290164][ T5744] rxe_eth0 speed is unknown, defaulting to 1000
[ 53.530473][ T5748] rxe_eth0 speed is unknown, defaulting to 1000
[ 53.645103][ T5755] rxe_eth0 speed is unknown, defaulting to 1000
[ 53.693474][ T27] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 53.693485][ T27] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 53.718109][ T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 53.718119][ T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
2026/10/30 12:42:29 executed programs: 0
[ 54.101978][ T58] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 54.103178][ T58] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 54.103583][ T58] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 54.105059][ T58] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 54.114868][ T58] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 54.139265][ T5007] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 54.143974][ T5007] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 54.148511][ T5776] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 54.153305][ T5776] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 54.154251][ T5776] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 54.173597][ T58] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 54.174687][ T58] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[ 54.174997][ T58] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[ 54.180369][ T58] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[ 54.188045][ T58] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[ 54.411338][ T5775] rxe_eth0 speed is unknown, defaulting to 1000
[ 54.460726][ T12] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 54.508664][ T5770] rxe_eth0 speed is unknown, defaulting to 1000
[ 54.583131][ T5773] rxe_eth0 speed is unknown, defaulting to 1000
[ 54.675386][ T5775] bridge0: port 1(bridge_slave_0) entered blocking state
[ 54.675478][ T5775] bridge0: port 1(bridge_slave_0) entered disabled state
[ 54.675528][ T5775] bridge_slave_0: entered allmulticast mode
[ 54.676227][ T5775] bridge_slave_0: entered promiscuous mode
[ 54.686558][ T5775] bridge0: port 2(bridge_slave_1) entered blocking state
[ 54.686599][ T5775] bridge0: port 2(bridge_slave_1) entered disabled state
[ 54.686647][ T5775] bridge_slave_1: entered allmulticast mode
[ 54.687350][ T5775] bridge_slave_1: entered promiscuous mode
[ 54.724851][ T5775] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 54.732374][ T5775] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 54.766988][ T5775] team0: Port device team_slave_0 added
[ 54.768312][ T5775] team0: Port device team_slave_1 added
[ 54.788766][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 54.788773][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 54.788783][ T5775] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 54.795049][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 54.795056][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 54.795065][ T5775] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 54.824649][ T5775] hsr_slave_0: entered promiscuous mode
[ 54.826777][ T5775] hsr_slave_1: entered promiscuous mode
[ 54.827438][ T5775] debugfs: 'hsr0' already exists in 'hsr'
[ 54.827552][ T5775] Cannot create hsr debugfs directory
[ 54.962587][ T5770] bridge0: port 1(bridge_slave_0) entered blocking state
[ 54.962715][ T5770] bridge0: port 1(bridge_slave_0) entered disabled state
[ 54.962829][ T5770] bridge_slave_0: entered allmulticast mode
[ 54.964297][ T5770] bridge_slave_0: entered promiscuous mode
[ 54.978411][ T5770] bridge0: port 2(bridge_slave_1) entered blocking state
[ 54.978463][ T5770] bridge0: port 2(bridge_slave_1) entered disabled state
[ 54.978628][ T5770] bridge_slave_1: entered allmulticast mode
[ 54.979262][ T5770] bridge_slave_1: entered promiscuous mode
[ 55.019173][ T5770] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 55.042996][ T5770] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 55.066087][ T5770] team0: Port device team_slave_0 added
[ 55.067487][ T5770] team0: Port device team_slave_1 added
[ 55.097812][ T5773] bridge0: port 1(bridge_slave_0) entered blocking state
[ 55.097896][ T5773] bridge0: port 1(bridge_slave_0) entered disabled state
[ 55.097947][ T5773] bridge_slave_0: entered allmulticast mode
[ 55.098631][ T5773] bridge_slave_0: entered promiscuous mode
[ 55.107373][ T5770] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 55.107381][ T5770] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 55.107390][ T5770] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 55.107935][ T5773] bridge0: port 2(bridge_slave_1) entered blocking state
[ 55.107976][ T5773] bridge0: port 2(bridge_slave_1) entered disabled state
[ 55.108081][ T5773] bridge_slave_1: entered allmulticast mode
[ 55.108785][ T5773] bridge_slave_1: entered promiscuous mode
