Warning: Permanently added '10.128.1.33' (ED25519) to the list of known hosts. 2024/11/22 09:41:30 ignoring optional flag "sandboxArg"="0" 2024/11/22 09:41:30 parsed 1 programs [ 129.907433][ T28] audit: type=1400 audit(1732268490.469:66): avc: denied { node_bind } for pid=396 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 130.873653][ T28] audit: type=1400 audit(1732268491.439:67): avc: denied { mounton } for pid=402 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1926 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 130.875017][ T402] cgroup: Unknown subsys name 'net' [ 130.896221][ T28] audit: type=1400 audit(1732268491.439:68): avc: denied { mount } for pid=402 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 130.923208][ T28] audit: type=1400 audit(1732268491.469:69): avc: denied { unmount } for pid=402 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 130.923401][ T402] cgroup: Unknown subsys name 'devices' [ 131.033163][ T402] cgroup: Unknown subsys name 'hugetlb' [ 131.039050][ T402] cgroup: Unknown subsys name 'rlimit' [ 131.142861][ T28] audit: type=1400 audit(1732268491.709:70): avc: denied { setattr } for pid=402 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 131.165829][ T28] audit: type=1400 audit(1732268491.709:71): avc: denied { create } for pid=402 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 131.185974][ T28] audit: type=1400 audit(1732268491.709:72): avc: denied { write } for pid=402 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 131.206183][ T28] audit: type=1400 audit(1732268491.709:73): avc: denied { read } for pid=402 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 131.226152][ T28] audit: type=1400 audit(1732268491.709:74): avc: denied { module_request } for pid=402 comm="syz-executor" kmod="netdev-wpan0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 131.236988][ T408] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 131.247996][ T28] audit: type=1400 audit(1732268491.709:75): avc: denied { mounton } for pid=402 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 131.317150][ T402] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 132.146274][ T438] syz-executor (438) used greatest stack depth: 21736 bytes left [ 132.218495][ T434] bridge0: port 1(bridge_slave_0) entered blocking state [ 132.228436][ T434] bridge0: port 1(bridge_slave_0) entered disabled state [ 132.239067][ T434] device bridge_slave_0 entered promiscuous mode [ 132.268477][ T434] bridge0: port 2(bridge_slave_1) entered blocking state [ 132.275646][ T434] bridge0: port 2(bridge_slave_1) entered disabled state [ 132.285467][ T434] device bridge_slave_1 entered promiscuous mode [ 132.381108][ T434] bridge0: port 2(bridge_slave_1) entered blocking state [ 132.387951][ T434] bridge0: port 2(bridge_slave_1) entered forwarding state [ 132.395095][ T434] bridge0: port 1(bridge_slave_0) entered blocking state [ 132.401875][ T434] bridge0: port 1(bridge_slave_0) entered forwarding state [ 132.423290][ T449] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 132.431180][ T449] bridge0: port 1(bridge_slave_0) entered disabled state [ 132.438179][ T449] bridge0: port 2(bridge_slave_1) entered disabled state [ 132.447859][ T449] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 132.455982][ T449] bridge0: port 1(bridge_slave_0) entered blocking state [ 132.462956][ T449] bridge0: port 1(bridge_slave_0) entered forwarding state [ 132.471715][ T449] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 132.479731][ T449] bridge0: port 2(bridge_slave_1) entered blocking state [ 132.486581][ T449] bridge0: port 2(bridge_slave_1) entered forwarding state [ 132.499086][ T449] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 132.514350][ T449] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 132.524578][ T449] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 132.536371][ T449] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 132.544187][ T449] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 132.551500][ T449] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 132.559522][ T434] device veth0_vlan entered promiscuous mode [ 132.569694][ T449] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready 2024/11/22 09:41:33 executed programs: 0 [ 132.579352][ T434] device veth1_macvtap entered promiscuous mode [ 132.589502][ T449] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 132.599565][ T449] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 132.683987][ T434] syz-executor (434) used greatest stack depth: 20488 bytes left [ 132.841007][ T474] bridge0: port 1(bridge_slave_0) entered blocking state [ 132.847865][ T474] bridge0: port 1(bridge_slave_0) entered disabled state [ 132.855217][ T474] device bridge_slave_0 entered promiscuous mode [ 