Warning: Permanently added '10.128.1.174' (ED25519) to the list of known hosts.
2025/07/13 04:03:49 ignoring optional flag "sandboxArg"="0"
2025/07/13 04:03:50 parsed 1 programs
[ 86.673920][ T5853] cgroup: Unknown subsys name 'net'
[ 86.808300][ T5853] cgroup: Unknown subsys name 'cpuset'
[ 86.819326][ T5853] cgroup: Unknown subsys name 'rlimit'
[ 88.282459][ T5853] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 90.580067][ T5864] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 91.087972][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 91.096940][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 91.134639][ T4436] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 91.142550][ T4436] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 91.815610][ T118] cfg80211: failed to load regulatory.db
[ 91.923597][ T5898] chnl_net:caif_netlink_parms(): no params data found
[ 92.004299][ T5898] bridge0: port 1(bridge_slave_0) entered blocking state
[ 92.011692][ T5898] bridge0: port 1(bridge_slave_0) entered disabled state
[ 92.019460][ T5898] bridge_slave_0: entered allmulticast mode
[ 92.027562][ T5898] bridge_slave_0: entered promiscuous mode
[ 92.037263][ T5898] bridge0: port 2(bridge_slave_1) entered blocking state
[ 92.044519][ T5898] bridge0: port 2(bridge_slave_1) entered disabled state
[ 92.051695][ T5898] bridge_slave_1: entered allmulticast mode
[ 92.058631][ T5898] bridge_slave_1: entered promiscuous mode
[ 92.114727][ T5898] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 92.126347][ T5898] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 92.172552][ T5898] team0: Port device team_slave_0 added
[ 92.180254][ T5898] team0: Port device team_slave_1 added
[ 92.209364][ T5898] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 92.216372][ T5898] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 92.242294][ T5898] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 92.254600][ T5898] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 92.261553][ T5898] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 92.287487][ T5898] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 92.327356][ T5898] hsr_slave_0: entered promiscuous mode
[ 92.334256][ T5898] hsr_slave_1: entered promiscuous mode
[ 92.475305][ T5898] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 92.486772][ T5898] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 92.496506][ T5898] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 92.506047][ T5898] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 92.572863][ T5898] 8021q: adding VLAN 0 to HW filter on device bond0
[ 92.599416][ T5898] 8021q: adding VLAN 0 to HW filter on device team0
[ 92.612997][ T49] bridge0: port 1(bridge_slave_0) entered blocking state
[ 92.620200][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 92.637508][ T4436] bridge0: port 2(bridge_slave_1) entered blocking state
[ 92.644622][ T4436] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 92.820162][ T5898] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 92.863280][ T5898] veth0_vlan: entered promiscuous mode
[ 92.874379][ T5898] veth1_vlan: entered promiscuous mode
[ 92.900682][ T5898] veth0_macvtap: entered promiscuous mode
[ 92.910890][ T5898] veth1_macvtap: entered promiscuous mode
[ 92.930656][ T5898] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 92.946087][ T5898] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 92.957128][ T5898] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 92.966526][ T5898] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 92.975473][ T5898] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 92.984280][ T5898] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 93.146028][ T36] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 93.256790][ T36] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 93.330051][ T36] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 93.398739][ T36] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 93.954553][ T5930] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 93.962814][ T5930] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 93.971987][ T5930] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 93.981378][ T5930] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 93.994040][ T5930] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