[ 55.143687][ T5773] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 55.144052][ T5770] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 55.144065][ T5770] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 55.144075][ T5770] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 55.169314][ T5773] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 55.174570][ T5775] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 55.177393][ T5775] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 55.177893][ T5775] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 55.182442][ T5775] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 55.196148][ T5773] team0: Port device team_slave_0 added
[ 55.196177][ T5775] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 55.198504][ T5775] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 55.199019][ T5775] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 55.200542][ T5775] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 55.202044][ T5773] team0: Port device team_slave_1 added
[ 55.252205][ T5770] hsr_slave_0: entered promiscuous mode
[ 55.252620][ T5770] hsr_slave_1: entered promiscuous mode
[ 55.252931][ T5770] debugfs: 'hsr0' already exists in 'hsr'
[ 55.252940][ T5770] Cannot create hsr debugfs directory
[ 55.253344][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 55.253352][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 55.253361][ T5773] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 55.254253][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 55.254259][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 55.254268][ T5773] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 55.323040][ T5773] hsr_slave_0: entered promiscuous mode
[ 55.323482][ T5773] hsr_slave_1: entered promiscuous mode
[ 55.323778][ T5773] debugfs: 'hsr0' already exists in 'hsr'
[ 55.323787][ T5773] Cannot create hsr debugfs directory
[ 55.345627][ T5775] bridge0: port 2(bridge_slave_1) entered blocking state
[ 55.345682][ T5775] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 55.346166][ T5775] bridge0: port 1(bridge_slave_0) entered blocking state
[ 55.346212][ T5775] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 55.464561][ T5775] 8021q: adding VLAN 0 to HW filter on device bond0
[ 55.471625][ T37] bridge0: port 1(bridge_slave_0) entered disabled state
[ 55.472106][ T37] bridge0: port 2(bridge_slave_1) entered disabled state
[ 55.487191][ T5775] 8021q: adding VLAN 0 to HW filter on device team0
[ 55.490268][ T37] bridge0: port 1(bridge_slave_0) entered blocking state
[ 55.490310][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 55.493300][ T37] bridge0: port 2(bridge_slave_1) entered blocking state
[ 55.493341][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 55.653237][ T5775] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 55.676384][ T5775] veth0_vlan: entered promiscuous mode
[ 55.680153][ T5775] veth1_vlan: entered promiscuous mode
[ 55.701987][ T5775] veth0_macvtap: entered promiscuous mode
[ 55.704032][ T5775] veth1_macvtap: entered promiscuous mode
[ 55.712860][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 55.721051][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 55.767355][ T121] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 55.767366][ T121] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 55.782568][ T121] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 55.782577][ T121] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 55.790663][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 55.790682][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 55.790695][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 55.790707][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 55.853650][ T5843] TC_ACT_REPEAT abuse ?
[ 55.966294][ T5686] BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1573
[ 55.966307][ T5686] in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5686, name: kworker/u8:3
[ 55.966313][ T5686] preempt_count: 0, expected: 0
[ 55.966316][ T5686] RCU nest depth: 1, expected: 0
[ 55.966320][ T5686] locks held by kworker/u8:3/5686: 3, last CPU#0:
[ 55.966328][ T5686] #0: ffff8881108f3948 ((wq_completion)act_ct_workqueue){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[ 55.966368][ T5686] #1: ffffc90004e67c40 ((work_completion)(&(&ct_ft->rwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[ 55.966399][ T5686] #2: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rhashtable_walk_start_check+0x64/0xcf0
[ 55.966435][ T5686] CPU: 0 UID: 0 PID: 5686 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT(full)
[ 55.966447][ T5686] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 55.966455][ T5686] Workqueue: act_ct_workqueue tcf_ct_flow_table_cleanup_work
[ 55.966469][ T5686] Call Trace:
[ 55.966474][ T5686]
[ 55.966480][ T5686] dump_stack_lvl+0xe8/0x150
[ 55.966499][ T5686] __might_resched+0x36a/0x4c0
[ 55.966516][ T5686] down_read+0x26/0x320
[ 55.966526][ T5686] flow_offload_work_del+0x240/0x5e0
[ 55.966537][ T5686] ? __pfx_flow_offload_work_del+0x10/0x10
[ 55.966544][ T5686] ? __pfx_hlock_conflict+0x10/0x10
[ 55.966553][ T5686] ? __bfs+0x153/0x290
[ 55.966559][ T5686] ? __pfx_hlock_conflict+0x10/0x10
[ 55.966568][ T5686] ? __pfx_stack_trace_save+0x10/0x10
[ 55.966578][ T5686] ? check_path+0x21/0x40
[ 55.966588][ T5686] ? check_noncircular+0xdb/0x150
[ 55.966599][ T5686] ? lockdep_unlock+0x5c/0xd0
[ 55.966606][ T5686] ? __lock_acquire+0x1511/0x2de0
