Warning: Permanently added '10.128.0.153' (ED25519) to the list of known hosts. 1970/01/01 00:00:56 ignoring optional flag "type"="gce" 1970/01/01 00:00:56 parsed 1 programs [ 56.270478][ T4321] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS 1970/01/01 00:00:56 executed programs: 0 [ 56.341680][ T4328] chnl_net:caif_netlink_parms(): no params data found [ 56.362330][ T4328] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.363468][ T4328] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.364963][ T4328] device bridge_slave_0 entered promiscuous mode [ 56.367093][ T4328] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.368457][ T4328] bridge0: port 2(bridge_slave_1) entered disabled state [ 56.370665][ T4328] device bridge_slave_1 entered promiscuous mode [ 56.379948][ T4328] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 56.382567][ T4328] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 56.391890][ T4328] team0: Port device team_slave_0 added [ 56.393904][ T4328] team0: Port device team_slave_1 added [ 56.401977][ T4328] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 56.403050][ T4328] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 56.407030][ T4328] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 56.409676][ T4328] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 56.410687][ T4328] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 56.414333][ T4328] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 56.489069][ T4328] device hsr_slave_0 entered promiscuous mode [ 56.528264][ T4328] device hsr_slave_1 entered promiscuous mode [ 57.053293][ T4328] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 57.079443][ T4328] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 57.119446][ T4328] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 57.160357][ T4328] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 57.197696][ T4328] bridge0: port 2(bridge_slave_1) entered blocking state [ 57.198865][ T4328] bridge0: port 2(bridge_slave_1) entered forwarding state [ 57.199992][ T4328] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.201044][ T4328] bridge0: port 1(bridge_slave_0) entered forwarding state [ 57.221342][ T4328] 8021q: adding VLAN 0 to HW filter on device bond0 [ 57.226276][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 57.229051][ T148] bridge0: port 1(bridge_slave_0) entered disabled state [ 57.230527][ T148] bridge0: port 2(bridge_slave_1) entered disabled state [ 57.232293][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 57.237011][ T4328] 8021q: adding VLAN 0 to HW filter on device team0 [ 57.241245][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 57.242689][ T325] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.243729][ T325] bridge0: port 1(bridge_slave_0) entered forwarding state [ 57.248106][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 57.250067][ T148] bridge0: port 2(bridge_slave_1) entered blocking state [ 57.251195][ T148] bridge0: port 2(bridge_slave_1) entered forwarding state [ 57.261435][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 57.263354][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 57.267600][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 57.271015][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 57.275103][ T4328] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 57.277265][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 57.280147][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 57.331263][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 57.332623][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 57.335917][ T4328] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 57.345208][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 