Warning: Permanently added '10.128.0.188' (ED25519) to the list of known hosts.
[   52.660329][ T4168] chnl_net:caif_netlink_parms(): no params data found
[   52.696657][ T4168] bridge0: port 1(bridge_slave_0) entered blocking state
[   52.704114][ T4168] bridge0: port 1(bridge_slave_0) entered disabled state
[   52.712613][ T4168] device bridge_slave_0 entered promiscuous mode
[   52.721654][ T4168] bridge0: port 2(bridge_slave_1) entered blocking state
[   52.729129][ T4168] bridge0: port 2(bridge_slave_1) entered disabled state
[   52.736712][ T4168] device bridge_slave_1 entered promiscuous mode
[   52.754386][ T4168] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   52.765775][ T4168] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   52.786388][ T4168] team0: Port device team_slave_0 added
[   52.793684][ T4168] team0: Port device team_slave_1 added
[   52.809513][ T4168] batman_adv: batadv0: Adding interface: batadv_slave_0
[   52.816472][ T4168] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   52.842993][ T4168] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   52.856915][ T4168] batman_adv: batadv0: Adding interface: batadv_slave_1
[   52.863968][ T4168] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   52.890799][ T4168] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   52.916894][ T4168] device hsr_slave_0 entered promiscuous mode
[   52.923785][ T4168] device hsr_slave_1 entered promiscuous mode
[   52.999914][ T4168] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   53.011358][ T4168] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   53.021626][ T4168] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   53.030617][ T4168] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   53.049770][ T4168] bridge0: port 2(bridge_slave_1) entered blocking state
[   53.057829][ T4168] bridge0: port 2(bridge_slave_1) entered forwarding state
[   53.065566][ T4168] bridge0: port 1(bridge_slave_0) entered blocking state
[   53.073617][ T4168] bridge0: port 1(bridge_slave_0) entered forwarding state
[   53.111237][ T4168] 8021q: adding VLAN 0 to HW filter on device bond0
[   53.122901][  T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[   53.132678][  T155] bridge0: port 1(bridge_slave_0) entered disabled state
[   53.140982][  T155] bridge0: port 2(bridge_slave_1) entered disabled state
[   53.149792][  T155] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[   53.162427][ T4168] 8021q: adding VLAN 0 to HW filter on device team0
[   53.172619][  T155] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[   53.181976][  T155] bridge0: port 1(bridge_slave_0) entered blocking state
[   53.189205][  T155] bridge0: port 1(bridge_slave_0) entered forwarding state
[   53.201771][  T155] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[   53.210449][  T155] bridge0: port 2(bridge_slave_1) entered blocking state
[   53.217563][  T155] bridge0: port 2(bridge_slave_1) entered forwarding state
[   53.236060][  T155] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[   53.244812][  T155] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[   53.258907][  T155] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[   53.271634][  T155] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[   53.282554][  T155] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[   53.293442][ T4168] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[   53.310216][  T155] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[   53.318688][  T155] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[   53.331663][ T4168] 8021q: adding VLAN 0 to HW filter on device batadv0
