syzkaller
syzkaller login: [ 15.300310][ T28] kauditd_printk_skb: 31 callbacks suppressed
[ 15.300326][ T28] audit: type=1400 audit(1781921727.329:59): avc: denied { transition } for pid=225 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 15.305399][ T28] audit: type=1400 audit(1781921727.329:60): avc: denied { noatsecure } for pid=225 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 15.309576][ T28] audit: type=1400 audit(1781921727.339:61): avc: denied { write } for pid=225 comm="sh" path="pipe:[13083]" dev="pipefs" ino=13083 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1
[ 15.313176][ T28] audit: type=1400 audit(1781921727.339:62): avc: denied { rlimitinh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 15.316223][ T28] audit: type=1400 audit(1781921727.339:63): avc: denied { siginh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
Warning: Permanently added '10.128.1.73' (ED25519) to the list of known hosts.
2026/06/20 02:15:37 parsed 1 programs
2026/06/20 02:15:37 serving rpc on tcp://44473
[ 25.434589][ T28] audit: type=1400 audit(1781921737.469:64): avc: denied { node_bind } for pid=295 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1
[ 25.455673][ T28] audit: type=1400 audit(1781921737.469:65): avc: denied { module_request } for pid=295 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1
[ 26.655561][ T28] audit: type=1400 audit(1781921738.689:66): avc: denied { mounton } for pid=301 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 26.659057][ T301] cgroup: Unknown subsys name 'net'
[ 26.678330][ T28] audit: type=1400 audit(1781921738.689:67): avc: denied { mount } for pid=301 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 26.705679][ T28] audit: type=1400 audit(1781921738.719:68): avc: denied { unmount } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 26.706073][ T301] cgroup: Unknown subsys name 'devices'
[ 26.833263][ T301] cgroup: Unknown subsys name 'hugetlb'
[ 26.838976][ T301] cgroup: Unknown subsys name 'rlimit'
[ 26.982183][ T28] audit: type=1400 audit(1781921739.019:69): avc: denied { setattr } for pid=301 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 27.005529][ T28] audit: type=1400 audit(1781921739.019:70): avc: denied { create } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 27.026091][ T28] audit: type=1400 audit(1781921739.019:71): avc: denied { write } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 27.046463][ T28] audit: type=1400 audit(1781921739.019:72): avc: denied { read } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
Setting up swapspace version 1, size = 127995904 bytes
[ 27.066953][ T28] audit: type=1400 audit(1781921739.019:73): avc: denied { mounton } for pid=301 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1
[ 27.077100][ T305] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped).
[ 27.139651][ T301] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 27.941768][ T315] request_module fs-gadgetfs succeeded, but still no fs?
[ 28.069894][ T314] bridge0: port 1(bridge_slave_0) entered blocking state
[ 28.113700][ T314] bridge0: port 1(bridge_slave_0) entered disabled state
[ 28.123085][ T314] device bridge_slave_0 entered promiscuous mode
[ 28.140725][ T314] bridge0: port 2(bridge_slave_1) entered blocking state
[ 28.148554][ T314] bridge0: port 2(bridge_slave_1) entered disabled state
[ 28.156235][ T314] device bridge_slave_1 entered promiscuous mode
[ 28.466418][ T314] bridge0: port 2(bridge_slave_1) entered blocking state
[ 28.474278][ T314] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 28.481988][ T314] bridge0: port 1(bridge_slave_0) entered blocking state
[ 28.489098][ T314] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 28.642981][ T341] syz-executor (341) used greatest stack depth: 21824 bytes left
[ 28.712360][ T43] bridge0: port 1(bridge_slave_0) entered disabled state
[ 28.725007][ T43] bridge0: port 2(bridge_slave_1) entered disabled state
[ 28.734058][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 28.742984][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 28.784434][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 28.797414][ T43] bridge0: port 1(bridge_slave_0) entered blocking state
[ 28.804665][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 28.814852][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 28.823370][ T43] bridge0: port 2(bridge_slave_1) entered blocking state
[ 28.830916][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 28.845031][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 28.863260][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 28.881437][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 28.895307][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 28.904227][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 28.912215][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 28.921007][ T314] device veth0_vlan entered promiscuous mode
