Warning: Permanently added '10.128.0.159' (ED25519) to the list of known hosts. 2026/09/12 10:33:32 parsed 1 programs 2026/09/12 10:33:32 serving rpc on tcp://41169 [ 111.339173][ T4298] cgroup: Unknown subsys name 'net' [ 111.478789][ T4298] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 112.821309][ T4298] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 115.130966][ T4341] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 115.142487][ T4341] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 115.150683][ T4341] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 115.159759][ T4341] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 115.167848][ T4341] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 115.175200][ T4341] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 115.561624][ T4353] chnl_net:caif_netlink_parms(): no params data found [ 115.610984][ T4353] bridge0: port 1(bridge_slave_0) entered blocking state [ 115.618784][ T4353] bridge0: port 1(bridge_slave_0) entered disabled state [ 115.626740][ T4353] device bridge_slave_0 entered promiscuous mode [ 115.643729][ T4353] bridge0: port 2(bridge_slave_1) entered blocking state [ 115.650865][ T4353] bridge0: port 2(bridge_slave_1) entered disabled state [ 115.658711][ T4353] device bridge_slave_1 entered promiscuous mode [ 115.677948][ T4353] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 115.688922][ T4353] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 115.714436][ T4353] team0: Port device team_slave_0 added [ 115.721397][ T4353] team0: Port device team_slave_1 added [ 115.737702][ T4353] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 115.744982][ T4353] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 115.771049][ T4353] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 115.789287][ T4353] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 115.796376][ T4353] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 115.822368][ T4353] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 115.850480][ T4353] device hsr_slave_0 entered promiscuous mode [ 115.857126][ T4353] device hsr_slave_1 entered promiscuous mode [ 115.977612][ T4353] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 115.987398][ T4353] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 115.996811][ T4353] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 116.005809][ T4353] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 116.024707][ T4353] bridge0: port 2(bridge_slave_1) entered blocking state [ 116.031905][ T4353] bridge0: port 2(bridge_slave_1) entered forwarding state [ 116.039833][ T4353] bridge0: port 1(bridge_slave_0) entered blocking state [ 116.046931][ T4353] bridge0: port 1(bridge_slave_0) entered forwarding state [ 116.129148][ T4353] 8021q: adding VLAN 0 to HW filter on device bond0 [ 116.142679][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 116.153273][ T52] bridge0: port 1(bridge_slave_0) entered disabled state [ 116.161665][ T52] bridge0: port 2(bridge_slave_1) entered disabled state [ 116.177321][ T4353] 8021q: adding VLAN 0 to HW filter on device team0 [ 116.188275][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 116.196862][ T52] bridge0: port 1(bridge_slave_0) entered blocking state [ 116.204000][ T52] bridge0: port 1(bridge_slave_0) entered forwarding state [ 116.215501][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 116.224814][ T52] bridge0: port 2(bridge_slave_1) entered blocking state [ 116.231910][ T52] bridge0: port 2(bridge_slave_1) entered forwarding state [ 116.256781][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 116.265606][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 116.277854][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 116.301100][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 116.315001][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 116.326314][ T4353] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 116.482903][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 116.490866][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 116.505450][ T4353] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 116.529718][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 116.538374][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 116.555647][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 116.566326][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 116.575126][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 116.583054][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 116.598082][ T4353] device veth0_vlan entered promiscuous mode [ 116.608877][ T4353] device veth1_vlan entered promiscuous mode [ 116.631197][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 116.639284][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 116.648645][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 