Warning: Permanently added '10.128.1.80' (ED25519) to the list of known hosts. 1970/01/01 00:00:37 parsed 1 programs 1970/01/01 00:00:37 serving rpc on tcp://42561 [ 38.467144][ T4339] cgroup: Unknown subsys name 'net' [ 38.739648][ T4339] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 39.022091][ T4339] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 51.796577][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.799615][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.801576][ T216] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 51.814620][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.816099][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.817719][ T216] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 51.916753][ T4399] chnl_net:caif_netlink_parms(): no params data found [ 51.938902][ T4399] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.940271][ T4399] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.941778][ T4399] device bridge_slave_0 entered promiscuous mode [ 51.944004][ T4399] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.945113][ T4399] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.946580][ T4399] device bridge_slave_1 entered promiscuous mode [ 51.955101][ T4399] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 51.957826][ T4399] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 51.964581][ T4399] team0: Port device team_slave_0 added [ 51.966329][ T4399] team0: Port device team_slave_1 added [ 51.972117][ T4399] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 51.973237][ T4399] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 51.977818][ T4399] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 51.981016][ T4399] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 51.982191][ T4399] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 51.986385][ T4399] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 52.029181][ T4399] device hsr_slave_0 entered promiscuous mode [ 52.067266][ T4399] device hsr_slave_1 entered promiscuous mode [ 52.138896][ T4399] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 52.178037][ T4399] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 52.247731][ T4399] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 52.296328][ T4399] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 52.351928][ T4399] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.353231][ T4399] bridge0: port 2(bridge_slave_1) entered forwarding state [ 52.354714][ T4399] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.355937][ T4399] bridge0: port 1(bridge_slave_0) entered forwarding state [ 52.373791][ T4399] 8021q: adding VLAN 0 to HW filter on device bond0 [ 52.377983][ T216] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 52.381186][ T216] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.382919][ T216] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.388165][ T4399] 8021q: adding VLAN 0 to HW filter on device team0 [ 52.401507][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 52.403331][ T39] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.404599][ T39] bridge0: port 1(bridge_slave_0) entered forwarding state [ 52.405976][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 52.408089][ T39] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.409302][ T39] bridge0: port 2(bridge_slave_1) entered forwarding state [ 52.413619][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 52.415188][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 52.418575][ T216] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 52.421505][ T216] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 52.424297][ T216] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 52.426615][ T4399] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 52.480079][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 52.481538][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 52.484904][ T4399] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 52.490900][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 52.496376][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 52.499048][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 52.500491][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 52.502879][ T4399] device veth0_vlan entered promiscuous mode [ 52.505837][ T4399] device veth1_vlan entered promiscuous mode [ 52.523178][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 52.524819][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 52.526372][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 52.529505][ T4399] device veth0_macvtap entered promiscuous mode [ 52.531740][ T4399] device veth1_macvtap entered promiscuous mode [ 52.537295][ T4399] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 52.538588][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 52.540642][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 52.543413][ T4399] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 52.544856][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 52.547931][ T4399] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.549456][ T4399] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.551023][ T4399] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.552688][ T4399] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.183956][ T4441] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 53.185537][ T4441] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 53.188150][ T4441] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 53.189810][ T4441] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 53.191331][ T4441] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 53.192580][ T4441] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 53.578940][ T663] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 1970/01/01 00:00:53 executed programs: 0 [ 53.744374][ T48] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 53.745915][ T48] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 53.748543][ T4443] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 53.750132][ T4443] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 53.751747][ T4443] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 53.753148][ T4443] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 53.794162][ T4452] chnl_net:caif_netlink_parms(): no params data found [ 53.809955][ T4452] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.811187][ T4452] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.812747][ T4452] device bridge_slave_0 entered promiscuous mode [ 53.814706][ T4452] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.815975][ T4452] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.817734][ T4452] device bridge_slave_1 entered promiscuous mode [ 53.823749][ T4452] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 53.826273][ T4452] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 53.833161][ T4452] team0: Port device team_slave_0 added [ 53.834868][ T4452] team0: Port device team_slave_1 added [ 53.840482][ T4452] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 53.841745][ T4452] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 53.846111][ T4452] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 53.848626][ T4452] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 53.849823][ T4452] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 53.854248][ T4452] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 53.898087][ T4452] device hsr_slave_0 entered promiscuous mode [ 53.937250][ T4452] device hsr_slave_1 entered promiscuous mode [ 53.977178][ T4452] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 53.978633][ T4452] Cannot create hsr debugfs directory [ 55.757363][ T4443] Bluetooth: hci0: command 0x0409 tx timeout [ 56.087886][ T663] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.837132][ T4443] Bluetooth: hci0: command 0x041b tx timeout [ 58.567684][ T663] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 58.648531][ T663] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 59.603104][ T4452] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 59.628277][ T4452] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 59.667829][ T4452] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 59.749410][ T4452] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 59.901428][ T4452] 8021q: adding VLAN 0 to HW filter on device bond0 [ 59.904868][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 59.906451][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 59.909257][ T4452] 8021q: adding VLAN 0 to HW filter on device team0 [ 59.911771][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 59.913495][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 59.914962][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.916221][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 59.917308][ T4443] Bluetooth: hci0: command 0x040f tx timeout [ 59.918120][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 59.922267][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 59.923898][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 59.925567][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.926914][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 59.929667][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 59.932236][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 59.935175][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 59.936924][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 59.939294][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 60.000003][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 60.001757][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 60.004498][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 60.006128][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 60.009819][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 60.011881][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 60.014511][ T4452] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 60.081542][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 60.082993][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 60.086141][ T4452] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 