Warning: Permanently added '10.128.1.76' (ED25519) to the list of known hosts. 2025/11/13 07:25:00 parsed 1 programs [ 65.624555][ T4188] cgroup: Unknown subsys name 'net' [ 65.754628][ T4188] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 67.276993][ T4188] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 70.325752][ T1281] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.345787][ T1281] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.367298][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 70.385134][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.394836][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.404908][ T1281] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 70.813332][ T4245] chnl_net:caif_netlink_parms(): no params data found [ 70.903913][ T4245] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.911647][ T4245] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.920463][ T4245] device bridge_slave_0 entered promiscuous mode [ 70.930741][ T4245] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.937988][ T4245] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.945897][ T4245] device bridge_slave_1 entered promiscuous mode [ 70.968070][ T4245] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.979616][ T4245] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 71.003642][ T4245] team0: Port device team_slave_0 added [ 71.011284][ T4245] team0: Port device team_slave_1 added [ 71.031257][ T4245] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.038388][ T4245] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 71.064407][ T4245] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.079174][ T4245] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.086285][ T4245] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 71.112729][ T4245] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.145093][ T4245] device hsr_slave_0 entered promiscuous mode [ 71.152248][ T4245] device hsr_slave_1 entered promiscuous mode [ 71.270197][ T4245] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 71.281260][ T4245] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 71.293632][ T4245] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 71.303300][ T4245] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 71.342433][ T1423] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.349274][ T1423] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.410471][ T4245] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.426020][ T1281] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 71.435785][ T1281] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 71.448822][ T4245] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.481395][ T1281] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 71.490236][ T1281] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 71.499621][ T1281] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.506838][ T1281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.515528][ T1281] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 71.551103][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 71.560644][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 71.570259][ T154] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.577316][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.585165][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 71.595843][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 71.626656][ T1281] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 71.638268][ T1281] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 71.646819][ T1281] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 71.658834][ T1281] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 71.667481][ T1281] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 71.681325][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 71.712778][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 71.724049][ T4245] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 71.839802][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 71.847341][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 71.862180][ T4245] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.897603][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 71.920302][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 71.929850][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 71.937604][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 71.947672][ T4245] device veth0_vlan entered promiscuous mode [ 71.971239][ T4245] device veth1_vlan entered promiscuous mode [ 71.998646][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 72.006910][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 72.016236][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 72.031690][ T4245] device veth0_macvtap entered promiscuous mode [ 72.064419][ T4245] device veth1_macvtap entered promiscuous mode [ 72.079550][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 72.091816][ T4245] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.101256][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 72.110758][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 72.126859][ T4245] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.139122][ T4245] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.150307][ T4245] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.159942][ T4245] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.169217][ T4245] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.182231][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 72.192402][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 72.342931][ T4245] syz-executor (4245) used greatest stack depth: 20160 bytes left 2025/11/13 07:25:10 executed programs: 0 [ 73.583432][ T4296] chnl_net:caif_netlink_parms(): no params data found [ 73.634809][ T4296] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.642432][ T4296] bridge0: port 1(bridge_slave_0) entered disabled state [ 73.650955][ T4296] device bridge_slave_0 entered promiscuous mode [ 73.659859][ T4296] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.667018][ T4296] bridge0: port 2(bridge_slave_1) entered disabled state [ 73.675713][ T4296] device bridge_slave_1 entered promiscuous mode [ 73.705616][ T4296] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 73.717524][ T4296] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 73.745773][ T4296] team0: Port device team_slave_0 added [ 73.753736][ T4296] team0: Port device team_slave_1 added [ 73.775555][ T4296] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 73.783856][ T4296] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.810508][ T4296] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 73.823101][ T4296] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 73.830652][ T4296] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.856764][ T4296] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 73.896799][ T4296] device hsr_slave_0 entered promiscuous mode [ 73.903776][ T4296] device hsr_slave_1 entered promiscuous mode [ 73.911118][ T4296] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 73.920723][ T4296] Cannot create hsr debugfs directory [ 73.934550][ T156] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 75.498716][ T4190] Bluetooth: hci0: command 0x0409 tx timeout [ 77.185555][ T156] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 77.353633][ T156] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 77.406480][ T156] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 77.578273][ T4190] Bluetooth: hci0: command 0x041b tx timeout [ 78.212890][ T4296] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 78.222364][ T4296] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 78.231402][ T4296] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 78.243565][ T4296] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 78.313221][ T4296] 8021q: adding VLAN 0 to HW filter on device bond0 [ 78.325860][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 78.333828][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 78.345139][ T4296] 8021q: adding VLAN 0 to HW filter on device team0 [ 78.354956][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 78.364883][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 78.374110][ T1244] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.381222][ T1244] bridge0: port 1(bridge_slave_0) entered forwarding state [ 78.390566][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 78.415546][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 78.424325][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 78.433188][ T1244] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.440290][ T1244] bridge0: port 2(bridge_slave_1) entered forwarding state [ 78.460626][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 78.469975][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 78.479062][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 78.489179][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 78.498352][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 78.506880][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 78.516155][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 78.525903][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 78.534721][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 78.559431][ T1281] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 78.568164][ T1281] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 78.579862][ T4296] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 78.680896][ T1281] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 78.688534][ T1281] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 78.704399][ T156] device hsr_slave_0 left promiscuous mode [ 78.711226][ T156] device hsr_slave_1 left promiscuous mode [ 78.718681][ T156] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 78.726146][ T156] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 78.735101][ T156] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 78.742616][ T156] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 78.750405][ T156] device bridge_slave_1 left promiscuous mode [ 78.757211][ T156] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.771629][ T156] device bridge_slave_0 left promiscuous mode [ 78.778008][ T156] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.794826][ T156] device veth1_macvtap left promiscuous mode [ 78.801779][ T156] device veth0_macvtap left promiscuous mode [ 78.808072][ T156] device veth1_vlan left promiscuous mode [ 78.814116][ T156] device veth0_vlan left promiscuous mode [ 78.977539][ T156] team0 (unregistering): Port device team_slave_1 removed [ 78.994143][ T156] team0 (unregistering): Port device team_slave_0 removed [ 79.007457][ T156] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 79.023286][ T156] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 79.083247][ T156] bond0 (unregistering): Released all slaves [ 79.154739][ T4296] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 79.177450][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 79.186690][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 79.210376][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 79.219679][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 79.228859][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 79.236802][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 79.253337][ T4296] device veth0_vlan entered promiscuous mode [ 79.266789][ T4296] device veth1_vlan entered promiscuous mode [ 79.285062][ T1281] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 79.293462][ T1281] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 79.303279][ T1281] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 79.311909][ T1281] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 79.322548][ T4296] device veth0_macvtap entered promiscuous mode [ 79.337114][ T4296] device veth1_macvtap entered promiscuous mode [ 79.345091][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 79.358888][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 79.375308][ T4296] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 79.385252][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 79.394170][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 79.409416][ T4296] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 79.418051][ T1281] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 79.428333][ T1281] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 79.438669][ T4296] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.448714][ T4296] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.457442][ T4296] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.466637][ T4296] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.525129][ T1244] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.543976][ T1244] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.551469][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.564458][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.572693][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 79.580792][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 79.659172][ T4324] Bluetooth: hci0: command 0x040f tx timeout [ 79.907785][ T4323] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 80.277991][ T4323] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 80.291163][ T4323] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 80.301744][ T4323] usb 1-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 80.312586][ T4323] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 80.334404][ T4323] usb 1-1: config 0 descriptor?? [ 80.821591][ T4323] cp2112 0003:10C4:EA90.0001: unknown main item tag 0x0 [ 80.832463][ T4323] cp2112 0003:10C4:EA90.0001: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.0-1/input0 [ 81.038343][ T4323] cp2112 0003:10C4:EA90.0001: Part Number: 0x82 Device Version: 0xFE [ 81.669320][ T4356] ================================================================== [ 81.677643][ T4356] BUG: KASAN: stack-out-of-bounds in cp2112_xfer+0x87c/0xe00 [ 81.685058][ T4356] Read of size 42 at addr ffffc9000342fd41 by task syz.0.17/4356 [ 81.692794][ T4356] [ 81.695134][ T4356] CPU: 1 PID: 4356 Comm: syz.0.17 Not tainted syzkaller #0 [ 81.702345][ T4356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 81.712429][ T4356] Call Trace: [ 81.715724][ T4356] [ 81.718676][ T4356] dump_stack_lvl+0x168/0x230 [ 81.723428][ T4356] ? show_regs_print_info+0x20/0x20 [ 81.728645][ T4356] ? _printk+0xcc/0x110 [ 81.732838][ T4356] ? load_image+0x3b0/0x3b0 [ 81.737365][ T4356] ? _raw_spin_lock_irqsave+0xb0/0xf0 [ 81.742772][ T4356] print_address_description+0x60/0x2d0 [ 81.748337][ T4356] ? cp2112_xfer+0x87c/0xe00 [ 81.752946][ T4356] kasan_report+0xdf/0x130 [ 81.757378][ T4356] ? cp2112_xfer+0x87c/0xe00 [ 81.762074][ T4356] ? cp2112_xfer+0x87c/0xe00 [ 81.766689][ T4356] kasan_check_range+0x27b/0x290 [ 81.771650][ T4356] memcpy+0x25/0x60 [ 81.775480][ T4356] cp2112_xfer+0x87c/0xe00 [ 81.779928][ T4356] ? cp2112_i2c_xfer+0xf20/0xf20 [ 81.784899][ T4356] ? lock_chain_count+0x20/0x20 [ 81.789783][ T4356] __i2c_smbus_xfer+0x733/0x1d50 [ 81.794750][ T4356] ? cp2112_i2c_xfer+0xf20/0xf20 [ 81.799722][ T4356] ? i2c_smbus_write_i2c_block_data+0x1a0/0x1a0 [ 81.805994][ T4356] ? rt_mutex_lock_nested+0x15a/0x1c0 [ 81.811651][ T4356] ? i2c_smbus_xfer+0x11d/0x3a0 [ 81.816517][ T4356] ? rwsem_down_read_slowpath+0x990/0x990 [ 81.822268][ T4356] ? __might_fault+0xb7/0x110 [ 81.826968][ T4356] i2c_smbus_xfer+0x263/0x3a0 [ 81.831670][ T4356] ? i2c_smbus_read_byte+0x1b0/0x1b0 [ 81.836974][ T4356] ? __might_fault+0xb3/0x110 [ 81.841675][ T4356] i2cdev_ioctl_smbus+0x3e3/0x650 [ 81.846727][ T4356] ? i2cdev_ioctl_rdwr+0x6c0/0x6c0 [ 81.851869][ T4356] ? __might_fault+0xb3/0x110 [ 81.856563][ T4356] ? _copy_from_user+0x111/0x170 [ 81.861522][ T4356] i2cdev_ioctl+0x545/0x750 [ 81.866045][ T4356] ? i2cdev_write+0x120/0x120 [ 81.870741][ T4356] ? lockdep_hardirqs_on_prepare+0x3fc/0x760 [ 81.876759][ T4356] ? lock_chain_count+0x20/0x20 [ 81.881633][ T4356] ? bpf_lsm_file_ioctl+0x5/0x10 [ 81.886585][ T4356] ? security_file_ioctl+0x7c/0xa0 [ 81.891718][ T4356] ? i2cdev_write+0x120/0x120 [ 81.896434][ T4356] __se_sys_ioctl+0xfa/0x170 [ 81.901049][ T4356] do_syscall_64+0x4c/0xa0 [ 81.905480][ T4356] ? clear_bhb_loop+0x30/0x80 [ 81.910174][ T4356] ? clear_bhb_loop+0x30/0x80 [ 81.914872][ T4356] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 81.920795][ T4356] RIP: 0033:0x7fd0e87006c9 [ 81.925230][ T4356] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 81.944855][ T4356] RSP: 002b:00007ffdf9d99f18 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 81.953286][ T4356] RAX: ffffffffffffffda RBX: 00007fd0e8956fa0 RCX: 00007fd0e87006c9 [ 81.961357][ T4356] RDX: 0000200000000200 RSI: 0000000000000720 RDI: 0000000000000004 [ 81.969341][ T4356] RBP: 00007fd0e8782f91 R08: 0000000000000000 R09: 0000000000000000 [ 81.977322][ T4356] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 81.985308][ T4356] R13: 00007fd0e8956fa0 R14: 00007fd0e8956fa0 R15: 0000000000000003 [ 81.993317][ T4356] [ 81.996357][ T4356] [ 81.998689][ T4356] [ 82.001022][ T4356] addr ffffc9000342fd41 is located in stack of task syz.0.17/4356 at offset 33 in frame: [ 82.010863][ T4356] i2cdev_ioctl_smbus+0x0/0x650 [ 82.015743][ T4356] [ 82.018072][ T4356] this frame has 1 object: [ 82.022490][ T4356] [32, 66) 'temp' [ 82.022504][ T4356] [ 82.028544][ T4356] Memory state around the buggy address: [ 82.034188][ T4356] ffffc9000342fc00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f3 f3 f3 [ 82.042262][ T4356] ffffc9000342fc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 82.050333][ T4356] >ffffc9000342fd00: 00 00 00 00 f1 f1 f1 f1 00 00 00 00 02 f3 f3 f3 [ 82.058405][ T4356] ^ [ 82.065610][ T4356] ffffc9000342fd80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 [ 82.073693][ T4356] ffffc9000342fe00: f1 f1 f1 f1 04 f2 00 00 f2 f2 00 00 f3 f3 f3 f3 [ 82.081776][ T4356] ================================================================== [ 82.090027][ T4356] Disabling lock debugging due to kernel taint [ 82.096913][ T4356] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 82.098370][ T4324] Bluetooth: hci0: command 0x0419 tx timeout [ 82.104140][ T4356] CPU: 0 PID: 4356 Comm: syz.0.17 Tainted: G B syzkaller #0 [ 82.118703][ T4356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 82.128756][ T4356] Call Trace: [ 82.132054][ T4356] [ 82.134982][ T4356] dump_stack_lvl+0x168/0x230 [ 82.139684][ T4356] ? show_regs_print_info+0x20/0x20 [ 82.144898][ T4356] ? load_image+0x3b0/0x3b0 [ 82.149423][ T4356] panic+0x2c9/0x7f0 [ 82.153349][ T4356] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 82.159516][ T4356] ? bpf_jit_dump+0xd0/0xd0 [ 82.164022][ T4356] ? _raw_spin_unlock_irqrestore+0xf6/0x100 [ 82.169911][ T4356] ? _raw_spin_unlock+0x40/0x40 [ 82.174759][ T4356] ? cp2112_xfer+0x87c/0xe00 [ 82.179344][ T4356] check_panic_on_warn+0x80/0xa0 [ 82.184277][ T4356] ? cp2112_xfer+0x87c/0xe00 [ 82.188863][ T4356] end_report+0x6d/0xf0 [ 82.193030][ T4356] kasan_report+0x102/0x130 [ 82.197539][ T4356] ? cp2112_xfer+0x87c/0xe00 [ 82.202137][ T4356] ? cp2112_xfer+0x87c/0xe00 [ 82.206723][ T4356] kasan_check_range+0x27b/0x290 [ 82.211743][ T4356] memcpy+0x25/0x60 [ 82.215636][ T4356] cp2112_xfer+0x87c/0xe00 [ 82.220049][ T4356] ? cp2112_i2c_xfer+0xf20/0xf20 [ 82.224982][ T4356] ? lock_chain_count+0x20/0x20 [ 82.229839][ T4356] __i2c_smbus_xfer+0x733/0x1d50 [ 82.234800][ T4356] ? cp2112_i2c_xfer+0xf20/0xf20 [ 82.239763][ T4356] ? i2c_smbus_write_i2c_block_data+0x1a0/0x1a0 [ 82.246023][ T4356] ? rt_mutex_lock_nested+0x15a/0x1c0 [ 82.251418][ T4356] ? i2c_smbus_xfer+0x11d/0x3a0 [ 82.256295][ T4356] ? rwsem_down_read_slowpath+0x990/0x990 [ 82.262034][ T4356] ? __might_fault+0xb7/0x110 [ 82.266710][ T4356] i2c_smbus_xfer+0x263/0x3a0 [ 82.271399][ T4356] ? i2c_smbus_read_byte+0x1b0/0x1b0 [ 82.276708][ T4356] ? __might_fault+0xb3/0x110 [ 82.281387][ T4356] i2cdev_ioctl_smbus+0x3e3/0x650 [ 82.286410][ T4356] ? i2cdev_ioctl_rdwr+0x6c0/0x6c0 [ 82.291560][ T4356] ? __might_fault+0xb3/0x110 [ 82.296253][ T4356] ? _copy_from_user+0x111/0x170 [ 82.301194][ T4356] i2cdev_ioctl+0x545/0x750 [ 82.306044][ T4356] ? i2cdev_write+0x120/0x120 [ 82.310829][ T4356] ? lockdep_hardirqs_on_prepare+0x3fc/0x760 [ 82.316819][ T4356] ? lock_chain_count+0x20/0x20 [ 82.321699][ T4356] ? bpf_lsm_file_ioctl+0x5/0x10 [ 82.326658][ T4356] ? security_file_ioctl+0x7c/0xa0 [ 82.331796][ T4356] ? i2cdev_write+0x120/0x120 [ 82.336501][ T4356] __se_sys_ioctl+0xfa/0x170 [ 82.341118][ T4356] do_syscall_64+0x4c/0xa0 [ 82.345534][ T4356] ? clear_bhb_loop+0x30/0x80 [ 82.350206][ T4356] ? clear_bhb_loop+0x30/0x80 [ 82.354885][ T4356] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 82.360787][ T4356] RIP: 0033:0x7fd0e87006c9 [ 82.365220][ T4356] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 82.384861][ T4356] RSP: 002b:00007ffdf9d99f18 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 82.393280][ T4356] RAX: ffffffffffffffda RBX: 00007fd0e8956fa0 RCX: 00007fd0e87006c9 [ 82.401260][ T4356] RDX: 0000200000000200 RSI: 0000000000000720 RDI: 0000000000000004 [ 82.409258][ T4356] RBP: 00007fd0e8782f91 R08: 0000000000000000 R09: 0000000000000000 [ 82.417245][ T4356] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 82.425592][ T4356] R13: 00007fd0e8956fa0 R14: 00007fd0e8956fa0 R15: 0000000000000003 [ 82.433577][ T4356] [ 82.436903][ T4356] Kernel Offset: disabled [ 82.441241][ T4356] Rebooting in 86400 seconds..