132.862069][ T474] bridge0: port 2(bridge_slave_1) entered blocking state [ 132.868907][ T474] bridge0: port 2(bridge_slave_1) entered disabled state [ 132.876457][ T474] device bridge_slave_1 entered promiscuous mode [ 132.961535][ T475] bridge0: port 1(bridge_slave_0) entered blocking state [ 132.968390][ T475] bridge0: port 1(bridge_slave_0) entered disabled state [ 132.975845][ T475] device bridge_slave_0 entered promiscuous mode [ 132.992051][ T470] bridge0: port 1(bridge_slave_0) entered blocking state [ 132.998895][ T470] bridge0: port 1(bridge_slave_0) entered disabled state [ 133.006229][ T470] device bridge_slave_0 entered promiscuous mode [ 133.014087][ T475] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.021036][ T475] bridge0: port 2(bridge_slave_1) entered disabled state [ 133.028210][ T475] device bridge_slave_1 entered promiscuous mode [ 133.048132][ T470] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.055065][ T470] bridge0: port 2(bridge_slave_1) entered disabled state [ 133.062344][ T470] device bridge_slave_1 entered promiscuous mode [ 133.152769][ T472] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.159624][ T472] bridge0: port 1(bridge_slave_0) entered disabled state [ 133.166933][ T472] device bridge_slave_0 entered promiscuous mode [ 133.173649][ T472] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.180614][ T472] bridge0: port 2(bridge_slave_1) entered disabled state [ 133.187802][ T472] device bridge_slave_1 entered promiscuous mode [ 133.268179][ T477] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.275135][ T477] bridge0: port 1(bridge_slave_0) entered disabled state [ 133.282367][ T477] device bridge_slave_0 entered promiscuous mode [ 133.293322][ T477] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.300165][ T477] bridge0: port 2(bridge_slave_1) entered disabled state [ 133.307573][ T477] device bridge_slave_1 entered promiscuous mode [ 133.459285][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 133.466686][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 133.490666][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 133.499122][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 133.507461][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.514435][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 133.530985][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 133.538513][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 133.546685][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 133.554735][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.561594][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 133.568719][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 133.576533][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 133.588172][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 133.595497][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 133.621666][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 133.629857][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 133.638945][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 133.646574][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 133.663020][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 133.671617][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 133.679573][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.686427][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 133.710999][ T475] device veth0_vlan entered promiscuous mode [ 133.722067][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 133.729577][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 133.737186][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 133.744733][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 133.752986][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 133.761007][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.767829][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 133.792878][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 133.800103][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 133.807571][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 133.815630][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.822472][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 133.831012][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 133.838971][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.845826][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 133.853112][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 133.861100][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 133.868794][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 133.876725][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 133.884524][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 