[ 86.861864][ T1107] cfg80211: failed to load regulatory.db
Warning: Permanently added '10.128.0.251' (ED25519) to the list of known hosts.
2026/08/03 22:09:40 parsed 1 programs
[ 96.797289][ T4522] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS
[ 100.991518][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 100.999929][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 101.011428][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 101.031894][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 101.040586][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 101.048931][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 101.244419][ T4691] chnl_net:caif_netlink_parms(): no params data found
[ 101.285149][ T4691] bridge0: port 1(bridge_slave_0) entered blocking state
[ 101.293685][ T4691] bridge0: port 1(bridge_slave_0) entered disabled state
[ 101.302634][ T4691] device bridge_slave_0 entered promiscuous mode
[ 101.311697][ T4691] bridge0: port 2(bridge_slave_1) entered blocking state
[ 101.319853][ T4691] bridge0: port 2(bridge_slave_1) entered disabled state
[ 101.329120][ T4691] device bridge_slave_1 entered promiscuous mode
[ 101.362107][ T4691] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 101.373683][ T4691] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 101.396571][ T4691] team0: Port device team_slave_0 added
[ 101.404546][ T4691] team0: Port device team_slave_1 added
[ 101.422185][ T4691] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 101.429479][ T4691] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 101.457170][ T4691] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 101.470921][ T4691] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 101.478855][ T4691] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 101.505659][ T4691] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 101.547761][ T4691] device hsr_slave_0 entered promiscuous mode
[ 101.555254][ T4691] device hsr_slave_1 entered promiscuous mode
[ 102.123383][ T4691] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 102.135926][ T4691] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 102.165961][ T4691] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 102.177917][ T4691] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 102.284589][ T4691] 8021q: adding VLAN 0 to HW filter on device bond0
[ 102.297764][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 102.318482][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 102.332240][ T4691] 8021q: adding VLAN 0 to HW filter on device team0
[ 102.351923][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 102.370383][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 102.388313][ T154] bridge0: port 1(bridge_slave_0) entered blocking state
[ 102.396122][ T154] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 102.413213][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 102.433517][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 102.453509][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 102.476301][ T154] bridge0: port 2(bridge_slave_1) entered blocking state
[ 102.483744][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 102.495716][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 102.523363][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 102.551525][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 102.562481][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 102.575403][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 102.586142][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 102.604592][ T4691] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[ 102.617221][ T4691] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 102.632653][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 102.651508][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 102.671787][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 102.687002][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 102.701824][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 102.712440][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 102.929158][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 102.950231][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 102.967033][ T4691] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 102.991822][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 103.010434][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 103.050464][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 103.059952][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 103.080691][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 103.089193][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 103.111091][ T4691] device veth0_vlan entered promiscuous mode
