Warning: Permanently added '10.128.0.245' (ED25519) to the list of known hosts.
2026/09/14 17:01:25 parsed 1 programs
2026/09/14 17:01:25 serving rpc on tcp://44685
[ 86.355442][ T5629] cgroup: Unknown subsys name 'net'
[ 86.470049][ T5629] cgroup: Unknown subsys name 'cpuset'
[ 86.473429][ T5629] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 88.218340][ T5629] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 91.261731][ T5641] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 91.265890][ T5641] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 91.297227][ T5641] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 91.299335][ T5641] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 91.311880][ T5641] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 91.862426][ T10] cfg80211: failed to load regulatory.db
[ 93.733418][ T5676] bridge0: port 1(bridge_slave_0) entered blocking state
[ 93.734076][ T5676] bridge0: port 1(bridge_slave_0) entered disabled state
[ 93.734190][ T5676] bridge_slave_0: entered allmulticast mode
[ 93.735640][ T5676] bridge_slave_0: entered promiscuous mode
[ 93.754583][ T5676] bridge0: port 2(bridge_slave_1) entered blocking state
[ 93.755014][ T5676] bridge0: port 2(bridge_slave_1) entered disabled state
[ 93.755440][ T5676] bridge_slave_1: entered allmulticast mode
[ 93.761209][ T5676] bridge_slave_1: entered promiscuous mode
[ 93.808904][ T5676] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 93.811612][ T5676] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 93.848753][ T5676] team0: Port device team_slave_0 added
[ 93.851031][ T5676] team0: Port device team_slave_1 added
[ 93.880987][ T5676] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 93.881000][ T5676] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 93.881019][ T5676] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 93.883368][ T5676] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 93.883383][ T5676] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 93.883413][ T5676] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 93.996496][ T5676] hsr_slave_0: entered promiscuous mode
[ 93.997552][ T5676] hsr_slave_1: entered promiscuous mode
[ 94.165830][ T5676] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 94.178865][ T5676] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 94.179780][ T5676] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 94.183206][ T5676] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 94.184894][ T5676] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 94.199993][ T5676] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 94.202475][ T5676] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 94.217609][ T5676] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 94.263564][ T5676] bridge0: port 2(bridge_slave_1) entered blocking state
[ 94.263773][ T5676] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 94.264175][ T5676] bridge0: port 1(bridge_slave_0) entered blocking state
[ 94.264262][ T5676] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 94.345579][ T5676] 8021q: adding VLAN 0 to HW filter on device bond0
[ 94.361331][ T59] bridge0: port 1(bridge_slave_0) entered disabled state
[ 94.363119][ T59] bridge0: port 2(bridge_slave_1) entered disabled state
[ 94.392285][ T5676] 8021q: adding VLAN 0 to HW filter on device team0
[ 94.404400][ T59] bridge0: port 1(bridge_slave_0) entered blocking state
[ 94.404475][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 94.425908][ T13] bridge0: port 2(bridge_slave_1) entered blocking state
[ 94.427242][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 94.791949][ T5676] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 94.840347][ T5676] veth0_vlan: entered promiscuous mode
[ 94.853484][ T5676] veth1_vlan: entered promiscuous mode
[ 94.889716][ T5676] veth0_macvtap: entered promiscuous mode
[ 94.893613][ T5676] veth1_macvtap: entered promiscuous mode
[ 94.918513][ T5676] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 94.925618][ T5676] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 94.996745][ T767] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 94.997196][ T767] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 94.997237][ T767] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 94.997273][ T767] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 95.151525][ T767] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 95.230220][ T767] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 95.283242][ T767] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 95.365078][ T767] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 95.825324][ T5734] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 95.826918][ T5734] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 95.832265][ T5734] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 95.838064][ T5734] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 95.840536][ T5734] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 96.160331][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 96.160365][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 96.202791][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 96.202814][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