133.899231][ T475] device veth1_macvtap entered promiscuous mode [ 133.914214][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 133.921792][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 133.929823][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 133.938011][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 133.947340][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.954193][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 133.961859][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 133.969941][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 133.978025][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.984868][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 133.992188][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 134.000004][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 134.021563][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 134.029848][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 134.038159][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 134.047406][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 134.087684][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 134.102771][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 134.111214][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 134.119254][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 134.126118][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 134.133702][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 134.141753][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 134.149798][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 134.156673][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 134.164025][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 134.185378][ T474] device veth0_vlan entered promiscuous mode [ 134.200164][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 134.208863][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 134.216261][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 134.224186][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 134.233979][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 134.243526][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 134.251581][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 134.259458][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 134.288076][ T472] device veth0_vlan entered promiscuous mode [ 134.307016][ T470] device veth0_vlan entered promiscuous mode [ 134.315255][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 134.323090][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 134.331168][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 134.339491][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 134.354892][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 134.362846][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 134.376174][ T474] device veth1_macvtap entered promiscuous mode [ 134.392084][ T477] device veth0_vlan entered promiscuous mode [ 134.411039][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 134.418527][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 134.426213][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 134.434134][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 134.442975][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 134.450999][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 134.459008][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 134.466684][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 134.475303][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 134.483549][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 134.492323][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 134.501740][ T472] device veth1_macvtap entered promiscuous mode [ 134.524593][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 134.532314][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 134.539652][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 134.549809][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 134.558949][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 134.567271][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 134.575825][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 134.585974][ T470] device veth1_macvtap entered promiscuous mode [ 134.605240][ T477] device veth1_macvtap entered promiscuous mode [ 134.615269][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 134.622992][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 134.631356][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 134.639635][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 134.647906][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 134.656668][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 