Warning: Permanently added '10.128.0.174' (ED25519) to the list of known hosts.
2025/08/03 03:51:07 ignoring optional flag "sandboxArg"="0"
2025/08/03 03:51:08 parsed 1 programs
[ 80.748117][ T4274] cgroup: Unknown subsys name 'net'
[ 80.856122][ T4274] cgroup: Unknown subsys name 'rlimit'
[ 82.615269][ T4274] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS
[ 86.496577][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 86.512083][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 86.529516][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 86.543324][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 86.551815][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 86.574201][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 86.672633][ T4343] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 86.680874][ T4343] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 86.688469][ T4343] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 86.696894][ T4345] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 86.705049][ T4345] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 86.713120][ T4345] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 86.720748][ T32] cfg80211: failed to load regulatory.db
[ 87.016949][ T4350] chnl_net:caif_netlink_parms(): no params data found
[ 87.112148][ T4350] bridge0: port 1(bridge_slave_0) entered blocking state
[ 87.120131][ T4350] bridge0: port 1(bridge_slave_0) entered disabled state
[ 87.128042][ T4350] device bridge_slave_0 entered promiscuous mode
[ 87.137714][ T4350] bridge0: port 2(bridge_slave_1) entered blocking state
[ 87.144984][ T4350] bridge0: port 2(bridge_slave_1) entered disabled state
[ 87.152920][ T4350] device bridge_slave_1 entered promiscuous mode
[ 87.176283][ T4350] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 87.189952][ T4350] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 87.214119][ T4350] team0: Port device team_slave_0 added
[ 87.222003][ T4350] team0: Port device team_slave_1 added
[ 87.242234][ T4350] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 87.249245][ T4350] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 87.275381][ T4350] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 87.288384][ T4350] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 87.295724][ T4350] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 87.321718][ T4350] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 87.354154][ T4350] device hsr_slave_0 entered promiscuous mode
[ 87.361340][ T4350] device hsr_slave_1 entered promiscuous mode
[ 87.507128][ T4350] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 87.530147][ T4350] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 87.539429][ T4350] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 87.549403][ T4350] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 87.626151][ T4350] 8021q: adding VLAN 0 to HW filter on device bond0
[ 87.654592][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 87.664095][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 87.687731][ T4350] 8021q: adding VLAN 0 to HW filter on device team0
[ 87.699063][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 87.708621][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 87.717666][ T1172] bridge0: port 1(bridge_slave_0) entered blocking state
[ 87.724950][ T1172] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 87.736315][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 87.745573][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 87.754429][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 87.762974][ T1172] bridge0: port 2(bridge_slave_1) entered blocking state
