syzkaller login: [ 91.949243][ T1351] cfg80211: failed to load regulatory.db Warning: Permanently added '[localhost]:1789' (ED25519) to the list of known hosts. 2025/08/09 23:15:55 ignoring optional flag "sandboxArg"="0" 2025/08/09 23:15:57 parsed 1 programs [ 120.497291][ T5371] cgroup: Unknown subsys name 'net' [ 120.574596][ T5371] cgroup: Unknown subsys name 'cpuset' [ 120.581319][ T5371] cgroup: Unknown subsys name 'rlimit' [ 122.357836][ T5371] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 125.996747][ T1152] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 126.001143][ T1152] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 126.037349][ T31] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 126.040811][ T31] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 126.084808][ T5385] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 128.605815][ T5422] chnl_net:caif_netlink_parms(): no params data found [ 128.671771][ T5422] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.675855][ T5422] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.679605][ T5422] bridge_slave_0: entered allmulticast mode [ 128.684000][ T5422] bridge_slave_0: entered promiscuous mode [ 128.690237][ T5422] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.693334][ T5422] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.696426][ T5422] bridge_slave_1: entered allmulticast mode [ 128.700939][ T5422] bridge_slave_1: entered promiscuous mode [ 128.726476][ T5422] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 128.734153][ T5422] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 128.751713][ T5422] team0: Port device team_slave_0 added [ 128.756186][ T5422] team0: Port device team_slave_1 added [ 128.781043][ T5422] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 128.784013][ T5422] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 128.796432][ T5422] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 128.803619][ T5422] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 128.806618][ T5422] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 128.820122][ T5422] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 128.855528][ T5422] hsr_slave_0: entered promiscuous mode [ 128.859867][ T5422] hsr_slave_1: entered promiscuous mode [ 129.016364][ T5422] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 129.027352][ T5422] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 129.035015][ T5422] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 129.047053][ T5422] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 129.078099][ T5422] bridge0: port 2(bridge_slave_1) entered blocking state [ 129.081158][ T5422] bridge0: port 2(bridge_slave_1) entered forwarding state [ 129.085312][ T5422] bridge0: port 1(bridge_slave_0) entered blocking state [ 129.088428][ T5422] bridge0: port 1(bridge_slave_0) entered forwarding state [ 129.111784][ T1152] bridge0: port 1(bridge_slave_0) entered disabled state [ 129.116372][ T1152] bridge0: port 2(bridge_slave_1) entered disabled state [ 129.162302][ T5422] 8021q: adding VLAN 0 to HW filter on device bond0 [ 129.183544][ T5422] 8021q: adding VLAN 0 to HW filter on device team0 [ 129.193864][ T1152] bridge0: port 1(bridge_slave_0) entered blocking state [ 129.198633][ T1152] bridge0: port 1(bridge_slave_0) entered forwarding state [ 129.212523][ T1152] bridge0: port 2(bridge_slave_1) entered blocking state [ 129.215719][ T1152] bridge0: port 2(bridge_slave_1) entered forwarding state [ 129.407504][ T5422] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 129.448200][ T5422] veth0_vlan: entered promiscuous mode [ 129.457397][ T5422] veth1_vlan: entered promiscuous mode [ 129.489317][ T5422] veth0_macvtap: entered promiscuous mode [ 129.495467][ T5422] veth1_macvtap: entered promiscuous mode [ 129.516123][ T5422] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 129.525756][ T5422] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 129.540765][ T1037] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.552868][ T1037] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.566768][ T1037] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.584790][ T1037] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.712776][ T1037] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 129.766032][ T1037] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 129.820836][ T1037] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 129.905975][ T1037] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 130.759861][ T45] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 130.764406][ T45] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 130.768055][ T45] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 130.772119][ T45] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 130.776064][ T45] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 2025/08/09 23:16:10 executed programs: 0 [ 131.850388][ T4706] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 131.854248][ T4706] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 131.857613][ T4706] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 131.879798][ T4706] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 131.884862][ T4706] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 132.243421][ T5480] chnl_net:caif_netlink_parms(): no params data found [ 132.398822][ T1037] bridge_slave_1: left allmulticast mode [ 132.401398][ T1037] bridge_slave_1: left promiscuous mode [ 132.404515][ T1037] bridge0: port 2(bridge_slave_1) entered disabled state [ 132.462162][ T1037] bridge_slave_0: left allmulticast mode [ 132.465126][ T1037] bridge_slave_0: left promiscuous mode [ 132.480339][ T1037] bridge0: port 1(bridge_slave_0) entered disabled state [ 132.873620][ T1037] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 132.881584][ T1037] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 132.886370][ T1037] bond0 (unregistering): Released all slaves [ 133.004671][ T1037] hsr_slave_0: left promiscuous mode [ 133.007593][ T1037] hsr_slave_1: left promiscuous mode [ 133.011565][ T1037] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 133.016356][ T1037] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 133.023756][ T1037] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 133.026804][ T1037] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 133.040818][ T1037] veth1_macvtap: left promiscuous mode [ 133.045519][ T1037] veth0_macvtap: left promiscuous mode [ 133.049649][ T1037] veth1_vlan: left promiscuous mode [ 133.052044][ T1037] veth0_vlan: left promiscuous mode [ 133.356799][ T1037] team0 (unregistering): Port device team_slave_1 removed [ 133.382315][ T1037] team0 (unregistering): Port device team_slave_0 removed [ 133.819466][ T5480] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.822422][ T5480] bridge0: port 1(bridge_slave_0) entered disabled state [ 133.825381][ T5480] bridge_slave_0: entered allmulticast mode [ 133.858546][ T5480] bridge_slave_0: entered promiscuous mode [ 133.871450][ T5480] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.875070][ T5480] bridge0: port 2(bridge_slave_1) entered disabled state [ 133.902258][ T5480] bridge_slave_1: entered allmulticast mode [ 133.919731][ T5480] bridge_slave_1: entered promiscuous mode [ 133.941707][ T4706] Bluetooth: hci0: command tx timeout [ 134.004633][ T5480] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 134.026800][ T5480] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 134.127365][ T5480] team0: Port device team_slave_0 added [ 134.159704][ T5480] team0: Port device team_slave_1 added [ 134.645436][ T5480] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 134.649902][ T5480] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 134.681271][ T5480] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 134.758652][ T5480] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 134.762396][ T5480] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 134.794515][ T5480] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 134.937124][ T5480] hsr_slave_0: entered promiscuous mode [ 134.955253][ T5480] hsr_slave_1: entered promiscuous mode [ 135.553823][ T5480] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 135.571332][ T5480] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 135.582735][ T5480] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 135.601370][ T5480] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 135.751985][ T5480] 8021q: adding VLAN 0 to HW filter on device bond0 [ 135.777667][ T5480] 8021q: adding VLAN 0 to HW filter on device team0 [ 135.813640][ T1037] bridge0: port 1(bridge_slave_0) entered blocking state [ 135.816589][ T1037] bridge0: port 1(bridge_slave_0) entered forwarding state [ 135.833447][ T1037] bridge0: port 2(bridge_slave_1) entered blocking state [ 135.837195][ T1037] bridge0: port 2(bridge_slave_1) entered forwarding state [ 136.018532][ T4706] Bluetooth: hci0: command tx timeout [ 136.220961][ T5480] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 136.294974][ T5480] veth0_vlan: entered promiscuous mode [ 136.313958][ T5480] veth1_vlan: entered promiscuous mode [ 136.365228][ T5480] veth0_macvtap: entered promiscuous mode [ 136.387997][ T5480] veth1_macvtap: entered promiscuous mode [ 136.420592][ T5480] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 136.443246][ T5480] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 136.462953][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 136.467039][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 136.476693][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 136.489116][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 136.545301][ T31] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 136.560457][ T31] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 136.585294][ T1152] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 136.590990][ T1152] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 136.667947][ T5533] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 136.675861][ T5533] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 136.682809][ T5533] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 136.688141][ T5533] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 136.702540][ T5439] wlan1: authenticate with 08:02:11:00:00:00 (local address=08:02:11:00:00:01) [ 136.706163][ T5439] wlan1: send auth to 08:02:11:00:00:00 (try 1/3) [ 136.820029][ T1152] wlan1: send auth to 08:02:11:00:00:00 (try 2/3) [ 136.929164][ T1037] wlan1: send auth to 08:02:11:00:00:00 (try 3/3) [ 137.039239][ T1152] wlan1: authentication with 08:02:11:00:00:00 timed out [ 137.226129][ T5534] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 137.237237][ T5534] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium 2025/08/09 23:16:16 executed programs: 3 [ 137.247736][ T5534] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 137.253941][ T5534] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 