last executing test programs: 3.000599696s ago: executing program 1 (id=2): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)=@deltaction={0x38, 0x18, 0x1, 0x70bdac, 0x25dfdbfc, {0xa}, [@TCA_ACT_TAB={0x24, 0x1, [{0xc, 0x8d, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3}}, {0x14, 0x8, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x44010}, 0x0) 2.864810052s ago: executing program 1 (id=5): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0xc}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x2, 0x0, 0x0, 0x0, 0x1) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) r3 = getpgid(0x0) syz_pidfd_open(r3, 0x0) capget(&(0x7f0000000040)={0x20071026, r3}, &(0x7f0000000080)={0x4, 0x1, 0x6, 0xfff, 0xe3bc, 0x1}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x16, 0x16, &(0x7f0000000200)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000180000003d030100000000009500f000000000006926000000000000bf67000000000000560702000f0200006706000020000000620a00ff0ee60000bf250000000000002d350000000000006507000002080000070700004c0000001f75000000000000bf54000000000000070400000400f9ffcd35010000000000ce040000000000001c0000000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x25, '\x00', 0x0, @fallback=0x1e}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x8}, 0x3b) 1.790152342s ago: executing program 1 (id=6): r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) 350.501253ms ago: executing program 3 (id=4): openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, &(0x7f00000006c0)={0x1, 0x0, @pic={0xa, 0x2, 0x4, 0xc0, 0xcd, 0x9, 0xfa, 0x8, 0x33, 0x9, 0x2, 0x8, 0xa, 0x7, 0x4, 0x4}}) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, &(0x7f0000000480)={0x0, 0x0, @pic={0x41, 0x9, 0x1, 0x4, 0x3, 0x26, 0x40, 0x8, 0x80, 0x0, 0xf9, 0x8, 0x2, 0x40, 0x9, 0x8}}) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x2000c011}, 0x4c020) ioctl$KVM_SET_PIT2(0xffffffffffffffff, 0x4070aea0, &(0x7f00000004c0)={[{0x1, 0xc, 0x3, 0x7, 0x4, 0x84, 0x10, 0x1, 0x3, 0x1, 0x40, 0x1, 0x2}, {0x806, 0x50, 0x6, 0x2, 0x3, 0x8, 0x7f, 0x8, 0x19, 0x1, 0x5, 0x9}, {0x40, 0x0, 0xff, 0x2, 0x4, 0x5c, 0x0, 0x9, 0x14, 0x1b, 0xf9, 0x3, 0x100080000}], 0x100006}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000500)={0x0, &(0x7f0000000000)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}], 0x30}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={0x60, 0x2, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x4}]}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x60}}, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x38, 0xfff, 0xd, 0x180, 0x2, 0x14, 0xf1, 0x0, 0x7fffffffffffe, 0x5, 0x4005, 0x8, 0x0, 0x45, 0x4, 0x4], 0xdddd0000, 0x1d4217}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 316.300454ms ago: executing program 0 (id=1): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='md0\x00', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='none\x00', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r2, &(0x7f0000000380)='1:0\x00', 0x4) openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/dev-ram0/bad_blocks\x00', 0x0, 0x0) 163.508492ms ago: executing program 2 (id=3): r0 = socket$nl_generic(0x10, 0x3, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, 0x0) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), r0) sendmsg$ETHTOOL_MSG_WOL_GET(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)={0x2c, r1, 0x1, 0x70bd2b, 0x0, {0x1b}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x26000810}, 0x20000000) 0s ago: executing program 3 (id=7): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000120)='./nfsd/versions\x00', 0x1, 0x0) write(r0, &(0x7f0000000130)='-3\n', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0) write(r1, &(0x7f0000000180)='tcp 2049\n', 0x9) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x1, 0x0) write(r2, &(0x7f0000000200)='1\n', 0x2) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.75' (ED25519) to the list of known hosts. [ 68.312507][ T5759] cgroup: Unknown subsys name 'net' [ 68.415054][ T5759] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 69.775988][ T5759] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 71.469308][ T1283] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.475887][ T1283] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.617435][ T5773] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 71.637674][ T5773] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 71.645411][ T5773] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 71.659303][ T5777] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 71.666880][ T5777] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 71.675065][ T5777] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 71.709457][ T5777] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 71.719522][ T5784] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 71.728795][ T5777] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 71.732340][ T5783] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 71.743370][ T5783] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 71.750309][ T5780] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 71.752401][ T5780] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 71.759132][ T5783] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 71.774059][ T5783] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 71.781808][ T5783] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 71.789181][ T5783] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 71.789398][ T5784] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 71.802737][ T5783] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 71.815096][ T5780] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 71.823054][ T5784] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 71.837103][ T5784] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 71.838346][ T5783] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 71.852163][ T5783] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 72.064250][ T5771] chnl_net:caif_netlink_parms(): no params data found [ 72.220938][ T5771] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.228149][ T5771] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.236249][ T5771] bridge_slave_0: entered allmulticast mode [ 72.243147][ T5771] bridge_slave_0: entered promiscuous mode [ 72.256302][ T5771] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.263814][ T5771] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.271369][ T5771] bridge_slave_1: entered allmulticast mode [ 72.277992][ T5771] bridge_slave_1: entered promiscuous mode [ 72.318573][ T5771] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.371106][ T5771] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.390462][ T5776] chnl_net:caif_netlink_parms(): no params data found [ 72.457804][ T5771] team0: Port device team_slave_0 added [ 72.469808][ T5775] chnl_net:caif_netlink_parms(): no params data found [ 72.490359][ T5771] team0: Port device team_slave_1 added [ 72.597540][ T5776] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.605055][ T5776] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.612420][ T5776] bridge_slave_0: entered allmulticast mode [ 72.621174][ T5776] bridge_slave_0: entered promiscuous mode [ 72.629493][ T5771] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.636453][ T5771] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.662566][ T5771] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.677938][ T5774] chnl_net:caif_netlink_parms(): no params data found [ 72.698774][ T5776] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.705931][ T5776] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.713385][ T5776] bridge_slave_1: entered allmulticast mode [ 72.720172][ T5776] bridge_slave_1: entered promiscuous mode [ 72.727441][ T5771] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.735411][ T5771] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.761637][ T5771] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.816265][ T5775] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.823493][ T5775] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.831008][ T5775] bridge_slave_0: entered allmulticast mode [ 72.837626][ T5775] bridge_slave_0: entered promiscuous mode [ 72.853782][ T5776] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.871318][ T5775] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.878973][ T5775] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.886116][ T5775] bridge_slave_1: entered allmulticast mode [ 72.893112][ T5775] bridge_slave_1: entered promiscuous mode [ 72.921357][ T5776] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.932314][ T5775] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.945236][ T5775] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 73.025810][ T5776] team0: Port device