[ 87.770138][ T1172] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 87.791023][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 87.802866][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 87.817130][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 87.826117][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 87.835292][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 87.845970][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 87.854879][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 87.874634][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 87.883295][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 87.896221][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 87.905279][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 87.922174][ T4350] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 88.193333][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 88.202054][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 88.217431][ T4350] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 88.244118][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 88.253752][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 88.275542][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 88.285006][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 88.294492][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 88.303330][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 88.315480][ T4350] device veth0_vlan entered promiscuous mode
[ 88.330794][ T4350] device veth1_vlan entered promiscuous mode
[ 88.353437][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 88.363622][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 88.372021][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 88.380492][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 88.393477][ T4350] device veth0_macvtap entered promiscuous mode
[ 88.402727][ T4350] device veth1_macvtap entered promiscuous mode
[ 88.418674][ T4350] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 88.426648][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 88.435127][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 88.443658][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 88.452718][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 88.465226][ T4350] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 88.475085][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 88.483907][ T1172] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 88.496830][ T4350] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 88.506057][ T4350] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 88.515264][ T4350] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 88.524353][ T4350] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 88.651331][ T1172] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2025/08/03 03:51:18 executed programs: 0
[ 89.063897][ T48] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 89.074691][ T48] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 89.082549][ T48] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 89.092373][ T48] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 89.100555][ T48] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 89.108051][ T48] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 89.248283][ T4377] chnl_net:caif_netlink_parms(): no params data found
[ 89.299567][ T4377] bridge0: port 1(bridge_slave_0) entered blocking state
[ 89.306880][ T4377] bridge0: port 1(bridge_slave_0) entered disabled state
[ 89.315764][ T4377] device bridge_slave_0 entered promiscuous mode
[ 89.323984][ T4377] bridge0: port 2(bridge_slave_1) entered blocking state
[ 89.331431][ T4377] bridge0: port 2(bridge_slave_1) entered disabled state
[ 89.339672][ T4377] device bridge_slave_1 entered promiscuous mode
[ 89.369385][ T4377] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 89.380652][ T4377] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 89.405879][ T4377] team0: Port device team_slave_0 added
[ 89.413763][ T4377] team0: Port device team_slave_1 added
