Warning: Permanently added '10.128.0.21' (ED25519) to the list of known hosts.
2026/04/12 06:33:38 parsed 1 programs
[ 70.497742][ T4188] cgroup: Unknown subsys name 'net'
[ 70.591146][ T4188] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 71.491291][ T1422] ieee802154 phy0 wpan0: encryption failed: -22
[ 71.497872][ T1422] ieee802154 phy1 wpan1: encryption failed: -22
[ 72.134682][ T4188] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS
[ 73.680334][ T4200] syz-executor (4200) used greatest stack depth: 20664 bytes left
[ 73.934145][ T389] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 73.942722][ T389] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 73.956191][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 73.975809][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 73.985078][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 73.995543][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 74.947239][ T4240] chnl_net:caif_netlink_parms(): no params data found
[ 75.020130][ T4240] bridge0: port 1(bridge_slave_0) entered blocking state
[ 75.028237][ T4240] bridge0: port 1(bridge_slave_0) entered disabled state
[ 75.036835][ T4240] device bridge_slave_0 entered promiscuous mode
[ 75.047581][ T4240] bridge0: port 2(bridge_slave_1) entered blocking state
[ 75.054779][ T4240] bridge0: port 2(bridge_slave_1) entered disabled state
[ 75.063251][ T4240] device bridge_slave_1 entered promiscuous mode
[ 75.090530][ T4240] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 75.102610][ T4240] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 75.133088][ T4240] team0: Port device team_slave_0 added
[ 75.141124][ T4240] team0: Port device team_slave_1 added
[ 75.165092][ T4240] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 75.172122][ T4240] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 75.198085][ T4240] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 75.211921][ T4240] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 75.219076][ T4240] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 75.245017][ T4240] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 75.284987][ T4240] device hsr_slave_0 entered promiscuous mode
[ 75.292093][ T4240] device hsr_slave_1 entered promiscuous mode
[ 75.443864][ T4240] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 75.458257][ T4240] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 75.469358][ T4240] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 75.482838][ T4240] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 75.516372][ T4240] bridge0: port 2(bridge_slave_1) entered blocking state
[ 75.523933][ T4240] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 75.532136][ T4240] bridge0: port 1(bridge_slave_0) entered blocking state
[ 75.539295][ T4240] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 75.604374][ T4240] 8021q: adding VLAN 0 to HW filter on device bond0
[ 75.624884][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 75.637628][ T154] bridge0: port 1(bridge_slave_0) entered disabled state
[ 75.646361][ T154] bridge0: port 2(bridge_slave_1) entered disabled state
[ 75.655322][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 75.670286][ T4240] 8021q: adding VLAN 0 to HW filter on device team0
[ 75.684255][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 75.694491][ T154] bridge0: port 1(bridge_slave_0) entered blocking state
[ 75.701793][ T154] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 75.718826][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 75.729242][ T1268] bridge0: port 2(bridge_slave_1) entered blocking state
[ 75.736485][ T1268] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 75.759755][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 75.771909][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 75.796816][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 75.806407][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 75.821878][ T4240] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 75.835499][ T4240] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 75.844745][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 75.991641][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 75.999295][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 76.015757][ T4240] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 76.042399][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 76.052643][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 76.084705][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 76.094920][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 76.120623][ T4240] device veth0_vlan entered promiscuous mode
[ 76.129064][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 76.138633][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 76.159659][ T4240] device veth1_vlan entered promiscuous mode
[ 76.196313][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 76.204864][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 76.213551][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 76.223163][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 76.236619][ T4240] device veth0_macvtap entered promiscuous mode
[ 76.246536][ T4240] device veth1_macvtap entered promiscuous mode
[ 76.263954][ T4240] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 76.272207][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 76.282051][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 76.291500][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 76.300479][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 76.313668][ T4240] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 76.321681][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 76.330685][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 76.342600][ T4240] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 76.352932][ T4240] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 76.361933][ T4240] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 76.371131][ T4240] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 76.477308][ T4240] syz-executor (4240) used greatest stack depth: 19952 bytes left
2026/04/12 06:33:48 executed programs: 0
[ 78.475868][ T4291] chnl_net:caif_netlink_parms(): no params data found
[ 78.546368][ T4291] bridge0: port 1(bridge_slave_0) entered blocking state
[ 78.555940][ T4291] bridge0: port 1(bridge_slave_0) entered disabled state
[ 78.564983][ T4291] device bridge_slave_0 entered promiscuous mode
[ 78.576668][ T4291] bridge0: port 2(bridge_slave_1) entered blocking state
[ 78.584538][ T4291] bridge0: port 2(bridge_slave_1) entered disabled state
[ 78.596382][ T4291] device bridge_slave_1 entered promiscuous mode
[ 78.622317][ T4291] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 78.635476][ T4291] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 78.664038][ T4291] team0: Port device team_slave_0 added