[ 55.966628][ T5686] nf_flow_table_offload_purge+0x51/0x80
[ 55.966640][ T5686] nf_flow_table_free+0x29b/0x3b0
[ 55.966651][ T5686] ? __pfx_nf_flow_table_free+0x10/0x10
[ 55.966665][ T5686] ? process_scheduled_works+0x97a/0x1630
[ 55.966674][ T5686] tcf_ct_flow_table_cleanup_work+0x1a/0x90
[ 55.966682][ T5686] process_scheduled_works+0xc3d/0x1630
[ 55.966703][ T5686] ? __pfx_process_scheduled_works+0x10/0x10
[ 55.966748][ T5686] ? assign_work+0x3cf/0x5d0
[ 55.966768][ T5686] worker_thread+0xa47/0xfb0
[ 55.966798][ T5686] ? __kthread_parkme+0x71/0x1f0
[ 55.966817][ T5686] kthread+0x38b/0x480
[ 55.966824][ T5686] ? __pfx_worker_thread+0x10/0x10
[ 55.966832][ T5686] ? __pfx_kthread+0x10/0x10
[ 55.966840][ T5686] ret_from_fork+0x514/0xb70
[ 55.966850][ T5686] ? __pfx_ret_from_fork+0x10/0x10
[ 55.966876][ T5686] ? __switch_to+0xc78/0x1410
[ 55.966888][ T5686] ? __pfx_kthread+0x10/0x10
[ 55.966895][ T5686] ret_from_fork_asm+0x1a/0x30
[ 55.966909][ T5686]
[ 55.966947][ T5686]
[ 56.046765][ T5686] =============================
[ 56.048236][ T5686] [ BUG: Invalid wait context ]
[ 56.049697][ T5686] syzkaller #0 Tainted: G W
[ 56.051507][ T5686] -----------------------------
[ 56.053013][ T5686] kworker/u8:3/5686 is trying to lock:
[ 56.054687][ T5686] ffff88817589eb28 (&flowtable->flow_block_lock){.+.+}-{4:4}, at: flow_offload_work_del+0x240/0x5e0
[ 56.057936][ T5686] other info that might help us debug this:
[ 56.059817][ T5686] context-{5:5}
[ 56.060965][ T5686] locks held by kworker/u8:3/5686: 3, last CPU#0:
[ 56.063213][ T5686] #0: ffff8881108f3948 ((wq_completion)act_ct_workqueue){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[ 56.066789][ T5686] #1: ffffc90004e67c40 ((work_completion)(&(&ct_ft->rwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[ 56.070926][ T5686] #2: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rhashtable_walk_start_check+0x64/0xcf0
[ 56.074184][ T5686] stack backtrace:
[ 56.075323][ T5686] CPU: 0 UID: 0 PID: 5686 Comm: kworker/u8:3 Tainted: G W syzkaller #0 PREEMPT(full)
[ 56.078584][ T5686] Tainted: [W]=WARN
[ 56.079733][ T5686] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 56.082807][ T5686] Workqueue: act_ct_workqueue tcf_ct_flow_table_cleanup_work
[ 56.085291][ T5686] Call Trace:
[ 56.086550][ T5686]
[ 56.087547][ T5686] dump_stack_lvl+0xe8/0x150
[ 56.089103][ T5686] __lock_acquire+0xf5b/0x2de0
[ 56.090671][ T5686] ? lockdep_hardirqs_on+0x7b/0x110
[ 56.092511][ T5686] ? irqentry_exit+0x2a0/0x9b0
[ 56.094280][ T5686] ? trace_irq_disable+0x3b/0x140
[ 56.095915][ T5686] lock_acquire+0x115/0x350
[ 56.097273][ T5686] ? flow_offload_work_del+0x240/0x5e0
[ 56.098912][ T5686] ? __might_resched+0x36a/0x4c0
[ 56.100390][ T5686] down_read+0x45/0x320
[ 56.101651][ T5686] ? flow_offload_work_del+0x240/0x5e0
[ 56.103280][ T5686] flow_offload_work_del+0x240/0x5e0
[ 56.104865][ T5686] ? __pfx_flow_offload_work_del+0x10/0x10
[ 56.106670][ T5686] ? __pfx_hlock_conflict+0x10/0x10
[ 56.108412][ T5686] ? __bfs+0x153/0x290
[ 56.109764][ T5686] ? __pfx_hlock_conflict+0x10/0x10
[ 56.111500][ T5686] ? __pfx_stack_trace_save+0x10/0x10
[ 56.113214][ T5686] ? check_path+0x21/0x40
[ 56.114740][ T5686] ? check_noncircular+0xdb/0x150
[ 56.116543][ T5686] ? lockdep_unlock+0x5c/0xd0
[ 56.118312][ T5686] ? __lock_acquire+0x1511/0x2de0
[ 56.120063][ T5686] nf_flow_table_offload_purge+0x51/0x80
[ 56.122102][ T5686] nf_flow_table_free+0x29b/0x3b0
[ 56.123860][ T5686] ? __pfx_nf_flow_table_free+0x10/0x10
[ 56.125595][ T5686] ? process_scheduled_works+0x97a/0x1630
[ 56.127410][ T5686] tcf_ct_flow_table_cleanup_work+0x1a/0x90
[ 56.129459][ T5686] process_scheduled_works+0xc3d/0x1630
[ 56.131124][ T5686] ? __pfx_process_scheduled_works+0x10/0x10
[ 56.132909][ T5686] ? assign_work+0x3cf/0x5d0
[ 56.134514][ T5686] worker_thread+0xa47/0xfb0
[ 56.136155][ T5686] ? __kthread_parkme+0x71/0x1f0
[ 56.137858][ T5686] kthread+0x38b/0x480
[ 56.139249][ T5686] ? __pfx_worker_thread+0x10/0x10
[ 56.140867][ T5686] ? __pfx_kthread+0x10/0x10
[ 56.142370][ T5686] ret_from_fork+0x514/0xb70
[ 56.143925][ T5686] ? __pfx_ret_from_fork+0x10/0x10
[ 56.145596][ T5686] ? __switch_to+0xc78/0x1410
[ 56.147261][ T5686] ? __pfx_kthread+0x10/0x10
[ 56.148674][ T5686] ret_from_fork_asm+0x1a/0x30
[ 56.150160][ T5686]
[ 56.158539][ T12] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 56.175424][ T5776] Bluetooth: hci1: command tx timeout
[ 56.175442][ T5776] Bluetooth: hci0: command tx timeout
[ 56.265380][ T5776] Bluetooth: hci2: command tx timeout
[ 56.398398][ T12] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 56.479117][ T12] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 56.534215][ T12] bridge_slave_1: left allmulticast mode
[ 56.534228][ T12] bridge_slave_1: left promiscuous mode
[ 56.534292][ T12] bridge0: port 2(bridge_slave_1) entered disabled state
[ 56.535760][ T12] bridge_slave_0: left allmulticast mode
[ 56.535769][ T12] bridge_slave_0: left promiscuous mode
[ 56.535883][ T12] bridge0: port 1(bridge_slave_0) entered disabled state
[ 56.646063][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 56.648461][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 56.649243][ T12] bond0 (unregistering): Released all slaves
