Warning: Permanently added '[localhost]:7494' (ED25519) to the list of known hosts. 2025/12/07 18:31:59 parsed 1 programs syzkaller login: [ 56.319944][ T5811] cgroup: Unknown subsys name 'net' [ 56.453080][ T5811] cgroup: Unknown subsys name 'cpuset' [ 56.458804][ T5811] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 58.148433][ T5811] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 60.082096][ T5822] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 60.206137][ T83] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 60.209315][ T83] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 60.247579][ T29] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 60.250000][ T29] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 60.374450][ T5848] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 60.378892][ T5848] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 60.381654][ T5848] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 60.385303][ T5848] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 60.388410][ T5848] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 61.118769][ T5870] chnl_net:caif_netlink_parms(): no params data found [ 61.240548][ T5870] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.244097][ T5870] bridge0: port 1(bridge_slave_0) entered disabled state [ 61.247347][ T5870] bridge_slave_0: entered allmulticast mode [ 61.251011][ T5870] bridge_slave_0: entered promiscuous mode [ 61.254875][ T5870] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.260252][ T5870] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.262545][ T5870] bridge_slave_1: entered allmulticast mode [ 61.265007][ T5870] bridge_slave_1: entered promiscuous mode [ 61.304830][ T5870] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 61.311537][ T5870] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 61.359478][ T5870] team0: Port device team_slave_0 added [ 61.366377][ T5870] team0: Port device team_slave_1 added [ 61.391269][ T5870] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 61.393385][ T5870] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 61.401507][ T5870] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 61.419139][ T5870] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 61.421211][ T5870] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 61.429220][ T5870] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 61.469004][ T5870] hsr_slave_0: entered promiscuous mode [ 61.477232][ T5870] hsr_slave_1: entered promiscuous mode [ 61.881033][ T5870] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 61.931784][ T5870] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 61.980194][ T5870] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 61.990711][ T5870] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 62.144863][ T5870] 8021q: adding VLAN 0 to HW filter on device bond0 [ 62.168307][ T5870] 8021q: adding VLAN 0 to HW filter on device team0 [ 62.174161][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.176322][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 62.188132][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.190300][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 62.351463][ T5870] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 62.374488][ T5870] veth0_vlan: entered promiscuous mode [ 62.381718][ T5870] veth1_vlan: entered promiscuous mode [ 62.413145][ T5870] veth0_macvtap: entered promiscuous mode [ 62.418545][ T5870] veth1_macvtap: entered promiscuous mode [ 62.428583][ T5870] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 62.435349][ T5870] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 62.444644][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.451584][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.454304][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.465931][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 2025/12/07 18:32:08 executed programs: 0 [ 62.833517][ T5848] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 62.848831][ T5848] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 62.852069][ T5848] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 62.855655][ T5848] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 62.860863][ T5848] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 62.874178][ T5198] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 62.878566][ T5198] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 62.885253][ T5928] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 62.885394][ T5926] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 62.891255][ T5928] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 