Warning: Permanently added '10.128.0.212' (ED25519) to the list of known hosts.
2026/09/06 19:31:01 parsed 1 programs
2026/09/06 19:31:01 serving rpc on tcp://44779
syzkaller login: [ 83.834668][ T5785] cgroup: Unknown subsys name 'net'
[ 83.970772][ T5785] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 85.708336][ T5785] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 88.984237][ T5834] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 88.994653][ T5834] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 89.005254][ T5085] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 89.024179][ T5085] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 89.032002][ T5085] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 89.040265][ T5085] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 90.540063][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 90.548491][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 90.627996][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 90.636174][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 91.654518][ T5874] chnl_net:caif_netlink_parms(): no params data found
[ 91.741973][ T5874] bridge0: port 1(bridge_slave_0) entered blocking state
[ 91.749320][ T5874] bridge0: port 1(bridge_slave_0) entered disabled state
[ 91.759522][ T5874] bridge_slave_0: entered allmulticast mode
[ 91.767866][ T5874] bridge_slave_0: entered promiscuous mode
[ 91.780633][ T5874] bridge0: port 2(bridge_slave_1) entered blocking state
[ 91.793696][ T5874] bridge0: port 2(bridge_slave_1) entered disabled state
[ 91.800886][ T5874] bridge_slave_1: entered allmulticast mode
[ 91.808126][ T5874] bridge_slave_1: entered promiscuous mode
[ 91.846805][ T5874] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 91.858010][ T5874] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 91.887541][ T5874] team0: Port device team_slave_0 added
[ 91.895962][ T5874] team0: Port device team_slave_1 added
[ 91.919634][ T5874] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 91.926659][ T5874] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 91.952671][ T5874] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 91.966409][ T5874] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 91.973497][ T5874] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 91.999476][ T5874] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 92.058037][ T5874] hsr_slave_0: entered promiscuous mode
[ 92.065827][ T5874] hsr_slave_1: entered promiscuous mode
[ 92.239380][ T5874] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 92.252024][ T5874] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 92.262277][ T5874] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 92.272169][ T5874] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 92.323238][ T5874] bridge0: port 2(bridge_slave_1) entered blocking state
[ 92.330813][ T5874] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 92.338878][ T5874] bridge0: port 1(bridge_slave_0) entered blocking state
[ 92.346026][ T5874] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 92.370921][ T23] cfg80211: failed to load regulatory.db
[ 92.446436][ T5874] 8021q: adding VLAN 0 to HW filter on device bond0
[ 92.474915][ T1141] bridge0: port 1(bridge_slave_0) entered disabled state
[ 92.483924][ T1141] bridge0: port 2(bridge_slave_1) entered disabled state
[ 92.509859][ T5874] 8021q: adding VLAN 0 to HW filter on device team0
[ 92.525987][ T11] bridge0: port 1(bridge_slave_0) entered blocking state
[ 92.533434][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 92.547963][ T11] bridge0: port 2(bridge_slave_1) entered blocking state
[ 92.555340][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 92.785037][ T5874] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 92.834857][ T5874] veth0_vlan: entered promiscuous mode
[ 92.856894][ T5874] veth1_vlan: entered promiscuous mode
[ 92.888560][ T5874] veth0_macvtap: entered promiscuous mode
[ 92.906919][ T5874] veth1_macvtap: entered promiscuous mode
[ 92.925136][ T5874] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 92.944063][ T5874] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 92.967050][ T5874] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 92.976446][ T5874] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 92.986051][ T5874] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 92.995090][ T5874] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 93.224937][ T60] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2026/09/06 19:31:13 executed programs: 0
[ 93.715860][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 93.726105][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 93.736339][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 93.744913][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 93.754007][ T51] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 93.761526][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 93.905935][ T5894] chnl_net:caif_netlink_parms(): no params data found
[ 93.970512][ T5894] bridge0: port 1(bridge_slave_0) entered blocking state
[ 93.978224][ T5894] bridge0: port 1(bridge_slave_0) entered disabled state
[ 93.985779][ T5894] bridge_slave_0: entered allmulticast mode
