last executing test programs: 2.300312495s ago: executing program 0 (id=1): r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000069c0)=[{{0x0, 0x0, &(0x7f0000000040)=[{0x0}], 0x1}, 0x9}], 0x1, 0x10002, 0x0) connect$llc(r0, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 1.778736011s ago: executing program 0 (id=6): r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000069c0)=[{{0x0, 0x0, &(0x7f0000000040)=[{0x0}, {0x0}], 0x2}, 0x9}], 0x1, 0x10002, 0x0) connect$llc(r0, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 1.639102822s ago: executing program 4 (id=5): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x2803, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_CPUID2(r2, 0x4048aecb, &(0x7f0000000480)={0x7, 0x0, [{0xb, 0xffffffff, 0x4, 0xffffff89, 0x6, 0x6, 0x3}, {0x1, 0x4, 0x0, 0x8, 0x0, 0x1, 0x5}, {0x0, 0x8, 0x0, 0x3ff, 0x7ffffdff, 0x8005, 0x31}, {0x80000019, 0xe5f, 0x1, 0x8, 0xdf3, 0x6, 0x80000001}, {0x80000000, 0x2ab, 0x1, 0xd, 0x3, 0x7ff, 0x400}, {0xc0000000, 0x100, 0x4, 0x6, 0x400003, 0x40000002, 0xe0000}, {0x80000001, 0x2, 0x3f91c194927b8e21, 0xfffffff7, 0xfffffff9, 0xff, 0x6}]}) 695.194636ms ago: executing program 4 (id=7): r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, 0x0, 0x0) setsockopt$MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, {0xa, 0x0, 0x0, @empty}, 0x0, {[0x2, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x2]}}, 0x5c) 436.639981ms ago: executing program 4 (id=8): socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet(0x2, 0x3, 0x2) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000180), 0xfea7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000007580), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB, @ANYRES16, @ANYBLOB="2d01620000000900509072fb60cb080003"], 0x2c}}, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB="46040000", @ANYRES16=r5, @ANYBLOB="ff830500000700ffffff", @ANYRES8=r1], 0x4}}, 0x0) sendfile(r4, r2, 0x0, 0x100000000) 361.091801ms ago: executing program 0 (id=9): syz_open_dev$dri(0x0, 0x1, 0xc0400) r0 = syz_open_dev$sg(&(0x7f0000001940), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000040)={0x0, 0x2, 0xffffff8f}) r1 = syz_open_dev$dri(0x0, 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r2, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000540), 0x3c) r3 = epoll_create1(0x80000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000180)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r5, &(0x7f0000000100)={0x20000014}) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r3, &(0x7f0000000000)={0xa0000001}) poll(&(0x7f00000000c0)=[{r6, 0x1009}], 0x1, 0x8000007) 318.394346ms ago: executing program 3 (id=4): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYRESHEX], 0x50}, 0x1, 0x0, 0x0, 0x8008800}, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x400000000000047, 0x0) 135.392938ms ago: executing program 3 (id=10): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r1, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c0000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="312000000005000014002b800800", @ANYRES32, @ANYBLOB="080003000200000008001b"], 0x3c}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) 0s ago: executing program 4 (id=11): openat$ttyprintk(0xffffff9c, &(0x7f0000000040), 0xc8100, 0x0) r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x5961, 0x10000, 0x0, 0x4e}, &(0x7f0000000100)=0x0, &(0x7f0000000200)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10}) io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) r4 = fcntl$getown(0xffffffffffffffff, 0x9) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB, @ANYRES32=r4, @ANYRESHEX=r4], &(0x7f0000000340)='GPL\x00', 0x6, 0xb9, &(0x7f0000000140)=""/185, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(r4, 0x1, &(0x7f0000000080)=0x7) prlimit64(r4, 0xb, &(0x7f00000000c0)={0xa000, 0x5}, 0x0) r5 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r5, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r6, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d39"]) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r9, 0x5, &(0x7f00000005c0)='fd', 0x0, r8) fsconfig$FSCONFIG_CMD_CREATE(r9, 0x6, 0x0, 0x0, 0x0) r10 = fsmount(r9, 0x0, 0x2) unlinkat(r10, &(0x7f0000000040)='./file0\x00', 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.153' (ED25519) to the list of known hosts. [ 66.738590][ T5577] cgroup: Unknown subsys name 'net' [ 66.987981][ T5577] cgroup: Unknown subsys name 'cpuset' [ 67.033966][ T5577] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 68.612641][ T5577] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 71.247587][ T1341] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.247656][ T1341] ieee802154 phy1 wpan1: encryption failed: -22 [ 72.653116][ T60] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 72.670818][ T60] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 72.673498][ T60] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 72.731187][ T5631] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 72.772306][ T5632] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 72.774335][ T5631] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 72.795755][ T5631] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 72.801476][ T5631] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 72.817718][ T5633] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 72.827265][ T5633] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 72.844387][ T5632] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 72.845986][ T5633] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 72.846799][ T5633] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 72.847553][ T5633] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 72.850932][ T5633] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 72.852308][ T5633] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 72.852779][ T5632] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 72.852987][ T5632] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 72.853177][ T5632] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 72.859081][ T5632] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 72.859643][ T5632] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 72.860994][ T5633] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 72.864856][ T5633] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 72.870235][ T5629] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 72.871007][ T5633] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 75.004569][ T5625] Bluetooth: hci3: command tx timeout [ 75.004797][ T60] Bluetooth: hci1: command tx timeout [ 75.083711][ T60] Bluetooth: hci2: command tx timeout [ 75.083816][ T60] Bluetooth: hci4: command tx timeout [ 75.083886][ T60] Bluetooth: hci0: command tx timeout [ 75.158918][ T5614] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.159629][ T5614] bridge0: port 1(bridge_slave_0) entered disabled state [ 75.159779][ T5614] bridge_slave_0: entered allmulticast mode [ 75.161637][ T5614] bridge_slave_0: entered promiscuous mode [ 75.222669][ T5614] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.222823][ T5614] bridge0: port 2(bridge_slave_1) entered disabled state [ 75.222960][ T5614] bridge_slave_1: entered allmulticast mode [ 75.226746][ T5614] bridge_slave_1: entered promiscuous mode [ 75.269399][ T5615] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.269565][ T5615] bridge0: port 1(bridge_slave_0) entered disabled state [ 75.269697][ T5615] bridge_slave_0: entered allmulticast mode [ 75.271463][ T5615] bridge_slave_0: entered promiscuous mode [ 75.337515][ T5615] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.337744][ T5615] bridge0: port 2(bridge_slave_1) entered disabled state [ 75.338591][ T5615] bridge_slave_1: entered allmulticast mode [ 75.340492][ T5615] bridge_slave_1: entered promiscuous mode [ 75.381360][ T5616] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.381640][ T5616] bridge0: port 1(bridge_slave_0) entered disabled state [ 75.381873][ T5616] bridge_slave_0: entered allmulticast mode [ 75.385316][ T5616] bridge_slave_0: entered promiscuous mode [ 75.395618][ T5613] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.395889][ T5613] bridge0: port 1(bridge_slave_0) entered disabled state [ 75.396108][ T5613] bridge_slave_0: entered allmulticast mode [ 75.400556][ T5613] bridge_slave_0: entered promiscuous mode [ 75.426549][ T5612] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.426822][ T5612] bridge0: port 1(bridge_slave_0) entered disabled state [ 75.427403][ T5612] bridge_slave_0: entered allmulticast mode [ 75.430904][ T5612] bridge_slave_0: entered promiscuous mode [ 75.446016][ T5614] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 75.446469][ T5616] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.446809][ T5616] bridge0: port 2(bridge_slave_1) entered disabled state [ 75.447063][ T5616] bridge_slave_1: entered allmulticast mode [ 75.451145][ T5616] bridge_slave_1: entered promiscuous mode [ 75.452750][ T5613] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.453019][ T5613] bridge0: port 2(bridge_slave_1) entered disabled state [ 75.455372][ T5613] bridge_slave_1: entered allmulticast mode [ 75.459967][ T5613] bridge_slave_1: entered promiscuous mode [ 75.488503][ T5612] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.488830][ T5612] bridge0: port 2(bridge_slave_1) entered disabled state [ 75.489058][ T5612] bridge_slave_1: entered