Warning: Permanently added '10.128.0.68' (ED25519) to the list of known hosts. 1970/01/01 00:00:31 parsed 1 programs 1970/01/01 00:00:31 serving rpc on tcp://45833 [ 32.098130][ T4724] cgroup: Unknown subsys name 'net' [ 32.219301][ T4724] cgroup: Unknown subsys name 'cpuset' [ 32.221384][ T4724] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 32.434286][ T4724] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 35.359570][ T4733] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 35.632348][ T4742] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.633160][ T4742] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.633244][ T4742] bridge_slave_0: entered allmulticast mode [ 35.634209][ T4742] bridge_slave_0: entered promiscuous mode [ 35.635379][ T4742] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.635422][ T4742] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.635468][ T4742] bridge_slave_1: entered allmulticast mode [ 35.635958][ T4742] bridge_slave_1: entered promiscuous mode [ 35.649534][ T4742] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 35.650486][ T4742] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 35.656792][ T4742] team0: Port device team_slave_0 added [ 35.657557][ T4742] team0: Port device team_slave_1 added [ 35.663474][ T4742] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 35.663502][ T4742] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.663515][ T4742] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 35.664343][ T4742] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 35.664350][ T4742] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.664364][ T4742] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 35.675067][ T4742] hsr_slave_0: entered promiscuous mode [ 35.675405][ T4742] hsr_slave_1: entered promiscuous mode [ 35.719519][ T4742] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 35.722567][ T4742] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 35.724328][ T4742] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 35.727001][ T4742] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 35.728524][ T4742] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 35.730519][ T4742] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 35.732069][ T4742] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 35.734004][ T4742] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 35.743358][ T4742] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.743409][ T4742] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.743549][ T4742] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.743576][ T4742] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.759904][ T4742] 8021q: adding VLAN 0 to HW filter on device bond0 [ 35.763631][ T15] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.765422][ T15] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.770403][ T4742] 8021q: adding VLAN 0 to HW filter on device team0 [ 35.773097][ T15] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.773143][ T15] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.779530][ T1306] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.779570][ T1306] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.873094][ T4742] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 35.884996][ T4742] veth0_vlan: entered promiscuous mode [ 35.893920][ T4742] veth1_vlan: entered promiscuous mode [ 35.902037][ T4742] veth0_macvtap: entered promiscuous mode [ 35.903097][ T4742] veth1_macvtap: entered promiscuous mode [ 35.908029][ T4742] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 35.909563][ T4742] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 35.914087][ T39] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.914131][ T39] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.914151][ T39] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.914172][ T39] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.002713][ T1306] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 36.014804][ T15] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 36.014835][ T15] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 36.023956][ T39] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 36.025285][ T39] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 36.060146][ T1306] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 36.110109][ T1306] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 36.173577][ T1306] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 36.378017][ T4802] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 36.378687][ T4802] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 36.378878][ T4802] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 36.379207][ T4802] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 36.379436][ T4802] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 1970/01/01 00:00:36 executed programs: 0 [ 36.915484][ T4802] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 36.915811][ T4802] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 36.915963][ T4802] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 36.916283][ T4802] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 36.916477][ T4802] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 37.044315][ T4828] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.044400][ T4828] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.044475][ T4828] bridge_slave_0: entered allmulticast mode [ 37.044889][ T4828] bridge_slave_0: entered promiscuous mode [ 37.045762][ T4828] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.045811][ T4828] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.045864][ T4828] bridge_slave_1: entered allmulticast mode [ 37.046319][ T4828] bridge_slave_1: entered promiscuous mode [ 37.054436][ T4828] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.055958][ T4828] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 37.064001][ T4828] team0: Port device team_slave_0 added [ 37.065816][ T4828] team0: Port device team_slave_1 added [ 37.072904][ T4828] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 37.072924][ T4828] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 37.072939][ T4828] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 37.073464][ T4828] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 37.073471][ T4828] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 37.073485][ T4828] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.086038][ T4828] hsr_slave_0: entered promiscuous mode [ 37.086364][ T4828] hsr_slave_1: entered promiscuous mode [ 37.087868][ T4828] debugfs: 'hsr0' already exists in 'hsr' [ 37.087983][ T4828] Cannot create hsr debugfs directory [ 38.966954][ T4802] Bluetooth: hci0: command tx timeout [ 39.046780][ T1306] bridge_slave_1: left allmulticast mode [ 39.046821][ T1306] bridge_slave_1: left promiscuous mode [ 39.047173][ T1306] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.052048][ T1306] bridge_slave_0: left allmulticast mode [ 39.052073][ T1306] bridge_slave_0: left promiscuous mode [ 39.052214][ T1306] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.108106][ T1306] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 39.137941][ T1306] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 39.148603][ T1306] bond0 (unregistering): Released all slaves [ 39.230692][ T1306] hsr_slave_0: left promiscuous mode [ 39.231704][ T1306] hsr_slave_1: left promiscuous mode [ 39.231964][ T1306] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 39.231979][ T1306] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 39.232388][ T1306] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 39.232398][ T1306] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 39.236349][ T1306] veth1_macvtap: left promiscuous mode [ 39.236385][ T1306] veth0_macvtap: left promiscuous mode [ 39.236431][ T1306] veth1_vlan: left promiscuous mode [ 39.236467][ T1306] veth0_vlan: left promiscuous mode [ 39.328658][ T1306] team0 (unregistering): Port device team_slave_1 removed [ 39.332742][ T1306] team0 (unregistering): Port device team_slave_0 removed [ 39.380253][ T4401] 8021q: adding VLAN 0 to HW filter on device eth0 [ 39.663600][ T4828] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 39.667246][ T4828] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 