Warning: Permanently added '10.128.0.238' (ED25519) to the list of known hosts. 1970/01/01 00:00:31 parsed 1 programs 1970/01/01 00:00:31 serving rpc on tcp://44397 [ 32.317935][ T4715] cgroup: Unknown subsys name 'net' [ 32.437735][ T4715] cgroup: Unknown subsys name 'cpuset' [ 32.439962][ T4715] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 32.617248][ T4715] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 34.819298][ T4723] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 34.925055][ T4731] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 34.925618][ T4731] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 34.925808][ T4731] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 34.926114][ T4731] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 34.930518][ T4731] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 35.501107][ T4755] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.501362][ T4755] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.501425][ T4755] bridge_slave_0: entered allmulticast mode [ 35.501872][ T4755] bridge_slave_0: entered promiscuous mode [ 35.502948][ T4755] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.502967][ T4755] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.503009][ T4755] bridge_slave_1: entered allmulticast mode [ 35.503420][ T4755] bridge_slave_1: entered promiscuous mode [ 35.510705][ T4755] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 35.511724][ T4755] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 35.518120][ T4755] team0: Port device team_slave_0 added [ 35.518835][ T4755] team0: Port device team_slave_1 added [ 35.524238][ T4755] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 35.524262][ T4755] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.524277][ T4755] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 35.524996][ T4755] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 35.525004][ T4755] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.525018][ T4755] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 35.538040][ T4755] hsr_slave_0: entered promiscuous mode [ 35.538391][ T4755] hsr_slave_1: entered promiscuous mode [ 35.581532][ T4755] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 35.584773][ T4755] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 35.588592][ T4755] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 35.591058][ T4755] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 35.592967][ T4755] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 35.595210][ T4755] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 35.596740][ T4755] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 35.598668][ T4755] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 35.608448][ T4755] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.608498][ T4755] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.608658][ T4755] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.608697][ T4755] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.629991][ T4755] 8021q: adding VLAN 0 to HW filter on device bond0 [ 35.634711][ T40] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.637548][ T40] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.641735][ T4755] 8021q: adding VLAN 0 to HW filter on device team0 [ 35.644514][ T1479] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.644565][ T1479] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.649004][ T1479] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.649044][ T1479] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.739232][ T4755] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 35.750202][ T4755] veth0_vlan: entered promiscuous mode [ 35.751925][ T4755] veth1_vlan: entered promiscuous mode [ 35.758788][ T4755] veth0_macvtap: entered promiscuous mode [ 35.759893][ T4755] veth1_macvtap: entered promiscuous mode [ 35.763745][ T4755] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 35.764894][ T4755] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 35.770901][ T40] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.771113][ T40] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.771152][ T40] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.771173][ T40] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.873406][ T1479] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.880582][ T1207] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 35.880611][ T1207] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 35.889824][ T1207] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 35.889849][ T1207] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 35.919875][ T1479] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.982446][ T1479] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 36.062508][ T1479] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 1970/01/01 00:00:36 executed programs: 0 [ 36.539532][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 36.541306][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 36.542036][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 36.542402][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 36.542598][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 36.673103][ T4819] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.673196][ T4819] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.673292][ T4819] bridge_slave_0: entered allmulticast mode [ 36.673699][ T4819] bridge_slave_0: entered promiscuous mode [ 36.674451][ T4819] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.674472][ T4819] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.674521][ T4819] bridge_slave_1: entered allmulticast mode [ 36.674912][ T4819] bridge_slave_1: entered promiscuous mode [ 36.681624][ T4819] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 36.682549][ T4819] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 36.689340][ T4819] team0: Port device team_slave_0 added [ 36.691199][ T4819] team0: Port device team_slave_1 added [ 36.697278][ T4819] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 36.697304][ T4819] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 36.697327][ T4819] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 36.697823][ T4819] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 36.697836][ T4819] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 36.697854][ T4819] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 36.707591][ T4819] hsr_slave_0: entered promiscuous mode [ 36.707882][ T4819] hsr_slave_1: entered promiscuous mode [ 36.708712][ T4819] debugfs: 'hsr0' already exists in 'hsr' [ 36.708760][ T4819] Cannot create hsr debugfs directory [ 38.566774][ T50] Bluetooth: hci0: command tx timeout [ 39.556311][ T1479] bridge_slave_1: left allmulticast mode [ 39.556364][ T1479] bridge_slave_1: left promiscuous mode [ 39.556743][ T1479] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.559767][ T1479] bridge_slave_0: left allmulticast mode [ 39.559795][ T1479] bridge_slave_0: left promiscuous mode [ 39.559863][ T1479] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.687694][ T1479] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 39.727955][ T1479] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 39.747076][ T1479] bond0 (unregistering): Released all slaves [ 39.796297][ T1479] hsr_slave_0: left promiscuous mode [ 39.797372][ T1479] hsr_slave_1: left promiscuous mode [ 39.797641][ T1479] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 39.797657][ T1479] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 39.798126][ T1479] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 39.798145][ T1479] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 39.809692][ T1479] veth1_macvtap: left promiscuous mode [ 39.810690][ T1479] veth0_macvtap: left promiscuous mode [ 39.811769][ T1479] veth1_vlan: left promiscuous mode [ 39.812674][ T1479] veth0_vlan: left promiscuous mode [ 39.910791][ T1479] team0 (unregistering): Port device team_slave_1 removed [ 39.915379][ T1479] team0 (unregistering): Port device team_slave_0 removed [ 39.961840][ T4393] 8021q: adding VLAN 0 to HW filter on device eth0 [ 40.217986][ T4819] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 40.220237][ T4819] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 