[ 89.437119][ T4377] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 89.444357][ T4377] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 89.470687][ T4377] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 89.483534][ T4377] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 89.490565][ T4377] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 89.516989][ T4377] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 89.555155][ T4377] device hsr_slave_0 entered promiscuous mode
[ 89.562047][ T4377] device hsr_slave_1 entered promiscuous mode
[ 89.568667][ T4377] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 89.576913][ T4377] Cannot create hsr debugfs directory
[ 90.991692][ T1172] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 91.190092][ T48] Bluetooth: hci0: command 0x0409 tx timeout
[ 93.269450][ T4345] Bluetooth: hci0: command 0x041b tx timeout
[ 93.310108][ T1172] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 93.382039][ T1172] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 94.308450][ T1172] device hsr_slave_0 left promiscuous mode
[ 94.323699][ T1172] device hsr_slave_1 left promiscuous mode
[ 94.345380][ T1172] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 94.353313][ T1172] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 94.362522][ T1172] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 94.386625][ T1172] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 94.394883][ T1172] device bridge_slave_1 left promiscuous mode
[ 94.420096][ T1172] bridge0: port 2(bridge_slave_1) entered disabled state
[ 94.432894][ T1172] device bridge_slave_0 left promiscuous mode
[ 94.440049][ T1172] bridge0: port 1(bridge_slave_0) entered disabled state
[ 94.467544][ T1172] device veth1_macvtap left promiscuous mode
[ 94.474503][ T1172] device veth0_macvtap left promiscuous mode
[ 94.481052][ T1172] device veth1_vlan left promiscuous mode
[ 94.487117][ T1172] device veth0_vlan left promiscuous mode
[ 94.868726][ T1172] team0 (unregistering): Port device team_slave_1 removed
[ 94.900553][ T1172] team0 (unregistering): Port device team_slave_0 removed
[ 94.928081][ T1172] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 94.957038][ T1172] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 95.202810][ T1172] bond0 (unregistering): Released all slaves
[ 95.268546][ T4377] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 95.277927][ T4377] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 95.287451][ T4377] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 95.297601][ T4377] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 95.359486][ T48] Bluetooth: hci0: command 0x040f tx timeout
[ 95.362948][ T4377] 8021q: adding VLAN 0 to HW filter on device bond0
[ 95.384066][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 95.394719][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 95.405732][ T4377] 8021q: adding VLAN 0 to HW filter on device team0
[ 95.416298][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 95.425347][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 95.437224][ T9] bridge0: port 1(bridge_slave_0) entered blocking state
[ 95.444506][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 95.455839][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 95.464119][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 95.475238][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 95.484483][ T9] bridge0: port 2(bridge_slave_1) entered blocking state