[ 57.048284][ T12] hsr_slave_0: left promiscuous mode
[ 57.048546][ T12] hsr_slave_1: left promiscuous mode
[ 57.048905][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 57.048913][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 57.049329][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 57.049339][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 57.050975][ T12] veth1_macvtap: left promiscuous mode
[ 57.050995][ T12] veth0_macvtap: left promiscuous mode
[ 57.051036][ T12] veth1_vlan: left promiscuous mode
[ 57.051063][ T12] veth0_vlan: left promiscuous mode
[ 57.143334][ T12] team0 (unregistering): Port device team_slave_1 removed
[ 57.155090][ T12] team0 (unregistering): Port device team_slave_0 removed
[ 57.198695][ T5770] netdevsim netdevsim1 netdevsim0: renamed from eth0
[ 57.202790][ T5770] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 57.203426][ T5770] netdevsim netdevsim1 netdevsim1: renamed from eth1
[ 57.204922][ T5770] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 57.217737][ T5770] netdevsim netdevsim1 netdevsim2: renamed from eth2
[ 57.222137][ T5770] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 57.231610][ T5770] netdevsim netdevsim1 netdevsim3: renamed from eth3
[ 57.232471][ T5770] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 57.251091][ T5773] netdevsim netdevsim2 netdevsim0: renamed from eth0
[ 57.252102][ T5773] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 57.252380][ T5773] netdevsim netdevsim2 netdevsim1: renamed from eth1
[ 57.253511][ T5773] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 57.254996][ T5773] netdevsim netdevsim2 netdevsim2: renamed from eth2
[ 57.265875][ T5773] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 57.266192][ T5773] netdevsim netdevsim2 netdevsim3: renamed from eth3
[ 57.269258][ T5773] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 57.313169][ T5770] 8021q: adding VLAN 0 to HW filter on device bond0
[ 57.321041][ T5773] 8021q: adding VLAN 0 to HW filter on device bond0
[ 57.321648][ T5770] 8021q: adding VLAN 0 to HW filter on device team0
[ 57.324097][ T2068] bridge0: port 1(bridge_slave_0) entered blocking state
[ 57.324133][ T2068] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 57.329199][ T5773] 8021q: adding VLAN 0 to HW filter on device team0
[ 57.332366][ T69] bridge0: port 1(bridge_slave_0) entered blocking state
[ 57.332391][ T69] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 57.336425][ T69] bridge0: port 2(bridge_slave_1) entered blocking state
[ 57.336461][ T69] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 57.362891][ T2068] bridge0: port 2(bridge_slave_1) entered blocking state
[ 57.362931][ T2068] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 57.488930][ T5770] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 57.491093][ T5773] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 57.517176][ T5770] veth0_vlan: entered promiscuous mode
[ 57.520310][ T5773] veth0_vlan: entered promiscuous mode
[ 57.521105][ T5770] veth1_vlan: entered promiscuous mode
[ 57.524326][ T5773] veth1_vlan: entered promiscuous mode
[ 57.537991][ T5770] veth0_macvtap: entered promiscuous mode
[ 57.541833][ T5770] veth1_macvtap: entered promiscuous mode
[ 57.550865][ T5770] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 57.552353][ T5773] veth0_macvtap: entered promiscuous mode
[ 57.554030][ T5770] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 57.563650][ T5773] veth1_macvtap: entered promiscuous mode
[ 57.582226][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 57.590540][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 57.592365][ T5770] ieee80211 phy7: Selected rate control algorithm 'minstrel_ht'
[ 57.608521][ T28] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 57.608535][ T28] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 57.613217][ T5770] ieee80211 phy8: Selected rate control algorithm 'minstrel_ht'
[ 57.628746][ T5891] TC_ACT_REPEAT abuse ?
[ 57.643169][ T5773] ieee80211 phy9: Selected rate control algorithm 'minstrel_ht'
[ 57.647384][ T5823] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 57.647617][ T5823] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 57.659458][ T28] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 57.659471][ T28] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 57.659955][ T121] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 57.659965][ T121] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 57.661944][ T5773] ieee80211 phy10: Selected rate control algorithm 'minstrel_ht'
[ 57.671001][ T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 57.671014][ T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 57.676690][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 57.676840][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 57.676952][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 57.677015][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 57.677027][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 57.677038][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 57.736787][ T5898] TC_ACT_REPEAT abuse ?