40.222078][ T4819] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 40.224771][ T4819] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 40.228985][ T4819] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 40.232947][ T4819] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 40.238010][ T4819] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 40.240231][ T4819] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 40.261567][ T4819] 8021q: adding VLAN 0 to HW filter on device bond0 [ 40.265618][ T4819] 8021q: adding VLAN 0 to HW filter on device team0 [ 40.269363][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.269408][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.273236][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.273289][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.507697][ T4819] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 40.517626][ T4819] veth0_vlan: entered promiscuous mode [ 40.519777][ T4819] veth1_vlan: entered promiscuous mode [ 40.527509][ T4819] veth0_macvtap: entered promiscuous mode [ 40.528566][ T4819] veth1_macvtap: entered promiscuous mode [ 40.531809][ T4819] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.533162][ T4819] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.536036][ T40] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.538163][ T40] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.538185][ T40] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.538202][ T40] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.590559][ T39] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.590581][ T39] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.597511][ T1207] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.598834][ T1207] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.646616][ T50] Bluetooth: hci0: command tx timeout [ 40. ** replaying previous printk message ** [ 40.649360][ T4913] ================================================================== [ 40.649372][ T4913] BUG: KASAN: slab-use-after-free in dvb_device_open+0xd0/0x254 [ 40.649392][ T4913] Read of size 8 at addr ffff0000cc9bce18 by task syz.0.19/4913 [ 40.649398][ T4913] [ 40.649403][ T4913] CPU: 1 UID: 0 PID: 4913 Comm: syz.0.19 Not tainted syzkaller #0 PREEMPT [ 40.649411][ T4913] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 [ 40.649415][ T4913] Call trace: [ 40.649417][ T4913] show_stack+0x2c/0x3c (C) [ 40.649430][ T4913] __dump_stack+0x30/0x40 [ 40.649440][ T4913] dump_stack_lvl+0xd8/0x12c [ 40.649449][ T4913] print_address_description+0xb0/0x238 [ 40.649457][ T4913] print_report+0x68/0x84 [ 40.649464][ T4913] kasan_report+0x8c/0xc4 [ 40.649474][ T4913] __asan_report_load8_noabort+0x20/0x2c [ 40.649483][ T4913] dvb_device_open+0xd0/0x254 [ 40.649493][ T4913] chrdev_open+0x398/0x3e8 [ 40.649501][ T4913] do_dentry_open+0x5c4/0xfb8 [ 40.649510][ T4913] vfs_open+0x44/0x2dc [ 40.649519][ T4913] path_openat+0x22d4/0x2b88 [ 40.649526][ T4913] do_file_open+0x1c8/0x2e8 [ 40.649533][ T4913] do_sys_openat2+0x114/0x1e8 [ 40.649542][ T4913] do_sys_open+0xac/0xdc [ 40.649550][ T4913] __arm64_sys_openat+0xa0/0xbc [ 40.649559][ T4913] invoke_syscall+0x98/0x244 [ 40.649569][ T4913] el0_svc_common+0xec/0x23c [ 40.649578][ T4913] do_el0_svc+0x4c/0x5c [ 40.649587][ T4913] el0_svc+0x64/0x260 [ 40.649595][ T4913] el0t_64_sync_handler+0x48/0x148 [ 40.649602][ T4913] el0t_64_sync+0x198/0x19c [ 40.649609][ T4913] [ 40.649611][ T4913] Allocated by task 1: [ 40.649615][ T4913] kasan_save_track+0x40/0x78 [ 40.649622][ T4913] kasan_save_alloc_info+0x44/0x54 [ 40.649630][ T4913] __kasan_kmalloc+0x9c/0xb4 [ 40.649636][ T4913] __kmalloc_cache_noprof+0x2d4/0x624 [ 40.649644][ T4913] dvb_register_device+0x1a4/0x16e0 [ 40.649652][ T4913] dvb_register_frontend+0x474/0x6d0 [ 40.649659][ T4913] vidtv_bridge_probe+0x5a4/0xa58 [ 40.649667][ T4913] platform_probe+0x100/0x1a4 [ 40.649675][ T4913] really_probe+0x29c/0x800 [ 40.649680][ T4913] __driver_probe_device+0x1e0/0x34c [ 40.649686][ T4913] driver_probe_device+0x6c/0x19c [ 40.649691][ T4913] __driver_attach+0x164/0x37c [ 40.649696][ T4913] bus_for_each_dev+0x128/0x1b4 [ 40.649704][ T4913] driver_attach+0x50/0x60 [ 40.649708][ T4913] bus_add_driver+0x208/0x500 [ 40.649716][ T4913] driver_register+0x220/0x310 [ 40.649721][ T4913] __platform_driver_register+0x70/0x84 [ 40.649728][ T4913] vidtv_bridge_init+0x34/0x5c [ 40.649734][ T4913] do_one_initcall+0x274/0xc38 [ 40.649742][ T4913] do_initcall_level+0x12c/0x1c4 [ 40.649750][ T4913] do_initcalls+0x70/0xd0 [ 40.649757][ T4913] do_basic_setup+0x7c/0x90 [ 40.649763][ T4913] kernel_init_freeable+0x268/0x3a8 [ 40.649771][ T4913] kernel_init+0x24/0x1dc [ 40.649777][ T4913] ret_from_fork+0x10/0x20 [ 40.649782][ T4913] [ 40.649784][ T4913] Freed by task 4912: [ 40.649787][ T4913] kasan_save_track+0x40/0x78 [ 40.649794][ T4913] kasan_save_free_info+0x58/0x70 [ 40.649801][ T4913] __kasan_slab_free+0x74/0xa4 [ 40.649808][ T4913] kfree+0x188/0x690 [ 40.649814][ T4913] dvb_device_put+0x64/0xd0 [ 40.649822][ T4913] dvb_device_open+0x23c/0x254 [ 40.649830][ T4913] chrdev_open+0x398/0x3e8 [ 40.649836][ T4913] do_dentry_open+0x5c4/0xfb8 [ 40.649843][ T4913] vfs_open+0x44/0x2dc [ 40.649850][ T4913] path_openat+0x22d4/0x2b88 [ 40.649856][ T4913] do_file_open+0x1c8/0x2e8 [ 40.649862][ T4913] do_sys_openat2+0x114/0x1e8 [ 40.649869][ T4913] do_sys_open+0xac/0xdc [ 40.649876][ T4913] __arm64_sys_openat+0xa0/0xbc [ 40.649883][ T4913] invoke_syscall+0x98/0x244 [ 40.649891][ T4913] el0_svc_common+0xec/0x23c [ 40.649899][ T4913] do_el0_svc+0x4c/0x5c [ 40.649906][ T4913] el0_svc+0x64/0x260 [ 40.649911][ T4913] el0t_64_sync_handler+0x48/0x148 [ 40.649917][ T4913] el0t_64_sync+0x198/0x19c [ 40.649922][ T4913] [ 40.649923][ T4913] The buggy address belongs to the object at ffff0000cc9bce00 [ 40.649923][ T4913] which belongs to the cache kmalloc-256 of size 256 [ 40.649929][ T4913] The buggy address is located 24 bytes inside of [ 40.649929][ T4913] freed 256-byte region [ffff0000cc9bce00, ffff0000cc9bcf00) [ 40.649936][ T4913] [ 40.649937][ T4913] The buggy address belongs to the physical page: [ 40.649941][ T4913] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10c9bc [ 40.649947][ T4913] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 40.649953][ T4913] flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 40.649960][ T4913] page_type: f5(slab) [ 40.649967][ T4913] raw: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122 [ 40.649972][ T4913] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 40.649977][ T4913] head: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122 [ 40.649983][ T4913] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 40.649988][ T4913] head: 05ffc00000000001 fffffdffc3326f01 00000000ffffffff 00000000ffffffff [ 40.649993][ T4913] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 40.649996][ T4913] page dumped because: kasan: bad access detected [ 40.649999][ T4913] [ 40.650001][ T4913] Memory state around the buggy address: [ 40.650004][ T4913] ffff0000cc9bcd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.650008][ T4913] ffff0000cc9bcd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.650012][ T4913] >ffff0000cc9bce00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.650015][ T4913] ^ [ 40.650019][ T4913] ffff0000cc9bce80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.650023][ T4913] ffff0000cc9bcf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.650026][ T4913] ================================================================== [ 40.650046][ T4913] Disabling lock debugging due to kernel taint [ 40.650054][ T4913] ------------[ cut here ]------------ [ 40.650058][ T4913] refcount_t: addition on 0; use-after-free. [ 40.650162][ T4913] WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x134/0x1f8, CPU#1: syz.0.19/4913 [ 40.744705][ T4913] Modules linked in: [ 40.745396][ T4913] CPU: 1 UID: 0 PID: 4913 Comm: syz.0.19 Tainted: G B syzkaller #0 PREEMPT [ 40.747189][ T4913] Tainted: [B]=BAD_PAGE [ 40.747878][ T4913] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 [ 40.749637][ T4913] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 40.750939][ T4913] pc : refcount_warn_saturate+0x134/0x1f8 [ 40.751892][ T4913] lr : refcount_warn_saturate+0x134/0x1f8 [ 40.752837][ T4913] sp : ffff8000934a7560 [ 40.753562][ T4913] x29: ffff8000934a7560 x28: dfff800000000000 x27: 1fffe0001b8b5c41 [ 40.755099][ T4913] x26: dfff800000000000 x25: ffff700012694ec0 x24: dfff800000000000 [ 40.756599][ T4913] x23: ffff8000873840e8 x22: ffff0000cc5ad400 x21: ffff0000cc9bce00 [ 40.757991][ T4913] x20: ffff0000cc9bce10 x19: ffff80008a04a000 x18: 0000000000000000 [ 40.759530][ T4913] x17: 3d3d3d3d3d3d3d3d x16: 3d3d3d3d3d3d3d3d x15: 3d3d3d3d3d3d3d3d [ 40.761035][ T4913] x14: 3d3d3d3d3d3d3d3d x13: 0000000000000001 x12: 0000000000000000 [ 40.762427][ T4913] x11: 0000000000000000 x10: 0000000000000002 x9 : f06ef3ef95ba0a00 [ 40.763748][ T4913] x8 : f06ef3ef95ba0a00 x7 : 0000000000000000 x6 : ffff80008048076c [ 40.765193][ T4913] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f45e0 [ 40.766688][ T4913] x2 : 0000000100000000 x1 : ffff0000cf88ba00 x0 : 0000000000000000 [ 40.768124][ T4913] Call trace: [ 40.768682][ T4913] refcount_warn_saturate+0x134/0x1f8 (P) [ 40.769670][ T4913] dvb_device_get+0x9c/0xc0 [ 40.770419][ T4913] dvb_device_open+0x100/0x254 [ 40.771265][ T4913] chrdev_open+0x398/0x3e8 [ 40.771931][ T4913] do_dentry_open+0x5c4/0xfb8 [ 40.772705][ T4913] vfs_open+0x44/0x2dc [ 40.773358][ T4913] path_openat+0x22d4/0x2b88 [ 40.774103][ T4913] do_file_open+0x1c8/0x2e8 [ 40.774896][ T4913] do_sys_openat2+0x114/0x1e8 [ 40.775700][ T4913] do_sys_open+0xac/0xdc [ 40.776447][ T4913] __arm64_sys_openat+0xa0/0xbc [ 40.777309][ T4913] invoke_syscall+0x98/0x244 [ 40.778162][ T4913] el0_svc_common+0xec/0x23c [ 40.778959][ T4913] do_el0_svc+0x4c/0x5c [ 40.779642][ T4913] el0_svc+0x64/0x260 [ 40.780295][ T4913] el0t_64_sync_handler+0x48/0x148 [ 40.781176][ T4913] el0t_64_sync+0x198/0x19c [ 40.781932][ T4913] irq event stamp: 971 [ 40.782621][ T4913] hardirqs last enabled at (971): [] arm64_exit_to_kernel_mode+0x80/0x94 [ 40.784401][ T4913] hardirqs last disabled at (970): [] el1_interrupt+0x28/0x60 [ 40.785985][ T4913] softirqs last enabled at (932): [] fpsimd_restore_current_state+0x39c/0x9c8 [ 40.787852][ T4913] softirqs last disabled at (930): [] fpsimd_restore_current_state+0x44/0x9c8 [ 40.789686][ T4913] ---[ end trace 0000000000000000 ]--- [ 40.793633][ T4913] ------------[ cut here ** replaying previous printk message ** [ 40.793633][ T4913] ------------[ cut here ]------------ [ 40.793666][ T4913] refcount_t: underflow; use-after-free. [ 40.794401][ T4913] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x154/0x1f8, CPU#0: syz.0.19/4913 [ 40.798674][ T4913] Modules linked in: [ 40.799322][ T4913] CPU: 0 UID: 0 PID: 4913 Comm: syz.0.19 Tainted: G B W syzkaller #0 PREEMPT [ 40.801026][ T4913] Tainted: [B]=BAD_PAGE, [W]=WARN [ 40.801859][ T4913] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 [ 40.803594][ T4913] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 40.804992][ T4913] pc : refcount_warn_saturate+0x154/0x1f8 [ 40.805897][ T4913] lr : refcount_warn_saturate+0x154/0x1f8 [ 40.806803][ T4913] sp : ffff8000934a7460 [ 40.807461][ T4913] x29: ffff8000934a7460 x28: ffff0000dc5ae1c0 x27: ffff0000cc4ac010 [ 40.808778][ T4913] x26: dfff800000000000 x25: 1fffe000199379c7 x24: ffff0000cc4ac060 [ 40.810017][ T4913] x23: 00000000fffffffc x22: ffff0000cc9bce3c x21: 00000000c0000000 [ 40.811415][ T4913] x20: ffff0000cc9bce10 x19: ffff80008a04a000 x18: 1fffe00035beb820 [ 40.812683][ T4913] x17: 0000000000000003 x16: ffff800088a0b000 x15: ffff800088abda60 [ 40.813940][ T4913] x14: ffff0001adf5c10c x13: 0000000000000001 x12: 0000000000000000 [ 40.815231][ T4913] x11: 0000000000000000 x10: 0000000000000003 x9 : f06ef3ef95ba0a00 [ 40.816445][ T4913] x8 : f06ef3ef95ba0a00 x7 : 0000000000000000 x6 : ffff8000803b4954 [ 40.817648][ T4913] x5 : 0000000000000000 x4 : 0000000000000008 x3 : ffff8000803b4ab0 [ 40.818878][ T4913] x2 : 0000000000000001 x1 : ffff0000cf88ba00 x0 : 0000000000000001 [ 40.820124][ T4913] Call trace: [ 40.820613][ T4913] refcount_warn_saturate+0x154/0x1f8 (P) [ 40.821510][ T4913] dvb_device_put+0xac/0xd0 [ 40.822244][ T4913] dvb_generic_release+0xec/0x158 [ 40.823044][ T4913] dvb_frontend_open+0x9cc/0x10a8 [ 40.823854][ T4913] dvb_device_open+0x1f8/0x254 [ 40.824646][ T4913] chrdev_open+0x398/0x3e8 [ 40.825346][ T4913] do_dentry_open+0x5c4/0xfb8 [ 40.826083][ T4913] vfs_open+0x44/0x2dc [ 40.826704][ T4913] path_openat+0x22d4/0x2b88 [ 40.827427][ T4913] do_file_open+0x1c8/0x2e8 [ 40.828152][ T4913] do_sys_openat2+0x114/0x1e8 [ 40.828863][ T4913] do_sys_open+0xac/0xdc [ 40.829564][ T4913] __arm64_sys_openat+0xa0/0xbc [ 40.830328][ T4913] invoke_syscall+0x98/0x244 [ 40.831047][ T4913] el0_svc_common+0xec/0x23c [ 40.831756][ T4913] do_el0_svc+0x4c/0x5c [ 40.832403][ T4913] el0_svc+0x64/0x260 [ 40.833048][ T4913] el0t_64_sync_handler+0x48/0x148 [ 40.833865][ T4913] el0t_64_sync+0x198/0x19c [ 40.834603][ T4913] irq event stamp: 971 [ 40.835248][ T4913] hardirqs last enabled at (971): [] arm64_exit_to_kernel_mode+0x80/0x94 [ 40.836729][ T4913] hardirqs last disabled at (970): [] el1_interrupt+0x28/0x60 [ 40.838086][ T4913] softirqs last enabled at (932): [] fpsimd_restore_current_state+0x39c/0x9c8 [ 40.839753][ T4913] softirqs last disabled at (930): [] fpsimd_restore_current_state+0x44/0x9c8 [ 40.841403][ T4913] ---[ end trace 0000000000000000 ]--- [ 40.849771][ T4915] ------------[ cut here ]------------ [ 40.849794][ T4915] refcount_t: saturated; leaking memory. [ 40.852020][ T4915] WARNING: lib/refcount.c:22 at refcount_warn_saturate+0x1b4/0x1f8, CPU#1: syz.0.20/4915 [ 40.853540][ T4915] Modules linked in: [ 40.854117][ T4915] CPU: 1 UID: 0 PID: 4915 Comm: syz.0.20 Tainted: G B W syzkaller #0 PREEMPT [ 40.855683][ T4915] Tainted: [B]=BAD_PAGE, [W]=WARN [ 40.856521][ T4915] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 [ 40.858192][ T4915] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 40.859455][ T4915] pc : refcount_warn_saturate+0x1b4/0x1f8 [ 40.860415][ T4915] lr : refcount_warn_saturate+0x1b4/0x1f8 [ 40.861397][ T4915] sp : ffff8000934a7560 [ 40.862100][ T4915] x29: ffff8000934a7560 x28: dfff800000000000 x27: 1fffe0001b8af041 [ 40.863560][ T4915] x26: dfff800000000000 x25: ffff700012694ec0 x24: dfff800000000000 [ 40.864892][ T4915] x23: ffff8000873840e8 x22: ffff0000cc5ad400 x21: 000000007ffffffe [ 40.866216][ T4915] x20: ffff0000cc9bce10 x19: ffff80008a04a000 x18: 1fffe00035bf0220 [ 40.867648][ T4915] x17: 0000000000000003 x16: ffff800088a0b000 x15: 0000000000000000 [ 40.868994][ T4915] x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000000 [ 40.870313][ T4915] x11: ffff800080156354 x10: 0000000000000003 x9 : 112f3cc6e6e28200 [ 40.871680][ T4915] x8 : 112f3cc6e6e28200 x7 : 0000000000000000 x6 : ffff8000803b4954 [ 40.873138][ T4915] x5 : 0000000000000000 x4 : 0000000000000008 x3 : ffff8000801563fc [ 40.874482][ T4915] x2 : 0000000000000000 x1 : ffff0000d54dd700 x0 : 0000000000000001 [ 40.875953][ T4915] Call trace: [ 40.876469][ T4915] refcount_warn_saturate+0x1b4/0x1f8 (P) [ 40.877415][ T4915] dvb_device_get+0x9c/0xc0 [ 40.878195][ T4915] dvb_device_open+0x100/0x254 [ 40.879022][ T4915] chrdev_open+0x398/0x3e8 [ 40.879773][ T4915] do_dentry_open+0x5c4/0xfb8 [ 40.880595][ T4915] vfs_open+0x44/0x2dc [ 40.881354][ T4915] path_openat+0x22d4/0x2b88 [ 40.882145][ T4915] do_file_open+0x1c8/0x2e8 [ 40.882935][ T4915] do_sys_openat2+0x114/0x1e8 [ 40.883688][ T4915] do_sys_open+0xac/0xdc [ 40.884351][ T4915] __arm64_sys_openat+0xa0/0xbc [ 40.885128][ T4915] invoke_syscall+0x98/0x244 [ 40.885871][ T4915] el0_svc_common+0xec/0x23c [ 40.886627][ T4915] do_el0_svc+0x4c/0x5c [ 40.887287][ T4915] el0_svc+0x64/0x260 [ 40.887936][ T4915] el0t_64_sync_handler+0x48/0x148 [ 40.888797][ T4915] el0t_64_sync+0x198/0x19c [ 40.889493][ T4915] irq event stamp: 0 [ 40.890086][ T4915] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 40.891203][ T4915] hardirqs last disabled at (0): [] copy_process+0x1348/0x337c [ 40.892676][ T4915] softirqs last enabled at (0): [] copy_process+0x1368/0x337c [ 40.894266][ T4915] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 40.895458][ T4915] ---[ end trace 0000000000000000 ]--- 1970/01/01 00:00:41 executed programs: 42 [ 42.726998][ T50] Bluetooth: hci0: command tx timeout [ 44.806324][ T50] Bluetooth: hci0: command tx timeout 1970/01/01 00:00:46 executed programs: 333