Warning: Permanently added '10.128.1.30' (ED25519) to the list of known hosts.
2025/07/20 15:04:02 ignoring optional flag "sandboxArg"="0"
2025/07/20 15:04:04 parsed 1 programs
syzkaller login: [ 91.194657][ T5796] cgroup: Unknown subsys name 'net'
[ 91.389031][ T5796] cgroup: Unknown subsys name 'rlimit'
[ 92.303540][ T27] cfg80211: failed to load regulatory.db
[ 93.086262][ T5796] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 95.933186][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 95.942867][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 95.951743][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 95.961342][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 95.969828][ T50] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 95.977305][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 97.116926][ T5842] chnl_net:caif_netlink_parms(): no params data found
[ 97.223483][ T5842] bridge0: port 1(bridge_slave_0) entered blocking state
[ 97.231075][ T5842] bridge0: port 1(bridge_slave_0) entered disabled state
[ 97.238342][ T5842] bridge_slave_0: entered allmulticast mode
[ 97.246497][ T5842] bridge_slave_0: entered promiscuous mode
[ 97.271936][ T5842] bridge0: port 2(bridge_slave_1) entered blocking state
[ 97.279215][ T5842] bridge0: port 2(bridge_slave_1) entered disabled state
[ 97.286731][ T5842] bridge_slave_1: entered allmulticast mode
[ 97.297655][ T5842] bridge_slave_1: entered promiscuous mode
[ 97.340292][ T5842] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 97.352060][ T5842] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 97.390271][ T5842] team0: Port device team_slave_0 added
[ 97.408307][ T5842] team0: Port device team_slave_1 added
[ 97.438259][ T5842] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 97.448563][ T5842] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 97.476132][ T5842] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 97.497727][ T5842] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 97.505101][ T5842] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 97.532327][ T5842] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 97.591646][ T5842] hsr_slave_0: entered promiscuous mode
[ 97.598119][ T5842] hsr_slave_1: entered promiscuous mode
[ 97.783907][ T5842] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 97.795896][ T5842] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 97.807346][ T5842] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 97.818185][ T5842] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 97.868541][ T5842] bridge0: port 2(bridge_slave_1) entered blocking state
[ 97.876164][ T5842] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 97.884388][ T5842] bridge0: port 1(bridge_slave_0) entered blocking state
[ 97.891625][ T5842] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 97.971310][ T5842] 8021q: adding VLAN 0 to HW filter on device bond0
[ 97.982536][ T58] bridge0: port 1(bridge_slave_0) entered disabled state
[ 97.991438][ T58] bridge0: port 2(bridge_slave_1) entered disabled state
[ 98.022175][ T5842] 8021q: adding VLAN 0 to HW filter on device team0
[ 98.036108][ T58] bridge0: port 1(bridge_slave_0) entered blocking state
[ 98.043355][ T58] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 98.057591][ T58] bridge0: port 2(bridge_slave_1) entered blocking state
[ 98.064966][ T58] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 98.273737][ T5842] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 98.321464][ T5842] veth0_vlan: entered promiscuous mode
[ 98.336254][ T5842] veth1_vlan: entered promiscuous mode
[ 98.368662][ T5842] veth0_macvtap: entered promiscuous mode
[ 98.379246][ T5842] veth1_macvtap: entered promiscuous mode