allmulticast mode [ 75.494200][ T5612] bridge_slave_1: entered promiscuous mode [ 75.501459][ T5614] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 75.589091][ T5615] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 75.646078][ T5615] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 75.680261][ T5616] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 75.694570][ T5613] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 75.715203][ T5612] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 75.718161][ T5614] team0: Port device team_slave_0 added [ 75.721746][ T5616] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 75.736285][ T5613] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 75.761960][ T5612] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 75.765058][ T5614] team0: Port device team_slave_1 added [ 75.797711][ T5615] team0: Port device team_slave_0 added [ 75.851680][ T5615] team0: Port device team_slave_1 added [ 75.883058][ T5616] team0: Port device team_slave_0 added [ 75.891981][ T5613] team0: Port device team_slave_0 added [ 75.909689][ T5612] team0: Port device team_slave_0 added [ 75.911566][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 75.911575][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 75.911588][ T5614] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 75.928461][ T5616] team0: Port device team_slave_1 added [ 75.932572][ T5613] team0: Port device team_slave_1 added [ 75.959498][ T5612] team0: Port device team_slave_1 added [ 75.961539][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 75.961550][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 75.961573][ T5614] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 76.037188][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 76.037200][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 76.037214][ T5615] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 76.103434][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 76.103447][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 76.103469][ T5615] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 76.135056][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 76.135069][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 76.135092][ T5616] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 76.159269][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 76.159282][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 76.159305][ T5613] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 76.162652][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 76.162663][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 76.162686][ T5612] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 76.170967][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 76.170979][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 76.171002][ T5616] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 76.177282][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 76.177294][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 76.177316][ T5613] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 76.180252][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 76.180263][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 76.180385][ T5612] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 76.309113][ T5614] hsr_slave_0: entered promiscuous mode [ 76.311242][ T5614] hsr_slave_1: entered promiscuous mode [ 76.409126][ T5615] hsr_slave_0: entered promiscuous mode [ 76.411121][ T5615] hsr_slave_1: entered promiscuous mode [ 76.412875][ T5615] debugfs: 'hsr0' already exists in 'hsr' [ 76.412978][ T5615] Cannot create hsr debugfs directory [ 76.497263][ T5616] hsr_slave_0: entered promiscuous mode [ 76.498528][ T5616] hsr_slave_1: entered promiscuous mode [ 76.499449][ T5616] debugfs: 'hsr0' already exists in 'hsr' [ 76.499470][ T5616] Cannot create hsr debugfs directory [ 76.507734][ T5613] hsr_slave_0: entered promiscuous mode [ 76.509854][ T5613] hsr_slave_1: entered promiscuous mode [ 76.511577][ T5613] debugfs: 'hsr0' already exists in 'hsr' [ 76.511597][ T5613] Cannot create hsr debugfs directory [ 76.525834][ T5612] hsr_slave_0: entered promiscuous mode [ 76.527831][ T5612] hsr_slave_1: entered promiscuous mode [ 76.531504][ T5612] debugfs: 'hsr0' already exists in 'hsr' [ 76.531524][ T5612] Cannot create hsr debugfs directory [ 77.087750][ T5635] Bluetooth: hci3: command tx timeout [ 77.088155][ T60] Bluetooth: hci1: command tx timeout [ 77.163815][ T5625] Bluetooth: hci0: command tx timeout [ 77.163900][ T5635] Bluetooth: hci4: command tx timeout [ 77.164055][ T60] Bluetooth: hci2: command tx timeout [ 77.786738][ T5614] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 