116.657255][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 116.672277][ T4353] device veth0_macvtap entered promiscuous mode [ 116.687948][ T4353] device veth1_macvtap entered promiscuous mode [ 116.702256][ T4353] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 116.710478][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 116.718869][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 116.727315][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 116.736234][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 116.748265][ T4353] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 116.757191][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 116.766062][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 116.782181][ T4353] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.792581][ T4353] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.801601][ T4353] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.811208][ T4353] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.013034][ T76] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 117.031708][ T29] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 117.044947][ T29] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 117.055795][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 117.074636][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 117.082495][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 117.091434][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 2026/09/12 10:33:41 executed programs: 0 [ 118.258199][ T48] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 118.266971][ T48] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 118.275186][ T48] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 118.282891][ T48] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 118.292090][ T48] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 118.299875][ T48] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 118.400852][ T4392] chnl_net:caif_netlink_parms(): no params data found [ 118.443986][ T4392] bridge0: port 1(bridge_slave_0) entered blocking state [ 118.451117][ T4392] bridge0: port 1(bridge_slave_0) entered disabled state [ 118.459055][ T4392] device bridge_slave_0 entered promiscuous mode [ 118.466881][ T4392] bridge0: port 2(bridge_slave_1) entered blocking state [ 118.477245][ T4392] bridge0: port 2(bridge_slave_1) entered disabled state [ 118.485603][ T4392] device bridge_slave_1 entered promiscuous mode [ 118.508309][ T4392] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 118.520006][ T4392] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 118.541518][ T4392] team0: Port device team_slave_0 added [ 118.548701][ T4392] team0: Port device team_slave_1 added [ 118.563999][ T4392] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 118.570973][ T4392] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 118.597886][ T4392] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 118.610641][ T4392] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 118.617640][ T4392] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 118.644259][ T4392] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 118.672786][ T4392] device hsr_slave_0 entered promiscuous mode [ 118.679919][ T4392] device hsr_slave_1 entered promiscuous mode [ 118.686651][ T4392] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 118.694563][ T4392] Cannot create hsr debugfs directory [ 119.173967][ T76] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 120.344275][ T4341] Bluetooth: hci0: command 0x0409 tx timeout [ 121.681667][ T76] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 121.725553][ T76] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.424482][ T4341] Bluetooth: hci0: command 0x041b tx timeout [ 122.499413][ T76] device hsr_slave_0 left promiscuous mode [ 122.522726][ T76] device hsr_slave_1 left promiscuous mode [ 122.531352][ T76] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 122.539834][ T76] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 122.548562][ T76] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 122.557186][ T76] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 122.565224][ T76] device bridge_slave_1 left promiscuous mode [ 122.572374][ T76] bridge0: port 2(bridge_slave_1) entered disabled state [ 122.586286][ T76] device bridge_slave_0 left promiscuous mode [ 122.592653][ T76] bridge0: port 1(bridge_slave_0) entered disabled state [ 122.620448][ T76] device veth1_macvtap left promiscuous mode [ 122.629351][ T76] device veth0_macvtap left promiscuous mode [ 122.635917][ T76] device veth1_vlan left promiscuous mode [ 122.642036][ T76] device veth0_vlan left promiscuous mode [ 122.973460][ T76] team0 (unregistering): Port device team_slave_1 removed [ 123.000984][ T76] team0 (unregistering): Port device team_slave_0 removed [ 123.028150][ T76] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 