[ 93.993485][ T5894] bridge_slave_0: entered promiscuous mode
[ 94.001695][ T5894] bridge0: port 2(bridge_slave_1) entered blocking state
[ 94.009148][ T5894] bridge0: port 2(bridge_slave_1) entered disabled state
[ 94.016374][ T5894] bridge_slave_1: entered allmulticast mode
[ 94.023927][ T5894] bridge_slave_1: entered promiscuous mode
[ 94.057219][ T5894] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 94.069984][ T5894] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 94.104899][ T5894] team0: Port device team_slave_0 added
[ 94.115807][ T5894] team0: Port device team_slave_1 added
[ 94.143020][ T5894] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 94.150048][ T5894] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 94.176669][ T5894] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 94.190377][ T5894] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 94.197488][ T5894] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 94.224587][ T5894] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 94.271389][ T5894] hsr_slave_0: entered promiscuous mode
[ 94.277778][ T5894] hsr_slave_1: entered promiscuous mode
[ 94.284655][ T5894] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 94.292644][ T5894] Cannot create hsr debugfs directory
[ 95.615414][ T60] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 95.803617][ T5085] Bluetooth: hci0: command tx timeout
[ 97.844613][ T60] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 97.893777][ T5085] Bluetooth: hci0: command tx timeout
[ 97.927630][ T60] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 98.840343][ T5894] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 98.851749][ T5894] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 98.878310][ T60] hsr_slave_0: left promiscuous mode
[ 98.886066][ T60] hsr_slave_1: left promiscuous mode
[ 98.893553][ T60] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 98.901059][ T60] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 98.915412][ T60] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 98.928830][ T60] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 98.938760][ T60] bridge_slave_1: left allmulticast mode
[ 98.947307][ T60] bridge_slave_1: left promiscuous mode
[ 98.955356][ T60] bridge0: port 2(bridge_slave_1) entered disabled state
[ 98.971176][ T60] bridge_slave_0: left allmulticast mode
[ 98.978631][ T60] bridge_slave_0: left promiscuous mode
[ 98.987643][ T60] bridge0: port 1(bridge_slave_0) entered disabled state
[ 99.016096][ T60] veth1_macvtap: left promiscuous mode
[ 99.022099][ T60] veth0_macvtap: left promiscuous mode
[ 99.028114][ T60] veth1_vlan: left promiscuous mode
[ 99.033811][ T60] veth0_vlan: left promiscuous mode
[ 99.490494][ T60] team0 (unregistering): Port device team_slave_1 removed
[ 99.532859][ T60] team0 (unregistering): Port device team_slave_0 removed
[ 99.566970][ T60] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 99.605696][ T60] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 99.856537][ T60] bond0 (unregistering): Released all slaves
[ 99.962543][ T5085] Bluetooth: hci0: command tx timeout
[ 99.968803][ T5894] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 99.980317][ T5894] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 100.080688][ T5894] 8021q: adding VLAN 0 to HW filter on device bond0
[ 100.112235][ T5894] 8021q: adding VLAN 0 to HW filter on device team0
[ 100.127399][ T11] bridge0: port 1(bridge_slave_0) entered blocking state
[ 100.134639][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 100.150318][ T3455] bridge0: port 2(bridge_slave_1) entered blocking state
[ 100.157532][ T3455] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 100.399759][ T5894] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 100.445132][ T5894] veth0_vlan: entered promiscuous mode
[ 100.462071][ T5894] veth1_vlan: entered promiscuous mode
[ 100.493762][ T5894] veth0_macvtap: entered promiscuous mode
[ 100.508383][ T5894] veth1_macvtap: entered promiscuous mode
[ 100.527296][ T5894] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 100.540404][ T5894] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 100.553645][ T5894] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 100.563233][ T5894] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 100.571983][ T5894] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 100.581694][ T5894] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 100.654587][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 100.663055][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 100.695733][ T4999] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 100.703823][ T4999] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 101.043972][ T9] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 101.247164][ T9] usb 1-1: config 0 has an invalid interface number: 1 but max is 0
[ 101.255413][ T9] usb 1-1: config 0 has no interface number 0
[ 101.265110][ T9] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b
[ 101.274214][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 101.282205][ T9] usb 1-1: Product: syz
[ 101.286654][ T9] usb 1-1: Manufacturer: syz
[ 101.291271][ T9] usb 1-1: SerialNumber: syz
[ 101.301343][ T9] usb 1-1: config 0 descriptor??
