Warning: Permanently added '10.128.0.23' (ED25519) to the list of known hosts. 1970/01/01 00:00:31 parsed 1 programs 1970/01/01 00:00:31 serving rpc on tcp://36099 [ 32.518617][ T4340] cgroup: Unknown subsys name 'net' [ 32.726451][ T4340] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 33.016425][ T4340] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 37.133620][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 37.136176][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 37.140959][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 37.148024][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 37.149408][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 37.150868][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 37.519485][ T4413] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 37.521025][ T4413] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 37.522402][ T4413] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 37.524520][ T4413] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 37.525937][ T4413] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 37.527376][ T4413] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 37.634187][ T4420] chnl_net:caif_netlink_parms(): no params data found [ 37.663958][ T4420] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.665464][ T4420] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.667350][ T4420] device bridge_slave_0 entered promiscuous mode [ 37.669888][ T4420] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.671129][ T4420] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.672698][ T4420] device bridge_slave_1 entered promiscuous mode [ 37.679831][ T4420] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.682219][ T4420] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 37.688567][ T4420] team0: Port device team_slave_0 added [ 37.690247][ T4420] team0: Port device team_slave_1 added [ 37.697679][ T4420] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 37.698962][ T4420] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.703583][ T4420] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 37.706620][ T4420] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 37.707726][ T4420] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.711714][ T4420] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.759068][ T4420] device hsr_slave_0 entered promiscuous mode [ 37.794882][ T4420] device hsr_slave_1 entered promiscuous mode [ 37.885922][ T4420] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 37.923330][ T4420] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 37.982517][ T4420] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 38.014822][ T4420] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 38.063079][ T4420] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.066977][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 38.068891][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 38.071729][ T4420] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.081485][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 38.083213][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 38.085007][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.086293][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.087884][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 38.089497][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 38.091129][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.092429][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.096588][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 38.099231][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 38.101901][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 38.113001][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 38.115410][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 38.116963][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 38.119797][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 38.121618][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 38.124319][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 38.126289][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 38.128866][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 38.130548][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 38.132845][ T4420] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 38.190102][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 