62.896519][ T5928] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 62.900046][ T5928] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 62.902784][ T5928] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 62.917446][ T5198] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 62.920904][ T5198] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 63.172707][ T5919] chnl_net:caif_netlink_parms(): no params data found [ 63.224104][ T5832] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 63.274120][ T5924] chnl_net:caif_netlink_parms(): no params data found [ 63.284900][ T5922] chnl_net:caif_netlink_parms(): no params data found [ 63.299839][ T5832] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 63.369109][ T5832] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 63.383837][ T5919] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.386518][ T5919] bridge0: port 1(bridge_slave_0) entered disabled state [ 63.389018][ T5919] bridge_slave_0: entered allmulticast mode [ 63.391900][ T5919] bridge_slave_0: entered promiscuous mode [ 63.394910][ T5919] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.397933][ T5919] bridge0: port 2(bridge_slave_1) entered disabled state [ 63.400508][ T5919] bridge_slave_1: entered allmulticast mode [ 63.404079][ T5919] bridge_slave_1: entered promiscuous mode [ 63.481915][ T5919] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 63.492172][ T5922] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.494396][ T5922] bridge0: port 1(bridge_slave_0) entered disabled state [ 63.497234][ T5922] bridge_slave_0: entered allmulticast mode [ 63.499734][ T5922] bridge_slave_0: entered promiscuous mode [ 63.503074][ T5924] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.505276][ T5924] bridge0: port 1(bridge_slave_0) entered disabled state [ 63.508368][ T5924] bridge_slave_0: entered allmulticast mode [ 63.512057][ T5924] bridge_slave_0: entered promiscuous mode [ 63.515192][ T5924] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.518146][ T5924] bridge0: port 2(bridge_slave_1) entered disabled state [ 63.520910][ T5924] bridge_slave_1: entered allmulticast mode [ 63.524440][ T5924] bridge_slave_1: entered promiscuous mode [ 63.530150][ T5919] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 63.546112][ T5922] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.548684][ T5922] bridge0: port 2(bridge_slave_1) entered disabled state [ 63.550810][ T5922] bridge_slave_1: entered allmulticast mode [ 63.553295][ T5922] bridge_slave_1: entered promiscuous mode [ 63.582080][ T5919] team0: Port device team_slave_0 added [ 63.609553][ T5924] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 63.614118][ T5919] team0: Port device team_slave_1 added [ 63.618130][ T5924] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 63.622594][ T5922] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 63.639026][ T5922] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 63.663745][ T5919] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 63.665768][ T5919] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 63.673450][ T5919] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 63.678415][ T5924] team0: Port device team_slave_0 added [ 63.687800][ T5922] team0: Port device team_slave_0 added [ 63.690004][ T5919] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 63.692246][ T5919] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 63.701184][ T5919] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 63.705548][ T5924] team0: Port device team_slave_1 added [ 63.718414][ T5922] team0: Port device team_slave_1 added [ 63.732429][ T5924] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 63.735142][ T5924] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 63.745137][ T5924] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 63.751392][ T5924] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 63.754084][ T5924] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 63.763883][ T5924] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 63.807860][ T5922] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 63.809906][ T5922] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 63.818501][ T5922] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 63.829388][ T5922] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 63.831501][ T5922] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 63.839815][ T5922] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 63.849078][ T5919] hsr_slave_0: entered promiscuous mode [ 63.851502][ T5919] hsr_slave_1: entered promiscuous mode [ 63.853484][ T5919] debugfs: 'hsr0' already exists in 'hsr' [ 