Warning: Permanently added '10.128.1.161' (ED25519) to the list of known hosts.
[ 130.927351][ C0] Scheduler tracepoints stat_sleep, stat_iowait, stat_blocked and stat_runtime require the kernel parameter schedstats=enable or kernel.sched_schedstats=1
[ 132.281582][ T1299] ieee802154 phy0 wpan0: encryption failed: -22
[ 132.293513][ T1299] ieee802154 phy1 wpan1: encryption failed: -22
[ 170.722056][ T6002] ==================================================================
[ 170.730181][ T6002] BUG: KASAN: use-after-free in ring_buffer_peek+0x3e0/0x430
[ 170.737591][ T6002] Read of size 1 at addr ffff88802a4cf010 by task syz-executor989/6002
[ 170.745858][ T6002]
[ 170.748207][ T6002] CPU: 1 UID: 0 PID: 6002 Comm: syz-executor989 Not tainted syzkaller #0 PREEMPT(full)
[ 170.748253][ T6002] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[ 170.748276][ T6002] Call Trace:
[ 170.748290][ T6002]
[ 170.748306][ T6002] dump_stack_lvl+0x100/0x190
[ 170.748365][ T6002] print_report+0x13d/0x4b0
[ 170.748431][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 170.748478][ T6002] ? __virt_addr_valid+0x239/0x430
[ 170.748541][ T6002] ? ring_buffer_peek+0x3e0/0x430
[ 170.748578][ T6002] kasan_report+0xdf/0x1c0
[ 170.748634][ T6002] ? ring_buffer_peek+0x3e0/0x430
[ 170.748702][ T6002] ring_buffer_peek+0x3e0/0x430
[ 170.748761][ T6002] peek_next_entry+0x17a/0x250
[ 170.748812][ T6002] ? ring_buffer_empty_cpu+0x203/0x3c0
[ 170.748887][ T6002] __find_next_entry+0x1ed/0x4e0
[ 170.748963][ T6002] ? __pfx___find_next_entry+0x10/0x10
[ 170.749014][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 170.749068][ T6002] ? ring_buffer_consume+0x28b/0x430
[ 170.749108][ T6002] ? lockdep_hardirqs_on+0x78/0x100
[ 170.749165][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 170.749212][ T6002] ? ring_buffer_consume+0x2b6/0x430
[ 170.749272][ T6002] trace_find_next_entry_inc+0x3d/0x1c0
[ 170.749338][ T6002] tracing_read_pipe+0x557/0xd60
[ 170.749425][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 170.749471][ T6002] ? rw_verify_area+0xce/0x6d0
[ 170.749519][ T6002] ? __pfx_tracing_read_pipe+0x10/0x10
[ 170.749583][ T6002] vfs_read+0x1e4/0xb40
[ 170.749640][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 170.749696][ T6002] ? __pfx_vfs_read+0x10/0x10
[ 170.749747][ T6002] ? __fget_files+0x215/0x3d0
[ 170.749833][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 170.749879][ T6002] ? __fget_files+0x21f/0x3d0
[ 170.749969][ T6002] ksys_read+0x12a/0x250
[ 170.750023][ T6002] ? __pfx_ksys_read+0x10/0x10
[ 170.750071][ T6002] ? trace_syscall_enter+0xd9/0x110
[ 170.750136][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 170.750199][ T6002] do_syscall_64+0x115/0x870
[ 170.750272][ T6002] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 170.750313][ T6002] RIP: 0033:0x7f588d3b7d9e
[ 170.750347][ T6002] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 170.750383][ T6002] RSP: 002b:00007f588d361198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 170.750419][ T6002] RAX: ffffffffffffffda RBX: 00007f588d3626c0 RCX: 00007f588d3b7d9e
[ 170.750444][ T6002] RDX: 0000000000001000 RSI: 00007f588d361200 RDI: 0000000000000003
[ 170.750469][ T6002] RBP: 00007f588d361200 R08: 0000000000000000 R09: 0000000000000000
[ 170.750492][ T6002] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 170.750517][ T6002] R13: 0000000000000000 R14: 00007ffe1b5bf5a0 R15: 00007ffe1b5bf688
[ 170.750597][ T6002]
[ 170.750610][ T6002]
[ 171.026924][ T6002] The buggy address belongs to the physical page:
[ 171.033340][ T6002] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a4cf
[ 171.042122][ T6002] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 171.049262][ T6002] raw: 00fff00000000000 ffffea0001ddbd08 ffffea00006f0fc8 0000000000000000
