Warning: Permanently added '10.128.1.63' (ED25519) to the list of known hosts. 1970/01/01 00:00:29 parsed 1 programs 1970/01/01 00:00:29 serving rpc on tcp://35279 [ 30.849874][ T4726] cgroup: Unknown subsys name 'net' [ 30.969918][ T4726] cgroup: Unknown subsys name 'cpuset' [ 30.972167][ T4726] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 31.136371][ T4726] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 34.251491][ T4732] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 34.485005][ T4738] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.485255][ T4738] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.485320][ T4738] bridge_slave_0: entered allmulticast mode [ 34.485746][ T4738] bridge_slave_0: entered promiscuous mode [ 34.487290][ T4738] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.487338][ T4738] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.487383][ T4738] bridge_slave_1: entered allmulticast mode [ 34.487782][ T4738] bridge_slave_1: entered promiscuous mode [ 34.504810][ T4738] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 34.505648][ T4738] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 34.511979][ T4738] team0: Port device team_slave_0 added [ 34.513013][ T4738] team0: Port device team_slave_1 added [ 34.518749][ T4738] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 34.518776][ T4738] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 34.518793][ T4738] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 34.519599][ T4738] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 34.519606][ T4738] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 34.519618][ T4738] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 34.528950][ T4738] hsr_slave_0: entered promiscuous mode [ 34.529239][ T4738] hsr_slave_1: entered promiscuous mode [ 34.571391][ T4738] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 34.574649][ T4738] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 34.575017][ T4738] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 34.577080][ T4738] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 34.577884][ T4738] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 34.579838][ T4738] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 34.580241][ T4738] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 34.581936][ T4738] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 34.591694][ T4738] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.591742][ T4738] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.591897][ T4738] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.591934][ T4738] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.606790][ T4738] 8021q: adding VLAN 0 to HW filter on device bond0 [ 34.611323][ T782] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.613298][ T782] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.619362][ T4738] 8021q: adding VLAN 0 to HW filter on device team0 [ 34.621387][ T14] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.621432][ T14] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.626133][ T14] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.626165][ T14] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.637901][ T4738] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 34.637929][ T4738] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 34.724822][ T4738] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 34.734890][ T4738] veth0_vlan: entered promiscuous mode [ 34.738062][ T4738] veth1_vlan: entered promiscuous mode [ 34.745516][ T4738] veth0_macvtap: entered promiscuous mode [ 34.746689][ T4738] veth1_macvtap: entered promiscuous mode [ 34.753390][ T4738] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 34.754512][ T4738] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 34.756571][ T14] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.756738][ T14] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.756856][ T14] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.756927][ T14] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.841034][ T4741] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 34.841601][ T4741] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 34.841777][ T4741] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 34.842109][ T4741] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 34.842307][ T4741] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 34.876931][ T14] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 34.951296][ T14] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.016024][ T14] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.102009][ T14] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.203278][ T39] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 35.204877][ T39] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 35.215331][ T39] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 35.216935][ T39] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 1970/01/01 00:00:35 executed programs: 0 [ 35.851704][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 35.852050][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 35.852487][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 35.852934][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 35.853132][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 35.982735][ T4830] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.982828][ T4830] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.982891][ T4830] bridge_slave_0: entered allmulticast mode [ 35.983336][ T4830] bridge_slave_0: entered promiscuous mode [ 35.984548][ T4830] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.984608][ T4830] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.984663][ T4830] bridge_slave_1: entered allmulticast mode [ 35.985088][ T4830] bridge_slave_1: entered promiscuous mode [ 35.993471][ T4830] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 35.994439][ T4830] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 36.001769][ T4830] team0: Port device team_slave_0 added [ 36.002582][ T4830] team0: Port device team_slave_1 added [ 36.009464][ T4830] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 36.009486][ T4830] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 36.009503][ T4830] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 36.010303][ T4830] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 36.010311][ T4830] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 36.010325][ T4830] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 36.020356][ T4830] hsr_slave_0: entered promiscuous mode [ 36.020707][ T4830] hsr_slave_1: entered promiscuous mode [ 36.020951][ T4830] debugfs: 'hsr0' already exists in 'hsr' [ 36.020992][ T4830] Cannot create hsr debugfs directory [ 37.868688][ T4741] Bluetooth: hci0: command tx timeout [ 38.222616][ T14] bridge_slave_1: left allmulticast mode [ 38.224220][ T14] bridge_slave_1: left promiscuous mode [ 38.225754][ T14] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.228508][ T14] bridge_slave_0: left allmulticast mode [ 38.228534][ T14] bridge_slave_0: left promiscuous mode [ 38.230719][ T14] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.283064][ T14] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 38.319665][ T14] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 