Warning: Permanently added '10.128.1.107' (ED25519) to the list of known hosts. 2026/04/09 20:58:53 parsed 1 programs [ 84.119741][ T5771] cgroup: Unknown subsys name 'net' [ 84.318432][ T5771] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 86.135723][ T5771] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 89.031689][ T5804] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 89.045990][ T5806] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 89.054228][ T5806] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 89.067435][ T5806] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 89.075535][ T5806] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 89.083108][ T5806] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 90.677174][ T5821] chnl_net:caif_netlink_parms(): no params data found [ 91.049582][ T3431] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.074127][ T3431] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.174196][ T3431] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.194961][ T3431] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.207166][ T5821] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.216786][ T5821] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.225823][ T5821] bridge_slave_0: entered allmulticast mode [ 91.234145][ T5821] bridge_slave_0: entered promiscuous mode [ 91.293763][ T5821] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.302104][ T5821] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.309841][ T5821] bridge_slave_1: entered allmulticast mode [ 91.321892][ T5821] bridge_slave_1: entered promiscuous mode [ 91.474606][ T5821] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.488245][ T5821] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.605818][ T5821] team0: Port device team_slave_0 added [ 91.734504][ T5821] team0: Port device team_slave_1 added [ 91.971928][ T5821] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.979179][ T5821] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 92.008128][ T5821] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 92.023591][ T5821] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.034520][ T5821] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 92.061805][ T5821] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.198655][ T5821] hsr_slave_0: entered promiscuous mode [ 92.208006][ T5821] hsr_slave_1: entered promiscuous mode [ 92.426170][ T967] cfg80211: failed to load regulatory.db [ 92.572914][ T5821] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 92.613301][ T5821] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 92.640832][ T5821] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 92.669055][ T5821] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 92.908730][ T5821] 8021q: adding VLAN 0 to HW filter on device bond0 [ 92.954728][ T5821] 8021q: adding VLAN 0 to HW filter on device team0 [ 92.989726][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.997318][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.025482][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.033103][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.279414][ T5821] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 93.341263][ T5821] veth0_vlan: entered promiscuous mode [ 93.371394][ T5821] veth1_vlan: entered promiscuous mode [ 93.399138][ T5821] veth0_macvtap: entered promiscuous mode [ 93.411304][ T5821] veth1_macvtap: entered promiscuous mode [ 93.444116][ T5821] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.458341][ T5821] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.474536][ T5821] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.485411][ T5821] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.494859][ T5821] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.504133][ T5821] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 2026/04/09 20:59:05 executed programs: 0 [ 93.779938][ T5806] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 93.811842][ T5804] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 93.820095][ T5804] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 93.830292][ T5889] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 93.838546][ T5804] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 93.848024][ T5889] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 93.857918][ T5892] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 93.860115][ T5889] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 93.873610][ T5891] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 93.874360][ T5889] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 93.881952][ T5893] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 93.889550][ T5889] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 93.903479][ T5889] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 93.904287][ T5893] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 93.923897][ T5083] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 93.933543][ T5889] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 93.941986][ T5889] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 