Warning: Permanently added '10.128.1.156' (ED25519) to the list of known hosts. 1970/01/01 00:00:29 parsed 1 programs 1970/01/01 00:00:29 serving rpc on tcp://34127 [ 31.011886][ T4729] cgroup: Unknown subsys name 'net' [ 31.141914][ T4729] cgroup: Unknown subsys name 'cpuset' [ 31.144161][ T4729] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 31.300658][ T4729] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 32.893980][ T4735] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 33.237524][ T4750] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.238148][ T4750] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.238241][ T4750] bridge_slave_0: entered allmulticast mode [ 33.238730][ T4750] bridge_slave_0: entered promiscuous mode [ 33.241246][ T4750] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.241302][ T4750] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.241378][ T4750] bridge_slave_1: entered allmulticast mode [ 33.241842][ T4750] bridge_slave_1: entered promiscuous mode [ 33.250175][ T4750] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 33.251777][ T4750] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 33.257978][ T4750] team0: Port device team_slave_0 added [ 33.259101][ T4750] team0: Port device team_slave_1 added [ 33.265682][ T4750] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 33.265708][ T4750] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 33.265724][ T4750] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 33.266519][ T4750] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 33.266527][ T4750] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 33.266540][ T4750] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 33.277344][ T4750] hsr_slave_0: entered promiscuous mode [ 33.277677][ T4750] hsr_slave_1: entered promiscuous mode [ 33.345134][ T4750] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 33.348651][ T4750] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 33.349388][ T4750] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 33.355630][ T4750] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 33.356802][ T4750] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 33.359429][ T4750] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 33.363101][ T4750] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 33.365298][ T4750] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 33.375398][ T4750] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.375477][ T4750] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.375621][ T4750] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.375650][ T4750] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.394655][ T4750] 8021q: adding VLAN 0 to HW filter on device bond0 [ 33.399578][ T4750] 8021q: adding VLAN 0 to HW filter on device team0 [ 33.402783][ T40] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.404336][ T40] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.411314][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.411375][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.415805][ T3659] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.415860][ T3659] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.426134][ T4750] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 33.426173][ T4750] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 33.522923][ T4750] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 33.537400][ T4750] veth0_vlan: entered promiscuous mode [ 33.540084][ T4750] veth1_vlan: entered promiscuous mode [ 33.548789][ T4750] veth0_macvtap: entered promiscuous mode [ 33.551115][ T4750] veth1_macvtap: entered promiscuous mode [ 33.555640][ T4750] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.556918][ T4750] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 33.559087][ T3659] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.560343][ T3659] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.560413][ T3659] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.560497][ T3659] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.687314][ T3659] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 33.699479][ T1937] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.701463][ T1937] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.709678][ T1937] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.711815][ T1937] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.735371][ T3659] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 33.827151][ T3659] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 33.862948][ T4798] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 33.863738][ T4798] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 33.863919][ T4798] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 33.864249][ T4798] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 33.864448][ T4798] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 33.878069][ T3659] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 1970/01/01 00:00:34 executed programs: 0 [ 34.655927][ T4798] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 34.657497][ T4798] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 34.658250][ T4798] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 34.658611][ T4798] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 34.658808][ T4798] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 34.803919][ T4830] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.804014][ T4830] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.804091][ T4830] bridge_slave_0: entered allmulticast mode [ 34.804534][ T4830] bridge_slave_0: entered promiscuous mode [ 34.805976][ T4830] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.806025][ T4830] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.806122][ T4830] bridge_slave_1: entered allmulticast mode [ 34.806541][ T4830] bridge_slave_1: entered promiscuous mode [ 34.814635][ T4830] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 34.816134][ T4830] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 34.823341][ T4830] team0: Port device team_slave_0 added [ 34.824209][ T4830] team0: Port device team_slave_1 added [ 34.830653][ T4830] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 34.830681][ T4830] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 34.830702][ T4830] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 34.831298][ T4830] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 34.831305][ T4830] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 34.831318][ T4830] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 34.842498][ T4830] hsr_slave_0: entered promiscuous mode [ 34.842821][ T4830] hsr_slave_1: entered promiscuous mode [ 34.843053][ T4830] debugfs: 'hsr0' already exists in 'hsr' [ 34.843116][ T4830] Cannot create hsr debugfs directory [ 36.670857][ T4798] Bluetooth: hci0: command tx timeout [ 37.187730][ T3659] bridge_slave_1: left allmulticast mode [ 37.187784][ T3659] bridge_slave_1: left promiscuous mode [ 37.188272][ T3659] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.192515][ T3659] bridge_slave_0: left allmulticast mode [ 37.192546][ T3659] bridge_slave_0: left promiscuous mode [ 37.192632][ T3659] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.255554][ T3659] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 37.302411][ T3659] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 37.311719][ T3659] bond0 (unregistering): Released all slaves [ 37.370872][ T3659] hsr_slave_0: left promiscuous mode [ 37.372303][ T3659] hsr_slave_1: left promiscuous mode [ 37.372619][ T3659] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 37.372637][ T3659] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 37.375357][ T3659] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 37.375373][ T3659] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 37.379866][ T3659] veth1_macvtap: left promiscuous mode [ 37.379932][ T3659] veth0_macvtap: left promiscuous mode [ 37.380004][ T3659] veth1_vlan: left promiscuous mode [ 37.380046][ T3659] veth0_vlan: left promiscuous mode [ 37.490122][ T3659] team0 (unregistering): Port device team_slave_1 removed [ 37.495512][ T3659] team0 (unregistering): Port device team_slave_0 removed [ 37.537149][ T4407] 8021q: adding VLAN 0 to HW filter on device eth0 [ 37.719942][ T4830] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 37.723908][ T4830] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 37.724389][ T4830] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 37.726980][ T4830] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 37.727457][ T4830] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 37.732566][ T4830] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 37.737585][ T4830] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 37.740634][ T4830] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 37.784164][ T4830] 8021q: adding VLAN 0 to HW filter on device bond0 [ 37.791205][ T4830] 8021q: adding VLAN 0 to HW filter on device team0 [ 37.988935][ T149] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.988998][ T149] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.013323][ T3951] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.013377][ T3951] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.237336][ T4830] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.250796][ T4830] veth0_vlan: entered promiscuous mode [ 38.254090][ T4830] veth1_vlan: entered promiscuous mode [ 38.261924][ T4830] veth0_macvtap: entered promiscuous mode [ 38.263116][ T4830] veth1_macvtap: entered promiscuous mode [ 38.266707][ T4830] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 38.267754][ T4830] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 38.270081][ T3951] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.336874][ T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 38.336909][ T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 38.340768][ T40] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.341450][ T40] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.341474][ T40] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.347727][ T1937] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 38.347769][ T1937] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 38.390868][ T4923] syz.0.17 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 38.393051][ T4923] CPU: 1 UID: 0 PID: 4923 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT [ 38.393069][ T4923] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 38.393075][ T4923] Call trace: [ 38.393079][ T4923] show_stack+0x2c/0x3c (C) [ 38.393102][ T4923] __dump_stack+0x30/0x40 [ 38.393114][ T4923] dump_stack_lvl+0xd8/0x12c [ 38.393124][ T4923] dump_stack+0x1c/0x28 [ 38.393133][ T4923] dump_header+0xbc/0x3f0 [ 38.393141][ T4923] oom_kill_process+0x248/0x8a0 [ 38.393150][ T4923] out_of_memory+0xd24/0x1064 [ 38.393159][ T4923] mem_cgroup_out_of_memory+0xe8/0x170 [ 38.393168][ T4923] try_charge_memcg+0x8ec/0xc64 [ 38.393175][ T4923] obj_cgroup_charge_pages+0x30/0xb0 [ 38.393182][ T4923] __memcg_slab_post_alloc_hook+0x4a0/0x8cc [ 38.393189][ T4923] kmem_cache_alloc_lru_noprof+0x32c/0x5dc [ 38.393199][ T4923] alloc_inode+0x84/0x198 [ 38.393208][ T4923] new_inode+0x20/0x50 [ 38.393217][ T4923] gadgetfs_make_inode+0x34/0x18c [ 38.393226][ T4923] gadgetfs_create_file+0x48/0xd8 [ 38.393234][ T4923] gadgetfs_bind+0x3f8/0x75c [ 38.393242][ T4923] gadget_bind_driver+0x274/0x834 [ 38.393250][ T4923] really_probe+0x29c/0x800 [ 38.393261][ T4923] __driver_probe_device+0x1e0/0x350 [ 38.393270][ T4923] driver_probe_device+0x6c/0x19c [ 38.393280][ T4923] __driver_attach+0x168/0x384 [ 38.393289][ T4923] bus_for_each_dev+0x128/0x1b4 [ 38.393297][ T4923] driver_attach+0x50/0x60 [ 38.393306][ T4923] bus_add_driver+0x208/0x500 [ 38.393315][ T4923] driver_register+0x220/0x310 [ 38.393324][ T4923] usb_gadget_register_driver_owner+0xf0/0x25c [ 38.393332][ T4923] dev_config+0x91c/0xcc0 [ 38.393339][ T4923] vfs_write+0x2a4/0xa0c [ 38.393346][ T4923] ksys_write+0x12c/0x228 [ 38.393353][ T4923] __arm64_sys_write+0x84/0x98 [ 38.393360][ T4923] invoke_syscall+0x98/0x244 [ 38.393370][ T4923] el0_svc_common+0xec/0x23c [ 38.393379][ T4923] do_el0_svc+0x4c/0x5c [ 38.393388][ T4923] el0_svc+0x64/0x260 [ 38.393398][ T4923] el0t_64_sync_handler+0x44/0x104 [ 38.393407][ T4923] el0t_64_sync+0x198/0x19c [ 38.399008][ T4923] memory: usage 0kB, limit 0kB, failcnt 19 [ 38.399029][ T4923] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 38.399037][ T4923] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 38.399042][ T4923] Memory cgroup stats for /syz0/test: [ 38.399162][ T4923] cache 0 [ 38.399167][ T4923] rss 0 [ 38.399170][ T4923] rss_huge 0 [ 38.399173][ T4923] shmem 0 [ 38.399176][ T4923] mapped_file 0 [ 38.399179][ T4923] dirty 0 [ 38.399182][ T4923] writeback 0 [ 38.399184][ T4923] workingset_refault_anon 0 [ 38.399188][ T4923] workingset_refault_file 0 [ 38.399191][ T4923] swap 0 [ 38.399194][ T4923] swapcached 0 [ 38.399197][ T4923] pgpgin 0 [ 38.399200][ T4923] pgpgout 0 [ 38.399203][ T4923] pgfault 0 [ 38.399206][ T4923] pgmajfault 0 [ 38.399209][ T4923] inactive_anon 0 [ 38.399212][ T4923] active_anon 0 [ 38.399215][ T4923] inactive_file 0 [ 38.399217][ T4923] active_file 0 [ 38.399220][ T4923] unevictable 0 [ 38.399223][ T4923] hierarchical_memory_limit 0 [ 38.399227][ T4923] hierarchical_memsw_limit 9223372036854771712 [ 38.399230][ T4923] total_cache 0 [ 38.399233][ T4923] total_rss 0 [ 38.399236][ T4923] total_rss_huge 0 [ 38.399239][ T4923] total_shmem 0 [ 38.399242][ T4923] total_mapped_file 0 [ 38.399245][ T4923] total_dirty 0 [ 38.399248][ T4923] total_writeback 0 [ 38.399251][ T4923] total_workingset_refault_anon 0 [ 38.399254][ T4923] total_workingset_refault_file 0 [ 38.399258][ T4923] total_swap 0 [ 38.399261][ T4923] total_swapcached 0 [ 38.399264][ T4923] total_pgpgin 0 [ 38.399267][ T4923] total_pgpgout 0 [ 38.399269][ T4923] total_pgfault 0 [ 38.399272][ T4923] total_pgmajfault 0 [ 38 ** replaying previous printk message ** [ 38.399275][ T4923] total_inactive_anon 0 [ 38.399278][ T4923] total_active_anon 0 [ 38.399281][ T4923] total_inactive_file 0 [ 38.399284][ T4923] total_active_file 0 [ 38.399287][ T4923] total_unevictable 0 [ 38.399290][ T4923] anon_cost 0 [ 38.399293][ T4923] file_cost 0 [ 38.399297][ T4923] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0,oom_memcg=/syz0/test,task_memcg=/syz0/test,task=syz.0.17,pid=4923,uid=0 [ 38.399403][ T4923] Memory cgroup out of memory: Killed process 4923 (syz.0.17) total-vm:44808kB, anon-rss:1288kB, file-rss:1040kB, shmem-rss:0kB, UID:0 pgtables:72kB oom_score_adj:1000 [ 38.405230][ T4923] udc dummy_udc.0: failed to start USB Gadget filesystem: -12 [ 38.405246][ T4923] gadgetfs gadget.0: probe with driver gadgetfs failed with error -12 [ 38.405486][ T4923] gadgetfs expected dummy_udc controller not usbip-vudc [ 38.405493][ T4923] udc usbip-vudc.0: failed to start USB Gadget filesystem: -19 [ 38.406655][ T4923] UDC core: USB Gadget filesystem: couldn't find an available UDC [ 38.458360][ T4924] ================================================================== [ 38.458371][ T4924] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irq+0x58/0x70 [ 38.458389][ T4924] Read of size 1 at addr ffff0000d17f2018 by task syz.0.18/4924 [ 38.458396][ T4924] [ 38.458401][ T4924] CPU: 0 UID: 0 PID: 4924 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT [ 38.458410][ T4924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 38.458414][ T4924] Call trace: [ 38.458417][ T4924] show_stack+0x2c/0x3c (C) [ 38.458430][ T4924] __dump_stack+0x30/0x40 [ 38.458440][ T4924] dump_stack_lvl+0xd8/0x12c [ 38.458449][ T4924] print_address_description+0xb0/0x238 [ 38.458457][ T4924] print_report+0x68/0x84 [ 38.458464][ T4924] kasan_report+0x8c/0xc4 [ 38.458473][ T4924] __kasan_check_byte+0x3c/0x54 [ 38.458482][ T4924] lock_acquire+0xa4/0x364 [ 38.458489][ T4924] _raw_spin_lock_irq+0x58/0x70 [ 38.458497][ T4924] gadget_dev_open+0x50/0x1c4 [ 38.458506][ T4924] do_dentry_open+0x5c4/0xfc0 [ 38.458516][ T4924] vfs_open+0x44/0x2dc [ 38.458525][ T4924] path_openat+0x21fc/0x2a60 [ 38.458533][ T4924] do_file_open+0x1c8/0x2e8 [ 38.458541][ T4924] do_sys_openat2+0x114/0x1e8 [ 38.458551][ T4924] do_sys_open+0xb0/0xe0 [ 38.458560][ T4924] __arm64_sys_openat+0xa8/0xc4 [ 38.458569][ T4924] invoke_syscall+0x98/0x244 [ 38.458579][ T4924] el0_svc_common+0xec/0x23c [ 38.458588][ T4924] do_el0_svc+0x4c/0x5c [ 38.458597][ T4924] el0_svc+0x64/0x260 [ 38.458605][ T4924] el0t_64_sync_handler+0x44/0x104 [ 38.458613][ T4924] el0t_64_sync+0x198/0x19c [ 38.458621][ T4924] [ 38.458623][ T4924] Allocated by task 4830: [ 38.458628][ T4924] kasan_save_track+0x40/0x78 [ 38.458635][ T4924] kasan_save_alloc_info+0x40/0x50 [ 38.458643][ T4924] __kasan_kmalloc+0x9c/0xb4 [ 38.458650][ T4924] __kmalloc_cache_noprof+0x2e8/0x5ec [ 38.458657][ T4924] gadgetfs_fill_super+0x19c/0x370 [ 38.458663][ T4924] vfs_get_super+0xb8/0x148 [ 38.458670][ T4924] get_tree_single+0x30/0x40 [ 38.458676][ T4924] gadgetfs_get_tree+0x28/0x38 [ 38.458682][ T4924] vfs_get_tree+0x90/0x28c [ 38.458688][ T4924] fc_mount+0x24/0xac [ 38.458695][ T4924] do_new_mount+0x2a4/0x538 [ 38.458702][ T4924] path_mount+0x5f0/0xa88 [ 38.458709][ T4924] do_mount+0xe8/0x148 [ 38.458716][ T4924] __arm64_sys_mount+0x33c/0x388 [ 38.458724][ T4924] invoke_syscall+0x98/0x244 [ 38.458732][ T4924] el0_svc_common+0xec/0x23c [ 38.458739][ T4924] do_el0_svc+0x4c/0x5c [ 38.458747][ T4924] el0_svc+0x64/0x260 [ 38.458753][ T4924] el0t_64_sync_handler+0x44/0x104 [ 38.458760][ T4924] el0t_64_sync+0x198/0x19c [ 38.458765][ T4924] [ 38.458766][ T4924] Freed by task 4923: [ 38.458770][ T4924] kasan_save_track+0x40/0x78 [ 38.458776][ T4924] kasan_save_free_info+0x54/0x6c [ 38.458784][ T4924] __kasan_slab_free+0x74/0xa4 [ 38.458791][ T4924] kfree+0x188/0x690 [ 38.458796][ T4924] put_dev+0x8c/0xf8 [ 38.458802][ T4924] dev_release+0x100/0x15c [ 38.458808][ T4924] __fput+0x338/0x74c [ 38.458814][ T4924] ____fput+0x20/0x30 [ 38.458819][ T4924] task_work_run+0x1cc/0x25c [ 38.458828][ T4924] do_exit+0x58c/0x1a74 [ 38.458844][ T4924] do_group_exit+0x198/0x238 [ 38.458849][ T4924] get_signal+0xfb0/0x1094 [ 38.458856][ T4924] arch_do_signal_or_restart+0x288/0x444c [ 38.458864][ T4924] exit_to_user_mode_loop+0x70/0x17c [ 38.458872][ T4924] el0_svc+0x18c/0x260 [ 