Warning: Permanently added '10.128.0.28' (ED25519) to the list of known hosts. 1970/01/01 00:00:22 parsed 1 programs 1970/01/01 00:00:22 serving rpc on tcp://33125 [ 23.567883][ T4721] cgroup: Unknown subsys name 'net' [ 23.707960][ T4721] cgroup: Unknown subsys name 'cpuset' [ 23.709458][ T4721] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 23.835990][ T4721] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 25.429282][ T4727] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 25.498892][ T286] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 25.498904][ T286] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 25.510440][ T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 25.510452][ T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 26.268155][ T4765] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.268465][ T4765] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.268543][ T4765] bridge_slave_0: entered allmulticast mode [ 26.268979][ T4765] bridge_slave_0: entered promiscuous mode [ 26.275613][ T4765] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.275657][ T4765] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.275703][ T4765] bridge_slave_1: entered allmulticast mode [ 26.276105][ T4765] bridge_slave_1: entered promiscuous mode [ 26.285223][ T4765] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 26.286090][ T4765] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 26.292262][ T4765] team0: Port device team_slave_0 added [ 26.292936][ T4765] team0: Port device team_slave_1 added [ 26.298421][ T4765] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 26.298430][ T4765] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.298441][ T4765] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 26.299185][ T4765] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 26.299193][ T4765] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.299209][ T4765] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 26.310600][ T4765] hsr_slave_0: entered promiscuous mode [ 26.310922][ T4765] hsr_slave_1: entered promiscuous mode [ 26.358180][ T4765] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 26.360251][ T4765] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 26.360690][ T4765] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 26.361616][ T4765] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 26.361939][ T4765] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 26.362856][ T4765] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 26.363173][ T4765] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 26.364154][ T4765] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 26.382233][ T4765] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.382264][ T4765] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.382408][ T4765] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.382435][ T4765] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.398601][ T4765] 8021q: adding VLAN 0 to HW filter on device bond0 [ 26.402190][ T40] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.402681][ T40] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.405139][ T4765] 8021q: adding VLAN 0 to HW filter on device team0 [ 26.414929][ T342] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.414960][ T342] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.415355][ T342] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.415372][ T342] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.420736][ T4765] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 26.420749][ T4765] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 26.507459][ T4765] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 26.517499][ T4765] veth0_vlan: entered promiscuous mode [ 26.522011][ T4765] veth1_vlan: entered promiscuous mode [ 26.531149][ T4765] veth0_macvtap: entered promiscuous mode [ 26.532208][ T4765] veth1_macvtap: entered promiscuous mode [ 26.535433][ T4765] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 26.538455][ T4765] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 26.543665][ T286] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.543832][ T286] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.543886][ T286] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.586779][ T286] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.633187][ T40] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 26.709121][ T40] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 26.763978][ T40] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 26.811614][ T40] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 26.889723][ T4733] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 26.890043][ T4815] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 26.890226][ T4815] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 26.890583][ T4815] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 26.890807][ T4815] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 1970/01/01 00:00:27 executed programs: 0 [ 27.074810][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 27.075242][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 27.075419][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 27.076160][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 27.077053][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 27.203724][ T4823] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.203777][ T4823] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.203832][ T4823] bridge_slave_0: entered allmulticast mode [ 27.204229][ T4823] bridge_slave_0: entered promiscuous mode [ 27.207266][ T4823] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.207289][ T4823] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.207342][ T4823] bridge_slave_1: entered allmulticast mode [ 27.207758][ T4823] bridge_slave_1: entered promiscuous mode [ 27.215003][ T4823] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 27.216151][ T4823] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 27.225078][ T4823] team0: Port device team_slave_0 added [ 27.225801][ T4823] team0: Port device team_slave_1 added [ 27.232205][ T4823] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 27.232216][ T4823] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 27.232231][ T4823] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 27.232751][ T4823] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 27.232757][ T4823] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 27.232768][ T4823] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 27.243832][ T4823] hsr_slave_0: entered promiscuous mode [ 27.244113][ T4823] hsr_slave_1: entered promiscuous mode [ 27.244316][ T4823] debugfs: 'hsr0' already exists in 'hsr' [ 27.244371][ T4823] Cannot create hsr debugfs directory [ 29.136786][ T4815] Bluetooth: hci0: command tx timeout [ 30.017194][ T40] bridge_slave_1: left allmulticast mode [ 30.017222][ T40] bridge_slave_1: left promiscuous mode [ 30.017527][ T40] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.019122][ T40] bridge_slave_0: left allmulticast mode [ 30.019133][ T40] bridge_slave_0: left promiscuous mode [ 30.019191][ T40] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.072945][ T40] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 30.080503][ T40] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 30.081371][ T40] bond0 (unregistering): Released all slaves [ 30.116996][ T40] hsr_slave_0: left promiscuous mode [ 30.117289][ T40] hsr_slave_1: left promiscuous mode [ 30.117576][ T40] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 30.117589][ T40] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 30.117981][ T40] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 30.117991][ T40] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 30.121520][ T40] veth1_macvtap: left promiscuous mode [ 30.121551][ T40] veth0_macvtap: left promiscuous mode [ 30.121596][ T40] veth1_vlan: left promiscuous mode [ 30.121633][ T40] veth0_vlan: left promiscuous mode [ 30.210794][ T40] team0 (unregistering): Port device team_slave_1 removed [ 30.215524][ T40] team0 (unregistering): Port device team_slave_0 removed [ 30.268112][ T4400] 8021q: adding VLAN 0 to HW filter on device eth0 [ 30.451063][ T4823] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 30.453987][ T4823] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.454353][ T4823] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 30.455437][ T4823] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.456278][ T4823] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 30.463830][ T4823] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.464192][ T4823] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 30.465050][ T4823] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.600772][ T4823] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.604632][ T4823] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.606053][ T41] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.606081][ T41] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.610713][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.610740][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.734741][ T4823] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.747321][ T4823] veth0_vlan: entered promiscuous mode [ 30.750060][ T4823] veth1_vlan: entered promiscuous mode [ 30.760952][ T4823] veth0_macvtap: entered promiscuous mode [ 30.761983][ T4823] veth1_macvtap: entered promiscuous mode [ 30.765751][ T4823] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.770914][ T4823] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.787716][ T489] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.787891][ T489] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.787906][ T489] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.787920][ T489] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.793712][ T489] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.793724][ T489] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.800193][ T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.800205][ T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.066699][ T26] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 31.226592][ T4815] Bluetooth: hci0: command tx timeout [ 31.227267][ T26] usb 1-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 31.228135][ T26] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 31.228148][ T26] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 31.229468][ T26] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.229476][ T26] usb 1-1: Product: syz [ 31.229482][ T26] usb 1-1: Manufacturer: syz [ 31.229488][ T26] usb 1-1: SerialNumber: syz [ 32.236781][ C1] ================================================================== [ 32.236793][ C1] BUG: KASAN: slab-out-of-bounds in gb_operation_message_alloc+0x224/0x258 [ 32.236811][ C1] Write of size 2 at addr ffff0000c2e71222 