38.191446][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 38.195817][ T4420] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.206488][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 38.212724][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 38.214708][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 38.216177][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 38.219162][ T4420] device veth0_vlan entered promiscuous mode [ 38.222117][ T4420] device veth1_vlan entered promiscuous mode [ 38.228456][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 38.229936][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 38.231414][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 38.233735][ T4420] device veth0_macvtap entered promiscuous mode [ 38.241457][ T4420] device veth1_macvtap entered promiscuous mode [ 38.247554][ T4420] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 38.248834][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 38.250522][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 38.252098][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 38.255447][ T4420] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 38.256753][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 38.258344][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 38.260731][ T4420] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.262121][ T4420] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.263592][ T4420] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.265699][ T4420] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 1970/01/01 00:00:38 executed programs: 0 [ 38.702757][ T48] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 38.704707][ T48] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 38.706243][ T48] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 38.708334][ T48] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 38.709986][ T48] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 38.711307][ T48] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 39.078939][ T4447] chnl_net:caif_netlink_parms(): no params data found [ 39.094544][ T4447] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.095799][ T4447] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.097222][ T4447] device bridge_slave_0 entered promiscuous mode [ 39.099314][ T4447] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.100626][ T4447] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.102125][ T4447] device bridge_slave_1 entered promiscuous mode [ 39.147821][ T4447] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 39.150326][ T4447] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 39.156951][ T4447] team0: Port device team_slave_0 added [ 39.158715][ T4447] team0: Port device team_slave_1 added [ 39.163663][ T4447] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 39.164868][ T4447] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 39.168785][ T4447] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 39.171046][ T4447] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 39.172134][ T4447] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 39.176971][ T4447] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 39.225829][ T4447] device hsr_slave_0 entered promiscuous mode [ 39.264070][ T4447] device hsr_slave_1 entered promiscuous mode [ 39.304044][ T4447] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 39.305437][ T4447] Cannot create hsr debugfs directory [ 39.715944][ T4447] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.714183][ T4413] Bluetooth: hci0: command 0x0409 tx timeout [ 42.624919][ T4447] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 42.794045][ T4413] Bluetooth: hci0: command 0x041b tx timeout [ 43.835107][ T4447] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 43.925640][ T4447] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.115616][ T4447] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 44.239886][ T4447] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 44.349161][ T4447] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 44.384916][ T4447] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 44.563197][ T4447] 8021q: adding VLAN 0 to HW filter on device bond0 [ 44.566787][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 44.568313][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 44.570748][ T4447] 8021q: adding