no interfaces have a carrier
[ 34.733885][ T3840] 8021q: adding VLAN 0 to HW filter on device bond0
[ 34.743492][ T3840] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting crond: OK
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.1.142' (ED25519) to the list of known hosts.
syzkaller login: [ 57.637725][ T3046] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 57.652685][ T3046] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 57.662332][ T402] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 57.674358][ T3046] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
executing program
[ 57.682440][ T3046] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 57.691060][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 57.713812][ T4169] loop0: detected capacity change from 0 to 128
[ 57.771267][ T4169] VFS: Found a Xenix FS (block size = 1024) on device loop0
[ 57.780536][ T4169] ==================================================================
[ 57.788724][ T4169] BUG: KASAN: use-after-free in sysv_new_inode+0x10b4/0x1240
[ 57.796149][ T4169] Read of size 2 at addr ffff88800ea351ce by task syz-executor101/4169
[ 57.804397][ T4169]
[ 57.806750][ T4169] CPU: 0 PID: 4169 Comm: syz-executor101 Not tainted 5.15.182-syzkaller #0
[ 57.815345][ T4169] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
[ 57.825415][ T4169] Call Trace:
[ 57.828687][ T4169]
[ 57.831615][ T4169] dump_stack_lvl+0x168/0x230
[ 57.836300][ T4169] ? show_regs_print_info+0x20/0x20
[ 57.841497][ T4169] ? load_image+0x3b0/0x3b0
[ 57.845991][ T4169] ? _raw_spin_lock_irqsave+0xb0/0xf0
[ 57.851363][ T4169] ? mutex_lock_io_nested+0x60/0x60
[ 57.856565][ T4169] print_address_description+0x60/0x2d0
[ 57.862123][ T4169] ? sysv_new_inode+0x10b4/0x1240
[ 57.867139][ T4169] kasan_report+0xdf/0x130
[ 57.871550][ T4169] ? sysv_new_inode+0x10b4/0x1240
[ 57.876576][ T4169] sysv_new_inode+0x10b4/0x1240
[ 57.881424][ T4169] ? __d_add+0x4b4/0x7f0
[ 57.885669][ T4169] ? __rwlock_init+0x140/0x140
[ 57.890424][ T4169] ? sysv_find_entry+0x554/0x5e0
[ 57.895354][ T4169] ? sysv_free_inode+0x7e0/0x7e0
[ 57.900472][ T4169] sysv_mknod+0x4a/0xd0
[ 57.904621][ T4169] ? sysv_lookup+0xe0/0xe0
[ 57.909044][ T4169] path_openat+0x11e1/0x2f30
[ 57.913764][ T4169] ? do_filp_open+0x3e0/0x3e0
[ 57.918447][ T4169] do_filp_open+0x1b3/0x3e0
[ 57.922948][ T4169] ? vfs_tmpfile+0x300/0x300
[ 57.927546][ T4169] ? _raw_spin_unlock+0x24/0x40
[ 57.932390][ T4169] ? alloc_fd+0x598/0x630
[ 57.936740][ T4169] do_sys_openat2+0x142/0x4a0
[ 57.941411][ T4169] ? __lock_acquire+0x7c60/0x7c60
[ 57.946432][ T4169] ? do_sys_open+0xe0/0xe0
[ 57.950837][ T4169] ? lockdep_hardirqs_on_prepare+0x3fc/0x760
[ 57.956812][ T4169] ? lock_chain_count+0x20/0x20
[ 57.961675][ T4169] ? vtime_user_exit+0x2dc/0x400
[ 57.966800][ T4169] __x64_sys_openat+0x135/0x160
[ 57.971646][ T4169] do_syscall_64+0x4c/0xa0
[ 57.976059][ T4169] ? clear_bhb_loop+0x15/0x70
[ 57.980724][ T4169] ? clear_bhb_loop+0x15/0x70
[ 57.985394][ T4169] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 57.991283][ T4169] RIP: 0033:0x7ff64e1afee9
