Warning: Permanently added '10.128.1.74' (ED25519) to the list of known hosts. 1970/01/01 00:00:30 parsed 1 programs 1970/01/01 00:00:30 serving rpc on tcp://37229 [ 31.234659][ T4720] cgroup: Unknown subsys name 'net' [ 31.364980][ T4720] cgroup: Unknown subsys name 'cpuset' [ 31.366921][ T4720] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 31.533275][ T4720] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 34.946319][ T4729] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 35.309468][ T4753] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 35.310007][ T4753] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 35.310160][ T4753] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 35.310467][ T4753] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 35.310675][ T4753] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 35.627180][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 35.628549][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 35.636620][ T15] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 35.636649][ T15] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 36.158644][ T4786] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.159093][ T4786] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.159179][ T4786] bridge_slave_0: entered allmulticast mode [ 36.159648][ T4786] bridge_slave_0: entered promiscuous mode [ 36.161219][ T4786] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.161271][ T4786] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.161335][ T4786] bridge_slave_1: entered allmulticast mode [ 36.161740][ T4786] bridge_slave_1: entered promiscuous mode [ 36.172402][ T4786] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 36.173875][ T4786] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 36.180082][ T4786] team0: Port device team_slave_0 added [ 36.181024][ T4786] team0: Port device team_slave_1 added [ 36.187256][ T4786] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 36.187280][ T4786] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 36.187291][ T4786] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 36.188111][ T4786] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 36.188119][ T4786] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 36.188133][ T4786] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 36.198210][ T4786] hsr_slave_0: entered promiscuous mode [ 36.198541][ T4786] hsr_slave_1: entered promiscuous mode [ 36.288898][ T4786] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 36.292040][ T4786] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 36.292554][ T4786] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 36.295137][ T4786] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 36.295433][ T4786] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 36.301556][ T4786] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 36.302947][ T4786] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 36.307054][ T4786] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 36.338364][ T4786] 8021q: adding VLAN 0 to HW filter on device bond0 [ 36.345531][ T4786] 8021q: adding VLAN 0 to HW filter on device team0 [ 36.354030][ T15] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.354096][ T15] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.358070][ T15] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.358110][ T15] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.460615][ T4786] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 36.472577][ T4786] veth0_vlan: entered promiscuous mode [ 36.476437][ T4786] veth1_vlan: entered promiscuous mode [ 36.485340][ T4786] veth0_macvtap: entered promiscuous mode [ 36.487698][ T4786] veth1_macvtap: entered promiscuous mode [ 36.491710][ T4786] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 36.492784][ T4786] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 36.496647][ T1195] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.498363][ T1195] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.508187][ T1195] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.510824][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.588937][ T1864] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 36.657940][ T1864] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 36.746442][ T1864] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 1970/01/01 00:00:36 executed programs: 0 [ 36.765919][ T4753] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 36.766308][ T4753] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 36.766474][ T4753] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 36.766783][ T4753] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 36.767000][ T4753] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 36.808590][ T1864] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 36.898324][ T4828] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.898415][ T4828] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.898467][ T4828] bridge_slave_0: entered allmulticast mode [ 36.898945][ T4828] bridge_slave_0: entered promiscuous mode [ 36.900113][ T4828] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.900142][ T4828] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.900194][ T4828] bridge_slave_1: entered allmulticast mode [ 36.900632][ T4828] bridge_slave_1: entered promiscuous mode [ 36.910385][ T4828] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 36.911270][ T4828] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 36.918266][ T4828] team0: Port device team_slave_0 added [ 36.918994][ T4828] team0: Port device team_slave_1 added [ 36.926244][ T4828] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 36.926266][ T4828] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 36.926281][ T4828] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 36.927237][ T4828] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 36.927244][ T4828] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 36.927259][ T4828] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 36.936848][ T4828] hsr_slave_0: entered promiscuous mode [ 36.937118][ T4828] hsr_slave_1: entered promiscuous mode [ 36.937315][ T4828] debugfs: 'hsr0' already exists in 'hsr' [ 36.937366][ T4828] Cannot create hsr debugfs directory [ 38.813597][ T4737] Bluetooth: hci0: command tx timeout [ 39.742810][ T1864] bridge_slave_1: left allmulticast mode [ 39.744233][ T1864] bridge_slave_1: left promiscuous mode [ 39.746071][ T1864] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.749405][ T1864] bridge_slave_0: left allmulticast mode [ 39.750542][ T1864] bridge_slave_0: left promiscuous mode [ 39.750792][ T1864] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.807878][ T1864] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 39.811579][ T1864] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 39.815929][ T1864] bond0 (unregistering): Released all slaves [ 39.866902][ T1864] hsr_slave_0: left promiscuous mode [ 39.867976][ T1864] hsr_slave_1: left promiscuous mode [ 39.868229][ T1864] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 39.868244][ T1864] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 39.871909][ T1864] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 39.873324][ T1864] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 39.878189][ T1864] veth1_macvtap: left promiscuous mode [ 39.879200][ T1864] veth0_macvtap: left promiscuous mode [ 39.880186][ T1864] veth1_vlan: left promiscuous mode [ 39.881175][ T1864] veth0_vlan: left promiscuous mode [ 39.976510][ T1864] team0 (unregistering): Port device team_slave_1 removed [ 39.980339][ T1864] team0 (unregistering): Port device team_slave_0 removed [ 40.035821][ T4399] 8021q: adding VLAN 0 to HW filter on device eth0 [ 40.305333][ T4828] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 40.307846][ T4828] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 40.309560][ T4828] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 40.312193][ T4828] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 40.314053][ T4828] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 40.316377][ T4828] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 40.316730][ T4828] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 40.321532][ T4828] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 40.352309][ T4828] 8021q: adding VLAN 0 to HW filter on device bond0 [ 40.364919][ T4828] 8021q: adding VLAN 0 to HW filter on device team0 [ 40.375530][ T15] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.375579][ T15] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.376102][ T15] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.376129][ T15] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.514342][ T4828] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 40.527444][ T4828] veth0_vlan: entered promiscuous mode [ 40.529335][ T4828] veth1_vlan: entered promiscuous mode [ 40.545001][ T4828] veth0_macvtap: entered promiscuous mode [ 40.546094][ T4828] veth1_macvtap: entered promiscuous mode [ 40.549256][ T4828] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.550356][ T4828] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.554284][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.555824][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.555875][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.560399][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.579620][ T1864] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.579651][ T1864] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.587016][ T1864] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.587043][ T1864] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.624971][ T4924] =============================================== ** replaying previous printk message ** [ 40.624971][ T4924] ================================================================== [ 40.624988][ T4924] BUG: KASAN: slab-use-after-free in dvb_device_open+0xd0/0x254 [ 40.625012][ T4924] Read of size 8 at addr ffff0000cbfd1a18 by task syz.0.19/4924 [ 40.625021][ T4924] [ 40.625026][ T4924] CPU: 1 UID: 0 PID: 4924 Comm: syz.0.19 Not tainted syzkaller #0 PREEMPT [ 40.625034][ T4924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 [ 40.625039][ T4924] Call trace: [ 40.625041][ T4924] show_stack+0x2c/0x3c (C) [ 40.625056][ T4924] __dump_stack+0x30/0x40 [ 40.625067][ T4924] dump_stack_lvl+0xd8/0x12c [ 40.625076][ T4924] print_address_description+0xb0/0x238 [ 40.625084][ T4924] print_report+0x68/0x84 [ 40.625091][ T4924] kasan_report+0x8c/0xc4 [ 40.625101][ T4924] __asan_report_load8_noabort+0x20/0x2c [ 40.625110][ T4924] dvb_device_open+0xd0/0x254 [ 40.625120][ T4924] chrdev_open+0x398/0x3e8 [ 40.625128][ T4924] do_dentry_open+0x5c4/0xfc0 [ 40.625137][ T4924] vfs_open+0x44/0x2dc [ 40.625146][ T4924] path_openat+0x21fc/0x2a60 [ 40.625154][ T4924] do_file_open+0x1c8/0x2e8 [ 40.625161][ T4924] do_sys_openat2+0x114/0x1e8 [ 40.625171][ T4924] do_sys_open+0xb0/0xe0 [ 40.625179][ T4924] __arm64_sys_openat+0xa0/0xbc [ 40.625189][ T4924] invoke_syscall+0x98/0x244 [ 40.625198][ T4924] el0_svc_common+0xec/0x23c [ 40.625207][ T4924] do_el0_svc+0x4c/0x5c [ 40.625216][ T4924] el0_svc+0x64/0x260 [ 40.625226][ T4924] el0t_64_sync_handler+0x48/0x148 [ 40.625234][ T4924] el0t_64_sync+0x198/0x19c [ 40.625242][ T4924] [ 40.625243][ T4924] Allocated by task 1: [ 40.625247][ T4924] kasan_save_track+0x40/0x78 [ 40.625254][ T4924] kasan_save_alloc_info+0x44/0x54 [ 40.625262][ T4924] __kasan_kmalloc+0x9c/0xb4 [ 40.625268][ T4924] __kmalloc_cache_noprof+0x2e8/0x5ec [ 40.625275][ T4924] dvb_register_device+0x1a4/0x16e0 [ 40.625283][ T4924] dvb_register_frontend+0x474/0x6d0 [ 40.625290][ T4924] vidtv_bridge_probe+0x5a4/0xa58 [ 40.625298][ T4924] platform_probe+0x100/0x1a4 [ 40.625304][ T4924] really_probe+0x29c/0x800 [ 40.625311][ T4924] __driver_probe_device+0x1e0/0x350 [ 40.625318][ T4924] driver_probe_device+0x6c/0x19c [ 40.625325][ T4924] __driver_attach+0x168/0x384 [ 40.625332][ T4924] bus_for_each_dev+0x128/0x1b4 [ 40.625338][ T4924] driver_attach+0x50/0x60 [ 40.625345][ T4924] bus_add_driver+0x208/0x500 [ 40.625351][ T4924] driver_register+0x220/0x310 [ 40.625358][ T4924] __platform_driver_register+0x90/0xa4 [ 40.625367][ T4924] vidtv_bridge_init+0x4c/0x74 [ 40.625376][ T4924] do_one_initcall+0x274/0xc38 [ 40.625384][ T4924] do_initcall_level+0x12c/0x1c4 [ 40.625390][ T4924] do_initcalls+0x70/0xd0 [ 40.625395][ T4924] do_basic_setup+0x7c/0x90 [ 40.625401][ T4924] kernel_init_freeable+0x268/0x3a8 [ 40.625406][ T4924] kernel_init+0x24/0x1dc [ 40.625415][ T4924] ret_from_fork+0x10/0x20 [ 40.625422][ T4924] [ 40.625423][ T4924] Freed by task 4923: [ 40.625427][ T4924] kasan_save_track+0x40/0x78 [ 40.625433][ T4924] kasan_save_free_info+0x58/0x70 [ 40.625441][ T4924] __kasan_slab_free+0x74/0xa4 [ 40.625448][ T4924] kfree+0x188/0x690 [ 40.625453][ T4924] dvb_device_put+0x64/0xd0 [ 40.625461][ T4924] dvb_device_open+0x23c/0x254 [ 40.625469][ T4924] chrdev_open+0x398/0x3e8 [ 40.625476][ T4924] do_dentry_open+0x5c4/0xfc0 [ 40.625484][ T4924] vfs_open+0x44/0x2dc [ 40.625491][ T4924] path_openat+0x21fc/0x2a60 [ 40.625497][ T4924] do_file_open+0x1c8/0x2e8 [ 40.625504][ T4924] do_sys_openat2+0x114/0x1e8 [ 40.625511][ T4924] do_sys_open+0xb0/0xe0 [ 40.625519][ T4924] __arm64_sys_openat+0xa0/0xbc [ 40.625526][ T4924] invoke_syscall+0x98/0x244 [ 40.625534][ T4924] el0_svc_common+0xec/0x23c [ 40.625542][ T4924] do_el0_svc+0x4c/0x5c [ 40.625550][ T4924] el0_svc+0x64/0x260 [ 40.625556][ T4924] el0t_64_sync_handler+0x48/0x148 [ 40.625563][ T4924] el0t_64_sync+0x198/0x19c [ 40.625568][ T4924] [ 40.625570][ T4924] The buggy address belongs to the object at ffff0000cbfd1a00 [ 40.625570][ T4924] which belongs to the cache kmalloc-256 of size 256 [ 40.625575][ T4924] The buggy address is located 24 bytes inside of [ 40.625575][ T4924] freed 256-byte region [ffff0000cbfd1a00, ffff0000cbfd1b00) [ 40.625582][ T4924] [ 40.625588][ T4924] The buggy address belongs to the physical page: [ 40.625592][ T4924] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10bfd0 [ 40.625599][ T4924] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 40.625604][ T4924] flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 40.625612][ T4924] page_type: f5(slab) [ 40.625619][ T4924] raw: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122 [ 40.625625][ T4924] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 40.625631][ T4924] head: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122 [ 40.625636][ T4924] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 40.625642][ T4924] head: 05ffc00000000001 fffffdffc32ff401 00000000ffffffff 00000000ffffffff [ 40.625647][ T4924] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 40.625650][ T4924] page dumped because: kasan: bad access detected [ 40.625653][ T4924] [ 40.625655][ T4924] Memory state around the buggy address: [ 40.625658][ T4924] ffff0000cbfd1900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.625662][ T4924] ffff0000cbfd1980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.625667][ T4924] >ffff0000cbfd1a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.625670][ T4924] ^ [ 40.625673][ T4924] ffff0000cbfd1a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.625677][ T4924] ffff0000cbfd1b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.625681][ T4924] ================================================================== [ 40.626648][ T4924] Disabling lock debugging due to kernel taint [ 40.626664][ T4924] ------------[ cut here ]------------ [ 40.626677][ T4924] refcount_t: addition on 0; use-after-free. [ 40.626788][ T4924] WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x134/0x1f8, CPU#1: syz.0.19/4924 [ 40.717490][ T4924] Modules linked in: [ 40.718123][ T4924] CPU: 1 UID: 0 PID: 4924 Comm: syz.0.19 Tainted: G B syzkaller #0 PREEMPT [ 40.719744][ T4924] Tainted: [B]=BAD_PAGE [ 40.720371][ T4924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 [ 40.721893][ T4924] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 40.723023][ T4924] pc : refcount_warn_saturate+0x134/0x1f8 [ 40.723958][ T4924] lr : refcount_warn_saturate+0x134/0x1f8 [ 40.724929][ T4924] sp : ffff80009bec7640 [ 40.725578][ T4924] x29: ffff80009bec7640 x28: dfff800000000000 x27: 1fffe0001a198601 [ 40.726918][ T4924] x26: dfff800000000000 x25: ffff7000137d8edc x24: dfff800000000000 [ 40.728160][ T4924] x23: ffff80008742cca8 x22: ffff0000cba8cc00 x21: ffff0000cbfd1a00 [ 40.729317][ T4924] x20: ffff0000cbfd1a10 x19: ffff80008a116000 x18: 1fffe00035bd2e28 [ 40.730558][ T4924] x17: 0000000000000003 x16: ffff800088ac7000 x15: 0000000000000000 [ 40.731749][ T4924] x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000000 [ 40.733076][ T4924] x11: 0000000000000000 x10: 0000000000000002 x9 : 93854f00a1ed2d00 [ 40.734305][ T4924] x8 : 93854f00a1ed2d00 x7 : 0000000000000000 x6 : ffff80008048ce60 [ 40.735579][ T4924] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f7010 [ 40.736779][ T4924] x2 : 0000000100000000 x1 : ffff0000c69f3a80 x0 : 0000000000000000 [ 40.738107][ T4924] Call trace: [ 40.738621][ T4924] refcount_warn_saturate+0x134/0x1f8 (P) [ 40.739592][ T4924] dvb_device_get+0x9c/0xc0 [ 40.740330][ T4924] dvb_device_open+0x100/0x254 [ 40.741198][ T4924] chrdev_open+0x398/0x3e8 [ 40.741868][ T4924] do_dentry_open+0x5c4/0xfc0 [ 40.742617][ T4924] vfs_open+0x44/0x2dc [ 40.743294][ T4924] path_openat+0x21fc/0x2a60 [ 40.744113][ T4924] do_file_open+0x1c8/0x2e8 [ 40.744841][ T4924] do_sys_openat2+0x114/0x1e8 [ 40.745562][ T4924] do_sys_open+0xb0/0xe0 [ 40.746262][ T4924] __arm64_sys_openat+0xa0/0xbc [ 40.747031][ T4924] invoke_syscall+0x98/0x244 [ 40.747757][ T4924] el0_svc_common+0xec/0x23c [ 40.748556][ T4924] do_el0_svc+0x4c/0x5c [ 40.749236][ T4924] el0_svc+0x64/0x260 [ 40.749826][ T4924] el0t_64_sync_handler+0x48/0x148 [ 40.750574][ T4924] el0t_64_sync+0x198/0x19c [ 40.751281][ T4924] irq event stamp: 999 [ 40.751911][ T4924] hardirqs last enabled at (999): [] finish_task_switch+0x234/0x858 [ 40.753443][ T4924] hardirqs last disabled at (998): [] __schedule+0x2f8/0x2d80 [ 40.754900][ T4924] softirqs last enabled at (964): [] fpsimd_restore_current_state+0x39c/0x9c8 [ 40.756571][ T4924] softirqs last disabled at (962): [] fpsimd_restore_current_state+0x44/0x9c8 [ 40.758198][ T4924] ---[ end trace 0000000000000000 ]--- [ ** replaying previous printk message ** [ 40.761611][ T4924] ------------[ cut here ]------------ [ 40.761640][ T4924] refcount_t: underflow; use-after-free. [ 40.761751][ T4924] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x154/0x1f8, CPU#1: syz.0.19/4924 [ 40.765340][ T4924] Modules linked in: [ 40.765905][ T4924] CPU: 1 UID: 0 PID: 4924 Comm: syz.0.19 Tainted: G B W syzkaller #0 PREEMPT [ 40.767456][ T4924] Tainted: [B]=BAD_PAGE, [W]=WARN [ 40.768221][ T4924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 [ 40.769804][ T4924] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 40.771129][ T4924] pc : refcount_warn_saturate+0x154/0x1f8 [ 40.772023][ T4924] lr : refcount_warn_saturate+0x154/0x1f8 [ 40.772956][ T4924] sp : ffff80009bec7540 [ 40.773658][ T4924] x29: ffff80009bec7540 x28: ffff0000d0cc2fc0 x27: ffff0000cb6b4010 [ 40.774930][ T4924] x26: dfff800000000000 x25: 1fffe000197fa347 x24: ffff0000cb6b4060 [ 40.776177][ T4924] x23: 00000000fffffffc x22: ffff0000cbfd1a3c x21: 00000000c0000000 [ 40.777555][ T4924] x20: ffff0000cbfd1a10 x19: ffff80008a116000 x18: 1fffe00035bd2e28 [ 40.778897][ T4924] x17: 0000000000000003 x16: ffff800088ac7000 x15: 0000000000000000 [ 40.780209][ T4924] x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000000 [ 40.781525][ T4924] x11: 0000000000000000 x10: 0000000000000002 x9 : 93854f00a1ed2d00 [ 40.782750][ T4924] x8 : 93854f00a1ed2d00 x7 : 0000000000000000 x6 : ffff80008048ce60 [ 40.783996][ T4924] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f7010 [ 40.785220][ T4924] x2 : 0000000100000000 x1 : ffff0000c69f3a80 x0 : 0000000000000000 [ 40.786554][ T4924] Call trace: [ 40.787140][ T4924] refcount_warn_saturate+0x154/0x1f8 (P) [ 40.788113][ T4924] dvb_device_put+0xac/0xd0 [ 40.788829][ T4924] dvb_generic_release+0xec/0x158 [ 40.789676][ T4924] dvb_frontend_open+0x9cc/0x10a8 [ 40.790451][ T4924] dvb_device_open+0x1f8/0x254 [ 40.791168][ T4924] chrdev_open+0x398/0x3e8 [ 40.791890][ T4924] do_dentry_open+0x5c4/0xfc0 [ 40.792653][ T4924] vfs_open+0x44/0x2dc [ 