63.855197][ T5919] Cannot create hsr debugfs directory [ 63.886489][ T5924] hsr_slave_0: entered promiscuous mode [ 63.889107][ T5924] hsr_slave_1: entered promiscuous mode [ 63.891026][ T5924] debugfs: 'hsr0' already exists in 'hsr' [ 63.892731][ T5924] Cannot create hsr debugfs directory [ 63.919593][ T5922] hsr_slave_0: entered promiscuous mode [ 63.922298][ T5922] hsr_slave_1: entered promiscuous mode [ 63.924306][ T5922] debugfs: 'hsr0' already exists in 'hsr' [ 63.925964][ T5922] Cannot create hsr debugfs directory [ 64.649595][ T5832] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 64.917543][ T5198] Bluetooth: hci0: command tx timeout [ 64.986861][ T5848] Bluetooth: hci2: command tx timeout [ 64.988779][ T5198] Bluetooth: hci1: command tx timeout [ 66.254728][ T5832] bridge_slave_1: left allmulticast mode [ 66.256506][ T5832] bridge_slave_1: left promiscuous mode [ 66.263388][ T5832] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.271415][ T5832] bridge_slave_0: left allmulticast mode [ 66.273112][ T5832] bridge_slave_0: left promiscuous mode [ 66.274832][ T5832] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.477812][ T5832] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 66.483927][ T5832] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 66.488655][ T5832] bond0 (unregistering): Released all slaves [ 66.607530][ T5832] hsr_slave_0: left promiscuous mode [ 66.609697][ T5832] hsr_slave_1: left promiscuous mode [ 66.611620][ T5832] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 66.613817][ T5832] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 66.617630][ T5832] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 66.620564][ T5832] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 66.639323][ T5832] veth1_macvtap: left promiscuous mode [ 66.641149][ T5832] veth0_macvtap: left promiscuous mode [ 66.642816][ T5832] veth1_vlan: left promiscuous mode [ 66.644751][ T5832] veth0_vlan: left promiscuous mode [ 66.901770][ T5832] team0 (unregistering): Port device team_slave_1 removed [ 66.915927][ T5832] team0 (unregistering): Port device team_slave_0 removed [ 66.998461][ T5198] Bluetooth: hci0: command tx timeout [ 67.076809][ T5848] Bluetooth: hci2: command tx timeout [ 67.078997][ T5198] Bluetooth: hci1: command tx timeout [ 67.204068][ T5919] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 67.222535][ T5919] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 67.237450][ T5919] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 67.249622][ T5919] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 67.292736][ T5924] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 67.303277][ T5924] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 67.311514][ T5924] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 67.339457][ T5924] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 67.382883][ T5919] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.409483][ T5922] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 67.414142][ T5922] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 67.418496][ T5922] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 67.423178][ T5922] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 67.444579][ T5919] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.456266][ T29] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.458454][ T29] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.467627][ T29] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.469711][ T29] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.514092][ T5924] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.540808][ T5924] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.546531][ T5922] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.569228][ T29] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.571389][ T29] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.574462][ T29] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.576544][ T29] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.589149][ T5922] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.598133][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.600957][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.608787][ T29] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.610958][ T29] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.669243][ T5922] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 67.691818][ T5919] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.731771][ T5919] veth0_vlan: entered promiscuous mode [ 67.736365][ T5924] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.745514][ T5919] veth1_vlan: entered promiscuous mode [ 67.775278][ T5919] veth0_macvtap: entered promiscuous mode [ 67.782957][ T5919] veth1_macvtap: entered promiscuous mode [ 67.791607][ T5924] veth0_vlan: entered promiscuous mode [ 67.795014][ T5922] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.812140][ T5924] veth1_vlan: entered promiscuous mode [ 67.818503][ T5919] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 67.828668][ T5919] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 67.841539][ T5851] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.844653][ T5851] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.855346][ T5851] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.858839][ T5851] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.869872][ T5924] veth0_macvtap: entered promiscuous mode [ 67.880100][ T5922] veth0_vlan: entered promiscuous mode [ 67.894479][ T5924] veth1_macvtap: entered promiscuous mode [ 67.898494][ T5922] veth1_vlan: entered promiscuous mode [ 67.933613][ T5924] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 67.948640][ T5924] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 67.953003][ T29] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.956435][ T29] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.969531][ T5851] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.972195][ T5851] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.974979][ T5851] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.979530][ T5922] veth0_macvtap: entered promiscuous mode [ 67.990372][ T5851] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.998882][ T5922] veth1_macvtap: entered promiscuous mode [ 68.005697][ T83] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.010300][ T83] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2025/12/07 18:32:13 executed programs: 6 [ 68.052627][ T5922] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 68.072525][ T6005] syz.1.18 uses obsolete (PF_INET,SOCK_PACKET) [ 68.075280][ T5922] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 68.081685][ T29] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.085431][ T29] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.089625][ T6005] netlink: 8 bytes leftover after parsing attributes in process `syz.1.18'. [ 68.103358][ T5832] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.116507][ T5851] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.120531][ T5851] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.123153][ T5851] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.127662][ T29] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.131165][ T29] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.219810][ T6007] netlink: 8 bytes leftover after parsing attributes in process `syz.1.20'. [ 68.220106][ T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.226295][ T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.231667][ T6009] netlink: 8 bytes leftover after parsing attributes in process `syz.2.19'. [ 68.256471][ T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.259560][ T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.271639][ T6010] ================================================================== [ 68.274722][ T6010] BUG: KASAN: slab-use-after-free in nf_flow_skb_encap_protocol+0x13a2/0x1540 [ 68.278194][ T6010] Read of size 2 at addr ffff888175605eb6 by task syz.1.20/6010 [ 68.281738][ T6010] [ 68.282475][ T6011] ------------[ cut here ]------------ [ 68.282728][ T6010] CPU: 1 UID: 0 PID: 6010 Comm: syz.1.20 Not tainted syzkaller #0 PREEMPT(full) [ 68.282743][ T6010] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 68.282750][ T6010] Call Trace: [ 68.282755][ T6010] [ 68.282761][ T6010] dump_stack_lvl+0x189/0x250 [ 68.282781][ T6010] ? __virt_addr_valid+0x1c8/0x5c0 [ 68.282797][ T6010] ? rcu_is_watching+0x15/0xb0 [ 68.282810][ T6010] ? __pfx_dump_stack_lvl+0x10/0x10 [ 68.282826][ T6010] ? rcu_is_watching+0x15/0xb0 [ 68.282837][ T6010] ? lock_release+0x4b/0x3e0 [ 68.282849][ T6010] ? _raw_spin_lock_irqsave+0xb3/0xf0 [ 68.282863][ T6010] ? __virt_addr_valid+0x1c8/0x5c0 [ 68.282877][ T6010] ? __virt_addr_valid+0x4a5/0x5c0 [ 68.282917][ T6010] print_report+0xca/0x240 [ 68.282931][ T6010] ? nf_flow_skb_encap_protocol+0x13a2/0x1540 [ 68.282946][ T6010] kasan_report+0x118/0x150 [ 68.282959][ T6010] ? nf_flow_skb_encap_protocol+0x13a2/0x1540 [ 68.282975][ T6010] nf_flow_skb_encap_protocol+0x13a2/0x1540 [ 68.282995][ T6010] nf_flow_offload_ipv6_hook+0x13c/0x32a0 [ 68.283009][ T6010] ? trace_sched_exit_tp+0x36/0x110 [ 68.283025][ T6010] ? __schedule+0x17ae/0x4cc0 [ 68.283043][ T6010] ? __pfx_nf_flow_offload_ipv6_hook+0x10/0x10 [ 68.283059][ T6010] ? page_table_check_set+0x18d/0x730 [ 68.283078][ T6010] ? __lock_acquire+0xab9/0xd20 [ 68.283090][ T6010] ? skb_copy_bits+0x420/0x8f0 [ 68.283104][ T6010] ? __asan_memcpy+0x40/0x70 [ 68.283118][ T6010] ? skb_copy_bits+0x7e6/0x8f0 [ 68.283138][ T6010] ? nf_flow_offload_inet_hook+0x3b4/0x630 [ 68.283153][ T6010] ? __netif_receive_skb_core+0x2171/0x2f90 [ 68.283164][ T6010] ? __pfx_nf_flow_offload_inet_hook+0x10/0x10 [ 68.283182][ T6010] nf_hook_slow+0xc5/0x220 [ 68.283199][ T6010] __netif_receive_skb_core+0x241c/0x2f90 [ 68.283209][ T6010] ? __netif_receive_skb_core+0x2171/0x2f90 [ 68.283220][ T6010] ? __pfx___skb_flow_dissect+0x10/0x10 [ 68.283233][ T6010] ? __pfx___up_read+0x10/0x10 [ 68.283248][ T6010] ? do_user_addr_fault+0xbbc/0x1380 [ 68.283261][ T6010] ? do_user_addr_fault+0xc85/0x1380 [ 68.283273][ T6010] ? __pfx___netif_receive_skb_core+0x10/0x10 [ 68.283285][ T6010] ? lockdep_hardirqs_on+0x9c/0x150 [ 68.283302][ T6010] ? netif_receive_skb+0x115/0x790 [ 68.283319][ T6010] ? netif_receive_skb+0x115/0x790 [ 68.283335][ T6010] __netif_receive_skb+0x72/0x380 [ 68.283347][ T6010] ? netif_receive_skb+0x115/0x790 [ 68.283362][ T6010] netif_receive_skb+0x1cb/0x790 [ 68.283378][ T6010] ? __pfx___local_bh_disable_ip+0x10/0x10 [ 68.283390][ T6010] ? __pfx_netif_receive_skb+0x10/0x10 [ 68.283408][ T6010] ? tun_rx_batched+0x160/0x730 [ 68.283423][ T6010] tun_rx_batched+0x1b9/0x730 [ 68.283436][ T6010] ? __lock_acquire+0xab9/0xd20 [ 68.283448][ T6010] ? __pfx_tun_rx_batched+0x10/0x10 [ 68.283462][ T6010] ? tun_get_user+0x272f/0x3e90 [ 68.283479][ T6010] tun_get_user+0x2b65/0x3e90 [ 68.283496][ T6010] ? tun_get_user+0x272f/0x3e90 [ 68.283510][ T6010] ? aa_file_perm+0x44d/0x1550 [ 68.283521][ T6010] ? __pfx_tun_get_user+0x10/0x10 [ 68.283540][ T6010] ? ref_tracker_alloc+0x318/0x460 [ 68.283551][ T6010] ? __lock_acquire+0xab9/0xd20 [ 68.283562][ T6010] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 68.283574][ T6010] ? tun_get+0x1c/0x2f0 [ 68.283589][ T6010] ? tun_get+0x1c/0x2f0 [ 68.283609][ T6010] ? tun_get+0x1c/0x2f0 [ 68.283623][ T6010] tun_chr_write_iter+0x113/0x200 [ 68.283637][ T6010] vfs_write+0x5c9/0xb30 [ 68.283654][ T6010] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 68.283667][ T6010] ? __pfx_vfs_write+0x10/0x10 [ 68.283685][ T6010] ? __fget_files+0x2a/0x420 [ 68.283699][ T6010] ksys_write+0x145/0x250 [ 68.283715][ T6010] ? __pfx_ksys_write+0x10/0x10 [ 68.283731][ T6010] ? do_syscall_64+0xbe/0xfa0 [ 68.283747][ T6010] do_syscall_64+0xfa/0xfa0 [ 68.283760][ T6010] ? lockdep_hardirqs_on+0x9c/0x150 [ 68.283772][ T6010] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 68.283784][ T6010] ? exc_page_fault+0xab/0x100 [ 68.283797][ T6010] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 68.283809][ T6010] RIP: 0033:0x7f53b9d8f7c9 [ 68.283820][ T6010] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 68.283830][ T6010] RSP: 002b:00007f53babe6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 68.283842][ T6010] RAX: ffffffffffffffda RBX: 00007f53b9fe6090 RCX: 00007f53b9d8f7c9 [ 68.283851][ T6010] RDX: 000000000000fdef RSI: 0000200000000340 RDI: 0000000000000003 [ 68.283858][ T6010] RBP: 00007f53b9df297f R08: 0000000000000000 R09: 0000000000000000 [ 68.283866][ T6010] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 68.283873][ T6010] R13: 00007f53b9fe6128 R14: 00007f53b9fe6090 R15: 00007ffc1b120a08 [ 68.283911][ T6010] [ 68.283917][ T6010] [ 68.284460][ T6011] refcount_t: underflow; use-after-free. [ 68.288024][ T6010] Allocated by task 6010: [ 68.288036][ T6010] kasan_save_track+0x3e/0x80 [ 68.288055][ T6010] __kasan_slab_alloc+0x6c/0x80 [ 68.288064][ T6010] kmem_cache_alloc_node_noprof+0x433/0x710 [ 68.288080][ T6010] __alloc_skb+0x255/0x430 [ 68.291323][ T6011] WARNING: CPU: 0 PID: 6011 at lib/refcount.c:28 refcount_warn_saturate+0x11a/0x1d0 [ 68.292493][ T6010] alloc_skb_with_frags+0xca/0x890 [ 68.293413][ T6011] Modules linked in: [ 68.295202][ T6010] sock_alloc_send_pskb+0x84d/0x980 [ 68.296845][ T6011] CPU: 0 UID: 0 PID: 6011 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full) [ 68.298576][ T6010] tun_get_user+0xa43/0x3e90 [ 68.300190][ T6011] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 68.302040][ T6010] tun_chr_write_iter+0x113/0x200 [ 68.303711][ T6011] RIP: 0010:refcount_warn_saturate+0x11a/0x1d0 [ 68.305734][ T6010] vfs_write+0x5c9/0xb30 [ 68.307802][ T6011] Code: 00 5a be 8b e8 27 80 f9 fc 90 0f 0b 90 90 eb d7 e8 1b 64 36 fd c6 05 22 96 dd 0a 01 90 48 c7 c7 60 5a be 8b e8 07 80 f9 fc 90 <0f> 0b 90 90 eb b7 e8 fb 63 36 fd c6 05 ff 95 dd 0a 01 90 48 c7 c7 [ 68.309649][ T6010] ksys_write+0x145/0x250 [ 68.311424][ T6011] RSP: 