syzkaller login: [ 65.224827][ C0] sched: DL replenish lagged too much [ 81.296670][ T971] cfg80211: failed to load regulatory.db Warning: Permanently added '[localhost]:26278' (ED25519) to the list of known hosts. 2025/08/12 05:38:42 ignoring optional flag "sandboxArg"="0" 2025/08/12 05:38:43 parsed 1 programs [ 87.580958][ T5857] cgroup: Unknown subsys name 'net' [ 87.730155][ T5857] cgroup: Unknown subsys name 'cpuset' [ 87.737479][ T5857] cgroup: Unknown subsys name 'rlimit' [ 89.553908][ T5857] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 91.988436][ T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.991619][ T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.032967][ T1087] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.037830][ T1087] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.091024][ T5863] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 92.838215][ T5240] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 92.841863][ T5240] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 92.844696][ T5240] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 92.848583][ T5240] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 92.851832][ T5240] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 93.758274][ T5901] chnl_net:caif_netlink_parms(): no params data found [ 93.825446][ T5901] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.828209][ T5901] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.830513][ T5901] bridge_slave_0: entered allmulticast mode [ 93.833281][ T5901] bridge_slave_0: entered promiscuous mode [ 93.837747][ T5901] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.839964][ T5901] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.842180][ T5901] bridge_slave_1: entered allmulticast mode [ 93.845334][ T5901] bridge_slave_1: entered promiscuous mode [ 93.867574][ T5901] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 93.872043][ T5901] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 93.894661][ T5901] team0: Port device team_slave_0 added [ 93.899116][ T5901] team0: Port device team_slave_1 added [ 93.919920][ T5901] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 93.922226][ T5901] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 93.930418][ T5901] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 93.937499][ T5901] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 93.939680][ T5901] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 93.947603][ T5901] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 93.978899][ T5901] hsr_slave_0: entered promiscuous mode [ 93.982009][ T5901] hsr_slave_1: entered promiscuous mode [ 94.118704][ T5901] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 94.126125][ T5901] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 94.130752][ T5901] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 94.136682][ T5901] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 94.217858][ T5901] 8021q: adding VLAN 0 to HW filter on device bond0 [ 94.232029][ T5901] 8021q: adding VLAN 0 to HW filter on device team0 [ 94.240440][ T3563] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.243393][ T3563] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.254496][ T1087] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.257425][ T1087] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.389144][ T5901] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.419465][ T5901] veth0_vlan: entered promiscuous mode [ 94.428016][ T5901] veth1_vlan: entered promiscuous mode [ 94.450801][ T5901] veth0_macvtap: entered promiscuous mode [ 94.455950][ T5901] veth1_macvtap: entered promiscuous mode [ 