38.458878][ T4924] el0t_64_sync_handler+0x44/0x104 [ 38.458885][ T4924] el0t_64_sync+0x198/0x19c [ 38.458891][ T4924] [ 38.458892][ T4924] The buggy address belongs to the object at ffff0000d17f2000 [ 38.458892][ T4924] which belongs to the cache kmalloc-1k of size 1024 [ 38.458898][ T4924] The buggy address is located 24 bytes inside of [ 38.458898][ T4924] freed 1024-byte region [ffff0000d17f2000, ffff0000d17f2400) [ 38.458905][ T4924] [ 38.458907][ T4924] The buggy address belongs to the physical page: [ 38.458911][ T4924] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff0000d17f0000 pfn:0x1117f0 [ 38.458919][ T4924] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 38.458925][ T4924] flags: 0x5ffc00000000240(workingset|head|node=0|zone=2|lastcpupid=0x7ff) [ 38.458933][ T4924] page_type: f5(slab) [ 38.458940][ T4924] raw: 05ffc00000000240 ffff0000c0001dc0 fffffdffc32a8410 ffff0000c0000888 [ 38.458946][ T4924] raw: ffff0000d17f0000 000000080010000e 00000000f5000000 0000000000000000 [ 38.458952][ T4924] head: 05ffc00000000240 ffff0000c0001dc0 fffffdffc32a8410 ffff0000c0000888 [ 38.458958][ T4924] head: ffff0000d17f0000 000000080010000e 00000000f5000000 0000000000000000 [ 38.458963][ T4924] head: 05ffc00000000003 fffffdffc345fc01 00000000ffffffff 00000000ffffffff [ 38.458968][ T4924] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 38.458971][ T4924] page dumped because: kasan: bad access detected [ 38.458974][ T4924] [ 38.458976][ T4924] Memory state around the buggy address: [ 38.458979][ T4924] ffff0000d17f1f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.458984][ T4924] ffff0000d17f1f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.458988][ T4924] >ffff0000d17f2000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 38.458991][ T4924] ^ [ 38.458994][ T4924] ffff0000d17f2080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 38.458998][ T4924] ffff0000d17f2100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 38.459001][ T4924] ================================================================== [ 38.459004][ T4924] Disabling lock debugging due to kernel taint [ 38.459008][ T4924] ------------[ cut here ]------------ [ 38.459010][ T4924] UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.h:68:9 [ 38.459016][ T4924] index 13022 is out of range for type 'unsigned long[8]' [ 38.459021][ T4924] CPU: 0 UID: 0 PID: 4924 Comm: syz.0.18 Tainted: G B syzkaller #0 PREEMPT [ 38.459030][ T4924] Tainted: [B]=BAD_PAGE [ 38.459033][ T4924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 38.459036][ T4924] Call trace: [ 38.459038][ T4924] show_stack+0x2c/0x3c (C) [ 38.459048][ T4924] __dump_stack+0x30/0x40 [ 38.459057][ T4924] dump_stack_lvl+0xd8/0x12c [ 38.459066][ T4924] dump_stack+0x1c/0x28 [ 38.459075][ T4924] ubsan_epilogue+0x14/0x48 [ 38.459084][ T4924] __ubsan_handle_out_of_bounds+0xd0/0xf8 [ 38.459095][ T4924] queued_spin_lock_slowpath+0x834/0xd04 [ 38.459104][ T4924] do_raw_spin_lock+0x21c/0x2d0 [ 38.459112][ T4924] _raw_spin_lock_irq+0x60/0x70 [ 38.459120][ T4924] gadget_dev_open+0x50/0x1c4 [ 38.459128][ T4924] do_dentry_open+0x5c4/0xfc0 [ 38.459137][ T4924] vfs_open+0x44/0x2dc [ 38.459146][ T4924] path_openat+0x21fc/0x2a60 [ 38.459154][ T4924] do_file_open+0x1c8/0x2e8 [ 38.459161][ T4924] do_sys_openat2+0x114/0x1e8 [ 38.459171][ T4924] do_sys_open+0xb0/0xe0 [ 38.459180][ T4924] __arm64_sys_openat+0xa8/0xc4 [ 38.459189][ T4924] invoke_syscall+0x98/0x244 [ 38.459198][ T4924] el0_svc_common+0xec/0x23c [ 38.459207][ T4924] do_el0_svc+0x4c/0x5c [ 38.459216][ T4924] el0_svc+0x64/0x260 [ 38.459224][ T4924] el0t_64_sync_handler+0x44/0x104 [ 38.459232][ T4924] el0t_64_sync+0x198/0x19c [ 38.459238][ T4924] ---[ end trace ]--- [ 38.459250][ T4924] Unable to handle kernel paging request at virtual address ffff800088af8700 [ 38.459254][ T4924] KASAN: probably user-memory-access in range [0x00000004457c3800-0x00000004457c3807] [ 38.459259][ T4924] Mem abort info: [ 38.459261][ T4924] ESR = 0x0000000096000047 [ 38.459264][ T4924] EC = 0x25: DABT (current EL), IL = 32 bits [ 38.459268][ T4924] SET = 0, FnV = 0 [ 38.459271][ T4924] EA = 0, S1PTW = 0 [ 38.459274][ T4924] FSC = 0x07: level 3 translation fault [ 38.459277][ T4924] Data abort info: [ 38.459278][ T4924] ISV = 0, ISS = 0x00000047, ISS2 = 0x00000000 [ 38.459282][ T4924] CM = 0, WnR = 1, TnD = 0, TagAccess = 0 [ 38.459286][ T4924] GCS = 0, Overlay = 0, DirtyBit = 0 [ 38.459290][ T4924] swapper pgtable: 4k pages, 48-bit VAs, pgdp=000000021ae49000 [ 38.459294][ T4924] [ffff800088af8700] pgd=0000000000000000, p4d=1000000221141003, pud=1000000221142003, pmd=1000000221146003, pte=0000000000000000 [ 38.459312][ T4924] Internal error: Oops: 0000000096000047 [#1] SMP [ 38.605458][ T4924] Modules linked in: [ 38.606144][ T4924] CPU: 0 UID: 0 PID: 4924 Comm: syz.0.18 Tainted: G B syzkaller #0 PREEMPT [ 38.607990][ T4924] Tainted: [B]=BAD_PAGE [ 38.608670][ T4924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 38.610285][ T4924] pstate: 834000c5 (Nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 38.611748][ T4924] pc : queued_spin_lock_slowpath+0x544/0xd04 [ 38.612845][ T4924] lr : queued_spin_lock_slowpath+0x834/0xd04 [ 38.613972][ T4924] sp : ffff800099957560 [ 38.614674][ T4924] x29: ffff800099957600 x28: ffff800088af8700 x27: 1fffe000188f43aa [ 38.616034][ T4924] x26: 1fffe0001a2fe400 x25: ffff0001a5dd0708 x24: dfff800000000000 [ 38.617320][ T4924] x23: ffff70001332aeb0 x22: ffff0001a5dd0700 x21: 1fffe00034bba0e0 [ 38.618586][ T4924] x20: ffff0000c47a1d50 x19: ffff0000d17f2000 x18: 0000000000000000 [ 38.619907][ T4924] x17: 363a682e6b636f6c x16: 0000000000000001 x15: 0000000000000000 [ 38.621304][ T4924] x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000004 [ 38.622709][ T4924] x11: ffff700011467668 x10: ffff800088af8700 x9 : ffff800088af8700 [ 38.624052][ T4924] x8 : 0000000000000000 x7 : 0000000000000001 x6 : ffff80008048c60c [ 38.625408][ T4924] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f5c74 [ 38.626740][ T4924] x2 : 0000000000000002 x1 : 0000000000000004 x0 : ffff0001a5dd0708 [ 38.628101][ T4924] Call trace: [ 38.628602][ T4924] queued_spin_lock_slowpath+0x544/0xd04 (P) [ 38.629577][ T4924] do_raw_spin_lock+0x21c/0x2d0 [ 38.630399][ T4924] _raw_spin_lock_irq+0x60/0x70 [ 38.631197][ T4924] gadget_dev_open+0x50/0x1c4 [ 38.631985][ T4924] do_dentry_open+0x5c4/0xfc0 [ 38.632897][ T4924] vfs_open+0x44/0x2dc [ 38.633625][ T4924] path_openat+0x21fc/0x2a60 [ 38.634395][ T4924] do_file_open+0x1c8/0x2e8 [ 38.635227][ T4924] do_sys_openat2+0x114/0x1e8 [ 38.636021][ T4924] do_sys_open+0xb0/0xe0 [ 38.636804][ T4924] __arm64_sys_openat+0xa8/0xc4 [ 38.637626][ T4924] invoke_syscall+0x98/0x244 [ 38.638384][ T4924] el0_svc_common+0xec/0x23c [ 38.639229][ T4924] do_el0_svc+0x4c/0x5c [ 38.639912][ T4924] el0_svc+0x64/0x260 [ 38.640629][ T4924] el0t_64_sync_handler+0x44/0x104 [ 38.641560][ T4924] el0t_64_sync+0x198/0x19c [ 38.642334][ T4924] Code: aa1c03e0 96899931 910022c0 52800081 (f9000396) [ 38.643495][ T4924] ---[ end trace 0000000000000000 ]--- [ 38.945367][ T4924] Kernel panic - not syncing: Oops: Fatal exception [ 38.946456][ T4924] SMP: stopping secondary CPUs [ 38.947266][ T4924] Kernel Offset: disabled [ 38.947964][ T4924] CPU features: 0x14000000,003c0008,27020a02,a84ff6a7 [ 38.949177][ T4924] Memory Limit: none [ 39.212739][ T4924] Rebooting in 86400 seconds..