Warning: Permanently added '10.128.0.62' (ED25519) to the list of known hosts. 1970/01/01 00:00:30 parsed 1 programs 1970/01/01 00:00:30 serving rpc on tcp://43183 [ 31.987968][ T4725] cgroup: Unknown subsys name 'net' [ 32.117982][ T4725] cgroup: Unknown subsys name 'cpuset' [ 32.120338][ T4725] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 32.296798][ T4725] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 36.329078][ T4732] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.329367][ T4732] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.329431][ T4732] bridge_slave_0: entered allmulticast mode [ 36.329901][ T4732] bridge_slave_0: entered promiscuous mode [ 36.331448][ T4732] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.331497][ T4732] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.331600][ T4732] bridge_slave_1: entered allmulticast mode [ 36.331997][ T4732] bridge_slave_1: entered promiscuous mode [ 36.341263][ T4732] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 36.342132][ T4732] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 36.348513][ T4732] team0: Port device team_slave_0 added [ 36.349275][ T4732] team0: Port device team_slave_1 added [ 36.355109][ T4732] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 36.355622][ T4732] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 36.355643][ T4732] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 36.356411][ T4732] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 36.356693][ T4732] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 36.356713][ T4732] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 36.368478][ T4732] hsr_slave_0: entered promiscuous mode [ 36.368842][ T4732] hsr_slave_1: entered promiscuous mode [ 36.412355][ T4732] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 36.415427][ T4732] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 36.417186][ T4732] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 36.419516][ T4732] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 36.420186][ T4732] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 36.421787][ T4732] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 36.422064][ T4732] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 36.424332][ T4732] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 36.433162][ T4732] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.433217][ T4732] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.433356][ T4732] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.433384][ T4732] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.449521][ T4732] 8021q: adding VLAN 0 to HW filter on device bond0 [ 36.453213][ T1894] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.455028][ T1894] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.460171][ T4732] 8021q: adding VLAN 0 to HW filter on device team0 [ 36.462390][ T1894] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.462454][ T1894] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.465539][ T1894] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.465578][ T1894] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.562860][ T4732] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 36.574149][ T4732] veth0_vlan: entered promiscuous mode [ 36.576077][ T4732] veth1_vlan: entered promiscuous mode [ 36.583291][ T4732] veth0_macvtap: entered promiscuous mode [ 36.584830][ T4732] veth1_macvtap: entered promiscuous mode [ 36.590659][ T4732] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 36.591882][ T4732] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 36.626723][ T15] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.628455][ T15] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.629120][ T15] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.629147][ T15] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.640709][ T4732] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 36.704032][ T1894] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 36.790884][ T1894] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 36.861987][ T4783] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 36.862542][ T4783] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 36.862725][ T4783] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 36.863046][ T4783] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 36.863259][ T4783] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 36.873526][ T1894] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 36.930175][ T1894] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 37.499986][ T1869] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 37.500020][ T1869] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 37.509995][ T180] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 37.510022][ T180] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 1970/01/01 00:00:37 executed programs: 0 [ 38.001584][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 38.001968][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 38.002127][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 38.002423][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 38.002660][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 38.140031][ T4834] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.140108][ T4834] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.140215][ T4834] bridge_slave_0: entered allmulticast mode [ 38.140651][ T4834] bridge_slave_0: entered promiscuous mode [ 38.141754][ T4834] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.141807][ T4834] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.141867][ T4834] bridge_slave_1: entered allmulticast mode [ 38.142297][ T4834] bridge_slave_1: entered promiscuous mode [ 38.149971][ T4834] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.150995][ T4834] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.158467][ T4834] team0: Port device team_slave_0 added [ 38.159286][ T4834] team0: Port device team_slave_1 added [ 38.165161][ T4834] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.165319][ T4834] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.165336][ T4834] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.165966][ T4834] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.165973][ T4834] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.165988][ T4834] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.176799][ T4834] hsr_slave_0: entered promiscuous mode [ 38.177127][ T4834] hsr_slave_1: entered promiscuous mode [ 38.177366][ T4834] debugfs: 'hsr0' already exists in 'hsr' [ 38.177413][ T4834] Cannot create hsr debugfs directory [ 39.893080][ T1894] bridge_slave_1: left allmulticast mode [ 39.894295][ T1894] bridge_slave_1: left promiscuous mode [ 39.895814][ T1894] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.899873][ T1894] bridge_slave_0: left allmulticast mode [ 39.900577][ T1894] bridge_slave_0: left promiscuous mode [ 39.900660][ T1894] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.959902][ T1894] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 39.978212][ T1894] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 39.987861][ T1894] bond0 (unregistering): Released all slaves [ 40.027089][ T4783] Bluetooth: hci0: command tx timeout [ 40.051847][ T1894] hsr_slave_0: left promiscuous mode [ 40.053295][ T1894] hsr_slave_1: left promiscuous mode [ 40.054825][ T1894] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 40.054867][ T1894] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 40.059448][ T1894] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 40.059477][ T1894] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 40.066155][ T1894] veth1_macvtap: left promiscuous mode [ 40.067688][ T1894] veth0_macvtap: left promiscuous mode [ 40.068818][ T1894] veth1_vlan: left promiscuous mode [ 40.070033][ T1894] veth0_vlan: left promiscuous mode [ 40.164003][ T1894] team0 (unregistering): Port device team_slave_1 removed [ 40.170217][ T1894] team0 (unregistering): Port device team_slave_0 removed [ 40.212489][ T4403] 8021q: adding VLAN 0 to HW filter on device eth0 [ 40.434590][ T4834] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 40.437377][ T4834] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 40.439126][ T4834] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 40.441478][ T4834] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 40.443118][ T4834] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 40.445459][ T4834] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 40.447644][ T4834] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 40.449914][ T4834] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 40.473652][ T4834] 8021q: adding VLAN 0 to HW filter