77.836720][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 77.843425][ T5614] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 77.877941][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 77.884279][ T5614] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 77.910545][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 77.927605][ T5614] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 77.969318][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 78.087649][ T5615] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 78.119600][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 78.134201][ T5615] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 78.166431][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 78.177904][ T5615] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 78.210690][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 78.240647][ T5615] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 78.276894][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 78.437887][ T5613] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 78.467544][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 78.471591][ T5613] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 78.490387][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 78.502126][ T5613] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 78.527945][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 78.553451][ T5613] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 78.588129][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 78.720694][ T5612] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 78.747817][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 78.762618][ T5612] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 78.786612][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 78.792516][ T5612] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 78.814791][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 78.849469][ T5612] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 78.887659][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 78.942835][ T5614] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.042857][ T5616] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 79.068075][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 79.095946][ T5616] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 79.128276][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 79.133497][ T5616] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 79.164428][ T60] Bluetooth: hci1: command tx timeout [ 79.164453][ T60] Bluetooth: hci3: command tx timeout [ 79.173277][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 79.186864][ T5614] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.203439][ T5616] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 79.243924][ T5635] Bluetooth: hci2: command tx timeout [ 79.243950][ T5635] Bluetooth: hci4: command tx timeout [ 79.243969][ T5635] Bluetooth: hci0: command tx timeout [ 79.249735][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 79.313188][ T1314] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.313332][ T1314] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.352615][ T5615] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.378718][ T1068] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.378829][ T1068] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.471656][ T5615] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.538619][ T3116] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.538762][ T3116] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.581007][ T5613] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.585897][ T1314] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.586078][ T1314] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.716452][ T5613] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.752428][ T5612] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.787546][ T3132] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.787805][ T3132] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.938732][ T3132] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.938892][ T3132] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.025050][ T5612] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.054560][ T5616] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.095739][ T87] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.115877][ T87] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.177669][ T3407] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.177829][ T3407] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.317132][ T5616] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.404889][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.404984][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.459129][ T3407] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.459328][ T3407] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.785038][ T5614] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.255141][ T60] Bluetooth: hci3: command tx timeout [ 81.255167][ T60] Bluetooth: hci1: command tx timeout [ 81.326038][ T5635] Bluetooth: hci0: command tx timeout [ 81.326067][ T5635] Bluetooth: hci4: command tx timeout [ 81.326087][ T5635] Bluetooth: hci2: command tx timeout [ 81.398830][ T5615] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.626122][ T1237] cfg80211: failed to load regulatory.db [ 81.911049][ T5615] veth0_vlan: entered promiscuous mode [ 82.086949][ T5615] veth1_vlan: entered promiscuous mode [ 82.112619][ T5613] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.170155][ T5614] veth0_vlan: entered promiscuous mode [ 82.201656][ T5612] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.255049][ T5614] veth1_vlan: entered promiscuous mode [ 82.371235][ T5616] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.404904][ T5615] veth0_macvtap: entered promiscuous mode [ 82.436985][ T5615] veth1_macvtap: entered promiscuous mode [ 82.486870][ T5613] veth0_vlan: entered promiscuous mode [ 82.516732][ T5614] veth0_macvtap: entered promiscuous mode [ 82.526315][ T5612] veth0_vlan: entered promiscuous mode [ 82.562728][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 82.577944][ T5614] veth1_macvtap: entered promiscuous mode [ 82.580496][ T5613] veth1_vlan: entered promiscuous mode [ 82.614826][ T5612] veth1_vlan: entered promiscuous mode [ 82.622602][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 82.688555][ T42] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.716401][ T42] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.730284][ T42] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.745991][ T42] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.746519][ T5616] veth0_vlan: entered promiscuous mode [ 82.758601][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 82.851949][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 82.926073][ T5616] veth1_vlan: entered promiscuous mode [ 82.975784][ T42] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.008376][ T42] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.010553][ T5613] veth0_macvtap: entered promiscuous mode [ 83.090519][ T42] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.217346][ T42] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.234824][ T5613] veth1_macvtap: entered promiscuous mode [ 83.240574][ T5612] veth0_macvtap: entered promiscuous mode [ 83.316483][ T5612] veth1_macvtap: entered promiscuous mode [ 83.418910][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.418934][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.576618][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.665797][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.669503][ T5616] veth0_macvtap: entered promiscuous mode [ 83.680407][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.701463][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.701481][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.752044][ T5616] veth1_macvtap: entered promiscuous mode [ 83.760729][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.760914][ T1321] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.787237][ T1321] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.819711][ T1321] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.839345][ T1321] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.841288][ T87] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.841304][ T87] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.869064][ T1321] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.880237][ T1321] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.891435][ T1321] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.897941][ T1321] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.951675][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.052213][ T1321] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.052232][ T1321] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.072952][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.348231][ T57] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.362615][ T57] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.479908][ T57] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.488381][ T57] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.990098][ T5815] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 85.014108][ T1321] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.014122][ T1321] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.420114][ T1321] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.420134][ T1321] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.871752][ T1321] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.883435][ T1321] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.188079][ T3407] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.188094][ T3407] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.226505][ T5823] program syz.0.9 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 86.330382][ T5827] Zero length message leads to an empty skb [ 86.449071][ T1321] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.449089][ T1321] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.577001][ T5835] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10'. [ 87.047996][ T5838] 9p: Bad value for 'version' [ 92.171516][ T5832] ================================================================== [ 92.171533][ T5832] BUG: KASAN: slab-use-after-free in clear_tfile_check_list+0x114/0x380 [ 92.171565][ T5832] Read of size 8 at addr ffff88803e29e168 by task syz.0.9/5832 [ 92.171584][ T5832] [ 92.171607][ T5832] CPU: 0 UID: 0 PID: 5832 Comm: syz.0.9 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 92.171631][ T5832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 92.171652][ T5832] Call Trace: [ 92.171663][ T5832] [ 92.171672][ T5832] dump_stack_lvl+0xe8/0x150 [ 92.171701][ T5832] print_address_description+0x55/0x1e0 [ 92.171728][ T5832] ? clear_tfile_check_list+0x114/0x380 [ 92.171747][ T5832] print_report+0x58/0x70 [ 92.171772][ T5832] kasan_report+0x117/0x150 [ 92.171808][ T5832] ? clear_tfile_check_list+0x114/0x380 [ 92.171835][ T5832] clear_tfile_check_list+0x114/0x380 [ 92.171855][ T5832] ? clear_tfile_check_list+0x22/0x380 [ 92.171876][ T5832] do_epoll_ctl_file+0x8fd/0xed0 [ 92.171908][ T5832] ? do_epoll_ctl_file+0xac3/0xed0 [ 92.171939][ T5832] ? __pfx_do_epoll_ctl_file+0x10/0x10 [ 92.171971][ T5832] ? __fget_files+0x3a6/0x420 [ 92.171996][ T5832] ? __fget_files+0x2a/0x420 [ 92.172026][ T5832] __se_sys_epoll_ctl+0x14e/0x210 [ 92.172059][ T5832] ? __pfx___se_sys_epoll_ctl+0x10/0x10 [ 92.172093][ T5832] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.172115][ T5832] do_syscall_64+0x174/0x580 [ 92.172135][ T5832] ? trace_irq_disable+0x3b/0x140 [ 92.172161][ T5832] ? clear_bhb_loop+0x40/0x90 [ 92.172184][ T5832] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.172205][ T5832] RIP: 0033:0x7ff45507ce59 [ 92.172227][ T5832] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.172245][ T5832] RSP: 002b:00007ff452e71028 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9 [ 92.172267][ T5832] RAX: ffffffffffffffda RBX: 00007ff4552f6270 RCX: 00007ff45507ce59 [ 92.172283][ T5832] RDX: 0000000000000005 RSI: 0000000000000001 RDI: 0000000000000008 [ 92.172295][ T5832] RBP: 00007ff455112d6f R08: 0000000000000000 R09: 0000000000000000 [ 92.172308][ T5832] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 92.172322][ T5832] R13: 00007ff4552f6308 R14: 00007ff4552f6270 R15: 00007ffcdcde6fe8 [ 92.172346][ T5832] [ 92.172353][ T5832] [ 92.172358][ T5832] Allocated by task 5829: [ 92.172368][ T5832] kasan_save_track+0x3e/0x80 [ 92.172391][ T5832] __kasan_slab_alloc+0x6c/0x80 [ 92.172415][ T5832] kmem_cache_alloc_noprof+0x33b/0x680 [ 92.172439][ T5832] ep_insert+0x512/0x1820 [ 92.172465][ T5832] do_epoll_ctl_file+0x8bb/0xed0 [ 92.172493][ T5832] __se_sys_epoll_ctl+0x14e/0x210 [ 92.172521][ T5832] do_syscall_64+0x174/0x580 [ 92.172538][ T5832] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.172557][ T5832] [ 92.172561][ T5832] Freed by task 5823: [ 92.172570][ T5832] kasan_save_track+0x3e/0x80 [ 92.172592][ T5832] kasan_save_free_info+0x46/0x50 [ 92.172610][ T5832] __kasan_slab_free+0x5c/0x80 [ 92.172635][ T5832] kmem_cache_free+0x187/0x6c0 [ 92.172660][ T5832] eventpoll_release_file+0xc2/0x240 [ 92.172687][ T5832] __fput+0x83c/0xa70 [ 92.172710][ T5832] task_work_run+0x1d9/0x270 [ 92.172734][ T5832] get_signal+0x11eb/0x1330 [ 92.172763][ T5832] arch_do_signal_or_restart+0xbc/0x840 [ 92.172784][ T5832] exit_to_user_mode_loop+0xa9/0x680 [ 92.172815][ T5832] do_syscall_64+0x353/0x580 [ 92.172833][ T5832] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.172851][ T5832] [ 92.172855][ T5832] The buggy address belongs to the object at ffff88803e29e160 [ 92.172855][ T5832] which belongs to the cache ep_head of size 16 [ 92.172872][ T5832] The buggy address is located 8 bytes inside of [ 92.172872][ T5832] freed 16-byte region [ffff88803e29e160, ffff88803e29e170) [ 92.172893][ T5832] [ 92.172898][ T5832] The buggy address belongs to the physical page: [ 92.172914][ T5832] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803e29e1e0 