Warning: Permanently added '10.128.0.151' (ED25519) to the list of known hosts. 1970/01/01 00:00:53 parsed 1 programs 1970/01/01 00:00:53 serving rpc on tcp://39381 [ 55.071015][ T4734] cgroup: Unknown subsys name 'net' [ 55.241017][ T4734] cgroup: Unknown subsys name 'cpuset' [ 55.243204][ T4734] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 55.409144][ T4734] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 58.812574][ T4742] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 59.818511][ T4785] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.818944][ T4785] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.819012][ T4785] bridge_slave_0: entered allmulticast mode [ 59.821959][ T4785] bridge_slave_0: entered promiscuous mode [ 59.823576][ T4785] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.823629][ T4785] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.823683][ T4785] bridge_slave_1: entered allmulticast mode [ 59.824115][ T4785] bridge_slave_1: entered promiscuous mode [ 59.832749][ T4785] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 59.833784][ T4785] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 59.840557][ T4785] team0: Port device team_slave_0 added [ 59.841358][ T4785] team0: Port device team_slave_1 added [ 59.847658][ T4785] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 59.847698][ T4785] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 59.847709][ T4785] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 59.850004][ T4785] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 59.850015][ T4785] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 59.850026][ T4785] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 59.862413][ T4785] hsr_slave_0: entered promiscuous mode [ 59.862728][ T4785] hsr_slave_1: entered promiscuous mode [ 59.912287][ T4785] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 59.915178][ T4785] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 59.915575][ T4785] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 59.917706][ T4785] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 59.918081][ T4785] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 59.920504][ T4785] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 59.921213][ T4785] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 59.923033][ T4785] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 59.932148][ T4785] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.932202][ T4785] bridge0: port 2(bridge_slave_1) entered forwarding state [ 59.932369][ T4785] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.932399][ T4785] bridge0: port 1(bridge_slave_0) entered forwarding state [ 59.950721][ T4785] 8021q: adding VLAN 0 to HW filter on device bond0 [ 59.956164][ T40] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.957743][ T40] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.963230][ T4785] 8021q: adding VLAN 0 to HW filter on device team0 [ 59.965635][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.965694][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 59.972067][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.972125][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 60.068102][ T4785] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 60.081004][ T4785] veth0_vlan: entered promiscuous mode [ 60.083300][ T4785] veth1_vlan: entered promiscuous mode [ 60.097688][ T4785] veth0_macvtap: entered promiscuous mode [ 60.101113][ T4785] veth1_macvtap: entered promiscuous mode [ 60.105064][ T4785] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 60.106147][ T4785] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 60.108626][ T1803] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.110734][ T1803] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.114698][ T1803] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.116521][ T1803] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.197864][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 60.198503][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 60.198684][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 60.198985][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 60.199206][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 60.223024][ T40] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 60.293568][ T40] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 60.327112][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 60.327147][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 60.338710][ T1870] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 60.339140][ T1870] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 60.352781][ T40] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 60.436422][ T40] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 1970/01/01 00:01:00 executed programs: 0 [ 60.670990][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 60.672729][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 60.674253][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 60.676014][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 60.677710][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 60.819010][ T4840] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.819113][ T4840] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.819173][ T4840] bridge_slave_0: entered allmulticast mode [ 60.819690][ T4840] bridge_slave_0: entered promiscuous mode [ 60.820531][ T4840] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.820575][ T4840] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.820676][ T4840] bridge_slave_1: entered allmulticast mode [ 60.821104][ T4840] bridge_slave_1: entered promiscuous mode [ 60.828734][ T4840] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 60.830696][ T4840] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 60.837414][ T4840] team0: Port device team_slave_0 added [ 60.838219][ T4840] team0: Port device team_slave_1 added [ 60.844877][ T4840] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 60.844909][ T4840] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 60.844924][ T4840] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 60.845476][ T4840] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 60.845483][ T4840] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 60.845496][ T4840] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 60.857462][ T4840] hsr_slave_0: entered promiscuous mode [ 60.857771][ T4840] hsr_slave_1: entered promiscuous mode [ 60.857983][ T4840] debugfs: 'hsr0' already exists in 'hsr' [ 60.858041][ T4840] Cannot create hsr debugfs directory [ 62.740013][ T4748] Bluetooth: hci0: command tx timeout [ 63.182955][ T40] bridge_slave_1: left allmulticast mode [ 63.183017][ T40] bridge_slave_1: left promiscuous mode [ 63.183384][ T40] bridge0: port 2(bridge_slave_1) entered disabled state [ 63.188831][ T40] bridge_slave_0: left allmulticast mode [ 63.188869][ T40] bridge_slave_0: left promiscuous mode [ 63.188968][ T40] bridge0: port 1(bridge_slave_0) entered disabled state [ 63.249854][ T40] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 63.280796][ T40] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 63.290663][ T40] bond0 (unregistering): Released all slaves [ 63.357458][ T40] hsr_slave_0: left promiscuous mode [ 63.358718][ T40] hsr_slave_1: left promiscuous mode [ 63.361212][ T40] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 63.362751][ T40] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 63.365665][ T40] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 