Warning: Permanently added '10.128.1.80' (ED25519) to the list of known hosts. 1970/01/01 00:00:29 parsed 1 programs 1970/01/01 00:00:29 serving rpc on tcp://44419 syzkaller login: [ 30.423411][ T4723] cgroup: Unknown subsys name 'net' [ 30.593438][ T4723] cgroup: Unknown subsys name 'cpuset' [ 30.595440][ T4723] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 30.779459][ T4723] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 33.275080][ T4731] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 33.581639][ T4745] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.583054][ T4745] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.583135][ T4745] bridge_slave_0: entered allmulticast mode [ 33.583612][ T4745] bridge_slave_0: entered promiscuous mode [ 33.585226][ T4745] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.585284][ T4745] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.585332][ T4745] bridge_slave_1: entered allmulticast mode [ 33.585746][ T4745] bridge_slave_1: entered promiscuous mode [ 33.593486][ T4745] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 33.594460][ T4745] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 33.600932][ T4745] team0: Port device team_slave_0 added [ 33.601977][ T4745] team0: Port device team_slave_1 added [ 33.608215][ T4745] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 33.608236][ T4745] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 33.608252][ T4745] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 33.608939][ T4745] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 33.608946][ T4745] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 33.608959][ T4745] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 33.642660][ T4745] hsr_slave_0: entered promiscuous mode [ 33.642998][ T4745] hsr_slave_1: entered promiscuous mode [ 33.689249][ T4745] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 33.693049][ T4745] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 33.693730][ T4745] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 33.695029][ T4745] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 33.695404][ T4745] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 33.697210][ T4745] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 33.697606][ T4745] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 33.699102][ T4745] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 33.707766][ T4745] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.707815][ T4745] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.707952][ T4745] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.707981][ T4745] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.727766][ T4745] 8021q: adding VLAN 0 to HW filter on device bond0 [ 33.732518][ T40] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.734252][ T40] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.738145][ T4745] 8021q: adding VLAN 0 to HW filter on device team0 [ 33.740105][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.740154][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.742602][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.742625][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.839096][ T4745] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 33.850417][ T4745] veth0_vlan: entered promiscuous mode [ 33.853232][ T4745] veth1_vlan: entered promiscuous mode [ 33.860198][ T4745] veth0_macvtap: entered promiscuous mode [ 33.861303][ T4745] veth1_macvtap: entered promiscuous mode [ 33.866068][ T4745] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.867247][ T4745] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 33.871309][ T3402] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.872792][ T3402] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.872821][ T3402] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.872837][ T3402] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.958909][ T1169] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 