[ 171.058040][ T6002] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 171.066665][ T6002] page dumped because: kasan: bad access detected
[ 171.073091][ T6002] page_owner tracks the page as freed
[ 171.078464][ T6002] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5981, tgid 5981 (syz-executor989), ts 130836230668, free_ts 170720200085
[ 171.098562][ T6002] post_alloc_hook+0xfd/0x120
[ 171.103293][ T6002] get_page_from_freelist+0xf48/0x3530
[ 171.108791][ T6002] __alloc_frozen_pages_noprof+0x299/0x2dc0
[ 171.114725][ T6002] __alloc_pages_noprof+0xb/0x110
[ 171.119782][ T6002] alloc_cpu_data+0x60/0x160
[ 171.124416][ T6002] __rb_allocate_pages+0xbd5/0x10a0
[ 171.129743][ T6002] ring_buffer_resize+0x6df/0x1e80
[ 171.134878][ T6002] __tracing_resize_ring_buffer.part.0+0x52/0x1f0
[ 171.141335][ T6002] tracing_update_buffers+0xd4/0xf0
[ 171.146577][ T6002] system_enable_write+0x151/0x300
[ 171.151731][ T6002] vfs_write+0x2aa/0x1050
[ 171.156094][ T6002] ksys_write+0x12a/0x250
[ 171.160455][ T6002] do_syscall_64+0x115/0x870
[ 171.165139][ T6002] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 171.171146][ T6002] page last free pid 6003 tgid 5981 stack trace:
[ 171.177480][ T6002] __free_frozen_pages+0x79f/0x1090
[ 171.182712][ T6002] ring_buffer_subbuf_order_set+0x1325/0x18e0
[ 171.188825][ T6002] buffer_subbuf_size_write+0x182/0x280
[ 171.194393][ T6002] vfs_write+0x2aa/0x1050
[ 171.198751][ T6002] ksys_write+0x12a/0x250
[ 171.203115][ T6002] do_syscall_64+0x115/0x870
[ 171.207739][ T6002] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 171.213652][ T6002]
[ 171.215976][ T6002] Memory state around the buggy address:
[ 171.221785][ T6002] ffff88802a4cef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 171.229864][ T6002] ffff88802a4cef80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[ 171.237954][ T6002] >ffff88802a4cf000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 171.246030][ T6002] ^
[ 171.250629][ T6002] ffff88802a4cf080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 171.258791][ T6002] ffff88802a4cf100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 171.266870][ T6002] ==================================================================
[ 171.280355][ T6002] Disabling lock debugging due to kernel taint
[ 171.286607][ T6002] ==================================================================
[ 171.294688][ T6002] BUG: KASAN: use-after-free in ring_buffer_event_length+0x218/0x260
[ 171.302831][ T6002] Read of size 4 at addr ffff88802a4cf010 by task syz-executor989/6002
[ 171.311096][ T6002]
[ 171.313463][ T6002] CPU: 0 UID: 0 PID: 6002 Comm: syz-executor989 Tainted: G B syzkaller #0 PREEMPT(full)
[ 171.313518][ T6002] Tainted: [B]=BAD_PAGE
[ 171.313531][ T6002] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[ 171.313554][ T6002] Call Trace:
[ 171.313570][ T6002]
[ 171.313586][ T6002] dump_stack_lvl+0x100/0x190
[ 171.313644][ T6002] print_report+0x13d/0x4b0
[ 171.313707][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 171.313754][ T6002] ? __virt_addr_valid+0x239/0x430
[ 171.313815][ T6002] ? ring_buffer_event_length+0x218/0x260
[ 171.313874][ T6002] kasan_report+0xdf/0x1c0
[ 171.313928][ T6002] ? ring_buffer_event_length+0x218/0x260
[ 171.314017][ T6002] ring_buffer_event_length+0x218/0x260
[ 171.314083][ T6002] peek_next_entry+0x198/0x250
[ 171.314133][ T6002] ? ring_buffer_empty_cpu+0x203/0x3c0
[ 171.314200][ T6002] __find_next_entry+0x1ed/0x4e0
[ 171.314273][ T6002] ? __pfx___find_next_entry+0x10/0x10
[ 171.314345][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 171.314398][ T6002] ? ring_buffer_consume+0x28b/0x430
[ 171.314437][ T6002] ? lockdep_hardirqs_on+0x78/0x100
[ 171.314494][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 171.314539][ T6002] ? ring_buffer_consume+0x2b6/0x430
[ 171.314597][ T6002] trace_find_next_entry_inc+0x3d/0x1c0
[ 171.314662][ T6002] tracing_read_pipe+0x557/0xd60
