[ 8.353602][ T4407] 8021q: adding VLAN 0 to HW filter on device bond0 [ 8.358795][ T4407] eql: remember to turn off Van-Jacobson compression on your slave devices Starting crond: [ 8.391115][ T3613] gve 0000:00:00.0 enp0s0: Device link is up. OK Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.177' (ED25519) to the list of known hosts. 1970/01/01 00:00:29 parsed 1 programs 1970/01/01 00:00:29 serving rpc on tcp://36777 syzkaller login: [ 30.921502][ T4729] cgroup: Unknown subsys name 'net' [ 31.051649][ T4729] cgroup: Unknown subsys name 'cpuset' [ 31.053885][ T4729] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 31.178018][ T4729] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 34.226206][ T3613] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.226235][ T3613] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.235260][ T3613] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.235289][ T3613] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.274594][ T4735] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 34.410643][ T4747] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 34.412386][ T4747] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 34.413591][ T4747] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 34.413953][ T4747] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 34.414219][ T4747] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 35.427611][ T4785] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.427982][ T4785] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.428059][ T4785] bridge_slave_0: entered allmulticast mode [ 35.428509][ T4785] bridge_slave_0: entered promiscuous mode [ 35.429415][ T4785] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.429445][ T4785] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.429489][ T4785] bridge_slave_1: entered allmulticast mode [ 35.429890][ T4785] bridge_slave_1: entered promiscuous mode [ 35.437590][ T4785] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 35.438425][ T4785] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 35.444528][ T4785] team0: Port device team_slave_0 added [ 35.445235][ T4785] team0: Port device team_slave_1 added [ 35.455465][ T4785] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 35.455491][ T4785] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.455512][ T4785] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 35.456462][ T4785] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 35.456470][ T4785] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.456484][ T4785] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 35.467080][ T4785] hsr_slave_0: entered promiscuous mode [ 35.467390][ T4785] hsr_slave_1: entered promiscuous mode [ 35.514933][ T4785] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 35.518565][ T4785] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 35.520935][ T4785] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 35.523549][ T4785] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 35.524572][ T4785] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 35.526135][ T4785] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 35.527325][ T4785] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 35.530515][ T4785] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 35.539617][ T4785] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.539695][ T4785] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.539852][ T4785] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.539880][ T4785] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.557275][ T4785] 