[ 103.126511][ T4691] device veth1_vlan entered promiscuous mode
[ 103.172266][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 103.183907][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 103.212265][ T4691] device veth0_macvtap entered promiscuous mode
[ 103.233519][ T4691] device veth1_macvtap entered promiscuous mode
[ 103.265261][ T4691] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 103.280742][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 103.301210][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 103.315740][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 103.331856][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 103.353892][ T4691] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 103.371144][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 103.395916][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 103.410244][ T4691] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 103.419297][ T4691] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 103.437158][ T4691] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 103.446834][ T4691] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 104.155114][ T645] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2026/08/03 22:09:51 executed programs: 0
[ 104.490083][ T4806] chnl_net:caif_netlink_parms(): no params data found
[ 104.555026][ T4806] bridge0: port 1(bridge_slave_0) entered blocking state
[ 104.562999][ T4806] bridge0: port 1(bridge_slave_0) entered disabled state
[ 104.571557][ T4806] device bridge_slave_0 entered promiscuous mode
[ 104.580498][ T4806] bridge0: port 2(bridge_slave_1) entered blocking state
[ 104.587794][ T4806] bridge0: port 2(bridge_slave_1) entered disabled state
[ 104.596693][ T4806] device bridge_slave_1 entered promiscuous mode
[ 104.632732][ T4806] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 104.646570][ T4806] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 104.682746][ T4806] team0: Port device team_slave_0 added
[ 104.691350][ T4806] team0: Port device team_slave_1 added
[ 104.718312][ T4806] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 104.728758][ T4806] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 104.759179][ T4806] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 104.773558][ T4806] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 104.781960][ T4806] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 104.811243][ T4806] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 104.854041][ T4806] device hsr_slave_0 entered promiscuous mode
[ 104.861755][ T4806] device hsr_slave_1 entered promiscuous mode
[ 104.868708][ T4806] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 104.879537][ T4806] Cannot create hsr debugfs directory
[ 106.316302][ T645] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 106.379793][ T4258] Bluetooth: hci0: command 0x0409 tx timeout
[ 107.845318][ T645] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 107.896504][ T645] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 108.470254][ T4258] Bluetooth: hci0: command 0x041b tx timeout
[ 108.793331][ T4806] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 108.804618][ T4806] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 108.826235][ T4806] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 108.841417][ T4806] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 108.936947][ T4806] 8021q: adding VLAN 0 to HW filter on device bond0
[ 108.959297][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 108.976641][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 108.993543][ T645] device hsr_slave_0 left promiscuous mode
[ 109.004173][ T645] device hsr_slave_1 left promiscuous mode
[ 109.014522][ T645] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 109.022566][ T645] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 109.033677][ T645] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 109.042304][ T645] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 109.053186][ T645] device bridge_slave_1 left promiscuous mode
