Warning: Permanently added '[localhost]:7767' (ED25519) to the list of known hosts. syzkaller login: [ 97.132739][ T10] cfg80211: failed to load regulatory.db 2026/06/29 17:46:36 parsed 1 programs 2026/06/29 17:46:36 serving rpc on tcp://39569 [ 100.540009][ T5299] cgroup: Unknown subsys name 'net' [ 100.617960][ T5299] cgroup: Unknown subsys name 'cpuset' [ 100.626144][ T5299] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 102.326979][ T5299] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0xe7000) [ 105.244942][ T1030] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1 [ 105.261470][ T1030] ata1: failed to read log page 10h (errno=-5) [ 105.275321][ T1030] ata1.00: exception Emask 0x1 SAct 0xc000 SErr 0x0 action 0x0 [ 105.293920][ T1030] ata1.00: irq_stat 0x41000000 [ 105.306115][ T1030] ata1.00: failed command: WRITE FPDMA QUEUED [ 105.327183][ T1030] ata1.00: cmd 61/38:70:d6:94:05/07:00:00:00:00/40 tag 14 ncq dma 946176 out [ 105.327183][ T1030] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 105.365834][ T1030] ata1.00: status: { DRDY } [ 105.379962][ T1030] ata1.00: failed command: WRITE FPDMA QUEUED [ 105.395204][ T1030] ata1.00: cmd 61/c8:78:0e:9c:05/08:00:00:00:00/40 tag 15 ncq dma 1150976 ou [ 105.395204][ T1030] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 105.437985][ T1030] ata1.00: status: { DRDY } [ 105.455396][ T1030] ata1.00: configured for UDMA/100 [ 105.467730][ T1030] ata1: EH complete [ 109.093528][ T5312] bridge0: port 1(bridge_slave_0) entered blocking state [ 109.101863][ T5312] bridge0: port 1(bridge_slave_0) entered disabled state [ 109.106177][ T5312] bridge_slave_0: entered allmulticast mode [ 109.114185][ T5312] bridge_slave_0: entered promiscuous mode [ 109.132978][ T5312] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.141542][ T5312] bridge0: port 2(bridge_slave_1) entered disabled state [ 109.151889][ T5312] bridge_slave_1: entered allmulticast mode [ 109.156896][ T5312] bridge_slave_1: entered promiscuous mode [ 109.235594][ T5312] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 109.244676][ T5312] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 109.311007][ T5312] team0: Port device team_slave_0 added [ 109.326853][ T5312] team0: Port device team_slave_1 added [ 109.379349][ T5312] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 109.391404][ T5312] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 109.412507][ T5312] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 109.427277][ T5312] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 109.441648][ T5312] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 109.464299][ T5312] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 109.555264][ T5312] hsr_slave_0: entered promiscuous mode [ 109.573039][ T5312] hsr_slave_1: entered promiscuous mode [ 109.873427][ T5312] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 109.888693][ T5312] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 109.895629][ T5312] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 109.900831][ T5312] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 109.906120][ T5312] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 109.917241][ T5312] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 109.929955][ T5312] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 109.941047][ T5312] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 110.109953][ T5312] 8021q: adding VLAN 0 to HW filter on device bond0 [ 110.175374][ T5312] 8021q: adding VLAN 0 to HW filter on device team0 [ 110.199405][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 110.203969][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 110.238297][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 110.241453][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 110.375586][ T5312] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 111.077431][ T5312] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 111.204523][ T5312] veth0_vlan: entered promiscuous mode [ 111.231034][ T5312] veth1_vlan: entered promiscuous mode [ 111.314248][ T5312] veth0_macvtap: entered promiscuous mode [ 111.336055][ T5312] veth1_macvtap: entered promiscuous mode [ 111.393388][ T5312] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.425424][ T5312] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.464140][ T137] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.484922][ T137] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.508330][ T137] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.525723][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.713181][ T5312] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 112.316575][ T1157] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.885657][ T1157] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 113.139578][ T1157] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 113.332659][ T1157] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 113.676319][ T5366] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 113.684329][ T5366] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 113.692112][ T5366] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 113.699982][ T5366] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 113.704781][ T5366] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 113.908915][ T1157] bridge_slave_1: left allmulticast mode [ 113.921843][ T1157] bridge_slave_1: left promiscuous mode [ 113.926078][ T1157] bridge0: port 2(bridge_slave_1) entered disabled state [ 113.958073][ T1157] bridge_slave_0: left allmulticast mode [ 113.960462][ T1157] bridge_slave_0: left promiscuous mode [ 113.972820][ T1157] bridge0: port 1(bridge_slave_0) entered disabled state [ 114.367148][ T1157] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 114.387224][ T1157] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 114.399891][ T1157] bond0 (unregistering): Released all slaves [ 114.627885][ T1157] hsr_slave_0: left promiscuous mode [ 114.646570][ T1157] hsr_slave_1: left promiscuous mode [ 114.661929][ T1157] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 114.672143][ T1157] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 114.684216][ T1157] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 114.696806][ T1157] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 114.769586][ T1157] veth1_macvtap: left promiscuous mode [ 114.783538][ T1157] veth0_macvtap: left promiscuous mode [ 114.792147][ T1157] veth1_vlan: left promiscuous mode [ 114.812990][ T1157] veth0_vlan: left promiscuous mode [ 115.604347][ T1157] team0 (unregistering): Port device team_slave_1 removed [ 115.636789][ T1157] team0 (unregistering): Port device team_slave_0 removed [ 115.771576][ T5366] Bluetooth: hci0: command tx timeout [ 115.903373][ T5001] 8021q: adding VLAN 0 to HW filter on device eth2 [ 117.102808][ T5001] 8021q: adding VLAN 0 to HW filter on device eth3 [ 117.718937][ T1157] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 117.735198][ T1157] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 117.863401][ T30] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 117.867724][ T30] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 118.096389][ T5001] 8021q: adding VLAN 0 to HW filter on device eth4 [ 119.060506][ T5001] 8021q: adding VLAN 0 to HW filter on device eth5 2026/06/29 17:47:03 executed programs: 0 [ 124.386772][ T4654] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 124.397073][ T4654] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 124.401036][ T4654] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 124.407144][ T4654] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 124.414189][ T4654] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 124.993679][ T5453] bridge0: port 1(bridge_slave_0) entered blocking state [ 124.997686][ T5453] bridge0: port 1(bridge_slave_0) entered disabled state [ 125.001610][ T5453] bridge_slave_0: entered allmulticast mode [ 125.005411][ T5453] bridge_slave_0: entered promiscuous mode [ 125.011709][ T5453] bridge0: port 