[ 28.934450][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 28.944551][ T314] device veth1_macvtap entered promiscuous mode
[ 28.956102][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 28.967258][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
2026/06/20 02:15:41 executed programs: 0
[ 29.121218][ T314] syz-executor (314) used greatest stack depth: 21024 bytes left
[ 29.343631][ T376] bridge0: port 1(bridge_slave_0) entered blocking state
[ 29.350720][ T376] bridge0: port 1(bridge_slave_0) entered disabled state
[ 29.358605][ T376] device bridge_slave_0 entered promiscuous mode
[ 29.368960][ T376] bridge0: port 2(bridge_slave_1) entered blocking state
[ 29.376087][ T376] bridge0: port 2(bridge_slave_1) entered disabled state
[ 29.383625][ T376] device bridge_slave_1 entered promiscuous mode
[ 29.425973][ T380] bridge0: port 1(bridge_slave_0) entered blocking state
[ 29.433186][ T380] bridge0: port 1(bridge_slave_0) entered disabled state
[ 29.440596][ T380] device bridge_slave_0 entered promiscuous mode
[ 29.449289][ T380] bridge0: port 2(bridge_slave_1) entered blocking state
[ 29.456389][ T380] bridge0: port 2(bridge_slave_1) entered disabled state
[ 29.463963][ T380] device bridge_slave_1 entered promiscuous mode
[ 29.482478][ T377] bridge0: port 1(bridge_slave_0) entered blocking state
[ 29.489655][ T377] bridge0: port 1(bridge_slave_0) entered disabled state
[ 29.497234][ T377] device bridge_slave_0 entered promiscuous mode
[ 29.506507][ T377] bridge0: port 2(bridge_slave_1) entered blocking state
[ 29.513700][ T377] bridge0: port 2(bridge_slave_1) entered disabled state
[ 29.521323][ T377] device bridge_slave_1 entered promiscuous mode
[ 29.547060][ T379] bridge0: port 1(bridge_slave_0) entered blocking state
[ 29.554258][ T379] bridge0: port 1(bridge_slave_0) entered disabled state
[ 29.562005][ T379] device bridge_slave_0 entered promiscuous mode
[ 29.592312][ T379] bridge0: port 2(bridge_slave_1) entered blocking state
[ 29.599407][ T379] bridge0: port 2(bridge_slave_1) entered disabled state
[ 29.607017][ T379] device bridge_slave_1 entered promiscuous mode
[ 29.660712][ T382] bridge0: port 1(bridge_slave_0) entered blocking state
[ 29.667846][ T382] bridge0: port 1(bridge_slave_0) entered disabled state
[ 29.675451][ T382] device bridge_slave_0 entered promiscuous mode
[ 29.711943][ T382] bridge0: port 2(bridge_slave_1) entered blocking state
[ 29.719005][ T382] bridge0: port 2(bridge_slave_1) entered disabled state
[ 29.726865][ T382] device bridge_slave_1 entered promiscuous mode
[ 29.871269][ T376] bridge0: port 2(bridge_slave_1) entered blocking state
[ 29.878351][ T376] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 29.885698][ T376] bridge0: port 1(bridge_slave_0) entered blocking state
[ 29.892763][ T376] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 29.921701][ T379] bridge0: port 2(bridge_slave_1) entered blocking state
[ 29.928789][ T379] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 29.936124][ T379] bridge0: port 1(bridge_slave_0) entered blocking state
[ 29.943210][ T379] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 29.952895][ T380] bridge0: port 2(bridge_slave_1) entered blocking state
[ 29.960092][ T380] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 29.967415][ T380] bridge0: port 1(bridge_slave_0) entered blocking state
[ 29.974516][ T380] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 29.996868][ T377] bridge0: port 2(bridge_slave_1) entered blocking state
[ 30.003994][ T377] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 30.011322][ T377] bridge0: port 1(bridge_slave_0) entered blocking state
[ 30.018371][ T377] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 30.034097][ T382] bridge0: port 2(bridge_slave_1) entered blocking state
[ 30.041228][ T382] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 30.048526][ T382] bridge0: port 1(bridge_slave_0) entered blocking state
[ 30.055616][ T382] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 30.078980][ T43] bridge0: port 1(bridge_slave_0) entered disabled state
[ 30.086397][ T43] bridge0: port 2(bridge_slave_1) entered disabled state
[ 30.093830][ T43] bridge0: port 1(bridge_slave_0) entered disabled state
[ 30.101804][ T43] bridge0: port 2(bridge_slave_1) entered disabled state
[ 30.109186][ T43] bridge0: port 1(bridge_slave_0) entered disabled state
[ 30.117064][ T43] bridge0: port 2(bridge_slave_1) entered disabled state
[ 30.124699][ T43] bridge0: port 1(bridge_slave_0) entered disabled state