[ 98.403774][ T5842] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 98.420791][ T5842] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 98.435462][ T5842] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 98.445623][ T5842] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 98.454848][ T5842] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 98.464857][ T5842] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 98.597962][ T5842] syz-executor (5842) used greatest stack depth: 20936 bytes left
[ 98.637803][ T3495] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 98.905821][ T3510] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 98.914133][ T3510] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 98.944973][ T1025] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 98.953068][ T1025] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
2025/07/20 15:04:16 executed programs: 0
[ 100.810844][ T5104] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 100.818782][ T5104] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 100.828245][ T5104] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 100.839285][ T5104] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 100.847633][ T5104] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 100.855932][ T5104] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 101.026328][ T5895] chnl_net:caif_netlink_parms(): no params data found
[ 101.101907][ T5895] bridge0: port 1(bridge_slave_0) entered blocking state
[ 101.109151][ T5895] bridge0: port 1(bridge_slave_0) entered disabled state
[ 101.116826][ T5895] bridge_slave_0: entered allmulticast mode
[ 101.124076][ T5895] bridge_slave_0: entered promiscuous mode
[ 101.133006][ T5895] bridge0: port 2(bridge_slave_1) entered blocking state
[ 101.140413][ T5895] bridge0: port 2(bridge_slave_1) entered disabled state
[ 101.148280][ T5895] bridge_slave_1: entered allmulticast mode
[ 101.156795][ T5895] bridge_slave_1: entered promiscuous mode
[ 101.190568][ T5895] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 101.202724][ T5895] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 101.238812][ T5895] team0: Port device team_slave_0 added
[ 101.247897][ T5895] team0: Port device team_slave_1 added
[ 101.278004][ T5895] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 101.285383][ T5895] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 101.312241][ T5895] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 101.324609][ T5895] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 101.338140][ T5895] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 101.364992][ T5895] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 101.414930][ T5895] hsr_slave_0: entered promiscuous mode
[ 101.422054][ T5895] hsr_slave_1: entered promiscuous mode
[ 101.428762][ T5895] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 101.437135][ T5895] Cannot create hsr debugfs directory
[ 101.526901][ T3495] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 102.930185][ T50] Bluetooth: hci0: command tx timeout
[ 103.932478][ T3495] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 104.016247][ T3495] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 104.914854][ T3495] hsr_slave_0: left promiscuous mode
[ 104.923890][ T3495] hsr_slave_1: left promiscuous mode
[ 104.932395][ T3495] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 104.942355][ T3495] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 104.952180][ T3495] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 104.962875][ T3495] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 104.971798][ T3495] bridge_slave_1: left allmulticast mode
[ 104.977510][ T3495] bridge_slave_1: left promiscuous mode