team_slave_0 added [ 73.034572][ T5774] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.041810][ T5774] bridge0: port 1(bridge_slave_0) entered disabled state [ 73.049210][ T5774] bridge_slave_0: entered allmulticast mode [ 73.055823][ T5774] bridge_slave_0: entered promiscuous mode [ 73.066663][ T5775] team0: Port device team_slave_0 added [ 73.075644][ T5775] team0: Port device team_slave_1 added [ 73.086311][ T5771] hsr_slave_0: entered promiscuous mode [ 73.093193][ T5771] hsr_slave_1: entered promiscuous mode [ 73.102632][ T5776] team0: Port device team_slave_1 added [ 73.124750][ T5774] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.136748][ T5774] bridge0: port 2(bridge_slave_1) entered disabled state [ 73.144211][ T5774] bridge_slave_1: entered allmulticast mode [ 73.151668][ T5774] bridge_slave_1: entered promiscuous mode [ 73.183692][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 73.190861][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.217092][ T5775] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 73.229751][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 73.236709][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.262717][ T5775] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 73.293061][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 73.300121][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.326327][ T5776] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 73.339233][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 73.346206][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.372243][ T5776] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 73.418061][ T5774] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 73.453585][ T5774] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 73.515510][ T5775] hsr_slave_0: entered promiscuous mode [ 73.521788][ T5775] hsr_slave_1: entered promiscuous mode [ 73.527868][ T5775] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 73.535862][ T5775] Cannot create hsr debugfs directory [ 73.561109][ T5776] hsr_slave_0: entered promiscuous mode [ 73.567362][ T5776] hsr_slave_1: entered promiscuous mode [ 73.574019][ T5776] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 73.581675][ T5776] Cannot create hsr debugfs directory [ 73.589638][ T5774] team0: Port device team_slave_0 added [ 73.628022][ T5774] team0: Port device team_slave_1 added [ 73.684757][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 73.692204][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.718316][ T5774] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 73.765556][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 73.772758][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.799137][ T5774] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 73.849147][ T5778] Bluetooth: hci0: command tx timeout [ 73.854889][ T5783] Bluetooth: hci2: command tx timeout [ 73.883433][ T5774] hsr_slave_0: entered promiscuous mode [ 73.890217][ T5774] hsr_slave_1: entered promiscuous mode [ 73.896208][ T5774] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 73.904361][ T5774] Cannot create hsr debugfs directory [ 73.929306][ T5778] Bluetooth: hci3: command tx timeout [ 73.935006][ T5783] Bluetooth: hci1: command tx timeout [ 74.054465][ T5771] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 74.082506][ T5771] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 74.096926][ T5771] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 74.107438][ T5771] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 74.204239][ T5775] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 74.225017][ T5775] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 74.252831][ T5775] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 74.263099][ T5775] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 74.332459][ T5776] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 74.343529][ T5776] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 74.356550][ T5776] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 74.366447][ T5776] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 74.456309][ T5774] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 74.477787][ T5774] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 74.487759][ T5774] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 74.498221][ T5774] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 74.514055][ T5771] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.581979][ T5771] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.605549][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.613010][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.642475][ T5775] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.655229][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.662366][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.715387][ T5775] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.732970][ T5776] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.765139][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.772277][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.799638][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.806761][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.831271][ T5776] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.863956][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.871086][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.922223][ T5774] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.938422][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.945571][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.006473][ T5774] 8021q: adding VLAN 0 to HW filter on device team0 [ 75.064386][ T2961] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.071600][ T2961] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.113596][ T2961] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.120794][ T2961] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.277477][ T5771] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.393328][ T5771] veth0_vlan: entered promiscuous mode [ 75.438401][ T5771] veth1_vlan: entered promiscuous mode [ 75.506312][ T5775] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.557086][ T5771] veth0_macvtap: entered promiscuous mode [ 75.573483][ T5774] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.596815][ T5776] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.611152][ T5771] veth1_macvtap: entered promiscuous mode [ 75.652958][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.680035][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.706272][ T5771] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.716131][ T5771] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.725670][ T5771] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.734731][ T5771] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.745376][ T5775] veth0_vlan: entered promiscuous mode [ 75.763881][ T5774] veth0_vlan: entered promiscuous mode [ 75.790737][ T5776] veth0_vlan: entered promiscuous mode [ 75.820749][ T5774] veth1_vlan: entered promiscuous mode [ 75.833403][ T5775] veth1_vlan: entered promiscuous mode [ 75.851260][ T5776] veth1_vlan: entered promiscuous mode [ 75.931721][ T5783] Bluetooth: hci2: command tx timeout [ 75.931754][ T5778] Bluetooth: hci0: command tx timeout [ 75.950088][ T1148] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.957998][ T1148] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.002486][ T5775] veth0_macvtap: entered promiscuous mode [ 76.009429][ T5778] Bluetooth: hci1: command tx timeout [ 76.010354][ T5783] Bluetooth: hci3: command tx timeout [ 76.019460][ T5775] veth1_macvtap: entered promiscuous mode [ 76.035250][ T5774] veth0_macvtap: entered promiscuous mode [ 76.046668][ T5776] veth0_macvtap: entered promiscuous mode [ 76.055333][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.061129][ T5774] veth1_macvtap: entered promiscuous mode [ 76.069518][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.092188][ T5776] veth1_macvtap: entered promiscuous mode [ 76.122798][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 76.145813][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.158166][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 76.174129][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 76.185739][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.204211][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 76.215843][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 76.227419][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.237475][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 76.247936][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.261791][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 76.282190][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 