2025/07/13 04:04:01 executed programs: 0
[ 95.661975][ T5930] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 95.671005][ T5930] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 95.679833][ T5930] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 95.689738][ T5930] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 95.697943][ T5930] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 95.840860][ T5955] chnl_net:caif_netlink_parms(): no params data found
[ 95.904094][ T5955] bridge0: port 1(bridge_slave_0) entered blocking state
[ 95.911240][ T5955] bridge0: port 1(bridge_slave_0) entered disabled state
[ 95.919231][ T5955] bridge_slave_0: entered allmulticast mode
[ 95.926208][ T5955] bridge_slave_0: entered promiscuous mode
[ 95.934652][ T5955] bridge0: port 2(bridge_slave_1) entered blocking state
[ 95.941721][ T5955] bridge0: port 2(bridge_slave_1) entered disabled state
[ 95.949017][ T5955] bridge_slave_1: entered allmulticast mode
[ 95.955972][ T5955] bridge_slave_1: entered promiscuous mode
[ 95.986688][ T5955] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 95.998177][ T5955] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 96.036580][ T5955] team0: Port device team_slave_0 added
[ 96.045630][ T5955] team0: Port device team_slave_1 added
[ 96.099096][ T5955] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 96.107580][ T5955] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 96.133948][ T5955] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 96.148715][ T5955] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 96.156003][ T5955] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 96.182191][ T5955] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 96.236033][ T36] bridge_slave_1: left allmulticast mode
[ 96.241776][ T36] bridge_slave_1: left promiscuous mode
[ 96.248672][ T36] bridge0: port 2(bridge_slave_1) entered disabled state
[ 96.259195][ T36] bridge_slave_0: left allmulticast mode
[ 96.264924][ T36] bridge_slave_0: left promiscuous mode
[ 96.270595][ T36] bridge0: port 1(bridge_slave_0) entered disabled state
[ 96.486095][ T36] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 96.496648][ T36] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 96.506798][ T36] bond0 (unregistering): Released all slaves
[ 96.534408][ T5955] hsr_slave_0: entered promiscuous mode
[ 96.540938][ T5955] hsr_slave_1: entered promiscuous mode
[ 96.547296][ T5955] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 96.555254][ T5955] Cannot create hsr debugfs directory
[ 96.649212][ T36] hsr_slave_0: left promiscuous mode
[ 96.656115][ T36] hsr_slave_1: left promiscuous mode
[ 96.661966][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 96.669436][ T36] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 96.677718][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 96.685555][ T36] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 96.701968][ T36] veth1_macvtap: left promiscuous mode
[ 96.707894][ T36] veth0_macvtap: left promiscuous mode
[ 96.713602][ T36] veth1_vlan: left promiscuous mode
[ 96.719022][ T36] veth0_vlan: left promiscuous mode
[ 96.974573][ T36] team0 (unregistering): Port device team_slave_1 removed
[ 96.998330][ T36] team0 (unregistering): Port device team_slave_0 removed
[ 97.727473][ T5169] Bluetooth: hci0: command tx timeout
[ 97.949758][ T5955] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 97.983896][ T5955] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 98.088899][ T5955] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 98.100379][ T5955] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 98.270991][ T5955] 8021q: adding VLAN 0 to HW filter on device bond0
[ 98.321757][ T5955] 8021q: adding VLAN 0 to HW filter on device team0
[ 98.341743][ T49] bridge0: port 1(bridge_slave_0) entered blocking state
[ 98.348941][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 98.369318][ T975] bridge0: port 2(bridge_slave_1) entered blocking state
[ 98.376506][ T975] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 98.630423][ T5955] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 98.668572][ T5955] veth0_vlan: entered promiscuous mode