[ 78.672973][ T4291] team0: Port device team_slave_1 added
[ 78.695648][ T4291] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 78.702981][ T4291] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 78.731814][ T4291] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 78.744931][ T4291] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 78.752545][ T4291] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 78.781526][ T4291] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 78.816380][ T4291] device hsr_slave_0 entered promiscuous mode
[ 78.823674][ T4291] device hsr_slave_1 entered promiscuous mode
[ 78.830666][ T4291] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 78.838691][ T4291] Cannot create hsr debugfs directory
[ 78.933903][ T4291] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 80.367960][ T4304] Bluetooth: hci0: command 0x0409 tx timeout
[ 81.054906][ T4291] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 81.103032][ T4291] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 81.186515][ T4291] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 81.307307][ T4291] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 81.317065][ T4291] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 81.326154][ T4291] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 81.336146][ T4291] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 81.425798][ T4291] 8021q: adding VLAN 0 to HW filter on device bond0
[ 81.440371][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 81.448518][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 81.461119][ T4291] 8021q: adding VLAN 0 to HW filter on device team0
[ 81.489923][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 81.499232][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 81.508602][ T1268] bridge0: port 1(bridge_slave_0) entered blocking state
[ 81.515704][ T1268] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 81.544940][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 81.553829][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 81.563774][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 81.572657][ T1268] bridge0: port 2(bridge_slave_1) entered blocking state
[ 81.580035][ T1268] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 81.611110][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 81.623641][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 81.635683][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 81.645624][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 81.655174][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 81.669279][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 81.678739][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 81.693184][ T4291] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[ 81.704552][ T4291] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 81.718644][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 81.728703][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 81.737635][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 81.746331][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 81.755297][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 81.773098][ T9] device hsr_slave_0 left promiscuous mode
[ 81.781251][ T9] device hsr_slave_1 left promiscuous mode
[ 81.788939][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 81.796446][ T9] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 81.808553][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 81.815998][ T9] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 81.828012][ T9] device bridge_slave_1 left promiscuous mode
[ 81.835346][ T9] bridge0: port 2(bridge_slave_1) entered disabled state
[ 81.855802][ T9] device bridge_slave_0 left promiscuous mode
[ 81.862867][ T9] bridge0: port 1(bridge_slave_0) entered disabled state
[ 81.882220][ T9] device veth1_macvtap left promiscuous mode
[ 81.889453][ T9] device veth0_macvtap left promiscuous mode
[ 81.895538][ T9] device veth1_vlan left promiscuous mode
[ 81.901736][ T9] device veth0_vlan left promiscuous mode
[ 82.076463][ T9] team0 (unregistering): Port device team_slave_1 removed
[ 82.092709][ T9] team0 (unregistering): Port device team_slave_0 removed
[ 82.111818][ T9] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 82.128537][ T9] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 82.188466][ T9] bond0 (unregistering): Released all slaves
[ 82.291034][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 82.305582][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 82.316453][ T4291] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 82.334477][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 82.343917][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 82.386081][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 82.395488][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 82.404697][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 82.413840][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 82.430617][ T4291] device veth0_vlan entered promiscuous mode
[ 82.447245][ T4261] Bluetooth: hci0: command 0x041b tx timeout
[ 82.458391][ T4291] device veth1_vlan entered promiscuous mode
[ 82.478923][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 82.488184][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 82.501074][ T4291] device veth0_macvtap entered promiscuous mode
[ 82.512287][ T4291] device veth1_macvtap entered promiscuous mode
[ 82.529144][ T4291] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 82.536477][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 82.545566][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 82.554908][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 82.564028][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 82.576084][ T4291] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 82.587560][ T4291] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 82.596434][ T4291] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 82.606039][ T4291] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 82.615318][ T4291] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 82.625757][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 82.635101][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 82.705150][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 82.723570][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 82.745612][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 82.761031][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 82.770076][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 82.778094][ T1268] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 82.841661][ T4312] netlink: 80 bytes leftover after parsing attributes in process `syz.0.17'.
