Warning: Permanently added '[localhost]:41038' (ED25519) to the list of known hosts. 2025/09/03 14:52:31 parsed 1 programs syzkaller login: [ 63.126599][ T5854] cgroup: Unknown subsys name 'net' [ 63.244773][ T5854] cgroup: Unknown subsys name 'cpuset' [ 63.249356][ T5854] cgroup: Unknown subsys name 'rlimit' [ 65.222585][ T5854] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 67.861880][ T5861] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 69.528269][ T5237] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 69.533246][ T5237] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 69.536795][ T5237] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 69.541199][ T5237] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 69.547199][ T5237] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 70.660005][ T1095] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.673820][ T1095] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.697683][ T3623] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.700401][ T3623] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.081183][ T5933] chnl_net:caif_netlink_parms(): no params data found [ 71.188783][ T5933] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.193326][ T5933] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.196430][ T5933] bridge_slave_0: entered allmulticast mode [ 71.201024][ T5933] bridge_slave_0: entered promiscuous mode [ 71.208369][ T5933] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.212138][ T5933] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.215519][ T5933] bridge_slave_1: entered allmulticast mode [ 71.220422][ T5933] bridge_slave_1: entered promiscuous mode [ 71.254863][ T5933] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 71.262943][ T5933] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 71.341266][ T5933] team0: Port device team_slave_0 added [ 71.347154][ T5933] team0: Port device team_slave_1 added [ 71.350035][ T1364] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.362875][ T1364] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.397145][ T5933] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.400194][ T5933] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 71.412635][ T5933] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.426501][ T5933] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.429761][ T5933] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 71.442644][ T5933] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.494428][ T5933] hsr_slave_0: entered promiscuous mode [ 71.499713][ T5933] hsr_slave_1: entered promiscuous mode [ 71.674276][ T5933] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 71.682911][ T5933] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 71.688178][ T5933] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 71.693931][ T5933] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 71.765420][ T5933] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.782900][ T5933] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.793053][ T29] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.796036][ T29] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.807926][ T29] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.810696][ T29] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.969602][ T5933] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.018246][ T5933] veth0_vlan: entered promiscuous mode [ 72.030525][ T5933] veth1_vlan: entered promiscuous mode [ 72.063169][ T5933] veth0_macvtap: entered promiscuous mode [ 72.070126][ T5933] veth1_macvtap: entered promiscuous mode [ 72.086127][ T5933] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.096533][ T5933] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.107871][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.115609][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.126044][ T5924] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.129773][ T5924] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.243847][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 72.345041][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 72.414526][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 72.495608][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2025/09/03 14:52:43 executed programs: 0 [ 72.738144][ T55] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 72.743277][ T55] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 72.749167][ T55] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 72.756495][ T55] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 72.760500][ T55] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 72.955178][ T5959] chnl_net:caif_netlink_parms(): no params data found [ 73.046919][ T5959] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.050195][ T5959] bridge0: port 1(bridge_slave_0) entered disabled state [ 73.053924][ T5959] bridge_slave_0: entered allmulticast mode [ 73.059081][ T5959] bridge_slave_0: entered promiscuous mode [ 73.065597][ T5959] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.069047][ T5959] bridge0: port 2(bridge_slave_1) entered disabled state [ 73.073822][ T5959] bridge_slave_1: entered allmulticast mode [ 73.077949][ T5959] bridge_slave_1: entered promiscuous mode [ 73.118669][ T5959] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 73.126093][ T5959] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 73.162480][ T5959] team0: Port device team_slave_0 added [ 73.167538][ T5959] team0: Port device team_slave_1 added [ 73.205060][ T5959] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 73.208474][ T5959] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.220201][ T5959] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 73.227887][ T5959] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 73.230694][ T5959] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.241392][ T5959] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 73.293981][ T5959] hsr_slave_0: entered promiscuous mode [ 73.297647][ T5959] hsr_slave_1: entered promiscuous mode [ 73.300899][ T5959] debugfs: 'hsr0' already exists in 'hsr' [ 73.304870][ T5959] Cannot create hsr debugfs directory [ 74.782469][ T5237] Bluetooth: hci0: command tx timeout [ 75.464639][ T12] bridge_slave_1: left allmulticast mode [ 75.467739][ T12] bridge_slave_1: left promiscuous mode [ 75.470921][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 75.477184][ T12] bridge_slave_0: left allmulticast mode [ 75.479082][ T12] bridge_slave_0: left promiscuous mode [ 75.481451][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 75.770560][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 75.778990][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 75.784427][ T12] bond0 (unregistering): Released all slaves [ 75.914094][ T12] hsr_slave_0: left promiscuous mode [ 75.917475][ T12] hsr_slave_1: left promiscuous mode [ 75.921100][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 75.925681][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 75.930280][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 75.938363][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 75.955498][ T12] veth1_macvtap: left promiscuous mode [ 75.958251][ T12] veth0_macvtap: left promiscuous mode [ 75.961274][ T12] veth1_vlan: left promiscuous mode [ 75.964326][ T12] veth0_vlan: left promiscuous mode [ 76.340219][ T12] team0 (unregistering): Port device team_slave_1 removed [ 76.368079][ T12] team0 (unregistering): Port device team_slave_0 removed [ 76.853996][ T5959] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 76.864392][ T5237] Bluetooth: hci0: command tx timeout [ 76.874307][ T5959] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 76.883915][ T5959] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 76.889725][ T5959] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 