134.692541][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 134.702041][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 134.713461][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 134.721658][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 134.730010][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 134.738372][ T548] ================================================================== [ 134.738703][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 134.746250][ T548] BUG: KASAN: use-after-free in cpu_map_enqueue+0xb4/0x370 [ 134.746292][ T548] Read of size 8 at addr ffff888118181008 by task syz.1.16/548 [ 134.765727][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 134.768727][ T548] [ 134.768747][ T548] CPU: 0 PID: 548 Comm: syz.1.16 Not tainted 6.1.112-syzkaller-00028-g1ca5db7e29a7 #0 [ 134.777332][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 134.778705][ T548] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 134.778726][ T548] Call Trace: [ 134.778733][ T548] [ 134.789504][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 134.795986][ T548] dump_stack_lvl+0x151/0x1b7 [ 134.796017][ T548] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 134.796039][ T548] ? _printk+0xd1/0x111 [ 134.807714][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 134.809000][ T548] ? __virt_addr_valid+0x242/0x2f0 [ 134.812601][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 134.819676][ T548] print_report+0x158/0x4e0 [ 134.819712][ T548] ? __virt_addr_valid+0x242/0x2f0 [ 134.863506][ T548] ? kasan_complete_mode_report_info+0x90/0x1b0 [ 134.869578][ T548] ? cpu_map_enqueue+0xb4/0x370 [ 134.874264][ T548] kasan_report+0x13c/0x170 [ 134.878783][ T548] ? cpu_map_enqueue+0xb4/0x370 [ 134.883469][ T548] __asan_report_load8_noabort+0x14/0x20 [ 134.888935][ T548] cpu_map_enqueue+0xb4/0x370 [ 134.893450][ T548] xdp_do_redirect_frame+0x275/0x800 [ 134.898566][ T548] bpf_test_run_xdp_live+0xc30/0x1f70 [ 134.903862][ T548] ? __kasan_check_write+0x14/0x20 [ 134.908812][ T548] ? bpf_test_run_xdp_live+0x7ae/0x1f70 [ 134.914186][ T548] ? xdp_convert_md_to_buff+0x360/0x360 [ 134.919568][ T548] ? bpf_dispatcher_change_prog+0xd86/0xf10 [ 134.925300][ T548] ? 0xffffffffa0003b40 [ 134.929296][ T548] ? trace_raw_output_bpf_test_finish+0xd0/0xd0 [ 134.935367][ T548] ? __kasan_check_write+0x14/0x20 [ 134.940317][ T548] ? _copy_from_user+0x90/0xc0 [ 134.944916][ T548] bpf_prog_test_run_xdp+0x7d1/0x1130 [ 134.950138][ T548] ? dev_put+0x80/0x80 [ 134.954030][ T548] ? __kasan_check_write+0x14/0x20 [ 134.958986][ T548] ? fput+0x15b/0x1b0 [ 134.962788][ T548] ? dev_put+0x80/0x80 [ 134.966700][ T548] bpf_prog_test_run+0x3b0/0x630 [ 134.971478][ T548] ? bpf_prog_query+0x260/0x260 [ 134.976168][ T548] ? selinux_bpf+0xd2/0x100 [ 134.980502][ T548] ? security_bpf+0x82/0xb0 [ 134.984835][ T548] __sys_bpf+0x59f/0x7f0 [ 134.988915][ T548] ? bpf_link_show_fdinfo+0x2d0/0x2d0 [ 134.994127][ T548] ? fpregs_restore_userregs+0x130/0x290 [ 134.999590][ T548] __x64_sys_bpf+0x7c/0x90 [ 135.003845][ T548] x64_sys_call+0x87f/0x9a0 [ 135.008181][ T548] do_syscall_64+0x3b/0xb0 [ 135.012432][ T548] ? clear_bhb_loop+0x55/0xb0 [ 135.016947][ T548] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 135.022678][ T548] RIP: 0033:0x7f4e6697e819 [ 135.026932][ T548] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 135.046367][ T548] RSP: 002b:00007f4e676f1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 135.054615][ T548] RAX: ffffffffffffffda RBX: 00007f4e66b35fa0 RCX: 00007f4e6697e819 [ 135.062427][ T548] RDX: 0000000000000050 RSI: 00000000200000c0 RDI: 000000000000000a [ 135.070237][ T548] RBP: 00007f4e669f175e R08: 0000000000000000 R09: 0000000000000000 [ 135.078048][ T548] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 135.085860][ T548] R13: 0000000000000000 R14: 00007f4e66b35fa0 R15: 00007ffc3f48a858 [ 135.093768][ T548] [ 135.096622][ T548] [ 135.098789][ T548] Allocated by task 540: [ 135.102869][ T548] kasan_set_track+0x4b/0x70 [ 135.107298][ T548] kasan_save_alloc_info+0x1f/0x30 [ 135.112333][ T548] __kasan_kmalloc+0x9c/0xb0 [ 135.116758][ T548] __kmalloc_node+0xb4/0x1e0 [ 135.121183][ T548] bpf_map_kmalloc_node+0xd0/0x2c0 [ 135.126140][ T548] cpu_map_update_elem+0x28f/0xf50 [ 135.131076][ T548] bpf_map_update_value+0x1a3/0x410 [ 135.136112][ T548] map_update_elem+0x500/0x680 [ 135.140720][ T548] __sys_bpf+0x460/0x7f0 [ 135.144797][ T548] __x64_sys_bpf+0x7c/0x90 [ 135.149053][ T548] x64_sys_call+0x87f/0x9a0 [ 135.153382][ T548] do_syscall_64+0x3b/0xb0 [ 135.157659][ T548] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 135.163363][ T548] [ 135.165619][ T548] Freed by task 541: [ 135.169353][ T548] kasan_set_track+0x4b/0x70 [ 135.173874][ T548] kasan_save_free_info+0x2b/0x40 [ 135.178742][ T548] ____kasan_slab_free+0x131/0x180 [ 135.183683][ T548] __kasan_slab_free+0x11/0x20 [ 135.188277][ T548] __kmem_cache_free+0x21d/0x410 [ 135.193051][ T548] kfree+0x7a/0xf0 [ 135.196607][ T548] put_cpu_map_entry+0x6e2/0x760 [ 135.201480][ T548] cpu_map_kthread_run+0x2463/0x2520 [ 135.206589][ T548] kthread+0x26d/0x300 [ 135.210493][ T548] ret_from_fork+0x1f/0x30 [ 135.214747][ T548] [ 135.216923][ T548] Last potentially related work creation: [ 135.222478][ T548] kasan_save_stack+0x3b/0x60 [ 135.226988][ T548] __kasan_record_aux_stack+0xb4/0xc0 [ 135.232188][ T548] kasan_record_aux_stack_noalloc+0xb/0x10 [ 135.237837][ T548] insert_work+0x56/0x310 [ 135.242007][ T548] __queue_work+0x9b6/0xd70 [ 135.246358][ T548] queue_work_on+0x105/0x170 [ 135.250762][ T548] cpu_map_free+0x1e7/0x2c0 [ 135.255102][ T548] bpf_map_free_deferred+0xf7/0x1b0 [ 135.260138][ T548] process_one_work+0x73d/0xcb0 [ 135.264824][ T548] worker_thread+0xa60/0x1260 [ 135.269338][ T548] kthread+0x26d/0x300 [ 135.273244][ T548] ret_from_fork+0x1f/0x30 [ 135.277495][ T548] [ 135.279700][ T548] Second to last potentially related work creation: [ 135.286091][ T548] kasan_save_stack+0x3b/0x60 [ 135.290601][ T548] __kasan_record_aux_stack+0xb4/0xc0 [ 135.295811][ T548] kasan_record_aux_stack_noalloc+0xb/0x10 [ 135.301448][ T548] call_rcu+0xdc/0x10f0 [ 135.305443][ T548] cpu_map_free+0x109/0x2c0 [ 135.309780][ T548] bpf_map_free_deferred+0xf7/0x1b0 [ 135.314818][ T548] process_one_work+0x73d/0xcb0 [ 135.319503][ T548] worker_thread+0xa60/0x1260 [ 135.324030][ T548] kthread+0x26d/0x300 [ 135.327922][ T548] ret_from_fork+0x1f/0x30 [ 135.332270][ T548] [ 135.334435][ T548] The buggy address belongs to the object at ffff888118181000 [ 135.334435][ T548] which belongs to the cache kmalloc-192 of size 192 [ 135.348319][ T548] The buggy address is located 8 bytes inside of [ 135.348319][ T548] 192-byte region [ffff888118181000, ffff8881181810c0) [ 135.361335][ T548] [ 135.363505][ T548] The buggy address belongs to the physical page: [ 135.369758][ T548] page:ffffea0004606040 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118181 [ 135.379913][ T548] flags: 0x4000000000000200(slab|zone=1) [ 135.385391][ T548] raw: 4000000000000200 ffffea000463aa40 dead000000000002 ffff888100042c00 [ 135.393813][ T548] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 135.402218][ T548] page dumped because: kasan: bad access detected [ 135.408477][ T548] page_owner tracks the page as allocated [ 135.414018][ T548] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 117, tgid 117 (udevd), ts 6107899573, free_ts 0 [ 135.430511][ T548] post_alloc_hook+0x213/0x220 [ 135.435109][ T548] prep_new_page+0x1b/0x110 [ 135.439456][ T548] get_page_from_freelist+0x2980/0x2a10 [ 135.444833][ T548] __alloc_pages+0x234/0x610 [ 135.449265][ T548] alloc_slab_page+0x6c/0xf0 [ 135.453681][ T548] new_slab+0x90/0x3e0 [ 135.457588][ T548] ___slab_alloc+0x6f9/0xb80 [ 135.462101][ T548] __slab_alloc+0x5d/0xa0 [ 135.466369][ T548] __kmem_cache_alloc_node+0x207/0x2a0 [ 135.471732][ T548] kmalloc_trace+0x2a/0xa0 [ 135.475987][ T548] kernfs_fop_open+0x350/0xb10 [ 135.480591][ T548] do_dentry_open+0x891/0x1250 [ 135.485185][ T548] vfs_open+0x73/0x80 [ 135.489003][ T548] path_openat+0x2532/0x2d60 [ 135.493430][ T548] do_filp_open+0x230/0x480 [ 135.497775][ T548] do_sys_openat2+0x151/0x870 [ 135.502287][ T548] page_owner free stack trace missing [ 135.507493][ T548] [ 135.509664][ T548] Memory state around the buggy address: [ 135.515133][ T548] ffff888118180f00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 135.523034][ T548] ffff888118180f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 135.531018][ T548] >ffff888118181000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 135.538911][ T548] ^ [ 135.543078][ T548] ffff888118181080: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 135.550995][ T548] ffff888118181100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 135.558876][ T548] ================================================================== [ 135.566798][ T548] Disabling lock debugging due to kernel taint [ 135.572851][ T548] general protection fault, probably for non-canonical address 0xe0ed6d3c1edc004e: 0000 [#1] PREEMPT SMP KASAN [ 135.580516][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 135.584302][ T548] KASAN: maybe wild-memory-access in range [0x076b89e0f6e00270-0x076b89e0f6e00277] [ 135.584323][ T548] CPU: 0 PID: 548 Comm: syz.1.16 Tainted: G B 6.1.112-syzkaller-00028-g1ca5db7e29a7 #0 [ 135.612167][ T548] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 135.622062][ T548] RIP: 0010:cpu_map_enqueue+0x113/0x370 [ 135.627651][ T548] Code: e8 03 42 80 3c 30 00 74 08 48 89 df e8 a6 e3 24 00 4c 8b 23 4f 8d 74 3c 58 4d 89 f5 49 c1 ed 03 48 b8 00 00 00 00 00 