[ 57.737939][ T5899] TC_ACT_REPEAT abuse ?
[ 57.766517][ T5901] TC_ACT_REPEAT abuse ?
[ 57.806208][ T5823] BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1573
[ 57.806222][ T5823] in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5823, name: kworker/u8:4
[ 57.806228][ T5823] preempt_count: 0, expected: 0
[ 57.806231][ T5823] RCU nest depth: 1, expected: 0
[ 57.806323][ T5823] INFO: lockdep is turned off.
[ 57.806332][ T5823] CPU: 0 UID: 0 PID: 5823 Comm: kworker/u8:4 Tainted: G W syzkaller #0 PREEMPT(full)
[ 57.806342][ T5823] Tainted: [W]=WARN
[ 57.806344][ T5823] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 57.806349][ T5823] Workqueue: act_ct_workqueue tcf_ct_flow_table_cleanup_work
[ 57.806363][ T5823] Call Trace:
[ 57.806366][ T5823]
[ 57.806370][ T5823] dump_stack_lvl+0xe8/0x150
[ 57.806382][ T5823] __might_resched+0x36a/0x4c0
[ 57.806393][ T5823] down_read+0x26/0x320
[ 57.806402][ T5823] flow_offload_work_del+0x240/0x5e0
[ 57.806410][ T5823] ? __pfx_flow_offload_work_del+0x10/0x10
[ 57.806416][ T5823] ? rcu_is_watching+0x16/0xb0
[ 57.806425][ T5823] ? lock_release+0x4b/0x3c0
[ 57.806433][ T5823] ? __mutex_unlock_slowpath+0x731/0x900
[ 57.806440][ T5823] ? rcu_is_watching+0x16/0xb0
[ 57.806448][ T5823] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 57.806456][ T5823] ? __flush_workqueue+0xe9e/0x10b0
[ 57.806468][ T5823] ? rcu_is_watching+0x16/0xb0
[ 57.806476][ T5823] nf_flow_table_offload_purge+0x51/0x80
[ 57.806484][ T5823] nf_flow_table_free+0x29b/0x3b0
[ 57.806494][ T5823] ? __pfx_nf_flow_table_free+0x10/0x10
[ 57.806503][ T5823] ? lock_acquire+0x58/0x350
[ 57.806509][ T5823] ? rcu_is_watching+0x16/0xb0
[ 57.806518][ T5823] ? process_scheduled_works+0x97a/0x1630
[ 57.806526][ T5823] tcf_ct_flow_table_cleanup_work+0x1a/0x90
[ 57.806534][ T5823] process_scheduled_works+0xc3d/0x1630
[ 57.806546][ T5823] ? __pfx_process_scheduled_works+0x10/0x10
[ 57.806554][ T5823] ? do_raw_spin_lock+0x12b/0x2f0
[ 57.806564][ T5823] ? assign_work+0x3cf/0x5d0
[ 57.806572][ T5823] worker_thread+0xa47/0xfb0
[ 57.806588][ T5823] ? __kthread_parkme+0x71/0x1f0
[ 57.806598][ T5823] kthread+0x38b/0x480
[ 57.806605][ T5823] ? __pfx_worker_thread+0x10/0x10
[ 57.806613][ T5823] ? __pfx
** replaying previous printk message **
[ 57.806613][ T5823] ? __pfx_kthread+0x10/0x10
[ 57.806619][ T5823] ret_from_fork+0x514/0xb70
[ 57.806627][ T5823] ? __pfx_ret_from_fork+0x10/0x10
[ 57.806633][ T5823] ? __switch_to+0xc78/0x1410
[ 57.806643][ T5823] ? __pfx_kthread+0x10/0x10
[ 57.806649][ T5823] ret_from_fork_asm+0x1a/0x30
[ 57.806657][ T5823]
[ 57.885683][ T27] ==================================================================
[ 57.885728][ T27] BUG: KASAN: slab-use-after-free in flow_offload_work_handler+0x11f/0xd30
[ 57.885747][ T27] Read of size 8 at addr ffff88816afa0b50 by task kworker/u10:0/27
[ 57.885757][ T27]
[ 57.885765][ T27] CPU: 1 UID: 0 PID: 27 Comm: kworker/u10:0 Tainted: G W syzkaller #0 PREEMPT(full)
[ 57.885780][ T27] Tainted: [W]=WARN
[ 57.885783][ T27] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 57.885791][ T27] Workqueue: nf_ft_offload_del flow_offload_work_handler
[ 57.885804][ T27] Call Trace:
[ 57.885809][ T27]
[ 57.885815][ T27] dump_stack_lvl+0xe8/0x150
[ 57.885832][ T27] print_address_description+0x55/0x1e0
[ 57.885847][ T27] ? flow_offload_work_handler+0x11f/0xd30
[ 57.885856][ T27] print_report+0x58/0x70
[ 57.885868][ T27] kasan_report+0x117/0x150
[ 57.885883][ T27] ? stack_trace_save+0xa9/0x100
[ 57.885896][ T27] ? flow_offload_work_handler+0x11f/0xd30
[ 57.885909][ T27] flow_offload_work_handler+0x11f/0xd30
