Warning: Permanently added '10.128.1.168' (ED25519) to the list of known hosts. 1970/01/01 00:00:30 parsed 1 programs 1970/01/01 00:00:30 serving rpc on tcp://34139 [ 31.927570][ T4338] cgroup: Unknown subsys name 'net' [ 32.194112][ T4338] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 32.458167][ T4338] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 36.945657][ T4373] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 36.947327][ T4373] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 36.948795][ T4373] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 36.950347][ T4373] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 36.952282][ T4373] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 36.953722][ T4373] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 37.487944][ T4394] chnl_net:caif_netlink_parms(): no params data found [ 37.504334][ T4394] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.505662][ T4394] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.507307][ T4394] device bridge_slave_0 entered promiscuous mode [ 37.509630][ T4394] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.510829][ T4394] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.513440][ T4394] device bridge_slave_1 entered promiscuous mode [ 37.520245][ T4394] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.526626][ T4394] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 37.532893][ T4394] team0: Port device team_slave_0 added [ 37.534568][ T4394] team0: Port device team_slave_1 added [ 37.539809][ T4394] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 37.540944][ T4394] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.545625][ T4394] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 37.548209][ T4394] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 37.549337][ T4394] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.553798][ T4394] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.622598][ T4394] device hsr_slave_0 entered promiscuous mode [ 37.661694][ T4394] device hsr_slave_1 entered promiscuous mode [ 37.759773][ T4394] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 37.792924][ T4394] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 37.823105][ T4394] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 37.872257][ T4394] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 37.951714][ T4394] 8021q: adding VLAN 0 to HW filter on device bond0 [ 37.955272][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 37.957300][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 37.959962][ T4394] 8021q: adding VLAN 0 to HW filter on device team0 [ 37.963358][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 37.965163][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 37.966712][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.967959][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.979349][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 37.982829][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 37.984561][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 37.986231][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.987479][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.990164][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 37.993824][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 37.996699][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 37.998485][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 38.000158][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 38.014636][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 38.016490][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 38.019274][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 38.020921][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 38.024468][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 38.026041][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 38.028513][ T4394] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 38.082875][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 38.084245][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 38.087272][ T4394] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.103490][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 38.105281][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 38.110095][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 38.112329][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 38.113993][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 38.115403][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 38.117721][ T4394] device veth0_vlan entered promiscuous mode [ 38.121030][ T4394] device veth1_vlan entered promiscuous mode [ 38.127434][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 38.128952][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 38.130452][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 38.133290][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 38.135747][ T4394] device veth0_macvtap entered promiscuous mode [ 38.148940][ T4394] device veth1_macvtap entered promiscuous mode [ 38.153670][ T4394] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 38.155009][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 38.156669][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 38.158166][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 38.159771][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 38.163269][ T4394] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 38.164651][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 38.166751][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 38.170587][ T4394] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.172482][ T4394] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.174079][ T4394] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.175552][ T4394] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.710603][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 38.712285][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 38.714739][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 38.720848][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 38.723769][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 