2026/09/14 17:01:40 executed programs: 0
[ 96.689019][ T4934] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 96.691311][ T4934] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 96.692391][ T4934] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 96.693357][ T4934] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 96.693968][ T4934] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 97.210741][ T5749] bridge0: port 1(bridge_slave_0) entered blocking state
[ 97.210930][ T5749] bridge0: port 1(bridge_slave_0) entered disabled state
[ 97.211488][ T5749] bridge_slave_0: entered allmulticast mode
[ 97.213046][ T5749] bridge_slave_0: entered promiscuous mode
[ 97.223215][ T5749] bridge0: port 2(bridge_slave_1) entered blocking state
[ 97.223535][ T5749] bridge0: port 2(bridge_slave_1) entered disabled state
[ 97.223874][ T5749] bridge_slave_1: entered allmulticast mode
[ 97.234780][ T5749] bridge_slave_1: entered promiscuous mode
[ 97.301490][ T5749] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 97.338135][ T5749] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 97.374280][ T767] bridge_slave_1: left allmulticast mode
[ 97.374316][ T767] bridge_slave_1: left promiscuous mode
[ 97.374892][ T767] bridge0: port 2(bridge_slave_1) entered disabled state
[ 97.398611][ T767] bridge_slave_0: left allmulticast mode
[ 97.398628][ T767] bridge_slave_0: left promiscuous mode
[ 97.398832][ T767] bridge0: port 1(bridge_slave_0) entered disabled state
[ 97.535154][ T767] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 97.546709][ T767] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 97.548023][ T767] bond0 (unregistering): Released all slaves
[ 97.553860][ T5749] team0: Port device team_slave_0 added
[ 97.583777][ T5749] team0: Port device team_slave_1 added
[ 97.640380][ T767] hsr_slave_0: left promiscuous mode
[ 97.641239][ T767] hsr_slave_1: left promiscuous mode
[ 97.642306][ T767] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 97.642334][ T767] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 97.643429][ T767] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 97.643448][ T767] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 97.673699][ T767] veth1_macvtap: left promiscuous mode
[ 97.673843][ T767] veth0_macvtap: left promiscuous mode
[ 97.674321][ T767] veth1_vlan: left promiscuous mode
[ 97.674550][ T767] veth0_vlan: left promiscuous mode
[ 98.023183][ T767] team0 (unregistering): Port device team_slave_1 removed
[ 98.045170][ T767] team0 (unregistering): Port device team_slave_0 removed
[ 98.236335][ T5749] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 98.236355][ T5749] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 98.236383][ T5749] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 98.282286][ T5279] 8021q: adding VLAN 0 to HW filter on device eth1
[ 98.284111][ T5749] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 98.284125][ T5749] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 98.284148][ T5749] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 98.401186][ T5749] hsr_slave_0: entered promiscuous mode
[ 98.402215][ T5749] hsr_slave_1: entered promiscuous mode
[ 98.737192][ T5734] Bluetooth: hci0: command tx timeout
[ 99.065522][ T5279] 8021q: adding VLAN 0 to HW filter on device eth2
[ 99.593891][ T5749] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 99.603870][ T5749] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 99.605420][ T5749] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 99.635925][ T5749] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 99.637028][ T5749] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 99.641477][ T5749] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 99.644808][ T5749] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 99.686928][ T5749] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 99.932859][ T5749] 8021q: adding VLAN 0 to HW filter on device bond0
[ 100.009082][ T5749] 8021q: adding VLAN 0 to HW filter on device team0
[ 100.040480][ T44] bridge0: port 1(bridge_slave_0) entered blocking state
[ 100.040593][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 100.072333][ T162] bridge0: port 2(bridge_slave_1) entered blocking state
[ 100.072445][ T162] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 100.653626][ T5749] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 100.697660][ T5749] veth0_vlan: entered promiscuous mode
[ 100.703541][ T5749] veth1_vlan: entered promiscuous mode
[ 100.739771][ T5749] veth0_macvtap: entered promiscuous mode
