Warning: Permanently added '10.128.0.141' (ED25519) to the list of known hosts. 2025/08/02 23:16:43 ignoring optional flag "sandboxArg"="0" 2025/08/02 23:16:45 parsed 1 programs [ 82.532752][ T4273] cgroup: Unknown subsys name 'net' [ 82.643477][ T4273] cgroup: Unknown subsys name 'rlimit' [ 84.239869][ T4273] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 86.137877][ T4289] chnl_net:caif_netlink_parms(): no params data found [ 86.196295][ T4289] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.204048][ T4289] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.212760][ T4289] device bridge_slave_0 entered promiscuous mode [ 86.221806][ T4289] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.229039][ T4289] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.237125][ T4289] device bridge_slave_1 entered promiscuous mode [ 86.264449][ T4289] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.276741][ T4289] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.302809][ T4289] team0: Port device team_slave_0 added [ 86.312976][ T4289] team0: Port device team_slave_1 added [ 86.333202][ T4289] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.340296][ T4289] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.366281][ T4289] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.381085][ T4289] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.388209][ T4289] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.414964][ T4289] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.452395][ T4289] device hsr_slave_0 entered promiscuous mode [ 86.459773][ T4289] device hsr_slave_1 entered promiscuous mode [ 86.565368][ T4289] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 86.576204][ T4289] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 86.589372][ T4289] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 86.598739][ T4289] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 86.626773][ T4289] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.634062][ T4289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.642265][ T4289] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.649637][ T4289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.701637][ T4289] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.718903][ T75] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 86.731212][ T75] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.740426][ T75] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.749709][ T75] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 86.764191][ T4289] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.784370][ T75] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 86.793977][ T75] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.801172][ T75] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.812083][ T75] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 86.821061][ T75] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.828190][ T75] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.838765][ T126] cfg80211: failed to load regulatory.db [ 86.892237][ T75] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 86.906263][ T75] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 86.920414][ T75] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 86.929784][ T75] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 86.944456][ T4289] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 86.959487][ T4289] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 86.970176][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 87.257561][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 87.265999][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 87.280978][ T4289] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.307960][ T75] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 87.318519][ T75] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 87.340046][ T75] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 87.349337][ T75] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 87.359371][ T75] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 87.367455][ T75] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 87.377709][ T4289] device veth0_vlan entered promiscuous mode [ 87.390410][ T4289] device veth1_vlan entered promiscuous mode [ 87.411472][ T75] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 87.420336][ T75] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 87.428912][ T75] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 87.437622][ T75] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 87.449699][ T4289] device veth0_macvtap entered promiscuous mode [ 87.459018][ T4289] device veth1_macvtap entered promiscuous mode [ 87.474539][ T4289] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.482877][ T75] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 87.493940][ T75] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 87.502499][ T75] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 87.511634][ T75] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 87.523911][ T4289] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.532291][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 87.541077][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 87.552616][ T4289] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.562397][ T4289] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.571640][ T4289] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.580708][ T4289] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.719335][ T9] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 88.736196][ T4338] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 88.744439][ T4338] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 88.753571][ T4338] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 88.763467][ T4338] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 88.771833][ T4338] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 88.779734][ T4338] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 88.978148][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.986426][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.997927][ T75] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 89.021769][ T41] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.030231][ T41] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.040352][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 89.886208][ T9] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2025/08/02 23:16:55 executed programs: 0 [ 90.488079][ T48] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 90.496242][ T48] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 90.503983][ T48] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 90.512890][ T48] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 90.521817][ T48] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 90.529565][ T48] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 90.665098][ T4367] chnl_net:caif_netlink_parms(): no params data found [ 90.715369][ T4367] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.722649][ T4367] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.730835][ T4367] device bridge_slave_0 entered promiscuous mode [ 90.738940][ T4367] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.746518][ T4367] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.754459][ T4367] device bridge_slave_1 entered promiscuous mode [ 90.779590][ T4367] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.790743][ T4367] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.817024][ T4367] team0: Port device team_slave_0 added [ 90.824506][ T4367] team0: Port device team_slave_1 added [ 90.848499][ T4367] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.855638][ T4367] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.881716][ T4367] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.893845][ T4367] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.900970][ T4367] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.927327][ T4367] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.964109][ T4367] device hsr_slave_0 entered promiscuous mode [ 90.971126][ T4367] device hsr_slave_1 entered promiscuous mode [ 90.978543][ T4367] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 90.986627][ T4367] Cannot create hsr debugfs directory [ 92.125729][ T9] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 92.188023][ T9] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 92.596591][ T4338] Bluetooth: hci0: command 0x0409 tx timeout [ 93.082413][ T9] device hsr_slave_0 left promiscuous mode [ 93.089233][ T9] device hsr_slave_1 left promiscuous mode [ 93.097449][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 93.105542][ T9] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 93.114260][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 93.122405][ T9] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 93.133023][ T9] device bridge_slave_1 left promiscuous mode [ 93.140738][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.156261][ T9] device bridge_slave_0 left promiscuous mode [ 93.162563][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.194313][ T9] device veth1_macvtap left promiscuous mode [ 93.200851][ T9] device veth0_macvtap left promiscuous mode [ 93.210610][ T9] device veth1_vlan left promiscuous mode [ 93.217038][ T9] device veth0_vlan left promiscuous mode [ 93.588914][ T9] team0 (unregistering): Port device team_slave_1 removed [ 93.618656][ T9] team0 (unregistering): Port device team_slave_0 removed [ 93.651236][ T9] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 93.682630][ T9] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 93.944452][ T9] bond0 (unregistering): Released all slaves [ 94.022840][ T4367] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 94.033940][ T4367] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 94.043278][ T4367] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 94.054617][ T4367] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 94.126752][ T4367] 8021q: adding VLAN 0 to HW filter on device bond0 [ 