34.035312][ T1169] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 34.098732][ T1169] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 34.176620][ T1169] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 34.298661][ T4800] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 34.300312][ T4800] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 34.302526][ T4800] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 34.303807][ T4800] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 34.304037][ T4800] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 34.390385][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.392817][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.401369][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.401395][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 1970/01/01 00:00:34 executed programs: 0 [ 34.902031][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 34.903266][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 34.904527][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 34.905361][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 34.905565][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 35.039087][ T4826] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.039178][ T4826] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.039490][ T4826] bridge_slave_0: entered allmulticast mode [ 35.039957][ T4826] bridge_slave_0: entered promiscuous mode [ 35.041021][ T4826] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.041043][ T4826] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.041102][ T4826] bridge_slave_1: entered allmulticast mode [ 35.041500][ T4826] bridge_slave_1: entered promiscuous mode [ 35.049098][ T4826] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 35.050085][ T4826] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 35.057490][ T4826] team0: Port device team_slave_0 added [ 35.058311][ T4826] team0: Port device team_slave_1 added [ 35.066053][ T4826] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 35.066079][ T4826] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.066094][ T4826] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 35.066602][ T4826] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 35.066609][ T4826] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.066622][ T4826] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 35.076729][ T4826] hsr_slave_0: entered promiscuous mode [ 35.077034][ T4826] hsr_slave_1: entered promiscuous mode [ 35.077233][ T4826] debugfs: 'hsr0' already exists in 'hsr' [ 35.077279][ T4826] Cannot create hsr debugfs directory [ 36.982320][ T4800] Bluetooth: hci0: command tx timeout [ 37.408546][ T1169] bridge_slave_1: left allmulticast mode [ 37.408600][ T1169] bridge_slave_1: left promiscuous mode [ 37.408919][ T1169] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.412417][ T1169] bridge_slave_0: left allmulticast mode [ 37.412446][ T1169] bridge_slave_0: left promiscuous mode [ 37.412733][ T1169] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.466650][ T1169] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 37.513411][ T1169] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 37.552876][ T1169] bond0 (unregistering): Released all slaves [ 37.616413][ T1169] hsr_slave_0: left promiscuous mode [ 37.617762][ T1169] hsr_slave_1: left promiscuous mode [ 37.619241][ T1169] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 37.620628][ T1169] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 37.622460][ T1169] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 37.624731][ T1169] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 37.630680][ T1169] veth1_macvtap: left promiscuous mode [ 37.631759][ T1169] veth0_macvtap: left promiscuous mode [ 37.631829][ T1169] veth1_vlan: left promiscuous mode [ 37.631900][ T1169] veth0_vlan: left promiscuous mode [ 37.723493][ T1169] team0 (unregistering): Port device team_slave_1 removed [ 37.727672][ T1169] team0 (unregistering): Port