[ 81.647406][ T7] cfg80211: failed to load regulatory.db
Warning: Permanently added '10.128.1.73' (ED25519) to the list of known hosts.
2026/10/14 08:46:08 parsed 1 programs
2026/10/14 08:46:08 serving rpc on tcp://41623
Setting up swapspace version 1, size = 127995904 bytes
[ 91.883599][ T4491] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS
[ 93.937622][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 93.950299][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 93.968469][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 93.986571][ T4315] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 93.994436][ T4315] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 94.002996][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 96.692911][ T4668] chnl_net:caif_netlink_parms(): no params data found
[ 96.731701][ T4668] bridge0: port 1(bridge_slave_0) entered blocking state
[ 96.738888][ T4668] bridge0: port 1(bridge_slave_0) entered disabled state
[ 96.747239][ T4668] device bridge_slave_0 entered promiscuous mode
[ 96.754960][ T4668] bridge0: port 2(bridge_slave_1) entered blocking state
[ 96.762144][ T4668] bridge0: port 2(bridge_slave_1) entered disabled state
[ 96.770467][ T4668] device bridge_slave_1 entered promiscuous mode
[ 96.788759][ T4668] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 96.799845][ T4668] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 96.819737][ T4668] team0: Port device team_slave_0 added
[ 96.827735][ T4668] team0: Port device team_slave_1 added
[ 96.843519][ T4668] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 96.851552][ T4668] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 96.877721][ T4668] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 96.889579][ T4668] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 96.896737][ T4668] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 96.923301][ T4668] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 96.950638][ T4668] device hsr_slave_0 entered promiscuous mode
[ 96.958573][ T4668] device hsr_slave_1 entered promiscuous mode
[ 97.523305][ T4668] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 97.534150][ T4668] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 97.549866][ T4668] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 97.587838][ T4668] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 97.701945][ T4668] 8021q: adding VLAN 0 to HW filter on device bond0
[ 97.737990][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 97.746378][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 97.757622][ T4668] 8021q: adding VLAN 0 to HW filter on device team0
[ 97.768508][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 97.785594][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 97.802756][ T4315] bridge0: port 1(bridge_slave_0) entered blocking state
[ 97.809880][ T4315] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 97.821328][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 97.847215][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 97.859418][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 97.869624][ T4315] bridge0: port 2(bridge_slave_1) entered blocking state
[ 97.876843][ T4315] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 97.903800][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 97.922539][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 97.934627][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 97.947698][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 97.957223][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 97.966683][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 97.982929][ T4668] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[ 97.993630][ T4668] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 98.018958][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 98.029515][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 98.041376][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 98.051158][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 98.060134][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 98.122246][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 98.226916][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 98.234385][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 98.255780][ T4668] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 98.283331][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 98.295971][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 98.326563][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 98.358725][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 98.375970][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 98.395366][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 98.407809][ T4668] device veth0_vlan entered promiscuous mode
