Warning: Permanently added '10.128.1.46' (ED25519) to the list of known hosts. 2026/05/24 18:17:09 parsed 1 programs syzkaller login: [ 88.390896][ T5789] cgroup: Unknown subsys name 'net' [ 88.528905][ T5789] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 90.236566][ T5789] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 91.993008][ T787] cfg80211: failed to load regulatory.db [ 93.769484][ T5849] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 93.778086][ T5849] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 93.796271][ T5849] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 93.804716][ T5849] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 93.815182][ T5849] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 93.824141][ T5849] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 94.310884][ T5839] chnl_net:caif_netlink_parms(): no params data found [ 94.600888][ T5839] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.608679][ T5839] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.628924][ T5839] bridge_slave_0: entered allmulticast mode [ 94.641330][ T5839] bridge_slave_0: entered promiscuous mode [ 94.676658][ T5839] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.684976][ T5839] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.694040][ T5839] bridge_slave_1: entered allmulticast mode [ 94.702405][ T5839] bridge_slave_1: entered promiscuous mode [ 94.891677][ T3503] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.900244][ T3503] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.041388][ T5839] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 95.213785][ T5839] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 95.329204][ T3503] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.351259][ T3503] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.397145][ T5839] team0: Port device team_slave_0 added [ 95.475985][ T5839] team0: Port device team_slave_1 added [ 95.610072][ T5839] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 95.626615][ T5839] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 95.658550][ T5839] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 95.728899][ T5839] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 95.736033][ T5839] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 95.770880][ T5839] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 95.905787][ T5839] hsr_slave_0: entered promiscuous mode [ 95.921063][ T5839] hsr_slave_1: entered promiscuous mode [ 96.425341][ T5839] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 96.459308][ T5839] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 96.487083][ T5839] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 96.499709][ T5839] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 96.623536][ T5839] 8021q: adding VLAN 0 to HW filter on device bond0 [ 96.646386][ T5839] 8021q: adding VLAN 0 to HW filter on device team0 [ 96.660074][ T34] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.667462][ T34] bridge0: port 1(bridge_slave_0) entered forwarding state [ 96.682889][ T2908] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.690059][ T2908] bridge0: port 2(bridge_slave_1) entered forwarding state [ 96.910224][ T5839] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 96.975667][ T5839] veth0_vlan: entered promiscuous mode [ 96.988258][ T5839] veth1_vlan: entered promiscuous mode [ 97.028502][ T5839] veth0_macvtap: entered promiscuous mode [ 97.039062][ T5839] veth1_macvtap: entered promiscuous mode [ 97.058711][ T5839] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 97.069890][ T5839] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 97.099410][ T5839] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.108689][ T5839] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.120428][ T5839] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.129230][ T5839] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 2026/05/24 18:17:20 executed programs: 0 [ 97.337743][ T5086] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 97.350827][ T5086] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 97.359194][ T5086] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 97.368931][ T5086] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 97.402735][ T5086] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 97.410170][ T5086] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 97.492075][ T51] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 97.500215][ T51] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 97.517793][ T51] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 97.545194][ T51] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 97.552891][ T51] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 97.553257][ T5905] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 97.578351][ T5905] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 97.589152][ T5086] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 97.599420][ T5086] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 97.615936][ T5086] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 97.634872][ T5086] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 97.645571][ T5086] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 97.689728][ T5849] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 