38.725230][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 39.053541][ T276] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 1970/01/01 00:00:39 executed programs: 0 [ 39.276150][ T48] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 39.277871][ T48] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 39.279331][ T48] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 39.282349][ T48] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 39.283893][ T48] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 39.285297][ T48] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 39.324281][ T4451] chnl_net:caif_netlink_parms(): no params data found [ 39.338869][ T4451] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.340168][ T4451] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.341843][ T4451] device bridge_slave_0 entered promiscuous mode [ 39.343929][ T4451] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.345123][ T4451] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.346668][ T4451] device bridge_slave_1 entered promiscuous mode [ 39.354042][ T4451] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 39.356605][ T4451] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 39.362568][ T4451] team0: Port device team_slave_0 added [ 39.364573][ T4451] team0: Port device team_slave_1 added [ 39.370299][ T4451] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 39.371788][ T4451] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 39.376486][ T4451] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 39.379001][ T4451] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 39.380200][ T4451] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 39.384915][ T4451] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 39.443271][ T4451] device hsr_slave_0 entered promiscuous mode [ 39.481730][ T4451] device hsr_slave_1 entered promiscuous mode [ 39.541568][ T4451] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 39.542907][ T4451] Cannot create hsr debugfs directory [ 41.291805][ T4373] Bluetooth: hci0: command 0x0409 tx timeout [ 41.382627][ T276] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 43.372222][ T4373] Bluetooth: hci0: command 0x041b tx timeout [ 43.923192][ T276] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.004649][ T276] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 45.075727][ T4451] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 45.163110][ T4451] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 45.212599][ T4451] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 45.343041][ T4451] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 45.451514][ T4373] Bluetooth: hci0: command 0x040f tx timeout [ 45.461933][ T4451] 8021q: adding VLAN 0 to HW filter on device bond0 [ 45.465514][ T4458] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 45.467158][ T4458] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 45.469650][ T4451] 8021q: adding VLAN 0 to HW filter on device team0 [ 45.472369][ T4458] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 45.474099][ T4458] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 45.475587][ T4458] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.476887][ T4458] bridge0: port 1(bridge_slave_0) entered forwarding state [ 45.479006][ T4458] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 45.483263][ T4458] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 45.484910][ T4458] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 45.486500][ T4458] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.487720][ T4458] bridge0: port 2(bridge_slave_1) entered forwarding state [ 45.534894][ T4458] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 45.537857][ T4458] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 45.540682][ T4458] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 45.542860][ T4458] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 45.544988][ T4458] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 45.547357][ T4458] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 45.549186][ T4458] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 45.553448][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 45.555234][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 45.557725][ T4458] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 45.559281][ T4458] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 45.561784][ T4451] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 45.626358][ T4458] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 45.627776][ T4458] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 45.630786][ T4451] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 45.667212][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 45.668998][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 45.674631][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 45.676170][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 45.677916][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 45.679302][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 45.681604][ T4451] device veth0_vlan entered promiscuous mode [ 45.684744][ T4451] device veth1_vlan entered promiscuous mode [ 45.691434][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 45.693506][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 45.695020][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 45.696595][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 45.698939][ T4451] device veth0_macvtap entered promiscuous mode [ 45.701184][ T4451] device veth1_macvtap entered promiscuous mode [ 45.745989][ T4451] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 45.747787][ T4451] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 45.749981][ T4451] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 45.751226][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 45.753200][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 45.754732][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 45.756408][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 45.759484][ T4451] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 45.761292][ T4451] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 