Warning: Permanently added '10.128.0.154' (ED25519) to the list of known hosts. 1970/01/01 00:00:30 parsed 1 programs 1970/01/01 00:00:30 serving rpc on tcp://46759 [ 32.066079][ T4340] cgroup: Unknown subsys name 'net' [ 32.313088][ T4340] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 32.585248][ T4340] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 37.204001][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 37.205481][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 37.207302][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 37.219319][ T39] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 37.223332][ T39] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 37.224781][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 37.650007][ T4384] chnl_net:caif_netlink_parms(): no params data found [ 37.667257][ T4384] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.668520][ T4384] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.670156][ T4384] device bridge_slave_0 entered promiscuous mode [ 37.672759][ T4384] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.673949][ T4384] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.675536][ T4384] device bridge_slave_1 entered promiscuous mode [ 37.682749][ T4384] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.685216][ T4384] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 37.691705][ T4384] team0: Port device team_slave_0 added [ 37.693379][ T4384] team0: Port device team_slave_1 added [ 37.701038][ T4384] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 37.702431][ T4384] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.706580][ T4384] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 37.709313][ T4384] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 37.710923][ T4384] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.715410][ T4384] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.781697][ T4384] device hsr_slave_0 entered promiscuous mode [ 37.820775][ T4384] device hsr_slave_1 entered promiscuous mode [ 37.939782][ T4384] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 37.961889][ T4384] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 38.021671][ T4384] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 38.083235][ T4384] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 38.138073][ T4384] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.139336][ T4384] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.140863][ T4384] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.142134][ T4384] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.159780][ T4384] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.163793][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 38.166122][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.167867][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.175788][ T4384] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.188740][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 38.190338][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.191747][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.196455][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 38.198111][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.199507][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.204144][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 38.206899][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 38.210014][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 38.211767][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 38.214259][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 38.216765][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 38.218561][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 38.221841][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 38.223486][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 38.225984][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 38.227554][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 38.230075][ T4384] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 38.280137][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 38.281758][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 38.285461][ T4384] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.291448][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 38.293339][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 38.299035][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 38.300645][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 38.302349][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 38.303823][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 38.306172][ T4384] device veth0_vlan entered promiscuous mode [ 38.309227][ T4384] device veth1_vlan entered promiscuous mode [ 38.316215][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 38.317819][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 38.319284][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 38.321486][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 38.325195][ T4384] device veth0_macvtap entered promiscuous mode [ 38.327576][ T4384] device veth1_macvtap entered promiscuous mode [ 38.335605][ T4384] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 38.337023][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 38.338658][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 38.340148][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 38.341983][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 38.345034][ T4384] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 38.346349][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 38.348291][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 38.352112][ T4384] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.353604][ T4384] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.355162][ T4384] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.356756][ T4384] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.669008][ T4419] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 38.671238][ T4419] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 38.672762][ T4419] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 38.674328][ T4419] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 38.675773][ T4419] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 38.677188][ T4419] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 1970/01/01 00:00:39 executed programs: 0 [ 39.053492][ T48] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 39.055328][ T48] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 39.056672][ T48] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 39.058225][ T48] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 39.059757][ T48] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 39.061662][ T48] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 39.111996][ T4438] chnl_net:caif_netlink_parms(): no params data found [ 39.126534][ T4438] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.127973][ T4438] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.129526][ T4438] device bridge_slave_0 entered promiscuous mode [ 39.132850][ T4438] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.134130][ T4438] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.135719][ T4438] device bridge_slave_1 entered promiscuous mode [ 39.151533][ T4438] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 39.154280][ T4438] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 39.161363][ T4438] team0: Port device team_slave_0 added [ 39.163321][ T4438] team0: Port device team_slave_1 added [ 39.168317][ T4438] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 39.169506][ T4438] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 39.175261][ T4438] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 39.178408][ T4438] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 39.179496][ T4438] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 39.184157][ T4438] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 39.232151][ T4438] device hsr_slave_0 entered