[ 98.681716][ T5955] veth1_vlan: entered promiscuous mode
[ 98.711461][ T5955] veth0_macvtap: entered promiscuous mode
[ 98.720067][ T5955] veth1_macvtap: entered promiscuous mode
[ 98.739736][ T5955] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 98.754773][ T5955] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 98.767174][ T5955] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 98.776005][ T5955] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 98.785152][ T5955] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 98.794898][ T5955] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 98.855032][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 98.862887][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 98.897418][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 98.905560][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 99.808605][ T5169] Bluetooth: hci0: command tx timeout
2025/07/13 04:04:06 executed programs: 74
[ 101.883397][ T5169] Bluetooth: hci0: command tx timeout
[ 103.966914][ T5169] Bluetooth: hci0: command tx timeout
2025/07/13 04:04:11 executed programs: 292
2025/07/13 04:04:16 executed programs: 548
[ 111.742428][ T5930] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 111.751792][ T5930] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 111.759991][ T5930] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 111.768810][ T5930] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 111.778016][ T5930] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 111.910388][ T6603] chnl_net:caif_netlink_parms(): no params data found
[ 111.970519][ T4436] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 112.007427][ T6603] bridge0: port 1(bridge_slave_0) entered blocking state
[ 112.014953][ T6603] bridge0: port 1(bridge_slave_0) entered disabled state
[ 112.022037][ T6603] bridge_slave_0: entered allmulticast mode
[ 112.029423][ T6603] bridge_slave_0: entered promiscuous mode
[ 112.038143][ T6603] bridge0: port 2(bridge_slave_1) entered blocking state
[ 112.046108][ T6603] bridge0: port 2(bridge_slave_1) entered disabled state
[ 112.053484][ T6603] bridge_slave_1: entered allmulticast mode
[ 112.060411][ T6603] bridge_slave_1: entered promiscuous mode
[ 112.083296][ T4436] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 112.107319][ T6603] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 112.118486][ T6603] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 112.148189][ T6603] team0: Port device team_slave_0 added
[ 112.158851][ T6603] team0: Port device team_slave_1 added
[ 112.171286][ T4436] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 112.204386][ T6603] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 112.211340][ T6603] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 112.237327][ T6603] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 112.250627][ T6603] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 112.258531][ T6603] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 112.286715][ T6603] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 112.305845][ T4436] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 112.348677][ T6603] hsr_slave_0: entered promiscuous mode
[ 112.357406][ T6603] hsr_slave_1: entered promiscuous mode
[ 112.515115][ T4436] bridge_slave_1: left allmulticast mode
[ 112.520877][ T4436] bridge_slave_1: left promiscuous mode
[ 112.526862][ T4436] bridge0: port 2(bridge_slave_1) entered disabled state
[ 112.537075][ T4436] bridge_slave_0: left allmulticast mode
[ 112.542710][ T4436] bridge_slave_0: left promiscuous mode
[ 112.549057][ T4436] bridge0: port 1(bridge_slave_0) entered disabled state
[ 112.775942][ T4436] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 112.786332][ T4436] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 112.797097][ T4436] bond0 (unregistering): Released all slaves
[ 113.118603][ T4436] hsr_slave_0: left promiscuous mode
[ 113.131635][ T4436] hsr_slave_1: left promiscuous mode
[ 113.138522][ T4436] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 113.146761][ T4436] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 113.156283][ T4436] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 113.163994][ T4436] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 113.187373][ T4436] veth1_macvtap: left promiscuous mode