[ 57.885920][ T27] ? rcu_is_watching+0x16/0xb0
[ 57.885934][ T27] ? trace_irq_enable+0x3b/0x140
[ 57.885947][ T27] ? __pfx_flow_offload_work_handler+0x10/0x10
[ 57.885958][ T27] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 57.885974][ T27] ? debug_object_assert_init+0x20d/0x380
[ 57.885988][ T27] ? __mod_timer+0xc8/0xed0
[ 57.886001][ T27] ? do_raw_spin_lock+0x12b/0x2f0
[ 57.886017][ T27] ? rcu_is_watching+0x16/0xb0
[ 57.886032][ T27] ? rcu_is_watching+0x16/0xb0
[ 57.886046][ T27] ? trace_hrtimer_start+0x82/0x200
[ 57.886058][ T27] ? do_raw_spin_lock+0x12b/0x2f0
[ 57.886073][ T27] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 57.886088][ T27] ? rcu_is_watching+0x16/0xb0
[ 57.886101][ T27] ? lock_acquire+0x58/0x350
[ 57.886112][ T27] ? rcu_is_watching+0x16/0xb0
[ 57.886126][ T27] ? rcu_is_watching+0x16/0xb0
[ 57.886139][ T27] ? process_scheduled_works+0x97a/0x1630
[ 57.886154][ T27] process_scheduled_works+0xc3d/0x1630
[ 57.886175][ T27] ? __pfx_process_scheduled_works+0x10/0x10
[ 57.886188][ T27] ? do_raw_spin_lock+0x12b/0x2f0
[ 57.886204][ T27] ? assign_work+0x3cf/0x5d0
[ 57.886217][ T27] worker_thread+0xa47/0xfb0
[ 57.886237][ T27] kthread+0x38b/0x480
[ 57.886247][ T27] ? __pfx_worker_thread+0x10/0x10
[ 57.886260][ T27] ? __pfx_kthread+0x10/0x10
[ 57.886270][ T27] ret_from_fork+0x514/0xb70
[ 57.886282][ T27] ? __pfx_ret_from_fork+0x10/0x10
[ 57.886293][ T27] ? __switch_to+0xc78/0x1410
[ 57.886309][ T27] ? __pfx_kthread+0x10/0x10
[ 57.886319][ T27] ret_from_fork_asm+0x1a/0x30
[ 57.886333][ T27]
[ 57.886338][ T27]
[ 57.886340][ T27] Allocated by task 5898:
[ 57.886346][ T27] kasan_save_track+0x3e/0x80
[ 57.886358][ T27] __kasan_kmalloc+0x93/0xb0
[ 57.886371][ T27] __kmalloc_cache_noprof+0x31c/0x600
[ 57.886384][ T27] tcf_ct_flow_table_get+0x88d/0x1f00
[ 57.886394][ T27] tcf_ct_init+0x6bd/0xb10
[ 57.886402][ T27] tcf_action_init_1+0x4ba/0x740
[ 57.886416][ T27] tcf_action_init+0x31b/0xa60
[ 57.886429][ T27] tcf_exts_validate_ex+0x247/0x540
[ 57.886446][ T27] mall_change+0x44f/0x890
[ 57.886456][ T27] tc_new_tfilter+0x1324/0x1900
[ 57.886467][ T27] rtnetlink_rcv_msg+0x802/0xc00
[ 57.886482][ T27] netlink_rcv_skb+0x226/0x4a0
[ 57.886493][ T27] netlink_unicast+0x8ef/0xa80
[ 57.886503][ T27] netlink_sendmsg+0x7f0/0xb20
[ 57.886515][ T27] sock_sendmsg_nosec+0x14e/0x190
[ 57.886526][ T27] ____sys_sendmsg+0x54e/0x850
[ 57.886539][ T27] ___sys_sendmsg+0x2a5/0x360
[ 57.886547][ T27] __x64_sys_sendmsg+0x1b1/0x290
[ 57.886553][ T27] do_syscall_64+0x166/0x520
[ 57.886559][ T27] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 57.886565][ T27]
[ 57.886566][ T27] Freed by task 5823:
[ 57.886570][ T27] kasan_save_track+0x3e/0x80
[ 57.886577][ T27] kasan_save_free_info+0x40/0x50
[ 57.886583][ T27] __kasan_slab_free+0x5c/0x80
[ 57.886591][ T27] kfree+0x1c5/0x650
[ 57.886597][ T27] tcf_ct_flow_table_cleanup_work+0x70/0x90
[ 57.886604][ T27] process_scheduled_works+0xc3d/0x1630
[ 57.886611][ T27] worker_thread+0xa47/0xfb0
[ 57.886619][ T27] kthread+0x38b/0x480
[ 57.886625][ T27] ret_from_fork+0x514/0xb70
[ 57.886630][ T27] ret_from_fork_asm+0x1a/0x30
[ 57.886636][ T27]
[ 57.886637][ T27] Last potentially related work creation:
[ 57.886640][ T27] kasan_save_stack+0x3e/0x60
[ 57.886647][ T27] kasan_record_aux_stack+0xbd/0xd0
[ 57.886654][ T27] insert_work+0x3d/0x330
[ 57.886661][ T27] __queue_work+0xd3c/0x1360
[ 57.886668][ T27] rcu_work_rcufn+0x75/0x90
[ 57.886677][ T27] rcu_core+0x92e/0x1230
[ 57.886683][ T27] handle_softirqs+0x265/0x8d0
[ 57.886719][ T27] __irq_exit_rcu+0xc6/0x220
[ 57.886732][ T27] irq_exit_rcu+0x9/0x30