[ 100.743179][ T5749] veth1_macvtap: entered promiscuous mode
[ 100.765267][ T5749] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 100.781414][ T5749] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 100.806361][ T5734] Bluetooth: hci0: command tx timeout
[ 100.826250][ T59] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 100.826967][ T162] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 100.827011][ T162] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 100.827047][ T162] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 100.898093][ T162] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 100.898115][ T162] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 100.938295][ T162] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 100.938318][ T162] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 101.286729][ T10] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 101.436103][ T10] usb 1-1: Using ep0 maxpacket: 32
[ 101.437738][ T10] usb 1-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66
[ 101.439515][ T10] usb 1-1: config index 0 descriptor too short (expected 156, got 27)
[ 101.439556][ T10] usb 1-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30
[ 101.439595][ T10] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 103, changing to 10
[ 101.439614][ T10] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has invalid maxpacket 26217, setting to 1024
[ 101.439633][ T10] usb 1-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144
[ 101.439652][ T10] usb 1-1: config 0 interface 0 has no altsetting 0
[ 101.441880][ T10] usb 1-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172
[ 101.441905][ T10] usb 1-1: Product: syz
[ 101.441923][ T10] usb 1-1: Manufacturer: syz
[ 101.441934][ T10] usb 1-1: SerialNumber: syz
[ 101.484939][ T10] usb 1-1: config 0 descriptor??
[ 101.505068][ T5837] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[ 101.555586][ T10] ldusb 1-1:0.0: Interrupt out endpoint not found (using control endpoint instead)
[ 101.575609][ T10] ldusb 1-1:0.0: LD USB Device #0 now attached to major 180 minor 0
[ 101.725244][ C0] ldusb 1-1:0.0: usb_submit_urb failed (-19)
[ 101.725269][ T10] usb 1-1: USB disconnect, device number 2
[ 101.750998][ T10] ldusb 1-1:0.0: LD USB Device #0 now disconnected
2026/09/14 17:01:45 executed programs: 3
[ 102.516124][ T10] usb 1-1: new high-speed USB device number 3 using dummy_hcd
[ 102.686137][ T10] usb 1-1: Using ep0 maxpacket: 32
[ 102.686743][ T10] usb 1-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66
[ 102.687791][ T10] usb 1-1: config index 0 descriptor too short (expected 156, got 27)
[ 102.687815][ T10] usb 1-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30
[ 102.687840][ T10] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 103, changing to 10
[ 102.687858][ T10] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has invalid maxpacket 26217, setting to 1024
[ 102.687877][ T10] usb 1-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144
[ 102.687894][ T10] usb 1-1: config 0 interface 0 has no altsetting 0
[ 102.689889][ T10] usb 1-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172
[ 102.689906][ T10] usb 1-1: Product: syz
[ 102.689916][ T10] usb 1-1: Manufacturer: syz
[ 102.689926][ T10] usb 1-1: SerialNumber: syz
[ 102.692588][ T10] usb 1-1: config 0 descriptor??
[ 102.693685][ T5839] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[ 102.704522][ T10] ldusb 1-1:0.0: Interrupt out endpoint not found (using control endpoint instead)
[ 102.731244][ T10] ldusb 1-1:0.0: LD USB Device #0 now attached to major 180 minor 0
[ 102.886783][ T5734] Bluetooth: hci0: command tx timeout
[ 102.904314][ T10] usb 1-1: USB disconnect, device number 3
[ 102.904421][ C0] ldusb 1-1:0.0: usb_submit_urb failed (-19)
[ 102.916084][ T10] ldusb 1-1:0.0: LD USB Device #0 now disconnected
[ 103.676064][ T5698] usb 1-1: new high-speed USB device number 4 using dummy_hcd
[ 103.826141][ T5698] usb 1-1: Using ep0 maxpacket: 32
[ 103.828460][ T5698] usb 1-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66
[ 103.829596][ T5698] usb 1-1: config index 0 descriptor too short (expected 156, got 27)
[ 103.829635][ T5698] usb 1-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30
[ 103.829719][ T5698] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 103, changing to 10
[ 103.829739][ T5698] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has invalid maxpacket 26217, setting to 1024
[ 103.829758][ T5698] usb 1-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144
[ 103.829776][ T5698] usb 1-1: config 0 interface 0 has no altsetting 0
[ 103.831843][ T5698] usb 1-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172
[ 103.831868][ T5698] usb 1-1: Product: syz
[ 103.831883][ T5698] usb 1-1: Manufacturer: syz
[ 103.831898][ T5698] usb 1-1: SerialNumber: syz
[ 103.836024][ T5698] usb 1-1: config 0 descriptor??