137.259963][ T5439] wlan1: authenticate with 08:02:11:00:00:00 (local address=08:02:11:00:00:01) [ 137.263412][ T5439] wlan1: send auth to 08:02:11:00:00:00 (try 1/3) [ 137.802727][ T5535] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 137.819194][ T1152] wlan1: authenticated [ 137.821722][ T5535] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 137.830141][ T5535] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 137.836191][ T5535] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 137.841006][ T12] wlan1: associate with 08:02:11:00:00:00 (try 1/3) [ 138.025412][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 138.030904][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 138.098529][ T4706] Bluetooth: hci0: command tx timeout [ 138.374469][ T5536] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 138.382763][ T5536] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 138.387786][ T1152] wlan1: RX AssocResp from 08:02:11:00:00:00 (capab=0x1 status=0 aid=1) [ 138.394113][ T5536] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 138.399709][ T1152] wlan1: associated [ 138.405366][ T5536] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 138.939956][ T5537] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 138.945209][ T5537] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 138.952988][ T5537] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 138.959161][ T1152] wlan1: AP 08:02:11:00:00:00 tries to chanswitch to same channel, ignore [ 138.964525][ T5537] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 139.501316][ T5538] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 139.506547][ T5538] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 139.514903][ T5538] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 139.523239][ T5538] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 140.048776][ T5539] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 140.060965][ T5539] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 140.066035][ T5539] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 140.073181][ T5539] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 140.179345][ T4706] Bluetooth: hci0: command tx timeout [ 140.603270][ T1037] ================================================================== [ 140.607606][ T1037] BUG: KASAN: slab-use-after-free in cmp_bss+0xd4d/0xe80 [ 140.611604][ T1037] Read of size 4 at addr ffff88803f558b98 by task kworker/u4:5/1037 [ 140.616534][ T1037] [ 140.617664][ T1037] CPU: 0 UID: 0 PID: 1037 Comm: kworker/u4:5 Not tainted 6.16.0-syzkaller-12250-gc30a13538d9f #0 PREEMPT(full) [ 140.617681][ T1037] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 140.617689][ T1037] Workqueue: events_unbound cfg80211_wiphy_work [ 140.617709][ T1037] Call Trace: [ 140.617717][ T1037] [ 140.617723][ T1037] dump_stack_lvl+0x189/0x250 [ 140.617737][ T1037] ? __kasan_check_byte+0x12/0x40 [ 140.617806][ T1037] ? __pfx_dump_stack_lvl+0x10/0x10 [ 140.617816][ T1037] ? lock_release+0x4b/0x3e0 [ 140.617832][ T1037] ? __virt_addr_valid+0x4a5/0x5c0 [ 140.617845][ T1037] print_report+0xca/0x240 [ 140.617855][ T1037] ? cmp_bss+0xd4d/0xe80 [ 140.617863][ T1037] kasan_report+0x118/0x150 [ 140.617874][ T1037] ? ret_from_fork_asm+0x1a/0x30 [ 140.617886][ T1037] ? cmp_bss+0xd4d/0xe80 [ 140.617897][ T1037] cmp_bss+0xd4d/0xe80 [ 140.617907][ T1037] ? __lock_acquire+0xab9/0xd20 [ 140.617920][ T1037] __cfg80211_bss_update+0xdb/0x2120 [ 140.617931][ T1037] ? do_raw_spin_lock+0x121/0x290 [ 140.617943][ T1037] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 140.617954][ T1037] ? trace_kmalloc+0x1f/0xd0 [ 140.617966][ T1037] ? cfg80211_inform_single_bss_data+0xb90/0x1ac0 [ 140.617977][ T1037] cfg80211_inform_single_bss_data+0xba9/0x1ac0 [ 140.617986][ T1037] ? __pfx_hlock_conflict+0x10/0x10 [ 140.617997][ T1037] ? __pfx_cfg80211_inform_single_bss_data+0x10/0x10 [ 140.618013][ T1037] ? cfg80211_inform_bss_data+0x1e8/0x3b30 [ 140.618024][ T1037] cfg80211_inform_bss_data+0x1fb/0x3b30 [ 140.618038][ T1037] ? __lock_acquire+0xab9/0xd20 [ 140.618051][ T1037] ? __pfx_cfg80211_inform_bss_data+0x10/0x10 [ 140.618062][ T1037] ? __lock_acquire+0xab9/0xd20 [ 140.618079][ T1037] ? rcu_read_lock_sched_held+0x89/0x100 [ 140.618090][ T1037] ? __pfx_rcu_read_lock_sched_held+0x10/0x10 [ 140.618104][ T1037] cfg80211_inform_bss_frame_data+0x3d7/0x730 [ 140.618116][ T1037] ? ieee80211_bss_info_update+0x2dc/0x9e0 [ 140.618168][ T1037] ieee80211_bss_info_update+0x746/0x9e0 [ 140.618179][ T1037] ? __pfx_ieee80211_bss_info_update+0x10/0x10 [ 140.618192][ T1037] ? ieee80211_get_channel_khz+0x15b/0x8a0 [ 140.618207][ T1037] ieee80211_rx_bss_info+0x176/0x280 [ 140.618219][ T1037] ieee80211_sta_rx_queued_mgmt+0x1294/0x4470 [ 140.618238][ T1037] ? __pfx_ieee80211_sta_rx_queued_mgmt+0x10/0x10 [ 140.618251][ T1037] ? unwind_next_frame+0xa5/0x2390 [ 140.618263][ T1037] ? unwind_next_frame+0xa5/0x2390 [ 140.618273][ T1037] ? unwind_next_frame+0x19ae/0x2390 [ 140.618283][ T1037] ? unwind_next_frame+0xa5/0x2390 [ 140.618293][ T1037] ? ret_from_fork_asm+0x1a/0x30 [ 140.618307][ T1037] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 140.618319][ T1037] ? arch_stack_walk+0x11c/0x150 [ 140.618332][ T1037] ? ret_from_fork_asm+0x1a/0x30 [ 140.618345][ T1037] ? __lock_acquire+0xab9/0xd20 [ 140.618360][ T1037] ? __lock_acquire+0xab9/0xd20 [ 140.618375][ T1037] ? __lock_acquire+0xab9/0xd20 [ 140.618392][ T1037] ? kcov_remote_start+0x18e/0x7f0 [ 140.618407][ T1037] ieee80211_iface_work+0x652/0x12d0 [ 140.618421][ T1037] cfg80211_wiphy_work+0x2b8/0x470 [ 140.618434][ T1037] ? process_scheduled_works+0x9ef/0x17b0 [ 140.618444][ T1037] process_scheduled_works+0xade/0x17b0 [ 140.618459][ T1037] ? __pfx_process_scheduled_works+0x10/0x10 [ 140.618479][ T1037] worker_thread+0x8a0/0xda0 [ 140.618494][ T1037] kthread+0x70e/0x8a0 [ 140.618507][ T1037] ? __pfx_worker_thread+0x10/0x10 [ 140.618516][ T1037] ? __pfx_kthread+0x10/0x10 [ 140.618528][ T1037] ? _raw_spin_unlock_irq+0x23/0x50 [ 140.618540][ T1037] ? lockdep_hardirqs_on+0x9c/0x150 [ 140.618551][ T1037] ? __pfx_kthread+0x10/0x10 [ 140.618562][ T1037] ret_from_fork+0x3fc/0x770 [ 140.618574][ T1037] ? __pfx_ret_from_fork+0x10/0x10 [ 140.618585][ T1037] ? __pfx_kthread+0x10/0x10 [ 140.618596][ T1037] ret_from_fork_asm+0x1a/0x30 [ 140.618611][ T1037] [ 140.618615][ T1037] [ 140.781189][ T1037] Allocated by task 1152: [ 140.783019][ T1037] kasan_save_track+0x3e/0x80 [ 140.785571][ T1037] __kasan_kmalloc+0x93/0xb0 [ 140.787637][ T1037] __kmalloc_noprof+0x27a/0x4f0 [ 140.789747][ T1037] cfg80211_inform_single_bss_data+0x905/0x1ac0 [ 140.792323][ T1037] cfg80211_inform_bss_data+0x1fb/0x3b30 [ 140.794617][ T1037] cfg80211_inform_bss_frame_data+0x3d7/0x730 [ 140.797024][ T1037] ieee80211_bss_info_update+0x746/0x9e0 [ 140.799463][ T1037] ieee80211_rx_bss_info+0x176/0x280 [ 140.801442][ T1037] ieee80211_rx_mgmt_beacon+0x197d/0x2cd0 [ 140.803788][ T1037] ieee80211_sta_rx_queued_mgmt+0x4ed/0x4470 [ 140.806208][ T1037] ieee80211_iface_work+0x652/0x12d0 [ 140.808536][ T1037] cfg80211_wiphy_work+0x2b8/0x470 [ 140.810725][ T1037] process_scheduled_works+0xade/0x17b0 [ 140.812720][ T1037] worker_thread+0x8a0/0xda0 [ 140.814659][ T1037] kthread+0x70e/0x8a0 [ 140.816354][ T1037] ret_from_fork+0x3fc/0x770 [ 140.818283][ T1037] ret_from_fork_asm+0x1a/0x30 [ 140.820154][ T1037] [ 140.821180][ T1037] Freed by task 1037: [ 140.823074][ T1037] kasan_save_track+0x3e/0x80 [ 140.825595][ T1037] kasan_save_free_info+0x46/0x50 [ 140.828338][ T1037] __kasan_slab_free+0x5b/0x80 [ 140.830596][ T1037] kmem_cache_free_bulk+0x2d1/0x520 [ 140.832988][ T1037] kvfree_rcu_bulk+0xe5/0x1f0 [ 140.835096][ T1037] kfree_rcu_monitor+0x211/0x2a0 [ 140.837304][ T1037] process_scheduled_works+0xade/0x17b0 [ 140.839867][ T1037] worker_thread+0x8a0/0xda0 [ 140.842040][ T1037] kthread+0x70e/0x8a0 [ 140.843983][ T1037] ret_from_fork+0x3fc/0x770 [ 140.846168][ T1037] ret_from_fork_asm+0x1a/0x30 [ 140.848450][ T1037] [ 140.849579][ T1037] Last potentially related work creation: [ 140.852015][ T1037] kasan_save_stack+0x3e/0x60 [ 140.854028][ T1037] kasan_record_aux_stack+0xbd/0xd0 [ 140.856186][ T1037] kvfree_call_rcu+0xbb/0x410 [ 140.858106][ T1037] cfg80211_update_known_bss+0x454/0x1330 [ 140.860504][ T1037] cfg80211_update_assoc_bss_entry+0x4ba/0x6a0 [ 140.863190][ T1037] cfg80211_ch_switch_notify+0x3c1/0x780 [ 140.865693][ T1037] ieee80211_sta_process_chanswitch+0xad4/0x2870 [ 140.868785][ T1037] ieee80211_rx_mgmt_beacon+0x19c7/0x2cd0 [ 140.871270][ T1037] ieee80211_sta_rx_queued_mgmt+0x4ed/0x4470 [ 140.873834][ T1037] ieee80211_iface_work+0x652/0x12d0 [ 140.876052][ T1037] cfg80211_wiphy_work+0x2b8/0x470 [ 140.878519][ T1037] process_scheduled_works+0xade/0x17b0 [ 140.881039][ T1037] worker_thread+0x8a0/0xda0 [ 140.883170][ T1037] kthread+0x70e/0x8a0 [ 140.885025][ T1037] ret_from_fork+0x3fc/0x770 [ 140.887004][ T1037] ret_from_fork_asm+0x1a/0x30 [ 140.888980][ T1037] [ 140.889943][ T1037] The buggy address belongs to the object at ffff88803f558b80 [ 140.889943][ T1037] which belongs to the cache kmalloc-96 of size 96 [ 140.895609][ T1037] The buggy address is located 24 bytes inside of [ 140.895609][ T1037] freed 96-byte region [ffff88803f558b80, ffff88803f558be0) [ 140.902188][ T1037] [ 140.903584][ T1037] The buggy address belongs to the physical page: [ 140.907051][ T1037] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3f558 [ 140.910795][ T1037] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 140.913985][ T1037] page_type: f5(slab) [ 140.915901][ T1037] raw: 04fff00000000000 ffff88801a441280 ffffea0000462300 dead000000000004 [ 140.920222][ T1037] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000 [ 140.924094][ T1037] page dumped because: kasan: bad access detected [ 140.927077][ T1037] page_owner tracks the page as allocated [ 140.929978][ T1037] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1152, tgid 1152 (kworker/u4:10), ts 130099219535, free_ts 128326711917 [ 140.938128][ T1037] post_alloc_hook+0x240/0x2a0 [ 140.940258][ T1037] get_page_from_freelist+0x21e4/0x22c0 [ 140.942743][ T1037] __alloc_frozen_pages_noprof+0x181/0x370 [ 140.945057][ T1037] alloc_pages_mpol+0x232/0x4a0 [ 140.947175][ T1037] allocate_slab+0x8a/0x370 [ 140.949254][ T1037] ___slab_alloc+0xbeb/0x1410 [ 140.951369][ T1037] __kmalloc_cache_noprof+0x296/0x3d0 [ 140.953840][ T1037] dst_cow_metrics_generic+0x56/0x1c0 [ 140.956083][ T1037] icmp6_dst_alloc+0x261/0x420 [ 140.958125][ T1037] ndisc_send_skb+0x41f/0x1440 [ 140.960309][ T1037] ndisc_send_ns+0xcb/0x150 [ 140.962481][ T1037] addrconf_dad_work+0xaae/0x14b0 [ 140.964818][ T1037] process_scheduled_works+0xade/0x17b0 [ 140.967000][ T1037] worker_thread+0x8a0/0xda0 [ 140.969155][ T1037] kthread+0x70e/0x8a0 [ 140.970811][ T1037] ret_from_fork+0x3fc/0x770 [ 140.972734][ T1037] page last free pid 5417 tgid 5417 stack trace: [ 140.975281][ T1037] __free_frozen_pages+0xbc4/0xd30 [ 140.977278][ T1037] vfree+0x25a/0x400 [ 140.978890][ T1037] kcov_close+0x28/0x50 [ 140.980728][ T1037] __fput+0x449/0xa70 [ 140.982652][ T1037] task_work_run+0x1d4/0x260 [ 140.984671][ T1037] do_exit+0x6b5/0x2300 [ 140.986561][ T1037] do_group_exit+0x21c/0x2d0 [ 140.988603][ T1037] get_signal+0x1286/0x1340 [ 140.990622][ T1037] arch_do_signal_or_restart+0x9a/0x750 [ 140.993104][ T1037] exit_to_user_mode_loop+0x75/0x110 [ 140.995400][ T1037] do_syscall_64+0x2bd/0x3b0 [ 140.998100][ T1037] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 141.000974][ T1037] [ 141.002068][ T1037] Memory state around the buggy address: [ 141.004505][ T1037] ffff88803f558a80: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 141.007975][ T1037] ffff88803f558b00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 141.011435][ T1037] >ffff88803f558b80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 141.014755][ T1037] ^ [ 141.017055][ T1037] ffff88803f558c00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 141.020577][ T1037] ffff88803f558c80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 141.024051][ T1037] ================================================================== [ 141.027567][ T1037] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 141.030616][ T1037] CPU: 0 UID: 0 PID: 1037 Comm: kworker/u4:5 Not tainted 6.16.0-syzkaller-12250-gc30a13538d9f #0 PREEMPT(full) [ 141.035699][ T1037] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 141.040511][ T1037] Workqueue: events_unbound cfg80211_wiphy_work [ 141.043428][ T1037] Call Trace: [ 141.044873][ T1037] [ 141.046024][ T1037] dump_stack_lvl+0x99/0x250 [ 141.047963][ T1037] ? __asan_memcpy+0x40/0x70 [ 141.050148][ T1037] ? __pfx_dump_stack_lvl+0x10/0x10 [ 141.052513][ T1037] ? __pfx__printk+0x10/0x10 [ 141.054399][ T1037] vpanic+0x281/0x750 [ 141.055958][ T1037] ? __pfx_vpanic+0x10/0x10 [ 141.058360][ T1037] ? irqentry_exit+0x74/0x90 [ 141.060519][ T1037] panic+0xb9/0xc0 [ 141.062101][ T1037] ? __pfx_panic+0x10/0x10 [ 141.064675][ T1037] ? _raw_spin_unlock_irqrestore+0xa8/0x110 [ 141.067728][ T1037] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 141.070307][ T1037] ? cmp_bss+0xd4d/0xe80 [ 141.071848][ T1037] check_panic_on_warn+0x89/0xb0 [ 141.073857][ T1037] ? cmp_bss+0xd4d/0xe80 [ 141.075789][ T1037] end_report+0x78/0x160 [ 141.077721][ T1037] kasan_report+0x129/0x150 [ 141.080091][ T1037] ? ret_from_fork_asm+0x1a/0x30 [ 141.082769][ T1037] ? cmp_bss+0xd4d/0xe80 [ 141.084550][ T1037] cmp_bss+0xd4d/0xe80 [ 141.086299][ T1037] ? __lock_acquire+0xab9/0xd20 [ 141.088409][ T1037] __cfg80211_bss_update+0xdb/0x2120 [ 141.090643][ T1037] ? do_raw_spin_lock+0x121/0x290 [ 141.092728][ T1037] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 141.094940][ T1037] ? trace_kmalloc+0x1f/0xd0 [ 141.096872][ T1037] ? cfg80211_inform_single_bss_data+0xb90/0x1ac0 [ 141.099775][ T1037] cfg80211_inform_single_bss_data+0xba9/0x1ac0 [ 141.102742][ T1037] ? __pfx_hlock_conflict+0x10/0x10 [ 141.104961][ T1037] ? __pfx_cfg80211_inform_single_bss_data+0x10/0x10 [ 141.107802][ T1037] ? cfg80211_inform_bss_data+0x1e8/0x3b30 [ 141.110496][ T1037] cfg80211_inform_bss_data+0x1fb/0x3b30 [ 141.113040][ T1037] ? __lock_acquire+0xab9/0xd20 [ 141.115156][ T1037] ? __pfx_cfg80211_inform_bss_data+0x10/0x10 [ 141.117784][ T1037] ? __lock_acquire+0xab9/0xd20 [ 141.120025][ T1037] ? rcu_read_lock_sched_held+0x89/0x100 [ 141.122543][ T1037] ? __pfx_rcu_read_lock_sched_held+0x10/0x10 [ 141.125063][ T1037] cfg80211_inform_bss_frame_data+0x3d7/0x730 [ 141.127682][ T1037] ? ieee80211_bss_info_update+0x2dc/0x9e0 [ 141.130335][ T1037] ieee80211_bss_info_update+0x746/0x9e0 [ 141.132750][ T1037] ? __pfx_ieee80211_bss_info_update+0x10/0x10 [ 141.135474][ T1037] ? ieee80211_get_channel_khz+0x15b/0x8a0 [ 141.138039][ T1037] ieee80211_rx_bss_info+0x176/0x280 [ 141.140209][ T1037] ieee80211_sta_rx_queued_mgmt+0x1294/0x4470 [ 141.142928][ T1037] ? __pfx_ieee80211_sta_rx_queued_mgmt+0x10/0x10 [ 141.145793][ T1037] ? unwind_next_frame+0xa5/0x2390 [ 141.147891][ T1037] ? unwind_next_frame+0xa5/0x2390 [ 141.150139][ T1037] ? unwind_next_frame+0x19ae/0x2390 [ 141.152242][ T1037] ? unwind_next_frame+0xa5/0x2390 [ 141.154639][ T1037] ? ret_from_fork_asm+0x1a/0x30 [ 141.157215][ T1037] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 141.159898][ T1037] ? arch_stack_walk+0x11c/0x150 [ 141.162204][ T1037] ? ret_from_fork_asm+0x1a/0x30 [ 141.164398][ T1037] ? __lock_acquire+0xab9/0xd20 [ 141.166691][ T1037] ? __lock_acquire+0xab9/0xd20 [ 141.168931][ T1037] ? __lock_acquire+0xab9/0xd20 [ 141.171154][ T1037] ? kcov_remote_start+0x18e/0x7f0 [ 141.173914][ T1037] ieee80211_iface_work+0x652/0x12d0 [ 141.176694][ T1037] cfg80211_wiphy_work+0x2b8/0x470 [ 141.178858][ T1037] ? process_scheduled_works+0x9ef/0x17b0 [ 141.181295][ T1037] process_scheduled_works+0xade/0x17b0 [ 141.183606][ T1037] ? __pfx_process_scheduled_works+0x10/0x10 [ 141.186187][ T1037] worker_thread+0x8a0/0xda0 [ 141.188337][ T1037] kthread+0x70e/0x8a0 [ 141.190211][ T1037] ? __pfx_worker_thread+0x10/0x10 [ 141.192503][ T1037] ? __pfx_kthread+0x10/0x10 [ 141.194639][ T1037] ? _raw_spin_unlock_irq+0x23/0x50 [ 141.196989][ T1037] ? lockdep_hardirqs_on+0x9c/0x150 [ 141.199107][ T1037] ? __pfx_kthread+0x10/0x10 [ 141.201202][ T1037] ret_from_fork+0x3fc/0x770 [ 141.203322][ T1037] ? __pfx_ret_from_fork+0x10/0x10 [ 141.205691][ T1037] ? __pfx_kthread+0x10/0x10 [ 141.207781][ T1037] ret_from_fork_asm+0x1a/0x30 [ 141.209860][ T1037] [ 141.211587][ T1037] Kernel Offset: disabled [ 141.213615][ T1037] Rebooting in 86400 seconds.. VM DIAGNOSIS: 23:16:19 Registers: info registers vcpu 0 CPU#0 RAX=1ffffffff33bf260 RBX=00000000000003fd RCX=0000000000000000 RDX=00000000000003fd RSI=0000000000000000 RDI=0000000000000020 RBP=ffffffff99df9a30 RSP=ffffc9000273e3f0 R8 =ffff888033c10237 R9 =1ffff11006782046 R10=dffffc0000000000 R11=ffffffff85508010 R12=dffffc0000000000 R13=0000000000000000 R14=ffffffff99df97a0 R15=0000000000000000 RIP=ffffffff85508087 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88808d211000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f9174774980 CR3=0000000043384000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000004000 Opmask01=0000000000000000 Opmask02=000000000000003f Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000316e616c77 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe60208226 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe60208226 00007ffe6020822c ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f9174812e46 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f9174812e53 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f9174812e4d ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f9174812e61 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f9174812ee7 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f9174812fc5 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000110208 0000001102080100 0011020800000050 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 8201010202020202 0206000001006400 0000000000000000 0000000011020800 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6f6c667265766f20 6772612061746164 000a747261745374 6f68000700080006 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4a49435740534a05 4257440544514441 000a515744515351 4a4d5655444b5300 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000