ci2-android-6-1/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-6-1/syz-executor1502191971 <...> [ 21.898991][ T28] audit: type=1400 audit(1787439206.038:62): avc: denied { rlimitinh } for pid=266 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 21.902220][ T28] audit: type=1400 audit(1787439206.038:63): avc: denied { siginh } for pid=266 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.105' (ED25519) to the list of known hosts. execve("ci2-android-6-1/syz-executor1502191971", ["ci2-android-6-1/syz-executor1502191971"], 0x7ffce6b563b0 /* 10 vars */) = 0 brk(NULL) = 0x555573352000 brk(0x555573352d40) = 0x555573352d40 arch_prctl(ARCH_SET_FS, 0x5555733523c0) = 0 set_tid_address(0x555573352690) = 304 set_robust_list(0x5555733526a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-6-1/syz-executor1502191971", 4096) = 44 getrandom("\x16\x48\xdc\xe3\x92\xb9\x3c\xf1", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555573352d40 brk(0x555573373d40) = 0x555573373d40 brk(0x555573374000) = 0x555573374000 mprotect(0x7f676be98000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555573352690) = 305 ci2-android-6-1/strace-static-x86_64: Process 305 attached [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 304] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 304] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 305] set_robust_list(0x5555733526a0, 24) = 0 [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 306 attached [pid 304] <... clone resumed>, child_tidptr=0x555573352690) = 306 [pid 305] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 305] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 304] rt_sigprocmask(SIG_SETMASK, [] [pid 305] <... clone resumed>, child_tidptr=0x555573352690) = 307 [pid 304] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 306] set_robust_list(0x5555733526a0, 24 [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 307 attached [pid 307] set_robust_list(0x5555733526a0, 24) = 0 [pid 307] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 307] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 304] rt_sigprocmask(SIG_BLOCK, ~[] [pid 307] <... prctl resumed>) = 0 [pid 307] setpgid(0, 0) = 0 [pid 307] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 304] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 306] <... set_robust_list resumed>) = 0 executing program [pid 304] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 307] <... openat resumed>) = 3 [pid 307] write(3, "1000", 4) = 4 [pid 307] close(3) = 0 [pid 307] write(1, "executing program\n", 18) = 18 [pid 307] add_key(NULL, NULL, NULL, 0, KEY_SPEC_THREAD_KEYRING) = -1 EFAULT (Bad address) [pid 307] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCIci2-android-6-1/strace-static-x86_64: Process 308 attached [pid 304] <... clone resumed>, child_tidptr=0x555573352690) = 308 [pid 307] <... socket resumed>) = 3 [pid 306] rt_sigprocmask(SIG_SETMASK, [] [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 304] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 304] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555573352690) = 309 [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 304] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 304] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 306] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 306] rt_sigprocmask(SIG_BLOCK, ~[] [pid 304] <... clone resumed>, child_tidptr=0x555573352690) = 310 [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 306] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 306] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555573352690) = 311 [pid 306] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 308] set_robust_list(0x5555733526a0, 24) = 0 [pid 308] rt_sigprocmask(SIG_SETMASK, [] [pid 307] openat(AT_FDCWD, "/dev/ptmx", O_RDWR|O_EXCL|O_NOCTTY|O_TRUNC [pid 308] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 308] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 309 attached ci2-android-6-1/strace-static-x86_64: Process 310 attached [pid 309] set_robust_list(0x5555733526a0, 24 [pid 310] set_robust_list(0x5555733526a0, 24 [pid 309] <... set_robust_list resumed>) = 0 ci2-android-6-1/strace-static-x86_64: Process 311 attached [pid 310] <... set_robust_list resumed>) = 0 [pid 309] rt_sigprocmask(SIG_SETMASK, [] [pid 311] set_robust_list(0x5555733526a0, 24) = 0 [pid 310] rt_sigprocmask(SIG_SETMASK, [] [pid 309] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 308] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 311] rt_sigprocmask(SIG_SETMASK, [] [pid 310] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 311] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 309] rt_sigprocmask(SIG_BLOCK, ~[] [pid 311] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 310] rt_sigprocmask(SIG_BLOCK, ~[] [pid 309] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 311] <... prctl resumed>) = 0 [pid 310] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 309] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 311] setpgid(0, 0 [pid 310] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 311] <... setpgid resumed>) = 0 [pid 309] <... clone resumed>, child_tidptr=0x555573352690) = 312 [pid 310] <... clone resumed>, child_tidptr=0x555573352690) = 313 [pid 307] <... openat resumed>) = 4 ci2-android-6-1/strace-static-x86_64: Process 313 attached [pid 311] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 310] rt_sigprocmask(SIG_SETMASK, [] [pid 309] rt_sigprocmask(SIG_SETMASK, [] [pid 307] ioctl(4, TIOCSETD, [15]ci2-android-6-1/strace-static-x86_64: Process 312 attached [pid 313] set_robust_list(0x5555733526a0, 24 [pid 311] <... openat resumed>) = 3 [pid 310] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 309] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 313] <... set_robust_list resumed>) = 0 [pid 307] <... ioctl resumed>) = 0 [pid 312] set_robust_list(0x5555733526a0, 24 [pid 311] write(3, "1000", 4 [pid 308] <... clone resumed>, child_tidptr=0x555573352690) = 314 ci2-android-6-1/strace-static-x86_64: Process 314 attached [pid 313] rt_sigprocmask(SIG_SETMASK, [] [pid 312] <... set_robust_list resumed>) = 0 [pid 311] <... write resumed>) = 4 [pid 308] rt_sigprocmask(SIG_SETMASK, [] [ 31.972141][ T28] audit: type=1400 audit(1787439216.118:64): avc: denied { execmem } for pid=304 comm="syz-executor150" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 31.995869][ T28] audit: type=1400 audit(1787439216.148:65): avc: denied { create } for pid=307 comm="syz-executor150" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 executing program [pid 307] ioctl(4, _IOC(_IOC_WRITE, 0x55, 0xc8, 0x4), 0x1000000000 [pid 314] set_robust_list(0x5555733526a0, 24 [pid 313] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 312] rt_sigprocmask(SIG_SETMASK, [] [pid 311] close(3 [pid 308] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 313] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 312] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 311] <... close resumed>) = 0 [pid 307] <... ioctl resumed>) = 0 [pid 313] <... prctl resumed>) = 0 [pid 312] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 311] write(1, "executing program\n", 18 [pid 307] ioctl(3, HCISETSCAN, 0x2000000002c0 [pid 314] <... set_robust_list resumed>) = 0 [pid 313] setpgid(0, 0 [pid 312] <... prctl resumed>) = 0 [pid 311] <... write resumed>) = 18 [pid 314] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 314] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 314] setpgid(0, 0) = 0 [pid 314] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 314] write(3, "1000", 4) = 4 [pid 314] close(3) = 0 executing program [pid 314] write(1, "executing program\n", 18) = 18 [pid 314] add_key(NULL, NULL, NULL, 0, KEY_SPEC_THREAD_KEYRING) = -1 EFAULT (Bad address) [pid 314] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 3 [pid 314] openat(AT_FDCWD, "/dev/ptmx", O_RDWR|O_EXCL|O_NOCTTY|O_TRUNC) = 4 [pid 314] ioctl(4, TIOCSETD, [15]) = 0 [pid 314] ioctl(4, _IOC(_IOC_WRITE, 0x55, 0xc8, 0x4), 0x1000000000) = 0 [pid 313] <... setpgid resumed>) = 0 [pid 312] setpgid(0, 0 [pid 311] add_key(NULL, NULL, NULL, 0, KEY_SPEC_THREAD_KEYRING [pid 314] ioctl(3, HCISETSCAN, 0x2000000002c0 [pid 313] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 312] <... setpgid resumed>) = 0 [pid 311] <... add_key resumed>) = -1 EFAULT (Bad address) [pid 313] <... openat resumed>) = 3 [pid 312] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 311] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI [pid 313] write(3, "1000", 4 [pid 312] <... openat resumed>) = 3 [pid 311] <... socket resumed>) = 3 [pid 313] <... write resumed>) = 4 [pid 312] write(3, "1000", 4 [pid 311] openat(AT_FDCWD, "/dev/ptmx", O_RDWR|O_EXCL|O_NOCTTY|O_TRUNC [pid 313] close(3 [pid 312] <... write resumed>) = 4 [pid 311] <... openat resumed>) = 4 [pid 