[ 103.838172][ T5840] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[ 103.851897][ T5698] ldusb 1-1:0.0: Interrupt out endpoint not found (using control endpoint instead)
[ 103.862506][ T5698] ldusb 1-1:0.0: LD USB Device #0 now attached to major 180 minor 0
[ 104.046341][ T5840] ==================================================================
[ 104.046354][ T5840] BUG: KASAN: slab-use-after-free in dvb_device_open+0xc4/0x340
[ 104.046391][ T5840] Read of size 8 at addr ffff88802bc69218 by task syz.0.19/5840
[ 104.046404][ T5840]
[ 104.046418][ T5840] CPU: 1 UID: 0 PID: 5840 Comm: syz.0.19 Not tainted syzkaller #0 PREEMPT(full)
[ 104.046435][ T5840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 104.046451][ T5840] Call Trace:
[ 104.046459][ T5840]
[ 104.046466][ T5840] dump_stack_lvl+0xe8/0x150
[ 104.046489][ T5840] print_address_description+0x55/0x1e0
[ 104.046511][ T5840] ? dvb_device_open+0xc4/0x340
[ 104.046531][ T5840] print_report+0x58/0x70
[ 104.046550][ T5840] kasan_report+0x117/0x150
[ 104.046576][ T5840] ? dvb_device_open+0xc4/0x340
[ 104.046600][ T5840] dvb_device_open+0xc4/0x340
[ 104.046620][ T5840] ? do_raw_spin_unlock+0xf5/0x200
[ 104.046644][ T5840] chrdev_open+0x4d9/0x600
[ 104.046674][ T5840] ? __pfx_chrdev_open+0x10/0x10
[ 104.046690][ T5840] ? fsnotify_open_perm_and_set_mode+0x135/0x6b0
[ 104.046709][ T5840] ? __pfx_chrdev_open+0x10/0x10
[ 104.046724][ T5840] do_dentry_open+0x816/0x1380
[ 104.046746][ T5840] vfs_open+0x3b/0x340
[ 104.046762][ T5840] ? path_openat+0x1428/0x1d60
[ 104.046777][ T5840] path_openat+0x1443/0x1d60
[ 104.046797][ T5840] do_file_open+0x23e/0x4a0
[ 104.046813][ T5840] ? __pfx_do_file_open+0x10/0x10
[ 104.046834][ T5840] ? _raw_spin_unlock+0x28/0x50
[ 104.046856][ T5840] ? alloc_fd+0x651/0x6c0
[ 104.046879][ T5840] do_sys_openat2+0x115/0x200
[ 104.046898][ T5840] ? __pfx_do_sys_openat2+0x10/0x10
[ 104.046920][ T5840] __ia32_compat_sys_openat+0x131/0x160
[ 104.046942][ T5840] do_int80_emulation+0x198/0x500
[ 104.046958][ T5840] ? asm_int80_emulation+0x1a/0x20
[ 104.046973][ T5840] ? clear_bhb_loop+0x70/0xc0
[ 104.046988][ T5840] ? clear_bhb_loop+0x70/0xc0
[ 104.047004][ T5840] asm_int80_emulation+0x1a/0x20
[ 104.047018][ T5840] RIP: 0023:0xf71a75ab
[ 104.047033][ T5840] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53
[ 104.047046][ T5840] RSP: 002b:00000000ffbf60ac EFLAGS: 00000246 ORIG_RAX: 0000000000000127
[ 104.047066][ T5840] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000ffbf6170
[ 104.047079][ T5840] RDX: 0000000000040402 RSI: 0000000000000000 RDI: 0000000000000000
[ 104.047088][ T5840] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 104.047096][ T5840] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
[ 104.047106][ T5840] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 104.047121][ T5840]
[ 104.047126][ T5840]
[ 104.047130][ T5840] Allocated by task 1:
[ 104.047137][ T5840] kasan_save_track+0x3e/0x80