[ 82.878204][ T4312] ==================================================================
[ 82.886763][ T4312] BUG: KASAN: slab-out-of-bounds in __xfrm_decode_session+0x17ae/0x1fa0
[ 82.895150][ T4312] Read of size 1 at addr ffff88807d62c810 by task syz.0.17/4312
[ 82.902907][ T4312]
[ 82.905276][ T4312] CPU: 0 PID: 4312 Comm: syz.0.17 Not tainted syzkaller #0
[ 82.912504][ T4312] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
[ 82.922605][ T4312] Call Trace:
[ 82.925957][ T4312]
[ 82.928939][ T4312] dump_stack_lvl+0x188/0x250
[ 82.933689][ T4312] ? show_regs_print_info+0x20/0x20
[ 82.939145][ T4312] ? _printk+0xda/0x130
[ 82.943364][ T4312] ? load_image+0x400/0x400
[ 82.947926][ T4312] ? _raw_spin_lock_irqsave+0xbc/0x100
[ 82.953855][ T4312] print_address_description+0x60/0x2d0
[ 82.959452][ T4312] ? __xfrm_decode_session+0x17ae/0x1fa0
[ 82.965129][ T4312] kasan_report+0xdf/0x130
[ 82.969688][ T4312] ? __xfrm_decode_session+0x17ae/0x1fa0
[ 82.975366][ T4312] __xfrm_decode_session+0x17ae/0x1fa0
[ 82.980961][ T4312] ? rcu_lock_release+0x9/0x20
[ 82.985777][ T4312] icmpv6_route_lookup+0x3ea/0x5a0
[ 82.991022][ T4312] ? icmpv6_xrlim_allow+0x4b0/0x4b0
[ 82.996352][ T4312] ? dst_release+0x51/0x180
[ 83.000895][ T4312] ? icmpv6_xrlim_allow+0x3b9/0x4b0
[ 83.006163][ T4312] icmp6_send+0xff2/0x1990
[ 83.010702][ T4312] ? hlock_conflict+0x59/0x1f0
[ 83.015515][ T4312] ? icmpv6_push_pending_frames+0x450/0x450
[ 83.021445][ T4312] ? __local_bh_enable_ip+0xd7/0x1c0
[ 83.026789][ T4312] ? __local_bh_enable_ip+0x136/0x1c0
[ 83.032222][ T4312] ? ip6_neigh_lookup+0x393/0x470
[ 83.037288][ T4312] ? ip6_tnl_xmit_ctl+0x17d/0x600
[ 83.042360][ T4312] ip6_link_failure+0x35/0x490
[ 83.047160][ T4312] ? ip6_negative_advice+0x2f0/0x2f0
[ 83.052489][ T4312] ip6_tnl_xmit+0x671/0x23e0
[ 83.057140][ T4312] ? ip6_tnl_xmit_ctl+0x600/0x600
[ 83.062339][ T4312] ? iptunnel_handle_offloads+0x2bc/0x550
[ 83.068205][ T4312] ip6_tnl_start_xmit+0xd27/0x12d0
[ 83.073573][ T4312] ? ip6_tnl_dev_uninit+0x150/0x150
[ 83.078801][ T4312] ? netif_skb_features+0x833/0xbc0
[ 83.084039][ T4312] ? validate_xmit_skb+0x7b3/0xe40
[ 83.089197][ T4312] dev_hard_start_xmit+0x2a5/0x7e0
[ 83.094390][ T4312] sch_direct_xmit+0x25a/0x4b0
[ 83.099204][ T4312] ? mrp_pdu_append_vecattr_event+0x1590/0x1590
[ 83.105487][ T4312] ? sfb_dequeue+0x280/0x3a0
[ 83.110128][ T4312] __qdisc_run+0xa7e/0x1490
[ 83.114807][ T4312] __dev_queue_xmit+0xe3d/0x2f80
[ 83.119799][ T4312] ? dev_queue_xmit+0x20/0x20
[ 83.124515][ T4312] ? rcu_read_lock_bh_held+0x76/0xf0
[ 83.129966][ T4312] ? rcu_read_lock_held+0x40/0x40
[ 83.135041][ T4312] ? neigh_connected_output+0x38d/0x3e0
[ 83.140944][ T4312] ip6_finish_output2+0x108c/0x1510
[ 83.146207][ T4312] ? nf_hook+0x360/0x360
[ 83.150702][ T4312] ip6_fragment+0x133d/0x1ee0
[ 83.155573][ T4312] ? nf_hook+0x360/0x360
