Warning: Permanently added '10.128.1.189' (ED25519) to the list of known hosts.
2026/08/08 21:45:01 parsed 1 programs
2026/08/08 21:45:01 serving rpc on tcp://35209
[ 90.229534][ T5791] cgroup: Unknown subsys name 'net'
[ 90.347234][ T5791] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 92.044603][ T5791] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 92.070063][ T27] cfg80211: failed to load regulatory.db
[ 94.114206][ T1117] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 94.126618][ T1117] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 94.160186][ T1080] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 94.168075][ T1080] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 95.327918][ T5836] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 95.336762][ T5836] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 95.344681][ T5836] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 95.353546][ T5836] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 95.361450][ T5836] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 95.369378][ T5836] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 96.234454][ T5854] chnl_net:caif_netlink_parms(): no params data found
[ 96.332907][ T5854] bridge0: port 1(bridge_slave_0) entered blocking state
[ 96.340712][ T5854] bridge0: port 1(bridge_slave_0) entered disabled state
[ 96.347887][ T5854] bridge_slave_0: entered allmulticast mode
[ 96.355612][ T5854] bridge_slave_0: entered promiscuous mode
[ 96.366215][ T5854] bridge0: port 2(bridge_slave_1) entered blocking state
[ 96.373476][ T5854] bridge0: port 2(bridge_slave_1) entered disabled state
[ 96.380773][ T5854] bridge_slave_1: entered allmulticast mode
[ 96.387808][ T5854] bridge_slave_1: entered promiscuous mode
[ 96.432858][ T5854] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 96.445172][ T5854] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 96.479230][ T5854] team0: Port device team_slave_0 added
[ 96.503649][ T5854] team0: Port device team_slave_1 added
[ 96.529661][ T5854] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 96.536655][ T5854] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 96.562760][ T5854] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 96.576250][ T5854] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 96.585018][ T5854] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 96.611359][ T5854] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 96.676560][ T5854] hsr_slave_0: entered promiscuous mode
[ 96.688995][ T5854] hsr_slave_1: entered promiscuous mode
[ 96.913847][ T5854] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 96.927081][ T5854] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 96.938942][ T5854] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 96.950676][ T5854] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 97.066732][ T5854] 8021q: adding VLAN 0 to HW filter on device bond0
[ 97.097776][ T5854] 8021q: adding VLAN 0 to HW filter on device team0
[ 97.114459][ T1068] bridge0: port 1(bridge_slave_0) entered blocking state
[ 97.121865][ T1068] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 97.137376][ T1068] bridge0: port 2(bridge_slave_1) entered blocking state
[ 97.144566][ T1068] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 97.394746][ T5854] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 97.448108][ T5854] veth0_vlan: entered promiscuous mode
[ 97.464991][ T5854] veth1_vlan: entered promiscuous mode
[ 97.494708][ T5854] veth0_macvtap: entered promiscuous mode
[ 97.510748][ T5854] veth1_macvtap: entered promiscuous mode