94.140477][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 94.148546][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 94.173449][ T4367] 8021q: adding VLAN 0 to HW filter on device team0 [ 94.183958][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 94.194472][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 94.203118][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.210320][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.219130][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 94.237526][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 94.249918][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 94.259008][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.266222][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.278565][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 94.297698][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 94.309370][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 94.319123][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 94.328685][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 94.346953][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 94.357147][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 94.366359][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 94.375016][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 94.386953][ T4402] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 94.395877][ T4402] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 94.408493][ T4367] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 94.652274][ T4402] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 94.661634][ T4402] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 94.674891][ T4338] Bluetooth: hci0: command 0x041b tx timeout [ 94.678845][ T4367] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.715365][ T4402] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 94.724382][ T4402] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 94.750372][ T4367] device veth0_vlan entered promiscuous mode [ 94.757572][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 94.772217][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 94.782474][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 94.790917][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 94.807558][ T4367] device veth1_vlan entered promiscuous mode [ 94.841423][ T4402] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 94.850877][ T4402] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 94.860077][ T4402] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 94.869168][ T4402] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 94.880431][ T4367] device veth0_macvtap entered promiscuous mode [ 94.891930][ T4367] device veth1_macvtap entered promiscuous mode [ 94.914550][ T4367] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.923057][ T4402] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 94.933045][ T4402] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 94.941444][ T4402] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 94.950643][ T4402] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 94.964138][ T4367] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.976151][ T4367] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.985286][ T4367] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.994519][ T4367] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.003669][ T4367] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.015334][ T4402] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 95.024259][ T4402] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 95.088073][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.110257][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.120315][ T4402] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.124987][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 95.134760][ T4402] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.144623][ T4402] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 2025/08/02 23:17:01 executed programs: 3 [ 96.754894][ T4338] Bluetooth: hci0: command 0x040f tx timeout [ 98.835335][ T4338] Bluetooth: hci0: command 0x0419 tx timeout 2025/08/02 23:17:06 executed programs: 9 2025/08/02 23:17:11 executed programs: 15 2025/08/02 23:17:16 executed programs: 21 2025/08/02 23:17:21 executed programs: 27 2025/08/02 23:17:26 executed programs: 33 2025/08/02 23:17:31 executed programs: 39 2025/08/02 23:17:36 executed programs: 45 [ 132.927906][ T1277] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.934856][ T1277] ieee802154 phy1 wpan1: encryption failed: -22 2025/08/02 23:17:42 executed programs: 51 2025/08/02 23:17:47 executed programs: 57 2025/08/02 23:17:52 executed programs: 63 2025/08/02 23:17:57 executed programs: 69 2025/08/02 23:18:02 executed programs: 75 2025/08/02 23:18:07 executed programs: 81 2025/08/02 23:18:12 executed programs: 87 2025/08/02 23:18:17 executed programs: 93 2025/08/02 23:18:23 executed programs: 99 2025/08/02 23:18:28 executed programs: 105 2025/08/02 23:18:33 executed programs: 111 2025/08/02 23:18:38 