[ 98.429382][ T4668] device veth1_vlan entered promiscuous mode
[ 98.470603][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 98.485827][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 98.505858][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 98.514790][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 98.528116][ T4668] device veth0_macvtap entered promiscuous mode
[ 98.541413][ T4668] device veth1_macvtap entered promiscuous mode
[ 98.581034][ T4668] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 98.597291][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 98.617274][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 98.626266][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 98.636593][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 98.649510][ T4668] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 98.670262][ T4668] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 98.695854][ T4668] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 98.704601][ T4668] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 98.725058][ T4668] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 98.745855][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 98.761892][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
2026/10/14 08:46:20 executed programs: 0
[ 100.628555][ T9] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 100.722042][ T4801] chnl_net:caif_netlink_parms(): no params data found
[ 100.785453][ T4801] bridge0: port 1(bridge_slave_0) entered blocking state
[ 100.792686][ T4801] bridge0: port 1(bridge_slave_0) entered disabled state
[ 100.801563][ T4801] device bridge_slave_0 entered promiscuous mode
[ 100.812968][ T4801] bridge0: port 2(bridge_slave_1) entered blocking state
[ 100.821570][ T4801] bridge0: port 2(bridge_slave_1) entered disabled state
[ 100.832487][ T4801] device bridge_slave_1 entered promiscuous mode
[ 100.862298][ T4801] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 100.876384][ T4801] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 100.907087][ T4801] team0: Port device team_slave_0 added
[ 100.915941][ T4801] team0: Port device team_slave_1 added
[ 100.938118][ T4801] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 100.946944][ T4801] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 100.973569][ T4801] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 100.986925][ T4801] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 100.993892][ T4801] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 101.021108][ T4801] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 101.058653][ T4801] device hsr_slave_0 entered promiscuous mode
[ 101.067330][ T4801] device hsr_slave_1 entered promiscuous mode
[ 101.073968][ T4801] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 101.082259][ T4801] Cannot create hsr debugfs directory
[ 102.605216][ T7] Bluetooth: hci0: command 0x0409 tx timeout
[ 103.801430][ T9] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 103.852688][ T9] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 103.913864][ T9] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 104.685170][ T7] Bluetooth: hci0: command 0x041b tx timeout
[ 104.732490][ T4801] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 104.741170][ T4801] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 104.750707][ T4801] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 104.760071][ T4801] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 104.831678][ T4801] 8021q: adding VLAN 0 to HW filter on device bond0
[ 104.844347][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 104.853138][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 104.863619][ T4801] 8021q: adding VLAN 0 to HW filter on device team0
[ 104.884781][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 104.894211][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 104.902954][ T144] bridge0: port 1(bridge_slave_0) entered blocking state