[ 30.132193][ T43] bridge0: port 2(bridge_slave_1) entered disabled state
[ 30.139736][ T43] bridge0: port 1(bridge_slave_0) entered disabled state
[ 30.147226][ T43] bridge0: port 2(bridge_slave_1) entered disabled state
[ 30.160012][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 30.167652][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 30.201254][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 30.209717][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 30.218318][ T43] bridge0: port 1(bridge_slave_0) entered blocking state
[ 30.225467][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 30.252634][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 30.260337][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 30.268248][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 30.276812][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 30.286255][ T43] bridge0: port 2(bridge_slave_1) entered blocking state
[ 30.293338][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 30.300752][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 30.308445][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 30.316369][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 30.324935][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 30.333411][ T43] bridge0: port 1(bridge_slave_0) entered blocking state
[ 30.340441][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 30.347972][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 30.356177][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 30.365217][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 30.373688][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 30.382104][ T43] bridge0: port 2(bridge_slave_1) entered blocking state
[ 30.389133][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 30.396617][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 30.405680][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 30.419493][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 30.427066][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 30.456456][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 30.464508][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 30.472089][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 30.480485][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 30.488993][ T43] bridge0: port 1(bridge_slave_0) entered blocking state
[ 30.496089][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 30.504081][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 30.512522][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 30.520641][ T43] bridge0: port 2(bridge_slave_1) entered blocking state
[ 30.527709][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 30.535350][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 30.543926][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 30.552190][ T43] bridge0: port 1(bridge_slave_0) entered blocking state
[ 30.559219][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 30.566676][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 30.575208][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 30.583510][ T43] bridge0: port 2(bridge_slave_1) entered blocking state
[ 30.590550][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 30.598118][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 30.606477][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 30.621245][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 30.629660][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 30.639320][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 30.647915][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 30.673770][ T376] device veth0_vlan entered promiscuous mode
[ 30.688135][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 30.696742][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 30.705964][ T43] bridge0: port 1(bridge_slave_0) entered blocking state
[ 30.713109][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 30.720678][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 30.729923][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 30.738213][ T43] bridge0: port 2(bridge_slave_1) entered blocking state
[ 30.745274][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 30.753156][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 30.761129][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 30.769182][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 30.777379][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 30.785628][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 30.794108][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 30.802277][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 30.810405][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 30.818150][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 30.843487][ T376] device veth1_macvtap entered promiscuous mode
