Warning: Permanently added '10.128.0.16' (ED25519) to the list of known hosts. 1970/01/01 00:00:32 parsed 1 programs 1970/01/01 00:00:32 serving rpc on tcp://44673 [ 33.671062][ T4716] cgroup: Unknown subsys name 'net' [ 33.801072][ T4716] cgroup: Unknown subsys name 'cpuset' [ 33.803114][ T4716] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 34.023040][ T4716] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 37.067422][ T4729] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 37.067984][ T4729] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 37.068195][ T4729] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 37.068502][ T4729] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 37.068712][ T4729] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 37.142608][ T4728] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 37.767232][ T4760] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.767517][ T4760] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.767583][ T4760] bridge_slave_0: entered allmulticast mode [ 37.768032][ T4760] bridge_slave_0: entered promiscuous mode [ 37.769203][ T4760] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.769249][ T4760] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.769290][ T4760] bridge_slave_1: entered allmulticast mode [ 37.770372][ T4760] bridge_slave_1: entered promiscuous mode [ 37.777748][ T4760] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.778559][ T4760] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 37.784739][ T4760] team0: Port device team_slave_0 added [ 37.785442][ T4760] team0: Port device team_slave_1 added [ 37.792504][ T4760] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 37.792534][ T4760] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 37.792547][ T4760] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 37.793272][ T4760] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 37.793278][ T4760] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 37.793291][ T4760] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.802766][ T4760] hsr_slave_0: entered promiscuous mode [ 37.803064][ T4760] hsr_slave_1: entered promiscuous mode [ 37.846670][ T4760] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 37.850399][ T4760] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 37.850731][ T4760] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 37.853170][ T4760] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 37.853467][ T4760] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 37.855625][ T4760] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 37.856119][ T4760] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 37.857488][ T4760] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 37.866736][ T4760] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.866794][ T4760] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.866941][ T4760] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.866970][ T4760] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.883778][ T4760] 8021q: adding VLAN 0 to HW filter on device bond0 [ 37.887171][ T1275] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.888965][ T1275] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.892976][ T4760] 8021q: adding VLAN 0 to HW filter on device team0 [ 37.894966][ T1275] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.895010][ T1275] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.898258][ T1275] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.898295][ T1275] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.998537][ T4760] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.010322][ T4760] veth0_vlan: entered promiscuous mode [ 38.012042][ T4760] veth1_vlan: entered promiscuous mode [ 38.019178][ T4760] veth0_macvtap: entered promiscuous mode [ 38.021381][ T4760] veth1_macvtap: entered promiscuous mode [ 38.025451][ T4760] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 38.027219][ T4760] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 38.032331][ T1275] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.034121][ T1275] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.035953][ T1275] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.037555][ T1275] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.125123][ T40] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 38.192388][ T40] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 38.273485][ T40] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 38.353190][ T40] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 38.443959][ T39] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 38.443986][ T39] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 38.453856][ T15] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 38.453878][ T15] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 1970/01/01 00:00:38 executed programs: 0 [ 38.944506][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 38.946255][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 38.947753][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 38.949427][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 38.951222][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 39.084116][ T4829] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.084199][ T4829] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.084260][ T4829] bridge_slave_0: entered allmulticast mode [ 39.084688][ T4829] bridge_slave_0: entered promiscuous mode [ 39.085541][ T4829] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.085587][ T4829] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.085639][ T4829] bridge_slave_1: entered allmulticast mode [ 39.086057][ T4829] bridge_slave_1: entered promiscuous mode [ 39.093824][ T4829] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 39.094894][ T4829] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 39.101716][ T4829] team0: Port device team_slave_0 added [ 39.102494][ T4829] team0: Port device team_slave_1 added [ 39.108096][ T4829] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 39.108119][ T4829] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.108139][ T4829] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 39.108677][ T4829] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 39.108685][ T4829] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.108701][ T4829] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 39.119141][ T4829] hsr_slave_0: entered promiscuous mode [ 39.120616][ T4829] hsr_slave_1: entered promiscuous mode [ 39.120845][ T4829] debugfs: 'hsr0' already exists in 'hsr' [ 39.120885][ T4829] Cannot create hsr debugfs directory [ 40.970195][ T50] Bluetooth: hci0: command tx timeout [ 41.809638][ T40] bridge_slave_1: left allmulticast mode [ 41.809692][ T40] bridge_slave_1: left promiscuous mode [ 41.810281][ T40] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.813370][ T40] bridge_slave_0: left allmulticast mode [ 41.813393][ T40] bridge_slave_0: left promiscuous mode [ 41.813469][ T40] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.934114][ T40] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 41.970853][ T40] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 41.990555][ T40] bond0 (unregistering): Released all slaves [ 42.056507][ T40] hsr_slave_0: left promiscuous mode [ 42.058144][ T40] hsr_slave_1: left promiscuous mode [ 42.058413][ T40] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 42.058436][ T40] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 42.066172][ T40] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 42.069206][ T40] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 42.074829][ T40] veth1_macvtap: left promiscuous mode [ 42.076004][ T40] veth0_macvtap: left promiscuous mode [ 42.077089][ T40] veth1_vlan: left promiscuous mode [ 42.078161][ T40] veth0_vlan: left promiscuous mode [ 42.168236][ T40] team0 (unregistering): Port device team_slave_1 removed [ 42.172134][ T40] team0 (unregistering): Port device team_slave_0 removed [ 42.217784][ T4393] 8021q: adding VLAN 0 to HW filter on device eth0 [ 42.484715][ T4829] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 42.488633][ T4829] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 