[ 95.491679][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 95.503074][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 95.515804][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 95.528897][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 95.538730][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 95.549813][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 95.563104][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 95.571931][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 95.583325][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 95.592112][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 95.615030][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 95.624879][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 95.634491][ T4377] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 95.845912][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 95.853628][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 95.865407][ T4377] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 95.882894][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 95.891826][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 95.915428][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 95.923807][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 95.933027][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 95.941532][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 95.953610][ T4377] device veth0_vlan entered promiscuous mode
[ 95.970524][ T4377] device veth1_vlan entered promiscuous mode
[ 95.988508][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 95.997271][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 96.005762][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 96.014559][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 96.030972][ T4377] device veth0_macvtap entered promiscuous mode
[ 96.041757][ T4377] device veth1_macvtap entered promiscuous mode
[ 96.057644][ T4377] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 96.065391][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 96.073877][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 96.082514][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 96.091263][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 96.106143][ T4377] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 96.113952][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 96.123394][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 96.134595][ T4377] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 96.143523][ T4377] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 96.152881][ T4377] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 96.161946][ T4377] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 96.219639][ T34] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 96.227607][ T34] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
2025/08/03 03:51:26 executed programs: 2
[ 96.259954][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 96.271759][ T34] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 96.281551][ T34] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 96.294689][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 97.439092][ T4345] Bluetooth: hci0: command 0x0419 tx timeout
[ 98.030552][ T4434] ==================================================================
[ 98.038825][ T4434] BUG: KASAN: use-after-free in __lock_acquire+0xf7/0x7c50
[ 98.046118][ T4434] Read of size 8 at addr ffff88802788c2b8 by task syz.0.18/4434
[ 98.053761][ T4434]
[ 98.056114][ T4434] CPU: 1 PID: 4434 Comm: syz.0.18 Not tainted 6.1.147-syzkaller #0
[ 98.064035][ T4434] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[ 98.074131][ T4434] Call Trace:
[ 98.077425][ T4434]
[ 98.080371][ T4434] dump_stack_lvl+0x168/0x22e
[ 98.085065][ T4434] ? __lock_acquire+0x7c50/0x7c50
[ 98.090109][ T4434] ? show_regs_print_info+0x12/0x12
[ 98.095319][ T4434] ? load_image+0x3b0/0x3b0
[ 98.099840][ T4434] ? _raw_spin_lock_irqsave+0xb0/0xf0
[ 98.105228][ T4434] ? __virt_addr_valid+0x188/0x540
[ 98.110356][ T4434] ? __virt_addr_valid+0x465/0x540
[ 98.115480][ T4434] ? __lock_acquire+0xf7/0x7c50
[ 98.120346][ T4434] print_report+0xa8/0x200
[ 98.124782][ T4434] kasan_report+0x10b/0x140
[ 98.129346][ T4434] ? __lock_acquire+0xf7/0x7c50
[ 98.134220][ T4434] __lock_acquire+0xf7/0x7c50
[ 98.138920][ T4434] ? lock_chain_count+0x20/0x20
[ 98.143801][ T4434] ? call_rcu+0x6a1/0x980
[ 98.148245][ T4434] ? lockdep_hardirqs_on+0x94/0x140
