Warning: Permanently added '10.128.0.98' (ED25519) to the list of known hosts.
[ 72.948753][ T4169] chnl_net:caif_netlink_parms(): no params data found
[ 73.023831][ T4169] bridge0: port 1(bridge_slave_0) entered blocking state
[ 73.032112][ T4169] bridge0: port 1(bridge_slave_0) entered disabled state
[ 73.048434][ T4169] device bridge_slave_0 entered promiscuous mode
[ 73.066559][ T4169] bridge0: port 2(bridge_slave_1) entered blocking state
[ 73.076889][ T4169] bridge0: port 2(bridge_slave_1) entered disabled state
[ 73.091310][ T4169] device bridge_slave_1 entered promiscuous mode
[ 73.124278][ T4169] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 73.148330][ T4169] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 73.187158][ T4169] team0: Port device team_slave_0 added
[ 73.199504][ T4169] team0: Port device team_slave_1 added
[ 73.239272][ T4169] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 73.255610][ T4169] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 73.328263][ T4169] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 73.360899][ T4169] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 73.380177][ T4169] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 73.440045][ T4169] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 73.505691][ T4169] device hsr_slave_0 entered promiscuous mode
[ 73.515140][ T4169] device hsr_slave_1 entered promiscuous mode
[ 73.657267][ T4169] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 73.671311][ T4169] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 73.685596][ T4169] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 73.703020][ T4169] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 73.754381][ T4169] bridge0: port 2(bridge_slave_1) entered blocking state
[ 73.767413][ T4169] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 73.779706][ T4169] bridge0: port 1(bridge_slave_0) entered blocking state
[ 73.794379][ T4169] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 73.856169][ T4169] 8021q: adding VLAN 0 to HW filter on device bond0
[ 73.871733][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 73.885126][ T154] bridge0: port 1(bridge_slave_0) entered disabled state
[ 73.896955][ T154] bridge0: port 2(bridge_slave_1) entered disabled state
[ 73.912591][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 73.943708][ T4169] 8021q: adding VLAN 0 to HW filter on device team0
[ 73.958928][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 73.973896][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 73.987004][ T154] bridge0: port 1(bridge_slave_0) entered blocking state
[ 73.997391][ T154] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 74.027619][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 74.046584][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 74.062435][ T154] bridge0: port 2(bridge_slave_1) entered blocking state
[ 74.073770][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 74.096962][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 74.134392][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 74.149128][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 74.161377][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 74.180145][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 74.193454][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 74.204504][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 74.217237][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 74.228527][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 74.240514][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 74.254223][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 74.268812][ T4169] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 