[ 8.484636][ T4403] 8021q: adding VLAN 0 to HW filter on device bond0 [ 8.488053][ T4403] eql: remember to turn off Van-Jacobson compression on your slave devices Starting crond: [ 8.518666][ T12] gve 0000:00:00.0 enp0s0: Device link is up. OK Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.52' (ED25519) to the list of known hosts. 1970/01/01 00:00:30 parsed 1 programs 1970/01/01 00:00:30 serving rpc on tcp://45925 syzkaller login: [ 31.146123][ T4726] cgroup: Unknown subsys name 'net' [ 31.266220][ T4726] cgroup: Unknown subsys name 'cpuset' [ 31.268342][ T4726] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 31.473009][ T4726] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 37.627675][ T4734] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 38.149760][ T4765] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 38.154283][ T4765] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 38.156051][ T4765] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 38.160368][ T4765] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 38.162439][ T4765] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 38.408933][ T4771] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.409286][ T4771] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.409353][ T4771] bridge_slave_0: entered allmulticast mode [ 38.409820][ T4771] bridge_slave_0: entered promiscuous mode [ 38.411237][ T4771] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.411293][ T4771] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.411374][ T4771] bridge_slave_1: entered allmulticast mode [ 38.411771][ T4771] bridge_slave_1: entered promiscuous mode [ 38.419441][ T4771] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.420463][ T4771] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.438190][ T4771] team0: Port device team_slave_0 added [ 38.438893][ T4771] team0: Port device team_slave_1 added [ 38.451140][ T4771] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.452499][ T4771] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.454702][ T4771] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.455546][ T4771] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.455555][ T4771] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.455571][ T4771] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.466074][ T4771] hsr_slave_0: entered promiscuous mode [ 38.466383][ T4771] hsr_slave_1: entered promiscuous mode [ 38.516888][ T4771] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 38.520221][ T4771] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 38.521964][ T4771] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 38.524159][ T4771] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 38.526098][ T4771] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 38.528186][ T4771] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 38.529815][ T4771] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 38.532207][ T4771] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 38.541667][ T4771] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.541730][ T4771] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.541890][ T4771] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.541919][ T4771] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.559948][ T4771] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.564744][ T40] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.566399][ T40] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.570772][ T4771] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.573277][ T1384] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.573325][ T1384] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.577261][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.577304][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.679171][ T4771] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.693677][ T4771] veth0_vlan: entered promiscuous mode [ 38.697383][ T4771] veth1_vlan: entered promiscuous mode [ 38.705218][ T4771] veth0_macvtap: entered promiscuous mode [ 38.706411][ T4771] veth1_macvtap: entered promiscuous mode [ 38.710950][ T4771] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 38.712145][ T4771] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 38.714323][ T1384] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.715154][ T1384] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.715178][ T1384] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.715195][ T1384] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.819453][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 38.918287][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 38.971647][ T1384] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 38.971683][ T1384] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 38.980883][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 38.989968][ T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 38.989994][ T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.080257][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 1970/01/01 00:00:39 executed programs: 0 [ 39.486338][ T4765] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 39.486705][ T4765] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 39.486871][ T4765] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 39.487554][ T4765] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 39.487754][ T4765] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 39.622801][ T4835] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.623524][ T4835] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.623644][ T4835] bridge_slave_0: entered allmulticast mode [ 39.624110][ T4835] bridge_slave_0: entered promiscuous mode [ 39.626569][ T4835] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.626590][ T4835] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.626643][ T4835] bridge_slave_1: entered allmulticast mode [ 39.627070][ T4835] bridge_slave_1: entered promiscuous mode [ 39.635796][ T4835] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 39.636872][ T4835] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 39.643198][ T4835] team0: Port device team_slave_0 added [ 39.644332][ T4835] team0: Port device team_slave_1 added [ 39.652363][ T4835] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 39.652390][ T4835] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.652423][ T4835] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 39.652948][ T4835] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 39.652962][ T4835] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.652983][ T4835] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 39.663774][ T4835] hsr_slave_0: entered promiscuous mode [ 39.664092][ T4835] hsr_slave_1: entered promiscuous mode [ 39.664317][ T4835] debugfs: 'hsr0' already exists in 'hsr' [ 39.664368][ T4835] Cannot create hsr debugfs directory [ 41.535219][ T4739] Bluetooth: hci0: command tx timeout [ 42.167862][ T12] bridge_slave_1: left allmulticast mode [ 42.167902][ T12] bridge_slave_1: left promiscuous mode [ 42.168231][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.174000][ T12] bridge_slave_0: left allmulticast mode [ 42.175720][ T12] bridge_slave_0: left promiscuous mode [ 42.176867][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.235985][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 42.252873][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 42.265658][ T12] bond0 (unregistering): Released all slaves [ 42.285195][ T4403] 8021q: adding VLAN 0 to HW filter on device eth0 [ 42.324402][ T12] hsr_slave_0: left promiscuous mode [ 42.326068][ T12] hsr_slave_1: left promiscuous mode [ 42.327361][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 42.328777][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 42.330587][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 42.332033][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 42.338979][ T12] veth1_macvtap: left promiscuous mode [ 42.340071][ T12] veth0_macvtap: left promiscuous mode [ 42.341321][ T12] veth1_vlan: left promiscuous mode [ 42.342356][ T12] veth0_vlan: left promiscuous mode [ 42.444288][ T12] team0 (unregistering): Port device team_slave_1 removed [ 42.448336][ T12] team0 (unregistering): Port device team_slave_0 removed [ 42.495389][ T4403] 8021q: adding VLAN 0 to HW filter on device eth1 [ 42.807744][ T4835] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 42.810625][ T4835] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 42.812416][ T4835] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 42.819331][ T4835] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 42.825457][ T4835] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 42.830640][ T4835] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 42.832596][ T4835] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 42.837159][ T4835] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 42.861402][ T4835] 8021q: adding VLAN 0 to HW filter on device bond0 [ 42.868149][ T4835] 8021q: adding VLAN 0 to HW filter on device team0 [ 42.873140][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.873190][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.006844][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.006887][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.107286][ T4835] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 43.117892][ T4835] veth0_vlan: entered promiscuous mode [ 43.119681][ T4835] veth1_vlan: entered promiscuous mode [ 43.126698][ T4835] veth0_macvtap: entered promiscuous mode [ 43.127839][ T4835] veth1_macvtap: entered promiscuous mode [ 43.131896][ T4835] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 43.133790][ T4835] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 