[ 8.333079][ T4403] 8021q: adding VLAN 0 to HW filter on device bond0 [ 8.336567][ T4403] eql: remember to turn off Van-Jacobson compression on your slave devices Starting crond: [ 8.371860][ T2692] gve 0000:00:00.0 enp0s0: Device link is up. OK Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.85' (ED25519) to the list of known hosts. 1970/01/01 00:00:30 parsed 1 programs 1970/01/01 00:00:30 serving rpc on tcp://38103 syzkaller login: [ 31.575741][ T4726] cgroup: Unknown subsys name 'net' [ 31.676905][ T4726] cgroup: Unknown subsys name 'cpuset' [ 31.679034][ T4726] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 31.872844][ T4726] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 34.900805][ T4737] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 34.902405][ T4737] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 34.903903][ T4737] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 34.904887][ T4737] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 34.905119][ T4737] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 34.977573][ T4734] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 35.202666][ T2714] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 35.202693][ T2714] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 35.211217][ T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 35.211244][ T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 35.799998][ T4769] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.800246][ T4769] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.800322][ T4769] bridge_slave_0: entered allmulticast mode [ 35.800749][ T4769] bridge_slave_0: entered promiscuous mode [ 35.802208][ T4769] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.802263][ T4769] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.802312][ T4769] bridge_slave_1: entered allmulticast mode [ 35.802708][ T4769] bridge_slave_1: entered promiscuous mode [ 35.809506][ T4769] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 35.810339][ T4769] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 35.816837][ T4769] team0: Port device team_slave_0 added [ 35.817521][ T4769] team0: Port device team_slave_1 added [ 35.823163][ T4769] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 35.823187][ T4769] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.823202][ T4769] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 35.823854][ T4769] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 35.823860][ T4769] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.823875][ T4769] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 35.835449][ T4769] hsr_slave_0: entered promiscuous mode [ 35.835743][ T4769] hsr_slave_1: entered promiscuous mode [ 35.888801][ T4769] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 35.892034][ T4769] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 35.893803][ T4769] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 35.896639][ T4769] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 35.898397][ T4769] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 35.900819][ T4769] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 35.902541][ T4769] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 35.904806][ T4769] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 35.917818][ T4769] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.917869][ T4769] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.918023][ T4769] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.918051][ T4769] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.938365][ T4769] 8021q: adding VLAN 0 to HW filter on device bond0 [ 35.942444][ T40] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.946136][ T40] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.949997][ T4769] 8021q: adding VLAN 0 to HW filter on device team0 [ 35.952003][ T264] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.952075][ T264] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.956839][ T264] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.956876][ T264] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.969354][ T4769] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 35.969385][ T4769] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 36.050495][ T4769] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 36.069936][ T4769] veth0_vlan: entered promiscuous mode [ 36.072014][ T4769] veth1_vlan: entered promiscuous mode [ 36.078805][ T4769] veth0_macvtap: entered promiscuous mode [ 36.079835][ T4769] veth1_macvtap: entered promiscuous mode [ 36.083892][ T4769] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 36.085108][ T4769] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 36.087885][ T264] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.090045][ T264] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.091782][ T264] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.097723][ T264] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.179063][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 36.227167][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 36.280778][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 36.337598][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 1970/01/01 00:00:36 executed programs: 0 [ 36.730501][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 36.730845][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 36.731110][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 36.731411][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 36.731614][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 36.867624][ T4831] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.867705][ T4831] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.867801][ T4831] bridge_slave_0: entered allmulticast mode [ 36.868220][ T4831] bridge_slave_0: entered promiscuous mode [ 36.869046][ T4831] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.869096][ T4831] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.869143][ T4831] bridge_slave_1: entered allmulticast mode [ 36.869550][ T4831] bridge_slave_1: entered promiscuous mode [ 36.877445][ T4831] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 36.878384][ T4831] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 36.885496][ T4831] team0: Port device team_slave_0 added [ 36.886301][ T4831] team0: Port device team_slave_1 added [ 36.891946][ T4831] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 36.891974][ T4831] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 36.891989][ T4831] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 36.892753][ T4831] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 36.892760][ T4831] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 36.892775][ T4831] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 36.903453][ T4831] hsr_slave_0: entered promiscuous mode [ 36.903741][ T4831] hsr_slave_1: entered promiscuous mode [ 36.903980][ T4831] debugfs: 'hsr0' already exists in 'hsr' [ 36.904017][ T4831] Cannot create hsr debugfs directory [ 38.754752][ T4737] Bluetooth: hci0: command tx timeout [ 39.133551][ T12] bridge_slave_1: left allmulticast mode [ 39.133588][ T12] bridge_slave_1: left promiscuous mode [ 39.133878][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.139450][ T12] bridge_slave_0: left allmulticast mode [ 39.140535][ T12] bridge_slave_0: left promiscuous mode [ 39.141683][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.193193][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 39.236206][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 39.255124][ T12] bond0 (unregistering): Released all slaves [ 39.339080][ T12] hsr_slave_0: left promiscuous mode [ 39.340424][ T12] hsr_slave_1: left promiscuous mode [ 39.341790][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 39.343310][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 39.347820][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 39.349217][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 39.354058][ T12] veth1_macvtap: left promiscuous mode [ 39.354106][ T12] veth0_macvtap: left promiscuous mode [ 39.354161][ T12] veth1_vlan: left promiscuous mode [ 39.357914][ T12] veth0_vlan: left promiscuous mode [ 39.451999][ T12] team0 (unregistering): Port device team_slave_1 removed [ 39.455978][ T12] team0 (unregistering): Port device team_slave_0 removed [ 39.495472][ T4403] 8021q: adding VLAN 0 to HW filter on device eth0 [ 39.714001][ T4831] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 39.716453][ T4831] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 39.718090][ T4831] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 39.720809][ T4831] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 39.721261][ T4831] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 39.724097][ T4831] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 39.726104][ T4831] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 39.728255][ T4831] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 39.754141][ T4831] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.760385][ T4831] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.765394][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.765433][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.765969][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.765997][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.998322][ T4831] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 