74.295165][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 74.308125][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 74.327004][ T4169] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 74.347046][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 74.357655][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 74.384883][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 74.397210][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 74.420252][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 74.430380][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 74.446668][ T4169] device veth0_vlan entered promiscuous mode
[ 74.461625][ T4169] device veth1_vlan entered promiscuous mode
[ 74.488044][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 74.498807][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 74.510336][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 74.521757][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 74.538760][ T4169] device veth0_macvtap entered promiscuous mode
[ 74.552604][ T4169] device veth1_macvtap entered promiscuous mode
[ 74.569552][ T4169] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 74.581406][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 74.594253][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 74.606492][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 74.617840][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 74.634380][ T4169] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 74.649832][ T3055] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 74.666514][ T3055] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 74.691238][ T4169] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 74.708855][ T4169] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 74.723648][ T4169] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
executing program
[ 74.738737][ T4169] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
executing program
executing program
[ 74.805959][ T4179] IPv6: ADDRCONF(NETDEV_CHANGE): bpq0: link becomes ready
[ 74.836982][ T4181] ==================================================================
[ 74.854655][ T4181] BUG: KASAN: use-after-free in ax25_fillin_cb+0x459/0x640
[ 74.864981][ T4181] Read of size 4 at addr ffff8880195b8538 by task syz-executor250/4181
[ 74.885546][ T4181]
[ 74.888372][ T4181] CPU: 0 PID: 4181 Comm: syz-executor250 Not tainted 5.15.185-syzkaller #0
[ 74.899558][ T4181] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
[ 74.913315][ T4181] Call Trace:
[ 74.916696][ T4181]
[ 74.920315][ T4181] dump_stack_lvl+0x168/0x230
[ 74.931179][ T4181] ? show_regs_print_info+0x20/0x20
[ 74.938252][ T4181] ? _printk+0xcc/0x110
[ 74.945313][ T4181] ? ax25_fillin_cb+0x459/0x640
[ 74.953838][ T4181] ? load_image+0x3b0/0x3b0
[ 74.959467][ T4181] print_address_description+0x60/0x2d0
[ 74.975257][ T4181] ? ax25_fillin_cb+0x459/0x640
[ 74.981310][ T4181] kasan_report+0xdf/0x130
[ 74.997183][ T4181] ? ax25_fillin_cb+0x459/0x640
[ 75.006034][ T4181] ax25_fillin_cb+0x459/0x640
[ 75.021558][ T4181] ax25_setsockopt+0x8a2/0xa40
[ 75.031374][ T4181] ? ax25_shutdown+0x10/0x10
[ 75.038891][ T4181] ? aa_sock_opt_perm+0x74/0x100
[ 75.047311][ T4181] ? bpf_lsm_socket_setsockopt+0x5/0x10
[ 75.059057][ T4181] ? security_socket_setsockopt+0x7a/0xa0
[ 75.081984][ T4181] ? ax25_shutdown+0x10/0x10
[ 75.088015][ T4181] __sys_setsockopt+0x3d6/0x5e0
[ 75.098298][ T4181] ? __ia32_sys_recv+0xb0/0xb0
[ 75.110282][ T4181] ? lockdep_hardirqs_on_prepare+0x3fc/0x760
[ 75.126515][ T4181] ? lock_chain_count+0x20/0x20
[ 75.137069][ T4181] ? vtime_user_exit+0x2dc/0x400
[ 75.147223][ T4181] __x64_sys_setsockopt+0xb1/0xc0
[ 75.160177][ T4181] do_syscall_64+0x4c/0xa0
[ 75.165500][ T4181] ? clear_bhb_loop+0x30/0x80
