Warning: Permanently added '10.128.1.33' (ED25519) to the list of known hosts. 1970/01/01 00:00:30 parsed 1 programs 1970/01/01 00:00:30 serving rpc on tcp://37995 [ 31.090157][ T4723] cgroup: Unknown subsys name 'net' [ 31.231401][ T4723] cgroup: Unknown subsys name 'cpuset' [ 31.232939][ T4723] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 31.387987][ T4723] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 33.401347][ T4730] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 33.944856][ T4761] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 33.945157][ T4761] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 33.945329][ T4761] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 33.945667][ T4761] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 33.945903][ T4761] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 34.065558][ T1184] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.065568][ T1184] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.071200][ T440] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.071214][ T440] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.410490][ T4771] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.410852][ T4771] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.410949][ T4771] bridge_slave_0: entered allmulticast mode [ 34.411481][ T4771] bridge_slave_0: entered promiscuous mode [ 34.414211][ T4771] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.414233][ T4771] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.414282][ T4771] bridge_slave_1: entered allmulticast mode [ 34.414705][ T4771] bridge_slave_1: entered promiscuous mode [ 34.437612][ T4771] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 34.439970][ T4771] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 34.446554][ T4771] team0: Port device team_slave_0 added [ 34.448011][ T4771] team0: Port device team_slave_1 added [ 34.456235][ T4771] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 34.456249][ T4771] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 34.456265][ T4771] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 34.457109][ T4771] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 34.457116][ T4771] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 34.457128][ T4771] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 34.467779][ T4771] hsr_slave_0: entered promiscuous mode [ 34.468128][ T4771] hsr_slave_1: entered promiscuous mode [ 34.532274][ T4771] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 34.534986][ T4771] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 34.535475][ T4771] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 34.536620][ T4771] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 34.536957][ T4771] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 34.537871][ T4771] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 34.538433][ T4771] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 34.549787][ T4771] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 34.573597][ T4771] 8021q: adding VLAN 0 to HW filter on device bond0 [ 34.578050][ T4771] 8021q: adding VLAN 0 to HW filter on device team0 [ 34.582702][ T440] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.582747][ T440] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.583399][ T440] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.583420][ T440] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.692439][ T4771] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 34.706229][ T4771] veth0_vlan: entered promiscuous mode [ 34.710198][ T4771] veth1_vlan: entered promiscuous mode [ 34.717696][ T4771] veth0_macvtap: entered promiscuous mode [ 34.721573][ T4771] veth1_macvtap: entered promiscuous mode [ 34.726154][ T4771] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 34.727159][ T4771] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 34.749125][ T440] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.749349][ T3227] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.749372][ T3227] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.749392][ T3227] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.804496][ T440] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 34.894684][ T440] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 34.952625][ T440] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 34.983260][ T440] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 1970/01/01 00:00:35 executed programs: 0 [ 35.287095][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 35.287558][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 35.287837][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 35.288199][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 35.294773][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 35.431734][ T4825] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.431805][ T4825] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.431894][ T4825] bridge_slave_0: entered allmulticast mode [ 35.432316][ T4825] bridge_slave_0: entered promiscuous mode [ 35.433207][ T4825] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.433249][ T4825] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.433298][ T4825] bridge_slave_1: entered allmulticast mode [ 35.433696][ T4825] bridge_slave_1: entered promiscuous mode [ 35.440529][ T4825] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 35.441415][ T4825] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 