42.490448][ T4829] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 42.493305][ T4829] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 42.495560][ T4829] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 42.497868][ T4829] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 42.504606][ T4829] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 42.507286][ T4829] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 42.667222][ T4829] 8021q: adding VLAN 0 to HW filter on device bond0 [ 42.683986][ T4829] 8021q: adding VLAN 0 to HW filter on device team0 [ 42.695230][ T15] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.695271][ T15] bridge0: port 1(bridge_slave_0) entered forwarding state [ 42.695827][ T15] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.695855][ T15] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.825819][ T4829] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 42.852408][ T4829] veth0_vlan: entered promiscuous mode [ 42.855421][ T4829] veth1_vlan: entered promiscuous mode [ 42.861412][ T4829] veth0_macvtap: entered promiscuous mode [ 42.862485][ T4829] veth1_macvtap: entered promiscuous mode [ 42.866492][ T4829] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 42.867489][ T4829] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 42.869948][ T15] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.873720][ T15] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.874066][ T15] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.874088][ T15] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.903533][ T15] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.903558][ T15] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.927840][ T1275] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.927869][ T1275] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.983861][ T4920] ================================================================== [ ** replaying previous printk message ** [ 42.983875][ T4920] BUG: KASAN: slab-use-after-free in dvb_device_open+0xd0/0x254 [ 42.983899][ T4920] Read of size 8 at addr ffff0000cc99ec18 by task syz.0.19/4920 [ 42.983906][ T4920] [ 42.983911][ T4920] CPU: 1 UID: 0 PID: 4920 Comm: syz.0.19 Not tainted syzkaller #0 PREEMPT [ 42.983919][ T4920] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 [ 42.983923][ T4920] Call trace: [ 42.983925][ T4920] show_stack+0x2c/0x3c (C) [ 42.983938][ T4920] __dump_stack+0x30/0x40 [ 42.983950][ T4920] dump_stack_lvl+0xd8/0x12c [ 42.983959][ T4920] print_address_description+0xb0/0x238 [ 42.983967][ T4920] print_report+0x68/0x84 [ 42.983973][ T4920] kasan_report+0x8c/0xc4 [ 42.983984][ T4920] __asan_report_load8_noabort+0x20/0x2c [ 42.983994][ T4920] dvb_device_open+0xd0/0x254 [ 42.984004][ T4920] chrdev_open+0x398/0x3e8 [ 42.984012][ T4920] do_dentry_open+0x5c4/0xfb8 [ 42.984021][ T4920] vfs_open+0x44/0x2dc [ 42.984029][ T4920] path_openat+0x22d4/0x2b88 [ 42.984037][ T4920] do_file_open+0x1c8/0x2e8 [ 42.984044][ T4920] do_sys_openat2+0x114/0x1e8 [ 42.984053][ T4920] do_sys_open+0xac/0xdc [ 42.984061][ T4920] __arm64_sys_openat+0xa0/0xbc [ 42.984070][ T4920] invoke_syscall+0x98/0x244 [ 42.984080][ T4920] el0_svc_common+0xec/0x23c [ 42.984089][ T4920] do_el0_svc+0x4c/0x5c [ 42.984098][ T4920] el0_svc+0x64/0x260 [ 42.984106][ T4920] el0t_64_sync_handler+0x48/0x148 [ 42.984113][ T4920] el0t_64_sync+0x198/0x19c [ 42.984120][ T4920] [ 42.984122][ T4920] Allocated by task 1: [ 42.984126][ T4920] kasan_save_track+0x40/0x78 [ 42.984133][ T4920] kasan_save_alloc_info+0x44/0x54 [ 42.984141][ T4920] __kasan_kmalloc+0x9c/0xb4 [ 42.984148][ T4920] __kmalloc_cache_noprof+0x2d4/0x624 [ 42.984155][ T4920] dvb_register_device+0x1a4/0x16e0 [ 42.984164][ T4920] dvb_register_frontend+0x474/0x6d0 [ 42.984170][ T4920] vidtv_bridge_probe+0x5a4/0xa58 [ 42.984178][ T4920] platform_probe+0x100/0x1a4 [ 42.984186][ T4920] really_probe+0x29c/0x800 [ 42.984191][ T4920] __driver_probe_device+0x1e0/0x34c [ 42.984196][ T4920] driver_probe_device+0x6c/0x19c [ 42.984202][ T4920] __driver_attach+0x164/0x37c [ 42.984207][ T4920] bus_for_each_dev+0x128/0x1b4 [ 42.984214][ T4920] driver_attach+0x50/0x60 [ 42.984219][ T4920] bus_add_driver+0x208/0x500 [ 42.984226][ T4920] driver_register+0x220/0x310 [ 42.984232][ T4920] __platform_driver_register+0x70/0x84 [ 42.984238][ T4920] vidtv_bridge_init+0x34/0x5c [ 42.984245][ T4920] do_one_initcall+0x274/0xc38 [ 42.984253][ T4920] do_initcall_level+0x12c/0x1c4 [ 42.984261][ T4920] do_initcalls+0x70/0xd0 [ 42.984267][ T4920] do_basic_setup+0x7c/0x90 [ 42.984274][ T4920] kernel_init_freeable+0x268/0x3a8 [ 42.984281][ T4920] kernel_init+0x24/0x1dc [ 42.984288][ T4920] ret_from_fork+0x10/0x20 [ 42.984293][ T4920] [ 42.984295][ T4920] Freed by task 4919: [ 42.984298][ T4920] kasan_save_track+0x40/0x78 [ 42.984305][ T4920] kasan_save_free_info+0x58/0x70 [ 42.984312][ T4920] __kasan_slab_free+0x74/0xa4 [ 42.984319][ T4920] kfree+0x188/0x690 [ 42.984325][ T4920] dvb_device_put+0x64/0xd0 [ 42.984340][ T4920] dvb_device_open+0x23c/0x254 [ 42.984349][ T4920] chrdev_open+0x398/0x3e8 [ 42.984355][ T4920] do_dentry_open+0x5c4/0xfb8 [ 42.984362][ T4920] vfs_open+0x44/0x2dc [ 42.984369][ T4920] path_openat+0x22d4/0x2b88 [ 42.984375][ T4920] do_file_open+0x1c8/0x2e8 [ 42.984381][ T4920] do_sys_openat2+0x114/0x1e8 [ 42.984388][ T4920] do_sys_open+0xac/0xdc [ 42.984395][ T4920] __arm64_sys_openat+0xa0/0xbc [ 42.984402][ T4920] invoke_syscall+0x98/0x244 [ 42.984410][ T4920] el0_svc_common+0xec/0x23c [ 42.984418][ T4920] do_el0_svc+0x4c/0x5c [ 42.984425][ T4920] el0_svc+0x64/0x260 [ 42.984430][ T4920] el0t_64_sync_handler+0x48/0x148 [ 42.984436][ T4920] el0t_64_sync+0x198/0x19c [ 42.984441][ T4920] [ 42.984443][ T4920] The buggy address belongs to the object at ffff0000cc99ec00 [ 42.984443][ T4920] which belongs to the cache kmalloc-256 of size 256 [ 42.984449][ T4920] The buggy address is located 24 bytes inside of [ 42.984449][ T4920] freed 256-byte region [ffff0000cc99ec00, ffff0000cc99ed00) [ 42.984455][ T4920] [ 42.984457][ T4920] The buggy address belongs to the physical page: [ 42.984461][ T4920] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10c99e [ 42.984467][ T4920] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 42.984473][ T4920] flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 42.984480][ T4920] page_type: f5(slab) [ 42.984487][ T4920] raw: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122 [ 42.984492][ T4920] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 42.984497][ T4920] head: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122 [ 42.984503][ T4920] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 42.984508][ T4920] head: 05ffc00000000001 fffffdffc3326781 00000000ffffffff 00000000ffffffff [ 42.984513][ T4920] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 42.984516][ T4920] page dumped because: kasan: bad access detected [ 42.984519][ T4920] [ 42.984521][ T4920] Memory state around the buggy address: [ 42.984524][ T4920] ffff0000cc99eb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.984528][ T4920] ffff0000cc99eb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.984532][ T4920] >ffff0000cc99ec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.984535][ T4920] ^ [ 42.984539][ T4920] ffff0000cc99ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.984543][ T4920] ffff0000cc99ed00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.984546][ T4920] ================================================================== [ 42.985919][ T4920] Disabling lock debugging due to kernel taint [ 42.985935][ T4920] ------------[ cut here ]------------ [ 42.985949][ T4920] refcount_t: addition on 0; use-after-free. [ 42.986059][ T4920] WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x134/0x1f8, CPU#1: syz.0.19/4920 [ 43.086595][ T4920] Modules linked in: [ 43.087238][ T4920] CPU: 1 UID: 0 PID: 4920 Comm: syz.0.19 Tainted: G B syzkaller #0 PREEMPT [ 43.088990][ T4920] Tainted: [B]=BAD_PAGE [ 43.089735][ T4920] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 [ 43.091447][ T4920] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 43.092747][ T4920] pc : refcount_warn_saturate+0x134/0x1f8 [ 43.093731][ T4920] lr : refcount_warn_saturate+0x134/0x1f8 [ 