[ 30.851434][ T379] device veth0_vlan entered promiscuous mode
[ 30.857999][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 30.867218][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 30.876526][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 30.884370][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 30.892113][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 30.908078][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 30.916208][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 30.951725][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 30.960253][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 30.969044][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 30.976644][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 30.984459][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 30.993513][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 31.003201][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 31.011818][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 31.020258][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 31.028921][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 31.037429][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 31.049460][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 31.063088][ T377] device veth0_vlan entered promiscuous mode
[ 31.073409][ T336] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 31.083749][ T379] device veth1_macvtap entered promiscuous mode
[ 31.095375][ T336] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 31.103049][ T336] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 31.110555][ T336] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 31.118756][ T336] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 31.127107][ T336] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 31.135562][ T336] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 31.144097][ T336] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 31.151823][ T336] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 31.165656][ T382] device veth0_vlan entered promiscuous mode
[ 31.176312][ T380] device veth0_vlan entered promiscuous mode
[ 31.184105][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 31.193499][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 31.219959][ T28] kauditd_printk_skb: 32 callbacks suppressed
[ 31.219974][ T28] audit: type=1400 audit(1781921743.249:106): avc: denied { ioctl } for pid=398 comm="syz.5.17" path="socket:[16163]" dev="sockfs" ino=16163 ioctlcmd=0x48dd scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1
[ 31.255216][ T382] device veth1_macvtap entered promiscuous mode
[ 31.263857][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 31.274080][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 31.282592][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 31.290764][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 31.299464][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 31.314710][ T380] device veth1_macvtap entered promiscuous mode
[ 31.332490][ T43] Bluetooth: hci1: Frame reassembly failed (-84)
[ 31.343852][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 31.352333][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 31.360583][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 31.373565][ T377] device veth1_macvtap entered promiscuous mode
[ 31.388611][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 31.396437][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 31.404919][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 31.413837][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 31.422837][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 31.431535][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 31.439838][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 31.448423][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 31.456889][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 31.475702][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 31.484342][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 31.516712][ T43] Bluetooth: hci2: Frame reassembly failed (-84)
[ 31.523915][ T336] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 31.533003][ T336] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 31.545583][ T8] device bridge_slave_1 left promiscuous mode
[ 31.554241][ T8] bridge0: port 2(bridge_slave_1) entered disabled state
[ 31.554248][ T405] Bluetooth: hci3: Frame reassembly failed (-84)