[ 104.987537][ T3495] bridge0: port 2(bridge_slave_1) entered disabled state
[ 105.005263][ T3495] bridge_slave_0: left allmulticast mode
[ 105.012205][ T50] Bluetooth: hci0: command tx timeout
[ 105.018061][ T3495] bridge_slave_0: left promiscuous mode
[ 105.026855][ T3495] bridge0: port 1(bridge_slave_0) entered disabled state
[ 105.063131][ T3495] veth1_macvtap: left promiscuous mode
[ 105.069114][ T3495] veth0_macvtap: left promiscuous mode
[ 105.075644][ T3495] veth1_vlan: left promiscuous mode
[ 105.083264][ T3495] veth0_vlan: left promiscuous mode
[ 105.579364][ T3495] team0 (unregistering): Port device team_slave_1 removed
[ 105.625850][ T3495] team0 (unregistering): Port device team_slave_0 removed
[ 105.658854][ T3495] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 105.696790][ T3495] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 106.047492][ T3495] bond0 (unregistering): Released all slaves
[ 106.157961][ T5895] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 106.168788][ T5895] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 106.184414][ T5895] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 106.196954][ T5895] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 106.329721][ T5895] 8021q: adding VLAN 0 to HW filter on device bond0
[ 106.356707][ T5895] 8021q: adding VLAN 0 to HW filter on device team0
[ 106.370677][ T3510] bridge0: port 1(bridge_slave_0) entered blocking state
[ 106.377850][ T3510] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 106.393054][ T42] bridge0: port 2(bridge_slave_1) entered blocking state
[ 106.400298][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 106.678702][ T5895] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 106.744780][ T5895] veth0_vlan: entered promiscuous mode
[ 106.757330][ T5895] veth1_vlan: entered promiscuous mode
[ 106.788243][ T5895] veth0_macvtap: entered promiscuous mode
[ 106.799283][ T5895] veth1_macvtap: entered promiscuous mode
[ 106.823465][ T5895] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 106.837681][ T5895] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 106.850536][ T5895] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 106.859279][ T5895] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 106.868615][ T5895] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 106.877413][ T5895] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 106.975816][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 106.983830][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 107.057962][ T3510] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 107.066228][ T3510] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 107.089679][ T50] Bluetooth: hci0: command tx timeout
2025/07/20 15:04:22 executed programs: 2
[ 108.949300][ T1025] ==================================================================
[ 108.957494][ T1025] BUG: KASAN: slab-use-after-free in __lock_acquire+0xff/0x7c80
[ 108.965328][ T1025] Read of size 8 at addr ffff88807b4307f0 by task kworker/u4:5/1025
[ 108.973312][ T1025]
[ 108.975650][ T1025] CPU: 0 PID: 1025 Comm: kworker/u4:5 Not tainted 6.6.99-syzkaller #0
[ 108.983811][ T1025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
[ 108.993875][ T1025] Workqueue: kkcmd kcm_tx_work
[ 108.998701][ T1025] Call Trace:
[ 109.002015][ T1025]
[ 109.004983][ T1025] dump_stack_lvl+0x16c/0x230
[ 109.009684][ T1025] ? __lock_acquire+0x7c80/0x7c80
[ 109.014716][ T1025] ? show_regs_print_info+0x20/0x20
[ 109.019933][ T1025] ? load_image+0x3b0/0x3b0
[ 109.024460][ T1025] ? __virt_addr_valid+0x469/0x540
[ 109.029623][ T1025] print_report+0xac/0x200
[ 109.034077][ T1025] ? __lock_acquire+0xff/0x7c80
[ 109.038947][ T1025] kasan_report+0x117/0x150