0018:ffffc900036c75c0 EFLAGS: 00010246 [ 68.313776][ T6010] do_syscall_64+0xfa/0xfa0 [ 68.315585][ T6011] [ 68.317442][ T6010] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 68.317453][ T6010] [ 68.317455][ T6010] Freed by task 6010: [ 68.317460][ T6010] kasan_save_track+0x3e/0x80 [ 68.317470][ T6010] __kasan_save_free_info+0x46/0x50 [ 68.317478][ T6010] __kasan_slab_free+0x5c/0x80 [ 68.317486][ T6010] kmem_cache_free+0x19b/0x690 [ 68.317497][ T6010] dst_discard_out+0x1c/0x30 [ 68.317506][ T6010] nf_flow_skb_encap_protocol+0x9c2/0x1540 [ 68.317514][ T6010] nf_flow_offload_ipv6_hook+0x13c/0x32a0 [ 68.317522][ T6010] nf_hook_slow+0xc5/0x220 [ 68.317531][ T6010] __netif_receive_skb_core+0x241c/0x2f90 [ 68.317537][ T6010] __netif_receive_skb+0x72/0x380 [ 68.317543][ T6010] netif_receive_skb+0x1cb/0x790 [ 68.317552][ T6010] tun_rx_batched+0x1b9/0x730 [ 68.317560][ T6010] tun_get_user+0x2b65/0x3e90 [ 68.317568][ T6010] tun_chr_write_iter+0x113/0x200 [ 68.317575][ T6010] vfs_write+0x5c9/0xb30 [ 68.319851][ T6011] RAX: 3a15d08988857100 RBX: 0000000000000003 RCX: ffff888113523a00 [ 68.321966][ T6010] ksys_write+0x145/0x250 [ 68.321980][ T6010] do_syscall_64+0xfa/0xfa0 [ 68.321989][ T6010] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 68.321995][ T6010] [ 68.321998][ T6010] The buggy address belongs to the object at ffff888175605e00 [ 68.321998][ T6010] which belongs to the cache skbuff_head_cache of size 240 [ 68.322005][ T6010] The buggy address is located 182 bytes inside of [ 68.322005][ T6010] freed 240-byte region [ffff888175605e00, ffff888175605ef0) [ 68.322012][ T6010] [ 68.322015][ T6010] The buggy address belongs to the physical page: [ 68.322019][ T6010] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x175604 [ 68.322027][ T6010] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 68.322034][ T6010] flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff) [ 68.323905][ T6011] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 [ 68.325332][ T6010] page_type: f5(slab) [ 68.325342][ T6010] raw: 057ff00000000040 ffff8881036c4a00 dead000000000122 0000000000000000 [ 68.327532][ T6011] RBP: 0000000000000000 R08: ffffffff8f7d1e77 R09: 1ffffffff1efa3ce [ 68.329388][ T6010] raw: 0000000000000000 0000000080150015 00000000f5000000 0000000000000000 [ 68.330949][ T6011] R10: dffffc0000000000 R11: fffffbfff1efa3cf R12: ffff8881b6033000 [ 68.332860][ T6010] head: 057ff00000000040 ffff8881036c4a00 dead000000000122 0000000000000000 [ 68.332872][ T6010] head: 0000000000000000 0000000080150015 00000000f5000000 0000000000000000 [ 68.332905][ T6010] head: 057ff00000000001 ffffea0005d58101 00000000ffffffff 00000000ffffffff [ 68.332916][ T6010] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 68.332922][ T6010] page dumped because: kasan: bad access detected [ 68.334270][ T6011] R13: ffff888175face70 R14: ffff888112441be4 R15: ffff888112441980 [ 68.335714][ T6010] page_owner tracks the page as allocated [ 68.337456][ T6011] FS: 00007fe7180a46c0(0000) GS:ffff88818eb2e000(0000) knlGS:0000000000000000 [ 68.339158][ T6010] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5922, tgid 5922 (syz-executor), ts 68256102142, free_ts 61484167308 [ 68.340921][ T6011] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 68.342652][ T6010] post_alloc_hook+0x234/0x290 [ 68.344319][ T6011] CR2: 0000200000010000 CR3: 000000011261c000 CR4: 00000000000006f0 [ 68.346041][ T6010] get_page_from_freelist+0x2365/0x2440 [ 68.347752][ T6011] Call Trace: [ 68.349082][ T6010] __alloc_frozen_pages_noprof+0x181/0x370 [ 68.350641][ T6011] [ 68.352240][ T6010] alloc_pages_mpol+0x232/0x4a0 [ 68.354028][ T6011] ip6_rcv_core+0x300/0x1590 [ 68.355956][ T6010] allocate_slab+0x96/0x350 [ 68.357535][ T6011] ? ip6_rcv_core+0x9e/0x1590 [ 68.359130][ T6010] ___slab_alloc+0xf56/0x1990 [ 68.360906][ T6011] ipv6_rcv+0x72/0xc0 [ 68.362478][ T6010] __slab_alloc+0x65/0x100 [ 68.364400][ T6011] __netif_receive_skb+0xd3/0x380 [ 68.366100][ T6010] kmem_cache_alloc_node_noprof+0x4c5/0x710 [ 68.368279][ T6011] ? netif_receive_skb+0x115/0x790 [ 68.369827][ T6010] __alloc_skb+0x255/0x430 [ 68.371689][ T6011] netif_receive_skb+0x1cb/0x790 [ 68.373087][ T6010] inet_ifmcaddr_notify+0x7e/0x150 [ 68.375073][ T6011] ? __pfx___local_bh_disable_ip+0x10/0x10 [ 68.376514][ T6010] ____ip_mc_inc_group+0x9b8/0xde0 [ 68.378370][ T6011] ? __pfx_netif_receive_skb+0x10/0x10 [ 68.380110][ T6010] ip_mc_up+0x125/0x300 [ 68.381969][ T6011] ? tun_rx_batched+0x160/0x730 [ 68.383554][ T6010] inetdev_event+0xfb3/0x15b0 [ 68.385516][ T6011] tun_rx_batched+0x1b9/0x730 [ 68.387204][ T6010] notifier_call_chain+0x1b6/0x3e0 [ 68.387219][ T6010] __dev_notify_flags+0x18d/0x2e0 [ 68.387230][ T6010] netif_change_flags+0xe8/0x1a0 [ 68.387241][ T6010] page last free pid 5811 tgid 5811 stack trace: [ 68.387248][ T6010] __free_frozen_pages+0xbc4/0xd30 [ 68.387261][ T6010] __slab_free+0x2e7/0x390 [ 68.389023][ T6011] ? __lock_acquire+0xab9/0xd20 [ 68.390711][ T6010] qlist_free_all+0x97/0x140 [ 68.392076][ T6011] ? __pfx_tun_rx_batched+0x10/0x10 [ 68.393619][ T6010] kasan_quarantine_reduce+0x148/0x160 [ 68.395379][ T6011] ? tun_get_user+0x272f/0x3e90 [ 68.396733][ T6010] __kasan_slab_alloc+0x22/0x80 [ 68.396743][ T6010] kmem_cache_alloc_noprof+0x367/0x6e0 [ 68.396752][ T6010] ptlock_alloc+0x20/0x70 [ 68.396760][ T6010] pte_alloc_one+0x7a/0x310 [ 68.396768][ T6010] __do_fault+0xd1/0x390 [ 68.396773][ T6010] __handle_mm_fault+0x1847/0x5400 [ 68.396781][ T6010] handle_mm_fault+0x40a/0x8e0 [ 68.396789][ T6010] do_user_addr_fault+0xa7c/0x1380 [ 68.398757][ T6011] tun_get_user+0x2b65/0x3e90 [ 68.400184][ T6010] exc_page_fault+0x82/0x100 [ 68.401664][ T6011] ? tun_get_user+0x272f/0x3e90 [ 68.403041][ T6010] asm_exc_page_fault+0x26/0x30 [ 68.404523][ T6011] ? aa_file_perm+0x44d/0x1550 [ 68.405987][ T6010] [ 68.405991][ T6010] Memory state around the buggy address: [ 68.407404][ T6011] ? __pfx_tun_get_user+0x10/0x10 [ 68.409012][ T6010] ffff888175605d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 68.410900][ T6011] ? ref_tracker_alloc+0x318/0x460 [ 68.412411][ T6010] ffff888175605e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 68.414238][ T6011] ? __lock_acquire+0xab9/0xd20 [ 68.415692][ T6010] >ffff888175605e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc [ 68.421749][ T6011] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 68.424469][ T6010] ^ [ 68.427073][ T6011] ? tun_get+0x1c/0x2f0 [ 68.429336][ T6010] ffff888175605f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 68.431847][ T6011] ? tun_get+0x1c/0x2f0 [ 68.434346][ T6010] ffff888175605f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 68.437005][ T6011] ? tun_get+0x1c/0x2f0 [ 68.437869][ T6010] ================================================================== [ 68.438030][ T6010] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 68.438041][ T6010] CPU: 1 UID: 0 PID: 6010 Comm: syz.1.20 Not tainted syzkaller #0 PREEMPT(full) [ 68.438053][ T6010] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 68.438058][ T6010] Call Trace: [ 68.438062][ T6010] [ 68.438065][ T6010] dump_stack_lvl+0x99/0x250 [ 68.438083][ T6010] ? __asan_memcpy+0x40/0x70 [ 68.438099][ T6010] ? __pfx_dump_stack_lvl+0x10/0x10 [ 68.438111][ T6010] ? __pfx__printk+0x10/0x10 [ 68.438120][ T6010] vpanic+0x237/0x6d0 [ 68.438130][ T6010] ? __pfx_vpanic+0x10/0x10 [ 68.438140][ T6010] panic+0xb9/0xc0 [ 68.438149][ T6010] ? __pfx_panic+0x10/0x10 [ 68.438158][ T6010] ? _raw_spin_unlock_irqrestore+0xa8/0x110 [ 68.438167][ T6010] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 68.438175][ T6010] ? is_module_address+0x17/0xf0 [ 68.438184][ T6010] ? nf_flow_skb_encap_protocol+0x13a2/0x1540 [ 68.438194][ T6010] check_panic_on_warn+0x89/0xb0 [ 68.438204][ T6010] ? nf_flow_skb_encap_protocol+0x13a2/0x1540 [ 68.438213][ T6010] end_report+0x78/0x160 [ 68.438219][ T6010] kasan_report+0x129/0x150 [ 68.438226][ T6010] ? nf_flow_skb_encap_protocol+0x13a2/0x1540 [ 68.438236][ T6010] nf_flow_skb_encap_protocol+0x13a2/0x1540 [ 68.438247][ T6010] nf_flow_offload_ipv6_hook+0x13c/0x32a0 [ 68.438256][ T6010] ? trace_sched_exit_tp+0x36/0x110 [ 68.438267][ T6010] ? __schedule+0x17ae/0x4cc0 [ 68.438277][ T6010] ? __pfx_nf_flow_offload_ipv6_hook+0x10/0x10 [ 68.438286][ T6010] ? page_table_check_set+0x18d/0x730 [ 68.438298][ T6010] ? __lock_acquire+0xab9/0xd20 [ 68.438308][ T6010] ? skb_copy_bits+0x420/0x8f0 [ 68.438321][ T6010] ? __asan_memcpy+0x40/0x70 [ 68.438335][ T6010] ? skb_copy_bits+0x7e6/0x8f0 [ 68.438353][ T6010] ? nf_flow_offload_inet_hook+0x3b4/0x630 [ 68.438367][ T6010] ? __netif_receive_skb_core+0x2171/0x2f90 [ 68.438378][ T6010] ? __pfx_nf_flow_offload_inet_hook+0x10/0x10 [ 68.438389][ T6010] nf_hook_slow+0xc5/0x220 [ 68.438400][ T6010] __netif_receive_skb_core+0x241c/0x2f90 [ 68.438407][ T6010] ? __netif_receive_skb_core+0x2171/0x2f90 [ 68.438417][ T6010] ? __pfx___skb_flow_dissect+0x10/0x10 [ 68.438430][ T6010] ? __pfx___up_read+0x10/0x10 [ 68.438444][ T6010] ? do_user_addr_fault+0xbbc/0x1380 [ 68.438453][ T6010] ? do_user_addr_fault+0xc85/0x1380 [ 68.438464][ T6010] ? __pfx___netif_receive_skb_core+0x10/0x10 [ 68.438476][ T6010] ? lockdep_hardirqs_on+0x9c/0x150 [ 68.438492][ T6010] ? netif_receive_skb+0x115/0x790 [ 68.438508][ T6010] ? netif_receive_skb+0x115/0x790 [ 68.438524][ T6010] __netif_receive_skb+0x72/0x380 [ 