[ 104.047151][ T5840] __kasan_kmalloc+0x93/0xb0
[ 104.047165][ T5840] __kmalloc_cache_noprof+0x321/0x600
[ 104.047178][ T5840] dvb_register_device+0x309/0x1dd0
[ 104.047195][ T5840] dvb_register_frontend+0x603/0x900
[ 104.047211][ T5840] vidtv_bridge_probe+0x9d5/0xf60
[ 104.047233][ T5840] platform_probe+0xf9/0x190
[ 104.047245][ T5840] really_probe+0x254/0xae0
[ 104.047260][ T5840] __driver_probe_device+0x1e8/0x360
[ 104.047274][ T5840] driver_probe_device+0x4f/0x240
[ 104.047289][ T5840] __driver_attach+0x339/0x600
[ 104.047303][ T5840] bus_for_each_dev+0x23b/0x2c0
[ 104.047322][ T5840] bus_add_driver+0x345/0x670
[ 104.047340][ T5840] driver_register+0x23a/0x320
[ 104.047356][ T5840] vidtv_bridge_init+0x3d/0x60
[ 104.047374][ T5840] do_one_initcall+0x250/0x870
[ 104.047393][ T5840] do_initcall_level+0x10a/0x1a0
[ 104.047406][ T5840] do_initcalls+0x59/0xa0
[ 104.047418][ T5840] kernel_init_freeable+0x29d/0x3e0
[ 104.047430][ T5840] kernel_init+0x22/0x1d0
[ 104.047447][ T5840] ret_from_fork+0x514/0xb70
[ 104.047459][ T5840] ret_from_fork_asm+0x1a/0x30
[ 104.047479][ T5840]
[ 104.047483][ T5840] Freed by task 5839:
[ 104.047489][ T5840] kasan_save_track+0x3e/0x80
[ 104.047502][ T5840] kasan_save_free_info+0x40/0x50
[ 104.047521][ T5840] __kasan_slab_free+0x5c/0x80
[ 104.047535][ T5840] kfree+0x1c5/0x650
[ 104.047553][ T5840] dvb_device_open+0x2b8/0x340
[ 104.047577][ T5840] chrdev_open+0x4d9/0x600
[ 104.047590][ T5840] do_dentry_open+0x816/0x1380
[ 104.047605][ T5840] vfs_open+0x3b/0x340
[ 104.047620][ T5840] path_openat+0x1443/0x1d60
[ 104.047631][ T5840] do_file_open+0x23e/0x4a0
[ 104.047643][ T5840] do_sys_openat2+0x115/0x200
[ 104.047659][ T5840] __ia32_compat_sys_openat+0x131/0x160
[ 104.047676][ T5840] do_int80_emulation+0x198/0x500
[ 104.047691][ T5840] asm_int80_emulation+0x1a/0x20
[ 104.047704][ T5840]
[ 104.047708][ T5840] The buggy address belongs to the object at ffff88802bc69200
[ 104.047708][ T5840] which belongs to the cache kmalloc-256 of size 256
[ 104.047720][ T5840] The buggy address is located 24 bytes inside of
[ 104.047720][ T5840] freed 256-byte region [ffff88802bc69200, ffff88802bc69300)
[ 104.047734][ T5840]
[ 104.047738][ T5840] The buggy address belongs to the physical page:
[ 104.047749][ T5840] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2bc68
[ 104.047762][ T5840] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 104.047774][ T5840] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 104.047792][ T5840] page_type: f5(slab)
[ 104.047805][ T5840] raw: 00fff00000000040 ffff88801b041b40 dead000000000100 dead000000000122
[ 104.047818][ T5840] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 104.047831][ T5840] head: 00fff00000000040 ffff88801b041b40 dead000000000100 dead000000000122
[ 104.047843][ T5840] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 104.047856][ T5840] head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