76.964389][ T5959] 8021q: adding VLAN 0 to HW filter on device bond0 [ 76.974816][ T5959] 8021q: adding VLAN 0 to HW filter on device team0 [ 76.985371][ T29] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.988278][ T29] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.006846][ T29] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.009647][ T29] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.228595][ T5959] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.275815][ T5959] veth0_vlan: entered promiscuous mode [ 77.285148][ T5959] veth1_vlan: entered promiscuous mode [ 77.314738][ T5959] veth0_macvtap: entered promiscuous mode [ 77.319422][ T5959] veth1_macvtap: entered promiscuous mode [ 77.329161][ T5959] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 77.337592][ T5959] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 77.347644][ T5955] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.353213][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.357906][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.363411][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.425286][ T29] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.428677][ T29] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.458625][ T29] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.463346][ T29] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.499903][ T5997] ================================================================== [ 77.503493][ T5997] BUG: KASAN: slab-out-of-bounds in nft_meta_inner_init+0x1a7/0x1d0 [ 77.507053][ T5997] Write of size 1 at addr ffff88810d9f5a40 by task syz.0.17/5997 [ 77.512351][ T5997] [ 77.513685][ T5997] CPU: 1 UID: 0 PID: 5997 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 77.513704][ T5997] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 77.513712][ T5997] Call Trace: [ 77.513720][ T5997] [ 77.513727][ T5997] dump_stack_lvl+0x189/0x250 [ 77.513752][ T5997] ? __kasan_check_byte+0x12/0x40 [ 77.513808][ T5997] ? __pfx_dump_stack_lvl+0x10/0x10 [ 77.513821][ T5997] ? lock_release+0x4b/0x3e0 [ 77.513841][ T5997] ? __virt_addr_valid+0x4a5/0x5c0 [ 77.513857][ T5997] print_report+0xca/0x240 [ 77.513868][ T5997] ? nft_meta_inner_init+0x1a7/0x1d0 [ 77.513882][ T5997] kasan_report+0x118/0x150 [ 77.513895][ T5997] ? nft_expr_inner_parse+0x10a/0x6a0 [ 77.513910][ T5997] ? nft_meta_inner_init+0x1a7/0x1d0 [ 77.513923][ T5997] nft_meta_inner_init+0x1a7/0x1d0 [ 77.513937][ T5997] nft_inner_init+0x534/0x630 [ 77.513957][ T5997] ? __pfx_nft_inner_init+0x10/0x10 [ 77.513976][ T5997] ? rcu_is_watching+0x15/0xb0 [ 77.513990][ T5997] ? trace_kmalloc+0x1f/0xd0 [ 77.514006][ T5997] ? nf_tables_newrule+0x1503/0x28a0 [ 77.514021][ T5997] nf_tables_newrule+0x17b0/0x28a0 [ 77.514040][ T5997] ? __pfx_nf_tables_newrule+0x10/0x10 [ 77.514055][ T5997] ? nfnl_pernet+0x23/0x240 [ 77.514075][ T5997] ? __nla_parse+0x40/0x60 [ 77.514095][ T5997] nfnetlink_rcv+0x1132/0x2520 [ 77.514121][ T5997] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 77.514142][ T5997] ? ref_tracker_free+0x63a/0x7d0 [ 77.514165][ T5997] ? __netlink_deliver_tap+0x807/0x850 [ 77.514177][ T5997] ? netlink_deliver_tap+0x2e/0x1b0 [ 77.514193][ T5997] netlink_unicast+0x82f/0x9e0 [ 77.514214][ T5997] ? __pfx_netlink_unicast+0x10/0x10 [ 77.514230][ T5997] ? netlink_sendmsg+0x642/0xb30 [ 77.514241][ T5997] ? skb_put+0x11b/0x210 [ 77.514254][ T5997] netlink_sendmsg+0x805/0xb30 [ 77.514270][ T5997] ? __pfx_netlink_sendmsg+0x10/0x10 [ 77.514283][ T5997] ? aa_sock_msg_perm+0xf1/0x1d0 [ 77.514296][ T5997] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 77.514310][ T5997] ? __pfx_netlink_sendmsg+0x10/0x10 [ 77.514321][ T5997] __sock_sendmsg+0x21c/0x270 [ 77.514340][ T5997] ____sys_sendmsg+0x505/0x830 [ 77.514355][ T5997] ? __pfx_____sys_sendmsg+0x10/0x10 [ 77.514370][ T5997] ? import_iovec+0x74/0xa0 [ 77.514384][ T5997] ___sys_sendmsg+0x21f/0x2a0 [ 77.514397][ T5997] ? __pfx____sys_sendmsg+0x10/0x10 [ 77.514411][ T5997] ? futex_hash_put+0x4b/0x60 [ 77.514423][ T5997] ? futex_wake+0x4b2/0x560 [ 77.514449][ T5997] ? count_memcg_event_mm+0x21/0x260 [ 77.514478][ T5997] __x64_sys_sendmsg+0x19b/0x260 [ 77.514493][ T5997] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 77.514511][ T5997] ? do_syscall_64+0xbe/0x3b0 [ 77.514527][ T5997] do_syscall_64+0xfa/0x3b0 [ 77.514539][ T5997] ? lockdep_hardirqs_on+0x9c/0x150 [ 77.514550][ T5997] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.514562][ T5997] ? exc_page_fault+0x9f/0xf0 [ 77.514574][ T5997] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.514586][ T5997] RIP: 0033:0x7f2d6c18ebe9 [ 77.514602][ T5997] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 77.514613][ T5997] RSP: 002b:00007fff1c4d5e58 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 77.514628][ T5997] RAX: ffffffffffffffda RBX: 00007f2d6c3c5fa0 RCX: 00007f2d6c18ebe9 [ 77.514638][ T5997] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 77.514646][ T5997] RBP: 00007f2d6c211e19 R08: 0000000000000000 R09: 0000000000000000 [ 77.514654][ T5997] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 77.514661][ T5997] R13: 00007f2d6c3c5fa0 R14: 00007f2d6c3c5fa0 R15: 0000000000000003 [ 77.514675][ T5997] [ 77.514680][ T5997] [ 77.675375][ T5997] Allocated by task 5997: [ 77.676945][ T5997] kasan_save_track+0x3e/0x80 [ 77.679226][ T5997] __kasan_kmalloc+0x93/0xb0 [ 77.681634][ T5997] __kmalloc_noprof+0x27a/0x4f0 [ 77.684246][ T5997] nf_tables_newrule+0x1503/0x28a0 [ 77.686485][ T5997] nfnetlink_rcv+0x1132/0x2520 [ 77.688480][ T5997] netlink_unicast+0x82f/0x9e0 [ 77.690677][ T5997] netlink_sendmsg+0x805/0xb30 [ 77.692964][ T5997] __sock_sendmsg+0x21c/0x270 [ 77.695230][ T5997] ____sys_sendmsg+0x505/0x830 [ 77.697531][ T5997] ___sys_sendmsg+0x21f/0x2a0 [ 77.699983][ T5997] __x64_sys_sendmsg+0x19b/0x260 [ 77.702355][ T5997] do_syscall_64+0xfa/0x3b0 [ 77.704004][ T5997] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.706434][ T5997] [ 77.707468][ T5997] The buggy address belongs to the object at ffff88810d9f5a00 [ 77.707468][ T5997] which belongs to the cache kmalloc-cg-64 of size 64 [ 77.713332][ T5997] The buggy address is located 0 bytes to the right of [ 77.713332][ T5997] allocated 64-byte region [ffff88810d9f5a00, ffff88810d9f5a40) [ 77.720259][ T5997] [ 77.721317][ T5997] The buggy address belongs to the physical page: [ 77.723814][ T5997] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88810d9f5880 pfn:0x10d9f5 [ 77.727833][ T5997] memcg:ffff88810dfc9601 [ 77.729689][ T5997] flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff) [ 77.733159][ T5997] page_type: f5(slab) [ 77.735210][ T5997] raw: 057ff00000000000 ffff88801a449c80 ffffea0000f4b500 0000000000000002 [ 77.739011][ T5997] raw: ffff88810d9f5880 000000008020001e 00000000f5000000 ffff88810dfc9601 [ 77.742581][ T5997] page dumped because: kasan: bad access detected [ 77.745815][ T5997] page_owner tracks the page as allocated [ 77.748739][ T5997] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5917, tgid 5917 (syz-executor), ts 70404800919, free_ts 68893144552 [ 77.756891][ T5997] post_alloc_hook+0x240/0x2a0 [ 77.759278][ T5997] get_page_from_freelist+0x21e4/0x22c0 [ 77.762052][ T5997] __alloc_frozen_pages_noprof+0x181/0x370 [ 77.764740][ T5997] alloc_pages_mpol+0x232/0x4a0 [ 77.766914][ T5997] allocate_slab+0x8a/0x370 [ 77.768968][ T5997] ___slab_alloc+0xbeb/0x1410 [ 77.771318][ T5997] __kvmalloc_node_noprof+0x429/0x5f0 [ 77.774105][ T5997] alloc_netdev_mqs+0xc7c/0x11b0 [ 77.776447][ T5997] ip6_tnl_init_net+0x104/0x3b0 [ 77.778579][ T5997] ops_init+0x35c/0x5c0 [ 77.780450][ T5997] setup_net+0x10c/0x320 [ 77.782438][ T5997] copy_net_ns+0x31b/0x4d0 [ 77.784718][ T5997] create_new_namespaces+0x3f3/0x720 [ 77.787306][ T5997] unshare_nsproxy_namespaces+0x11c/0x170 [ 77.789578][ T5997] ksys_unshare+0x4c8/0x8c0 [ 77.791521][ T5997] __x64_sys_unshare+0x38/0x50 [ 77.793544][ T5997] page last free pid 976 tgid 976 stack trace: [ 77.796308][ T5997] __free_frozen_pages+0xbc4/0xd30 [ 77.798912][ T5997] kasan_depopulate_vmalloc_pte+0x74/0xa0 [ 77.801335][ T5997] __apply_to_page_range+0xb92/0x1380 [ 77.803542][ T5997] kasan_release_vmalloc+0xa2/0xd0 [ 77.805713][ T5997] purge_vmap_node+0x214/0x8f0 [ 77.807750][ T5997] __purge_vmap_area_lazy+0x7a4/0xb40 [ 77.810133][ T5997] drain_vmap_area_work+0x27/0x40 [ 77.812806][ T5997] process_scheduled_works+0xae1/0x17b0 [ 77.815659][ T5997] worker_thread+0x8a0/0xda0 [ 77.817822][ T5997] kthread+0x711/0x8a0 [ 77.819556][ T5997] ret_from_fork+0x3fc/0x770 [ 77.821517][ T5997] ret_from_fork_asm+0x1a/0x30 [ 77.823513][ T5997] [ 77.824550][ T5997] Memory state around the buggy address: [ 77.827212][ T5997] ffff88810d9f5900: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 77.831161][ T5997] ffff88810d9f5980: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 77.834419][ T5997] >ffff88810d9f5a00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 77.838351][ T5997] ^ [ 77.842205][ T5997] ffff88810d9f5a80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 77.846979][ T5997] ffff88810d9f5b00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 77.850288][ T5997] ================================================================== [ 77.861427][ T5997] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 77.865068][ T5997] CPU: 1 UID: 0 PID: 5997 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 77.869173][ T5997] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 77.873344][ T5997] Call Trace: [ 77.875081][ T5997] [ 77.876429][ T5997] dump_stack_lvl+0x99/0x250 [ 77.878834][ T5997] ? __asan_memcpy+0x40/0x70 [ 77.881240][ T5997] ? __pfx_dump_stack_lvl+0x10/0x10 [ 77.883992][ T5997] ? __pfx__printk+0x10/0x10 [ 77.886024][ T5997] vpanic+0x281/0x750 [ 77.887783][ T5997] ? preempt_schedule+0xae/0xc0 [ 77.889793][ T5997] ? __pfx_vpanic+0x10/0x10 [ 77.891699][ T5997] ? preempt_schedule_common+0x83/0xd0 [ 77.894003][ T5997] ? preempt_schedule+0xae/0xc0 [ 77.896362][ T5997] ? __pfx_preempt_schedule+0x10/0x10 [ 77.898860][ T5997] panic+0xb9/0xc0 [ 77.900583][ T5997] ? __pfx_panic+0x10/0x10 [ 77.903047][ T5997] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 77.906105][ T5997] ? nft_meta_inner_init+0x1a7/0x1d0 [ 77.908665][ T5997] check_panic_on_warn+0x89/0xb0 [ 77.910796][ T5997] ? nft_meta_inner_init+0x1a7/0x1d0 [ 77.913010][ T5997] end_report+0x78/0x160 [ 77.915079][ T5997] kasan_report+0x129/0x150 [ 77.917001][ T5997] ? nft_expr_inner_parse+0x10a/0x6a0 [ 77.919681][ T5997] ? nft_meta_inner_init+0x1a7/0x1d0 [ 77.922195][ T5997] nft_meta_inner_init+0x1a7/0x1d0 [ 77.925029][ T5997] nft_inner_init+0x534/0x630 [ 77.927704][ T5997] ? __pfx_nft_inner_init+0x10/0x10 [ 77.929922][ T5997] ? rcu_is_watching+0x15/0xb0 [ 77.931877][ T5997] ? trace_kmalloc+0x1f/0xd0 [ 77.933657][ T5997] ? nf_tables_newrule+0x1503/0x28a0 [ 77.936212][ T5997] nf_tables_newrule+0x17b0/0x28a0 [ 77.939185][ T5997] ? __pfx_nf_tables_newrule+0x10/0x10 [ 77.942167][ T5997] ? nfnl_pernet+0x23/0x240 [ 77.944231][ T5997] ? __nla_parse+0x40/0x60 [ 77.946372][ T5997] nfnetlink_rcv+0x1132/0x2520 [ 77.948347][ T5997] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 77.950602][ T5997] ? ref_tracker_free+0x63a/0x7d0 [ 77.953213][ T5997] ? __netlink_deliver_tap+0x807/0x850 [ 77.955787][ T5997] ? netlink_deliver_tap+0x2e/0x1b0 [ 77.957910][ T5997] netlink_unicast+0x82f/0x9e0 [ 77.959940][ T5997] ? __pfx_netlink_unicast+0x10/0x10 [ 77.962138][ T5997] ? netlink_sendmsg+0x642/0xb30 [ 77.964689][ T5997] ? skb_put+0x11b/0x210 [ 77.967223][ T5997] netlink_sendmsg+0x805/0xb30 [ 77.969522][ T5997] ? __pfx_netlink_sendmsg+0x10/0x10 [ 77.971682][ T5997] ? aa_sock_msg_perm+0xf1/0x1d0 [ 77.973725][ T5997] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 77.976081][ T5997] ? __pfx_netlink_sendmsg+0x10/0x10 [ 77.978334][ T5997] __sock_sendmsg+0x21c/0x270 [ 77.980362][ T5997] ____sys_sendmsg+0x505/0x830 [ 77.982731][ T5997] ? __pfx_____sys_sendmsg+0x10/0x10 [ 77.985109][ T5997] ? import_iovec+0x74/0xa0 [ 77.987675][ T5997] ___sys_sendmsg+0x21f/0x2a0 [ 77.989988][ T5997] ? __pfx____sys_sendmsg+0x10/0x10 [ 77.992212][ T5997] ? futex_hash_put+0x4b/0x60 [ 77.994126][ T5997] ? futex_wake+0x4b2/0x560 [ 77.996502][ T5997] ? count_memcg_event_mm+0x21/0x260 [ 77.998647][ T5997] __x64_sys_sendmsg+0x19b/0x260 [ 78.000720][ T5997] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 78.003109][ T5997] ? do_syscall_64+0xbe/0x3b0 [ 78.005469][ T5997] do_syscall_64+0xfa/0x3b0 [ 78.007534][ T5997] ? lockdep_hardirqs_on+0x9c/0x150 [ 78.009883][ T5997] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.012457][ T5997] ? exc_page_fault+0x9f/0xf0 [ 78.014593][ T5997] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.017247][ T5997] RIP: 0033:0x7f2d6c18ebe9 [ 78.019464][ T5997] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 78.028359][ T5997] RSP: 002b:00007fff1c4d5e58 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 78.032548][ T5997] RAX: ffffffffffffffda RBX: 00007f2d6c3c5fa0 RCX: 00007f2d6c18ebe9 [ 78.035857][ T5997] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 78.039519][ T5997] RBP: 00007f2d6c211e19 R08: 0000000000000000 R09: 0000000000000000 [ 78.043381][ T5997] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 78.047048][ T5997] R13: 00007f2d6c3c5fa0 R14: 00007f2d6c3c5fa0 R15: 0000000000000003 [ 78.051190][ T5997] [ 78.053611][ T5997] Kernel Offset: disabled [ 78.055588][ T5997] Rebooting in 86400 seconds.. VM DIAGNOSIS: 14:52:48 Registers: info registers vcpu 0 CPU#0 RAX=2fe0001016ccd800 RBX=ffffffff819683c8 RCX=2fe0001016ccd800 RDX=0000000000000001 RSI=ffffffff8d9b95cc RDI=ffffffff8be33800 RBP=ffffffff8de07eb8 RSP=ffffffff8de07d80 R8 =ffff88804b032f9b R9 =1ffff110096065f3 R10=dffffc0000000000 R11=ffffed10096065f4 R12=ffffffff8fa39330 R13=0000000000000000 R14=0000000000000000 R15=1ffffffff1bd2a20 RIP=ffffffff8b7a43f3 RFL=00000282 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880b8614000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000555566b37808 CR3=0000000109ccc000 CR4=000006f0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0000000000000000 0000000000000000 XMM01=2525252525252525 2525252525252525 XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000 XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 00007f2d6c212e53 XMM06=0000000000000000 00007f2d6c212e4d XMM07=0000000000000000 00007f2d6c212e61 XMM08=0000000000000000 00007f2d6c212ee7 XMM09=0000000000000000 00007f2d6c212fc5 XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000 XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000 XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000000064 RBX=0000000000000064 RCX=0000000000000000 RDX=00000000000003f8 RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc9000292e8f0 R8 =ffff8881080b8237 R9 =1ffff11021017046 R10=dffffc0000000000 R11=ffffffff854f3d80 R12=dffffc0000000000 R13=ffffffff99b018f9 R14=ffffffff99df6420 R15=0000000000000000 RIP=ffffffff854f3dfc RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000555566b37500 ffffffff 00c00000 GS =0000 ffff8881a3c14000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000200000000080 CR3=0000000028c62000 CR4=000006f0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0000000000000000 0000000000000000 XMM01=0000000001010a00 000000280a000000 XMM02=307a797300010009 00000002d5ff1a5e XMM03=0000002c03000000 4002000800000000 XMM04=0100110000001400 000000327a797300 XMM05=0300090000000030 7a79730001000900 XMM06=00000200000000ff e6000003010a0300 XMM07=00002c0300000040 0200080000000030 XMM08=0000000000000000 00007f2d6c212ee7 XMM09=0000000000000000 00007f2d6c212fc5 XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000 XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000 XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000