[ 98.153483][ T4434] ? verify_lock_unused+0x140/0x140
[ 98.158707][ T4434] ? put_task_stack+0x161/0x1f0
[ 98.163583][ T4434] ? finish_task_switch+0x446/0x8f0
[ 98.168820][ T4434] ? __schedule+0x10f4/0x40b0
[ 98.173512][ T4434] lock_acquire+0x1b4/0x490
[ 98.178028][ T4434] ? remove_wait_queue+0x20/0x120
[ 98.183068][ T4434] ? read_lock_is_recursive+0x10/0x10
[ 98.188452][ T4434] ? lockdep_hardirqs_on_prepare+0x3fc/0x760
[ 98.194451][ T4434] _raw_spin_lock_irqsave+0xa4/0xf0
[ 98.199667][ T4434] ? remove_wait_queue+0x20/0x120
[ 98.204745][ T4434] ? _raw_spin_lock+0x40/0x40
[ 98.209433][ T4434] ? _raw_spin_unlock_irqrestore+0xaa/0x100
[ 98.215348][ T4434] ? _raw_spin_unlock+0x40/0x40
[ 98.220224][ T4434] remove_wait_queue+0x20/0x120
[ 98.225108][ T4434] poll_freewait+0x99/0x210
[ 98.229636][ T4434] do_select+0x1761/0x1850
[ 98.234077][ T4434] ? do_select+0xeb/0x1850
[ 98.238605][ T4434] ? core_sys_select+0x8b0/0x8b0
[ 98.243564][ T4434] ? __ia32_compat_sys_ppoll_time64+0x2f0/0x2f0
[ 98.249833][ T4434] ? __ia32_compat_sys_ppoll_time64+0x2f0/0x2f0
[ 98.256085][ T4434] ? __ia32_compat_sys_ppoll_time64+0x2f0/0x2f0
[ 98.262348][ T4434] ? __ia32_compat_sys_ppoll_time64+0x2f0/0x2f0
[ 98.268606][ T4434] ? __ia32_compat_sys_ppoll_time64+0x2f0/0x2f0
[ 98.274877][ T4434] ? __ia32_compat_sys_ppoll_time64+0x2f0/0x2f0
[ 98.281135][ T4434] ? __ia32_compat_sys_ppoll_time64+0x2f0/0x2f0
[ 98.287422][ T4434] ? __ia32_compat_sys_ppoll_time64+0x2f0/0x2f0
[ 98.293692][ T4434] ? __ia32_compat_sys_ppoll_time64+0x2f0/0x2f0
[ 98.299959][ T4434] ? __lock_acquire+0x7c50/0x7c50
[ 98.305009][ T4434] ? futex_unqueue+0xc7/0xf0
[ 98.309617][ T4434] ? __lock_acquire+0x7c50/0x7c50
[ 98.314653][ T4434] ? __might_fault+0xa6/0x120
[ 98.319347][ T4434] ? __might_fault+0xc2/0x120
[ 98.324052][ T4434] ? __might_fault+0xa6/0x120
[ 98.328750][ T4434] core_sys_select+0x6ad/0x8b0
[ 98.333536][ T4434] ? poll_select_set_timeout+0x150/0x150
[ 98.339210][ T4434] ? sigprocmask+0x190/0x190
[ 98.343818][ T4434] ? do_sys_openat2+0x1fe/0x490
[ 98.348684][ T4434] __se_sys_pselect6+0x2ed/0x3a0
[ 98.353637][ T4434] ? __x64_sys_pselect6+0xf0/0xf0
[ 98.358678][ T4434] ? __x64_sys_pselect6+0x1d/0xf0
[ 98.363719][ T4434] do_syscall_64+0x4c/0xa0
[ 98.368158][ T4434] ? clear_bhb_loop+0x60/0xb0
[ 98.372850][ T4434] ? clear_bhb_loop+0x60/0xb0
[ 98.377544][ T4434] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 98.383460][ T4434] RIP: 0033:0x7f1043d8eb69
[ 98.387897][ T4434] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 98.407520][ T4434] RSP: 002b:00007f1044b5f038 EFLAGS: 00000246 ORIG_RAX: 000000000000010e
[ 98.415944][ T4434] RAX: ffffffffffffffda RBX: 00007f1043fb5fa0 RCX: 00007f1043d8eb69
[ 98.423924][ T4434] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000040
[ 98.431905][ T4434] RBP: 00007f1043e11df1 R08: 0000000000000000 R09: 0000000000000000
[ 98.439886][ T4434] R10: 0000200000000180 R11: 0000000000000246 R12: 0000000000000000
[ 98.447860][ T4434] R13: 0000000000000000 R14: 00007f1043fb5fa0 R15: 00007ffcd1599c58
[ 98.455847][ T4434]
[ 98.458879][ T4434]
[ 98.461209][ T4434] Allocated by task 4432:
[ 98.465539][ T4434] kasan_set_track+0x4b/0x70
[ 98.470158][ T4434] __kasan_kmalloc+0x8e/0xa0
[ 98.474760][ T4434] comedi_device_postconfig+0x496/0xc50
[ 98.480323][ T4434] comedi_device_attach+0x52f/0x650
[ 98.485537][ T4434] comedi_unlocked_ioctl+0x5ec/0xf20
[ 98.490832][ T4434] __se_sys_ioctl+0xfa/0x170
[ 98.495439][ T4434] do_syscall_64+0x4c/0xa0
[ 98.499882][ T4434] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 98.505820][ T4434]
[ 98.508143][ T4434] Freed by task 4435:
[ 98.512119][ T4434] kasan_set_track+0x4b/0x70
[ 98.516719][ T4434] kasan_save_free_info+0x2d/0x50
[ 98.521761][ T4434] ____kasan_slab_free+0x126/0x1e0
[ 98.526889][ T4434] slab_free_freelist_hook+0x131/0x1a0
[ 98.532351][ T4434] __kmem_cache_free+0xb6/0x1f0
[ 98.537207][ T4434] comedi_device_detach+0x35f/0x6e0
[ 98.542411][ T4434] comedi_unlocked_ioctl+0xb6b/0xf20