[ 97.531658][ T5854] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 97.546540][ T5854] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 97.562227][ T5854] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 97.572059][ T5854] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 97.581224][ T5854] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 97.590517][ T5854] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 98.071560][ T1080] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2026/08/08 21:45:13 executed programs: 0
[ 99.247600][ T5087] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 99.255878][ T5087] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 99.264638][ T5087] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 99.273546][ T5087] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 99.282559][ T5087] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 99.290601][ T5087] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 99.444071][ T5889] chnl_net:caif_netlink_parms(): no params data found
[ 99.512941][ T5889] bridge0: port 1(bridge_slave_0) entered blocking state
[ 99.522143][ T5889] bridge0: port 1(bridge_slave_0) entered disabled state
[ 99.530275][ T5889] bridge_slave_0: entered allmulticast mode
[ 99.537281][ T5889] bridge_slave_0: entered promiscuous mode
[ 99.546342][ T5889] bridge0: port 2(bridge_slave_1) entered blocking state
[ 99.553669][ T5889] bridge0: port 2(bridge_slave_1) entered disabled state
[ 99.561164][ T5889] bridge_slave_1: entered allmulticast mode
[ 99.568116][ T5889] bridge_slave_1: entered promiscuous mode
[ 99.596660][ T5889] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 99.608718][ T5889] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 99.642254][ T5889] team0: Port device team_slave_0 added
[ 99.651559][ T5889] team0: Port device team_slave_1 added
[ 99.679941][ T5889] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 99.687022][ T5889] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 99.713084][ T5889] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 99.728774][ T5889] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 99.735757][ T5889] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 99.761997][ T5889] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 99.805164][ T5889] hsr_slave_0: entered promiscuous mode
[ 99.811701][ T5889] hsr_slave_1: entered promiscuous mode
[ 99.817863][ T5889] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 99.826370][ T5889] Cannot create hsr debugfs directory
[ 100.570918][ T1080] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 101.350449][ T5087] Bluetooth: hci0: command tx timeout
[ 102.990336][ T1080] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 103.054894][ T1080] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 103.430364][ T5087] Bluetooth: hci0: command tx timeout
[ 103.986171][ T5889] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 104.001564][ T5889] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 104.017854][ T5889] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 104.046424][ T5889] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 104.090480][ T1080] hsr_slave_0: left promiscuous mode
[ 104.096817][ T1080] hsr_slave_1: left promiscuous mode
[ 104.108894][ T1080] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 104.116436][ T1080] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 104.127650][ T1080] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 104.135162][ T1080] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 104.143267][ T1080] bridge_slave_1: left allmulticast mode
[ 104.149039][ T1080] bridge_slave_1: left promiscuous mode