device team_slave_0 removed [ 37.770176][ T4400] 8021q: adding VLAN 0 to HW filter on device eth0 [ 37.998023][ T4826] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 38.001368][ T4826] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 38.002664][ T4826] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 38.003555][ T4826] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 38.004348][ T4826] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 38.009353][ T4826] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 38.010997][ T4826] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 38.013539][ T4826] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 38.041217][ T4826] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.046500][ T4826] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.049580][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.049632][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.054776][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.054819][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.350620][ T4826] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.382907][ T4826] veth0_vlan: entered promiscuous mode [ 38.385788][ T4826] veth1_vlan: entered promiscuous mode [ 38.392414][ T4826] veth0_macvtap: entered promiscuous mode [ 38.393584][ T4826] veth1_macvtap: entered promiscuous mode [ 38.397774][ T4826] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 38.398857][ T4826] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 38.402175][ T15] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.402259][ T15] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.402317][ T15] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.402388][ T15] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.451867][ T1169] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 38.453560][ T1169] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 38.458356][ T15] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 38.458916][ T15] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 38.509880][ T4919] ================================================================== [ 38.509896][ T4919] BUG: KASAN: slab-use-after-free in dvb_frontend_release+0x374/0x414 [ 38.509920][ T4919] Read of size 4 at addr ffff0000cc0e323c by task syz.0.18/4919 [ 38.509929][ T4919] [ 38.509934][ T4919] CPU: 0 UID: 0 PID: 4919 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT [ 38.509943][ T4919] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 [ 38.509948][ T4919] Call trace: [ 38.509951][ T4919] show_stack+0x2c/0x3c (C) [ 38.509964][ T4919] __dump_stack+0x30/0x40 [ 38.509974][ T4919] dump_stack_lvl+0xd8/0x12c [ 38.509984][ T4919] print_address_description+0xb0/0x238 [ 38.509992][ T4919] print_report+0x68/0x84 [ 38.509999][ T4919] kasan_report+0x8c/0xc4 [ 38.510008][ T4919] __asan_report_load4_noabort+0x20/0x2c [ 38.510018][ T4919] dvb_frontend_release+0x374/0x414 [ 38.510026][ T4919] __fput+0x338/0x74c [ 38.510034][ T4919] ____fput+0x20/0x30 [ 38.510041][ T4919] task_work_run+0x1cc/0x25c [ 38.510051][ T4919] exit_to_user_mode_loop+0x10c/0x17c [ 38.510060][ T4919] el0_svc+0x18c/0x260 [ 38.510070][ T4919] el0t_64_sync_handler+0x48/0x148 [ 38.510078][ T4919] el0t_64_sync+0x198/0x19c [ 38.510086][ T4919] [ 38.510088][ T4919] Allocated by task 1: [ 38.510092][ T4919] kasan_save_track+0x40/0x78 [ 38.510100][ T4919] kasan_save_alloc_info+0x44/0x54 [ 38.510108][ T4919] __kasan_kmalloc+0x9c/0xb4 [ 38.510114][ T4919] __kmalloc_cache_noprof+0x2e8/0x5ec [ 38.510122][ T4919] dvb_register_device+0x1a4/0x16e0 [ 38.510131][ T4919] dvb_register_frontend+0x474/0x6d0 [ 38.510137][ T4919] vidtv_bridge_probe+0x5a4/0xa58 [ 38.510146][ T4919] platform_probe+0x100/0x1a4 [ 38.510152][ T4919] really_probe+0x29c/0x800 [ 38.510160][ T4919] __driver_probe_device+0x1e0/0x350 [ 38.510167][ T4919] driver_probe_device+0x6c/0x19c [ 38.510174][ T4919] __driver_attach+0x168/0x384 [ 38.510182][ T4919] bus_for_each_dev+0x128/0x1b4 [ 38.510188][ T4919] driver_attach+0x50/0x60 [ 38.510195][ T4919] bus_add_driver+0x208/0x500 [ 38.510201][ T4919] driver_register+0x220/0x310 [ 38.510209][ T4919] __platform_driver_register+0x90/0xa4 [ 38.510217][ T4919] vidtv_bridge_init+0x4c/0x74 [ 38.510226][ T4919] do_one_initcall+0x274/0xc38 [ 38.510235][ T4919] do_initcall_level+0x12c/0x1c4 [ 38.510241][ T4919] do_initcalls+0x70/0xd0 [ 38.510247][ T4919] do_basic_setup+0x7c/0x90 [ 38.510252][ T4919] kernel_init_freeable+0x268/0x3a8 [ 38.510258][ T4919] kernel_init+0x24/0x1dc [ 38.510267][ T4919] ret_from_fork+0x10/0x20 [ 38.510272][ T4919] [ 38.510274][ T4919] Freed by task 4919: [ 38.510277][ T4919] kasan_save_track+0x40/0x78 [ 38.510283][ T4919] kasan_save_free_info+0x58/0x70 [ 38.510291][ T4919] __kasan_slab_free+0x74/0xa4 [ 38.510298][ T4919] kfree+0x188/0x690 [ 38.510304][ T4919] dvb_device_put+0x64/0xd0 [ 38.510312][ T4919] dvb_generic_release+0xec/0x158 [ 38.510320][ T4919] dvb_frontend_release+0x114/0x414 [ 38.510327][ T4919] __fput+0x338/0x74c [ 38.510332][ T4919] ____fput+0x20/0x30 [ 38.510338][ T4919] task_work_run+0x1cc/0x25c [ 38.510346][ T4919] exit_to_user_mode_loop+0x10c/0x17c [ 38.510353][ T4919] el0_svc+0x18c/0x260 [ 38.510360][ T4919] el0t_64_sync_handler+0x48/0x148 [ 38.510367][ T4919] el0t_64_sync+0x198/0x19c [ 38.510372][ T4919] [ 38.51037 ** replaying previous printk message ** [ 38.510374][ T4919] The buggy address belongs to the object at ffff0000cc0e3200 [ 38.510374][ T4919] which belongs to the cache kmalloc-256 of size 256 [ 38.510379][ T4919] The buggy address is located 60 bytes inside of [ 38.510379][ T4919] freed 256-byte region [ffff0000cc0e3200, ffff0000cc0e3300) [ 38.510386][ T4919] [ 38.510388][ T4919] The buggy address belongs to the physical page: [ 38.510392][ T4919] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10c0e2 [ 38.510398][ T4919] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 38.510404][ T4919] flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 38.510412][ T4919] page_type: f5(slab) [ 38.510418][ T4919] raw: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122 [ 38.510424][ T4919] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 38.510431][ T4919] head: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122 [ 38.510437][ T4919] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 38.510442][ T4919] head: 05ffc00000000001 fffffdffc3303881 00000000ffffffff 00000000ffffffff [ 38.510448][ T4919] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 38.510452][ T4919] page dumped because: kasan: bad access detected [ 38.510455][ T4919] [ 38.510456][ T4919] Memory state around the buggy address: [ 38.510460][ T4919] ffff0000cc0e3100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.510464][ T4919] ffff0000cc0e3180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.510468][ T4919] >ffff0000cc0e3200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 38.510471][ T4919] ^ [ 38.510475][ T4919] ffff0000cc0e3280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 38.510479][ T4919] ffff0000cc0e3300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.510482][ T4919] ================================================================== [ 38.532020][ T4919] Disabling lock debugging due to kernel taint [ 38.561400][ T4920] ------------[ cut here ]------------ [ 38.561410][ T4920] refcount_t: addition on 0; use-after-free. [ 38.561516][ T4920] WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x134/0x1f8, CPU#1: syz.0.19/4920 [ 38.592054][ T4920] Modules linked in: [ 38.592606][ T4920] CPU: 1 UID: 0 PID: 4920 Comm: syz.0.19 Tainted: G B syzkaller #0 PREEMPT [ 38.594023][ T4920] Tainted: [B]=BAD_PAGE [ 38.594604][ T4920] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 [ 38.595998][ T4920] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 38.597065][ T4920] pc : refcount_warn_saturate+0x134/0x1f8 [ 38.597816][ T4920] lr : refcount_warn_saturate+0x134/0x1f8 [ 38.598544][ T4920] sp : ffff800093e27640 [ 38.599116][ T4920] x29: ffff800093e27640 x28: dfff800000000000 x27: 1fffe00019bbbcb1 [ 38.600262][ T4920] x26: dfff800000000000 x25: ffff7000127c4edc x24: dfff800000000000 [ 38.601303][ T4920] x23: ffff80008742cca8 x22: ffff0000cbb05000 x21: ffff0000cc0e3200 [ 38.602413][ T4920] x20: ffff0000cc0e3210 x19: ffff80008a116000 x18: 0000000000000000 [ 38.603549][ T4920] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 38.604663][ T4920] x14: 00000000ffff8000 x13: 0000000000000001 x12: 0000000000000000 [ 38.605751][ T4920] x11: 0000000000000000 x10: 0000000000000002 x9 : 502a5e28092eab00 [ 38.606901][ T4920] x8 : 502a5e28092eab00 x7 : 0000000000000000 x6 : ffff80008048ce60 [ 38.608005][ T4920] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f7010 [ 38.609219][ T4920] x2 : 0000000100000000 x1 : ffff0000cce457c0 x0 : 0000000000000000 [ 38.610414][ T4920] Call trace: [ 38.610849][ T4920] refcount_warn_saturate+0x134/0x1f8 (P) [ 38.611683][ T4920] dvb_device_get+0x9c/0xc0 [ 38.612319][ T4920] dvb_device_open+0x100/0x254 [ 38.612937][ T4920] chrdev_open+0x398/0x3e8 [ 38.613566][ T4920] do_dentry_open+0x5c4/0xfc0 [ 38.614215][ T4920] vfs_open+0x44/0x2dc [ 38.614794][ T4920] path_openat+0x21fc/0x2a60 [ 38.615394][ T4920] do_file_open+0x1c8/0x2e8 [ 38.616030][ T4920] do_sys_openat2+0x114/0x1e8 [ 38.616665][ T4920] do_sys_open+0xb0/0xe0 [ 38.617236][ T4920] __arm64_sys_openat+0xa0/0xbc [ 38.617864][ T4920] invoke_syscall+0x98/0x244 [ 38.618539][ T4920] el0_svc_common+0xec/0x23c [ 38.619169][ T4920] do_el0_svc+0x4c/0x5c [ 38.619749][ T4920] el0_svc+0x64/0x260 [ 38.620277][ T4920] el0t_64_sync_handler+0x48/0x148 [ 38.621029][ T4920] el0t_64_sync+0x198/0x19c [ 38.621651][ T4920] irq event stamp: 0 [ 38.622183][ T4920] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 38.623137][ T4920] hardirqs last disabled at (0): [] copy_process+0x1384/0x3320 [ 38.624449][ T4920] softirqs last enabled at (0): [] copy_process+0x13a4/0x3320 [ 38.625717][ T4920] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 38.626639][ T4920] ---[ end trace 0000000000000000 ]--- [ 38.629531][ T4920] ------------[ cut here ]------------ [ 38.629549][ T4920] refcount_t: saturated; leaking memory. [ 38.629665][ T4920] WARNING: lib/refcount.c:22 at refcount_warn_saturate+0x1b4/0x1f8, CPU#0: syz.0.19/4920 [ 38.632760][ T4920] Modules linked in: [ 38.633386][ T4920] CPU: 0 UID: 0 PID: 4920 Comm: syz.0.19 Tainted: G B W syzkaller #0 PREEMPT [ 38.634905][ T4920] Tainted: [B]=BAD_PAGE, [W]=WARN [ 38.635656][ T4920] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 [ 38.637185][ T4920] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 38.638315][ T4920] pc : refcount_warn_saturate+0x1b4/0x1f8 [ 38.639112][ T4920] lr : refcount_warn_saturate+0x1b4/0x1f8 [ 38.639897][ T4920] sp : ffff800093e27640 [ 38.640527][ T4920] x29: ffff800093e27640 x28: dfff800000000000 x27: 1fffe0001a75f351 [ 38.641633][ T4920] x26: dfff800000000000 x25: ffff7000127c4edc x24: dfff800000000000 [ 38.642912][ T4920] x23: ffff80008742cca8 x22: ffff0000cbb05000 x21: 000000007ffffffe [ 38.644070][ T4920] x20: ffff0000cc0e3210 x19: ffff80008a116000 x18: 0000000000000000 [ 38.645171][ T4920] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 38.646280][ T4920] x14: 00000000ffff8000 x13: 0000000000000001 x12: 0000000000000000 [ 38.647365][ T4920] x11: 0000000000000000 x10: 0000000000000002 x9 : 502a5e28092eab00 [ 38.648430][ T4920] x8 : 502a5e28092eab00 x7 : 0000000000000000 x6 : ffff80008048ce60 [ 38.649562][ T4920] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f7010 [ 38.650942][ T4920] x2 : 0000000100000000 x1 : ffff0000cce457c0 x0 : 0000000000000000 [ 38.652111][ T4920] Call trace: [ 38.652567][ T4920] refcount_warn_saturate+0x1b4/0x1f8 (P) [ 38.653367][ T4920] dvb_device_get+0x9c/0xc0 [ 38.653951][ T4920] dvb_device_open+0x100/0x254 [ 38.654588][ T4920] chrdev_open+0x398/0x3e8 [ 38.655171][ T4920] do_dentry_open+0x5c4/0xfc0 [ 38.655863][ T4920] vfs_open+0x44/0x2dc [ 38.656490][ T4920] path_openat+0x21fc/0x2a60 [ 38.657190][ T4920] do_file_open+0x1c8/0x2e8 [ 