[ 89.536998][ T3082] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 89.638562][ T3082] veth1_macvtap: left promiscuous mode
[ 89.638749][ T3082] veth0_macvtap: left promiscuous mode
[ 89.638915][ T3082] veth1_vlan: left promiscuous mode
[ 89.639345][ T3082] veth0_vlan: left promiscuous mode
[ 90.285361][ T3082] team0 (unregistering): Port device team_slave_1 removed
[ 90.325274][ T3082] team0 (unregistering): Port device team_slave_0 removed
[ 90.488662][ T5257] 8021q: adding VLAN 0 to HW filter on device eth2
[ 91.255891][ T5257] 8021q: adding VLAN 0 to HW filter on device eth3
[ 91.999612][ T5257] 8021q: adding VLAN 0 to HW filter on device eth4
Warning: Permanently added '10.128.1.124' (ED25519) to the list of known hosts.
2026/08/04 23:42:52 ignoring optional flag "type"="gce"
2026/08/04 23:42:52 parsed 1 programs
2026/08/04 23:42:54 executed programs: 0
[ 100.612965][ T5762] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 100.685267][ T59] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 100.708391][ T59] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 100.711742][ T59] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 100.713155][ T59] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 100.714016][ T59] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 101.476455][ T5769] bridge0: port 1(bridge_slave_0) entered blocking state
[ 101.476605][ T5769] bridge0: port 1(bridge_slave_0) entered disabled state
[ 101.476730][ T5769] bridge_slave_0: entered allmulticast mode
[ 101.478648][ T5769] bridge_slave_0: entered promiscuous mode
[ 101.480749][ T5769] bridge0: port 2(bridge_slave_1) entered blocking state
[ 101.480882][ T5769] bridge0: port 2(bridge_slave_1) entered disabled state
[ 101.480999][ T5769] bridge_slave_1: entered allmulticast mode
[ 101.482444][ T5769] bridge_slave_1: entered promiscuous mode
[ 101.669239][ T5769] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 101.674181][ T5769] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 101.807858][ T5769] team0: Port device team_slave_0 added
[ 101.810003][ T5769] team0: Port device team_slave_1 added
[ 101.966939][ T5769] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 101.966957][ T5769] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 101.966982][ T5769] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 101.968425][ T5769] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 101.968439][ T5769] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 101.968460][ T5769] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 102.282141][ T5769] hsr_slave_0: entered promiscuous mode
[ 102.283487][ T5769] hsr_slave_1: entered promiscuous mode
[ 102.775291][ T4911] Bluetooth: hci0: command tx timeout
[ 104.320830][ T5769] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 104.359941][ T5769] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 104.362781][ T5769] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 104.425117][ T5769] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 104.426554][ T5769] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 104.462619][ T5769] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 104.478021][ T5769] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 104.518925][ T5769] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 104.731773][ T5769] 8021q: adding VLAN 0 to HW filter on device bond0
[ 104.783867][ T5769] 8021q: adding VLAN 0 to HW filter on device team0
[ 104.812333][ T2159] bridge0: port 1(bridge_slave_0) entered blocking state
[ 104.812535][ T2159] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 104.851123][ T2159] bridge0: port 2(bridge_slave_1) entered blocking state