[ 104.155656][ T1080] bridge0: port 2(bridge_slave_1) entered disabled state
[ 104.166890][ T1080] bridge_slave_0: left allmulticast mode
[ 104.172674][ T1080] bridge_slave_0: left promiscuous mode
[ 104.179318][ T1080] bridge0: port 1(bridge_slave_0) entered disabled state
[ 104.203891][ T1080] veth1_macvtap: left promiscuous mode
[ 104.209864][ T1080] veth0_macvtap: left promiscuous mode
[ 104.215488][ T1080] veth1_vlan: left promiscuous mode
[ 104.221652][ T1080] veth0_vlan: left promiscuous mode
[ 104.657196][ T1080] team0 (unregistering): Port device team_slave_1 removed
[ 104.691437][ T1080] team0 (unregistering): Port device team_slave_0 removed
[ 104.723247][ T1080] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 104.757442][ T1080] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 104.987935][ T1080] bond0 (unregistering): Released all slaves
[ 105.108000][ T5889] 8021q: adding VLAN 0 to HW filter on device bond0
[ 105.134147][ T5889] 8021q: adding VLAN 0 to HW filter on device team0
[ 105.151493][ T1108] bridge0: port 1(bridge_slave_0) entered blocking state
[ 105.158705][ T1108] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 105.175391][ T1068] bridge0: port 2(bridge_slave_1) entered blocking state
[ 105.182655][ T1068] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 105.406198][ T5889] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 105.462981][ T5889] veth0_vlan: entered promiscuous mode
[ 105.477330][ T5889] veth1_vlan: entered promiscuous mode
[ 105.508363][ T5087] Bluetooth: hci0: command tx timeout
[ 105.516887][ T5889] veth0_macvtap: entered promiscuous mode
[ 105.527361][ T5889] veth1_macvtap: entered promiscuous mode
[ 105.547742][ T5889] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 105.566837][ T5889] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 105.584466][ T5889] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 105.595556][ T5889] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 105.606868][ T5889] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 105.615909][ T5889] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 105.726609][ T1068] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 105.740505][ T1068] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 105.765453][ T1068] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
2026/08/08 21:45:19 executed programs: 2
[ 105.773983][ T1068] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 105.851626][ T5929] syz.0.17 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000
[ 105.863602][ T5929] CPU: 1 PID: 5929 Comm: syz.0.17 Not tainted syzkaller #0
[ 105.870855][ T5929] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 105.880964][ T5929] Call Trace:
[ 105.884278][ T5929]
[ 105.887324][ T5929] dump_stack_lvl+0x18c/0x250
[ 105.892067][ T5929] ? show_regs_print_info+0x20/0x20
[ 105.897325][ T5929] ? load_image+0x420/0x420
[ 105.901878][ T5929] ? ___ratelimit+0x478/0x610
[ 105.906593][ T5929] ? radix_tree_cpu_dead+0x160/0x160
[ 105.911903][ T5929] dump_header+0xd8/0x820
[ 105.916283][ T5929] oom_kill_process+0x390/0x580
[ 105.921173][ T5929] out_of_memory+0xe0e/0x1200
[ 105.925887][ T5929] ? mem_cgroup_out_of_memory+0xc1/0x390
[ 105.931548][ T5929] ? mutex_lock_nested+0x20/0x20
[ 105.936515][ T5929] ? unregister_oom_notifier+0x20/0x20
[ 105.942026][ T5929] mem_cgroup_out_of_memory+0x2c2/0x390
[ 105.947606][ T5929] ? try_charge_memcg+0xc91/0x17c0
[ 105.952735][ T5929] ? drain_local_stock+0x630/0x630
[ 105.957889][ T5929] ? do_raw_spin_unlock+0x121/0x230
[ 105.963118][ T5929] try_charge_memcg+0xca1/0x17c0