313] <... close resumed>) = 0 [pid 312] close(3 [pid 311] ioctl(4, TIOCSETD, [15] executing program [pid 313] write(1, "executing program\n", 18 [pid 312] <... close resumed>) = 0 [pid 311] <... ioctl resumed>) = 0 [pid 313] <... write resumed>) = 18 executing program [pid 312] write(1, "executing program\n", 18 [pid 311] ioctl(4, _IOC(_IOC_WRITE, 0x55, 0xc8, 0x4), 0x1000000000 [pid 313] add_key(NULL, NULL, NULL, 0, KEY_SPEC_THREAD_KEYRING [pid 312] <... write resumed>) = 18 [pid 311] <... ioctl resumed>) = 0 [pid 313] <... add_key resumed>) = -1 EFAULT (Bad address) [pid 312] add_key(NULL, NULL, NULL, 0, KEY_SPEC_THREAD_KEYRING [pid 311] ioctl(3, HCISETSCAN, 0x2000000002c0 [pid 313] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI [pid 312] <... add_key resumed>) = -1 EFAULT (Bad address) [pid 313] <... socket resumed>) = 3 [pid 312] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI [pid 313] openat(AT_FDCWD, "/dev/ptmx", O_RDWR|O_EXCL|O_NOCTTY|O_TRUNC [pid 312] <... socket resumed>) = 3 [pid 313] <... openat resumed>) = 4 [pid 312] openat(AT_FDCWD, "/dev/ptmx", O_RDWR|O_EXCL|O_NOCTTY|O_TRUNC [pid 313] ioctl(4, TIOCSETD, [15] [pid 312] <... openat resumed>) = 4 [pid 313] <... ioctl resumed>) = 0 [pid 312] ioctl(4, TIOCSETD, [15] [pid 313] ioctl(4, _IOC(_IOC_WRITE, 0x55, 0xc8, 0x4), 0x1000000000 [pid 312] <... ioctl resumed>) = 0 [pid 313] <... ioctl resumed>) = 0 [pid 312] ioctl(4, _IOC(_IOC_WRITE, 0x55, 0xc8, 0x4), 0x1000000000 [pid 313] ioctl(3, HCISETSCAN, 0x2000000002c0 [pid 312] <... ioctl resumed>) = 0 [ 32.021264][ T28] audit: type=1400 audit(1787439216.168:66): avc: denied { ioctl } for pid=307 comm="syz-executor150" path="socket:[15187]" dev="sockfs" ino=15187 ioctlcmd=0x48dd scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 32.056807][ T43] Bluetooth: hci1: Frame reassembly failed (-84) [ 32.064481][ T8] Bluetooth: hci2: Frame reassembly failed (-84) [ 32.071430][ T43] Bluetooth: hci3: Frame reassembly failed (-84) [ 32.077935][ T8] Bluetooth: hci2: Frame reassembly failed (-84) [ 32.079732][ T10] Bluetooth: hci4: Frame reassembly failed (-84) [ 34.087049][ T315] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 34.087082][ T323] Bluetooth: hci4: command 0x1003 tx timeout [ 34.093347][ T315] Bluetooth: hci3: command 0x1003 tx timeout [ 34.099224][ T321] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 34.105332][ T315] Bluetooth: hci2: command 0x1003 tx timeout [ 34.111279][ T319] Bluetooth: hci3: Opcode 0x1003 failed: -110 [ 34.117349][ T317] Bluetooth: hci2: Opcode 0x1003 failed: -110 [ 34.123336][ T307] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [pid 312] ioctl(3, HCISETSCAN, 0x2000000002c0 [pid 307] <... ioctl resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 307] exit_group(0) = ? [ 34.135644][ T325] Bluetooth: hci0: Frame reassembly failed (-84) [pid 314] <... ioctl resumed>) = -1 EINVAL (Invalid argument) [pid 314] exit_group(0 [pid 311] <... ioctl resumed>) = -1 EINVAL (Invalid argument) [pid 307] +++ exited with 0 +++ [pid 314] <... exit_group resumed>) = ? [pid 313] <... ioctl resumed>) = -1 EINVAL (Invalid argument) [pid 313] exit_group(0) = ? [pid 305] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=307, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 305] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 305] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 312] <... ioctl resumed>) = -1 EINVAL (Invalid argument) [pid 311] exit_group(0) = ? [pid 312] exit_group(0) = ? [pid 305] <... clone resumed>, child_tidptr=0x555573352690) = 327 [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 327 attached [pid 327] set_robust_list(0x5555733526a0, 24) = 0 [pid 327] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 327] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 327] setpgid(0, 0) = 0 [pid 327] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 327] write(3, "1000", 4) = 4 [pid 327] close(3) = 0 [pid 327] write(1, "executing program\n", 18) = 18 executing program [pid 327] add_key(NULL, NULL, NULL, 0, KEY_SPEC_THREAD_KEYRING) = -1 EFAULT (Bad address) [pid 327] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 3 [pid 327] openat(AT_FDCWD, "/dev/ptmx", O_RDWR|O_EXCL|O_NOCTTY|O_TRUNC) = 4 [pid 327] ioctl(4, TIOCSETD, [15]) = 0 [ 36.167028][ T319] Bluetooth: hci0: command 0x0c1a tx timeout [ 36.167043][ T45] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 36.179370][ T314] Bluetooth: hci0: Opcode 0x0c1a failed: -22 [ 36.185465][ T311] Bluetooth: hci0: Opcode 0x0c1a failed: -22 [ 36.192236][ T313] Bluetooth: hci0: Opcode 0x0c1a failed: -22 [ 36.198529][ T312] Bluetooth: hci0: Opcode 0x0c1a failed: -22 [ 36.214251][ T45] ================================================================== [ 36.222334][ T45] BUG: KASAN: use-after-free in enqueue_timer+0xae/0x480 [ 36.229374][ T45] Write of size 8 at addr ffff88810e9f8a00 by task kworker/u5:0/45 [ 36.237252][ T45] [ 36.239651][ T45] CPU: 1 PID: 45 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 36.247025][ T45] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 36.257070][ T45] Workqueue: hci0 hci_power_on [ 36.261867][ T45] Call Trace: [ 36.265140][ T45] [ 36.268066][ T45] __dump_stack+0x21/0x24 [ 36.272394][ T45] dump_stack_lvl+0x110/0x170 [ 36.277066][ T45] ? __cfi_dump_stack_lvl+0x8/0x8 [ 36.282101][ T45] ? sched_clock_cpu+0x6e/0x260 [ 36.286953][ T45] ? activate_task+0x80/0xa0 [ 36.291546][ T45] ? enqueue_timer+0xae/0x480 [ 36.296221][ T45] print_address_description+0x71/0x200 [ 36.301762][ T45] print_report+0x4a/0x60 [ 36.306093][ T45] kasan_report+0x122/0x150 [ 36.310611][ T45] ? enqueue_timer+0xae/0x480 [ 36.315310][ T45] __asan_report_store8_noabort+0x17/0x20 [ 36.321027][ T45] enqueue_timer+0xae/0x480 [ 36.325526][ T45] ? detach_if_pending+0xf5/0x300 [ 36.330550][ T45] __mod_timer+0x859/0xc00 [ 36.334962][ T45] schedule_timeout+0x154/0x340 [ 36.339802][ T45] ? __cfi_schedule_timeout+0x10/0x10 [ 36.345178][ T45] ? queue_work_on+0x104/0x150 [ 36.349937][ T45] ? __cfi_process_timeout+0x10/0x10 [ 36.355218][ T45] ? prepare_to_wait_event+0x40b/0x440 [ 36.360675][ T45] __hci_cmd_sync_sk+0x3ef/0xd80 [ 36.365610][ T45] ? __cfi___hci_cmd_sync_sk+0x10/0x10 [ 36.371065][ T45] ? __cfi_autoremove_wake_function+0x10/0x10 [ 36.377133][ T45] ? __kasan_check_read+0x11/0x20 [ 36.382153][ T45] hci_dev_open_sync+0x12bf/0x30b0 [ 36.387291][ T45] ? __cfi_hci_dev_open_sync+0x10/0x10 [ 36.392742][ T45] ? __kasan_check_write+0x14/0x20 [ 36.397855][ T45] ? __switch_to+0x56f/0x1070 [ 36.402535][ T45] ? __kasan_check_write+0x14/0x20 [ 36.407644][ T45] ? mutex_lock+0x93/0x1b0 [ 36.412069][ T45] ? __cfi_mutex_lock+0x10/0x10 [ 36.416919][ T45] ? kthread_data+0x50/0xc0 [ 36.421418][ T45] hci_power_on+0x1a1/0x5f0 [ 36.425918][ T45] ? finish_task_switch+0x16b/0x7c0 [ 36.431112][ T45] ? switch_mm_irqs_off+0x32d/0x960 [ 36.436305][ T45] ? __cfi_hci_power_on+0x10/0x10 [ 36.441325][ T45] ? __schedule+0xbea/0x14b0 [ 36.445913][ T45] process_one_work+0x717/0xc30 [ 36.450759][ T45] worker_thread+0xa4d/0x11d0 [ 36.455437][ T45] kthread+0x281/0x320 [ 36.459514][ T45] ? __cfi_worker_thread+0x10/0x10 [ 36.464628][ T45] ? __cfi_kthread+0x10/0x10 [ 36.469210][ T45] ret_from_fork+0x1f/0x30 [ 36.473624][ T45] [ 36.476637][ T45] [ 36.479038][ T45] Allocated by task 307: [ 36.483287][ T45] kasan_set_track+0x4b/0x70 [ 36.487874][ T45] kasan_save_alloc_info+0x1f/0x30 [ 36.492976][ T45] __kasan_kmalloc+0x95/0xb0 [ 36.497561][ T45] __kmalloc+0xb4/0x1e0 [ 36.501717][ T45] hci_alloc_dev_priv+0x27/0x1bd0 [ 36.506779][ T45] hci_uart_tty_ioctl+0x3c4/0xa40 [ 36.511805][ T45] tty_ioctl+0x8ef/0xc60 [ 36.516045][ T45] __se_sys_ioctl+0x12f/0x1b0 [ 36.520717][ T45] __x64_sys_ioctl+0x7b/0x90 [ 36.525307][ T45] x64_sys_call+0x58b/0x9a0 [ 36.529802][ T45] do_syscall_64+0x4c/0xa0 [ 36.534217][ T45] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 36.540116][ T45] [ 36.542470][ T45] Freed by task 312: [ 36.546351][ T45] kasan_set_track+0x4b/0x70 [ 36.550935][ T45] kasan_save_free_info+0x2b/0x40 [ 36.555949][ T45] ____kasan_slab_free+0x132/0x180 [ 36.561069][ T45] __kasan_slab_free+0x11/0x20 [ 36.565838][ T45] slab_free_freelist_hook+0xc2/0x190 [ 36.571200][ T45] __kmem_cache_free+0xb7/0x1b0 [ 36.576047][ T45] kfree+0x6f/0xf0 [ 36.579765][ T45] hci_release_dev+0x12a3/0x13b0 [ 36.584712][ T45] bt_host_release+0x82/0x90 [ 36.589317][ T45] device_release+0xa4/0x1d0 [ 36.593911][ T45] kobject_put+0x19d/0x280 [ 36.598330][ T45] put_device+0x1f/0x30 [ 36.602479][ T45] hci_dev_cmd+0x279/0x740 [ 36.606892][ T45] hci_sock_ioctl+0x41e/0x7f0 [ 36.611565][ T45] sock_do_ioctl+0x114/0x330 [ 36.616159][ T45] sock_ioctl+0x475/0x700 [ 36.620489][ T45] __se_sys_ioctl+0x12f/0x1b0 [ 36.625162][ T45] __x64_sys_ioctl+0x7b/0x90 [ 36.629747][ T45] x64_sys_call+0x58b/0x9a0 [ 36.634250][ T45] do_syscall_64+0x4c/0xa0 [ 36.638734][ T45] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 