39.669053][ T4828] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 39.671235][ T4828] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 39.672787][ T4828] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 39.674821][ T4828] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 39.676349][ T4828] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 39.681076][ T4828] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 39.706237][ T4828] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.712671][ T4828] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.715684][ T39] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.715726][ T39] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.725550][ T4828] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 39.725594][ T4828] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 39.732514][ T1848] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.732561][ T1848] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.073765][ T4828] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 40.084803][ T4828] veth0_vlan: entered promiscuous mode [ 40.088724][ T4828] veth1_vlan: entered promiscuous mode [ 40.094969][ T4828] veth0_macvtap: entered promiscuous mode [ 40.096022][ T4828] veth1_macvtap: entered promiscuous mode [ 40.099338][ T4828] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.100293][ T4828] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.102337][ T15] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.109890][ T15] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.110106][ T15] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.110125][ T15] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.140689][ T39] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.140719][ T39] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.213181][ T15] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.214476][ T15] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40. ** replaying previous printk message ** [ 40.319786][ T4925] ================================================================== [ 40.319800][ T4925] BUG: KASAN: slab-use-after-free in dvb_device_open+0xd0/0x254 [ 40.319822][ T4925] Read of size 8 at addr ffff0000cbc9be18 by task syz.0.19/4925 [ 40.319830][ T4925] [ 40.319834][ T4925] CPU: 0 UID: 0 PID: 4925 Comm: syz.0.19 Not tainted syzkaller #0 PREEMPT [ 40.319843][ T4925] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 [ 40.319848][ T4925] Call trace: [ 40.319851][ T4925] show_stack+0x2c/0x3c (C) [ 40.319866][ T4925] __dump_stack+0x30/0x40 [ 40.319878][ T4925] dump_stack_lvl+0xd8/0x12c [ 40.319887][ T4925] print_address_description+0xb0/0x238 [ 40.319896][ T4925] print_report+0x68/0x84 [ 40.319902][ T4925] kasan_report+0x8c/0xc4 [ 40.319912][ T4925] __asan_report_load8_noabort+0x20/0x2c [ 40.319922][ T4925] dvb_device_open+0xd0/0x254 [ 40.319931][ T4925] chrdev_open+0x398/0x3e8 [ 40.319940][ T4925] do_dentry_open+0x5c4/0xfc0 [ 40.319950][ T4925] vfs_open+0x44/0x2dc [ 40.319958][ T4925] path_openat+0x21fc/0x2a60 [ 40.319967][ T4925] do_file_open+0x1c8/0x2e8 [ 40.319974][ T4925] do_sys_openat2+0x114/0x1e8 [ 40.319983][ T4925] do_sys_open+0xb0/0xe0 [ 40.319992][ T4925] __arm64_sys_openat+0xa0/0xbc [ 40.320002][ T4925] invoke_syscall+0x98/0x244 [ 40.320011][ T4925] el0_svc_common+0xec/0x23c [ 40.320021][ T4925] do_el0_svc+0x4c/0x5c [ 40.320030][ T4925] el0_svc+0x64/0x260 [ 40.320039][ T4925] el0t_64_sync_handler+0x48/0x148 [ 40.320048][ T4925] el0t_64_sync+0x198/0x19c [ 40.320056][ T4925] [ 40.320057][ T4925] Allocated by task 1: [ 40.320061][ T4925] kasan_save_track+0x40/0x78 [ 40.320069][ T4925] kasan_save_alloc_info+0x44/0x54 [ 40.320076][ T4925] __kasan_kmalloc+0x9c/0xb4 [ 40.320083][ T4925] __kmalloc_cache_noprof+0x2e8/0x5ec [ 40.320090][ T4925] dvb_register_device+0x1a4/0x16e0 [ 40.320098][ T4925] dvb_register_frontend+0x474/0x6d0 [ 40.320105][ T4925] vidtv_bridge_probe+0x5a4/0xa58 [ 40.320113][ T4925] platform_probe+0x100/0x1a4 [ 40.320120][ T4925] really_probe+0x29c/0x800 [ 40.320127][ T4925] __driver_probe_device+0x1e0/0x350 [ 40.320134][ T4925] driver_probe_device+0x6c/0x19c [ 40.320146][ T4925] __driver_attach+0x168/0x384 [ 40.320154][ T4925] bus_for_each_dev+0x128/0x1b4 [ 40.320160][ T4925] driver_attach+0x50/0x60 [ 40.320167][ T4925] bus_add_driver+0x208/0x500 [ 40.320174][ T4925] driver_register+0x220/0x310 [ 40.320182][ T4925] __platform_driver_register+0x90/0xa4 [ 40.320190][ T4925] vidtv_bridge_init+0x4c/0x74 [ 40.320199][ T4925] do_one_initcall+0x274/0xc38 [ 40.320208][ T4925] do_initcall_level+0x12c/0x1c4 [ 40.320214][ T4925] do_initcalls+0x70/0xd0 [ 40.320219][ T4925] do_basic_setup+0x7c/0x90 [ 40.320225][ T4925] kernel_init_freeable+0x268/0x3a8 [ 40.320231][ T4925] kernel_init+0x24/0x1dc [ 40.320239][ T4925] ret_from_fork+0x10/0x20 [ 40.320244][ T4925] [ 40.320246][ T4925] Freed by task 4923: [ 40.320249][ T4925] kasan_save_track+0x40/0x78 [ 40.320256][ T4925] kasan_save_free_info+0x58/0x70 [ 40.320263][ T4925] __kasan_slab_free+0x74/0xa4 [ 40.320270][ T4925] kfree+0x188/0x690 [ 40.320276][ T4925] dvb_device_put+0x64/0xd0 [ 40.320284][ T4925] dvb_device_open+0x23c/0x254 [ 40.320292][ T4925] chrdev_open+0x398/0x3e8 [ 40.320298][ T4925] do_dentry_open+0x5c4/0xfc0 [ 40.320306][ T4925] vfs_open+0x44/0x2dc [ 40.320313][ T4925] path_openat+0x21fc/0x2a60 [ 40.320320][ T4925] do_file_open+0x1c8/0x2e8 [ 40.320326][ T4925] do_sys_openat2+0x114/0x1e8 [ 40.320333][ T4925] do_sys_open+0xb0/0xe0 [ 40.320341][ T4925] __arm64_sys_openat+0xa0/0xbc [ 40.320349][ T4925] invoke_syscall+0x98/0x244 [ 40.320357][ T4925] el0_svc_common+0xec/0x23c [ 40.320364][ T4925] do_el0_svc+0x4c/0x5c [ 40.320372][ T4925] el0_svc+0x64/0x260 [ 40.320378][ T4925] el0t_64_sync_handler+0x48/0x148 [ 40.320385][ T4925] el0t_64_sync+0x198/0x19c [ 40.320390][ T4925] [ 40.320392][ T4925] The buggy address belongs to the object at ffff0000cbc9be00 [ 40.320392][ T4925] which belongs to the cache kmalloc-256 of size 256 [ 40.320398][ T4925] The buggy address is located 24 bytes inside of [ 40.320398][ T4925] freed 256-byte region [ffff0000cbc9be00, ffff0000cbc9bf00) [ 40.320405][ T4925] [ 40.320406][ T4925] The buggy address belongs to the physical page: [ 40.320410][ T4925] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10bc9a [ 40.320417][ T4925] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 40.320423][ T4925] flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 40.320432][ T4925] page_type: f5(slab) [ 40.320438][ T4925] raw: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122 [ 40.320444][ T4925] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 40.320450][ T4925] head: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122 [ 40.320455][ T4925] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 40.320461][ T4925] head: 05ffc00000000001 fffffdffc32f2681 00000000ffffffff 00000000ffffffff [ 40.320466][ T4925] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 40.320469][ T4925] page dumped because: kasan: bad access detected [ 40.320472][ T4925] [ 40.320473][ T4925] Memory state around the buggy address: [ 40.320477][ T4925] ffff0000cbc9bd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.320481][ T4925] ffff0000cbc9bd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.320485][ T4925] >ffff0000cbc9be00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.320488][ T4925] ^ [ 40.320492][ T4925] ffff0000cbc9be80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.320496][ T4925] ffff0000cbc9bf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.320499][ T4925] ================================================================== [ 40.320517][ T4925] Disabling lock debugging due to kernel taint [ 40.320526][ T4925] ------------[ cut here ]------------ [ 40.320531][ T4925] refcount_t: addition on 0; use-after-free. [ 40.320635][ T4925] WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x134/0x1f8, CPU#0: syz.0.19/4925 [ 40.400189][ T4925] Modules linked in: [ 40.400767][ T4925] CPU: 0 UID: 0 PID: 4925 Comm: syz.0.19 Tainted: G B syzkaller #0 PREEMPT [ 40.402170][ T4925] Tainted: [B]=BAD_PAGE [ 40.402722][ T4925] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 [ 40.404070][ T4925] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 40.405230][ T4925] pc : refcount_warn_saturate+0x134/0x1f8 [ 40.406043][ T4925] lr : refcount_warn_saturate+0x134/0x1f8 [ 40.406881][ T4925] sp : ffff8000935f7640 [ 40.407510][ T4925] x29: ffff8000935f7640 x28: dfff800000000000 x27: 1fffe00019ff3921 [ 40.408621][ T4925] x26: dfff800000000000 x25: ffff7000126beedc x24: dfff800000000000 [ 40.409834][ T4925] x23: ffff80008742cca8 x22: ffff0000cb6d8000 x21: ffff0000cbc9be00 [ 40.410909][ T4925] x20: ffff0000cbc9be10 x19: ffff80008a116000 x18: 0000000000000000 [ 40.411980][ T4925] x17: 3d3d3d3d3d3d3d3d x16: 3d3d3d3d3d3d3d3d x15: 3d3d3d3d3d3d3d3d [ 40.413096][ T4925] x14: 3d3d3d3d3d3d3d3d x13: 0000000000000001 x12: 0000000000000000 [ 40.414190][ T4925] x11: 0000000000000000 x10: 0000000000000002 x9 : 42d099054a6bd700 [ 40.415277][ T4925] x8 : 42d099054a6bd700 x7 : 0000000000000000 x6 : ffff80008048ce60 [ 40.416457][ T4925] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f7010 [ 40.417534][ T4925] x2 : 0000000100000000 x1 : ffff0000cca257c0 x0 : 0000000000000000 [ 40.418627][ T4925] Call trace: [ 40.419055][ T4925] refcount_warn_saturate+0x134/0x1f8 (P) [ 40.419833][ T4925] dvb_device_get+0x9c/0xc0 [ 40.420445][ T4925] dvb_device_open+0x100/0x254 [ 40.421054][ T4925] chrdev_open+0x398/0x3e8 [ 40.421655][ T4925] do_dentry_open+0x5c4/0xfc0 [ 40.422274][ T4925] vfs_open+0x44/0x2dc [ 40.422834][ T4925] path_openat+0x21fc/0x2a60 [ 40.423512][ T4925] do_file_open+0x1c8/0x2e8 [ 40.424152][ T4925] do_sys_openat2+0x114/0x1e8 [ 40.424827][ T4925] do_sys_open+0xb0/0xe0 [ 40.425390][ T4925] __arm64_sys_openat+0xa0/0xbc [ 40.426089][ T4925] invoke_syscall+0x98/0x244 [ 40.426714][ T4925] el0_svc_common+0xec/0x23c [ 40.427420][ T4925] do_el0_svc+0x4c/0x5c [ 40.428059][ T4925] el0_svc+0x64/0x260 [ 40.428604][ T4925] el0t_64_sync_handler+0x48/0x148 [ 40.429273][ T4925] el0t_64_sync+0x198/0x19c [ 40.429878][ T4925] irq event stamp: 10801 [ 40.430465][ T4925] hardirqs last enabled at (10801): [] arm64_exit_to_kernel_mode+0x80/0x94 [ 40.431893][ T4925] hardirqs last disabled at (10800): [] el1_interrupt+0x28/0x60 [ 40.433237][ T4925] softirqs last enabled at (10774): [] do_sve_acc+0x32c/0x4b8 [ 40.434438][ T4925] softirqs last disabled at (10772): [] do_sve_acc+0x10c/0x4b8 [ 40.435717][ T4925] ---[ end trace 0000000000000000 ]--- [ ** replaying previous printk message ** [ 40.441480][ T4925] ------------[ cut here ]------------ [ 40.441512][ T4925] refcount_t: underflow; use-after-free. [ 40.441639][ T4925] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x154/0x1f8, CPU#0: syz.0.19/4925 [ 40.445026][ T4925] Modules linked in: [ 40.445551][ T4925] CPU: 0 UID: 0 PID: 4925 Comm: syz.0.19 Tainted: G B W syzkaller #0 PREEMPT [ 40.447078][ T4925] Tainted: [B]=BAD_PAGE, [W]=WARN [ 40.447730][ T4925] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 [ 40.449049][ T4925] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 40.450106][ T4925] pc : refcount_warn_saturate+0x154/0x1f8 [ 40.450977][ T4925] lr : refcount_warn_saturate+0x154/0x1f8 [ 40.451847][ T4925] sp : ffff8000935f7540 [ 40.452468][ T4925] x29: ffff8000935f7540 x28: ffff0000cff9c8c0 x27: ffff0000cb380010 [ 40.453506][ T4925] x26: dfff800000000000 x25: 1fffe000197937c7 x24: ffff0000cb380060 [ 40.454610][ T4925] x23: 00000000fffffffc x22: ffff0000cbc9be3c x21: 00000000c0000000 [ 40.455720][ T4925] x20: ffff0000cbc9be10 x19: ffff80008a116000 x18: 0000000000000000 [ 40.456876][ T4925] x17: 3d3d3d3d3d3d3d3d x16: 3d3d3d3d3d3d3d3d x15: 3d3d3d3d3d3d3d3d [ 40.457950][ T4925] x14: 3d3d3d3d3d3d3d3d x13: 0000000000000001 x12: 0000000000000000 [ 40.459075][ T4925] x11: 0000000000000000 x10: 0000000000000002 x9 : 42d099054a6bd700 [ 40.460162][ T4925] x8 : 42d099054a6bd700 x7 : 0000000000000000 x6 : ffff80008048ce60 [ 40.461331][ T4925] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f7010 [ 40.462395][ T4925] x2 : 0000000100000000 x1 : ffff0000cca257c0 x0 : 0000000000000000 [ 40.463485][ T4925] Call trace: [ 40.463960][ T4925] refcount_warn_saturate+0x154/0x1f8 (P) [ 40.464727][ T4925] dvb_device_put+0xac/0xd0 [ 40.465413][ T4925] dvb_generic_release+0xec/0x158 [ 40.466086][ T4925] dvb_frontend_open+0x9cc/0x10a8 [ 40.466774][ T4925] dvb_device_open+0x1f8/0x254 [ 40.467421][ T4925] chrdev_open+0x398/0x3e8 [ 40.468101][ T4925] do_dentry_open+0x5c4/0xfc0 [ 40.468714][ T4925] vfs_open+0x44/0x2dc [ 40.469266][ T4925] path_openat+0x21fc/0x2a60 [ 40.469903][ T4925] do_file_open+0x1c8/0x2e8 [ 40.470500][ T4925] do_sys_openat2+0x114/0x1e8 [ 40.471123][ T4925] do_sys_open+0xb0/0xe0 [ 40.471713][ T4925] __arm64_sys_openat+0xa0/0xbc [ 40.472372][ T4925] invoke_syscall+0x98/0x244 [ 40.473012][ T4925] el0_svc_common+0xec/0x23c [ 40.473646][ T4925] do_el0_svc+0x4c/0x5c [ 40.474224][ T4925] el0_svc+0x64/0x260 [ 40.474815][ T4925] el0t_64_sync_handler+0x48/0x148 [ 40.475556][ T4925] el0t_64_sync+0x198/0x19c [ 40.476214][ T4925] irq event stamp: 10801 [ 40.476834][ T4925] hardirqs last enabled at (10801): [] arm64_exit_to_kernel_mode+0x80/0x94 [ 40.478199][ T4925] hardirqs last disabled at (10800): [] el1_interrupt+0x28/0x60 [ 40.479433][ T4925] softirqs last enabled at (10774): [] do_sve_acc+0x32c/0x4b8 [ 40.480668][ T4925] softirqs last disabled at (10772): [] do_sve_acc+0x10c/0x4b8 [ 40.481920][ T4925] ---[ end trace 0000000000000000 ]--- [ 40.507371][ T4927] ------------[ cut here ]------------ [ 40.507390][ T4927] refcount_t: saturated; leaking memory. [ 40.509461][ T4927] WARNING: lib/refcount.c:22 at refcount_warn_saturate+0x1b4/0x1f8, CPU#1: syz.0.20/4927 [ 40.510784][ T4927] Modules linked in: [ 40.511375][ T4927] CPU: 1 UID: 0 PID: 4927 Comm: syz.0.20 Tainted: G B W syzkaller #0 PREEMPT [ 40.512810][ T4927] Tainted: [B]=BAD_PAGE, [W]=WARN [ 40.513506][ T4927] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 [ 40.514956][ T4927] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 40.516021][ T4927] pc : refcount_warn_saturate+0x1b4/0x1f8 [ 40.516888][ T4927] lr : refcount_warn_saturate+0x1b4/0x1f8 [ 40.517674][ T4927] sp : ffff8000935f7640 [ 40.518250][ T4927] x29: ffff8000935f7640 x28: dfff800000000000 x27: 1fffe00019a9f879 [ 40.519327][ T4927] x26: dfff800000000000 x25: ffff7000126beedc x24: dfff800000000000 [ 40.520464][ T4927] x23: ffff80008742cca8 x22: ffff0000cb6d8000 x21: 000000007ffffffe [ 40.521526][ T4927] x20: ffff0000cbc9be10 x19: ffff80008a116000 x18: 1fffe00035bd2e28 [ 40.522704][ T4927] x17: 0000000000000003 x16: ffff800088ac7000 x15: 0000000000000000 [ 40.523993][ T4927] x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000000 [ 40.525151][ T4927] x11: ffff800080156ee8 x10: 0000000000000003 x9 : 1e0180e8590afe00 [ 40.526305][ T4927] x8 : 1e0180e8590afe00 x7 : 0000000000000000 x6 : ffff8000803b7898 [ 40.527414][ T4927] x5 : 0000000000000000 x4 : 0000000000000008 x3 : ffff800080156f90 [ 40.528477][ T4927] x2 : 0000000000000000 x1 : ffff0000cf5a57c0 x0 : 0000000000000001 [ 40.529543][ T4927] Call trace: [ 40.529967][ T4927] refcount_warn_saturate+0x1b4/0x1f8 (P) [ 40.530779][ T4927] dvb_device_get+0x9c/0xc0 [ 40.531376][ T4927] dvb_device_open+0x100/0x254 [ 40.532003][ T4927] chrdev_open+0x398/0x3e8 [ 40.532553][ T4927] do_dentry_open+0x5c4/0xfc0 [ 40.533200][ T4927] vfs_open+0x44/0x2dc [ 40.533778][ T4927] path_openat+0x21fc/0x2a60 [ 40.534422][ T4927] do_file_open+0x1c8/0x2e8 [ 40.535090][ T4927] do_sys_openat2+0x114/0x1e8 [ 40.535740][ T4927] do_sys_open+0xb0/0xe0 [ 40.536331][ T4927] __arm64_sys_openat+0xa0/0xbc [ 40.537059][ T4927] invoke_syscall+0x98/0x244 [ 40.537681][ T4927] el0_svc_common+0xec/0x23c [ 40.538323][ T4927] do_el0_svc+0x4c/0x5c [ 40.538901][ T4927] el0_svc+0x64/0x260 [ 40.539448][ T4927] el0t_64_sync_handler+0x48/0x148 [ 40.540129][ T4927] el0t_64_sync+0x198/0x19c [ 40.540771][ T4927] irq event stamp: 0 [ 40.541291][ T4927] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 40.542272][ T4927] hardirqs last disabled at (0): [] copy_process+0x1384/0x3320 [ 40.543621][ T4927] softirqs last enabled at (0): [] copy_process+0x13a4/0x3320 [ 40.544877][ T4927] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 40.545795][ T4927] ---[ end trace 0000000000000000 ]--- [ 41.046689][ T4802] Bluetooth: hci0: command tx timeout 1970/01/01 00:00:41 executed programs: 81 [ 43.126642][ T4802] Bluetooth: hci0: command tx timeout [ 45.206738][ T4802] Bluetooth: hci0: command tx timeout 1970/01/01 00:00:46 executed programs: 366