2(bridge_slave_1) entered blocking state [ 125.015206][ T5453] bridge0: port 2(bridge_slave_1) entered disabled state [ 125.018223][ T5453] bridge_slave_1: entered allmulticast mode [ 125.021892][ T5453] bridge_slave_1: entered promiscuous mode [ 125.053151][ T5453] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 125.059312][ T5453] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 125.088923][ T5453] team0: Port device team_slave_0 added [ 125.094129][ T5453] team0: Port device team_slave_1 added [ 125.119713][ T5453] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 125.122843][ T5453] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 125.133046][ T5453] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 125.138825][ T5453] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 125.142948][ T5453] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 125.155926][ T5453] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 125.205217][ T5453] hsr_slave_0: entered promiscuous mode [ 125.208535][ T5453] hsr_slave_1: entered promiscuous mode [ 125.984905][ T5453] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 126.010086][ T5453] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 126.023637][ T5453] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 126.046321][ T5453] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 126.056753][ T5453] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 126.096661][ T5453] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 126.113541][ T5453] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 126.159010][ T5453] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 126.336559][ T5453] 8021q: adding VLAN 0 to HW filter on device bond0 [ 126.382929][ T5453] 8021q: adding VLAN 0 to HW filter on device team0 [ 126.393333][ T30] bridge0: port 1(bridge_slave_0) entered blocking state [ 126.396319][ T30] bridge0: port 1(bridge_slave_0) entered forwarding state [ 126.442980][ T30] bridge0: port 2(bridge_slave_1) entered blocking state [ 126.446209][ T30] bridge0: port 2(bridge_slave_1) entered forwarding state [ 126.481876][ T4654] Bluetooth: hci0: command tx timeout [ 127.260659][ T5453] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 127.386120][ T5453] veth0_vlan: entered promiscuous mode [ 127.414814][ T5453] veth1_vlan: entered promiscuous mode [ 127.499597][ T5453] veth0_macvtap: entered promiscuous mode [ 127.527796][ T5453] veth1_macvtap: entered promiscuous mode [ 127.567554][ T5453] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 127.593415][ T5453] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 127.634845][ T30] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 127.649026][ T30] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 127.664501][ T1157] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 127.676598][ T1157] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 127.875230][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 127.887678][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 127.984756][ T30] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 127.995356][ T30] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 128.354790][ T5527] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000011: 0000 [#1] SMP KASAN NOPTI [ 128.359892][ T5527] KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f] [ 128.364027][ T5527] CPU: 0 UID: 0 PID: 5527 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 128.369572][ T5527] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 128.373914][ T5527] RIP: 0010:mas_start+0xfe/0x550 [ 128.376262][ T5527] Code: 4c 02 00 00 c6 43 4c 00 48 8b 44 24 28 42 80 3c 30 00 74 08 48 89 df e8 70 61 87 f6 4c 8b 23 49 83 c4 48 4c 89 e0 48 c1 e8 03 <42> 80 3c 30 00 74 08 4c 89 e7 e8 53 61 87 f6 4d 8b 24 24 e8 aa 9b [ 128.384830][ T5527] RSP: 0018:ffffc90002dff898 EFLAGS: 00010206 [ 128.387979][ T5527] RAX: 0000000000000011 RBX: ffffc90002dff960 RCX: 1ffff920005bff35 [ 128.391084][ T5527] RDX: 1ffff920005bff2c RSI: 0000000000000001 RDI: ffffc90002dff988 [ 