VLAN 0 to HW filter on device team0 [ 44.573106][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 44.575732][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 44.577451][ T4443] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.578586][ T4443] bridge0: port 1(bridge_slave_0) entered forwarding state [ 44.579977][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 44.583652][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 44.588226][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 44.590094][ T4443] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.591258][ T4443] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.648678][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 44.651385][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 44.655077][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 44.656976][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 44.658478][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 44.661221][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 44.662801][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 44.665778][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 44.667419][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 44.669951][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 44.671591][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 44.675137][ T4447] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 44.752322][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 44.753574][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 44.830894][ T4447] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 44.836512][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 44.838153][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 44.843759][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 44.845669][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 44.847802][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 44.849244][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 44.851625][ T4447] device veth0_vlan entered promiscuous mode [ 44.854816][ T4447] device veth1_vlan entered promiscuous mode [ 44.860863][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 44.862448][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 44.865302][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 44.866949][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 44.874065][ T4413] Bluetooth: hci0: command 0x040f tx timeout [ 44.911444][ T4447] device veth0_macvtap entered promiscuous mode [ 44.913714][ T4447] device veth1_macvtap entered promiscuous mode [ 44.918253][ T4447] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 44.919854][ T4447] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 44.921890][ T4447] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 44.923146][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 44.924934][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 44.926311][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 44.928018][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 44.930568][ T4447] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 44.932260][ T4447] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 44.934445][ T4447] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 44.935654][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 44.937260][ T4443] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 44.939549][ T4447] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.940956][ T4447] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.942447][ T4447] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.943808][ T4447] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 44.965280][ T39] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 44.965370][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 44.966739][ T39] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 44.968062][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 44.998311][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 44.999804][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 45.036485][ T1291] device hsr_slave_0 left promiscuous mode [ 45.074266][ T1291] device hsr_slave_1 left promiscuous mode [ 45.096158][ T4461] ------------[ cut here ]------------ [ 45.097098][ T4461] WARNING: CPU: 0 PID: 4461 at net/tls/tls_strp.c:493 tls_strp_msg_load+0x5ac/0x82c [ 45.098633][ T4461] Modules linked in: [ 