[ 98.547792][ T4434] __se_sys_ioctl+0xfa/0x170
[ 98.552399][ T4434] do_syscall_64+0x4c/0xa0
[ 98.556823][ T4434] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 98.562727][ T4434]
[ 98.565151][ T4434] The buggy address belongs to the object at ffff88802788c200
[ 98.565151][ T4434] which belongs to the cache kmalloc-256 of size 256
[ 98.579294][ T4434] The buggy address is located 184 bytes inside of
[ 98.579294][ T4434] 256-byte region [ffff88802788c200, ffff88802788c300)
[ 98.592566][ T4434]
[ 98.594895][ T4434] The buggy address belongs to the physical page:
[ 98.601314][ T4434] page:ffffea00009e2300 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2788c
[ 98.611481][ T4434] head:ffffea00009e2300 order:1 compound_mapcount:0 compound_pincount:0
[ 98.619899][ T4434] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 98.627917][ T4434] raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888017441b40
[ 98.636513][ T4434] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[ 98.645099][ T4434] page dumped because: kasan: bad access detected
[ 98.651522][ T4434] page_owner tracks the page as allocated
[ 98.657237][ T4434] page last allocated via order 1, migratetype Unmovable, gfp_mask 0x152a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 4353, tgid 4353 (kworker/1:12), ts 96349405228, free_ts 96344272914
[ 98.677908][ T4434] post_alloc_hook+0x173/0x1a0
[ 98.682696][ T4434] get_page_from_freelist+0x1a26/0x1ac0
[ 98.688252][ T4434] __alloc_pages+0x1df/0x4e0
[ 98.692852][ T4434] alloc_slab_page+0x5d/0x160
[ 98.697536][ T4434] new_slab+0x87/0x2c0
[ 98.701614][ T4434] ___slab_alloc+0xbc6/0x1220
[ 98.706294][ T4434] __kmem_cache_alloc_node+0x1a0/0x260
[ 98.711755][ T4434] kmalloc_trace+0x26/0xe0
[ 98.716185][ T4434] batadv_bla_get_backbone_gw+0x134/0xe70
[ 98.721912][ T4434] batadv_bla_tx+0xbcd/0x1370
[ 98.726614][ T4434] batadv_interface_tx+0x57d/0x15d0
[ 98.731814][ T4434] dev_hard_start_xmit+0x262/0x870
[ 98.736936][ T4434] __dev_queue_xmit+0x1bf1/0x3760
[ 98.741974][ T4434] ip6_finish_output2+0xda2/0x1590
[ 98.747089][ T4434] ndisc_send_skb+0xbfb/0x1510
[ 98.751859][ T4434] ndisc_send_ns+0xc8/0x150
[ 98.756385][ T4434] page last free stack trace:
[ 98.761059][ T4434] free_unref_page_prepare+0x8b4/0x9a0
[ 98.766529][ T4434] free_unref_page+0x2e/0x3f0
[ 98.771217][ T4434] qlist_free_all+0x76/0xe0
[ 98.775721][ T4434] kasan_quarantine_reduce+0x144/0x160
[ 98.781184][ T4434] __kasan_slab_alloc+0x1e/0x80
[ 98.786039][ T4434] slab_post_alloc_hook+0x4b/0x480
[ 98.791239][ T4434] __kmem_cache_alloc_node+0x140/0x260
[ 98.796742][ T4434] __kmalloc+0xa0/0x240
[ 98.800911][ T4434] tomoyo_realpath_from_path+0xdf/0x5d0
[ 98.806477][ T4434] tomoyo_path_perm+0x1fd/0x550
[ 98.811337][ T4434] security_inode_getattr+0xcf/0x120
[ 98.816632][ T4434] vfs_getattr+0x26/0x3a0
[ 98.820974][ T4434] __x64_sys_newfstat+0x102/0x1c0
[ 98.826008][ T4434] do_syscall_64+0x4c/0xa0
[ 98.830431][ T4434] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 98.836339][ T4434]
[ 98.838678][ T4434] Memory state around the buggy address:
[ 98.844315][ T4434] ffff88802788c180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 98.852378][ T4434] ffff88802788c200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 98.860443][ T4434] >ffff88802788c280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 98.868528][ T4434] ^
[ 98.874423][ T4434] ffff88802788c300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 98.882491][ T4434] ffff88802788c380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 98.890554][ T4434] ==================================================================
[ 98.898641][ T4434] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 98.905834][ T4434] CPU: 1 PID: 4434 Comm: syz.0.18 Not tainted 6.1.147-syzkaller #0
[ 98.913736][ T4434] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[ 98.923795][ T4434] Call Trace:
[ 98.927083][ T4434]
[ 98.930021][ T4434] dump_stack_lvl+0x168/0x22e