43.094752][ T4920] sp : ffff800092b37560 [ 43.095442][ T4920] x29: ffff800092b37560 x28: dfff800000000000 x27: 1fffe00018bfa441 [ 43.096819][ T4920] x26: dfff800000000000 x25: ffff700012566ec0 x24: dfff800000000000 [ 43.098264][ T4920] x23: ffff8000873840e8 x22: ffff0000cc2c8c00 x21: ffff0000cc99ec00 [ 43.099605][ T4920] x20: ffff0000cc99ec10 x19: ffff80008a04a000 x18: 1fffe00035bf0220 [ 43.100989][ T4920] x17: 0000000000000003 x16: ffff800088a0b000 x15: 0000000000000000 [ 43.102345][ T4920] x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000000 [ 43.103673][ T4920] x11: 0000000000000000 x10: 0000000000000002 x9 : 956b6afc9b506900 [ 43.105103][ T4920] x8 : 956b6afc9b506900 x7 : 0000000000000000 x6 : ffff80008048076c [ 43.106470][ T4920] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f45e0 [ 43.107890][ T4920] x2 : 0000000100000000 x1 : ffff0000d4f6ba00 x0 : 0000000000000000 [ 43.109280][ T4920] Call trace: [ 43.109797][ T4920] refcount_warn_saturate+0x134/0x1f8 (P) [ 43.110774][ T4920] dvb_device_get+0x9c/0xc0 [ 43.111528][ T4920] dvb_device_open+0x100/0x254 [ 43.112317][ T4920] chrdev_open+0x398/0x3e8 [ 43.113125][ T4920] do_dentry_open+0x5c4/0xfb8 [ 43.113929][ T4920] vfs_open+0x44/0x2dc [ 43.114619][ T4920] path_openat+0x22d4/0x2b88 [ 43.115402][ T4920] do_file_open+0x1c8/0x2e8 [ 43.116102][ T4920] do_sys_openat2+0x114/0x1e8 [ 43.116874][ T4920] do_sys_open+0xac/0xdc [ 43.117612][ T4920] __arm64_sys_openat+0xa0/0xbc [ 43.118465][ T4920] invoke_syscall+0x98/0x244 [ 43.119214][ T4920] el0_svc_common+0xec/0x23c [ 43.119980][ T4920] do_el0_svc+0x4c/0x5c [ 43.120603][ T4920] el0_svc+0x64/0x260 [ 43.121294][ T4920] el0t_64_sync_handler+0x48/0x148 [ 43.122232][ T4920] el0t_64_sync+0x198/0x19c [ 43.122975][ T4920] irq event stamp: 931 [ 43.123677][ T4920] hardirqs last enabled at (931): [] finish_task_switch+0x234/0x7b8 [ 43.125308][ T4920] hardirqs last disabled at (930): [] __schedule+0x2fc/0x2db8 [ 43.126893][ T4920] softirqs last enabled at (894): [] fpsimd_restore_current_state+0x39c/0x9c8 [ 43.128703][ T4920] softirqs last disabled at (892): [] fpsimd_restore_current_state+0x44/0x9c8 [ 43.130450][ T4920] ---[ end trace 0000000000000000 ]--- [ 43.132706][ T50] Bluetooth: hci0: command tx timeout [ ** replaying previous printk message ** [ 43.135293][ T4920] ------------[ cut here ]------------ [ 43.135323][ T4920] refcount_t: underflow; use-after-free. [ 43.135445][ T4920] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x154/0x1f8, CPU#0: syz.0.19/4920 [ 43.139537][ T4920] Modules linked in: [ 43.140275][ T4920] CPU: 0 UID: 0 PID: 4920 Comm: syz.0.19 Tainted: G B W syzkaller #0 PREEMPT [ 43.142127][ T4920] Tainted: [B]=BAD_PAGE, [W]=WARN [ 43.142935][ T4920] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 [ 43.144639][ T4920] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 43.146037][ T4920] pc : refcount_warn_saturate+0x154/0x1f8 [ 43.147122][ T4920] lr : refcount_warn_saturate+0x154/0x1f8 [ 43.148103][ T4920] sp : ffff800092b37460 [ 43.148789][ T4920] x29: ffff800092b37460 x28: ffff0000c5fd21c0 x27: ffff0000cc248010 [ 43.150167][ T4920] x26: dfff800000000000 x25: 1fffe00019933d87 x24: ffff0000cc248060 [ 43.151519][ T4920] x23: 00000000fffffffc x22: ffff0000cc99ec3c x21: 00000000c0000000 [ 43.152972][ T4920] x20: ffff0000cc99ec10 x19: ffff80008a04a000 x18: 1fffe00035bf0220 [ 43.154359][ T4920] x17: 0000000000000003 x16: ffff800088a0b000 x15: 0000000000000000 [ 43.155721][ T4920] x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000000 [ 43.157131][ T4920] x11: 0000000000000000 x10: 0000000000000002 x9 : 956b6afc9b506900 [ 43.158572][ T4920] x8 : 956b6afc9b506900 x7 : 0000000000000000 x6 : ffff80008048076c [ 43.159936][ T4920] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f45e0 [ 43.161444][ T4920] x2 : 0000000100000000 x1 : ffff0000d4f6ba00 x0 : 0000000000000000 [ 43.162852][ T4920] Call trace: [ 43.163439][ T4920] refcount_warn_saturate+0x154/0x1f8 (P) [ 43.164406][ T4920] dvb_device_put+0xac/0xd0 [ 43.165213][ T4920] dvb_generic_release+0xec/0x158 [ 43.166060][ T4920] dvb_frontend_open+0x9cc/0x10a8 [ 43.166919][ T4920] dvb_device_open+0x1f8/0x254 [ 43.167717][ T4920] chrdev_open+0x398/0x3e8 [ 43.168498][ T4920] do_dentry_open+0x5c4/0xfb8 [ 43.169302][ T4920] vfs_open+0x44/0x2dc [ 43.170021][ T4920] path_openat+0x22d4/0x2b88 [ 43.170819][ T4920] do_file_open+0x1c8/0x2e8 [ 43.171634][ T4920] do_sys_openat2+0x114/0x1e8 [ 43.172494][ T4920] do_sys_open+0xac/0xdc [ 43.173266][ T4920] __arm64_sys_openat+0xa0/0xbc [ 43.174146][ T4920] invoke_syscall+0x98/0x244 [ 43.174957][ T4920] el0_svc_common+0xec/0x23c [ 43.175799][ T4920] do_el0_svc+0x4c/0x5c [ 43.176550][ T4920] el0_svc+0x64/0x260 [ 43.177294][ T4920] el0t_64_sync_handler+0x48/0x148 [ 43.178243][ T4920] el0t_64_sync+0x198/0x19c [ 43.179000][ T4920] irq event stamp: 931 [ 43.179744][ T4920] hardirqs last enabled at (931): [] finish_task_switch+0x234/0x7b8 [ 43.181469][ T4920] hardirqs last disabled at (930): [] __schedule+0x2fc/0x2db8 [ 43.182985][ T4920] softirqs last enabled at (894): [] fpsimd_restore_current_state+0x39c/0x9c8 [ 43.184901][ T4920] softirqs last disabled at (892): [] fpsimd_restore_current_state+0x44/0x9c8 [ 43.186764][ T4920] ---[ end trace 0000000000000000 ]--- [ 43.199922][ T4921] ------------[ cut here ]------------ [ 43.199940][ T4921] refcount_t: saturated; leaking memory. [ 43.200053][ T4921] WARNING: lib/refcount.c:22 at refcount_warn_saturate+0x1b4/0x1f8, CPU#1: syz.0.20/4921 [ 43.203484][ T4921] Modules linked in: [ 43.204103][ T4921] CPU: 1 UID: 0 PID: 4921 Comm: syz.0.20 Tainted: G B W syzkaller #0 PREEMPT [ 43.205742][ T4921] Tainted: [B]=BAD_PAGE, [W]=WARN [ 43.206514][ T4921] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 [ 43.208068][ T4921] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 43.209429][ T4921] pc : refcount_warn_saturate+0x1b4/0x1f8 [ 43.210457][ T4921] lr : refcount_warn_saturate+0x1b4/0x1f8 [ 43.211467][ T4921] sp : ffff800092b37560 [ 43.212238][ T4921] x29: ffff800092b37560 x28: dfff800000000000 x27: 1fffe00019754ae1 [ 43.213625][ T4921] x26: dfff800000000000 x25: ffff700012566ec0 x24: dfff800000000000 [ 43.215056][ T4921] x23: ffff8000873840e8 x22: ffff0000cc2c8c00 x21: 000000007ffffffe [ 43.216390][ T4921] x20: ffff0000cc99ec10 x19: ffff80008a04a000 x18: 0000000000000000 [ 43.217679][ T4921] x17: 0000000000000000 x16: ffff0001fea148f8 x15: ffff0001fea148f8 [ 43.219093][ T4921] x14: 00000000ffff8000 x13: 0000000000000001 x12: 0000000000000000 [ 43.220469][ T4921] x11: 0000000000000000 x10: 0000000000000002 x9 : 591dbd2774970300 [ 43.221901][ T4921] x8 : 591dbd2774970300 x7 : 0000000000000000 x6 : ffff80008048076c [ 43.223253][ T4921] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f45e0 [ 43.224574][ T4921] x2 : 0000000100000000 x1 : ffff0000d5a75700 x0 : 0000000000000000 [ 43.225884][ T4921] Call trace: [ 43.226458][ T4921] refcount_warn_saturate+0x1b4/0x1f8 (P) [ 43.227408][ T4921] dvb_device_get+0x9c/0xc0 [ 43.228238][ T4921] dvb_device_open+0x100/0x254 [ 43.229094][ T4921] chrdev_open+0x398/0x3e8 [ 43.229870][ T4921] do_dentry_open+0x5c4/0xfb8 [ 43.230674][ T4921] vfs_open+0x44/0x2dc [ 43.231335][ T4921] path_openat+0x22d4/0x2b88 [ 43.232067][ T4921] do_file_open+0x1c8/0x2e8 [ 43.232853][ T4921] do_sys_openat2+0x114/0x1e8 [ 43.233671][ T4921] do_sys_open+0xac/0xdc [ 43.234374][ T4921] __arm64_sys_openat+0xa0/0xbc [ 43.235195][ T4921] invoke_syscall+0x98/0x244 [ 43.235985][ T4921] el0_svc_common+0xec/0x23c [ 43.236819][ T4921] do_el0_svc+0x4c/0x5c [ 43.237610][ T4921] el0_svc+0x64/0x260 [ 43.238311][ T4921] el0t_64_sync_handler+0x48/0x148 [ 43.239238][ T4921] el0t_64_sync+0x198/0x19c [ 43.240117][ T4921] irq event stamp: 0 [ 43.240734][ T4921] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 43.241935][ T4921] hardirqs last disabled at (0): [] copy_process+0x1348/0x337c [ 43.243506][ T4921] softirqs last enabled at (0): [] copy_process+0x1368/0x337c [ 43.245087][ T4921] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 43.246351][ T4921] ---[ end trace 0000000000000000 ]--- 1970/01/01 00:00:43 executed programs: 45 [ 45.209567][ T50] Bluetooth: hci0: command tx timeout [ 47.289537][ T50] Bluetooth: hci0: command tx timeout 1970/01/01 00:00:48 executed programs: 340