[ 113.193410][ T4436] veth0_macvtap: left promiscuous mode
[ 113.199096][ T4436] veth1_vlan: left promiscuous mode
[ 113.205392][ T4436] veth0_vlan: left promiscuous mode
[ 113.538650][ T4436] team0 (unregistering): Port device team_slave_1 removed
[ 113.569365][ T4436] team0 (unregistering): Port device team_slave_0 removed
[ 113.803534][ T5930] Bluetooth: hci1: command tx timeout
[ 113.881464][ T6603] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 113.897032][ T6603] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 113.908815][ T6603] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 113.932157][ T6603] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 114.044563][ T6603] 8021q: adding VLAN 0 to HW filter on device bond0
[ 114.087165][ T6603] 8021q: adding VLAN 0 to HW filter on device team0
[ 114.106205][ T975] bridge0: port 1(bridge_slave_0) entered blocking state
[ 114.113385][ T975] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 114.128461][ T60] bridge0: port 2(bridge_slave_1) entered blocking state
[ 114.135642][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 114.417308][ T6603] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 114.458862][ T6603] veth0_vlan: entered promiscuous mode
[ 114.470436][ T6603] veth1_vlan: entered promiscuous mode
[ 114.497236][ T6603] veth0_macvtap: entered promiscuous mode
[ 114.506369][ T6603] veth1_macvtap: entered promiscuous mode
[ 114.521615][ T6603] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 114.538077][ T6603] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 114.549932][ T6603] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 114.558805][ T6603] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 114.569190][ T6603] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 114.578846][ T6603] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 114.636522][ T975] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 114.649782][ T975] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 114.673470][ T975] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 114.681315][ T975] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 114.721165][ T6649] ==================================================================
[ 114.729234][ T6649] BUG: KASAN: slab-use-after-free in force_devcd_write+0x312/0x340
[ 114.737208][ T6649] Read of size 8 at addr ffff888076ef2000 by task syz.0.616/6649
[ 114.744903][ T6649]
[ 114.747224][ T6649] CPU: 0 UID: 0 PID: 6649 Comm: syz.0.616 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full)
[ 114.747242][ T6649] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
[ 114.747252][ T6649] Call Trace:
[ 114.747259][ T6649]
[ 114.747267][ T6649] dump_stack_lvl+0x116/0x1f0
[ 114.747290][ T6649] print_report+0xcd/0x610
[ 114.747303][ T6649] ? __virt_addr_valid+0x81/0x610
[ 114.747318][ T6649] ? __phys_addr+0xe8/0x180
[ 114.747332][ T6649] ? force_devcd_write+0x312/0x340
[ 114.747352][ T6649] kasan_report+0xe0/0x110
[ 114.747363][ T6649] ? force_devcd_write+0x312/0x340
[ 114.747385][ T6649] force_devcd_write+0x312/0x340
[ 114.747405][ T6649] ? __pfx_force_devcd_write+0x10/0x10
[ 114.747426][ T6649] ? __debugfs_file_get+0x1fe/0x840
[ 114.747439][ T6649] ? __pfx___debugfs_file_get+0x10/0x10
[ 114.747454][ T6649] full_proxy_write+0x13c/0x200
[ 114.747467][ T6649] ? __pfx_full_proxy_write+0x10/0x10
[ 114.747480][ T6649] vfs_write+0x29d/0x1150
[ 114.747500][ T6649] ? __pfx_vfs_write+0x10/0x10
[ 114.747517][ T6649] ? do_futex+0x122/0x350
[ 114.747533][ T6649] ? __pfx_do_futex+0x10/0x10
[ 114.747548][ T6649] ? find_held_lock+0x2b/0x80
[ 114.747562][ T6649] ? handle_mm_fault+0x2ab/0xd10
[ 114.747580][ T6649] ? __x64_sys_futex+0x1e0/0x4c0
[ 114.747594][ T6649] ? __x64_sys_futex+0x1e9/0x4c0
[ 114.747615][ T6649] ksys_write+0x12a/0x250
[ 114.747633][ T6649] ? __pfx_ksys_write+0x10/0x10
[ 114.747653][ T6649] do_syscall_64+0xcd/0x490
[ 114.747673][ T6649] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 114.747687][ T6649] RIP: 0033:0x7feeb0b8e929
