Warning: Permanently added '10.128.1.223' (ED25519) to the list of known hosts. 1970/01/01 00:00:43 ignoring optional flag "sandboxArg"="0" 1970/01/01 00:00:44 parsed 1 programs [ 47.125790][ T4030] cgroup: Unknown subsys name 'net' [ 47.432542][ T4030] cgroup: Unknown subsys name 'rlimit' [ 47.760224][ T4030] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 56.721832][ T4065] chnl_net:caif_netlink_parms(): no params data found [ 56.766978][ T4065] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.769017][ T4065] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.771642][ T4065] device bridge_slave_0 entered promiscuous mode [ 56.782193][ T4065] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.784103][ T4065] bridge0: port 2(bridge_slave_1) entered disabled state [ 56.786903][ T4065] device bridge_slave_1 entered promiscuous mode [ 56.805367][ T4065] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 56.810097][ T4065] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 56.827618][ T4065] team0: Port device team_slave_0 added [ 56.830945][ T4065] team0: Port device team_slave_1 added [ 56.844911][ T4065] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 56.846958][ T4065] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 56.853760][ T4065] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 56.863097][ T4065] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 56.864982][ T4065] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 56.872007][ T4065] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 56.947981][ T4065] device hsr_slave_0 entered promiscuous mode [ 56.985951][ T4065] device hsr_slave_1 entered promiscuous mode [ 57.171825][ T4065] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 57.220410][ T4065] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 57.268631][ T4065] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 57.319400][ T4065] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 57.399545][ T4065] bridge0: port 2(bridge_slave_1) entered blocking state [ 57.401709][ T4065] bridge0: port 2(bridge_slave_1) entered forwarding state [ 57.404093][ T4065] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.406082][ T4065] bridge0: port 1(bridge_slave_0) entered forwarding state [ 57.452160][ T4065] 8021q: adding VLAN 0 to HW filter on device bond0 [ 57.463456][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 57.468243][ T1701] bridge0: port 1(bridge_slave_0) entered disabled state [ 57.471576][ T1701] bridge0: port 2(bridge_slave_1) entered disabled state [ 57.474640][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 57.487397][ T4065] 8021q: adding VLAN 0 to HW filter on device team0 [ 57.497630][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 57.500538][ T1701] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.502538][ T1701] bridge0: port 1(bridge_slave_0) entered forwarding state [ 57.504922][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 57.510068][ T1701] bridge0: port 2(bridge_slave_1) entered blocking state [ 57.512006][ T1701] bridge0: port 2(bridge_slave_1) entered forwarding state [ 57.527703][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 57.530594][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 57.533475][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 57.541720][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 57.547535][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 57.557000][ T4065] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 57.640158][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 57.642448][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 57.651087][ T4065] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 57.665036][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 57.680032][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 57.683295][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 57.687209][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 57.692139][ T4065] device veth0_vlan entered promiscuous mode [ 57.701064][ T4065] device veth1_vlan entered promiscuous mode [ 57.717572][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 57.720573][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 57.724984][ T4065] device veth0_macvtap entered promiscuous mode [ 57.730811][ T4065] device veth1_macvtap entered promiscuous mode [ 57.743472][ T4065] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 57.746038][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 57.748751][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 57.751375][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 57.754160][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 57.761538][ T4065] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 57.766336][ T4065] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.768770][ T4065] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.771083][ T4065] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.773509][ T4065] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.780103][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 57.782952][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 58.614353][ T148] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 59.081013][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 59.083378][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 59.086862][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 59.104167][ T369] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 59.107283][ T369] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 59.110237][ T369] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 1970/01/01 00:00:59 executed programs: 0 [ 59.549468][ T4120] chnl_net:caif_netlink_parms(): no params data found [ 59.586409][ T4120] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.588593][ T4120] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.591381][ T4120] device bridge_slave_0 entered promiscuous mode [ 59.595130][ T4120] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.597419][ T4120] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.600187][ T4120] device bridge_slave_1 entered promiscuous mode [ 59.618122][ T4120] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 59.627455][ T4120] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 59.644835][ T4120] team0: Port device team_slave_0 added [ 59.648911][ T4120] team0: Port device team_slave_1 added [ 59.664116][ T4120] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 59.666295][ T4120] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 59.673183][ T4120] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 59.678017][ T4120] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 59.679924][ T4120] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 59.687121][ T4120] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 59.757650][ T4120] device hsr_slave_0 entered promiscuous mode [ 59.806254][ T4120] device hsr_slave_1 entered promiscuous mode [ 59.865816][ T4120] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 59.868329][ T4120] Cannot create hsr debugfs directory [ 60.823789][ T148] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 61.546294][ T4047] Bluetooth: hci0: command 0x0409 tx timeout [ 63.162345][ T148] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 63.235732][ T148] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 63.615894][ T4047] Bluetooth: hci0: command 0x041b tx timeout [ 64.217813][ T4120] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 64.249224][ T4120] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 64.288058][ T4120] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 64.328284][ T4120] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 64.418954][ T4120] 8021q: adding VLAN 0 to HW filter on device bond0 [ 64.427405][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 64.430306][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 64.435133][ T4120] 8021q: adding VLAN 0 to HW filter on device team0 [ 64.441395][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 64.444228][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 64.447062][ T1701] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.449032][ T1701] bridge0: port 1(bridge_slave_0) entered forwarding state [ 64.451625][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 64.458787][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 64.461629][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 64.464315][ T1701] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.466384][ T1701] bridge0: port 2(bridge_slave_1) entered forwarding state [ 64.471764][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 64.478684][ T369] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 64.483852][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 64.488600][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 64.491523][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 64.534160][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 64.537848][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 64.543084][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 64.546590][ T1701] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 64.552326][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 64.555168][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 64.561675][ T4120] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 64.643850][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 64.648858][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 64.656329][ T4120] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 64.671237][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 64.674162][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 