63.365708][ T40] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 63.375384][ T40] veth1_macvtap: left promiscuous mode [ 63.378009][ T40] veth0_macvtap: left promiscuous mode [ 63.378102][ T40] veth1_vlan: left promiscuous mode [ 63.378161][ T40] veth0_vlan: left promiscuous mode [ 63.481272][ T40] team0 (unregistering): Port device team_slave_1 removed [ 63.487460][ T40] team0 (unregistering): Port device team_slave_0 removed [ 63.540286][ T4407] 8021q: adding VLAN 0 to HW filter on device eth0 [ 63.740507][ T4840] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 63.743690][ T4840] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 63.744221][ T4840] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 63.749959][ T4840] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 63.751842][ T4840] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 63.754248][ T4840] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 63.756389][ T4840] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 63.758686][ T4840] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 63.790910][ T4840] 8021q: adding VLAN 0 to HW filter on device bond0 [ 63.805557][ T4840] 8021q: adding VLAN 0 to HW filter on device team0 [ 63.880900][ T15] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.880955][ T15] bridge0: port 1(bridge_slave_0) entered forwarding state [ 63.884936][ T1225] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.884995][ T1225] bridge0: port 2(bridge_slave_1) entered forwarding state [ 63.916646][ T4840] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 64.081131][ T4840] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 64.093237][ T4840] veth0_vlan: entered promiscuous mode [ 64.095914][ T4840] veth1_vlan: entered promiscuous mode [ 64.104336][ T4840] veth0_macvtap: entered promiscuous mode [ 64.105682][ T4840] veth1_macvtap: entered promiscuous mode [ 64.108993][ T4840] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 64.112999][ T4840] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 64.151530][ T15] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.152043][ T15] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.152072][ T15] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.152092][ T15] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.171868][ T1907] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.171902][ T1907] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.193506][ T1907] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.193537][ T1907] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.240364][ T4929] gadgetfs: bound to dummy_udc driver [ 64.259021][ T4930] gadgetfs: bound to dummy_udc driver [ 64.274199][ T4931] FAULT_INJECTION: forcing a failure. [ 64.274199][ T4931] name failslab, interval 1, probability 0, space 0, times 1 [ 64.274247][ T4931] CPU: 1 UID: 0 PID: 4931 Comm: syz.0.19 Not tainted syzkaller #0 PREEMPT [ 64.274262][ T4931] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 64.274268][ T4931] Call trace: [ 64.274272][ T4931] show_stack+0x2c/0x3c (C) [ 64.274290][ T4931] __dump_stack+0x30/0x40 [ 64.274301][ T4931] dump_stack_lvl+0xd8/0x12c [ 64.274310][ T4931] dump_stack+0x1c/0x28 [ 64.274319][ T4931] should_fail_ex+0x41c/0x590 [ 64.274330][ T4931] should_failslab+0xc4/0x120 [ 64.274339][ T4931] __kmalloc_cache_noprof+0x94/0x5ec [ 64.274347][ T4931] gadgetfs_bind+0x204/0x75c [ 64.274356][ T4931] gadget_bind_driver+0x274/0x834 [ 64.274364][ T4931] really_probe+0x29c/0x800 [ 64.274374][ T4931] __driver_probe_device+0x1e0/0x350 [ 64.274383][ T4931] driver_probe_device+0x6c/0x19c [ 64.274392][ T4931] __driver_attach+0x168/0x384 [ 64.274401][ T4931] bus_for_each_dev+0x128/0x1b4 [ 64.274409][ T4931] driver_attach+0x50/0x60 [ 64.274417][ T4931] bus_add_driver+0x208/0x500 [ 64.274425][ T4931] driver_register+0x220/0x310 [ 64.274434][ T4931] usb_gadget_register_driver_owner+0xf0/0x25c [ 64.274445][ T4931] dev_config+0x91c/0xcc0 [ 64.274452][ T4931] vfs_write+0x2a4/0xa0c [ 64.274463][ T4931] ksys_write+0x12c/0x228 [ 64.274469][ T4931] __arm64_sys_write+0x7c/0x90 [ 64.274476][ T4931] invoke_syscall+0x98/0x244 [ 64.274486][ T4931] el0_svc_common+0xec/0x23c [ 64.274495][ T4931] do_el0_svc+0x4c/0x5c [ 64.274505][ T4931] el0_svc+0x64/0x260 [ 64.274515][ T4931] el0t_64_sync_handler+0x48/0x148 [ 64.274525][ T4931] el0t_64_sync+0x198/0x19c [ 64.274546][ T4931] udc dummy_udc.0: failed to start USB Gadget filesystem: -12 [ 64.274554][ T4931] gadgetfs gadget.0: probe with driver gadgetfs failed with error -12 [ 64.274745][ T4931] gadgetfs expected dummy_udc controller not usbip-vudc [ 64.274752][ T4931] udc usbip-vudc.0: failed to start USB Gadget filesystem: -19 [ 64.275065][ T4931] UDC core: USB Gadget filesystem: couldn't find an available UDC [ 64.314495][ T4932] ================================================================== [ 64.314511][ T4932] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irq+0x58/0x70 [ 64.314537][ T4932] Read of size 1 at addr ffff0000d0323818 by task syz.0.20/4932 [ 64.314547][ T4932] [ 64.314552][ T4932] CPU: 0 UID: 0 PID: 4932 Comm: syz.0.20 Not tainted syzkaller #0 PREEMPT [ 64.314562][ T4932] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 64.314568][ T4932] Call trace: [ 64.314571][ T4932] show_stack+0x2c/0x3c (C) [ 64.314588][ T4932] __dump_stack+0x30/0x40 [ 64.314600][ T4932] dump_stack_lvl+0xd8/0x12c [ 64.314610][ T4932] print_address_description+0xb0/0x238 [ 64.314619][ T4932] print_report+0x68/0x84 [ 64.314626][ T4932] kasan_report+0x8c/0xc4 [ 64.314636][ T4932] __kasan_check_byte+0x3c/0x54 [ 64.314644][ T4932] lock_acquire+0xa4/0x364 [ 64.314652][ T4932] _raw_spin_lock_irq+0x58/0x70 [ 64.314662][ T4932] gadget_dev_open+0x50/0x1c4 [ 64.314670][ T4932] do_dentry_open+0x5c4/0xfc0 [ 64.314681][ T4932] vfs_open+0x44/0x2dc [ 64.314689][ T4932] path_openat+0x21fc/0x2a60 [ 64.314698][ T4932] do_file_open+0x1c8/0x2e8 [ 64.314706][ T4932] do_sys_openat2+0x114/0x1e8 [ 64.314715][ T4932] do_sys_open+0xb0/0xe0 [ 64.314724][ T4932] __arm64_sys_openat+0xa0/0xbc [ 64.314734][ T4932] invoke_syscall+0x98/0x244 [ 64.314743][ T4932] el0_svc_common+0xec/0x23c [ 64.314753][ T4932] do_el0_svc+0x4c/0x5c [ 64.314762][ T4932] el0_svc+0x64/0x260 [ 64.314771][ T4932] el0t_64_sync_handler+0x48/0x148 [ 64.314780][ T4932] el0t_64_sync+0x198/0x19c [ 64.314788][ T4932] [ 64.314790][ T4932] Allocated by task 4840: [ 64.314795][ T4932] kasan_save_track+0x40/0x78 [ 64.314802][ T4932] kasan_save_alloc_info+0x44/0x54 [ 64.314810][ T4932] __kasan_kmalloc+0x9c/0xb4 [ 64.314816][ T4932] __kmalloc_cache_noprof+0x2e8/0x5ec [ 64.314823][ T4932] gadgetfs_fill_super+0x19c/0x370 [ 64.314829][ T4932] vfs_get_super+0xb8/0x148 [ 64.314836][ T4932] get_tree_single+0x30/0x40 [ 64.314842][ T4932] gadgetfs_get_tree+0x28/0x38 [ 64.314847][ T4932] vfs_get_tree+0x90/0x28c [ 64.314854][ T4932] fc_mount+0x24/0xac [ 64.314860][ T4932] do_new_mount+0x2a4/0x538 [ 64.314867][ T4932] path_mount+0x5f0/0xa88 [ 64.314874][ T4932] do_mount+0xe8/0x148 [ 64.314881][ T4932] __arm64_sys_mount+0x334/0x380 [ 64.314888][ T4932] invoke_syscall+0x98/0x244 [ 64.314896][ T4932] el0_svc_common+0xec/0x23c [ 64.314904][ T4932] do_el0_svc+0x4c/0x5c [ 64.314911][ T4932] el0_svc+0x64/0x260 [ 64.314919][ T4932] el0t_64_sync_handler+0x48/0x148 [ 64.314926][ T4932] el0t_64_sync+0x198/0x19c [ 64.314931][ T4932] [ 64.314933][ T4932] Freed by task 4931: [ 64.314937][ T4932] kasan_save_track+0x40/0x78 [ 64.314943][ T4932] kasan_save_free_info+0x58/0x70 [ 64.314951][ T4932] __kasan_slab_free+0x74/0xa4 [ 64.314957][ T4932] kfree+0x188/0x690 [ 64.314963][ T4932] put_dev+0x8c/0xf8 [ 64.314968][ T4932] dev_release+0x100/0x15c [ 64.314974][ T4932] __fput+0x338/0x74c [ 64.314980][ T4932] ____fput+0x20/0x30 [ 64.314985][ T4932] task_work_run+0x1cc/0x25c [ 64.314993][ T4932] exit_to_user_mode_loop+0x10c/0x17c [ 64.315001][ T4932] el0_svc+0x18c/0x260 [ 64.315008][ T4932] el0t_64_sync_handler+0x48/0x148 [ 64.315015][ T4932] el0t_64_sync+0x198/0x19c [ 64.315021][ T4932] [ 64.315022][ T4932] The buggy address belongs to the object at ffff0000d0323800 [ 64.315022][ T4932] which belongs to the cache kmalloc-1k of size 1024 [ 64.315028][ T4932] The buggy address is located 24 bytes inside of [ 64.315028][ T4932] freed 1024-byte region [ffff0000d0323800, ffff0000d0323c00) [ 64.315035][ T4932] [ 64.315037][ T4932] The buggy address belongs to the physical page: [ 64.315041][ T4932] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x110320 [ 64.315048][ T4932] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 64.315053][ T4932] flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 64.315067][ T4932] page_type: f5(slab) [ 64.315074][ T4932] raw: 05ffc00000000040 ffff0000c0001dc0 dead000000000100 dead000000000122 [ 64.315081][ T4932] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 64.315087][ T4932] head: 05ffc00000000040 ffff0000c0001dc0 dead000000000100 dead000000000122 [ 64.315093][ T4932] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 64.315099][ T4932] head: 05ffc00000000003 fffffdffc340c801 00000000ffffffff 00000000ffffffff [ 64.315105][ T4932] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 64.315108][ T4932] page dumped because: kasan: bad access detected [ 64.315111][ T4932] [ 64.315112][ T4932] Memory state around the buggy address: [ 64.315116][ T4932] ffff0000d0323700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 64.315121][ T4932] ffff0000d0323780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 64.315125][ T4932] >ffff0000d0323800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 64.315128][ T4932] ^ [ 64.315132][ T4932] ffff0000d0323880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 64.315136][ T4932] ffff0000d0323900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 64.315139][ T4932] ================================================================== [ 64.315142][ T4932] Disabling lock debugging due to kernel taint [ 64.315145][ T4932] ------------[ cut here ]------------ [ 64.315148][ T4932] UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.h:68:9 [ 64.315154][ T4932] index 13411 is out of range for type 'unsigned long[8]' [ 64.315159][ T4932] CPU: 0 UID: 0 PID: 4932 Comm: syz.0.20 Tainted: G B syzkaller #0 PREEMPT [ 64.315168][ T4932] Tainted: [B]=BAD_PAGE [ 64.315170][ T4932] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 64.315174][ T4932] Call trace: [ 64.315176][ T4932] show_stack+0x2c/0x3c (C) [ 64.315186][ T4932] __dump_stack+0x30/0x40 [ 64.315195][ T4932] dump_stack_lvl+0xd8/0x12c [ 64.315204][ T4932] dump_stack+0x1c/0x28 [ 64.315213][ T4932] ubsan_epilogue+0x14/0x48 [ 64.315222][ T4932] __ubsan_handle_out_of_bounds+0xd0/0xf8 [ 64.315232][ T4932] queued_spin_lock_slowpath+0x834/0xd04 [ 64.315242][ T4932] do_raw_spin_lock+0x21c/0x2d0 [ 64.315250][ T4932] _raw_spin_lock_irq+0x60/0x70 [ 64.315260][ T4932] gadget_dev_open+0x50/0x1c4 [ 64.315267][ T4932] do_dentry_open+0x5c4/0xfc0 [ 64.315276][ T4932] vfs_open+0x44/0x2dc [ 64.315284][ T4932] path_openat+0x21fc/0x2a60 [ 64.315292][ T4932] do_file_open+0x1c8/0x2e8 [ 64.315300][ T4932] do_sys_openat2+0x114/0x1e8 [ 64.315309][ T4932] do_sys_open+0xb0/0xe0 [ 64.315318][ T4932] __arm64_sys_openat+0xa0/0xbc [ 64.315327][ T4932] invoke_syscall+0x98/0x244 [ 64.315336][ T4932] el0_svc_common+0xec/0x23c [ 64.315346][ T4932] do_el0_svc+0x4c/0x5c [ 64.315355][ T4932] el0_svc+0x64/0x260 [ 