94.469789][ T5901] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.480497][ T5901] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.495567][ T5745] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.498780][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.501781][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.512090][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.612727][ T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 94.655584][ T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 94.708997][ T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 94.756343][ T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2025/08/12 05:38:53 executed programs: 0 [ 96.023032][ T55] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 96.028106][ T55] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 96.031457][ T55] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 96.036492][ T55] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 96.039696][ T55] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 96.185288][ T5958] chnl_net:caif_netlink_parms(): no params data found [ 96.248707][ T5958] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.250903][ T5958] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.253066][ T5958] bridge_slave_0: entered allmulticast mode [ 96.256966][ T5958] bridge_slave_0: entered promiscuous mode [ 96.260982][ T5958] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.263592][ T5958] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.266248][ T5958] bridge_slave_1: entered allmulticast mode [ 96.269034][ T5958] bridge_slave_1: entered promiscuous mode [ 96.294566][ T5958] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 96.299735][ T5958] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 96.320390][ T5958] team0: Port device team_slave_0 added [ 96.323735][ T5958] team0: Port device team_slave_1 added [ 96.343626][ T5958] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 96.345859][ T5958] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 96.353376][ T5958] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 96.359317][ T5958] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 96.361417][ T5958] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 96.369585][ T5958] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 96.398510][ T5958] hsr_slave_0: entered promiscuous mode [ 96.401223][ T5958] hsr_slave_1: entered promiscuous mode [ 96.403872][ T5958] debugfs: 'hsr0' already exists in 'hsr' [ 96.406299][ T5958] Cannot create hsr debugfs directory [ 97.567826][ T13] bridge_slave_1: left allmulticast mode [ 97.570380][ T13] bridge_slave_1: left promiscuous mode [ 97.573357][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.581905][ T13] bridge_slave_0: left allmulticast mode [ 97.584012][ T13] bridge_slave_0: left promiscuous mode [ 97.589179][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.809821][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 97.814677][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 97.819889][ T13] bond0 (unregistering): Released all slaves [ 97.934327][ T13] hsr_slave_0: left promiscuous mode [ 97.941840][ T13] hsr_slave_1: left promiscuous mode [ 97.943969][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 97.946886][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 97.953169][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 97.958590][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 97.969367][ T13] veth1_macvtap: left promiscuous mode [ 97.971651][ T13] veth0_macvtap: left promiscuous mode [ 97.974298][ T13] veth1_vlan: left promiscuous mode [ 97.976738][ T13] veth0_vlan: left promiscuous mode [ 98.098852][ T5240] Bluetooth: hci0: command tx timeout [ 98.228300][ T13] team0 (unregistering): Port device team_slave_1 removed [ 98.250477][ T13] team0 (unregistering): Port device team_slave_0 removed [ 98.762892][ T5958] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 98.769229][ T5958] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 98.773880][ T5958] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 98.778707][ T5958] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 98.852844][ T5958] 8021q: adding VLAN 0 to HW filter on device bond0 [ 98.866674][ T5958] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.872246][ T53] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.874759][ T53] bridge0: port 1(bridge_slave_0) entered forwarding state [ 99.120923][ T27] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.123161][ T27] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.313129][ T5958] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 99.393770][ T5958] veth0_vlan: entered promiscuous mode [ 99.401809][ T5958] veth1_vlan: entered promiscuous mode [ 99.441040][ T5958] veth0_macvtap: entered promiscuous mode [ 99.446143][ T5958] veth1_macvtap: entered promiscuous mode [ 99.456543][ T5958] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 99.464900][ T5958] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 99.472715][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.479760][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.483261][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.487268][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.532305][ T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.534649][ T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.554590][ T1087] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.557559][ T1087] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.581163][ T6010] netlink: 24 bytes leftover after parsing attributes in process `syz.0.17'. [ 99.587432][ T6010] ================================================================== [ 99.590683][ T6010] BUG: KASAN: slab-out-of-bounds in bond_fill_info+0xc72/0x2280 [ 99.593660][ T6010] Read of size 2 at addr ffff88810d4e36c6 by task syz.0.17/6010 [ 99.597779][ T6010] [ 99.598831][ T6010] CPU: 1 UID: 0 PID: 6010 Comm: syz.0.17 Not tainted 6.16.0-syzkaller-12063-g37816488247d-dirty #0 PREEMPT(full) [ 99.598849][ T6010] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 99.598859][ T6010] Call Trace: [ 99.598867][ T6010] [ 99.598889][ T6010] dump_stack_lvl+0x189/0x250 [ 99.598913][ T6010] ? __kasan_check_byte+0x12/0x40 [ 99.598964][ T6010] ? __pfx_dump_stack_lvl+0x10/0x10 [ 99.598980][ T6010] ? lock_release+0x4b/0x3e0 [ 99.599005][ T6010] ? __virt_addr_valid+0x4a5/0x5c0 [ 99.599025][ T6010] print_report+0xca/0x240 [ 99.599041][ T6010] ? bond_fill_info+0xc72/0x2280 [ 99.599060][ T6010] kasan_report+0x118/0x150 [ 99.599081][ T6010] ? bond_fill_info+0xc72/0x2280 [ 99.599103][ T6010] bond_fill_info+0xc72/0x2280 [ 99.599127][ T6010] ? __pfx_bond_fill_info+0x10/0x10 [ 99.599153][ T6010] ? __lock_acquire+0xab9/0xd20 [ 99.599176][ T6010] ? dev_get_alias+0x26/0x250 [ 99.599197][ T6010] ? __lock_acquire+0xab9/0xd20 [ 99.599219][ T6010] ? nla_put+0xd0/0x150 [ 99.599243][ T6010] ? nla_put+0xd0/0x150 [ 99.599262][ T6010] ? nla_put+0xd0/0x150 [ 99.599282][ T6010] ? nla_put+0xd0/0x150 [ 99.599300][ T6010] rtnl_link_fill+0x288/0x800 [ 99.599320][ T6010] ? rtnl_fill_stats+0x74/0x8c0 [ 99.599337][ T6010] rtnl_fill_ifinfo+0x17ca/0x1e70 [ 99.599354][ T6010] ? __pfx_rtnl_fill_ifinfo+0x10/0x10 [ 99.599378][ T6010] ? rcu_is_watching+0x15/0xb0 [ 99.599395][ T6010] ? trace_kmalloc+0x1f/0xd0 [ 99.599413][ T6010] ? __kmalloc_node_track_caller_noprof+0x286/0x4e0 [ 99.599436][ T6010] rtmsg_ifinfo_build_skb+0x17d/0x260 [ 99.599455][ T6010] rtmsg_ifinfo+0x8c/0x1a0 [ 99.599473][ T6010] netif_state_change+0x29e/0x3a0 [ 99.599490][ T6010] ? __pfx_netif_state_change+0x10/0x10 [ 99.599508][ T6010] ? netif_change_flags+0xe8/0x1a0 [ 99.599530][ T6010] do_setlink+0x35de/0x41c0 [ 99.599550][ T6010] ? trace_kmalloc+0x1f/0xd0 [ 99.599568][ T6010] ? bond_option_arp_ip_targets_set+0x3ae/0xbc0 [ 99.599584][ T6010] ? __pfx_do_setlink+0x10/0x10 [ 99.599602][ T6010] ? bond_opt_parse+0x2f1/0x870 [ 99.599622][ T6010] ? __pfx____ratelimit+0x10/0x10 [ 99.599639][ T6010] ? __pfx_bond_option_arp_ip_targets_set+0x10/0x10 [ 99.599655][ T6010] ? bond_option_arp_ip_targets_clear+0x177/0x1e0 [ 99.599668][ T6010] ? __pfx_bond_opt_parse+0x10/0x10 [ 99.599691][ T6010] ? __pfx_bond_option_arp_ip_targets_clear+0x10/0x10 [ 99.599715][ T6010] ? __bond_opt_set+0x446/0xee0 [ 99.599736][ T6010] ? bond_changelink+0x233b/0x26d0 [ 99.599759][ T6010] ? __pfx_bond_changelink+0x10/0x10 [ 99.599778][ T6010] ? rtnl_newlink+0x8db/0x1c70 [ 99.599799][ T6010] ? ns_capable+0x8a/0xf0 [ 99.599814][ T6010] ? rtnl_link_get_net_capable+0x16a/0x350 [ 99.599834][ T6010] rtnl_newlink+0x160b/0x1c70 [ 99.599849][ T6010] ? netlink_sendmsg+0x805/0xb30 [ 99.599870][ T6010] ? __pfx_rtnl_newlink+0x10/0x10 [ 99.599891][ T6010] ? kasan_quarantine_put+0xdd/0x220 [ 99.599904][ T6010] ? lockdep_hardirqs_on+0x9c/0x150 [ 99.599949][ T6010] ? nlmon_xmit+0xb0/0x100 [ 99.599967][ T6010] ? kmem_cache_free+0x18f/0x400 [ 99.599986][ T6010] ? __local_bh_enable_ip+0x12d/0x1c0 [ 99.600000][ T6010] ? lockdep_hardirqs_on+0x9c/0x150 [ 99.600014][ T6010] ? __local_bh_enable_ip+0x12d/0x1c0 [ 99.600027][ T6010] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 99.600041][ T6010] ? __dev_queue_xmit+0x27b/0x3b50 [ 99.600053][ T6010] ? __dev_queue_xmit+0x27b/0x3b50 [ 99.600065][ T6010] ? __dev_queue_xmit+0x27b/0x3b50 [ 99.600078][ T6010] ? __dev_queue_xmit+0x1d79/0x3b50 [ 99.600092][ T6010] ? __lock_acquire+0xab9/0xd20 [ 99.600119][ T6010] ? __pfx_rtnl_newlink+0x10/0x10 [ 99.600135][ T6010] rtnetlink_rcv_msg+0x7cf/0xb70 [ 99.600160][ T6010] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 99.600176][ T6010] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 99.600191][ T6010] ? ref_tracker_free+0x63a/0x7d0 [ 99.600207][ T6010] ? __asan_memcpy+0x40/0x70 [ 99.600221][ T6010] ? __pfx_ref_tracker_free+0x10/0x10 [ 99.600236][ T6010] ? __skb_clone+0x63/0x7a0 [ 99.600259][ T6010] netlink_rcv_skb+0x208/0x470 [ 99.600275][ T6010] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 99.600292][ T6010] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 99.600311][ T6010] ? netlink_deliver_tap+0x2e/0x1b0 [ 99.600329][ T6010] netlink_unicast+0x82f/0x9e0 [ 99.600346][ T6010] ? __pfx_netlink_unicast+0x10/0x10 [ 99.600361][ T6010] ? netlink_sendmsg+0x642/0xb30 [ 99.600376][ T6010] ? skb_put+0x11b/0x210 [ 99.600393][ T6010] netlink_sendmsg+0x805/0xb30 [ 99.600413][ T6010] ? __pfx_netlink_sendmsg+0x10/0x10 [ 99.600430][ T6010] ? aa_sock_msg_perm+0xf1/0x1d0 [ 99.600451][ T6010] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 99.600467][ T6010] ? __pfx_netlink_sendmsg+0x10/0x10 [ 99.600483][ T6010] __sock_sendmsg+0x21c/0x270 [ 99.600500][ T6010] ____sys_sendmsg+0x505/0x830 [ 99.600520][ T6010] ? __pfx_____sys_sendmsg+0x10/0x10 [ 99.600542][ T6010] ? import_iovec+0x74/0xa0 [ 99.600555][ T6010] ___sys_sendmsg+0x21f/0x2a0 [ 99.600574][ T6010] ? __pfx____sys_sendmsg+0x10/0x10 [ 99.600594][ T6010] ? futex_hash_put+0x4b/0x60 [ 99.600609][ T6010] ? futex_wake+0x4b2/0x560 [ 99.600631][ T6010] ? _copy_to_user+0x8a/0xb0 [ 99.600653][ T6010] __x64_sys_sendmsg+0x19b/0x260 [ 99.600672][ T6010] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 99.600696][ T6010] ? do_syscall_64+0xbe/0x3b0 [ 99.600713][ T6010] do_syscall_64+0xfa/0x3b0 [ 99.600729][ T6010] ? lockdep_hardirqs_on+0x9c/0x150 [ 99.600744][ T6010] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.600757][ T6010] ? exc_page_fault+0x9f/0xf0 [ 99.600771][ T6010] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.600785][ T6010] RIP: 0033:0x7f536498ebe9 [ 99.600799][ T6010] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 99.600828][ T6010] RSP: 002b:00007ffe69efd978 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 99.600843][ T6010] RAX: ffffffffffffffda RBX: 00007f5364bb5fa0 RCX: 00007f536498ebe9 [ 99.600852][ T6010] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000004 [ 99.600861][ T6010] RBP: 00007f5364a11e19 R08: 0000000000000000 R09: 0000000000000000 [ 99.600870][ T6010] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 99.600878][ T6010] R13: 00007f5364bb5fa0 R14: 00007f5364bb5fa0 R15: 0000000000000003 [ 99.600893][ T6010] [ 99.600899][ T6010] [ 99.828530][ T6010] Allocated by task 6010: [ 99.830256][ T6010] kasan_save_track+0x3e/0x80 [ 99.831987][ T6010] __kasan_kmalloc+0x93/0xb0 [ 99.833419][ T6010] __kmalloc_noprof+0x27a/0x4f0 [ 99.835300][ T6010] bond_option_arp_ip_targets_set+0x227/0xbc0 [ 99.837629][ T6010] __bond_opt_set+0x27b/0xee0 [ 99.839531][ T6010] bond_changelink+0xa66/0x26d0 [ 99.841493][ T6010] rtnl_newlink+0x1669/0x1c70 [ 99.843370][ T6010] rtnetlink_rcv_msg+0x7cf/0xb70 [ 99.845343][ T6010] netlink_rcv_skb+0x208/0x470 [ 99.847088][ T6010] netlink_unicast+0x82f/0x9e0 [ 99.849004][ T6010] netlink_sendmsg+0x805/0xb30 [ 99.850897][ T6010] __sock_sendmsg+0x21c/0x270 [ 99.852811][ T6010] ____sys_sendmsg+0x505/0x830 [ 99.854735][ T6010] ___sys_sendmsg+0x21f/0x2a0 [ 99.856625][ T6010] __x64_sys_sendmsg+0x19b/0x260 [ 99.858593][ T6010] do_syscall_64+0xfa/0x3b0 [ 99.860427][ T6010] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.862720][ T6010] [ 99.863610][ T6010] The buggy address belongs to the object at ffff88810d4e36c0 [ 99.863610][ T6010] which belongs to the cache kmalloc-8 of size 8 [ 99.868233][ T6010] The buggy address is located 6 bytes inside of [ 99.868233][ T6010] allocated 7-byte region [ffff88810d4e36c0, ffff88810d4e36c7) [ 99.873375][ T6010] [ 99.874222][ T6010] The buggy address belongs to the physical page: [ 99.876202][ T6010] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88810d4e31c0 pfn:0x10d4e3 [ 99.879677][ T6010] flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff) [ 99.882564][ T6010] page_type: f5(slab) [ 99.884194][ T6010] raw: 057ff00000000000 ffff88801a441500 dead000000000122 0000000000000000 [ 99.887514][ T6010] raw: ffff88810d4e31c0 000000008080006d 00000000f5000000 0000000000000000 [ 99.890610][ T6010] page dumped because: kasan: bad access detected [ 99.893141][ T6010] page_owner tracks the page as allocated [ 99.895414][ T6010] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5954, tgid 5954 (syz-executor), ts 95720202696, free_ts 95706797594 [ 99.901277][ T6010] post_alloc_hook+0x240/0x2a0 [ 99.903008][ T6010] get_page_from_freelist+0x21e4/0x22c0 [ 99.905053][ T6010] __alloc_frozen_pages_noprof+0x181/0x370 [ 99.906868][ T6010] alloc_pages_mpol+0x232/0x4a0 [ 99.908557][ T6010] allocate_slab+0x8a/0x370 [ 99.910265][ T6010] ___slab_alloc+0xbeb/0x1410 [ 99.911864][ T6010] __kmalloc_node_track_caller_noprof+0x2f8/0x4e0 [ 99.913873][ T6010] kstrdup+0x42/0x100 [ 99.915333][ T6010] __kernfs_new_node+0x9c/0x7e0 [ 99.917294][ T6010] kernfs_new_node+0x102/0x210 [ 99.919202][ T6010] kernfs_create_dir_ns+0x44/0x130 [ 99.921214][ T6010] sysfs_create_dir_ns+0x123/0x280 [ 99.922788][ T6010] kobject_add_internal+0x59f/0xb40 [ 99.924444][ T6010] kobject_add+0x155/0x220 [ 99.925995][ T6010] device_add+0x408/0xb50 [ 99.927690][ T6010] netdev_register_kobject+0x178/0x310 [ 99.929659][ T6010] page last free pid 5954 tgid 5954 stack trace: [ 99.932101][ T6010] __free_frozen_pages+0xbc4/0xd30 [ 99.933819][ T6010] __slab_free+0x303/0x3c0 [ 99.935208][ T6010] qlist_free_all+0x97/0x140 [ 99.936594][ T6010] kasan_quarantine_reduce+0x148/0x160 [ 99.938616][ T6010] __kasan_slab_alloc+0x22/0x80 [ 99.940546][ T6010] __kmalloc_noprof+0x224/0x4f0 [ 99.942495][ T6010] ops_init+0x7b/0x5c0 [ 99.944135][ T6010] setup_net+0x10c/0x320 [ 99.945844][ T6010] copy_net_ns+0x31b/0x4d0 [ 99.947666][ T6010] create_new_namespaces+0x3f3/0x720 [ 99.949774][ T6010] unshare_nsproxy_namespaces+0x11c/0x170 [ 99.952035][ T6010] ksys_unshare+0x4c8/0x8c0 [ 99.953847][ T6010] __x64_sys_unshare+0x38/0x50 [ 99.955775][ T6010] do_syscall_64+0xfa/0x3b0 [ 99.957632][ T6010] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.959971][ T6010] [ 99.960949][ T6010] Memory state around the buggy address: [ 99.963195][ T6010] ffff88810d4e3580: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc [ 99.966398][ T6010] ffff88810d4e3600: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc [ 99.969563][ T6010] >ffff88810d4e3680: fa fc fc fc fa fc fc fc 07 fc fc fc fa fc fc fc [ 99.972709][ T6010] ^ [ 99.975149][ T6010] ffff88810d4e3700: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc [ 99.978186][ T6010] ffff88810d4e3780: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc [ 99.981233][ T6010] ================================================================== [ 99.992361][ T6010] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 99.994939][ T6010] CPU: 1 UID: 0 PID: 6010 Comm: syz.0.17 Not tainted 6.16.0-syzkaller-12063-g37816488247d-dirty #0 PREEMPT(full) [ 99.998555][ T6010] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 100.001660][ T6010] Call Trace: [ 100.002725][ T6010] [ 100.003651][ T6010] dump_stack_lvl+0x99/0x250 [ 100.005098][ T6010] ? __asan_memcpy+0x40/0x70 [ 100.006538][ T6010] ? __pfx_dump_stack_lvl+0x10/0x10 [ 100.008163][ T6010] ? __pfx__printk+0x10/0x10 [ 100.009603][ T6010] vpanic+0x281/0x750 [ 100.010859][ T6010] ? preempt_schedule+0xae/0xc0 [ 100.012377][ T6010] ? __pfx_vpanic+0x10/0x10 [ 100.013783][ T6010] ? preempt_schedule_common+0x83/0xd0 [ 100.015467][ T6010] ? preempt_schedule+0xae/0xc0 [ 100.016967][ T6010] ? __pfx_preempt_schedule+0x10/0x10 [ 100.018571][ T6010] panic+0xb9/0xc0 [ 100.019729][ T6010] ? __pfx_panic+0x10/0x10 [ 100.021109][ T6010] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 100.022913][ T6010] ? bond_fill_info+0xc72/0x2280 [ 100.024412][ T6010] check_panic_on_warn+0x89/0xb0 [ 100.025947][ T6010] ? bond_fill_info+0xc72/0x2280 [ 100.027461][ T6010] end_report+0x78/0x160 [ 100.028751][ T6010] kasan_report+0x129/0x150 [ 100.030161][ T6010] ? bond_fill_info+0xc72/0x2280 [ 100.031673][ T6010] bond_fill_info+0xc72/0x2280 [ 100.033151][ T6010] ? __pfx_bond_fill_info+0x10/0x10 [ 100.034694][ T6010] ? __lock_acquire+0xab9/0xd20 [ 100.036153][ T6010] ? dev_get_alias+0x26/0x250 [ 100.037549][ T6010] ? __lock_acquire+0xab9/0xd20 [ 100.039004][ T6010] ? nla_put+0xd0/0x150 [ 100.040254][ T6010] ? nla_put+0xd0/0x150 [ 100.041537][ T6010] ? nla_put+0xd0/0x150 [ 100.042813][ T6010] ? nla_put+0xd0/0x150 [ 100.044051][ T6010] rtnl_link_fill+0x288/0x800 [ 100.045472][ T6010] ? rtnl_fill_stats+0x74/0x8c0 [ 100.046984][ T6010] rtnl_fill_ifinfo+0x17ca/0x1e70 [ 100.048494][ T6010] ? __pfx_rtnl_fill_ifinfo+0x10/0x10 [ 100.050085][ T6010] ? rcu_is_watching+0x15/0xb0 [ 100.051562][ T6010] ? trace_kmalloc+0x1f/0xd0 [ 100.053060][ T6010] ? __kmalloc_node_track_caller_noprof+0x286/0x4e0 [ 100.055304][ T6010] rtmsg_ifinfo_build_skb+0x17d/0x260 [ 100.057049][ T6010] rtmsg_ifinfo+0x8c/0x1a0 [ 100.058502][ T6010] netif_state_change+0x29e/0x3a0 [ 100.060089][ T6010] ? __pfx_netif_state_change+0x10/0x10 [ 100.061937][ T6010] ? netif_change_flags+0xe8/0x1a0 [ 100.063631][ T6010] do_setlink+0x35de/0x41c0 [ 100.065082][ T6010] ? trace_kmalloc+0x1f/0xd0 [ 100.066505][ T6010] ? bond_option_arp_ip_targets_set+0x3ae/0xbc0 [ 100.068505][ T6010] ? __pfx_do_setlink+0x10/0x10 [ 100.070086][ T6010] ? bond_opt_parse+0x2f1/0x870 [ 100.071677][ T6010] ? __pfx____ratelimit+0x10/0x10 [ 100.073320][ T6010] ? __pfx_bond_option_arp_ip_targets_set+0x10/0x10 [ 100.075446][ T6010] ? bond_option_arp_ip_targets_clear+0x177/0x1e0 [ 100.077568][ T6010] ? __pfx_bond_opt_parse+0x10/0x10 [ 100.079342][ T6010] ? __pfx_bond_option_arp_ip_targets_clear+0x10/0x10 [ 100.081416][ T6010] ? __bond_opt_set+0x446/0xee0 [ 100.082859][ T6010] ? bond_changelink+0x233b/0x26d0 [ 100.084490][ T6010] ? __pfx_bond_changelink+0x10/0x10 [ 100.086209][ T6010] ? rtnl_newlink+0x8db/0x1c70 [ 100.087771][ T6010] ? ns_capable+0x8a/0xf0 [ 100.089146][ T6010] ? rtnl_link_get_net_capable+0x16a/0x350 [ 100.090954][ T6010] rtnl_newlink+0x160b/0x1c70 [ 100.092428][ T6010] ? netlink_sendmsg+0x805/0xb30 [ 100.093983][ T6010] ? __pfx_rtnl_newlink+0x10/0x10 [ 100.095554][ T6010] ? kasan_quarantine_put+0xdd/0x220 [ 100.097547][ T6010] ? lockdep_hardirqs_on+0x9c/0x150 [ 100.099562][ T6010] ? nlmon_xmit+0xb0/0x100 [ 100.100986][ T6010] ? kmem_cache_free+0x18f/0x400 [ 100.102472][ T6010] ? __local_bh_enable_ip+0x12d/0x1c0 [ 100.104131][ T6010] ? lockdep_hardirqs_on+0x9c/0x150 [ 100.105687][ T6010] ? __local_bh_enable_ip+0x12d/0x1c0 [ 100.107453][ T6010] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 100.109320][ T6010] ? __dev_queue_xmit+0x27b/0x3b50 [ 100.111210][ T6010] ? __dev_queue_xmit+0x27b/0x3b50 [ 100.112947][ T6010] ? __dev_queue_xmit+0x27b/0x3b50 [ 100.114638][ T6010] ? __dev_queue_xmit+0x1d79/0x3b50 [ 100.116300][ T6010] ? __lock_acquire+0xab9/0xd20 [ 100.117827][ T6010] ? __pfx_rtnl_newlink+0x10/0x10 [ 100.119450][ T6010] rtnetlink_rcv_msg+0x7cf/0xb70 [ 100.121050][ T6010] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 100.122969][ T6010] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 100.125009][ T6010] ? ref_tracker_free+0x63a/0x7d0 [ 100.127020][ T6010] ? __asan_memcpy+0x40/0x70 [ 100.128619][ T6010] ? __pfx_ref_tracker_free+0x10/0x10 [ 100.130268][ T6010] ? __skb_clone+0x63/0x7a0 [ 100.131669][ T6010] netlink_rcv_skb+0x208/0x470 [ 100.133169][ T6010] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 100.134810][ T6010] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 100.136380][ T6010] ? netlink_deliver_tap+0x2e/0x1b0 [ 100.137965][ T6010] netlink_unicast+0x82f/0x9e0 [ 100.139507][ T6010] ? __pfx_netlink_unicast+0x10/0x10 [ 100.141148][ T6010] ? netlink_sendmsg+0x642/0xb30 [ 100.142617][ T6010] ? skb_put+0x11b/0x210 [ 100.144204][ T6010] netlink_sendmsg+0x805/0xb30 [ 100.146053][ T6010] ? __pfx_netlink_sendmsg+0x10/0x10 [ 100.147685][ T6010] ? aa_sock_msg_perm+0xf1/0x1d0 [ 100.149314][ T6010] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 100.150941][ T6010] ? __pfx_netlink_sendmsg+0x10/0x10 [ 100.152569][ T6010] __sock_sendmsg+0x21c/0x270 [ 100.154035][ T6010] ____sys_sendmsg+0x505/0x830 [ 100.155512][ T6010] ? __pfx_____sys_sendmsg+0x10/0x10 [ 100.157185][ T6010] ? import_iovec+0x74/0xa0 [ 100.158598][ T6010] ___sys_sendmsg+0x21f/0x2a0 [ 100.160289][ T6010] ? __pfx____sys_sendmsg+0x10/0x10 [ 100.162331][ T6010] ? futex_hash_put+0x4b/0x60 [ 100.163972][ T6010] ? futex_wake+0x4b2/0x560 [ 100.165661][ T6010] ? _copy_to_user+0x8a/0xb0 [ 100.167130][ T6010] __x64_sys_sendmsg+0x19b/0x260 [ 100.168914][ T6010] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 100.171107][ T6010] ? do_syscall_64+0xbe/0x3b0 [ 100.173013][ T6010] do_syscall_64+0xfa/0x3b0 [ 100.174560][ T6010] ? lockdep_hardirqs_on+0x9c/0x150 [ 100.176286][ T6010] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.178530][ T6010] ? exc_page_fault+0x9f/0xf0 [ 100.180325][ T6010] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.182588][ T6010] RIP: 0033:0x7f536498ebe9 [ 100.184346][ T6010] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 100.191127][ T6010] RSP: 002b:00007ffe69efd978 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 100.193779][ T6010] RAX: ffffffffffffffda RBX: 00007f5364bb5fa0 RCX: 00007f536498ebe9 [ 100.196973][ T6010] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000004 [ 100.200052][ T6010] RBP: 00007f5364a11e19 R08: 0000000000000000 R09: 0000000000000000 [ 100.203336][ T6010] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 100.206492][ T6010] R13: 00007f5364bb5fa0 R14: 00007f5364bb5fa0 R15: 0000000000000003 [ 100.209614][ T6010] [ 100.211268][ T6010] Kernel Offset: disabled [ 100.212547][ T6010] Rebooting in 86400 seconds.. VM DIAGNOSIS: 05:38:57 Registers: info registers vcpu 0 CPU#0 RAX=70aa2e41147df500 RBX=ffffffff81968308 RCX=70aa2e41147df500 RDX=0000000000000001 RSI=ffffffff8d9b614d RDI=ffffffff8be32680 RBP=ffffffff8de07eb8 RSP=ffffffff8de07d80 R8 =ffff88804b032f9b R9 =1ffff110096065f3 R10=dffffc0000000000 R11=ffffed10096065f4 R12=ffffffff8fa34930 R13=0000000000000000 R14=0000000000000000 R15=1ffffffff1bd2a20 RIP=ffffffff8b78c3f3 RFL=00000282 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8880b8621000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000555592d60808 CR3=0000000029116000 CR4=000006f0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0000000000000000 0000000000000000 XMM01=2525252525252525 2525252525252525 XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000 XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 00007f5364a12e53 XMM06=0000000000000000 00007f5364a12e4d XMM07=0000000000000000 00007f5364a12e61 XMM08=0000000000000000 00007f5364a12ee7 XMM09=0000000000000000 00007f5364a12fc5 XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000 XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000 XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000000079 RBX=0000000000000079 RCX=0000000000000000 RDX=00000000000003f8 RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc900029bdc90 R8 =ffff888021580237 R9 =1ffff110042b0046 R10=dffffc0000000000 R11=ffffffff854e71d0 R12=dffffc0000000000 R13=ffffffff99af4901 R14=ffffffff99de94e0 R15=0000000000000000 RIP=ffffffff854e724c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000555592d60500 ffffffff 00c00000 GS =0000 ffff8881a3c21000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000000000000000 CR3=0000000027f52000 CR4=000006f0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0000000000000000 0000000000000000 XMM01=00ff000000000000 0000000000000000 XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 000000000000ff00 XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000 XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000 XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000 XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000 XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000 XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000