45.099314][ T4461] CPU: 0 PID: 4461 Comm: syz.0.17 Not tainted syzkaller #0 [ 45.100472][ T4461] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 45.102161][ T4461] pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 45.103493][ T4461] pc : tls_strp_msg_load+0x5ac/0x82c [ 45.104399][ T4461] lr : tls_strp_msg_load+0x5ac/0x82c [ 45.105257][ T4461] sp : ffff800020d774c0 [ 45.105915][ T4461] x29: ffff800020d77540 x28: 1fffe0001b039e9b x27: 1fffe0001b039e9b [ 45.107279][ T4461] x26: ffff7000041aee9c x25: dfff800000000000 x24: ffff0000d81cf4dc [ 45.108636][ T4461] x23: 0000000000000000 x22: 000000000000001e x21: ffff0000dd963da0 [ 45.109962][ T4461] x20: ffff0000d81cf4d0 x19: ffff0000d81cf4d8 x18: 0000000000000000 [ 45.111325][ T4461] x17: 0000000000000000 x16: ffff800011b90080 x15: 0000000000000000 [ 45.112612][ T4461] x14: 0000000000000002 x13: 1ffff000041aef06 x12: 0000000000000000 [ 45.114030][ T4461] x11: ff008000108900fc x10: 0000000000000000 x9 : ffff8000108900fc [ 45.115417][ T4461] x8 : ffff0000c328d400 x7 : 0000000000000000 x6 : ffff800020d777fc [ 45.116781][ T4461] x5 : 0000000000000001 x4 : 0000000000000000 x3 : 0000000000000001 [ 45.118146][ T4461] x2 : 0000000000000000 x1 : 000000000000001e x0 : 0000000000000000 [ 45.119519][ T4461] Call trace: [ 45.120061][ T4461] tls_strp_msg_load+0x5ac/0x82c [ 45.120918][ T4461] tls_rx_rec_wait+0x784/0x8c0 [ 45.121754][ T4461] tls_sw_recvmsg+0x554/0x181c [ 45.122546][ T4461] inet_recvmsg+0x118/0x1c8 [ 45.123351][ T4461] ____sys_recvmsg+0x270/0x754 [ 45.124203][ T4461] __sys_recvmsg+0x250/0x33c [ 45.124974][ T4461] __arm64_sys_recvmsg+0x80/0x94 [ 45.125803][ T4461] invoke_syscall+0x98/0x290 [ 45.126590][ T4461] el0_svc_common+0x13c/0x258 [ 45.127411][ T4461] do_el0_svc+0x5c/0x134 [ 45.128158][ T4461] el0_svc+0x58/0x128 [ 45.128849][ T4461] el0t_64_sync_handler+0x84/0xf0 [ 45.129701][ T4461] el0t_64_sync+0x18c/0x190 [ 45.130459][ T4461] irq event stamp: 850 [ 45.131140][ T4461] hardirqs last enabled at (849): [] __local_bh_enable_ip+0x1f8/0x37c [ 45.132796][ T4461] hardirqs last disabled at (850): [] el1_dbg+0x24/0x80 [ 45.134206][ T4461] softirqs last enabled at (848): [] lock_sock_nested+0xe0/0x130 [ 45.135759][ T4461] softirqs last disabled at (846): [] lock_sock_nested+0x88/0x130 [ 45.137291][ T4461] ---[ end trace 0000000000000000 ]--- [ 45.139203][ T4461] ================================================================== [ 45.140565][ T4461] BUG: KASAN: use-after-free in __skb_nsg+0x474/0x504 [ 45.141640][ T4461] Read of size 4 at addr ffff0000d0517a60 by task syz.0.17/4461 [ 45.142862][ T4461] [ 45.143236][ T4461] CPU: 1 PID: 4461 Comm: syz.0.17 Tainted: G W syzkaller #0 [ 45.144772][ T4461] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 45.146615][ T4461] Call trace: [ 45.147172][ T4461] dump_backtrace+0x1c4/0x1f0 [ 45.147983][ T4461] show_stack+0x2c/0x3c [ 45.148687][ T4461] __dump_stack+0x30/0x40 [ 45.149405][ T4461] dump_stack_lvl+0xf4/0x15c [ 45.150188][ T4461] print_address_description+0x88/0x218 [ 45.151183][ T4461] print_report+0x50/0x68 [ 45.151945][ T4461] kasan_report+0xa8/0xfc [ 45.152659][ T4461] __asan_report_load4_noabort+0x2c/0x38 [ 45.153619][ T4461] __skb_nsg+0x474/0x504 [ 45.154300][ T4461] tls_decrypt_sg+0x268/0x27c8 [ 45.155074][ T4461] tls_decrypt_sw+0xb8/0x9e0 [ 45.155847][ T4461] tls_rx_one_record+0x164/0xc18 [ 45.156736][ T4461] tls_sw_recvmsg+0x7e8/0x181c [ 45.157581][ T4461] inet_recvmsg+0x118/0x1c8 [ 45.158352][ T4461] ____sys_recvmsg+0x270/0x754 [ 45.159167][ T4461] __sys_recvmsg+0x250/0x33c [ 45.159948][ T4461] __arm64_sys_recvmsg+0x80/0x94 [ 45.160795][ T4461] invoke_syscall+0x98/0x290 [ 45.161552][ T4461] el0_svc_common+0x13c/0x258 [ 45.162335][ T4461] do_el0_svc+0x5c/0x134 [ 45.163045][ T4461] el0_svc+0x58/0x128 [ 45.163740][ T4461] el0t_64_sync_handler+0x84/0xf0 [ 45.164587][ T4461] el0t_64_sync+0x18c/0x190 [ 45.165361][ T4461] [ 45.165745][ T4461] Allocated by task 4462: [ 45.166435][ T4461] kasan_set_track+0x4c/0x80 [ 45.167195][ T4461] kasan_save_alloc_info+0x24/0x30 [ 45.168040][ T4461] __kasan_slab_alloc+0x70/0x88 [ 45.168836][ T4461] slab_post_alloc_hook+0x74/0x430 [ 45.169702][ T4461] kmem_cache_alloc_node+0x258/0x344 [ 45.170594][ T4461] __alloc_skb+0x128/0x728 [ 45.171371][ T4461] tcp_stream_alloc_skb+0x48/0x2d8 [ 45.172247][ T4461] do_tcp_sendpages+0x798/0x22dc [ 45.173133][ T4461] tls_push_sg+0x128/0x6e4 [ 45.173883][ T4461] tls_tx_records+0x2bc/0x4b8 [ 45.174645][ T4461] tls_push_record+0x1860/0x2d78 [ 45.175480][ T4461] bpf_exec_tx_verdict+0xc88/0x1258 [ 45.176362][ T4461] tls_sw_sendmsg+0xabc/0x14d4 [ 45.177158][ T4461] inet_sendmsg+0x154/0x27c [ 45.177916][ T4461] ____sys_sendmsg+0x588/0x90c [ 45.178698][ T4461] __sys_sendmsg+0x288/0x374 [ 45.179490][ T4461] __arm64_sys_sendmsg+0x80/0x94 [ 45.180346][ T4461] invoke_syscall+0x98/0x290 [ 45.181116][ T4461] el0_svc_common+0x13c/0x258 [ 45.181927][ T4461] do_el0_svc+0x5c/0x134 [ 45.182673][ T4461] el0_svc+0x58/0x128 [ 45.183352][ T4461] el0t_64_sync_handler+0x84/0xf0 [ 45.184228][ T4461] el0t_64_sync+0x18c/0x190 [ 45.185043][ T4461] [ 45.185460][ T4461] Freed by task 4462: [ 45.186180][ T4461] kasan_set_track+0x4c/0x80 [ 45.186950][ T4461] kasan_save_free_info+0x38/0x5c [ 45.187768][ T4461] ____kasan_slab_free+0x148/0x1b0 [ 45.188623][ T4461] __kasan_slab_free+0x18/0x28 [ 45.189422][ T4461] slab_free_freelist_hook+0x16c/0x1e8 [ 45.190359][ T4461] kmem_cache_free+0x118/0x318 [ 45.191167][ T4461] kfree_skbmem+0x10c/0x198 [ 45.191935][ T4461] __kfree_skb+0x5c/0x74 [ 45.192626][ T4461] tcp_rtx_queue_unlink_and_free+0x2ec/0x4a4 [ 45.193604][ T4461] tcp_ack+0x19c4/0x4d08 [ 45.194312][ T4461] tcp_rcv_established+0xb0c/0x1d30 [ 45.195185][ T4461] tcp_v4_do_rcv+0x784/0xa68 [ 45.195984][ T4461] __release_sock+0x1b0/0x3b0 [ 45.196808][ T4461] release_sock+0x60/0x1bc [ 45.197581][ T4461] tls_sw_sendmsg+0x1244/0x14d4 [ 45.198406][ T4461] inet_sendmsg+0x154/0x27c [ 45.199143][ T4461] ____sys_sendmsg+0x588/0x90c [ 45.199944][ T4461] __sys_sendmsg+0x288/0x374 [ 45.200705][ T4461] __arm64_sys_sendmsg+0x80/0x94 [ 45.201517][ T4461] invoke_syscall+0x98/0x290 [ 45.202270][ T4461] el0_svc_common+0x13c/0x258 [ 45.203093][ T4461] do_el0_svc+0x5c/0x134 [ 45.203804][ T4461] el0_svc+0x58/0x128 [ 45.204479][ T4461] el0t_64_sync_handler+0x84/0xf0 [ 45.205323][ T4461] el0t_64_sync+0x18c/0x190 [ 45.206080][ T4461] [ 45.206474][ T4461] The buggy address belongs to the object at ffff0000d0517900 [ 45.206474][ T4461] which belongs to the cache skbuff_fclone_cache of size 488 [ 45.209089][ T4461] The buggy address is located 352 bytes inside of [ 45.209089][ T4461] 488-byte region [ffff0000d0517900, ffff0000d0517ae8) [ 45.211361][ T4461] [ 45.211729][ T4461] The buggy address belongs to the physical page: [ 45.212780][ T4461] page:00000000d5b4479a refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x110516 [ 45.214455][ T4461] head:00000000d5b4479a order:1 compound_mapcount:0 compound_pincount:0 [ 45.215846][ T4461] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 45.217186][ T4461] raw: 05ffc00000010200 0000000000000000 dead000000000122 ffff0000c0870300 [ 45.218605][ T4461] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 [ 45.220038][ T4461] page dumped because: kasan: bad access detected [ 45.221168][ T4461] [ 45.221583][ T4461] Memory state around the buggy address: [ 45.222522][ T4461] ffff0000d0517900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 45.223847][ T4461] ffff0000d0517980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 45.225210][ T4461] >ffff0000d0517a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 45.226731][ T4461] ^ [ 45.227994][ T4461] ffff0000d0517a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc [ 45.229355][ T4461] ffff0000d0517b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 45.230776][ T4461] ================================================================== [ 45.232686][ T4461] Disabling lock debugging due to kernel taint [ 45.233874][ T4461] ------------[ cut here ]------------ [ 45.234828][ T4461] WARNING: CPU: 1 PID: 4461 at net/core/skbuff.c:4603 __skb_to_sgvec+0x540/0x900 [ 45.236432][ T4461] Modules linked in: [ 45.237142][ T4461] CPU: 1 PID: 4461 Comm: syz.0.17 Tainted: G B W syzkaller #0 [ 45.238747][ T4461] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 45.240440][ T4461] pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 45.241820][ T4461] pc : __skb_to_sgvec+0x540/0x900 [ 45.242695][ T4461] lr : __skb_to_sgvec+0x540/0x900 [ 45.243562][ T4461] sp : ffff800020d77120 [ 45.244249][ T4461] x29: ffff800020d77170 x28: 1fffe0001993b419 x27: ffff0000c3114d08 [ 45.245653][ T4461] x26: dfff800000000000 x25: ffff0000cc9da0d0 x24: 0000000000000000 [ 45.247066][ T4461] x23: 000000000000000d x22: ffff0000cc9da0cc x21: 0000000000000000 [ 45.248461][ T4461] x20: 00000000fffffff1 x19: 00000000ffffffe4 x18: 1fffe00033e7697e [ 45.249846][ T4461] x17: 0000000000fe010c x16: ffff800011b90080 x15: 0000000000000000 [ 45.251242][ T4461] x14: 0000000000000008 x13: 1fffe0001862299d x12: 0000000000000000 [ 45.252545][ T4461] x11: ff0080000feb61f8 x10: 0000000000000000 x9 : ffff80000feb61f8 [ 45.253831][ T4461] x8 : ffff0000c328d400 x7 : 0000000000000000 x6 : 0000000000000000 [ 45.255194][ T4461] x5 : ffff0000c3114ca0 x4 : 0000000000000000 x3 : 00000000ffffffe4 [ 45.256592][ T4461] x2 : 000000000000000d x1 : 00000000fffffff1 x0 : 0000000000000000 [ 45.258042][ T4461] Call trace: [ 45.258631][ T4461] __skb_to_sgvec+0x540/0x900 [ 45.259349][ T4461] skb_to_sgvec+0x40/0xb4 [ 45.260051][ T4461] tls_decrypt_sg+0xe6c/0x27c8 [ 45.260848][ T4461] tls_decrypt_sw+0xb8/0x9e0 [ 45.261633][ T4461] tls_rx_one_record+0x164/0xc18 [ 45.262428][ T4461] tls_sw_recvmsg+0x7e8/0x181c [ 45.263240][ T4461] inet_recvmsg+0x118/0x1c8 [ 45.264004][ T4461] ____sys_recvmsg+0x270/0x754 [ 45.264826][ T4461] __sys_recvmsg+0x250/0x33c [ 45.265621][ T4461] __arm64_sys_recvmsg+0x80/0x94 [ 45.266480][ T4461] invoke_syscall+0x98/0x290 [ 45.267273][ T4461] el0_svc_common+0x13c/0x258 [ 45.268110][ T4461] do_el0_svc+0x5c/0x134 [ 45.268855][ T4461] el0_svc+0x58/0x128 [ 45.269538][ T4461] el0t_64_sync_handler+0x84/0xf0 [ 45.270353][ T4461] el0t_64_sync+0x18c/0x190 [ 45.271092][ T4461] irq event stamp: 1317 [ 45.271811][ T4461] hardirqs last enabled at (1317): [] finish_lock_switch+0xb0/0x1c8 [ 45.273421][ T4461] hardirqs last disabled at (1316): [] __schedule+0x294/0x1a6c [ 45.274965][ T4461] softirqs last enabled at (900): [] handle_softirqs+0xb1c/0xc90 [ 45.276528][ T4461] softirqs last disabled at (853): [] __do_softirq+0x14/0x20 [ 45.278012][ T4461] ---[ end trace 0000000000000000 ]--- [ 45.279416][ T4461] ------------[ cut here ]------------ [ 45.280278][ T4461] kernel BUG at net/core/skbuff.c:4646! [ 45.281175][ T4461] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP [ 45.282462][ T4461] Modules linked in: [ 45.283123][ T4461] CPU: 1 PID: 4461 Comm: syz.0.17 Tainted: G B W syzkaller #0 [ 45.284493][ T4461] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 45.286120][ T4461] pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 45.287463][ T4461] pc : __skb_to_sgvec+0x8fc/0x900 [ 45.288300][ T4461] lr : __skb_to_sgvec+0x8fc/0x900 [ 45.289135][ T4461] sp : ffff800020d77120 [ 45.289792][ T4461] x29: ffff800020d77170 x28: 1fffe0001993b419 x27: ffff0000c3114d08 [ 45.291176][ T4461] x26: dfff800000000000 x25: 0000000000000000 x24: 0000000000000000 [ 45.292557][ T4461] x23: 000000000000000d x22: ffff0000cc9da0cc x21: 0000000000000001 [ 45.293953][ T4461] x20: ffff0000ccaa58c0 x19: 00000000ffffffe4 x18: 1fffe00033e7697e [ 45.295361][ T4461] x17: 0000000000fe010c x16: ffff800011b90080 x15: 0000000000000000 [ 45.296652][ T4461] x14: 0000000000000008 x13: 1fffe0001862299d x12: 0000000000000000 [ 45.297995][ T4461] x11: ff0080000feb65b4 x10: 0000000000000000 x9 : ffff80000feb65b4 [ 45.299372][ T4461] x8 : ffff0000c328d400 x7 : 0000000000000000 x6 : 0000000000000000 [ 45.300718][ T4461] x5 : ffff0000c3114ca0 x4 : 0000000000000000 x3 : 00000000ffffffe4 [ 45.302113][ T4461] x2 : 000000000000000d x1 : 00000000ffffffe4 x0 : 0000000000000000 [ 45.303449][ T4461] Call trace: [ 45.304014][ T4461] __skb_to_sgvec+0x8fc/0x900 [ 45.304785][ T4461] skb_to_sgvec+0x40/0xb4 [ 45.305541][ T4461] tls_decrypt_sg+0xe6c/0x27c8 [ 45.306336][ T4461] tls_decrypt_sw+0xb8/0x9e0 [ 45.307078][ T4461] tls_rx_one_record+0x164/0xc18 [ 45.307928][ T4461] tls_sw_recvmsg+0x7e8/0x181c [ 45.308719][ T4461] inet_recvmsg+0x118/0x1c8 [ 45.309483][ T4461] ____sys_recvmsg+0x270/0x754 [ 45.310303][ T4461] __sys_recvmsg+0x250/0x33c [ 45.311100][ T4461] __arm64_sys_recvmsg+0x80/0x94 [ 45.311940][ T4461] invoke_syscall+0x98/0x290 [ 45.312720][ T4461] el0_svc_common+0x13c/0x258 [ 45.313514][ T4461] do_el0_svc+0x5c/0x134 [ 45.314227][ T4461] el0_svc+0x58/0x128 [ 45.314891][ T4461] el0t_64_sync_handler+0x84/0xf0 [ 45.315718][ T4461] el0t_64_sync+0x18c/0x190 [ 45.316507][ T4461] Code: d4210000 9617f187 d4210000 9617f185 (d4210000) [ 45.317709][ T4461] ---[ end trace 0000000000000000 ]--- [ 45.512450][ T4461] Kernel panic - not syncing: Oops - BUG: Fatal exception [ 45.513668][ T4461] SMP: stopping secondary CPUs [ 45.514449][ T4461] Kernel Offset: disabled [ 45.515172][ T4461] CPU features: 0x0a0000,000f0097,a65bfea7 [ 45.516099][ T4461] Memory Limit: none [ 45.699111][ T4461] Rebooting in 86400 seconds..