[ 105.968102][ T5929] ? folio_flags+0x120/0x120
[ 105.972716][ T5929] ? percpu_ref_tryget+0x15/0x180
[ 105.977760][ T5929] ? get_mem_cgroup_from_objcg+0x19/0x150
[ 105.983505][ T5929] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0
[ 105.989511][ T5929] ? percpu_ref_tryget+0x15/0x180
[ 105.994572][ T5929] ? percpu_ref_tryget+0x15/0x180
[ 105.999621][ T5929] ? get_mem_cgroup_from_objcg+0x19/0x150
[ 106.005363][ T5929] ? get_mem_cgroup_from_objcg+0x19/0x150
[ 106.011107][ T5929] ? get_mem_cgroup_from_objcg+0x13c/0x150
[ 106.016961][ T5929] obj_cgroup_charge+0x36e/0x630
[ 106.021920][ T5929] ? obj_cgroup_charge+0xed/0x630
[ 106.026993][ T5929] ? mod_objcg_mlstate+0x320/0x320
[ 106.032135][ T5929] ? percpu_ref_put+0x12/0x100
[ 106.036925][ T5929] ? percpu_ref_put+0x12/0x100
[ 106.041713][ T5929] slab_pre_alloc_hook+0x2e2/0x300
[ 106.046847][ T5929] ? slab_pre_alloc_hook+0xb1/0x300
[ 106.052091][ T5929] kmem_cache_alloc_lru+0x4d/0x2b0
[ 106.057235][ T5929] ? __d_alloc+0x31/0x710
[ 106.061592][ T5929] __d_alloc+0x31/0x710
[ 106.065771][ T5929] ? hashlen_string+0xb8/0x110
[ 106.070555][ T5929] d_alloc_name+0xbb/0x320
[ 106.075031][ T5929] ? d_alloc_pseudo+0x70/0x70
[ 106.079759][ T5929] gadgetfs_create_file+0x4e/0x2a0
[ 106.084903][ T5929] ? usb_ep_alloc_request+0x107/0x250
[ 106.090305][ T5929] gadgetfs_bind+0x445/0x830
[ 106.094925][ T5929] ? is_valid_config+0x1a0/0x1a0
[ 106.099881][ T5929] gadget_bind_driver+0x2b3/0x770
[ 106.104940][ T5929] ? gadget_match_driver+0x130/0x130
[ 106.110249][ T5929] really_probe+0x247/0xae0
[ 106.114777][ T5929] ? pm_runtime_barrier+0x14b/0x1c0
[ 106.120009][ T5929] __driver_probe_device+0x1f5/0x390
[ 106.125336][ T5929] driver_probe_device+0x4f/0x420
[ 106.130398][ T5929] __driver_attach+0x444/0x6d0
[ 106.135194][ T5929] bus_for_each_dev+0x235/0x2b0
[ 106.140091][ T5929] ? driver_attach+0x50/0x50
[ 106.144708][ T5929] ? bus_remove_file+0x140/0x140
[ 106.149681][ T5929] ? do_raw_spin_unlock+0x121/0x230
[ 106.154917][ T5929] bus_add_driver+0x340/0x630
[ 106.159631][ T5929] driver_register+0x23a/0x310
[ 106.164423][ T5929] usb_gadget_register_driver_owner+0xf9/0x270
[ 106.170606][ T5929] dev_config+0xe49/0x1260
[ 106.175063][ T5929] ? rcu_read_lock_any_held+0xb4/0x140
[ 106.180552][ T5929] ? rcu_read_lock_bh_held+0x100/0x100
[ 106.186038][ T5929] ? ep0_read+0x1890/0x1890
[ 106.190587][ T5929] ? ep0_read+0x1890/0x1890
[ 106.195122][ T5929] vfs_write+0x299/0x9a0
[ 106.199401][ T5929] ? file_end_write+0x250/0x250
[ 106.204290][ T5929] ? __ia32_sys_get_robust_list+0x110/0x110
[ 106.210221][ T5929] ? __fdget_pos+0x2ba/0x330
[ 106.214856][ T5929] ksys_write+0x151/0x260
[ 106.219232][ T5929] ? __ia32_sys_read+0x90/0x90
[ 106.224028][ T5929] ? lockdep_hardirqs_on+0x98/0x150
[ 106.229278][ T5929] do_syscall_64+0x55/0xb0
[ 106.233721][ T5929] ? clear_bhb_loop+0x40/0x90
[ 106.238433][ T5929] ? clear_bhb_loop+0x40/0x90
[ 106.243129][ T5929] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 106.249042][ T5929] RIP: 0033:0x7fa12819e0d9
[ 106.253496][ T5929] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 106.273118][ T5929] RSP: 002b:00007ffcdd9e8f68 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 106.281572][ T5929] RAX: ffffffffffffffda RBX: 00007fa128425fa0 RCX: 00007fa12819e0d9
[ 106.289591][ T5929] RDX: 000000000000001f RSI: 0000200000000400 RDI: 0000000000000003
[ 106.297598][ T5929] RBP: 00007fa128235024 R08: 0000000000000000 R09: 0000000000000000
[ 106.305604][ T5929] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 106.313685][ T5929] R13: 00007fa128425fac R14: 00007fa128425fa0 R15: 00007fa128425fa0
[ 106.321698][ T5929]
[ 106.342288][ T5929] memory: usage 0kB, limit 0kB, failcnt 19
