Warning: Permanently added '10.128.0.39' (ED25519) to the list of known hosts. 1970/01/01 00:00:23 parsed 1 programs 1970/01/01 00:00:23 serving rpc on tcp://39769 [ 24.674785][ T4725] cgroup: Unknown subsys name 'net' [ 24.805288][ T4725] cgroup: Unknown subsys name 'cpuset' [ 24.806610][ T4725] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 24.977441][ T4725] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 26.856125][ T4731] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 27.292812][ T4748] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.293074][ T4748] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.293137][ T4748] bridge_slave_0: entered allmulticast mode [ 27.294054][ T4748] bridge_slave_0: entered promiscuous mode [ 27.295229][ T4748] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.295274][ T4748] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.295320][ T4748] bridge_slave_1: entered allmulticast mode [ 27.295699][ T4748] bridge_slave_1: entered promiscuous mode [ 27.302212][ T4748] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 27.303006][ T4748] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 27.309193][ T4748] team0: Port device team_slave_0 added [ 27.309836][ T4748] team0: Port device team_slave_1 added [ 27.317003][ T4748] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 27.317012][ T4748] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 27.317026][ T4748] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 27.317686][ T4748] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 27.317694][ T4748] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 27.317707][ T4748] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 27.327279][ T4748] hsr_slave_0: entered promiscuous mode [ 27.327578][ T4748] hsr_slave_1: entered promiscuous mode [ 27.368920][ T4748] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 27.370912][ T4748] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 27.371473][ T4748] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 27.372365][ T4748] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 27.372711][ T4748] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 27.373869][ T4748] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 27.374161][ T4748] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 27.375566][ T4748] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 27.384985][ T4748] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.385025][ T4748] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.385173][ T4748] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.385201][ T4748] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.399759][ T4748] 8021q: adding VLAN 0 to HW filter on device bond0 [ 27.405209][ T1732] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.405693][ T1732] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.408356][ T4748] 8021q: adding VLAN 0 to HW filter on device team0 [ 27.410400][ T1732] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.410484][ T1732] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.412544][ T1368] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.412566][ T1368] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.420647][ T4748] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 27.420659][ T4748] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 27.510234][ T4748] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 27.520527][ T4748] veth0_vlan: entered promiscuous mode [ 27.525277][ T4748] veth1_vlan: entered promiscuous mode [ 27.532476][ T4748] veth0_macvtap: entered promiscuous mode [ 27.535296][ T4748] veth1_macvtap: entered promiscuous mode [ 27.539810][ T4748] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 27.540910][ T4748] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 27.563460][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.583586][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.583740][ T1758] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.583767][ T1758] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.638597][ T1758] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 27.695982][ T1758] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 27.758439][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 27.758453][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 27.769742][ T1732] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 27.769753][ T1732] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 27.779053][ T1758] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 27.838279][ T1758] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 28.252040][ T4815] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 28.252453][ T4815] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 28.252626][ T4815] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 28.252905][ T4815] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 28.253111][ T4815] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 1970/01/01 00:00:28 executed programs: 0 [ 28.540016][ T4736] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 28.540345][ T4736] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 28.540508][ T4736] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 28.540815][ T4736] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 28.541212][ T4736] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 28.672886][ T4826] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.672951][ T4826] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.673016][ T4826] bridge_slave_0: entered allmulticast mode [ 28.673930][ T4826] bridge_slave_0: entered promiscuous mode [ 28.675065][ T4826] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.675116][ T4826] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.675176][ T4826] bridge_slave_1: entered allmulticast mode [ 28.675574][ T4826] bridge_slave_1: entered promiscuous mode [ 28.682901][ T4826] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 28.684184][ T4826] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 28.690265][ T4826] team0: Port device team_slave_0 added [ 28.690997][ T4826] team0: Port device team_slave_1 added [ 28.697866][ T4826] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 28.697874][ T4826] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 28.697886][ T4826] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 28.698390][ T4826] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 28.698397][ T4826] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 28.698411][ T4826] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 28.708503][ T4826] hsr_slave_0: entered promiscuous mode [ 28.708812][ T4826] hsr_slave_1: entered promiscuous mode [ 28.709015][ T4826] debugfs: 'hsr0' already exists in 'hsr' [ 28.709060][ T4826] Cannot create hsr debugfs directory [ 30.573775][ T4815] Bluetooth: hci0: command tx timeout [ 30.904496][ T1758] bridge_slave_1: left allmulticast mode [ 30.904527][ T1758] bridge_slave_1: left promiscuous mode [ 30.904758][ T1758] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.906776][ T1758] bridge_slave_0: left allmulticast mode [ 30.906789][ T1758] bridge_slave_0: left promiscuous mode [ 30.906850][ T1758] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.962679][ T1758] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 31.004500][ T1758] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 31.024152][ T1758] bond0 (unregistering): Released all slaves [ 31.074088][ T1758] hsr_slave_0: left promiscuous mode [ 31.074374][ T1758] hsr_slave_1: left promiscuous mode [ 31.074653][ T1758] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 31.074666][ T1758] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 31.075298][ T1758] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 31.075308][ T1758] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 31.078836][ T1758] veth1_macvtap: left promiscuous mode [ 31.078866][ T1758] veth0_macvtap: left promiscuous mode [ 31.078933][ T1758] veth1_vlan: left promiscuous mode [ 31.078973][ T1758] veth0_vlan: left promiscuous mode [ 31.173115][ T1758] team0 (unregistering): Port device team_slave_1 removed [ 31.178412][ T1758] team0 (unregistering): Port device team_slave_0 removed [ 31.221520][ T4403] 8021q: adding VLAN 0 to HW filter on device eth0 [ 31.430806][ T4826] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 31.432127][ T4826] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 31.432550][ T4826] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 31.435519][ T4826] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 31.435913][ T4826] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 31.438149][ T4826] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 31.438466][ T4826] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 31.440601][ T4826] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.479081][ T4826] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.483117][ T4826] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.658121][ T726] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.658154][ T726] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.667806][ T1732] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.667830][ T1732] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.672226][ T4826] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 31.672239][ T4826] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 31.788708][ T4826] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.819517][ T4826] veth0_vlan: entered promiscuous mode [ 31.821670][ T4826] veth1_vlan: entered promiscuous mode [ 31.830876][ T4826] veth0_macvtap: entered promiscuous mode [ 31.832211][ T4826] veth1_macvtap: entered promiscuous mode [ 31.835468][ T4826] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.837736][ T4826] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.863106][ T726] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.863118][ T726] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.866025][ T726] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.866121][ T726] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.866139][ T726] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.870419][ T726] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.870430][ T726] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.915281][ T4915] syz.0.17 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 31.915303][ T4915] CPU: 0 UID: 0 PID: 4915 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT [ 31.915315][ T4915] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 31.915320][ T4915] Call trace: [ 31.915323][ T4915] show_stack+0x2c/0x3c (C) [ 31.915342][ T4915] __dump_stack+0x30/0x40 [ 31.915355][ T4915] dump_stack_lvl+0xd8/0x12c [ 31.915365][ T4915] dump_stack+0x1c/0x28 [ 31.915374][ T4915] dump_header+0xbc/0x3f0 [ 31.915386][ T4915] oom_kill_process+0x248/0x864 [ 31.915396][ T4915] out_of_memory+0xd24/0x1064 [ 31.915402][ T4915] mem_cgroup_out_of_memory+0xe8/0x170 [ 31.915411][ T4915] try_charge_memcg+0x9bc/0xd38 [ 31.915423][ T4915] obj_cgroup_charge_pages+0x44/0xc8 [ 31.915432][ T4915] __memcg_slab_post_alloc_hook+0x498/0x824 [ 31.915442][ T4915] kmem_cache_alloc_lru_noprof+0x32c/0x5d8 [ 31.915450][ T4915] alloc_inode+0x84/0x198 [ 31.915460][ T4915] new_inode+0x20/0x50 [ 31.915468][ T4915] gadgetfs_make_inode+0x34/0x18c [ 31.915481][ T4915] gadgetfs_create_file+0x48/0xd8 [ 31.915490][ T4915] gadgetfs_bind+0x3f8/0x75c [ 31.915499][ T4915] gadget_bind_driver+0x274/0x834 [ 31.915508][ T4915] really_probe+0x29c/0x800 [ 31.915516][ T4915] __driver_probe_device+0x1e0/0x350 [ 31.915527][ T4915] driver_probe_device+0x6c/0x19c [ 31.915534][ T4915] __driver_attach+0x168/0x384 [ 31.915544][ T4915] bus_for_each_dev+0x128/0x1b4 [ 31.915553][ T4915] driver_attach+0x50/0x60 [ 31.915563][ T4915] bus_add_driver+0x208/0x500 [ 31.915572][ T4915] driver_register+0x220/0x310 [ 31.915579][ T4915] usb_gadget_register_driver_owner+0xf0/0x25c [ 31.915587][ T4915] dev_config+0x91c/0xcc0 [ 31.915596][ T4915] vfs_write+0x2a4/0xa0c [ 31.915606][ T4915] ksys_write+0x12c/0x228 [ 31.915616][ T4915] __arm64_sys_write+0x84/0x98 [ 31.915626][ T4915] invoke_syscall+0x98/0x244 [ 31.915636][ T4915] el0_svc_common+0xec/0x23c [ 31.915645][ T4915] do_el0_svc+0x4c/0x5c [ 31.915654][ T4915] el0_svc+0x60/0x1d8 [ 31.915665][ T4915] el0t_64_sync_handler+0x44/0x104 [ 31.915673][ T4915] el0t_64_sync+0x198/0x19c [ 31.916550][ T4915] memory: usage 0kB, limit 0kB, failcnt 19 [ 31.916572][ T4915] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 31.916583][ T4915] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 31.916589][ T4915] Memory cgroup stats for /syz0/test: [ 31.916676][ T4915] cache 0 [ 31.916681][ T4915] rss 0 [ 31.916684][ T4915] rss_huge 0 [ 31.916687][ T4915] shmem 0 [ 31.916689][ T4915] mapped_file 0 [ 31.916692][ T4915] dirty 0 [ 31.916695][ T4915] writeback 0 [ 31.916698][ T4915] workingset_refault_anon 0 [ 31.916701][ T4915] workingset_refault_file 0 [ 31.916705][ T4915] swap 0 [ 31.916707][ T4915] swapcached 0 [ 31.916710][ T4915] pgpgin 0 [ 31.916713][ T4915] pgpgout 0 [ 31.916716][ T4915] pgfault 0 [ 31.916719][ T4915] pgmajfault 0 [ 31.916722][ T4915] inactive_anon 0 [ 31.916725][ T4915] active_anon 0 [ 31.916728][ T4915] inactive_file 0 [ 31.916731][ T4915] active_file 0 [ 31.916734][ T4915] unevictable 0 [ 31.916736][ T4915] hierarchical_memory_limit 0 [ 31.916740][ T4915] hierarchical_memsw_limit 9223372036854771712 [ 31.916743][ T4915] total_cache 0 [ 31.916746][ T4915] total_rss 0 [ 31.916749][ T4915] total_rss_huge 0 [ 31.916752][ T4915] total_shmem 0 [ 31.916755][ T4915] total_mapped_file 0 [ 31.916758][ T4915] total_dirty 0 [ 31.916761][ T4915] total_writeback 0 [ 31.916764][ T4915] total_workingset_refault_anon 0 [ 31.916767][ T4915] total_workingset_refault_file 0 [ 31.916770][ T4915] total_swap 0 [ 31.916773][ T4915] total_swapcached 0 [ 31.916776][ T4915] total_pgpgin 0 [ 31.916779][ T4915] total_pgpgout 0 [ 31.916782][ T4915] total_pgfault 0 [ 31.916785][ T4915] total_pgmajfault 0 [ 31.916788][ T4915] total_inactive_anon 0 [ 31.916791][ T4915] total_active_anon 0 [ 31.916794][ T4915] total_inactive_file 0 [ 31.916797][ T4915] total_active_file 0 [ 31.916800][ T4915] total_unevictable 0 [ 31.916803][ T4915] anon_cost 0 [ 31.916806][ T4915] file_cost 0 [ 31.916809][ T4915] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0,oom_memcg=/syz0/test,task_memcg=/syz0/test,task=syz.0.17,pid=4915,uid=0 [ 31.916899][ T4915] Memory cgroup out of memory: Killed process 4915 (syz.0.17) total-vm:44808kB, anon-rss:1296kB, file-rss:976kB, shmem-rss:0kB, UID:0 pgtables:76kB oom_score_adj:1000 [ 31.920270][ T4915] udc dummy_udc.0: failed to start USB Gadget filesystem: -12 [ 31.920285][ T4915] gadgetfs gadget.0: probe with driver gadgetfs failed with error -12 [ 31.920524][ T4915] gadgetfs expected dummy_udc controller not usbip-vudc [ 31.920532][ T4915] udc usbip-vudc.0: failed to start USB Gadget filesystem: -19 [ 31.922296][ T4915] UDC core: USB Gadget filesystem: couldn't find an available UDC [ 31.960465][ T4916] ================================================================== [ 31.960474][ T4916] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irq+0x58/0x70 [ 31.960495][ T4916] Read of size 1 at addr ffff0000cd20c018 by task syz.0.18/4916 [ 31.960502][ T4916] [ 31.960506][ T4916] CPU: 0 UID: 0 PID: 4916 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT [ 31.960515][ T4916] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 31.960519][ T4916] Call trace: [ 31.960521][ T4916] show_stack+0x2c/0x3c (C) [ 31.960533][ T4916] __dump_stack+0x30/0x40 [ 31.960543][ T4916] dump_stack_lvl+0xd8/0x12c [ 31.960552][ T4916] print_address_description+0xb0/0x238 [ 31.960559][ T4916] print_report+0x68/0x84 [ 31.960566][ T4916] kasan_report+0x8c/0xc4 [ 31.960574][ T4916] __kasan_check_byte+0x3c/0x54 [ 31.960581][ T4916] lock_acquire+0xa4/0x320 [ 31.960589][ T4916] _raw_spin_lock_irq+0x58/0x70 [ 31.960598][ T4916] gadget_dev_open+0x50/0x1c4 [ 31.960607][ T4916] do_dentry_open+0x5c4/0xfbc [ 31.960616][ T4916] vfs_open+0x44/0x2dc [ 31.960625][ T4916] path_openat+0x1084/0x18f0 [ 31.960633][ T4916] do_file_open+0x1c8/0x2e8 [ 31.960641][ T4916] do_sys_openat2+0x114/0x1e8 [ 31.960650][ T4916] do_sys_open+0xb0/0xe0 [ 31.960658][ T4916] __arm64_sys_openat+0xa8/0xc4 [ 31.960667][ T4916] invoke_syscall+0x98/0x244 [ 31.960677][ T4916] el0_svc_common+0xec/0x23c [ 31.960686][ T4916] do_el0_svc+0x4c/0x5c [ 31.960695][ T4916] el0_svc+0x60/0x1d8 [ 31.960703][ T4916] el0t_64_sync_handler+0x44/0x104 [ 31.960712][ T4916] el0t_64_sync+0x198/0x19c [ 31.960719][ T4916] [ 31.960721][ T4916] Allocated by task 4826: [ 31.960724][ T4916] kasan_save_track+0x40/0x78 [ 31.960731][ T4916] kasan_save_alloc_info+0x40/0x50 [ 31.960738][ T4916] __kasan_kmalloc+0x9c/0xb4 [ 31.960743][ T4916] __kmalloc_cache_noprof+0x2f4/0x5fc [ 31.960749][ T4916] gadgetfs_fill_super+0x19c/0x370 [ 31.960757][ T4916] vfs_get_super+0xb8/0x148 [ 31.960763][ T4916] get_tree_single+0x30/0x40 [ 31.960769][ T4916] gadgetfs_get_tree+0x28/0x38 [ 31.960776][ T4916] vfs_get_tree+0x90/0x28c [ 31.960782][ T4916] fc_mount+0x24/0xac [ 31.960788][ T4916] do_new_mount+0x2a4/0x538 [ 31.960795][ T4916] path_mount+0x5f0/0xa88 [ 31.960802][ T4916] do_mount+0xe8/0x148 [ 31.960809][ T4916] __arm64_sys_mount+0x33c/0x388 [ 31.960816][ T4916] invoke_syscall+0x98/0x244 [ 31.960824][ T4916] el0_svc_common+0xec/0x23c [ 31.960831][ T4916] do_el0_svc+0x4c/0x5c [ 31.960839][ T4916] el0_svc+0x60/0x1d8 [ 31.960845][ T4916] el0t_64_sync_handler+0x44/0x104 [ 31.960853][ T4916] el0t_64_sync+0x198/0x19c [ 31.960858][ T4916] [ 31.960859][ T4916] Freed by task 4915: [ 31.960862][ T4916] kasan_save_track+0x40/0x78 [ 31.960868][ T4916] kasan_save_free_info+0x54/0x6c [ 31.960875][ T4916] __kasan_slab_free+0x74/0xa4 [ 31.960881][ T4916] kfree+0x188/0x658 [ 31.960889][ T4916] put_dev+0x8c/0xf8 [ 31.960895][ T4916] dev_release+0x100/0x15c [ 31.960902][ T4916] __fput+0x338/0x74c [ 31.960908][ T4916] ____fput+0x20/0x30 [ 31.960913][ T4916] task_work_run+0x1cc/0x25c [ 31.960921][ T4916] do_exit+0x58c/0x1a74 [ 31.960930][ T4916] do_group_exit+0x198/0x238 [ 31.960938][ T4916] get_signal+0xfb0/0x1094 [ 31.960943][ T4916] arch_do_signal_or_restart+0x288/0x444c [ 31.960951][ T4916] exit_to_user_mode_loop+0x70/0x17c [ 31.960959][ T4916] el0_svc+0x12c/0x1d8 [ 31.960966][ T4916] el0t_64_sync_handler+0x44/0x104 [ 31.960973][ T4916] el0t_64_sync+0x198/0x19c [ 31.960978][ T4916] [ 31.960980][ T4916] The buggy address belongs to the object at ffff0000cd20c000 [ 31.960980][ T4916] which belongs to the cache kmalloc-1k of size 1024 [ 31.960985][ T4916] The buggy address is located 24 bytes inside of [ 31.960985][ T4916] freed 1024-byte region [ffff0000cd20c000, ffff0000cd20c400) [ 31.960998][ T4916] [ 31.961000][ T4916] The buggy address belongs to the physical page: [ 31.961003][ T4916] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10d208 [ 31.961010][ T4916] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 31.961016][ T4916] flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 31.961023][ T4916] page_type: f5(slab) [ 31.961030][ T4916] raw: 05ffc00000000040 ffff0000c0001dc0 dead000000000100 dead000000000122 [ 31.961037][ T4916] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 31.961043][ T4916] head: 05ffc00000000040 ffff0000c0001dc0 dead000000000100 dead000000000122 [ 31.961049][ T4916] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 31.961054][ T4916] head: 05ffc00000000003 fffffdffc3348201 00000000ffffffff 00000000ffffffff [ 31.961059][ T4916] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 31.961062][ T4916] page dumped because: kasan: bad access detected [ 31.961065][ T4916] [ 31.961067][ T4916] Memory state around the buggy address: [ 31.961070][ T4916] ffff0000cd20bf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.961075][ T4916] ffff0000cd20bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.961079][ T4916] >ffff0000cd20c000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.961082][ T4916] ^ [ 31.961085][ T4916] ffff0000cd20c080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.961089][ T4916] ffff0000cd20c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.961092][ T4916] ================================================================== [ 31.961095][ T4916] Disabling lock debugging due to kernel taint [ 31.961099][ T4916] ------------[ cut here ]------------ [ 31.961101][ T4916] UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.h:68:9 [ 31.961107][ T4916] index 12734 is out of range for type 'unsigned long[8]' [ 31.961112][ T4916] CPU: 0 UID: 0 PID: 4916 Comm: syz.0.18 Tainted: G B syzkaller #0 PREEMPT [ 31.961121][ T4916] Tainted: [B]=BAD_PAGE [ 31.961124][ T4916] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 31.961127][ T4916] Call trace: [ 31.961129][ T4916] show_stack+0x2c/0x3c (C) [ 31.961138][ T4916] __dump_stack+0x30/0x40 [ 31.961148][ T4916] dump_stack_lvl+0xd8/0x12c [ 31.961157][ T4916] dump_stack+0x1c/0x28 [ 31.961166][ T4916] ubsan_epilogue+0x14/0x48 [ 31.961174][ T4916] __ubsan_handle_out_of_bounds+0xd0/0xf8 [ 31.961184][ T4916] queued_spin_lock_slowpath+0x834/0xb5c [ 31.961194][ T4916] do_raw_spin_lock+0x21c/0x2d0 [ 31.961202][ T4916] _raw_spin_lock_irq+0x60/0x70 [ 31.961211][ T4916] gadget_dev_open+0x50/0x1c4 [ 31.961219][ T4916] do_dentry_open+0x5c4/0xfbc [ 31.961228][ T4916] vfs_open+0x44/0x2dc [ 31.961237][ T4916] path_openat+0x1084/0x18f0 [ 31.961244][ T4916] do_file_open+0x1c8/0x2e8 [ 31.961252][ T4916] do_sys_openat2+0x114/0x1e8 [ 31.961261][ T4916] do_sys_open+0xb0/0xe0 [ 31.961269][ T4916] __arm64_sys_openat+0xa8/0xc4 [ 31.961278][ T4916] invoke_syscall+0x98/0x244 [ 31.961287][ T4916] el0_svc_common+0xec/0x23c [ 31.961296][ T4916] do_el0_svc+0x4c/0x5c [ 31.961304][ T4916] el0_svc+0x60/0x1d8 [ 31.961312][ T4916] el0t_64_sync_handler+0x44/0x104 [ 31.961321][ T4916] el0t_64_sync+0x198/0x19c [ 31.961328][ T4916] ---[ end trace ]--- [ 32.653333][ T4815] Bluetooth: hci0: command tx timeout [ 34.753268][ T4815] Bluetooth: hci0: command tx timeout [ 36.853416][ T4815] Bluetooth: hci0: command tx timeout