36.644631][ T45] [ 36.646945][ T45] Last potentially related work creation: [ 36.652651][ T45] kasan_save_stack+0x3a/0x60 [ 36.657338][ T45] __kasan_record_aux_stack+0xb6/0xc0 [ 36.662719][ T45] kasan_record_aux_stack_noalloc+0xb/0x10 [ 36.668536][ T45] insert_work+0x51/0x300 [ 36.672859][ T45] __queue_work+0x9d0/0xd50 [ 36.677360][ T45] queue_work_on+0xde/0x150 [ 36.681858][ T45] __hci_cmd_sync_sk+0xaa8/0xd80 [ 36.686794][ T45] hci_cmd_sync_status+0x53/0x120 [ 36.691816][ T45] hci_dev_cmd+0x357/0x740 [ 36.696241][ T45] hci_sock_ioctl+0x41e/0x7f0 [ 36.700917][ T45] sock_do_ioctl+0x114/0x330 [ 36.705530][ T45] sock_ioctl+0x475/0x700 [ 36.709859][ T45] __se_sys_ioctl+0x12f/0x1b0 [ 36.714528][ T45] __x64_sys_ioctl+0x7b/0x90 [ 36.719111][ T45] x64_sys_call+0x58b/0x9a0 [ 36.723616][ T45] do_syscall_64+0x4c/0xa0 [ 36.728031][ T45] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 36.733942][ T45] [ 36.736258][ T45] Second to last potentially related work creation: [ 36.742835][ T45] kasan_save_stack+0x3a/0x60 [ 36.747515][ T45] __kasan_record_aux_stack+0xb6/0xc0 [ 36.752878][ T45] kasan_record_aux_stack_noalloc+0xb/0x10 [ 36.758681][ T45] insert_work+0x51/0x300 [ 36.763007][ T45] __queue_work+0x9d0/0xd50 [ 36.767603][ T45] queue_work_on+0xde/0x150 [ 36.772106][ T45] __hci_cmd_sync_sk+0xaa8/0xd80 [ 36.777129][ T45] hci_cmd_sync_status+0x53/0x120 [ 36.782151][ T45] hci_dev_cmd+0x357/0x740 [ 36.786557][ T45] hci_sock_ioctl+0x41e/0x7f0 [ 36.791242][ T45] sock_do_ioctl+0x114/0x330 [ 36.795834][ T45] sock_ioctl+0x475/0x700 [ 36.800184][ T45] __se_sys_ioctl+0x12f/0x1b0 [ 36.804875][ T45] __x64_sys_ioctl+0x7b/0x90 [ 36.809460][ T45] x64_sys_call+0x58b/0x9a0 [ 36.813958][ T45] do_syscall_64+0x4c/0xa0 [ 36.818388][ T45] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 36.824282][ T45] [ 36.826612][ T45] The buggy address belongs to the object at ffff88810e9f8000 [ 36.826612][ T45] which belongs to the cache kmalloc-8k of size 8192 [ 36.840651][ T45] The buggy address is located 2560 bytes inside of [ 36.840651][ T45] 8192-byte region [ffff88810e9f8000, ffff88810e9fa000) [ 36.854088][ T45] [ 36.856401][ T45] The buggy address belongs to the physical page: [ 36.862843][ T45] page:ffffea00043a7e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10e9f8 [ 36.873080][ T45] head:ffffea00043a7e00 order:3 compound_mapcount:0 compound_pincount:0 [ 36.881402][ T45] flags: 0x4000000000010200(slab|head|zone=1) [ 36.887472][ T45] raw: 4000000000010200 ffffea00043a2600 dead000000000006 ffff888100043500 [ 36.896066][ T45] raw: 0000000000000000 0000000000020002 00000001ffffffff 0000000000000000 [ 36.904627][ T45] page dumped because: kasan: bad access detected [ 36.911023][ T45] page_owner tracks the page as allocated [ 36.916750][ T45] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 3957389528, free_ts 3822905520 [ 36.937151][ T45] post_alloc_hook+0x1f5/0x210 [ 36.941911][ T45] prep_new_page+0x1c/0x110 [ 36.946411][ T45] get_page_from_freelist+0x2ca9/0x2d20 [ 36.951953][ T45] __alloc_pages+0x1fa/0x610 [ 36.956537][ T45] alloc_slab_page+0x6e/0xf0 [ 36.961130][ T45] new_slab+0x98/0x3e0 [ 36.965208][ T45] ___slab_alloc+0x70f/0xb70 [ 36.969798][ T45] __slab_alloc+0x5e/0xa0 [ 36.974207][ T45] __kmem_cache_alloc_node+0x204/0x2d0 [ 36.979665][ T45] __kmalloc+0xa4/0x1e0 [ 36.983805][ T45] ops_init+0x88/0x470 [ 36.987867][ T45] register_pernet_operations+0x2a0/0x600 [ 36.993593][ T45] register_pernet_device+0x2a/0x80 [ 36.998786][ T45] tipc_init+0x57/0x18c [ 37.002941][ T45] do_one_initcall+0x1d6/0x580 [ 37.007800][ T45] do_initcall_level+0x174/0x2df [ 37.012736][ T45] page last free stack trace: [ 37.017394][ T45] __free_pages_ok+0xb87/0xc80 [ 37.022151][ T45] __free_pages+0xec/0x100 [ 37.026564][ T45] free_large_kmalloc+0xae/0xf0 [ 37.031404][ T45] kfree+0x8b/0xf0 [ 37.035152][ T45] kvfree+0x35/0x40 [ 37.038958][ T45] btf_check_all_metas+0x5d1/0xad0 [ 37.044065][ T45] btf_parse_vmlinux+0x437/0x940 [ 37.049000][ T45] bpf_get_btf_vmlinux+0x41/0x60 [ 37.053941][ T45] btf_get_module_btf+0x85/0x200 [ 37.058873][ T45] register_btf_kfunc_id_set+0x44/0x600 [ 37.064418][ T45] register_nf_conntrack_bpf+0x1b/0xb0 [ 37.069865][ T45] nf_conntrack_init_start+0x3c3/0x460 [ 37.075315][ T45] nf_conntrack_standalone_init+0x11/0x100 [ 37.081125][ T45] do_one_initcall+0x1d6/0x580 [ 37.085880][ T45] do_initcall_level+0x174/0x2df [ 37.090806][ T45] do_initcalls+0x50/0x92 [ 37.095123][ T45] [ 37.097432][ T45] Memory state around the buggy address: [ 37.103068][ T45] ffff88810e9f8900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 37.111130][ T45] ffff88810e9f8980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [pid 327] ioctl(4, _IOC(_IOC_WRITE, 0x55, 0xc8, 0x4), 0x1000000000) = 0 [pid 327] ioctl(3, HCISETSCAN, 0x2000000002c0 [pid 310] kill(-313, SIGKILL [pid 308] kill(-314, SIGKILL [pid 310] <... kill resumed>) = 0 [pid 309] kill(-312, SIGKILL [ 37.119178][ T45] >ffff88810e9f8a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 37.127230][ T45] ^ [ 37.131305][ T45] ffff88810e9f8a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 37.139394][ T45] ffff88810e9f8b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 37.147466][ T45] ================================================================== [ 37.155513][ T45] Disabling lock debugging due to kernel taint [ 37.162367][ T325] Bluetooth: hci0: Frame reassembly failed (-84) [pid 306] kill(-311, SIGKILL [pid 308] <... kill resumed>) = 0 [pid 308] kill(314, SIGKILL) = 0 [pid 310] kill(313, SIGKILL) = 0 [pid 309] <... kill resumed>) = 0 [pid 309] kill(312, SIGKILL) = 0 [pid 306] <... kill resumed>) = 0 [pid 306] kill(311, SIGKILL) = 0 [pid 314] +++ exited with 0 +++ [pid 308] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=314, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 308] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 308] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555573352690) = 330 [pid 308] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 330 attached [pid 330] set_robust_list(0x5555733526a0, 24) = 0 [pid 330] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 330] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 330] setpgid(0, 0) = 0 [pid 330] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 330] write(3, "1000", 4) = 4 [pid 330] close(3) = 0 executing program [pid 330] write(1, "executing program\n", 18) = 18 [pid 330] add_key(NULL, NULL, NULL, 0, KEY_SPEC_THREAD_KEYRING) = -1 EFAULT (Bad address) [pid 330] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 3 [pid 330] openat(AT_FDCWD, "/dev/ptmx", O_RDWR|O_EXCL|O_NOCTTY|O_TRUNC) = 4 [ 37.175683][ T28] audit: type=1400 audit(1787439221.318:67): avc: denied { read } for pid=84 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 37.197507][ T28] audit: type=1400 audit(1787439221.318:68): avc: denied { search } for pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [pid 330] ioctl(4, TIOCSETD, [15]) = 0 [pid 330] ioctl(4, _IOC(_IOC_WRITE, 0x55, 0xc8, 0x4), 0x1000000000) = 0 [pid 313] +++ exited with 0 +++ [pid 312] +++ exited with 0 +++ [pid 311] +++ exited with 0 +++ [pid 330] ioctl(3, HCISETSCAN, 0x2000000002c0 [pid 310] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=313, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 309] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=312, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 306] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=311, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 310] rt_sigprocmask(SIG_BLOCK, ~[] [pid 309] rt_sigprocmask(SIG_BLOCK, ~[] [pid 310] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 309] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 310] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 309] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 310] <... clone resumed>, child_tidptr=0x555573352690) = 331 [pid 309] <... clone resumed>, child_tidptr=0x555573352690) = 332 [pid 306] rt_sigprocmask(SIG_BLOCK, ~[] [pid 310] rt_sigprocmask(SIG_SETMASK, [] [pid 309] rt_sigprocmask(SIG_SETMASK, [] [pid 306] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 310] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 309] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 306] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555573352690) = 333 [pid 306] rt_sigprocmask(SIG_SETMASK, []ci2-android-6-1/strace-static-x86_64: Process 331 attached , NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 333 attached ci2-android-6-1/strace-static-x86_64: Process 332 attached [pid 333] set_robust_list(0x5555733526a0, 24 [pid 332] set_robust_list(0x5555733526a0, 24 [pid 331] set_robust_list(0x5555733526a0, 24 [pid 332] <... set_robust_list resumed>) = 0 [pid 333] <... set_robust_list resumed>) = 0 [pid 331] <... set_robust_list resumed>) = 0 [pid 332] rt_sigprocmask(SIG_SETMASK, [] [pid 