[ 83.159870][ T4312] ? ip6_frag_next+0xbb0/0xbb0
[ 83.164790][ T4312] ip6_xmit+0x109b/0x16d0
[ 83.169185][ T4312] ? ip6_autoflowlabel+0xd0/0xd0
[ 83.174176][ T4312] ? read_lock_is_recursive+0x10/0x10
[ 83.179632][ T4312] sctp_v6_xmit+0x985/0x11b0
[ 83.184276][ T4312] ? lockdep_hardirqs_on+0x94/0x140
[ 83.189550][ T4312] ? rcu_lock_release+0x20/0x20
[ 83.194529][ T4312] ? __skb_checksum+0x6fc/0x7a0
[ 83.199422][ T4312] ? rcu_is_watching+0x11/0xa0
[ 83.204232][ T4312] ? kmem_cache_free+0x14c/0x210
[ 83.209220][ T4312] sctp_packet_transmit+0x239c/0x2910
[ 83.214753][ T4312] sctp_packet_singleton+0x231/0x330
[ 83.220617][ T4312] ? sctp_outq_select_transport+0x570/0x570
[ 83.226568][ T4312] ? sctp_outq_select_transport+0x45d/0x570
[ 83.232505][ T4312] ? sctp_transport_burst_limited+0x193/0x280
[ 83.238622][ T4312] sctp_outq_flush+0x4ac/0x3100
[ 83.243535][ T4312] ? rcu_is_watching+0x11/0xa0
[ 83.248702][ T4312] ? sctp_outq_tail+0x8a0/0x8a0
[ 83.253664][ T4312] ? sctp_outq_tail+0x600/0x8a0
[ 83.258895][ T4312] ? sctp_outq_uncork+0x49/0xa0
[ 83.263926][ T4312] sctp_do_sm+0x4ee2/0x55f0
[ 83.268524][ T4312] ? sctp_generate_t3_rtx_event+0x340/0x340
[ 83.274711][ T4312] ? sctp_stream_init_ext+0x53/0x160
[ 83.280139][ T4312] ? ____sys_sendmsg+0x5b7/0x8f0
[ 83.285241][ T4312] ? ___sys_sendmsg+0x236/0x2e0
[ 83.290174][ T4312] ? __sk_mem_raise_allocated+0x6d7/0x1140
[ 83.296269][ T4312] sctp_primitive_ASSOCIATE+0x91/0xc0
[ 83.301699][ T4312] sctp_sendmsg_to_asoc+0x14a7/0x1d90
[ 83.307141][ T4312] ? sctp_assoc_add_peer+0xe2c/0x15a0
[ 83.312591][ T4312] ? sctp_sendmsg_check_sflags+0x2d0/0x2d0
[ 83.318433][ T4312] ? __sctp_connect+0xd80/0xd80
[ 83.323333][ T4312] ? __local_bh_enable_ip+0x136/0x1c0
[ 83.329027][ T4312] ? bpf_lsm_sctp_bind_connect+0x5/0x10
[ 83.334711][ T4312] ? security_sctp_bind_connect+0x85/0xb0
[ 83.340658][ T4312] sctp_sendmsg+0x196a/0x2900
[ 83.345395][ T4312] ? aa_sk_perm+0x7dc/0x910
[ 83.349928][ T4312] ? sctp_getsockopt+0x8a0/0x8a0
[ 83.355050][ T4312] ? aa_af_perm+0x340/0x340
[ 83.359897][ T4312] ? tomoyo_socket_sendmsg_permission+0x1dd/0x2f0
[ 83.366360][ T4312] ? __lock_acquire+0x13bc/0x7d10
[ 83.371427][ T4312] ? sock_rps_record_flow+0x17/0x3b0
[ 83.376754][ T4312] ? inet_sendmsg+0xe5/0x2f0
[ 83.381384][ T4312] ? inet_send_prepare+0x260/0x260
[ 83.386540][ T4312] ____sys_sendmsg+0x5b7/0x8f0
[ 83.391389][ T4312] ? __sys_sendmsg_sock+0x30/0x30
[ 83.396575][ T4312] ? import_iovec+0x6f/0xa0
[ 83.401216][ T4312] ___sys_sendmsg+0x236/0x2e0
[ 83.405940][ T4312] ? __sys_sendmsg+0x2a0/0x2a0
[ 83.410788][ T4312] ? verify_lock_unused+0x140/0x140
[ 83.416161][ T4312] __sys_sendmmsg+0x2ba/0x500
[ 83.420895][ T4312] ? __ia32_sys_sendmsg+0x80/0x80
[ 83.425988][ T4312] ? __context_tracking_exit+0x4c/0x80
[ 83.431501][ T4312] ? lockdep_hardirqs_on_prepare+0x409/0x770
[ 83.437532][ T4312] ? lock_chain_count+0x20/0x20