[ 106.348186][ T5929] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0
[ 106.357508][ T5929] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0
[ 106.364757][ T5929] Memory cgroup stats for /syz0/test:
[ 106.365229][ T5929] cache 0
[ 106.375683][ T5929] rss 0
[ 106.378567][ T5929] rss_huge 0
[ 106.381827][ T5929] shmem 0
[ 106.385493][ T5929] mapped_file 0
[ 106.390370][ T5929] dirty 0
[ 106.393361][ T5929] writeback 0
[ 106.396679][ T5929] workingset_refault_anon 0
[ 106.401413][ T5929] workingset_refault_file 0
[ 106.405985][ T5929] swap 0
[ 106.409019][ T5929] pgpgin 0
[ 106.412158][ T5929] pgpgout 0
[ 106.415302][ T5929] pgfault 0
[ 106.418497][ T5929] pgmajfault 0
[ 106.421915][ T5929] inactive_anon 0
[ 106.425652][ T5929] active_anon 0
[ 106.429306][ T5929] inactive_file 0
[ 106.432979][ T5929] active_file 0
[ 106.436477][ T5929] unevictable 0
[ 106.441230][ T5929] hierarchical_memory_limit 0
[ 106.445955][ T5929] hierarchical_memsw_limit 9223372036854771712
[ 106.452201][ T5929] total_cache 0
[ 106.455693][ T5929] total_rss 0
[ 106.460493][ T5929] total_rss_huge 0
[ 106.464418][ T5929] total_shmem 0
[ 106.467924][ T5929] total_mapped_file 0
[ 106.472712][ T5929] total_dirty 0
[ 106.476229][ T5929] total_writeback 0
[ 106.481316][ T5929] total_workingset_refault_anon 0
[ 106.487186][ T5929] total_workingset_refault_file 0
[ 106.492440][ T5929] total_swap 0
[ 106.495871][ T5929] total_pgpgin 0
[ 106.501060][ T5929] total_pgpgout 0
[ 106.504776][ T5929] total_pgfault 0
[ 106.508588][ T5929] total_pgmajfault 0
[ 106.512528][ T5929] total_inactive_anon 0
[ 106.516798][ T5929] total_active_anon 0
[ 106.522759][ T5929] total_inactive_file 0
[ 106.526974][ T5929] total_active_file 0
[ 106.531350][ T5929] total_unevictable 0
[ 106.535378][ T5929] anon_cost 0
[ 106.538905][ T5929] file_cost 0
[ 106.543591][ T5929] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0-1,oom_memcg=/syz0/test,task_memcg=/syz0/test,task=syz.0.17,pid=5929,uid=0
[ 106.562990][ T5929] Memory cgroup out of memory: Killed process 5929 (syz.0.17) total-vm:44920kB, anon-rss:1236kB, file-rss:1024kB, shmem-rss:0kB, UID:0 pgtables:76kB oom_score_adj:1000
[ 106.592606][ T5929] udc dummy_udc.0: failed to start USB Gadget filesystem: -12
[ 106.601589][ T5929] gadgetfs: probe of gadget.0 failed with error -12
[ 106.613735][ T5929] udc dummy_udc.1: failed to start USB Gadget filesystem: -12
[ 106.621696][ T5929] gadgetfs: probe of gadget.1 failed with error -12
[ 106.636843][ T5929] ==================================================================
[ 106.644943][ T5929] BUG: KASAN: slab-use-after-free in gadgetfs_bind+0xd3/0x830
[ 106.652466][ T5929] Write of size 8 at addr ffff88802cfe88c0 by task syz.0.17/5929
[ 106.660196][ T5929]
[ 106.662539][ T5929] CPU: 1 PID: 5929 Comm: syz.0.17 Not tainted syzkaller #0
[ 106.669744][ T5929] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 106.679826][ T5929] Call Trace:
[ 106.683130][ T5929]
[ 106.686072][ T5929] dump_stack_lvl+0x18c/0x250
[ 106.690766][ T5929] ? read_lock_is_recursive+0x20/0x20
[ 106.696158][ T5929] ? show_regs_print_info+0x20/0x20
[ 106.701373][ T5929] ? load_image+0x420/0x420
[ 106.705888][ T5929] ? _raw_spin_lock_irqsave+0xc0/0x100
[ 106.711374][ T5929] ? __virt_addr_valid+0x10c/0x380
[ 106.716531][ T5929] ? __virt_addr_valid+0x10c/0x380
[ 106.721688][ T5929] ? __virt_addr_valid+0x10c/0x380
[ 106.726840][ T5929] print_report+0xa8/0x210
[ 106.731315][ T5929] ? gadgetfs_bind+0xd3/0x830
[ 106.736045][ T5929] kasan_report+0x117/0x150
[ 106.740565][ T5929] ? gadgetfs_bind+0xd3/0x830
[ 106.745253][ T5929] gadgetfs_bind+0xd3/0x830