57.347462][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 57.355845][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 57.357320][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 57.360719][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 57.362188][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 57.364663][ T4328] device veth0_vlan entered promiscuous mode [ 57.369992][ T4328] device veth1_vlan entered promiscuous mode [ 57.376930][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 57.379845][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 57.381371][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 57.382999][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 57.386027][ T4328] device veth0_macvtap entered promiscuous mode [ 57.389289][ T4328] device veth1_macvtap entered promiscuous mode [ 57.395118][ T4328] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 57.396277][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 57.397927][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 57.400351][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 57.401900][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 57.405227][ T4328] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 57.407433][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 57.409279][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 57.411183][ T4328] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.412485][ T4328] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.413758][ T4328] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.415057][ T4328] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.328561][ T13] Bluetooth: hci0: command 0x0409 tx timeout [ 60.408479][ T13] Bluetooth: hci0: command 0x041b tx timeout 1970/01/01 00:01:01 executed programs: 253 [ 62.488316][ T3623] Bluetooth: hci0: command 0x040f tx timeout [ 64.568211][ T3623] Bluetooth: hci0: command 0x0419 tx timeout 1970/01/01 00:01:06 executed programs: 663 [ 69.610014][ T2062] ieee802154 phy0 wpan0: encryption failed: -22 [ 69.610419][ T3336] cfg80211: failed to load regulatory.db [ 69.611148][ T2062] ieee802154 phy1 wpan1: encryption failed: -22 1970/01/01 00:01:11 executed programs: 1071 1970/01/01 00:01:16 executed programs: 1489 1970/01/01 00:01:21 executed programs: 1908 1970/01/01 00:01:26 executed programs: 2328 1970/01/01 00:01:31 executed programs: 2750 1970/01/01 00:01:36 executed programs: 3167 1970/01/01 00:01:41 executed programs: 3619 [ 101.758050][ C0] IPv4: Attempt to release TCP socket in state 8 000000001f9fb457 [ 101.759471][ C0] [ 101.759807][ C0] ========================= [ 101.760458][ C0] WARNING: held lock freed! [ 101.761074][ C0] syzkaller #0 Not tainted [ 101.761768][ C0] ------------------------- [ 101.762455][ C0] syz-executor.0/11967 is freeing memory ffff0000c2ca7300-ffff0000c2ca7de7, with a lock still held there! [ 101.764091][ C0] ffff0000c2ca7420 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_sendmsg+0x154/0x284 [ 101.765415][ C0] 2 locks held by syz-executor.0/11967: [ 101.766189][ C0] #0: ffff0000c2ca7420 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_sendmsg+0x154/0x284 [ 101.767487][ C0] #1: ffff800008007b80 ((&msk->sk.icsk_retransmit_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd0/0x858 [ 101.769021][ C0] [ 101.769021][ C0] stack backtrace: [ 101.769916][ C0] CPU: 0 PID: 11967 Comm: syz-executor.0 Not tainted syzkaller #0 [ 101.771143][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 [ 101.772621][ C0] Call trace: [ 101.773109][ C0] dump_backtrace+0x0/0x43c [ 101.773811][ C0] show_stack+0x2c/0x3c [ 101.774465][ C0] __dump_stack+0x30/0x40 [ 101.775214][ C0] dump_stack_lvl+0xf8/0x160 [ 101.775935][ C0] dump_stack+0x1c/0x5c [ 101.776579][ C0] debug_check_no_locks_freed+0x20c/0x2a0 [ 101.777467][ C0] slab_free_freelist_hook+0x88/0x1e8 [ 101.778286][ C0] kmem_cache_free+0xdc/0x3b4 [ 101.778938][ C0] __sk_destruct+0x42c/0x624 [ 101.779666][ C0] __sk_free+0x320/0x430 [ 101.780235][ C0] sk_free+0x68/0xdc [ 101.780759][ C0] mptcp_retransmit_timer+0x190/0x2b4 [ 101.781511][ C0] call_timer_fn+0x19c/0x858 [ 101.782144][ C0] __run_timers+0x46c/0x6c4 [ 101.782797][ C0] run_timer_softirq+0x7c/0x114 [ 101.783495][ C0] handle_softirqs+0x344/0xbf0 [ 101.784164][ C0] __irq_exit_rcu+0x240/0x440 [ 101.784811][ C0] irq_exit+0x14/0x88 [ 101.785386][ C0] handle_domain_irq+0x14c/0x1fc [ 101.786077][ C0] gic_handle_irq+0x78/0x1c8 [ 101.786740][ C0] call_on_irq_stack+0x30/0x48 [ 101.787404][ C0] do_interrupt_handler+0x6c/0x88 [ 101.788084][ C0] el1_interrupt+0x30/0x58 [ 101.788694][ C0] el1h_64_irq_handler+0x18/0x24 [ 101.789407][ C0] el1h_64_irq+0x78/0x7c [ 101.790029][ C0] _raw_spin_unlock_irqrestore+0xb8/0x14c [ 101.790873][ C0] __mod_timer+0x6e8/0xb44 [ 101.791531][ C0] mod_timer+0x2c/0x3c [ 101.792107][ C0] sk_reset_timer+0x30/0xfc [ 101.792745][ C0] __mptcp_push_pending+0x55c/0x664 [ 101.793434][ C0] mptcp_sendmsg+0x14dc/0x19ec [ 101.794091][ C0] inet_sendmsg+0x154/0x284 [ 101.794724][ C0] ____sys_sendmsg+0x61c/0x920 [ 101.795413][ C0] ___sys_sendmsg+0x1d0/0x240 [ 101.796062][ C0] __arm64_sys_sendmsg+0x1a8/0x254 [ 101.796748][ C0] invoke_syscall+0x98/0x2b8 [ 101.797348][ C0] el0_svc_common+0x138/0x258 [ 101.798008][ C0] do_el0_svc+0x58/0x14c [ 101.798581][ C0] el0_svc+0x78/0x1e0 [ 101.799114][ C0] el0t_64_sync_handler+0xcc/0xe4 [ 101.799795][ C0] el0t_64_sync+0x1a0/0x1a4 [ 101.800899][T11967] ------------[ cut here ]------------ [ 101.801683][T11967] refcount_t: addition on 0; use-after-free. [ 101.802629][T11967] WARNING: CPU: 0 PID: 11967 at lib/refcount.c:25 refcount_warn_saturate+0x134/0x1f8 [ 101.803961][T11967] Modules linked in: [ 101.804493][T11967] CPU: 0 PID: 11967 Comm: syz-executor.0 Not tainted syzkaller #0 [ 101.805587][T11967] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 [ 101.806965][T11967] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 101.808047][T11967] pc : refcount_warn_saturate+0x134/0x1f8 [ 101.808881][T11967] lr : refcount_warn_saturate+0x134/0x1f8 [ 101.809701][T11967] sp : ffff80001f4474b0 [ 101.810299][T11967] x29: ffff80001f4474b0 x28: 00000000000000d0 x27: 0000000000000000 [ 101.811429][T11967] x26: ffff0000cb668170 x25: dfff800000000000 x24: ffff0000cb668180 [ 101.812604][T11967] x23: ffff0000c2ca7b80 x22: 0000000000000000 x21: ffff0000c2ca79b8 [ 101.813814][T11967] x20: ffff0000c2ca7380 x19: ffff80001655f000 x18: 0000000000000001 [ 101.814976][T11967] x17: 0000000000000000 x16: ffff800008302164 x15: 00000000ffffffff [ 101.816194][T11967] x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 [ 101.817397][T11967] x11: 0000000000000000 x10: 0000000000000000 x9 : eb04aa51d9105000 [ 101.818575][T11967] x8 : eb04aa51d9105000 x7 : 0000000000000001 x6 : 0000000000000001 [ 101.819744][T11967] x5 : ffff80001f446d98 x4 : ffff8000141ff5a0 x3 : ffff800008302274 [ 101.820915][T11967] x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000002a [ 101.822081][T11967] Call trace: [ 101.822573][T11967] refcount_warn_saturate+0x134/0x1f8 [ 101.823337][T11967] sk_reset_timer+0xcc/0xfc [ 101.823968][T11967] __mptcp_push_pending+0x55c/0x664 [ 101.824667][T11967] mptcp_sendmsg+0x14dc/0x19ec [ 101.825337][T11967] inet_sendmsg+0x154/0x284 [ 101.825971][T11967] ____sys_sendmsg+0x61c/0x920 [ 101.826625][T11967] ___sys_sendmsg+0x1d0/0x240 [ 101.827307][T11967] __arm64_sys_sendmsg+0x1a8/0x254 [ 101.828053][T11967] invoke_syscall+0x98/0x2b8 [ 101.828731][T11967] el0_svc_common+0x138/0x258 [ 101.829386][T11967] do_el0_svc+0x58/0x14c [ 101.829963][T11967] el0_svc+0x78/0x1e0 [ 