97.699265][ T5849] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 97.709360][ T5849] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 97.734689][ T5849] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 97.749638][ T5849] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 97.757647][ T5849] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 97.994437][ T12] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 98.225586][ T5894] chnl_net:caif_netlink_parms(): no params data found [ 98.359018][ T5898] chnl_net:caif_netlink_parms(): no params data found [ 98.513164][ T5894] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.524001][ T5894] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.533282][ T5894] bridge_slave_0: entered allmulticast mode [ 98.541013][ T5894] bridge_slave_0: entered promiscuous mode [ 98.555331][ T5894] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.562729][ T5894] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.570159][ T5894] bridge_slave_1: entered allmulticast mode [ 98.578050][ T5894] bridge_slave_1: entered promiscuous mode [ 98.597576][ T5898] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.604887][ T5898] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.612821][ T5898] bridge_slave_0: entered allmulticast mode [ 98.619988][ T5898] bridge_slave_0: entered promiscuous mode [ 98.638589][ T5899] chnl_net:caif_netlink_parms(): no params data found [ 98.666651][ T5898] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.674105][ T5898] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.681807][ T5898] bridge_slave_1: entered allmulticast mode [ 98.689088][ T5898] bridge_slave_1: entered promiscuous mode [ 98.696665][ T5906] chnl_net:caif_netlink_parms(): no params data found [ 98.781929][ T5894] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 98.799160][ T5894] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 98.813670][ T5898] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 98.825931][ T5898] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 98.909627][ T5898] team0: Port device team_slave_0 added [ 98.925584][ T5894] team0: Port device team_slave_0 added [ 98.934883][ T5894] team0: Port device team_slave_1 added [ 98.966369][ T5898] team0: Port device team_slave_1 added [ 99.009636][ T5899] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.026306][ T5899] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.034009][ T5899] bridge_slave_0: entered allmulticast mode [ 99.041621][ T5899] bridge_slave_0: entered promiscuous mode [ 99.099633][ T5894] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 99.106862][ T5894] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 99.133479][ T5894] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 99.145025][ T5899] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.152400][ T5899] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.160132][ T5899] bridge_slave_1: entered allmulticast mode [ 99.167784][ T5899] bridge_slave_1: entered promiscuous mode [ 99.223042][ T5898] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 99.230050][ T5898] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 99.262813][ T5898] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 99.302155][ T5894] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 99.309899][ T5894] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 99.340510][ T5894] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 99.371024][ T5906] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.378246][ T5906] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.389861][ T5906] bridge_slave_0: entered allmulticast mode [ 99.398944][ T5906] bridge_slave_0: entered promiscuous mode [ 99.407827][ T5906] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.415588][ T5906] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.427011][ T5906] bridge_slave_1: entered allmulticast mode [ 99.436102][ T5906] bridge_slave_1: entered promiscuous mode [ 99.454711][ T5899] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.473876][ T5899] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 99.500003][ T5898] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 99.507360][ T5898] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 99.514903][ T5086] Bluetooth: hci0: command tx timeout [ 99.533999][ T5898] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 99.618666][ T5899] team0: Port device team_slave_0 added [ 99.633650][ T5899] team0: Port device team_slave_1 added [ 99.677936][ T5086] Bluetooth: hci1: command tx timeout [ 99.688969][ T5906] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.713593][ T5899] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 99.720708][ T5899] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 99.746978][ T5899] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 99.757910][ T5086] Bluetooth: hci2: command tx timeout [ 99.795076][ T5906] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 99.814912][ T5899] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 99.822265][ T5899] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 99.848563][ T5899] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 99.871817][ T5894] hsr_slave_0: entered promiscuous mode [ 99.878623][ T5894] hsr_slave_1: entered promiscuous mode [ 99.885085][ T5894] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 99.893676][ T5894] Cannot create hsr debugfs directory [ 99.912318][ T5086] Bluetooth: hci3: command tx timeout [ 99.931843][ T5898] hsr_slave_0: entered promiscuous mode [ 99.938344][ T5898] hsr_slave_1: entered promiscuous mode [ 99.945008][ T5898] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 99.952963][ T5898] Cannot create hsr debugfs directory [ 100.001302][ T5906] team0: Port device team_slave_0 added [ 100.048256][ T5906] team0: Port device team_slave_1 added [ 100.077419][ T5899] hsr_slave_0: entered promiscuous mode [ 100.087522][ T5899] hsr_slave_1: entered promiscuous mode [ 100.094802][ T5899] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 100.102599][ T5899] Cannot create hsr debugfs directory [ 100.130251][ T12] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.169826][ T5906] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.180731][ T5906] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 100.207507][ T5906] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 100.259196][ T5906] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 100.266405][ T5906] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 100.293349][ T5906] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 100.521445][ T5906] hsr_slave_0: entered promiscuous mode [ 100.527754][ T5906] hsr_slave_1: entered promiscuous mode [ 100.534405][ T5906] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 100.542248][ T5906] Cannot create hsr debugfs directory [ 101.591339][ T5086] Bluetooth: hci0: command tx timeout [ 101.750607][ T5086] Bluetooth: hci1: command tx timeout [ 101.831413][ T5086] Bluetooth: hci2: command tx timeout [ 101.991514][ T5086] Bluetooth: hci3: command tx timeout [ 102.391694][ T12] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 102.443540][ T12] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 103.638578][ T5898] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 103.669427][ T5898] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 103.676256][ T5086] Bluetooth: hci0: command tx timeout [ 103.686536][ T5898] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 103.698585][ T5898] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 103.806492][ T5894] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 103.825589][ T5894] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 103.832426][ T5086] Bluetooth: hci1: command tx timeout [ 103.861742][ T5894] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 103.899168][ T5894] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 103.910682][ T5086] Bluetooth: hci2: command tx timeout [ 103.989519][ T12] hsr_slave_0: left promiscuous mode [ 103.996012][ T12] hsr_slave_1: left promiscuous mode [ 104.007009][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 104.014773][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 104.025028][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 104.032589][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 104.040349][ T12] bridge_slave_1: left allmulticast mode [ 104.046417][ T12] bridge_slave_1: left promiscuous mode [ 104.053113][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 104.065256][ T12] bridge_slave_0: left allmulticast mode [ 104.072217][ T5086] Bluetooth: hci3: command tx timeout [ 104.077736][ T12] bridge_slave_0: left promiscuous mode [ 104.083740][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 104.108162][ T12] veth1_macvtap: left promiscuous mode [ 104.114192][ T12] veth0_macvtap: left promiscuous mode [ 104.119871][ T12] veth1_vlan: left promiscuous mode [ 104.125747][ T12] veth0_vlan: left promiscuous mode [ 104.598839][ T12] team0 (unregistering): Port device team_slave_1 removed [ 104.634740][ T12] team0 (unregistering): Port device team_slave_0 removed [ 104.670012][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 104.703266][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 104.937506][ T12] bond0 (unregistering): Released all slaves [ 105.099229][ T5899] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 105.112757][ T5899] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 105.142185][ T5899] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 105.155127][ T5899] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 105.278074][ T5906] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 105.297433][ T5906] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 105.308386][ T5906] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 105.327314][ T5906] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 105.357978][ T5898] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.407279][ T5898] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.427682][ T5894] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.475680][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.482893][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.523532][ T5894] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.563593][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.570828][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.626018][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.633202][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.667198][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.674381][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.707116][ T5899] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.752058][ T5086] Bluetooth: hci0: command tx timeout [ 105.760258][ T5906] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.816159][ T5906] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.836406][ T5899] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.884868][ T5894] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 105.896904][ T5894] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 105.911696][ T5086] Bluetooth: hci1: command tx timeout [ 105.930027][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.937266][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.972957][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.980154][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.996635][ T5086] Bluetooth: hci2: command tx timeout [ 106.005172][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.012420][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.027736][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.034984][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.152652][ T5086] Bluetooth: hci3: command tx timeout [ 106.256615][ T5898] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.380300][ T5898] veth0_vlan: entered promiscuous mode [ 106.428436][ T5898] veth1_vlan: entered promiscuous mode [ 106.480114][ T5894] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.540015][ T5898] veth0_macvtap: entered promiscuous mode [ 106.585242][ T5898] veth1_macvtap: entered promiscuous mode [ 106.640039][ T5898] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 106.660417][ T5894] veth0_vlan: entered promiscuous mode [ 106.683192][ T5898] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 106.697170][ T5894] veth1_vlan: entered promiscuous mode [ 106.708959][ T5899] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.722497][ T5898] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.732971][ T5898] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.743737][ T5898] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.752753][ T5898] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.813650][ T5906] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.861465][ T5894] veth0_macvtap: entered promiscuous mode [ 106.893751][ T5894] veth1_macvtap: entered promiscuous mode [ 106.916172][ T5899] veth0_vlan: entered promiscuous mode [ 106.967580][ T5906] veth0_vlan: entered promiscuous mode [ 106.976982][ T5899] veth1_vlan: entered promiscuous mode [ 106.995398][ T5894] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 107.008093][ T5894] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 107.020066][ T5894] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 107.038215][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.053678][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.068519][ T5894] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 107.079180][ T5894] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 107.092243][ T5894] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 107.117361][ T5906] veth1_vlan: entered promiscuous mode [ 107.138862][ T5894] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.148219][ T5894] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.157870][ T5894] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.166742][ T5894] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.216771][ T5899] veth0_macvtap: entered promiscuous mode [ 107.225628][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.235810][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.254131][ T5899] veth1_macvtap: entered promiscuous mode [ 107.303067][ T5906] veth0_macvtap: entered promiscuous mode [ 107.343769][ T5899] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 107.357838][ T5899] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 107.368842][ T5899] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 107.379696][ T5899] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! 2026/05/24 18:17:30 executed programs: 8 [ 107.392040][ T5899] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 107.412682][ T5906] veth1_macvtap: entered promiscuous mode [ 107.440063][ T5906] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 107.464727][ T5906] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 107.475644][ T5906] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 107.486675][ T5906] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 107.496816][ T5906] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 107.511112][ T5906] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 107.524703][ T5906] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 107.547488][ T5899] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 107.559972][ T5899] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 107.575420][ T5899] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 107.586121][ T5899] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 107.613878][ T5899] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 107.641315][ T3503] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.649191][ T3503] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.676407][ T5899] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.686362][ T5899] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.695654][ T5899] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.705084][ T5899] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.717749][ T5906] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 107.730143][ T5906] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 107.740340][ T5906] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 107.764479][ T5906] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 107.779253][ T5906] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 107.796077][ T5906] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 107.807862][ T5906] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 107.831750][ T5906] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.840698][ T5906] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.849433][ T5906] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.859510][ T5906] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.941705][ T3503] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.953815][ T3503] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.240868][ T2919] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.249828][ T2919] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.389549][ T2908] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.424968][ T2919] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.433468][ T2908] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.476503][ T2919] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.593712][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.628815][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2026/05/24 18:17:36 executed programs: 130 2026/05/24 18:17:41 executed programs: 287 2026/05/24 18:17:46 executed programs: 456 2026/05/24 18:17:51 executed programs: 634 2026/05/24 18:17:56 executed programs: 815 [ 132.955110][ T1287] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.962065][ T1287] ieee802154 phy1 wpan1: encryption failed: -22 2026/05/24 18:18:01 executed programs: 993 2026/05/24 18:18:06 executed programs: 1170 2026/05/24 18:18:11 executed programs: 1349 2026/05/24 18:18:16 executed programs: 1521 2026/05/24 18:18:21 executed programs: 1705 2026/05/24 18:18:26 executed programs: 1885 2026/05/24 18:18:31 executed programs: 2063 2026/05/24 18:18:36 executed programs: 2242 [ 176.424162][ T5849] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 176.442531][ T5849] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 176.458409][ T5849] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 176.491171][ T5849] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 176.501333][ T5849] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 176.511669][ T5849] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 176.837782][ T3503] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.060005][ T3503] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.236100][ T3503] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.419605][ T3503] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.632551][T10712] chnl_net:caif_netlink_parms(): no params data found 2026/05/24 18:18:41 executed programs: 2404 [ 178.402137][T10712] bridge0: port 1(bridge_slave_0) entered blocking state [ 178.409363][T10712] bridge0: port 1(bridge_slave_0) entered disabled state [ 178.447048][T10712] bridge_slave_0: entered allmulticast mode [ 178.465370][T10712] bridge_slave_0: entered promiscuous mode [ 178.559496][T10712] bridge0: port 2(bridge_slave_1) entered blocking state [ 178.601024][T10712] bridge0: port 2(bridge_slave_1) entered disabled state [ 178.608311][T10712] bridge_slave_1: entered allmulticast mode [ 178.630854][ T5086] Bluetooth: hci4: command tx timeout [ 178.680036][T10712] bridge_slave_1: entered promiscuous mode [ 178.946054][T10712] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 179.163110][T10712] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 179.445872][T10712] team0: Port device team_slave_0 added [ 179.483878][T10712] team0: Port device team_slave_1 added [ 179.759487][T10712] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 179.790885][T10712] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 179.835673][T10712] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 179.941924][T10712] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 179.950842][T10712] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 180.029292][T10712] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 180.473600][T10712] hsr_slave_0: entered promiscuous mode [ 180.528360][T10712] hsr_slave_1: entered promiscuous mode [ 180.699706][ T3503] hsr_slave_0: left promiscuous mode [ 180.711674][ T5086] Bluetooth: hci4: command tx timeout [ 180.733353][ T3503] hsr_slave_1: left promiscuous mode [ 180.746342][ T3503] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 180.762160][ T3503] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 180.770360][ T3503] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 180.791391][ T3503] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 180.811399][ T3503] bridge_slave_1: left allmulticast mode [ 180.817263][ T3503] bridge_slave_1: left promiscuous mode [ 180.841761][ T3503] bridge0: port 2(bridge_slave_1) entered disabled state [ 180.854819][ T3503] bridge_slave_0: left