Warning: Permanently added '10.128.1.133' (ED25519) to the list of known hosts.
2025/11/17 03:54:17 parsed 1 programs
[ 121.786058][ T6162] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 125.126650][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 125.144120][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 125.152579][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 125.161996][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 125.170789][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 125.554047][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 125.562326][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 125.588074][ T1318] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 125.600042][ T1318] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 126.880547][ T6220] chnl_net:caif_netlink_parms(): no params data found
[ 126.992738][ T6220] bridge0: port 1(bridge_slave_0) entered blocking state
[ 126.999923][ T6220] bridge0: port 1(bridge_slave_0) entered disabled state
[ 127.007549][ T6220] bridge_slave_0: entered allmulticast mode
[ 127.015188][ T6220] bridge_slave_0: entered promiscuous mode
[ 127.024582][ T6220] bridge0: port 2(bridge_slave_1) entered blocking state
[ 127.031821][ T6220] bridge0: port 2(bridge_slave_1) entered disabled state
[ 127.039084][ T6220] bridge_slave_1: entered allmulticast mode
[ 127.046635][ T6220] bridge_slave_1: entered promiscuous mode
[ 127.083963][ T6220] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 127.097786][ T6220] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 127.136899][ T6220] team0: Port device team_slave_0 added
[ 127.146260][ T6220] team0: Port device team_slave_1 added
[ 127.172191][ T6220] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 127.179148][ T6220] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 127.205277][ T6220] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 127.217306][ T6220] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 127.224473][ T6220] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 127.250410][ T6220] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 127.294184][ T6220] hsr_slave_0: entered promiscuous mode
[ 127.300914][ T6220] hsr_slave_1: entered promiscuous mode
[ 127.771308][ T6220] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 127.784439][ T6220] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 127.798238][ T6220] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 127.812382][ T6220] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 127.918686][ T6220] 8021q: adding VLAN 0 to HW filter on device bond0
[ 127.947882][ T6220] 8021q: adding VLAN 0 to HW filter on device team0
[ 127.964726][ T1318] bridge0: port 1(bridge_slave_0) entered blocking state
[ 127.972004][ T1318] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 127.996895][ T1318] bridge0: port 2(bridge_slave_1) entered blocking state
[ 128.004220][ T1318] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 128.263174][ T6220] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 128.329406][ T6220] veth0_vlan: entered promiscuous mode
[ 128.347478][ T6220] veth1_vlan: entered promiscuous mode
[ 128.392538][ T6220] veth0_macvtap: entered promiscuous mode
[ 128.404660][ T6220] veth1_macvtap: entered promiscuous mode
[ 128.430662][ T6220] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 128.449100][ T6220] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 128.468250][ T1318] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 128.491759][ T1318] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 128.502817][ T1318] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 128.521531][ T1318] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 128.674252][ T36] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 128.772904][ T36] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 128.862676][ T36] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 128.958239][ T36] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2025/11/17 03:54:30 executed programs: 0
[ 130.414700][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 130.427140][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 130.436906][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 130.446144][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 130.455239][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 130.463354][ T51] ==================================================================