38.369187][ T14] bond0 (unregistering): Released all slaves [ 38.419418][ T14] hsr_slave_0: left promiscuous mode [ 38.419748][ T14] hsr_slave_1: left promiscuous mode [ 38.420319][ T14] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 38.420346][ T14] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 38.420943][ T14] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 38.420954][ T14] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 38.427248][ T14] veth1_macvtap: left promiscuous mode [ 38.427278][ T14] veth0_macvtap: left promiscuous mode [ 38.427325][ T14] veth1_vlan: left promiscuous mode [ 38.427364][ T14] veth0_vlan: left promiscuous mode [ 38.526401][ T14] team0 (unregistering): Port device team_slave_1 removed [ 38.530297][ T14] team0 (unregistering): Port device team_slave_0 removed [ 38.574018][ T4402] 8021q: adding VLAN 0 to HW filter on device eth0 [ 38.821050][ T4830] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 38.824641][ T4830] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 38.824973][ T4830] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 38.828151][ T4830] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 38.830924][ T4830] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 38.833364][ T4830] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 38.835178][ T4830] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 38.837751][ T4830] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 38.862189][ T4830] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.866952][ T4830] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.873041][ T4099] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.873088][ T4099] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.097433][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.097480][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.104873][ T4830] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 39.104902][ T4830] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 39.203670][ T4830] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.233154][ T4830] veth0_vlan: entered promiscuous mode [ 39.235076][ T4830] veth1_vlan: entered promiscuous mode [ 39.242252][ T4830] veth0_macvtap: entered promiscuous mode [ 39.243286][ T4830] veth1_macvtap: entered promiscuous mode [ 39.246697][ T4830] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.251775][ T4830] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.290154][ T39] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.290204][ T39] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.290237][ T39] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.290257][ T39] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.312213][ T4099] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.312241][ T4099] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.320764][ T4099] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.320794][ T4099] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.363010][ T4935] syz.0.17 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 39.363042][ T4935] CPU: 1 UID: 0 PID: 4935 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT [ 39.363053][ T4935] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 39.363059][ T4935] Call trace: [ 39.363062][ T4935] show_stack+0x2c/0x3c (C) [ 39.363082][ T4935] __dump_stack+0x30/0x40 [ 39.363095][ T4935] dump_stack_lvl+0xd8/0x12c [ 39.363105][ T4935] dump_stack+0x1c/0x28 [ 39.363114][ T4935] dump_header+0xbc/0x3f0 [ 39.363122][ T4935] oom_kill_process+0x248/0x8a0 [ 39.363132][ T4935] out_of_memory+0xd24/0x1064 [ 39.363140][ T4935] mem_cgroup_out_of_memory+0xe8/0x170 [ 39.363151][ T4935] try_charge_memcg+0x8ec/0xc64 [ 39.363158][ T4935] obj_cgroup_charge_pages+0x30/0xb0 [ 39.363166][ T4935] __memcg_slab_post_alloc_hook+0x4a0/0x8cc [ 39.363173][ T4935] kmem_cache_alloc_lru_noprof+0x32c/0x5dc [ 39.363182][ T4935] alloc_inode+0x84/0x198 [ 39.363192][ T4935] new_inode+0x20/0x50 [ 39.363201][ T4935] gadgetfs_make_inode+0x34/0x18c [ 39.363210][ T4935] gadgetfs_create_file+0x48/0xd8 [ 39.363218][ T4935] gadgetfs_bind+0x3f8/0x75c [ 39.363226][ T4935] gadget_bind_driver+0x274/0x834 [ 39.363234][ T4935] really_probe+0x29c/0x800 [ 39.363245][ T4935] __driver_probe_device+0x1e0/0x350 [ 39.363255][ T4935] driver_probe_device+0x6c/0x19c [ 39.363265][ T4935] __driver_attach+0x168/0x384 [ 39.363274][ T4935] bus_for_each_dev+0x128/0x1b4 [ 39.363283][ T4935] driver_attach+0x50/0x60 [ 39.363292][ T4935] bus_add_driver+0x208/0x500 [ 39.363300][ T4935] driver_register+0x220/0x310 [ 39.363310][ T4935] usb_gadget_register_dr ** replaying previous printk message ** [ 39.363310][ T4935] usb_gadget_register_driver_owner+0xf0/0x25c [ 39.363318][ T4935] dev_config+0x91c/0xcc0 [ 39.363325][ T4935] vfs_write+0x2a4/0xa0c [ 39.363332][ T4935] ksys_write+0x12c/0x228 [ 39.363339][ T4935] __arm64_sys_write+0x84/0x98 [ 39.363346][ T4935] invoke_syscall+0x98/0x244 [ 39.363356][ T4935] el0_svc_common+0xec/0x23c [ 39.363366][ T4935] do_el0_svc+0x4c/0x5c [ 39.363375][ T4935] el0_svc+0x64/0x260 [ 39.363384][ T4935] el0t_64_sync_handler+0x44/0x104 [ 39.363393][ T4935] el0t_64_sync+0x198/0x19c [ 39.363402][ T4935] memory: usage 0kB, limit 0kB, failcnt 19 [ 39.363407][ T4935] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 39.363413][ T4935] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 39.363418][ T4935] Memory cgroup stats for /syz0/test: [ 39.363480][ T4935] cache 0 [ 39.363484][ T4935] rss 0 [ 39.363487][ T4935] rss_huge 0 [ 39.363490][ T4935] shmem 0 [ 39.363493][ T4935] mapped_file 0 [ 39.363496][ T4935] dirty 0 [ 39.363498][ T4935] writeback 0 [ 39.363501][ T4935] workingset_refault_anon 0 [ 39.363505][ T4935] workingset_refault_file 0 [ 39.363508][ T4935] swap 0 [ 39.363511][ T4935] swapcached 0 [ 39.363514][ T4935] pgpgin 0 [ 39.363516][ T4935] pgpgout 0 [ 39.363519][ T4935] pgfault 0 [ 39.363522][ T4935] pgmajfault 0 [ 39.363525][ T4935] inactive_anon 0 [ 39.363528][ T4935] active_anon 0 [ 39.363531][ T4935] inactive_file 0 [ 39.363534][ T4935] active_file 0 [ 39.363537][ T4935] unevictable 0 [ 39.363540][ T4935] hierarchical_memory_limit 0 [ 39.363543][ T4935] hierarchical_memsw_limit 9223372036854771712 [ 39.363546][ T4935] total_cache 0 [ 39.363549][ T4935] total_rss 0 [ 39.363552][ T4935] total_rss_huge 0 [ 39.363555][ T4935] total_shmem 0 [ 39.363558][ T4935] total_mapped_file 0 [ 39.363561][ T4935] total_dirty 0 [ 39.363564][ T4935] total_writeback 0 [ 39.363567][ T4935] total_workingset_refault_anon 0 [ 39.363570][ T4935] total_workingset_refault_file 0 [ 39.363573][ T4935] total_swap 0 [ 39.363576][ T4935] total_swapcached 0 [ 39.363579][ T4935] total_pgpgin 0 [ 39.363582][ T4935] total_pgpgout 0 [ 39.363585][ T4935] total_pgfault 0 [ 39.363588][ T4935] total_pgmajfault 0 [ 39.363591][ T4935] total_inactive_anon 0 [ 39.363594][ T4935] total_active_anon 0 [ 39.363597][ T4935] total_inactive_file 0 [ 39.363600][ T4935] total_active_file 0 [ 39.363603][ T4935] total_unevictable 0 [ 39.363606][ T4935] anon_cost 0 [ 39.363609][ T4935] file_cost 0 [ 39.363612][ T4935] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0,oom_memcg=/syz0/test,task_memcg=/syz0/test,task=syz.0.17,pid=4935,uid=0 [ 39.363684][ T4935] Memory cgroup out of memory: Killed process 4935 (syz.0.17) total-vm:44804kB, anon-rss:1292kB, file-rss:976kB, shmem-rss:0kB, UID:0 