[ 57.886743][ T27] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 57.886762][ T27] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 57.886791][ T27]
[ 57.886793][ T27] Second to last potentially related work creation:
[ 57.886796][ T27] kasan_save_stack+0x3e/0x60
[ 57.886804][ T27] kasan_record_aux_stack+0xbd/0xd0
[ 57.886810][ T27] call_rcu+0x86/0x300
[ 57.886818][ T27] queue_rcu_work+0xe7/0x160
[ 57.886826][ T27] tcf_ct_params_free+0xd2/0x230
[ 57.886831][ T27] rcu_core+0x92e/0x1230
[ 57.886838][ T27] handle_softirqs+0x265/0x8d0
[ 57.886845][ T27] __irq_exit_rcu+0xc6/0x220
[ 57.886852][ T27] irq_exit_rcu+0x9/0x30
[ 57.886858][ T27] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 57.886867][ T27] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 57.886873][ T27]
[ 57.886875][ T27] The buggy address belongs to the object at ffff88816afa0800
[ 57.886875][ T27] which belongs to the cache kmalloc-1k of size 1024
[ 57.886881][ T27] The buggy address is located 848 bytes inside of
[ 57.886881][ T27] freed 1024-byte region [ffff88816afa0800, ffff88816afa0c00)
[ 57.886888][ T27]
[ 57.886890][ T27] The buggy address belongs to the physical page:
[ 57.886894][ T27] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x16afa0
[ 57.886902][ T27] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 57.886907][ T27] flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[ 57.886914][ T27] page_type: f5(slab)
[ 57.886921][ T27] raw: 057ff00000000040 ffff888100041dc0 dead000000000100 dead000000000122
[ 57.886927][ T27] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 57.886932][ T27] head: 057ff00000000040 ffff888100041dc0 dead000000000100 dead000000000122
[ 57.886938][ T27] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 57.886946][ T27] head: 057ff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 57.886951][ T27] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 57.886955][ T27] page dumped because: kasan: bad access detected
[ 57.886958][ T27] page_owner tracks the page as allocated
[ 57.886961][ T27] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5773, tgid 5773 (syz-executor), ts 57724988339
[ 57.886972][ T27] post_alloc_hook+0x1f9/0x250
[ 57.886980][ T27] get_page_from_freelist+0x2209/0x2280
[ 57.886988][ T27] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 57.886996][ T27] allocate_slab+0x7d/0x620
[ 57.887001][ T27] refill_objects+0x2d5/0x350
[ 57.887007][ T27] __pcs_replace_empty_main+0x2c8/0x6c0
[ 57.887016][ T27] __kmalloc_noprof+0x476/0x710
[ 57.887023][ T27] ipt_alloc_initial_table+0x6b/0x6a0
[ 57.887030][ T27] iptable_nat_table_init+0x23/0x300
[ 57.887037][ T27] xt_find_table_lock+0x311/0x400
[ 57.887044][ T27] xt_request_find_table_lock+0x26/0x100
[ 57.887052][ T27] do_ipt_get_ctl+0x77f/0x1300
[ 57.887058][ T27] nf_getsockopt+0x26e/0x290
[ 57.887064][ T27] ip_getsockopt+0x19e/0x230
[ 57.887071][ T27] do_sock_getsockopt+0x4aa/0x640
[ 57.887079][ T27] __x64_sys_getsockopt+0x1a4/0x240
[ 57.887088][ T27] page last free pid 12 tgid 12 ts 56646822043 stack trace:
[ 57.887093][ T27] __free_frozen_pages+0xc93/0xd90
[ 57.887100][ T27] __slab_free+0x274/0x2c0
[ 57.887107][ T27] qlist_free_all+0x99/0x100
[ 57.887114][ T27] kasan_quarantine_reduce+0x148/0x160
[ 57.887122][ T27] __kasan_slab_alloc+0x22/0x80
[ 57.887130][ T27] kmem_cache_alloc_node_noprof+0x34f/0x600
[ 57.887137][ T27] __alloc_skb+0x1db/0x7a0
[ 57.887145][ T27] inet_ifmcaddr_notify+0x7e/0x150
[ 57.887152][ T27] __ip_mc_dec_group+0x202/0x3e0
[ 57.887157][ T27] inetdev_event+0x23d/0x1610
[ 57.887165][ T27] notifier_call_chain+0x1a5/0x3d0
[ 57.887171][ T27] netif_close_many+0x463/0x660
[ 57.887178][ T27] netif_close+0x160/0x220