[ 109.043482][ T1025] ? __lock_acquire+0xff/0x7c80
[ 109.048370][ T1025] __lock_acquire+0xff/0x7c80
[ 109.053073][ T1025] ? lockdep_hardirqs_on_prepare+0x400/0x760
[ 109.059096][ T1025] ? finish_task_switch+0x265/0x920
[ 109.064338][ T1025] ? lockdep_hardirqs_on+0x98/0x150
[ 109.069567][ T1025] ? finish_task_switch+0x265/0x920
[ 109.074781][ T1025] ? verify_lock_unused+0x140/0x140
[ 109.080012][ T1025] ? __schedule+0x14ea/0x4580
[ 109.084806][ T1025] lock_acquire+0x197/0x410
[ 109.089325][ T1025] ? __lock_sock+0x156/0x2a0
[ 109.093944][ T1025] ? asan.module_dtor+0x20/0x20
[ 109.098816][ T1025] ? __local_bh_disable_ip+0xff/0x190
[ 109.104199][ T1025] ? read_lock_is_recursive+0x20/0x20
[ 109.109604][ T1025] ? kthread_data+0x4f/0xc0
[ 109.114135][ T1025] ? kthread_data+0x4f/0xc0
[ 109.118768][ T1025] ? __lock_sock+0x156/0x2a0
[ 109.123372][ T1025] _raw_spin_lock_bh+0x36/0x50
[ 109.128181][ T1025] ? __lock_sock+0x156/0x2a0
[ 109.132781][ T1025] __lock_sock+0x156/0x2a0
[ 109.137215][ T1025] ? sk_stream_moderate_sndbuf+0x220/0x220
[ 109.143038][ T1025] ? do_raw_spin_lock+0x121/0x2c0
[ 109.148083][ T1025] ? wake_bit_function+0x200/0x200
[ 109.153229][ T1025] ? __rwlock_init+0x150/0x150
[ 109.158011][ T1025] ? lockdep_hardirqs_on_prepare+0x400/0x760
[ 109.164008][ T1025] ? lock_sock_nested+0x6a/0x100
[ 109.168963][ T1025] lock_sock_nested+0x9f/0x100
[ 109.173760][ T1025] kcm_tx_work+0x31/0x180
[ 109.178123][ T1025] ? process_scheduled_works+0x957/0x15b0
[ 109.183861][ T1025] process_scheduled_works+0xa45/0x15b0
[ 109.189463][ T1025] ? assign_work+0x400/0x400
[ 109.194108][ T1025] ? assign_work+0x39e/0x400
[ 109.198749][ T1025] worker_thread+0xa55/0xfc0
[ 109.203369][ T1025] kthread+0x2fa/0x390
[ 109.207450][ T1025] ? pr_cont_work+0x560/0x560
[ 109.212155][ T1025] ? kthread_blkcg+0xd0/0xd0
[ 109.216762][ T1025] ret_from_fork+0x48/0x80
[ 109.221196][ T1025] ? kthread_blkcg+0xd0/0xd0
[ 109.225955][ T1025] ret_from_fork_asm+0x11/0x20
[ 109.230869][ T1025]
[ 109.233931][ T1025]
[ 109.236277][ T1025] Allocated by task 5955:
[ 109.240656][ T1025] kasan_set_track+0x4e/0x70
[ 109.245263][ T1025] __kasan_slab_alloc+0x6c/0x80
[ 109.250124][ T1025] slab_post_alloc_hook+0x6e/0x4d0
[ 109.255262][ T1025] kmem_cache_alloc+0x11e/0x2e0
[ 109.260130][ T1025] sk_prot_alloc+0x57/0x210
[ 109.264642][ T1025] sk_alloc+0x3a/0x360
[ 109.268718][ T1025] kcm_ioctl+0x215/0xff0
[ 109.272987][ T1025] sock_do_ioctl+0xd7/0x2f0
[ 109.277686][ T1025] sock_ioctl+0x623/0x7a0
[ 109.282049][ T1025] __se_sys_ioctl+0xfd/0x170
[ 109.286839][ T1025] do_syscall_64+0x55/0xb0
[ 109.291280][ T1025] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 109.297219][ T1025]
[ 109.299554][ T1025] Freed by task 5956:
[ 109.303540][ T1025] kasan_set_track+0x4e/0x70
[ 109.308147][ T1025] kasan_save_free_info+0x2e/0x50
[ 109.313184][ T1025] ____kasan_slab_free+0x126/0x1e0
[ 109.318327][ T1025] slab_free_freelist_hook+0x130/0x1b0
[ 109.323853][ T1025] kmem_cache_free+0xf8/0x280
[ 109.328581][ T1025] __sk_destruct+0x485/0x620
[ 109.333200][ T1025] kcm_release+0x524/0x5b0
[ 109.337633][ T1025] sock_close+0xbd/0x230
[ 109.341902][ T1025] __fput+0x234/0x970
[ 109.345901][ T1025] __se_sys_close+0x15f/0x220
[ 109.350592][ T1025] do_syscall_64+0x55/0xb0
[ 109.355043][ T1025] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 109.360957][ T1025]
[ 109.363287][ T1025] Last potentially related work creation:
[ 109.369026][ T1025] kasan_save_stack+0x3e/0x60
[ 109.373716][ T1025] __kasan_record_aux_stack+0xaf/0xc0
[ 109.379104][ T1025] insert_work+0x3d/0x310
[ 109.383450][ T1025] __queue_work+0xc39/0x1020
[ 109.388056][ T1025] queue_work_on+0x121/0x1e0
[ 109.392655][ T1025] kcm_unattach+0x861/0xe80
[ 109.397171][ T1025] kcm_ioctl+0x791/0xff0
