Warning: Permanently added '10.128.0.207' (ED25519) to the list of known hosts. 1970/01/01 00:00:30 parsed 1 programs 1970/01/01 00:00:30 serving rpc on tcp://41107 [ 31.676506][ T4722] cgroup: Unknown subsys name 'net' [ 31.797846][ T4722] cgroup: Unknown subsys name 'cpuset' [ 31.799985][ T4722] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 31.953824][ T4722] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 34.198189][ T4729] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 34.698539][ T4747] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.698800][ T4747] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.698869][ T4747] bridge_slave_0: entered allmulticast mode [ 34.699323][ T4747] bridge_slave_0: entered promiscuous mode [ 34.700571][ T4747] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.700609][ T4747] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.700654][ T4747] bridge_slave_1: entered allmulticast mode [ 34.701043][ T4747] bridge_slave_1: entered promiscuous mode [ 34.708214][ T4747] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 34.709068][ T4747] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 34.717401][ T4747] team0: Port device team_slave_0 added [ 34.718147][ T4747] team0: Port device team_slave_1 added [ 34.723562][ T4747] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 34.723586][ T4747] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 34.723599][ T4747] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 34.724538][ T4747] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 34.724546][ T4747] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 34.724561][ T4747] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 34.735595][ T4747] hsr_slave_0: entered promiscuous mode [ 34.735949][ T4747] hsr_slave_1: entered promiscuous mode [ 34.777976][ T4747] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 34.781501][ T4747] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 34.783663][ T4747] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 34.786384][ T4747] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 34.786793][ T4747] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 34.789019][ T4747] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 34.789333][ T4747] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 34.791262][ T4747] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 34.800074][ T4747] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.800129][ T4747] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.800285][ T4747] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.800314][ T4747] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.817403][ T4747] 8021q: adding VLAN 0 to HW filter on device bond0 [ 34.820959][ T1889] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.822857][ T1889] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.828369][ T4747] 8021q: adding VLAN 0 to HW filter on device team0 [ 34.837042][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.837114][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.837469][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.837488][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.928020][ T4747] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 34.939982][ T4747] veth0_vlan: entered promiscuous mode [ 34.943188][ T4747] veth1_vlan: entered promiscuous mode [ 34.950261][ T4747] veth0_macvtap: entered promiscuous mode [ 34.952148][ T4747] veth1_macvtap: entered promiscuous mode [ 34.959223][ T4747] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 34.960485][ T4747] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 34.996274][ T1889] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.996802][ T1889] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.996970][ T1889] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.996995][ T1889] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.040425][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.119878][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.132492][ T1889] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 