Warning: Permanently added '10.128.0.206' (ED25519) to the list of known hosts. 2026/08/19 09:25:25 parsed 1 programs 2026/08/19 09:25:25 serving rpc on tcp://39937 syzkaller login: [ 73.460065][ T5782] cgroup: Unknown subsys name 'net' [ 73.594730][ T5782] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 74.993749][ T5782] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 76.916077][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 76.923937][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 76.932604][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 76.941471][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 76.949308][ T51] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 76.956653][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 78.720358][ T5844] chnl_net:caif_netlink_parms(): no params data found [ 78.784578][ T5844] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.792387][ T5844] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.799679][ T5844] bridge_slave_0: entered allmulticast mode [ 78.806577][ T5844] bridge_slave_0: entered promiscuous mode [ 78.815192][ T5844] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.822713][ T5844] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.830094][ T5844] bridge_slave_1: entered allmulticast mode [ 78.836756][ T5844] bridge_slave_1: entered promiscuous mode [ 78.866096][ T5844] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.877471][ T5844] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.901418][ T5844] team0: Port device team_slave_0 added [ 78.910407][ T5844] team0: Port device team_slave_1 added [ 78.930493][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.937450][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.963662][ T5844] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.982200][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.989200][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.015476][ T5844] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.062464][ T5844] hsr_slave_0: entered promiscuous mode [ 79.069094][ T5844] hsr_slave_1: entered promiscuous mode [ 79.210270][ T5844] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 79.223269][ T5844] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 79.235650][ T5844] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 79.246795][ T5844] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 79.280475][ T5844] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.287784][ T5844] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.295741][ T5844] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.302955][ T5844] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.352651][ T5844] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.368961][ T4879] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.382832][ T4879] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.408058][ T5844] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.434164][ T1325] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.441306][ T1325] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.454646][ T4879] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.461872][ T4879] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.638445][ T5844] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 79.675753][ T5844] veth0_vlan: entered promiscuous mode [ 79.686010][ T5844] veth1_vlan: entered promiscuous mode [ 79.720407][ T5844] veth0_macvtap: entered promiscuous mode [ 79.730711][ T5844] veth1_macvtap: entered promiscuous mode [ 79.745635][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 79.761395][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 79.785838][ T5844] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.794853][ T5844] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.803573][ T5844] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.812345][ T5844] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.125001][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.138204][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.163986][ T4879] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.174389][ T4879] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.201561][ T41] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2026/08/19 09:25:34 executed programs: 0 [ 81.151708][ T5086] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 81.161577][ T5086] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 81.169646][ T5086] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 81.177554][ T5086] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 81.186077][ T5086] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 81.193374][ T5086] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 81.307665][ T5887] chnl_net:caif_netlink_parms(): no