76.294401][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.304896][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 76.317729][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.327887][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 76.338747][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.352046][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 76.362756][ T5775] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.373356][ T5775] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.382676][ T5775] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.393071][ T5775] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.406609][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 76.419644][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.429776][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 76.440502][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.456544][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 76.472295][ T5835] IPv6: NLM_F_CREATE should be specified when creating new route [ 76.483393][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 76.501645][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.515358][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 76.528076][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.540522][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 76.551736][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.563178][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 76.599996][ T5776] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.850884][ T5837] capability: warning: `syz.1.5' uses deprecated v2 capabilities in a way that may be insecure [ 76.879586][ T5776] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.899512][ T5776] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.908657][ T5776] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.978719][ T5811] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 78.008860][ T5778] Bluetooth: hci0: command tx timeout [ 78.014462][ T5783] Bluetooth: hci2: command tx timeout [ 78.088655][ T5783] Bluetooth: hci3: command tx timeout [ 78.094108][ T5783] Bluetooth: hci1: command tx timeout [ 78.177916][ T5811] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 78.189938][ T5811] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 78.203507][ T5811] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 78.218219][ T5811] usb 2-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice= 1.00 [ 78.231596][ T5811] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 78.240520][ T5811] usb 2-1: Product: syz [ 78.245824][ T5811] usb 2-1: Manufacturer: syz [ 78.281009][ T5845] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 78.301596][ T5845] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 78.315203][ T5845] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 78.563726][ T5774] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.577992][ T5774] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.588645][ T5774] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.597378][ T5774] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.724464][ T2961] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.736053][ T2961] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.753784][ T1148] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.769336][ T1148] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.804484][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.818642][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.857870][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.874171][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.884516][ T5811] redrat3 2-1:1.0: Problem fetching firmware ID [ 78.915819][ T5811] redrat3 2-1:1.0: Failed to read timeout from hardware [ 78.925766][ T2961] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.936742][ T2961] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.022993][ T1148] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.063852][ T1148] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.103036][ T5811] rc_core: IR keymap rc-hauppauge not found [ 79.129513][ T5811] Registered IR keymap rc-empty [ 79.140718][ T5852] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 79.147364][ T5811] rc rc0: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/rc/rc0 [ 79.234606][ T5811] input: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/rc/rc0/input5 [ 79.300244][ T5811] redrat3 2-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0 [ 79.310945][ T5811] redrat3 2-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0 [ 79.322141][ T5811] redrat3 2-1:1.0: redrat3_enable_detector: detector status: -5, should be 1 [ 79.344955][ T5811] redrat3: probe of 2-1:1.0 failed with error -5 [ 79.382157][ T5811] usb 2-1: USB disconnect, device number 2 [ 79.400734][ T5142] ================================================================== [ 79.408839][ T5142] BUG: KASAN: slab-use-after-free in string+0x204/0x290 [ 79.415815][ T5142] Read of size 1 at addr ffff888021bf8760 by task udevd/5142 [ 79.423198][ T5142] [ 79.425547][ T5142] CPU: 1 PID: 5142 Comm: udevd Not tainted syzkaller #0 [ 79.432494][ T5142] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 79.442576][ T5142] Call Trace: [ 79.445878][ T5142] [ 79.448821][ T5142] dump_stack_lvl+0x18c/0x250 [ 79.453523][ T5142] ? __lock_acquire+0x7d80/0x7d80 [ 79.458565][ T5142] ? show_regs_print_info+0x20/0x20 [ 79.463784][ T5142] ? load_image+0x420/0x420 [ 79.468309][ T5142] ? __virt_addr_valid+0x10c/0x380 [ 79.473445][ T5142] ? __virt_addr_valid+0x10c/0x380 [ 79.478574][ T5142] ? __virt_addr_valid+0x10c/0x380 [ 79.483712][ T5142] print_report+0xa8/0x210 [ 79.488149][ T5142] ? string+0x204/0x290 [ 79.492320][ T5142] kasan_report+0x117/0x150 [ 79.496844][ T5142] ? string+0x204/0x290 [ 79.501027][ T5142] string+0x204/0x290 [ 79.505027][ T5142] vsnprintf+0xf72/0x1ba0 [ 79.509383][ T5142] add_uevent_var+0x1d1/0x460 [ 79.514073][ T5142] ? vfs_read+0x486/0x990 [ 79.518412][ T5142] ? kobject_uevent_env+0x890/0x890 [ 79.523640][ T5142] rc_dev_uevent+0x15f/0x190 [ 79.528689][ T5142] dev_uevent+0x53a/0x7c0 [ 79.533046][ T5142] ? dev_uevent_name+0xa0/0xa0 [ 79.537839][ T5142] uevent_show+0x196/0x300 [ 79.542283][ T5142] dev_attr_show+0x54/0xc0 [ 79.546718][ T5142] sysfs_kf_seq_show+0x34d/0x4c0 [ 79.551673][ T5142] ? device_get_ownership+0xb0/0xb0 [ 79.556896][ T5142] seq_read_iter+0x464/0xc50 [ 79.561508][ T5142] ? common_file_perm+0x198/0x1f0 [ 79.566578][ T5142] vfs_read+0x486/0x990 [ 79.570757][ T5142] ? kernel_read+0x1e0/0x1e0 [ 79.575369][ T5142] ? __x64_sys_newfstat+0x1c4/0x250 [ 79.580588][ T5142] ? do_sys_openat2+0x170/0x1d0 [ 79.585465][ T5142] ? __fdget_pos+0x2ba/0x330 [ 79.590082][ T5142] ksys_read+0x151/0x260 [ 79.594350][ T5142] ? vfs_write+0x9a0/0x9a0 [ 79.598784][ T5142] ? lockdep_hardirqs_on+0x98/0x150 [ 79.603997][ T5142] do_syscall_64+0x55/0xb0 [ 79.608423][ T5142] ? clear_bhb_loop+0x40/0x90 [ 79.613113][ T5142] ? clear_bhb_loop+0x40/0x90 [ 79.617809][ T5142] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 79.623739][ T5142] RIP: 0033:0x7f38dcea7407 [ 79.628184][ T5142] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 79.647808][ T5142] RSP: 002b:00007fffcdb38150 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 79.656246][ T5142] RAX: ffffffffffffffda RBX: 00007f38dd597880 RCX: 00007f38dcea7407 [ 79.664229][ T5142] RDX: 0000000000001000 RSI: 00005587935cc550 RDI: 000000000000000c [ 79.672207][ T5142] RBP: 00007f38dcfefff0 R08: 0000000000000000 R09: 0000000000000000 [ 79.680181][ T5142] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 79.688142][ T5142] R13: 00007f38dcfefea0 R14: 0000000000000000 R15: 00005587935be7a0 [ 79.696118][ T5142] [ 79.699132][ T5142] [ 79.701443][ T5142] Allocated by task 5811: [ 79.705754][ T5142] kasan_set_track+0x4e/0x70 [ 79.710339][ T5142] __kasan_kmalloc+0x8f/0xa0 [ 79.714923][ T5142] redrat3_dev_probe+0x3f9/0x23d0 [ 79.719944][ T5142] usb_probe_interface+0x6eb/0xcf0 [ 79.725044][ T5142] really_probe+0x247/0xae0 [ 79.729533][ T5142] __driver_probe_device+0x1f5/0x390 [ 79.734803][ T5142] driver_probe_device+0x4f/0x420 [ 79.739817][ T5142] __device_attach_driver+0x2ca/0x510 [ 79.745201][ T5142] bus_for_each_drv+0x252/0x2e0 [ 79.750041][ T5142] __device_attach+0x2c1/0x420 [ 79.754793][ T5142] bus_probe_device+0x180/0x260 [ 79.759814][ T5142] device_add+0x87c/0xc40 [ 79.764139][ T5142] usb_set_configuration+0x1ad0/0x2150 [ 79.769592][ T5142] usb_generic_driver_probe+0x8d/0x150 [ 79.775046][ T5142] usb_probe_device+0x12a/0x260 [ 79.779949][ T5142] really_probe+0x247/0xae0 [ 79.784463][ T5142] __driver_probe_device+0x1f5/0x390 [ 79.789757][ T5142] driver_probe_device+0x4f/0x420 [ 79.794794][ T5142] __device_attach_driver+0x2ca/0x510 [ 79.800162][ T5142] bus_for_each_drv+0x252/0x2e0 [ 79.805005][ T5142] __device_attach+0x2c1/0x420 [ 79.809757][ T5142] bus_probe_device+0x180/0x260 [ 79.814599][ T5142] device_add+0x87c/0xc40 [ 79.818921][ T5142] usb_new_device+0x995/0x1550 [ 79.823671][ T5142] hub_event+0x29d5/0x4a80 [ 79.828078][ T5142] process_scheduled_works+0xa60/0x1600 [ 79.833613][ T5142] worker_thread+0xa5e/0xfe0 [ 79.838190][ T5142] kthread+0x2fa/0x390 [ 79.842244][ T5142] ret_from_fork+0x48/0x80 [ 79.846666][ T5142] ret_from_fork_asm+0x11/0x20 [ 79.851437][ T5142] [ 79.853759][ T5142] Freed by task 5811: [ 79.857733][ T5142] kasan_set_track+0x4e/0x70 [ 79.862330][ T5142] kasan_save_free_info+0x28/0x40 [ 79.867347][ T5142] ____kasan_slab_free+0x126/0x1f0 [ 79.872450][ T5142] slab_free_freelist_hook+0x130/0x1a0 [ 79.877899][ T5142] __kmem_cache_free+0xba/0x1f0 [ 79.882740][ T5142] redrat3_dev_probe+0x1b73/0x23d0 [ 79.887844][ T5142] usb_probe_interface+0x6eb/0xcf0 [ 79.892947][ T5142] really_probe+0x247/0xae0 [ 79.897441][ T5142] __driver_probe_device+0x1f5/0x390 [ 79.902714][ T5142] driver_probe_device+0x4f/0x420 [ 79.907726][ T5142] __device_attach_driver+0x2ca/0x510 [ 79.913086][ T5142] bus_for_each_drv+0x252/0x2e0 [ 79.917934][ T5142] __device_attach+0x2c1/0x420 [ 79.922712][ T5142] bus_probe_device+0x180/0x260 [ 79.927556][ T5142] device_add+0x87c/0xc40 [ 79.931881][ T5142] usb_set_configuration+0x1ad0/0x2150 [ 79.937339][ T5142] usb_generic_driver_probe+0x8d/0x150 [ 79.942792][ T5142] usb_probe_device+0x12a/0x260 [ 79.947634][ T5142] really_probe+0x247/0xae0 [ 79.952124][ T5142] __driver_probe_device+0x1f5/0x390 [ 79.957395][ T5142] driver_probe_device+0x4f/0x420 [ 79.962414][ T5142] __device_attach_driver+0x2ca/0x510 [ 79.967777][ T5142] bus_for_each_drv+0x252/0x2e0 [ 79.972622][ T5142] __device_attach+0x2c1/0x420 [ 79.977371][ T5142] bus_probe_device+0x180/0x260 [ 79.982226][ T5142] device_add+0x87c/0xc40 [ 79.986544][ T5142] usb_new_device+0x995/0x1550 [ 79.991296][ T5142] hub_event+0x29d5/0x4a80 [ 79.995701][ T5142] process_scheduled_works+0xa60/0x1600 [ 80.001269][ T5142] worker_thread+0xa5e/0xfe0 [ 80.005853][ T5142] kthread+0x2fa/0x390 [ 80.009920][ T5142] ret_from_fork+0x48/0x80 [ 80.014332][ T5142] ret_from_fork_asm+0x11/0x20 [ 80.019090][ T5142] [ 80.021405][ T5142] The buggy address belongs to the object at ffff888021bf8000 [ 80.021405][ T5142] which belongs to the cache kmalloc-2k of size 2048 [ 80.035447][ T5142] The buggy address is located 1888 bytes inside of [ 80.035447][ T5142] freed 2048-byte region [ffff888021bf8000, ffff888021bf8800) [ 80.049407][ T5142] [ 80.051743][ T5142] The buggy address belongs to the physical page: [ 80.058167][ T5142] page:ffffea000086fe00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x21bf8 [ 80.068337][ T5142] head:ffffea000086fe00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 80.077281][ T5142] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 80.085257][ T5142] page_type: 0xffffffff() [ 80.089596][ T5142] raw: 00fff00000000840 ffff888017c42000 dead000000000122 0000000000000000 [ 80.098167][ T5142] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000 [ 80.106738][ T5142] page dumped because: kasan: bad access detected [ 80.113142][ T5142] page_owner tracks the page as allocated [ 80.118850][ T5142] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5811, tgid 5811 (kworker/1:3), ts 78333024394, free_ts 78314961065 [ 80.141499][ T5142] post_alloc_hook+0x1c1/0x200 [ 80.146261][ T5142] get_page_from_freelist+0x2181/0x22a0 [ 80.151794][ T5142] __alloc_pages+0x1f0/0x460 [ 80.156372][ T5142] alloc_slab_page+0x5d/0x180 [ 80.161034][ T5142] new_slab+0x87/0x2d0 [ 80.165091][ T5142] ___slab_alloc+0xc5c/0x12f0 [ 80.169755][ T5142] __kmem_cache_alloc_node+0x11f/0x250 [ 80.175216][ T5142] kmalloc_trace+0x2a/0xe0 [ 80.179625][ T5142] redrat3_dev_probe+0x3f9/0x23d0 [ 80.184643][ T5142] usb_probe_interface+0x6eb/0xcf0 [ 80.189739][ T5142] really_probe+0x247/0xae0 [ 80.194232][ T5142] __driver_probe_device+0x1f5/0x390 [ 80.199503][ T5142] driver_probe_device+0x4f/0x420 [ 80.204520][ T5142] __device_attach_driver+0x2ca/0x510 [ 80.209911][ T5142] bus_for_each_drv+0x252/0x2e0 [ 80.214776][ T5142] __device_attach+0x2c1/0x420 [ 80.219531][ T5142] page last free stack trace: [ 80.224195][ T5142] free_unref_page_prepare+0x7d7/0x8f0 [ 80.229644][ T5142] free_unref_page+0x32/0x2e0 [ 80.234316][ T5142] __unfreeze_partials+0x1cf/0x210 [ 80.239417][ T5142] put_cpu_partial+0x17c/0x250 [ 80.244172][ T5142] __slab_free+0x319/0x400 [ 80.248589][ T5142] qlist_free_all+0x75/0xd0 [ 80.253091][ T5142] kasan_quarantine_reduce+0x143/0x160 [ 80.258545][ T5142] __kasan_slab_alloc+0x22/0x80 [ 80.263388][ T5142] slab_post_alloc_hook+0x6a/0x4d0 [ 80.268492][ T5142] __kmem_cache_alloc_node+0x194/0x250 [ 80.273944][ T5142] kmalloc_trace+0x2a/0xe0 [ 80.278352][ T5142] syslog_print+0x104/0x630 [ 80.282850][ T5142] do_syslog+0x575/0x820 [ 80.287081][ T5142] __x64_sys_syslog+0x7c/0x90 [ 80.291749][ T5142] do_syscall_64+0x55/0xb0 [ 80.296158][ T5142] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 80.302051][ T5142] [ 80.304389][ T5142] Memory state around the buggy address: [ 80.310009][ T5142] ffff888021bf8600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 80.318057][ T5142] ffff888021bf8680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 80.326109][ T5142] >ffff888021bf8700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 80.334193][ T5142] ^ [ 80.341377][ T5142] ffff888021bf8780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 80.349428][ T5142] ffff888021bf8800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 80.357472][ T5142] ================================================================== [ 80.414615][ T5783] Bluetooth: hci2: command tx timeout [ 80.420092][ T5778] Bluetooth: hci0: command tx timeout [ 80.420122][ T5778] Bluetooth: hci1: command tx timeout [ 80.420158][ T5778] Bluetooth: hci3: command tx timeout [ 80.453555][ T5142] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 80.460791][ T5142] CPU: 0 PID: 5142 Comm: udevd Not tainted syzkaller #0 [ 80.467744][ T5142] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 80.477814][ T5142] Call Trace: [ 80.481105][ T5142] [ 80.484051][ T5142] dump_stack_lvl+0x18c/0x250 [ 80.488751][ T5142] ? show_regs_print_info+0x20/0x20 [ 80.493965][ T5142] ? load_image+0x420/0x420 [ 80.498488][ T5142] panic+0x2ca/0x720 [ 80.502407][ T5142] ? bpf_jit_dump+0xd0/0xd0 [ 80.506930][ T5142] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 80.512925][ T5142] ? _raw_spin_unlock+0x40/0x40 [ 80.517794][ T5142] ? print_memory_metadata+0x314/0x400 [ 80.523274][ T5142] ? string+0x204/0x290 [ 80.527445][ T5142] check_panic_on_warn+0x84/0xa0 [ 80.532400][ T5142] ? string+0x204/0x290 [ 80.536594][ T5142] end_report+0x6f/0x130 [ 80.540852][ T5142] kasan_report+0x128/0x150 [ 80.545361][ T5142] ? string+0x204/0x290 [ 80.549520][ T5142] string+0x204/0x290 [ 80.553503][ T5142] vsnprintf+0xf72/0x1ba0 [ 80.557829][ T5142] add_uevent_var+0x1d1/0x460 [ 80.562499][ T5142] ? vfs_read+0x486/0x990 [ 80.566820][ T5142] ? kobject_uevent_env+0x890/0x890 [ 80.572007][ T5142] rc_dev_uevent+0x15f/0x190 [ 80.576590][ T5142] dev_uevent+0x53a/0x7c0 [ 80.580921][ T5142] ? dev_uevent_name+0xa0/0xa0 [ 80.585678][ T5142] uevent_show+0x196/0x300 [ 80.590180][ T5142] dev_attr_show+0x54/0xc0 [ 80.594589][ T5142] sysfs_kf_seq_show+0x34d/0x4c0 [ 80.599519][ T5142] ? device_get_ownership+0xb0/0xb0 [ 80.604714][ T5142] seq_read_iter+0x464/0xc50 [ 80.609299][ T5142] ? common_file_perm+0x198/0x1f0 [ 80.614317][ T5142] vfs_read+0x486/0x990 [ 80.618478][ T5142] ? kernel_read+0x1e0/0x1e0 [ 80.623067][ T5142] ? __x64_sys_newfstat+0x1c4/0x250 [ 80.628260][ T5142] ? do_sys_openat2+0x170/0x1d0 [ 80.633116][ T5142] ? __fdget_pos+0x2ba/0x330 [ 80.637701][ T5142] ksys_read+0x151/0x260 [ 80.641937][ T5142] ? vfs_write+0x9a0/0x9a0 [ 80.646351][ T5142] ? lockdep_hardirqs_on+0x98/0x150 [ 80.651544][ T5142] do_syscall_64+0x55/0xb0 [ 80.655980][ T5142] ? clear_bhb_loop+0x40/0x90 [ 80.660658][ T5142] ? clear_bhb_loop+0x40/0x90 [ 80.665350][ T5142] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 80.671235][ T5142] RIP: 0033:0x7f38dcea7407 [ 80.675643][ T5142] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 80.695246][ T5142] RSP: 002b:00007fffcdb38150 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 80.703652][ T5142] RAX: ffffffffffffffda RBX: 00007f38dd597880 RCX: 00007f38dcea7407 [ 80.711616][ T5142] RDX: 0000000000001000 RSI: 00005587935cc550 RDI: 000000000000000c [ 80.719582][ T5142] RBP: 00007f38dcfefff0 R08: 0000000000000000 R09: 0000000000000000 [ 80.727541][ T5142] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 80.735502][ T5142] R13: 00007f38dcfefea0 R14: 0000000000000000 R15: 00005587935be7a0 [ 80.743468][ T5142] [ 80.746717][ T5142] Kernel Offset: disabled [ 80.751048][ T5142] Rebooting in 86400 seconds..