[ 104.910145][ T144] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 104.918952][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 104.941112][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 104.949863][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 104.958888][ T144] bridge0: port 2(bridge_slave_1) entered blocking state
[ 104.965997][ T144] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 104.977461][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 104.990193][ T9] device hsr_slave_0 left promiscuous mode
[ 104.998145][ T9] device hsr_slave_1 left promiscuous mode
[ 105.004336][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 105.012304][ T9] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 105.020226][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 105.028081][ T9] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 105.035990][ T9] device bridge_slave_1 left promiscuous mode
[ 105.042372][ T9] bridge0: port 2(bridge_slave_1) entered disabled state
[ 105.051757][ T9] device bridge_slave_0 left promiscuous mode
[ 105.058159][ T9] bridge0: port 1(bridge_slave_0) entered disabled state
[ 105.069179][ T9] device veth1_macvtap left promiscuous mode
[ 105.075313][ T9] device veth0_macvtap left promiscuous mode
[ 105.081348][ T9] device veth1_vlan left promiscuous mode
[ 105.087360][ T9] device veth0_vlan left promiscuous mode
[ 105.223404][ T9] team0 (unregistering): Port device team_slave_1 removed
[ 105.236651][ T9] team0 (unregistering): Port device team_slave_0 removed
[ 105.253738][ T9] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 105.267553][ T9] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 105.319492][ T9] bond0 (unregistering): Released all slaves
[ 105.342839][ T4801] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[ 105.353939][ T4801] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 105.367925][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 105.377799][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 105.387726][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 105.396788][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 105.405818][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 105.414173][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 105.423859][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 105.432643][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 105.441210][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 105.449500][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 105.457443][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 105.565581][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 105.573026][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 105.586442][ T4801] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 105.603321][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 105.611947][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 105.635587][ T4801] device veth0_vlan entered promiscuous mode
[ 105.650888][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 105.659337][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 105.667948][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 105.675894][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 105.685339][ T4801] device veth1_vlan entered promiscuous mode
[ 105.702631][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 105.711739][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 105.719883][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 105.728746][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 105.739728][ T4801] device veth0_macvtap entered promiscuous mode
[ 105.749356][ T4801] device veth1_macvtap entered promiscuous mode
[ 105.762862][ T4801] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 105.770474][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 105.780559][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 105.788651][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 105.797583][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 105.811498][ T4801] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 105.822622][ T4801] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 105.831476][ T4801] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 105.840401][ T4801] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 105.850030][ T4801] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 105.859939][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 105.869457][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 105.932653][ T4315] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 105.956476][ T4315] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