pgtables:72kB oom_score_adj:1000 [ 39.368142][ T4935] udc dummy_udc.0: failed to start USB Gadget filesystem: -12 [ 39.368155][ T4935] gadgetfs gadget.0: probe with driver gadgetfs failed with error -12 [ 39.368346][ T4935] gadgetfs expected dummy_udc controller not usbip-vudc [ 39.368355][ T4935] udc usbip-vudc.0: failed to start USB Gadget filesystem: -19 [ 39.372606][ T4935] UDC core: USB Gadget filesystem: couldn't find an available UDC [ 39.391917][ T4936] ================================================================== [ 39.391926][ T4936] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irq+0x58/0x70 [ 39.391941][ T4936] Read of size 1 at addr ffff0000d065d018 by task syz.0.18/4936 [ 39.391947][ T4936] [ 39.391951][ T4936] CPU: 1 UID: 0 PID: 4936 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT [ 39.391960][ T4936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 39.391964][ T4936] Call trace: [ 39.391967][ T4936] show_stack+0x2c/0x3c (C) [ 39.391979][ T4936] __dump_stack+0x30/0x40 [ 39.391989][ T4936] dump_stack_lvl+0xd8/0x12c [ 39.391998][ T4936] print_address_description+0xb0/0x238 [ 39.392006][ T4936] print_report+0x68/0x84 [ 39.392012][ T4936] kasan_report+0x8c/0xc4 [ 39.392022][ T4936] __kasan_check_byte+0x3c/0x54 [ 39.392030][ T4936] lock_acquire+0xa4/0x364 [ 39.392038][ T4936] _raw_spin_lock_irq+0x58/0x70 [ 39.392046][ T4936] gadget_dev_open+0x50/0x1c4 [ 39.392055][ T4936] do_dentry_open+0x5c4/0xfc0 [ 39.392064][ T4936] vfs_open+0x44/0x2dc [ 39.392073][ T4936] path_openat+0x21fc/0x2a60 [ 39.392082][ T4936] do_file_open+0x1c8/0x2e8 [ 39.392090][ T4936] do_sys_openat2+0x114/0x1e8 [ 39.392099][ T4936] do_sys_open+0xb0/0xe0 [ 39.392108][ T4936] __arm64_sys_openat+0xa8/0xc4 [ 39.392117][ T4936] invoke_syscall+0x98/0x244 [ 39.392127][ T4936] el0_svc_common+0xec/0x23c [ 39.392137][ T4936] do_el0_svc+0x4c/0x5c [ 39.392146][ T4936] el0_svc+0x64/0x260 [ 39.392153][ T4936] el0t_64_sync_handler+0x44/0x104 [ 39.392162][ T4936] el0t_64_sync+0x198/0x19c [ 39.392169][ T4936] [ 39.392171][ T4936] Allocated by task 4830: [ 39.392175][ T4936] kasan_save_track+0x40/0x78 [ 39.392182][ T4936] kasan_save_alloc_info+0x40/0x50 [ 39.392190][ T4936] __kasan_kmalloc+0x9c/0xb4 [ 39.392196][ T4936] __kmalloc_cache_noprof+0x2e8/0x5ec [ 39.392203][ T4936] gadgetfs_fill_super+0x19c/0x370 [ 39.392209][ T4936] vfs_get_super+0xb8/0x148 [ 39.392216][ T4936] get_tree_single+0x30/0x40 [ 39.392222][ T4936] gadgetfs_get_tree+0x28/0x38 [ 39.392228][ T4936] vfs_get_tree+0x90/0x28c [ 39.392235][ T4936] fc_mount+0x24/0xac [ 39.392241][ T4936] do_new_mount+0x2a4/0x538 [ 39.392249][ T4936] path_mount+0x5f0/0xa88 [ 39.392255][ T4936] do_mount+0xe8/0x148 [ 39.392262][ T4936] __arm64_sys_mount+0x33c/0x388 [ 39.392270][ T4936] invoke_syscall+0x98/0x244 [ 39.392278][ T4936] el0_svc_common+0xec/0x23c [ 39.392285][ T4936] do_el0_svc+0x4c/0x5c [ 39.392293][ T4936] el0_svc+0x64/0x260 [ 39.392299][ T4936] el0t_64_sync_handler+0x44/0x104 [ 39.392306][ T4936] el0t_64_sync+0x198/0x19c [ 39.392311][ T4936] [ 39.392312][ T4936] Freed by task 4935: [ 39.392315][ T4936] kasan_save_track+0x40/0x78 [ 39.392322][ T4936] kasan_save_free_info+0x54/0x6c [ 39.392329][ T4936] __kasan_slab_free+0x74/0xa4 [ 39.392336][ T4936] kfree+0x188/0x690 [ 39.392342][ T4936] put_dev+0x8c/0xf8 [ 39.392347][ T4936] dev_release+0x100/0x15c [ 39.392353][ T4936] __fput+0x338/0x74c [ 39.392359][ T4936] ____fput+0x20/0x30 [ 39.392364][ T4936] task_work_run+0x1cc/0x25c [ 39.392372][ T4936] do_exit+0x58c/0x1a74 [ 39.392381][ T4936] do_group_exit+0x198/0x238 [ 39.392385][ T4936] get_signal+0xfb0/0x1094 [ 39.392391][ T4936] arch_do_signal_or_restart+0x288/0x444c [ 39.392400][ T4936] exit_to_user_mode_loop+0x70/0x17c [ 39.392407][ T4936] el0_svc+0x18c/0x260 [ 39.392413][ T4936] el0t_64_sync_handler+0x44/0x104 [ 39.392420][ T4936] el0t_64_sync+0x198/0x19c [ 39.392425][ T4936] [ 39.392426][ T4936] The buggy address belongs to the object at ffff0000d065d000 [ 39.392426][ T4936] which belongs to the cache kmalloc-1k of size 1024 [ 39.392432][ T4936] The buggy address is located 24 bytes inside of [ 39.392432][ T4936] freed 1024-byte region [ffff0000d065d000, ffff0000d065d400) [ 39.392438][ T4936] [ 39.392440][ T4936] The buggy address belongs to the physical page: [ 39.392444][ T4936] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x110658 [ 39.392450][ T4936] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 39.392456][ T4936] flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 39.392463][ T4936] page_type: f5(slab) [ 39.392469][ T4936] raw: 05ffc00000000040 ffff0000c0001dc0 dead000000000100 dead000000000122 [ 39.392474][ T4936] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 39.392480][ T4936] head: 05ffc00000000040 ffff0000c0001dc0 dead000000000100 dead000000000122 [ 39.392485][ T4936] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 39.392491][ T4936] head: 05ffc00000000003 fffffdffc3419601 00000000ffffffff 00000000ffffffff [ 39.392496][ T4936] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 39.392499][ T4936] page dumped because: kasan: bad access detected [ 39.392502][ T4936] [ 39.392503][ T4936] Memory state around the buggy address: [ 39.392507][ T4936] ffff0000d065cf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.392511][ T4936] ffff0000d065cf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.392515][ T4936] >ffff0000d065d000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 39.392518][ T4936] ^ [ 39.392521][ T4936] ffff0000d065d080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 39.392525][ T4936] ffff0000d065d100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 39.392528][ T4936] ================================================================== [ 39.392531][ T4936] Disabling lock debugging due to kernel taint [ 39.392535][ T4936] ------------[ cut here ]------------ [ 39.392537][ T4936] UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.h:68:9 [ 39.392543][ T4936] index 13277 is out of range for type 'unsigned long[8]' [ 39.392548][ T4936] CPU: 1 UID: 0 PID: 4936 Comm: syz.0.18 Tainted: G B syzkaller #0 PREEMPT [ 39.392556][ T4936] Tainted: [B]=BAD_PAGE [ 39.392559][ T4936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 39.392562][ T4936] Call trace: [ 39.392564][ T4936] show_stack+0x2c/0x3c (C) [ 39.392574][ T4936] __dump_stack+0x30/0x40 [ 39.392583][ T4936] dump_stack_lvl+0xd8/0x12c [ 39.392592][ T4936] dump_stack+0x1c/0x28 [ 39.392601][ T4936] ubsan_epilogue+0x14/0x48 [ 39.392609][ T4936] __ubsan_handle_out_of_bounds+0xd0/0xf8 [ 39.392620][ T4936] queued_spin_lock_slowpath+0x834/0xd04 [ 39.392629][ T4936] do_raw_spin_lock+0x21c/0x2d0 [ 39.392637][ T4936] _raw_spin_lock_irq+0x60/0x70 [ 39.392645][ T4936] gadget_dev_open+0x50/0x1c4 [ 39.392652][ T4936] do_dentry_open+0x5c4/0xfc0 [ 39.392661][ T4936] vfs_open+0x44/0x2dc [ 39.392670][ T4936] path_openat+0x21fc/0x2a60 [ 39.392678][ T4936] do_file_open+0x1c8/0x2e8 [ 39.392686][ T4936] do_sys_openat2+0x114/0x1e8 [ 39.392695][ T4936] do_sys_open+0xb0/0xe0 [ 39.392704][ T4936] __arm64_sys_openat+0xa8/0xc4 [ 39.392713][ T4936] invoke_syscall+0x98/0x244 [ 39.392722][ T4936] el0_svc_common+0xec/0x23c [ 39.392732][ T4936] do_el0_svc+0x4c/0x5c [ 39.392741][ T4936] el0_svc+0x64/0x260 [ 39.392748][ T4936] el0t_64_sync_handler+0x44/0x104 [ 39.392756][ T4936] el0t_64_sync+0x198/0x19c [ 39.392763][ T4936] ---[ end trace ]--- [ 39.392778][ T4936] Unable to handle kernel paging request at virtual address ffff800088af8700 [ 39.392783][ T4936] KASAN: probably user-memory-access in range [0x00000004457c3800-0x00000004457c3807] [ 39.392791][ T4936] Mem abort info: [ 39.392793][ T4936] ESR = 0x0000000096000047 [ 39.392797][ T4936] EC = 0x25: DABT (current EL), IL = 32 bits [ 39.392801][ T4936] SET = 0, FnV = 0 [ 39.392804][ T4936] EA = 0, S1PTW = 0 [ 39.392807][ T4936] FSC = 0x07: level 3 translation fault [ 39.392811][ T4936] Data abort info: [ 39.392812][ T4936] ISV = 0, ISS = 0x00000047, ISS2 = 0x00000000 [ 39.392816][ T4936] CM = 0, WnR = 1, TnD = 0, TagAccess = 0 [ 39.392820][ T4936] GCS = 0, Overlay = 0, DirtyBit = 0 [ 39.392824][ T4936] swapper pgtable: 4k pages, 48-bit VAs, pgdp=000000021ae49000 [ 39.392828][ T4936] [ffff800088af8700] pgd=0000000000000000, p4d=1000000221141003, pud=1000000221142003, pmd=1000000221146003, pte=0000000000000000 [ 39.392844][ T4936] Internal error: Oops: 0000000096000047 [#1] SMP [ 39.584796][ T4936] Modules linked in: [ 39.585461][ T4936] CPU: 1 UID: 0 PID: 4936 Comm: syz.0.18 Tainted: G B syzkaller #0 PREEMPT [ 39.587225][ T4936] Tainted: [B]=BAD_PAGE [ 39.587941][ T4936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 39.589639][ T4936] pstate: 834000c5 (Nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 39.590991][ T4936] pc : queued_spin_lock_slowpath+0x544/0xd04 [ 39.592083][ T4936] lr : queued_spin_lock_slowpath+0x834/0xd04 [ 39.593133][ T4936] sp : ffff80009a307560 [ 39.593868][ T4936] x29: ffff80009a307600 x28: ffff800088af8700 x27: 1fffe0001a3c1002 [ 39.595285][ T4936] x26: 1fffe0001a0cba00 x25: ffff0001a5df5708 x24: dfff800000000000 [ 39.596740][ T4936] x23: ffff700013460eb0 x22: ffff0001a5df5700 x21: 1fffe00034bbeae0 [ 39.598220][ T4936] x20: ffff0000d1e08010 x19: ffff0000d065d000 x18: 0000000000000000 [ 39.599691][ T4936] x17: 363a682e6b636f6c x16: 0000000000000001 x15: 0000000000000000 [ 39.601118][ T4936] x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000004 [ 39.602489][ T4936] x11: ffff700011467668 x10: ffff800088af8700 x9 : ffff800088af8700 [ 39.603917][ T4936] x8 : 0000000000000000 x7 : 0000000000000001 x6 : ffff80008048c60c [ 39.605313][ T4936] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f5c74 [ 39.606713][ T4936] x2 : 0000000000000002 x1 : 0000000000000004 x0 : ffff0001a5df5708 [ 39.608169][ T4936] Call trace: [ 39.608772][ T4936] queued_spin_lock_slowpath+0x544/0xd04 (P) [ 39.609830][ T4936] do_raw_spin_lock+0x21c/0x2d0 [ 39.610674][ T4936] _raw_spin_lock_irq+0x60/0x70 [ 39.611488][ T4936] gadget_dev_open+0x50/0x1c4 [ 39.612293][ T4936] do_dentry_open+0x5c4/0xfc0 [ 39.613191][ T4936] vfs_open+0x44/0x2dc [ 39.613931][ T4936] path_openat+0x21fc/0x2a60 [ 39.614741][ T4936] do_file_open+0x1c8/0x2e8 [ 39.615514][ T4936] do_sys_openat2+0x114/0x1e8 [ 39.616332][ T4936] do_sys_open+0xb0/0xe0 [ 39.617099][ T4936] __arm64_sys_openat+0xa8/0xc4 [ 39.617977][ T4936] invoke_syscall+0x98/0x244 [ 39.618758][ T4936] el0_svc_common+0xec/0x23c [ 39.619563][ T4936] do_el0_svc+0x4c/0x5c [ 39.620335][ T4936] el0_svc+0x64/0x260 [ 39.621057][ T4936] el0t_64_sync_handler+0x44/0x104 [ 39.621993][ T4936] el0t_64_sync+0x198/0x19c [ 39.622779][ T4936] Code: aa1c03e0 96899931 910022c0 52800081 (f9000396) [ 39.623998][ T4936] ---[ end trace 0000000000000000 ]--- [ 39.847714][ T4936] Kernel panic - not syncing: Oops: Fatal exception [ 39.848900][ T4936] SMP: stopping secondary CPUs [ 39.849747][ T4936] Kernel Offset: disabled [ 39.850503][ T4936] CPU features: 0x14000000,003c0008,27020a02,a84ff6a7 [ 39.851695][ T4936] Memory Limit: none [ 40.080509][ T4936] Rebooting in 86400 seconds..