[   53.351052][  T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[   53.370108][  T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[   53.378529][  T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[   53.386474][  T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[   53.397395][ T4168] device veth0_vlan entered promiscuous mode
[   53.408083][ T4168] device veth1_vlan entered promiscuous mode
[   53.424559][  T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[   53.433085][  T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[   53.441785][  T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[   53.452084][ T4168] device veth0_macvtap entered promiscuous mode
[   53.461414][ T4168] device veth1_macvtap entered promiscuous mode
[   53.476824][ T4168] batman_adv: batadv0: Interface activated: batadv_slave_0
[   53.484500][  T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[   53.495419][  T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[   53.506506][ T4168] batman_adv: batadv0: Interface activated: batadv_slave_1
[   53.515683][  T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
executing program
[   53.526060][ T4168] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   53.536017][ T4168] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   53.545492][ T4168] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   53.554897][ T4168] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
executing program
executing program
[   53.598737][ T4177] IPv6: ADDRCONF(NETDEV_CHANGE): bpq0: link becomes ready
[   53.631259][ T4179] ==================================================================
[   53.639429][ T4179] BUG: KASAN: use-after-free in ax25_fillin_cb+0x459/0x640
[   53.646641][ T4179] Read of size 4 at addr ffff8880195c9438 by task syz-executor891/4179
[   53.654870][ T4179] 
[   53.657183][ T4179] CPU: 1 PID: 4179 Comm: syz-executor891 Not tainted 5.15.185-syzkaller #0
[   53.665989][ T4179] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
[   53.676032][ T4179] Call Trace:
[   53.679411][ T4179]  <TASK>
[   53.682327][ T4179]  dump_stack_lvl+0x168/0x230
[   53.687098][ T4179]  ? show_regs_print_info+0x20/0x20
[   53.692297][ T4179]  ? _printk+0xcc/0x110
[   53.696468][ T4179]  ? ax25_fillin_cb+0x459/0x640
[   53.701440][ T4179]  ? load_image+0x3b0/0x3b0
[   53.706360][ T4179]  print_address_description+0x60/0x2d0
[   53.711998][ T4179]  ? ax25_fillin_cb+0x459/0x640
[   53.716846][ T4179]  kasan_report+0xdf/0x130
[   53.721469][ T4179]  ? ax25_fillin_cb+0x459/0x640
[   53.726450][ T4179]  ax25_fillin_cb+0x459/0x640
[   53.731123][ T4179]  ax25_setsockopt+0x8a2/0xa40
[   53.735879][ T4179]  ? ax25_shutdown+0x10/0x10
[   53.740578][ T4179]  ? aa_sock_opt_perm+0x74/0x100
[   53.745631][ T4179]  ? bpf_lsm_socket_setsockopt+0x5/0x10
[   53.751211][ T4179]  ? security_socket_setsockopt+0x7a/0xa0
[   53.756934][ T4179]  ? ax25_shutdown+0x10/0x10
[   53.761540][ T4179]  __sys_setsockopt+0x3d6/0x5e0
[   53.766849][ T4179]  ? __ia32_sys_recv+0xb0/0xb0
[   53.772337][ T4179]  ? lockdep_hardirqs_on_prepare+0x3fc/0x760
[   53.778433][ T4179]  ? lock_chain_count+0x20/0x20
[   53.784170][ T4179]  ? vtime_user_exit+0x2dc/0x400
[   53.789321][ T4179]  __x64_sys_setsockopt+0xb1/0xc0
[   53.794477][ T4179]  do_syscall_64+0x4c/0xa0
[   53.799189][ T4179]  ? clear_bhb_loop+0x30/0x80
[   53.804046][ T4179]  ? clear_bhb_loop+0x30/0x80
[   53.808938][ T4179]  entry_SYSCALL_64_after_hwframe+0x66/0xd0
[   53.815099][ T4179] RIP: 0033:0x7fedfe190619
[   53.819615][ T4179] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 31 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   53.839656][ T4179] RSP: 002b:00007ffc45c5c758 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[   53.848381][ T4179] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fedfe190619