[ 57.995690][ T4169] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 71 1d 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[ 58.015615][ T4169] RSP: 002b:00007ffd790b6568 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 58.024029][ T4169] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007ff64e1afee9
[ 58.031992][ T4169] RDX: 000000000000275a RSI: 0000200000000080 RDI: 00000000ffffff9c
[ 58.039957][ T4169] RBP: 00007ff64e1fd2b7 R08: 0000000000009e80 R09: 00007ff64e1fd2e7
[ 58.048014][ T4169] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff64e1fd238
[ 58.055980][ T4169] R13: 0000000000000003 R14: 0000000000050012 R15: 000000000000000d
[ 58.063970][ T4169]
[ 58.066991][ T4169]
[ 58.069302][ T4169] The buggy address belongs to the page:
[ 58.074916][ T4169] page:ffffea00003a8d40 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0xea35
[ 58.085061][ T4169] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 58.092169][ T4169] raw: 00fff00000000000 ffffea00003a8d08 ffffea000170a548 0000000000000000
[ 58.100739][ T4169] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
[ 58.109304][ T4169] page dumped because: kasan: bad access detected
[ 58.115702][ T4169] page_owner tracks the page as freed
[ 58.121053][ T4169] page last allocated via order 0, migratetype Movable, gfp_mask 0x1100cca(GFP_HIGHUSER_MOVABLE), pid 4162, ts 51864837987, free_ts 51992199649
[ 58.135617][ T4169] get_page_from_freelist+0x1b77/0x1c60
[ 58.141162][ T4169] __alloc_pages+0x1e1/0x470
[ 58.145763][ T4169] alloc_pages_vma+0x393/0x7c0
[ 58.150612][ T4169] handle_mm_fault+0x1b98/0x43c0
[ 58.155540][ T4169] do_user_addr_fault+0x489/0xc80
[ 58.160560][ T4169] exc_page_fault+0x60/0x100
[ 58.165146][ T4169] asm_exc_page_fault+0x22/0x30
[ 58.169988][ T4169] page last free stack trace:
[ 58.174644][ T4169] free_unref_page_prepare+0x637/0x6c0
[ 58.180091][ T4169] free_unref_page_list+0x122/0x7e0
[ 58.185280][ T4169] release_pages+0x184b/0x1bb0
[ 58.190033][ T4169] tlb_finish_mmu+0x164/0x2e0
[ 58.194695][ T4169] exit_mmap+0x3a6/0x5f0
[ 58.198934][ T4169] __mmput+0x115/0x3b0
[ 58.202986][ T4169] exit_mm+0x567/0x6c0
[ 58.207050][ T4169] do_exit+0x599/0x20a0
[ 58.211207][ T4169] do_group_exit+0x12e/0x300
[ 58.215797][ T4169] __x64_sys_exit_group+0x3b/0x40
[ 58.220811][ T4169] do_syscall_64+0x4c/0xa0
[ 58.225220][ T4169] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 58.231109][ T4169]
[ 58.233435][ T4169] Memory state around the buggy address:
[ 58.239066][ T4169] ffff88800ea35080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 58.247116][ T4169] ffff88800ea35100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 58.255167][ T4169] >ffff88800ea35180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 58.263215][ T4169] ^
[ 58.269614][ T4169] ffff88800ea35200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 58.277674][ T4169] ffff88800ea35280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 58.285723][ T4169] ==================================================================
