[ 92.086534][ T787] cfg80211: failed to load regulatory.db Warning: Permanently added '10.128.1.70' (ED25519) to the list of known hosts. 2025/12/19 09:17:17 parsed 1 programs [ 97.091295][ T5777] cgroup: Unknown subsys name 'net' [ 97.263648][ T5777] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 99.039404][ T5777] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 102.732520][ T5811] chnl_net:caif_netlink_parms(): no params data found [ 102.808839][ T5811] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.816634][ T5811] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.823858][ T5811] bridge_slave_0: entered allmulticast mode [ 102.831238][ T5811] bridge_slave_0: entered promiscuous mode [ 102.843745][ T5811] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.851188][ T5811] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.858544][ T5811] bridge_slave_1: entered allmulticast mode [ 102.866077][ T5811] bridge_slave_1: entered promiscuous mode [ 102.935658][ T5811] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.948101][ T5811] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.980315][ T5811] team0: Port device team_slave_0 added [ 102.988319][ T5811] team0: Port device team_slave_1 added [ 103.018698][ T5811] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 103.025741][ T5811] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 103.052203][ T5811] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 103.078191][ T5811] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 103.085238][ T5811] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 103.111418][ T5811] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 103.170192][ T5811] hsr_slave_0: entered promiscuous mode [ 103.177499][ T5811] hsr_slave_1: entered promiscuous mode [ 103.359574][ T5811] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 103.370691][ T5811] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 103.380865][ T5811] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 103.405885][ T5811] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 103.455051][ T5811] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.462299][ T5811] bridge0: port 2(bridge_slave_1) entered forwarding state [ 103.470776][ T5811] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.477964][ T5811] bridge0: port 1(bridge_slave_0) entered forwarding state [ 103.550525][ T5811] 8021q: adding VLAN 0 to HW filter on device bond0 [ 103.569771][ T1124] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.581893][ T1124] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.599017][ T5811] 8021q: adding VLAN 0 to HW filter on device team0 [ 103.622816][ T1132] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.630014][ T1132] bridge0: port 1(bridge_slave_0) entered forwarding state [ 103.644136][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.651307][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 103.898454][ T5811] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 103.941624][ T5811] veth0_vlan: entered promiscuous mode [ 103.953511][ T5811] veth1_vlan: entered promiscuous mode [ 103.985117][ T5811] veth0_macvtap: entered promiscuous mode [ 103.995449][ T5811] veth1_macvtap: entered promiscuous mode [ 104.017547][ T5811] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 104.032884][ T5811] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 104.045888][ T5811] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.056247][ T5811] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.065176][ T5811] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.073898][ T5811] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.206405][ T5811] syz-executor (5811) used greatest stack depth: 19952 bytes left [ 104.241584][ T1132] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 104.367707][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 104.376648][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 104.385537][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 104.393770][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 104.402516][ T51] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 104.410094][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 105.289408][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.297622][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.330652][ T1024] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.339608][ T1024] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2025/12/19 09:17:29 executed programs: 0 [ 106.587988][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 106.599408][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 106.607903][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 106.616977][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 106.624988][ T51] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 106.632299][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 106.797690][ T5880] chnl_net:caif_netlink_parms(): no params data found [ 106.867304][ T5880] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.874756][ T5880] bridge0: port 1(bridge_slave_0) entered disabled state [ 106.882209][ T5880] bridge_slave_0: entered allmulticast mode [ 106.889550][ T5880] bridge_slave_0: entered promiscuous mode [ 106.898629][ T5880] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.906320][ T5880] bridge0: port 2(bridge_slave_1) entered disabled state [ 106.913561][ T5880] bridge_slave_1: entered allmulticast mode [ 106.921709][ T5880] bridge_slave_1: entered promiscuous mode [ 106.940245][ T1132] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 106.981785][ T5880] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 106.993826][ T5880] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 107.035711][ T5880] team0: Port device team_slave_0 added [ 107.043945][ T5880] team0: Port device team_slave_1 added [ 107.071881][ T5880] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 107.079091][ T5880] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 107.106100][ T5880] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 107.118503][ T5880] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 107.125866][ T5880] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 107.152692][ T5880] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 107.197129][ T5880] hsr_slave_0: entered promiscuous mode [ 107.206975][ T5880] hsr_slave_1: entered promiscuous mode [ 107.213198][ T5880] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 107.221149][ T5880] Cannot create hsr debugfs directory [ 108.725249][ T5081] Bluetooth: hci0: command tx timeout [ 109.155924][ T1132] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 109.231380][ T1132] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 110.118742][ T5880] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 110.133567][ T5880] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 110.167771][ T5880] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 110.179376][ T5880] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 110.208460][ T1132] hsr_slave_0: left promiscuous mode [ 110.217665][ T1132] hsr_slave_1: left promiscuous mode [ 110.224023][ T1132] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 110.231994][ T1132] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 110.243814][ T1132] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 110.252220][ T1132] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 110.262215][ T1132] bridge_slave_1: left allmulticast mode [ 110.268274][ T1132] bridge_slave_1: left promiscuous mode [ 110.275188][ T1132] bridge0: port 2(bridge_slave_1) entered disabled state [ 110.289010][ T1132] bridge_slave_0: left allmulticast mode [ 110.294780][ T1132] bridge_slave_0: left promiscuous mode [ 110.300615][ T1132] bridge0: port 1(bridge_slave_0) entered disabled state [ 110.332523][ T1132] veth1_macvtap: left promiscuous mode [ 110.338654][ T1132] veth0_macvtap: left promiscuous mode [ 110.347127][ T1132] veth1_vlan: left promiscuous mode [ 110.352812][ T1132] veth0_vlan: left promiscuous mode [ 110.759585][ T1132] team0 (unregistering): Port device team_slave_1 removed [ 110.792065][ T1132] team0 (unregistering): Port device team_slave_0 removed [ 110.814416][ T5081] Bluetooth: hci0: command tx timeout [ 110.831029][ T1132] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 110.865753][ T1132] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 111.316867][ T1132] bond0 (unregistering): Released all slaves [ 111.517784][ T5880] 8021q: adding VLAN 0 to HW filter on device bond0 [ 111.538680][ T5880] 8021q: adding VLAN 0 to HW filter on device team0 [ 111.560829][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.568021][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 111.585761][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 111.592905][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 111.832500][ T5880] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 111.915014][ T5880] veth0_vlan: entered promiscuous mode [ 111.928604][ T5880] veth1_vlan: entered promiscuous mode [ 111.983181][ T5880] veth0_macvtap: entered promiscuous mode [ 112.001337][ T5880] veth1_macvtap: entered promiscuous mode [ 112.039242][ T5880] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 112.053283][ T5880] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 112.077744][ T5880] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.087037][ T5880] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.096331][ T5880] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.106081][ T5880] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.171487][ T1124] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.190748][ T1124] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 2025/12/19 09:17:35 executed programs: 2 [ 112.217431][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.225907][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.274204][ T5927] syz.0.17[5927]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 112.309849][ T5927] loop0: detected capacity change from 0 to 2048 [ 112.350562][ T5927] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 112.885113][ T5081] Bluetooth: hci0: command tx timeout [ 112.940803][ T5880] ================================================================== [ 112.949123][ T5880] BUG: KASAN: slab-use-after-free in udf_unlink+0x5e3/0x6d0 [ 112.956671][ T5880] Read of size 4 at addr ffff88807b2f45c0 by task syz-executor/5880 [ 112.964680][ T5880] [ 112.967067][ T5880] CPU: 1 PID: 5880 Comm: syz-executor Not tainted syzkaller #0 [ 112.974642][ T5880] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 112.984757][ T5880] Call Trace: [ 112.988072][ T5880] [ 112.991023][ T5880] dump_stack_lvl+0x16c/0x230 [ 112.995725][ T5880] ? __lock_acquire+0x7c80/0x7c80 [ 113.000785][ T5880] ? show_regs_print_info+0x20/0x20 [ 113.006004][ T5880] ? load_image+0x3b0/0x3b0 [ 113.010521][ T5880] ? __virt_addr_valid+0x469/0x540 [ 113.015645][ T5880] print_report+0xac/0x220 [ 113.020078][ T5880] ? udf_unlink+0x5e3/0x6d0 [ 113.024607][ T5880] kasan_report+0x117/0x150 [ 113.029300][ T5880] ? udf_unlink+0x5e3/0x6d0 [ 113.033825][ T5880] udf_unlink+0x5e3/0x6d0 [ 113.038263][ T5880] ? udf_link+0x4e0/0x4e0 [ 113.042615][ T5880] ? down_write+0x162/0x1f0 [ 113.047129][ T5880] ? down_read_killable+0x340/0x340 [ 113.052428][ T5880] ? bpf_lsm_inode_unlink+0x9/0x10 [ 113.057549][ T5880] ? security_inode_unlink+0xcf/0x110 [ 113.062942][ T5880] vfs_unlink+0x389/0x600 [ 113.067305][ T5880] do_unlinkat+0x328/0x570 [ 113.071731][ T5880] ? fsnotify_link_count+0xf0/0xf0 [ 113.076858][ T5880] ? getname_flags+0x20a/0x500 [ 113.081642][ T5880] __x64_sys_unlink+0x49/0x50 [ 113.086340][ T5880] do_syscall_64+0x55/0xb0 [ 113.090769][ T5880] ? clear_bhb_loop+0x40/0x90 [ 113.095456][ T5880] ? clear_bhb_loop+0x40/0x90 [ 113.100145][ T5880] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 113.106053][ T5880] RIP: 0033:0x7f8c1c58ecf7 [ 113.110489][ T5880] Code: 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 113.130123][ T5880] RSP: 002b:00007fffd6b81d98 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 [ 113.138549][ T5880] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f8c1c58ecf7 [ 113.146529][ T5880] RDX: 00007fffd6b81dc0 RSI: 00007fffd6b81e50 RDI: 00007fffd6b81e50 [ 113.154515][ T5880] RBP: 00007fffd6b81e50 