[   53.856810][ T4179] RDX: 0000000000000019 RSI: 0000000000000101 RDI: 0000000000000006
[   53.866592][ T4179] RBP: 00007ffc45c5c790 R08: e5a01e6e238456fc R09: 0000000000000001
[   53.876393][ T4179] R10: 0000200000000000 R11: 0000000000000246 R12: 00000000000f4240
[   53.885077][ T4179] R13: 000000000000d143 R14: 00007ffc45c5c774 R15: 00007ffc45c5c780
[   53.893375][ T4179]  </TASK>
[   53.896717][ T4179] 
[   53.899216][ T4179] Allocated by task 4177:
[   53.903756][ T4179]  __kasan_kmalloc+0xb5/0xf0
[   53.908446][ T4179]  ax25_dev_device_up+0x50/0x580
[   53.913450][ T4179]  ax25_device_event+0x483/0x4f0
[   53.918369][ T4179]  raw_notifier_call_chain+0xcb/0x160
[   53.923728][ T4179]  __dev_notify_flags+0x178/0x2d0
[   53.928776][ T4179]  dev_change_flags+0xe3/0x1a0
[   53.933513][ T4179]  dev_ifsioc+0x147/0xe70
[   53.937819][ T4179]  dev_ioctl+0x55f/0xe50
[   53.942079][ T4179]  sock_do_ioctl+0x222/0x2f0
[   53.947117][ T4179]  sock_ioctl+0x4ed/0x6e0
[   53.952073][ T4179]  __se_sys_ioctl+0xfa/0x170
[   53.956717][ T4179]  do_syscall_64+0x4c/0xa0
[   53.962297][ T4179]  entry_SYSCALL_64_after_hwframe+0x66/0xd0
[   53.969809][ T4179] 
[   53.972124][ T4179] Freed by task 4178:
[   53.976324][ T4179]  kasan_set_track+0x4b/0x70
[   53.981818][ T4179]  kasan_set_free_info+0x1f/0x40
[   53.987002][ T4179]  ____kasan_slab_free+0xd5/0x110
[   53.992216][ T4179]  slab_free_freelist_hook+0xea/0x170
[   53.997682][ T4179]  kfree+0xef/0x2a0
[   54.001492][ T4179]  ax25_release+0x661/0x870
[   54.005974][ T4179]  sock_close+0xd5/0x240
[   54.010725][ T4179]  __fput+0x234/0x930
[   54.015153][ T4179]  task_work_run+0x125/0x1a0
[   54.019851][ T4179]  exit_to_user_mode_loop+0x10f/0x130
[   54.026339][ T4179]  exit_to_user_mode_prepare+0xb1/0x140
[   54.033586][ T4179]  syscall_exit_to_user_mode+0x16/0x40
[   54.043085][ T4179]  do_syscall_64+0x58/0xa0
[   54.049326][ T4179]  entry_SYSCALL_64_after_hwframe+0x66/0xd0
[   54.056607][ T4179] 
[   54.059148][ T4179] The buggy address belongs to the object at ffff8880195c9400
[   54.059148][ T4179]  which belongs to the cache kmalloc-192 of size 192
[   54.073542][ T4179] The buggy address is located 56 bytes inside of
[   54.073542][ T4179]  192-byte region [ffff8880195c9400, ffff8880195c94c0)
[   54.087050][ T4179] The buggy address belongs to the page:
[   54.092947][ T4179] page:ffffea0000657240 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x195c9
[   54.103272][ T4179] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
[   54.110904][ T4179] raw: 00fff00000000200 dead000000000100 dead000000000122 ffff888016841a00
[   54.120429][ T4179] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[   54.129211][ T4179] page dumped because: kasan: bad access detected
[   54.135717][ T4179] page_owner tracks the page as allocated
[   54.148623][ T4179] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 2111718525, free_ts 0
[   54.164516][ T4179]  get_page_from_freelist+0x1b77/0x1c60
[   54.170066][ T4179]  __alloc_pages+0x1e1/0x470
[   54.174815][ T4179]  alloc_page_interleave+0x24/0x1e0
[   54.180003][ T4179]  new_slab+0xc0/0x4b0
[   54.184175][ T4179]  ___slab_alloc+0x81e/0xdf0
[   54.189089][ T4179]  kmem_cache_alloc_trace+0x1a5/0x2a0
[   54.194544][ T4179]  call_usermodehelper_setup+0x8a/0x260
[   54.200576][ T4179]  kobject_uevent_env+0x65e/0x890
[   54.206175][ T4179]  kernel_add_sysfs_param+0xfb/0x120
[   54.211820][ T4179]  param_sysfs_builtin+0x164/0x1e0
[   54.217116][ T4179]  param_sysfs_init+0x66/0x70
[   54.222018][ T4179]  do_one_initcall+0x1ee/0x680
[   54.227003][ T4179]  do_initcall_level+0x137/0x1f0
[   54.232111][ T4179]  do_initcalls+0x4b/0x90
[   54.236869][ T4179]  kernel_init_freeable+0x3ce/0x560