[ 101.511469][ T9] usb 1-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state
[ 101.524963][ T9] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer
[ 101.535650][ T9] dvbdev: DVB: registering new adapter (E3C EC168 reference design)
[ 101.544467][ T9] usb 1-1: media controller created
[ 101.561413][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[ 102.044654][ T5085] Bluetooth: hci0: command tx timeout
[ 102.694102][ T9] i2c i2c-1: ec100: i2c rd failed=-110 reg=33
[ 102.694950][ T5934] ==================================================================
[ 102.708340][ T5934] BUG: KASAN: slab-out-of-bounds in ec168_i2c_xfer+0x4d5/0x630
[ 102.715921][ T5934] Read of size 1 at addr ffff888026a5be61 by task syz.0.17/5934
[ 102.723552][ T5934]
[ 102.725873][ T5934] CPU: 1 PID: 5934 Comm: syz.0.17 Not tainted syzkaller #0
[ 102.733105][ T5934] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 102.743184][ T5934] Call Trace:
[ 102.746502][ T5934]
[ 102.749442][ T5934] dump_stack_lvl+0x18c/0x250
[ 102.754142][ T5934] ? __lock_acquire+0x7d80/0x7d80
[ 102.759221][ T5934] ? show_regs_print_info+0x20/0x20
[ 102.764472][ T5934] ? load_image+0x420/0x420
[ 102.769021][ T5934] ? __virt_addr_valid+0x10c/0x380
[ 102.774176][ T5934] ? __virt_addr_valid+0x10c/0x380
[ 102.779682][ T5934] ? __virt_addr_valid+0x10c/0x380
[ 102.784874][ T5934] print_report+0xa8/0x210
[ 102.789301][ T5934] ? ec168_i2c_xfer+0x4d5/0x630
[ 102.794158][ T5934] kasan_report+0x117/0x150
[ 102.798673][ T5934] ? ec168_i2c_xfer+0x4d5/0x630
[ 102.803558][ T5934] ec168_i2c_xfer+0x4d5/0x630
[ 102.808253][ T5934] ? ec168_ctrl_msg+0x730/0x730
[ 102.813105][ T5934] __i2c_transfer+0x891/0x2090
[ 102.817874][ T5934] ? i2c_cmd+0x110/0x110
[ 102.822113][ T5934] ? i2c_transfer+0x11b/0x3a0
[ 102.826796][ T5934] i2c_transfer+0x261/0x3a0
[ 102.831304][ T5934] ? __i2c_transfer+0x2090/0x2090
[ 102.836326][ T5934] ? __might_fault+0xc6/0x120
[ 102.841006][ T5934] ? __might_fault+0xaa/0x120
[ 102.845683][ T5934] ? _copy_from_user+0xa5/0xe0
[ 102.850455][ T5934] i2cdev_ioctl_rdwr+0x3b0/0x690
[ 102.855394][ T5934] i2cdev_ioctl+0x6a0/0x840
[ 102.859893][ T5934] ? i2cdev_write+0x120/0x120
[ 102.864662][ T5934] ? bpf_lsm_file_ioctl+0x9/0x10
[ 102.869684][ T5934] ? security_file_ioctl+0x80/0xa0
[ 102.874892][ T5934] ? i2cdev_write+0x120/0x120
[ 102.879569][ T5934] __se_sys_ioctl+0xfd/0x170
[ 102.884170][ T5934] do_syscall_64+0x55/0xb0
[ 102.888689][ T5934] ? clear_bhb_loop+0x40/0x90
[ 102.894008][ T5934] ? clear_bhb_loop+0x40/0x90
[ 102.898709][ T5934] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 102.904634][ T5934] RIP: 0033:0x7f42e259e159
[ 102.909084][ T5934] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 102.929172][ T5934] RSP: 002b:00007ffe002194f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 102.937688][ T5934] RAX: ffffffffffffffda RBX: 00007f42e2825fa0 RCX: 00007f42e259e159
[ 102.945766][ T5934] RDX: 0000200000000200 RSI: 0000000000000707 RDI: 0000000000000004
[ 102.953759][ T5934] RBP: 00007f42e2635024 R08: 0000000000000000 R09: 0000000000000000
[ 102.961919][ T5934] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 102.969950][ T5934] R13: 00007f42e2825fac R14: 00007f42e2825fa0 R15: 00007f42e2825fa0
[ 102.978048][ T5934]
[ 102.981067][ T5934]
[ 102.983425][ T5934] Allocated by task 5934:
[ 102.987759][ T5934] kasan_set_track+0x4e/0x70