[ 83.442614][ T4312] ? vtime_user_exit+0x2c8/0x3e0
[ 83.447604][ T4312] __x64_sys_sendmmsg+0x9c/0xb0
[ 83.452555][ T4312] do_syscall_64+0x4c/0xa0
[ 83.457513][ T4312] ? clear_bhb_loop+0x30/0x80
[ 83.462322][ T4312] ? clear_bhb_loop+0x30/0x80
[ 83.467038][ T4312] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 83.473079][ T4312] RIP: 0033:0x7f3d90ae1819
[ 83.477529][ T4312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 83.497180][ T4312] RSP: 002b:00007ffe530e6338 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
[ 83.505632][ T4312] RAX: ffffffffffffffda RBX: 00007f3d90d5afa0 RCX: 00007f3d90ae1819
[ 83.513650][ T4312] RDX: 0000000000000002 RSI: 0000200000002fc0 RDI: 0000000000000004
[ 83.521682][ T4312] RBP: 00007f3d90b77c91 R08: 0000000000000000 R09: 0000000000000000
[ 83.529812][ T4312] R10: 0000000024000045 R11: 0000000000000246 R12: 0000000000000000
[ 83.537816][ T4312] R13: 00007f3d90d5afac R14: 00007f3d90d5afa0 R15: 00007f3d90d5afa0
[ 83.545843][ T4312]
[ 83.548887][ T4312]
[ 83.551236][ T4312] Allocated by task 0:
[ 83.555405][ T4312] (stack is not available)
[ 83.559929][ T4312]
[ 83.562281][ T4312] The buggy address belongs to the object at ffff88807d62c000
[ 83.562281][ T4312] which belongs to the cache kmalloc-2k of size 2048
[ 83.576372][ T4312] The buggy address is located 16 bytes to the right of
[ 83.576372][ T4312] 2048-byte region [ffff88807d62c000, ffff88807d62c800)
[ 83.590385][ T4312] The buggy address belongs to the page:
[ 83.596055][ T4312] page:ffffea0001f58a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7d628
[ 83.606358][ T4312] head:ffffea0001f58a00 order:3 compound_mapcount:0 compound_pincount:0
[ 83.614723][ T4312] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 83.622788][ T4312] raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888016c42000
[ 83.631414][ T4312] raw: 0000000000000000 0000000080080008 00000001ffffffff 0000000000000000
[ 83.640022][ T4312] page dumped because: kasan: bad access detected
[ 83.646635][ T4312] page_owner tracks the page as allocated
[ 83.652382][ T4312] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 4312, ts 82875304530, free_ts 82825966408
[ 83.672686][ T4312] get_page_from_freelist+0x1bbd/0x1ca0
[ 83.678279][ T4312] __alloc_pages+0x1ee/0x480
[ 83.683081][ T4312] new_slab+0xc0/0x4b0
[ 83.687177][ T4312] ___slab_alloc+0x80a/0xdd0
[ 83.691801][ T4312] __kmalloc_node_track_caller+0x1fc/0x3a0
[ 83.697727][ T4312] __alloc_skb+0x22c/0x750
[ 83.702261][ T4312] ip6_frag_next+0x128/0xbb0
[ 83.706968][ T4312] ip6_fragment+0x12ee/0x1ee0
[ 83.711685][ T4312] ip6_xmit+0x109b/0x16d0
[ 83.716051][ T4312] sctp_v6_xmit+0x985/0x11b0
[ 83.720780][ T4312] sctp_packet_transmit+0x239c/0x2910
[ 83.726186][ T4312] sctp_packet_singleton+0x231/0x330
[ 83.731547][ T4312] sctp_outq_flush+0x4ac/0x3100
[ 83.736470][ T4312] sctp_do_sm+0x4ee2/0x55f0