123.060551][ T76] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 123.221737][ T76] bond0 (unregistering): Released all slaves [ 123.312753][ T4392] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 123.321545][ T4392] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 123.333783][ T4392] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 123.342791][ T4392] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 123.399043][ T4392] 8021q: adding VLAN 0 to HW filter on device bond0 [ 123.426339][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 123.434603][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 123.445142][ T4392] 8021q: adding VLAN 0 to HW filter on device team0 [ 123.455302][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 123.466936][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 123.475595][ T52] bridge0: port 1(bridge_slave_0) entered blocking state [ 123.482775][ T52] bridge0: port 1(bridge_slave_0) entered forwarding state [ 123.492037][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 123.515625][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 123.525072][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 123.533450][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 123.540594][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 123.548542][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 123.558040][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 123.575570][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 123.584770][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 123.593180][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 123.601932][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 123.617293][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 123.629286][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 123.638017][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 123.651220][ T4392] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 123.664651][ T4392] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 123.672855][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 123.681852][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 123.862803][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 123.870474][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 123.881929][ T4392] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 123.913093][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 123.923197][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 123.941258][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 123.949933][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 123.958857][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 123.969039][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 123.979899][ T4392] device veth0_vlan entered promiscuous mode [ 123.990166][ T4392] device veth1_vlan entered promiscuous mode [ 124.007425][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 124.016007][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 124.024610][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 124.033038][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 124.043935][ T4392] device veth0_macvtap entered promiscuous mode [ 124.052435][ T4392] device veth1_macvtap entered promiscuous mode [ 124.068305][ T4392] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 124.076057][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 124.084950][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 124.092879][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 124.101682][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 124.115044][ T4392] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 124.123048][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 124.132261][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 124.151464][ T4392] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 124.160877][ T4392] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 124.170211][ T4392] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 124.178992][ T4392] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 124.239473][ T52] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 124.250898][ T52] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 124.260086][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 124.289445][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 124.297726][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 124.307547][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 124.349643][ C1] hrtimer: interrupt took 36093 ns [ 124.357118][ C0] ================================================================== [ 124.365205][ C0] BUG: KASAN: slab-out-of-bounds in __bpf_get_stackid+0x6c9/0x920 [ 124.373041][ C0] Write of size 24 at addr ffff88805bce8928 by task syz.0.17/4438 [ 124.380823][ C0] [ 124.383139][ C0] CPU: 0 PID: 4438 Comm: syz.0.17 