[ 31.554298][ T405] Bluetooth: hci3: Frame reassembly failed (-84)
[ 31.574845][ T405] Bluetooth: hci3: Frame reassembly failed (-84)
[ 31.581463][ T8] device bridge_slave_0 left promiscuous mode
[ 31.587580][ T8] bridge0: port 1(bridge_slave_0) entered disabled state
[ 31.595897][ T8] device veth1_macvtap left promiscuous mode
[ 31.602076][ T8] device veth0_vlan left promiscuous mode
[ 31.709665][ T405] Bluetooth: hci4: Frame reassembly failed (-84)
[ 33.241189][ T398] Bluetooth: hci0: Opcode 0x0c1a failed: -110
[ 33.247596][ T8] Bluetooth: hci0: Frame reassembly failed (-84)
[ 33.401193][ T409] Bluetooth: hci1: command 0x1003 tx timeout
[ 33.401227][ T400] Bluetooth: hci1: Opcode 0x1003 failed: -110
[ 33.561172][ T409] Bluetooth: hci2: command 0x1003 tx timeout
[ 33.561161][ T404] Bluetooth: hci3: Opcode 0x1003 failed: -110
[ 33.567364][ T400] Bluetooth: hci3: command 0x1003 tx timeout
[ 33.573371][ T402] Bluetooth: hci2: Opcode 0x1003 failed: -110
[ 33.721186][ T407] Bluetooth: hci4: Opcode 0x1003 failed: -110
[ 33.721498][ T402] Bluetooth: hci4: command 0x1003 tx timeout
[ 35.321284][ T404] Bluetooth: hci0: command 0x0c1a tx timeout
[ 35.321558][ T45] Bluetooth: hci0: Opcode 0x1003 failed: -110
[ 35.327488][ T404] Bluetooth: hci0: sending frame failed (-49)
[ 35.339758][ T401] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[ 35.347235][ T403] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[ 35.354900][ T406] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[ 35.360886][ T408] Bluetooth: hci0: Opcode 0x0c1a failed: -4
2026/06/20 02:15:47 executed programs: 15
[ 35.374817][ T8] Bluetooth: hci0: Frame reassembly failed (-84)
[ 35.409961][ T405] Bluetooth: hci1: Frame reassembly failed (-84)
[ 35.450272][ T405] Bluetooth: hci2: Frame reassembly failed (-84)
[ 35.459595][ T336] Bluetooth: hci3: Frame reassembly failed (-84)
[ 35.466616][ T405] Bluetooth: hci4: Frame reassembly failed (-84)
[ 37.401118][ T409] Bluetooth: hci0: command 0x1003 tx timeout
[ 37.403993][ T45] Bluetooth: hci0: Opcode 0x1003 failed: -110
[ 37.413470][ T412] Bluetooth: hci0: Opcode 0x0c1a failed: -22
[ 37.419567][ T414] Bluetooth: hci0: Opcode 0x0c1a failed: -22
[ 37.425796][ T415] Bluetooth: hci0: Opcode 0x0c1a failed: -22
[ 37.432034][ T417] Bluetooth: hci0: Opcode 0x0c1a failed: -22
[ 37.438202][ T416] Bluetooth: hci0: Opcode 0x0c1a failed: -22
[ 37.481193][ T45] Bluetooth: hci4: command 0x1003 tx timeout
[ 37.481233][ T407] Bluetooth: hci2: Opcode 0x1003 failed: -110
[ 37.481261][ T404] Bluetooth: hci1: Opcode 0x1003 failed: -110
[ 37.487459][ T407] Bluetooth: hci3: command 0x1003 tx timeout
[ 37.487482][ T407] Bluetooth: hci1: command 0x1003 tx timeout
[ 37.511857][ T402] Bluetooth: hci3: Opcode 0x1003 failed: -110
[ 37.517992][ T400] Bluetooth: hci4: Opcode 0x1003 failed: -110
[ 37.540242][ T8] Bluetooth: hci0: Frame reassembly failed (-84)
[ 37.551128][ T43] Bluetooth: hci1: Frame reassembly failed (-84)
[ 37.558988][ T405] Bluetooth: hci2: Frame reassembly failed (-84)
[ 37.565824][ T336] Bluetooth: hci3: Frame reassembly failed (-84)
[ 37.577584][ T336] Bluetooth: hci4: Frame reassembly failed (-84)
[ 39.561126][ T407] Bluetooth: hci2: command 0x1003 tx timeout
[ 39.561135][ T402] Bluetooth: hci2: Opcode 0x1003 failed: -110
[ 39.561167][ T407] Bluetooth: hci1: command 0x1003 tx timeout
[ 39.567220][ T400] Bluetooth: hci1: Opcode 0x1003 failed: -110
[ 39.574649][ T407] Bluetooth: hci0: command 0x1003 tx timeout
[ 39.579340][ T404] Bluetooth: hci0: Opcode 0x1003 failed: -110
[ 39.597920][ T420] Bluetooth: hci0: Opcode 0x0c1a failed: -22
[ 39.604167][ T423] Bluetooth: hci0: Opcode 0x0c1a failed: -22
[ 39.611471][ T422] Bluetooth: hci0: Opcode 0x0c1a failed: -22
[ 39.617606][ T421] Bluetooth: hci0: Opcode 0x0c1a failed: -22
[ 39.623835][ T419] Bluetooth: hci0: Opcode 0x0c1a failed: -22
[ 39.641182][ T45] Bluetooth: hci4: Opcode 0x1003 failed: -110
[ 39.647344][ T404] Bluetooth: hci3: command 0x1003 tx timeout
[ 39.647351][ T409] Bluetooth: hci3: Opcode 0x1003 failed: -110
[ 39.655486][ T424] Bluetooth: hci4: command 0x1003 tx timeout
[ 39.672652][ T336] Bluetooth: hci0: Frame reassembly failed (-84)
[ 39.692887][ T43] Bluetooth: hci1: Frame reassembly failed (-84)
[ 39.699776][ T405] Bluetooth: hci2: Frame reassembly failed (-84)
[ 39.701775][ T43] Bluetooth: hci4: Frame reassembly failed (-84)
[ 39.715795][ T43] Bluetooth: hci3: Frame reassembly failed (-84)
[ 41.641103][ C1] ==================================================================
[ 41.649241][ C1] BUG: KASAN: use-after-free in __run_timers+0x341/0x9b0
[ 41.656309][ C1] Write of size 8 at addr ffff88811aeb4a00 by task swapper/1/0
[ 41.663865][ C1]
[ 41.666196][ C1] CPU: 1 PID: 0 Comm: swapper/1 Not tainted syzkaller #0
