[ 92.012391][ T9] cfg80211: failed to load regulatory.db Warning: Permanently added '[localhost]:33202' (ED25519) to the list of known hosts. 2026/02/23 14:26:27 parsed 1 programs [ 100.719604][ T5314] cgroup: Unknown subsys name 'net' [ 100.770197][ T5314] cgroup: Unknown subsys name 'cpuset' [ 100.775842][ T5314] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 102.518495][ T5314] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 103.534681][ T5314] ODEBUG: Out of memory. ODEBUG disabled [ 107.727203][ T5322] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 109.459028][ T5337] chnl_net:caif_netlink_parms(): no params data found [ 109.616705][ T5337] bridge0: port 1(bridge_slave_0) entered blocking state [ 109.620797][ T5337] bridge0: port 1(bridge_slave_0) entered disabled state [ 109.626161][ T5337] bridge_slave_0: entered allmulticast mode [ 109.642774][ T5337] bridge_slave_0: entered promiscuous mode [ 109.649737][ T5337] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.663373][ T5337] bridge0: port 2(bridge_slave_1) entered disabled state [ 109.666417][ T5337] bridge_slave_1: entered allmulticast mode [ 109.670183][ T5337] bridge_slave_1: entered promiscuous mode [ 109.728150][ T5337] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 109.748306][ T5337] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 109.793657][ T5337] team0: Port device team_slave_0 added [ 109.804464][ T5337] team0: Port device team_slave_1 added [ 109.850296][ T5337] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 109.862912][ T5337] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 109.883124][ T5337] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 109.889064][ T5337] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 109.891898][ T5337] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 109.922955][ T5337] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 109.994484][ T5337] hsr_slave_0: entered promiscuous mode [ 110.003294][ T5337] hsr_slave_1: entered promiscuous mode [ 110.294671][ T5337] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 110.314661][ T5337] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 110.334158][ T5337] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 110.339553][ T5337] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 110.375899][ T5337] bridge0: port 2(bridge_slave_1) entered blocking state [ 110.379090][ T5337] bridge0: port 2(bridge_slave_1) entered forwarding state [ 110.382379][ T5337] bridge0: port 1(bridge_slave_0) entered blocking state [ 110.385393][ T5337] bridge0: port 1(bridge_slave_0) entered forwarding state [ 110.415511][ T24] bridge0: port 1(bridge_slave_0) entered disabled state [ 110.419207][ T24] bridge0: port 2(bridge_slave_1) entered disabled state [ 110.490860][ T5337] 8021q: adding VLAN 0 to HW filter on device bond0 [ 110.515777][ T5337] 8021q: adding VLAN 0 to HW filter on device team0 [ 110.527479][ T24] bridge0: port 1(bridge_slave_0) entered blocking state [ 110.530535][ T24] bridge0: port 1(bridge_slave_0) entered forwarding state [ 110.554592][ T71] bridge0: port 2(bridge_slave_1) entered blocking state [ 110.558055][ T71] bridge0: port 2(bridge_slave_1) entered forwarding state [ 110.825964][ T5337] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 110.880496][ T5337] veth0_vlan: entered promiscuous mode [ 110.899068][ T5337] veth1_vlan: entered promiscuous mode [ 110.964200][ T5337] veth0_macvtap: entered promiscuous mode [ 110.976893][ T5337] veth1_macvtap: entered promiscuous mode [ 111.024286][ T5337] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.043956][ T5337] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.056383][ T71] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.060171][ T71] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.087887][ T71] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.091614][ T71] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.296379][ T71] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.365227][ T71] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.443806][ T71] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.525852][ T71] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.749891][ T106] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.753622][ T106] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.799179][ T106] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.803142][ T106] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.689289][ T71] bridge_slave_1: left allmulticast mode [ 113.692134][ T71] bridge_slave_1: left promiscuous mode [ 113.697998][ T71] bridge0: port 2(bridge_slave_1) entered disabled state [ 113.773679][ T71] bridge_slave_0: left allmulticast mode [ 113.776077][ T71] bridge_slave_0: left promiscuous mode [ 113.778580][ T71] bridge0: port 1(bridge_slave_0) entered disabled state [ 114.248792][ T71] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 114.265308][ T71] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 114.270021][ T71] bond0 (unregistering): Released all slaves [ 114.455210][ T71] hsr_slave_0: left promiscuous mode [ 114.458077][ T71] hsr_slave_1: left promiscuous mode [ 114.472912][ T71] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 114.476201][ T71] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 114.493672][ T71] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 114.496868][ T71] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 114.533944][ T71] veth1_macvtap: left promiscuous mode [ 114.536671][ T71] veth0_macvtap: left promiscuous mode [ 114.539008][ T71] veth1_vlan: left promiscuous mode [ 114.541394][ T71] veth0_vlan: left promiscuous mode [ 115.007389][ T71] team0 (unregistering): Port device team_slave_1 removed [ 115.018942][ T71] team0 (unregistering): Port device team_slave_0 removed [ 115.249219][ T5407] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 115.254826][ T5407] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 115.257972][ T5407] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 115.266588][ T5407] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 115.269869][ T5407] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 2026/02/23 14:26:47 executed programs: 0 [ 118.059765][ T5407] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 118.063803][ T5407] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 118.067115][ T5407] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 118.070834][ T5407] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 118.074542][ T5407] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 118.235830][ T5446] chnl_net:caif_netlink_parms(): no params data found [ 118.307597][ T5446] bridge0: port 1(bridge_slave_0) entered blocking state [ 118.310906][ T5446] bridge0: port 1(bridge_slave_0) entered disabled state [ 118.313953][ T5446] bridge_slave_0: entered allmulticast mode [ 118.317521][ T5446] bridge_slave_0: entered promiscuous mode [ 118.321727][ T5446] bridge0: port 2(bridge_slave_1) entered blocking state [ 118.325075][ T5446] bridge0: port 2(bridge_slave_1) entered disabled state [ 118.328127][ T5446] bridge_slave_1: entered allmulticast mode [ 118.331881][ T5446] bridge_slave_1: entered promiscuous mode [ 118.351777][ T5446] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 118.357800][ T5446] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 118.381935][ T5446] team0: Port device team_slave_0 added [ 118.387177][ T5446] team0: Port device team_slave_1 added [ 118.407063][ T5446] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 118.409977][ T5446] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 118.420659][ T5446] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 118.426592][ T5446] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 