[ 104.870493][ T2159] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 104.870537][ T4911] Bluetooth: hci0: command tx timeout
[ 105.632531][ T5769] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 105.814513][ T5769] veth0_vlan: entered promiscuous mode
[ 105.839781][ T5769] veth1_vlan: entered promiscuous mode
[ 105.921443][ T5769] veth0_macvtap: entered promiscuous mode
[ 105.952216][ T5769] veth1_macvtap: entered promiscuous mode
[ 106.000456][ T5769] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 106.020188][ T5769] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 106.366672][ T73] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 106.370676][ T73] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 106.586056][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 106.586103][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
2026/08/04 23:43:00 executed programs: 1
[ 106.658373][ T5902] jffs2: notice: (5902) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[ 106.745272][ T5905] ==================================================================
[ 106.745287][ T5905] BUG: KASAN: slab-use-after-free in mutex_lock_interruptible_nested+0x5a/0x1d0
[ 106.745333][ T5905] Read of size 1 at addr ffff888036262128 by task jffs2_gcd_mtd0/5905
[ 106.745348][ T5905]
[ 106.745371][ T5905] CPU: 0 UID: 0 PID: 5905 Comm: jffs2_gcd_mtd0 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
[ 106.745394][ T5905] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 106.745412][ T5905] Call Trace:
[ 106.745419][ T5905]
[ 106.745427][ T5905] dump_stack_lvl+0xe8/0x150
[ 106.745459][ T5905] print_address_description+0x55/0x1e0
[ 106.745484][ T5905] ? mutex_lock_interruptible_nested+0x5a/0x1d0
[ 106.745503][ T5905] print_report+0x58/0x70
[ 106.745525][ T5905] kasan_report+0x117/0x150
[ 106.745547][ T5905] ? mutex_lock_interruptible_nested+0x5a/0x1d0
[ 106.745569][ T5905] ? jffs2_garbage_collect_pass+0xb0/0x2170
[ 106.745594][ T5905] __kasan_check_byte+0x2a/0x40
[ 106.745615][ T5905] lock_acquire+0x84/0x350
[ 106.745636][ T5905] ? jffs2_garbage_collect_pass+0xb0/0x2170
[ 106.745663][ T5905] ? jffs2_garbage_collect_pass+0xb0/0x2170
[ 106.745689][ T5905] mutex_lock_interruptible_nested+0x5a/0x1d0
[ 106.745708][ T5905] ? jffs2_garbage_collect_pass+0xb0/0x2170
[ 106.745737][ T5905] jffs2_garbage_collect_pass+0xb0/0x2170
[ 106.745763][ T5905] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 106.745786][ T5905] ? lockdep_hardirqs_on+0x7a/0x110
[ 106.745809][ T5905] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 106.745832][ T5905] ? rt_mutex_slowunlock+0x4ee/0xa20
[ 106.745851][ T5905] ? reacquire_held_locks+0x104/0x190
[ 106.745874][ T5905] ? __pfx_jffs2_garbage_collect_pass+0x10/0x10
[ 106.745910][ T5905] ? rt_spin_unlock+0x157/0x200
[ 106.745929][ T5905] ? rt_spin_unlock+0x163/0x200
[ 106.745948][ T5905] ? sigprocmask+0x15c/0x1a0
[ 106.745972][ T5905] jffs2_garbage_collect_thread+0x634/0x6c0
[ 106.745997][ T5905] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10
[ 106.746019][ T5905] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 106.746042][ T5905] ? __kthread_parkme+0x71/0x1f0
[ 106.746066][ T5905] ? __kthread_parkme+0x196/0x1f0
[ 106.746091][ T5905] kthread+0x388/0x470
[ 106.746115][ T5905] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10
[ 106.746133][ T5905] ? __pfx_kthread+0x10/0x10
[ 106.746158][ T5905] ret_from_fork+0x514/0xb70
[ 106.746184][ T5905] ? __pfx_ret_from_fork+0x10/0x10
[ 106.746210][ T5905] ? __switch_to+0xc89/0x1420
[ 106.746232][ T5905] ? __pfx_kthread+0x10/0x10
[ 106.746257][ T5905] ret_from_fork_asm+0x1a/0x30
[ 106.746281][ T5905]
[ 106.746288][ T5905]
[ 106.746292][ T5905] Allocated by task 5902:
[ 106.746301][ T5905] kasan_save_track+0x3e/0x80
[ 106.746317][ T5905] __kasan_kmalloc+0x93/0xb0
[ 106.746333][ T5905] __kmalloc_cache_noprof+0x3d2/0x6b0
[ 106.746351][ T5905] jffs2_init_fs_context+0x4f/0xc0
[ 106.746365][ T5905] alloc_fs_context+0x9a3/0xd00
[ 106.746380][ T5905] do_new_mount+0x17f/0xdc0
[ 106.746392][ T5905] __se_sys_mount+0x31d/0x420
[ 106.746404][ T5905] do_syscall_64+0x174/0x580
[ 106.746425][ T5905] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 106.746442][ T5905]
[ 106.746446][ T5905] Freed by task 5769:
[ 106.746453][ T5905] kasan_save_track+0x3e/0x80
[ 106.746467][ T5905] kasan_save_free_info+0x40/0x50
[ 106.746486][ T5905] __kasan_slab_free+0x5c/0x80
[ 106.746501][ T5905] kfree+0x1c5/0x6c0
[ 106.746513][ T5905] deactivate_locked_super+0xbc/0x130
[ 106.746529][ T5905] cleanup_mnt+0x3d3/0x460
[ 106.746548][ T5905] task_work_run+0x1d9/0x270
[ 106.746563][ T5905] exit_to_user_mode_loop+0x1fa/0x730
[ 106.746580][ T5905] do_syscall_64+0x353/0x580
[ 106.746601][ T5905] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 106.746617][ T5905]
[ 106.746621][ T5905] The buggy address belongs to the object at ffff888036262000
[ 106.746621][ T5905] which belongs to the cache kmalloc-4k of size 4096
[ 106.746634][ T5905] The buggy address is located 296 bytes inside of
[ 106.746634][ T5905] freed 4096-byte region [ffff888036262000, ffff888036263000)
[ 106.746654][ T5905]
[ 106.746659][ T5905] The buggy address belongs to the physical page:
[ 106.746675][ T5905] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36260
[ 106.746707][ T5905] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 106.746721][ T5905] flags: 0x80000000000040(head|node=0|zone=1)
[ 106.746741][ T5905] page_type: f5(slab)
[ 106.746764][ T5905] raw: 0080000000000040 ffff88813ffb3140 dead000000000100 dead000000000122
[ 106.746780][ T5905] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
[ 106.746796][ T5905] head: 0080000000000040 ffff88813ffb3140 dead000000000100 dead000000000122
[ 106.746811][ T5905] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
[ 106.746826][ T5905] head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 106.746840][ T5905] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008
[ 106.746849][ T5905] page dumped because: kasan: bad access detected
[ 106.746863][ T5905] page_owner tracks the page as allocated
[ 106.746870][ T5905] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5902, tgid 5901 (syz-executor.0), ts 106656152718, free_ts 87574105052
[ 106.746906][ T5905] post_alloc_hook+0x1f9/0x250
[ 106.746923][ T5905] get_page_from_freelist+0x262a/0x26a0
[ 106.746942][ T5905] __alloc_frozen_pages_noprof+0x18d/0x380
[ 106.746961][ T5905] allocate_slab+0x79/0x5e0
[ 106.746983][ T5905] refill_objects+0x2d8/0x350
[ 106.747005][ T5905] __pcs_replace_empty_main+0x330/0x690
[ 106.747027][ T5905] __kmalloc_cache_noprof+0x468/0x6b0
[ 106.747045][ T5905] jffs2_init_fs_context+0x4f/0xc0
[ 106.747062][ T5905] alloc_fs_context+0x9a3/0xd00
[ 106.747082][ T5905] do_new_mount+0x17f/0xdc0
[ 106.747097][ T5905] __se_sys_mount+0x31d/0x420
[ 106.747112][ T5905] do_syscall_64+0x174/0x580
[ 106.747134][ T5905] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 106.747150][ T5905] page last free pid 5661 tgid 5661 stack trace:
[ 106.747160][ T5905] __free_frozen_pages+0x10e7/0x11c0
[ 106.747176][ T5905] __slab_free+0x252/0x2a0
[ 106.747192][ T5905] qlist_free_all+0x99/0x100
[ 106.747207][ T5905] kasan_quarantine_reduce+0x148/0x160
[ 106.747222][ T5905] __kasan_slab_alloc+0x22/0x80
[ 106.747239][ T5905] kmem_cache_alloc_noprof+0x355/0x650
[ 106.747255][ T5905] do_getname+0x2e/0x250
[ 106.747269][ T5905] do_sys_openat2+0xcc/0x200
