Warning: Permanently added '10.128.1.138' (ED25519) to the list of known hosts. 1970/01/01 00:00:22 parsed 1 programs 1970/01/01 00:00:22 serving rpc on tcp://46027 [ 23.308302][ T4755] cgroup: Unknown subsys name 'net' [ 23.458483][ T4755] cgroup: Unknown subsys name 'cpuset' [ 23.459874][ T4755] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 23.633028][ T4755] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 25.849724][ T4761] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 26.033681][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 26.033694][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 26.060249][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 26.060264][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 26.617297][ T4793] rxe_eth0 speed is unknown, defaulting to 1000 [ 26.617669][ T4793] rxe_eth0 speed is unknown, defaulting to 1000 [ 26.618043][ T4793] rxe_eth0 speed is unknown, defaulting to 1000 [ 26.653505][ T4793] infiniband rxe0: set active [ 26.653752][ T900] rxe_eth0 speed is unknown, defaulting to 1000 [ 26.653793][ T4793] infiniband rxe0: added rxe_eth0 [ 26.674379][ T4793] RDS/IB: rxe0: added [ 26.674458][ T4793] smc: adding ib device rxe0 with port count 1 [ 26.674481][ T4793] smc: ib device rxe0 port 1 has no pnetid [ 26.674780][ T1104] rxe_eth0 speed is unknown, defaulting to 1000 [ 26.679606][ T4793] rxe_eth0 speed is unknown, defaulting to 1000 [ 26.771624][ T4793] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.771893][ T4793] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.771956][ T4793] bridge_slave_0: entered allmulticast mode [ 26.772424][ T4793] bridge_slave_0: entered promiscuous mode [ 26.773578][ T4793] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.773624][ T4793] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.773668][ T4793] bridge_slave_1: entered allmulticast mode [ 26.774076][ T4793] bridge_slave_1: entered promiscuous mode [ 26.781024][ T4793] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 26.782226][ T4793] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 26.788184][ T4793] team0: Port device team_slave_0 added [ 26.788912][ T4793] team0: Port device team_slave_1 added [ 26.794631][ T4793] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 26.794640][ T4793] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.794652][ T4793] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 26.795377][ T4793] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 26.795384][ T4793] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.795397][ T4793] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 26.806479][ T4793] hsr_slave_0: entered promiscuous mode [ 26.806863][ T4793] hsr_slave_1: entered promiscuous mode [ 26.848816][ T4793] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 26.850708][ T4793] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 26.851102][ T4793] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 26.852151][ T4793] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 26.852551][ T4793] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 26.853414][ T4793] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 26.853742][ T4793] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 26.854506][ T4793] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 26.863625][ T4793] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.863657][ T4793] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.863792][ T4793] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.863826][ T4793] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.879608][ T4793] 8021q: adding VLAN 0 to HW filter on device bond0 [ 26.883119][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.883541][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.886663][ T4793] 8021q: adding VLAN 0 to HW filter on device team0 [ 26.892347][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.892380][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.899445][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.899467][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.989188][ T4793] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 27.002374][ T4793] veth0_vlan: entered promiscuous mode [ 27.004333][ T4793] veth1_vlan: entered promiscuous mode [ 27.013673][ T4793] veth0_macvtap: entered promiscuous mode [ 27.015276][ T4793] veth1_macvtap: entered promiscuous mode [ 27.019616][ T4793] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 27.020623][ T4793] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 27.038056][ T49] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.038087][ T49] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.038106][ T49] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.038121][ T49] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.105730][ T4832] rxe_eth0 speed is unknown, defaulting to 1000 [ 27.112641][ T3731] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 27.174003][ T3731] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 27.213518][ T4836] rxe_eth0 speed is unknown, defaulting to 1000 [ 27.230995][ T3731] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 27.313821][ T4840] rxe_eth0 speed is unknown, defaulting to 1000 [ 27.321970][ T3731] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 27.411139][ T4845] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 27.411436][ T4845] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 27.411610][ T4845] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 27.411952][ T4845] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 27.412172][ T4845] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 27.421796][ T4844] rxe_eth0 speed is unknown, defaulting to 1000 [ 27.539983][ T4850] rxe_eth0 speed is unknown, defaulting to 1000 [ 27.689690][ T4855] rxe_eth0 speed is unknown, defaulting to 1000 [ 27.825891][ T4859] rxe_eth0 speed is unknown, defaulting to 1000 1970/01/01 00:00:27 executed programs: 0 [ 28.013908][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 28.014445][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 28.014801][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 28.015277][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 28.015527][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 28.090067][ T4862] rxe_eth0 speed is unknown, defaulting to 1000 [ 28.186675][ T4862] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.187700][ T4862] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.187765][ T4862] bridge_slave_0: entered allmulticast mode [ 28.188188][ T4862] bridge_slave_0: entered promiscuous mode [ 28.189001][ T4862] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.189045][ T4862] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.189094][ T4862] bridge_slave_1: entered allmulticast mode [ 28.189507][ T4862] bridge_slave_1: entered promiscuous mode [ 28.196234][ T4862] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 28.197457][ T4862] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 28.203629][ T4862] team0: Port device team_slave_0 added [ 28.204475][ T4862] team0: Port device team_slave_1 added [ 28.211527][ T4862] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 28.211535][ T4862] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 28.211547][ T4862] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 28.212478][ T4862] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 28.212485][ T4862] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 28.212502][ T4862] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 28.234088][ T4862] hsr_slave_0: entered promiscuous mode [ 28.234470][ T4862] hsr_slave_1: entered promiscuous mode [ 28.234689][ T4862] debugfs: 'hsr0' already exists in 'hsr' [ 28.234728][ T4862] Cannot create hsr debugfs directory [ 30.097002][ T51] Bluetooth: hci0: command tx timeout [ 30.297636][ T3731] bridge_slave_1: left allmulticast mode [ 30.297661][ T3731] bridge_slave_1: left promiscuous mode [ 30.297911][ T3731] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.301375][ T3731] bridge_slave_0: left allmulticast mode [ 30.301391][ T3731] bridge_slave_0: left promiscuous mode [ 30.301473][ T3731] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.356055][ T3731] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 30.360195][ T3731] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 30.361461][ T3731] bond0 (unregistering): Released all slaves [ 30.435457][ T3731] hsr_slave_0: left promiscuous mode [ 30.435750][ T3731] hsr_slave_1: left promiscuous mode [ 30.436032][ T3731] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 30.436047][ T3731] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 30.436413][ T3731] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 30.436423][ T3731] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 30.457533][ T3731] veth1_macvtap: left promiscuous mode [ 30.457570][ T3731] veth0_macvtap: left promiscuous mode [ 30.457620][ T3731] veth1_vlan: left promiscuous mode [ 30.457660][ T3731] veth0_vlan: left promiscuous mode [ 30.552977][ T3731] team0 (unregistering): Port device team_slave_1 removed [ 30.556655][ T3731] team0 (unregistering): Port device team_slave_0 removed [ 30.612059][ T4434] 8021q: adding VLAN 0 to HW filter on device eth0 [ 30.963521][ T4862] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 30.964934][ T4862] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.965317][ T4862] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 30.966391][ T4862] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.975544][ T4862] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 30.990917][ T4862] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.991484][ T4862] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 30.992915][ T4862] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.014486][ T4862] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.019086][ T4862] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.023428][ T3618] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.023457][ T3618] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.040288][ T3618] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.040329][ T3618] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.162227][ T4862] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.186017][ T4862] veth0_vlan: entered promiscuous mode [ 31.194656][ T4862] veth1_vlan: entered promiscuous mode [ 31.203389][ T4862] veth0_macvtap: entered promiscuous mode [ 31.204457][ T4862] veth1_macvtap: entered promiscuous mode [ 31.209431][ T4862] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.212386][ T4862] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.248033][ T3618] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.248178][ T3618] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.248242][ T3618] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.253262][ T3753] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.253275][ T3753] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.275941][ T3618] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.275956][ T3618] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.276945][ T3753] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.316602][ T4949] FAULT_INJECTION: forcing a failure. [ 31.316602][ T4949] name failslab, interval 1, probability 0, space 0, times 1 [ 31.316624][ T4949] CPU: 1 UID: 0 PID: 4949 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT [ 31.316638][ T4949] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 31.316643][ T4949] Call trace: [ 31.316646][ T4949] show_stack+0x2c/0x3c (C) [ 31.316661][ T4949] __dump_stack+0x30/0x40 [ 31.316669][ T4949] dump_stack_lvl+0xd8/0x12c [ 31.316677][ T4949] dump_stack+0x1c/0x28 [ 31.316683][ T4949] should_fail_ex+0x418/0x58c [ 31.316694][ T4949] should_failslab+0xc4/0x120 [ 31.316704][ T4949] kmem_cache_alloc_lru_noprof+0x98/0x5d8 [ 31.316714][ T4949] __d_alloc+0x50/0x600 [ 31.316727][ T4949] d_alloc+0x54/0x17c [ 31.316736][ T4949] lookup_one_qstr_excl+0x9c/0x200 [ 31.316743][ T4949] __start_dirop+0xb8/0xf4 [ 31.316753][ T4949] start_dirop+0x38/0x4c [ 31.316761][ T4949] simple_start_creating+0xcc/0x114 [ 31.316770][ T4949] gadgetfs_create_file+0x7c/0xd8 [ 31.316782][ T4949] gadgetfs_bind+0x3f8/0x75c [ 31.316792][ T4949] gadget_bind_driver+0x274/0x834 [ 31.316803][ T4949] really_probe+0x29c/0x800 [ 31.316814][ T4949] __driver_probe_device+0x1e0/0x350 [ 31.316824][ T4949] driver_probe_device+0x6c/0x19c [ 31.316834][ T4949] __driver_attach+0x168/0x384 [ 31.316843][ T4949] bus_for_each_dev+0x128/0x1b4 [ 31.316852][ T4949] driver_attach+0x50/0x60 [ 31.316862][ T4949] bus_add_driver+0x208/0x500 [ 31.316871][ T4949] driver_register+0x220/0x310 [ 31.316877][ T4949] usb_gadget_register_driver_owner+0xf0/0x25c [ 31.316887][ T4949] dev_config+0x91c/0xcc0 [ 31.316897][ T4949] vfs_write+0x2a4/0xa0c [ 31.316905][ T4949] ksys_write+0x12c/0x228 [ 31.316912][ T4949] __arm64_sys_write+0x84/0x98 [ 31.316920][ T4949] invoke_syscall+0x98/0x244 [ 31.316928][ T4949] el0_svc_common+0xec/0x23c [ 31.316935][ T4949] do_el0_svc+0x4c/0x5c [ 31.316942][ T4949] el0_svc+0x60/0x1d8 [ 31.316950][ T4949] el0t_64_sync_handler+0x44/0x104 [ 31.316957][ T4949] el0t_64_sync+0x198/0x19c [ 31.354147][ T4949] udc dummy_udc.0: failed to start USB Gadget filesystem: -12 [ 31.354165][ T4949] gadgetfs gadget.0: probe with driver gadgetfs failed with error -12 [ 31.354412][ T4949] gadgetfs expected dummy_udc controller not usbip-vudc [ 31.354421][ T4949] udc usbip-vudc.0: failed to start USB Gadget filesystem: -19 [ 31.359890][ T4949] UDC core: USB Gadget filesystem: couldn't find an available UDC [ 31.399882][ T4950] ================================================================== [ 31.399894][ T4950] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irq+0x58/0x70 [ 31.399908][ T4950] Read of size 1 at addr ffff0000d3945018 by task syz.0.18/4950 [ 31.399915][ T4950] [ 31.399919][ T4950] CPU: 1 UID: 0 PID: 4950 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT [ 31.399928][ T4950] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 31.399932][ T4950] Call trace: [ 31.399935][ T4950] show_stack+0x2c/0x3c (C) [ 31.399945][ T4950] __dump_stack+0x30/0x40 [ 31.399953][ T4950] dump_stack_lvl+0xd8/0x12c [ 31.399960][ T4950] print_address_description+0xb0/0x238 [ 31.399969][ T4950] print_report+0x68/0x84 [ 31.399976][ T4950] kasan_report+0x8c/0xc4 [ 31.399987][ T4950] __kasan_check_byte+0x3c/0x54 [ 31.399996][ T4950] lock_acquire+0xa4/0x320 [ 31.400005][ T4950] _raw_spin_lock_irq+0x58/0x70 [ 31.400012][ T4950] gadget_dev_open+0x50/0x1c4 [ 31.400023][ T4950] do_dentry_open+0x5c4/0xfbc [ 31.400030][ T4950] vfs_open+0x44/0x2dc [ 31.400037][ T4950] path_openat+0x1084/0x18f0 [ 31.400047][ T4950] do_file_open+0x1c8/0x2e8 [ 31.400056][ T4950] do_sys_openat2+0x114/0x1e8 [ 31.400064][ T4950] do_sys_open+0xb0/0xe0 [ 31.400070][ T4950] __arm64_sys_openat+0xa8/0xc4 [ 31.400078][ T4950] invoke_syscall+0x98/0x244 [ 31.400086][ T4950] el0_svc_common+0xec/0x23c [ 31.400093][ T4950] do_el0_svc+0x4c/0x5c [ 31.400099][ T4950] el0_svc+0x60/0x1d8 [ 31.400106][ T4950] el0t_64_sync_handler+0x44/0x104 [ 31.400113][ T4950] el0t_64_sync+0x198/0x19c [ 31.400121][ T4950] [ 31.400123][ T4950] Allocated by task 4862: [ 31.400126][ T4950] kasan_save_track+0x40/0x78 [ 31.400134][ T4950] kasan_save_alloc_info+0x40/0x50 [ 31.400143][ T4950] __kasan_kmalloc+0x9c/0xb4 [ 31.400150][ T4950] __kmalloc_cache_noprof+0x2f4/0x5fc [ 31.400158][ T4950] gadgetfs_fill_super+0x19c/0x370 [ 31.400166][ T4950] vfs_get_super+0xb8/0x148 [ 31.400174][ T4950] get_tree_single+0x30/0x40 [ 31.400182][ T4950] gadgetfs_get_tree+0x28/0x38 [ 31.400190][ T4950] vfs_get_tree+0x90/0x28c [ 31.400197][ T4950] fc_mount+0x24/0xac [ 31.400205][ T4950] do_new_mount+0x2a4/0x538 [ 31.400210][ T4950] path_mount+0x5f0/0xa88 [ 31.400215][ T4950] do_mount+0xe8/0x148 [ 31.400220][ T4950] __arm64_sys_mount+0x33c/0x388 [ 31.400225][ T4950] invoke_syscall+0x98/0x244 [ 31.400231][ T4950] el0_svc_common+0xec/0x23c [ 31.400237][ T4950] do_el0_svc+0x4c/0x5c [ 31.400242][ T4950] el0_svc+0x60/0x1d8 [ 31.400247][ T4950] el0t_64_sync_handler+0x44/0x104 [ 31.400252][ T4950] el0t_64_sync+0x198/0x19c [ 31.400258][ T4950] [ 31.400259][ T4950] Freed by task 4949: [ 31.400262][ T4950] kasan_save_track+0x40/0x78 [ 31.400269][ T4950] kasan_save_free_info+0x54/0x6c [ 31.400278][ T4950] __kasan_slab_free+0x74/0xa4 [ 31.400285][ T4950] kfree+0x188/0x658 [ 31.400291][ T4950] put_dev+0x8c/0xf8 [ 31.400299][ T4950] dev_release+0x100/0x15c [ 31.400307][ T4950] __fput+0x338/0x74c [ 31.400313][ T4950] ____fput+0x20/0x30 [ 31.400325][ T4950] task_work_run+0x1cc/0x25c [ 31.400332][ T4950] exit_to_user_mode_loop+0x10c/0x17c [ 31.400341][ T4950] el0_svc+0x12c/0x1d8 [ 31.400347][ T4950] el0t_64_sync_handler+0x44/0x104 [ 31.400352][ T4950] el0t_64_sync+0x198/0x19c [ 31.400358][ T4950] [ 31.400360][ T4950] The buggy address belongs to the object at ffff0000d3945000 [ 31.400360][ T4950] which belongs to the cache kmalloc-1k of size 1024 [ 31.400366][ T4950] The buggy address is located 24 bytes inside of [ 31.400366][ T4950] freed 1024-byte region [ffff0000d3945000, ffff0000d3945400) [ 31.400373][ T4950] [ 31.400375][ T4950] The buggy address belongs to the physical page: [ 31.400379][ T4950] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113940 [ 31.400386][ T4950] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 31.400392][ T4950] flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 31.400400][ T4950] page_type: f5(slab) [ 31.400406][ T4950] raw: 05ffc00000000040 ffff0000c0001dc0 dead000000000100 dead000000000122 [ 31.400412][ T4950] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 31.400418][ T4950] head: 05ffc00000000040 ffff0000c0001dc0 dead000000000100 dead000000000122 [ 31.400423][ T4950] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 31.400429][ T4950] head: 05ffc00000000003 fffffdffc34e5001 00000000ffffffff 00000000ffffffff [ 31.400434][ T4950] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 31.400438][ T4950] page dumped because: kasan: bad access detected [ 31.400440][ T4950] [ 31.400442][ T4950] Memory state around the buggy address: [ 31.400446][ T4950] ffff0000d3944f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.400450][ T4950] ffff0000d3944f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.400454][ T4950] >ffff0000d3945000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.400458][ T4950] ^ [ 31.400461][ T4950] ffff0000d3945080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.400465][ T4950] ffff0000d3945100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.400468][ T4950] ================================================================== [ 31.400471][ T4950] Disabling lock debugging due to kernel taint [ 31.400475][ T4950] ------------[ cut here ]------------ [ 31.400477][ T4950] UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.h:68:9 [ 31.400483][ T4950] index 13027 is out of range for type 'unsigned long[8]' [ 31.400489][ T4950] CPU: 1 UID: 0 PID: 4950 Comm: syz.0.18 Tainted: G B syzkaller #0 PREEMPT [ 31.400498][ T4950] Tainted: [B]=BAD_PAGE [ 31.400500][ T4950] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 31.400504][ T4950] Call trace: [ 31.400506][ T4950] show_stack+0x2c/0x3c (C) [ 31.400513][ T4950] __dump_stack+0x30/0x40 [ 31.400520][ T4950] dump_stack_lvl+0xd8/0x12c [ 31.400527][ T4950] dump_stack+0x1c/0x28 [ 31.400534][ T4950] ubsan_epilogue+0x14/0x48 [ 31.400543][ T4950] __ubsan_handle_out_of_bounds+0xd0/0xf8 [ 31.400552][ T4950] queued_spin_lock_slowpath+0x834/0xb5c [ 31.400560][ T4950] do_raw_spin_lock+0x21c/0x2d0 [ 31.400570][ T4950] _raw_spin_lock_irq+0x60/0x70 [ 31.400576][ T4950] gadget_dev_open+0x50/0x1c4 [ 31.400586][ T4950] do_dentry_open+0x5c4/0xfbc [ 31.400593][ T4950] vfs_open+0x44/0x2dc [ 31.400599][ T4950] path_openat+0x1084/0x18f0 [ 31.400608][ T4950] do_file_open+0x1c8/0x2e8 [ 31.400618][ T4950] do_sys_openat2+0x114/0x1e8 [ 31.400625][ T4950] do_sys_open+0xb0/0xe0 [ 31.400631][ T4950] __arm64_sys_openat+0xa8/0xc4 [ 31.400638][ T4950] invoke_syscall+0x98/0x244 [ 31.400645][ T4950] el0_svc_common+0xec/0x23c [ 31.400652][ T4950] do_el0_svc+0x4c/0x5c [ 31.400659][ T4950] el0_svc+0x60/0x1d8 [ 31.400665][ T4950] el0t_64_sync_handler+0x44/0x104 [ 31.400672][ T4950] el0t_64_sync+0x198/0x19c [ 31.400679][ T4950] ---[ end trace ]--- [ 31.400689][ T4950] Unable to handle kernel paging request at virtual address ffff8000897ba150 [ 31.400693][ T4950] KASAN: probably user-memory-access in range [0x000000044bdd0a80-0x000000044bdd0a87] [ 31.400698][ T4950] Mem abort info: [ 31.400700][ T4950] ESR = 0x0000000096000047 [ 31.400703][ T4950] EC = 0x25: DABT (current EL), IL = 32 bits [ 31.400707][ T4950] SET = 0, FnV = 0 [ 31.400710][ T4950] EA = 0, S1PTW = 0 [ 31.400713][ T4950] FSC = 0x07: level 3 translation fault [ 31.400716][ T4950] Data abort info: [ 31.400718][ T4950] ISV = 0, ISS = 0x00000047, ISS2 = 0x00000000 [ 31.400722][ T4950] CM = 0, WnR = 1, TnD = 0, TagAccess = 0 [ 31.400726][ T4950] GCS = 0, Overlay = 0, DirtyBit = 0 [ 31.400730][ T4950] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000219508000 [ 31.400735][ T4950] [ffff8000897ba150] pgd=0000000000000000, p4d=100000021f82f003, pud=100000021f830003, pmd=100000021f834003, pte=0000000000000000 [ 31.400753][ T4950] Internal error: Oops: 0000000096000047 [#1] SMP [ 31.532113][ T4950] Modules linked in: [ 31.532779][ T4950] CPU: 1 UID: 0 PID: 4950 Comm: syz.0.18 Tainted: G B syzkaller #0 PREEMPT [ 31.534546][ T4950] Tainted: [B]=BAD_PAGE [ 31.535266][ T4950] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 31.537019][ T4950] pstate: 834000c5 (Nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 31.538363][ T4950] pc : queued_spin_lock_slowpath+0x544/0xb5c [ 31.539408][ T4950] lr : queued_spin_lock_slowpath+0x834/0xb5c [ 31.540468][ T4950] sp : ffff80009d6f7620 [ 31.541204][ T4950] x29: ffff80009d6f76c0 x28: 1fffe000359f1c28 x27: 1fffe000198fa002 [ 31.542640][ T4950] x26: ffff0001acf8e148 x25: ffff8000897ba150 x24: dfff800000000000 [ 31.544088][ T4950] x23: ffff700013adeec8 x22: 1fffe0001a728a00 x21: ffff0001acf8e140 [ 31.545499][ T4950] x20: ffff0000cc7d0010 x19: ffff0000d3945000 x18: 0000000000000000 [ 31.546862][ T4950] x17: 363a682e6b636f6c x16: 0000000000000001 x15: 0000000000000000 [ 31.548302][ T4950] x14: 000000000000076e x13: 0000000000000001 x12: 0000000000000004 [ 31.549686][ T4950] x11: ffff700011604e68 x10: ffff8000897ba140 x9 : ffff8000897ba150 [ 31.551078][ T4950] x8 : 0000000000000000 x7 : 0000000000000001 x6 : ffff800080484084 [ 31.552518][ T4950] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f41d4 [ 31.553958][ T4950] x2 : 0000000000000002 x1 : 0000000000000004 x0 : ffff0001acf8e148 [ 31.555327][ T4950] Call trace: [ 31.555898][ T4950] queued_spin_lock_slowpath+0x544/0xb5c (P) [ 31.556968][ T4950] do_raw_spin_lock+0x21c/0x2d0 [ 31.557825][ T4950] _raw_spin_lock_irq+0x60/0x70 [ 31.558687][ T4950] gadget_dev_open+0x50/0x1c4 [ 31.559535][ T4950] do_dentry_open+0x5c4/0xfbc [ 31.560386][ T4950] vfs_open+0x44/0x2dc [ 31.561114][ T4950] path_openat+0x1084/0x18f0 [ 31.561932][ T4950] do_file_open+0x1c8/0x2e8 [ 31.562739][ T4950] do_sys_openat2+0x114/0x1e8 [ 31.563581][ T4950] do_sys_open+0xb0/0xe0 [ 31.564340][ T4950] __arm64_sys_openat+0xa8/0xc4 [ 31.565207][ T4950] invoke_syscall+0x98/0x244 [ 31.565995][ T4950] el0_svc_common+0xec/0x23c [ 31.566787][ T4950] do_el0_svc+0x4c/0x5c [ 31.567500][ T4950] el0_svc+0x60/0x1d8 [ 31.568174][ T4950] el0t_64_sync_handler+0x44/0x104 [ 31.569035][ T4950] el0t_64_sync+0x198/0x19c [ 31.569822][ T4950] Code: aa1903e0 968adf85 910022a0 52800081 (f9000335) [ 31.571013][ T4950] ---[ end trace 0000000000000000 ]--- [ 31.843515][ T4950] Kernel panic - not syncing: Oops: Fatal exception [ 31.844603][ T4950] SMP: stopping secondary CPUs [ 31.845384][ T4950] Kernel Offset: disabled [ 31.846242][ T4950] CPU features: 0x0,a0000000,00f00020,9c080a02,a84ff6a7 [ 31.847572][ T4950] Memory Limit: none [ 32.062504][ T4950] Rebooting in 86400 seconds..