allmulticast mode [ 180.873843][ T3503] bridge_slave_0: left promiscuous mode [ 180.898251][ T3503] bridge0: port 1(bridge_slave_0) entered disabled state [ 181.023731][ T3503] veth1_macvtap: left promiscuous mode [ 181.029328][ T3503] veth0_macvtap: left promiscuous mode [ 181.071247][ T3503] veth1_vlan: left promiscuous mode [ 181.076651][ T3503] veth0_vlan: left promiscuous mode [ 182.793127][ T5086] Bluetooth: hci4: command tx timeout 2026/05/24 18:18:46 executed programs: 2516 [ 183.431667][ T3503] team0 (unregistering): Port device team_slave_1 removed [ 183.576664][ T3503] team0 (unregistering): Port device team_slave_0 removed [ 183.772853][ T3503] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 183.932261][ T3503] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 184.870562][ T5086] Bluetooth: hci4: command tx timeout [ 184.929531][ T3503] bond0 (unregistering): Released all slaves [ 186.806710][T10712] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 186.869299][T10712] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 186.934040][T10712] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 186.957777][T10712] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 187.255960][T10712] 8021q: adding VLAN 0 to HW filter on device bond0 [ 187.323234][T10712] 8021q: adding VLAN 0 to HW filter on device team0 [ 187.418036][ T34] bridge0: port 1(bridge_slave_0) entered blocking state [ 187.425262][ T34] bridge0: port 1(bridge_slave_0) entered forwarding state [ 187.480383][ T34] bridge0: port 2(bridge_slave_1) entered blocking state [ 187.487683][ T34] bridge0: port 2(bridge_slave_1) entered forwarding state 2026/05/24 18:18:51 executed programs: 2633 [ 188.298873][T10712] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 188.462859][T10712] veth0_vlan: entered promiscuous mode [ 188.534955][T10712] veth1_vlan: entered promiscuous mode [ 188.655087][T10712] veth0_macvtap: entered promiscuous mode [ 188.716419][T10712] veth1_macvtap: entered promiscuous mode [ 188.802877][T10712] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 188.848746][T10712] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 188.901131][T10712] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 188.938716][T10712] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 188.974924][T10712] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 188.997047][T10712] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 189.022215][T10712] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 189.092240][T10712] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 189.140499][T10712] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 189.177401][T10712] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 189.220707][T10712] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 189.248242][T10712] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 189.290645][T10712] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 189.315548][T10712] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 189.357008][T10712] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 189.387165][T10712] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 189.417742][T10712] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 189.449305][T10712] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 189.775128][ T34] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 189.814870][ T34] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 189.919214][ T2919] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 189.975060][ T2919] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 190.377409][ T5849] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 190.389731][ T5849] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 190.410616][ T5849] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 190.433175][ T5849] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 190.455610][ T5849] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 190.463256][ T5849] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 190.558381][T11428] ================================================================== [ 190.566511][T11428] BUG: KASAN: slab-out-of-bounds in __bpf_get_stackid+0x6bf/0x900 [ 190.574388][T11428] Write of size 32 at addr ffff88805db64960 by task syz.2.2695/11428 [ 190.582509][T11428] [ 190.584889][T11428] CPU: 1 PID: 11428 Comm: syz.2.2695 Not tainted syzkaller #0 [ 190.592386][T11428] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 190.602487][T11428] Call Trace: [ 190.605806][T11428] [ 190.608799][T11428] dump_stack_lvl+0x18c/0x250 [ 190.613516][T11428] ? __lock_acquire+0x7d40/0x7d40 [ 190.618577][T11428] ? show_regs_print_info+0x20/0x20 [ 190.623816][T11428] ? load_image+0x420/0x420 [ 190.628364][T11428] ? _raw_spin_lock_irqsave+0xc0/0x100 [ 190.633873][T11428] ? __virt_addr_valid+0x18c/0x540 [ 190.639034][T11428] ? __virt_addr_valid+0x469/0x540 [ 190.644191][T11428] print_report+0xa8/0x210 [ 190.648665][T11428] ? __bpf_get_stackid+0x6bf/0x900 [ 190.653822][T11428] kasan_report+0x117/0x150 [ 190.658366][T11428] ? __bpf_get_stackid+0x6bf/0x900 [ 190.663523][T11428] kasan_check_range+0x241/0x290 [ 190.668500][T11428] ? __bpf_get_stackid+0x6bf/0x900 [ 190.673657][T11428] __asan_memcpy+0x40/0x70 [ 190.678121][T11428] __bpf_get_stackid+0x6bf/0x900 [ 190.683109][T11428] bpf_get_stackid_pe+0x2f0/0x410 [ 190.688189][T11428] bpf_prog_62e511ddb73e4811+0x33/0x48 [ 190.693750][T11428] bpf_overflow_handler+0x1fc/0x510 [ 190.698989][T11428] ? bpf_overflow_handler+0xde/0x510 [ 190.704345][T11428] ? tp_perf_event_destroy+0x20/0x20 [ 190.709676][T11428] ? mark_lock+0x94/0x320 [ 190.714059][T11428] ? __perf_event_account_interrupt+0x187/0x280 [ 190.720345][T11428] __perf_event_overflow+0x447/0x630 [ 190.725674][T11428] perf_swevent_overflow+0x268/0x340 [ 190.731013][T11428] ? perf_event_switch_output+0x790/0x790 [ 190.736783][T11428] ? rcu_is_watching+0x15/0xb0 [ 190.741595][T11428] perf_swevent_event+0x45c/0x570 [ 190.746709][T11428] ? perf_tp_event+0x1520/0x1520 [ 190.751704][T11428] ? get_futex_key+0x7f0/0x1010 [ 190.756608][T11428] ___perf_sw_event+0x4a7/0x730 [ 190.761511][T11428] ? ___perf_sw_event+0x199/0x730 [ 190.766616][T11428] ? perf_swevent_put_recursion_context+0xb0/0xb0 [ 190.773072][T11428] ? futex_wake+0x3fa/0x4f0 [ 190.777634][T11428] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 190.783667][T11428] ? lock_chain_count+0x20/0x20 [ 190.788561][T11428] __perf_sw_event+0x139/0x270 [ 190.793370][T11428] do_user_addr_fault+0x123e/0x12c0 [ 190.798615][T11428] ? rcu_is_watching+0x15/0xb0 [ 190.803428][T11428] exc_page_fault+0x64/0x100 [ 190.808071][T11428] ? clear_bhb_loop+0x40/0x90 [ 190.812794][T11428] asm_exc_page_fault+0x26/0x30 [ 190.817694][T11428] RIP: 0033:0x7fb5380655c3 [ 190.822149][T11428] Code: 53 48 83 ec 38 80 3d 5b ca 3a 00 00 89 7c 24 18 48 89 74 24 28 0f 85 cd 09 00 00 80 3d 2a 01 ee 00 00 49 89 f1 41 89 d2 89 cb 05 36 ca 3a 00 01 41 89 d7 0f 85 45 04 00 00 80 3d f6 00 ee 00 [ 190.841799][T11428] RSP: 002b:00007ffe3d546040 EFLAGS: 00010246 [ 190.847912][T11428] RAX: 00007fb538415fa0 RBX: 0000000000000000 RCX: 0000000000000000 [ 190.855964][T11428] RDX: 0000000000000003 RSI: 00007fb538416038 RDI: 0000000000000006 [ 190.863974][T11428] RBP: 00007fb538415fb0 R08: 0000000000000000 R09: 00007fb538416038 [ 190.871985][T11428] R10: 0000000000000003 R11: 0000000000000000 R12: 00007fb538415fa0 [ 190.879996][T11428] R13: 0000200000000000 R14: 00007ffe3d5460b8 R15: 00007fb538415fa0 [ 190.888017][T11428] [ 190.891079][T11428] [ 190.893430][T11428] Allocated by task 11428: [ 190.897868][T11428] kasan_set_track+0x4e/0x70 [ 190.902501][T11428] __kasan_kmalloc+0x8f/0xa0 [ 190.907125][T11428] __kmalloc_node+0xb4/0x230 [ 190.911776][T11428] bpf_map_area_alloc+0x5e/0x110 [ 190.916757][T11428] prealloc_elems_and_freelist+0x86/0x1c0 [ 190.922523][T11428] stack_map_alloc+0x33a/0x4c0 [ 190.927331][T11428] map_create+0x877/0x12f0 [ 190.931792][T11428] __sys_bpf+0x651/0x890 [ 190.936078][T11428] __x64_sys_bpf+0x7c/0x90 [ 190.940545][T11428] do_syscall_64+0x55/0xb0 [ 190.945010][T11428] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 190.950945][T11428] [ 190.953291][T11428] Last potentially related work creation: [ 190.959021][T11428] kasan_save_stack+0x3e/0x60 [ 190.963720][T11428] __kasan_record_aux_stack+0xaf/0xc0 [ 190.969125][T11428] kvfree_call_rcu+0xee/0x790 [ 190.973855][T11428] drop_sysctl_table+0x394/0x540 [ 190.978826][T11428] unregister_sysctl_table+0x41/0x60 [ 190.984322][T11428] mpls_dev_sysctl_unregister+0x8b/0xc0 [ 190.989908][T11428] mpls_dev_notify+0x533/0x7a0 [ 190.994744][T11428] notifier_call_chain+0x197/0x380 [ 190.999893][T11428] unregister_netdevice_many_notify+0x100d/0x1900 [ 191.006452][T11428] default_device_exit_batch+0x9ee/0xa80 [ 191.012122][T11428] cleanup_net+0x795/0xbb0 [ 191.016586][T11428] process_scheduled_works+0xa5d/0x15d0 [ 191.022181][T11428] worker_thread+0xa55/0xfc0 [ 191.026810][T11428] kthread+0x2fa/0x390 [ 191.030912][T11428] ret_from_fork+0x48/0x80 [ 191.035368][T11428] ret_from_fork_asm+0x11/0x20 [ 191.040182][T11428] [ 191.042531][T11428] The buggy address belongs to the object at ffff88805db64900 [ 191.042531][T11428] which belongs to the cache kmalloc-cg-128 of size 128 [ 191.056873][T11428] The buggy address is located 96 bytes inside of [ 191.056873][T11428] allocated 120-byte region [ffff88805db64900, ffff88805db64978) [ 191.070956][T11428] [ 191.073311][T11428] The buggy address belongs to the physical page: [ 191.079762][T11428] page:ffffea000176d900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5db64 [ 191.089966][T11428] memcg:ffff88805daf1001 [ 191.094236][T11428] flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff) [ 191.101831][T11428] page_type: 0xffffffff() [ 191.106195][T11428] raw: 00fff00000000800 ffff888017c4dc80 ffffea0001d40f80 0000000000000002 [ 191.114818][T11428] raw: 0000000000000000 0000000000100010 00000001ffffffff ffff88805daf1001 [ 191.123468][T11428] page dumped because: kasan: bad access detected [ 191.129922][T11428] page_owner tracks the page as allocated [ 191.135685][T11428] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5898, tgid 5898 (syz-executor), ts 98596288718, free_ts 97784334796 [ 191.153952][T11428] post_alloc_hook+0x1c1/0x200 [ 191.158770][T11428] get_page_from_freelist+0x1951/0x19e0 [ 191.164348][T11428] __alloc_pages+0x1f0/0x460 [ 191.168979][T11428] alloc_slab_page+0x5d/0x160 [ 191.173713][T11428] new_slab+0x87/0x2d0 [ 191.177828][T11428] ___slab_alloc+0xc5d/0x12f0 [ 191.182558][T11428] __kmem_cache_alloc_node+0x19e/0x250 [ 191.188079][T11428] __kmalloc+0xa4/0x230 [ 191.192274][T11428] __register_sysctl_table+0x6e/0x1240 [ 191.197764][T11428] mpls_dev_sysctl_register+0x207/0x2f0 [ 191.203360][T11428] mpls_dev_notify+0x357/0x7a0 [ 191.208167][T11428] notifier_call_chain+0x197/0x380 [ 191.213321][T11428] register_netdevice+0x16a5/0x1bb0 [ 191.218564][T11428] veth_newlink+0x7f4/0xc30 [ 191.223162][T11428] rtnl_newlink+0x1542/0x20a0 [ 191.227877][T11428] rtnetlink_rcv_msg+0x869/0xfa0 [ 191.232847][T11428] page last free stack trace: [ 191.237539][T11428] free_unref_page_prepare+0x7b2/0x8c0 [ 191.243042][T11428] free_unref_page+0x32/0x2e0 [ 191.247766][T11428] vfree+0x1a6/0x320 [ 191.251699][T11428] kcov_close+0x2b/0x50 [ 191.255915][T11428] __fput+0x234/0x970 [ 191.259927][T11428] task_work_run+0x1d4/0x260 [ 191.264586][T11428] do_exit+0x95a/0x2460 [ 191.268788][T11428] do_group_exit+0x21b/0x2d0 [ 191.273441][T11428] get_signal+0x12fc/0x13f0 [ 191.277979][T11428] arch_do_signal_or_restart+0xc2/0x800 [ 191.283575][T11428] exit_to_user_mode_loop+0x70/0x110 [ 191.288905][T11428] exit_to_user_mode_prepare+0xee/0x180 [ 191.294488][T11428] syscall_exit_to_user_mode+0x1a/0x50 [ 191.299993][T11428] do_syscall_64+0x61/0xb0 [ 191.304454][T11428] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 191.310388][T11428] [ 191.312738][T11428] Memory state around the buggy address: [ 191.318401][T11428] ffff88805db64800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 191.326499][T11428] ffff88805db64880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 191.334596][T11428] >ffff88805db64900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 191.342701][T11428] ^ [ 191.350800][T11428] ffff88805db64980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 191.358893][T11428] ffff88805db64a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 191.366996][T11428] ================================================================== [ 191.375116][T11428] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 191.382342][T11428] CPU: 1 PID: 11428 Comm: syz.2.2695 Not tainted syzkaller #0 [ 191.389854][T11428] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 191.400047][T11428] Call Trace: [ 191.403371][T11428] [ 191.406335][T11428] dump_stack_lvl+0x18c/0x250 [ 191.411057][T11428] ? show_regs_print_info+0x20/0x20 [ 191.416315][T11428] ? load_image+0x420/0x420 [ 191.420914][T11428] panic+0x2dc/0x730 [ 191.424857][T11428] ? __lock_acquire+0x7d40/0x7d40 [ 191.429916][T11428] ? bpf_jit_dump+0xd0/0xd0 [ 191.434499][T11428] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 191.440438][T11428] ? _raw_spin_unlock+0x40/0x40 [ 191.445345][T11428] ? __bpf_get_stackid+0x6bf/0x900 [ 191.450506][T11428] check_panic_on_warn+0x84/0xa0 [ 191.455486][T11428] ? __bpf_get_stackid+0x6bf/0x900 [ 191.460635][T11428] end_report+0x6f/0x130 [ 191.464921][T11428] kasan_report+0x128/0x150 [ 191.469457][T11428] ? __bpf_get_stackid+0x6bf/0x900 [ 191.474628][T11428] kasan_check_range+0x241/0x290 [ 191.479604][T11428] ? __bpf_get_stackid+0x6bf/0x900 [ 191.484835][T11428] __asan_memcpy+0x40/0x70 [ 191.489298][T11428] __bpf_get_stackid+0x6bf/0x900 [ 191.494302][T11428] bpf_get_stackid_pe+0x2f0/0x410 [ 191.499379][T11428] bpf_prog_62e511ddb73e4811+0x33/0x48 [ 191.504873][T11428] bpf_overflow_handler+0x1fc/0x510 [ 191.510140][T11428] ? bpf_overflow_handler+0xde/0x510 [ 191.515470][T11428] ? tp_perf_event_destroy+0x20/0x20 [ 191.520808][T11428] ? mark_lock+0x94/0x320 [ 191.525178][T11428] ? __perf_event_account_interrupt+0x187/0x280 [ 191.531467][T11428] __perf_event_overflow+0x447/0x630 [ 191.536789][T11428] perf_swevent_overflow+0x268/0x340 [ 191.542121][T11428] ? perf_event_switch_output+0x790/0x790 [ 191.547878][T11428] ? rcu_is_watching+0x15/0xb0 [ 191.552686][T11428] perf_swevent_event+0x45c/0x570 [ 191.557745][T11428] ? perf_tp_event+0x1520/0x1520 [ 191.562713][T11428] ? get_futex_key+0x7f0/0x1010 [ 191.567612][T11428] ___perf_sw_event+0x4a7/0x730 [ 191.572505][T11428] ? ___perf_sw_event+0x199/0x730 [ 191.577571][T11428] ? perf_swevent_put_recursion_context+0xb0/0xb0 [ 191.584026][T11428] ? futex_wake+0x3fa/0x4f0 [ 191.588589][T11428] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 191.594624][T11428] ? lock_chain_count+0x20/0x20 [ 191.599509][T11428] __perf_sw_event+0x139/0x270 [ 191.604307][T11428] do_user_addr_fault+0x123e/0x12c0 [ 191.609547][T11428] ? rcu_is_watching+0x15/0xb0 [ 191.614353][T11428] exc_page_fault+0x64/0x100 [ 191.618986][T11428] ? clear_bhb_loop+0x40/0x90 [ 191.623697][T11428] asm_exc_page_fault+0x26/0x30 [ 191.628674][T11428] RIP: 0033:0x7fb5380655c3 [ 191.633121][T11428] Code: 53 48 83 ec 38 80 3d 5b ca 3a 00 00 89 7c 24 18 48 89 74 24 28 0f 85 cd 09 00 00 80 3d 2a 01 ee 00 00 49 89 f1 41 89 d2 89 cb 05 36 ca 3a 00 01 41 89 d7 0f 85 45 04 00 00 80 3d f6 00 ee 00 [ 191.652753][T11428] RSP: 002b:00007ffe3d546040 EFLAGS: 00010246 [ 191.658861][T11428] RAX: 00007fb538415fa0 RBX: 0000000000000000 RCX: 0000000000000000 [ 191.666851][T11428] RDX: 0000000000000003 RSI: 00007fb538416038 RDI: 0000000000000006 [ 191.674853][T11428] RBP: 00007fb538415fb0 R08: 0000000000000000 R09: 00007fb538416038 [ 191.682857][T11428] R10: 0000000000000003 R11: 0000000000000000 R12: 00007fb538415fa0 [ 191.690865][T11428] R13: 0000200000000000 R14: 00007ffe3d5460b8 R15: 00007fb538415fa0 [ 191.698881][T11428] [ 191.702489][T11428] Kernel Offset: disabled [ 191.706832][T11428] Rebooting in 86400 seconds..