60.092970][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 60.094546][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 60.101750][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 60.103494][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 60.105262][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 60.106716][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 60.161104][ T4452] device veth0_vlan entered promiscuous mode [ 60.164157][ T4452] device veth1_vlan entered promiscuous mode [ 60.171202][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 60.172851][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 60.174342][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 60.176041][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 60.179260][ T4452] device veth0_macvtap entered promiscuous mode [ 60.181488][ T4452] device veth1_macvtap entered promiscuous mode [ 60.185535][ T4452] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 60.187921][ T4452] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 60.190115][ T4452] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 60.191384][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 60.193039][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 60.194651][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 60.196336][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 60.198936][ T4452] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 60.200790][ T4452] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 60.203001][ T4452] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 60.204319][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 60.205973][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 60.209466][ T4452] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.210937][ T4452] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.212405][ T4452] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.213913][ T4452] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.275490][ T39] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 60.276894][ T39] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 60.278851][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 60.284851][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 60.286532][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 60.288134][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 60.356332][ T4542] FAULT_INJECTION: forcing a failure. [ 60.356332][ T4542] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 60.356351][ T4542] CPU: 0 PID: 4542 Comm: syz.0.17 Not tainted syzkaller #0 [ 60.356359][ T4542] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 60.356363][ T4542] Call trace: [ 60.356366][ T4542] dump_backtrace+0x1c4/0x1f0 [ 60.356377][ T4542] show_stack+0x2c/0x3c [ 60.356382][ T4542] __dump_stack+0x30/0x40 [ 60.356388][ T4542] dump_stack_lvl+0xf4/0x15c [ 60.356392][ T4542] dump_stack+0x1c/0x5c [ 60.356396][ T4542] should_fail_ex+0x3cc/0x524 [ 60.356407][ T4542] should_fail_alloc_page+0x74/0xb8 [ 60.356412][ T4542] prepare_alloc_pages+0x1b8/0x4f0 [ 60.356425][ T4542] __alloc_pages+0x134/0x544 [ 60.356430][ T4542] __kmalloc_large_node+0x9c/0x1dc [ 60.356438][ T4542] __kmalloc+0x12c/0x180 [ 60.356443][ T4542] vc_do_resize+0x2e8/0x1154 [ 60.356451][ T4542] vc_resize+0x58/0x6c [ 60.356457][ T4542] fbcon_modechanged+0x644/0xf5c [ 60.356463][ T4542] store_rotate+0x2f4/0x4bc [ 60.356469][ T4542] dev_attr_store+0x6c/0x90 [ 60.356477][ T4542] sysfs_kf_write+0x1f8/0x274 [ 60.356484][ T4542] kernfs_fop_write_iter+0x390/0x4b4 [ 60.356489][ T4542] vfs_write+0x3c8/0x7c8 [ 60.356494][ T4542] ksys_write+0x12c/0x228 [ 60.356499][ T4542] __arm64_sys_write+0x7c/0x90 [ 60.356504][ T4542] invoke_syscall+0x98/0x290 [ 60.356511][ T4542] el0_svc_common+0x13c/0x258 [ 60.356517][ T4542] do_el0_svc+0x5c/0x134 [ 60.356523][ T4542] el0_svc+0x58/0x128 [ 60.356528][ T4542] el0t_64_sync_handler+0x84/0xf0 [ 60.356532][ T4542] el0t_64_sync+0x18c/0x190 [ 60.390665][ T4542] ================================================================== [ 60.390671][ T4542] BUG: KASAN: vmalloc-out-of-bounds in sys_imageblit+0x1560/0x1d10 [ 60.390684][ T4542] Write of size 4 at addr ffff800024869fc0 by task syz.0.17/4542 [ 60.390690][ T4542] [ 60.390692][ T4542] CPU: 0 PID: 4542 Comm: syz.0.17 Not tainted syzkaller #0 [ 60.390698][ T4542] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 60.390702][ T4542] Call trace: [ 60.390703][ T4542] dump_backtrace+0x1c4/0x1f0 [ 60.390709][ T4542] show_stack+0x2c/0x3c [ 60.390713][ T4542] __dump_stack+0x30/0x40 [ 60.390717][ T4542] dump_stack_lvl+0xf4/0x15c [ 60.390721][ T4542] print_address_description+0x88/0x218 [ 60.390729][ T4542] print_report+0x50/0x68 [ 60.390735][ T4542] kasan_report+0xa8/0xfc [ 60.390740][ T4542] __asan_report_store4_noabort+0x2c/0x38 [ 60.390746][ T4542] sys_imageblit+0x1560/0x1d10 [ 60.390752][ T4542] drm_fb_helper_sys_imageblit+0x40/0x464 [ 60.390758][ T4542] drm_fbdev_fb_imageblit+0x170/0x1dc [ 60.390762][ T4542] cw_putcs+0xab0/0xd18 [ 60.390767][ T4542] fbcon_putcs+0x30c/0x4b8 [ 60.390772][ T4542] do_update_region+0x40c/0x554 [ 60.390778][ T4542] redraw_screen+0x78c/0xcc0 [ 60.390783][ T4542] fbcon_modechanged+0x914/0xf5c [ 60.390787][ T4542] store_rotate+0x2f4/0x4bc [ 60.390792][ T4542] dev_attr_store+0x6c/0x90 [ 60.390798][ T4542] sysfs_kf_write+0x1f8/0x274 [ 60.390803][ T4542] kernfs_fop_write_iter+0x390/0x4b4 [ 60.390808][ T4542] vfs_write+0x3c8/0x7c8 [ 60.390813][ T4542] ksys_write+0x12c/0x228 [ 60.390817][ T4542] __arm64_sys_write+0x7c/0x90 [ 60.390821][ T4542] invoke_syscall+0x98/0x290 [ 60.390828][ T4542] el0_svc_common+0x13c/0x258 [ 60.390834][ T4542] do_el0_svc+0x5c/0x134 [ 60.390839][ T4542] el0_svc+0x58/0x128 [ 60.390844][ T4542] el0t_64_sync_handler+0x84/0xf0 [ 60.390848][ T4542] el0t_64_sync+0x18c/0x190 [ 60.390853][ T4542] [ 60.390854][ T4542] The buggy address belongs to a vmalloc virtual mapping [ 60.390861][ T4542] Memory state around the buggy address: [ 60.390865][ T4542] ffff800024869e80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 60.390868][ T4542] ffff800024869f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 60.390871][ T4542] >ffff800024869f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 60.390874][ T4542] ^ [ 60.390877][ T4542] ffff80002486a000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 60.390880][ T4542] ffff80002486a080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 60.390883][ T4542] ================================================================== [ 60.390886][ T4542] Disabling lock debugging due to kernel taint [ 60.390894][ T4542] Unable to handle kernel paging request at virtual address ffff800024869fc0 [ 60.390899][ T4542] KASAN: probably user-memory-access in range [0x000000012434fe00-0x000000012434fe07] [ 60.390905][ T4542] Mem abort info: [ 60.390908][ T4542] ESR = 0x0000000096000047 [ 60.390911][ T4542] EC = 0x25: DABT (current EL), IL = 32 bits [ 60.390916][ T4542] SET = 0, FnV = 0 [ 60.390920][ T4542] EA = 0, S1PTW = 0 [ 60.390923][ T4542] FSC = 0x07: level 3 translation fault [ 60.390927][ T4542] Data abort info: [ 60.390930][ T4542] ISV = 0, ISS = 0x00000047 [ 60.390933][ T4542] CM = 0, WnR = 1 [ 60.390937][ T4542] swapper pgtable: 4k pages, 48-bit VAs, pgdp=000000020dd3f000 [ 60.390942][ T4542] [ffff800024869fc0] pgd=100000023ffff003, p4d=100000023ffff003, pud=100000023fffe003, pmd=100000010e8a9003, pte=0000000000000000 [ 60.390964][ T4542] Internal error: Oops: 0000000096000047 [#1] PREEMPT SMP [ 60.390969][ T4542] Modules linked in: [ 60.390973][ T4542] CPU: 0 PID: 4542 Comm: syz.0.17 Tainted: G B syzkaller #0 [ 60.390978][ T4542] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 60.390981][ T4542] pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 60.390987][ T4542] pc : sys_imageblit+0x1338/0x1d10 [ 60.390993][ T4542] lr : sys_imageblit+0x1560/0x1d10 [ 60.390999][ T4542] sp : ffff800021197220 [ 60.391001][ T4542] x29: ffff800021197370 x28: 0000000000000001 x27: ffff800024869fc0 [ 60.391009][ T4542] x26: ffff0000ce76ce31 x25: 1fffe00019ced9c6 x24: ffff800024869fc0 [ 60.391016][ T4542] x23: ffff800024869fc0 x22: 0000000000000000 x21: ffff8000211972e0 [ 60.391024][ T4542] x20: 0000000000000000 x19: ffff0000ce76ce30 x18: 1fffe00033e7037e [ 60.391031][ T4542] x17: 3d3d3d3d3d3d3d3d x16: ffff800011b9ea98 x15: 0000000000000000 [ 60.391039][ T4542] x14: 0000000000000001 x13: 1ffff00002ff216c x12: 0000000000000000 [ 60.391046][ T4542] x11: dfff800000000000 x10: 0000000000000000 x9 : 0000000000000000 [ 60.391053][ T4542] x8 : ffff0000da289c00 x7 : 64206b636f6c2067 x6 : ffff80000831261c [ 60.391060][ T4542] x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800008195a30 [ 60.391067][ T4542] x2 : 0000000000000001 x1 : 0000000000000000 x0 : ffff800024869fc0 [ 60.391075][ T4542] Call trace: [ 60.391076][ T4542] sys_imageblit+0x1338/0x1d10 [ 60.391082][ T4542] drm_fb_helper_sys_imageblit+0x40/0x464 [ 60.391086][ T4542] drm_fbdev_fb_imageblit+0x170/0x1dc [ 60.391091][ T4542] cw_putcs+0xab0/0xd18 [ 60.391096][ T4542] fbcon_putcs+0x30c/0x4b8 [ 60.391100][ T4542] do_update_region+0x40c/0x554 [ 60.391106][ T4542] redraw_screen+0x78c/0xcc0 [ 60.391111][ T4542] fbcon_modechanged+0x914/0xf5c [ 60.391115][ T4542] store_rotate+0x2f4/0x4bc [ 60.391120][ T4542] dev_attr_store+0x6c/0x90 [ 60.391125][ T4542] sysfs_kf_write+0x1f8/0x274 [ 60.391130][ T4542] kernfs_fop_write_iter+0x390/0x4b4 [ 60.391135][ T4542] vfs_write+0x3c8/0x7c8 [ 60.391139][ T4542] ksys_write+0x12c/0x228 [ 60.391143][ T4542] __arm64_sys_write+0x7c/0x90 [ 60.391147][ T4542] invoke_syscall+0x98/0x290 [ 60.391153][ T4542] el0_svc_common+0x13c/0x258 [ 60.391159][ T4542] do_el0_svc+0x5c/0x134 [ 60.391165][ T4542] el0_svc+0x58/0x128 [ 60.391169][ T4542] el0t_64_sync_handler+0x84/0xf0 [ 60.391173][ T4542] el0t_64_sync+0x18c/0x190 [ 60.391180][ T4542] Code: 38eb6928 b86a5ab4 350010c8 8b160360 (b8004414) [ 60.391184][ T4542] ---[ end trace 0000000000000000 ]--- [ 60.616105][ T4542] Kernel panic - not syncing: Oops: Fatal exception [ 60.616117][ T4542] SMP: stopping secondary CPUs [ 60.616132][ T4542] Kernel Offset: disabled [ 60.616135][ T4542] CPU features: 0x0a0000,000f0097,a65bfea7 [ 60.616141][ T4542] Memory Limit: none [ 60.944621][ T4542] Rebooting in 86400 seconds..