[ 109.062322][ T645] bridge0: port 2(bridge_slave_1) entered disabled state
[ 109.072238][ T645] device bridge_slave_0 left promiscuous mode
[ 109.083653][ T645] bridge0: port 1(bridge_slave_0) entered disabled state
[ 109.102291][ T645] device veth1_macvtap left promiscuous mode
[ 109.111564][ T645] device veth0_macvtap left promiscuous mode
[ 109.120225][ T645] device veth1_vlan left promiscuous mode
[ 109.129940][ T645] device veth0_vlan left promiscuous mode
[ 109.334724][ T645] team0 (unregistering): Port device team_slave_1 removed
[ 109.352306][ T645] team0 (unregistering): Port device team_slave_0 removed
[ 109.370708][ T645] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 109.394138][ T645] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 109.456239][ T645] bond0 (unregistering): Released all slaves
[ 109.509368][ T4806] 8021q: adding VLAN 0 to HW filter on device team0
[ 109.524873][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 109.534560][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 109.543777][ T9] bridge0: port 1(bridge_slave_0) entered blocking state
[ 109.552887][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 109.564521][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 109.573321][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 109.583367][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 109.592732][ T9] bridge0: port 2(bridge_slave_1) entered blocking state
[ 109.602626][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 109.617283][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 109.653059][ T4806] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[ 109.671111][ T4806] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 109.686076][ T4247] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 109.696422][ T4247] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 109.706320][ T4247] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 109.715866][ T4247] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 109.726050][ T4247] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 109.735895][ T4247] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 109.748940][ T4247] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 109.759392][ T4247] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 109.768759][ T4247] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 109.778527][ T4247] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 109.786951][ T4247] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 109.891530][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 109.899435][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 109.911332][ T4806] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 109.929258][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 109.938137][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 109.959471][ T4806] device veth0_vlan entered promiscuous mode
[ 109.967244][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 109.976188][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 109.990171][ T4806] device veth1_vlan entered promiscuous mode
[ 109.997325][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 110.006694][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 110.015948][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 110.046265][ T4806] device veth0_macvtap entered promiscuous mode
[ 110.055534][ T4247] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 110.067591][ T4247] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 110.076756][ T4247] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 110.087589][ T4247] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 110.100655][ T4806] device veth1_macvtap entered promiscuous mode
[ 110.119421][ T4806] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 110.128197][ T4247] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 110.139373][ T4247] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 110.149329][ T4247] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 110.165082][ T4806] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 110.175365][ T4247] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 110.187506][ T4247] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 110.203339][ T4806] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 110.213938][ T4806] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 110.226298][ T4806] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 110.236712][ T4806] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 110.324512][ T4247] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 110.345329][ T4247] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