333] rt_sigprocmask(SIG_SETMASK, [] [pid 331] rt_sigprocmask(SIG_SETMASK, [] [pid 332] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 333] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 331] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 332] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 333] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 331] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 332] <... prctl resumed>) = 0 [pid 331] setpgid(0, 0 [pid 332] setpgid(0, 0 [pid 333] <... prctl resumed>) = 0 [pid 331] <... setpgid resumed>) = 0 [pid 332] <... setpgid resumed>) = 0 [pid 333] setpgid(0, 0 [pid 331] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 332] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 333] <... setpgid resumed>) = 0 [pid 333] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 332] <... openat resumed>) = 3 [pid 331] <... openat resumed>) = 3 [ 37.219229][ T28] audit: type=1400 audit(1787439221.318:69): avc: denied { write } for pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 37.237023][ T325] Bluetooth: hci1: Frame reassembly failed (-84) [ 37.242472][ T28] audit: type=1400 audit(1787439221.318:70): avc: denied { add_name } for pid=84 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 executing program executing program executing program [pid 333] <... openat resumed>) = 3 [pid 331] write(3, "1000", 4 [pid 333] write(3, "1000", 4 [pid 331] <... write resumed>) = 4 [pid 332] write(3, "1000", 4 [pid 333] <... write resumed>) = 4 [pid 331] close(3 [pid 332] <... write resumed>) = 4 [pid 333] close(3 [pid 331] <... close resumed>) = 0 [pid 333] <... close resumed>) = 0 [pid 332] close(3) = 0 [pid 333] write(1, "executing program\n", 18 [pid 331] write(1, "executing program\n", 18 [pid 333] <... write resumed>) = 18 [pid 332] write(1, "executing program\n", 18 [pid 331] <... write resumed>) = 18 [pid 332] <... write resumed>) = 18 [pid 333] add_key(NULL, NULL, NULL, 0, KEY_SPEC_THREAD_KEYRING [pid 331] add_key(NULL, NULL, NULL, 0, KEY_SPEC_THREAD_KEYRING [pid 332] add_key(NULL, NULL, NULL, 0, KEY_SPEC_THREAD_KEYRING [pid 333] <... add_key resumed>) = -1 EFAULT (Bad address) [pid 331] <... add_key resumed>) = -1 EFAULT (Bad address) [pid 332] <... add_key resumed>) = -1 EFAULT (Bad address) [pid 331] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI [pid 333] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 3 [pid 332] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI [pid 331] <... socket resumed>) = 3 [pid 333] openat(AT_FDCWD, "/dev/ptmx", O_RDWR|O_EXCL|O_NOCTTY|O_TRUNC [pid 332] <... socket resumed>) = 3 [pid 331] openat(AT_FDCWD, "/dev/ptmx", O_RDWR|O_EXCL|O_NOCTTY|O_TRUNC [pid 333] <... openat resumed>) = 4 [pid 332] openat(AT_FDCWD, "/dev/ptmx", O_RDWR|O_EXCL|O_NOCTTY|O_TRUNC [pid 331] <... openat resumed>) = 4 [pid 332] <... openat resumed>) = 4 [pid 332] ioctl(4, TIOCSETD, [15] [pid 331] ioctl(4, TIOCSETD, [15] [pid 333] ioctl(4, TIOCSETD, [15] [pid 332] <... ioctl resumed>) = 0 [pid 331] <... ioctl resumed>) = 0 [pid 333] <... ioctl resumed>) = 0 [pid 332] ioctl(4, _IOC(_IOC_WRITE, 0x55, 0xc8, 0x4), 0x1000000000 [pid 331] ioctl(4, _IOC(_IOC_WRITE, 0x55, 0xc8, 0x4), 0x1000000000 [pid 333] ioctl(4, _IOC(_IOC_WRITE, 0x55, 0xc8, 0x4), 0x1000000000 [pid 331] <... ioctl resumed>) = 0 [pid 333] <... ioctl resumed>) = 0 [pid 331] ioctl(3, HCISETSCAN, 0x2000000002c0 [pid 333] ioctl(3, HCISETSCAN, 0x2000000002c0 [pid 332] <... ioctl resumed>) = 0 [ 37.269427][ T28] audit: type=1400 audit(1787439221.318:71): avc: denied { create } for pid=84 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 37.290763][ T28] audit: type=1400 audit(1787439221.328:72): avc: denied { append open } for pid=84 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 37.291611][ T325] Bluetooth: hci3: Frame reassembly failed (-84) [ 37.318050][ T10] Bluetooth: hci4: Frame reassembly failed (-84) [ 37.320562][ T8] Bluetooth: hci2: Frame reassembly failed (-84) [ 37.326441][ T28] audit: type=1400 audit(1787439221.328:73): avc: denied { getattr } for pid=84 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 38.246949][ T45] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 38.246980][ C1] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN [ 38.264792][ C1] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 38.273193][ C1] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G B syzkaller #0 [ 