[ 171.314746][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 171.314791][ T6002] ? rw_verify_area+0xce/0x6d0
[ 171.314837][ T6002] ? __pfx_tracing_read_pipe+0x10/0x10
[ 171.314899][ T6002] vfs_read+0x1e4/0xb40
[ 171.314955][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 171.315009][ T6002] ? __pfx_vfs_read+0x10/0x10
[ 171.315060][ T6002] ? __fget_files+0x215/0x3d0
[ 171.315138][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 171.315184][ T6002] ? __fget_files+0x21f/0x3d0
[ 171.315271][ T6002] ksys_read+0x12a/0x250
[ 171.315327][ T6002] ? __pfx_ksys_read+0x10/0x10
[ 171.315374][ T6002] ? trace_syscall_enter+0xd9/0x110
[ 171.315437][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 171.315498][ T6002] do_syscall_64+0x115/0x870
[ 171.315570][ T6002] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 171.315611][ T6002] RIP: 0033:0x7f588d3b7d9e
[ 171.315644][ T6002] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 171.315680][ T6002] RSP: 002b:00007f588d361198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 171.315715][ T6002] RAX: ffffffffffffffda RBX: 00007f588d3626c0 RCX: 00007f588d3b7d9e
[ 171.315741][ T6002] RDX: 0000000000001000 RSI: 00007f588d361200 RDI: 0000000000000003
[ 171.315765][ T6002] RBP: 00007f588d361200 R08: 0000000000000000 R09: 0000000000000000
[ 171.315788][ T6002] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 171.315812][ T6002] R13: 0000000000000000 R14: 00007ffe1b5bf5a0 R15: 00007ffe1b5bf688
[ 171.315889][ T6002]
[ 171.315901][ T6002]
[ 171.600130][ T6002] The buggy address belongs to the physical page:
[ 171.606550][ T6002] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a4cf
[ 171.615335][ T6002] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 171.622481][ T6002] raw: 00fff00000000000 ffffea0001ddbd08 ffffea00006f0fc8 0000000000000000
[ 171.631092][ T6002] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 171.639689][ T6002] page dumped because: kasan: bad access detected
[ 171.646109][ T6002] page_owner tracks the page as freed
[ 171.651484][ T6002] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5981, tgid 5981 (syz-executor989), ts 130836230668, free_ts 170720200085
[ 171.671588][ T6002] post_alloc_hook+0xfd/0x120
[ 171.676316][ T6002] get_page_from_freelist+0xf48/0x3530
[ 171.681827][ T6002] __alloc_frozen_pages_noprof+0x299/0x2dc0
[ 171.687772][ T6002] __alloc_pages_noprof+0xb/0x110
[ 171.692838][ T6002] alloc_cpu_data+0x60/0x160
[ 171.697467][ T6002] __rb_allocate_pages+0xbd5/0x10a0
[ 171.702714][ T6002] ring_buffer_resize+0x6df/0x1e80
[ 171.707859][ T6002] __tracing_resize_ring_buffer.part.0+0x52/0x1f0
[ 171.714342][ T6002] tracing_update_buffers+0xd4/0xf0
[ 171.719585][ T6002] system_enable_write+0x151/0x300
[ 171.724734][ T6002] vfs_write+0x2aa/0x1050
[ 171.729097][ T6002] ksys_write+0x12a/0x250
[ 171.733460][ T6002] do_syscall_64+0x115/0x870
[ 171.738089][ T6002] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 171.744009][ T6002] page last free pid 6003 tgid 5981 stack trace:
[ 171.750351][ T6002] __free_frozen_pages+0x79f/0x1090
[ 171.755588][ T6002] ring_buffer_subbuf_order_set+0x1325/0x18e0
[ 171.761710][ T6002] buffer_subbuf_size_write+0x182/0x280
[ 171.767343][ T6002] vfs_write+0x2aa/0x1050
[ 171.771715][ T6002] ksys_write+0x12a/0x250
[ 171.776081][ T6002] do_syscall_64+0x115/0x870
[ 171.780712][ T6002] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 171.786650][ T6002]
[ 171.788978][ T6002] Memory state around the buggy address:
[ 171.794618][ T6002] ffff88802a4cef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 171.802701][ T6002] ffff88802a4cef80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[ 171.810788][ T6002] >ffff88802a4cf000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 171.818867][ T6002] ^