[ 75.180879][ T4181] ? clear_bhb_loop+0x30/0x80
[ 75.191930][ T4181] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 75.225080][ T4181] RIP: 0033:0x7f8d367ef619
[ 75.236207][ T4181] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 31 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 75.294360][ T4181] RSP: 002b:00007ffc4e5679a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[ 75.310999][ T4181] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f8d367ef619
[ 75.326949][ T4181] RDX: 0000000000000019 RSI: 0000000000000101 RDI: 0000000000000007
[ 75.350430][ T4181] RBP: 00007ffc4e5679e0 R08: 0000000000000010 R09: 0000000000000001
[ 75.365266][ T4181] R10: 0000200000000180 R11: 0000000000000246 R12: 00000000000f4240
[ 75.380847][ T4181] R13: 000000000001241b R14: 00007ffc4e5679c4 R15: 00007ffc4e5679d0
[ 75.393054][ T4181]
[ 75.396739][ T4181]
[ 75.399822][ T4181] Allocated by task 4179:
[ 75.406809][ T4181] __kasan_kmalloc+0xb5/0xf0
[ 75.414908][ T4181] ax25_dev_device_up+0x50/0x580
[ 75.422385][ T4181] ax25_device_event+0x483/0x4f0
[ 75.429605][ T4181] raw_notifier_call_chain+0xcb/0x160
[ 75.436222][ T4181] __dev_notify_flags+0x178/0x2d0
[ 75.442609][ T4181] dev_change_flags+0xe3/0x1a0
[ 75.450850][ T4181] dev_ifsioc+0x147/0xe70
[ 75.455586][ T4181] dev_ioctl+0x55f/0xe50
[ 75.460771][ T4181] sock_do_ioctl+0x222/0x2f0
[ 75.468225][ T4181] sock_ioctl+0x4ed/0x6e0
[ 75.474817][ T4181] __se_sys_ioctl+0xfa/0x170
[ 75.481827][ T4181] do_syscall_64+0x4c/0xa0
[ 75.486796][ T4181] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 75.495252][ T4181]
[ 75.500884][ T4181] Freed by task 4180:
[ 75.511017][ T4181] kasan_set_track+0x4b/0x70
[ 75.519592][ T4181] kasan_set_free_info+0x1f/0x40
[ 75.527657][ T4181] ____kasan_slab_free+0xd5/0x110
[ 75.534539][ T4181] slab_free_freelist_hook+0xea/0x170
[ 75.542051][ T4181] kfree+0xef/0x2a0
[ 75.548949][ T4181] ax25_release+0x661/0x870
[ 75.555034][ T4181] sock_close+0xd5/0x240
[ 75.559744][ T4181] __fput+0x234/0x930
[ 75.564043][ T4181] task_work_run+0x125/0x1a0
[ 75.578588][ T4181] exit_to_user_mode_loop+0x10f/0x130
[ 75.591306][ T4181] exit_to_user_mode_prepare+0xb1/0x140
[ 75.598560][ T4181] syscall_exit_to_user_mode+0x16/0x40
[ 75.609024][ T4181] do_syscall_64+0x58/0xa0
[ 75.614349][ T4181] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 75.623058][ T4181]
[ 75.628157][ T4181] The buggy address belongs to the object at ffff8880195b8500
[ 75.628157][ T4181] which belongs to the cache kmalloc-192 of size 192
[ 75.652123][ T4181] The buggy address is located 56 bytes inside of
[ 75.652123][ T4181] 192-byte region [ffff8880195b8500, ffff8880195b85c0)
[ 75.678966][ T4181] The buggy address belongs to the page:
[ 75.688828][ T4181] page:ffffea0000656e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x195b8
[ 75.707084][ T4181] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 75.716955][ T4181] raw: 00fff00000000200 dead000000000100 dead000000000122 ffff888016841a00
[ 75.728175][ T4181] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[ 75.738684][ T4181] page dumped because: kasan: bad access detected
[ 75.749554][ T4181] page_owner tracks the page as allocated
[ 75.757906][ T4181] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 2667137717, free_ts 0
[ 75.785622][ T4181] get_page_from_freelist+0x1b77/0x1c60
[ 75.794679][ T4181] __alloc_pages+0x1e1/0x470
[ 75.800052][ T4181] alloc_page_interleave+0x24/0x1e0
[ 75.808285][ T4181] new_slab+0xc0/0x4b0
[ 75.814944][ T4181] ___slab_alloc+0x81e/0xdf0
[ 75.820372][ T4181] kmem_cache_alloc_trace+0x1a5/0x2a0
[ 75.829481][ T4181] call_usermodehelper_setup+0x8a/0x260
[ 75.835955][ T4181] kobject_uevent_env+0x65e/0x890
[ 75.842804][ T4181] kernel_add_sysfs_param+0xfb/0x120