[ 130.471440][ T51] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 130.478900][ T51] Read of size 2 at addr ffff88807c7ed678 by task kworker/u9:0/51
[ 130.486687][ T51]
[ 130.489027][ T51] CPU: 0 UID: 0 PID: 51 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full)
[ 130.489042][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 130.489052][ T51] Workqueue: hci0 hci_cmd_work
[ 130.489082][ T51] Call Trace:
[ 130.489090][ T51]
[ 130.489097][ T51] dump_stack_lvl+0x189/0x250
[ 130.489117][ T51] ? __virt_addr_valid+0x1c8/0x5c0
[ 130.489130][ T51] ? rcu_is_watching+0x15/0xb0
[ 130.489141][ T51] ? __pfx_dump_stack_lvl+0x10/0x10
[ 130.489157][ T51] ? rcu_is_watching+0x15/0xb0
[ 130.489168][ T51] ? lock_release+0x4b/0x3d0
[ 130.489183][ T51] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 130.489197][ T51] ? __virt_addr_valid+0x1c8/0x5c0
[ 130.489210][ T51] ? __virt_addr_valid+0x4a5/0x5c0
[ 130.489223][ T51] print_report+0xca/0x240
[ 130.489238][ T51] ? hci_cmd_work+0x5d0/0x7b0
[ 130.489252][ T51] kasan_report+0x118/0x150
[ 130.489268][ T51] ? hci_cmd_work+0x5d0/0x7b0
[ 130.489285][ T51] hci_cmd_work+0x5d0/0x7b0
[ 130.489301][ T51] ? process_one_work+0x868/0x15e0
[ 130.489315][ T51] process_one_work+0x93a/0x15e0
[ 130.489330][ T51] ? __lock_acquire+0xab9/0xd20
[ 130.489351][ T51] ? __pfx_process_one_work+0x10/0x10
[ 130.489368][ T51] ? assign_work+0x3a1/0x410
[ 130.489384][ T51] worker_thread+0x9b0/0xee0
[ 130.489407][ T51] kthread+0x711/0x8a0
[ 130.489420][ T51] ? __pfx_worker_thread+0x10/0x10
[ 130.489435][ T51] ? __pfx_kthread+0x10/0x10
[ 130.489447][ T51] ? _raw_spin_unlock_irq+0x23/0x50
[ 130.489459][ T51] ? lockdep_hardirqs_on+0x9c/0x150
[ 130.489472][ T51] ? __pfx_kthread+0x10/0x10
[ 130.489484][ T51] ret_from_fork+0x599/0xb30
[ 130.489500][ T51] ? __pfx_ret_from_fork+0x10/0x10
[ 130.489518][ T51] ? __switch_to_asm+0x39/0x70
[ 130.489529][ T51] ? __switch_to_asm+0x33/0x70
[ 130.489541][ T51] ? __pfx_kthread+0x10/0x10
[ 130.489552][ T51] ret_from_fork_asm+0x1a/0x30
[ 130.489569][ T51]
[ 130.489575][ T51]
[ 130.679995][ T51] Allocated by task 5887:
[ 130.684305][ T51] kasan_save_track+0x3e/0x80
[ 130.689058][ T51] __kasan_slab_alloc+0x6c/0x80
[ 130.693954][ T51] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 130.699935][ T51] __alloc_skb+0x112/0x2d0
[ 130.704347][ T51] hci_cmd_sync_alloc+0x3d/0x3b0
[ 130.709291][ T51] __hci_cmd_sync_sk+0x1a7/0xc70
[ 130.714218][ T51] hci_read_current_iac_lap_sync+0x2c/0x120
[ 130.720102][ T51] hci_dev_open_sync+0x24ad/0x2dc0
[ 130.725198][ T51] hci_power_on+0x1b4/0x720
[ 130.730329][ T51] process_one_work+0x93a/0x15e0
[ 130.735340][ T51] worker_thread+0x9b0/0xee0
[ 130.740012][ T51] kthread+0x711/0x8a0
[ 130.744142][ T51] ret_from_fork+0x599/0xb30
[ 130.748729][ T51] ret_from_fork_asm+0x1a/0x30
[ 130.753479][ T51]
[ 130.755783][ T51] Freed by task 6338:
[ 130.759920][ T51] kasan_save_track+0x3e/0x80
[ 130.764681][ T51] kasan_save_free_info+0x46/0x50
[ 130.769713][ T51] __kasan_slab_free+0x5c/0x80
[ 130.774463][ T51] kmem_cache_free+0x197/0x640
[ 130.779297][ T51] vhci_read+0x49a/0x5b0
[ 130.783612][ T51] vfs_read+0x200/0xa30
[ 130.787756][ T51] ksys_read+0x145/0x250
[ 130.791978][ T51] do_syscall_64+0xfa/0xfa0
[ 130.796465][ T51] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 130.802514][ T51]
[ 130.804821][ T51] The buggy address belongs to the object at ffff88807c7ed640
[ 130.804821][ T51] which belongs to the cache skbuff_head_cache of size 240
[ 130.819542][ T51] The buggy address is located 56 bytes inside of
[ 130.819542][ T51] freed 240-byte region [ffff88807c7ed640, ffff88807c7ed730)
[ 130.833233][ T51]
[ 130.835546][ T51] The buggy address belongs to the physical page:
[ 130.841965][ T51] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7c7ed
[ 130.850715][ T51] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 130.857808][ T51] page_type: f5(slab)
[ 130.861772][ T51] raw: 00fff00000000000 ffff88801def0a00 ffffea0001e40dc0 dead000000000002
[ 130.870435][ T51] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
[ 130.879106][ T51] page dumped because: kasan: bad access detected
[ 130.885542][ T51] page_owner tracks the page as allocated