[ 171.823474][ T6002] ffff88802a4cf080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 171.831559][ T6002] ffff88802a4cf100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 171.839648][ T6002] ==================================================================
[ 171.856891][ T6002] ==================================================================
[ 171.865012][ T6002] BUG: KASAN: use-after-free in ring_buffer_event_length+0x243/0x260
[ 171.873149][ T6002] Read of size 1 at addr ffff88802a4cf010 by task syz-executor989/6002
[ 171.881429][ T6002]
[ 171.883786][ T6002] CPU: 0 UID: 0 PID: 6002 Comm: syz-executor989 Tainted: G B syzkaller #0 PREEMPT(full)
[ 171.883840][ T6002] Tainted: [B]=BAD_PAGE
[ 171.883854][ T6002] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[ 171.883876][ T6002] Call Trace:
[ 171.883890][ T6002]
[ 171.883905][ T6002] dump_stack_lvl+0x100/0x190
[ 171.883962][ T6002] print_report+0x13d/0x4b0
[ 171.884025][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 171.884072][ T6002] ? __virt_addr_valid+0x239/0x430
[ 171.884132][ T6002] ? ring_buffer_event_length+0x243/0x260
[ 171.884192][ T6002] kasan_report+0xdf/0x1c0
[ 171.884246][ T6002] ? ring_buffer_event_length+0x243/0x260
[ 171.884340][ T6002] ring_buffer_event_length+0x243/0x260
[ 171.884407][ T6002] peek_next_entry+0x198/0x250
[ 171.884457][ T6002] ? ring_buffer_empty_cpu+0x203/0x3c0
[ 171.884524][ T6002] __find_next_entry+0x1ed/0x4e0
[ 171.884597][ T6002] ? __pfx___find_next_entry+0x10/0x10
[ 171.884647][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 171.884699][ T6002] ? ring_buffer_consume+0x28b/0x430
[ 171.884739][ T6002] ? lockdep_hardirqs_on+0x78/0x100
[ 171.884795][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 171.884840][ T6002] ? ring_buffer_consume+0x2b6/0x430
[ 171.884898][ T6002] trace_find_next_entry_inc+0x3d/0x1c0
[ 171.884962][ T6002] tracing_read_pipe+0x557/0xd60
[ 171.885047][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 171.885093][ T6002] ? rw_verify_area+0xce/0x6d0
[ 171.885139][ T6002] ? __pfx_tracing_read_pipe+0x10/0x10
[ 171.885202][ T6002] vfs_read+0x1e4/0xb40
[ 171.885257][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 171.885312][ T6002] ? __pfx_vfs_read+0x10/0x10
[ 171.885369][ T6002] ? __fget_files+0x215/0x3d0
[ 171.885448][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 171.885493][ T6002] ? __fget_files+0x21f/0x3d0
[ 171.885580][ T6002] ksys_read+0x12a/0x250
[ 171.885632][ T6002] ? __pfx_ksys_read+0x10/0x10
[ 171.885679][ T6002] ? trace_syscall_enter+0xd9/0x110
[ 171.885742][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 171.885804][ T6002] do_syscall_64+0x115/0x870
[ 171.885876][ T6002] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 171.885917][ T6002] RIP: 0033:0x7f588d3b7d9e
[ 171.885950][ T6002] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 171.885985][ T6002] RSP: 002b:00007f588d361198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 171.886021][ T6002] RAX: ffffffffffffffda RBX: 00007f588d3626c0 RCX: 00007f588d3b7d9e
[ 171.886046][ T6002] RDX: 0000000000001000 RSI: 00007f588d361200 RDI: 0000000000000003
[ 171.886070][ T6002] RBP: 00007f588d361200 R08: 0000000000000000 R09: 0000000000000000
[ 171.886094][ T6002] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 171.886117][ T6002] R13: 0000000000000000 R14: 00007ffe1b5bf5a0 R15: 00007ffe1b5bf688
[ 171.886195][ T6002]
[ 171.886208][ T6002]
[ 172.169863][ T6002] The buggy address belongs to the physical page:
[ 172.176281][ T6002] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a4cf
[ 172.185071][ T6002] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 172.192220][ T6002] raw: 00fff00000000000 ffffea0001ddbd08 ffffea00006f0fc8 0000000000000000
[ 172.200827][ T6002] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 172.209420][ T6002] page dumped because: kasan: bad access detected
[ 172.215837][ T6002] page_owner tracks the page as freed
