Warning: Permanently added '[localhost]:37980' (ED25519) to the list of known hosts. 2025/11/21 05:01:34 parsed 1 programs syzkaller login: [ 52.094785][ T5820] cgroup: Unknown subsys name 'net' [ 52.197947][ T5820] cgroup: Unknown subsys name 'cpuset' [ 52.201613][ T5820] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 53.556184][ T5820] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 55.614461][ T5827] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 56.044913][ T5844] chnl_net:caif_netlink_parms(): no params data found [ 56.087591][ T5844] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.090033][ T5844] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.092142][ T5844] bridge_slave_0: entered allmulticast mode [ 56.094649][ T5844] bridge_slave_0: entered promiscuous mode [ 56.099038][ T5844] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.101166][ T5844] bridge0: port 2(bridge_slave_1) entered disabled state [ 56.103289][ T5844] bridge_slave_1: entered allmulticast mode [ 56.106410][ T5844] bridge_slave_1: entered promiscuous mode [ 56.128375][ T5844] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 56.133044][ T5844] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 56.150394][ T5844] team0: Port device team_slave_0 added [ 56.154685][ T5844] team0: Port device team_slave_1 added [ 56.172604][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 56.174925][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 56.184762][ T5844] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 56.190031][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 56.192385][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 56.201311][ T5844] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 56.225777][ T5844] hsr_slave_0: entered promiscuous mode [ 56.228027][ T5844] hsr_slave_1: entered promiscuous mode [ 56.312876][ T5844] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 56.320206][ T5844] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 56.324518][ T5844] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 56.329346][ T5844] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 56.349083][ T5844] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.351508][ T5844] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.354406][ T5844] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.356968][ T5844] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.387595][ T5844] 8021q: adding VLAN 0 to HW filter on device bond0 [ 56.400618][ T1092] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.403529][ T1092] bridge0: port 2(bridge_slave_1) entered disabled state [ 56.411896][ T5844] 8021q: adding VLAN 0 to HW filter on device team0 [ 56.419659][ T1092] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.422556][ T1092] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.429813][ T1092] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.432057][ T1092] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.527880][ T5844] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 56.548229][ T5844] veth0_vlan: entered promiscuous mode [ 56.553326][ T5844] veth1_vlan: entered promiscuous mode [ 56.567668][ T5844] veth0_macvtap: entered promiscuous mode [ 56.571318][ T5844] veth1_macvtap: entered promiscuous mode [ 56.580434][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 56.587883][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 56.593671][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.596917][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.602319][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.605036][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.671162][ T5200] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 56.677355][ T5200] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 56.680944][ T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 56.685154][ T5200] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 56.688620][ T5200] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 56.691173][ T5200] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 56.735432][ T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 56.785168][ T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 56.823714][ T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.838978][ T3627] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.841548][ T3627] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 57.860284][ T3627] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.862712][ T3627] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2025/11/21 05:01:42 executed programs: 0 [ 58.229367][ T57] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 58.232528][ T57] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 58.235589][ T57] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 58.240284][ T57] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 58.243478][ T57] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 58.354670][ T5926] chnl_net:caif_netlink_parms(): no params data found [ 58.395856][ T5926] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.398058][ T5926] bridge0: port 1(bridge_slave_0) entered disabled state [ 58.400208][ T5926] bridge_slave_0: entered allmulticast mode [ 58.402702][ T5926] bridge_slave_0: entered promiscuous mode [ 58.405838][ T5926] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.408006][ T5926] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.410155][ T5926] bridge_slave_1: entered allmulticast mode [ 58.412658][ T5926] bridge_slave_1: entered promiscuous mode [ 58.429443][ T5926] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 58.434031][ T5926] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 58.450694][ T5926] team0: Port device team_slave_0 added [ 58.454326][ T5926] team0: Port device team_slave_1 added [ 58.479792][ T5926] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 58.482402][ T5926] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 58.491889][ T5926] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 58.497318][ T5926] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 58.499783][ T5926] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 58.509279][ T5926] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 58.543846][ T5926] hsr_slave_0: entered promiscuous mode [ 58.547741][ T5926] hsr_slave_1: entered promiscuous mode [ 58.550353][ T5926] debugfs: 'hsr0' already exists in 'hsr' [ 58.552566][ T5926] Cannot create hsr debugfs directory [ 59.843524][ T13] bridge_slave_1: left allmulticast mode [ 59.845953][ T13] bridge_slave_1: left promiscuous mode [ 59.848629][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.855111][ T13] bridge_slave_0: left allmulticast mode [ 59.858438][ T13] bridge_slave_0: left promiscuous mode [ 59.860699][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.017782][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 60.022322][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 60.026838][ T13] bond0 (unregistering): Released all slaves [ 60.155105][ T13] hsr_slave_0: left promiscuous mode [ 60.158930][ T13] hsr_slave_1: left promiscuous mode [ 60.161627][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 60.164590][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 60.168855][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 60.171734][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 60.187137][ T13] veth1_macvtap: left promiscuous mode [ 60.189407][ T13] veth0_macvtap: left promiscuous mode [ 60.191654][ T13] veth1_vlan: left promiscuous mode [ 60.193844][ T13] veth0_vlan: left promiscuous mode [ 60.277830][ T57] Bluetooth: hci0: command tx timeout [ 60.411350][ T13] team0 (unregistering): Port device team_slave_1 removed [ 60.425349][ T13] team0 (unregistering): Port device team_slave_0 removed [ 60.722843][ T5926] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 60.729262][ T5926] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 60.738027][ T5926] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 60.742321][ T5926] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 60.809650][ T5926] 8021q: adding VLAN 0 to HW filter on device bond0 [ 60.819815][ T5926] 8021q: adding VLAN 0 to HW filter on device team0 [ 60.824513][ T26] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.827004][ T26] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.833816][ T27] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.836074][ T27] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.140933][ T5926] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 61.178051][ T5926] veth0_vlan: entered promiscuous mode [ 61.182913][ T5926] veth1_vlan: entered promiscuous mode [ 61.201274][ T5926] veth0_macvtap: entered promiscuous mode [ 61.207486][ T5926] veth1_macvtap: entered promiscuous mode [ 61.226932][ T5926] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 