on device bond0 [ 40.478830][ T4834] 8021q: adding VLAN 0 to HW filter on device team0 [ 40.482104][ T15] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.482152][ T15] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.487572][ T15] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.487611][ T15] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.856636][ T4834] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 40.914696][ T4834] veth0_vlan: entered promiscuous mode [ 40.918630][ T4834] veth1_vlan: entered promiscuous mode [ 40.925908][ T4834] veth0_macvtap: entered promiscuous mode [ 40.927080][ T4834] veth1_macvtap: entered promiscuous mode [ 40.930550][ T4834] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.931542][ T4834] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.969441][ T15] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.969477][ T15] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.981621][ T1869] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.981648][ T1869] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.986756][ T15] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.988707][ T1869] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.988731][ T1869] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.988748][ T1869] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.018029][ T4923] syz.0.17 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 41.018066][ T4923] CPU: 0 UID: 0 PID: 4923 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT [ 41.018077][ T4923] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 41.018083][ T4923] Call trace: [ 41.018086][ T4923] show_stack+0x2c/0x3c (C) [ 41.018105][ T4923] __dump_stack+0x30/0x40 [ 41.018116][ T4923] dump_stack_lvl+0xd8/0x12c [ 41.018126][ T4923] dump_stack+0x1c/0x28 [ 41.018136][ T4923] dump_header+0xbc/0x3f0 [ 41.018144][ T4923] oom_kill_process+0x248/0x8a0 [ 41.018154][ T4923] out_of_memory+0xd24/0x1064 [ 41.018162][ T4923] mem_cgroup_out_of_memory+0xe8/0x170 [ 41.018172][ T4923] try_charge_memcg+0x8ec/0xc64 [ 41.018180][ T4923] obj_cgroup_charge_pages+0x30/0xb0 [ 41.018191][ T4923] __memcg_slab_post_alloc_hook+0x4a0/0x8cc [ 41.018199][ T4923] kmem_cache_alloc_lru_noprof+0x32c/0x5dc [ 41.018208][ T4923] alloc_inode+0x84/0x198 [ 41.018218][ T4923] new_inode+0x20/0x50 [ 41.018226][ T4923] gadgetfs_make_inode+0x34/0x18c [ 41.018236][ T4923] gadgetfs_create_file+0x48/0xd8 [ 41.018244][ T4923] gadgetfs_bind+0x3f8/0x75c [ 41.018252][ T4923] gadget_bind_driver+0x274/0x834 [ 41.018260][ T4923] really_probe+0x29c/0x800 [ 41.018272][ T4923] __driver_probe_device+0x1e0/0x350 [ 41.018282][ T4923] driver_probe_device+0x6c/0x19c [ 41.018291][ T4923] __driver_attach+0x168/0x384 [ 41.018301][ T4923] bus_for_each_dev+0x128/0x1b4 [ 41.018310][ T4923] driver_attach+0x50/0x60 [ 41.018319][ T4923] bus_add_driver+0x208/0x500 [ 41.018327][ T4923] driver_register+0x220/0x310 [ 41.018337][ T4923] usb_gadget_register_driver_owner+0xf0/0x25c [ 41.018345][ T4923] dev_config+0x91c/0xcc0 [ 41.018352][ T4923] vfs_write+0x2a4/0xa0c [ 41.018360][ T4923] ksys_write+0x12c/0x228 [ 41.018366][ T4923] __arm64_sys_write+0x84/0x98 [ 41.018374][ T4923] invoke_syscall+0x98/0x244 [ 41.018384][ T4923] el0_svc_common+0xec/0x23c [ 41.018394][ T4923] do_el0_svc+0x4c/0x5c [ 41.018404][ T4923] el0_svc+0x64/0x260 [ 41.018413][ T4923] el0t_64_sync_handler+0x44/0x104 [ 41.018422][ T4923] el0t_64_sync+0x198/0x19c [ 41.020334][ T4923] memory: usage 0kB, limit 0kB, failcnt 19 [ 41.020349][ T4923] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 41.020356][ T4923] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 41.020361][ T4923] Memory cgroup stats for /syz0/test: [ 41.020441][ T4923] cache 0 [ 41.020445][ T4923] rss 0 [ 41.020448][ T4923] rss_huge 0 [ 41.020451][ T4923] shmem 0 [ 41.020454][ T4923] mapped_file 0 [ 41.020457][ T4923] dirty 0 [ 41.020460][ T4923] writeback 0 [ 41.020463][ T4923] workingset_refault_anon 0 [ 41.020466][ T4923] workingset_refault_file 0 [ 41.020469][ T4923] swap 0 [ 41.020472][ T4923] swapcached 0 [ 41.020475][ T4923] pgpgin 0 [ 41.020478][ T4923] pgpgout 0 [ 41.020481][ T4923] pgfault 0 [ 41.020484][ T4923] pgmajfault 0 [ 41.020487][ T4923] inactive_anon 0 [ 41.020490][ T4923] active_anon 0 [ 41.020493][ T4923] inactive_file 0 [ 41.020496][ T4923] active_file 0 [ 41.020499][ T4923] unevictable 0 [ 41.020502][ T4923] hierarchical_memory_limit 0 [ 41.020505][ T4923] hierarchical_memsw_limit 9223372036854771712 [ 41.020514][ T4923] total_cache 0 [ 41.020517][ T4923] total_rss 0 [ 41.020520][ T4923] total_rss_huge 0 [ 41.020524][ T4923] total_shmem 0 [ 41.020527][ T4923] total_mapped_file 0 [ 41.020530][ T4923] total_dirty 0 [ 41.020533][ T4923] total_writeback 0 [ 41.020536][ T4923] total_workingset_refault_anon 0 [ 41.020539][ T4923] total_workingset_refault_file 0 [ 41.020543][ T4923] total_swap 0 [ 41.020546][ T4923] total_swapcached 0 [ 41.020549][ T4923] total_pgpgin 0 [ 41.020552][ T4923] total_pgpgout 0 [ 41.020555][ T4923] total_pgfault 0 [ 41.020558][ T4923] total_pgmajfault 0 [ 41.020561][ T4923] total_inactive_anon 0 [ 41.020564][ T4923] total_active_anon 0 [ 41.020567][ T4923] total_inactive_file 0 [ 41.020570][ T4923] total_active_file 0 [ 41.020573][ T4923] total_unevictable 0 [ 41.020576][ T4923] anon_cost 0 [ 41.020579][ T4923] file_cost 0 [ 41.020583][ T4923] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0,oom_memcg=/syz0/test,task_memcg=/syz0/test,task=syz.0.17,pid=4923,uid=0 [ 41.020667][ T4923] Memory cgroup out of memory: Killed process 4923 (syz.0.17) total-vm:44808kB, anon-rss:1292kB, file-rss:1040kB, shmem-rss:0kB, UID:0 pgtables:76kB oom_score_adj:1000 [ 41.024406][ T4923] udc dummy_udc.0: failed to start USB Gadget filesystem: -12 [ 41.024420][ T4923] gadgetfs gadget.0: probe with driver gadgetfs failed with error -12 [ 41.024609][ T4923] gadgetfs expected dummy_udc controller not usbip-vudc [ 41.024618][ T4923] udc usbip-vudc.0: failed to start USB Gadget filesystem: -19 [ 41.025198][ T4923] UDC core: USB Gadget filesystem: couldn't find an available UDC [ 41.041617][ T4924] ================================================================== [ 41.041627][ T4924] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irq+0x58/0x70 [ 41.041643][ T4924] Read of size 1 at addr ffff0000d8503018 by task syz.0.18/4924 [ 41.041650][ T4924] [ 41.041654][ T4924] CPU: 0 UID: 0 PID: 4924 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT [ 41.041663][ T4924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 41.041667][ T4924] Call trace: [ 41.041670][ T4924] show_stack+0x2c/0x3c (C) [ 41.041682][ T4924] __dump_stack+0x30/0x40 [ 41.041693][ T4924] dump_stack_lvl+0xd8/0x12c [ 41.041702][ T4924] print_address_description+0xb0/0x238 [ 41.041711][ T4924] print_report+0x68/0x84 [ 41.041718][ T4924] kasan_report+0x8c/0xc4 [ 41.041727][ T4924] __kasan_check_byte+0x3c/0x54 [ 41.041736][ T4924] lock_acquire+0xa4/0x364 [ 41.041744][ T4924] _raw_spin_lock_irq+0x58/0x70 [ 41.041752][ T4924] gadget_dev_open+0x50/0x1c4 [ 41.041761][ T4924] do_dentry_open+0x5c4/0xfc0 [ 41.041771][ T4924] vfs_open+0x44/0x2dc [ 41.041780][ T4924] path_openat+0x21fc/0x2a60 [ 41.041789][ T4924] do_file_open+0x1c8/0x2e8 [ 41.041797][ T4924] do_sys_openat2+0x114/0x1e8 [ 41.041806][ T4924] do_sys_open+0xb0/0xe0 [ 41.041815][ T4924] __arm64_sys_openat+0xa8/0xc4 [ 41.041825][ T4924] invoke_syscall+0x98/0x244 [ 41.041835][ T4924] el0_svc_common+0xec/0x23c [ 41.041844][ T4924] do_el0_svc+0x4c/0x5c [ 41.041853][ T4924] el0_svc+0x64/0x260 [ 41.041861][ T4924] el0t_64_sync_handler+0x44/0x104 [ 41.041869][ T4924] el0t_64_sync+0x198/0x19c [ 41.041877][ T4924] [ 41.041879][ T4924] Allocated by task 4834: [ 41.041883][ T4924] kasan_save_track+0x40/0x78 [ 41.041890][ T4924] kasan_save_alloc_info+0x40/0x50 [ 41.041898][ T4924] __kasan_kmalloc+0x9c/0xb4 [ 41.041905][ T4924] __kmalloc_cache_noprof+0x2e8/0x5ec [ 41.041912][ T4924] gadgetfs_fill_super+0x19c/0x370 [ 41.041919][ T4924] vfs_get_super+0xb8/0x148 [ 41.041925][ T4924] get_tree_single+0x30/0x40 [ 41.041932][ T4924] gadgetfs_get_tree+0x28/0x38 [ 41.041938][ T4924] vfs_get_tree+0x90/0x28c [ 41.041944][ T4924] fc_mount+0x24/0xac [ 41.041951][ T4924] do_new_mount+0x2a4/0x538 [ 41.041958][ T4924] path_mount+0x5f0/0xa88 [ 41.041965][ T4924] do_mount+0xe8/0x148 [ 41.041972][ T4924] __arm64_sys_mount+0x33c/0x388 [ 41.041980][ T4924] invoke_syscall+0x98/0x244 [ 41.041988][ T4924] el0_svc_common+0xec/0x23c [ 41.041996][ T4924] do_el0_svc+0x4c/0x5c [ 41.042003][ T4924] el0_svc+0x64/0x260 [ 41.042009][ T4924] el0t_64_sync_handler+0x44/0x104 [ 41.042016][ T4924] el0t_64_sync+0x198/0x19c [ 41.042021][ T4924] [ 41.042023][ T4924] Freed by task 4923: [ 41.042026][ T4924] kasan_save_track+0x40/0x78 [ 41.042033][ T4924] kasan_save_free_info+0x54/0x6c [ 41.042040][ T4924] __kasan_slab_free+0x74/0xa4 [ 41.042047][ T4924] kfree+0x188/0x690 [ 41.042053][ T4924] put_dev+0x8c/0xf8 [ 41.042059][ T4924] dev_release+0x100/0x15c [ 41.042065][ T4924] __fput+0x338/0x74c [ 41.042070][ T4924] ____fput+0x20/0x30 [ 41.042076][ T4924] task_work_run+0x1cc/0x25c [ 41.042084][ T4924] do_exit+0x58c/0x1a74 [ 41.042093][ T4924] do_group_exit+0x198/0x238 [ 41.042098][ T4924] get_signal+0xfb0/0x1094 [ 41.042103][ T4924] arch_do_signal_or_restart+0x288/0x444c [ 41.042112][ T4924] exit_to_user_mode_loop+0x70/0x17c [ 41.042119][ T4924] el0_svc+0x18c/0x260 [ 41.042125][ T4924] el0t_64_sync_handler+0x44/0x104 [ 41.042132][ T4924] el0t_64_sync+0x198/0x19c [ 41.042137][ T4924] [ 41.042139][ T4924] The buggy address belongs to the object at ffff0000d8503000 [ 41.042139][ T4924] which belongs to the cache kmalloc-1k of size 1024 [ 41.042144][ T4924] The buggy address is located 24 bytes inside of [ 41.042144][ T4924] freed 1024-byte region [ffff0000d8503000, ffff0000d8503400) [ 41.042151][ T4924] [ 41.042153][ T4924] The buggy address belongs to the physical page: [ 41.042156][ T4924] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118500 [ 41.042163][ T4924] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 41.042169][ T4924] flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 41.042176][ T4924] page_type: f5(slab) [ 41.042182][ T4924] raw: 05ffc00000000040 ffff0000c0001dc0 dead000000000100 dead000000000122 [ 41.042188][ T4924] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 41.042194][ T4924] head: 05ffc00000000040 ffff0000c0001dc0 dead000000000100 dead000000000122 [ 41.042199][ T4924] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 41.042205][ T4924] head: 05ffc00000000003 fffffdffc3614001 00000000ffffffff 00000000ffffffff [ 41.042210][ T4924] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 41.042213][ T4924] page dumped because: kasan: bad access detected [ 41.042216][ T4924] [ 41.042217][ T4924] Memory state around the buggy address: [ 41.042221][ T4924] ffff0000d8502f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 41.042225][ T4924] ffff0000d8502f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 41.042229][ T4924] >ffff0000d8503000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 41.042232][ T4924] ^ [ 41.042236][ T4924] ffff0000d8503080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 41.042240][ T4924] ffff0000d8503100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 41.042243][ T4924] ================================================================== [ 41.042246][ T4924] Disabling lock debugging due to kernel taint [ 41.042250][ T4924] ------------[ cut here ]------------ [ 41.042252][ T4924] UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.h:68:9 [ 41.042258][ T4924] index 13596 is out of range for type 'unsigned long[8]' [ 41.042263][ T4924] CPU: 0 UID: 0 PID: 4924 Comm: syz.0.18 Tainted: G B syzkaller #0 PREEMPT [ 41.042272][ T4924] Tainted: [B]=BAD_PAGE [ 41.042274][ T4924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 41.042278][ T4924] Call trace: [ 41.042280][ T4924] show_stack+0x2c/0x3c (C) [ 41.042290][ T4924] __dump_stack+0x30/0x40 [ 41.042299][ T4924] dump_stack_lvl+0xd8/0x12c [ 41.042308][ T4924] dump_stack+0x1c/0x28 [ 41.042318][ T4924] ubsan_epilogue+0x14/0x48 [ 41.042326][ T4924] __ubsan_handle_out_of_bounds+0xd0/0xf8 [ 41.042337][ T4924] queued_spin_lock_slowpath+0x834/0xd04 [ 41.042346][ T4924] do_raw_spin_lock+0x21c/0x2d0 [ 41.042354][ T4924] _raw_spin_lock_irq+0x60/0x70 [ 41.042362][ T4924] gadget_dev_open+0x50/0x1c4 [ 41.042370][ T4924] do_dentry_open+0x5c4/0xfc0 [ 41.042379][ T4924] vfs_open+0x44/0x2dc [ 41.042388][ T4924] path_openat+0x21fc/0x2a60 [ 41.042396][ T4924] do_file_open+0x1c8/0x2e8 [ 41.042403][ T4924] do_sys_openat2+0x114/0x1e8 [ 41.042413][ T4924] do_sys_open+0xb0/0xe0 [ 41.042422][ T4924] __arm64_sys_openat+0xa8/0xc4 [ 41.042431][ T4924] invoke_syscall+0x98/0x244 [ 41.042441][ T4924] el0_svc_common+0xec/0x23c [ 41.042450][ T4924] do_el0_svc+0x4c/0x5c [ 41.042459][ T4924] el0_svc+0x64/0x260 [ 41.042466][ T4924] el0t_64_sync_handler+0x44/0x104 [ 41.042474][ T4924] el0t_64_sync+0x198/0x19c [ 41.042481][ T4924] ---[ end trace ]--- [ 42.136574][ T4783] Bluetooth: hci0: command tx timeout [ 44.186456][ T4783] Bluetooth: hci0: command tx timeout [ 46.286597][ T4783] Bluetooth: hci0: command tx timeout