[ 106.747285][ T5905] __x64_sys_openat+0x138/0x170
[ 106.747301][ T5905] do_syscall_64+0x174/0x580
[ 106.747323][ T5905] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 106.747339][ T5905]
[ 106.747342][ T5905] Memory state around the buggy address:
[ 106.747351][ T5905] ffff888036262000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 106.747362][ T5905] ffff888036262080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 106.747374][ T5905] >ffff888036262100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 106.747381][ T5905] ^
[ 106.747389][ T5905] ffff888036262180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 106.747399][ T5905] ffff888036262200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 106.747408][ T5905] ==================================================================
[ 106.750405][ T5905] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 106.750426][ T5905] CPU: 0 UID: 0 PID: 5905 Comm: jffs2_gcd_mtd0 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
[ 106.750449][ T5905] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 106.750459][ T5905] Call Trace:
[ 106.750466][ T5905]
[ 106.750474][ T5905] vpanic+0x56c/0xa60
[ 106.750496][ T5905] ? rcu_is_watching+0x15/0xb0
[ 106.750516][ T5905] ? __pfx_vpanic+0x10/0x10
[ 106.750535][ T5905] panic+0xc5/0xd0
[ 106.750551][ T5905] ? __pfx_panic+0x10/0x10
[ 106.750568][ T5905] ? preempt_schedule_thunk+0x16/0x40
[ 106.750591][ T5905] ? preempt_schedule_thunk+0x16/0x40
[ 106.750611][ T5905] ? mutex_lock_interruptible_nested+0x5a/0x1d0
[ 106.750633][ T5905] check_panic_on_warn+0x89/0xb0
[ 106.750650][ T5905] ? mutex_lock_interruptible_nested+0x5a/0x1d0
[ 106.750667][ T5905] end_report+0x73/0x170
[ 106.750687][ T5905] ? mutex_lock_interruptible_nested+0x5a/0x1d0
[ 106.750704][ T5905] kasan_report+0x128/0x150
[ 106.750724][ T5905] ? mutex_lock_interruptible_nested+0x5a/0x1d0
[ 106.750745][ T5905] ? jffs2_garbage_collect_pass+0xb0/0x2170
[ 106.750771][ T5905] __kasan_check_byte+0x2a/0x40
[ 106.750791][ T5905] lock_acquire+0x84/0x350
[ 106.750810][ T5905] ? jffs2_garbage_collect_pass+0xb0/0x2170
[ 106.750837][ T5905] ? jffs2_garbage_collect_pass+0xb0/0x2170
[ 106.750863][ T5905] mutex_lock_interruptible_nested+0x5a/0x1d0
[ 106.750880][ T5905] ? jffs2_garbage_collect_pass+0xb0/0x2170
[ 106.750918][ T5905] jffs2_garbage_collect_pass+0xb0/0x2170
[ 106.750947][ T5905] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 106.750969][ T5905] ? lockdep_hardirqs_on+0x7a/0x110
[ 106.750990][ T5905] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 106.751010][ T5905] ? rt_mutex_slowunlock+0x4ee/0xa20
[ 106.751027][ T5905] ? reacquire_held_locks+0x104/0x190
[ 106.751046][ T5905] ? __pfx_jffs2_garbage_collect_pass+0x10/0x10
[ 106.751071][ T5905] ? rt_spin_unlock+0x157/0x200
[ 106.751088][ T5905] ? rt_spin_unlock+0x163/0x200
[ 106.751103][ T5905] ? sigprocmask+0x15c/0x1a0
[ 106.751122][ T5905] jffs2_garbage_collect_thread+0x634/0x6c0
[ 106.751140][ T5905] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10
[ 106.751155][ T5905] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 106.751182][ T5905] ? __kthread_parkme+0x71/0x1f0
[ 106.751200][ T5905] ? __kthread_parkme+0x196/0x1f0
[ 106.751219][ T5905] kthread+0x388/0x470
[ 106.751238][ T5905] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10
[ 106.751253][ T5905] ? __pfx_kthread+0x10/0x10
[ 106.751274][ T5905] ret_from_fork+0x514/0xb70
[ 106.751299][ T5905] ? __pfx_ret_from_fork+0x10/0x10
[ 106.751322][ T5905] ? __switch_to+0xc89/0x1420
[ 106.751344][ T5905] ? __pfx_kthread+0x10/0x10
[ 106.751363][ T5905] ret_from_fork_asm+0x1a/0x30
[ 106.751381][ T5905]
[ 106.752310][ T5905] Kernel Offset: disabled