Warning: Permanently added '10.128.1.24' (ED25519) to the list of known hosts. 1970/01/01 00:00:29 parsed 1 programs 1970/01/01 00:00:29 serving rpc on tcp://42355 [ 30.672018][ T4720] cgroup: Unknown subsys name 'net' [ 30.812113][ T4720] cgroup: Unknown subsys name 'cpuset' [ 30.813470][ T4720] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 30.941433][ T4720] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 32.733593][ T4728] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 33.367099][ T1159] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.367114][ T1159] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.376160][ T1159] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.376174][ T1159] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.468379][ T4767] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 33.469048][ T4767] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 33.469448][ T4767] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 33.470108][ T4767] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 33.470313][ T4767] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 33.964667][ T4780] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.964922][ T4780] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.964992][ T4780] bridge_slave_0: entered allmulticast mode [ 33.965445][ T4780] bridge_slave_0: entered promiscuous mode [ 33.966631][ T4780] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.966678][ T4780] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.966730][ T4780] bridge_slave_1: entered allmulticast mode [ 33.967121][ T4780] bridge_slave_1: entered promiscuous mode [ 33.974492][ T4780] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 33.975335][ T4780] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 33.981940][ T4780] team0: Port device team_slave_0 added [ 33.982623][ T4780] team0: Port device team_slave_1 added [ 33.988470][ T4780] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 33.988480][ T4780] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 33.988495][ T4780] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 33.989255][ T4780] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 33.989262][ T4780] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 33.989277][ T4780] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 34.000098][ T4780] hsr_slave_0: entered promiscuous mode [ 34.000496][ T4780] hsr_slave_1: entered promiscuous mode [ 34.049280][ T4780] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 34.052524][ T4780] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 34.052983][ T4780] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 34.053886][ T4780] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 34.054242][ T4780] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 34.055492][ T4780] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 34.055824][ T4780] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 34.056645][ T4780] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 34.135875][ T4780] 8021q: adding VLAN 0 to HW filter on device bond0 [ 34.139941][ T4780] 8021q: adding VLAN 0 to HW filter on device team0 [ 34.144109][ T1159] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.144156][ T1159] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.145258][ T1159] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.145284][ T1159] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.157000][ T4780] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 34.260088][ T4780] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 34.273538][ T4780] veth0_vlan: entered promiscuous mode [ 34.275591][ T4780] veth1_vlan: entered promiscuous mode [ 34.282855][ T4780] veth0_macvtap: entered promiscuous mode [ 34.285665][ T4780] veth1_macvtap: entered promiscuous mode [ 34.289801][ T4780] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 34.294945][ T4780] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 34.312165][ T40] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.312393][ T1159] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.312412][ T1159] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.312427][ T1159] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.376518][ T61] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 34.451660][ T61] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 34.513904][ T61] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 1970/01/01 00:00:34 executed programs: 0 [ 34.545136][ T4767] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 34.545435][ T4767] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 34.545605][ T4767] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 34.545937][ T4767] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 34.546167][ T4767] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 34.567885][ T61] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 34.677847][ T4822] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.677910][ T4822] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.677960][ T4822] bridge_slave_0: entered allmulticast mode [ 34.678346][ T4822] bridge_slave_0: entered promiscuous mode [ 34.679110][ T4822] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.679128][ T4822] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.679170][ T4822] bridge_slave_1: entered allmulticast mode [ 34.679576][ T4822] bridge_slave_1: entered promiscuous mode [ 34.687230][ T4822] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 34.688086][ T4822] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 34.696213][ T4822] team0: Port device team_slave_0 added [ 34.696918][ T4822] team0: Port device team_slave_1 added [ 34.702438][ T4822] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 34.702446][ T4822] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 34.702461][ T4822] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 34.702939][ T4822] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 34.702945][ T4822] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 34.702956][ T4822] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 34.712831][ T4822] hsr_slave_0: entered promiscuous mode [ 34.713114][ T4822] hsr_slave_1: entered promiscuous mode [ 34.713318][ T4822] debugfs: 'hsr0' already exists in 'hsr' [ 34.713375][ T4822] Cannot create hsr debugfs directory [ 36.570877][ T4767] Bluetooth: hci0: command tx timeout [ 38.015819][ T61] bridge_slave_1: left allmulticast mode [ 38.015845][ T61] bridge_slave_1: left promiscuous mode [ 38.016155][ T61] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.017963][ T61] bridge_slave_0: left allmulticast mode [ 38.017976][ T61] bridge_slave_0: left promiscuous mode [ 38.018036][ T61] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.071055][ T61] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 38.084528][ T61] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 38.121292][ T61] bond0 (unregistering): Released all slaves [ 38.158134][ T61] hsr_slave_0: left promiscuous mode [ 38.158437][ T61] hsr_slave_1: left promiscuous mode [ 38.158732][ T61] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 38.158747][ T61] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 38.159118][ T61] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 38.159128][ T61] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 38.171815][ T61] veth1_macvtap: left promiscuous mode [ 38.171846][ T61] veth0_macvtap: left promiscuous mode [ 38.171892][ T61] veth1_vlan: left promiscuous mode [ 38.171960][ T61] veth0_vlan: left promiscuous mode [ 38.269168][ T61] team0 (unregistering): Port device team_slave_1 removed [ 38.272932][ T61] team0 (unregistering): Port device team_slave_0 removed [ 38.319618][ T4399] 8021q: adding VLAN 0 to HW filter on device eth0 [ 38.561315][ T4822] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 38.562759][ T4822] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 38.563169][ T4822] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 38.564187][ T4822] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 38.564547][ T4822] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 38.565387][ T4822] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 38.565752][ T4822] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 38.566571][ T4822] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 38.606951][ T4822] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.610597][ T4822] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.612121][ T3404] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.612145][ T3404] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.614584][ T3404] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.614608][ T3404] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.620876][ T4822] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 38.620888][ T4822] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 38.651706][ T4767] Bluetooth: hci0: command tx timeout [ 38.751403][ T4822] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.762709][ T4822] veth0_vlan: entered promiscuous mode [ 38.764540][ T4822] veth1_vlan: entered promiscuous mode [ 38.773621][ T4822] veth0_macvtap: entered promiscuous mode [ 38.774992][ T4822] veth1_macvtap: entered promiscuous mode [ 38.779046][ T4822] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 38.779945][ T4822] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 38.808902][ T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 38.808913][ T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 38.821229][ T61] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 38.821242][ T61] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 38.840776][ T1159] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.852477][ T4918] syz.0.17 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 38.852495][ T4918] CPU: 0 UID: 0 PID: 4918 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT [ 38.852505][ T4918] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 38.852510][ T4918] Call trace: [ 38.852513][ T4918] show_stack+0x2c/0x3c (C) [ 38.852533][ T4918] __dump_stack+0x30/0x40 [ 38.852546][ T4918] dump_stack_lvl+0xd8/0x12c [ 38.852556][ T4918] dump_stack+0x1c/0x28 [ 38.852565][ T4918] dump_header+0xbc/0x3f0 [ 38.852573][ T4918] oom_kill_process+0x248/0x864 [ 38.852582][ T4918] out_of_memory+0xd24/0x1064 [ 38.852590][ T4918] mem_cgroup_out_of_memory+0xe8/0x170 [ 38.852599][ T4918] try_charge_memcg+0x9bc/0xd38 [ 38.852606][ T4918] obj_cgroup_charge_pages+0x44/0xc8 [ 38.852616][ T4918] __memcg_slab_post_alloc_hook+0x498/0x824 [ 38.852626][ T4918] kmem_cache_alloc_lru_noprof+0x32c/0x5d8 [ 38.852635][ T4918] alloc_inode+0x84/0x198 [ 38.852645][ T4918] new_inode+0x20/0x50 [ 38.852655][ T4918] gadgetfs_make_inode+0x34/0x18c [ 38.852666][ T4918] gadgetfs_create_file+0x48/0xd8 [ 38.852686][ T4918] gadgetfs_bind+0x3f8/0x75c [ 38.852697][ T4918] gadget_bind_driver+0x274/0x834 [ 38.852707][ T4918] really_probe+0x29c/0x800 [ 38.852716][ T4918] __driver_probe_device+0x1e0/0x350 [ 38.852724][ T4918] driver_probe_device+0x6c/0x19c [ 38.852732][ T4918] __driver_attach+0x168/0x384 [ 38.852739][ T4918] bus_for_each_dev+0x128/0x1b4 [ 38.852749][ T4918] driver_attach+0x50/0x60 [ 38.852756][ T4918] bus_add_driver+0x208/0x500 [ 38.852766][ T4918] driver_register+0x220/0x310 [ 38.852774][ T4918] usb_gadget_register_driver_owner+0xf0/0x25c [ 38.852783][ T4918] dev_config+0x91c/0xcc0 [ 38.852793][ T4918] vfs_write+0x2a4/0xa0c [ 38.852800][ T4918] ksys_write+0x12c/0x228 [ 38.852807][ T4918] __arm64_sys_write+0x84/0x98 [ 38.852814][ T4918] invoke_syscall+0x98/0x244 [ 38.852825][ T4918] el0_svc_common+0xec/0x23c [ 38.852834][ T4918] do_el0_svc+0x4c/0x5c [ 38.852844][ T4918] el0_svc+0x60/0x1d8 [ 38.852852][ T4918] el0t_64_sync_handler+0x44/0x104 [ 38.852859][ T4918] el0t_64_sync+0x198/0x19c [ 38.852869][ T4918] memory: usage 0kB, limit 0kB, failcnt 19 [ 38.852874][ T4918] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 38.852880][ T4918] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 38.852884][ T4918] Memory cgroup stats for /syz0/test: [ 38.852948][ T4918] cache 0 [ 38.852952][ T4918] rss 0 [ 38.852955][ T4918] rss_huge 0 [ 38.852958][ T4918] shmem 0 [ 38.852961][ T4918] mapped_file 0 [ 38.852964][ T4918] dirty 0 [ 38.852967][ T4918] writeback 0 [ 38.852970][ T4918] workingset_refault_anon 0 [ 38.852973][ T4918] workingset_refault_file 0 [ 38.852976][ T4918] swap 0 [ 38.852979][ T4918] swapcached 0 [ 38.852982][ T4918] pgpgin 0 [ 38.852985][ T4918] pgpgout 0 [ 38.852988][ T4918] pgfault 0 [ 38.852991][ T4918] pgmajfault 0 [ 38.852994][ T4918] inactive_anon 0 [ 38.852997][ T4918] active_anon 0 [ 38.853000][ T4918] inactive_file 0 [ 38.853003][ T4918] active_file 0 [ 38.853006][ T4918] unevictable 0 [ 38.853009][ T4918] hierarchical_memory_limit 0 [ 38.853012][ T4918] hierarchical_memsw_limit 9223372036854771712 [ 38.853016][ T4918] total_cache 0 [ 38.853018][ T4918] total_rss 0 [ 38.853021][ T4918] total_rss_huge 0 [ 38.853024][ T4918] total_shmem 