[ 109.401428][ T1025] sock_do_ioctl+0xd7/0x2f0
[ 109.405947][ T1025] sock_ioctl+0x623/0x7a0
[ 109.410309][ T1025] __se_sys_ioctl+0xfd/0x170
[ 109.414970][ T1025] do_syscall_64+0x55/0xb0
[ 109.419417][ T1025] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 109.425339][ T1025]
[ 109.427703][ T1025] Second to last potentially related work creation:
[ 109.434303][ T1025] kasan_save_stack+0x3e/0x60
[ 109.438994][ T1025] __kasan_record_aux_stack+0xaf/0xc0
[ 109.444387][ T1025] insert_work+0x3d/0x310
[ 109.448729][ T1025] __queue_work+0xc39/0x1020
[ 109.453330][ T1025] queue_work_on+0x121/0x1e0
[ 109.457930][ T1025] kcm_ioctl+0xe4f/0xff0
[ 109.462189][ T1025] sock_do_ioctl+0xd7/0x2f0
[ 109.466887][ T1025] sock_ioctl+0x623/0x7a0
[ 109.471233][ T1025] __se_sys_ioctl+0xfd/0x170
[ 109.475838][ T1025] do_syscall_64+0x55/0xb0
[ 109.480362][ T1025] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 109.486290][ T1025]
[ 109.488622][ T1025] The buggy address belongs to the object at ffff88807b430740
[ 109.488622][ T1025] which belongs to the cache KCM of size 1720
[ 109.502079][ T1025] The buggy address is located 176 bytes inside of
[ 109.502079][ T1025] freed 1720-byte region [ffff88807b430740, ffff88807b430df8)
[ 109.515975][ T1025]
[ 109.518328][ T1025] The buggy address belongs to the physical page:
[ 109.524768][ T1025] page:ffffea0001ed0c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7b430
[ 109.534948][ T1025] head:ffffea0001ed0c00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 109.543893][ T1025] memcg:ffff888025fcf901
[ 109.548226][ T1025] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 109.556243][ T1025] page_type: 0xffffffff()
[ 109.560611][ T1025] raw: 00fff00000000840 ffff88814c3feb40 dead000000000122 0000000000000000
[ 109.569247][ T1025] raw: 0000000000000000 0000000080110011 00000001ffffffff ffff888025fcf901
[ 109.577845][ T1025] page dumped because: kasan: bad access detected
[ 109.584278][ T1025] page_owner tracks the page as allocated
[ 109.589998][ T1025] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5946, tgid 5945 (syz.0.16), ts 107180967408, free_ts 107111735687
[ 109.612586][ T1025] post_alloc_hook+0x1cd/0x210
[ 109.617375][ T1025] get_page_from_freelist+0x195c/0x19f0
[ 109.622941][ T1025] __alloc_pages+0x1e3/0x460
[ 109.627547][ T1025] alloc_slab_page+0x5d/0x170
[ 109.632332][ T1025] new_slab+0x87/0x2e0
[ 109.636421][ T1025] ___slab_alloc+0xc6d/0x12f0
[ 109.641119][ T1025] kmem_cache_alloc+0x1b7/0x2e0
[ 109.646007][ T1025] sk_prot_alloc+0x57/0x210
[ 109.650522][ T1025] sk_alloc+0x3a/0x360
[ 109.654606][ T1025] kcm_create+0x100/0x570
[ 109.658952][ T1025] __sock_create+0x4a6/0x940
[ 109.663552][ T1025] __sys_socket+0xd7/0x1a0
[ 109.667982][ T1025] __x64_sys_socket+0x7a/0x90
[ 109.672690][ T1025] do_syscall_64+0x55/0xb0
[ 109.677139][ T1025] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 109.683066][ T1025] page last free stack trace:
[ 109.687757][ T1025] free_unref_page_prepare+0x7ce/0x8e0
[ 109.693340][ T1025] free_unref_page+0x32/0x2e0
[ 109.698052][ T1025] __slab_free+0x35e/0x410
[ 109.702574][ T1025] qlist_free_all+0x75/0xe0
[ 109.707094][ T1025] kasan_quarantine_reduce+0x143/0x160
[ 109.712604][ T1025] __kasan_slab_alloc+0x22/0x80
[ 109.717475][ T1025] slab_post_alloc_hook+0x6e/0x4d0
[ 109.722610][ T1025] __kmem_cache_alloc_node+0x13e/0x260
[ 109.728093][ T1025] kmalloc_trace+0x2a/0xe0
[ 109.732526][ T1025] kernfs_fop_open+0x3f5/0xcc0
[ 109.737307][ T1025] do_dentry_open+0x8c6/0x1500
[ 109.742100][ T1025] path_openat+0x274b/0x3190
[ 109.746718][ T1025] do_filp_open+0x1c5/0x3d0
[ 109.751246][ T1025] do_sys_openat2+0x12c/0x1c0
[ 109.756031][ T1025] __x64_sys_openat+0x139/0x160
[ 109.760904][ T1025] do_syscall_64+0x55/0xb0
