Warning: Permanently added '10.128.1.4' (ED25519) to the list of known hosts. 2026/08/25 22:21:11 parsed 1 programs 2026/08/25 22:21:11 serving rpc on tcp://42349 syzkaller login: [ 90.263930][ T5787] cgroup: Unknown subsys name 'net' [ 90.427727][ T5787] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 92.210624][ T788] cfg80211: failed to load regulatory.db [ 92.234512][ T5787] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 95.286630][ T2917] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.294941][ T2917] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.351194][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.362406][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.134253][ T5860] chnl_net:caif_netlink_parms(): no params data found [ 98.283033][ T5860] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.291466][ T5860] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.298823][ T5860] bridge_slave_0: entered allmulticast mode [ 98.305989][ T5860] bridge_slave_0: entered promiscuous mode [ 98.316159][ T5860] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.323470][ T5860] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.331208][ T5860] bridge_slave_1: entered allmulticast mode [ 98.338497][ T5860] bridge_slave_1: entered promiscuous mode [ 98.378877][ T5860] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 98.391171][ T5860] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 98.421964][ T5860] team0: Port device team_slave_0 added [ 98.431761][ T5860] team0: Port device team_slave_1 added [ 98.471159][ T5860] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.478224][ T5860] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 98.504378][ T5860] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.519112][ T5860] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 98.526202][ T5860] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 98.552804][ T5860] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 98.607279][ T5860] hsr_slave_0: entered promiscuous mode [ 98.614360][ T5860] hsr_slave_1: entered promiscuous mode [ 98.846922][ T5860] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 98.859724][ T5860] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 98.885235][ T5860] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 98.896630][ T5860] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 99.015937][ T5860] 8021q: adding VLAN 0 to HW filter on device bond0 [ 99.044623][ T5860] 8021q: adding VLAN 0 to HW filter on device team0 [ 99.062070][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.069645][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 99.086825][ T3453] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.094055][ T3453] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.342567][ T5860] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 99.385664][ T5860] veth0_vlan: entered promiscuous mode [ 99.398580][ T5860] veth1_vlan: entered promiscuous mode [ 99.431107][ T5860] veth0_macvtap: entered promiscuous mode [ 99.441585][ T5860] veth1_macvtap: entered promiscuous mode [ 99.462979][ T5860] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 99.477648][ T5860] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 99.491924][ T5860] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.501195][ T5860] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.510151][ T5860] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.519349][ T5860] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.646291][ T5860] syz-executor (5860) used greatest stack depth: 20760 bytes left [ 99.685964][ T11] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.864425][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 99.874147][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 99.883279][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 99.894898][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 99.903517][ T51] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 99.911465][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 2026/08/25 22:21:24 executed programs: 0 [ 100.685576][ T5086] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 100.696869][ T5086] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 100.705371][ T5086] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 100.714194][ T5086] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 100.723295][ T5086] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 100.732249][ T5086] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 100.914603][ T5891] chnl_net:caif_netlink_parms(): no params data found [ 101.004233][ T5891] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.012179][ T5891] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.020009][ T5891] bridge_slave_0: entered allmulticast mode [ 101.027093][ T5891] bridge_slave_0: entered promiscuous mode [ 101.037095][ T5891] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.044546][ T5891] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.052215][ T5891] bridge_slave_1: entered allmulticast mode [ 101.060603][ T5891] bridge_slave_1: entered promiscuous mode [ 101.094837][ T5891] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.107269][ T5891] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.139944][ T5891] team0: Port device team_slave_0 added [ 101.149251][ T5891] team0: Port device team_slave_1 added [ 101.177229][ T5891] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.184760][ T5891] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 101.212046][ T5891] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.225636][ T5891] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.233277][ T5891] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 101.260772][ T5891] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.309155][ T5891] hsr_slave_0: entered promiscuous mode [ 101.315679][ T5891] hsr_slave_1: entered promiscuous mode [ 101.322207][ T5891] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 101.331614][ T5891] Cannot create hsr debugfs directory [ 102.302953][ T11] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 102.778822][ T5086] Bluetooth: hci0: command tx timeout [ 104.650777][ T11] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 104.703542][ T11] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 104.849425][ T5086] Bluetooth: hci0: command tx timeout [ 105.633971][ T11] hsr_slave_0: left promiscuous mode [ 105.640679][ T11] hsr_slave_1: left promiscuous mode [ 105.647036][ T11] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 105.658956][ T11] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 105.667886][ T11] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 105.679655][ T11] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 105.687686][ T11] bridge_slave_1: left allmulticast mode [ 105.696353][ T11] bridge_slave_1: left promiscuous mode [ 105.703751][ T11] bridge0: port 2(bridge_slave_1) entered disabled state [ 105.722152][ T11] bridge_slave_0: left allmulticast mode [ 105.727903][ T11] bridge_slave_0: left promiscuous mode [ 105.736898][ T11] bridge0: port 1(bridge_slave_0) entered disabled state [ 105.777048][ T11] veth1_macvtap: left promiscuous mode [ 105.783313][ T11] veth0_macvtap: left promiscuous mode [ 105.792465][ T11] veth1_vlan: left promiscuous mode [ 105.798540][ T11] veth0_vlan: left promiscuous mode [ 106.304202][ T11] team0 (unregistering): Port device team_slave_1 removed [ 106.344439][ T11] team0 (unregistering): Port device team_slave_0 removed [ 106.378698][ T11] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 106.415748][ T11] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 106.672704][ T11] bond0 (unregistering): Released all slaves [ 106.749639][ T5891] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 106.770929][ T5891] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 106.783978][ T5891] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 106.796630][ T5891] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 106.911247][ T5891] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.928875][ T5086] Bluetooth: hci0: command tx timeout [ 106.943600][ T5891] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.956989][ T3481] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.964382][ T3481] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.979293][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.986482][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.243821][ T5891] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.302832][ T5891] veth0_vlan: entered promiscuous mode [ 107.319125][ T5891] veth1_vlan: entered promiscuous mode [ 107.364675][ T5891] veth0_macvtap: entered promiscuous mode [ 107.375878][ T5891] veth1_macvtap: entered promiscuous mode [ 107.406316][ T5891] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 107.425494][ T5891] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 107.453822][ T5891] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.462794][ T5891] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.472742][ T5891] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.481573][ T5891] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.583956][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.593013][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 2026/08/25 22:21:31 executed programs: 2 [ 107.640598][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.649864][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.729906][ C1] hrtimer: interrupt took 89191 ns [ 109.010673][ T5086] Bluetooth: hci0: command tx timeout [ 110.266066][ C0] ================================================================== [ 110.274198][ C0] BUG: KASAN: slab-out-of-bounds in __bpf_get_stackid+0x6c7/0x900 [ 110.282039][ C0] Write of size 32 at addr ffff888060bb6c60 by task syz.0.82/5997 [ 110.289858][ C0] [ 110.292220][ C0] CPU: 0 PID: 5997 Comm: syz.0.82 Not tainted syzkaller #0 [ 110.299419][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 110.309693][ C0] Call Trace: [ 110.313006][ C0] [ 110.315950][ C0] dump_stack_lvl+0x18c/0x250 [ 110.320821][ C0] ? read_lock_is_recursive+0x20/0x20 [ 110.326400][ C0] ? show_regs_print_info+0x20/0x20 [ 110.331889][ C0] ? load_image+0x420/0x420 [ 110.336414][ C0] ? _raw_spin_lock_irqsave+0xc0/0x100 [ 110.341899][ C0] ? __virt_addr_valid+0x10c/0x380 [ 110.347046][ C0] ? __virt_addr_valid+0x10c/0x380 [ 110.352183][ C0] ? __virt_addr_valid+0x10c/0x380 [ 110.357326][ C0] print_report+0xa8/0x210 [ 110.361858][ C0] ? __bpf_get_stackid+0x6c7/0x900 [ 110.367002][ C0] kasan_report+0x117/0x150 [ 110.371617][ C0] ? __bpf_get_stackid+0x6c7/0x900 [ 110.376868][ C0] kasan_check_range+0x241/0x290 [ 110.381832][ C0] ? __bpf_get_stackid+0x6c7/0x900 [ 110.386969][ C0] __asan_memcpy+0x40/0x70 [ 110.391414][ C0] __bpf_get_stackid+0x6c7/0x900 [ 110.396383][ C0] bpf_get_stackid_pe+0x2f0/0x410 [ 110.401523][ C0] bpf_prog_d499e7ac612d6085+0x2c/0x44 [ 110.407019][ C0] bpf_overflow_handler+0x1fc/0x510 [ 110.412245][ C0] ? bpf_overflow_handler+0xde/0x510 [ 110.417646][ C0] ? tp_perf_event_destroy+0x20/0x20 [ 110.422961][ C0] ? __lock_acquire+0x1336/0x7d80 [ 110.428105][ C0] ? __perf_event_account_interrupt+0x187/0x280 [ 110.434396][ C0] __perf_event_overflow+0x461/0x660 [ 110.439730][ C0] perf_swevent_hrtimer+0x437/0x610 [ 110.444972][ C0] ? cpu_clock_event_read+0x40/0x40 [ 110.450215][ C0] ? do_raw_spin_unlock+0x121/0x230 [ 110.455442][ C0] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 110.461356][ C0] ? _raw_spin_unlock+0x40/0x40 [ 110.466230][ C0] ? cpu_clock_event_read+0x40/0x40 [ 110.471460][ C0] __hrtimer_run_queues+0x4e8/0xc10 [ 110.476680][ C0] ? ktime_get_update_offsets_now+0x99/0x3f0 [ 110.482682][ C0] ? ktime_get_update_offsets_now+0x99/0x3f0 [ 110.488693][ C0] ? hrtimer_interrupt+0x980/0x980 [ 110.493833][ C0] ? read_tsc+0x9/0x20 [ 110.497926][ C0] ? ktime_get_update_offsets_now+0x3d2/0x3f0 [ 110.504031][ C0] hrtimer_interrupt+0x39d/0x980 [ 110.509004][ C0] __sysvec_apic_timer_interrupt+0xfb/0x3b0 [ 110.514952][ C0] sysvec_apic_timer_interrupt+0x51/0xc0 [ 110.520621][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 110.526658][ C0] RIP: 0033:0x7f2ca4456699 [ 110.531102][ C0] Code: 00 53 48 8b 1d 28 17 3d 00 45 31 d2 31 c9 48 8b 17 45 31 db 4c 8d 83 00 00 40 00 48 89 d0 0f 1f 00 4c 39 c0 73 63 44 0f b6 08 <48> 83 c0 01 4c 89 ce 83 e6 7f 48 d3 e6 49 09 f2 45 84 c9 79 2a 83 [ 110.550819][ C0] RSP: 002b:00007ffc12fa22c0 EFLAGS: 00000283 [ 110.556918][ C0] RAX: 0000001b2be20762 RBX: 0000001b2be20000 RCX: 0000000000000000 [ 110.564907][ C0] RDX: 0000001b2be20762 RSI: 