by task swapper/1/0 [ 32.236818][ C1] [ 32.236823][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT [ 32.236832][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 32.236837][ C1] Call trace: [ 32.236840][ C1] show_stack+0x2c/0x3c (C) [ 32.236853][ C1] __dump_stack+0x30/0x40 [ 32.236864][ C1] dump_stack_lvl+0xd8/0x12c [ 32.236874][ C1] print_address_description+0xb0/0x238 [ 32.236882][ C1] print_report+0x68/0x84 [ 32.236889][ C1] kasan_report+0x8c/0xc4 [ 32.236899][ C1] __asan_report_store2_noabort+0x20/0x2c [ 32.236909][ C1] gb_operation_message_alloc+0x224/0x258 [ 32.236918][ C1] gb_operation_create_common+0xa4/0x3b4 [ 32.236927][ C1] gb_connection_recv+0x268/0xfd4 [ 32.236936][ C1] greybus_data_rcvd+0x254/0x67c [ 32.236943][ C1] cport_in_callback+0x15c/0x298 [ 32.236952][ C1] __usb_hcd_giveback_urb+0x314/0x594 [ 32.236961][ C1] usb_hcd_giveback_urb+0x100/0x350 [ 32.236969][ C1] dummy_timer+0x570/0x2ba0 [ 32.236977][ C1] __hrtimer_run_queues+0x310/0x998 [ 32.236986][ C1] hrtimer_run_softirq+0x1b4/0x2a8 [ 32.236994][ C1] handle_softirqs+0x324/0xcbc [ 32.237003][ C1] __do_softirq+0x14/0x20 [ 32.237010][ C1] ____do_softirq+0x14/0x20 [ 32.237018][ C1] call_on_irq_stack+0x30/0x48 [ 32.237025][ C1] do_softirq_own_stack+0x20/0x2c [ 32.237033][ C1] __irq_exit_rcu+0x10c/0x318 [ 32.237040][ C1] irq_exit_rcu+0x14/0x84 [ 32.237048][ C1] el1_interrupt+0x40/0x60 [ 32.237060][ C1] el1h_64_irq_handler+0x18/0x24 [ 32.237070][ C1] el1h_64_irq+0x78/0x7c [ 32.237077][ C1] default_idle_call+0xa0/0xb8 (P) [ 32.237086][ C1] do_idle+0x1ec/0x450 [ 32.237096][ C1] cpu_startup_entry+0x5c/0x74 [ 32.237105][ C1] secondary_start_kernel+0x1bc/0x1e0 [ 32.237115][ C1] __secondary_switched+0xc0/0xc4 [ 32.237125][ C1] [ 32.237127][ C1] Allocated by task 0: [ 32.237130][ C1] kasan_save_track+0x40/0x78 [ 32.237138][ C1] kasan_save_alloc_info+0x40/0x50 [ 32.237146][ C1] __kasan_kmalloc+0x9c/0xb4 [ 32.237152][ C1] __kmalloc_noprof+0x34c/0x6c8 [ 32.237159][ C1] gb_operation_message_alloc+0x90/0x258 [ 32.237166][ C1] gb_operation_create_common+0xa4/0x3b4 [ 32.237174][ C1] gb_connection_recv+0x268/0xfd4 [ 32.237181][ C1] greybus_data_rcvd+0x254/0x67c [ 32.237186][ C1] cport_in_callback+0x15c/0x298 [ 32.237194][ C1] __usb_hcd_giveback_urb+0x314/0x594 [ 32.237200][ C1] usb_hcd_giveback_urb+0x100/0x350 [ 32.237206][ C1] dummy_timer+0x570/0x2ba0 [ 32.237212][ C1] __hrtimer_run_queues+0x310/0x998 [ 32.237219][ C1] hrtimer_run_softirq+0x1b4/0x2a8 [ 32.237225][ C1] handle_softirqs+0x324/0xcbc [ 32.237231][ C1] __do_softirq+0x14/0x20 [ 32.237237][ C1] [ 32.237239][ C1] The buggy address belongs to the object at ffff0000c2e71220 [ 32.237239][ C1] which belongs to the cache kmalloc-8 of size 8 [ 32.237245][ C1] The buggy address is located 2 bytes inside of [ 32.237245][ C1] allocated 3-byte region [ffff0000c2e71220, ffff0000c2e71223) [ 32.237252][ C1] [ 32.237254][ C1] The buggy address belongs to the physical page: [ 32.237258][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff0000c2e71440 pfn:0x102e71 [ 32.237266][ C1] flags: 0x5ffc00000000200(workingset|node=0|zone=2|lastcpupid=0x7ff) [ 32.237274][ C1] page_type: f5(slab) [ 32.237281][ C1] raw: 05ffc00000000200 ffff0000c0001500 ffff0000c0000348 fffffdffc31ab750 [ 32.237288][ C1] raw: ffff0000c2e71440 000000000080007e 00000000f5000000 0000000000000000 [ 32.237291][ C1] page dumped because: kasan: bad access detected [ 32.237295][ C1] [ 32.237296][ C1] Memory state around the buggy address: [ 32.237300][ C1] ffff0000c2e71100: 00 fc fc fc fa fc fc fc fa fc fc fc 00 fc fc fc [ 32.237305][ C1] ffff0000c2e71180: 00 fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc [ 32.237309][ C1] >ffff0000c2e71200: fa fc fc fc 03 fc fc fc fa fc fc fc 00 fc fc fc [ 32.237313][ C1] ^ [ 32.237316][ C1] ffff0000c2e71280: 00 fc fc fc 00 fc fc fc 00 fc fc fc fa fc fc fc [ 32.237321][ C1] ffff0000c2e71300: 06 fc fc fc 06 fc fc fc 06 fc fc fc 06 fc fc fc [ 32.237324][ C1] ================================================================== [ 32.237328][ C1] Disabling lock debugging due to kernel taint [ 32.237363][ T489] greybus 1-svc: unexpected request 0x00 received (state 0) [ 32.237867][ T4915] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 32.238038][ T4915] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 32.438276][ T4780] usb 1-1: USB disconnect, device number 2 [ 32.438319][ C1] usb 1-1: failed to resubmit arpc in-urb: -19 [ 32.438334][ C1] usb 1-1: failed to resubmit arpc in-urb: -19 [ 32.438344][ C1] usb 1-1: failed to resubmit in-urb: -19 [ 32.438355][ C1] usb 1-1: failed to resubmit in-urb: -19 [ 32.438364][ C1] usb 1-1: failed to resubmit in-urb: -19 [ 32.438372][ C1] usb 1-1: failed to resubmit in-urb: -19 [ 32.439653][ T4780] usb 1-1: failed to send ARPC request 4: -19 [ 32.439679][ T4780] usb 1-1: failed to execute ARPC: -19 [ 32.439687][ T4780] usb 1-1: failed to flush cport 0: -19 [ 32.439694][ T4780] greybus greybus1: 0/0:0: failed to flush host cport: -19 [ 32.439720][ T4780] usb 1-1: failed to send ARPC request 2: -19 [ 32.439737][ T4780] usb 1-1: failed to execute ARPC: -19 [ 32.439742][ T4780] usb 1-1: failed to quiesce cport 0: -19 (0) [ 32.439749][ T4780] greybus greybus1: 0/0:0: failed to quiesce host cport: -19 [ 32.439774][ T4780] usb 1-1: failed to send ARPC request 3: -19 [ 32.439791][ T4780] usb 1-1: failed to execute ARPC: -19 [ 32.439796][ T4780] usb 1-1: failed to clear cport 0: -19 [ 32.439801][ T4780] greybus greybus1: 0/0:0: failed to clear host cport: -19