[ 102.992370][ T5934] __kasan_kmalloc+0x8f/0xa0
[ 102.996976][ T5934] __kmalloc_node_track_caller+0xb4/0x230
[ 103.002732][ T5934] memdup_user+0x2b/0xc0
[ 103.006994][ T5934] i2cdev_ioctl_rdwr+0x116/0x690
[ 103.011968][ T5934] i2cdev_ioctl+0x6a0/0x840
[ 103.016839][ T5934] __se_sys_ioctl+0xfd/0x170
[ 103.021669][ T5934] do_syscall_64+0x55/0xb0
[ 103.026097][ T5934] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 103.032006][ T5934]
[ 103.034351][ T5934] The buggy address belongs to the object at ffff888026a5be60
[ 103.034351][ T5934] which belongs to the cache kmalloc-8 of size 8
[ 103.048681][ T5934] The buggy address is located 0 bytes to the right of
[ 103.048681][ T5934] allocated 1-byte region [ffff888026a5be60, ffff888026a5be61)
[ 103.063724][ T5934]
[ 103.066368][ T5934] The buggy address belongs to the physical page:
[ 103.072789][ T5934] page:ffffea00009a96c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x26a5b
[ 103.082953][ T5934] flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 103.090680][ T5934] page_type: 0xffffffff()
[ 103.095093][ T5934] raw: 00fff00000000800 ffff888017c41280 dead000000000122 0000000000000000
[ 103.103862][ T5934] raw: 0000000000000000 0000000000660066 00000001ffffffff 0000000000000000
[ 103.113080][ T5934] page dumped because: kasan: bad access detected
[ 103.119591][ T5934] page_owner tracks the page as allocated
[ 103.125587][ T5934] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5894, tgid 5894 (syz-executor), ts 94367264255, free_ts 94351655245
[ 103.144180][ T5934] post_alloc_hook+0x1c1/0x200
[ 103.149004][ T5934] get_page_from_freelist+0x2181/0x22a0
[ 103.154569][ T5934] __alloc_pages+0x1f0/0x460
[ 103.159158][ T5934] alloc_slab_page+0x5d/0x180
[ 103.163832][ T5934] new_slab+0x87/0x2d0
[ 103.167896][ T5934] ___slab_alloc+0xc5c/0x12f0
[ 103.172578][ T5934] __kmem_cache_alloc_node+0x11f/0x250
[ 103.178190][ T5934] __kmalloc_node_track_caller+0xa4/0x230
[ 103.183937][ T5934] kstrdup+0x3b/0x80
[ 103.187922][ T5934] __kernfs_new_node+0xaa/0x7f0
[ 103.192806][ T5934] kernfs_new_node+0x14c/0x260
[ 103.197588][ T5934] kernfs_create_link+0xa7/0x200
[ 103.202545][ T5934] sysfs_do_create_link_sd+0x83/0x110
[ 103.207947][ T5934] device_add_class_symlinks+0x1cf/0x240
[ 103.213627][ T5934] device_add+0x4f9/0xc40
[ 103.217957][ T5934] device_create+0x26a/0x300
[ 103.222547][ T5934] page last free stack trace:
[ 103.227340][ T5934] free_unref_page_prepare+0x7d7/0x8f0
[ 103.232861][ T5934] free_unref_page+0x32/0x2e0
[ 103.237724][ T5934] __unfreeze_partials+0x1cf/0x210
[ 103.242945][ T5934] put_cpu_partial+0x17c/0x250
[ 103.247905][ T5934] __slab_free+0x319/0x400
[ 103.252430][ T5934] qlist_free_all+0x75/0xd0
[ 103.257074][ T5934] kasan_quarantine_reduce+0x143/0x160
[ 103.262569][ T5934] __kasan_slab_alloc+0x22/0x80
[ 103.267531][ T5934] slab_post_alloc_hook+0x6a/0x4d0
[ 103.273453][ T5934] __kmem_cache_alloc_node+0x194/0x250
[ 103.279210][ T5934] kmalloc_trace+0x2a/0xe0
[ 103.283644][ T5934] ref_tracker_alloc+0x163/0x4b0
[ 103.288583][ T5934] netdev_queue_update_kobjects+0x18f/0x480
[ 103.294650][ T5934] netdev_register_kobject+0x277/0x320
[ 103.300157][ T5934] register_netdevice+0x12aa/0x1ba0
[ 103.305642][ T5934] ipvlan_link_new+0x38d/0xae0
[ 103.310614][ T5934]
[ 103.312966][ T5934] Memory state around the buggy address:
[ 103.318612][ T5934] ffff888026a5bd00: fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc 00 fc
[ 103.326785][ T5934] ffff888026a5bd80: fc fc fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc
[ 103.334945][ T5934] >ffff888026a5be00: fc fc 00 fc fc fc fc 00 fc fc fc fc 01 fc fc fc
[ 103.343111][ T5934] ^
[ 103.350325][ T5934] ffff888026a5be80: fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc
[ 103.358481][ T5934] ffff888026a5bf00: 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc 00
[ 103.366536][ T5934] ==================================================================
[ 103.375825][ T5934] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 103.383105][ T5934] CPU: 1 PID: 5934 Comm: syz.0.17 Not tainted syzkaller #0
[ 103.390325][ T5934] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 103.400388][ T5934] Call Trace:
[ 103.403698][ T5934]
[ 103.406660][ T5934] dump_stack_lvl+0x18c/0x250
[ 103.411456][ T5934] ? show_regs_print_info+0x20/0x20
[ 103.417645][ T5934] ? load_image+0x420/0x420
[ 103.422184][ T5934] panic+0x2ca/0x720
[ 103.426132][ T5934] ? bpf_jit_dump+0xd0/0xd0
[ 103.430864][ T5934] ? _raw_spin_unlock_irqrestore+0x111/0x120
[ 103.436896][ T5934] ? _raw_spin_unlock+0x40/0x40
[ 103.441772][ T5934] ? print_memory_metadata+0x314/0x400
[ 103.447246][ T5934] ? ec168_i2c_xfer+0x4d5/0x630
[ 103.452479][ T5934] check_panic_on_warn+0x84/0xa0
[ 103.457536][ T5934] ? ec168_i2c_xfer+0x4d5/0x630
[ 103.462432][ T5934] end_report+0x6f/0x130
[ 103.466697][ T5934] kasan_report+0x128/0x150
[ 103.471215][ T5934] ? ec168_i2c_xfer+0x4d5/0x630
[ 103.476115][ T5934] ec168_i2c_xfer+0x4d5/0x630
[ 103.480852][ T5934] ? ec168_ctrl_msg+0x730/0x730
[ 103.485725][ T5934] __i2c_transfer+0x891/0x2090
[ 103.490513][ T5934] ? i2c_cmd+0x110/0x110
[ 103.494777][ T5934] ? i2c_transfer+0x11b/0x3a0
[ 103.499470][ T5934] i2c_transfer+0x261/0x3a0
[ 103.504161][ T5934] ? __i2c_transfer+0x2090/0x2090
[ 103.509197][ T5934] ? __might_fault+0xc6/0x120
[ 103.513882][ T5934] ? __might_fault+0xaa/0x120
[ 103.518597][ T5934] ? _copy_from_user+0xa5/0xe0
[ 103.523402][ T5934] i2cdev_ioctl_rdwr+0x3b0/0x690
[ 103.528367][ T5934] i2cdev_ioctl+0x6a0/0x840
[ 103.533265][ T5934] ? i2cdev_write+0x120/0x120
[ 103.538094][ T5934] ? bpf_lsm_file_ioctl+0x9/0x10
[ 103.543070][ T5934] ? security_file_ioctl+0x80/0xa0
[ 103.548319][ T5934] ? i2cdev_write+0x120/0x120
[ 103.553030][ T5934] __se_sys_ioctl+0xfd/0x170
[ 103.557673][ T5934] do_syscall_64+0x55/0xb0
[ 103.562132][ T5934] ? clear_bhb_loop+0x40/0x90
[ 103.567013][ T5934] ? clear_bhb_loop+0x40/0x90
[ 103.571706][ T5934] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 103.577623][ T5934] RIP: 0033:0x7f42e259e159
[ 103.582064][ T5934] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 103.601874][ T5934] RSP: 002b:00007ffe002194f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 103.610310][ T5934] RAX: ffffffffffffffda RBX: 00007f42e2825fa0 RCX: 00007f42e259e159
[ 103.618295][ T5934] RDX: 0000200000000200 RSI: 0000000000000707 RDI: 0000000000000004
[ 103.626364][ T5934] RBP: 00007f42e2635024 R08: 0000000000000000 R09: 0000000000000000
[ 103.634364][ T5934] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 103.642356][ T5934] R13: 00007f42e2825fac R14: 00007f42e2825fa0 R15: 00007f42e2825fa0
[ 103.650441][ T5934]
[ 103.653707][ T5934] Kernel Offset: disabled
[ 103.658056][ T5934] Rebooting in 86400 seconds..