executed programs: 117 [ 194.367170][ T1277] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.373676][ T1277] ieee802154 phy1 wpan1: encryption failed: -22 2025/08/02 23:18:43 executed programs: 123 [ 199.431135][ T11] ================================================================== [ 199.439280][ T11] BUG: KASAN: use-after-free in do_raw_spin_lock+0x235/0x280 [ 199.446690][ T11] Read of size 4 at addr ffff88807e7841dc by task kworker/u4:1/11 [ 199.454506][ T11] [ 199.456875][ T11] CPU: 1 PID: 11 Comm: kworker/u4:1 Not tainted 6.1.147-syzkaller #0 [ 199.464963][ T11] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 199.475092][ T11] Workqueue: kkcmd kcm_tx_work [ 199.479883][ T11] Call Trace: [ 199.483251][ T11] [ 199.486190][ T11] dump_stack_lvl+0x168/0x22e [ 199.490925][ T11] ? __lock_acquire+0x7c50/0x7c50 [ 199.495965][ T11] ? show_regs_print_info+0x12/0x12 [ 199.501172][ T11] ? load_image+0x3b0/0x3b0 [ 199.505688][ T11] ? _raw_spin_lock_irqsave+0xb0/0xf0 [ 199.511079][ T11] ? __virt_addr_valid+0x188/0x540 [ 199.516223][ T11] ? __virt_addr_valid+0x465/0x540 [ 199.521345][ T11] ? do_raw_spin_lock+0x235/0x280 [ 199.526404][ T11] print_report+0xa8/0x200 [ 199.530833][ T11] kasan_report+0x10b/0x140 [ 199.535347][ T11] ? do_raw_spin_lock+0x235/0x280 [ 199.540384][ T11] do_raw_spin_lock+0x235/0x280 [ 199.545260][ T11] ? __bpf_trace_softirq+0x10/0x10 [ 199.550402][ T11] ? __rwlock_init+0x140/0x140 [ 199.555204][ T11] ? lock_sock_nested+0x66/0x100 [ 199.560214][ T11] ? release_sock+0x2b/0x1b0 [ 199.564858][ T11] ? process_one_work+0x7a1/0x1160 [ 199.570099][ T11] release_sock+0x2b/0x1b0 [ 199.574540][ T11] ? process_one_work+0x7a1/0x1160 [ 199.579660][ T11] process_one_work+0x898/0x1160 [ 199.584616][ T11] ? worker_detach_from_pool+0x240/0x240 [ 199.590288][ T11] ? _raw_spin_lock_irq+0xab/0xe0 [ 199.595361][ T11] ? _raw_spin_lock_irqsave+0xf0/0xf0 [ 199.600765][ T11] ? kthread_data+0x4b/0xc0 [ 199.605306][ T11] worker_thread+0xaa2/0x1250 [ 199.610004][ T11] kthread+0x29d/0x330 [ 199.614103][ T11] ? worker_clr_flags+0x1a0/0x1a0 [ 199.619134][ T11] ? kthread_blkcg+0xd0/0xd0 [ 199.623736][ T11] ret_from_fork+0x1f/0x30 [ 199.628170][ T11] [ 199.631190][ T11] [ 199.633513][ T11] Allocated by task 4938: [ 199.637839][ T11] kasan_set_track+0x4b/0x70 [ 199.642438][ T11] __kasan_slab_alloc+0x6b/0x80 [ 199.647297][ T11] slab_post_alloc_hook+0x4b/0x480 [ 199.652409][ T11] kmem_cache_alloc+0x123/0x2f0 [ 199.657261][ T11] sk_prot_alloc+0x57/0x210 [ 199.661777][ T11] sk_alloc+0x36/0x340 [ 199.665864][ T11] kcm_ioctl+0x211/0xff0 [ 199.670139][ T11] sock_do_ioctl+0xd3/0x2f0 [ 199.674650][ T11] sock_ioctl+0x4ed/0x6e0 [ 199.678999][ T11] __se_sys_ioctl+0xfa/0x170 [ 199.683619][ T11] do_syscall_64+0x4c/0xa0 [ 199.688054][ T11] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 199.693959][ T11] [ 199.696282][ T11] Freed by task 4939: [ 199.700261][ T11] kasan_set_track+0x4b/0x70 [ 199.704864][ T11] kasan_save_free_info+0x2d/0x50 [ 199.709896][ T11] ____kasan_slab_free+0x126/0x1e0 [ 199.715041][ T11] slab_free_freelist_hook+0x131/0x1a0 [ 199.720507][ T11] kmem_cache_free+0xf7/0x290 [ 199.725201][ T11] __sk_destruct+0x48d/0x630 [ 199.729800][ T11] kcm_release+0x520/0x5b0 [ 199.734281][ T11] sock_close+0xd5/0x240 [ 199.738534][ T11] __fput+0x22c/0x920 [ 199.742525][ T11] task_work_run+0x1ca/0x250 [ 199.747123][ T11] exit_to_user_mode_loop+0xe6/0x110 [ 199.752419][ T11] exit_to_user_mode_prepare+0xb1/0x140 [ 199.757971][ T11] syscall_exit_to_user_mode+0x16/0x40 [ 199.763538][ T11] do_syscall_64+0x58/0xa0 [ 199.767964][ T11] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 199.773893][ T11] [ 199.776213][ T11] Last potentially related work creation: [ 199.781928][ T11] kasan_save_stack+0x3a/0x60 [ 199.786613][ T11] __kasan_record_aux_stack+0xb2/0xc0 [ 199.791996][ T11] insert_work+0x54/0x3c0 [ 199.796331][ T11] __queue_work+0xba3/0xfb0 [ 199.800849][ T11] queue_work_on+0x11d/0x1d0 [ 199.805452][ T11] kcm_unattach+0x861/0xe80 [ 199.809980][ T11] kcm_ioctl+0x78d/0xff0 [ 199.814245][ T11] sock_do_ioctl+0xd3/0x2f0 [ 199.818764][ T11] sock_ioctl+0x4ed/0x6e0 [ 199.823099][ T11] __se_sys_ioctl+0xfa/0x170 [ 199.827701][ T11] do_syscall_64+0x4c/0xa0 [ 199.832136][ T11] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 199.838048][ T11] [ 199.840368][ T11] Second to last potentially related work creation: [ 199.846963][ T11] kasan_save_stack+0x3a/0x60 [ 199.851667][ T11] __kasan_record_aux_stack+0xb2/0xc0 [ 199.857057][ T11] insert_work+0x54/0x3c0 [ 199.861389][ T11] __queue_work+0xba3/0xfb0 [ 199.865903][ T11] queue_work_on+0x11d/0x1d0 [ 199.870510][ T11] kcm_ioctl+0xe4b/0xff0 [ 199.874778][ T11] sock_do_ioctl+0xd3/0x2f0 [ 199.879306][ T11] sock_ioctl+0x4ed/0x6e0 [ 199.883734][ T11] __se_sys_ioctl+0xfa/0x170 [ 199.888333][ T11] do_syscall_64+0x4c/0xa0 [ 199.892781][ T11] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 199.898684][ T11] [ 199.901013][ T11] The buggy address belongs to the object at ffff88807e784140 [ 199.901013][ T11] which belongs to the cache KCM of size 1720 [ 199.914462][ T11] The buggy address is located 156 