[ 114.747702][ T6649] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 114.747715][ T6649] RSP: 002b:00007ffc6ace87c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 114.747728][ T6649] RAX: ffffffffffffffda RBX: 00007feeb0db5fa0 RCX: 00007feeb0b8e929
[ 114.747737][ T6649] RDX: 000000000000000e RSI: 0000000000000000 RDI: 0000000000000003
[ 114.747745][ T6649] RBP: 00007feeb0c10b39 R08: 0000000000000000 R09: 0000000000000000
[ 114.747753][ T6649] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 114.747761][ T6649] R13: 00007feeb0db5fa0 R14: 00007feeb0db5fa0 R15: 0000000000000003
[ 114.747773][ T6649]
[ 114.747778][ T6649]
[ 114.974424][ T6649] Allocated by task 5955:
[ 114.978740][ T6649] kasan_save_stack+0x33/0x60
[ 114.983422][ T6649] kasan_save_track+0x14/0x30
[ 114.988108][ T6649] __kasan_kmalloc+0xaa/0xb0
[ 114.992704][ T6649] vhci_open+0x4c/0x430
[ 114.996862][ T6649] misc_open+0x35d/0x420
[ 115.001100][ T6649] chrdev_open+0x231/0x6a0
[ 115.005520][ T6649] do_dentry_open+0x744/0x1c10
[ 115.010285][ T6649] vfs_open+0x82/0x3f0
[ 115.014350][ T6649] path_openat+0x1de4/0x2cb0
[ 115.018940][ T6649] do_filp_open+0x20b/0x470
[ 115.023444][ T6649] do_sys_openat2+0x11b/0x1d0
[ 115.028114][ T6649] __x64_sys_openat+0x174/0x210
[ 115.032959][ T6649] do_syscall_64+0xcd/0x490
[ 115.037463][ T6649] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 115.043349][ T6649]
[ 115.045666][ T6649] Freed by task 5955:
[ 115.049632][ T6649] kasan_save_stack+0x33/0x60
[ 115.054311][ T6649] kasan_save_track+0x14/0x30
[ 115.058989][ T6649] kasan_save_free_info+0x3b/0x60
[ 115.064013][ T6649] __kasan_slab_free+0x51/0x70
[ 115.068778][ T6649] kfree+0x2b4/0x4d0
[ 115.072669][ T6649] vhci_release+0xbb/0xf0
[ 115.076999][ T6649] __fput+0x3ff/0xb70
[ 115.080972][ T6649] task_work_run+0x150/0x240
[ 115.085564][ T6649] do_exit+0x86c/0x2bd0
[ 115.089718][ T6649] do_group_exit+0xd3/0x2a0
[ 115.094218][ T6649] get_signal+0x2673/0x26d0
[ 115.098719][ T6649] arch_do_signal_or_restart+0x8f/0x790
[ 115.104263][ T6649] exit_to_user_mode_loop+0x84/0x110
[ 115.109550][ T6649] do_syscall_64+0x3f6/0x490
[ 115.114234][ T6649] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 115.120122][ T6649]
[ 115.122433][ T6649] The buggy address belongs to the object at ffff888076ef2000
[ 115.122433][ T6649] which belongs to the cache kmalloc-1k of size 1024
[ 115.136479][ T6649] The buggy address is located 0 bytes inside of
[ 115.136479][ T6649] freed 1024-byte region [ffff888076ef2000, ffff888076ef2400)
[ 115.150182][ T6649]
[ 115.152498][ T6649] The buggy address belongs to the physical page:
[ 115.158917][ T6649] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x76ef0
[ 115.167669][ T6649] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 115.176157][ T6649] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 115.184133][ T6649] page_type: f5(slab)
[ 115.188109][ T6649] raw: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001
[ 115.196684][ T6649] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 115.205260][ T6649] head: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001
[ 115.213920][ T6649] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 115.222583][ T6649] head: 00fff00000000003 ffffea0001dbbc01 00000000ffffffff 00000000ffffffff
[ 115.231244][ T6649] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 115.239901][ T6649] page dumped because: kasan: bad access detected
[ 115.246309][ T6649] page_owner tracks the page as allocated
[ 115.252009][ T6649] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5951, tgid 5951 (syz-executor), ts 95175127093, free_ts 95034696160
[ 115.273370][ T6649] post_alloc_hook+0x1c0/0x230
[ 115.278133][ T6649] get_page_from_freelist+0x1321/0x3890
[ 115.283678][ T6649] __alloc_frozen_pages_noprof+0x261/0x23f0
[ 115.289569][ T6649] alloc_pages_mpol+0x1fb/0x550
[ 115.294409][ T6649] new_slab+0x23b/0x330
[ 115.298558][ T6649] ___slab_alloc+0xd9c/0x1940
[ 115.303230][ T6649] __slab_alloc.constprop.0+0x56/0xb0
[ 115.308598][ T6649] __kmalloc_cache_noprof+0xfb/0x3e0
[ 115.313879][ T6649] afs_alloc_call+0x51/0x640
[ 115.318462][ T6649] afs_charge_preallocation+0xf7/0x320
[ 115.323921][ T6649] afs_open_socket+0x323/0x400
[ 115.328682][ T6649] afs_net_init+0x825/0xb00
[ 115.333179][ T6649] ops_init+0x1df/0x5f0
[ 115.337334][ T6649] setup_net+0x1ff/0x510
[ 115.341574][ T6649] copy_net_ns+0x2a6/0x5f0