[ 58.293765][ T4169] Disabling lock debugging due to kernel taint
[ 58.300631][ T4169] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 58.307837][ T4169] CPU: 0 PID: 4169 Comm: syz-executor101 Tainted: G B 5.15.182-syzkaller #0
[ 58.317801][ T4169] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
[ 58.327951][ T4169] Call Trace:
[ 58.331219][ T4169]
[ 58.334139][ T4169] dump_stack_lvl+0x168/0x230
[ 58.338917][ T4169] ? show_regs_print_info+0x20/0x20
[ 58.344201][ T4169] ? load_image+0x3b0/0x3b0
[ 58.348696][ T4169] panic+0x2c9/0x7f0
[ 58.352580][ T4169] ? bpf_jit_dump+0xd0/0xd0
[ 58.357074][ T4169] ? _raw_spin_unlock_irqrestore+0xf6/0x100
[ 58.362957][ T4169] ? _raw_spin_unlock+0x40/0x40
[ 58.367866][ T4169] ? sysv_new_inode+0x10b4/0x1240
[ 58.372882][ T4169] check_panic_on_warn+0x80/0xa0
[ 58.377809][ T4169] ? sysv_new_inode+0x10b4/0x1240
[ 58.382816][ T4169] end_report+0x6d/0xf0
[ 58.386958][ T4169] kasan_report+0x102/0x130
[ 58.391451][ T4169] ? sysv_new_inode+0x10b4/0x1240
[ 58.396486][ T4169] sysv_new_inode+0x10b4/0x1240
[ 58.401426][ T4169] ? __d_add+0x4b4/0x7f0
[ 58.405667][ T4169] ? __rwlock_init+0x140/0x140
[ 58.410549][ T4169] ? sysv_find_entry+0x554/0x5e0
[ 58.415510][ T4169] ? sysv_free_inode+0x7e0/0x7e0
[ 58.420457][ T4169] sysv_mknod+0x4a/0xd0
[ 58.424775][ T4169] ? sysv_lookup+0xe0/0xe0
[ 58.429178][ T4169] path_openat+0x11e1/0x2f30
[ 58.433763][ T4169] ? do_filp_open+0x3e0/0x3e0
[ 58.438432][ T4169] do_filp_open+0x1b3/0x3e0
[ 58.442925][ T4169] ? vfs_tmpfile+0x300/0x300
[ 58.447514][ T4169] ? _raw_spin_unlock+0x24/0x40
[ 58.452358][ T4169] ? alloc_fd+0x598/0x630
[ 58.456675][ T4169] do_sys_openat2+0x142/0x4a0
[ 58.461341][ T4169] ? __lock_acquire+0x7c60/0x7c60
[ 58.466377][ T4169] ? do_sys_open+0xe0/0xe0
[ 58.470798][ T4169] ? lockdep_hardirqs_on_prepare+0x3fc/0x760
[ 58.476771][ T4169] ? lock_chain_count+0x20/0x20
[ 58.481624][ T4169] ? vtime_user_exit+0x2dc/0x400
[ 58.486550][ T4169] __x64_sys_openat+0x135/0x160
[ 58.491390][ T4169] do_syscall_64+0x4c/0xa0
[ 58.495796][ T4169] ? clear_bhb_loop+0x15/0x70
[ 58.500459][ T4169] ? clear_bhb_loop+0x15/0x70
[ 58.505121][ T4169] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 58.511001][ T4169] RIP: 0033:0x7ff64e1afee9
[ 58.515412][ T4169] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 71 1d 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[ 58.535086][ T4169] RSP: 002b:00007ffd790b6568 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 58.543484][ T4169] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007ff64e1afee9
[ 58.551440][ T4169] RDX: 000000000000275a RSI: 0000200000000080 RDI: 00000000ffffff9c
[ 58.559396][ T4169] RBP: 00007ff64e1fd2b7 R08: 0000000000009e80 R09: 00007ff64e1fd2e7
[ 58.567356][ T4169] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff64e1fd238
[ 58.575317][ T4169] R13: 0000000000000003 R14: 0000000000050012 R15: 000000000000000d
[ 58.583285][ T4169]
[ 58.586586][ T4169] Kernel Offset: disabled
[ 58.590905][ T4169] Rebooting in 86400 seconds..