[ 104.047868][ T5840] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[ 104.047875][ T5840] page dumped because: kasan: bad access detected
[ 104.047885][ T5840] page_owner tracks the page as allocated
[ 104.047891][ T5840] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 17194007772
[ 104.047913][ T5840] post_alloc_hook+0x1f9/0x250
[ 104.047933][ T5840] get_page_from_freelist+0x2209/0x2280
[ 104.047947][ T5840] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 104.047961][ T5840] allocate_slab+0x7d/0x620
[ 104.047977][ T5840] refill_objects+0x2d5/0x350
[ 104.047995][ T5840] __pcs_replace_empty_main+0x2c8/0x6c0
[ 104.048011][ T5840] __kmalloc_cache_noprof+0x39b/0x600
[ 104.048023][ T5840] bus_add_driver+0x162/0x670
[ 104.048041][ T5840] driver_register+0x23a/0x320
[ 104.048057][ T5840] usb_register_driver+0x1e4/0x390
[ 104.048077][ T5840] do_one_initcall+0x250/0x870
[ 104.048096][ T5840] do_initcall_level+0x10a/0x1a0
[ 104.048109][ T5840] do_initcalls+0x59/0xa0
[ 104.048121][ T5840] kernel_init_freeable+0x29d/0x3e0
[ 104.048134][ T5840] kernel_init+0x22/0x1d0
[ 104.048150][ T5840] ret_from_fork+0x514/0xb70
[ 104.048161][ T5840] page_owner free stack trace missing
[ 104.048166][ T5840]
[ 104.048170][ T5840] Memory state around the buggy address:
[ 104.048177][ T5840] ffff88802bc69100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 104.048186][ T5840] ffff88802bc69180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 104.048196][ T5840] >ffff88802bc69200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 104.048203][ T5840] ^
[ 104.048210][ T5840] ffff88802bc69280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 104.048219][ T5840] ffff88802bc69300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 104.048226][ T5840] ==================================================================
[ 104.048273][ T5840] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 104.797710][ T5840] CPU: 1 UID: 0 PID: 5840 Comm: syz.0.19 Not tainted syzkaller #0 PREEMPT(full)
[ 104.806830][ T5840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 104.816895][ T5840] Call Trace:
[ 104.820180][ T5840]
[ 104.823134][ T5840] vpanic+0x56d/0xa60
[ 104.827132][ T5840] ? __pfx_vpanic+0x10/0x10
[ 104.831650][ T5840] panic+0xc5/0xd0
[ 104.835393][ T5840] ? __pfx_panic+0x10/0x10
[ 104.839823][ T5840] ? dvb_device_open+0xc4/0x340
[ 104.844698][ T5840] ? dvb_device_open+0xc4/0x340
[ 104.849573][ T5840] check_panic_on_warn+0x89/0xb0
[ 104.854565][ T5840] ? dvb_device_open+0xc4/0x340
[ 104.859456][ T5840] end_report+0x73/0x170
[ 104.863717][ T5840] ? dvb_device_open+0xc4/0x340
[ 104.868582][ T5840] kasan_report+0x128/0x150
[ 104.873101][ T5840] ? dvb_device_open+0xc4/0x340
[ 104.877999][ T5840] dvb_device_open+0xc4/0x340
[ 104.882690][ T5840] ? do_raw_spin_unlock+0xf5/0x200
[ 104.887820][ T5840] chrdev_open+0x4d9/0x600
[ 104.892268][ T5840] ? __pfx_chrdev_open+0x10/0x10
[ 104.897227][ T5840] ? fsnotify_open_perm_and_set_mod