38.281678][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 38.291736][ C1] RIP: 0010:__queue_work+0x582/0xd50 [ 38.297022][ C1] Code: b4 00 00 00 e8 7f 4d 29 00 48 bb 00 00 00 00 00 fc ff df 4c 89 ef e8 ed e5 b8 03 4c 8b 65 d0 4c 8b 6d c0 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 00 d8 6e 00 49 8b 3e e8 88 e1 b8 03 [ 38.316625][ C1] RSP: 0018:ffffc900001b0c78 EFLAGS: 00010046 [ 38.322686][ C1] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff888100331440 [ 38.330655][ C1] RDX: 0000000000000100 RSI: 000000007fffffff RDI: 000000007fffffff [ 38.338628][ C1] RBP: ffffc900001b0d08 R08: 0000000000000007 R09: 00000000fffffffb [ 38.346617][ C1] R10: dffffc0000000000 R11: ffffed1021d3f139 R12: ffff88810e9f89c8 [ 38.354578][ C1] R13: ffff88810bbc1c00 R14: 0000000000000000 R15: 000000007fffffff [ 38.362547][ C1] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 38.371473][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.378075][ C1] CR2: 00007ffeef424c38 CR3: 000000010d60c000 CR4: 00000000003506a0 [ 38.386059][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 38.394028][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 38.402009][ C1] Call Trace: [ 38.405305][ C1] [ 38.408147][ C1] delayed_work_timer_fn+0x61/0x80 [ 38.413263][ C1] ? __cfi_delayed_work_timer_fn+0x10/0x10 [ 38.419076][ C1] call_timer_fn+0x46/0x2a0 [ 38.423590][ C1] ? __cfi_delayed_work_timer_fn+0x10/0x10 [ 38.429422][ C1] __run_timers+0x672/0x9b0 [ 38.433936][ C1] ? calc_index+0x200/0x200 [ 38.438498][ C1] ? kvm_sched_clock_read+0x18/0x40 [ 38.443700][ C1] run_timer_softirq+0x6a/0xf0 [ 38.448464][ C1] handle_softirqs+0x1d7/0x600 [ 38.453227][ C1] __irq_exit_rcu+0x52/0xf0 [ 38.457725][ C1] irq_exit_rcu+0x9/0x10 [ 38.461965][ C1] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 38.467625][ C1] [ 38.470564][ C1] [ 38.473497][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 38.479481][ C1] RIP: 0010:default_idle+0xf/0x20 [ 38.484504][ C1] Code: cc 00 00 cc cc 00 00 cc cc 00 00 90 90 90 90 90 90 90 90 90 90 90 b8 0c 67 40 a5 55 48 89 e5 66 90 0f 00 2d 53 5b 65 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90 [ 38.504098][ C1] RSP: 0018:ffffc90000147dd8 EFLAGS: 00000257 [ 38.510163][ C1] RAX: ffff8881f6f00000 RBX: ffff888100331440 RCX: d942e7be0106db00 [ 38.518127][ C1] RDX: 0000000000000001 RSI: ffffffff85ca6940 RDI: ffffffff85ca6900 [ 38.526107][ C1] RBP: ffffc90000147dd8 R08: ffff8881f6f348b3 R09: 1ffff1103ede6916 [ 38.534071][ C1] R10: 0000000000000000 R11: ffffffff8500d380 R12: dffffc0000000000 [ 38.542094][ C1] R13: 0000000000000001 R14: ffff888100331440 R15: dffffc0000000000 [ 38.550070][ C1] ? __cfi_default_idle+0x10/0x10 [ 38.555103][ C1] arch_cpu_idle+0x1c/0x20 [ 38.559530][ C1] default_idle_call+0x71/0x1d0 [ 38.564413][ C1] do_idle+0x354/0x640 [ 38.568486][ C1] ? ct_irq_exit+0x9/0x10 [ 38.572814][ C1] ? irqentry_exit+0x30/0x40 [ 38.577401][ C1] ? idle_inject_timer_fn+0x60/0x60 [ 38.582615][ C1] cpu_startup_entry+0x43/0x60 [ 38.587405][ C1] start_secondary+0x119/0x120 [ 38.592173][ C1] secondary_startup_64_no_verify+0xce/0xdb [ 38.598063][ C1] [ 38.601096][ C1] Modules linked in: [ 38.604993][ C1] ---[ end trace 0000000000000000 ]--- [ 38.610439][ C1] RIP: 0010:__queue_work+0x582/0xd50 [ 38.615724][ C1] Code: b4 00 00 00 e8 7f 4d 29 00 48 bb 00 00 00 00 00 fc ff df 4c 89 ef e8 ed e5 b8 03 4c 8b 65 d0 4c 8b 6d c0 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 00 d8 6e 00 49 8b 3e e8 88 e1 b8 03 [ 38.635340][ C1] RSP: 0018:ffffc900001b0c78 EFLAGS: 00010046 [ 38.641429][ C1] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff888100331440 [ 38.649398][ C1] RDX: 0000000000000100 RSI: 000000007fffffff RDI: 000000007fffffff [ 38.657365][ C1] RBP: ffffc900001b0d08 R08: 0000000000000007 R09: 00000000fffffffb [ 38.665352][ C1] R10: dffffc0000000000 R11: ffffed1021d3f139 R12: ffff88810e9f89c8 [ 38.673320][ C1] R13: ffff88810bbc1c00 R14: 0000000000000000 R15: 000000007fffffff [ 38.681320][ C1] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 38.690246][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.696820][ C1] CR2: 00007ffeef424c38 CR3: 000000010d60c000 CR4: 00000000003506a0 [ 38.704807][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 38.712771][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 38.720739][ C1] Kernel panic - not syncing: Fatal exception in interrupt [ 38.728500][ C1] Kernel Offset: disabled [ 38.732821][ C1] Rebooting in 86400 seconds..