[ 57.887186][ T27] dev_close+0xf7/0x210
[ 57.887194][ T27] __bond_release_one+0xb80/0x11c0
[ 57.887203][ T27] bond_uninit+0x129/0x2d0
[ 57.887209][ T27]
[ 57.887210][ T27] Memory state around the buggy address:
[ 57.887214][ T27] ffff88816afa0a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 57.887219][ T27] ffff88816afa0a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 57.887223][ T27] >ffff88816afa0b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 57.887226][ T27] ^
[ 57.887230][ T27] ffff88816afa0b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 57.887234][ T27] ffff88816afa0c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 57.887237][ T27] ==================================================================
[ 57.887307][ T27] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 58.230939][ T27] CPU: 1 UID: 0 PID: 27 Comm: kworker/u10:0 Tainted: G W syzkaller #0 PREEMPT(full)
[ 58.235054][ T27] Tainted: [W]=WARN
[ 58.236506][ T27] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 58.240133][ T27] Workqueue: nf_ft_offload_del flow_offload_work_handler
[ 58.242795][ T27] Call Trace:
[ 58.244070][ T27]
[ 58.245161][ T27] vpanic+0x56d/0xa60
[ 58.246453][ T27] ? __pfx_vpanic+0x10/0x10
[ 58.248226][ T27] ? rcu_is_watching+0x16/0xb0
[ 58.250085][ T27] panic+0xc5/0xd0
[ 58.251572][ T27] ? __pfx_panic+0x10/0x10
[ 58.253267][ T27] ? preempt_schedule_thunk+0x16/0x40
[ 58.255290][ T27] ? flow_offload_work_handler+0x11f/0xd30
[ 58.257509][ T27] ? preempt_schedule_thunk+0x16/0x40
[ 58.259583][ T27] ? flow_offload_work_handler+0x11f/0xd30
[ 58.261830][ T27] check_panic_on_warn+0x89/0xb0
[ 58.263449][ T27] ? flow_offload_work_handler+0x11f/0xd30
[ 58.265190][ T27] end_report+0x73/0x170
[ 58.266462][ T27] ? flow_offload_work_handler+0x11f/0xd30
[ 58.268187][ T27] kasan_report+0x128/0x150
[ 58.269835][ T27] ? stack_trace_save+0xa9/0x100
[ 58.271712][ T27] ? flow_offload_work_handler+0x11f/0xd30
[ 58.273591][ T27] flow_offload_work_handler+0x11f/0xd30
[ 58.275448][ T27] ? rcu_is_watching+0x16/0xb0
[ 58.277133][ T27] ? trace_irq_enable+0x3b/0x140
[ 58.278714][ T27] ? __pfx_flow_offload_work_handler+0x10/0x10
[ 58.280948][ T27] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 58.282774][ T27] ? debug_object_assert_init+0x20d/0x380
[ 58.284818][ T27] ? __mod_timer+0xc8/0xed0
[ 58.286512][ T27] ? do_raw_spin_lock+0x12b/0x2f0
[ 58.288381][ T27] ? rcu_is_watching+0x16/0xb0
[ 58.290091][ T27] ? rcu_is_watching+0x16/0xb0
[ 58.291872][ T27] ? trace_hrtimer_start+0x82/0x200
[ 58.293875][ T27] ? do_raw_spin_lock+0x12b/0x2f0
[ 58.295915][ T27] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 58.297954][ T27] ? rcu_is_watching+0x16/0xb0
[ 58.299790][ T27] ? lock_acquire+0x58/0x350
[ 58.301429][ T27] ? rcu_is_watching+0x16/0xb0
[ 58.303130][ T27] ? rcu_is_watching+0x16/0xb0
[ 58.304737][ T27] ? process_scheduled_works+0x97a/0x1630
[ 58.306423][ T27] process_scheduled_works+0xc3d/0x1630
[ 58.308063][ T27] ? __pfx_process_scheduled_works+0x10/0x10
[ 58.309829][ T27] ? do_raw_spin_lock+0x12b/0x2f0
[ 58.311301][ T27] ? assign_work+0x3cf/0x5d0
[ 58.312682][ T27] worker_thread+0xa47/0xfb0
[ 58.314059][ T27] kthread+0x38b/0x480
[ 58.315253][ T27] ? __pfx_worker_thread+0x10/0x10
[ 58.317017][ T27] ? __pfx_kthread+0x10/0x10
[ 58.318758][ T27] ret_from_fork+0x514/0xb70
[ 58.320459][ T27] ? __pfx_ret_from_fork+0x10/0x10
[ 58.322165][ T27] ? __switch_to+0xc78/0x1410
[ 58.323609][ T27] ? __pfx_kthread+0x10/0x10
[ 58.325019][ T27] ret_from_fork_asm+0x1a/0x30
[ 58.326443][ T27]
[ 58.328070][ T27] Kernel Offset: disabled
[ 58.329338][ T27] Rebooting in 86400 seconds..