[   54.242162][ T4179]  kernel_init+0x19/0x1b0
[   54.246808][ T4179] page_owner free stack trace missing
[   54.252252][ T4179] 
[   54.254654][ T4179] Memory state around the buggy address:
[   54.260584][ T4179]  ffff8880195c9300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   54.268819][ T4179]  ffff8880195c9380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   54.276873][ T4179] >ffff8880195c9400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   54.285002][ T4179]                                         ^
[   54.290966][ T4179]  ffff8880195c9480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   54.299037][ T4179]  ffff8880195c9500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   54.307083][ T4179] ==================================================================
[   54.315224][ T4179] Disabling lock debugging due to kernel taint
[   54.323212][ T4179] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   54.330529][ T4179] CPU: 0 PID: 4179 Comm: syz-executor891 Tainted: G    B             5.15.185-syzkaller #0
[   54.340785][ T4179] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
[   54.351299][ T4179] Call Trace:
[   54.354577][ T4179]  <TASK>
[   54.357522][ T4179]  dump_stack_lvl+0x168/0x230
[   54.362304][ T4179]  ? show_regs_print_info+0x20/0x20
[   54.367510][ T4179]  ? load_image+0x3b0/0x3b0
[   54.372417][ T4179]  panic+0x2c9/0x7f0
[   54.376575][ T4179]  ? bpf_jit_dump+0xd0/0xd0
[   54.381531][ T4179]  ? _raw_spin_unlock_irqrestore+0xf6/0x100
[   54.388829][ T4179]  ? _raw_spin_unlock+0x40/0x40
[   54.393777][ T4179]  ? print_memory_metadata+0x314/0x400
[   54.399518][ T4179]  ? ax25_fillin_cb+0x459/0x640
[   54.404392][ T4179]  check_panic_on_warn+0x80/0xa0
[   54.409761][ T4179]  ? ax25_fillin_cb+0x459/0x640
[   54.414628][ T4179]  end_report+0x6d/0xf0
[   54.418820][ T4179]  kasan_report+0x102/0x130
[   54.423430][ T4179]  ? ax25_fillin_cb+0x459/0x640
[   54.428807][ T4179]  ax25_fillin_cb+0x459/0x640
[   54.434186][ T4179]  ax25_setsockopt+0x8a2/0xa40
[   54.439303][ T4179]  ? ax25_shutdown+0x10/0x10
[   54.444857][ T4179]  ? aa_sock_opt_perm+0x74/0x100
[   54.451726][ T4179]  ? bpf_lsm_socket_setsockopt+0x5/0x10
[   54.458151][ T4179]  ? security_socket_setsockopt+0x7a/0xa0
[   54.464171][ T4179]  ? ax25_shutdown+0x10/0x10
[   54.469729][ T4179]  __sys_setsockopt+0x3d6/0x5e0
[   54.475817][ T4179]  ? __ia32_sys_recv+0xb0/0xb0
[   54.481466][ T4179]  ? lockdep_hardirqs_on_prepare+0x3fc/0x760
[   54.488021][ T4179]  ? lock_chain_count+0x20/0x20
[   54.493795][ T4179]  ? vtime_user_exit+0x2dc/0x400
[   54.499827][ T4179]  __x64_sys_setsockopt+0xb1/0xc0
[   54.505503][ T4179]  do_syscall_64+0x4c/0xa0
[   54.510772][ T4179]  ? clear_bhb_loop+0x30/0x80
[   54.515452][ T4179]  ? clear_bhb_loop+0x30/0x80
[   54.520548][ T4179]  entry_SYSCALL_64_after_hwframe+0x66/0xd0
[   54.526713][ T4179] RIP: 0033:0x7fedfe190619
[   54.531155][ T4179] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 31 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   54.551581][ T4179] RSP: 002b:00007ffc45c5c758 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[   54.560524][ T4179] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fedfe190619
[   54.569587][ T4179] RDX: 0000000000000019 RSI: 0000000000000101 RDI: 0000000000000006
[   54.577667][ T4179] RBP: 00007ffc45c5c790 R08: e5a01e6e238456fc R09: 0000000000000001
[   54.586607][ T4179] R10: 0000200000000000 R11: 0000000000000246 R12: 00000000000f4240
[   54.595467][ T4179] R13: 000000000000d143 R14: 00007ffc45c5c774 R15: 00007ffc45c5c780
[   54.603774][ T4179]  </TASK>
[   54.607543][ T4179] Kernel Offset: disabled
[   54.613037][ T4179] Rebooting in 86400 seconds..