Warning: Permanently added '10.128.0.218' (ED25519) to the list of known hosts. 1970/01/01 00:00:30 parsed 1 programs 1970/01/01 00:00:30 serving rpc on tcp://46055 [ 31.736165][ T4725] cgroup: Unknown subsys name 'net' [ 31.857021][ T4725] cgroup: Unknown subsys name 'cpuset' [ 31.859187][ T4725] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 32.036542][ T4725] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 34.477258][ T4734] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 34.861850][ T4751] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.862211][ T4751] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.862283][ T4751] bridge_slave_0: entered allmulticast mode [ 34.862758][ T4751] bridge_slave_0: entered promiscuous mode [ 34.864575][ T4751] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.864636][ T4751] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.864686][ T4751] bridge_slave_1: entered allmulticast mode [ 34.865090][ T4751] bridge_slave_1: entered promiscuous mode [ 34.872006][ T4751] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 34.872902][ T4751] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 34.894807][ T4751] team0: Port device team_slave_0 added [ 34.895540][ T4751] team0: Port device team_slave_1 added [ 34.901490][ T4751] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 34.901964][ T4751] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 34.901983][ T4751] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 34.902732][ T4751] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 34.902739][ T4751] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 34.902751][ T4751] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 34.913276][ T4751] hsr_slave_0: entered promiscuous mode [ 34.913918][ T4751] hsr_slave_1: entered promiscuous mode [ 34.960922][ T4751] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 34.963974][ T4751] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 34.966076][ T4751] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 34.968445][ T4751] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 34.970167][ T4751] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 34.972354][ T4751] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 34.973918][ T4751] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 34.976472][ T4751] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 34.986006][ T4751] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.986068][ T4751] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.986231][ T4751] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.986265][ T4751] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.008810][ T4751] 8021q: adding VLAN 0 to HW filter on device bond0 [ 35.016403][ T3526] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.018142][ T3526] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.023293][ T4751] 8021q: adding VLAN 0 to HW filter on device team0 [ 35.027338][ T3040] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.027401][ T3040] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.031142][ T3040] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.031225][ T3040] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.128190][ T4751] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 35.141934][ T4751] veth0_vlan: entered promiscuous mode [ 35.146714][ T4751] veth1_vlan: entered promiscuous mode [ 35.153755][ T4751] veth0_macvtap: entered promiscuous mode [ 35.154982][ T4751] veth1_macvtap: entered promiscuous mode [ 35.159336][ T4751] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 35.160535][ T4751] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 35.169077][ T39] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.169291][ T39] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.169310][ T39] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.169327][ T39] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 35.269303][ T1480] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.319798][ T1480] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.371284][ T1480] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.371804][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 35.372103][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 35.372261][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 35.372669][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 35.373140][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 35.451709][ T1480] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.724876][ T39] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 35.724908][ T39] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 35.735033][ T39] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 35.735067][ T39] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 1970/01/01 00:00:36 executed programs: 0 [ 36.137542][ T4739] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 36.139029][ T4739] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 36.139962][ T4739] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 36.140293][ T4739] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 36.140525][ T4739] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 36.274828][ T4830] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.274914][ T4830] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.274992][ T4830] bridge_slave_0: entered allmulticast mode [ 36.275564][ T4830] bridge_slave_0: entered promiscuous mode [ 36.276694][ T4830] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.276718][ T4830] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.276818][ T4830] bridge_slave_1: entered allmulticast mode [ 36.277278][ T4830] bridge_slave_1: entered promiscuous mode [ 36.287844][ T4830] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 36.288844][ T4830] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 36.296827][ T4830] team0: Port device team_slave_0 added [ 36.297655][ T4830] team0: Port device team_slave_1 added [ 36.303579][ T4830] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 36.303610][ T4830] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 36.303624][ T4830] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 36.306175][ T4830] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 36.306183][ T4830] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 36.306196][ T4830] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 36.316011][ T4830] hsr_slave_0: entered promiscuous mode [ 36.316333][ T4830] hsr_slave_1: entered promiscuous mode [ 36.316562][ T4830] debugfs: 'hsr0' already exists in 'hsr' [ 36.316613][ T4830] Cannot create hsr debugfs directory [ 38.184614][ T50] Bluetooth: hci0: command tx timeout [ 38.845506][ T1480] bridge_slave_1: left allmulticast mode [ 38.845549][ T1480] bridge_slave_1: left promiscuous mode [ 38.845854][ T1480] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.851190][ T1480] bridge_slave_0: left allmulticast mode [ 38.852026][ T1480] bridge_slave_0: left promiscuous mode [ 38.852111][ T1480] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.908009][ T1480] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 38.945679][ T1480] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 38.956309][ T1480] bond0 (unregistering): Released all slaves [ 39.019082][ T1480] hsr_slave_0: left promiscuous mode [ 39.021385][ T1480] hsr_slave_1: left promiscuous mode [ 39.021748][ T1480] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 39.021786][ T1480] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 39.027189][ T1480] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 39.027204][ T1480] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 39.033998][ T1480] veth1_macvtap: left promiscuous mode [ 39.035211][ T1480] veth0_macvtap: left promiscuous mode [ 39.036243][ T1480] veth1_vlan: left promiscuous mode [ 39.037285][ T1480] veth0_vlan: left promiscuous mode [ 39.131948][ T1480] team0 (unregistering): Port device team_slave_1 removed [ 39.138783][ T1480] team0 (unregistering): Port device team_slave_0 removed [ 39.180662][ T4403] 8021q: adding VLAN 0 to HW filter on device eth0 [ 39.461606][ T4830] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 