[ 83.741114][ T4312] sctp_primitive_ASSOCIATE+0x91/0xc0
[ 83.746526][ T4312] sctp_sendmsg_to_asoc+0x14a7/0x1d90
[ 83.751937][ T4312] page last free stack trace:
[ 83.756636][ T4312] free_unref_page_prepare+0x637/0x6c0
[ 83.762130][ T4312] free_unref_page+0x8f/0x2a0
[ 83.766862][ T4312] __unfreeze_partials+0x1a5/0x200
[ 83.772004][ T4312] put_cpu_partial+0x12d/0x190
[ 83.776881][ T4312] qlist_free_all+0x35/0x90
[ 83.781413][ T4312] kasan_quarantine_reduce+0x150/0x160
[ 83.786931][ T4312] __kasan_slab_alloc+0x2f/0xd0
[ 83.791818][ T4312] slab_post_alloc_hook+0x4c/0x380
[ 83.797042][ T4312] kmem_cache_alloc_node_trace+0x13d/0x300
[ 83.802986][ T4312] __get_vm_area_node+0x119/0x2d0
[ 83.808050][ T4312] __vmalloc_node_range+0xef/0x8b0
[ 83.813203][ T4312] vzalloc+0x75/0x80
[ 83.817138][ T4312] alloc_counters+0xcb/0x750
[ 83.821762][ T4312] do_ipt_get_ctl+0xa2f/0x1110
[ 83.826553][ T4312] nf_getsockopt+0x25e/0x280
[ 83.831266][ T4312] ip_getsockopt+0x1256/0x16a0
[ 83.836062][ T4312]
[ 83.838511][ T4312] Memory state around the buggy address:
[ 83.844192][ T4312] ffff88807d62c700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 83.852279][ T4312] ffff88807d62c780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 83.860600][ T4312] >ffff88807d62c800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 83.868730][ T4312] ^
[ 83.873368][ T4312] ffff88807d62c880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 83.881511][ T4312] ffff88807d62c900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 83.889603][ T4312] ==================================================================
[ 83.897790][ T4312] Disabling lock debugging due to kernel taint
[ 83.904166][ T4312] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 83.911481][ T4312] CPU: 0 PID: 4312 Comm: syz.0.17 Tainted: G B syzkaller #0
[ 83.920097][ T4312] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
[ 83.930193][ T4312] Call Trace:
[ 83.933597][ T4312]
[ 83.936645][ T4312] dump_stack_lvl+0x188/0x250
[ 83.941358][ T4312] ? show_regs_print_info+0x20/0x20
[ 83.946677][ T4312] ? load_image+0x400/0x400
[ 83.951216][ T4312] panic+0x2e5/0x810
[ 83.955168][ T4312] ? asm_common_interrupt+0x22/0x40
[ 83.960594][ T4312] ? bpf_jit_dump+0xd0/0xd0
[ 83.965126][ T4312] ? _raw_spin_unlock_irqrestore+0xbc/0x120
[ 83.971135][ T4312] ? _raw_spin_unlock_irqrestore+0xc1/0x120
[ 83.977063][ T4312] ? _raw_spin_unlock+0x40/0x40
[ 83.981945][ T4312] ? __xfrm_decode_session+0x17ae/0x1fa0
[ 83.987614][ T4312] check_panic_on_warn+0x80/0xa0
[ 83.992600][ T4312] ? __xfrm_decode_session+0x17ae/0x1fa0
[ 83.998370][ T4312] end_report+0x6d/0xf0
[ 84.002564][ T4312] kasan_report+0x102/0x130
[ 84.007241][ T4312] ? __xfrm_decode_session+0x17ae/0x1fa0
[ 84.012900][ T4312] __xfrm_decode_session+0x17ae/0x1fa0
[ 84.018388][ T4312] ? rcu_lock_release+0x9/0x20