params data found [ 81.359189][ T5887] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.366341][ T5887] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.373710][ T5887] bridge_slave_0: entered allmulticast mode [ 81.381863][ T5887] bridge_slave_0: entered promiscuous mode [ 81.390366][ T5887] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.397433][ T5887] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.405684][ T5887] bridge_slave_1: entered allmulticast mode [ 81.413498][ T5887] bridge_slave_1: entered promiscuous mode [ 81.440770][ T5887] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.452594][ T5887] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.485516][ T5887] team0: Port device team_slave_0 added [ 81.494354][ T5887] team0: Port device team_slave_1 added [ 81.519684][ T5887] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.526669][ T5887] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.553474][ T5887] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.567230][ T5887] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.574472][ T5887] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.600603][ T5887] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.640610][ T5887] hsr_slave_0: entered promiscuous mode [ 81.646811][ T5887] hsr_slave_1: entered promiscuous mode [ 81.653277][ T5887] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 81.661773][ T5887] Cannot create hsr debugfs directory [ 82.758596][ T41] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 83.288885][ T51] Bluetooth: hci0: command tx timeout [ 85.287350][ T41] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.340924][ T41] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.369159][ T51] Bluetooth: hci0: command tx timeout [ 86.222833][ T5887] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 86.233302][ T5887] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 86.245562][ T5887] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 86.267194][ T5887] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 86.317059][ T41] hsr_slave_0: left promiscuous mode [ 86.324012][ T41] hsr_slave_1: left promiscuous mode [ 86.330909][ T41] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 86.339506][ T41] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 86.347513][ T41] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 86.354952][ T41] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 86.363485][ T41] bridge_slave_1: left allmulticast mode [ 86.369188][ T41] bridge_slave_1: left promiscuous mode [ 86.375461][ T41] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.385755][ T41] bridge_slave_0: left allmulticast mode [ 86.392471][ T41] bridge_slave_0: left promiscuous mode [ 86.398122][ T41] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.416012][ T41] veth1_macvtap: left promiscuous mode [ 86.423019][ T41] veth0_macvtap: left promiscuous mode [ 86.428877][ T41] veth1_vlan: left promiscuous mode [ 86.434343][ T41] veth0_vlan: left promiscuous mode [ 86.783847][ T41] team0 (unregistering): Port device team_slave_1 removed [ 86.814345][ T41] team0 (unregistering): Port device team_slave_0 removed [ 86.843179][ T41] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 86.874248][ T41] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 86.896093][ T55] cfg80211: failed to load regulatory.db [ 87.075288][ T41] bond0 (unregistering): Released all slaves [ 87.183831][ T5887] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.199287][ T5887] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.212894][ T4879] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.220285][ T4879] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.248151][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.255327][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.435571][ T5887] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.449941][ T51] Bluetooth: hci0: command tx timeout [ 87.472924][ T5887] veth0_vlan: entered promiscuous mode [ 87.493679][ T5887] veth1_vlan: entered promiscuous mode [ 87.526405][ T5887] veth0_macvtap: entered promiscuous mode [ 87.542382][ T5887] veth1_macvtap: entered promiscuous mode [ 87.562005][ T5887] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.575385][ T5887] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.586613][ T5887] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.596676][ T5887] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.605616][ T5887] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.616189][ T5887] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.726082][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.738847][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.763072][ T1325] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.774622][ T1325] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.809153][ T5931] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN [ 87.820904][ T5931] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 87.829309][ T5931] CPU: 1 PID: 5931 Comm: syz.0.17 Not tainted syzkaller #0 [ 87.836483][ T5931] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 87.846516][ T5931] RIP: 0010:vsscanf+0x19a/0x2520 [ 87.851449][ T5931] Code: 48 c7 c6 d0 6d 74 8e e8 64 72 07 f7 41 83 fe 25 74 4d 45 85 f6 0f 84 1e 22 00 00 48 ff c3 48 89 5c 24 78 4c 89 f8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 bd 1b 00 00 41 0f b6 1f 45 0f b6 f6 44 [ 87.871042][ T5931] RSP: 0018:ffffc900033b7640 EFLAGS: 00010246 [ 87.877101][ T5931] RAX: 0000000000000000 RBX: ffffffff8ad68661 RCX: 0000000000000001 [ 87.885074][ T5931] RDX: ffffffff8a80047c RSI: ffffffff8e746dd0 RDI: 0000000000000030 [ 87.893033][ T5931] RBP: ffffc900033b7770 R08: ffff88802a8b5a00 R09: 0000000000000002 [ 87.901002][ T5931] R10: 0000000000000025 R11: 0000000000000000 R12: ffffffff8ad68660 [ 87.908968][ T5931] R13: dffffc0000000000 R14: 0000000000000030 R15: 0000000000000000 [ 87.916933][ T5931] FS: 00005555597c4500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 87.925849][ T5931] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 87.932421][ T5931] CR2: 00007f8cbb470000 CR3: 0000000076e96000 CR4: 00000000003506e0 [ 87.940384][ T5931] Call Trace: [ 87.943654][ T5931] [ 87.946580][ T5931] ? bprintf+0x140/0x140 [ 87.950821][ T5931] sscanf+0xe3/0x140 [ 87.954707][ T5931] ? __might_fault+0xaa/0x120 [ 87.959371][ T5931] ? skip_atoi+0xe0/0xe0 [ 87.963606][ T5931] ? __might_fault+0xaa/0x120 [ 87.968269][ T5931] ? __might_fault+0xc6/0x120 [ 87.972936][ T5931] ? __might_fault+0xaa/0x120 [ 87.977598][ T5931] ? split_huge_pages_write+0x372/0x1b60 [ 87.983220][ T5931] split_huge_pages_write+0x391/0x1b60 [ 87.988669][ T5931] ? mark_lock+0x94/0x320 [ 87.992994][ T5931] ? deferred_split_scan+0x940/0x940 [ 87.998283][ T5931] ? aa_file_perm+0x11b/0xee0 [ 88.002957][ T5931] ? debugfs_file_get+0x36c/0x460 [ 88.007972][ T5931] ? rcu_read_lock_any_held+0xb4/0x140 [ 88.013419][ T5931] ? rcu_read_lock_bh_held+0x100/0x100 [ 88.018873][ T5931] full_proxy_write+0x110/0x1c0 [ 88.023715][ T5931] ? full_proxy_read+0x1c0/0x1c0 [ 88.028641][ T5931] vfs_write+0x299/0x9a0 [ 88.032883][ T5931] ? file_end_write+0x250/0x250 [ 88.037723][ T5931] ? __ia32_sys_get_robust_list+0x110/0x110 [ 88.043603][ T5931] ? __fdget_pos+0x2ba/0x330 [ 88.048183][ T5931] ksys_write+0x151/0x260 [ 88.052506][ T5931] ? __ia32_sys_read+0x90/0x90 [ 88.057258][ T5931] ? lockdep_hardirqs_on+0x98/0x150 [ 88.062450][ T5931] do_syscall_64+0x55/0xb0 [ 88.066852][ T5931] ? clear_bhb_loop+0x40/0x90 [ 88.071523][ T5931] ? clear_bhb_loop+0x40/0x90 [ 88.076185][ T5931] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 88.082066][ T5931] RIP: 0033:0x7f8cbb59e0d9 [ 88.086482][ T5931] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 88.106074][ T5931] RSP: 002b:00007ffcf85ae418 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 88.114474][ T5931] RAX: ffffffffffffffda RBX: 00007f8cbb825fa0 RCX: 00007f8cbb59e0d9 [ 88.122431][ T5931] RDX: 0000000000000005 RSI: 0000200000000600 RDI: 0000000000000003 [ 88.130387][ T5931] RBP: 00007f8cbb635024 R08: 0000000000000000 R09: 0000000000000000 [ 88.138343][ T5931] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 88.146300][ T5931] R13: 00007f8cbb825fac R14: 00007f8cbb825fa0 R15: 00007f8cbb825fa0 [ 88.154260][ T5931] [ 88.157261][ T5931] Modules linked in: [ 88.169644][ T5931] ---[ end trace 0000000000000000 ]--- [ 88.175115][ T5931] RIP: 0010:vsscanf+0x19a/0x2520 [ 88.181537][ T5931] Code: 48 c7 c6 d0 6d 74 8e e8 64 72 07 f7 41 83 fe 25 74 4d 45 85 f6 0f 84 1e 22 00 00 48 ff c3 48 89 5c 24 78 4c 89 f8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 bd 1b 00 00 41 0f b6 1f 45 0f b6 f6 44 [ 88.201497][ T5931] RSP: 0018:ffffc900033b7640 EFLAGS: 00010246 [ 88.207595][ T5931] RAX: 0000000000000000 RBX: ffffffff8ad68661 RCX: 0000000000000001 [ 88.216088][ T5931] RDX: ffffffff8a80047c RSI: ffffffff8e746dd0 RDI: 0000000000000030 [ 88.224125][ T5931] RBP: ffffc900033b7770 R08: ffff88802a8b5a00 R09: 0000000000000002 [ 88.232215][ T5931] R10: 0000000000000025 R11: 0000000000000000 R12: ffffffff8ad68660 [ 88.240277][ T5931] R13: dffffc0000000000 R14: 0000000000000030 R15: 0000000000000000 [ 88.248985][ T5931] FS: 00005555597c4500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 88.257968][ T5931] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 88.265042][ T5931] CR2: 00007f8cbb470000 CR3: 0000000076e96000 CR4: 00000000003506e0 [ 88.273579][ T5931] Kernel panic - not syncing: Fatal exception [ 88.279889][ T5931] Kernel Offset: disabled [ 88.284201][ T5931] Rebooting in 86400 seconds..