0 [ 38.853027][ T4918] total_mapped_file 0 [ 38.853031][ T4918] total_dirty 0 [ 38.853034][ T4918] total_writeback 0 [ 38.853037][ T4918] total_workingset_refault_anon 0 [ 38.853040][ T4918] total_workingset_refault_file 0 [ 38.853043][ T4918] total_swap 0 [ 38.853046][ T4918] total_swapcached 0 [ 38.853049][ T4918] total_pgpgin 0 [ 38.853052][ T4918] total_pgpgout 0 [ 38.853055][ T4918] total_pgfault 0 [ 38.853058][ T4918] total_pgmajfault 0 [ 38.853061][ T4918] total_inactive_anon 0 [ 38.853065][ T4918] total_active_anon 0 [ 38.853068][ T4918] total_inactive_file 0 [ 38.853071][ T4918] total_active_file 0 [ 38.853074][ T4918] total_unevictable 0 [ 38.853077][ T4918] anon_cost 0 [ 38.853080][ T4918] file_cost 0 [ 38.853083][ T4918] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0,oom_memcg=/syz0/test,task_memcg=/syz0/test,task=syz.0.17,pid=4918,uid=0 [ 38.853161][ T4918] Memory cgroup out of memory: Killed process 4918 (syz.0.17) total-vm:44824kB, anon-rss:1300kB, file-rss:1040kB, shmem-rss:0kB, UID:0 pgtables:72kB oom_score_adj:1000 [ 38.855725][ T4918] udc dummy_udc.0: failed to start USB Gadget filesystem: -12 [ 38.855740][ T4918] gadgetfs gadget.0: probe with driver gadgetfs failed with error -12 [ 38.855916][ T4918] gadgetfs expected dummy_udc controller not usbip-vudc [ 38.855925][ T4918] udc usbip-vudc.0: failed to start USB Gadget filesystem: -19 [ 38.856395][ T4918] UDC core: USB Gadget filesystem: couldn't find an available UDC [ 38.868562][ T4920] ================================================================== [ 38.868571][ T4920] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irq+0x58/0x70 [ 38.868584][ T4920] Read of size 1 at addr ffff0000c9fb1818 by task syz.0.18/4920 [ 38.868591][ T4920] [ 38.868595][ T4920] CPU: 0 UID: 0 PID: 4920 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT [ 38.868604][ T4920] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 38.868608][ T4920] Call trace: [ 38.868611][ T4920] show_stack+0x2c/0x3c (C) [ 38.868624][ T4920] __dump_stack+0x30/0x40 [ 38.868633][ T4920] dump_stack_lvl+0xd8/0x12c [ 38.868643][ T4920] print_address_description+0xb0/0x238 [ 38.868650][ T4920] print_report+0x68/0x84 [ 38.868657][ T4920] kasan_report+0x8c/0xc4 [ 38.868666][ T4920] __kasan_check_byte+0x3c/0x54 [ 38.868681][ T4920] lock_acquire+0xa4/0x320 [ 38.868689][ T4920] _raw_spin_lock_irq+0x58/0x70 [ 38.868697][ T4920] gadget_dev_open+0x50/0x1c4 [ 38.868708][ T4920] do_dentry_open+0x5c4/0xfbc [ 38.868718][ T4920] vfs_open+0x44/0x2dc [ 38.868727][ T4920] path_openat+0x1084/0x18f0 [ 38.868736][ T4920] do_file_open+0x1c8/0x2e8 [ 38.868744][ T4920] do_sys_openat2+0x114/0x1e8 [ 38.868754][ T4920] do_sys_open+0xb0/0xe0 [ 38.868763][ T4920] __arm64_sys_openat+0xa8/0xc4 [ 38.868772][ T4920] invoke_syscall+0x98/0x244 [ 38.868782][ T4920] el0_svc_common+0xec/0x23c [ 38.868791][ T4920] do_el0_svc+0x4c/0x5c [ 38.868801][ T4920] el0_svc+0x60/0x1d8 [ 38.868807][ T4920] el0t_64_sync_handler+0x44/0x104 [ 38.868814][ T4920] el0t_64_sync+0x198/0x19c [ 38.868822][ T4920] [ 38.868824][ T4920] Allocated by task 4822: [ 38.868828][ T4920] kasan_save_track+0x40/0x78 [ 38.868835][ T4920] kasan_save_alloc_info+0x40/0x50 [ 38.868842][ T4920] __kasan_kmalloc+0x9c/0xb4 [ 38.868848][ T4920] __kmalloc_cache_noprof+0x2f4/0x5fc [ 38.868855][ T4920] gadgetfs_fill_super+0x19c/0x370 [ 38.868863][ T4920] vfs_get_super+0xb8/0x148 [ 38.868870][ T4920] get_tree_single+0x30/0x40 [ 38.868876][ T4920] gadgetfs_get_tree+0x28/0x38 [ 38.868884][ T4920] vfs_get_tree+0x90/0x28c [ 38.868891][ T4920] fc_mount+0x24/0xac [ 38.868898][ T4920] do_new_mount+0x2a4/0x538 [ 38.868905][ T4920] path_mount+0x5f0/0xa88 [ 38.868912][ T4920] do_mount+0xe8/0x148 [ 38.868920][ T4920] __arm64_sys_mount+0x33c/0x388 [ 38.868927][ T4920] invoke_syscall+0x98/0x244 [ 38.868935][ T4920] el0_svc_common+0xec/0x23c [ 38.868943][ T4920] do_el0_svc+0x4c/0x5c [ 38.868951][ T4920] el0_svc+0x60/0x1d8 [ 38.868956][ T4920] el0t_64_sync_handler+0x44/0x104 [ 38.868961][ T4920] el0t_64_sync+0x198/0x19c [ 38.868966][ T4920] [ 38.868968][ T4920] Freed by task 4918: [ 38.868971][ T4920] kasan_save_track+0x40/0x78 [ 38.868977][ T4920] kasan_save_free_info+0x54/0x6c [ 38.868984][ T4920] __kasan_slab_free+0x74/0xa4 [ 38.868990][ T4920] kfree+0x188/0x658 [ 38.868995][ T4920] put_dev+0x8c/0xf8 [ 38.869003][ T4920] dev_release+0x100/0x15c [ 38.869011][ T4920] __fput+0x338/0x74c [ 38.869016][ T4920] ____fput+0x20/0x30 [ 38.869022][ T4920] task_work_run+0x1cc/0x25c [ 38.869031][ T4920] do_exit+0x58c/0x1a74 [ 38.869039][ T4920] do_group_exit+0x198/0x238 [ 38.869044][ T4920] get_signal+0xfb0/0x1094 [ 38.869050][ T4920] arch_do_signal_or_restart+0x288/0x444c [ 38.869058][ T4920] exit_to_user_mode_loop+0x70/0x17c [ 38.869066][ T4920] el0_svc+0x12c/0x1d8 [ 38.869071][ T4920] el0t_64_sync_handler+0x44/0x104 [ 38.869077][ T4920] el0t_64_sync+0x198/0x19c [ 38.869082][ T4920] [ 38.869083][ T4920] The buggy address belongs to the object at ffff0000c9fb1800 [ 38.869083][ T4920] which belongs to the cache kmalloc-1k of size 1024 [ 38.869089][ T4920] The buggy address is located 24 bytes inside of [ 38.869089][ T4920] freed 1024-byte region [ffff0000c9fb1800, ffff0000c9fb1c00) [ 38.869095][ T4920] [ 38.869097][ T4920] The buggy address belongs to the physical page: [ 38.869101][ T4920] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109fb0 [ 38.869107][ T4920] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 38.869113][ T4920] flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 38.869120][ T4920] page_type: f5(slab) [ 38.869127][ T4920] raw: 05ffc00000000040 ffff0000c0001dc0 dead000000000100 dead000000000122 [ 38.869132][ T4920] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 38.869138][ T4920] head: 05ffc00000000040 ffff0000c0001dc0 dead000000000100 dead000000000122 [ 38.869144][ T4920] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 38.869149][ T4920] head: 05ffc00000000003 fffffdffc327ec01 00000000ffffffff 00000000ffffffff [ 38.869154][ T4920] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 38.869158][ T4920] page dumped because: kasan: bad access detected [ 38.869160][ T4920] [ 38.869162][ T4920] Memory state around the buggy address: [ 38.869165][ T4920] ffff0000c9fb1700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.869170][ T4920] ffff0000c9fb1780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.869174][ T4920] >ffff0000c9fb1800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 38.869177][ T4920] ^ [ 38.869180][ T4920] ffff0000c9fb1880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 38.869184][ T4920] ffff0000c9fb1900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 38.869188][ T4920] ================================================================== [ 38.869191][ T4920] Disabling lock debugging due to kernel taint [ 38.869194][ T4920] ------------[ cut here ]------------ [ 38.869197][ T4920] UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.h:68:9 [ 38.869203][ T4920] index 12985 is out of range for type 'unsigned long[8]' [ 38.869208][ T4920] CPU: 0 UID: 0 PID: 4920 Comm: syz.0.18 Tainted: G B syzkaller #0 PREEMPT [ 38.869216][ T4920] Tainted: [B]=BAD_PAGE [ 38.869219][ T4920] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 38.869222][ T4920] Call trace: [ 38.869224][ T4920] show_stack+0x2c/0x3c (C) [ 38.869234][ T4920] __dump_stack+0x30/0x40 [ 38.869243][ T4920] dump_stack_lvl+0xd8/0x12c [ 38.869252][ T4920] dump_stack+0x1c/0x28 [ 38.869261][ T4920] ubsan_epilogue+0x14/0x48 [ 38.869269][ T4920] __ubsan_handle_out_of_bounds+0xd0/0xf8 [ 38.869280][ T4920] queued_spin_lock_slowpath+0x834/0xb5c [ 38.869288][ T4920] do_raw_spin_lock+0x21c/0x2d0 [ 38.869296][ T4920] _raw_spin_lock_irq+0x60/0x70 [ 38.869303][ T4920] gadget_dev_open+0x50/0x1c4 [ 38.869312][ T4920] do_dentry_open+0x5c4/0xfbc [ 38.869322][ T4920] vfs_open+0x44/0x2dc [ 38.869330][ T4920] path_openat+0x1084/0x18f0 [ 38.869339][ T4920] do_file_open+0x1c8/0x2e8 [ 38.869347][ T4920] do_sys_openat2+0x114/0x1e8 [ 38.869356][ T4920] do_sys_open+0xb0/0xe0 [ 38.869365][ T4920] __arm64_sys_openat+0xa8/0xc4 [ 38.869374][ T4920] invoke_syscall+0x98/0x244 [ 38.869384][ T4920] el0_svc_common+0xec/0x23c [ 38.869393][ T4920] do_el0_svc+0x4c/0x5c [ 38.869402][ T4920] el0_svc+0x60/0x1d8 [ 38.869408][ T4920] el0t_64_sync_handler+0x44/0x104 [ 38.869415][ T4920] el0t_64_sync+0x198/0x19c [ 38.869421][ T4920] ---[ end trace ]--- [ 38.920756][ T1159] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.310960][ T40] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.311341][ T40] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.760607][ T4767] Bluetooth: hci0: command tx timeout [ 42.810415][ T4767] Bluetooth: hci0: command tx timeout