[ 41.673228][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
[ 41.683313][ C1] Call Trace:
[ 41.686606][ C1]
[ 41.689458][ C1] __dump_stack+0x21/0x24
[ 41.693812][ C1] dump_stack_lvl+0x110/0x170
[ 41.698511][ C1] ? __cfi_dump_stack_lvl+0x8/0x8
[ 41.703594][ C1] ? __cfi_trigger_load_balance+0x10/0x10
[ 41.709426][ C1] ? __run_timers+0x341/0x9b0
[ 41.714190][ C1] print_address_description+0x71/0x200
[ 41.719772][ C1] print_report+0x4a/0x60
[ 41.722949][ T400] Bluetooth: hci3: command 0x1003 tx timeout
[ 41.724115][ C1] kasan_report+0x122/0x150
[ 41.730224][ T400] Bluetooth: hci4: command 0x1003 tx timeout
[ 41.734670][ C1] ? __run_timers+0x341/0x9b0
[ 41.734703][ C1] __asan_report_store8_noabort+0x17/0x20
[ 41.740716][ T407] Bluetooth: hci3: Opcode 0x1003 failed: -110
[ 41.745371][ C1] __run_timers+0x341/0x9b0
[ 41.745406][ C1] ? sched_clock_cpu+0x6e/0x260
[ 41.751171][ T404] Bluetooth: hci4: Opcode 0x1003 failed: -110
[ 41.757191][ C1] ? calc_index+0x200/0x200
[ 41.761838][ T402] Bluetooth: hci2: command 0x1003 tx timeout
[ 41.766551][ C1] ? kvm_sched_clock_read+0x18/0x40
[ 41.788315][ C1] run_timer_softirq+0x6a/0xf0
[ 41.793089][ C1] handle_softirqs+0x1d7/0x600
[ 41.797856][ C1] __irq_exit_rcu+0x52/0xf0
[ 41.802446][ C1] irq_exit_rcu+0x9/0x10
[ 41.806687][ C1] sysvec_apic_timer_interrupt+0xa9/0xc0
[ 41.812334][ C1]
[ 41.815277][ C1]
[ 41.818203][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[ 41.824208][ C1] RIP: 0010:default_idle+0xf/0x20
[ 41.829234][ C1] Code: cc 00 00 cc cc 00 00 cc cc 00 00 90 90 90 90 90 90 90 90 90 90 90 b8 0c 67 40 a5 55 48 89 e5 66 90 0f 00 2d 63 7b 65 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
[ 41.848835][ C1] RSP: 0018:ffffc90000147dd8 EFLAGS: 00000257
[ 41.854934][ C1] RAX: ffff8881f6f00000 RBX: ffff888100332880 RCX: 3ca9454812aa2a00
[ 41.862902][ C1] RDX: 0000000000000001 RSI: ffffffff85ca6000 RDI: ffffffff85ca5fc0
[ 41.870874][ C1] RBP: ffffc90000147dd8 R08: ffff8881f6f348b3 R09: 1ffff1103ede6916
[ 41.878852][ C1] R10: 0000000000000000 R11: ffffffff8500b370 R12: dffffc0000000000
[ 41.886834][ C1] R13: 0000000000000001 R14: ffff888100332880 R15: dffffc0000000000
[ 41.894838][ C1] ? __cfi_default_idle+0x10/0x10
[ 41.899893][ C1] arch_cpu_idle+0x1c/0x20
[ 41.904317][ C1] default_idle_call+0x71/0x1d0
[ 41.909168][ C1] do_idle+0x354/0x640
[ 41.913253][ C1] ? irqentry_exit+0x30/0x40
[ 41.917843][ C1] ? sysvec_call_function_single+0x61/0xc0
[ 41.923660][ C1] ? asm_sysvec_call_function_single+0x1b/0x20
[ 41.929822][ C1] ? idle_inject_timer_fn+0x60/0x60
[ 41.935021][ C1] ? do_idle+0x62c/0x640
[ 41.939265][ C1] cpu_startup_entry+0x43/0x60
[ 41.944029][ C1] start_secondary+0x119/0x120
[ 41.948815][ C1] secondary_startup_64_no_verify+0xce/0xdb
[ 41.954716][ C1]
[ 41.957734][ C1]
[ 41.960053][ C1] Allocated by task 420:
[ 41.964302][ C1] kasan_set_track+0x4b/0x70
[ 41.968898][ C1] kasan_save_alloc_info+0x1f/0x30
[ 41.974012][ C1] __kasan_kmalloc+0x95/0xb0
[ 41.978602][ C1] __kmalloc+0xb4/0x1e0
[ 41.982752][ C1] hci_alloc_dev_priv+0x27/0x1bd0
[ 41.987814][ C1] hci_uart_tty_ioctl+0x3c4/0xa40
[ 41.993154][ C1] tty_ioctl+0x8ef/0xc60
[ 41.997453][ C1] __se_sys_ioctl+0x12f/0x1b0
[ 42.002171][ C1] __x64_sys_ioctl+0x7b/0x90
[ 42.006774][ C1] x64_sys_call+0x58b/0x9a0
[ 42.011289][ C1] do_syscall_64+0x4c/0xa0
[ 42.015741][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 42.021656][ C1]
[ 42.024074][ C1] Freed by task 419:
[ 42.027965][ C1] kasan_set_track+0x4b/0x70
[ 42.032561][ C1] kasan_save_free_info+0x2b/0x40
[ 42.037588][ C1] ____kasan_slab_free+0x132/0x180
[ 42.042713][ C1] __kasan_slab_free+0x11/0x20
[ 42.047497][ C1] slab_free_freelist_hook+0xc2/0x190
[ 42.052870][ C1] __kmem_cache_free+0xb7/0x1b0
[ 42.057728][ C1] kfree+0x6f/0xf0
[ 42.061447][ C1] hci_release_dev+0x12a3/0x13b0
[ 42.066402][ C1] bt_host_release+0x82/0x90
[ 42.071006][ C1] device_release+0xa4/0x1d0
[ 42.075610][ C1] kobject_put+0x19d/0x280
[ 42.080047][ C1] put_device+0x1f/0x30
[ 42.084210][ C1] hci_dev_cmd+0x279/0x740
[ 42.088639][ C1] hci_sock_ioctl+0x41e/0x7f0
[ 42.093338][ C1] sock_do_ioctl+0x114/0x330
[ 42.097931][ C1] sock_ioctl+0x475/0x700
[ 42.102261][ C1] __se_sys_ioctl+0x12f/0x1b0
[ 42.106952][ C1] __x64_sys_ioctl+0x7b/0x90
[ 42.111554][ C1] x64_sys_call+0x58b/0x9a0
[ 42.116078][ C1] do_syscall_64+0x4c/0xa0
[ 42.120549][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 42.126456][ C1]
[ 42.128781][ C1] Last potentially related work creation:
[ 42.134490][ C1] kasan_save_stack+0x3a/0x60
[ 42.139285][ C1] __kasan_record_aux_stack+0xb6/0xc0
[ 42.144660][ C1] kasan_record_aux_stack_noalloc+0xb/0x10
[ 42.150478][ C1] insert_work+0x51/0x300
[ 42.154808][ C1] __queue_work+0x9d0/0xd50