35.132522][ T1889] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 35.142397][ T14] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 35.142422][ T14] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 35.177778][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.231702][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.650938][ T4734] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 35.651653][ T4734] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 35.651852][ T4734] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 35.652181][ T4734] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 35.652433][ T4734] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 1970/01/01 00:00:35 executed programs: 0 [ 35.875644][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 35.876003][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 35.876200][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 35.876538][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 35.876739][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 36.009804][ T4825] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.009853][ T4825] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.009924][ T4825] bridge_slave_0: entered allmulticast mode [ 36.010351][ T4825] bridge_slave_0: entered promiscuous mode [ 36.011208][ T4825] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.011229][ T4825] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.011317][ T4825] bridge_slave_1: entered allmulticast mode [ 36.011751][ T4825] bridge_slave_1: entered promiscuous mode [ 36.020275][ T4825] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 36.021283][ T4825] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 36.027882][ T4825] team0: Port device team_slave_0 added [ 36.028677][ T4825] team0: Port device team_slave_1 added [ 36.034663][ T4825] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 36.034692][ T4825] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 36.034705][ T4825] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 36.038792][ T4825] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 36.038801][ T4825] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 36.038813][ T4825] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 36.048745][ T4825] hsr_slave_0: entered promiscuous mode [ 36.049058][ T4825] hsr_slave_1: entered promiscuous mode [ 36.049250][ T4825] debugfs: 'hsr0' already exists in 'hsr' [ 36.049330][ T4825] Cannot create hsr debugfs directory [ 37.925484][ T51] Bluetooth: hci0: command tx timeout [ 38.513908][ T12] bridge_slave_1: left allmulticast mode [ 38.513947][ T12] bridge_slave_1: left promiscuous mode [ 38.514208][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.518919][ T12] bridge_slave_0: left allmulticast mode [ 38.518951][ T12] bridge_slave_0: left promiscuous mode [ 38.519025][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.582564][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 38.587004][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 38.626202][ T12] bond0 (unregistering): Released all slaves [ 38.667030][ T12] hsr_slave_0: left promiscuous mode [ 38.668370][ T12] hsr_slave_1: left promiscuous mode [ 38.668701][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 38.668714][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 38.670046][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 38.670060][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 38.676282][ T12] veth1_macvtap: left promiscuous mode [ 38.676330][ T12] veth0_macvtap: left promiscuous mode [ 38.676400][ T12] veth1_vlan: left promiscuous mode [ 38.676442][ T12] veth0_vlan: left promiscuous mode [ 38.779930][ T12] team0 (unregistering): Port device team_slave_1 removed [ 38.783739][ T12] team0 (unregistering): Port device team_slave_0 removed [ 38.838276][ T4400] 8021q: adding VLAN 0 to HW filter on device eth0 [ 39.090541][ T4825] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 39.093672][ T4825] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 39.096739][ T4825] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 