pfn:0x3e29e [ 92.172933][ T5832] memcg:ffff88806177a001 [ 92.172942][ T5832] flags: 0x80000000000200(workingset|node=0|zone=1) [ 92.172964][ T5832] page_type: f5(slab) [ 92.172983][ T5832] raw: 0080000000000200 ffff888140e93dc0 ffff8880212cc088 ffffea0000fc0910 [ 92.173003][ T5832] raw: ffff88803e29e1e0 000000080080003c 00000000f5000000 ffff88806177a001 [ 92.173014][ T5832] page dumped because: kasan: bad access detected [ 92.173026][ T5832] page_owner tracks the page as allocated [ 92.173033][ T5832] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4987, tgid 4987 (udevd), ts 32151830168, free_ts 32134871224 [ 92.173068][ T5832] post_alloc_hook+0x1f9/0x250 [ 92.173092][ T5832] get_page_from_freelist+0x265c/0x26e0 [ 92.173121][ T5832] __alloc_frozen_pages_noprof+0x18d/0x380 [ 92.173149][ T5832] allocate_slab+0x74/0x5e0 [ 92.173166][ T5832] refill_objects+0x33c/0x3d0 [ 92.173182][ T5832] __pcs_replace_empty_main+0x373/0x720 [ 92.173202][ T5832] kmem_cache_alloc_noprof+0x433/0x680 [ 92.173225][ T5832] ep_insert+0x512/0x1820 [ 92.173252][ T5832] do_epoll_ctl_file+0x8bb/0xed0 [ 92.173278][ T5832] __se_sys_epoll_ctl+0x14e/0x210 [ 92.173306][ T5832] do_syscall_64+0x174/0x580 [ 92.173323][ T5832] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.173341][ T5832] page last free pid 29 tgid 29 stack trace: [ 92.173352][ T5832] __free_frozen_pages+0x10af/0x1190 [ 92.173377][ T5832] tlb_remove_table_rcu+0x85/0x100 [ 92.173406][ T5832] rcu_cpu_kthread+0x99e/0x1470 [ 92.173433][ T5832] smpboot_thread_fn+0x541/0xa50 [ 92.173451][ T5832] kthread+0x388/0x470 [ 92.173473][ T5832] ret_from_fork+0x514/0xb70 [ 92.173496][ T5832] ret_from_fork_asm+0x1a/0x30 [ 92.173521][ T5832] [ 92.173525][ T5832] Memory state around the buggy address: [ 92.173534][ T5832] ffff88803e29e000: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 92.173547][ T5832] ffff88803e29e080: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 92.173561][ T5832] >ffff88803e29e100: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 92.173571][ T5832] ^ [ 92.173582][ T5832] ffff88803e29e180: fa fb fc fc 00 00 fc fc 00 00 fc fc fa fb fc fc [ 92.173595][ T5832] ffff88803e29e200: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 92.173605][ T5832] ================================================================== [ 92.193184][ T5832] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 92.193215][ T5832] CPU: 0 UID: 0 PID: 5832 Comm: syz.0.9 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 92.193240][ T5832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 92.193253][ T5832] Call Trace: [ 92.193261][ T5832] [ 92.193269][ T5832] vpanic+0x56c/0xa60 [ 92.193303][ T5832] ? __pfx_vpanic+0x10/0x10 [ 92.193332][ T5832] ? __pfx___schedule+0x10/0x10 [ 92.193385][ T5832] panic+0xc5/0xd0 [ 92.193412][ T5832] ? __pfx_panic+0x10/0x10 [ 92.193440][ T5832] ? preempt_schedule_thunk+0x16/0x40 [ 92.193465][ T5832] ? clear_tfile_check_list+0x114/0x380 [ 92.193485][ T5832] check_panic_on_warn+0x89/0xb0 [ 92.193515][ T5832] ? clear_tfile_check_list+0x114/0x380 [ 92.193533][ T5832] end_report+0x73/0x170 [ 92.193563][ T5832] ? clear_tfile_check_list+0x114/0x380 [ 92.193582][ T5832] kasan_report+0x128/0x150 [ 92.193610][ T5832] ? clear_tfile_check_list+0x114/0x380 [ 92.193633][ T5832] clear_tfile_check_list+0x114/0x380 [ 92.193653][ T5832] ? clear_tfile_check_list+0x22/0x380 [ 92.193674][ T5832] do_epoll_ctl_file+0x8fd/0xed0 [ 92.193704][ T5832] ? do_epoll_ctl_file+0xac3/0xed0 [ 92.193735][ T5832] ? __pfx_do_epoll_ctl_file+0x10/0x10 [ 92.193762][ T5832] ? __fget_files+0x3a6/0x420 [ 92.193785][ T5832] ? __fget_files+0x2a/0x420 [ 92.193823][ T5832] __se_sys_epoll_ctl+0x14e/0x210 [ 92.193855][ T5832] ? __pfx___se_sys_epoll_ctl+0x10/0x10 [ 92.193890][ T5832] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.193912][ T5832] do_syscall_64+0x174/0x580 [ 92.193932][ T5832] ? trace_irq_disable+0x3b/0x140 [ 92.193958][ T5832] ? clear_bhb_loop+0x40/0x90 [ 92.193981][ T5832] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.194001][ T5832] RIP: 0033:0x7ff45507ce59 [ 92.194020][ T5832] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.194037][ T5832] RSP: 002b:00007ff452e71028 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9 [ 92.194060][ T5832] RAX: ffffffffffffffda RBX: 00007ff4552f6270 RCX: 00007ff45507ce59 [ 92.194076][ T5832] RDX: 0000000000000005 RSI: 0000000000000001 RDI: 0000000000000008 [ 92.194088][ T5832] RBP: 00007ff455112d6f R08: 0000000000000000 R09: 0000000000000000 [ 92.194101][ T5832] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 92.194115][ T5832] R13: 00007ff4552f6308 R14: 00007ff4552f6270 R15: 00007ffcdcde6fe8 [ 92.194139][ T5832] [ 92.194382][ T5832] Kernel Offset: disabled