bytes inside of [ 199.914462][ T11] 1720-byte region [ffff88807e784140, ffff88807e7847f8) [ 199.927829][ T11] [ 199.930153][ T11] The buggy address belongs to the physical page: [ 199.936588][ T11] page:ffffea0001f9e000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7e780 [ 199.946741][ T11] head:ffffea0001f9e000 order:3 compound_mapcount:0 compound_pincount:0 [ 199.955069][ T11] memcg:ffff88801d645401 [ 199.959317][ T11] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 199.967319][ T11] raw: 00fff00000010200 0000000000000000 dead000000000001 ffff88802f803a00 [ 199.975910][ T11] raw: 0000000000000000 0000000080110011 00000001ffffffff ffff88801d645401 [ 199.984487][ T11] page dumped because: kasan: bad access detected [ 199.990930][ T11] page_owner tracks the page as allocated [ 199.996641][ T11] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 4612, tgid 4610 (syz.0.59), ts 131110890153, free_ts 131040058907 [ 200.019231][ T11] post_alloc_hook+0x173/0x1a0 [ 200.024015][ T11] get_page_from_freelist+0x1a26/0x1ac0 [ 200.029572][ T11] __alloc_pages+0x1df/0x4e0 [ 200.034169][ T11] alloc_slab_page+0x5d/0x160 [ 200.038851][ T11] new_slab+0x87/0x2c0 [ 200.042925][ T11] ___slab_alloc+0xbc6/0x1220 [ 200.047606][ T11] kmem_cache_alloc+0x1b7/0x2f0 [ 200.052460][ T11] sk_prot_alloc+0x57/0x210 [ 200.057006][ T11] sk_alloc+0x36/0x340 [ 200.061112][ T11] kcm_ioctl+0x211/0xff0 [ 200.065369][ T11] sock_do_ioctl+0xd3/0x2f0 [ 200.069902][ T11] sock_ioctl+0x4ed/0x6e0 [ 200.074236][ T11] __se_sys_ioctl+0xfa/0x170 [ 200.078853][ T11] do_syscall_64+0x4c/0xa0 [ 200.083274][ T11] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 200.089181][ T11] page last free stack trace: [ 200.093863][ T11] free_unref_page_prepare+0x8b4/0x9a0 [ 200.099344][ T11] free_unref_page+0x2e/0x3f0 [ 200.104031][ T11] __unfreeze_partials+0x1a5/0x200 [ 200.109148][ T11] put_cpu_partial+0x17c/0x250 [ 200.113916][ T11] qlist_free_all+0x76/0xe0 [ 200.118426][ T11] kasan_quarantine_reduce+0x144/0x160 [ 200.123889][ T11] __kasan_slab_alloc+0x1e/0x80 [ 200.128750][ T11] slab_post_alloc_hook+0x4b/0x480 [ 200.133873][ T11] kmem_cache_alloc+0x123/0x2f0 [ 200.138730][ T11] getname_flags+0xb7/0x500 [ 200.143255][ T11] user_path_at_empty+0x28/0x60 [ 200.148137][ T11] __x64_sys_umount+0xf1/0x160 [ 200.152958][ T11] do_syscall_64+0x4c/0xa0 [ 200.157383][ T11] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 200.163296][ T11] [ 200.165623][ T11] Memory state around the buggy address: [ 200.171264][ T11] ffff88807e784080: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc [ 200.179420][ T11] ffff88807e784100: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 200.187487][ T11] >ffff88807e784180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 200.195568][ T11] ^ [ 200.202506][ T11] ffff88807e784200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 200.210576][ T11] ffff88807e784280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 200.218659][ T11] ================================================================== [ 200.226860][ T11] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 200.234104][ T11] CPU: 1 PID: 11 Comm: kworker/u4:1 Not tainted 6.1.147-syzkaller #0 [ 200.242227][ T11] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 200.252321][ T11] Workqueue: kkcmd kcm_tx_work [ 200.257123][ T11] Call Trace: [ 200.260415][ T11] [ 200.263389][ T11] dump_stack_lvl+0x168/0x22e [ 200.268100][ T11] ? memcpy+0x3c/0x60 [ 200.272127][ T11] ? show_regs_print_info+0x12/0x12 [ 200.277339][ T11] ? load_image+0x3b0/0x3b0 [ 200.281870][ T11] panic+0x2c9/0x710 [ 200.285781][ T11] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 200.291957][ T11] ? bpf_jit_dump+0xd0/0xd0 [ 200.296503][ T11] ? _raw_spin_unlock_irqrestore+0xa5/0x100 [ 200.302422][ T11] ? _raw_spin_unlock_irqrestore+0xaa/0x100 [ 200.308339][ T11] ? _raw_spin_unlock+0x40/0x40 [ 200.313221][ T11] check_panic_on_warn+0x80/0xa0 [ 200.318178][ T11] ? do_raw_spin_lock+0x235/0x280 [ 200.323222][ T11] end_report+0x66/0x110 [ 200.327483][ T11] kasan_report+0x118/0x140 [ 200.332001][ T11] ? do_raw_spin_lock+0x235/0x280 [ 200.337052][ T11] do_raw_spin_lock+0x235/0x280 [ 200.341932][ T11] ? __bpf_trace_softirq+0x10/0x10 [ 200.347069][ T11] ? __rwlock_init+0x140/0x140 [ 200.351847][ T11] ? lock_sock_nested+0x66/0x100 [ 200.356819][ T11] ? release_sock+0x2b/0x1b0 [ 200.361434][ T11] ? process_one_work+0x7a1/0x1160 [ 200.366582][ T11] release_sock+0x2b/0x1b0 [ 200.371018][ T11] ? process_one_work+0x7a1/0x1160 [ 200.376138][ T11] process_one_work+0x898/0x1160 [ 200.381106][ T11] ? worker_detach_from_pool+0x240/0x240 [ 200.386761][ T11] ? _raw_spin_lock_irq+0xab/0xe0 [ 200.391804][ T11] ? _raw_spin_lock_irqsave+0xf0/0xf0 [ 200.397185][ T11] ? kthread_data+0x4b/0xc0 [ 200.401701][ T11] worker_thread+0xaa2/0x1250 [ 200.406394][ T11] kthread+0x29d/0x330 [ 200.410496][ T11] ? worker_clr_flags+0x1a0/0x1a0 [ 200.415562][ T11] ? kthread_blkcg+0xd0/0xd0 [ 200.420172][ T11] ret_from_fork+0x1f/0x30 [ 200.424608][ T11] [ 200.427989][ T11] Kernel Offset: disabled [ 200.432325][ T11] Rebooting in 86400 seconds..