2026/08/03 22:09:57 executed programs: 2
[ 110.369167][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 110.385689][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 110.395050][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 110.404227][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 110.540336][ T4258] Bluetooth: hci0: command 0x040f tx timeout
[ 112.620069][ T4673] Bluetooth: hci0: command 0x0419 tx timeout
2026/08/03 22:10:02 executed programs: 8
[ 116.467625][ T645] ==================================================================
[ 116.476290][ T645] BUG: KASAN: use-after-free in __lock_acquire+0x107/0x7b50
[ 116.483846][ T645] Read of size 8 at addr ffff88807b46cba0 by task kworker/u4:3/645
[ 116.492135][ T645]
[ 116.494477][ T645] CPU: 1 PID: 645 Comm: kworker/u4:3 Not tainted syzkaller #0
[ 116.502193][ T645] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 116.512690][ T645] Workqueue: kkcmd kcm_tx_work
[ 116.517557][ T645] Call Trace:
[ 116.521760][ T645]
[ 116.525017][ T645] dump_stack_lvl+0x188/0x250
[ 116.530062][ T645] ? show_regs_print_info+0x20/0x20
[ 116.535575][ T645] ? load_image+0x410/0x410
[ 116.540171][ T645] ? _raw_spin_lock_irqsave+0xbc/0x100
[ 116.545978][ T645] print_address_description+0x60/0x2d0
[ 116.552189][ T645] ? __lock_acquire+0x107/0x7b50
[ 116.557221][ T645] kasan_report+0xdf/0x130
[ 116.562167][ T645] ? __lock_acquire+0x107/0x7b50
[ 116.567219][ T645] __lock_acquire+0x107/0x7b50
[ 116.571994][ T645] ? lockdep_hardirqs_on_prepare+0x448/0x7c0
[ 116.578256][ T645] ? __lock_acquire+0x7b50/0x7b50
[ 116.583279][ T645] ? lock_chain_count+0x20/0x20
[ 116.588466][ T645] ? finish_lock_switch+0x12d/0x290
[ 116.593736][ T645] ? finish_lock_switch+0x12d/0x290
[ 116.599348][ T645] ? verify_lock_unused+0x140/0x140
[ 116.604986][ T645] ? finish_task_switch+0x12f/0x650
[ 116.610587][ T645] ? __schedule+0x11cb/0x4350
[ 116.615808][ T645] lock_acquire+0x19e/0x400
[ 116.620506][ T645] ? __lock_sock+0x166/0x2b0
[ 116.625343][ T645] ? lockdep_hardirqs_on_prepare+0x7c0/0x7c0
[ 116.631451][ T645] ? __local_bh_disable_ip+0x111/0x1a0
[ 116.637533][ T645] ? read_lock_is_recursive+0x10/0x10
[ 116.643196][ T645] ? __local_bh_enable_ip+0x136/0x1c0
[ 116.648760][ T645] ? kthread_data+0x4b/0xc0
[ 116.653346][ T645] ? kthread_data+0x4b/0xc0
[ 116.658139][ T645] ? __lock_sock+0x166/0x2b0
[ 116.662893][ T645] _raw_spin_lock_bh+0x32/0x50
[ 116.668082][ T645] ? __lock_sock+0x166/0x2b0
[ 116.673053][ T645] __lock_sock+0x166/0x2b0
[ 116.678024][ T645] ? sk_page_frag_refill+0x200/0x200
[ 116.684009][ T645] ? do_raw_spin_lock+0x128/0x2f0
[ 116.689060][ T645] ? init_wait_entry+0xd0/0xd0
[ 116.695172][ T645] ? __rwlock_init+0x140/0x140
[ 116.701083][ T645] ? lockdep_hardirqs_on_prepare+0x448/0x7c0
[ 116.707173][ T645] ? __lock_acquire+0x7b50/0x7b50
[ 116.712447][ T645] ? lock_sock_nested+0x68/0x100
[ 116.718050][ T645] lock_sock_nested+0x9d/0x100
[ 116.724672][ T645] kcm_tx_work+0x2d/0x180
[ 116.729712][ T645] process_one_work+0x867/0xff0
[ 116.735779][ T645] ? worker_detach_from_pool+0x240/0x240
[ 116.742788][ T645] ? lockdep_hardirqs_off+0x70/0x100
[ 116.748716][ T645] ? _raw_spin_lock_irq+0xb7/0xf0
[ 116.753746][ T645] ? _raw_spin_lock_irqsave+0x100/0x100
[ 116.759574][ T645] ? wq_worker_running+0x97/0x170
[ 116.765706][ T645] worker_thread+0xad7/0x12a0
[ 116.771599][ T645] ? _raw_spin_unlock_irqrestore+0xc1/0x120
[ 116.777689][ T645] kthread+0x42e/0x520
[ 116.782996][ T645] ? rcu_lock_release+0x20/0x20
[ 116.788662][ T645] ? kthread_blkcg+0xd0/0xd0
[ 116.794322][ T645] ret_from_fork+0x1f/0x30
[ 116.800756][ T645]
[ 116.804322][ T645]
[ 116.807082][ T645] Allocated by task 5135:
[ 116.811795][ T645] __kasan_slab_alloc+0x92/0xc0
[ 116.817034][ T645] slab_post_alloc_hook+0x4c/0x380
[ 116.822764][ T645] kmem_cache_alloc+0x15d/0x280
[ 116.828741][ T645] sk_prot_alloc+0x57/0x210
[ 116.833431][ T645] sk_alloc+0x2f/0x310
[ 116.838030][ T645] kcm_ioctl+0x20f/0xfd0