64.687498][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 64.690348][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 64.693104][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 64.695898][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 64.702093][ T4120] device veth0_vlan entered promiscuous mode [ 64.709129][ T4120] device veth1_vlan entered promiscuous mode [ 64.724936][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 64.728068][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 64.730584][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 64.733258][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 64.737970][ T4120] device veth0_macvtap entered promiscuous mode [ 64.742251][ T4120] device veth1_macvtap entered promiscuous mode [ 64.754609][ T4120] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 64.757917][ T4120] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 64.761706][ T4120] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 64.764451][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 64.768138][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 64.770779][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 64.773518][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 64.778407][ T4120] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 64.781228][ T4120] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 64.784880][ T4120] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 64.791770][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 64.794734][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 64.799723][ T4120] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.802204][ T4120] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.804500][ T4120] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.807413][ T4120] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.852806][ T369] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.855049][ T369] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.859618][ T369] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 64.906740][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.908991][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.911766][ T369] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 1970/01/01 00:01:04 executed programs: 2 [ 64.945988][ T4181] IPv6: ADDRCONF(NETDEV_CHANGE): bpq0: link becomes ready [ 64.982945][ T4183] ================================================================== [ 64.985369][ T4183] BUG: KASAN: use-after-free in ax25_fillin_cb+0x394/0x568 [ 64.987401][ T4183] Read of size 4 at addr ffff0000dbbec038 by task syz.0.18/4183 [ 64.989832][ T4183] [ 64.990462][ T4183] CPU: 0 PID: 4183 Comm: syz.0.18 Not tainted 5.15.186-syzkaller #0 [ 64.992600][ T4183] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 64.995406][ T4183] Call trace: [ 64.996305][ T4183] dump_backtrace+0x0/0x43c [ 64.997515][ T4183] show_stack+0x2c/0x3c [ 64.998661][ T4183] __dump_stack+0x30/0x40 [ 64.999907][ T4183] dump_stack_lvl+0xf8/0x160 [ 65.001144][ T4183] print_address_description+0x78/0x30c [ 65.002685][ T4183] kasan_report+0xec/0x15c [ 65.003892][ T4183] __asan_report_load4_noabort+0x44/0x50 [ 65.005454][ T4183] ax25_fillin_cb+0x394/0x568 [ 65.006797][ T4183] ax25_setsockopt+0x8d0/0xa5c [ 65.008040][ T4183] __sys_setsockopt+0x2f8/0x4b0 [ 65.009404][ T4183] __arm64_sys_setsockopt+0xb8/0xd4 [ 65.010816][ T4183] invoke_syscall+0x98/0x2b8 [ 65.012026][ T4183] el0_svc_common+0x138/0x258 [ 65.013331][ T4183] do_el0_svc+0x58/0x14c [ 65.014481][ T4183] el0_svc+0x78/0x1e0 [ 65.015576][ T4183] el0t_64_sync_handler+0xcc/0xe4 [ 65.017027][ T4183] el0t_64_sync+0x1a0/0x1a4 [ 65.018284][ T4183] [ 65.018931][ T4183] Allocated by task 4181: [ 65.020210][ T4183] __kasan_kmalloc+0xb0/0xf0 [ 65.021489][ T4183] kmem_cache_alloc_trace+0x274/0x3fc [ 65.023002][ T4183] ax25_dev_device_up+0x5c/0x540 [ 65.024333][ T4183] ax25_device_event+0x504/0x590 [ 65.025745][ T4183] raw_notifier_call_chain+0xd4/0x164 [ 65.027196][ T4183] __dev_notify_flags+0x250/0x46c [ 65.028586][ T4183] dev_change_flags+0xc8/0x154 [ 65.029926][ T4183] dev_ifsioc+0x504/0xef4 [ 65.031137][ T4183] dev_ioctl+0x4d0/0xc94 [ 65.032355][ T4183] sock_do_ioctl+0x18c/0x240 [ 65.033631][ T4183] sock_ioctl+0x5c8/0x87c [ 65.034839][ T4183] __arm64_sys_ioctl+0x14c/0x1c8 [ 65.036218][ T4183] invoke_syscall+0x98/0x2b8 [ 65.037561][ T4183] el0_svc_common+0x138/0x258 [ 65.038821][ T4183] do_el0_svc+0x58/0x14c [ 65.040079][ T4183] el0_svc+0x78/0x1e0 [ 65.041174][ T4183] el0t_64_sync_handler+0xcc/0xe4 [ 65.042604][ T4183] el0t_64_sync+0x1a0/0x1a4 [ 65.043817][ T4183] [ 65.044467][ T4183] Freed by task 4182: [ 65.045589][ T4183] kasan_set_track+0x4c/0x84 [ 65.046876][ T4183] kasan_set_free_info+0x28/0x4c [ 65.048248][ T4183] ____kasan_slab_free+0x118/0x164 [ 65.049732][ T4183] __kasan_slab_free+0x18/0x28 [ 65.051074][ T4183] slab_free_freelist_hook+0x128/0x1e8 [ 65.052619][ T4183] kfree+0x170/0x40c [ 65.053738][ T4183] ax25_release+0x564/0x814 [ 65.055027][ T4183] sock_close+0xb4/0x1f8 [ 65.056226][ T4183] __fput+0x1c0/0x7f8 [ 65.057362][ T4183] ____fput+0x20/0x30 [ 65.058531][ T4183] task_work_run+0x12c/0x1e0 [ 65.059812][ T4183] do_notify_resume+0x24b4/0x3128 [ 65.061154][ T4183] el0_svc+0xf0/0x1e0 [ 65.062281][ T4183] el0t_64_sync_handler+0xcc/0xe4 [ 65.063711][ T4183] el0t_64_sync+0x1a0/0x1a4 [ 65.064981][ T4183] [ 65.065738][ T4183] The buggy address belongs to the object at ffff0000dbbec000 [ 65.065738][ T4183] which belongs to the cache kmalloc-256 of size 256 [ 65.069658][ T4183] The buggy address is located 56 bytes inside of [ 65.069658][ T4183] 256-byte region [ffff0000dbbec000, ffff0000dbbec100) [ 65.073484][ T4183] The buggy address belongs to the page: [ 65.075159][ T4183] page:0000000079ff954d refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11bbec [ 65.078085][ T4183] head:0000000079ff954d order:1 compound_mapcount:0 [ 65.079954][ T4183] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 65.082193][ T4183] raw: 05ffc00000010200 0000000000000000 dead000000000122 ffff0000c0002480 [ 65.084589][ T4183] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 65.087029][ T4183] page dumped because: kasan: bad access detected [ 65.088798][ T4183] [ 65.089463][ T4183] Memory state around the buggy address: [ 65.091002][ T4183] ffff0000dbbebf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 65.093236][ T4183] ffff0000dbbebf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 65.095548][ T4183] >ffff0000dbbec000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 65.097774][ T4183] ^ [ 65.099414][ T4183] ffff0000dbbec080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 65.101639][ T4183] ffff0000dbbec100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 65.103904][ T4183] ================================================================== [ 65.106123][ T4183] Disabling lock debugging due to kernel taint [ 65.110886][ T4183] Unable to handle kernel paging request at virtual address a7a00317000015fe [ 65.113288][ T4183] Mem abort info: [ 65.114253][ T4183] ESR = 0x0000000096000021 [ 65.115491][ T4183] EC = 0x25: DABT (current EL), IL = 32 bits [ 65.117191][ T4183] SET = 0, FnV = 0 [ 65.118233][ T4183] EA = 0, S1PTW = 0 [ 65.119311][ T4183] FSC = 0x21: alignment fault [ 65.120615][ T4183] Data abort info: [ 65.121768][ T4183] ISV = 0, ISS = 0x00000021 [ 65.123815][ T4183] CM = 0, WnR = 0 [ 65.124880][ T4183] [a7a00317000015fe] address between user and kernel address ranges [ 65.127669][ T4183] Internal error: Oops: 0000000096000021 [#1] PREEMPT SMP [ 65.129651][ T4183] Modules linked in: [ 65.130735][ T4183] CPU: 0 PID: 4183 Comm: syz.0.18 Tainted: G B 5.15.186-syzkaller #0 [ 65.133324][ T4183] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 65.136213][ T4183] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 65.138387][ T4183] pc : ax25_release+0x4f4/0x814 [ 65.139763][ T4183] lr : ax25_release+0x4ec/0x814 [ 65.141170][ T4183] sp : ffff80001fab7a00 [ 65.142336][ T4183] x29: ffff80001fab7a20 x28: dfff800000000000 x27: ffff0000d6fbb080 [ 65.144610][ T4183] x26: ffff0000d723c828 x25: 0000000000000002 x24: 00000000ffffffff [ 65.146878][ T4183] x23: a7a00317000015fe x22: ffff0000dbbec000 x21: ffff0000ec828018 [ 65.149139][ T4183] x20: ffff0000d6fbb000 x19: 1fffe0001ae47905 x18: 0000000000000000 [ 65.151426][ T4183] x17: 0000000000000000 x16: ffff8000082d6448 x15: 0000000000000002 [ 65.153652][ T4183] x14: 0000000000ff0100 x13: ffffffffffffffff x12: 0000000000ff0100 [ 65.155858][ T4183] x11: 0000000000000000 x10: 0000000000000000 x9 : ffff8000104555f4 [ 65.158149][ T4183] x8 : ffff0000d6cc3680 x7 : 0000000000000000 x6 : ffff80000837b9b0 [ 65.160382][ T4183] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000104555e8 [ 65.162602][ T4183] x2 : 0000000000000001 x1 : 0000000000000004 x0 : 0000000000000001 [ 65.164875][ T4183] Call trace: [ 65.165794][ T4183] ax25_release+0x4f4/0x814 [ 65.167085][ T4183] sock_close+0xb4/0x1f8 [ 65.168261][ T4183] __fput+0x1c0/0x7f8 [ 65.169389][ T4183] ____fput+0x20/0x30 [ 65.170534][ T4183] task_work_run+0x12c/0x1e0 [ 65.171909][ T4183] do_notify_resume+0x24b4/0x3128 [ 65.173320][ T4183] el0_svc+0xf0/0x1e0 [ 65.174407][ T4183] el0t_64_sync_handler+0xcc/0xe4 [ 65.175793][ T4183] el0t_64_sync+0x1a0/0x1a4 [ 65.177054][ T4183] Code: d503201f 9600931b 52800038 4b1803f8 (b87802f8) [ 65.179030][ T4183] ---[ end trace 5c71f95c4f82c6e8 ]--- [ 65.513613][ T4183] Kernel panic - not syncing: Oops: Fatal exception [ 65.515568][ T4183] SMP: stopping secondary CPUs [ 65.516931][ T4183] Kernel Offset: disabled [ 65.518066][ T4183] CPU features: 0x8,000081c1,21302e40 [ 65.519572][ T4183] Memory Limit: none [ 65.820055][ T4183] Rebooting in 86400 seconds..