[ 84.023191][ T4312] icmpv6_route_lookup+0x3ea/0x5a0
[ 84.028341][ T4312] ? icmpv6_xrlim_allow+0x4b0/0x4b0
[ 84.033619][ T4312] ? dst_release+0x51/0x180
[ 84.038153][ T4312] ? icmpv6_xrlim_allow+0x3b9/0x4b0
[ 84.043393][ T4312] icmp6_send+0xff2/0x1990
[ 84.047843][ T4312] ? hlock_conflict+0x59/0x1f0
[ 84.052649][ T4312] ? icmpv6_push_pending_frames+0x450/0x450
[ 84.058583][ T4312] ? __local_bh_enable_ip+0xd7/0x1c0
[ 84.064522][ T4312] ? __local_bh_enable_ip+0x136/0x1c0
[ 84.069944][ T4312] ? ip6_neigh_lookup+0x393/0x470
[ 84.075007][ T4312] ? ip6_tnl_xmit_ctl+0x17d/0x600
[ 84.080166][ T4312] ip6_link_failure+0x35/0x490
[ 84.084973][ T4312] ? ip6_negative_advice+0x2f0/0x2f0
[ 84.090300][ T4312] ip6_tnl_xmit+0x671/0x23e0
[ 84.094942][ T4312] ? ip6_tnl_xmit_ctl+0x600/0x600
[ 84.100012][ T4312] ? iptunnel_handle_offloads+0x2bc/0x550
[ 84.105783][ T4312] ip6_tnl_start_xmit+0xd27/0x12d0
[ 84.110963][ T4312] ? ip6_tnl_dev_uninit+0x150/0x150
[ 84.116286][ T4312] ? netif_skb_features+0x833/0xbc0
[ 84.121652][ T4312] ? validate_xmit_skb+0x7b3/0xe40
[ 84.126818][ T4312] dev_hard_start_xmit+0x2a5/0x7e0
[ 84.131981][ T4312] sch_direct_xmit+0x25a/0x4b0
[ 84.136791][ T4312] ? mrp_pdu_append_vecattr_event+0x1590/0x1590
[ 84.143238][ T4312] ? sfb_dequeue+0x280/0x3a0
[ 84.147872][ T4312] __qdisc_run+0xa7e/0x1490
[ 84.152423][ T4312] __dev_queue_xmit+0xe3d/0x2f80
[ 84.157409][ T4312] ? dev_queue_xmit+0x20/0x20
[ 84.162118][ T4312] ? rcu_read_lock_bh_held+0x76/0xf0
[ 84.167541][ T4312] ? rcu_read_lock_held+0x40/0x40
[ 84.172593][ T4312] ? neigh_connected_output+0x38d/0x3e0
[ 84.178176][ T4312] ip6_finish_output2+0x108c/0x1510
[ 84.183407][ T4312] ? nf_hook+0x360/0x360
[ 84.187690][ T4312] ip6_fragment+0x133d/0x1ee0
[ 84.192415][ T4312] ? nf_hook+0x360/0x360
[ 84.196772][ T4312] ? ip6_frag_next+0xbb0/0xbb0
[ 84.201577][ T4312] ip6_xmit+0x109b/0x16d0
[ 84.205949][ T4312] ? ip6_autoflowlabel+0xd0/0xd0
[ 84.211016][ T4312] ? read_lock_is_recursive+0x10/0x10
[ 84.216693][ T4312] sctp_v6_xmit+0x985/0x11b0
[ 84.221426][ T4312] ? lockdep_hardirqs_on+0x94/0x140
[ 84.226669][ T4312] ? rcu_lock_release+0x20/0x20
[ 84.231600][ T4312] ? __skb_checksum+0x6fc/0x7a0
[ 84.236490][ T4312] ? rcu_is_watching+0x11/0xa0
[ 84.241284][ T4312] ? kmem_cache_free+0x14c/0x210
[ 84.246253][ T4312] sctp_packet_transmit+0x239c/0x2910
[ 84.251669][ T4312] sctp_packet_singleton+0x231/0x330
[ 84.256985][ T4312] ? sctp_outq_select_transport+0x570/0x570
[ 84.263000][ T4312] ? sctp_outq_select_transport+0x45d/0x570
[ 84.268933][ T4312] ? sctp_transport_burst_limited+0x193/0x280
[ 84.275068][ T4312] sctp_outq_flush+0x4ac/0x3100
[ 84.279966][ T4312] ? rcu_is_watching+0x11/0xa0
[ 84.284769][ T4312] ? sctp_outq_tail+0x8a0/0x8a0
[ 84.289657][ T4312] ? sctp_outq_tail+0x600/0x8a0
[ 84.294541][ T4312] ? sctp_outq_uncork+0x49/0xa0
[ 84.299461][ T4312] sctp_do_sm+0x4ee2/0x55f0