64.315363][ T4932] el0t_64_sync_handler+0x48/0x148 [ 64.315372][ T4932] el0t_64_sync+0x198/0x19c [ 64.315379][ T4932] ---[ end trace ]--- [ 64.315390][ T4932] Unable to handle kernel paging request at virtual address ffff7fbfe45e33d2 [ 64.315394][ T4932] KASAN: probably wild-memory-access in range [0xfffffdff22f19e90-0xfffffdff22f19e97] [ 64.315399][ T4932] Mem abort info: [ 64.315401][ T4932] ESR = 0x0000000096000006 [ 64.315404][ T4932] EC = 0x25: DABT (current EL), IL = 32 bits [ 64.315408][ T4932] SET = 0, FnV = 0 [ 64.315411][ T4932] EA = 0, S1PTW = 0 [ 64.315414][ T4932] FSC = 0x06: level 2 translation fault [ 64.315417][ T4932] Data abort info: [ 64.315419][ T4932] ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 [ 64.315422][ T4932] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 64.315427][ T4932] GCS = 0, Overlay = 0, DirtyBit = 0 [ 64.315431][ T4932] swapper pgtable: 4k pages, 48-bit VAs, pgdp=000000021b01e000 [ 64.315436][ T4932] [ffff7fbfe45e33d2] pgd=0000000000000000, p4d=100000023cc9f403, pud=100000023cc9e403, pmd=0000000000000000 [ 64.315451][ T4932] Internal error: Oops: 0000000096000006 [#1] SMP [ 64.445965][ T4932] Modules linked in: [ 64.446660][ T4932] CPU: 0 UID: 0 PID: 4932 Comm: syz.0.20 Tainted: G B syzkaller #0 PREEMPT [ 64.448445][ T4932] Tainted: [B]=BAD_PAGE [ 64.449173][ T4932] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 64.450896][ T4932] pstate: 834000c5 (Nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 64.452231][ T4932] pc : queued_spin_lock_slowpath+0x52c/0xd04 [ 64.453270][ T4932] lr : queued_spin_lock_slowpath+0x834/0xd04 [ 64.454290][ T4932] sp : ffff80009a787560 [ 64.454975][ T4932] x29: ffff80009a787600 x28: fffffdff22f19e90 x27: 1fffe000188f6afa [ 64.456498][ T4932] x26: 1fffe0001a064700 x25: ffff0001ade40708 x24: dfff800000000000 [ 64.457985][ T4932] x23: ffff7000134f0eb0 x22: ffff0001ade40700 x21: 1fffe00035bc80e0 [ 64.459463][ T4932] x20: ffff0000c47b57d0 x19: ffff0000d0323800 x18: 0000000000000000 [ 64.460852][ T4932] x17: 363a682e6b636f6c x16: 0000000000000001 x15: 0000000000000000 [ 64.462205][ T4932] x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000004 [ 64.463593][ T4932] x11: ffff70001145ec6c x10: ffff800088ac7700 x9 : ffff800088ac7710 [ 64.464939][ T4932] x8 : 1fffffbfe45e33d2 x7 : 0000000000000001 x6 : ffff80008048de94 [ 64.466354][ T4932] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f7498 [ 64.467708][ T4932] x2 : 0000000000000002 x1 : ffff0000c47b57c0 x0 : 0000000000000000 [ 64.469090][ T4932] Call trace: [ 64.469646][ T4932] queued_spin_lock_slowpath+0x52c/0xd04 (P) [ 64.470680][ T4932] do_raw_spin_lock+0x21c/0x2d0 [ 64.471527][ T4932] _raw_spin_lock_irq+0x60/0x70 [ 64.472367][ T4932] gadget_dev_open+0x50/0x1c4 [ 64.473208][ T4932] do_dentry_open+0x5c4/0xfc0 [ 64.474015][ T4932] vfs_open+0x44/0x2dc [ 64.474712][ T4932] path_openat+0x21fc/0x2a60 [ 64.475530][ T4932] do_file_open+0x1c8/0x2e8 [ 64.476309][ T4932] do_sys_openat2+0x114/0x1e8 [ 64.477114][ T4932] do_sys_open+0xb0/0xe0 [ 64.477898][ T4932] __arm64_sys_openat+0xa0/0xbc [ 64.478768][ T4932] invoke_syscall+0x98/0x244 [ 64.479548][ T4932] el0_svc_common+0xec/0x23c [ 64.480327][ T4932] do_el0_svc+0x4c/0x5c [ 64.481054][ T4932] el0_svc+0x64/0x260 [ 64.481756][ T4932] el0t_64_sync_handler+0x48/0x148 [ 64.482628][ T4932] el0t_64_sync+0x198/0x19c [ 64.483430][ T4932] Code: f94007e9 f9400388 8b09011c d343ff88 (38786908) [ 64.484654][ T4932] ---[ end trace 0000000000000000 ]--- [ 64.702429][ T4932] Kernel panic - not syncing: Oops: Fatal exception [ 64.703597][ T4932] SMP: stopping secondary CPUs [ 64.704423][ T4932] Kernel Offset: disabled [ 64.705138][ T4932] CPU features: 0x14000000,003c0008,27020501,5427fea7 [ 64.706261][ T4932] Memory Limit: none [ 64.928059][ T4932] Rebooting in 86400 seconds..