R08: 0000000000000000 R09: 0000000000000000 [ 113.162514][ T5880] R10: 0000000000000100 R11: 0000000000000206 R12: 00007fffd6b82f40 [ 113.170502][ T5880] R13: 00007f8c1c613d7d R14: 000000000001b8e8 R15: 00007fffd6b85100 [ 113.178498][ T5880] [ 113.181521][ T5880] [ 113.183895][ T5880] Allocated by task 5880: [ 113.188242][ T5880] kasan_set_track+0x4e/0x70 [ 113.192839][ T5880] __kasan_kmalloc+0x8f/0xa0 [ 113.197440][ T5880] kobject_uevent_env+0x274/0x8c0 [ 113.202567][ T5880] netdev_queue_update_kobjects+0x243/0x480 [ 113.208469][ T5880] netdev_register_kobject+0x269/0x310 [ 113.213943][ T5880] register_netdevice+0x128f/0x1ae0 [ 113.219145][ T5880] veth_newlink+0x598/0xc30 [ 113.223664][ T5880] rtnl_newlink+0x14d0/0x2020 [ 113.228348][ T5880] rtnetlink_rcv_msg+0x7c7/0xf10 [ 113.233299][ T5880] netlink_rcv_skb+0x216/0x480 [ 113.238067][ T5880] netlink_unicast+0x751/0x8d0 [ 113.242851][ T5880] netlink_sendmsg+0x8c1/0xbe0 [ 113.247622][ T5880] __sys_sendto+0x46a/0x620 [ 113.252132][ T5880] __x64_sys_sendto+0xde/0xf0 [ 113.256817][ T5880] do_syscall_64+0x55/0xb0 [ 113.261236][ T5880] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 113.267140][ T5880] [ 113.269469][ T5880] Freed by task 5880: [ 113.273458][ T5880] kasan_set_track+0x4e/0x70 [ 113.278056][ T5880] kasan_save_free_info+0x2e/0x50 [ 113.283106][ T5880] ____kasan_slab_free+0x126/0x1e0 [ 113.288396][ T5880] slab_free_freelist_hook+0x130/0x1b0 [ 113.293872][ T5880] __kmem_cache_free+0xba/0x1f0 [ 113.298734][ T5880] kobject_uevent_env+0x363/0x8c0 [ 113.303779][ T5880] netdev_queue_update_kobjects+0x243/0x480 [ 113.309683][ T5880] netdev_register_kobject+0x269/0x310 [ 113.315151][ T5880] register_netdevice+0x128f/0x1ae0 [ 113.320614][ T5880] veth_newlink+0x598/0xc30 [ 113.325221][ T5880] rtnl_newlink+0x14d0/0x2020 [ 113.329906][ T5880] rtnetlink_rcv_msg+0x7c7/0xf10 [ 113.334853][ T5880] netlink_rcv_skb+0x216/0x480 [ 113.339623][ T5880] netlink_unicast+0x751/0x8d0 [ 113.344492][ T5880] netlink_sendmsg+0x8c1/0xbe0 [ 113.349271][ T5880] __sys_sendto+0x46a/0x620 [ 113.353784][ T5880] __x64_sys_sendto+0xde/0xf0 [ 113.358464][ T5880] do_syscall_64+0x55/0xb0 [ 113.362905][ T5880] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 113.368807][ T5880] [ 113.371146][ T5880] The buggy address belongs to the object at ffff88807b2f4000 [ 113.371146][ T5880] which belongs to the cache kmalloc-4k of size 4096 [ 113.385293][ T5880] The buggy address is located 1472 bytes inside of [ 113.385293][ T5880] freed 4096-byte region [ffff88807b2f4000, ffff88807b2f5000) [ 113.399267][ T5880] [ 113.401592][ T5880] The buggy address belongs to the physical page: [ 113.408021][ T5880] page:ffffea0001ecbc00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7b2f0 [ 113.418194][ T5880] head:ffffea0001ecbc00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 113.427140][ T5880] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 113.435234][ T5880] page_type: 0xffffffff() [ 113.439583][ T5880] raw: 00fff00000000840 ffff888017842140 dead000000000122 0000000000000000 [ 113.448182][ T5880] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 113.456773][ T5880] page dumped because: kasan: bad access detected [ 113.463201][ T5880] page_owner tracks the page as allocated [ 113.468920][ T5880] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5880, tgid 5880 (syz-executor), ts 106823072622, free_ts 106729168604 [ 113.491852][ T5880] post_alloc_hook+0x1cd/0x210 [ 113.496640][ T5880] get_page_from_freelist+0x195c/0x19f0 [ 113.502303][ T5880] __alloc_pages+0x1e3/0x460 [ 113.506921][ T5880] alloc_slab_page+0x5d/0x170 [ 113.511614][ T5880] new_slab+0x87/0x2e0 [ 113.515817][ T5880] ___slab_alloc+0xc6d/0x1300 [ 113.520539][ T5880] __kmem_cache_alloc_node+0x1a2/0x260 [ 113.526024][ T5880] kmalloc_trace+0x2a/0xe0 [ 113.530466][ T5880] kobject_uevent_env+0x274/0x8c0 [ 113.535509][ T5880] net_rx_queue_update_kobjects+0x313/0x580 [ 113.541429][ T5880] netdev_register_kobject+0x227/0x310 [ 113.546921][ T5880] register_netdevice+0x128f/0x1ae0 [ 113.552137][ T5880] veth_newlink+0x598/0xc30 [ 113.556663][ T5880] rtnl_newlink+0x14d0/0x2020 [ 113.561352][ T5880] rtnetlink_rcv_msg+0x7c7/0xf10 [ 113.566302][ T5880] netlink_rcv_skb+0x216/0x480 [ 113.571073][ T5880] page last free stack trace: [ 113.575771][ T5880] free_unref_page_prepare+0x7ce/0x8e0 [ 113.581262][ T5880] free_unref_page+0x32/0x2e0 [ 113.585951][ T5880] __slab_free+0x35e/0x410 [ 113.590378][ T5880] qlist_free_all+0x75/0xe0 [ 113.594889][ T5880] kasan_quarantine_reduce+0x143/0x160 [ 113.600368][ T5880] __kasan_slab_alloc+0x22/0x80 [ 113.605223][ T5880] slab_post_alloc_hook+0x6e/0x4d0 [ 113.610345][ T5880] kmem_cache_alloc+0x11e/0x2e0 [ 113.615213][ T5880] __kernfs_new_node+0xd8/0x7e0 [ 113.620080][ T5880] kernfs_new_node+0x14c/0x260 [ 113.624855][ T5880] __kernfs_create_file+0x4b/0x2e0 [ 113.629977][ T5880] sysfs_add_file_mode_ns+0x238/0x300 [ 113.635360][ T5880] internal_create_group+0x428/0xd00 [ 113.640646][ T5880] sysfs_create_groups+0x59/0x120 [ 113.645676][ T5880] device_add_attrs+0x1b2/0x810 [ 113.650539][ T5880] device_add+0x528/0xc20 [ 113.654880][ T5880] [ 113.657208][ T5880] Memory state around the buggy address: [ 113.662842][ T5880] ffff88807b2f4480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 113.670904][ T5880] ffff88807b2f4500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 113.678969][ T5880] >ffff88807b2f4580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 113.687030][ T5880] ^ [ 113.693189][ T5880] ffff88807b2f4600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 113.701365][ T5880] ffff88807b2f4680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 113.709513][ T5880] ================================================================== [ 113.727037][ T5880] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 113.734284][ T5880] CPU: 0 PID: 5880 Comm: syz-executor Not tainted syzkaller #0 [ 113.741859][ T5880] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 113.751950][ T5880] Call Trace: [ 113.755254][ T5880] [ 113.758232][ T5880] dump_stack_lvl+0x16c/0x230 [ 113.762950][ T5880] ? show_regs_print_info+0x20/0x20 [ 113.768189][ T5880] ? load_image+0x3b0/0x3b0 [ 113.772730][ T5880] panic+0x2c0/0x710 [ 113.776669][ T5880] ? bpf_jit_dump+0xd0/0xd0 [ 113.781195][ T5880] ? _raw_spin_unlock_irqrestore+0xfa/0x110 [ 113.787110][ T5880] ? _raw_spin_unlock+0x40/0x40 [ 113.791975][ T5880] ? print_memory_metadata+0x314/0x400 [ 113.797449][ T5880] ? udf_unlink+0x5e3/0x6d0 [ 113.801961][ T5880] check_panic_on_warn+0x84/0xa0 [ 113.806930][ T5880] ? udf_unlink+0x5e3/0x6d0 [ 113.811535][ T5880] end_report+0x6f/0x140 [ 113.815794][ T5880] kasan_report+0x128/0x150 [ 113.820315][ T5880] ? udf_unlink+0x5e3/0x6d0 [ 113.824845][ T5880] udf_unlink+0x5e3/0x6d0 [ 113.829201][ T5880] ? udf_link+0x4e0/0x4e0 [ 113.833548][ T5880] ? down_write+0x162/0x1f0 [ 113.838059][ T5880] ? down_read_killable+0x340/0x340 [ 113.843269][ T5880] ? bpf_lsm_inode_unlink+0x9/0x10 [ 113.848389][ T5880] ? security_inode_unlink+0xcf/0x110 [ 113.853776][ T5880] vfs_unlink+0x389/0x600 [ 113.858121][ T5880] do_unlinkat+0x328/0x570 [ 113.862545][ T5880] ? fsnotify_link_count+0xf0/0xf0 [ 113.867666][ T5880] ? getname_flags+0x20a/0x500 [ 113.872447][ T5880] __x64_sys_unlink+0x49/0x50 [ 113.877132][ T5880] do_syscall_64+0x55/0xb0 [ 113.881550][ T5880] ? clear_bhb_loop+0x40/0x90 [ 113.886260][ T5880] ? clear_bhb_loop+0x40/0x90 [ 113.890954][ T5880] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 113.896856][ T5880] RIP: 0033:0x7f8c1c58ecf7 [ 113.901279][ T5880] Code: 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 113.920894][ T5880] RSP: 002b:00007fffd6b81d98 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 [ 113.929352][ T5880] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f8c1c58ecf7 [ 113.937330][ T5880] RDX: 00007fffd6b81dc0 RSI: 00007fffd6b81e50 RDI: 00007fffd6b81e50 [ 113.945396][ T5880] RBP: 00007fffd6b81e50 R08: 0000000000000000 R09: 0000000000000000 [ 113.953399][ T5880] R10: 0000000000000100 R11: 0000000000000206 R12: 00007fffd6b82f40 [ 113.961493][ T5880] R13: 00007f8c1c613d7d R14: 000000000001b8e8 R15: 00007fffd6b85100 [ 113.969501][ T5880] [ 113.972846][ T5880] Kernel Offset: disabled [ 113.977176][ T5880] Rebooting in 86400 seconds..