35.447822][ T4825] team0: Port device team_slave_0 added [ 35.448665][ T4825] team0: Port device team_slave_1 added [ 35.455097][ T4825] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 35.455108][ T4825] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.455121][ T4825] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 35.455988][ T4825] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 35.455996][ T4825] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.456019][ T4825] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 35.467024][ T4825] hsr_slave_0: entered promiscuous mode [ 35.467331][ T4825] hsr_slave_1: entered promiscuous mode [ 35.467519][ T4825] debugfs: 'hsr0' already exists in 'hsr' [ 35.467574][ T4825] Cannot create hsr debugfs directory [ 37.298671][ T4761] Bluetooth: hci0: command tx timeout [ 38.052834][ T440] bridge_slave_1: left allmulticast mode [ 38.052861][ T440] bridge_slave_1: left promiscuous mode [ 38.053189][ T440] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.056327][ T440] bridge_slave_0: left allmulticast mode [ 38.056347][ T440] bridge_slave_0: left promiscuous mode [ 38.056414][ T440] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.114781][ T440] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 38.139916][ T440] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 38.159320][ T440] bond0 (unregistering): Released all slaves [ 38.213271][ T440] hsr_slave_0: left promiscuous mode [ 38.213631][ T440] hsr_slave_1: left promiscuous mode [ 38.213930][ T440] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 38.213944][ T440] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 38.214344][ T440] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 38.214354][ T440] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 38.217803][ T440] veth1_macvtap: left promiscuous mode [ 38.217836][ T440] veth0_macvtap: left promiscuous mode [ 38.217884][ T440] veth1_vlan: left promiscuous mode [ 38.217944][ T440] veth0_vlan: left promiscuous mode [ 38.316829][ T440] team0 (unregistering): Port device team_slave_1 removed [ 38.324054][ T440] team0 (unregistering): Port device team_slave_0 removed [ 38.373537][ T4400] 8021q: adding VLAN 0 to HW filter on device eth0 [ 38.560816][ T4825] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 38.563516][ T4825] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 38.563965][ T4825] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 38.564988][ T4825] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 38.565373][ T4825] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 38.566671][ T4825] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 38.567074][ T4825] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 38.567936][ T4825] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 38.601361][ T4825] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.605849][ T4825] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.608840][ T42] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.608867][ T42] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.609390][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.609408][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.617497][ T4825] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 38.617511][ T4825] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 38.856197][ T4825] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.870943][ T4825] veth0_vlan: entered promiscuous mode [ 38.872732][ T4825] veth1_vlan: entered promiscuous mode [ 38.882996][ T4825] veth0_macvtap: entered promiscuous mode [ 38.885121][ T4825] veth1_macvtap: entered promiscuous mode [ 38.890952][ T4825] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 38.895069][ T4825] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 38.919097][ T1184] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.919128][ T1184] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.919148][ T1184] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.919162][ T1184] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.930514][ T1411] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 38.930528][ T1411] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 38.946638][ T440] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 38.946653][ T440] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.228418][ T9] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 39.378719][ T9] usb 1-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 39.379622][ T9] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 39.379633][ T9] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 39.380959][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.380970][ T9] usb 1-1: Product: syz [ 39.380976][ T9] usb 1-1: Manufacturer: syz [ 39.380982][ T9] usb 1-1: SerialNumber: syz [ 39.388590][ T4761] Bluetooth: hci0: command tx timeout [ 40.387359][ C0] ================================================================== [ 40.387372][ C0] BUG: KASAN: slab-out-of-bounds in gb_operation_message_alloc+0x224/0x258 [ 40.387391][ C0] Write of size 2 at addr ffff0000c64b3442 by task syz.0.17/4933 [ 40.387398][ C0] [ 40.387403][ C0] CPU: 0 UID: 0 PID: 4933 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT [ 40.387413][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 40.387418][ C0] Call trace: [ 40.387420][ C0] show_stack+0x2c/0x3c (C) [ 40.387434][ C0] __dump_stack+0x30/0x40 [ 