promiscuous mode [ 39.270838][ T4438] device hsr_slave_1 entered promiscuous mode [ 39.310668][ T4438] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 39.312158][ T4438] Cannot create hsr debugfs directory [ 39.431701][ T4438] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.131012][ T48] Bluetooth: hci0: command 0x0409 tx timeout [ 41.812474][ T4438] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 43.210849][ T48] Bluetooth: hci0: command 0x041b tx timeout [ 43.881711][ T4438] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 43.992189][ T4438] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.232574][ T4438] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 44.281742][ T4438] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 44.382865][ T4438] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 44.421931][ T4438] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 44.512241][ T4438] 8021q: adding VLAN 0 to HW filter on device bond0 [ 44.515837][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 44.517371][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 44.519854][ T4438] 8021q: adding VLAN 0 to HW filter on device team0 [ 44.522835][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 44.524466][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 44.526037][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.527175][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 44.528625][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 44.573205][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 44.575078][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 44.576656][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.577967][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.581681][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 44.584400][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 44.587053][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 44.588878][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 44.590741][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 44.593446][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 44.595091][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 44.597644][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 44.599277][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 44.602906][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 44.604425][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 44.606878][ T4438] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 44.666332][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 44.667860][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 44.671662][ T4438] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 44.738024][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 44.739797][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 44.746398][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 44.748217][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 44.750000][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 44.751613][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 44.754051][ T4438] device veth0_vlan entered promiscuous mode [ 44.757201][ T4438] device veth1_vlan entered promiscuous mode [ 44.764107][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 44.765741][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 44.767290][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 44.768939][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 44.771435][ T4438] device veth0_macvtap entered promiscuous mode [ 44.775658][ T1812] device hsr_slave_0 left promiscuous mode [ 44.820980][ T1812] device hsr_slave_1 left promiscuous mode [ 44.910702][ T1812] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 44.911977][ T1812] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 44.913759][ T1812] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 44.915057][ T1812] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 44.916557][ T1812] device bridge_slave_1 left promiscuous mode [ 44.917935][ T1812] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.961640][ T1812] device bridge_slave_0 left promiscuous mode [ 44.962855][ T1812] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.081717][ T1812] device veth1_macvtap left promiscuous mode [ 45.082846][ T1812] device veth0_macvtap left promiscuous mode [ 45.083858][ T1812] device veth1_vlan left promiscuous mode [ 45.084931][ T1812] device veth0_vlan left promiscuous mode [ 45.300818][ T48] Bluetooth: hci0: command 0x040f tx timeout [ 47.322304][ T1812] team0 (unregistering): Port device team_slave_1 removed [ 47.370594][ T48] Bluetooth: hci0: command 0x0419 tx timeout [ 47.491440][ T1812] team0 (unregistering): Port device team_slave_0 removed [ 47.661308][ T1812] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 47.871038][ T1812] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 49.452100][ T1812] bond0 (unregistering): Released all slaves [ 49.752370][ T4438] device veth1_macvtap entered promiscuous mode [ 49.757906][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 49.759558][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 49.765015][ T4438] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.767632][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 49.769390][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 49.772592][ T4438] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.773841][ T4448] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 49.775542][ T4448] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 49.778088][ T4438] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.779646][ T4438] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.781454][ T4438] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.782898][ T4438] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.805383][ T1316] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.806822][ T1316] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.808095][ T1316] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 49.815249][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.816672][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.818020][ T1316] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 1970/01/01 00:00:49 executed programs: 2 [ 49.867788][ T4463] syz.0.17 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 49.869592][ T4463] CPU: 1 PID: 4463 Comm: syz.0.17 Not tainted syzkaller #0 [ 49.870800][ T4463] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 49.872596][ T4463] Call trace: [ 49.873155][ T4463] dump_backtrace+0x1c4/0x1f0 [ 49.873970][ T4463] show_stack+0x2c/0x3c [ 49.874698][ T4463] __dump_stack+0x30/0x40 [ 49.875478][ T4463] dump_stack_lvl+0xf4/0x15c [ 49.876339][ T4463] dump_stack+0x1c/0x5c [ 49.877100][ T4463] dump_header+0xc0/0x724 [ 49.877849][ T4463] oom_kill_process+0x35c/0x660 [ 49.878727][ T4463] out_of_memory+0xbf0/0xf70 [ 49.879550][ T4463] mem_cgroup_out_of_memory+0x228/0x2d0 [ 49.880521][ T4463] try_charge_memcg+0xa4c/0x1390 [ 49.881398][ T4463] obj_cgroup_charge+0x178/0x2e4 [ 49.882246][ T4463] slab_pre_alloc_hook+0x2fc/0x31c [ 49.883136][ T4463] kmem_cache_alloc_lru+0x60/0x284 [ 49.884041][ T4463] __d_alloc+0x40/0x68c [ 49.884762][ T4463] d_alloc_name+0xbc/0x2a8 [ 49.885520][ T4463] gadgetfs_create_file+0x5c/0x258 [ 49.886389][ T4463] gadgetfs_bind+0x3a8/0x7b0 [ 49.887164][ T4463] gadget_bind_driver+0x26c/0x684 [ 49.888027][ T4463] really_probe+0x3a0/0xac4 [ 49.888812][ T4463] __driver_probe_device+0x1c8/0x368 [ 49.889727][ T4463] driver_probe_device+0x78/0x324 [ 49.890556][ T4463] __driver_attach+0x3bc/0x614 [ 49.891379][ T4463] bus_for_each_dev+0x148/0x1d0 [ 49.892226][ T4463] driver_attach+0x50/0x60 [ 49.893009][ T4463] bus_add_driver+0x2c0/0x518 [ 49.893791][ T4463] driver_register+0x200/0x37c [ 49.894642][ T4463] usb_gadget_register_driver_owner+0xf0/0x25c [ 49.895753][ T4463] dev_config+0xba8/0xfec [ 49.896524][ T4463] vfs_write+0x2a8/0x7c8 [ 49.897275][ T4463] ksys_write+0x12c/0x228 [ 49.898192][ T4463] __arm64_sys_write+0x7c/0x90 [ 49.899126][ T4463] invoke_syscall+0x98/0x290 [ 49.900007][ T4463] el0_svc_common+0x13c/0x258 [ 49.900983][ T4463] do_el0_svc+0x5c/0x134 [ 49.901855][ T4463] el0_svc+0x58/0x128 [ 49.902661][ T4463] el0t_64_sync_handler+0x84/0xf0 [ 49.903594][ T4463] el0t_64_sync+0x18c/0x190 [ 49.904632][ T4463] memory: usage 0kB, limit 0kB, failcnt 19 [ 49.905676][ T4463] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 49.906972][ T4463] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 49.908103][ T4463] Memory cgroup stats for /syz0/test: [ 49.908265][ T4463] anon 0 [ 49.908265][ T4463] file 0 [ 49.908265][ T4463] kernel 0 [ 49.908265][ T4463] kernel_stack 0 [ 49.908265][ T4463] pagetables 0 [ 49.908265][ T4463] sec_pagetables 0 [ 49.908265][ T4463] percpu 0 [ 49.908265][ T4463] sock 0 [ 49.908265][ T4463] vmalloc 0 [ 49.908265][ T4463] shmem 0 [ 49.908265][ T4463] zswap 0 [ 49.908265][ T4463] zswapped 0 [ 49.908265][ T4463] file_mapped 0 [ 49.908265][ T4463] file_dirty 0 [ 49.908265][ T4463] file_writeback 0 [ 49.908265][ T4463] swapcached 0 [ 49.908265][ T4463] anon_thp 0 [ 49.908265][ T4463] file_thp 0 [ 49.908265][ T4463] shmem_thp 0 [ 49.908265][ T4463] inactive_anon 0 [ 49.908265][ T4463] active_anon 0 [ 49.908265][ T4463] inactive_file 0 [ 49.908265][ T4463] active_file 0 [ 49.908265][ T4463] unevictable 0 [ 49.908265][ T4463] slab_reclaimable 0 [ 49.908265][ T4463] slab_unreclaimable 0 [ 49.908265][ T4463] slab 0 [ 49.908265][ T4463] workingset_refault_anon 0 [ 49.924878][ T4463] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0,oom_memcg=/syz0/test,task_memcg=/syz0/test,task=syz.0.17,pid=4463,uid=0 [ 49.927607][ T4463] Memory cgroup out of memory: Killed process 4463 (syz.0.17) total-vm:44796kB, anon-rss:1276kB, file-rss:0kB, shmem-rss:0kB, UID:0 pgtables:72kB oom_score_adj:1000 [ 49.932045][ T4463] udc dummy_udc.0: failed to start USB Gadget filesystem: -12 [ 49.933384][ T4463] gadgetfs: probe of gadget.0 failed with error -12 [ 49.934635][ T4463] gadgetfs expected dummy_udc controller not usbip-vudc [ 49.935880][ T4463] udc usbip-vudc.0: failed to start USB Gadget filesystem: -19 [ 49.937585][ T4463] UDC core: USB Gadget filesystem: couldn't find an available UDC [ 49.947801][ T4464] ================================================================== [ 49.949242][ T4464] BUG: KASAN: use-after-free in __lock_acquire+0x104/0x6634 [ 49.950423][ T4464] Read of size 8 at addr ffff0000deb98818 by task syz.0.18/4464 [ 49.951821][ T4464] [ 49.952275][ T4464] CPU: 0 PID: 4464 Comm: syz.0.18 Not tainted syzkaller #0 [ 49.953702][ T4464] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 49.955644][ T4464] Call trace: [ 49.956289][ T4464] dump_backtrace+0x1c4/0x1f0 [ 49.957170][ T4464] show_stack+0x2c/0x3c [ 49.957962][ T4464] __dump_stack+0x30/0x40 [ 49.958765][ T4464] dump_stack_lvl+0xf4/0x15c [ 49.959613][ T4464] print_address_description+0x88/0x218 [ 49.960653][ T4464] print_report+0x50/0x68 [ 49.961469][ T4464] kasan_report+0xa8/0xfc [ 49.962299][ T4464] __asan_report_load8_noabort+0x2c/0x38 [ 49.963224][ T4464] __lock_acquire+0x104/0x6634 [ 49.964090][ T4464] lock_acquire+0x20c/0x638 [ 49.964864][ T4464] _raw_spin_lock_irq+0x70/0x98 [ 49.965707][ T4464] gadget_dev_open+0x50/0x1c4 [ 49.966515][ T4464] do_dentry_open+0x738/0xf8c [ 49.967336][ T4464] vfs_open+0x7c/0x90 [ 49.968027][ T4464] path_openat+0x1fc0/0x27a0 [ 49.968839][ T4464] do_filp_open+0x198/0x38c [ 49.969634][ T4464] do_sys_openat2+0x134/0x3fc [ 49.970443][ T4464] __arm64_sys_openat+0x11c/0x150 [ 49.971367][ T4464] invoke_syscall+0x98/0x290 [ 49.972149][ T4464] el0_svc_common+0x13c/0x258 [ 49.972959][ T4464] do_el0_svc+0x5c/0x134 [ 49.973699][ T4464] el0_svc+0x58/0x128 [ 49.974361][ T4464] el0t_64_sync_handler+0x84/0xf0 [ 49.975232][ T4464] el0t_64_sync+0x18c/0x190 [ 49.976001][ T4464] [ 49.976403][ T4464] Allocated by task 4438: [ 49.977139][ T4464] kasan_set_track+0x4c/0x80 [ 49.977936][ T4464] kasan_save_alloc_info+0x24/0x30 [ 49.978871][ T4464] __kasan_kmalloc+0xa0/0xb8 [ 49.979610][ T4464] kmalloc_trace+0x7c/0x94 [ 49.980375][ T4464] gadgetfs_fill_super+0x2c0/0x5c0 [ 49.981313][ T4464] get_tree_single+0xb8/0x170 [ 49.982112][ T4464] gadgetfs_get_tree+0x28/0x38 [ 49.982913][ T4464] vfs_get_tree+0x90/0x278 [ 49.983728][ T4464] do_new_mount+0x228/0x804 [ 49.984550][ T4464] path_mount+0x5ac/0xe6c [ 49.985341][ T4464] __arm64_sys_mount+0x4a0/0x5a0 [ 49.986210][ T4464] invoke_syscall+0x98/0x290 [ 49.987029][ T4464] el0_svc_common+0x13c/0x258 [ 49.987876][ T4464] do_el0_svc+0x5c/0x134 [ 49.988612][ T4464] el0_svc+0x58/0x128 [ 49.989276][ T4464] el0t_64_sync_handler+0x84/0xf0 [ 49.990138][ T4464] el0t_64_sync+0x18c/0x190 [ 49.990859][ T4464] [ 49.991243][ T4464] Freed by task 4463: [ 49.991915][ T4464] kasan_set_track+0x4c/0x80 [ 49.992743][ T4464] kasan_save_free_info+0x38/0x5c [ 49.993623][ T4464] ____kasan_slab_free+0x148/0x1b0 [ 49.994504][ T4464] __kasan_slab_free+0x18/0x28 [ 49.995344][ T4464] slab_free_freelist_hook+0x16c/0x1e8 [ 49.996288][ T4464] __kmem_cache_free+0xbc/0x21c [ 49.997138][ T4464] kfree+0xd0/0x1a8 [ 49.997787][ T4464] dev_release+0x160/0x214 [ 49.998596][ T4464] __fput+0x1b4/0x7b0 [ 49.999326][ T4464] ____fput+0x20/0x30 [ 50.000000][ T4464] task_work_run+0x1f4/0x280 [ 50.000800][ T4464] do_exit+0x54c/0x19ac [ 50.001475][ T4464] do_group_exit+0x198/0x238 [ 50.002261][ T4464] get_signal+0x11f4/0x133c [ 50.003022][ T4464] do_notify_resume+0x364/0x2c84 [ 50.003913][ T4464] el0_svc+0x98/0x128 [ 50.004580][ T4464] el0t_64_sync_handler+0x84/0xf0 [ 50.005470][ T4464] el0t_64_sync+0x18c/0x190 [ 50.006263][ T4464] [ 50.006688][ T4464] The buggy address belongs to the object at ffff0000deb98800 [ 50.006688][ T4464] which belongs to the cache kmalloc-1k of size 1024 [ 50.009092][ T4464] The buggy address is located 24 bytes inside of [ 50.009092][ T4464] 1024-byte region [ffff0000deb98800, ffff0000deb98c00) [ 50.011314][ T4464] [ 50.011713][ T4464] The buggy address belongs to the physical page: [ 50.012846][ T4464] page:0000000059fc2a5c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11eb98 [ 50.014687][ T4464] head:0000000059fc2a5c order:3 compound_mapcount:0 compound_pincount:0 [ 50.016162][ T4464] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 50.017593][ T4464] raw: 05ffc00000010200 0000000000000000 dead000000000122 ffff0000c0002780 [ 50.019040][ T4464] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 50.020536][ T4464] page dumped because: kasan: bad access detected [ 50.021673][ T4464] [ 50.022115][ T4464] Memory state around the buggy address: [ 50.023065][ T4464] ffff0000deb98700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 50.024441][ T4464] ffff0000deb98780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 50.025890][ T4464] >ffff0000deb98800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.027360][ T4464] ^ [ 50.028169][ T4464] ffff0000deb98880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.029498][ T4464] ffff0000deb98900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.030856][ T4464] ================================================================== [ 50.032254][ T4464] Disabling lock debugging due to kernel taint [ 50.033366][ T4464] ================================================================================ [ 50.034881][ T4464] UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.c:131:9 [ 50.036330][ T4464] index 12987 is out of range for type 'unsigned long[8]' [ 50.037578][ T4464] CPU: 0 PID: 4464 Comm: syz.0.18 Tainted: G B syzkaller #0 [ 50.039031][ T4464] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 50.040636][ T4464] Call trace: [ 50.041208][ T4464] dump_backtrace+0x1c4/0x1f0 [ 50.042014][ T4464] show_stack+0x2c/0x3c [ 50.042759][ T4464] __dump_stack+0x30/0x40 [ 50.043474][ T4464] dump_stack_lvl+0xf4/0x15c [ 50.044245][ T4464] dump_stack+0x1c/0x5c [ 50.044996][ T4464] ubsan_epilogue+0x14/0x48 [ 50.045858][ T4464] __ubsan_handle_out_of_bounds+0xd0/0xf8 [ 50.046860][ T4464] queued_spin_lock_slowpath+0x8a8/0xc14 [ 50.047823][ T4464] do_raw_spin_lock+0x2f4/0x2f8 [ 50.048683][ T4464] _raw_spin_lock_irq+0x78/0x98 [ 50.049556][ T4464] gadget_dev_open+0x50/0x1c4 [ 50.050382][ T4464] do_dentry_open+0x738/0xf8c [ 50.051215][ T4464] vfs_open+0x7c/0x90 [ 50.051909][ T4464] path_openat+0x1fc0/0x27a0 [ 50.052711][ T4464] do_filp_open+0x198/0x38c [ 50.053537][ T4464] do_sys_openat2+0x134/0x3fc [ 50.054357][ T4464] __arm64_sys_openat+0x11c/0x150 [ 50.055197][ T4464] invoke_syscall+0x98/0x290 [ 50.056050][ T4464] el0_svc_common+0x13c/0x258 [ 50.056913][ T4464] do_el0_svc+0x5c/0x134 [ 50.057698][ T4464] el0_svc+0x58/0x128 [ 50.058402][ T4464] el0t_64_sync_handler+0x84/0xf0 [ 50.059328][ T4464] el0t_64_sync+0x18c/0x190 [ 50.060106][ T4464] ================================================================================ [ 50.061720][ T4464] Unable to handle kernel paging request at virtual address ffff8000152fb1b0 [ 50.063184][ T4464] KASAN: probably user-memory-access in range [0x00000000a97d8d80-0x00000000a97d8d87] [ 50.064834][ T4464] Mem abort info: [ 50.065458][ T4464] ESR = 0x0000000096000047 [ 50.066247][ T4464] EC = 0x25: DABT (current EL), IL = 32 bits [ 50.067312][ T4464] SET = 0, FnV = 0 [ 50.067995][ T4464] EA = 0, S1PTW = 0 [ 50.068660][ T4464] FSC = 0x07: level 3 translation fault [ 50.069599][ T4464] Data abort info: [ 50.070196][ T4464] ISV = 0, ISS = 0x00000047 [ 50.071135][ T4464] CM = 0, WnR = 1 [ 50.071771][ T4464] swapper pgtable: 4k pages, 48-bit VAs, pgdp=000000020dd3f000 [ 50.073062][ T4464] [ffff8000152fb1b0] pgd=100000023ffff003, p4d=100000023ffff003, pud=100000023fffe003, pmd=100000023fff9003, pte=0000000000000000 [ 50.075350][ T4464] Internal error: Oops: 0000000096000047 [#1] PREEMPT SMP [ 50.076609][ T4464] Modules linked in: [ 50.077297][ T4464] CPU: 0 PID: 4464 Comm: syz.0.18 Tainted: G B syzkaller #0 [ 50.078798][ T4464] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 50.080582][ T4464] pstate: 824000c5 (Nzcv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 50.081968][ T4464] pc : queued_spin_lock_slowpath+0x598/0xc14 [ 50.083023][ T4464] lr : queued_spin_lock_slowpath+0x8a8/0xc14 [ 50.084060][ T4464] sp : ffff800021597520 [ 50.084776][ T4464] x29: ffff8000215975c0 x28: 1fffe00033e72c30 x27: ffff8000152fb1b0 [ 50.086218][ T4464] x26: ffff00019f396188 x25: ffff800021597540 x24: 1fffe0001bd73100 [ 50.087678][ T4464] x23: dfff800000000000 x22: ffff7000042b2ea8 x21: ffff8000152fb1b0 [ 50.089109][ T4464] x20: ffff00019f396180 x19: ffff0000deb98800 x18: 0000000000000000 [ 50.090533][ T4464] x17: 3d3d3d3d3d3d3d3d x16: ffff800008195558 x15: 3d3d3d3d3d3d3d3d [ 50.091949][ T4464] x14: ffff700002ff20bc x13: 1ffff00002ff20bc x12: 0000000000000004 [ 50.093395][ T4464] x11: ff008000081955dc x10: ffff8000152fb180 x9 : 0000000000000003 [ 50.094777][ T4464] x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000001 [ 50.096139][ T4464] x5 : ffff800021596f78 x4 : ffff800015474e80 x3 : ffff8000081955a4 [ 50.097577][ T4464] x2 : 0000000000000001 x1 : 0000000000000004 x0 : ffff00019f396188 [ 50.098972][ T4464] Call trace: [ 50.099556][ T4464] queued_spin_lock_slowpath+0x598/0xc14 [ 50.100558][ T4464] do_raw_spin_lock+0x2f4/0x2f8 [ 50.101407][ T4464] _raw_spin_lock_irq+0x78/0x98 [ 50.102294][ T4464] gadget_dev_open+0x50/0x1c4 [ 50.103158][ T4464] do_dentry_open+0x738/0xf8c [ 50.104032][ T4464] vfs_open+0x7c/0x90 [ 50.104751][ T4464] path_openat+0x1fc0/0x27a0 [ 50.105567][ T4464] do_filp_open+0x198/0x38c [ 50.106348][ T4464] do_sys_openat2+0x134/0x3fc [ 50.107119][ T4464] __arm64_sys_openat+0x11c/0x150 [ 50.107944][ T4464] invoke_syscall+0x98/0x290 [ 50.108701][ T4464] el0_svc_common+0x13c/0x258 [ 50.109529][ T4464] do_el0_svc+0x5c/0x134 [ 50.110252][ T4464] el0_svc+0x58/0x128 [ 50.110937][ T4464] el0t_64_sync_handler+0x84/0xf0 [ 50.111803][ T4464] el0t_64_sync+0x18c/0x190 [ 50.112578][ T4464] Code: aa1503e0 978da72c 91002280 52800081 (f90002b4) [ 50.113745][ T4464] ---[ end trace 0000000000000000 ]--- [ 54.173315][ T4464] Kernel panic - not syncing: Oops: Fatal exception [ 54.174440][ T4464] SMP: stopping secondary CPUs [ 54.175271][ T4464] Kernel Offset: disabled [ 54.176003][ T4464] CPU features: 0x0a0000,000f0097,a65bfea7 [ 54.177041][ T4464] Memory Limit: none [ 57.884208][ T4464] Rebooting in 86400 seconds..