[ 172.221209][ T6002] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5981, tgid 5981 (syz-executor989), ts 130836230668, free_ts 170720200085
[ 172.241305][ T6002] post_alloc_hook+0xfd/0x120
[ 172.246037][ T6002] get_page_from_freelist+0xf48/0x3530
[ 172.251582][ T6002] __alloc_frozen_pages_noprof+0x299/0x2dc0
[ 172.257518][ T6002] __alloc_pages_noprof+0xb/0x110
[ 172.262576][ T6002] alloc_cpu_data+0x60/0x160
[ 172.267196][ T6002] __rb_allocate_pages+0xbd5/0x10a0
[ 172.272439][ T6002] ring_buffer_resize+0x6df/0x1e80
[ 172.277569][ T6002] __tracing_resize_ring_buffer.part.0+0x52/0x1f0
[ 172.284023][ T6002] tracing_update_buffers+0xd4/0xf0
[ 172.289260][ T6002] system_enable_write+0x151/0x300
[ 172.294405][ T6002] vfs_write+0x2aa/0x1050
[ 172.298760][ T6002] ksys_write+0x12a/0x250
[ 172.303120][ T6002] do_syscall_64+0x115/0x870
[ 172.307741][ T6002] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 172.313651][ T6002] page last free pid 6003 tgid 5981 stack trace:
[ 172.319979][ T6002] __free_frozen_pages+0x79f/0x1090
[ 172.325214][ T6002] ring_buffer_subbuf_order_set+0x1325/0x18e0
[ 172.331322][ T6002] buffer_subbuf_size_write+0x182/0x280
[ 172.336896][ T6002] vfs_write+0x2aa/0x1050
[ 172.341279][ T6002] ksys_write+0x12a/0x250
[ 172.345655][ T6002] do_syscall_64+0x115/0x870
[ 172.350313][ T6002] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 172.356244][ T6002]
[ 172.358568][ T6002] Memory state around the buggy address:
[ 172.364289][ T6002] ffff88802a4cef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 172.372369][ T6002] ffff88802a4cef80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[ 172.380447][ T6002] >ffff88802a4cf000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 172.388521][ T6002] ^
[ 172.393118][ T6002] ffff88802a4cf080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 172.401365][ T6002] ffff88802a4cf100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 172.409436][ T6002] ==================================================================
[ 172.625964][ T6002] ==================================================================
[ 172.634089][ T6002] BUG: KASAN: use-after-free in ring_buffer_event_data+0x129/0x150
[ 172.642041][ T6002] Read of size 4 at addr ffff88802a4cf010 by task syz-executor989/6002
[ 172.650311][ T6002]
[ 172.652666][ T6002] CPU: 1 UID: 0 PID: 6002 Comm: syz-executor989 Tainted: G B syzkaller #0 PREEMPT(full)
[ 172.652721][ T6002] Tainted: [B]=BAD_PAGE
[ 172.652734][ T6002] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[ 172.652757][ T6002] Call Trace:
[ 172.652771][ T6002]
[ 172.652786][ T6002] dump_stack_lvl+0x100/0x190
[ 172.652848][ T6002] print_report+0x13d/0x4b0
[ 172.652913][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 172.652960][ T6002] ? __virt_addr_valid+0x239/0x430
[ 172.653022][ T6002] ? ring_buffer_event_data+0x129/0x150
[ 172.653075][ T6002] kasan_report+0xdf/0x1c0
[ 172.653130][ T6002] ? ring_buffer_event_data+0x129/0x150
[ 172.653209][ T6002] ring_buffer_event_data+0x129/0x150
[ 172.653266][ T6002] peek_next_entry+0x1d3/0x250
[ 172.653317][ T6002] ? ring_buffer_empty_cpu+0x203/0x3c0
[ 172.653385][ T6002] __find_next_entry+0x1ed/0x4e0
[ 172.653460][ T6002] ? __pfx___find_next_entry+0x10/0x10
[ 172.653511][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 172.653565][ T6002] ? ring_buffer_consume+0x28b/0x430
[ 172.653604][ T6002] ? lockdep_hardirqs_on+0x78/0x100
[ 172.653661][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 172.653708][ T6002] ? ring_buffer_consume+0x2b6/0x430
[ 172.653767][ T6002] trace_find_next_entry_inc+0x3d/0x1c0
[ 172.653838][ T6002] tracing_read_pipe+0x557/0xd60
[ 172.653921][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 172.653967][ T6002] ? rw_verify_area+0xce/0x6d0
[ 172.654014][ T6002] ? __pfx_tracing_read_pipe+0x10/0x10