40.387445][ C0] dump_stack_lvl+0xd8/0x12c [ 40.387455][ C0] print_address_description+0xb0/0x238 [ 40.387463][ C0] print_report+0x68/0x84 [ 40.387470][ C0] kasan_report+0x8c/0xc4 [ 40.387480][ C0] __asan_report_store2_noabort+0x20/0x2c [ 40.387490][ C0] gb_operation_message_alloc+0x224/0x258 [ 40.387499][ C0] gb_operation_create_common+0xa4/0x3b4 [ 40.387508][ C0] gb_connection_recv+0x268/0xfd4 [ 40.387517][ C0] greybus_data_rcvd+0x254/0x67c [ 40.387524][ C0] cport_in_callback+0x15c/0x298 [ 40.387534][ C0] __usb_hcd_giveback_urb+0x314/0x594 [ 40.387543][ C0] usb_hcd_giveback_urb+0x100/0x350 [ 40.387551][ C0] dummy_timer+0x570/0x2ba0 [ 40.387558][ C0] __hrtimer_run_queues+0x310/0x998 [ 40.387567][ C0] hrtimer_run_softirq+0x1b4/0x2a8 [ 40.387575][ C0] handle_softirqs+0x324/0xcbc [ 40.387584][ C0] __do_softirq+0x14/0x20 [ 40.387592][ C0] ____do_softirq+0x14/0x20 [ 40.387599][ C0] call_on_irq_stack+0x30/0x48 [ 40.387607][ C0] do_softirq_own_stack+0x20/0x2c [ 40.387614][ C0] __irq_exit_rcu+0x10c/0x318 [ 40.387622][ C0] irq_exit_rcu+0x14/0x84 [ 40.387629][ C0] el1_interrupt+0x40/0x60 [ 40.387641][ C0] el1h_64_irq_handler+0x18/0x24 [ 40.387651][ C0] el1h_64_irq+0x78/0x7c [ 40.387658][ C0] vm_area_dup+0x290/0x5c8 (P) [ 40.387669][ C0] __split_vma+0x1a8/0x83c [ 40.387680][ C0] vma_modify+0x11ac/0x18f0 [ 40.387690][ C0] vma_modify_flags+0x228/0x33c [ 40.387699][ C0] mprotect_fixup+0x2b0/0x728 [ 40.387709][ C0] do_mprotect_pkey+0x7f8/0xa84 [ 40.387718][ C0] __arm64_sys_mprotect+0x88/0xa0 [ 40.387728][ C0] invoke_syscall+0x98/0x244 [ 40.387738][ C0] el0_svc_common+0xec/0x23c [ 40.387748][ C0] do_el0_svc+0x4c/0x5c [ 40.387758][ C0] el0_svc+0x60/0x1d8 [ 40.387768][ C0] el0t_64_sync_handler+0x44/0x104 [ 40.387779][ C0] el0t_64_sync+0x198/0x19c [ 40.387786][ C0] [ 40.387788][ C0] Allocated by task 4933: [ 40.387792][ C0] kasan_save_track+0x40/0x78 [ 40.387800][ C0] kasan_save_alloc_info+0x40/0x50 [ 40.387807][ C0] __kasan_kmalloc+0x9c/0xb4 [ 40.387814][ C0] __kmalloc_noprof+0x34c/0x6c8 [ 40.387821][ C0] gb_operation_message_alloc+0x90/0x258 [ 40.387828][ C0] gb_operation_create_common+0xa4/0x3b4 [ 40.387835][ C0] gb_connection_recv+0x268/0xfd4 [ 40.387842][ C0] greybus_data_rcvd+0x254/0x67c [ 40.387848][ C0] cport_in_callback+0x15c/0x298 [ 40.387856][ C0] __usb_hcd_giveback_urb+0x314/0x594 [ 40.387862][ C0] usb_hcd_giveback_urb+0x100/0x350 [ 40.387868][ C0] dummy_timer+0x570/0x2ba0 [ 40.387874][ C0] __hrtimer_run_queues+0x310/0x998 [ 40.387880][ C0] hrtimer_run_softirq+0x1b4/0x2a8 [ 40.387887][ C0] handle_softirqs+0x324/0xcbc [ 40.387893][ C0] __do_softirq+0x14/0x20 [ 40.387899][ C0] [ 40.387900][ C0] The buggy address belongs to the object at ffff0000c64b3440 [ 40.387900][ C0] which belongs to the cache kmalloc-8 of size 8 [ 40.387906][ C0] The buggy address is located 2 bytes inside of [ 40.387906][ C0] allocated 3-byte region [ffff0000c64b3440, ffff0000c64b3443) [ 40.387914][ C0] [ 40.387916][ C0] The buggy address belongs to the physical page: [ 40.387920][ C0] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1064b3 [ 40.387927][ C0] flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) [ 40.387934][ C0] page_type: f5(slab) [ 40.387942][ C0] raw: 05ffc00000000000 ffff0000c0001500 dead000000000100 dead000000000122 [ 40.387948][ C0] raw: 0000000000000000 0000000000800080 00000000f5000000 0000000000000000 [ 40.387951][ C0] page dumped because: kasan: bad access detected [ 40.387954][ C0] [ 40.387956][ C0] Memory state around the buggy address: [ 40.387960][ C0] ffff0000c64b3300: fa fc fc fc 06 fc fc fc 06 fc fc fc 06 fc fc fc [ 40.387965][ C0] ffff0000c64b3380: 06 fc fc fc fa fc fc fc 06 fc fc fc 06 fc fc fc [ 40.387969][ C0] >ffff0000c64b3400: 06 fc fc fc 06 fc fc fc 03 fc fc fc 06 fc fc fc [ 40.387973][ C0] ^ [ 40.387976][ C0] ffff0000c64b3480: 06 fc fc fc 06 fc fc fc 06 fc fc fc 00 fc fc fc [ 40.387981][ C0] ffff0000c64b3500: 06 fc fc fc 06 fc fc fc 06 fc fc fc 06 fc fc fc [ 40.387984][ C0] ================================================================== [ 40.387988][ C0] Disabling lock debugging due to kernel taint [ 40.388028][ T440] greybus 1-svc: unexpected request 0x00 received (state 0) [ 40.393709][ T4935] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 40.393834][ T4935] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 40.588550][ T24] usb 1-1: USB disconnect, device number 2 [ 40.588626][ C0] usb 1-1: failed to resubmit arpc in-urb: -19 [ 40.588641][ C0] usb 1-1: failed to resubmit arpc in-urb: -19 [ 40.588652][ C0] usb 1-1: failed to resubmit in-urb: -19 [ 40.588662][ C0] usb 1-1: failed to resubmit in-urb: -19 [ 40.588670][ C0] usb 1-1: failed to resubmit in-urb: -19 [ 40.588678][ C0] usb 1-1: failed to resubmit in-urb: -19 [ 40.590742][ T24] usb 1-1: failed to send ARPC request 4: -19 [ 40.590767][ T24] usb 1-1: failed to execute ARPC: -19 [ 40.590774][ T24] usb 1-1: failed to flush cport 0: -19 [ 40.590781][ T24] greybus greybus1: 0/0:0: failed to flush host cport: -19 [ 40.590811][ T24] usb 1-1: failed to send ARPC request 2: -19 [ 40.590828][ T24] usb 1-1: failed to execute ARPC: -19 [ 40.590834][ T24] usb 1-1: failed to quiesce cport 0: -19 (0) [ 40.590840][ T24] greybus greybus1: 0/0:0: failed to quiesce host cport: -19 [ 40.590865][ T24] usb 1-1: failed to send ARPC request 3: -19 [ 40.590882][ T24] usb 1-1: failed to execute ARPC: -19 [ 40.590887][ T24] usb 1-1: failed to clear cport 0: -19 [ 40.590893][ T24] greybus greybus1: 0/0:0: failed to clear host cport: -19