0000000000000081 RDI: 00007f2ca4825fb0 [ 110.572902][ C0] RBP: 00007f2ca4825fb0 R08: 0000001b2c220000 R09: 0000000000000001 [ 110.580897][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: 00007f2ca4825fa0 [ 110.588905][ C0] R13: 0000200000000000 R14: 00007ffc12fa22d8 R15: 00007f2ca4825fa0 [ 110.596922][ C0] [ 110.599973][ C0] [ 110.602320][ C0] Allocated by task 5997: [ 110.606672][ C0] kasan_set_track+0x4e/0x70 [ 110.611480][ C0] __kasan_kmalloc+0x8f/0xa0 [ 110.616115][ C0] __kmalloc_node+0xb6/0x240 [ 110.620747][ C0] bpf_map_area_alloc+0x5e/0x110 [ 110.625731][ C0] prealloc_elems_and_freelist+0x86/0x1c0 [ 110.631598][ C0] stack_map_alloc+0x32b/0x4b0 [ 110.636413][ C0] map_create+0x877/0x12f0 [ 110.640857][ C0] __sys_bpf+0x651/0x890 [ 110.645171][ C0] __x64_sys_bpf+0x7c/0x90 [ 110.649623][ C0] do_syscall_64+0x55/0xb0 [ 110.654081][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 110.660044][ C0] [ 110.662400][ C0] Last potentially related work creation: [ 110.668140][ C0] kasan_save_stack+0x3e/0x60 [ 110.672866][ C0] __kasan_record_aux_stack+0xaf/0xc0 [ 110.678279][ C0] call_rcu+0x153/0x900 [ 110.682472][ C0] __nf_register_net_hook+0x787/0x910 [ 110.687911][ C0] nf_register_net_hook+0xb2/0x190 [ 110.693151][ C0] nf_register_net_hooks+0x44/0x1b0 [ 110.698426][ C0] ipt_register_table+0x51a/0x7b0 [ 110.703492][ C0] iptable_mangle_table_init+0x41/0x60 [ 110.708989][ C0] xt_find_table_lock+0x304/0x3e0 [ 110.714091][ C0] xt_request_find_table_lock+0x26/0x100 [ 110.719769][ C0] do_ipt_get_ctl+0x71a/0x1210 [ 110.724580][ C0] nf_getsockopt+0x262/0x280 [ 110.729386][ C0] ip_getsockopt+0x19f/0x230 [ 110.734015][ C0] do_sock_getsockopt+0x379/0x450 [ 110.739071][ C0] __x64_sys_getsockopt+0x1d6/0x280 [ 110.744293][ C0] do_syscall_64+0x55/0xb0 [ 110.748737][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 110.754831][ C0] [ 110.757175][ C0] The buggy address belongs to the object at ffff888060bb6c00 [ 110.757175][ C0] which belongs to the cache kmalloc-cg-128 of size 128 [ 110.771509][ C0] The buggy address is located 96 bytes inside of [ 110.771509][ C0] allocated 120-byte region [ffff888060bb6c00, ffff888060bb6c78) [ 110.785593][ C0] [ 110.788124][ C0] The buggy address belongs to the physical page: [ 110.794591][ C0] page:ffffea000182ed80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x60bb6 [ 110.804776][ C0] memcg:ffff88805fc3cf01 [ 110.809042][ C0] flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff) [ 110.816696][ C0] page_type: 0xffffffff() [ 110.821061][ C0] raw: 00fff00000000800 ffff888017c4dc80 ffffea000089c9c0 0000000000000006 [ 110.829674][ C0] raw: 0000000000000000 0000000080100010 00000001ffffffff ffff88805fc3cf01 [ 110.838646][ C0] page dumped because: kasan: bad access detected [ 110.845084][ C0] page_owner tracks the page as allocated [ 110.850818][ C0] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 3481, tgid 3481 (kworker/u4:10), ts 95457073768, free_ts 95446395233 [ 110.869427][ C0] post_alloc_hook+0x1c1/0x200 [ 110.874250][ C0] get_page_from_freelist+0x2181/0x22a0 [ 110.879855][ C0] __alloc_pages+0x1f0/0x460 [ 110.884481][ C0] alloc_slab_page+0x5d/0x180 [ 110.889281][ C0] new_slab+0x87/0x2d0 [ 110.893379][ C0] ___slab_alloc+0xc5c/0x12f0 [ 110.898266][ C0] __kmem_cache_alloc_node+0x11f/0x250 [ 110.904278][ C0] __kmalloc_node+0xa6/0x240 [ 110.909170][ C0] kvmalloc_node+0x70/0x180 [ 110.913870][ C0] __nf_hook_entries_try_shrink+0x336/0x700 [ 110.919973][ C0] __nf_unregister_net_hook+0x4da/0x6d0 [ 110.925722][ C0] nf_unregister_net_hooks+0xcb/0x130 [ 110.931835][ C0] cleanup_net+0x592/0xbb0 [ 110.936797][ C0] process_scheduled_works+0xa60/0x1600 [ 110.943429][ C0] worker_thread+0xa5e/0xfe0 [ 110.949681][ C0] kthread+0x2fa/0x390 [ 110.954450][ C0] page last free stack trace: [ 110.960298][ C0] free_unref_page_prepare+0x7d7/0x8f0 [ 110.966581][ C0] free_unref_page_list+0xbe/0x860 [ 110.972351][ C0] release_pages+0x208a/0x2300 [ 110.977162][ C0] tlb_flush_mmu+0x379/0x510 [ 110.981795][ C0] tlb_finish_mmu+0xf4/0x220 [ 110.986515][ C0] exit_mmap+0x428/0xb90 [ 110.990958][ C0] __mmput+0x118/0x3a0 [ 110.995220][ C0] exit_mm+0x23f/0x340 [ 110.999519][ C0] do_exit+0x909/0x2530 [ 111.003892][ C0] do_group_exit+0x22d/0x2f0 [ 111.009408][ C0] get_signal+0x12a6/0x1390 [ 111.014032][ C0] arch_do_signal_or_restart+0xc2/0x7b0 [ 111.020273][ C0] exit_to_user_mode_loop+0x70/0x110 [ 111.026662][ C0] exit_to_user_mode_prepare+0xee/0x180 [ 111.032785][ C0] syscall_exit_to_user_mode+0x1a/0x50 [ 111.038478][ C0] do_syscall_64+0x61/0xb0 [ 111.043725][ C0] [ 111.046442][ C0] Memory state around the buggy address: [ 111.052736][ C0] ffff888060bb6b00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 111.060830][ C0] ffff888060bb6b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 111.069000][ C0] >ffff888060bb6c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 111.077598][ C0] ^ [ 111.085586][ C0] ffff888060bb6c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 111.093840][ C0] ffff888060bb6d00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 111.101940][ C0] ================================================================== [ 111.110018][ C0] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 111.117238][ C0] CPU: 0 PID: 5997 Comm: syz.0.82 Not tainted syzkaller #0 [ 111.124462][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 111.134730][ C0] Call Trace: [ 111.138041][ C0] [ 111.141248][ C0] dump_stack_lvl+0x18c/0x250 [ 111.145964][ C0] ? show_regs_print_info+0x20/0x20 [ 111.151184][ C0] ? load_image+0x420/0x420 [ 111.155932][ C0] panic+0x2ca/0x720 [ 111.159951][ C0] ? __lock_acquire+0x7d80/0x7d80 [ 111.165002][ C0] ? bpf_jit_dump+0xd0/0xd0 [ 111.169534][ C0] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 111.175463][ C0] ? _raw_spin_unlock+0x40/0x40 [ 111.180359][ C0] ? __bpf_get_stackid+0x6c7/0x900 [ 111.185752][ C0] check_panic_on_warn+0x84/0xa0 [ 111.190720][ C0] ? __bpf_get_stackid+0x6c7/0x900 [ 111.196218][ C0] end_report+0x6f/0x130 [ 111.200492][ C0] kasan_report+0x128/0x150 [ 111.205631][ C0] ? __bpf_get_stackid+0x6c7/0x900 [ 111.210770][ C0] kasan_check_range+0x241/0x290 [ 111.215729][ C0] ? __bpf_get_stackid+0x6c7/0x900 [ 111.220863][ C0] __asan_memcpy+0x40/0x70 [ 111.225477][ C0] __bpf_get_stackid+0x6c7/0x900 [ 111.230530][ C0] bpf_get_stackid_pe+0x2f0/0x410 [ 111.235575][ C0] bpf_prog_d499e7ac612d6085+0x2c/0x44 [ 111.241049][ C0] bpf_overflow_handler+0x1fc/0x510 [ 111.246276][ C0] ? bpf_overflow_handler+0xde/0x510 [ 111.251698][ C0] ? tp_perf_event_destroy+0x20/0x20 [ 111.257181][ C0] ? __lock_acquire+0x1336/0x7d80 [ 111.262238][ C0] ? __perf_event_account_interrupt+0x187/0x280 [ 111.268505][ C0] __perf_event_overflow+0x461/0x660 [ 111.274071][ C0] perf_swevent_hrtimer+0x437/0x610 [ 111.279385][ C0] ? cpu_clock_event_read+0x40/0x40 [ 111.284612][ C0] ? do_raw_spin_unlock+0x121/0x230 [ 111.289865][ C0] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 111.295776][ C0] ? _raw_spin_unlock+0x40/0x40 [ 111.300830][ C0] ? cpu_clock_event_read+0x40/0x40 [ 111.306135][ C0] __hrtimer_run_queues+0x4e8/0xc10 [ 111.311543][ C0] ? ktime_get_update_offsets_now+0x99/0x3f0 [ 111.317659][ C0] ? ktime_get_update_offsets_now+0x99/0x3f0 [ 111.324127][ C0] ? hrtimer_interrupt+0x980/0x980 [ 111.329480][ C0] ? read_tsc+0x9/0x20 [ 111.333578][ C0] ? ktime_get_update_offsets_now+0x3d2/0x3f0 [ 111.339785][ C0] hrtimer_interrupt+0x39d/0x980 [ 111.344867][ C0] __sysvec_apic_timer_interrupt+0xfb/0x3b0 [ 111.351163][ C0] sysvec_apic_timer_interrupt+0x51/0xc0 [ 111.357274][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 111.363384][ C0] RIP: 0033:0x7f2ca4456699 [ 111.368731][ C0] Code: 00 53 48 8b 1d 28 17 3d 00 45 31 d2 31 c9 48 8b 17 45 31 db 4c 8d 83 00 00 40 00 48 89 d0 0f 1f 00 4c 39 c0 73 63 44 0f b6 08 <48> 83 c0 01 4c 89 ce 83 e6 7f 48 d3 e6 49 09 f2 45 84 c9 79 2a 83 [ 111.388555][ C0] RSP: 002b:00007ffc12fa22c0 EFLAGS: 00000283 [ 111.394644][ C0] RAX: 0000001b2be20762 RBX: 0000001b2be20000 RCX: 0000000000000000 [ 111.402928][ C0] RDX: 0000001b2be20762 RSI: 0000000000000081 RDI: 00007f2ca4825fb0 [ 111.410925][ C0] RBP: 00007f2ca4825fb0 R08: 0000001b2c220000 R09: 0000000000000001 [ 111.419009][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: 00007f2ca4825fa0 [ 111.427092][ C0] R13: 0000200000000000 R14: 00007ffc12fa22d8 R15: 00007f2ca4825fa0 [ 111.435113][ C0] [ 111.438307][ C0] Kernel Offset: disabled [ 111.442731][ C0] Rebooting in 86400 seconds..