[ 42.159314][ C1] queue_work_on+0xde/0x150
[ 42.163819][ C1] __hci_cmd_sync_sk+0xaa8/0xd80
[ 42.168762][ C1] hci_cmd_sync_status+0x53/0x120
[ 42.173861][ C1] hci_dev_cmd+0x357/0x740
[ 42.178291][ C1] hci_sock_ioctl+0x41e/0x7f0
[ 42.183004][ C1] sock_do_ioctl+0x114/0x330
[ 42.187605][ C1] sock_ioctl+0x475/0x700
[ 42.191939][ C1] __se_sys_ioctl+0x12f/0x1b0
[ 42.196623][ C1] __x64_sys_ioctl+0x7b/0x90
[ 42.201495][ C1] x64_sys_call+0x58b/0x9a0
[ 42.206016][ C1] do_syscall_64+0x4c/0xa0
[ 42.210435][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 42.216331][ C1]
[ 42.218651][ C1] Second to last potentially related work creation:
[ 42.225229][ C1] kasan_save_stack+0x3a/0x60
[ 42.229912][ C1] __kasan_record_aux_stack+0xb6/0xc0
[ 42.235287][ C1] kasan_record_aux_stack_noalloc+0xb/0x10
[ 42.241092][ C1] insert_work+0x51/0x300
[ 42.245421][ C1] __queue_work+0x9d0/0xd50
[ 42.249924][ C1] queue_work_on+0xde/0x150
[ 42.254458][ C1] __hci_cmd_sync_sk+0xaa8/0xd80
[ 42.259404][ C1] hci_cmd_sync_status+0x53/0x120
[ 42.264524][ C1] hci_dev_cmd+0x357/0x740
[ 42.268940][ C1] hci_sock_ioctl+0x41e/0x7f0
[ 42.273624][ C1] sock_do_ioctl+0x114/0x330
[ 42.278219][ C1] sock_ioctl+0x475/0x700
[ 42.282553][ C1] __se_sys_ioctl+0x12f/0x1b0
[ 42.287236][ C1] __x64_sys_ioctl+0x7b/0x90
[ 42.291829][ C1] x64_sys_call+0x58b/0x9a0
[ 42.296334][ C1] do_syscall_64+0x4c/0xa0
[ 42.300754][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 42.306653][ C1]
[ 42.309018][ C1] The buggy address belongs to the object at ffff88811aeb4000
[ 42.309018][ C1] which belongs to the cache kmalloc-8k of size 8192
[ 42.323085][ C1] The buggy address is located 2560 bytes inside of
[ 42.323085][ C1] 8192-byte region [ffff88811aeb4000, ffff88811aeb6000)
[ 42.336528][ C1]
[ 42.338860][ C1] The buggy address belongs to the physical page:
[ 42.345279][ C1] page:ffffea00046bac00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11aeb0
[ 42.355530][ C1] head:ffffea00046bac00 order:3 compound_mapcount:0 compound_pincount:0
[ 42.363881][ C1] flags: 0x4000000000010200(slab|head|zone=1)
[ 42.369964][ C1] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100043500
[ 42.378549][ C1] raw: 0000000000000000 0000000000020002 00000001ffffffff 0000000000000000
[ 42.387207][ C1] page dumped because: kasan: bad access detected
[ 42.393616][ C1] page_owner tracks the page as allocated
[ 42.399320][ C1] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 420, tgid 420 (syz.6.28), ts 37536485983, free_ts 37535327043
[ 42.421562][ C1] post_alloc_hook+0x1f5/0x210
[ 42.426344][ C1] prep_new_page+0x1c/0x110
[ 42.430855][ C1] get_page_from_freelist+0x2ca9/0x2d20
[ 42.436431][ C1] __alloc_pages+0x1fa/0x610
[ 42.441023][ C1] alloc_slab_page+0x6e/0xf0
[ 42.445605][ C1] new_slab+0x98/0x3e0
[ 42.449665][ C1] ___slab_alloc+0x70f/0xb70
[ 42.454256][ C1] __slab_alloc+0x5e/0xa0
[ 42.458618][ C1] __kmem_cache_alloc_node+0x204/0x2d0
[ 42.464113][ C1] __kmalloc+0xa4/0x1e0
[ 42.468262][ C1] hci_alloc_dev_priv+0x27/0x1bd0
[ 42.473284][ C1] hci_uart_tty_ioctl+0x3c4/0xa40
[ 42.478322][ C1] tty_ioctl+0x8ef/0xc60
[ 42.482568][ C1] __se_sys_ioctl+0x12f/0x1b0
[ 42.487244][ C1] __x64_sys_ioctl+0x7b/0x90
[ 42.491848][ C1] x64_sys_call+0x58b/0x9a0
[ 42.496369][ C1] page last free stack trace:
[ 42.501035][ C1] free_unref_page_prepare+0x80c/0x820
[ 42.506515][ C1] free_unref_page+0x93/0x530
[ 42.511211][ C1] __free_pages+0x67/0x100
[ 42.515630][ C1] __free_slab+0xc7/0x1a0
[ 42.519977][ C1] __unfreeze_partials+0x15a/0x190
[ 42.525084][ C1] put_cpu_partial+0xa9/0x100
[ 42.529779][ C1] __slab_free+0x1c4/0x280
[ 42.534225][ C1] ___cache_free+0xbf/0xd0
[ 42.538640][ C1] qlist_free_all+0xc6/0x140
[ 42.543226][ C1] kasan_quarantine_reduce+0x14a/0x170
[ 42.548688][ C1] __kasan_slab_alloc+0x24/0x80
[ 42.553538][ C1] slab_post_alloc_hook+0x4f/0x2d0
[ 42.558651][ C1] kmem_cache_alloc+0x166/0x320
[ 42.563500][ C1] security_inode_alloc+0x33/0x120
[ 42.568616][ C1] inode_init_always+0x6ee/0x950
[ 42.573558][ C1] new_inode_pseudo+0xa2/0x1f0
[ 42.578321][ C1]
[ 42.580642][ C1] Memory state around the buggy address:
[ 42.586285][ C1] ffff88811aeb4900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 42.594358][ C1] ffff88811aeb4980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 42.602422][ C1] >ffff88811aeb4a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 42.610501][ C1] ^
[ 42.614569][ C1] ffff88811aeb4a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 42.622632][ C1] ffff88811aeb4b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 42.630694][ C1] ==================================================================
[ 42.638753][ C1] Disabling lock debugging due to kernel taint
[ 42.645020][ C1] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