[ 106.749766][ T5929] ? kernfs_put+0x309/0x360
[ 106.754282][ T5929] ? is_valid_config+0x1a0/0x1a0
[ 106.759227][ T5929] gadget_bind_driver+0x2b3/0x770
[ 106.764269][ T5929] ? gadget_match_driver+0x130/0x130
[ 106.769563][ T5929] really_probe+0x247/0xae0
[ 106.774082][ T5929] ? pm_runtime_barrier+0x14b/0x1c0
[ 106.779308][ T5929] __driver_probe_device+0x1f5/0x390
[ 106.784612][ T5929] driver_probe_device+0x4f/0x420
[ 106.789754][ T5929] __driver_attach+0x444/0x6d0
[ 106.794596][ T5929] bus_for_each_dev+0x235/0x2b0
[ 106.799486][ T5929] ? driver_attach+0x50/0x50
[ 106.804109][ T5929] ? bus_remove_file+0x140/0x140
[ 106.809059][ T5929] ? do_raw_spin_unlock+0x121/0x230
[ 106.814271][ T5929] bus_add_driver+0x340/0x630
[ 106.818962][ T5929] driver_register+0x23a/0x310
[ 106.823748][ T5929] usb_gadget_register_driver_owner+0xf9/0x270
[ 106.829917][ T5929] dev_config+0xe49/0x1260
[ 106.834352][ T5929] ? rcu_read_lock_any_held+0xb4/0x140
[ 106.839819][ T5929] ? rcu_read_lock_bh_held+0x100/0x100
[ 106.845296][ T5929] ? ep0_read+0x1890/0x1890
[ 106.849810][ T5929] ? ep0_read+0x1890/0x1890
[ 106.854321][ T5929] vfs_write+0x299/0x9a0
[ 106.858596][ T5929] ? file_end_write+0x250/0x250
[ 106.863477][ T5929] ? __ia32_sys_get_robust_list+0x110/0x110
[ 106.869390][ T5929] ? __fdget_pos+0x2ba/0x330
[ 106.874033][ T5929] ksys_write+0x151/0x260
[ 106.878412][ T5929] ? __ia32_sys_read+0x90/0x90
[ 106.883221][ T5929] ? lockdep_hardirqs_on+0x98/0x150
[ 106.888471][ T5929] do_syscall_64+0x55/0xb0
[ 106.892897][ T5929] ? clear_bhb_loop+0x40/0x90
[ 106.897580][ T5929] ? clear_bhb_loop+0x40/0x90
[ 106.902260][ T5929] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 106.908152][ T5929] RIP: 0033:0x7fa12819e0d9
[ 106.912581][ T5929] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 106.932195][ T5929] RSP: 002b:00007ffcdd9e8f68 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 106.940630][ T5929] RAX: ffffffffffffffda RBX: 00007fa128425fa0 RCX: 00007fa12819e0d9
[ 106.948642][ T5929] RDX: 000000000000001f RSI: 0000200000000400 RDI: 0000000000000003
[ 106.956641][ T5929] RBP: 00007fa128235024 R08: 0000000000000000 R09: 0000000000000000
[ 106.964618][ T5929] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 106.972612][ T5929] R13: 00007fa128425fac R14: 00007fa128425fa0 R15: 00007fa128425fa0
[ 106.980609][ T5929]
[ 106.983655][ T5929]
[ 106.985998][ T5929] Allocated by task 5889:
[ 106.990351][ T5929] kasan_set_track+0x4e/0x70
[ 106.994970][ T5929] __kasan_kmalloc+0x8f/0xa0
[ 106.999605][ T5929] gadgetfs_fill_super+0x2ec/0x5f0
[ 107.004754][ T5929] get_tree_single+0xba/0x140
[ 107.009436][ T5929] vfs_get_tree+0x8c/0x280
[ 107.013862][ T5929] do_new_mount+0x24a/0xa40
[ 107.018391][ T5929] __se_sys_mount+0x2e7/0x3d0
[ 107.023083][ T5929] do_syscall_64+0x55/0xb0
[ 107.027505][ T5929] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 107.033403][ T5929]
[ 107.035738][ T5929] Freed by task 5929:
[ 107.039717][ T5929] kasan_set_track+0x4e/0x70
[ 107.044314][ T5929] kasan_save_free_info+0x28/0x40
[ 107.049360][ T5929] ____kasan_slab_free+0x126/0x1f0
[ 107.054480][ T5929] slab_free_freelist_hook+0x130/0x1a0
[ 107.059943][ T5929] __kmem_cache_free+0xba/0x1f0
[ 107.064807][ T5929] gadgetfs_bind+0x6d6/0x830
[ 107.069396][ T5929] gadget_bind_driver+0x2b3/0x770
[ 107.074445][ T5929] really_probe+0x247/0xae0
[ 107.078984][ T5929] __driver_probe_device+0x1f5/0x390
[ 107.084296][ T5929] driver_probe_device+0x4f/0x420
[ 107.089341][ T5929] __driver_attach+0x444/0x6d0
[ 107.094112][ T5929] bus_for_each_dev+0x235/0x2b0
[ 107.098973][ T5929] bus_add_driver+0x340/0x630
[ 107.103681][ T5929] driver_register+0x23a/0x310