2026/10/14 08:46:25 executed programs: 2
[ 105.978933][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 105.996793][ T145] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 106.004652][ T145] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 106.013576][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 106.091369][ T5057] syz.0.17 uses obsolete (PF_INET,SOCK_PACKET)
[ 106.776713][ T7] Bluetooth: hci0: command 0x040f tx timeout
[ 108.627251][ T5059] ==================================================================
[ 108.635486][ T5059] BUG: KASAN: use-after-free in tcf_ct_act+0x361f/0x3b40
[ 108.642512][ T5059] Write of size 4 at addr ffff8880266eb094 by task syz.0.18/5059
[ 108.650220][ T5059]
[ 108.652537][ T5059] CPU: 1 PID: 5059 Comm: syz.0.18 Not tainted syzkaller #0
[ 108.659718][ T5059] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[ 108.669773][ T5059] Call Trace:
[ 108.673044][ T5059]
[ 108.675968][ T5059] dump_stack_lvl+0x188/0x250
[ 108.680643][ T5059] ? show_regs_print_info+0x20/0x20
[ 108.685834][ T5059] ? load_image+0x410/0x410
[ 108.690329][ T5059] ? _raw_spin_lock_irqsave+0xbc/0x100
[ 108.695779][ T5059] ? ipv6_defrag+0x3a0/0x3a0
[ 108.700358][ T5059] print_address_description+0x60/0x2d0
[ 108.705901][ T5059] ? tcf_ct_act+0x361f/0x3b40
[ 108.710563][ T5059] kasan_report+0xdf/0x130
[ 108.714985][ T5059] ? tcf_ct_act+0x361f/0x3b40
[ 108.719667][ T5059] tcf_ct_act+0x361f/0x3b40
[ 108.724168][ T5059] ? mark_lock+0x94/0x320
[ 108.728486][ T5059] ? tunnel_key_exit_net+0x100/0x100
[ 108.733896][ T5059] ? __lock_acquire+0x13b3/0x7d40
[ 108.738947][ T5059] ? rcu_lockdep_current_cpu_online+0x35/0x130
[ 108.745107][ T5059] ? rcu_read_lock_held+0x40/0x40
[ 108.750149][ T5059] tcf_action_exec+0x177/0x570
[ 108.754914][ T5059] tcf_classify+0x218/0xad0
[ 108.759422][ T5059] __netif_receive_skb_core+0x1cd8/0x3670
[ 108.765144][ T5059] ? set_rps_cpu+0x660/0x660
[ 108.769727][ T5059] ? ktime_get_with_offset+0xff/0x320
[ 108.775106][ T5059] ? read_lock_is_recursive+0x10/0x10
[ 108.780475][ T5059] ? lock_chain_count+0x20/0x20
[ 108.785414][ T5059] ? do_user_addr_fault+0x69f/0xc90
[ 108.790640][ T5059] __netif_receive_skb+0x74/0x290
[ 108.795660][ T5059] ? ktime_get_with_offset+0x2d7/0x320
[ 108.801114][ T5059] netif_receive_skb+0x19e/0x700
[ 108.806078][ T5059] ? __bpf_trace_softirq+0x10/0x10
[ 108.811179][ T5059] ? netif_receive_skb_core+0x210/0x210
[ 108.816729][ T5059] tun_rx_batched+0x606/0x760
[ 108.821395][ T5059] ? lockdep_hardirqs_on_prepare+0x7c0/0x7c0
[ 108.827365][ T5059] ? local_bh_enable+0x20/0x20
[ 108.832130][ T5059] ? __local_bh_enable_ip+0x136/0x1c0
[ 108.837565][ T5059] ? read_lock_is_recursive+0x10/0x10
[ 108.842953][ T5059] ? __local_bh_enable_ip+0x136/0x1c0
[ 108.848324][ T5059] ? _local_bh_enable+0xa0/0xa0
[ 108.853188][ T5059] tun_get_user+0x2bf4/0x3b10
[ 108.857891][ T5059] ? tun_ring_recv+0xc90/0xc90
[ 108.862671][ T5059] ? rcu_lock_release+0x5/0x20
[ 108.867431][ T5059] ? __lock_acquire+0x7d40/0x7d40
[ 108.872461][ T5059] tun_chr_write_iter+0x112/0x1e0
[ 108.877481][ T5059] vfs_write+0x748/0xd70
[ 108.881730][ T5059] ? file_end_write+0x250/0x250
[ 108.885428][ T4309] Bluetooth: hci0: command 0x0419 tx timeout
[ 108.886603][ T5059] ? __fget_files+0x402/0x470
[ 108.897269][ T5059] ? __fdget_pos+0x1e2/0x370
[ 108.901919][ T5059] ? ksys_write+0x70/0x260
[ 108.906332][ T5059] ksys_write+0x153/0x260
[ 108.910664][ T5059] ? __ia32_sys_read+0x80/0x80
[ 108.915419][ T5059] ? lockdep_hardirqs_on+0x94/0x140
[ 108.920609][ T5059] do_syscall_64+0x4c/0xa0
[ 108.925023][ T5059] ? clear_bhb_loop+0x30/0x80
[ 108.929700][ T5059] ? clear_bhb_loop+0x30/0x80
[ 108.934366][ T5059] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 108.940251][ T5059] RIP: 0033:0x7f2b3bfe6159
[ 108.944655][ T5059] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 108.964246][ T5059] RSP: 002b:00007f2b3b646028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 108.972653][ T5059] RAX: ffffffffffffffda RBX: 00007f2b3c26dfa0 RCX: 00007f2b3bfe6159
[ 108.980612][ T5059] RDX: 0000000000000fce RSI: 0000200000001280 RDI: 0000000000000003
[ 108.988582][ T5059] RBP: 00007f2b3c07d06b R08: 0000000000000000 R09: 0000000000000000
[ 108.996628][ T5059] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 109.004584][ T5059] R13: 00007f2b3c26e038 R14: 00007f2b3c26dfa0 R15: 00007ffd5fc4d958
[ 109.012551][ T5059]