38.657842][ T4920] do_sys_openat2+0x114/0x1e8 [ 38.658510][ T4920] do_sys_open+0xb0/0xe0 [ 38.659148][ T4920] __arm64_sys_openat+0xa0/0xbc [ 38.659867][ T4920] invoke_syscall+0x98/0x244 [ 38.660585][ T4920] el0_svc_common+0xec/0x23c [ 38.661345][ T4920] do_el0_svc+0x4c/0x5c [ 38.661960][ T4920] el0_svc+0x64/0x260 [ 38.662571][ T4920] el0t_64_sync_handler+0x48/0x148 [ 38.663320][ T4920] el0t_64_sync+0x198/0x19c [ 38.663942][ T4920] irq event stamp: 0 [ 38.664480][ T4920] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 38.665551][ T4920] hardirqs last disabled at (0): [] copy_process+0x1384/0x3320 [ 38.666875][ T4920] softirqs last enabled at (0): [] copy_process+0x13a4/0x3320 [ 38.668452][ T4920] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 38.669541][ T4920] ---[ end trace 0000000000000000 ]--- [ 38.6 ** replaying previous printk message ** [ 38.670764][ T4920] ------------[ cut here ]------------ [ 38.670782][ T4920] refcount_t: underflow; use-after-free. [ 38.670895][ T4920] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x154/0x1f8, CPU#0: syz.0.19/4920 [ 38.674401][ T4920] Modules linked in: [ 38.674902][ T4920] CPU: 0 UID: 0 PID: 4920 Comm: syz.0.19 Tainted: G B W syzkaller #0 PREEMPT [ 38.676262][ T4920] Tainted: [B]=BAD_PAGE, [W]=WARN [ 38.676925][ T4920] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 [ 38.678432][ T4920] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 38.679514][ T4920] pc : refcount_warn_saturate+0x154/0x1f8 [ 38.680338][ T4920] lr : refcount_warn_saturate+0x154/0x1f8 [ 38.681185][ T4920] sp : ffff800093e27540 [ 38.681815][ T4920] x29: ffff800093e27540 x28: ffff0000d3af9a40 x27: ffff0000cb7bc010 [ 38.682914][ T4920] x26: dfff800000000000 x25: 1fffe0001981c647 x24: ffff0000cb7bc060 [ 38.683999][ T4920] x23: 00000000fffffffc x22: ffff0000cc0e323c x21: 00000000c0000000 [ 38.685167][ T4920] x20: ffff0000cc0e3210 x19: ffff80008a116000 x18: 0000000000000000 [ 38.686402][ T4920] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 38.687524][ T4920] x14: 00000000ffff8000 x13: 0000000000000001 x12: 0000000000000000 [ 38.688608][ T4920] x11: 0000000000000000 x10: 0000000000000002 x9 : 502a5e28092eab00 [ 38.689742][ T4920] x8 : 502a5e28092eab00 x7 : 0000000000000000 x6 : ffff80008048ce60 [ 38.690877][ T4920] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f7010 [ 38.691962][ T4920] x2 : 0000000100000000 x1 : ffff0000cce457c0 x0 : 0000000000000000 [ 38.693061][ T4920] Call trace: [ 38.693566][ T4920] refcount_warn_saturate+0x154/0x1f8 (P) [ 38.694349][ T4920] dvb_device_put+0xac/0xd0 [ 38.694963][ T4920] dvb_generic_release+0xec/0x158 [ 38.695702][ T4920] dvb_frontend_open+0x9cc/0x10a8 [ 38.696448][ T4920] dvb_device_open+0x1f8/0x254 [ 38.697077][ T4920] chrdev_open+0x398/0x3e8 [ 38.697693][ T4920] do_dentry_open+0x5c4/0xfc0 [ 38.698307][ T4920] vfs_open+0x44/0x2dc [ 38.698910][ T4920] path_openat+0x21fc/0x2a60 [ 38.699540][ T4920] do_file_open+0x1c8/0x2e8 [ 38.700139][ T4920] do_sys_openat2+0x114/0x1e8 [ 38.700816][ T4920] do_sys_open+0xb0/0xe0 [ 38.701424][ T4920] __arm64_sys_openat+0xa0/0xbc [ 38.702113][ T4920] invoke_syscall+0x98/0x244 [ 38.702745][ T4920] el0_svc_common+0xec/0x23c [ 38.703381][ T4920] do_el0_svc+0x4c/0x5c [ 38.703933][ T4920] el0_svc+0x64/0x260 [ 38.704469][ T4920] el0t_64_sync_handler+0x48/0x148 [ 38.705153][ T4920] el0t_64_sync+0x198/0x19c [ 38.705775][ T4920] irq event stamp: 0 [ 38.706318][ T4920] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 38.707265][ T4920] hardirqs last disabled at (0): [] copy_process+0x1384/0x3320 [ 38.708551][ T4920] softirqs last enabled at (0): [] copy_process+0x13a4/0x3320 [ 38.709824][ T4920] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 38.710801][ T4920] ---[ end trace 0000000000000000 ]--- [ 39.051957][ T4800] Bluetooth: hci0: command tx timeout 1970/01/01 00:00:39 executed programs: 71 [ 41.131946][ T4800] Bluetooth: hci0: command tx timeout [ 43.222088][ T4800] Bluetooth: hci0: command tx timeout 1970/01/01 00:00:44 executed programs: 371