[ 107.108462][ T5929] usb_gadget_register_driver_owner+0xf9/0x270
[ 107.114644][ T5929] dev_config+0xe49/0x1260
[ 107.119083][ T5929] vfs_write+0x299/0x9a0
[ 107.123412][ T5929] ksys_write+0x151/0x260
[ 107.127769][ T5929] do_syscall_64+0x55/0xb0
[ 107.132188][ T5929] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 107.138082][ T5929]
[ 107.140408][ T5929] The buggy address belongs to the object at ffff88802cfe8800
[ 107.140408][ T5929] which belongs to the cache kmalloc-1k of size 1024
[ 107.154472][ T5929] The buggy address is located 192 bytes inside of
[ 107.154472][ T5929] freed 1024-byte region [ffff88802cfe8800, ffff88802cfe8c00)
[ 107.168365][ T5929]
[ 107.170708][ T5929] The buggy address belongs to the physical page:
[ 107.177142][ T5929] page:ffffea0000b3fa00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2cfe8
[ 107.187301][ T5929] head:ffffea0000b3fa00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 107.196241][ T5929] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 107.204242][ T5929] page_type: 0xffffffff()
[ 107.208633][ T5929] raw: 00fff00000000840 ffff888017c41dc0 dead000000000100 dead000000000122
[ 107.217218][ T5929] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
[ 107.225798][ T5929] page dumped because: kasan: bad access detected
[ 107.232229][ T5929] page_owner tracks the page as allocated
[ 107.237975][ T5929] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5889, tgid 5889 (syz-executor), ts 105764660751, free_ts 105689541549
[ 107.260933][ T5929] post_alloc_hook+0x1c1/0x200
[ 107.265724][ T5929] get_page_from_freelist+0x2181/0x22a0
[ 107.271271][ T5929] __alloc_pages+0x1f0/0x460
[ 107.275860][ T5929] alloc_slab_page+0x5d/0x180
[ 107.280535][ T5929] new_slab+0x87/0x2d0
[ 107.284601][ T5929] ___slab_alloc+0xc5c/0x12f0
[ 107.289277][ T5929] __kmem_cache_alloc_node+0x11f/0x250
[ 107.294755][ T5929] __kmalloc_node+0xa6/0x240
[ 107.299373][ T5929] qdisc_alloc+0x95/0xa40
[ 107.303717][ T5929] qdisc_create_dflt+0x63/0x430
[ 107.308575][ T5929] dev_activate+0x396/0x1160
[ 107.313185][ T5929] __dev_open+0x347/0x430
[ 107.317518][ T5929] __dev_change_flags+0x1e8/0x6a0
[ 107.322560][ T5929] dev_change_flags+0x7c/0x1a0
[ 107.327322][ T5929] devinet_ioctl+0x949/0x1d70
[ 107.332004][ T5929] inet_ioctl+0x42b/0x560
[ 107.336336][ T5929] page last free stack trace:
[ 107.341025][ T5929] free_unref_page_prepare+0x7d7/0x8f0
[ 107.346490][ T5929] free_unref_page+0x32/0x2e0
[ 107.351190][ T5929] __slab_free+0x35a/0x400
[ 107.355615][ T5929] qlist_free_all+0x75/0xd0
[ 107.360143][ T5929] kasan_quarantine_reduce+0x143/0x160
[ 107.365616][ T5929] __kasan_slab_alloc+0x22/0x80
[ 107.370474][ T5929] slab_post_alloc_hook+0x6a/0x4d0
[ 107.375600][ T5929] __kmem_cache_alloc_node+0x194/0x250
[ 107.381071][ T5929] kmalloc_trace+0x2a/0xe0
[ 107.385497][ T5929] nsim_fib_event_work+0x86e/0x32c0
[ 107.390703][ T5929] process_scheduled_works+0xa60/0x1600
[ 107.396255][ T5929] worker_thread+0xa5e/0xfe0
[ 107.400850][ T5929] kthread+0x2fa/0x390
[ 107.404925][ T5929] ret_from_fork+0x48/0x80
[ 107.409366][ T5929] ret_from_fork_asm+0x11/0x20
[ 107.414164][ T5929]
[ 107.416492][ T5929] Memory state around the buggy address:
[ 107.422119][ T5929] ffff88802cfe8780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 107.430194][ T5929] ffff88802cfe8800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 107.438299][ T5929] >ffff88802cfe8880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 107.446412][ T5929] ^
[ 107.452599][ T5929] ffff88802cfe8900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 107.460711][ T5929] ffff88802cfe8980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 107.468783][ T5929] ==================================================================