[ 109.015559][ T5059]
[ 109.017869][ T5059] Allocated by task 5059:
[ 109.022176][ T5059] __kasan_slab_alloc+0x92/0xc0
[ 109.027013][ T5059] slab_post_alloc_hook+0x4c/0x380
[ 109.032107][ T5059] kmem_cache_alloc_node+0x184/0x2c0
[ 109.037382][ T5059] __alloc_skb+0xf4/0x750
[ 109.041700][ T5059] alloc_skb_with_frags+0xa7/0x720
[ 109.046800][ T5059] sock_alloc_send_pskb+0x87f/0x9a0
[ 109.051984][ T5059] tun_get_user+0x8f7/0x3b10
[ 109.056560][ T5059] tun_chr_write_iter+0x112/0x1e0
[ 109.061568][ T5059] vfs_write+0x748/0xd70
[ 109.065792][ T5059] ksys_write+0x153/0x260
[ 109.070111][ T5059] do_syscall_64+0x4c/0xa0
[ 109.074509][ T5059] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 109.080387][ T5059]
[ 109.082704][ T5059] Freed by task 5059:
[ 109.086688][ T5059] kasan_set_track+0x4b/0x70
[ 109.091284][ T5059] kasan_set_free_info+0x1f/0x40
[ 109.096219][ T5059] ____kasan_slab_free+0xd5/0x110
[ 109.101237][ T5059] slab_free_freelist_hook+0xec/0x170
[ 109.106623][ T5059] kmem_cache_free+0x8f/0x210
[ 109.111294][ T5059] nf_ct_frag6_gather+0x1002/0x1da0
[ 109.116502][ T5059] tcf_ct_act+0xc8d/0x3b40
[ 109.120920][ T5059] tcf_action_exec+0x177/0x570
[ 109.125670][ T5059] tcf_classify+0x218/0xad0
[ 109.130169][ T5059] __netif_receive_skb_core+0x1cd8/0x3670
[ 109.135902][ T5059] __netif_receive_skb+0x74/0x290
[ 109.140930][ T5059] netif_receive_skb+0x19e/0x700
[ 109.145855][ T5059] tun_rx_batched+0x606/0x760
[ 109.150519][ T5059] tun_get_user+0x2bf4/0x3b10
[ 109.155179][ T5059] tun_chr_write_iter+0x112/0x1e0
[ 109.160201][ T5059] vfs_write+0x748/0xd70
[ 109.164428][ T5059] ksys_write+0x153/0x260
[ 109.168740][ T5059] do_syscall_64+0x4c/0xa0
[ 109.173142][ T5059] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 109.179019][ T5059]
[ 109.181342][ T5059] The buggy address belongs to the object at ffff8880266eb000
[ 109.181342][ T5059] which belongs to the cache skbuff_head_cache of size 232
[ 109.195903][ T5059] The buggy address is located 148 bytes inside of
[ 109.195903][ T5059] 232-byte region [ffff8880266eb000, ffff8880266eb0e8)
[ 109.209165][ T5059] The buggy address belongs to the page:
[ 109.214784][ T5059] page:ffffea000099bac0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x266eb
[ 109.224921][ T5059] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 109.232455][ T5059] raw: 00fff00000000200 ffffea000096cd00 0000000800000008 ffff88801c7e4140
[ 109.241027][ T5059] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
[ 109.249593][ T5059] page dumped because: kasan: bad access detected
[ 109.255988][ T5059] page_owner tracks the page as allocated
[ 109.261685][ T5059] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 3559, ts 22413698607, free_ts 20062089383
[ 109.277730][ T5059] get_page_from_freelist+0x24f6/0x2670
[ 109.283265][ T5059] __alloc_pages+0x1ee/0x480
[ 109.287843][ T5059] new_slab+0xc0/0x4b0
[ 109.291899][ T5059] ___slab_alloc+0x807/0xdd0
[ 109.296474][ T5059] kmem_cache_alloc_node+0x118/0x2c0
[ 109.301741][ T5059] __alloc_skb+0xf4/0x750
[ 109.306098][ T5059] alloc_uevent_skb+0x7d/0x230
[ 109.310860][ T5059] kobject_uevent_net_broadcast+0x2e6/0x530
[ 109.316736][ T5059] kobject_uevent_env+0x550/0x890
[ 109.321742][ T5059] kobject_synth_uevent+0x457/0x940
[ 109.326939][ T5059] uevent_store+0x48/0x70
[ 109.331254][ T5059] kernfs_fop_write_iter+0x3a8/0x500
[ 109.336526][ T5059] vfs_write+0x748/0xd70
[ 109.340757][ T5059] ksys_write+0x153/0x260
[ 109.345072][ T5059] do_syscall_64+0x4c/0xa0
[ 109.349486][ T5059] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 109.355366][ T5059] page last free stack trace:
[ 109.360021][ T5059] free_unref_page_prepare+0x637/0x6c0
[ 109.365475][ T5059] free_unref_page+0x8f/0x2a0
[ 109.370143][ T5059] kasan_depopulate_vmalloc_pte+0x67/0x80
[ 109.375859][ T5059] __apply_to_page_range+0x987/0xd10
[ 109.381130][ T5059] kasan_release_vmalloc+0x93/0xb0
[ 109.386235][ T5059] __purge_vmap_area_lazy+0xaf6/0x1940
[ 109.391699][ T5059] _vm_unmap_aliases+0x40b/0x4a0
[ 109.396722][ T5059] change_page_attr_set_clr+0x317/0xc30
[ 109.402274][ T5059] set_memory_nx+0xd3/0x110
[ 109.406788][ T5059] free_initmem+0x8e/0xd0
[ 109.411119][ T5059] kernel_init+0x23/0x1b0
[ 109.415463][ T5059] ret_from_fork+0x1f/0x30
[ 109.419881][ T5059]
[ 109.422197][ T5059] Memory state around the buggy address:
[ 109.427813][ T5059] ffff8880266eaf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 109.435892][ T5059] ffff8880266eb000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 109.443942][ T5059] >ffff8880266eb080: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc
[ 109.451993][ T5059] ^
[ 109.456582][ T5059] ffff8880266eb100: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[ 109.464636][ T5059] ffff8880266eb180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 109.472695][ T5059] ==================================================================
[ 109.480755][ T5059] Disabling lock debugging due to kernel taint
[ 109.486951][ T5059] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 109.494144][ T5059] CPU: 1 PID: 5059 Comm: syz.0.18 Tainted: G B syzkaller #0
[ 109.502734][ T5059] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[ 109.512930][ T5059] Call Trace:
[ 109.516214][ T5059]
[ 109.519165][ T5059] dump_stack_lvl+0x188/0x250
[ 109.523932][ T5059] ? show_regs_print_info+0x20/0x20
[ 109.529121][ T5059] ? load_image+0x410/0x410
[ 109.533618][ T5059] panic+0x2f8/0x850
[ 109.537510][ T5059] ? bpf_jit_dump+0xd0/0xd0
[ 109.542007][ T5059] ? _raw_spin_unlock_irqrestore+0xbc/0x120
[ 109.547895][ T5059] ? _raw_spin_unlock_irqrestore+0xc1/0x120
[ 109.553785][ T5059] ? _raw_spin_unlock+0x40/0x40
[ 109.558656][ T5059] ? tcf_ct_act+0x361f/0x3b40
[ 109.563337][ T5059] check_panic_on_warn+0x80/0xa0
[ 109.568283][ T5059] ? tcf_ct_act+0x361f/0x3b40
[ 109.573038][ T5059] end_report+0x6d/0xf0
[ 109.577206][ T5059] kasan_report+0x102/0x130
[ 109.581721][ T5059] ? tcf_ct_act+0x361f/0x3b40
[ 109.586405][ T5059] tcf_ct_act+0x361f/0x3b40
[ 109.590912][ T5059] ? mark_lock+0x94/0x320
[ 109.595228][ T5059] ? tunnel_key_exit_net+0x100/0x100
[ 109.600501][ T5059] ? __lock_acquire+0x13b3/0x7d40
[ 109.605517][ T5059] ? rcu_lockdep_current_cpu_online+0x35/0x130
[ 109.611659][ T5059] ? rcu_read_lock_held+0x40/0x40
[ 109.616685][ T5059] tcf_action_exec+0x177/0x570
[ 109.621440][ T5059] tcf_classify+0x218/0xad0
[ 109.625933][ T5059] __netif_receive_skb_core+0x1cd8/0x3670
[ 109.631654][ T5059] ? set_rps_cpu+0x660/0x660
[ 109.636235][ T5059] ? ktime_get_with_offset+0xff/0x320
[ 109.641595][ T5059] ? read_lock_is_recursive+0x10/0x10
[ 109.646970][ T5059] ? lock_chain_count+0x20/0x20
[ 109.651807][ T5059] ? do_user_addr_fault+0x69f/0xc90
[ 109.656993][ T5059] __netif_receive_skb+0x74/0x290
[ 109.662007][ T5059] ? ktime_get_with_offset+0x2d7/0x320
[ 109.667452][ T5059] netif_receive_skb+0x19e/0x700
[ 109.672375][ T5059] ? __bpf_trace_softirq+0x10/0x10
[ 109.677472][ T5059] ? netif_receive_skb_core+0x210/0x210
[ 109.683012][ T5059] tun_rx_batched+0x606/0x760
[ 109.687708][ T5059] ? lockdep_hardirqs_on_prepare+0x7c0/0x7c0
[ 109.693686][ T5059] ? local_bh_enable+0x20/0x20
[ 109.698439][ T5059] ? __local_bh_enable_ip+0x136/0x1c0
[ 109.703800][ T5059] ? read_lock_is_recursive+0x10/0x10
[ 109.709168][ T5059] ? __local_bh_enable_ip+0x136/0x1c0
[ 109.714527][ T5059] ? _local_bh_enable+0xa0/0xa0
[ 109.719371][ T5059] tun_get_user+0x2bf4/0x3b10
[ 109.724057][ T5059] ? tun_ring_recv+0xc90/0xc90
[ 109.728809][ T5059] ? rcu_lock_release+0x5/0x20
[ 109.733650][ T5059] ? __lock_acquire+0x7d40/0x7d40
[ 109.738666][ T5059] tun_chr_write_iter+0x112/0x1e0
[ 109.743681][ T5059] vfs_write+0x748/0xd70
[ 109.747911][ T5059] ? file_end_write+0x250/0x250
[ 109.752762][ T5059] ? __fget_files+0x402/0x470
[ 109.757426][ T5059] ? __fdget_pos+0x1e2/0x370
[ 109.762003][ T5059] ? ksys_write+0x70/0x260
[ 109.766411][ T5059] ksys_write+0x153/0x260
[ 109.770729][ T5059] ? __ia32_sys_read+0x80/0x80
[ 109.775484][ T5059] ? lockdep_hardirqs_on+0x94/0x140
[ 109.780679][ T5059] do_syscall_64+0x4c/0xa0
[ 109.785111][ T5059] ? clear_bhb_loop+0x30/0x80
[ 109.789802][ T5059] ? clear_bhb_loop+0x30/0x80
[ 109.794482][ T5059] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 109.800378][ T5059] RIP: 0033:0x7f2b3bfe6159
[ 109.804804][ T5059] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 109.824578][ T5059] RSP: 002b:00007f2b3b646028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 109.832988][ T5059] RAX: ffffffffffffffda RBX: 00007f2b3c26dfa0 RCX: 00007f2b3bfe6159
[ 109.840957][ T5059] RDX: 0000000000000fce RSI: 0000200000001280 RDI: 0000000000000003
[ 109.848926][ T5059] RBP: 00007f2b3c07d06b R08: 0000000000000000 R09: 0000000000000000
[ 109.856896][ T5059] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 109.864853][ T5059] R13: 00007f2b3c26e038 R14: 00007f2b3c26dfa0 R15: 00007ffd5fc4d958
[ 109.872814][ T5059]
[ 109.876042][ T5059] Kernel Offset: disabled
[ 109.880364][ T5059] Rebooting in 86400 seconds..