[ 115.345980][ T6649] create_new_namespaces+0x3ea/0xa90
[ 115.351258][ T6649] page last free pid 5853 tgid 5853 stack trace:
[ 115.357571][ T6649] __free_frozen_pages+0x7fe/0x1180
[ 115.362765][ T6649] __folio_put+0x329/0x450
[ 115.367182][ T6649] skb_release_data+0x7fb/0x9c0
[ 115.372033][ T6649] __kfree_skb+0x4f/0x70
[ 115.376282][ T6649] tcp_ack+0x19b2/0x5c90
[ 115.380519][ T6649] tcp_rcv_established+0xda1/0x22e0
[ 115.385713][ T6649] tcp_v4_do_rcv+0x5ca/0xa90
[ 115.390302][ T6649] __release_sock+0x31b/0x400
[ 115.394981][ T6649] release_sock+0x5a/0x220
[ 115.399395][ T6649] tcp_sendmsg+0x38/0x50
[ 115.403639][ T6649] inet_sendmsg+0xb9/0x140
[ 115.408056][ T6649] sock_write_iter+0x4aa/0x5b0
[ 115.412814][ T6649] vfs_write+0x6c7/0x1150
[ 115.417145][ T6649] ksys_write+0x1f8/0x250
[ 115.421470][ T6649] do_syscall_64+0xcd/0x490
[ 115.425976][ T6649] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 115.431863][ T6649]
[ 115.434173][ T6649] Memory state around the buggy address:
[ 115.439788][ T6649] ffff888076ef1f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 115.447838][ T6649] ffff888076ef1f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 115.455891][ T6649] >ffff888076ef2000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 115.463941][ T6649] ^
[ 115.467994][ T6649] ffff888076ef2080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 115.476049][ T6649] ffff888076ef2100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 115.484098][ T6649] ==================================================================
[ 115.520402][ T6649] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 115.527625][ T6649] CPU: 0 UID: 0 PID: 6649 Comm: syz.0.616 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full)
[ 115.539507][ T6649] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
[ 115.549553][ T6649] Call Trace:
[ 115.552826][ T6649]
[ 115.555753][ T6649] dump_stack_lvl+0x3d/0x1f0
[ 115.560348][ T6649] panic+0x71c/0x800
[ 115.564247][ T6649] ? __pfx_panic+0x10/0x10
[ 115.568661][ T6649] ? mark_held_locks+0x49/0x80
[ 115.573427][ T6649] ? preempt_schedule_thunk+0x16/0x30
[ 115.578799][ T6649] ? force_devcd_write+0x312/0x340
[ 115.583916][ T6649] ? preempt_schedule_common+0x44/0xc0
[ 115.589378][ T6649] ? check_panic_on_warn+0x1f/0xb0
[ 115.594494][ T6649] ? force_devcd_write+0x312/0x340
[ 115.599610][ T6649] check_panic_on_warn+0xab/0xb0
[ 115.604550][ T6649] end_report+0x107/0x170
[ 115.608872][ T6649] kasan_report+0xee/0x110
[ 115.613284][ T6649] ? force_devcd_write+0x312/0x340
[ 115.618403][ T6649] force_devcd_write+0x312/0x340
[ 115.623346][ T6649] ? __pfx_force_devcd_write+0x10/0x10
[ 115.628809][ T6649] ? __debugfs_file_get+0x1fe/0x840
[ 115.634003][ T6649] ? __pfx___debugfs_file_get+0x10/0x10
[ 115.639550][ T6649] full_proxy_write+0x13c/0x200
[ 115.644398][ T6649] ? __pfx_full_proxy_write+0x10/0x10
[ 115.649775][ T6649] vfs_write+0x29d/0x1150
[ 115.654120][ T6649] ? __pfx_vfs_write+0x10/0x10
[ 115.658884][ T6649] ? do_futex+0x122/0x350
[ 115.663211][ T6649] ? __pfx_do_futex+0x10/0x10
[ 115.667886][ T6649] ? find_held_lock+0x2b/0x80
[ 115.672648][ T6649] ? handle_mm_fault+0x2ab/0xd10
[ 115.677599][ T6649] ? __x64_sys_futex+0x1e0/0x4c0
[ 115.682536][ T6649] ? __x64_sys_futex+0x1e9/0x4c0
[ 115.687473][ T6649] ksys_write+0x12a/0x250
[ 115.691806][ T6649] ? __pfx_ksys_write+0x10/0x10
[ 115.696662][ T6649] do_syscall_64+0xcd/0x490
[ 115.701171][ T6649] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 115.707069][ T6649] RIP: 0033:0x7feeb0b8e929
[ 115.711479][ T6649] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 115.731084][ T6649] RSP: 002b:00007ffc6ace87c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 115.739495][ T6649] RAX: ffffffffffffffda RBX: 00007feeb0db5fa0 RCX: 00007feeb0b8e929
[ 115.747462][ T6649] RDX: 000000000000000e RSI: 0000000000000000 RDI: 0000000000000003
[ 115.755427][ T6649] RBP: 00007feeb0c10b39 R08: 0000000000000000 R09: 0000000000000000
[ 115.763391][ T6649] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 115.771354][ T6649] R13: 00007feeb0db5fa0 R14: 00007feeb0db5fa0 R15: 0000000000000003
[ 115.779335][ T6649]
[ 115.782581][ T6649] Kernel Offset: disabled
[ 115.786910][ T6649] Rebooting in 86400 seconds..