45.763776][ T4451] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 45.765234][ T4458] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 45.766897][ T4458] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 45.769225][ T4451] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.770659][ T4451] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.772470][ T4451] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.773985][ T4451] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.793061][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 45.795471][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 45.797315][ T4458] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 45.803705][ T4458] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 45.805140][ T4458] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 45.806556][ T4458] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 45.842836][ T4500] loop0: detected capacity change from 0 to 16 [ 45.848420][ T4500] erofs: (device loop0): mounted with root inode @ nid 36. [ 45.850714][ T4500] erofs: (device loop0): z_erofs_readahead: readahead error at page 4 @ nid 89 [ 45.855103][ T4500] erofs: (device loop0): z_erofs_readahead: readahead error at page 3 @ nid 89 [ 45.856780][ T4500] syz.0.17: attempt to access beyond end of device [ 45.856780][ T4500] loop0: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 45.859180][ T4500] syz.0.17: attempt to access beyond end of device [ 45.859180][ T4500] loop0: rw=524288, sector=8, nr_sectors = 16 limit=16 [ 45.863184][ T4500] ================================================================== [ 45.864555][ T4500] BUG: KASAN: use-after-free in z_erofs_transform_plain+0x39c/0x494 [ 45.866038][ T4500] Read of size 4096 at addr ffff0000cb83a000 by task syz.0.17/4500 [ 45.867400][ T4500] [ 45.867808][ T4500] CPU: 0 PID: 4500 Comm: syz.0.17 Not tainted syzkaller #0 [ 45.869032][ T4500] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 45.870650][ T4500] Call trace: [ 45.871276][ T4500] dump_backtrace+0x1c4/0x1f0 [ 45.872230][ T4500] show_stack+0x2c/0x3c [ 45.873042][ T4500] __dump_stack+0x30/0x40 [ 45.873901][ T4500] dump_stack_lvl+0xf4/0x15c [ 45.874782][ T4500] print_address_description+0x88/0x218 [ 45.875867][ T4500] print_report+0x50/0x68 [ 45.876703][ T4500] kasan_report+0xa8/0xfc [ 45.877551][ T4500] kasan_check_range+0x258/0x290 [ 45.878503][ T4500] memcpy+0x48/0x90 [ 45.879235][ T4500] z_erofs_transform_plain+0x39c/0x494 [ 45.880269][ T4500] z_erofs_decompress+0x9c/0xd4 [ 45.881174][ T4500] z_erofs_decompress_queue+0x103c/0x1bf4 [ 45.882198][ T4500] z_erofs_runqueue+0x1508/0x16a8 [ 45.883120][ T4500] z_erofs_read_folio+0x2dc/0x5cc [ 45.883982][ T4500] filemap_read_folio+0x134/0x384 [ 45.884865][ T4500] filemap_read+0x1290/0x20dc [ 45.885655][ T4500] generic_file_read_iter+0xf8/0x5ac [ 45.886584][ T4500] vfs_read+0x3cc/0x7b8 [ 45.887318][ T4500] ksys_read+0x12c/0x228 [ 45.888046][ T4500] __arm64_sys_read+0x7c/0x90 [ 45.888871][ T4500] invoke_syscall+0x98/0x290 [ 45.889661][ T4500] el0_svc_common+0x13c/0x258 [ 45.890480][ T4500] do_el0_svc+0x5c/0x134 [ 45.891189][ T4500] el0_svc+0x58/0x128 [ 45.891882][ T4500] el0t_64_sync_handler+0x84/0xf0 [ 45.892808][ T4500] el0t_64_sync+0x18c/0x190 [ 45.893635][ T4500] [ 45.894054][ T4500] Allocated by task 4272: [ 45.894830][ T4500] kasan_set_track+0x4c/0x80 [ 45.895573][ T4500] kasan_save_alloc_info+0x24/0x30 [ 45.896451][ T4500] __kasan_slab_alloc+0x70/0x88 [ 45.897301][ T4500] slab_post_alloc_hook+0x74/0x430 [ 45.898167][ T4500] kmem_cache_alloc+0x234/0x310 [ 45.898997][ T4500] prepare_creds+0x44/0x698 [ 45.899800][ T4500] __sys_setgid+0x8c/0x31c [ 45.900550][ T4500] __arm64_sys_setgid+0x3c/0x4c [ 45.901376][ T4500] invoke_syscall+0x98/0x290 [ 45.902248][ T4500] el0_svc_common+0x13c/0x258 [ 45.903020][ T4500] do_el0_svc+0x5c/0x134 [ 45.903743][ T4500] el0_svc+0x58/0x128 [ 45.904435][ T4500] el0t_64_sync_handler+0x84/0xf0 [ 45.905296][ T4500] el0t_64_sync+0x18c/0x190 [ 45.906067][ T4500] [ 45.906465][ T4500] Last potentially related work creation: [ 45.907463][ T4500] kasan_save_stack+0x40/0x70 [ 45.908329][ T4500] __kasan_record_aux_stack+0xc0/0xdc [ 45.909306][ T4500] kasan_record_aux_stack_noalloc+0x14/0x20 [ 45.910347][ T4500] call_rcu+0x104/0x958 [ 45.911081][ T4500] __put_cred+0x17c/0x208 [ 45.911904][ T4500] file_free_rcu+0x9c/0x128 [ 45.912695][ T4500] rcu_core+0x848/0x18e8 [ 45.913422][ T4500] rcu_core_si+0x10/0x1c [ 45.914188][ T4500] handle_softirqs+0x318/0xc90 [ 45.915027][ T4500] __do_softirq+0x14/0x20 [ 45.915794][ T4500] [ 45.916198][ T4500] The buggy address belongs to the object at ffff0000cb83a000 [ 45.916198][ T4500] which belongs to the cache cred_jar of size 200 [ 45.918485][ T4500] The buggy address is located 0 bytes inside of [ 45.918485][ T4500] 200-byte region [ffff0000cb83a000, ffff0000cb83a0c8) [ 45.920778][ T4500] [ 45.921186][ T4500] The buggy address belongs to the physical page: [ 45.922285][ T4500] page:000000006ef2e2e6 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff0000cb83ab40 pfn:0x10b83a [ 45.924298][ T4500] flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff) [ 45.925672][ T4500] raw: 05ffc00000000200 fffffc00036c6948 fffffc00035ef548 ffff0000c03ded80 [ 45.927206][ T4500] raw: ffff0000cb83ab40 00000000000c0004 00000001ffffffff 0000000000000000 [ 45.928684][ T4500] page dumped because: kasan: bad access detected [ 45.929824][ T4500] [ 45.930246][ T4500] Memory state around the buggy address: [ 45.931285][ T4500] ffff0000cb839f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 45.932700][ T4500] ffff0000cb839f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 45.934129][ T4500] >ffff0000cb83a000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 45.935526][ T4500] ^ [ 45.936215][ T4500] ffff0000cb83a080: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc [ 45.937605][ T4500] ffff0000cb83a100: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 45.939051][ T4500] ================================================================== [ 45.942397][ T4500] Disabling lock debugging due to kernel taint [ 45.943585][ T4500] syz.0.17: attempt to access beyond end of device [ 45.943585][ T4500] loop0: rw=0, sector=34359738360, nr_sectors = 8 limit=16