128.393834][ T5527] RBP: 0000000000000001 R08: ffffffff8baf8bfa R09: 0000000000000000 [ 128.396582][ T5527] R10: 0000000000000000 R11: ffffffff8e959c20 R12: 0000000000000088 [ 128.399562][ T5527] R13: ffffc90002dff960 R14: dffffc0000000000 R15: 1ffff920005bff35 [ 128.403137][ T5527] FS: 0000000000000000(0000) GS:ffff88808c815000(0000) knlGS:0000000000000000 [ 128.407011][ T5527] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 128.409832][ T5527] CR2: 00007f6060627000 CR3: 0000000011d72000 CR4: 0000000000352ef0 [ 128.413008][ T5527] Call Trace: [ 128.414590][ T5527] [ 128.416064][ T5527] mtree_load+0x1f5/0x780 [ 128.418202][ T5527] ? mtree_load+0x12a/0x780 [ 128.420097][ T5527] ? copy_from_vaddr+0x123/0x300 [ 128.422140][ T5527] ? __pfx_mtree_load+0x10/0x10 [ 128.424096][ T5527] ? rcu_is_watching+0x15/0xb0 [ 128.426085][ T5527] ? __up_read+0x29c/0x930 [ 128.428023][ T5527] set_orig_insn+0x226/0x310 [ 128.430053][ T5527] ? __pfx_set_orig_insn+0x10/0x10 [ 128.432281][ T5527] register_for_each_vma+0xa0e/0xb80 [ 128.434565][ T5527] uprobe_unregister_nosync+0x118/0x1b0 [ 128.436840][ T5527] bpf_uprobe_multi_link_release+0x99/0x1a0 [ 128.439032][ T5527] bpf_link_free+0xdd/0x3e0 [ 128.440912][ T5527] ? __pfx_bpf_link_release+0x10/0x10 [ 128.443851][ T5527] bpf_link_release+0x6b/0x80 [ 128.446521][ T5527] __fput+0x418/0xa50 [ 128.448535][ T5527] task_work_run+0x1d9/0x270 [ 128.450763][ T5527] ? __pfx_task_work_run+0x10/0x10 [ 128.452921][ T5527] ? do_raw_spin_unlock+0x4d/0x210 [ 128.455188][ T5527] do_exit+0x73a/0x2360 [ 128.457139][ T5527] ? __pfx_do_exit+0x10/0x10 [ 128.459375][ T5527] ? rcu_is_watching+0x15/0xb0 [ 128.462115][ T5527] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.465340][ T5527] __x64_sys_exit+0x40/0x40 [ 128.467577][ T5527] x64_sys_call+0x2231/0x2240 [ 128.469663][ T5527] do_syscall_64+0x174/0x580 [ 128.471656][ T5527] ? trace_irq_disable+0x3b/0x140 [ 128.473915][ T5527] ? clear_bhb_loop+0x40/0x90 [ 128.475885][ T5527] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.478287][ T5527] RIP: 0033:0x7f0d3e19ce59 [ 128.480187][ T5527] Code: Unable to access opcode bytes at 0x7f0d3e19ce2f. [ 128.483392][ T5527] RSP: 002b:00007ffebf74c2d8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 128.487805][ T5527] RAX: ffffffffffffffda RBX: 00007f0d3e415fa0 RCX: 00007f0d3e19ce59 [ 128.491327][ T5527] RDX: 0000555585c45808 RSI: 0000000000000000 RDI: 0000000000000000 [ 128.494496][ T5527] RBP: 00007f0d3e232e6f R08: 0000000000000000 R09: 0000000000000000 [ 128.498082][ T5527] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 128.502041][ T5527] R13: 00007f0d3e415fac R14: 00007f0d3e415fa0 R15: 00007f0d3e415fa0 [ 128.505398][ T5527] [ 128.506742][ T5527] Modules linked in: [ 128.509109][ T5527] ---[ end trace 0000000000000000 ]--- [ 128.533460][ T5527] RIP: 0010:mas_start+0xfe/0x550 [ 128.535704][ T5527] Code: 4c 02 00 00 c6 43 4c 00 48 8b 44 24 28 42 80 3c 30 00 74 08 48 89 df e8 70 61 87 f6 4c 8b 23 49 83 c4 48 4c 89 e0 48 c1 e8 03 <42> 80 3c 30 00 74 08 4c 89 e7 e8 53 61 87 f6 4d 8b 24 24 e8 aa 9b [ 128.547757][ T5527] RSP: 0018:ffffc90002dff898 EFLAGS: 00010206 [ 128.551615][ T5527] RAX: 0000000000000011 RBX: ffffc90002dff960 RCX: 1ffff920005bff35 [ 128.554680][ T5527] RDX: 1ffff920005bff2c RSI: 0000000000000001 RDI: ffffc90002dff988 [ 128.558091][ T5527] RBP: 0000000000000001 R08: ffffffff8baf8bfa R09: 0000000000000000 [ 128.565108][ T4654] Bluetooth: hci0: command tx timeout [ 128.568356][ T5527] R10: 0000000000000000 R11: ffffffff8e959c20 R12: 0000000000000088 [ 128.572310][ T5527] R13: ffffc90002dff960 R14: dffffc0000000000 R15: 1ffff920005bff35 [ 128.575648][ T5527] FS: 0000000000000000(0000) GS:ffff88808c815000(0000) knlGS:0000000000000000 [ 128.579557][ T5527] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 128.583328][ T5527] CR2: 00007ffdab94d0d8 CR3: 0000000011fa6000 CR4: 0000000000352ef0 [ 128.586898][ T5527] Kernel panic - not syncing: Fatal exception [ 128.589729][ T5527] Kernel Offset: disabled [ 128.591586][ T5527] Rebooting in 86400 seconds..