Warning: Permanently added '10.128.0.179' (ED25519) to the list of known hosts. 1970/01/01 00:00:29 parsed 1 programs 1970/01/01 00:00:29 serving rpc on tcp://35547 [ 30.644721][ T4716] cgroup: Unknown subsys name 'net' [ 30.774736][ T4716] cgroup: Unknown subsys name 'cpuset' [ 30.777140][ T4716] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 30.923669][ T4716] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 33.276199][ T4724] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 33.433880][ T4739] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 33.435398][ T4739] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 33.436980][ T4739] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 33.438733][ T4739] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 33.440416][ T4739] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 34.017874][ T54] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.017903][ T54] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.028513][ T54] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.028540][ T54] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.558675][ T4779] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.558975][ T4779] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.559039][ T4779] bridge_slave_0: entered allmulticast mode [ 34.559512][ T4779] bridge_slave_0: entered promiscuous mode [ 34.561037][ T4779] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.561101][ T4779] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.561151][ T4779] bridge_slave_1: entered allmulticast mode [ 34.561534][ T4779] bridge_slave_1: entered promiscuous mode [ 34.569573][ T4779] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 34.570459][ T4779] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 34.581396][ T4779] team0: Port device team_slave_0 added [ 34.582131][ T4779] team0: Port device team_slave_1 added [ 34.588401][ T4779] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 34.588426][ T4779] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 34.588464][ T4779] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 34.589175][ T4779] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 34.589182][ T4779] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 34.589195][ T4779] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 34.599841][ T4779] hsr_slave_0: entered promiscuous mode [ 34.600146][ T4779] hsr_slave_1: entered promiscuous mode [ 34.653689][ T4779] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 34.656708][ T4779] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 34.658655][ T4779] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 34.661148][ T4779] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 34.661592][ T4779] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 34.664339][ T4779] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 34.664780][ T4779] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 34.666968][ T4779] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 34.681684][ T4779] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.681739][ T4779] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.681904][ T4779] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.681939][ T4779] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.699350][ T4779] 8021q: adding VLAN 0 to HW filter on device bond0 [ 34.705046][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.706507][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.711173][ T4779] 8021q: adding VLAN 0 to HW filter on device team0 [ 34.716044][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.716099][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.719748][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.719784][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.812794][ T4779] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 34.826421][ T4779] veth0_vlan: entered promiscuous mode [ 34.828572][ T4779] veth1_vlan: entered promiscuous mode [ 34.835799][ T4779] veth0_macvtap: entered promiscuous mode [ 34.836945][ T4779] veth1_macvtap: entered promiscuous mode [ 34.841885][ T4779] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 34.846859][ T4779] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 34.863757][ T54] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.863797][ T54] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.864448][ T54] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.864471][ T54] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.938666][ T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 34.987123][ T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.050916][ T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 1970/01/01 00:00:35 executed programs: 0 [ 35.074618][ T4730] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 35.076093][ T4730] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 35.076642][ T4730] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 35.077065][ T4730] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 35.077295][ T4730] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 35.127508][ T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.208260][ T4816] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.208344][ T4816] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.208432][ T4816] bridge_slave_0: entered allmulticast mode [ 35.208824][ T4816] bridge_slave_0: entered promiscuous mode [ 35.209840][ T4816] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.209884][ T4816] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.209927][ T4816] bridge_slave_1: entered allmulticast mode [ 35.210343][ T4816] bridge_slave_1: entered promiscuous mode [ 35.219639][ T4816] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 35.220504][ T4816] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 35.227019][ T4816] team0: Port device team_slave_0 added [ 35.227722][ T4816] team0: Port device team_slave_1 added [ 35.233632][ T4816] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 35.233655][ T4816] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.233670][ T4816] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 35.234303][ T4816] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 35.234310][ T4816] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.234323][ T4816] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 35.244639][ T4816] hsr_slave_0: entered promiscuous mode [ 35.244964][ T4816] hsr_slave_1: entered promiscuous mode [ 35.245166][ T4816] debugfs: 'hsr0' already exists in 'hsr' [ 35.245202][ T4816] Cannot create hsr debugfs directory [ 37.153590][ T4730] Bluetooth: hci0: command tx timeout [ 37.955282][ T13] bridge_slave_1: left allmulticast mode [ 37.955328][ T13] bridge_slave_1: left promiscuous mode [ 37.955645][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.959933][ T13] bridge_slave_0: left allmulticast mode [ 37.959967][ T13] bridge_slave_0: left promiscuous mode [ 37.960040][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.016837][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 38.025739][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 38.028512][ T13] bond0 (unregistering): Released all slaves [ 38.078935][ T13] hsr_slave_0: left promiscuous mode [ 38.080139][ T13] hsr_slave_1: left promiscuous mode [ 38.080448][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 38.080462][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 38.080876][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 38.080887][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 38.086690][ T13] veth1_macvtap: left promiscuous mode [ 38.086747][ T13] veth0_macvtap: left promiscuous mode [ 38.086809][ T13] veth1_vlan: left promiscuous mode [ 38.086850][ T13] veth0_vlan: left promiscuous mode [ 38.184988][ T13] team0 (unregistering): Port device team_slave_1 removed [ 38.188902][ T13] team0 (unregistering): Port device team_slave_0 removed [ 38.244605][ T4396] 8021q: adding VLAN 0 to HW filter on device eth0 [ 38.449655][ T4816] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 38.456830][ T4816] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 38.457153][ T4816] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 38.461278][ T4816] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 38.464433][ T4816] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 38.467339][ T4816] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 38.469150][ T4816] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 38.471599][ T4816] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 38.517514][ T4816] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.525713][ T4816] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.530426][ T3694] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.530472][ T3694] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.531019][ T3694] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.531038][ T3694] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.639600][ T4816] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.654706][ T4816] veth0_vlan: entered promiscuous mode [ 38.656623][ T4816] veth1_vlan: entered promiscuous mode [ 38.664378][ T4816] veth0_macvtap: entered promiscuous mode [ 38.666883][ T4816] veth1_macvtap: entered promiscuous mode [ 38.672794][ T4816] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 38.676210][ T4816] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 38.699371][ T54] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 38.699390][ T54] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 38.707851][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 38.707874][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 38.713169][ T54] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.713289][ T54] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.713327][ T54] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.713355][ T54] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.760191][ T4911] ================================================================== [ 38.760205][ T4911] BUG: KASAN: slab-use-after-free in dvb_device_open+0xd0/0x254 [ 38.760223][ T4911] Read of size 8 at addr ffff0000cb357818 by task syz.0.19/4911 [ 38.760230][ T4911] [ 38.760234][ T4911] CPU: 1 UID: 0 PID: 4911 Comm: syz.0.19 Not tainted syzkaller #0 PREEMPT [ 38.760243][ T4911] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 38.760247][ T4911 ** replaying previous printk message ** [ 38.760247][ T4911] Call trace: [ 38.760250][ T4911] show_stack+0x2c/0x3c (C) [ 38.760263][ T4911] __dump_stack+0x30/0x40 [ 38.760273][ T4911] dump_stack_lvl+0xd8/0x12c [ 38.760282][ T4911] print_address_description+0xb0/0x238 [ 38.760290][ T4911] print_report+0x68/0x84 [ 38.760297][ T4911] kasan_report+0x8c/0xc4 [ 38.760306][ T4911] __asan_report_load8_noabort+0x20/0x2c [ 38.760315][ T4911] dvb_device_open+0xd0/0x254 [ 38.760323][ T4911] chrdev_open+0x398/0x3e8 [ 38.760332][ T4911] do_dentry_open+0x5c4/0xfc0 [ 38.760342][ T4911] vfs_open+0x44/0x2dc [ 38.760351][ T4911] path_openat+0x1084/0x18f4 [ 38.760359][ T4911] do_file_open+0x1c8/0x2e8 [ 38.760367][ T4911] do_sys_openat2+0x114/0x1e8 [ 38.760376][ T4911] do_sys_open+0xb0/0xe0 [ 38.760385][ T4911] __arm64_sys_openat+0xa8/0xc4 [ 38.760394][ T4911] invoke_syscall+0x98/0x244 [ 38.760404][ T4911] el0_svc_common+0xec/0x23c [ 38.760413][ T4911] do_el0_svc+0x4c/0x5c [ 38.760422][ T4911] el0_svc+0x64/0x260 [ 38.760432][ T4911] el0t_64_sync_handler+0x44/0x104 [ 38.760440][ T4911] el0t_64_sync+0x198/0x19c [ 38.760448][ T4911] [ 38.760450][ T4911] Allocated by task 1: [ 38.760454][ T4911] kasan_save_track+0x40/0x78 [ 38.760460][ T4911] kasan_save_alloc_info+0x40/0x50 [ 38.760467][ T4911] __kasan_kmalloc+0x9c/0xb4 [ 38.760473][ T4911] __kmalloc_cache_noprof+0x2f4/0x5fc [ 38.760479][ T4911] dvb_register_device+0x1a4/0x16e0 [ 38.760486][ T4911] dvb_register_frontend+0x474/0x6d0 [ 38.760495][ T4911] vidtv_bridge_probe+0x5a4/0xa58 [ 38.760501][ T4911] platform_probe+0x100/0x1a4 [ 38.760509][ T4911] really_probe+0x29c/0x800 [ 38.760517][ T4911] __driver_probe_device+0x1e0/0x350 [ 38.760525][ T4911] driver_probe_device+0x6c/0x19c [ 38.760534][ T4911] __driver_attach+0x168/0x384 [ 38.760542][ T4911] bus_for_each_dev+0x128/0x1b4 [ 38.760549][ T4911] driver_attach+0x50/0x60 [ 38.760557][ T4911] bus_add_driver+0x208/0x500 [ 38.760564][ T4911] driver_register+0x220/0x310 [ 38.760570][ T4911] __platform_driver_register+0x90/0xa4 [ 38.760576][ T4911] vidtv_bridge_init+0x4c/0x74 [ 38.760585][ T4911] do_one_initcall+0x274/0xc38 [ 38.760594][ T4911] do_initcall_level+0x12c/0x1c4 [ 38.760601][ T4911] do_initcalls+0x70/0xd0 [ 38.760606][ T4911] do_basic_setup+0x7c/0x90 [ 38.760612][ T4911] kernel_init_freeable+0x268/0x3a8 [ 38.760618][ T4911] kernel_init+0x28/0x1e0 [ 38.760627][ T4911] ret_from_fork+0x10/0x20 [ 38.760632][ T4911] [ 38.760633][ T4911] Freed by task 4910: [ 38.760637][ T4911] kasan_save_track+0x40/0x78 [ 38.760642][ T4911] kasan_save_free_info+0x54/0x6c [ 38.760649][ T4911] __kasan_slab_free+0x74/0xa4 [ 38.760655][ T4911] kfree+0x188/0x698 [ 38.760663][ T4911] dvb_device_put+0x64/0xd0 [ 38.760670][ T4911] dvb_device_open+0x23c/0x254 [ 38.760677][ T4911] chrdev_open+0x398/0x3e8 [ 38.760684][ T4911] do_dentry_open+0x5c4/0xfc0 [ 38.760691][ T4911] vfs_open+0x44/0x2dc [ 38.760698][ T4911] path_openat+0x1084/0x18f4 [ 38.760705][ T4911] do_file_open+0x1c8/0x2e8 [ 38.760711][ T4911] do_sys_openat2+0x114/0x1e8 [ 38.760719][ T4911] do_sys_open+0xb0/0xe0 [ 38.760726][ T4911] __arm64_sys_openat+0xa8/0xc4 [ 38.760734][ T4911] invoke_syscall+0x98/0x244 [ 38.760742][ T4911] el0_svc_common+0xec/0x23c [ 38.760750][ T4911] do_el0_svc+0x4c/0x5c [ 38.760758][ T4911] el0_svc+0x64/0x260 [ 38.760764][ T4911] el0t_64_sync_handler+0x44/0x104 [ 38.760770][ T4911] el0t_64_sync+0x198/0x19c [ 38.760776][ T4911] [ 38.760778][ T4911] The buggy address belongs to the object at ffff0000cb357800 [ 38.760778][ T4911] which belongs to the cache kmalloc-256 of size 256 [ 38.760783][ T4911] The buggy address is located 24 bytes inside of [ 38.760783][ T4911] freed 256-byte region [ffff0000cb357800, ffff0000cb357900) [ 38.760790][ T4911] [ 38.760792][ T4911] The buggy address belongs to the physical page: [ 38.760796][ T4911] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10b356 [ 38.760802][ T4911] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 38.760808][ T4911] flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 38.760815][ T4911] page_type: f5(slab) [ 38.760822][ T4911] raw: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122 [ 38.760828][ T4911] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 38.760834][ T4911] head: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122 [ 38.760839][ T4911] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 38.760845][ T4911] head: 05ffc00000000001 fffffdffc32cd581 00000000ffffffff 00000000ffffffff [ 38.760851][ T4911] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 38.760854][ T4911] page dumped because: kasan: bad access detected [ 38.760857][ T4911] [ 38.760858][ T4911] Memory state around the buggy address: [ 38.760862][ T4911] ffff0000cb357700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.760866][ T4911] ffff0000cb357780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.760871][ T4911] >ffff0000cb357800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 38.760874][ T4911] ^ [ 38.760877][ T4911] ffff0000cb357880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 38.760882][ T4911] ffff0000cb357900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.760885][ T4911] ================================================================== [ 38.769593][ T4911] Disabling lock debugging due to kernel taint [ 38.769613][ T4911] ------------[ cut here ]------------ [ 38.769621][ T4911] refcount_t: addition on 0; use-after-free. [ 38.769732][ T4911] WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x134/0x1f8, CPU#0: syz.0.19/4911 [ 38.875542][ T4911] Modules linked in: [ 38.876398][ T4911] CPU: 0 UID: 0 PID: 4911 Comm: syz.0.19 Tainted: G B syzkaller #0 PREEMPT [ 38.878624][ T4911] Tainted: [B]=BAD_PAGE [ 38.879539][ T4911] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 38.881453][ T4911] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 38.882953][ T4911] pc : refcount_warn_saturate+0x134/0x1f8 [ 38.884044][ T4911] lr : refcount_warn_saturate+0x134/0x1f8 [ 38.885126][ T4911] sp : ffff8000977f7700 [ 38.885906][ T4911] x29: ffff8000977f7700 x28: dfff800000000000 x27: 1fffe0001b358809 [ 38.887466][ T4911] x26: dfff800000000000 x25: ffff700012efeef4 x24: dfff800000000000 [ 38.888938][ T4911] x23: ffff800087501208 x22: ffff0000cb508c00 x21: ffff0000cb357800 [ 38.890451][ T4911] x20: ffff0000cb357810 x19: ffff80008a26d000 x18: 1fffe00035b9ec28 [ 38.892027][ T4911] x17: 0000000000000003 x16: ffff800088bf7000 x15: ffff800088ca7ee0 [ 38.893625][ T4911] x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000003 [ 38.895137][ T4911] x11: 0000000000000000 x10: 0000000000000002 x9 : 1f4bfc1387312100 [ 38.896606][ T4911] x8 : 1f4bfc1387312100 x7 : 0000000000000000 x6 : ffff80008048e314 [ 38.898080][ T4911] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f9194 [ 38.899544][ T4911] x2 : 0000000100000000 x1 : ffff0000c7f95880 x0 : 0000000000000000 [ 38.901051][ T4911] Call trace: [ 38.901672][ T4911] refcount_warn_saturate+0x134/0x1f8 (P) [ 38.902712][ T4911] dvb_device_get+0x9c/0xc0 [ 38.903548][ T4911] dvb_device_open+0x100/0x254 [ 38.904432][ T4911] chrdev_open+0x398/0x3e8 [ 38.905252][ T4911] do_dentry_open+0x5c4/0xfc0 [ 38.906160][ T4911] vfs_open+0x44/0x2dc [ 38.906941][ T4911] path_openat+0x1084/0x18f4 [ 38.907778][ T4911] do_file_open+0x1c8/0x2e8 [ 38.908589][ T4911] do_sys_openat2+0x114/0x1e8 [ 38.909464][ T4911] do_sys_open+0xb0/0xe0 [ 38.910263][ T4911] __arm64_sys_openat+0xa8/0xc4 [ 38.911177][ T4911] invoke_syscall+0x98/0x244 [ 38.911978][ T4911] el0_svc_common+0xec/0x23c [ 38.912773][ T4911] do_el0_svc+0x4c/0x5c [ 38.913480][ T4911] el0_svc+0x64/0x260 [ 38.914186][ T4911] el0t_64_sync_handler+0x44/0x104 [ 38.915076][ T4911] el0t_64_sync+0x198/0x19c [ 38.915879][ T4911] irq event stamp: 985 [ 38.916582][ T4911] hardirqs last enabled at (985): [] finish_task_switch+0x234/0x858 [ 38.918278][ T4911] hardirqs last disabled at (984): [] __schedule+0x2f8/0x2d80 [ 38.919805][ T4911] softirqs last enabled at (944): [] fpsimd_restore_current_state+0x39c/0x9c8 [ 38.921595][ T4911] softirqs last disabled at (942): [] fpsimd_restore_current_state+0x44/0x9c8 [ 38.923438][ T4911] ---[ end trace 0000000000000000 ]--- [ 38.931319][ ** replaying previous printk message ** [ 38.931319][ T4911] ------------[ cut here ]------------ [ 38.931358][ T4911] refcount_t: underflow; use-after-free. [ 38.931609][ T4911] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x154/0x1f8, CPU#0: syz.0.19/4911 [ 38.936411][ T4911] Modules linked in: [ 38.937174][ T4911] CPU: 0 UID: 0 PID: 4911 Comm: syz.0.19 Tainted: G B W syzkaller #0 PREEMPT [ 38.939230][ T4911] Tainted: [B]=BAD_PAGE, [W]=WARN [ 38.940175][ T4911] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 38.942109][ T4911] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 38.943602][ T4911] pc : refcount_warn_saturate+0x154/0x1f8 [ 38.944692][ T4911] lr : refcount_warn_saturate+0x154/0x1f8 [ 38.945802][ T4911] sp : ffff8000977f75b0 [ 38.946582][ T4911] x29: ffff8000977f75b0 x28: ffff0000cb323000 x27: ffff0000cb357800 [ 38.948069][ T4911] x26: ffff0000cb573308 x25: dfff800000000000 x24: ffff0000cb55c180 [ 38.949554][ T4911] x23: 00000000fffffffc x22: 1fffe0001966af07 x21: 00000000c0000000 [ 38.951051][ T4911] x20: ffff0000cb357810 x19: ffff80008a26d000 x18: 1fffe00035b9ec28 [ 38.952547][ T4911] x17: 0000000000000003 x16: ffff800088bf7000 x15: ffff800088ca7ee0 [ 38.954001][ T4911] x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000003 [ 38.955508][ T4911] x11: ffff80008015610c x10: 0000000000000003 x9 : 1f4bfc1387312100 [ 38.957017][ T4911] x8 : 1f4bfc1387312100 x7 : 0000000000000000 x6 : ffff8000803b9710 [ 38.958529][ T4911] x5 : 0000000000000000 x4 : 0000000000000008 x3 : ffff8000801561b4 [ 38.960051][ T4911] x2 : 0000000000000000 x1 : ffff0000c7f95880 x0 : 0000000000000001 [ 38.961468][ T4911] Call trace: [ 38.962057][ T4911] refcount_warn_saturate+0x154/0x1f8 (P) [ 38.963109][ T4911] dvb_device_put+0xac/0xd0 [ 38.963888][ T4911] dvb_generic_release+0xec/0x158 [ 38.964782][ T4911] __dvb_frontend_open+0x5c4/0xa34 [ 38.965753][ T4911] dvb_frontend_open+0x19c/0x70c [ 38.966690][ T4911] dvb_device_open+0x1f8/0x254 [ 38.967577][ T4911] chrdev_open+0x398/0x3e8 [ 38.968381][ T4911] do_dentry_open+0x5c4/0xfc0 [ 38.969221][ T4911] vfs_open+0x44/0x2dc [ 38.969948][ T4911] path_openat+0x1084/0x18f4 [ 38.970807][ T4911] do_file_open+0x1c8/0x2e8 [ 38.971621][ T4911] do_sys_openat2+0x114/0x1e8 [ 38.972493][ T4911] do_sys_open+0xb0/0xe0 [ 38.973281][ T4911] __arm64_sys_openat+0xa8/0xc4 [ 38.974144][ T4911] invoke_syscall+0x98/0x244 [ 38.974949][ T4911] el0_svc_common+0xec/0x23c [ 38.975769][ T4911] do_el0_svc+0x4c/0x5c [ 38.976536][ T4911] el0_svc+0x64/0x260 [ 38.977287][ T4911] el0t_64_sync_handler+0x44/0x104 [ 38.978199][ T4911] el0t_64_sync+0x198/0x19c [ 38.979008][ T4911] irq event stamp: 985 [ 38.979742][ T4911] hardirqs last enabled at (985): [] finish_task_switch+0x234/0x858 [ 38.981498][ T4911] hardirqs last disabled at (984): [] __schedule+0x2f8/0x2d80 [ 38.983173][ T4911] softirqs last enabled at (944): [] fpsimd_restore_current_state+0x39c/0x9c8 [ 38.985127][ T4911] softirqs last disabled at (942): [] fpsimd_restore_current_state+0x44/0x9c8 [ 38.987037][ T4911] ---[ end trace 0000000000000000 ]--- [ 38 ** replaying previous printk message ** [ 38.995820][ T4912] ------------[ cut here ]------------ [ 38.995840][ T4912] refcount_t: saturated; leaking memory. [ 38.995960][ T4912] WARNING: lib/refcount.c:22 at refcount_warn_saturate+0x1b4/0x1f8, CPU#0: syz.0.20/4912 [ 39.000561][ T4912] Modules linked in: [ 39.001274][ T4912] CPU: 0 UID: 0 PID: 4912 Comm: syz.0.20 Tainted: G B W syzkaller #0 PREEMPT [ 39.003071][ T4912] Tainted: [B]=BAD_PAGE, [W]=WARN [ 39.004016][ T4912] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 39.005950][ T4912] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 39.007494][ T4912] pc : refcount_warn_saturate+0x1b4/0x1f8 [ 39.008598][ T4912] lr : refcount_warn_saturate+0x1b4/0x1f8 [ 39.009713][ T4912] sp : ffff8000977f7700 [ 39.010490][ T4912] x29: ffff8000977f7700 x28: dfff800000000000 x27: 1fffe00019f920e9 [ 39.012015][ T4912] x26: dfff800000000000 x25: ffff700012efeef4 x24: dfff800000000000 [ 39.013482][ T4912] x23: ffff800087501208 x22: ffff0000cb508c00 x21: 000000007ffffffe [ 39.015026][ T4912] x20: ffff0000cb357810 x19: ffff80008a26d000 x18: 0000000000000000 [ 39.016526][ T4912] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 39.017980][ T4912] x14: 00000000ffff8000 x13: 0000000000000001 x12: 0000000000000003 [ 39.019532][ T4912] x11: 0000000000000000 x10: 0000000000000002 x9 : 19923ec1f98cfa00 [ 39.021041][ T4912] x8 : 19923ec1f98cfa00 x7 : 0000000000000000 x6 : ffff80008048e314 [ 39.022541][ T4912] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f9194 [ 39.023984][ T4912] x2 : 0000000100000000 x1 : ffff0000c4a2d880 x0 : 0000000000000000 [ 39.025431][ T4912] Call trace: [ 39.026037][ T4912] refcount_warn_saturate+0x1b4/0x1f8 (P) [ 39.027101][ T4912] dvb_device_get+0x9c/0xc0 [ 39.027926][ T4912] dvb_device_open+0x100/0x254 [ 39.028813][ T4912] chrdev_open+0x398/0x3e8 [ 39.029638][ T4912] do_dentry_open+0x5c4/0xfc0 [ 39.030495][ T4912] vfs_open+0x44/0x2dc [ 39.031217][ T4912] path_openat+0x1084/0x18f4 [ 39.032061][ T4912] do_file_open+0x1c8/0x2e8 [ 39.032890][ T4912] do_sys_openat2+0x114/0x1e8 [ 39.033748][ T4912] do_sys_open+0xb0/0xe0 [ 39.034577][ T4912] __arm64_sys_openat+0xa8/0xc4 [ 39.035499][ T4912] invoke_syscall+0x98/0x244 [ 39.036343][ T4912] el0_svc_common+0xec/0x23c [ 39.037183][ T4912] do_el0_svc+0x4c/0x5c [ 39.037934][ T4912] el0_svc+0x64/0x260 [ 39.038661][ T4912] el0t_64_sync_handler+0x44/0x104 [ 39.039598][ T4912] el0t_64_sync+0x198/0x19c [ 39.040438][ T4912] irq event stamp: 0 [ 39.041180][ T4912] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 39.042513][ T4912] hardirqs last disabled at (0): [] copy_process+0x1384/0x332c [ 39.044177][ T4912] softirqs last enabled at (0): [] copy_process+0x13a4/0x332c [ 39.045806][ T4912] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 39.047134][ T4912] ---[ end trace 0000000000000000 ]--- [ 39.233150][ T4730] Bluetooth: hci0: command tx timeout 1970/01/01 00:00:40 executed programs: 66 [ 41.313166][ T4730] Bluetooth: hci0: command tx timeout [ 43.393311][ T4730] Bluetooth: hci0: command tx timeout 1970/01/01 00:00:45 executed programs: 366