8021q: adding VLAN 0 to HW filter on device bond0 [ 35.561730][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.563542][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.567782][ T4785] 8021q: adding VLAN 0 to HW filter on device team0 [ 35.570043][ T3836] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.570088][ T3836] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.574812][ T3836] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.574853][ T3836] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.670619][ T4785] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 35.682967][ T4785] veth0_vlan: entered promiscuous mode [ 35.684877][ T4785] veth1_vlan: entered promiscuous mode [ 35.692746][ T4785] veth0_macvtap: entered promiscuous mode [ 35.693894][ T4785] veth1_macvtap: entered promiscuous mode [ 35.698943][ T4785] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 35.706492][ T4785] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 35.720993][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.721213][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.721247][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.721263][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.795346][ T3613] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.853674][ T3613] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.928083][ T3613] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 36.014115][ T3613] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 1970/01/01 00:00:36 executed programs: 0 [ 36.125311][ T4747] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 36.127032][ T4747] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 36.128624][ T4747] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 36.130768][ T4747] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 36.132513][ T4747] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 36.263454][ T4833] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.263554][ T4833] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.263608][ T4833] bridge_slave_0: entered allmulticast mode [ 36.264114][ T4833] bridge_slave_0: entered promiscuous mode [ 36.264945][ T4833] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.264994][ T4833] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.265074][ T4833] bridge_slave_1: entered allmulticast mode [ 36.265447][ T4833] bridge_slave_1: entered promiscuous mode [ 36.272219][ T4833] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 36.273092][ T4833] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 36.279376][ T4833] team0: Port device team_slave_0 added [ 36.281208][ T4833] team0: Port device team_slave_1 added [ 36.288227][ T4833] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 36.289677][ T4833] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 36.290357][ T4833] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 36.291001][ T4833] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 36.291008][ T4833] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 36.291021][ T4833] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 36.301066][ T4833] hsr_slave_0: entered promiscuous mode [ 36.301351][ T4833] hsr_slave_1: entered promiscuous mode [ 36.301551][ T4833] debugfs: 'hsr0' already exists in 'hsr' [ 36.301611][ T4833] Cannot create hsr debugfs directory [ 38.170434][ T4747] Bluetooth: hci0: command tx timeout [ 39.336995][ T3613] bridge_slave_1: left allmulticast mode [ 39.337039][ T3613] bridge_slave_1: left promiscuous mode [ 39.337326][ T3613] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.339709][ T3613] bridge_slave_0: left allmulticast mode [ 39.339723][ T3613] bridge_slave_0: left promiscuous mode [ 39.339794][ T3613] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.395587][ T3613] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 39.421512][ T3613] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 39.460904][ T3613] bond0 (unregistering): Released all slaves [ 39.514523][ T3613] hsr_slave_0: left promiscuous mode [ 39.516671][ T3613] hsr_slave_1: left promiscuous mode [ 39.516962][ T3613] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 39.516988][ T3613] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 39.521820][ T3613] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 39.523305][ T3613] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 39.528161][ T3613] veth1_macvtap: left promiscuous mode [ 39.529347][ T3613] veth0_macvtap: left promiscuous mode [ 39.529430][ T3613] veth1_vlan: left promiscuous mode [ 39.533074][ T3613] veth0_vlan: left promiscuous mode [ 39.625171][ T3613] team0 (unregistering): Port device team_slave_1 removed [ 39.628868][ T3613] team0 (unregistering): Port device team_slave_0 removed [ 39.673502][ T4407] 8021q: adding VLAN 0 to HW filter on device eth0 [ 39.957520][ T4833] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 39.965756][ T4833] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 39.967863][ T4833] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 39.970846][ T4833] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 39.973219][ T4833] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 39.977393][ T4833] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 39.977746][ T4833] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 39.981413][ T4833] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 40.007044][ T4833] 8021q: adding VLAN 0 to HW filter on device bond0 [ 40.012594][ T4833] 8021q: adding VLAN 0 to HW filter on device team0 [ 40.082417][ T3613] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.082460][ T3613] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.086045][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.086082][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.096783][ T4833] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 40.206346][ T4833] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 40.219907][ T4833] veth0_vlan: entered promiscuous mode [ 40.221843][ T4833] veth1_vlan: entered promiscuous mode [ 40.228146][ T4833] veth0_macvtap: entered promiscuous mode [ 40.229555][ T4833] veth1_macvtap: entered promiscuous mode [ 40.234817][ T4833] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.235777][ T4833] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.260346][ T4747] Bluetooth: hci0: command tx timeout [ 40.265521][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.265557][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.267205][ T1464] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.267227][ T1464] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.267246][ T1464] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.269054][ T1464] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.269063][ T1464] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.271527][ T3613] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.343316][ T4935] ================================================================== [ 40.343331][ T4935] BUG: KASAN: slab-use-after-free in dvb_device_open+0xd0/0x254 [ 40.343350][ T4935] Read of size 8 at addr ffff0000cbd0b618 by task syz.0.19/4935 [ 40.343358][ T4935] [ 40.343363][ T4935] CPU: 1 UID: 0 PID: 4935 Comm: syz.0.19 Not tainted syzkaller #0 PREEMPT [ 40.343371][ T4935] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 40.343376][ T4935] Call trace: [ 40.343379][ T4935] show_stack+0x2c/0x3c (C) [ 40.343392][ T4935] __dump_stack+0x30/0x40 [ 40.343403][ T4935] dump_stack_lvl+0xd8/0x12c [ 40.343412][ T4935] print_address_description+0xb0/0x238 [ 40.343420][ T4935] print_report+0x68/0x84 [ 40.343427][ T4935] kasan_report+0x8c/0xc4 [ 40.343437][ T4935] __asan_report_load8_noabort+0x20/0x2c [ 40.343447][ T4935] dvb_device_open+0xd0/0x254 [ 40.343454][ T4935] chrdev_open+0x398/0x3e8 [ 40.343464][ T4935] ** replaying previous printk message ** [ 40.343464][ T4935] do_dentry_open+0x5c4/0xfc0 [ 40.343473][ T4935] vfs_open+0x44/0x2dc [ 40.343482][ T4935] path_openat+0x21fc/0x2a60 [ 40.343491][ T4935] do_file_open+0x1c8/0x2e8 [ 40.343498][ T4935] do_sys_openat2+0x114/0x1e8 [ 40.343508][ T4935] do_sys_open+0xb0/0xe0 [ 40.343517][ T4935] __arm64_sys_openat+0xa8/0xc4 [ 40.343526][ T4935] invoke_syscall+0x98/0x244 [ 40.343536][ T4935] el0_svc_common+0xec/0x23c [ 40.343546][ T4935] do_el0_svc+0x4c/0x5c [ 40.343555][ T4935] el0_svc+0x64/0x260 [ 40.343564][ T4935] el0t_64_sync_handler+0x44/0x104 [ 40.343572][ T4935] el0t_64_sync+0x198/0x19c [ 40.343580][ T4935] [ 40.343582][ T4935] Allocated by task 1: [ 40.343585][ T4935] kasan_save_track+0x40/0x78 [ 40.343593][ T4935] kasan_save_alloc_info+0x40/0x50 [ 40.343601][ T4935] __kasan_kmalloc+0x9c/0xb4 [ 40.343608][ T4935] __kmalloc_cache_noprof+0x2e8/0x5ec [ 40.343615][ T4935] dvb_register_device+0x1a4/0x16e0 [ 40.343621][ T4935] dvb_register_frontend+0x474/0x6d0 [ 40.343628][ T4935] vidtv_bridge_probe+0x5a4/0xa58 [ 40.343643][ T4935] platform_probe+0x100/0x1a4 [ 40.343650][ T4935] really_probe+0x29c/0x800 [ 40.343658][ T4935] __driver_probe_device+0x1e0/0x350 [ 40.343667][ T4935] driver_probe_device+0x6c/0x19c [ 40.343675][ T4935] __driver_attach+0x168/0x384 [ 40.343683][ T4935] bus_for_each_dev+0x128/0x1b4 [ 40.343690][ T4935] driver_attach+0x50/0x60 [ 40.343697][ T4935] bus_add_driver+0x208/0x500 [ 40.343704][ T4935] driver_register+0x220/0x310 [ 40.343712][ T4935] __platform_driver_register+0x90/0xa4 [ 40.343718][ T4935] vidtv_bridge_init+0x4c/0x74 [ 40.343725][ T4935] do_one_initcall+0x274/0xc38 [ 40.343734][ T4935] do_initcall_level+0x12c/0x1c4 [ 40.343742][ T4935] do_initcalls+0x70/0xd0 [ 40.343750][ T4935] do_basic_setup+0x7c/0x90 [ 40.343757][ T4935] kernel_init_freeable+0x268/0x3a8 [ 40.343765][ T4935] kernel_init+0x24/0x1dc [ 40.343773][ T4935] ret_from_fork+0x10/0x20 [ 40.343778][ T4935] [ 40.343780][ T4935] Freed by task 4933: [ 40.343783][ T4935] kasan_save_track+0x40/0x78 [ 40.343790][ T4935] kasan_save_free_info+0x54/0x6c [ 40.343797][ T4935] __kasan_slab_free+0x74/0xa4 [ 40.343804][ T4935] kfree+0x188/0x690 [ 40.343810][ T4935] dvb_device_put+0x64/0xd0 [ 40.343815][ T4935] dvb_device_open+0x23c/0x254 [ 40.343821][ T4935] chrdev_open+0x398/0x3e8 [ 40.343828][ T4935] do_dentry_open+0x5c4/0xfc0 [ 40.343836][ T4935] vfs_open+0x44/0x2dc [ 40.343843][ T4935] path_openat+0x21fc/0x2a60 [ 40.343850][ T4935] do_file_open+0x1c8/0x2e8 [ 40.343856][ T4935] do_sys_openat2+0x114/0x1e8 [ 40.343864][ T4935] do_sys_open+0xb0/0xe0 [ 40.343872][ T4935] __arm64_sys_openat+0xa8/0xc4 [ 40.343880][ T4935] invoke_syscall+0x98/0x244 [ 40.343888][ T4935] el0_svc_common+0xec/0x23c [ 40.343896][ T4935] do_el0_svc+0x4c/0x5c [ 40.343903][ T4935] el0_svc+0x64/0x260 [ 40.343910][ T4935] el0t_64_sync_handler+0x44/0x104 [ 40.343916][ T4935] el0t_64_sync+0x198/0x19c [ 40.343921][ T4935] [ 40.343923][ T4935] The buggy address belongs to the object at ffff0000cbd0b600 [ 40.343923][ T4935] which belongs to the cache kmalloc-256 of size 256 [ 40.343929][ T4935] The buggy address is located 24 bytes inside of [ 40.343929][ T4935] freed 256-byte region [ffff0000cbd0b600, ffff0000cbd0b700) [ 40.343936][ T4935] [ 40.343937][ T4935] The buggy address belongs to the physical page: [ 40.343941][ T4935] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10bd0a [ 40.343948][ T4935] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 40.343953][ T4935] flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 40.343961][ T4935] page_type: f5(slab) [ 40.343968][ T4935] raw: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122 [ 40.343974][ T4935] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 40.343980][ T4935] head: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122 [ 40.343985][ T4935] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 40.343990][ T4935] head: 05ffc00000000001 fffffdffc32f4281 00000000ffffffff 00000000ffffffff [ 40.343996][ T4935] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 40.343999][ T4935] page dumped because: kasan: bad access detected [ 40.344002][ T4935] [ 40.344003][ T4935] Memory state around the buggy address: [ 40.344007][ T4935] ffff0000cbd0b500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.344011][ T4935] ffff0000cbd0b580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.344015][ T4935] >ffff0000cbd0b600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.344018][ T4935] ^ [ 40.344022][ T4935] ffff0000cbd0b680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.344026][ T4935] ffff0000cbd0b700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.344029][ T4935] ================================================================== [ 40.361791][ T4935] Disabling lock debugging due to kernel taint [ 40.361811][ T4935] ------------[ cut here ]------------ [ 40.361825][ T4935] refcount_t: addition on 0; use-after-free. [ 40.361943][ T4935] WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x134/0x1f8, CPU#0: syz.0.19/4935 [ 40.450504][ T4935] Modules linked in: [ 40.451210][ T4935] CPU: 0 UID: 0 PID: 4935 Comm: syz.0.19 Tainted: G B syzkaller #0 PREEMPT [ 40.453005][ T4935] Tainted: [B]=BAD_PAGE [ 40.453724][ T4935] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 40.455553][ T4935] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 40.456915][ T4935] pc : refcount_warn_saturate+0x134/0x1f8 [ 40.457909][ T4935] lr : refcount_warn_saturate+0x134/0x1f8 [ 40.458943][ T4935] sp : ffff800095387640 [ 40.459689][ T4935] x29: ffff800095387640 x28: dfff800000000000 x27: 1fffe000199a5b51 [ 40.461134][ T4935] x26: dfff800000000000 x25: ffff700012a70edc x24: dfff800000000000 [ 40.462679][ T4935] x23: ffff80008746da28 x22: ffff0000cbd59400 x21: ffff0000cbd0b600 [ 40.464244][ T4935] x20: ffff0000cbd0b610 x19: ffff80008a19d000 x18: 1fffe00034bb7428 [ 40.465733][ T4935] x17: 0000000000000003 x16: ffff800088b37000 x15: 0000000000000000 [ 40.467236][ T4935] x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000000 [ 40.468722][ T4935] x11: 0000000000000000 x10: 0000000000000002 x9 : 6bdc2548fd769800 [ 40.470200][ T4935] x8 : 6bdc2548fd769800 x7 : 0000000000000000 x6 : ffff80008048c60c [ 40.471723][ T4935] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f6830 [ 40.473235][ T4935] x2 : 0000000100000000 x1 : ffff0000d1f00000 x0 : 0000000000000000 [ 40.474781][ T4935] Call trace: [ 40.475400][ T4935] refcount_warn_saturate+0x134/0x1f8 (P) [ 40.476447][ T4935] dvb_device_get+0x9c/0xc0 [ 