101.830507][T11967] el0t_64_sync_handler+0xcc/0xe4 [ 101.831182][T11967] el0t_64_sync+0x1a0/0x1a4 [ 101.831804][T11967] irq event stamp: 1564 [ 101.832409][T11967] hardirqs last enabled at (1564): [] kasan_quarantine_put+0xc4/0x204 [ 101.833826][T11967] hardirqs last disabled at (1563): [] kasan_quarantine_put+0x108/0x204 [ 101.835180][T11967] softirqs last enabled at (1528): [] mptcp_sendmsg+0xccc/0x19ec [ 101.836436][T11967] softirqs last disabled at (1533): [] __irq_exit_rcu+0x240/0x440 [ 101.837830][T11967] ---[ end trace 578d2326e5830231 ]--- [ 101.839745][T11966] ------------[ cut here ]------------ [ 101.840682][T11966] refcount_t: saturated; leaking memory. [ 101.841634][T11966] WARNING: CPU: 1 PID: 11966 at lib/refcount.c:22 refcount_warn_saturate+0x1b4/0x1f8 [ 101.843041][T11966] Modules linked in: [ 101.843633][T11966] CPU: 1 PID: 11966 Comm: syz-executor.0 Tainted: G W syzkaller #0 [ 101.844984][T11966] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 [ 101.846462][T11966] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 101.847587][T11966] pc : refcount_warn_saturate+0x1b4/0x1f8 [ 101.848418][T11966] lr : refcount_warn_saturate+0x1b4/0x1f8 [ 101.849247][T11966] sp : ffff80001f2579a0 [ 101.849862][T11966] x29: ffff80001f2579a0 x28: ffff0000e2d568d0 x27: 1fffe0001bb252d5 [ 101.851011][T11966] x26: ffff0000c2ca7300 x25: ffff80001409f000 x24: 1ffff00002813e30 [ 101.852252][T11966] x23: ffff0000c2ca7cd0 x22: 00000000c0000000 x21: ffff0000c2ca7380 [ 101.853427][T11966] x20: ffff0000c2ca7380 x19: ffff80001655f000 x18: 0000000000000001 [ 101.854578][T11966] x17: 0000000000000000 x16: ffff800011169180 x15: 00000000ffffffff [ 101.855726][T11966] x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 [ 101.856914][T11966] x11: 0000000000000000 x10: 0000000000000000 x9 : cf989562efe81a00 [ 101.858067][T11966] x8 : cf989562efe81a00 x7 : 0000000000000001 x6 : 0000000000000001 [ 101.859254][T11966] x5 : ffff80001f257298 x4 : ffff8000141ff5a0 x3 : ffff8000085043fc [ 101.860389][T11966] x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000026 [ 101.861502][T11966] Call trace: [ 101.861985][T11966] refcount_warn_saturate+0x1b4/0x1f8 [ 101.862756][T11966] mptcp_close+0x738/0xa04 [ 101.863354][T11966] inet_release+0x120/0x16c [ 101.863978][T11966] sock_close+0xb4/0x1f8 [ 101.864556][T11966] __fput+0x1c0/0x7f8 [ 101.865124][T11966] ____fput+0x20/0x30 [ 101.865681][T11966] task_work_run+0x12c/0x1e0 [ 101.866315][T11966] do_notify_resume+0x24b4/0x3128 [ 101.867040][T11966] el0_svc+0xf0/0x1e0 [ 101.867623][T11966] el0t_64_sync_handler+0xcc/0xe4 [ 101.868348][T11966] el0t_64_sync+0x1a0/0x1a4 [ 101.868994][T11966] irq event stamp: 1506 [ 101.869559][T11966] hardirqs last enabled at (1505): [] _raw_spin_unlock_irqrestore+0xa8/0x14c [ 101.870995][T11966] hardirqs last disabled at (1506): [] __schedule+0x2ec/0x1bf8 [ 101.872305][T11966] softirqs last enabled at (1428): [] local_bh_enable+0x10/0x34 [ 101.873638][T11966] softirqs last disabled at (1426): [] local_bh_disable+0x10/0x34 [ 101.874923][T11966] ---[ end trace 578d2326e5830232 ]--- [ 101.876073][T11966] ------------[ cut here ]------------ [ 101.876925][T11966] ODEBUG: assert_init not available (active state 0) object type: timer_list hint: mptcp_retransmit_timer+0x0/0x2b4 [ 101.878938][T11966] WARNING: CPU: 1 PID: 11966 at lib/debugobjects.c:521 debug_print_object+0x148/0x1d4 [ 101.880230][T11966] Modules linked in: [ 101.880787][T11966] CPU: 1 PID: 11966 Comm: syz-executor.0 Tainted: G W syzkaller #0 [ 101.882052][T11966] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 [ 101.883575][T11966] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 101.884826][T11966] pc : debug_print_object+0x148/0x1d4 [ 101.885629][T11966] lr : debug_print_object+0x148/0x1d4 [ 101.886400][T11966] sp : ffff80001f257790 [ 101.886986][T11966] x29: ffff80001f257790 x28: dfff800000000000 x27: 0000000000000002 [ 101.888119][T11966] x26: ffff800014120000 x25: ffff80000837e34c x24: dfff800000000000 [ 101.889326][T11966] x23: 0000000000000000 x22: ffff80001105837c x21: ffff80001177d820 [ 101.890503][T11966] x20: ffff8000112e2ec0 x19: ffff80001177d360 x18: 0000000000000001 [ 101.891679][T11966] x17: 0000000000000000 x16: ffff800011169180 x15: 00000000ffffffff [ 101.892885][T11966] x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 [ 101.894065][T11966] x11: 0000000000000000 x10: 0000000000000000 x9 : cf989562efe81a00 [ 101.895277][T11966] x8 : cf989562efe81a00 x7 : 0000000000000001 x6 : 0000000000000001 [ 101.896445][T11966] x5 : ffff80001f257078 x4 : ffff8000141ff5a0 x3 : ffff80000a728d0c [ 101.897573][T11966] x2 : ffff0001a1152d50 x1 : 0000000100000000 x0 : 0000000000000071 [ 101.898698][T11966] Call trace: [ 101.899153][T11966] debug_print_object+0x148/0x1d4 [ 101.899878][T11966] debug_object_assert_init+0x24c/0x2c4 [ 101.900665][T11966] del_timer+0x48/0x1e4 [ 101.901291][T11966] sk_stop_timer+0x24/0xd4 [ 101.901936][T11966] __mptcp_destroy_sock+0x284/0x610 [ 101.902656][T11966] mptcp_close+0x5b8/0xa04 [ 101.903271][T11966] inet_release+0x120/0x16c [ 101.903962][T11966] sock_close+0xb4/0x1f8 [ 101.904576][T11966] __fput+0x1c0/0x7f8 [ 101.905178][T11966] ____fput+0x20/0x30 [ 101.905746][T11966] task_work_run+0x12c/0x1e0 [ 101.906402][T11966] do_notify_resume+0x24b4/0x3128 [ 101.907110][T11966] el0_svc+0xf0/0x1e0 [ 101.907688][T11966] el0t_64_sync_handler+0xcc/0xe4 [ 101.908407][T11966] el0t_64_sync+0x1a0/0x1a4 [ 101.909043][T11966] irq event stamp: 1506 [ 101.909618][T11966] hardirqs last enabled at (1505): [] _raw_spin_unlock_irqrestore+0xa8/0x14c [ 101.911043][T11966] hardirqs last disabled at (1506): [] __schedule+0x2ec/0x1bf8 [ 101.912249][T11966] softirqs last enabled at (1428): [] local_bh_enable+0x10/0x34 [ 101.913502][T11966] softirqs last disabled at (1426): [] local_bh_disable+0x10/0x34 [ 101.914819][T11966] ---[ end trace 578d2326e5830233 ]--- [ 101.915622][T11966] ------------[ cut here ]------------ [ 101.916391][T11966] ODEBUG: assert_init not available (active state 0) object type: timer_list hint: mptcp_tout_timer+0x0/0xe8 [ 101.918060][T11966] WARNING: CPU: 1 PID: 11966 at lib/debugobjects.c:521 debug_print_object+0x148/0x1d4 [ 101.919322][T11966] Modules linked in: [ 101.919846][T11966] CPU: 1 PID: 11966 Comm: syz-executor.0 Tainted: G W syzkaller #0 [ 101.921111][T11966] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 [ 101.922479][T11966] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 101.923640][T11966] pc : debug_print_object+0x148/0x1d4 [ 101.924449][T11966] lr : debug_print_object+0x148/0x1d4 [ 101.925245][T11966] sp : ffff80001f257790 [ 101.925836][T11966] x29: ffff80001f257790 x28: dfff800000000000 x27: 0000000000000003 [ 101.927085][T11966] x26: ffff800014120000 x25: ffff80000837e34c x24: dfff800000000000 [ 101.928269][T11966] x23: 0000000000000000 x22: ffff800011058630 x21: ffff80001177d820 [ 101.929422][T11966] x20: ffff8000112e2ec0 x19: ffff80001177d360 x18: 0000000000000001 [ 101.930576][T11966] x17: 0000000000000000 x16: ffff800011169180 x15: 00000000ffffffff [ 101.931695][T11966] x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 [ 101.932813][T11966] x11: 0000000000000000 x10: 0000000000000000 x9 : cf989562efe81a00 [ 101.933977][T11966] x8 : cf989562efe81a00 x7 : 0000000000000001 x6 : 0000000000000001 [ 101.935156][T11966] x5 : ffff80001f257078 x4 : ffff8000141ff5a0 x3 : ffff80000a728d0c [ 101.936328][T11966] x2 : ffff0001a1152d50 x1 : 0000000100000000 x0 : 000000000000006a [ 101.937513][T11966] Call trace: [ 101.937993][T11966] debug_print_object+0x148/0x1d4 [ 