39.464178][ T4830] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 39.465087][ T4830] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 39.468021][ T4830] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 39.469769][ T4830] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 39.472083][ T4830] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 39.473639][ T4830] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 39.479434][ T4830] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 39.510356][ T4830] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.517886][ T4830] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.520899][ T3526] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.520958][ T3526] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.526091][ T39] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.526140][ T39] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.882039][ T4830] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.894338][ T4830] veth0_vlan: entered promiscuous mode [ 39.897998][ T4830] veth1_vlan: entered promiscuous mode [ 39.907570][ T4830] veth0_macvtap: entered promiscuous mode [ 39.926049][ T4830] veth1_macvtap: entered promiscuous mode [ 39.931950][ T4830] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.932981][ T4830] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.937644][ T39] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.939645][ T39] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.944435][ T39] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.944488][ T39] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.960670][ T39] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.960702][ T39] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.011795][ T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.011825][ T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.151499][ T49 ** replaying previous printk message ** [ 40.151499][ T4928] ================================================================== [ 40.151515][ T4928] BUG: KASAN: slab-use-after-free in dvb_device_open+0xd0/0x254 [ 40.151533][ T4928] Read of size 8 at addr ffff0000cc32c218 by task syz.0.19/4928 [ 40.151543][ T4928] [ 40.151548][ T4928] CPU: 0 UID: 0 PID: 4928 Comm: syz.0.19 Not tainted syzkaller #0 PREEMPT [ 40.151560][ T4928] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 40.151565][ T4928] Call trace: [ 40.151568][ T4928] show_stack+0x2c/0x3c (C) [ 40.151582][ T4928] __dump_stack+0x30/0x40 [ 40.151592][ T4928] dump_stack_lvl+0xd8/0x12c [ 40.151601][ T4928] print_address_description+0xb0/0x238 [ 40.151610][ T4928] print_report+0x68/0x84 [ 40.151617][ T4928] kasan_report+0x8c/0xc4 [ 40.151626][ T4928] __asan_report_load8_noabort+0x20/0x2c [ 40.151636][ T4928] dvb_device_open+0xd0/0x254 [ 40.151642][ T4928] chrdev_open+0x398/0x3e8 [ 40.151652][ T4928] do_dentry_open+0x5c4/0xfc0 [ 40.151661][ T4928] vfs_open+0x44/0x2dc [ 40.151670][ T4928] path_openat+0x21fc/0x2a60 [ 40.151678][ T4928] do_file_open+0x1c8/0x2e8 [ 40.151686][ T4928] do_sys_openat2+0x114/0x1e8 [ 40.151695][ T4928] do_sys_open+0xb0/0xe0 [ 40.151704][ T4928] __arm64_sys_openat+0xa0/0xbc [ 40.151714][ T4928] invoke_syscall+0x98/0x244 [ 40.151723][ T4928] el0_svc_common+0xec/0x23c [ 40.151733][ T4928] do_el0_svc+0x4c/0x5c [ 40.151742][ T4928] el0_svc+0x64/0x260 [ 40.151752][ T4928] el0t_64_sync_handler+0x48/0x148 [ 40.151761][ T4928] el0t_64_sync+0x198/0x19c [ 40.151769][ T4928] [ 40.151771][ T4928] Allocated by task 1: [ 40.151775][ T4928] kasan_save_track+0x40/0x78 [ 40.151782][ T4928] kasan_save_alloc_info+0x44/0x54 [ 40.151790][ T4928] __kasan_kmalloc+0x9c/0xb4 [ 40.151797][ T4928] __kmalloc_cache_noprof+0x2e8/0x5ec [ 40.151804][ T4928] dvb_register_device+0x1a4/0x16e0 [ 40.151809][ T4928] dvb_register_frontend+0x474/0x6d0 [ 40.151816][ T4928] vidtv_bridge_probe+0x5a4/0xa58 [ 40.151825][ T4928] platform_probe+0x100/0x1a4 [ 40.151832][ T4928] really_probe+0x29c/0x800 [ 40.151839][ T4928] __driver_probe_device+0x1e0/0x350 [ 40.151847][ T4928] driver_probe_device+0x6c/0x19c [ 40.151854][ T4928] __driver_attach+0x168/0x384 [ 40.151861][ T4928] bus_for_each_dev+0x128/0x1b4 [ 40.151868][ T4928] driver_attach+0x50/0x60 [ 40.151875][ T4928] bus_add_driver+0x208/0x500 [ 40.151881][ T4928] driver_register+0x220/0x310 [ 40.151889][ T4928] __platform_driver_register+0x90/0xa4 [ 40.151894][ T4928] vidtv_bridge_init+0x4c/0x74 [ 40.151901][ T4928] do_one_initcall+0x274/0xc38 [ 40.151910][ T4928] do_initcall_level+0x12c/0x1c4 [ 40.151917][ T4928] do_initcalls+0x70/0xd0 [ 40.151924][ T4928] do_basic_setup+0x7c/0x90 [ 40.151931][ T4928] kernel_init_freeable+0x268/0x3a8 [ 40.151939][ T4928] kernel_init+0x24/0x1dc [ 40.151944][ T4928] ret_from_fork+0x10/0x20 [ 40.151949][ T4928] [ 40.151951][ T4928] Freed by task 4926: [ 40.151954][ T4928] kasan_save_track+0x40/0x78 [ 40.151961][ T4928] kasan_save_free_info+0x58/0x70 [ 40.151969][ T4928] __kasan_slab_free+0x74/0xa4 [ 40.151975][ T4928] kfree+0x188/0x690 [ 40.151981][ T4928] dvb_device_put+0x64/0xd0 [ 40.151986][ T4928] dvb_device_open+0x23c/0x254 [ 40.151991][ T4928] chrdev_open+0x398/0x3e8 [ 40.151998][ T4928] do_dentry_open+0x5c4/0xfc0 [ 40.152006][ T4928] vfs_open+0x44/0x2dc [ 40.152013][ T4928] path_openat+0x21fc/0x2a60 [ 40.152019][ T4928] do_file_open+0x1c8/0x2e8 [ 40.152026][ T4928] do_sys_openat2+0x114/0x1e8 [ 40.152033][ T4928] do_sys_open+0xb0/0xe0 [ 40.152041][ T4928] __arm64_sys_openat+0xa0/0xbc [ 40.152049][ T4928] invoke_syscall+0x98/0x244 [ 40.152057][ T4928] el0_svc_common+0xec/0x23c [ 40.152065][ T4928] do_el0_svc+0x4c/0x5c [ 40.152073][ T4928] el0_svc+0x64/0x260 [ 40.152080][ T4928] el0t_64_sync_handler+0x48/0x148 [ 40.152088][ T4928] el0t_64_sync+0x198/0x19c [ 40.152093][ T4928] [ 40.152094][ T4928] The buggy address belongs to the object at ffff0000cc32c200 [ 40.152094][ T4928] which belongs to the cache kmalloc-256 of size 256 [ 40.152100][ T4928] The buggy address is located 24 bytes inside of [ 40.152100][ T4928] freed 256-byte region [ffff0000cc32c200, ffff0000cc32c300) [ 40.152107][ T4928] [ 40.152109][ T4928] The buggy address belongs to the physical page: [ 40.152113][ T4928] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10c32c [ 40.152120][ T4928] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 40.152125][ T4928] flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 40.152133][ T4928] page_type: f5(slab) [ 40.152140][ T4928] raw: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122 [ 40.152146][ T4928] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 40.152152][ T4928] head: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122 [ 40.152157][ T4928] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 40.152162][ T4928] head: 05ffc00000000001 fffffdffc330cb01 00000000ffffffff 00000000ffffffff [ 40.152168][ T4928] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 40.152171][ T4928] page dumped because: kasan: bad access detected [ 40.152174][ T4928] [ 40.152175][ T4928] Memory state around the buggy address: [ 40.152179][ T4928] ffff0000cc32c100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.152183][ T4928] ffff0000cc32c180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.152187][ T4928] >ffff0000cc32c200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.152191][ T4928] ^ [ 40.152194][ T4928] ffff0000cc32c280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.152198][ T4928] ffff0000cc32c300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.152201][ T4928] ================================================================== [ 40.152453][ T4928] Disabling lock debugging due to kernel taint [ 40.152470][ T4928] ------------[ cut here ]------------ [ 40.152484][ T4928] refcount_t: addition on 0; use-after-free. [ 40.152592][ T4928] WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x134/0x1f8, CPU#0: syz.0.19/4928 [ 40.252924][ T4928] Modules linked in: [ 40.253633][ T4928] CPU: 0 UID: 0 PID: 4928 Comm: syz.0.19 Tainted: G B syzkaller #0 PREEMPT [ 40.255356][ T4928] Tainted: [B]=BAD_PAGE [ 40.256098][ T4928] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 40.257886][ T4928] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 40.259236][ T4928] pc : refcount_warn_saturate+0x134/0x1f8 [ 40.260269][ T4928] lr : refcount_warn_saturate+0x134/0x1f8 [ 40.261235][ T4928] sp : ffff80009d037640 [ 40.261952][ T4928] x29: ffff80009d037640 x28: dfff800000000000 x27: 1fffe0001a190271 [ 40.263398][ T4928] x26: dfff800000000000 x25: ffff700013a06edc x24: dfff800000000000 [ 40.264752][ T4928] x23: ffff80008744d368 x22: ffff0000cc4fdc00 x21: ffff0000cc32c200 [ 40.266271][ T4928] x20: ffff0000cc32c210 x19: ffff80008a158000 x18: 1fffe00035bc5428 [ 40.267971][ T4928] x17: 0000000000000003 x16: ffff800088b07000 x15: 0000000000000000 [ 40.269473][ T4928] x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000000 [ 40.270865][ T4928] x11: 0000000000000000 x10: 0000000000000002 x9 : 82b0932a66e3d500 [ 40.272230][ T4928] x8 : 82b0932a66e3d500 x7 : 0000000000000000 x6 : ffff80008048de94 [ 40.273652][ T4928] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f8054 [ 40.275138][ T4928] x2 : 0000000100000000 x1 : ffff0000d1df57c0 x0 : 0000000000000000 [ 40.276670][ T4928] Call trace: [ 40.277311][ T4928] refcount_warn_saturate+0x134/0x1f8 (P) [ 40.278316][ T4928] dvb_device_get+0x9c/0xc0 [ 40.279168][ T4928] dvb_device_open+0x100/0x254 [ 40.280029][ T4928] chrdev_open+0x398/0x3e8 [ 40.280813][ T4928] do_dentry_open+0x5c4/0xfc0 [ 40.281685][ T4928] vfs_open+0x44/0x2dc [ 40.282410][ T4928] path_openat+0x21fc/0x2a60 [ 40.283212][ T4928] do_file_open+0x1c8/0x2e8 [ 40.283953][ T4928] do_sys_openat2+0x114/0x1e8 [ 40.284735][ T4928] do_sys_open+0xb0/0xe0 [ 40.285424][ T4928] __arm64_sys_openat+0xa0/0xbc [ 40.286245][ T4928] invoke_syscall+0x98/0x244 [ 40.287009][ T4928] el0_svc_common+0xec/0x23c [ 40.287775][ T4928] do_el0_svc+0x4c/0x5c [ 40.288476][ T4928] el0_svc+0x64/0x260 [ 40.289179][ T4928] el0t_64_sync_handler+0x48/0x148 [ 40.290016][ T4928] el0t_64_sync+0x198/0x19c [ 40.290768][ T4928] irq event stamp: 24699 [ 40.291476][ T4928] hardirqs last enabled at (24699): [] finish_task_switch+0x234/0x858 [ 40.293129][ T4928] hardirqs last disabled at (24698): [] __schedule+0x2f8/0x2d80 [ 40.294680][ T4928] softirqs last enabled at (23832): [] do_sve_acc+0x32c/0x4b8 [ 40.296182][ T4928] softirqs last disabled at (23830): [] do_sve_acc+0x10c/0x4b8 [ 40.297739][ T4928] ---[ end trace 0000000000000000 ]--- [ 40.299621][ T50] Bluetooth: hci0: command tx timeout [ 40.308360][ T4928] ------------[ cut here ]------------ [ 40.308399][ T4928] refcount_t: underflow; use-after-free. [ 40.310655][ T4928] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x154/0x1f8, CPU#0: syz.0.19/4928 [ 40.312253][ T4928] Modules linked in: [ 40.312899][ T4928] CPU: 0 UID: 0 PID: 4928 Comm: syz.0.19 Tainted: G B W syzkaller #0 PREEMPT [ 40.314676][ T4928] Tainted: [B]=BAD_PAGE, [W]=WARN [ 40.315508][ T4928] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 40.317195][ T4928] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 40.318508][ T4928] pc : refcount_warn_saturate+0x154/0x1f8 [ 40.319462][ T4928] lr : refcount_warn_saturate+0x154/0x1f8 [ 40.320417][ T4928] sp : ffff80009d037540 [ 40.321100][ T4928] x29: ffff80009d037540 x28: ffff0000d0c81340 x27: ffff0000cba2c010 [ 40.322420][ T4928] x26: dfff800000000000 x25: 1fffe00019865847 x24: ffff0000cba2c060 [ 40.323756][ T4928] x23: 00000000fffffffc x22: ffff0000cc32c23c x21: 00000000c0000000 [ 40.325180][ T4928] x20: ffff0000cc32c210 x19: ffff80008a158000 x18: 1fffe00035bc5428 [ 40.326606][ T4928] x17: 0000000000000003 x16: ffff800088b07000 x15: ffff800088bbd060 [ 40.328059][ T4928] x14: ffff0001ade2a14c x13: 0000000000000001 x12: 0000000000000000 [ 40.329488][ T4928] x11: 0000000000000000 x10: 0000000000000003 x9 : 82b0932a66e3d500 [ 40.330923][ T4928] x8 : 82b0932a66e3d500 x7 : 0000000000000000 x6 : ffff8000803b88cc [ 40.332244][ T4928] x5 : 0000000000000000 x4 : 0000000000000008 x3 : ffff8000803b8a40 [ 40.333647][ T4928] x2 : 0000000000000001 x1 : ffff0000d1df57c0 x0 : 0000000000000001 [ 40.335030][ T4928] Call trace: [ 40.335598][ T4928] refcount_warn_saturate+0x154/0x1f8 (P) [ 40.336620][ T4928] dvb_device_put+0xac/0xd0 [ 40.337399][ T4928] dvb_generic_release+0xec/0x158 [ 40.338282][ T4928] dvb_frontend_open+0x9cc/0x10a8 [ 40.339177][ T4928] dvb_device_open+0x1f8/0x254 [ 40.340001][ T4928] chrdev_open+0x398/0x3e8 [ 40.340748][ T4928] do_dentry_open+0x5c4/0xfc0 [ 40.341557][ T4928] vfs_open+0x44/0x2dc [ 40.342257][ T4928] path_openat+0x21fc/0x2a60 [ 40.343037][ T4928] do_file_open+0x1c8/0x2e8 [ 40.343766][ T4928] do_sys_openat2+0x114/0x1e8 [ 40.344534][ T4928] do_sys_open+0xb0/0xe0 [ 40.345251][ T4928] __arm64_sys_openat+0xa0/0xbc [ 40.346052][ T4928] invoke_syscall+0x98/0x244 [ 40.346856][ T4928] el0_svc_common+0xec/0x23c [ 40.347639][ T4928] do_el0_svc+0x4c/0x5c [ 40.348365][ T4928] el0_svc+0x64/0x260 [ 40.349055][ T4928] el0t_64_sync_handler+0x48/0x148 [ 40.349923][ T4928] el0t_64_sync+0x198/0x19c [ 40.350660][ T4928] irq event stamp: 24699 [ 40.351368][ T4928] hardirqs last enabled at (24699): [] finish_task_switch+0x234/0x858 [ 40.352999][ T4928] hardirqs last disabled at (24698): [] __schedule+0x2f8/0x2d80 [ 40.354584][ T4928] softirqs last enabled at (23832): [] do_sve_acc+0x32c/0x4b8 [ 40.356133][ T4928] softirqs last disabled at (23830): [] do_sve_acc+0x10c/0x4b8 [ 40.357659][ T4928] ---[ end trace 0000000000000000 ]--- [ 40.378791][ T4930] ------------[ cut here ]------------ [ 40.378809][ T4930] refcount_t: saturated; leaking memory. [ 40.381266][ T4930] WARNING: lib/refcount.c:22 at refcount_warn_saturate+0x1b4/0x1f8, CPU#0: syz.0.20/4930 [ 40.382797][ T4930] Modules linked in: [ 40.383466][ T4930] CPU: 0 UID: 0 PID: 4930 Comm: syz.0.20 Tainted: G B W syzkaller #0 PREEMPT [ 40.385143][ T4930] Tainted: [B]=BAD_PAGE, [W]=WARN [ 40.385986][ T4930] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 40.387562][ T4930] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 40.388850][ T4930] pc : refcount_warn_saturate+0x1b4/0x1f8 [ 40.389822][ T4930] lr : refcount_warn_saturate+0x1b4/0x1f8 [ 40.390818][ T4930] sp : ffff80009c837640 [ 40.391499][ T4930] x29: ffff80009c837640 x28: dfff800000000000 x27: 1fffe0001b435c41 [ 40.392827][ T4930] x26: dfff800000000000 x25: ffff700013906edc x24: dfff800000000000 [ 40.394237][ T4930] x23: ffff80008744d368 x22: ffff0000cc4fdc00 x21: 000000007ffffffe [ 40.395641][ T4930] x20: ffff0000cc32c210 x19: ffff80008a158000 x18: 1fffe00035bc5428 [ 40.397103][ T4930] x17: 0000000000000003 x16: ffff800088b07000 x15: ffff800088bbd060 [ 40.398604][ T4930] x14: ffff0001ade2a14c x13: 0000000000000001 x12: 0000000000000000 [ 40.399962][ T4930] x11: 0000000000000000 x10: 0000000000000003 x9 : 6a1dc61b69d72b00 [ 40.401387][ T4930] x8 : 6a1dc61b69d72b00 x7 : 0000000000000000 x6 : ffff8000803b88cc [ 40.402824][ T4930] x5 : 0000000000000000 x4 : 0000000000000008 x3 : ffff8000803b8a40 [ 40.404212][ T4930] x2 : 0000000000000001 x1 : ffff0000cfa93a80 x0 : 0000000000000001 [ 40.405582][ T4930] Call trace: [ 40.406174][ T4930] refcount_warn_saturate+0x1b4/0x1f8 (P) [ 40.407188][ T4930] dvb_device_get+0x9c/0xc0 [ 40.407995][ T4930] dvb_device_open+0x100/0x254 [ 40.408857][ T4930] chrdev_open+0x398/0x3e8 [ 40.409621][ T4930] do_dentry_open+0x5c4/0xfc0 [ 40.410430][ T4930] vfs_open+0x44/0x2dc [ 40.411119][ T4930] path_openat+0x21fc/0x2a60 [ 40.411910][ T4930] do_file_open+0x1c8/0x2e8 [ 40.412715][ T4930] do_sys_openat2+0x114/0x1e8 [ 40.413568][ T4930] do_sys_open+0xb0/0xe0 [ 40.414337][ T4930] __arm64_sys_openat+0xa0/0xbc [ 40.415209][ T4930] invoke_syscall+0x98/0x244 [ 40.416033][ T4930] el0_svc_common+0xec/0x23c [ 40.416804][ T4930] do_el0_svc+0x4c/0x5c [ 40.417502][ T4930] el0_svc+0x64/0x260 [ 40.418145][ T4930] el0t_64_sync_handler+0x48/0x148 [ 40.418999][ T4930] el0t_64_sync+0x198/0x19c [ 40.419800][ T4930] irq event stamp: 0 [ 40.420484][ T4930] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 40.421700][ T4930] hardirqs last disabled at (0): [] copy_process+0x1384/0x32e8 [ 40.423278][ T4930] softirqs last enabled at (0): [] copy_process+0x13a4/0x32e8 [ 40.424857][ T4930] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 40.426098][ T4930] ---[ end trace 0000000000000000 ]--- 1970/01/01 00:00:41 executed programs: 45 [ 42.344760][ T50] Bluetooth: hci0: command tx timeout [ 44.434322][ T50] Bluetooth: hci0: command tx timeout 1970/01/01 00:00:46 executed programs: 336