[ 130.891324][ T51] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5198, tgid 5198 (udevadm), ts 28665935769, free_ts 24192911012
[ 130.910238][ T51] post_alloc_hook+0x240/0x2a0
[ 130.914992][ T51] get_page_from_freelist+0x2365/0x2440
[ 130.920530][ T51] __alloc_frozen_pages_noprof+0x181/0x370
[ 130.926347][ T51] alloc_pages_mpol+0x232/0x4a0
[ 130.931216][ T51] allocate_slab+0x86/0x3b0
[ 130.935707][ T51] ___slab_alloc+0xf56/0x1990
[ 130.940366][ T51] __slab_alloc+0x65/0x100
[ 130.944794][ T51] kmem_cache_alloc_node_noprof+0x4ce/0x710
[ 130.950667][ T51] __alloc_skb+0x112/0x2d0
[ 130.955081][ T51] alloc_uevent_skb+0x7d/0x230
[ 130.959827][ T51] kobject_uevent_net_broadcast+0x2fa/0x560
[ 130.965719][ T51] kobject_uevent_env+0x55c/0x9f0
[ 130.970727][ T51] kobject_synth_uevent+0x527/0xb00
[ 130.975996][ T51] store_uevent+0x16/0x30
[ 130.980367][ T51] module_attr_store+0x65/0x90
[ 130.985122][ T51] kernfs_fop_write_iter+0x3af/0x540
[ 130.990407][ T51] page last free pid 1 tgid 1 stack trace:
[ 130.996200][ T51] __free_frozen_pages+0xbc8/0xd30
[ 131.001412][ T51] free_contig_range+0x1bd/0x4a0
[ 131.006429][ T51] destroy_args+0x69/0x660
[ 131.010835][ T51] debug_vm_pgtable+0x38f/0x3a0
[ 131.015684][ T51] do_one_initcall+0x1fb/0x870
[ 131.020432][ T51] do_initcall_level+0x104/0x190
[ 131.025533][ T51] do_initcalls+0x59/0xa0
[ 131.029847][ T51] kernel_init_freeable+0x334/0x4b0
[ 131.035031][ T51] kernel_init+0x1d/0x1d0
[ 131.039347][ T51] ret_from_fork+0x599/0xb30
[ 131.043919][ T51] ret_from_fork_asm+0x1a/0x30
[ 131.049103][ T51]
[ 131.051409][ T51] Memory state around the buggy address:
[ 131.057022][ T51] ffff88807c7ed500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 131.065110][ T51] ffff88807c7ed580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 131.073165][ T51] >ffff88807c7ed600: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 131.081301][ T51] ^
[ 131.089436][ T51] ffff88807c7ed680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 131.097482][ T51] ffff88807c7ed700: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 131.105567][ T51] ==================================================================
[ 131.117973][ T51] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 131.125206][ T51] CPU: 0 UID: 0 PID: 51 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full)
[ 131.134579][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 131.144666][ T51] Workqueue: hci0 hci_cmd_work
[ 131.149504][ T51] Call Trace:
[ 131.152790][ T51]
[ 131.155736][ T51] dump_stack_lvl+0x99/0x250
[ 131.160345][ T51] ? __asan_memcpy+0x40/0x70
[ 131.164955][ T51] ? __pfx_dump_stack_lvl+0x10/0x10
[ 131.170167][ T51] ? __pfx__printk+0x10/0x10
[ 131.174787][ T51] vpanic+0x237/0x6d0
[ 131.178871][ T51] ? __pfx_vpanic+0x10/0x10
[ 131.183471][ T51] ? preempt_schedule+0xae/0xc0
[ 131.188342][ T51] ? __pfx_preempt_schedule+0x10/0x10
[ 131.193747][ T51] panic+0xb9/0xc0
[ 131.197576][ T51] ? __pfx_panic+0x10/0x10
[ 131.202098][ T51] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 131.208005][ T51] ? is_module_address+0x17/0xf0
[ 131.213047][ T51] ? hci_cmd_work+0x5d0/0x7b0
[ 131.217827][ T51] check_panic_on_warn+0x89/0xb0
[ 131.222777][ T51] ? hci_cmd_work+0x5d0/0x7b0
[ 131.227500][ T51] end_report+0x6f/0x160
[ 131.231770][ T51] kasan_report+0x129/0x150
[ 131.236291][ T51] ? hci_cmd_work+0x5d0/0x7b0
[ 131.240984][ T51] hci_cmd_work+0x5d0/0x7b0
[ 131.245496][ T51] ? process_one_work+0x868/0x15e0
[ 131.250616][ T51] process_one_work+0x93a/0x15e0
[ 131.255554][ T51] ? __lock_acquire+0xab9/0xd20
[ 131.260422][ T51] ? __pfx_process_one_work+0x10/0x10
[ 131.265885][ T51] ? assign_work+0x3a1/0x410
[ 131.270548][ T51] worker_thread+0x9b0/0xee0
[ 131.275137][ T51] kthread+0x711/0x8a0
[ 131.279195][ T51] ? __pfx_worker_thread+0x10/0x10
[ 131.284292][ T51] ? __pfx_kthread+0x10/0x10
[ 131.288868][ T51] ? _raw_spin_unlock_irq+0x23/0x50
[ 131.294053][ T51] ? lockdep_hardirqs_on+0x9c/0x150
[ 131.299238][ T51] ? __pfx_kthread+0x10/0x10
[ 131.303809][ T51] ret_from_fork+0x599/0xb30
[ 131.308468][ T51] ? __pfx_ret_from_fork+0x10/0x10
[ 131.313572][ T51] ? __switch_to_asm+0x39/0x70
[ 131.318321][ T51] ? __switch_to_asm+0x33/0x70
[ 131.323073][ T51] ? __pfx_kthread+0x10/0x10
[ 131.327665][ T51] ret_from_fork_asm+0x1a/0x30
[ 131.332504][ T51]
[ 131.335893][ T51] Kernel Offset: disabled
[ 131.340217][ T51] Rebooting in 86400 seconds..