Not tainted syzkaller #0 [ 124.390331][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 124.400382][ C0] Call Trace: [ 124.403654][ C0] [ 124.406567][ C0] dump_stack_lvl+0x188/0x24e [ 124.411229][ C0] ? __lock_acquire+0x7c40/0x7c40 [ 124.416232][ C0] ? show_regs_print_info+0x12/0x12 [ 124.421410][ C0] ? load_image+0x410/0x410 [ 124.425904][ C0] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 124.431374][ C0] ? __virt_addr_valid+0x188/0x540 [ 124.436473][ C0] ? __virt_addr_valid+0x467/0x540 [ 124.441570][ C0] ? __bpf_get_stackid+0x6c9/0x920 [ 124.446666][ C0] print_report+0xa8/0x210 [ 124.451067][ C0] kasan_report+0x10b/0x140 [ 124.455579][ C0] ? __bpf_get_stackid+0x6c9/0x920 [ 124.460668][ C0] kasan_check_range+0x235/0x290 [ 124.465594][ C0] ? __bpf_get_stackid+0x6c9/0x920 [ 124.470685][ C0] memcpy+0x3c/0x60 [ 124.474476][ C0] __bpf_get_stackid+0x6c9/0x920 [ 124.479397][ C0] bpf_get_stackid_pe+0x2ec/0x400 [ 124.484423][ C0] bpf_prog_ee169d054574282b+0x24/0x39 [ 124.489874][ C0] bpf_overflow_handler+0x50b/0x790 [ 124.495057][ C0] ? bpf_overflow_handler+0xd9/0x790 [ 124.500323][ C0] ? perf_swevent_overflow+0x230/0x230 [ 124.505765][ C0] ? sched_clock_cpu+0x6e/0x260 [ 124.510598][ C0] ? __perf_event_account_interrupt+0x187/0x280 [ 124.516820][ C0] __perf_event_overflow+0x457/0x630 [ 124.522088][ C0] perf_swevent_hrtimer+0x472/0x630 [ 124.527299][ C0] ? cpu_clock_event_read+0x50/0x50 [ 124.532489][ C0] ? do_raw_spin_unlock+0x11d/0x230 [ 124.537675][ C0] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 124.543556][ C0] ? _raw_spin_unlock+0x40/0x40 [ 124.548401][ C0] __hrtimer_run_queues+0x4e7/0xc90 [ 124.553588][ C0] ? ktime_get_update_offsets_now+0x95/0x3e0 [ 124.559556][ C0] ? cpu_clock_event_read+0x50/0x50 [ 124.564736][ C0] ? hrtimer_interrupt+0x980/0x980 [ 124.569841][ C0] ? ktime_get_update_offsets_now+0x3ce/0x3e0 [ 124.575904][ C0] hrtimer_interrupt+0x399/0x980 [ 124.580839][ C0] __sysvec_apic_timer_interrupt+0x153/0x5a0 [ 124.586834][ C0] sysvec_apic_timer_interrupt+0x4d/0xc0 [ 124.592450][ C0] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 124.598425][ C0] RIP: 0033:0x7fc749857bd7 [ 124.602820][ C0] Code: 83 c4 08 c3 0f 1f 80 00 00 00 00 48 83 ec 08 48 89 f2 48 63 ff 4c 89 d6 41 51 31 c0 4d 89 c1 49 89 c8 4c 89 d9 e8 69 65 14 00 <5a> 59 48 83 c4 08 c3 66 90 66 0f ef c0 4c 63 c9 49 89 d0 0f 11 07 [ 124.623045][ C0] RSP: 002b:00007ffd39f595d0 EFLAGS: 00000217 [ 124.629136][ C0] RAX: 0000000000000000 RBX: 00007fc749c25fa0 RCX: 00007fc74999e159 [ 124.637100][ C0] RDX: 0000000000000004 RSI: 0000000040042408 RDI: 0000000000000005 [ 124.645058][ C0] RBP: 00007fc749a3503b R08: 0000000000000000 R09: 0000000000000000 [ 124.653025][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 124.660982][ C0] R13: 00007fc749c25fac R14: 00007fc749c25fa0 R15: 00007fc749c25fa0 [ 124.668951][ C0] [ 124.671971][ C0] [ 124.674284][ C0] Allocated by task 4438: [ 124.678592][ C0] kasan_set_track+0x4b/0x70 [ 124.683166][ C0] __kasan_kmalloc+0x8e/0xa0 [ 124.687740][ C0] __kmalloc_node+0xb2/0x240 [ 124.692309][ C0] bpf_map_area_alloc+0x47/0xe0 [ 124.697140][ C0] prealloc_elems_and_freelist+0x86/0x1c0 [ 124.702846][ C0] stack_map_alloc+0x386/0x510 [ 124.707598][ C0] map_create+0x524/0xff0 [ 124.711908][ C0] __sys_bpf+0x38b/0x780 [ 124.716131][ C0] __x64_sys_bpf+0x78/0x90 [ 124.720532][ C0] do_syscall_64+0x4c/0xa0 [ 124.724932][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 124.730808][ C0] [ 124.733110][ C0] The buggy address belongs to the object at ffff88805bce8900 [ 124.733110][ C0] which belongs to the cache kmalloc-cg-64 of size 64 [ 124.747232][ C0] The buggy address is located 40 bytes inside of [ 124.747232][ C0] 64-byte region [ffff88805bce8900, ffff88805bce8940) [ 124.760314][ C0] [ 124.762618][ C0] The buggy address belongs to the physical page: [ 124.769017][ C0] page:ffffea00016f3a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5bce8 [ 124.779150][ C0] memcg:ffff88802909ce01 [ 124.783451][ C0] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 124.791028][ C0] raw: 00fff00000000200 0000000000000000 dead000000000122 ffff888017442780 [ 124.799784][ C0] raw: 0000000000000000 0000000080200020 00000001ffffffff ffff88802909ce01 [ 124.808451][ C0] page dumped because: kasan: bad access detected [ 124.815818][ C0] page_owner tracks the page as allocated [ 124.821521][ C0] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 4385, tgid 4385 (syz-executor), ts 117802677363, free_ts 117657903283 [ 124.839915][ C0] post_alloc_hook+0x173/0x1a0 [ 124.844670][ C0] get_page_from_freelist+0x206b/0x2180 [ 124.850213][ C0] __alloc_pages+0x1ec/0x4f0 [ 124.854798][ C0] alloc_slab_page+0x5d/0x180 [ 124.859466][ C0] new_slab+0x87/0x2d0 [ 124.863599][ C0] ___slab_alloc+0xbc5/0x1240 [ 124.868270][ C0] __kmem_cache_alloc_node+0x126/0x270 [ 124.873708][ C0] __kmalloc_node+0xa2/0x240 [ 124.878281][ C0] kvmalloc_node+0x6c/0x180 [ 