[ 98.934705][ T4434] ? memcpy+0x3c/0x60
[ 98.938709][ T4434] ? show_regs_print_info+0x12/0x12
[ 98.944204][ T4434] ? load_image+0x3b0/0x3b0
[ 98.948726][ T4434] panic+0x2c9/0x710
[ 98.952634][ T4434] ? __lock_acquire+0x7c50/0x7c50
[ 98.957674][ T4434] ? bpf_jit_dump+0xd0/0xd0
[ 98.962188][ T4434] ? _raw_spin_unlock_irqrestore+0xaa/0x100
[ 98.968113][ T4434] ? _raw_spin_unlock+0x40/0x40
[ 98.972982][ T4434] check_panic_on_warn+0x80/0xa0
[ 98.977926][ T4434] ? __lock_acquire+0xf7/0x7c50
[ 98.982792][ T4434] end_report+0x66/0x110
[ 98.987061][ T4434] kasan_report+0x118/0x140
[ 98.991579][ T4434] ? __lock_acquire+0xf7/0x7c50
[ 98.996452][ T4434] __lock_acquire+0xf7/0x7c50
[ 99.001141][ T4434] ? lock_chain_count+0x20/0x20
[ 99.006003][ T4434] ? call_rcu+0x6a1/0x980
[ 99.010348][ T4434] ? lockdep_hardirqs_on+0x94/0x140
[ 99.015566][ T4434] ? verify_lock_unused+0x140/0x140
[ 99.020777][ T4434] ? put_task_stack+0x161/0x1f0
[ 99.025648][ T4434] ? finish_task_switch+0x446/0x8f0
[ 99.030858][ T4434] ? __schedule+0x10f4/0x40b0
[ 99.035544][ T4434] lock_acquire+0x1b4/0x490
[ 99.040152][ T4434] ? remove_wait_queue+0x20/0x120
[ 99.045192][ T4434] ? read_lock_is_recursive+0x10/0x10
[ 99.050577][ T4434] ? lockdep_hardirqs_on_prepare+0x3fc/0x760
[ 99.056578][ T4434] _raw_spin_lock_irqsave+0xa4/0xf0
[ 99.061795][ T4434] ? remove_wait_queue+0x20/0x120
[ 99.066856][ T4434] ? _raw_spin_lock+0x40/0x40
[ 99.071550][ T4434] ? _raw_spin_unlock_irqrestore+0xaa/0x100
[ 99.077457][ T4434] ? _raw_spin_unlock+0x40/0x40
[ 99.082321][ T4434] remove_wait_queue+0x20/0x120
[ 99.087185][ T4434] poll_freewait+0x99/0x210
[ 99.091701][ T4434] do_select+0x1761/0x1850
[ 99.096137][ T4434] ? do_select+0xeb/0x1850
[ 99.100576][ T4434] ? core_sys_select+0x8b0/0x8b0
[ 99.105531][ T4434] ? __ia32_compat_sys_ppoll_time64+0x2f0/0x2f0
[ 99.111792][ T4434] ? __ia32_compat_sys_ppoll_time64+0x2f0/0x2f0
[ 99.118046][ T4434] ? __ia32_compat_sys_ppoll_time64+0x2f0/0x2f0
[ 99.124324][ T4434] ? __ia32_compat_sys_ppoll_time64+0x2f0/0x2f0
[ 99.130584][ T4434] ? __ia32_compat_sys_ppoll_time64+0x2f0/0x2f0
[ 99.136839][ T4434] ? __ia32_compat_sys_ppoll_time64+0x2f0/0x2f0
[ 99.143091][ T4434] ? __ia32_compat_sys_ppoll_time64+0x2f0/0x2f0
[ 99.149351][ T4434] ? __ia32_compat_sys_ppoll_time64+0x2f0/0x2f0
[ 99.155606][ T4434] ? __ia32_compat_sys_ppoll_time64+0x2f0/0x2f0
[ 99.161885][ T4434] ? __lock_acquire+0x7c50/0x7c50
[ 99.166924][ T4434] ? futex_unqueue+0xc7/0xf0
[ 99.171528][ T4434] ? __lock_acquire+0x7c50/0x7c50
[ 99.176571][ T4434] ? __might_fault+0xa6/0x120
[ 99.181263][ T4434] ? __might_fault+0xc2/0x120
[ 99.185952][ T4434] ? __might_fault+0xa6/0x120
[ 99.190647][ T4434] core_sys_select+0x6ad/0x8b0
[ 99.195427][ T4434] ? poll_select_set_timeout+0x150/0x150
[ 99.201080][ T4434] ? sigprocmask+0x190/0x190
[ 99.205684][ T4434] ? do_sys_openat2+0x1fe/0x490
[ 99.210554][ T4434] __se_sys_pselect6+0x2ed/0x3a0
[ 99.215504][ T4434] ? __x64_sys_pselect6+0xf0/0xf0
[ 99.220553][ T4434] ? __x64_sys_pselect6+0x1d/0xf0
[ 99.225591][ T4434] do_syscall_64+0x4c/0xa0
[ 99.230019][ T4434] ? clear_bhb_loop+0x60/0xb0
[ 99.234702][ T4434] ? clear_bhb_loop+0x60/0xb0
[ 99.239398][ T4434] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 99.245323][ T4434] RIP: 0033:0x7f1043d8eb69
[ 99.249765][ T4434] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 99.269395][ T4434] RSP: 002b:00007f1044b5f038 EFLAGS: 00000246 ORIG_RAX: 000000000000010e
[ 99.277902][ T4434] RAX: ffffffffffffffda RBX: 00007f1043fb5fa0 RCX: 00007f1043d8eb69
[ 99.285912][ T4434] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000040
[ 99.293903][ T4434] RBP: 00007f1043e11df1 R08: 0000000000000000 R09: 0000000000000000
[ 99.301896][ T4434] R10: 0000200000000180 R11: 0000000000000246 R12: 0000000000000000
[ 99.309892][ T4434] R13: 0000000000000000 R14: 00007f1043fb5fa0 R15: 00007ffcd1599c58
[ 99.317889][ T4434]
[ 99.321231][ T4434] Kernel Offset: disabled
[ 99.325568][ T4434] Rebooting in 86400 seconds..