[ 116.842476][ T645] sock_do_ioctl+0xfb/0x320
[ 116.847142][ T645] sock_ioctl+0x48a/0x700
[ 116.851862][ T645] __se_sys_ioctl+0xfa/0x170
[ 116.856839][ T645] do_syscall_64+0x4c/0xa0
[ 116.861333][ T645] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 116.867422][ T645]
[ 116.870438][ T645] Freed by task 5136:
[ 116.874490][ T645] kasan_set_track+0x4b/0x70
[ 116.879261][ T645] kasan_set_free_info+0x1f/0x40
[ 116.884288][ T645] ____kasan_slab_free+0xd5/0x110
[ 116.890437][ T645] slab_free_freelist_hook+0xec/0x170
[ 116.895974][ T645] kmem_cache_free+0x8f/0x210
[ 116.900764][ T645] __sk_destruct+0x571/0x840
[ 116.905721][ T645] kcm_release+0x504/0x590
[ 116.910344][ T645] sock_close+0xbf/0x210
[ 116.914860][ T645] __fput+0x212/0x8c0
[ 116.919246][ T645] task_work_run+0x125/0x1a0
[ 116.924307][ T645] exit_to_user_mode_loop+0x10f/0x130
[ 116.930291][ T645] exit_to_user_mode_prepare+0xee/0x180
[ 116.936412][ T645] syscall_exit_to_user_mode+0x16/0x40
[ 116.942215][ T645] do_syscall_64+0x58/0xa0
[ 116.947074][ T645] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 116.953149][ T645]
[ 116.955747][ T645] Last potentially related work creation:
[ 116.961690][ T645] kasan_save_stack+0x35/0x60
[ 116.966895][ T645] kasan_record_aux_stack+0xb8/0x100
[ 116.972280][ T645] insert_work+0x54/0x3d0
[ 116.976688][ T645] __queue_work+0x90b/0xc80
[ 116.981265][ T645] queue_work_on+0x124/0x1f0
[ 116.985979][ T645] kcm_unattach+0x89a/0xef0
[ 116.990654][ T645] kcm_ioctl+0x749/0xfd0
[ 116.995017][ T645] sock_do_ioctl+0xfb/0x320
[ 117.000453][ T645] sock_ioctl+0x48a/0x700
[ 117.004951][ T645] __se_sys_ioctl+0xfa/0x170
[ 117.009863][ T645] do_syscall_64+0x4c/0xa0
[ 117.014371][ T645] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 117.020812][ T645]
[ 117.023401][ T645] Second to last potentially related work creation:
[ 117.030152][ T645] kasan_save_stack+0x35/0x60
[ 117.035357][ T645] kasan_record_aux_stack+0xb8/0x100
[ 117.041009][ T645] insert_work+0x54/0x3d0
[ 117.045328][ T645] __queue_work+0x90b/0xc80
[ 117.049995][ T645] queue_work_on+0x124/0x1f0
[ 117.054568][ T645] kcm_ioctl+0xe32/0xfd0
[ 117.058803][ T645] sock_do_ioctl+0xfb/0x320
[ 117.063293][ T645] sock_ioctl+0x48a/0x700
[ 117.067632][ T645] __se_sys_ioctl+0xfa/0x170
[ 117.072212][ T645] do_syscall_64+0x4c/0xa0
[ 117.076701][ T645] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 117.082930][ T645]
[ 117.085249][ T645] The buggy address belongs to the object at ffff88807b46cb00
[ 117.085249][ T645] which belongs to the cache KCM of size 1736
[ 117.098954][ T645] The buggy address is located 160 bytes inside of
[ 117.098954][ T645] 1736-byte region [ffff88807b46cb00, ffff88807b46d1c8)
[ 117.112565][ T645] The buggy address belongs to the page:
[ 117.118300][ T645] page:ffffea0001ed1a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7b468
[ 117.129927][ T645] head:ffffea0001ed1a00 order:3 compound_mapcount:0 compound_pincount:0
[ 117.138441][ T645] memcg:ffff88801fd92801
[ 117.142663][ T645] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 117.150969][ T645] raw: 00fff00000010200 0000000000000000 dead000000000122 ffff88814bf70640
[ 117.159768][ T645] raw: 0000000000000000 0000000080110011 00000001ffffffff ffff88801fd92801
[ 117.168339][ T645] page dumped because: kasan: bad access detected
[ 117.174770][ T645] page_owner tracks the page as allocated
[ 117.180483][ T645] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5107, ts 110499401480, free_ts 110447892680
[ 117.201319][ T645] get_page_from_freelist+0x24f6/0x2670
[ 117.207303][ T645] __alloc_pages+0x1ee/0x480
[ 117.211882][ T645] new_slab+0xc0/0x4b0
[ 117.216024][ T645] ___slab_alloc+0x807/0xdd0
[ 117.225524][ T645] kmem_cache_alloc+0xf0/0x280
[ 117.230636][ T645] sk_prot_alloc+0x57/0x210
[ 117.235420][ T645] sk_alloc+0x2f/0x310
[ 117.239657][ T645] kcm_ioctl+0x20f/0xfd0
[ 117.244255][ T645] sock_do_ioctl+0xfb/0x320
[ 117.249118][ T645] sock_ioctl+0x48a/0x700
[ 117.254034][ T645] __se_sys_ioctl+0xfa/0x170
[ 117.258714][ T645] do_syscall_64+0x4c/0xa0
[ 117.264654][ T645] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 117.271430][ T645] page last free stack trace:
[ 117.276672][ T645] free_unref_page_prepare+0x637/0x6c0
[ 117.284077][ T645] free_unref_page+0x8f/0x2a0
[ 117.289217][ T645] qlist_free_all+0x35/0x90
[ 117.293920][ T645] kasan_quarantine_reduce+0x150/0x160