[ 75.853467][ T4181] param_sysfs_builtin+0x164/0x1e0
[ 75.860099][ T4181] param_sysfs_init+0x66/0x70
[ 75.869221][ T4181] do_one_initcall+0x1ee/0x680
[ 75.875203][ T4181] do_initcall_level+0x137/0x1f0
[ 75.880962][ T4181] do_initcalls+0x4b/0x90
[ 75.886801][ T4181] kernel_init_freeable+0x3ce/0x560
[ 75.894051][ T4181] kernel_init+0x19/0x1b0
[ 75.898894][ T4181] page_owner free stack trace missing
[ 75.907943][ T4181]
[ 75.910277][ T4181] Memory state around the buggy address:
[ 75.927114][ T4181] ffff8880195b8400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 75.939850][ T4181] ffff8880195b8480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 75.953018][ T4181] >ffff8880195b8500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 75.964750][ T4181] ^
[ 75.979013][ T4181] ffff8880195b8580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 75.991316][ T4181] ffff8880195b8600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.013486][ T4181] ==================================================================
[ 76.023648][ T4181] Disabling lock debugging due to kernel taint
[ 76.044143][ T4181] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 76.055217][ T4181] CPU: 0 PID: 4181 Comm: syz-executor250 Tainted: G B 5.15.185-syzkaller #0
[ 76.069353][ T4181] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
[ 76.091129][ T4181] Call Trace:
[ 76.097818][ T4181]
[ 76.102758][ T4181] dump_stack_lvl+0x168/0x230
[ 76.114083][ T4181] ? show_regs_print_info+0x20/0x20
[ 76.120325][ T4181] ? load_image+0x3b0/0x3b0
[ 76.130451][ T4181] panic+0x2c9/0x7f0
[ 76.134859][ T4181] ? bpf_jit_dump+0xd0/0xd0
[ 76.140063][ T4181] ? _raw_spin_unlock_irqrestore+0xf6/0x100
[ 76.150035][ T4181] ? _raw_spin_unlock+0x40/0x40
[ 76.158688][ T4181] ? print_memory_metadata+0x314/0x400
[ 76.168359][ T4181] ? ax25_fillin_cb+0x459/0x640
[ 76.175541][ T4181] check_panic_on_warn+0x80/0xa0
[ 76.183854][ T4181] ? ax25_fillin_cb+0x459/0x640
[ 76.193544][ T4181] end_report+0x6d/0xf0
[ 76.198128][ T4181] kasan_report+0x102/0x130
[ 76.207945][ T4181] ? ax25_fillin_cb+0x459/0x640
[ 76.215390][ T4181] ax25_fillin_cb+0x459/0x640
[ 76.224483][ T4181] ax25_setsockopt+0x8a2/0xa40
[ 76.235908][ T4181] ? ax25_shutdown+0x10/0x10
[ 76.247242][ T4181] ? aa_sock_opt_perm+0x74/0x100
[ 76.261235][ T4181] ? bpf_lsm_socket_setsockopt+0x5/0x10
[ 76.271918][ T4181] ? security_socket_setsockopt+0x7a/0xa0
[ 76.280660][ T4181] ? ax25_shutdown+0x10/0x10
[ 76.290434][ T4181] __sys_setsockopt+0x3d6/0x5e0
[ 76.300031][ T4181] ? __ia32_sys_recv+0xb0/0xb0
[ 76.307791][ T4181] ? lockdep_hardirqs_on_prepare+0x3fc/0x760
[ 76.317656][ T4181] ? lock_chain_count+0x20/0x20
[ 76.324346][ T4181] ? vtime_user_exit+0x2dc/0x400
[ 76.332742][ T4181] __x64_sys_setsockopt+0xb1/0xc0
[ 76.338837][ T4181] do_syscall_64+0x4c/0xa0
[ 76.345333][ T4181] ? clear_bhb_loop+0x30/0x80
[ 76.353851][ T4181] ? clear_bhb_loop+0x30/0x80
[ 76.361619][ T4181] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 76.369217][ T4181] RIP: 0033:0x7f8d367ef619
[ 76.376027][ T4181] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 31 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 76.404219][ T4181] RSP: 002b:00007ffc4e5679a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[ 76.419122][ T4181] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f8d367ef619
[ 76.439887][ T4181] RDX: 0000000000000019 RSI: 0000000000000101 RDI: 0000000000000007
[ 76.453537][ T4181] RBP: 00007ffc4e5679e0 R08: 0000000000000010 R09: 0000000000000001
[ 76.466622][ T4181] R10: 0000200000000180 R11: 0000000000000246 R12: 00000000000f4240
[ 76.478927][ T4181] R13: 000000000001241b R14: 00007ffc4e5679c4 R15: 00007ffc4e5679d0
[ 76.494553][ T4181]
[ 76.498165][ T4181] Kernel Offset: disabled
[ 76.507135][ T4181] Rebooting in 86400 seconds..