Warning: Permanently added '10.128.0.97' (ED25519) to the list of known hosts. 1970/01/01 00:00:31 parsed 1 programs 1970/01/01 00:00:31 serving rpc on tcp://40753 [ 32.071666][ T4340] cgroup: Unknown subsys name 'net' [ 32.374119][ T4340] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 32.655415][ T4340] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 38.532152][ T4383] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 38.533692][ T4383] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 38.535012][ T4383] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 38.536373][ T4383] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 38.537803][ T4383] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 38.539076][ T4383] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 38.807314][ T4393] chnl_net:caif_netlink_parms(): no params data found [ 38.828075][ T4393] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.829479][ T4393] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.831132][ T4393] device bridge_slave_0 entered promiscuous mode [ 38.834185][ T4393] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.835467][ T4393] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.837025][ T4393] device bridge_slave_1 entered promiscuous mode [ 38.845192][ T4393] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.847915][ T4393] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.854726][ T4393] team0: Port device team_slave_0 added [ 38.856853][ T4393] team0: Port device team_slave_1 added [ 38.863766][ T4393] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.864908][ T4393] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 38.869027][ T4393] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.872040][ T4393] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.873191][ T4393] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 38.877543][ T4393] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.942537][ T4393] device hsr_slave_0 entered promiscuous mode [ 38.981605][ T4393] device hsr_slave_1 entered promiscuous mode [ 39.054900][ T4393] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 39.083205][ T4393] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 39.112420][ T4393] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 39.153266][ T4393] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 39.218345][ T4393] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.219718][ T4393] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.221286][ T4393] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.222572][ T4393] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.240183][ T4393] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.244022][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 39.246590][ T11] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.248520][ T11] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.256862][ T4393] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.260726][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 39.263213][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.264427][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.267120][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 39.268704][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.269816][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.276132][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 39.277805][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 39.280785][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 39.284744][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 39.288114][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 39.290847][ T4393] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 39.343027][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 39.344308][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 39.347832][ T4393] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.354406][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 39.360301][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 39.362415][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 39.363847][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 39.366255][ T4393] device veth0_vlan entered promiscuous mode [ 39.369406][ T4393] device veth1_vlan entered promiscuous mode [ 39.377858][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 39.379431][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 39.380932][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 39.384314][ T4393] device veth0_macvtap entered promiscuous mode [ 39.387166][ T4393] device veth1_macvtap entered promiscuous mode [ 39.393123][ T4393] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.394509][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 39.396117][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 39.398703][ T4393] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.399931][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 39.402070][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 39.404913][ T4393] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.406471][ T4393] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.407838][ T4393] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.409210][ T4393] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.599307][ T1577] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.600780][ T1577] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.608018][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 39.611228][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.612778][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.614090][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 1970/01/01 00:00:40 executed programs: 0 [ 40.037705][ T48] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 40.039327][ T48] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 40.040704][ T48] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 40.042857][ T48] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 40.044212][ T48] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 40.045505][ T48] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 40.344053][ T4448] chnl_net:caif_netlink_parms(): no params data found [ 40.359958][ T4448] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.361330][ T4448] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.363552][ T4448] device bridge_slave_0 entered promiscuous mode [ 40.365576][ T4448] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.366680][ T4448] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.368202][ T4448] device bridge_slave_1 entered promiscuous mode [ 40.374807][ T4448] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 40.377195][ T4448] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 40.384174][ T4448] team0: Port device team_slave_0 added [ 40.385864][ T4448] team0: Port device team_slave_1 added [ 40.391338][ T4448] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 40.393071][ T4448] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 40.397184][ T4448] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 40.400982][ T4448] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 40.402318][ T4448] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 40.406152][ T4448] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 40.462559][ T4448] device hsr_slave_0 entered promiscuous mode [ 40.501627][ T4448] device hsr_slave_1 entered promiscuous mode [ 40.541483][ T4448] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 40.542884][ T4448] Cannot create hsr debugfs directory [ 40.863661][ T662] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 42.092064][ T4383] Bluetooth: hci0: command 0x0409 tx timeout [ 43.602506][ T662] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.171683][ T4383] Bluetooth: hci0: command 0x041b tx timeout [ 45.273306][ T662] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 45.363211][ T662] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 46.251420][ T4383] Bluetooth: hci0: command 0x040f tx timeout [ 46.285100][ T4448] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 46.332492][ T4448] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 46.353064][ T4448] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 46.613159][ T4448] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 46.712453][ T4448] 8021q: adding VLAN 0 to HW filter on device bond0 [ 46.716035][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 46.717501][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 46.720006][ T4448] 8021q: adding VLAN 0 to HW filter on device team0 [ 46.754287][ T4456] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 46.756274][ T4456] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 46.757764][ T4456] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.758922][ T4456] bridge0: port 1(bridge_slave_0) entered forwarding state [ 46.760755][ T4456] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 46.763906][ T4456] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 46.765482][ T4456] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 46.766998][ T4456] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.768152][ T4456] bridge0: port 2(bridge_slave_1) entered forwarding state [ 46.771058][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 46.773985][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 46.776546][ T4456] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 46.780169][ T4456] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 46.782368][ T4456] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 46.785428][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 46.787050][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 46.789676][ T4456] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 46.791196][ T4456] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 46.834116][ T4456] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 46.835784][ T4456] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 46.838145][ T4448] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 46.967200][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 46.968547][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 46.972024][ T4448] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 46.977892][ T4456] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 46.979480][ T4456] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 46.985016][ T4456] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 46.986516][ T4456] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 46.988040][ T4456] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 46.989545][ T4456] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 46.991819][ T4448] device veth0_vlan entered promiscuous mode [ 46.995671][ T4448] device veth1_vlan entered promiscuous mode [ 47.033729][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 47.035328][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 47.036858][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 47.038443][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 47.041024][ T4448] device veth0_macvtap entered promiscuous mode [ 47.044423][ T4448] device veth1_macvtap entered promiscuous mode [ 47.049296][ T4448] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 47.050929][ T4448] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 47.053412][ T4448] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 47.054602][ T4456] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 47.056080][ T4456] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 47.057628][ T4456] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 47.059213][ T4456] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 47.061572][ T4448] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 47.063356][ T4448] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 47.065360][ T4448] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 47.066438][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 47.067971][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 47.070520][ T4448] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 47.072251][ T4448] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 47.073659][ T4448] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 47.075030][ T4448] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 47.151774][ T4456] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 47.154032][ T4456] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 47.155983][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 47.162919][ T4456] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 47.164137][ T4456] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 47.165469][ T4456] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 1970/01/01 00:00:47 executed programs: 2 [ 47.246940][ T4526] md: pers->run() failed ... [ 47.273849][ T4526] md: could not open device unknown-block(1,2). [ 47.286685][ T4529] md: could not open device unknown-block(1,0). [ 47.300545][ T4529] md/raid1:md0: active with 1 out of 4 mirrors [ 47.306321][ T4532] md: recovery of RAID array md0 [ 47.307392][ T4532] md: md0: recovery done. [ 47.332748][ T4533] md: recovery of RAID array md0 [ 47.332767][ T4529] md: could not open device unknown-block(1,2). [ 47.333613][ T4533] md: md0: recovery done. [ 47.344907][ T4534] md: could not open device unknown-block(1,0). [ 47.348370][ T4533] ================================================================== [ 47.349800][ T4533] BUG: KASAN: use-after-free in r1buf_pool_free+0x130/0x134 [ 47.350943][ T4533] Read of size 4 at addr ffff0000c3827c08 by task md0_resync/4533 [ 47.352201][ T4533] [ 47.352583][ T4533] CPU: 1 PID: 4533 Comm: md0_resync Not tainted syzkaller #0 [ 47.353797][ T4533] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 47.355478][ T4533] Call trace: [ 47.356045][ T4533] dump_backtrace+0x1c4/0x1f0 [ 47.356872][ T4533] show_stack+0x2c/0x3c [ 47.357542][ T4533] __dump_stack+0x30/0x40 [ 47.358285][ T4533] dump_stack_lvl+0xf4/0x15c [ 47.359034][ T4533] print_address_description+0x88/0x218 [ 47.359979][ T4533] print_report+0x50/0x68 [ 47.360736][ T4533] kasan_report+0xa8/0xfc [ 47.361460][ T4533] __asan_report_load4_noabort+0x2c/0x38 [ 47.362400][ T4533] r1buf_pool_free+0x130/0x134 [ 47.363178][ T4533] mempool_exit+0x190/0x290 [ 47.363907][ T4533] raid1_sync_request+0x328/0x26e4 [ 47.364758][ T4533] md_do_sync+0x2e18/0x36ec [ 47.365491][ T4533] md_thread+0x1e0/0x3cc [ 47.366188][ T4533] kthread+0x254/0x2e0 [ 47.366823][ T4533] ret_from_fork+0x10/0x20 [ 47.367526][ T4533] [ 47.367902][ T4533] Allocated by task 4529: [ 47.368605][ T4533] kasan_set_track+0x4c/0x80 [ 47.369371][ T4533] kasan_save_alloc_info+0x24/0x30 [ 47.370226][ T4533] __kasan_kmalloc+0xa0/0xb8 [ 47.370987][ T4533] kmalloc_trace+0x7c/0x94 [ 47.371727][ T4533] raid1_reshape+0x590/0x102c [ 47.372518][ T4533] chunk_size_store+0x1ec/0x358 [ 47.373304][ T4533] md_attr_store+0x168/0x234 [ 47.374092][ T4533] sysfs_kf_write+0x1f8/0x274 [ 47.374882][ T4533] kernfs_fop_write_iter+0x390/0x4b4 [ 47.375767][ T4533] vfs_write+0x3c8/0x7c8 [ 47.376436][ T4533] ksys_write+0x12c/0x228 [ 47.377148][ T4533] __arm64_sys_write+0x7c/0x90 [ 47.377925][ T4533] invoke_syscall+0x98/0x290 [ 47.378701][ T4533] el0_svc_common+0x13c/0x258 [ 47.379491][ T4533] do_el0_svc+0x5c/0x134 [ 47.380248][ T4533] el0_svc+0x58/0x128 [ 47.380931][ T4533] el0t_64_sync_handler+0x84/0xf0 [ 47.381769][ T4533] el0t_64_sync+0x18c/0x190 [ 47.382598][ T4533] [ 47.382955][ T4533] Freed by task 4534: [ 47.383595][ T4533] kasan_set_track+0x4c/0x80 [ 47.384340][ T4533] kasan_save_free_info+0x38/0x5c [ 47.385151][ T4533] ____kasan_slab_free+0x148/0x1b0 [ 47.386016][ T4533] __kasan_slab_free+0x18/0x28 [ 47.386810][ T4533] slab_free_freelist_hook+0x16c/0x1e8 [ 47.387716][ T4533] __kmem_cache_free+0xbc/0x21c [ 47.388527][ T4533] kfree+0xd0/0x1a8 [ 47.389166][ T4533] raid1_reshape+0xc74/0x102c [ 47.389916][ T4533] chunk_size_store+0x1ec/0x358 [ 47.390696][ T4533] md_attr_store+0x168/0x234 [ 47.391444][ T4533] sysfs_kf_write+0x1f8/0x274 [ 47.392198][ T4533] kernfs_fop_write_iter+0x390/0x4b4 [ 47.393060][ T4533] vfs_write+0x3c8/0x7c8 [ 47.393768][ T4533] ksys_write+0x12c/0x228 [ 47.394494][ T4533] __arm64_sys_write+0x7c/0x90 [ 47.395301][ T4533] invoke_syscall+0x98/0x290 [ 47.396114][ T4533] el0_svc_common+0x13c/0x258 [ 47.396942][ T4533] do_el0_svc+0x5c/0x134 [ 47.397660][ T4533] el0_svc+0x58/0x128 [ 47.398357][ T4533] el0t_64_sync_handler+0x84/0xf0 [ 47.399238][ T4533] el0t_64_sync+0x18c/0x190 [ 47.399958][ T4533] [ 47.400332][ T4533] Last potentially related work creation: [ 47.401246][ T4533] kasan_save_stack+0x40/0x70 [ 47.402037][ T4533] __kasan_record_aux_stack+0xc0/0xdc [ 47.402938][ T4533] kasan_record_aux_stack_noalloc+0x14/0x20 [ 47.403914][ T4533] kvfree_call_rcu+0xb4/0x6f0 [ 47.404683][ T4533] kernfs_unlink_open_file+0x370/0x41c [ 47.405580][ T4533] kernfs_fop_release+0x128/0x194 [ 47.406423][ T4533] __fput+0x1b4/0x7b0 [ 47.407116][ T4533] ____fput+0x20/0x30 [ 47.407810][ T4533] task_work_run+0x1f4/0x280 [ 47.408597][ T4533] do_notify_resume+0x20f8/0x2c84 [ 47.409447][ T4533] el0_svc+0x98/0x128 [ 47.410104][ T4533] el0t_64_sync_handler+0x84/0xf0 [ 47.410985][ T4533] el0t_64_sync+0x18c/0x190 [ 47.411773][ T4533] [ 47.412182][ T4533] The buggy address belongs to the object at ffff0000c3827c00 [ 47.412182][ T4533] which belongs to the cache kmalloc-128 of size 128 [ 47.414612][ T4533] The buggy address is located 8 bytes inside of [ 47.414612][ T4533] 128-byte region [ffff0000c3827c00, ffff0000c3827c80) [ 47.416736][ T4533] [ 47.417103][ T4533] The buggy address belongs to the physical page: [ 47.418107][ T4533] page:0000000024334aca refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103827 [ 47.419756][ T4533] flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff) [ 47.421010][ T4533] raw: 05ffc00000000200 fffffc0003103640 dead000000000004 ffff0000c0002300 [ 47.422381][ T4533] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 47.423758][ T4533] page dumped because: kasan: bad access detected [ 47.424773][ T4533] [ 47.425135][ T4533] Memory state around the buggy address: [ 47.426017][ T4533] ffff0000c3827b00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 47.427286][ T4533] ffff0000c3827b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 47.428547][ T4533] >ffff0000c3827c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 47.429838][ T4533] ^ [ 47.430530][ T4533] ffff0000c3827c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 47.431828][ T4533] ffff0000c3827d00: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 47.433114][ T4533] ================================================================== [ 47.435510][ T4533] Disabling lock debugging due to kernel taint [ 47.436422][ T4533] Unable to handle kernel paging request at virtual address dfff800000000008 [ 47.437815][ T4533] KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] [ 47.439252][ T4533] Mem abort info: [ 47.439835][ T4533] ESR = 0x0000000096000006 [ 47.440614][ T4533] EC = 0x25: DABT (current EL), IL = 32 bits [ 47.441659][ T4533] SET = 0, FnV = 0 [ 47.442348][ T4533] EA = 0, S1PTW = 0 [ 47.443070][ T4533] FSC = 0x06: level 2 translation fault [ 47.444052][ T4533] Data abort info: [ 47.444653][ T4533] ISV = 0, ISS = 0x00000006 [ 47.445479][ T4533] CM = 0, WnR = 0 [ 47.446119][ T4533] [dfff800000000008] address between user and kernel address ranges [ 47.447593][ T4533] Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP [ 47.448718][ T4533] Modules linked in: [ 47.449361][ T4533] CPU: 1 PID: 4533 Comm: md0_resync Tainted: G B syzkaller #0 [ 47.450755][ T4533] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 47.452386][ T4533] pstate: 02400005 (nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 47.453671][ T4533] pc : r1buf_pool_free+0x90/0x134 [ 47.454569][ T4533] lr : r1buf_pool_free+0x84/0x134 [ 47.455428][ T4533] sp : ffff800021707500 [ 47.456099][ T4533] x29: ffff800021707500 x28: 1fffe0001bedc44b x27: 1fffe0001bedc44e [ 47.457375][ T4533] x26: ffff80000ea38468 x25: 1fffe0001a43f080 x24: 00000000000011b5 [ 47.458629][ T4533] x23: ffff0000d21ef658 x22: dfff800000000000 x21: 0000000000000040 [ 47.459969][ T4533] x20: ffff0000d21f8400 x19: ffff0000d21ef600 x18: 1fffe00033e7697e [ 47.461328][ T4533] x17: 0000000000000000 x16: ffff800008043b30 x15: 0000000000000000 [ 47.462648][ T4533] x14: 0000000000000001 x13: 1ffff00002ff016c x12: 0000000000000000 [ 47.463972][ T4533] x11: ff0080000ea384c8 x10: 0000000000000000 x9 : ffff80001c5fab10 [ 47.465306][ T4533] x8 : 0000000000000008 x7 : 0000000000000001 x6 : 0000000000000001 [ 47.466631][ T4533] x5 : ffff800021706ed8 x4 : ffff800015464e80 x3 : ffff80000ea384ec [ 47.467978][ T4533] x2 : 0000000000000000 x1 : 0000000000000008 x0 : 0000000000000000 [ 47.469310][ T4533] Call trace: [ 47.469853][ T4533] r1buf_pool_free+0x90/0x134 [ 47.470626][ T4533] mempool_exit+0x190/0x290 [ 47.471389][ T4533] raid1_sync_request+0x328/0x26e4 [ 47.472243][ T4533] md_do_sync+0x2e18/0x36ec [ 47.473004][ T4533] md_thread+0x1e0/0x3cc [ 47.473720][ T4533] kthread+0x254/0x2e0 [ 47.474432][ T4533] ret_from_fork+0x10/0x20 [ 47.475201][ T4533] Code: 967af112 f9400288 91010115 d343fea8 (38766908) [ 47.476371][ T4533] ---[ end trace 0000000000000000 ]--- [ 47.646162][ T4533] Kernel panic - not syncing: Oops: Fatal exception [ 47.647311][ T4533] SMP: stopping secondary CPUs [ 47.648103][ T4533] Kernel Offset: disabled [ 47.648822][ T4533] CPU features: 0x0a0000,000f0097,a65bfea7 [ 47.649854][ T4533] Memory Limit: none [ 47.817329][ T4533] Rebooting in 86400 seconds..