[ 109.765344][ T1025]
[ 109.767676][ T1025] Memory state around the buggy address:
[ 109.773313][ T1025] ffff88807b430680: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc
[ 109.781491][ T1025] ffff88807b430700: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 109.789584][ T1025] >ffff88807b430780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 109.797682][ T1025] ^
[ 109.805411][ T1025] ffff88807b430800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 109.813490][ T1025] ffff88807b430880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 109.821759][ T1025] ==================================================================
[ 109.829877][ T1025] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 109.837177][ T1025] CPU: 0 PID: 1025 Comm: kworker/u4:5 Not tainted 6.6.99-syzkaller #0
[ 109.845461][ T1025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
[ 109.855543][ T1025] Workqueue: kkcmd kcm_tx_work
[ 109.860346][ T1025] Call Trace:
[ 109.863639][ T1025]
[ 109.866670][ T1025] dump_stack_lvl+0x16c/0x230
[ 109.871370][ T1025] ? show_regs_print_info+0x20/0x20
[ 109.876584][ T1025] ? load_image+0x3b0/0x3b0
[ 109.881117][ T1025] panic+0x2c0/0x710
[ 109.885117][ T1025] ? bpf_jit_dump+0xd0/0xd0
[ 109.889647][ T1025] ? _raw_spin_unlock_irqrestore+0xae/0x110
[ 109.895570][ T1025] ? _raw_spin_unlock+0x40/0x40
[ 109.900495][ T1025] ? print_memory_metadata+0x314/0x400
[ 109.905965][ T1025] ? __lock_acquire+0xff/0x7c80
[ 109.910850][ T1025] check_panic_on_warn+0x84/0xa0
[ 109.915805][ T1025] ? __lock_acquire+0xff/0x7c80
[ 109.920759][ T1025] end_report+0x6f/0x140
[ 109.925159][ T1025] kasan_report+0x128/0x150
[ 109.929708][ T1025] ? __lock_acquire+0xff/0x7c80
[ 109.934604][ T1025] __lock_acquire+0xff/0x7c80
[ 109.939313][ T1025] ? lockdep_hardirqs_on_prepare+0x400/0x760
[ 109.945343][ T1025] ? finish_task_switch+0x265/0x920
[ 109.950581][ T1025] ? lockdep_hardirqs_on+0x98/0x150
[ 109.955798][ T1025] ? finish_task_switch+0x265/0x920
[ 109.961006][ T1025] ? verify_lock_unused+0x140/0x140
[ 109.966219][ T1025] ? __schedule+0x14ea/0x4580
[ 109.970918][ T1025] lock_acquire+0x197/0x410
[ 109.975442][ T1025] ? __lock_sock+0x156/0x2a0
[ 109.980055][ T1025] ? asan.module_dtor+0x20/0x20
[ 109.984925][ T1025] ? __local_bh_disable_ip+0xff/0x190
[ 109.990320][ T1025] ? read_lock_is_recursive+0x20/0x20
[ 109.995735][ T1025] ? kthread_data+0x4f/0xc0
[ 110.001596][ T1025] ? kthread_data+0x4f/0xc0
[ 110.006573][ T1025] ? __lock_sock+0x156/0x2a0
[ 110.011602][ T1025] _raw_spin_lock_bh+0x36/0x50
[ 110.018417][ T1025] ? __lock_sock+0x156/0x2a0
[ 110.023210][ T1025] __lock_sock+0x156/0x2a0
[ 110.027843][ T1025] ? sk_stream_moderate_sndbuf+0x220/0x220
[ 110.033763][ T1025] ? do_raw_spin_lock+0x121/0x2c0
[ 110.038826][ T1025] ? wake_bit_function+0x200/0x200
[ 110.043971][ T1025] ? __rwlock_init+0x150/0x150
[ 110.048778][ T1025] ? lockdep_hardirqs_on_prepare+0x400/0x760
[ 110.054785][ T1025] ? lock_sock_nested+0x6a/0x100
[ 110.059747][ T1025] lock_sock_nested+0x9f/0x100
[ 110.064618][ T1025] kcm_tx_work+0x31/0x180
[ 110.068983][ T1025] ? process_scheduled_works+0x957/0x15b0
[ 110.075075][ T1025] process_scheduled_works+0xa45/0x15b0
[ 110.080727][ T1025] ? assign_work+0x400/0x400
[ 110.085360][ T1025] ? assign_work+0x39e/0x400
[ 110.090084][ T1025] worker_thread+0xa55/0xfc0
[ 110.094719][ T1025] kthread+0x2fa/0x390
[ 110.099342][ T1025] ? pr_cont_work+0x560/0x560
[ 110.104043][ T1025] ? kthread_blkcg+0xd0/0xd0
[ 110.108671][ T1025] ret_from_fork+0x48/0x80
[ 110.113160][ T1025] ? kthread_blkcg+0xd0/0xd0
[ 110.117767][ T1025] ret_from_fork_asm+0x11/0x20
[ 110.122601][ T1025]
[ 110.125758][ T1025] Kernel Offset: disabled
[ 110.130087][ T1025] Rebooting in 86400 seconds..