[ 42.656766][ C1] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
[ 42.665301][ C1] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G B syzkaller #0
[ 42.673839][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
[ 42.684250][ C1] RIP: 0010:__queue_work+0x582/0xd50
[ 42.689556][ C1] Code: b4 00 00 00 e8 7f 4d 29 00 48 bb 00 00 00 00 00 fc ff df 4c 89 ef e8 fd d6 b8 03 4c 8b 65 d0 4c 8b 6d c0 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 30 d8 6e 00 49 8b 3e e8 98 d2 b8 03
[ 42.709228][ C1] RSP: 0018:ffffc900001b0c78 EFLAGS: 00010046
[ 42.715335][ C1] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff888100332880
[ 42.723354][ C1] RDX: 0000000000000100 RSI: 000000007fffffff RDI: 000000007fffffff
[ 42.731364][ C1] RBP: ffffc900001b0d08 R08: 0000000000000007 R09: 00000000fffffffb
[ 42.739348][ C1] R10: dffffc0000000000 R11: ffffed10235d6939 R12: ffff88811aeb49c8
[ 42.747332][ C1] R13: ffff88812c706000 R14: 0000000000000000 R15: 000000007fffffff
[ 42.755477][ C1] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
[ 42.764438][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 42.771065][ C1] CR2: 00007fcf21148060 CR3: 0000000122eda000 CR4: 00000000003506a0
[ 42.779081][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 42.787070][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 42.795055][ C1] Call Trace:
[ 42.798341][ C1]
[ 42.801232][ C1] delayed_work_timer_fn+0x61/0x80
[ 42.806360][ C1] ? __cfi_delayed_work_timer_fn+0x10/0x10
[ 42.812179][ C1] call_timer_fn+0x46/0x2a0
[ 42.816693][ C1] ? __cfi_delayed_work_timer_fn+0x10/0x10
[ 42.822504][ C1] __run_timers+0x672/0x9b0
[ 42.827029][ C1] ? calc_index+0x200/0x200
[ 42.831537][ C1] ? kvm_sched_clock_read+0x18/0x40
[ 42.836751][ C1] run_timer_softirq+0x6a/0xf0
[ 42.841520][ C1] handle_softirqs+0x1d7/0x600
[ 42.846303][ C1] __irq_exit_rcu+0x52/0xf0
[ 42.850836][ C1] irq_exit_rcu+0x9/0x10
[ 42.855083][ C1] sysvec_apic_timer_interrupt+0xa9/0xc0
[ 42.860727][ C1]
[ 42.863682][ C1]
[ 42.866609][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[ 42.872597][ C1] RIP: 0010:default_idle+0xf/0x20
[ 42.877659][ C1] Code: cc 00 00 cc cc 00 00 cc cc 00 00 90 90 90 90 90 90 90 90 90 90 90 b8 0c 67 40 a5 55 48 89 e5 66 90 0f 00 2d 63 7b 65 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
[ 42.897272][ C1] RSP: 0018:ffffc90000147dd8 EFLAGS: 00000257
[ 42.903348][ C1] RAX: ffff8881f6f00000 RBX: ffff888100332880 RCX: 3ca9454812aa2a00
[ 42.911337][ C1] RDX: 0000000000000001 RSI: ffffffff85ca6000 RDI: ffffffff85ca5fc0
[ 42.919319][ C1] RBP: ffffc90000147dd8 R08: ffff8881f6f348b3 R09: 1ffff1103ede6916
[ 42.927294][ C1] R10: 0000000000000000 R11: ffffffff8500b370 R12: dffffc0000000000
[ 42.935270][ C1] R13: 0000000000000001 R14: ffff888100332880 R15: dffffc0000000000
[ 42.943570][ C1] ? __cfi_default_idle+0x10/0x10
[ 42.949596][ C1] arch_cpu_idle+0x1c/0x20
[ 42.954042][ C1] default_idle_call+0x71/0x1d0
[ 42.958915][ C1] do_idle+0x354/0x640
[ 42.962996][ C1] ? irqentry_exit+0x30/0x40
[ 42.967624][ C1] ? sysvec_call_function_single+0x61/0xc0
[ 42.973449][ C1] ? asm_sysvec_call_function_single+0x1b/0x20
[ 42.979614][ C1] ? idle_inject_timer_fn+0x60/0x60
[ 42.984908][ C1] ? do_idle+0x62c/0x640
[ 42.989157][ C1] cpu_startup_entry+0x43/0x60
[ 42.993948][ C1] start_secondary+0x119/0x120
[ 42.998726][ C1] secondary_startup_64_no_verify+0xce/0xdb
[ 43.004650][ C1]
[ 43.007670][ C1] Modules linked in:
[ 43.011656][ C1] ---[ end trace 0000000000000000 ]---
[ 43.017117][ C1] RIP: 0010:__queue_work+0x582/0xd50
[ 43.022429][ C1] Code: b4 00 00 00 e8 7f 4d 29 00 48 bb 00 00 00 00 00 fc ff df 4c 89 ef e8 fd d6 b8 03 4c 8b 65 d0 4c 8b 6d c0 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 30 d8 6e 00 49 8b 3e e8 98 d2 b8 03
[ 43.042134][ C1] RSP: 0018:ffffc900001b0c78 EFLAGS: 00010046
[ 43.048215][ C1] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff888100332880
[ 43.056205][ C1] RDX: 0000000000000100 RSI: 000000007fffffff RDI: 000000007fffffff
[ 43.064185][ C1] RBP: ffffc900001b0d08 R08: 0000000000000007 R09: 00000000fffffffb
[ 43.072162][ C1] R10: dffffc0000000000 R11: ffffed10235d6939 R12: ffff88811aeb49c8
[ 43.080138][ C1] R13: ffff88812c706000 R14: 0000000000000000 R15: 000000007fffffff
[ 43.088116][ C1] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
[ 43.097054][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 43.103661][ C1] CR2: 00007fcf21148060 CR3: 0000000122eda000 CR4: 00000000003506a0
[ 43.111638][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 43.119641][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 43.127640][ C1] Kernel panic - not syncing: Fatal exception in interrupt
[ 43.135427][ C1] Kernel Offset: disabled
[ 43.139760][ C1] Rebooting in 86400 seconds..