124.882781][ C0] nf_hook_entries_grow+0x31a/0x760 [ 124.887964][ C0] nf_hook_entries_insert_raw+0x47/0x300 [ 124.893581][ C0] nf_nat_register_fn+0x1d9/0x540 [ 124.898587][ C0] iptable_nat_table_init+0x1f3/0x2d0 [ 124.903956][ C0] xt_find_table_lock+0x220/0x360 [ 124.908988][ C0] xt_request_find_table_lock+0x22/0x100 [ 124.914635][ C0] do_ipt_get_ctl+0x6e2/0x11a0 [ 124.919427][ C0] page last free stack trace: [ 124.924078][ C0] free_unref_page_prepare+0x8e5/0x9e0 [ 124.929542][ C0] free_unref_page+0x2e/0x3f0 [ 124.934219][ C0] __vunmap+0x874/0xa40 [ 124.938366][ C0] kcov_close+0x27/0x50 [ 124.942512][ C0] __fput+0x20a/0x8b0 [ 124.946479][ C0] task_work_run+0x1d0/0x260 [ 124.951056][ C0] do_exit+0x9d5/0x2570 [ 124.955217][ C0] do_group_exit+0x229/0x2e0 [ 124.959886][ C0] get_signal+0x1259/0x1340 [ 124.964373][ C0] arch_do_signal_or_restart+0xc4/0x1310 [ 124.969989][ C0] exit_to_user_mode_loop+0x70/0x110 [ 124.975269][ C0] exit_to_user_mode_prepare+0xee/0x180 [ 124.980884][ C0] syscall_exit_to_user_mode+0x16/0x40 [ 124.986430][ C0] do_syscall_64+0x58/0xa0 [ 124.990831][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 124.996731][ C0] [ 124.999035][ C0] Memory state around the buggy address: [ 125.004665][ C0] ffff88805bce8800: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 125.012706][ C0] ffff88805bce8880: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 125.020744][ C0] >ffff88805bce8900: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 125.028782][ C0] ^ [ 125.034480][ C0] ffff88805bce8980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 125.042519][ C0] ffff88805bce8a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 125.050567][ C0] ================================================================== [ 125.058640][ C0] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 125.065823][ C0] CPU: 0 PID: 4438 Comm: syz.0.17 Not tainted syzkaller #0 [ 125.072999][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 125.083036][ C0] Call Trace: [ 125.086303][ C0] [ 125.089216][ C0] dump_stack_lvl+0x188/0x24e [ 125.093880][ C0] ? memcpy+0x3c/0x60 [ 125.097840][ C0] ? show_regs_print_info+0x12/0x12 [ 125.103020][ C0] ? load_image+0x410/0x410 [ 125.107509][ C0] panic+0x2d3/0x710 [ 125.111387][ C0] ? __lock_acquire+0x7c40/0x7c40 [ 125.116394][ C0] ? bpf_jit_dump+0xd0/0xd0 [ 125.120876][ C0] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 125.126747][ C0] ? _raw_spin_unlock+0x40/0x40 [ 125.131579][ C0] check_panic_on_warn+0x80/0xa0 [ 125.136502][ C0] ? __bpf_get_stackid+0x6c9/0x920 [ 125.141620][ C0] end_report+0x66/0x110 [ 125.145852][ C0] kasan_report+0x118/0x140 [ 125.150361][ C0] ? __bpf_get_stackid+0x6c9/0x920 [ 125.155458][ C0] kasan_check_range+0x235/0x290 [ 125.160380][ C0] ? __bpf_get_stackid+0x6c9/0x920 [ 125.165514][ C0] memcpy+0x3c/0x60 [ 125.169303][ C0] __bpf_get_stackid+0x6c9/0x920 [ 125.174239][ C0] bpf_get_stackid_pe+0x2ec/0x400 [ 125.179259][ C0] bpf_prog_ee169d054574282b+0x24/0x39 [ 125.184705][ C0] bpf_overflow_handler+0x50b/0x790 [ 125.189886][ C0] ? bpf_overflow_handler+0xd9/0x790 [ 125.195149][ C0] ? perf_swevent_overflow+0x230/0x230 [ 125.200610][ C0] ? sched_clock_cpu+0x6e/0x260 [ 125.205461][ C0] ? __perf_event_account_interrupt+0x187/0x280 [ 125.211686][ C0] __perf_event_overflow+0x457/0x630 [ 125.216970][ C0] perf_swevent_hrtimer+0x472/0x630 [ 125.222153][ C0] ? cpu_clock_event_read+0x50/0x50 [ 125.227353][ C0] ? do_raw_spin_unlock+0x11d/0x230 [ 125.232532][ C0] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 125.238412][ C0] ? _raw_spin_unlock+0x40/0x40 [ 125.243252][ C0] __hrtimer_run_queues+0x4e7/0xc90 [ 125.248437][ C0] ? ktime_get_update_offsets_now+0x95/0x3e0 [ 125.254444][ C0] ? cpu_clock_event_read+0x50/0x50 [ 125.259626][ C0] ? hrtimer_interrupt+0x980/0x980 [ 125.264718][ C0] ? ktime_get_update_offsets_now+0x3ce/0x3e0 [ 125.270766][ C0] hrtimer_interrupt+0x399/0x980 [ 125.275685][ C0] __sysvec_apic_timer_interrupt+0x153/0x5a0 [ 125.281649][ C0] sysvec_apic_timer_interrupt+0x4d/0xc0 [ 125.287264][ C0] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 125.293224][ C0] RIP: 0033:0x7fc749857bd7 [ 125.297623][ C0] Code: 83 c4 08 c3 0f 1f 80 00 00 00 00 48 83 ec 08 48 89 f2 48 63 ff 4c 89 d6 41 51 31 c0 4d 89 c1 49 89 c8 4c 89 d9 e8 69 65 14 00 <5a> 59 48 83 c4 08 c3 66 90 66 0f ef c0 4c 63 c9 49 89 d0 0f 11 07 [ 125.317230][ C0] RSP: 002b:00007ffd39f595d0 EFLAGS: 00000217 [ 125.323279][ C0] RAX: 0000000000000000 RBX: 00007fc749c25fa0 RCX: 00007fc74999e159 [ 125.331238][ C0] RDX: 0000000000000004 RSI: 0000000040042408 RDI: 0000000000000005 [ 125.339205][ C0] RBP: 00007fc749a3503b R08: 0000000000000000 R09: 0000000000000000 [ 125.347529][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 125.355849][ C0] R13: 00007fc749c25fac R14: 00007fc749c25fa0 R15: 00007fc749c25fa0 [ 125.363996][ C0] [ 125.367159][ C0] Kernel Offset: disabled [ 125.371478][ C0] Rebooting in 86400 seconds..