40.014426][ T4831] veth0_vlan: entered promiscuous mode [ 40.016468][ T4831] veth1_vlan: entered promiscuous mode [ 40.023566][ T4831] veth0_macvtap: entered promiscuous mode [ 40.026585][ T4831] veth1_macvtap: entered promiscuous mode [ 40.030368][ T4831] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.031372][ T4831] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.037256][ T264] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.039023][ T264] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.041640][ T264] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.042258][ T264] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.064100][ T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.064132][ T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.074052][ T2692] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.075603][ T2692] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.117016][ T4926] dummy_hcd dummy_hcd.0: remove, state 4 [ 40.117076][ T4926] usb usb1: USB disconnect, device number 1 [ 40.121894][ T4926] dummy_hcd dummy_hcd.0: stopped [ 40.121933][ T4926] dummy_hcd dummy_hcd.0: USB bus 1 deregistered [ 40.126328][ T4 ** replaying previous printk message ** [ 40.126328][ T4926] Unable to handle kernel paging request at virtual address dfff800000000000 [ 40.126359][ T4926] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 40.126614][ T4926] Mem abort info: [ 40.126622][ T4926] ESR = 0x0000000096000005 [ 40.126631][ T4926] EC = 0x25: DABT (current EL), IL = 32 bits [ 40.126638][ T4926] SET = 0, FnV = 0 [ 40.126643][ T4926] EA = 0, S1PTW = 0 [ 40.126647][ T4926] FSC = 0x05: level 1 translation fault [ 40.126652][ T4926] Data abort info: [ 40.126655][ T4926] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 40.126659][ T4926] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 40.126664][ T4926] GCS = 0, Overlay = 0, DirtyBit = 0 [ 40.126669][ T4926] [dfff800000000000] address between user and kernel address ranges [ 40.126698][ T4926] Internal error: Oops: 0000000096000005 [#1] SMP [ 40.141284][ T4926] Modules linked in: [ 40.141968][ T4926] CPU: 0 UID: 0 PID: 4926 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT [ 40.143531][ T4926] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 40.145374][ T4926] pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 40.146789][ T4926] pc : dummy_udc_start+0xdc/0x1d8 [ 40.147785][ T4926] lr : dummy_udc_start+0xd8/0x1d8 [ 40.148709][ T4926] sp : ffff800098ea76c0 [ 40.149478][ T4926] x29: ffff800098ea76c0 x28: 1fffe00019445401 x27: 1fffe0001a2edc27 [ 40.151002][ T4926] x26: dfff800000000000 x25: 1fffe00019445400 x24: ffff8000835b52c4 [ 40.152532][ T4926] x23: ffff0000c5d94c00 x22: dfff800000000000 x21: 0000000000000003 [ 40.154074][ T4926] x20: 0000000000000000 x19: ffff0000d176e050 x18: 00000000ffffffff [ 40.155471][ T4926] x17: ffff80008a791000 x16: 0000000000000002 x15: ffff80008a31ada0 [ 40.156931][ T4926] x14: ffff80008a590e28 x13: 0000000000000001 x12: 0000000000000000 [ 40.158438][ T4926] x11: 0000000000000000 x10: 000000000000003f x9 : 0000000000000000 [ 40.159868][ T4926] x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 [ 40.161356][ T4926] x5 : 0000000000000030 x4 : 0000000000000008 x3 : ffff8000835b5358 [ 40.162845][ T4926] x2 : 0000000000000003 x1 : ffff0000c4489d40 x0 : 0000000000000000 [ 40.164287][ T4926] Call trace: [ 40.164886][ T4926] dummy_udc_start+0xdc/0x1d8 (P) [ 40.165785][ T4926] gadget_bind_driver+0x328/0x834 [ 40.166650][ T4926] really_probe+0x29c/0x800 [ 40.167400][ T4926] __driver_probe_device+0x1e0/0x350 [ 40.168310][ T4926] driver_probe_device+0x6c/0x19c [ 40.169204][ T4926] __driver_attach+0x168/0x384 [ 40.169968][ T4926] bus_for_each_dev+0x128/0x1b4 [ 40.170764][ T4926] driver_attach+0x50/0x60 [ 40.171486][ T4926] bus_add_driver+0x208/0x500 [ 40.172277][ T4926] driver_register+0x220/0x310 [ 40.173061][ T4926] usb_gadget_register_driver_owner+0xf0/0x25c [ 40.174135][ T4926] raw_ioctl+0x10f8/0x356c [ 40.174924][ T4926] __arm64_sys_ioctl+0x14c/0x1c4 [ 40.175797][ T4926] invoke_syscall+0x98/0x244 [ 40.176584][ T4926] el0_svc_common+0xec/0x23c [ 40.177398][ T4926] do_el0_svc+0x4c/0x5c [ 40.178088][ T4926] el0_svc+0x64/0x260 [ 40.178788][ T4926] el0t_64_sync_handler+0x48/0x148 [ 40.179716][ T4926] el0t_64_sync+0x198/0x19c [ 40.180550][ T4926] Code: 9742848d 14000002 9742848b d343fe88 (38766908) [ 40.181787][ T4926] ---[ end trace 0000000000000000 ]--- [ 40.387937][ T4926] Kernel panic - not syncing: Oops: Fatal exception [ 40.389097][ T4926] SMP: stopping secondary CPUs [ 40.389920][ T4926] Kernel Offset: disabled [ 40.390642][ T4926] CPU features: 0x14000000,003c0008,27020501,5427fea7 [ 40.391785][ T4926] Memory Limit: none [ 40.586609][ T4926] Rebooting in 86400 seconds..