93.949451][ T5083] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 93.952528][ T5889] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 93.970779][ T5806] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 93.994665][ T5889] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 94.013401][ T5889] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 94.022590][ T5889] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 94.030715][ T5889] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 94.660785][ T5885] chnl_net:caif_netlink_parms(): no params data found [ 94.784967][ T5886] chnl_net:caif_netlink_parms(): no params data found [ 94.826114][ T5885] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.833703][ T5885] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.842369][ T5885] bridge_slave_0: entered allmulticast mode [ 94.850133][ T5885] bridge_slave_0: entered promiscuous mode [ 94.865117][ T5883] chnl_net:caif_netlink_parms(): no params data found [ 94.926517][ T5885] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.933891][ T5885] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.942381][ T5885] bridge_slave_1: entered allmulticast mode [ 94.949945][ T5885] bridge_slave_1: entered promiscuous mode [ 95.020867][ T5885] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 95.046700][ T5882] chnl_net:caif_netlink_parms(): no params data found [ 95.061660][ T5885] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 95.167307][ T5886] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.174733][ T5886] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.182451][ T5886] bridge_slave_0: entered allmulticast mode [ 95.189387][ T5886] bridge_slave_0: entered promiscuous mode [ 95.199816][ T5886] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.207150][ T5886] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.214810][ T5886] bridge_slave_1: entered allmulticast mode [ 95.223399][ T5886] bridge_slave_1: entered promiscuous mode [ 95.234145][ T5885] team0: Port device team_slave_0 added [ 95.245257][ T5885] team0: Port device team_slave_1 added [ 95.251637][ T5883] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.258903][ T5883] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.266766][ T5883] bridge_slave_0: entered allmulticast mode [ 95.273888][ T5883] bridge_slave_0: entered promiscuous mode [ 95.339427][ T5883] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.346804][ T5883] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.354591][ T5883] bridge_slave_1: entered allmulticast mode [ 95.364120][ T5883] bridge_slave_1: entered promiscuous mode [ 95.392524][ T5883] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 95.419579][ T5886] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 95.442245][ T5885] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 95.449268][ T5885] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 95.476462][ T5885] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 95.490261][ T5883] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 95.529149][ T5886] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 95.550673][ T5885] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 95.557676][ T5885] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 95.586126][ T5885] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 95.615139][ T5882] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.623589][ T5882] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.631287][ T5882] bridge_slave_0: entered allmulticast mode [ 95.638277][ T5882] bridge_slave_0: entered promiscuous mode [ 95.647894][ T5882] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.655883][ T5882] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.663415][ T5882] bridge_slave_1: entered allmulticast mode [ 95.673045][ T5882] bridge_slave_1: entered promiscuous mode [ 95.698305][ T5886] team0: Port device team_slave_0 added [ 95.719005][ T5883] team0: Port device team_slave_0 added [ 95.728853][ T5883] team0: Port device team_slave_1 added [ 95.764444][ T5886] team0: Port device team_slave_1 added [ 95.807384][ T5882] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 95.830206][ T5882] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 95.868482][ T5883] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 95.875744][ T5883] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 95.902894][ T5883] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 95.938617][ T5886] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 95.951561][ T5889] Bluetooth: hci0: command tx timeout [ 95.952112][ T5886] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 95.984296][ T5886] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 95.997492][ T5886] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 96.004900][ T5886] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 96.032616][ T5889] Bluetooth: hci1: command tx timeout [ 96.032782][ T5886] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 96.046024][ T5889] Bluetooth: hci2: command tx timeout [ 96.050934][ T5883] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 96.062634][ T5883] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 96.089438][ T5883] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 96.100882][ T5889] Bluetooth: hci3: command tx timeout [ 96.111167][ T5885] hsr_slave_0: entered promiscuous mode [ 96.117794][ T5885] hsr_slave_1: entered promiscuous mode [ 96.125238][ T5885] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 96.134046][ T5885] Cannot create hsr debugfs directory [ 96.167771][ T1081] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 96.224428][ T5882] team0: Port device team_slave_0 added [ 96.234124][ T5882] team0: Port device team_slave_1 added [ 96.271526][ T5886] hsr_slave_0: entered promiscuous mode [ 96.277975][ T5886] hsr_slave_1: entered promiscuous mode [ 96.285012][ T5886] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 96.293191][ T5886] Cannot create hsr debugfs directory [ 96.341731][ T5882] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 96.349077][ T5882] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 96.375466][ T5882] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 96.426621][ T5882] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 96.434208][ T5882] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 96.460708][ T5882] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 96.485798][ T5883] hsr_slave_0: entered promiscuous mode [ 96.493206][ T5883] hsr_slave_1: entered promiscuous mode [ 96.499525][ T5883] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 96.507704][ T5883] Cannot create hsr debugfs directory [ 96.643840][ T5882] hsr_slave_0: entered promiscuous mode [ 96.651053][ T5882] hsr_slave_1: entered promiscuous mode [ 96.657469][ T5882] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 96.665373][ T5882] Cannot create hsr debugfs directory [ 96.974713][ T5885] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 96.999774][ T5885] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 97.016356][ T5885] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 97.026283][ T5885] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 97.105379][ T5885] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.125653][ T5885] 8021q: adding VLAN 0 to HW filter on device team0 [ 97.137664][ T65] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.145028][ T65] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.162398][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.169607][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.376111][ T5885] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 97.421056][ T5885] veth0_vlan: entered promiscuous mode [ 97.437322][ T5885] veth1_vlan: entered promiscuous mode [ 97.468389][ T5885] veth0_macvtap: entered promiscuous mode [ 97.480099][ T5885] veth1_macvtap: entered promiscuous mode [ 97.499470][ T5885] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 97.510781][ T5885] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 97.523381][ T5885] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 97.535968][ T5885] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 97.549645][ T5885] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 97.561963][ T5885] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 97.576008][ T5885] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.585150][ T5885] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.594468][ T5885] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.605328][ T5885] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.697598][ T1081] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 97.715368][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.727131][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.758058][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.767135][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.822790][ T5925] syz.1.18[5925]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 98.031492][ T5889] Bluetooth: hci0: command tx timeout [ 98.095583][ T5925] loop1: detected capacity change from 0 to 40427 [ 98.104177][ T5889] Bluetooth: hci2: command tx timeout [ 98.110700][ T5804] Bluetooth: hci1: command tx timeout [ 98.123623][ T5925] F2FS-fs (loop1): Invalid SB checksum offset: 0 [ 98.131823][ T5925] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock [ 98.148569][ T5925] F2FS-fs (loop1): invalid crc value [ 98.181569][ T5889] Bluetooth: hci3: command tx timeout [ 98.239675][ T1081] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 98.280492][ T5925] F2FS-fs (loop1): Try to recover 2th superblock, ret: 0 [ 98.287987][ T5925] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 98.324972][ T1081] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 98.355840][ T5925] netlink: 4 bytes leftover after parsing attributes in process `syz.1.18'. [ 99.568060][ T5883] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 99.598219][ T5883] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 99.609368][ T5883] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 99.670482][ T5883] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 99.749170][ T1081] hsr_slave_0: left promiscuous mode [ 99.756154][ T1081] hsr_slave_1: left promiscuous mode [ 99.762817][ T1081] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 99.770993][ T1081] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 99.782400][ T1081] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 99.790044][ T1081] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 99.799675][ T1081] bridge_slave_1: left allmulticast mode [ 99.805768][ T1081] bridge_slave_1: left promiscuous mode [ 99.812766][ T1081] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.824202][ T1081] bridge_slave_0: left allmulticast mode [ 99.829902][ T1081] bridge_slave_0: left promiscuous mode [ 99.836744][ T1081] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.859773][ T1081] veth1_macvtap: left promiscuous mode [ 99.866568][ T1081] veth0_macvtap: left promiscuous mode [ 99.872763][ T1081] veth1_vlan: left promiscuous mode [ 99.878967][ T1081] veth0_vlan: left promiscuous mode [ 100.111213][ T5889] Bluetooth: hci0: command tx timeout [ 100.196864][ T5889] Bluetooth: hci2: command tx timeout [ 100.200758][ T5804] Bluetooth: hci1: command tx timeout [ 100.270769][ T5804] Bluetooth: hci3: command tx timeout [ 100.437756][ T1081] team0 (unregistering): Port device team_slave_1 removed [ 100.478784][ T1081] team0 (unregistering): Port device team_slave_0 removed [ 100.518310][ T1081] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 100.557760][ T1081] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 100.861589][ T1081] bond0 (unregistering): Released all slaves [ 101.015323][ T5886] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 101.051039][ T5886] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 101.074669][ T5886] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 101.095574][ T5886] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 101.236692][ T5882] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 101.246505][ T5882] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 101.259863][ T5883] 8021q: adding VLAN 0 to HW filter on device bond0 [ 101.283640][ T5882] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 101.306575][ T5882] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 101.319165][ T5883] 8021q: adding VLAN 0 to HW filter on device team0 2026/04/09 20:59:12 executed programs: 9 [ 101.348578][ T5885] syz-executor: attempt to access beyond end of device [ 101.348578][ T5885] loop1: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 101.375561][ T34] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.383193][ T34] bridge0: port 1(bridge_slave_0) entered forwarding state [ 101.399973][ T5885] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 101.414082][ T5885] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 101.442604][ T34] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.450170][ T34] bridge0: port 2(bridge_slave_1) entered forwarding state [ 101.610140][ T5886] 8021q: adding VLAN 0 to HW filter on device bond0 [ 101.665847][ T5883] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 101.734012][ T5886] 8021q: adding VLAN 0 to HW filter on device team0 [ 101.791777][ T1081] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.799798][ T1081] bridge0: port 1(bridge_slave_0) entered forwarding state [ 101.833392][ T1081] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.840840][ T1081] bridge0: port 2(bridge_slave_1) entered forwarding state [ 101.866793][ T5882] 8021q: adding VLAN 0 to HW filter on device bond0 [ 101.957176][ T5882] 8021q: adding VLAN 0 to HW filter on device team0 [ 102.027314][ T3463] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.034716][ T3463] bridge0: port 1(bridge_slave_0) entered forwarding state [ 102.065913][ T3463] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.073331][ T3463] bridge0: port 2(bridge_slave_1) entered forwarding state [ 102.180882][ T5804] Bluetooth: hci0: command tx timeout [ 102.242676][ T5883] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 102.260729][ T5804] Bluetooth: hci1: command tx timeout [ 102.266262][ T5804] Bluetooth: hci2: command tx timeout [ 102.340781][ T5804] Bluetooth: hci3: command tx timeout [ 102.393942][ T5883] veth0_vlan: entered promiscuous mode [ 102.439289][ T5883] veth1_vlan: entered promiscuous mode [ 102.482726][ T5883] veth0_macvtap: entered promiscuous mode [ 102.500297][ T5883] veth1_macvtap: entered promiscuous mode [ 102.554098][ T5883] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 102.596256][ T5883] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 102.620046][ T5883] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 102.640160][ T5883] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 102.655620][ T5883] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 102.669322][ T5883] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 102.695467][ T5883] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.706845][ T5883] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.717238][ T5883] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.727081][ T5883] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.762101][ T5886] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 102.808439][ T5965] loop1: detected capacity change from 0 to 40427 [ 102.839518][ T5882] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 102.848366][ T5965] F2FS-fs (loop1): Invalid SB checksum offset: 0 [ 102.855475][ T5965] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock [ 102.866303][ T5965] F2FS-fs (loop1): invalid crc value [ 103.031290][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.039294][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.088418][ T5965] F2FS-fs (loop1): Try to recover 2th superblock, ret: 0 [ 103.091925][ T5886] veth0_vlan: entered promiscuous mode [ 103.097170][ T5965] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 103.166994][ T5886] veth1_vlan: entered promiscuous mode [ 103.192788][ T3463] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.193391][ T5882] veth0_vlan: entered promiscuous mode [ 103.224514][ T3463] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.248097][ T5980] netlink: 4 bytes leftover after parsing attributes in process `syz.1.21'. [ 103.295429][ T5882] veth1_vlan: entered promiscuous mode [ 103.364139][ T5885] syz-executor: attempt to access beyond end of device [ 103.364139][ T5885] loop1: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 103.391877][ T5885] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 103.427035][ T5886] veth0_macvtap: entered promiscuous mode [ 103.433236][ T5885] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 103.475174][ T5886] veth1_macvtap: entered promiscuous mode [ 103.505926][ T5882] veth0_macvtap: entered promiscuous mode [ 103.546036][ T5882] veth1_macvtap: entered promiscuous mode [ 103.607195][ T5886] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 103.633037][ T5886] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 103.644143][ T5886] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 103.680979][ T5886] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 103.702922][ T5886] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 103.742578][ T5886] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 103.770420][ T5886] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 103.791191][ T5886] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 103.810576][ T5886] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 103.833085][ T5886] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 103.862076][ T5886] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.889195][ T5886] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.908899][ T5886] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.935839][ T5886] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.999375][ T5882] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 104.021104][ T5882] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 104.040434][ T5882] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 104.060475][ T5882] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 104.085232][ T5882] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 104.110601][ T5882] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 104.134608][ T5882] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 104.189584][ T5882] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 104.211536][ T5882] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 104.240614][ T5882] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 104.270896][ T5882] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 104.286920][ T5984] loop0: detected capacity change from 0 to 40427 [ 104.293738][ T5882] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 104.319864][ T5882] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 104.330826][ T5984] F2FS-fs (loop0): Invalid SB checksum offset: 0 [ 104.337303][ T5984] F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock [ 104.353511][ T5882] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 104.367791][ T5882] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.377699][ T5882] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.381088][ T5984] F2FS-fs (loop0): invalid crc value [ 104.386852][ T5882] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.423926][ T5882] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.640773][ T5986] loop1: detected capacity change from 0 to 40427 [ 104.649136][ T5984] F2FS-fs (loop0): Try to recover 2th superblock, ret: 0 [ 104.668623][ T5986] F2FS-fs (loop1): Invalid SB checksum offset: 0 [ 104.673222][ T5984] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 104.676039][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.701685][ T5986] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock [ 104.716748][ T5986] F2FS-fs (loop1): invalid crc value [ 104.731331][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.773048][ T5984] netlink: 4 bytes leftover after parsing attributes in process `syz.0.17'. [ 104.864638][ T5986] F2FS-fs (loop1): Try to recover 2th superblock, ret: 0 [ 104.878223][ T5986] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 105.045113][ T5998] netlink: 4 bytes leftover after parsing attributes in process `syz.1.22'. [ 105.090025][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.103788][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.121456][ T5885] syz-executor: attempt to access beyond end of device [ 105.121456][ T5885] loop1: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 105.150220][ T34] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.159912][ T5885] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 105.161970][ T34] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.169485][ T5885] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 105.216986][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.270771][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.131437][ T6004] loop3: detected capacity change from 0 to 40427 [ 106.138749][ T5883] syz-executor: attempt to access beyond end of device [ 106.138749][ T5883] loop0: rw=2049, sector=45096, nr_sectors = 16 limit=40427 [ 106.146448][ T6002] loop2: detected capacity change from 0 to 40427 [ 106.171628][ T6004] F2FS-fs (loop3): Invalid SB checksum offset: 0 [ 106.190596][ T5883] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 106.197567][ T5883] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 106.197588][ T6004] F2FS-fs (loop3): Can't find valid F2FS filesystem in 2th superblock [ 106.228711][ T6002] F2FS-fs (loop2): Invalid SB checksum offset: 0 [ 106.245697][ T6004] F2FS-fs (loop3): invalid crc value [ 106.259805][ T6002] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock [ 106.316527][ T6002] F2FS-fs (loop2): invalid crc value [ 106.653768][ T6004] F2FS-fs (loop3): Try to recover 2th superblock, ret: 0 [ 106.673781][ T6002] F2FS-fs (loop2): Try to recover 2th superblock, ret: 0 [ 106.680497][ T6004] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 106.692756][ T6006] loop1: detected capacity change from 0 to 40427 [ 106.699739][ T6002] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 106.748961][ T6004] netlink: 4 bytes leftover after parsing attributes in process `syz.3.20'. [ 106.772213][ T6006] F2FS-fs (loop1): Invalid SB checksum offset: 0 [ 106.793083][ T6006] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock [ 106.833890][ T6006] F2FS-fs (loop1): invalid crc value [ 107.094638][ T6006] F2FS-fs (loop1): Try to recover 2th superblock, ret: 0 [ 107.096063][ T6002] netlink: 4 bytes leftover after parsing attributes in process `syz.2.19'. [ 107.108295][ T6006] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 107.358065][ T6015] ================================================================== [ 107.366591][ T6015] BUG: KASAN: slab-use-after-free in __pm_runtime_resume+0x14c/0x170 [ 107.374871][ T6015] Read of size 2 at addr ffff8880615109a8 by task syz.3.20/6015 [ 107.382715][ T6015] [ 107.385068][ T6015] CPU: 1 PID: 6015 Comm: syz.3.20 Not tainted syzkaller #0 [ 107.392301][ T6015] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 107.402389][ T6015] Call Trace: [ 107.405692][ T6015] [ 107.408653][ T6015] dump_stack_lvl+0x18c/0x250 [ 107.413640][ T6015] ? __lock_acquire+0x7d40/0x7d40 [ 107.418783][ T6015] ? show_regs_print_info+0x20/0x20 [ 107.424117][ T6015] ? load_image+0x420/0x420 [ 107.428676][ T6015] ? _raw_spin_lock_irqsave+0xc0/0x100 [ 107.434274][ T6015] ? __virt_addr_valid+0x18c/0x540 [ 107.439437][ T6015] ? __virt_addr_valid+0x469/0x540 [ 107.444769][ T6015] print_report+0xa8/0x210 [ 107.449326][ T6015] ? __pm_runtime_resume+0x14c/0x170 [ 107.454646][ T6015] kasan_report+0x117/0x150 [ 107.459364][ T6015] ? __mutex_lock+0x4f9/0xcc0 [ 107.464078][ T6015] ? __pm_runtime_resume+0x14c/0x170 [ 107.469473][ T6015] __pm_runtime_resume+0x14c/0x170 [ 107.474778][ T6015] ethnl_ops_begin+0x5d/0x1f0 [ 107.479573][ T6015] module_prepare_data+0x46/0x100 [ 107.484615][ T6015] ethnl_default_doit+0x4fa/0xb80 [ 107.489746][ T6015] genl_family_rcv_msg_doit+0x211/0x310 [ 107.495493][ T6015] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 107.501404][ T6015] genl_rcv_msg+0x619/0x7a0 [ 107.506195][ T6015] ? genl_bind+0x360/0x360 [ 107.510635][ T6015] ? ethnl_default_notify+0x790/0x790 [ 107.516399][ T6015] ? ref_tracker_free+0x690/0x840 [ 107.521544][ T6015] netlink_rcv_skb+0x241/0x4d0 [ 107.526371][ T6015] ? genl_bind+0x360/0x360 [ 107.530812][ T6015] ? netlink_ack+0x1180/0x1180 [ 107.535699][ T6015] ? __lock_acquire+0x7d40/0x7d40 [ 107.540740][ T6015] ? down_read+0x1ac/0x2e0 [ 107.545168][ T6015] genl_rcv+0x28/0x40 [ 107.549243][ T6015] netlink_unicast+0x751/0x8d0 [ 107.554032][ T6015] netlink_sendmsg+0x8d0/0xbf0 [ 107.558986][ T6015] ? netlink_getsockopt+0x590/0x590 [ 107.564236][ T6015] ? aa_sock_msg_perm+0x94/0x150 [ 107.569453][ T6015] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 107.574842][ T6015] ? security_socket_sendmsg+0x80/0xa0 [ 107.580579][ T6015] ? netlink_getsockopt+0x590/0x590 [ 107.586677][ T6015] ____sys_sendmsg+0x5ba/0x960 [ 107.591743][ T6015] ? __asan_memset+0x22/0x40 [ 107.596616][ T6015] ? __sys_sendmsg_sock+0x30/0x30 [ 107.601909][ T6015] ? __import_iovec+0x5f2/0x850 [ 107.607200][ T6015] ? import_iovec+0x73/0xa0 [ 107.611889][ T6015] ___sys_sendmsg+0x2a6/0x360 [ 107.617033][ T6015] ? __sys_sendmsg+0x2a0/0x2a0 [ 107.621837][ T6015] __se_sys_sendmsg+0x1c2/0x2b0 [ 107.626886][ T6015] ? __x64_sys_sendmsg+0x80/0x80 [ 107.631934][ T6015] ? lockdep_hardirqs_on+0x98/0x150 [ 107.637232][ T6015] do_syscall_64+0x55/0xa0 [ 107.641857][ T6015] ? clear_bhb_loop+0x40/0x90 [ 107.646730][ T6015] ? clear_bhb_loop+0x40/0x90 [ 107.651471][ T6015] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 107.657487][ T6015] RIP: 0033:0x7f20e8b9c819 [ 107.662003][ T6015] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 107.681808][ T6015] RSP: 002b:00007f20e9987028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 107.690412][ T6015] RAX: ffffffffffffffda RBX: 00007f20e8e16090 RCX: 00007f20e8b9c819 [ 107.698652][ T6015] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000004 [ 107.706949][ T6015] RBP: 00007f20e8c32c91 R08: 0000000000000000 R09: 0000000000000000 [ 107.715049][ T6015] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 107.723327][ T6015] R13: 00007f20e8e16128 R14: 00007f20e8e16090 R15: 00007ffdd38f4e18 [ 107.731506][ T6015] [ 107.734653][ T6015] [ 107.737010][ T6015] Allocated by task 5882: [ 107.741443][ T6015] kasan_set_track+0x4e/0x70 [ 107.746419][ T6015] __kasan_kmalloc+0x8f/0xa0 [ 107.751021][ T6015] __kmalloc_node+0xb4/0x230 [ 107.755802][ T6015] kvmalloc_node+0x70/0x180 [ 107.760409][ T6015] alloc_netdev_mqs+0x87/0x1040 [ 107.765556][ T6015] rtnl_create_link+0x30e/0xd00 [ 107.770588][ T6015] veth_newlink+0x2bc/0xc30 [ 107.775111][ T6015] rtnl_newlink+0x1542/0x20a0 [ 107.779887][ T6015] rtnetlink_rcv_msg+0x869/0xfa0 [ 107.784845][ T6015] netlink_rcv_skb+0x241/0x4d0 [ 107.789884][ T6015] netlink_unicast+0x751/0x8d0 [ 107.794758][ T6015] netlink_sendmsg+0x8d0/0xbf0 [ 107.799543][ T6015] __sys_sendto+0x4a9/0x6b0 [ 107.804142][ T6015] __x64_sys_sendto+0xde/0xf0 [ 107.809011][ T6015] do_syscall_64+0x55/0xa0 [ 107.813440][ T6015] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 107.819430][ T6015] [ 107.821761][ T6015] Freed by task 6004: [ 107.825757][ T6015] kasan_set_track+0x4e/0x70 [ 107.830352][ T6015] kasan_save_free_info+0x2e/0x50 [ 107.835619][ T6015] ____kasan_slab_free+0x126/0x1e0 [ 107.840858][ T6015] slab_free_freelist_hook+0x130/0x1a0 [ 107.846516][ T6015] __kmem_cache_free+0xba/0x1e0 [ 107.851392][ T6015] device_release+0x96/0x1c0 [ 107.856013][ T6015] kobject_put+0x221/0x460 [ 107.860627][ T6015] netdev_run_todo+0xcb7/0xdc0 [ 107.865496][ T6015] rtnetlink_rcv_msg+0xab7/0xfa0 [ 107.870725][ T6015] netlink_rcv_skb+0x241/0x4d0 [ 107.875847][ T6015] netlink_unicast+0x751/0x8d0 [ 107.880882][ T6015] netlink_sendmsg+0x8d0/0xbf0 [ 107.885681][ T6015] ____sys_sendmsg+0x5ba/0x960 [ 107.890653][ T6015] ___sys_sendmsg+0x2a6/0x360 [ 107.895576][ T6015] __se_sys_sendmsg+0x1c2/0x2b0 [ 107.900543][ T6015] do_syscall_64+0x55/0xa0 [ 107.905084][ T6015] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 107.911152][ T6015] [ 107.913493][ T6015] The buggy address belongs to the object at ffff888061510000 [ 107.913493][ T6015] which belongs to the cache kmalloc-cg-4k of size 4096 [ 107.927838][ T6015] The buggy address is located 2472 bytes inside of [ 107.927838][ T6015] freed 4096-byte region [ffff888061510000, ffff888061511000) [ 107.941931][ T6015] [ 107.944387][ T6015] The buggy address belongs to the physical page: [ 107.950993][ T6015] page:ffffea0001854400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x61510 [ 107.961428][ T6015] head:ffffea0001854400 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 107.970559][ T6015] memcg:ffff888060805201 [ 107.974889][ T6015] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 107.983135][ T6015] page_type: 0xffffffff() [ 107.987474][ T6015] raw: 00fff00000000840 ffff888017c4f500 dead000000000122 0000000000000000 [ 107.996169][ T6015] raw: 0000000000000000 0000000000040004 00000001ffffffff ffff888060805201 [ 108.005305][ T6015] page dumped because: kasan: bad access detected [ 108.012101][ T6015] page_owner tracks the page as allocated [ 108.017906][ T6015] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d60c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5882, tgid 5882 (syz-executor), ts 96708796971, free_ts 91904594498 [ 108.042864][ T6015] post_alloc_hook+0x1c1/0x200 [ 108.047760][ T6015] get_page_from_freelist+0x1951/0x19e0 [ 108.053315][ T6015] __alloc_pages+0x1f0/0x460 [ 108.058001][ T6015] alloc_slab_page+0x5d/0x160 [ 108.062780][ T6015] new_slab+0x87/0x2d0 [ 108.066982][ T6015] ___slab_alloc+0xc5d/0x12f0 [ 108.071851][ T6015] __kmem_cache_alloc_node+0x19e/0x250 [ 108.077407][ T6015] __kmalloc_node+0xa4/0x230 [ 108.082044][ T6015] kvmalloc_node+0x70/0x180 [ 108.086821][ T6015] alloc_netdev_mqs+0x87/0x1040 [ 108.091829][ T6015] rtnl_create_link+0x30e/0xd00 [ 108.096708][ T6015] veth_newlink+0x2bc/0xc30 [ 108.101247][ T6015] rtnl_newlink+0x1542/0x20a0 [ 108.106085][ T6015] rtnetlink_rcv_msg+0x869/0xfa0 [ 108.111074][ T6015] netlink_rcv_skb+0x241/0x4d0 [ 108.115873][ T6015] netlink_unicast+0x751/0x8d0 [ 108.120760][ T6015] page last free stack trace: [ 108.125443][ T6015] free_unref_page_prepare+0x7b2/0x8c0 [ 108.131195][ T6015] free_unref_page+0x32/0x2e0 [ 108.135972][ T6015] vfree+0x1a6/0x320 [ 108.139876][ T6015] kcov_close+0x2b/0x50 [ 108.144127][ T6015] __fput+0x234/0x970 [ 108.148204][ T6015] task_work_run+0x1d4/0x260 [ 108.152991][ T6015] do_exit+0x95a/0x2460 [ 108.157160][ T6015] do_group_exit+0x21b/0x2d0 [ 108.161799][ T6015] get_signal+0x12fc/0x13f0 [ 108.166403][ T6015] arch_do_signal_or_restart+0xc2/0x800 [ 108.172196][ T6015] exit_to_user_mode_loop+0x70/0x110 [ 108.177507][ T6015] exit_to_user_mode_prepare+0xee/0x180 [ 108.183171][ T6015] syscall_exit_to_user_mode+0x1a/0x50 [ 108.188827][ T6015] do_syscall_64+0x61/0xa0 [ 108.193338][ T6015] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 108.199938][ T6015] [ 108.202271][ T6015] Memory state around the buggy address: [ 108.208089][ T6015] ffff888061510880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 108.216407][ T6015] ffff888061510900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 108.224532][ T6015] >ffff888061510980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 108.232781][ T6015] ^ [ 108.238160][ T6015] ffff888061510a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 108.246250][ T6015] ffff888061510a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 108.254704][ T6015] ================================================================== [ 108.276852][ T6015] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 108.284136][ T6015] CPU: 0 PID: 6015 Comm: syz.3.20 Not tainted syzkaller #0 [ 108.291627][ T6015] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 108.301910][ T6015] Call Trace: [ 108.305231][ T6015] [ 108.308361][ T6015] dump_stack_lvl+0x18c/0x250 [ 108.313092][ T6015] ? show_regs_print_info+0x20/0x20 [ 108.318500][ T6015] ? load_image+0x420/0x420 [ 108.323284][ T6015] panic+0x2dc/0x730 [ 108.327287][ T6015] ? bpf_jit_dump+0xd0/0xd0 [ 108.331828][ T6015] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 108.338259][ T6015] ? _raw_spin_unlock+0x40/0x40 [ 108.343129][ T6015] ? print_memory_metadata+0x314/0x400 [ 108.349133][ T6015] ? __pm_runtime_resume+0x14c/0x170 [ 108.354779][ T6015] check_panic_on_warn+0x84/0xa0 [ 108.359836][ T6015] ? __pm_runtime_resume+0x14c/0x170 [ 108.365225][ T6015] end_report+0x6f/0x130 [ 108.369507][ T6015] kasan_report+0x128/0x150 [ 108.374017][ T6015] ? __mutex_lock+0x4f9/0xcc0 [ 108.378958][ T6015] ? __pm_runtime_resume+0x14c/0x170 [ 108.384344][ T6015] __pm_runtime_resume+0x14c/0x170 [ 108.389469][ T6015] ethnl_ops_begin+0x5d/0x1f0 [ 108.394344][ T6015] module_prepare_data+0x46/0x100 [ 108.399472][ T6015] ethnl_default_doit+0x4fa/0xb80 [ 108.404604][ T6015] genl_family_rcv_msg_doit+0x211/0x310 [ 108.410160][ T6015] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 108.416063][ T6015] genl_rcv_msg+0x619/0x7a0 [ 108.420584][ T6015] ? genl_bind+0x360/0x360 [ 108.425263][ T6015] ? ethnl_default_notify+0x790/0x790 [ 108.430754][ T6015] ? ref_tracker_free+0x690/0x840 [ 108.435794][ T6015] netlink_rcv_skb+0x241/0x4d0 [ 108.440757][ T6015] ? genl_bind+0x360/0x360 [ 108.445417][ T6015] ? netlink_ack+0x1180/0x1180 [ 108.450560][ T6015] ? __lock_acquire+0x7d40/0x7d40 [ 108.455602][ T6015] ? down_read+0x1ac/0x2e0 [ 108.460093][ T6015] genl_rcv+0x28/0x40 [ 108.464179][ T6015] netlink_unicast+0x751/0x8d0 [ 108.468958][ T6015] netlink_sendmsg+0x8d0/0xbf0 [ 108.473931][ T6015] ? netlink_getsockopt+0x590/0x590 [ 108.479228][ T6015] ? aa_sock_msg_perm+0x94/0x150 [ 108.484175][ T6015] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 108.489471][ T6015] ? security_socket_sendmsg+0x80/0xa0 [ 108.495195][ T6015] ? netlink_getsockopt+0x590/0x590 [ 108.500499][ T6015] ____sys_sendmsg+0x5ba/0x960 [ 108.505371][ T6015] ? __asan_memset+0x22/0x40 [ 108.509980][ T6015] ? __sys_sendmsg_sock+0x30/0x30 [ 108.515008][ T6015] ? __import_iovec+0x5f2/0x850 [ 108.520045][ T6015] ? import_iovec+0x73/0xa0 [ 108.524653][ T6015] ___sys_sendmsg+0x2a6/0x360 [ 108.529692][ T6015] ? __sys_sendmsg+0x2a0/0x2a0 [ 108.534496][ T6015] __se_sys_sendmsg+0x1c2/0x2b0 [ 108.539550][ T6015] ? __x64_sys_sendmsg+0x80/0x80 [ 108.544786][ T6015] ? lockdep_hardirqs_on+0x98/0x150 [ 108.550530][ T6015] do_syscall_64+0x55/0xa0 [ 108.555044][ T6015] ? clear_bhb_loop+0x40/0x90 [ 108.560081][ T6015] ? clear_bhb_loop+0x40/0x90 [ 108.564791][ T6015] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 108.570963][ T6015] RIP: 0033:0x7f20e8b9c819 [ 108.575559][ T6015] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 108.595707][ T6015] RSP: 002b:00007f20e9987028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 108.604655][ T6015] RAX: ffffffffffffffda RBX: 00007f20e8e16090 RCX: 00007f20e8b9c819 [ 108.612812][ T6015] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000004 [ 108.620879][ T6015] RBP: 00007f20e8c32c91 R08: 0000000000000000 R09: 0000000000000000 [ 108.628949][ T6015] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 108.637019][ T6015] R13: 00007f20e8e16128 R14: 00007f20e8e16090 R15: 00007ffdd38f4e18 [ 108.645026][ T6015] [ 108.648712][ T6015] Kernel Offset: disabled [ 108.653039][ T6015] Rebooting in 86400 seconds..