[ 84.304177][ T4312] ? sctp_generate_t3_rtx_event+0x340/0x340
[ 84.310115][ T4312] ? sctp_stream_init_ext+0x53/0x160
[ 84.315469][ T4312] ? ____sys_sendmsg+0x5b7/0x8f0
[ 84.320442][ T4312] ? ___sys_sendmsg+0x236/0x2e0
[ 84.325338][ T4312] ? __sk_mem_raise_allocated+0x6d7/0x1140
[ 84.331204][ T4312] sctp_primitive_ASSOCIATE+0x91/0xc0
[ 84.336694][ T4312] sctp_sendmsg_to_asoc+0x14a7/0x1d90
[ 84.342192][ T4312] ? sctp_assoc_add_peer+0xe2c/0x15a0
[ 84.347630][ T4312] ? sctp_sendmsg_check_sflags+0x2d0/0x2d0
[ 84.353466][ T4312] ? __sctp_connect+0xd80/0xd80
[ 84.358720][ T4312] ? __local_bh_enable_ip+0x136/0x1c0
[ 84.364128][ T4312] ? bpf_lsm_sctp_bind_connect+0x5/0x10
[ 84.369716][ T4312] ? security_sctp_bind_connect+0x85/0xb0
[ 84.375481][ T4312] sctp_sendmsg+0x196a/0x2900
[ 84.380195][ T4312] ? aa_sk_perm+0x7dc/0x910
[ 84.384722][ T4312] ? sctp_getsockopt+0x8a0/0x8a0
[ 84.389693][ T4312] ? aa_af_perm+0x340/0x340
[ 84.394222][ T4312] ? tomoyo_socket_sendmsg_permission+0x1dd/0x2f0
[ 84.400671][ T4312] ? __lock_acquire+0x13bc/0x7d10
[ 84.405736][ T4312] ? sock_rps_record_flow+0x17/0x3b0
[ 84.411062][ T4312] ? inet_sendmsg+0xe5/0x2f0
[ 84.415673][ T4312] ? inet_send_prepare+0x260/0x260
[ 84.420814][ T4312] ____sys_sendmsg+0x5b7/0x8f0
[ 84.425694][ T4312] ? __sys_sendmsg_sock+0x30/0x30
[ 84.430757][ T4312] ? import_iovec+0x6f/0xa0
[ 84.435292][ T4312] ___sys_sendmsg+0x236/0x2e0
[ 84.440097][ T4312] ? __sys_sendmsg+0x2a0/0x2a0
[ 84.444912][ T4312] ? verify_lock_unused+0x140/0x140
[ 84.450175][ T4312] __sys_sendmmsg+0x2ba/0x500
[ 84.454872][ T4312] ? __ia32_sys_sendmsg+0x80/0x80
[ 84.459938][ T4312] ? __context_tracking_exit+0x4c/0x80
[ 84.465513][ T4312] ? lockdep_hardirqs_on_prepare+0x409/0x770
[ 84.471529][ T4312] ? lock_chain_count+0x20/0x20
[ 84.476403][ T4312] ? vtime_user_exit+0x2c8/0x3e0
[ 84.481376][ T4312] __x64_sys_sendmmsg+0x9c/0xb0
[ 84.486258][ T4312] do_syscall_64+0x4c/0xa0
[ 84.490693][ T4312] ? clear_bhb_loop+0x30/0x80
[ 84.495424][ T4312] ? clear_bhb_loop+0x30/0x80
[ 84.500218][ T4312] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 84.506129][ T4312] RIP: 0033:0x7f3d90ae1819
[ 84.510563][ T4312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 84.530186][ T4312] RSP: 002b:00007ffe530e6338 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
[ 84.538618][ T4312] RAX: ffffffffffffffda RBX: 00007f3d90d5afa0 RCX: 00007f3d90ae1819
[ 84.546608][ T4312] RDX: 0000000000000002 RSI: 0000200000002fc0 RDI: 0000000000000004
[ 84.554593][ T4312] RBP: 00007f3d90b77c91 R08: 0000000000000000 R09: 0000000000000000
[ 84.562595][ T4312] R10: 0000000024000045 R11: 0000000000000246 R12: 0000000000000000
[ 84.570590][ T4312] R13: 00007f3d90d5afac R14: 00007f3d90d5afa0 R15: 00007f3d90d5afa0
[ 84.578596][ T4312]
[ 84.581734][ T4312] Kernel Offset: disabled
[ 84.586079][ T4312] Rebooting in 86400 seconds..