fc ff df <41> 0f b6 44 05 00 84 c0 0f 85 a8 01 00 00 4d 01 fc 41 8b 1e bf 08 [ 135.647179][ T548] RSP: 0018:ffffc90000c17600 EFLAGS: 00010207 [ 135.653082][ T548] RAX: dffffc0000000000 RBX: ffffffff86748890 RCX: ffff888119525100 [ 135.660898][ T548] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008 [ 135.668701][ T548] RBP: ffffc90000c17638 R08: ffffffff81982e0e R09: fffffbfff0f6e0fd [ 135.676512][ T548] R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8881f6e00000 [ 135.684326][ T548] R13: 00ed713c1edc004e R14: 076b89e0f6e00275 R15: 076c015f0000021d [ 135.692136][ T548] FS: 00007f4e676f16c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 135.700901][ T548] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 135.707346][ T548] CR2: 00007f12e9175093 CR3: 0000000131fe8000 CR4: 00000000003506b0 [ 135.715135][ T548] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 135.722945][ T548] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 135.730847][ T548] Call Trace: [ 135.734171][ T548] [ 135.736950][ T548] ? __die_body+0x62/0xb0 [ 135.741111][ T548] ? die_addr+0x9f/0xd0 [ 135.745102][ T548] ? exc_general_protection+0x317/0x4c0 [ 135.750506][ T548] ? asm_exc_general_protection+0x27/0x30 [ 135.756039][ T548] ? cpu_map_enqueue+0xce/0x370 [ 135.760727][ T548] ? cpu_map_enqueue+0x113/0x370 [ 135.765504][ T548] xdp_do_redirect_frame+0x275/0x800 [ 135.770623][ T548] bpf_test_run_xdp_live+0xc30/0x1f70 [ 135.775829][ T548] ? __kasan_check_write+0x14/0x20 [ 135.780777][ T548] ? bpf_test_run_xdp_live+0x7ae/0x1f70 [ 135.786157][ T548] ? xdp_convert_md_to_buff+0x360/0x360 [ 135.791539][ T548] ? bpf_dispatcher_change_prog+0xd86/0xf10 [ 135.797263][ T548] ? 0xffffffffa0003b40 [ 135.801269][ T548] ? trace_raw_output_bpf_test_finish+0xd0/0xd0 [ 135.807335][ T548] ? __kasan_check_write+0x14/0x20 [ 135.812282][ T548] ? _copy_from_user+0x90/0xc0 [ 135.816880][ T548] bpf_prog_test_run_xdp+0x7d1/0x1130 [ 135.822094][ T548] ? dev_put+0x80/0x80 [ 135.825995][ T548] ? __kasan_check_write+0x14/0x20 [ 135.830939][ T548] ? fput+0x15b/0x1b0 [ 135.834759][ T548] ? dev_put+0x80/0x80 [ 135.838663][ T548] bpf_prog_test_run+0x3b0/0x630 [ 135.843440][ T548] ? bpf_prog_query+0x260/0x260 [ 135.848122][ T548] ? selinux_bpf+0xd2/0x100 [ 135.852476][ T548] ? security_bpf+0x82/0xb0 [ 135.856813][ T548] __sys_bpf+0x59f/0x7f0 [ 135.860885][ T548] ? bpf_link_show_fdinfo+0x2d0/0x2d0 [ 135.866102][ T548] ? fpregs_restore_userregs+0x130/0x290 [ 135.871576][ T548] __x64_sys_bpf+0x7c/0x90 [ 135.875817][ T548] x64_sys_call+0x87f/0x9a0 [ 135.880151][ T548] do_syscall_64+0x3b/0xb0 [ 135.884404][ T548] ? clear_bhb_loop+0x55/0xb0 [ 135.888918][ T548] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 135.894643][ T548] RIP: 0033:0x7f4e6697e819 [ 135.898897][ T548] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 135.918340][ T548] RSP: 002b:00007f4e676f1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 135.926584][ T548] RAX: ffffffffffffffda RBX: 00007f4e66b35fa0 RCX: 00007f4e6697e819 [ 135.934400][ T548] RDX: 0000000000000050 RSI: 00000000200000c0 RDI: 000000000000000a [ 135.942226][ T548] RBP: 00007f4e669f175e R08: 0000000000000000 R09: 0000000000000000 [ 135.950017][ T548] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 135.957829][ T548] R13: 0000000000000000 R14: 00007f4e66b35fa0 R15: 00007ffc3f48a858 [ 135.965643][ T548] [ 135.968505][ T548] Modules linked in: [ 135.972279][ T548] ---[ end trace 0000000000000000 ]--- [ 135.977540][ T548] RIP: 0010:cpu_map_enqueue+0x113/0x370 [ 135.982941][ T548] Code: e8 03 42 80 3c 30 00 74 08 48 89 df e8 a6 e3 24 00 4c 8b 23 4f 8d 74 3c 58 4d 89 f5 49 c1 ed 03 48 b8 00 00 00 00 00 fc ff df <41> 0f b6 44 05 00 84 c0 0f 85 a8 01 00 00 4d 01 fc 41 8b 1e bf 08 [ 136.002383][ T548] RSP: 0018:ffffc90000c17600 EFLAGS: 00010207 [ 136.008260][ T548] RAX: dffffc0000000000 RBX: ffffffff86748890 RCX: ffff888119525100 [ 136.016113][ T548] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008 [ 136.023896][ T548] RBP: ffffc90000c17638 R08: ffffffff81982e0e R09: fffffbfff0f6e0fd [ 136.031711][ T548] R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8881f6e00000 [ 136.039506][ T548] R13: 00ed713c1edc004e R14: 076b89e0f6e00275 R15: 076c015f0000021d [ 136.047337][ T548] FS: 00007f4e676f16c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 136.056107][ T548] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 136.062520][ T548] CR2: 00007f12e9175093 CR3: 0000000131fe8000 CR4: 00000000003506b0 [ 136.070331][ T548] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 136.078127][ T548] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 136.085966][ T548] Kernel panic - not syncing: Fatal exception in interrupt [ 136.093283][ T548] Kernel Offset: disabled [ 136.097415][ T548] Rebooting in 86400 seconds..