61.239889][ T5926] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 61.252255][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.255498][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.263967][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.272990][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.345584][ T3627] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 61.351637][ T3627] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 61.389603][ T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 61.391994][ T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 61.429017][ T5959] ================================================================== [ 61.431553][ T5959] BUG: KASAN: slab-use-after-free in tcp_ioctl+0x673/0x860 [ 61.433761][ T5959] Read of size 2 at addr ffff888101fe3bf6 by task syz.0.17/5959 [ 61.436888][ T5959] [ 61.437640][ T5959] CPU: 1 UID: 0 PID: 5959 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 61.437650][ T5959] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 61.437655][ T5959] Call Trace: [ 61.437659][ T5959] [ 61.437662][ T5959] dump_stack_lvl+0x189/0x250 [ 61.437675][ T5959] ? __kasan_check_byte+0x12/0x40 [ 61.437684][ T5959] ? __pfx_dump_stack_lvl+0x10/0x10 [ 61.437693][ T5959] ? lock_release+0x4b/0x3e0 [ 61.437702][ T5959] ? __virt_addr_valid+0x4a5/0x5c0 [ 61.437713][ T5959] print_report+0xca/0x240 [ 61.437722][ T5959] ? tcp_ioctl+0x673/0x860 [ 61.437728][ T5959] kasan_report+0x118/0x150 [ 61.437735][ T5959] ? stack_trace_save+0x9c/0xe0 [ 61.437746][ T5959] ? tcp_ioctl+0x673/0x860 [ 61.437753][ T5959] tcp_ioctl+0x673/0x860 [ 61.437759][ T5959] ? kasan_save_track+0x4f/0x80 [ 61.437765][ T5959] ? kasan_save_track+0x3e/0x80 [ 61.437771][ T5959] ? __kasan_save_free_info+0x46/0x50 [ 61.437779][ T5959] ? udp_bpf_ioctl+0xaa/0x1d0 [ 61.437788][ T5959] sk_ioctl+0x3c7/0x600 [ 61.437797][ T5959] ? __pfx_sk_ioctl+0x10/0x10 [ 61.437807][ T5959] inet_ioctl+0x416/0x4c0 [ 61.437815][ T5959] ? __pfx_inet_ioctl+0x10/0x10 [ 61.437822][ T5959] ? lockdep_hardirqs_on+0x9c/0x150 [ 61.437832][ T5959] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 61.437843][ T5959] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 61.437855][ T5959] sock_do_ioctl+0xdc/0x300 [ 61.437866][ T5959] ? __pfx_sock_do_ioctl+0x10/0x10 [ 61.437878][ T5959] sock_ioctl+0x576/0x790 [ 61.437888][ T5959] ? __pfx_sock_ioctl+0x10/0x10 [ 61.437897][ T5959] ? __fget_files+0x3a0/0x420 [ 61.437905][ T5959] ? __fget_files+0x2a/0x420 [ 61.437912][ T5959] ? bpf_lsm_file_ioctl+0x9/0x20 [ 61.437922][ T5959] ? __pfx_sock_ioctl+0x10/0x10 [ 61.437930][ T5959] __se_sys_ioctl+0xfc/0x170 [ 61.437940][ T5959] do_syscall_64+0xfa/0xfa0 [ 61.437947][ T5959] ? lockdep_hardirqs_on+0x9c/0x150 [ 61.437953][ T5959] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 61.437960][ T5959] ? exc_page_fault+0xab/0x100 [ 61.437966][ T5959] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 61.437974][ T5959] RIP: 0033:0x7f4a1458f6c9 [ 61.437981][ T5959] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 61.437987][ T5959] RSP: 002b:00007f4a1545b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 61.437996][ T5959] RAX: ffffffffffffffda RBX: 00007f4a147e5fa0 RCX: 00007f4a1458f6c9 [ 61.438002][ T5959] RDX: 0000000000000000 RSI: 0000000000008905 RDI: 0000000000000004 [ 61.438006][ T5959] RBP: 00007f4a14611f91 R08: 0000000000000000 R09: 0000000000000000 [ 61.438010][ T5959] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 61.438014][ T5959] R13: 00007f4a147e6038 R14: 00007f4a147e5fa0 R15: 00007ffef33173a8 [ 61.438022][ T5959] [ 61.438024][ T5959] [ 61.524147][ T5959] Allocated by task 5926: [ 61.525451][ T5959] kasan_save_track+0x3e/0x80 [ 61.526888][ T5959] __kasan_slab_alloc+0x6c/0x80 [ 61.528380][ T5959] kmem_cache_alloc_noprof+0x367/0x6e0 [ 61.530034][ T5959] sk_prot_alloc+0x57/0x220 [ 61.531430][ T5959] sk_alloc+0x3a/0x370 [ 61.532703][ T5959] inet_create+0x7a0/0x1000 [ 61.534100][ T5959] __sock_create+0x4b3/0x9f0 [ 61.535540][ T5959] __sys_socket+0xd7/0x1b0 [ 61.536896][ T5959] __x64_sys_socket+0x7a/0x90 [ 61.538325][ T5959] do_syscall_64+0xfa/0xfa0 [ 61.539697][ T5959] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 61.541441][ T5959] [ 61.542165][ T5959] Freed by task 5926: [ 61.543417][ T5959] kasan_save_track+0x3e/0x80 [ 61.544862][ T5959] __kasan_save_free_info+0x46/0x50 [ 61.546450][ T5959] __kasan_slab_free+0x5c/0x80 [ 61.547928][ T5959] kmem_cache_free+0x19b/0x690 [ 61.549431][ T5959] __sk_destruct+0x4d2/0x660 [ 61.550836][ T5959] inet_release+0x144/0x190 [ 61.552254][ T5959] sock_close+0xc3/0x240 [ 61.553563][ T5959] __fput+0x44c/0xa70 [ 61.554770][ T5959] fput_close_sync+0x119/0x200 [ 61.556227][ T5959] __x64_sys_close+0x7f/0x110 [ 61.557661][ T5959] do_syscall_64+0xfa/0xfa0 [ 61.559042][ T5959] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 61.560858][ T5959] [ 61.561612][ T5959] The buggy address belongs to the object at ffff888101fe3b80 [ 61.561612][ T5959] which belongs to the cache UDP of size 1984 [ 61.565564][ T5959] The buggy address is located 118 bytes inside of [ 61.565564][ T5959] freed 1984-byte region [ffff888101fe3b80, ffff888101fe4340) [ 61.569670][ T5959] [ 61.570426][ T5959] The buggy address belongs to the physical page: [ 61.572407][ T5959] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101fe0 [ 61.575080][ T5959] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 61.577634][ T5959] memcg:ffff8881086b4301 [ 61.578928][ T5959] anon flags: 0x17ff00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 61.581411][ T5959] page_type: f5(slab) [ 61.582666][ T5959] raw: 017ff00000000040 ffff888160ef5b40 0000000000000000 0000000000000001 [ 61.585285][ T5959] raw: 0000000000000000 00000000800f000f 00000000f5000000 ffff8881086b4301 [ 61.587907][ T5959] head: 017ff00000000040 ffff888160ef5b40 0000000000000000 0000000000000001 [ 61.590529][ T5959] head: 0000000000000000 00000000800f000f 00000000f5000000 ffff8881086b4301 [ 61.593141][ T5959] head: 017ff00000000003 ffffea000407f801 00000000ffffffff 00000000ffffffff [ 61.595775][ T5959] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 61.598389][ T5959] page dumped because: kasan: bad access detected [ 61.600355][ T5959] page_owner tracks the page as allocated [ 61.602061][ T5959] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 3581320107, free_ts 0 [ 61.607856][ T5959] post_alloc_hook+0x240/0x2a0 [ 61.609337][ T5959] get_page_from_freelist+0x2365/0x2440 [ 61.610982][ T5959] __alloc_frozen_pages_noprof+0x181/0x370 [ 61.612720][ T5959] alloc_pages_mpol+0x232/0x4a0 [ 61.614166][ T5959] allocate_slab+0x96/0x350 [ 61.615550][ T5959] ___slab_alloc+0xf56/0x1990 [ 61.616982][ T5959] __slab_alloc+0x65/0x100 [ 61.618376][ T5959] kmem_cache_alloc_noprof+0x3f9/0x6e0 [ 61.620028][ T5959] sk_prot_alloc+0x57/0x220 [ 61.621430][ T5959] sk_alloc+0x3a/0x370 [ 61.622701][ T5959] inet_create+0x7a0/0x1000 [ 61.624085][ T5959] __sock_create+0x4b3/0x9f0 [ 61.625517][ T5959] inet_ctl_sock_create+0x9a/0x220 [ 61.627059][ T5959] igmp_net_init+0xb9/0x150 [ 61.628480][ T5959] ops_init+0x35c/0x5c0 [ 61.629772][ T5959] register_pernet_operations+0x336/0x800 [ 61.631494][ T5959] page_owner free stack trace missing [ 61.633141][ T5959] [ 61.633904][ T5959] Memory state around the buggy address: [ 61.635607][ T5959] ffff888101fe3a80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 61.638060][ T5959] ffff888101fe3b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.640531][ T5959] >ffff888101fe3b80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.642958][ T5959] ^ [ 61.645291][ T5959] ffff888101fe3c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.647710][ T5959] ffff888101fe3c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.650176][ T5959] ================================================================== [ 61.657123][ T5959] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 61.659300][ T5959] CPU: 1 UID: 0 PID: 5959 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 61.661992][ T5959] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 61.664995][ T5959] Call Trace: [ 61.666040][ T5959] [ 61.666961][ T5959] dump_stack_lvl+0x99/0x250 [ 61.668373][ T5959] ? __asan_memcpy+0x40/0x70 [ 61.669793][ T5959] ? __pfx_dump_stack_lvl+0x10/0x10 [ 61.671384][ T5959] ? __pfx__printk+0x10/0x10 [ 61.672799][ T5959] vpanic+0x237/0x6d0 [ 61.674015][ T5959] ? __pfx_vpanic+0x10/0x10 [ 61.675435][ T5959] ? preempt_schedule+0xae/0xc0 [ 61.676882][ T5959] ? __pfx_preempt_schedule+0x10/0x10 [ 61.678526][ T5959] panic+0xb9/0xc0 [ 61.679676][ T5959] ? __pfx_panic+0x10/0x10 [ 61.681026][ T5959] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 61.682831][ T5959] ? tcp_ioctl+0x673/0x860 [ 61.684188][ T5959] check_panic_on_warn+0x89/0xb0 [ 61.685734][ T5959] ? tcp_ioctl+0x673/0x860 [ 61.687088][ T5959] end_report+0x78/0x160 [ 61.688400][ T5959] kasan_report+0x129/0x150 [ 61.689763][ T5959] ? stack_trace_save+0x9c/0xe0 [ 61.691230][ T5959] ? tcp_ioctl+0x673/0x860 [ 61.692580][ T5959] tcp_ioctl+0x673/0x860 [ 61.693888][ T5959] ? kasan_save_track+0x4f/0x80 [ 61.695362][ T5959] ? kasan_save_track+0x3e/0x80 [ 61.696854][ T5959] ? __kasan_save_free_info+0x46/0x50 [ 61.698480][ T5959] ? udp_bpf_ioctl+0xaa/0x1d0 [ 61.699890][ T5959] sk_ioctl+0x3c7/0x600 [ 61.701151][ T5959] ? __pfx_sk_ioctl+0x10/0x10 [ 61.702587][ T5959] inet_ioctl+0x416/0x4c0 [ 61.703893][ T5959] ? __pfx_inet_ioctl+0x10/0x10 [ 61.705357][ T5959] ? lockdep_hardirqs_on+0x9c/0x150 [ 61.706936][ T5959] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 61.708624][ T5959] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 61.710154][ T5959] sock_do_ioctl+0xdc/0x300 [ 61.711565][ T5959] ? __pfx_sock_do_ioctl+0x10/0x10 [ 61.713105][ T5959] sock_ioctl+0x576/0x790 [ 61.714427][ T5959] ? __pfx_sock_ioctl+0x10/0x10 [ 61.715925][ T5959] ? __fget_files+0x3a0/0x420 [ 61.717356][ T5959] ? __fget_files+0x2a/0x420 [ 61.718775][ T5959] ? bpf_lsm_file_ioctl+0x9/0x20 [ 61.720292][ T5959] ? __pfx_sock_ioctl+0x10/0x10 [ 61.721800][ T5959] __se_sys_ioctl+0xfc/0x170 [ 61.723230][ T5959] do_syscall_64+0xfa/0xfa0 [ 61.724624][ T5959] ? lockdep_hardirqs_on+0x9c/0x150 [ 61.726177][ T5959] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 61.728035][ T5959] ? exc_page_fault+0xab/0x100 [ 61.729495][ T5959] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 61.731284][ T5959] RIP: 0033:0x7f4a1458f6c9 [ 61.732631][ T5959] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 61.738450][ T5959] RSP: 002b:00007f4a1545b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 61.740953][ T5959] RAX: ffffffffffffffda RBX: 00007f4a147e5fa0 RCX: 00007f4a1458f6c9 [ 61.743379][ T5959] RDX: 0000000000000000 RSI: 0000000000008905 RDI: 0000000000000004 [ 61.745813][ T5959] RBP: 00007f4a14611f91 R08: 0000000000000000 R09: 0000000000000000 [ 61.748271][ T5959] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 61.750726][ T5959] R13: 00007f4a147e6038 R14: 00007f4a147e5fa0 R15: 00007ffef33173a8 [ 61.753091][ T5959] [ 61.754720][ T5959] Kernel Offset: disabled [ 61.756074][ T5959] Rebooting in 86400 seconds.. VM DIAGNOSIS: 05:01:45 Registers: info registers vcpu 0 CPU#0 RAX=d1ba6886890d9100 RBX=ffffffff81967e77 RCX=d1ba6886890d9100 RDX=0000000000000001 RSI=ffffffff8d70f195 RDI=ffffffff8bbf0e60 RBP=ffffffff8dc07ea8 RSP=ffffffff8dc07d80 R8 =ffff888121232f5b R9 =1ffff110242465eb R10=dffffc0000000000 R11=ffffed10242465ec R12=ffffffff8f7cee70 R13=0000000000000000 R14=0000000000000000 R15=1ffffffff1b92a40 RIP=ffffffff8b46ddd3 RFL=00000286 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88818eb38000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000001b2f163fff CR3=00000001718b2000 CR4=000006f0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000 XMM02=00007f4a147b7498 00007f4a147b7470 XMM03=00007f4a147b74a8 00007f4a147b74a0 XMM04=00007f4a1531d100 00007f4a147b7460 XMM05=00007f4a147b7478 00007f4a147b74c0 XMM06=00007f4a147b74b8 00007f4a147b74b0 XMM07=00007f4a147b74a8 00007f4a147b74a0 XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 00007f4a146131cf XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000 XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000 XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000000030 RBX=0000000000000030 RCX=0000000000000000 RDX=00000000000003f8 RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90003def230 R8 =ffff88816a6f0237 R9 =1ffff1102d4de046 R10=dffffc0000000000 R11=ffffffff85153300 R12=dffffc0000000000 R13=ffffffff997dc937 R14=ffffffff99aeff60 R15=0000000000000000 RIP=ffffffff8515337c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00007f4a1545b6c0 ffffffff 00c00000 GS =0000 ffff8882a9f38000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f4a1545afc8 CR3=00000001718b2000 CR4=000006f0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000 XMM02=00007f4a147b7498 00007f4a147b7470 XMM03=00007f4a147b74a8 00007f4a147b74a0 XMM04=00007f4a1531d100 00007f4a147b7460 XMM05=00007f4a147b7478 00007f4a147b74c0 XMM06=00007f4a147b74b8 00007f4a147b74b0 XMM07=00007f4a147b74a8 00007f4a147b74a0 XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 00007f4a146131cf XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000 XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000 XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000