43.170615][ T3649] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 43.170644][ T3649] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 43.179201][ T781] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 43.179228][ T781] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 43.185074][ T781] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.185113][ T781] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.185137][ T781] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.185157][ T781] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.445242][ T1491] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 43.614864][ T1491] usb 1-1: Using ep0 maxpacket: 32 [ 43.614968][ T4739] Bluetooth: hci0: command tx timeout [ 43.617110][ T4951] dummy_hcd dummy_hcd.0: remove, state 1 [ 43.617157][ T4951] usb usb1: USB disconnect, device number 1 [ 45.694693][ T4739] Bluetooth: hci0: command tx timeout [ 47.774964][ T4739] Bluetooth: hci0: command tx timeout [ 48.655655][ T1491] usb 1-1: unable to get BOS descriptor or descriptor too short [ 48.660019][ T4951] dummy_hcd dummy_hcd.0: stopped [ 48.660059][ T4951] dummy_hcd dummy_hcd.0: USB bus 1 deregistered [ 48.663727][ T4951] Unable to handle kernel paging request at virtual address dfff800000000000 [ 48.663742][ T4951] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 48.663749][ T4951] Mem abort info: [ 48.663753][ T4951] ESR = 0x0000000096000005 [ 48.663758][ T4951] EC = 0x25: DABT (current EL), IL = 32 bits [ 48.663764][ T4951] SET = 0, FnV = 0 [ 48.663768][ T4951] EA = 0, S1PTW = 0 [ 48.663771][ T4951] FSC = 0x05: level 1 translation fault [ 48.663775][ T4951] Data abort info: [ 48.663777][ T4951] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 48.663781][ T4951] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 48.663785][ T4951] GCS = 0, Overlay = 0, DirtyBit = 0 [ 48.663789][ T4951] [dfff800000000000] address between user and kernel address ranges [ 48.663841][ T4951] Internal error: Oops: 0000000096000005 [#1] SMP [ 48.678969][ T4951] Modules linked in: [ 48.679694][ T4951] CPU: 1 UID: 0 PID: 4951 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT [ 48.681225][ T4951] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 48.683015][ T4951] pstate: 834000c5 (Nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 48.684394][ T4951] pc : set_link_state+0x38/0xcec [ 48.685304][ T4951] lr : set_link_state+0x34/0xcec [ 48.686195][ T4951] sp : ffff800094777480 [ 48.686959][ T4951] x29: ffff8000947774a0 x28: dfff800000000000 x27: 0000000000008002 [ 48.688390][ T4951] x26: 1fffe000195b0989 x25: dfff800000000000 x24: dfff800000000000 [ 48.689773][ T4951] x23: 0000000000000000 x22: 0000000000000000 x21: ffff0000cad8529a [ 48.691215][ T4951] x20: 0000000000000000 x19: 0000000000000000 x18: 00000000ffffffff [ 48.692642][ T4951] x17: ffff800080374940 x16: ffff800080ca4590 x15: ffff80008030624c [ 48.694087][ T4951] x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000004 [ 48.695528][ T4951] x11: ffff7000128eee84 x10: ffff7000128eee84 x9 : 0000000000000000 [ 48.696945][ T4951] x8 : 0000000000000000 x7 : ffff8000835b2ff4 x6 : 0000000000000000 [ 48.698416][ T4951] x5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff8000835b3004 [ 48.699844][ T4951] x2 : 0000000000000000 x1 : ffff0000c5238000 x0 : 0000000000000000 [ 48.701319][ T4951] Call trace: [ 48.701920][ T4951] set_link_state+0x38/0xcec (P) [ 48.702804][ T4951] dummy_pullup+0xd8/0x12c [ 48.703562][ T4951] usb_gadget_disconnect_locked+0xf8/0x60c [ 48.704630][ T4951] gadget_unbind_driver+0xa0/0x790 [ 48.705512][ T4951] device_remove+0xc4/0x134 [ 48.706285][ T4951] device_release_driver_internal+0x124/0x20c [ 48.707378][ T4951] driver_detach+0x124/0x1b4 [ 48.708224][ T4951] bus_remove_driver+0x124/0x22c [ 48.709128][ T4951] driver_unregister+0x78/0xac [ 48.710006][ T4951] usb_gadget_unregister_driver+0x50/0x78 [ 48.711064][ T4951] raw_release+0xc4/0x290 [ 48.711872][ T4951] __fput+0x338/0x74c [ 48.712559][ T4951] ____fput+0x20/0x30 [ 48.713242][ T4951] task_work_run+0x1cc/0x25c [ 48.714042][ T4951] do_exit+0x58c/0x1a74 [ 48.714786][ T4951] do_group_exit+0x198/0x238 [ 48.715607][ T4951] get_signal+0xfb0/0x1094 [ 48.716375][ T4951] arch_do_signal_or_restart+0x288/0x444c [ 48.717386][ T4951] exit_to_user_mode_loop+0x70/0x17c [ 48.718347][ T4951] el0_svc+0x18c/0x260 [ 48.719053][ T4951] el0t_64_sync_handler+0x44/0x104 [ 48.719951][ T4951] el0t_64_sync+0x198/0x19c [ 48.720751][ T4951] Code: aa0003f4 f2fbfff9 9742853d d343fe88 (38796908) [ 48.721967][ T4951] ---[ end trace 0000000000000000 ]--- [ 48.951050][ T4951] Kernel panic - not syncing: Oops: Fatal exception [ 48.952449][ T4951] SMP: stopping secondary CPUs [ 48.953341][ T4951] Kernel Offset: disabled [ 48.954114][ T4951] CPU features: 0x14000000,003c0008,27020a02,a84ff6a7 [ 48.955485][ T4951] Memory Limit: none [ 49.164225][ T4951] Rebooting in 86400 seconds..