101.938699][T11966] debug_object_assert_init+0x24c/0x2c4 [ 101.939496][T11966] del_timer+0x48/0x1e4 [ 101.940090][T11966] sk_stop_timer+0x24/0xd4 [ 101.940717][T11966] __mptcp_destroy_sock+0x290/0x610 [ 101.941410][T11966] mptcp_close+0x5b8/0xa04 [ 101.942029][T11966] inet_release+0x120/0x16c [ 101.942685][T11966] sock_close+0xb4/0x1f8 [ 101.943272][T11966] __fput+0x1c0/0x7f8 [ 101.943823][T11966] ____fput+0x20/0x30 [ 101.944396][T11966] task_work_run+0x12c/0x1e0 [ 101.945045][T11966] do_notify_resume+0x24b4/0x3128 [ 101.945766][T11966] el0_svc+0xf0/0x1e0 [ 101.946335][T11966] el0t_64_sync_handler+0xcc/0xe4 [ 101.947047][T11966] el0t_64_sync+0x1a0/0x1a4 [ 101.947688][T11966] irq event stamp: 1506 [ 101.948252][T11966] hardirqs last enabled at (1505): [] _raw_spin_unlock_irqrestore+0xa8/0x14c [ 101.949832][T11966] hardirqs last disabled at (1506): [] __schedule+0x2ec/0x1bf8 [ 101.951175][T11966] softirqs last enabled at (1428): [] local_bh_enable+0x10/0x34 [ 101.952555][T11966] softirqs last disabled at (1426): [] local_bh_disable+0x10/0x34 [ 101.953868][T11966] ---[ end trace 578d2326e5830234 ]--- [ 101.954727][T11966] ------------[ cut here ]------------ [ 101.955482][T11966] refcount_t: underflow; use-after-free. [ 101.956383][T11966] WARNING: CPU: 1 PID: 11966 at lib/refcount.c:28 refcount_warn_saturate+0x154/0x1f8 [ 101.957680][T11966] Modules linked in: [ 101.958222][T11966] CPU: 1 PID: 11966 Comm: syz-executor.0 Tainted: G W syzkaller #0 [ 101.959550][T11966] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 [ 101.960998][T11966] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 101.962112][T11966] pc : refcount_warn_saturate+0x154/0x1f8 [ 101.962951][T11966] lr : refcount_warn_saturate+0x154/0x1f8 [ 101.963846][T11966] sp : ffff80001f2578c0 [ 101.964497][T11966] x29: ffff80001f2578c0 x28: dfff800000000000 x27: 1ffff00003e4af20 [ 101.965690][T11966] x26: ffff0000c2ca7300 x25: 1fffe00018594f9a x24: ffff0000c2ca7cd0 [ 101.967000][T11966] x23: ffff0000c2ca7cf8 x22: 0000000000000000 x21: 00000000c0000000 [ 101.968310][T11966] x20: ffff0000c2ca7380 x19: ffff80001655f000 x18: 0000000000000001 [ 101.969497][T11966] x17: 0000000000000000 x16: ffff800011169180 x15: 00000000ffffffff [ 101.970742][T11966] x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 [ 101.971974][T11966] x11: 0000000000000000 x10: 0000000000000000 x9 : cf989562efe81a00 [ 101.973200][T11966] x8 : cf989562efe81a00 x7 : 0000000000000001 x6 : 0000000000000001 [ 101.974353][T11966] x5 : ffff80001f2571b8 x4 : ffff8000141ff5a0 x3 : ffff80000a728d0c [ 101.975498][T11966] x2 : ffff0001a1152d50 x1 : 0000000100000000 x0 : 0000000000000026 [ 101.976615][T11966] Call trace: [ 101.977076][T11966] refcount_warn_saturate+0x154/0x1f8 [ 101.977827][T11966] __mptcp_destroy_sock+0x564/0x610 [ 101.978581][T11966] mptcp_close+0x5b8/0xa04 [ 101.979173][T11966] inet_release+0x120/0x16c [ 101.979877][T11966] sock_close+0xb4/0x1f8 [ 101.980451][T11966] __fput+0x1c0/0x7f8 [ 101.980998][T11966] ____fput+0x20/0x30 [ 101.981589][T11966] task_work_run+0x12c/0x1e0 [ 101.982245][T11966] do_notify_resume+0x24b4/0x3128 [ 101.982962][T11966] el0_svc+0xf0/0x1e0 [ 101.983545][T11966] el0t_64_sync_handler+0xcc/0xe4 [ 101.984279][T11966] el0t_64_sync+0x1a0/0x1a4 [ 101.984892][T11966] irq event stamp: 1506 [ 101.985483][T11966] hardirqs last enabled at (1505): [] _raw_spin_unlock_irqrestore+0xa8/0x14c [ 101.986949][T11966] hardirqs last disabled at (1506): [] __schedule+0x2ec/0x1bf8 [ 101.988321][T11966] softirqs last enabled at (1428): [] local_bh_enable+0x10/0x34 [ 101.989656][T11966] softirqs last disabled at (1426): [] local_bh_disable+0x10/0x34 [ 101.991000][T11966] ---[ end trace 578d2326e5830235 ]--- 1970/01/01 00:01:46 executed programs: 4175 1970/01/01 00:01:51 executed programs: 4764