118.429364][ T5446] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 118.440219][ T5446] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 118.475738][ T5446] hsr_slave_0: entered promiscuous mode [ 118.478565][ T5446] hsr_slave_1: entered promiscuous mode [ 118.885044][ T5446] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 118.905488][ T5446] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 118.916529][ T5446] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 118.934205][ T5446] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 119.054920][ T5446] 8021q: adding VLAN 0 to HW filter on device bond0 [ 119.080240][ T5446] 8021q: adding VLAN 0 to HW filter on device team0 [ 119.113709][ T24] bridge0: port 1(bridge_slave_0) entered blocking state [ 119.116961][ T24] bridge0: port 1(bridge_slave_0) entered forwarding state [ 119.121236][ T24] bridge0: port 2(bridge_slave_1) entered blocking state [ 119.124539][ T24] bridge0: port 2(bridge_slave_1) entered forwarding state [ 119.172310][ T5446] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 119.192858][ T5446] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 119.443598][ T5446] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 119.503943][ T5446] veth0_vlan: entered promiscuous mode [ 119.517191][ T5446] veth1_vlan: entered promiscuous mode [ 119.541579][ T5446] veth0_macvtap: entered promiscuous mode [ 119.564146][ T5446] veth1_macvtap: entered promiscuous mode [ 119.589041][ T5446] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 119.606537][ T5446] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 119.613676][ T71] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.618312][ T71] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.622373][ T71] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.638902][ T71] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.725634][ T106] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 119.729264][ T106] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.772298][ T1054] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 119.778555][ T1054] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 120.143625][ T4662] Bluetooth: hci0: command tx timeout [ 122.222831][ T4662] Bluetooth: hci0: command tx timeout [ 122.281849][ T5008] ================================================================== [ 122.285292][ T5008] BUG: KASAN: slab-use-after-free in sock_def_readable+0x1cb/0x580 [ 122.291267][ T5008] Read of size 8 at addr ffff8880546ef440 by task dhcpcd/5008 [ 122.295474][ T5008] [ 122.296475][ T5008] CPU: 0 UID: 0 PID: 5008 Comm: dhcpcd Not tainted syzkaller #0 PREEMPT(full) [ 122.296488][ T5008] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 122.296494][ T5008] Call Trace: [ 122.296501][ T5008] [ 122.296505][ T5008] dump_stack_lvl+0xe8/0x150 [ 122.296604][ T5008] print_report+0xba/0x230 [ 122.296616][ T5008] ? sock_def_readable+0x1cb/0x580 [ 122.296631][ T5008] kasan_report+0x117/0x150 [ 122.296675][ T5008] ? lock_acquire+0xf0/0x2e0 [ 122.296794][ T5008] ? sock_def_readable+0x1cb/0x580 [ 122.296808][ T5008] sock_def_readable+0x1cb/0x580 [ 122.296820][ T5008] ? sock_def_readable+0xae/0x580 [ 122.296834][ T5008] send_to_lecd+0x322/0x600 [ 122.296942][ T5008] ? make_entry+0x200/0x2f0 [ 122.296953][ T5008] lec_start_xmit+0xec0/0x2660 [ 122.296968][ T5008] dev_hard_start_xmit+0x2d8/0x870 [ 122.296985][ T5008] sch_direct_xmit+0x251/0x4c0 [ 122.297024][ T5008] ? __pfx_sch_direct_xmit+0x10/0x10 [ 122.297035][ T5008] __dev_queue_xmit+0x1538/0x38a0 [ 122.297047][ T5008] ? __dev_notify_flags+0x1a9/0x310 [ 122.297059][ T5008] ? __dev_queue_xmit+0x274/0x38a0 [ 122.297073][ T5008] ? __pfx___dev_queue_xmit+0x10/0x10 [ 122.297087][ T5008] ? rcu_is_watching+0x15/0xb0 [ 122.297198][ T5008] ? trace_kmem_cache_alloc+0x29/0xf0 [ 122.297275][ T5008] ? eth_header+0x11b/0x200 [ 122.297286][ T5008] ? __asan_memcpy+0x40/0x70 [ 122.297299][ T5008] ? eth_header+0x11b/0x200 [ 122.297310][ T5008] ? __pfx_eth_header+0x10/0x10 [ 122.297319][ T5008] ? lapbeth_data_transmit+0x218/0x2e0 [ 122.297500][ T5008] ? __pfx_lapbeth_data_transmit+0x10/0x10 [ 122.297510][ T5008] lapb_data_transmit+0x90/0xb0 [ 122.297611][ T5008] lapb_transmit_buffer+0x163/0x200 [ 122.297622][ T5008] lapb_establish_data_link+0x89/0xe0 [ 122.297633][ T5008] lapb_device_event+0x4e1/0x670 [ 122.297644][ T5008] notifier_call_chain+0x1be/0x400 [ 122.297753][ T5008] __dev_notify_flags+0x1a9/0x310 [ 122.297765][ T5008] ? __pfx___dev_notify_flags+0x10/0x10 [ 122.297775][ T5008] ? __dev_change_flags+0x4c6/0x690 [ 122.297787][ T5008] ? __pfx___dev_change_flags+0x10/0x10 [ 122.297799][ T5008] ? __pfx___mutex_lock+0x10/0x10 [ 122.298531][ T5008] netif_change_flags+0xe8/0x1a0 [ 122.298544][ T5008] dev_change_flags+0x130/0x260 [ 122.298557][ T5008] devinet_ioctl+0x9f2/0x1b30 [ 122.298629][ T5008] ? __pfx_devinet_ioctl+0x10/0x10 [ 122.298636][ T5008] ? get_user_ifreq+0x12b/0x180 [ 122.298746][ T5008] inet_ioctl+0x42a/0x560 [ 122.298759][ T5008] ? __pfx_inet_ioctl+0x10/0x10 [ 122.298775][ T5008] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 122.298816][ T5008] sock_do_ioctl+0x101/0x320 [ 122.298830][ T5008] ? __pfx_sock_do_ioctl+0x10/0x10 [ 122.298845][ T5008] sock_ioctl+0x5c6/0x7f0 [ 122.298858][ T5008] ? __pfx_sock_ioctl+0x10/0x10 [ 122.298870][ T5008] ? fd_install+0x306/0x3d0 [ 122.298915][ T5008] ? bpf_lsm_file_ioctl+0x9/0x20 [ 122.298945][ T5008] ? __pfx_sock_ioctl+0x10/0x10 [ 122.298957][ T5008] __se_sys_ioctl+0xfc/0x170 [ 122.298970][ T5008] do_syscall_64+0x14d/0xf80 [ 122.298984][ T5008] ? trace_irq_disable+0x3b/0x150 [ 122.299027][ T5008] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.299036][ T5008] ? clear_bhb_loop+0x40/0x90 [ 122.299047][ T5008] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.299057][ T5008] RIP: 0033:0x7fdcf5e01378 [ 122.299068][ T5008] Code: 00 00 48 8d 44 24 08 48 89 54 24 e0 48 89 44 24 c0 48 8d 44 24 d0 48 89 44 24 c8 b8 10 00 00 00 c7 44 24 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 07 89 d0 c3 0f 1f 40 00 48 8b 15 49 3a 0d [ 122.299076][ T5008] RSP: 002b:00007ffc6e8c8a88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 122.299088][ T5008] RAX: ffffffffffffffda RBX: 0000000000000018 RCX: 00007fdcf5e01378 [ 122.299094][ T5008] RDX: 00007ffc6e8d8c80 RSI: 0000000000008914 RDI: 0000000000000018 [ 122.299101][ T5008] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 122.299107][ T5008] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc6e8e8e20 [ 122.299114][ T5008] R13: 00007fdcf5d016c8 R14: 0000000000000028 R15: 0000000000008914 [ 122.299123][ T5008] [ 122.299127][ T5008] [ 122.465777][ T5008] Allocated by task 5488: [ 122.467532][ T5008] kasan_save_track+0x3e/0x80 [ 122.469423][ T5008] __kasan_slab_alloc+0x6c/0x80 [ 122.471268][ T5008] kmem_cache_alloc_lru_noprof+0x2b8/0x640 [ 122.473277][ T5008] sock_alloc_inode+0x28/0xc0 [ 122.475091][ T5008] alloc_inode+0x6a/0x1b0 [ 122.476804][ T5008] __sock_create+0x12d/0x9d0 [ 122.478709][ T5008] __sys_socket+0xd6/0x1b0 [ 122.480497][ T5008] __x64_sys_socket+0x7a/0x90 [ 122.482488][ T5008] do_syscall_64+0x14d/0xf80 [ 122.484536][ T5008] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.487000][ T5008] [ 122.488151][ T5008] Freed by task 5487: [ 122.489862][ T5008] kasan_save_track+0x3e/0x80 [ 122.491912][ T5008] kasan_save_free_info+0x46/0x50 [ 122.494036][ T5008] __kasan_slab_free+0x5c/0x80 [ 122.495989][ T5008] kmem_cache_free+0x187/0x630 [ 122.497877][ T5008] rcu_core+0x7cd/0x1070 [ 122.499622][ T5008] handle_softirqs+0x22a/0x870 [ 122.501503][ T5008] __irq_exit_rcu+0x5f/0x150 [ 122.503307][ T5008] irq_exit_rcu+0x9/0x30 [ 122.505039][ T5008] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 122.507299][ T5008] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 122.509841][ T5008] [ 122.510904][ T5008] Last potentially related work creation: [ 122.513451][ T5008] kasan_save_stack+0x3e/0x60 [ 122.515424][ T5008] kasan_record_aux_stack+0xbd/0xd0 [ 122.517586][ T5008] call_rcu+0xee/0x890 [ 122.519329][ T5008] evict+0x95b/0xb10 [ 122.521027][ T5008] __dentry_kill+0x1a2/0x5e0 [ 122.522928][ T5008] finish_dput+0xc9/0x480 [ 122.524824][ T5008] __fput+0x691/0xa70 [ 122.526512][ T5008] task_work_run+0x1d9/0x270 [ 122.528559][ T5008] exit_to_user_mode_loop+0xed/0x480 [ 122.530800][ T5008] do_syscall_64+0x32d/0xf80 [ 122.532832][ T5008] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.535382][ T5008] [ 122.536435][ T5008] The buggy address belongs to the object at ffff8880546ef3c0 [ 122.536435][ T5008] which belongs to the cache sock_inode_cache of size 1344 [ 122.542569][ T5008] The buggy address is located 128 bytes inside of [ 122.542569][ T5008] freed 1344-byte region [ffff8880546ef3c0, ffff8880546ef900) [ 122.548326][ T5008] [ 122.549393][ T5008] The buggy address belongs to the physical page: [ 122.552068][ T5008] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880546ef3c0 pfn:0x546ec [ 122.556444][ T5008] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 122.560154][ T5008] memcg:ffff8880546eff41 [ 122.561984][ T5008] flags: 0x4fff00000000240(workingset|head|node=1|zone=1|lastcpupid=0x7ff) [ 122.565555][ T5008] page_type: f5(slab) [ 122.567370][ T5008] raw: 04fff00000000240 ffff88801b3cf500 ffffea00011f9610 ffffea000151ba10 [ 122.571026][ T5008] raw: ffff8880546ef3c0 00000008000b0003 00000000f5000000 ffff8880546eff41 [ 122.574649][ T5008] head: 04fff00000000240 ffff88801b3cf500 ffffea00011f9610 ffffea000151ba10 [ 122.578608][ T5008] head: ffff8880546ef3c0 00000008000b0003 00000000f5000000 ffff8880546eff41 [ 122.582272][ T5008] head: 04fff00000000002 ffffea000151bb01 00000000ffffffff 00000000ffffffff [ 122.585935][ T5008] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 122.589840][ T5008] page dumped because: kasan: bad access detected [ 122.592677][ T5008] page_owner tracks the page as allocated [ 122.595134][ T5008] page last allocated via order 2, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5446, tgid 5446 (syz-executor), ts 119654976992, free_ts 117658681881 [ 122.604999][ T5008] post_alloc_hook+0x231/0x280 [ 122.607272][ T5008] get_page_from_freelist+0x24dc/0x2580 [ 122.609647][ T5008] __alloc_frozen_pages_noprof+0x18d/0x380 [ 122.612046][ T5008] allocate_slab+0x77/0x660 [ 122.614133][ T5008] refill_objects+0x331/0x3c0 [ 122.616025][ T5008] __pcs_replace_empty_main+0x2b9/0x620 [ 122.618041][ T5008] kmem_cache_alloc_lru_noprof+0x37c/0x640 [ 122.620339][ T5008] sock_alloc_inode+0x28/0xc0 [ 122.622223][ T5008] alloc_inode+0x6a/0x1b0 [ 122.623949][ T5008] __sock_create+0x12d/0x9d0 [ 122.625835][ T5008] udp_sock_create4+0xca/0x480 [ 122.627855][ T5008] wg_socket_init+0x676/0xeb0 [ 122.629785][ T5008] wg_open+0x24f/0x420 [ 122.631562][ T5008] __dev_open+0x44d/0x830 [ 122.633446][ T5008] __dev_change_flags+0x1f7/0x690 [ 122.635682][ T5008] netif_change_flags+0x88/0x1a0 [ 122.637773][ T5008] page last free pid 5440 tgid 5440 stack trace: [ 122.640474][ T5008] __free_frozen_pages+0xc2b/0xdb0 [ 122.642712][ T5008] __slab_free+0x263/0x2b0 [ 122.644553][ T5008] qlist_free_all+0x97/0x100 [ 122.646477][ T5008] kasan_quarantine_reduce+0x148/0x160 [ 122.648827][ T5008] __kasan_slab_alloc+0x22/0x80 [ 122.650931][ T5008] kmem_cache_alloc_noprof+0x2bc/0x650 [ 122.653303][ T5008] do_getname+0x2e/0x250 [ 122.655289][ T5008] vfs_fstatat+0x45/0x170 [ 122.657060][ T5008] __x64_sys_newfstatat+0x151/0x200 [ 122.659289][ T5008] do_syscall_64+0x14d/0xf80 [ 122.661228][ T5008] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.663779][ T5008] [ 122.664730][ T5008] Memory state around the buggy address: [ 122.667167][ T5008] ffff8880546ef300: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 122.670622][ T5008] ffff8880546ef380: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 122.674215][ T5008] >ffff8880546ef400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 122.677672][ T5008] ^ [ 122.680555][ T5008] ffff8880546ef480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 122.684100][ T5008] ffff8880546ef500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 122.687645][ T5008] ================================================================== [ 122.691158][ T5008] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 122.694446][ T5008] CPU: 0 UID: 0 PID: 5008 Comm: dhcpcd Not tainted syzkaller #0 PREEMPT(full) [ 122.698415][ T5008] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 122.702811][ T5008] Call Trace: [ 122.704357][ T5008] [ 122.705749][ T5008] vpanic+0x56c/0xa60 [ 122.707587][ T5008] ? __pfx_vpanic+0x10/0x10 [ 122.709631][ T5008] panic+0xc5/0xd0 [ 122.711291][ T5008] ? __pfx_panic+0x10/0x10 [ 122.713248][ T5008] ? sock_def_readable+0x1cb/0x580 [ 122.715518][ T5008] ? sock_def_readable+0x1cb/0x580 [ 122.718151][ T5008] ? sock_def_readable+0x1cb/0x580 [ 122.720485][ T5008] check_panic_on_warn+0x89/0xb0 [ 122.722767][ T5008] ? sock_def_readable+0x1cb/0x580 [ 122.725036][ T5008] end_report+0x73/0x180 [ 122.726932][ T5008] ? sock_def_readable+0x1cb/0x580 [ 122.729248][ T5008] kasan_report+0x128/0x150 [ 122.731328][ T5008] ? lock_acquire+0xf0/0x2e0 [ 122.733367][ T5008] ? sock_def_readable+0x1cb/0x580 [ 122.735643][ T5008] sock_def_readable+0x1cb/0x580 [ 122.737888][ T5008] ? sock_def_readable+0xae/0x580 [ 122.740167][ T5008] send_to_lecd+0x322/0x600 [ 122.742194][ T5008] ? make_entry+0x200/0x2f0 [ 122.744276][ T5008] lec_start_xmit+0xec0/0x2660 [ 122.746357][ T5008] dev_hard_start_xmit+0x2d8/0x870 [ 122.749662][ T5008] sch_direct_xmit+0x251/0x4c0 [ 122.751846][ T5008] ? __pfx_sch_direct_xmit+0x10/0x10 [ 122.754199][ T5008] __dev_queue_xmit+0x1538/0x38a0 [ 122.756461][ T5008] ? __dev_notify_flags+0x1a9/0x310 [ 122.758731][ T5008] ? __dev_queue_xmit+0x274/0x38a0 [ 122.761051][ T5008] ? __pfx___dev_queue_xmit+0x10/0x10 [ 122.763516][ T5008] ? rcu_is_watching+0x15/0xb0 [ 122.765557][ T5008] ? trace_kmem_cache_alloc+0x29/0xf0 [ 122.767899][ T5008] ? eth_header+0x11b/0x200 [ 122.769865][ T5008] ? __asan_memcpy+0x40/0x70 [ 122.771908][ T5008] ? eth_header+0x11b/0x200 [ 122.774015][ T5008] ? __pfx_eth_header+0x10/0x10 [ 122.776149][ T5008] ? lapbeth_data_transmit+0x218/0x2e0 [ 122.778547][ T5008] ? __pfx_lapbeth_data_transmit+0x10/0x10 [ 122.781089][ T5008] lapb_data_transmit+0x90/0xb0 [ 122.783142][ T5008] lapb_transmit_buffer+0x163/0x200 [ 122.785347][ T5008] lapb_establish_data_link+0x89/0xe0 [ 122.787646][ T5008] lapb_device_event+0x4e1/0x670 [ 122.789776][ T5008] notifier_call_chain+0x1be/0x400 [ 122.791903][ T5008] __dev_notify_flags+0x1a9/0x310 [ 122.794138][ T5008] ? __pfx___dev_notify_flags+0x10/0x10 [ 122.796557][ T5008] ? __dev_change_flags+0x4c6/0x690 [ 122.798852][ T5008] ? __pfx___dev_change_flags+0x10/0x10 [ 122.801198][ T5008] ? __pfx___mutex_lock+0x10/0x10 [ 122.803348][ T5008] netif_change_flags+0xe8/0x1a0 [ 122.805558][ T5008] dev_change_flags+0x130/0x260 [ 122.807683][ T5008] devinet_ioctl+0x9f2/0x1b30 [ 122.809800][ T5008] ? __pfx_devinet_ioctl+0x10/0x10 [ 122.812077][ T5008] ? get_user_ifreq+0x12b/0x180 [ 122.814184][ T5008] inet_ioctl+0x42a/0x560 [ 122.816073][ T5008] ? __pfx_inet_ioctl+0x10/0x10 [ 122.818271][ T5008] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 122.820534][ T5008] sock_do_ioctl+0x101/0x320 [ 122.822543][ T5008] ? __pfx_sock_do_ioctl+0x10/0x10 [ 122.824841][ T5008] sock_ioctl+0x5c6/0x7f0 [ 122.826776][ T5008] ? __pfx_sock_ioctl+0x10/0x10 [ 122.829120][ T5008] ? fd_install+0x306/0x3d0 [ 122.830976][ T5008] ? bpf_lsm_file_ioctl+0x9/0x20 [ 122.833018][ T5008] ? __pfx_sock_ioctl+0x10/0x10 [ 122.834997][ T5008] __se_sys_ioctl+0xfc/0x170 [ 122.836908][ T5008] do_syscall_64+0x14d/0xf80 [ 122.839408][ T5008] ? trace_irq_disable+0x3b/0x150 [ 122.841801][ T5008] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.844559][ T5008] ? clear_bhb_loop+0x40/0x90 [ 122.846702][ T5008] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.849332][ T5008] RIP: 0033:0x7fdcf5e01378 [ 122.851332][ T5008] Code: 00 00 48 8d 44 24 08 48 89 54 24 e0 48 89 44 24 c0 48 8d 44 24 d0 48 89 44 24 c8 b8 10 00 00 00 c7 44 24 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 07 89 d0 c3 0f 1f 40 00 48 8b 15 49 3a 0d [ 122.859537][ T5008] RSP: 002b:00007ffc6e8c8a88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 122.863146][ T5008] RAX: ffffffffffffffda RBX: 0000000000000018 RCX: 00007fdcf5e01378 [ 122.866744][ T5008] RDX: 00007ffc6e8d8c80 RSI: 0000000000008914 RDI: 0000000000000018 [ 122.870128][ T5008] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 122.873530][ T5008] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc6e8e8e20 [ 122.876872][ T5008] R13: 00007fdcf5d016c8 R14: 0000000000000028 R15: 0000000000008914 [ 122.880268][ T5008] [ 122.882027][ T5008] Kernel Offset: disabled [ 122.883872][ T5008] Rebooting in 86400 seconds.. VM DIAGNOSIS: 14:26:52 Registers: info registers vcpu 0 CPU#0 RAX=1ffffffff34ba760 RBX=00000000000003fd RCX=0000000000000000 RDX=00000000000003fd RSI=0000000000000000 RDI=0000000000000020 RBP=ffffffff9a5d3ef0 RSP=ffffc90006ce6af0 R8 =ffff888034cd8237 R9 =1ffff1100699b046 R10=dffffc0000000000 R11=ffffffff85417a20 R12=dffffc0000000000 R13=0000000000000000 R14=ffffffff9a5d3c60 R15=0000000000000000 RIP=ffffffff85417a97 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00007fdcf5d01740 ffffffff 00c00000 GS =0000 ffff88808ca5b000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000559212d60138 CR3=00000000336ef000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=000000000000002b Opmask01=0000000020003fff Opmask02=00000000bfffbfff Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffc6e8c88c0 00007ffc6e8d8c30 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000559b6690ff24 0000559b6690fed0 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffc6e8c88d8 00007ffc6e8d8c30 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fdcf5d43ef0 00000000000015a2 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000000015a2 00007ffc6e8c88d8 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000003 ffffffffffffff88 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 70002f74656e2f73 73616c632f737973 2f002f74656e2f73 79732f636f72702f ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6d6f726620796c64 657463657078656e 7520646574697865 2073257325732500 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 484a5743055c4941 40514640555d404b 50054140514c5d40 0556005600560000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 040e12b900000000 000080fe00010014 00000007fd80400a fb642b74699c63ac ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000008000080008 0000170a0000170a ffffffffffffffff 0006001427d6e0d8 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 5330a65b00000000 000080fe00010014 00000008fd80400a fb642b74699c63ac ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0002001400000048 0000008000080008 0000170200001702 ffffffffffffffff ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0006001413930f10 040e12b900000000 000080fe00010014 00000007fd80400a ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 bfbfbfbfbfbfbfbf bfbfbfbfbfbfbfbf bfbfbfbfbfbfbfbf bfbff52532232d20 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 262821df2e2e33df 3228df3232202b22 df312e232d2435bf 2324353124322431 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4141414141414141 4141414141414141 4141414141414141 4141414141414141 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2020202020202020 2020202020202020 2020202020202020 2020202020202020 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000