39.100287][ T4825] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 39.102108][ T4825] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 39.104452][ T4825] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 39.106907][ T4825] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 39.110915][ T4825] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 39.142599][ T4825] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.148604][ T4825] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.159035][ T1744] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.159084][ T1744] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.159642][ T1744] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.159661][ T1744] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.440677][ T4825] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.454089][ T4825] veth0_vlan: entered promiscuous mode [ 39.475963][ T4825] veth1_vlan: entered promiscuous mode [ 39.483462][ T4825] veth0_macvtap: entered promiscuous mode [ 39.485128][ T4825] veth1_macvtap: entered promiscuous mode [ 39.488785][ T4825] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.489922][ T4825] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.493028][ T1744] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.495547][ T1744] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.543116][ T1744] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.544629][ T1744] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.552143][ T1889] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.553739][ T1889] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.555163][ T1889] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.566059][ T1889] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ ** replaying previous printk message ** [ 39.621640][ T4922] ================================================================== [ 39.621655][ T4922] BUG: KASAN: slab-use-after-free in dvb_device_open+0xd0/0x254 [ 39.621678][ T4922] Read of size 8 at addr ffff0000cb785a18 by task syz.0.19/4922 [ 39.621686][ T4922] [ 39.621691][ T4922] CPU: 0 UID: 0 PID: 4922 Comm: syz.0.19 Not tainted syzkaller #0 PREEMPT [ 39.621700][ T4922] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 39.621705][ T4922] Call trace: [ 39.621707][ T4922] show_stack+0x2c/0x3c (C) [ 39.621722][ T4922] __dump_stack+0x30/0x40 [ 39.621732][ T4922] dump_stack_lvl+0xd8/0x12c [ 39.621742][ T4922] print_address_description+0xb0/0x238 [ 39.621751][ T4922] print_report+0x68/0x84 [ 39.621757][ T4922] kasan_report+0x8c/0xc4 [ 39.621767][ T4922] __asan_report_load8_noabort+0x20/0x2c [ 39.621776][ T4922] dvb_device_open+0xd0/0x254 [ 39.621784][ T4922] chrdev_open+0x398/0x3e8 [ 39.621794][ T4922] do_dentry_open+0x5c4/0xfc0 [ 39.621803][ T4922] vfs_open+0x44/0x2dc [ 39.621812][ T4922] path_openat+0x1084/0x18f4 [ 39.621821][ T4922] do_file_open+0x1c8/0x2e8 [ 39.621829][ T4922] do_sys_openat2+0x114/0x1e8 [ 39.621838][ T4922] do_sys_open+0xb0/0xe0 [ 39.621847][ T4922] __arm64_sys_openat+0xa8/0xc4 [ 39.621856][ T4922] invoke_syscall+0x98/0x244 [ 39.621866][ T4922] el0_svc_common+0xec/0x23c [ 39.621875][ T4922] do_el0_svc+0x4c/0x5c [ 39.621885][ T4922] el0_svc+0x64/0x260 [ 39.621894][ T4922] el0t_64_sync_handler+0x44/0x104 [ 39.621903][ T4922] el0t_64_sync+0x198/0x19c [ 39.621911][ T4922] [ 39.621913][ T4922] Allocated by task 1: [ 39.621917][ T4922] kasan_save_track+0x40/0x78 [ 39.621924][ T4922] kasan_save_alloc_info+0x40/0x50 [ 39.621931][ T4922] __kasan_kmalloc+0x9c/0xb4 [ 39.621937][ T4922] __kmalloc_cache_noprof+0x2f4/0x5fc [ 39.621943][ T4922] dvb_register_device+0x1a4/0x16e0 [ 39.621950][ T4922] dvb_register_frontend+0x474/0x6d0 [ 39.621959][ T4922] vidtv_bridge_probe+0x5a4/0xa58 [ 39.621966][ T4922] platform_probe+0x100/0x1a4 [ 39.621974][ T4922] really_probe+0x29c/0x800 [ 39.621983][ T4922] __driver_probe_device+0x1e0/0x350 [ 39.621991][ T4922] driver_probe_device+0x6c/0x19c [ 39.622000][ T4922] __driver_attach+0x168/0x384 [ 39.622008][ T4922] bus_for_each_dev+0x128/0x1b4 [ 39.622015][ T4922] driver_attach+0x50/0x60 [ 39.622023][ T4922] bus_add_driver+0x208/0x500 [ 39.622031][ T4922] driver_register+0x220/0x310 [ 39.622036][ T4922] __platform_driver_register+0x90/0xa4 [ 39.622042][ T4922] vidtv_bridge_init+0x4c/0x74 [ 39.622053][ T4922] do_one_initcall+0x274/0xc38 [ 39.622061][ T4922] do_initcall_level+0x12c/0x1c4 [ 39.622068][ T4922] do_initcalls+0x70/0xd0 [ 39.622074][ T4922] do_basic_setup+0x7c/0x90 [ 39.622080][ T4922] kernel_init_freeable+0x268/0x3a8 [ 39.622086][ T4922] kernel_init+0x28/0x1e0 [ 39.622094][ T4922] ret_from_fork+0x10/0x20 [ 39.622099][ T4922] [ 39.622101][ T4922] Freed by task 4920: [ 39.622104][ T4922] kasan_save_track+0x40/0x78 [ 39.622110][ T4922] kasan_save_free_info+0x54/0x6c [ 39.622117][ T4922] __kasan_slab_free+0x74/0xa4 [ 39.622123][ T4922] kfree+0x188/0x698 [ 39.622131][ T4922] dvb_device_put+0x64/0xd0 [ 39.622138][ T4922] dvb_device_open+0x23c/0x254 [ 39.622145][ T4922] chrdev_open+0x398/0x3e8 [ 39.622152][ T4922] do_dentry_open+0x5c4/0xfc0 [ 39.622159][ T4922] vfs_open+0x44/0x2dc [ 39.622166][ T4922] path_openat+0x1084/0x18f4 [ 39.622173][ T4922] do_file_open+0x1c8/0x2e8 [ 39.622179][ T4922] do_sys_openat2+0x114/0x1e8 [ 39.622187][ T4922] do_sys_open+0xb0/0xe0 [ 39.622194][ T4922] __arm64_sys_openat+0xa8/0xc4 [ 39.622202][ T4922] invoke_syscall+0x98/0x244 [ 39.622210][ T4922] el0_svc_common+0xec/0x23c [ 39.622218][ T4922] do_el0_svc+0x4c/0x5c [ 39.622226][ T4922] el0_svc+0x64/0x260 [ 39.622232][ T4922] el0t_64_sync_handler+0x44/0x104 [ 39.622239][ T4922] el0t_64_sync+0x198/0x19c [ 39.622244][ T4922] [ 39.622246][ T4922] The buggy address belongs to the object at ffff0000cb785a00 [ 39.622246][ T4922] which belongs to the cache kmalloc-256 of size 256 [ 39.622252][ T4922] The buggy address is located 24 bytes inside of [ 39.622252][ T4922] freed 256-byte region [ffff0000cb785a00, ffff0000cb785b00) [ 39.622259][ T4922] [ 39.622261][ T4922] The buggy address belongs to the physical page: [ 39.622265][ T4922] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10b784 [ 39.622272][ T4922] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 39.622277][ T4922] flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 39.622286][ T4922] page_type: f5(slab) [ 39.622293][ T4922] raw: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122 [ 39.622299][ T4922] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 39.622305][ T4922] head: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122 [ 39.622310][ T4922] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 39.622316][ T4922] head: 05ffc00000000001 fffffdffc32de101 00000000ffffffff 00000000ffffffff [ 39.622321][ T4922] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 39.622325][ T4922] page dumped because: kasan: bad access detected [ 39.622328][ T4922] [ 39.622329][ T4922] Memory state around the buggy address: [ 39.622334][ T4922] ffff0000cb785900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.622338][ T4922] ffff0000cb785980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.622342][ T4922] >ffff0000cb785a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 39.622346][ T4922] ^ [ 39.622349][ T4922] ffff0000cb785a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 39.622353][ T4922] ffff0000cb785b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.622360][ T4922] ================================================================== [ 39.622381][ T4922] Disabling lock debugging due to kernel taint [ 39.622390][ T4922] ------------[ cut here ]------------ [ 39.622393][ T4922] refcount_t: addition on 0; use-after-free. [ 39.622502][ T4922] WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x134/0x1f8, CPU#0: syz.0.19/4922 [ 39.721613][ T4922] Modules linked in: [ 39.722287][ T4922] CPU: 0 UID: 0 PID: 4922 Comm: syz.0.19 Tainted: G B syzkaller #0 PREEMPT [ 39.724015][ T4922] Tainted: [B]=BAD_PAGE [ 39.724712][ T4922] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 39.726424][ T4922] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 39.727748][ T4922] pc : refcount_warn_saturate+0x134/0x1f8 [ 39.728732][ T4922] lr : refcount_warn_saturate+0x134/0x1f8 [ 39.729727][ T4922] sp : ffff800099c07700 [ 39.730440][ T4922] x29: ffff800099c07700 x28: dfff800000000000 x27: 1fffe0001a00ce39 [ 39.731858][ T4922] x26: dfff800000000000 x25: ffff700013380ef4 x24: dfff800000000000 [ 39.733266][ T4922] x23: ffff800087501208 x22: ffff0000cbac8800 x21: ffff0000cb785a00 [ 39.734632][ T4922] x20: ffff0000cb785a10 x19: ffff80008a26d000 x18: 0000000000000000 [ 39.736079][ T4922] x17: 3d3d3d3d3d3d3d3d x16: 3d3d3d3d3d3d3d3d x15: 3d3d3d3d3d3d3d3d [ 39.737562][ T4922] x14: 3d3d3d3d3d3d3d3d x13: 0000000000000001 x12: 0000000000000003 [ 39.738956][ T4922] x11: 0000000000000000 x10: 0000000000000002 x9 : f10e2209635ac500 [ 39.740625][ T4922] x8 : f10e2209635ac500 x7 : 0000000000000000 x6 : ffff80008048e314 [ 39.742247][ T4922] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f9194 [ 39.743800][ T4922] x2 : 0000000100000000 x1 : ffff0000cc3e9d80 x0 : 0000000000000000 [ 39.745322][ T4922] Call trace: [ 39.745919][ T4922] refcount_warn_saturate+0x134/0x1f8 (P) [ 39.746970][ T4922] dvb_device_get+0x9c/0xc0 [ 39.747811][ T4922] dvb_device_open+0x100/0x254 [ 39.748676][ T4922] chrdev_open+0x398/0x3e8 [ 39.749456][ T4922] do_dentry_open+0x5c4/0xfc0 [ 39.750321][ T4922] vfs_open+0x44/0x2dc [ 39.751054][ T4922] path_openat+0x1084/0x18f4 [ 39.751833][ T4922] do_file_open+0x1c8/0x2e8 [ 39.752642][ T4922] do_sys_openat2+0x114/0x1e8 [ 39.753489][ T4922] do_sys_open+0xb0/0xe0 [ 39.754268][ T4922] __arm64_sys_openat+0xa8/0xc4 [ 39.755309][ T4922] invoke_syscall+0x98/0x244 [ 39.756164][ T4922] el0_svc_common+0xec/0x23c [ 39.756995][ T4922] do_el0_svc+0x4c/0x5c [ 39.757794][ T4922] el0_svc+0x64/0x260 [ 39.758534][ T4922] el0t_64_sync_handler+0x44/0x104 [ 39.759494][ T4922] el0t_64_sync+0x198/0x19c [ 39.760332][ T4922] irq event stamp: 1441 [ 39.761099][ T4922] hardirqs last enabled at (1441): [] __arm64_exit_to_kernel_mode+0x64/0x78 [ 39.763002][ T4922] hardirqs last disabled at (1440): [] el1_interrupt+0x28/0x60 [ 39.764611][ T4922] softirqs last enabled at (1414): [] fpsimd_restore_current_state+0x39c/0x9c8 [ 39.766455][ T4922] softirqs last disabled at (1412): [] fpsimd_restore_current_state+0x44/0x9c8 [ 39.768319][ T4922] ---[ end trace 0000000000000000 ]--- [ 39.773571][ T4922] ------------[ cut here ]------------ [ 39.773596][ T4922] refcount_t: underflow; use-after-free. [ 39.773711][ T4922] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x154/0x1f8, CPU#0: syz.0.19/4922 [ 39.777190][ T4922] Modules linked in: [ 39.777920][ T4922] CPU: 0 UID: 0 PID: 4922 Comm: syz.0.19 Tainted: G B W syzkaller #0 PREEMPT [ 39.779739][ T4922] Tainted: [B]=BAD_PAGE, [W]=WARN [ 39.780639][ T4922] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 39.782372][ T4922] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 39.783747][ T4922] pc : refcount_warn_saturate+0x154/0x1f8 [ 39.784762][ T4922] lr : refcount_warn_saturate+0x154/0x1f8 [ 39.785749][ T4922] sp : ffff800099c075b0 [ 39.786446][ T4922] x29: ffff800099c075b0 x28: ffff0000ca4a1000 x27: ffff0000cb785a00 [ 39.787883][ T4922] x26: ffff0000cb852308 x25: dfff800000000000 x24: ffff0000cb2a4180 [ 39.789544][ T4922] x23: 00000000fffffffc x22: 1fffe000196f0b47 x21: 00000000c0000000 [ 39.791172][ T4922] x20: ffff0000cb785a10 x19: ffff80008a26d000 x18: 0000000000000000 [ 39.792640][ T4922] x17: 3d3d3d3d3d3d3d3d x16: 3d3d3d3d3d3d3d3d x15: 3d3d3d3d3d3d3d3d [ 39.794088][ T4922] x14: 3d3d3d3d3d3d3d3d x13: 0000000000000001 x12: 0000000000000003 [ 39.795527][ T4922] x11: 0000000000000000 x10: 0000000000000002 x9 : f10e2209635ac500 [ 39.797033][ T4922] x8 : f10e2209635ac500 x7 : 0000000000000000 x6 : ffff80008048e314 [ 39.798491][ T4922] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f9194 [ 39.799889][ T4922] x2 : 0000000100000000 x1 : ffff0000cc3e9d80 x0 : 0000000000000000 [ 39.801239][ T4922] Call trace: [ 39.801794][ T4922] refcount_warn_saturate+0x154/0x1f8 (P) [ 39.802786][ T4922] dvb_device_put+0xac/0xd0 [ 39.803560][ T4922] dvb_generic_release+0xec/0x158 [ 39.804428][ T4922] __dvb_frontend_open+0x5c4/0xa34 [ 39.805296][ T4922] dvb_frontend_open+0x19c/0x70c [ 39.806119][ T4922] dvb_device_open+0x1f8/0x254 [ 39.806914][ T4922] chrdev_open+0x398/0x3e8 [ 39.807667][ T4922] do_dentry_open+0x5c4/0xfc0 [ 39.808442][ T4922] vfs_open+0x44/0x2dc [ 39.809153][ T4922] path_openat+0x1084/0x18f4 [ 39.809949][ T4922] do_file_open+0x1c8/0x2e8 [ 39.810742][ T4922] do_sys_openat2+0x114/0x1e8 [ 39.811574][ T4922] do_sys_open+0xb0/0xe0 [ 39.812322][ T4922] __arm64_sys_openat+0xa8/0xc4 [ 39.813182][ T4922] invoke_syscall+0x98/0x244 [ 39.814012][ T4922] el0_svc_common+0xec/0x23c [ 39.814836][ T4922] do_el0_svc+0x4c/0x5c [ 39.815601][ T4922] el0_svc+0x64/0x260 [ 39.816329][ T4922] el0t_64_sync_handler+0x44/0x104 [ 39.817280][ T4922] el0t_64_sync+0x198/0x19c [ 39.818113][ T4922] irq event stamp: 1441 [ 39.818874][ T4922] hardirqs last enabled at (1441): [] __arm64_exit_to_kernel_mode+0x64/0x78 [ 39.820644][ T4922] hardirqs last disabled at (1440): [] el1_interrupt+0x28/0x60 [ 39.822267][ T4922] softirqs last enabled at (1414): [] fpsimd_restore_current_state+0x39c/0x9c8 [ 39.824209][ T4922] softirqs last disabled at (1412): [] fpsimd_restore_current_state+0x44/0x9c8 [ 39.826116][ T4922] ---[ end trace 0000000000000000 ]--- [ 39.844329][ T4924] ------------[ cut here ]------------ [ 39.844346][ T4924] refcount_t: saturated; leaking memory. [ 39.847108][ T4924] WARNING: lib/refcount.c:22 at refcount_warn_saturate+0x1b4/0x1f8, CPU#1: syz.0.20/4924 [ 39.848771][ T4924] Modules linked in: [ 39.849483][ T4924] CPU: 1 UID: 0 PID: 4924 Comm: syz.0.20 Tainted: G B W syzkaller #0 PREEMPT [ 39.851304][ T4924] Tainted: [B]=BAD_PAGE, [W]=WARN [ 39.852190][ T4924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 39.854012][ T4924] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 39.855452][ T4924] pc : refcount_warn_saturate+0x1b4/0x1f8 [ 39.856493][ T4924] lr : refcount_warn_saturate+0x1b4/0x1f8 [ 39.857540][ T4924] sp : ffff800099be7700 [ 39.858295][ T4924] x29: ffff800099be7700 x28: dfff800000000000 x27: 1fffe0001b337a01 [ 39.859746][ T4924] x26: dfff800000000000 x25: ffff70001337cef4 x24: dfff800000000000 [ 39.861166][ T4924] x23: ffff800087501208 x22: ffff0000cbac8800 x21: 000000007ffffffe [ 39.862601][ T4924] x20: ffff0000cb785a10 x19: ffff80008a26d000 x18: 1fffe00035ba3828 [ 39.864050][ T4924] x17: 0000000000000003 x16: ffff800088bf7000 x15: ffff800088ca7ee0 [ 39.865413][ T4924] x14: ffff0001add1c14c x13: 0000000000000001 x12: 0000000000000000 [ 39.866791][ T4924] x11: 0000000000000000 x10: 0000000000000003 x9 : 1929847dd60c7b00 [ 39.868237][ T4924] x8 : 1929847dd60c7b00 x7 : 0000000000000000 x6 : ffff8000803b9710 [ 39.869643][ T4924] x5 : 0000000000000000 x4 : 0000000000000008 x3 : ffff8000803b9884 [ 39.871044][ T4924] x2 : 0000000000000001 x1 : ffff0000c47c0000 x0 : 0000000000000001 [ 39.872457][ T4924] Call trace: [ 39.873041][ T4924] refcount_warn_saturate+0x1b4/0x1f8 (P) [ 39.874068][ T4924] dvb_device_get+0x9c/0xc0 [ 39.874905][ T4924] dvb_device_open+0x100/0x254 [ 39.875812][ T4924] chrdev_open+0x398/0x3e8 [ 39.876650][ T4924] do_dentry_open+0x5c4/0xfc0 [ 39.877477][ T4924] vfs_open+0x44/0x2dc [ 39.878188][ T4924] path_openat+0x1084/0x18f4 [ 39.879027][ T4924] do_file_open+0x1c8/0x2e8 [ 39.879896][ T4924] do_sys_openat2+0x114/0x1e8 [ 39.880787][ T4924] do_sys_open+0xb0/0xe0 [ 39.881586][ T4924] __arm64_sys_openat+0xa8/0xc4 [ 39.882422][ T4924] invoke_syscall+0x98/0x244 [ 39.883251][ T4924] el0_svc_common+0xec/0x23c [ 39.884090][ T4924] do_el0_svc+0x4c/0x5c [ 39.884820][ T4924] el0_svc+0x64/0x260 [ 39.885567][ T4924] el0t_64_sync_handler+0x44/0x104 [ 39.886512][ T4924] el0t_64_sync+0x198/0x19c [ 39.887341][ T4924] irq event stamp: 0 [ 39.888047][ T4924] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 39.889362][ T4924] hardirqs last disabled at (0): [] copy_process+0x1384/0x332c [ 39.890980][ T4924] softirqs last enabled at (0): [] copy_process+0x13a4/0x332c [ 39.892541][ T4924] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 39.893762][ T4924] ---[ end trace 0000000000000000 ]--- [ 40.007715][ T51] Bluetooth: hci0: command tx timeout 1970/01/01 00:00:40 executed programs: 56 [ 42.085236][ T51] Bluetooth: hci0: command tx timeout [ 44.165052][ T51] Bluetooth: hci0: command tx timeout 1970/01/01 00:00:45 executed programs: 349