[ 117.299920][ T645] __kasan_slab_alloc+0x2f/0xc0
[ 117.304961][ T645] slab_post_alloc_hook+0x4c/0x380
[ 117.310063][ T645] kmem_cache_alloc+0x15d/0x280
[ 117.315254][ T645] getname_flags+0xb7/0x4f0
[ 117.319980][ T645] user_path_at_empty+0x2a/0x190
[ 117.325376][ T645] vfs_statx+0x107/0x4c0
[ 117.329931][ T645] __x64_sys_newfstatat+0x15f/0x200
[ 117.335884][ T645] do_syscall_64+0x4c/0xa0
[ 117.341029][ T645] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 117.346949][ T645]
[ 117.349277][ T645] Memory state around the buggy address:
[ 117.355075][ T645] ffff88807b46ca80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 117.363302][ T645] ffff88807b46cb00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 117.372323][ T645] >ffff88807b46cb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 117.383157][ T645] ^
[ 117.388285][ T645] ffff88807b46cc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 117.396695][ T645] ffff88807b46cc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 117.406530][ T645] ==================================================================
[ 117.415105][ T645] Disabling lock debugging due to kernel taint
[ 117.421460][ T645] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 117.428910][ T645] CPU: 1 PID: 645 Comm: kworker/u4:3 Tainted: G B syzkaller #0
[ 117.437829][ T645] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 117.447969][ T645] Workqueue: kkcmd kcm_tx_work
[ 117.452897][ T645] Call Trace:
[ 117.456169][ T645]
[ 117.459100][ T645] dump_stack_lvl+0x188/0x250
[ 117.463945][ T645] ? show_regs_print_info+0x20/0x20
[ 117.469312][ T645] ? load_image+0x410/0x410
[ 117.474242][ T645] panic+0x2f8/0x850
[ 117.478316][ T645] ? bpf_jit_dump+0xd0/0xd0
[ 117.482900][ T645] ? _raw_spin_unlock_irqrestore+0xc1/0x120
[ 117.489198][ T645] ? _raw_spin_unlock+0x40/0x40
[ 117.494237][ T645] ? __lock_acquire+0x107/0x7b50
[ 117.499557][ T645] check_panic_on_warn+0x80/0xa0
[ 117.505808][ T645] ? __lock_acquire+0x107/0x7b50
[ 117.511119][ T645] end_report+0x6d/0xf0
[ 117.515765][ T645] kasan_report+0x102/0x130
[ 117.520633][ T645] ? __lock_acquire+0x107/0x7b50
[ 117.526367][ T645] __lock_acquire+0x107/0x7b50
[ 117.531228][ T645] ? lockdep_hardirqs_on_prepare+0x448/0x7c0
[ 117.537744][ T645] ? __lock_acquire+0x7b50/0x7b50
[ 117.543264][ T645] ? lock_chain_count+0x20/0x20
[ 117.548998][ T645] ? finish_lock_switch+0x12d/0x290
[ 117.554403][ T645] ? finish_lock_switch+0x12d/0x290
[ 117.560030][ T645] ? verify_lock_unused+0x140/0x140
[ 117.565440][ T645] ? finish_task_switch+0x12f/0x650
[ 117.571009][ T645] ? __schedule+0x11cb/0x4350
[ 117.578993][ T645] lock_acquire+0x19e/0x400
[ 117.584412][ T645] ? __lock_sock+0x166/0x2b0
[ 117.589687][ T645] ? lockdep_hardirqs_on_prepare+0x7c0/0x7c0
[ 117.596582][ T645] ? __local_bh_disable_ip+0x111/0x1a0
[ 117.603084][ T645] ? read_lock_is_recursive+0x10/0x10
[ 117.609193][ T645] ? __local_bh_enable_ip+0x136/0x1c0
[ 117.615445][ T645] ? kthread_data+0x4b/0xc0
[ 117.620402][ T645] ? kthread_data+0x4b/0xc0
[ 117.625439][ T645] ? __lock_sock+0x166/0x2b0
[ 117.630621][ T645] _raw_spin_lock_bh+0x32/0x50
[ 117.635894][ T645] ? __lock_sock+0x166/0x2b0
[ 117.640730][ T645] __lock_sock+0x166/0x2b0
[ 117.645350][ T645] ? sk_page_frag_refill+0x200/0x200
[ 117.651154][ T645] ? do_raw_spin_lock+0x128/0x2f0
[ 117.656727][ T645] ? init_wait_entry+0xd0/0xd0
[ 117.661605][ T645] ? __rwlock_init+0x140/0x140
[ 117.666715][ T645] ? lockdep_hardirqs_on_prepare+0x448/0x7c0
[ 117.672972][ T645] ? __lock_acquire+0x7b50/0x7b50
[ 117.678092][ T645] ? lock_sock_nested+0x68/0x100
[ 117.683039][ T645] lock_sock_nested+0x9d/0x100
[ 117.687793][ T645] kcm_tx_work+0x2d/0x180
[ 117.692531][ T645] process_one_work+0x867/0xff0
[ 117.697579][ T645] ? worker_detach_from_pool+0x240/0x240
[ 117.703453][ T645] ? lockdep_hardirqs_off+0x70/0x100
[ 117.709282][ T645] ? _raw_spin_lock_irq+0xb7/0xf0
[ 117.714496][ T645] ? _raw_spin_lock_irqsave+0x100/0x100
[ 117.720312][ T645] ? wq_worker_running+0x97/0x170
[ 117.725731][ T645] worker_thread+0xad7/0x12a0
[ 117.730665][ T645] ? _raw_spin_unlock_irqrestore+0xc1/0x120
[ 117.737229][ T645] kthread+0x42e/0x520
[ 117.741753][ T645] ? rcu_lock_release+0x20/0x20
[ 117.747003][ T645] ? kthread_blkcg+0xd0/0xd0
[ 117.751793][ T645] ret_from_fork+0x1f/0x30
[ 117.756495][ T645]
[ 117.760251][ T645] Kernel Offset: disabled
[ 117.765494][ T645] Rebooting in 86400 seconds..