40.477281][ T4935] dvb_device_open+0x100/0x254 [ 40.478168][ T4935] chrdev_open+0x398/0x3e8 [ 40.478982][ T4935] do_dentry_open+0x5c4/0xfc0 [ 40.479841][ T4935] vfs_open+0x44/0x2dc [ 40.480590][ T4935] path_openat+0x21fc/0x2a60 [ 40.481431][ T4935] do_file_open+0x1c8/0x2e8 [ 40.482211][ T4935] do_sys_openat2+0x114/0x1e8 [ 40.483033][ T4935] do_sys_open+0xb0/0xe0 [ 40.483805][ T4935] __arm64_sys_openat+0xa8/0xc4 [ 40.484677][ T4935] invoke_syscall+0x98/0x244 [ 40.485495][ T4935] el0_svc_common+0xec/0x23c [ 40.486343][ T4935] do_el0_svc+0x4c/0x5c [ 40.487107][ T4935] el0_svc+0x64/0x260 [ 40.487814][ T4935] el0t_64_sync_handler+0x44/0x104 [ 40.488731][ T4935] el0t_64_sync+0x198/0x19c [ 40.489525][ T4935] irq event stamp: 5593 [ 40.490277][ T4935] hardirqs last enabled at (5593): [] finish_task_switch+0x234/0x858 [ 40.492045][ T4935] hardirqs last disabled at (5592): [] __schedule+0x2f8/0x2d80 [ 40.493712][ T4935] softirqs last enabled at (5564): [] fpsimd_restore_current_state+0x39c/0x9c8 [ 40.495684][ T4935] softirqs last disabled at (5562): [] fpsimd_restore_current_state+0x44/0x9c8 [ 40.497558][ T4935] ---[ end trace 0000000000000000 ]--- [ 40.50178 ** replaying previous printk message ** [ 40.501785][ T4935] ------------[ cut here ]------------ [ 40.501824][ T4935] refcount_t: underflow; use-after-free. [ 40.502038][ T4935] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x154/0x1f8, CPU#0: syz.0.19/4935 [ 40.506323][ T4935] Modules linked in: [ 40.507008][ T4935] CPU: 0 UID: 0 PID: 4935 Comm: syz.0.19 Tainted: G B W syzkaller #0 PREEMPT [ 40.508999][ T4935] Tainted: [B]=BAD_PAGE, [W]=WARN [ 40.509921][ T4935] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 40.511862][ T4935] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 40.513413][ T4935] pc : refcount_warn_saturate+0x154/0x1f8 [ 40.514545][ T4935] lr : refcount_warn_saturate+0x154/0x1f8 [ 40.515687][ T4935] sp : ffff800095387540 [ 40.516486][ T4935] x29: ffff800095387540 x28: ffff0000ccd2da40 x27: ffff0000cb2a8010 [ 40.517973][ T4935] x26: dfff800000000000 x25: 1fffe000197a16c7 x24: ffff0000cb2a8060 [ 40.519500][ T4935] x23: 00000000fffffffc x22: ffff0000cbd0b63c x21: 00000000c0000000 [ 40.521052][ T4935] x20: ffff0000cbd0b610 x19: ffff80008a19d000 x18: 1fffe00034bb7428 [ 40.522538][ T4935] x17: 0000000000000003 x16: ffff800088b37000 x15: 0000000000000000 [ 40.524050][ T4935] x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000000 [ 40.525625][ T4935] x11: ffff800080156074 x10: 0000000000000003 x9 : 6bdc2548fd769800 [ 40.527108][ T4935] x8 : 6bdc2548fd769800 x7 : 0000000000000000 x6 : ffff8000803b6f44 [ 40.528633][ T4935] x5 : 0000000000000000 x4 : 0000000000000008 x3 : ffff80008015611c [ 40.530099][ T4935] x2 : 0000000000000000 x1 : ffff0000d1f00000 x0 : 0000000000000001 [ 40.531605][ T4935] Call trace: [ 40.532232][ T4935] refcount_warn_saturate+0x154/0x1f8 (P) [ 40.533330][ T4935] dvb_device_put+0xac/0xd0 [ 40.534189][ T4935] dvb_generic_release+0xec/0x158 [ 40.535160][ T4935] dvb_frontend_open+0x9cc/0x10a8 [ 40.536133][ T4935] dvb_device_open+0x1f8/0x254 [ 40.537019][ T4935] chrdev_open+0x398/0x3e8 [ 40.537810][ T4935] do_dentry_open+0x5c4/0xfc0 [ 40.538661][ T4935] vfs_open+0x44/0x2dc [ 40.539397][ T4935] path_openat+0x21fc/0x2a60 [ 40.540238][ T4935] do_file_open+0x1c8/0x2e8 [ 40.541065][ T4935] do_sys_openat2+0x114/0x1e8 [ 40.541923][ T4935] do_sys_open+0xb0/0xe0 [ 40.542716][ T4935] __arm64_sys_openat+0xa8/0xc4 [ 40.543630][ T4935] invoke_syscall+0x98/0x244 [ 40.544475][ T4935] el0_svc_common+0xec/0x23c [ 40.545348][ T4935] do_el0_svc+0x4c/0x5c [ 40.546116][ T4935] el0_svc+0x64/0x260 [ 40.546878][ T4935] el0t_64_sync_handler+0x44/0x104 [ 40.547882][ T4935] el0t_64_sync+0x198/0x19c [ 40.548775][ T4935] irq event stamp: 5593 [ 40.549548][ T4935] hardirqs last enabled at (5593): [] finish_task_switch+0x234/0x858 [ 40.551467][ T4935] hardirqs last disabled at (5592): [] __schedule+0x2f8/0x2d80 [ 40.553232][ T4935] softirqs last enabled at (5564): [] fpsimd_restore_current_state+0x39c/0x9c8 [ 40.555318][ T4935] softirqs last disabled at (5562): [] fpsimd_restore_current_state+0x44/0x9c8 [ 40.557332][ T4935] ---[ end trace 0000000000000000 ]--- [ 40.568536][ T4937] ------------[ cut here ]------------ [ 40.568556][ T4937] refcount_t: saturated; leaking memory. [ 40.571235][ T4937] WARNING: lib/refcount.c:22 at refcount_warn_saturate+0x1b4/0x1f8, CPU#1: syz.0.20/4937 [ 40.573042][ T4937] Modules linked in: [ 40.573787][ T4937] CPU: 1 UID: 0 PID: 4937 Comm: syz.0.20 Tainted: G B W syzkaller #0 PREEMPT [ 40.575668][ T4937] Tainted: [B]=BAD_PAGE, [W]=WARN [ 40.576601][ T4937] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 40.578493][ T4937] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 40.579953][ T4937] pc : refcount_warn_saturate+0x1b4/0x1f8 [ 40.581027][ T4937] lr : refcount_warn_saturate+0x1b4/0x1f8 [ 40.582119][ T4937] sp : ffff800095577640 [ 40.582910][ T4937] x29: ffff800095577640 x28: dfff800000000000 x27: 1fffe000188a2d21 [ 40.584455][ T4937] x26: dfff800000000000 x25: ffff700012aaeedc x24: dfff800000000000 [ 40.585964][ T4937] x23: ffff80008746da28 x22: ffff0000cbd59400 x21: 000000007ffffffe [ 40.587514][ T4937] x20: ffff0000cbd0b610 x19: ffff80008a19d000 x18: 1fffe00034bbbe28 [ 40.589082][ T4937] x17: 0000000000000003 x16: ffff800088b37000 x15: ffff800088bed220 [ 40.590612][ T4937] x14: ffff0001a5ddf14c x13: 0000000000000001 x12: 0000000000000000 [ 40.592159][ T4937] x11: 0000000000000000 x10: 0000000000000003 x9 : 69dc7164544aa100 [ 40.593725][ T4937] x8 : 69dc7164544aa100 x7 : 0000000000000000 x6 : ffff8000803b6f44 [ 40.595274][ T4937] x5 : 0000000000000000 x4 : 0000000000000008 x3 : ffff8000803b70b8 [ 40.596905][ T4937] x2 : 0000000000000001 x1 : ffff0000c2f39d40 x0 : 0000000000000001 [ 40.598510][ T4937] Call trace: [ 40.599143][ T4937] refcount_warn_saturate+0x1b4/0x1f8 (P) [ 40.600269][ T4937] dvb_device_get+0x9c/0xc0 [ 40.601109][ T4937] dvb_device_open+0x100/0x254 [ 40.601996][ T4937] chrdev_open+0x398/0x3e8 [ 40.602817][ T4937] do_dentry_open+0x5c4/0xfc0 [ 40.603661][ T4937] vfs_open+0x44/0x2dc [ 40.604391][ T4937] path_openat+0x21fc/0x2a60 [ 40.605230][ T4937] do_file_open+0x1c8/0x2e8 [ 40.606051][ T4937] do_sys_openat2+0x114/0x1e8 [ 40.606926][ T4937] do_sys_open+0xb0/0xe0 [ 40.607762][ T4937] __arm64_sys_openat+0xa8/0xc4 [ 40.608685][ T4937] invoke_syscall+0x98/0x244 [ 40.609561][ T4937] el0_svc_common+0xec/0x23c [ 40.610427][ T4937] do_el0_svc+0x4c/0x5c [ 40.611209][ T4937] el0_svc+0x64/0x260 [ 40.611954][ T4937] el0t_64_sync_handler+0x44/0x104 [ 40.612912][ T4937] el0t_64_sync+0x198/0x19c [ 40.613744][ T4937] irq event stamp: 0 [ 40.614472][ T4937] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 40.615761][ T4937] hardirqs last disabled at (0): [] copy_process+0x1384/0x32e8 [ 40.617427][ T4937] softirqs last enabled at (0): [] copy_process+0x13a4/0x32e8 [ 40.619150][ T4937] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 40.620488][ T4937] ---[ end trace 0000000000000000 ]--- 1970/01/01 00:00:41 executed programs: 33 [ 42.330079][ T4747] Bluetooth: hci0: command tx timeout [ 44.411151][ T4747] Bluetooth: hci0: command tx timeout 1970/01/01 00:00:46 executed programs: 324