40.793280][ T4924] path_openat+0x21fc/0x2a60 [ 40.794043][ T4924] do_file_open+0x1c8/0x2e8 [ 40.794808][ T4924] do_sys_openat2+0x114/0x1e8 [ 40.795533][ T4924] do_sys_open+0xb0/0xe0 [ 40.796205][ T4924] __arm64_sys_openat+0xa0/0xbc [ 40.797042][ T4924] invoke_syscall+0x98/0x244 [ 40.797780][ T4924] el0_svc_common+0xec/0x23c [ 40.798533][ T4924] do_el0_svc+0x4c/0x5c [ 40.799075][ T4924] el0_svc+0x64/0x260 [ 40.799732][ T4924] el0t_64_sync_handler+0x48/0x148 [ 40.800597][ T4924] el0t_64_sync+0x198/0x19c [ 40.801271][ T4924] irq event stamp: 999 [ 40.801819][ T4924] hardirqs last enabled at (999): [] finish_task_switch+0x234/0x858 [ 40.803346][ T4924] hardirqs last disabled at (998): [] __schedule+0x2f8/0x2d80 [ 40.804981][ T4924] softirqs last enabled at (964): [] fpsimd_restore_current_state+0x39c/0x9c8 [ 40.806687][ T4924] softirqs last disabled at (962): [] fpsimd_restore_current_state+0x44/0x9c8 [ 40.808340][ T4924] ---[ end trace 0000000000000000 ]--- [ 40.817054 ** replaying previous printk message ** [ 40.817054][ T4925] ------------[ cut here ]------------ [ 40.817079][ T4925] refcount_t: saturated; leaking memory. [ 40.817324][ T4925] WARNING: lib/refcount.c:22 at refcount_warn_saturate+0x1b4/0x1f8, CPU#0: syz.0.20/4925 [ 40.820725][ T4925] Modules linked in: [ 40.821142][ T4925] CPU: 0 UID: 0 PID: 4925 Comm: syz.0.20 Tainted: G B W syzkaller #0 PREEMPT [ 40.822319][ T4925] Tainted: [B]=BAD_PAGE, [W]=WARN [ 40.822967][ T4925] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 [ 40.824511][ T4925] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 40.825748][ T4925] pc : refcount_warn_saturate+0x1b4/0x1f8 [ 40.826635][ T4925] lr : refcount_warn_saturate+0x1b4/0x1f8 [ 40.827468][ T4925] sp : ffff800099b97640 [ 40.828044][ T4925] x29: ffff800099b97640 x28: dfff800000000000 x27: 1fffe00019f968e9 [ 40.829410][ T4925] x26: dfff800000000000 x25: ffff700013372edc x24: dfff800000000000 [ 40.830628][ T4925] x23: ffff80008742cca8 x22: ffff0000cba8cc00 x21: 000000007ffffffe [ 40.831942][ T4925] x20: ffff0000cbfd1a10 x19: ffff80008a116000 x18: 1fffe00035bce428 [ 40.833242][ T4925] x17: 0000000000000003 x16: ffff800088ac7000 x15: 0000000000000000 [ 40.834545][ T4925] x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000000 [ 40.835773][ T4925] x11: ffff800080156e90 x10: 0000000000000003 x9 : e7e6169bfb57da00 [ 40.837262][ T4925] x8 : e7e6169bfb57da00 x7 : 0000000000000000 x6 : ffff8000803b7898 [ 40.838623][ T4925] x5 : 0000000000000000 x4 : 0000000000000008 x3 : ffff800080156f38 [ 40.839949][ T4925] x2 : 0000000000000000 x1 : ffff0000c7769d40 x0 : 0000000000000001 [ 40.841199][ T4925] Call trace: [ 40.841686][ T4925] refcount_warn_saturate+0x1b4/0x1f8 (P) [ 40.842591][ T4925] dvb_device_get+0x9c/0xc0 [ 40.843235][ T4925] dvb_device_open+0x100/0x254 [ 40.843964][ T4925] chrdev_open+0x398/0x3e8 [ 40.844709][ T4925] do_dentry_open+0x5c4/0xfc0 [ 40.845517][ T4925] vfs_open+0x44/0x2dc [ 40.846219][ T4925] path_openat+0x21fc/0x2a60 [ 40.847010][ T4925] do_file_open+0x1c8/0x2e8 [ 40.847704][ T4925] do_sys_openat2+0x114/0x1e8 [ 40.848425][ T4925] do_sys_open+0xb0/0xe0 [ 40.849103][ T4925] __arm64_sys_openat+0xa0/0xbc [ 40.849898][ T4925] invoke_syscall+0x98/0x244 [ 40.850677][ T4925] el0_svc_common+0xec/0x23c [ 40.851352][ T4925] do_el0_svc+0x4c/0x5c [ 40.852051][ T4925] el0_svc+0x64/0x260 [ 40.852719][ T4925] el0t_64_sync_handler+0x48/0x148 [ 40.853487][ T4925] el0t_64_sync+0x198/0x19c [ 40.854204][ T4925] irq event stamp: 0 [ 40.854867][ T4925] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 40.856063][ T4925] hardirqs last disabled at (0): [] copy_process+0x1384/0x3320 [ 40.857606][ T4925] softirqs last enabled at (0): [] copy_process+0x13a4/0x3320 [ 40.859074][ T4925] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 40.860180][ T4925] ---[ end trace 0000000000000000 ]--- [ 40.893276][ T4737] Bluetooth: hci0: command tx timeout 1970/01/01 00:00:41 executed programs: 54 [ 42.973136][ T4737] Bluetooth: hci0: command tx timeout [ 45.053214][ T4737] Bluetooth: hci0: command tx timeout 1970/01/01 00:00:46 executed programs: 342