[ 107.484750][ T5929] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 107.492018][ T5929] CPU: 1 PID: 5929 Comm: syz.0.17 Not tainted syzkaller #0
[ 107.499254][ T5929] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 107.509356][ T5929] Call Trace:
[ 107.512682][ T5929]
[ 107.515679][ T5929] dump_stack_lvl+0x18c/0x250
[ 107.520440][ T5929] ? show_regs_print_info+0x20/0x20
[ 107.525683][ T5929] ? load_image+0x420/0x420
[ 107.530248][ T5929] panic+0x2ca/0x720
[ 107.534190][ T5929] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 107.540386][ T5929] ? bpf_jit_dump+0xd0/0xd0
[ 107.544967][ T5929] ? _raw_spin_unlock_irqrestore+0x111/0x120
[ 107.551015][ T5929] ? _raw_spin_unlock+0x40/0x40
[ 107.555926][ T5929] ? gadgetfs_bind+0xd3/0x830
[ 107.560631][ T5929] check_panic_on_warn+0x84/0xa0
[ 107.565605][ T5929] ? gadgetfs_bind+0xd3/0x830
[ 107.570324][ T5929] end_report+0x6f/0x130
[ 107.574628][ T5929] kasan_report+0x128/0x150
[ 107.579175][ T5929] ? gadgetfs_bind+0xd3/0x830
[ 107.583885][ T5929] gadgetfs_bind+0xd3/0x830
[ 107.588429][ T5929] ? kernfs_put+0x309/0x360
[ 107.589945][ T5087] Bluetooth: hci0: command tx timeout
[ 107.598343][ T5929] ? is_valid_config+0x1a0/0x1a0
[ 107.603300][ T5929] gadget_bind_driver+0x2b3/0x770
[ 107.608359][ T5929] ? gadget_match_driver+0x130/0x130
[ 107.613676][ T5929] really_probe+0x247/0xae0
[ 107.618204][ T5929] ? pm_runtime_barrier+0x14b/0x1c0
[ 107.623432][ T5929] __driver_probe_device+0x1f5/0x390
[ 107.628760][ T5929] driver_probe_device+0x4f/0x420
[ 107.633813][ T5929] __driver_attach+0x444/0x6d0
[ 107.638609][ T5929] bus_for_each_dev+0x235/0x2b0
[ 107.643496][ T5929] ? driver_attach+0x50/0x50
[ 107.648114][ T5929] ? bus_remove_file+0x140/0x140
[ 107.653076][ T5929] ? do_raw_spin_unlock+0x121/0x230
[ 107.658295][ T5929] bus_add_driver+0x340/0x630
[ 107.662992][ T5929] driver_register+0x23a/0x310
[ 107.667778][ T5929] usb_gadget_register_driver_owner+0xf9/0x270
[ 107.673957][ T5929] dev_config+0xe49/0x1260
[ 107.678398][ T5929] ? rcu_read_lock_any_held+0xb4/0x140
[ 107.683887][ T5929] ? rcu_read_lock_bh_held+0x100/0x100
[ 107.689458][ T5929] ? ep0_read+0x1890/0x1890
[ 107.693989][ T5929] ? ep0_read+0x1890/0x1890
[ 107.698516][ T5929] vfs_write+0x299/0x9a0
[ 107.702791][ T5929] ? file_end_write+0x250/0x250
[ 107.707672][ T5929] ? __ia32_sys_get_robust_list+0x110/0x110
[ 107.713590][ T5929] ? __fdget_pos+0x2ba/0x330
[ 107.718223][ T5929] ksys_write+0x151/0x260
[ 107.722588][ T5929] ? __ia32_sys_read+0x90/0x90
[ 107.727376][ T5929] ? lockdep_hardirqs_on+0x98/0x150
[ 107.732598][ T5929] do_syscall_64+0x55/0xb0
[ 107.737031][ T5929] ? clear_bhb_loop+0x40/0x90
[ 107.741734][ T5929] ? clear_bhb_loop+0x40/0x90
[ 107.746433][ T5929] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 107.752367][ T5929] RIP: 0033:0x7fa12819e0d9
[ 107.756798][ T5929] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 107.776420][ T5929] RSP: 002b:00007ffcdd9e8f68 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 107.784865][ T5929] RAX: ffffffffffffffda RBX: 00007fa128425fa0 RCX: 00007fa12819e0d9
[ 107.792860][ T5929] RDX: 000000000000001f RSI: 0000200000000400 RDI: 0000000000000003
[ 107.800854][ T5929] RBP: 00007fa128235024 R08: 0000000000000000 R09: 0000000000000000
[ 107.808854][ T5929] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 107.816846][ T5929] R13: 00007fa128425fac R14: 00007fa128425fa0 R15: 00007fa128425fa0
[ 107.824849][ T5929]
[ 107.828469][ T5929] Kernel Offset: disabled
[ 107.832806][ T5929] Rebooting in 86400 seconds..