68.438534][ T6010] ? netif_receive_skb+0x115/0x790 [ 68.438544][ T6010] netif_receive_skb+0x1cb/0x790 [ 68.438554][ T6010] ? __pfx___local_bh_disable_ip+0x10/0x10 [ 68.438562][ T6010] ? __pfx_netif_receive_skb+0x10/0x10 [ 68.438572][ T6010] ? tun_rx_batched+0x160/0x730 [ 68.438581][ T6010] tun_rx_batched+0x1b9/0x730 [ 68.438589][ T6010] ? __lock_acquire+0xab9/0xd20 [ 68.784424][ T6010] ? __pfx_tun_rx_batched+0x10/0x10 [ 68.786068][ T6010] ? tun_get_user+0x272f/0x3e90 [ 68.787592][ T6010] tun_get_user+0x2b65/0x3e90 [ 68.789068][ T6010] ? tun_get_user+0x272f/0x3e90 [ 68.790550][ T6010] ? aa_file_perm+0x44d/0x1550 [ 68.792081][ T6010] ? __pfx_tun_get_user+0x10/0x10 [ 68.793776][ T6010] ? ref_tracker_alloc+0x318/0x460 [ 68.795292][ T6010] ? __lock_acquire+0xab9/0xd20 [ 68.796852][ T6010] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 68.798664][ T6010] ? tun_get+0x1c/0x2f0 [ 68.800001][ T6010] ? tun_get+0x1c/0x2f0 [ 68.801343][ T6010] ? tun_get+0x1c/0x2f0 [ 68.802691][ T6010] tun_chr_write_iter+0x113/0x200 [ 68.804372][ T6010] vfs_write+0x5c9/0xb30 [ 68.805730][ T6010] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 68.807443][ T6010] ? __pfx_vfs_write+0x10/0x10 [ 68.808940][ T6010] ? __fget_files+0x2a/0x420 [ 68.810600][ T6010] ksys_write+0x145/0x250 [ 68.811960][ T6010] ? __pfx_ksys_write+0x10/0x10 [ 68.813439][ T6010] ? do_syscall_64+0xbe/0xfa0 [ 68.814849][ T6010] do_syscall_64+0xfa/0xfa0 [ 68.816249][ T6010] ? lockdep_hardirqs_on+0x9c/0x150 [ 68.817811][ T6010] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 68.819669][ T6010] ? exc_page_fault+0xab/0x100 [ 68.821101][ T6010] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 68.822906][ T6010] RIP: 0033:0x7f53b9d8f7c9 [ 68.824335][ T6010] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 68.830686][ T6010] RSP: 002b:00007f53babe6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 68.833162][ T6010] RAX: ffffffffffffffda RBX: 00007f53b9fe6090 RCX: 00007f53b9d8f7c9 [ 68.835520][ T6010] RDX: 000000000000fdef RSI: 0000200000000340 RDI: 0000000000000003 [ 68.838038][ T6010] RBP: 00007f53b9df297f R08: 0000000000000000 R09: 0000000000000000 [ 68.840622][ T6010] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 68.843090][ T6010] R13: 00007f53b9fe6128 R14: 00007f53b9fe6090 R15: 00007ffc1b120a08 [ 68.845451][ T6010] [ 69.936654][ T6010] Shutting down cpus with NMI [ 69.938848][ T6010] Kernel Offset: disabled [ 69.940207][ T6010] Rebooting in 86400 seconds.. VM DIAGNOSIS: 18:32:13 Registers: info registers vcpu 0 CPU#0 RAX=4877ae7777464900 RBX=ffffffff81967b47 RCX=4877ae7777464900 RDX=0000000000000001 RSI=ffffffff8d71437c RDI=ffffffff8bbf08e0 RBP=ffffffff8dc07ea8 RSP=ffffffff8dc07d80 R8 =ffff888121232fdb R9 =1ffff110242465fb R10=dffffc0000000000 R11=ffffed10242465fc R12=ffffffff8f7d1e70 R13=0000000000000000 R14=0000000000000000 R15=1ffffffff1b92a40 RIP=ffffffff8b488dd3 RFL=00000286 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88818eb2e000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f53babe6d58 CR3=0000000175738000 CR4=000006f0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000 XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000 XMM04=ffff000000000000 ffff000000000000 XMM05=0000000000000000 00007f68825f24a2 XMM06=0000000000000000 00007f68825f249c XMM07=0000000000000000 00007f68825f24b0 XMM08=0000000000000000 00007f68825f2418 XMM09=0000000000000000 00007f68825f2424 XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000 XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000 XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000000072 RBX=0000000000000072 RCX=0000000000000000 RDX=00000000000003f8 RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc900034f6810 R8 =ffff888109720237 R9 =1ffff110212e4046 R10=dffffc0000000000 R11=ffffffff8514faf0 R12=dffffc0000000000 R13=ffffffff997e692d R14=ffffffff99af9f40 R15=0000000000000000 RIP=ffffffff8514fb6c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00007f53babe66c0 ffffffff 00c00000 GS =0000 ffff8882a9f2e000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000200000010000 CR3=0000000175738000 CR4=000006f0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000 XMM02=00007f53b9fba498 00007f53b9fba470 XMM03=00007f53b9fba4a8 00007f53b9fba4a0 XMM04=00007f53bab1d100 00007f53b9fba460 XMM05=00007f53b9fba478 00007f53b9fba4c0 XMM06=00007f53b9fba4b8 00007f53b9fba4b0 XMM07=00007f53b9fba4a8 00007f53b9fba4a0 XMM08=160000005c000000 0000000000000000 XMM09=0000000000000000 00007f53b9df2424 XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000 XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000 XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000