[ 172.654078][ T6002] vfs_read+0x1e4/0xb40
[ 172.654133][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 172.654189][ T6002] ? __pfx_vfs_read+0x10/0x10
[ 172.654240][ T6002] ? __fget_files+0x215/0x3d0
[ 172.654342][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 172.654388][ T6002] ? __fget_files+0x21f/0x3d0
[ 172.654476][ T6002] ksys_read+0x12a/0x250
[ 172.654529][ T6002] ? __pfx_ksys_read+0x10/0x10
[ 172.654577][ T6002] ? trace_syscall_enter+0xd9/0x110
[ 172.654641][ T6002] ? srso_alias_return_thunk+0x5/0xfbef5
[ 172.654704][ T6002] do_syscall_64+0x115/0x870
[ 172.654776][ T6002] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 172.654817][ T6002] RIP: 0033:0x7f588d3b7d9e
[ 172.654859][ T6002] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 172.654894][ T6002] RSP: 002b:00007f588d361198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 172.654929][ T6002] RAX: ffffffffffffffda RBX: 00007f588d3626c0 RCX: 00007f588d3b7d9e
[ 172.654955][ T6002] RDX: 0000000000001000 RSI: 00007f588d361200 RDI: 0000000000000003
[ 172.654979][ T6002] RBP: 00007f588d361200 R08: 0000000000000000 R09: 0000000000000000
[ 172.655003][ T6002] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 172.655027][ T6002] R13: 0000000000000000 R14: 00007ffe1b5bf5a0 R15: 00007ffe1b5bf688
[ 172.655105][ T6002]
[ 172.655119][ T6002]
[ 172.938488][ T6002] The buggy address belongs to the physical page:
[ 172.944907][ T6002] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a4cf
[ 172.953688][ T6002] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 172.960836][ T6002] raw: 00fff00000000000 ffffea0001ddbd08 ffffea00006f0fc8 0000000000000000
[ 172.969459][ T6002] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 172.978060][ T6002] page dumped because: kasan: bad access detected
[ 172.984484][ T6002] page_owner tracks the page as freed
[ 172.989865][ T6002] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5981, tgid 5981 (syz-executor989), ts 130836230668, free_ts 170720200085
[ 173.009975][ T6002] post_alloc_hook+0xfd/0x120
[ 173.014702][ T6002] get_page_from_freelist+0xf48/0x3530
[ 173.020214][ T6002] __alloc_frozen_pages_noprof+0x299/0x2dc0
[ 173.026164][ T6002] __alloc_pages_noprof+0xb/0x110
[ 173.031244][ T6002] alloc_cpu_data+0x60/0x160
[ 173.035881][ T6002] __rb_allocate_pages+0xbd5/0x10a0
[ 173.041129][ T6002] ring_buffer_resize+0x6df/0x1e80
[ 173.046275][ T6002] __tracing_resize_ring_buffer.part.0+0x52/0x1f0
[ 173.052760][ T6002] tracing_update_buffers+0xd4/0xf0
[ 173.058014][ T6002] system_enable_write+0x151/0x300
[ 173.063169][ T6002] vfs_write+0x2aa/0x1050
[ 173.067545][ T6002] ksys_write+0x12a/0x250
[ 173.071914][ T6002] do_syscall_64+0x115/0x870
[ 173.076544][ T6002] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 173.082468][ T6002] page last free pid 6003 tgid 5981 stack trace:
[ 173.088812][ T6002] __free_frozen_pages+0x79f/0x1090
[ 173.094054][ T6002] ring_buffer_subbuf_order_set+0x1325/0x18e0
[ 173.100172][ T6002] buffer_subbuf_size_write+0x182/0x280
[ 173.105751][ T6002] vfs_write+0x2aa/0x1050
[ 173.110122][ T6002] ksys_write+0x12a/0x250
[ 173.114494][ T6002] do_syscall_64+0x115/0x870
[ 173.119131][ T6002] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 173.125059][ T6002]
[ 173.127391][ T6002] Memory state around the buggy address:
[ 173.133033][ T6002] ffff88802a4cef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 173.141115][ T6002] ffff88802a4cef80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[ 173.149282][ T6002] >ffff88802a4cf000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 173.157361][ T6002] ^
[ 173.161960][ T6002] ffff88802a4cf080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 173.170037][ T6002] ffff88802a4cf100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 173.178109][ T6002] ==================================================================