Warning: Permanently added '10.128.0.116' (ED25519) to the list of known hosts. 2026/01/04 19:55:07 parsed 1 programs [ 64.347243][ T2382] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 64.972392][ T2387] chnl_net:caif_netlink_parms(): no params data found [ 66.633756][ T2387] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.743858][ T2387] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.917728][ T101] bond0 (unregistering): Released all slaves [ 70.591768][ T1954] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 70.600112][ T1954] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 70.607808][ T1954] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 70.615886][ T1954] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 70.623511][ T1954] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 70.630860][ T1954] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 2026/01/04 19:55:14 executed programs: 0 [ 70.940395][ T1920] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 70.948012][ T1920] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 70.955375][ T1920] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 70.963463][ T1920] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 70.971869][ T1920] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 70.979365][ T1920] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 71.171796][ T2873] chnl_net:caif_netlink_parms(): no params data found [ 72.877462][ T2873] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.062213][ T1920] Bluetooth: hci0: command tx timeout [ 73.982101][ T2873] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.142156][ T1920] Bluetooth: hci0: command tx timeout 2026/01/04 19:55:19 executed programs: 2 [ 77.222220][ T1920] Bluetooth: hci0: command tx timeout [ 79.302148][ T1920] Bluetooth: hci0: command tx timeout [ 80.244492][ T1277] ================================================================== [ 80.252630][ T1277] BUG: KASAN: slab-use-after-free in __lock_acquire+0x91/0xba0 [ 80.260201][ T1277] Read of size 8 at addr ffff888173802c38 by task kworker/u4:10/1277 [ 80.268255][ T1277] [ 80.270585][ T1277] CPU: 1 PID: 1277 Comm: kworker/u4:10 Not tainted syzkaller #0 [ 80.278490][ T1277] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 80.288633][ T1277] Workqueue: kkcmd kcm_tx_work [ 80.293403][ T1277] Call Trace: [ 80.296725][ T1277] [ 80.299658][ T1277] dump_stack_lvl+0xe0/0x160 [ 80.304419][ T1277] ? show_regs_print_info+0x10/0x10 [ 80.309643][ T1277] ? load_image+0x550/0x550 [ 80.314243][ T1277] ? _raw_spin_lock_irqsave+0xa6/0xe0 [ 80.319812][ T1277] ? __virt_addr_valid+0x13d/0x270 [ 80.324945][ T1277] ? __virt_addr_valid+0x21e/0x270 [ 80.330067][ T1277] print_report+0xac/0x220 [ 80.334494][ T1277] ? __lock_acquire+0x91/0xba0 [ 80.339280][ T1277] kasan_report+0x117/0x150 [ 80.343785][ T1277] ? __lock_acquire+0x5c5/0xba0 [ 80.348641][ T1277] ? __lock_acquire+0x91/0xba0 [ 80.353411][ T1277] __lock_acquire+0x91/0xba0 [ 80.358010][ T1277] lock_acquire+0x171/0x350 [ 80.362550][ T1277] ? lock_sock_nested+0x4f/0xd0 [ 80.367433][ T1277] ? read_lock_is_recursive+0x20/0x20 [ 80.372837][ T1277] ? __lock_acquire+0xba0/0xba0 [ 80.377795][ T1277] ? lock_sock_nested+0x4f/0xd0 [ 80.382669][ T1277] _raw_spin_lock_bh+0x33/0x50 [ 80.387539][ T1277] ? lock_sock_nested+0x4f/0xd0 [ 80.392392][ T1277] lock_sock_nested+0x4f/0xd0 [ 80.397069][ T1277] kcm_tx_work+0x2c/0x140 [ 80.401398][ T1277] ? process_scheduled_works+0x895/0x11f0 [ 80.407126][ T1277] process_scheduled_works+0x92b/0x11f0 [ 80.412881][ T1277] ? assign_work+0x370/0x370 [ 80.417677][ T1277] ? assign_work+0x25c/0x370 [ 80.422470][ T1277] worker_thread+0x856/0xc80 [ 80.427125][ T1277] kthread+0x229/0x280 [ 80.431227][ T1277] ? pr_cont_work+0x4a0/0x4a0 [ 80.436008][ T1277] ? kthread_blkcg+0xa0/0xa0 [ 80.440610][ T1277] ret_from_fork+0x2f/0x60 [ 80.445212][ T1277] ? kthread_blkcg+0xa0/0xa0 [ 80.449895][ T1277] ret_from_fork_asm+0x11/0x20 [ 80.454753][ T1277] [ 80.457771][ T1277] [ 80.460110][ T1277] Allocated by task 3296: [ 80.464440][ T1277] kasan_set_track+0x4e/0x70 [ 80.469176][ T1277] __kasan_slab_alloc+0x6c/0x80 [ 80.474052][ T1277] slab_post_alloc_hook+0x66/0x430 [ 80.479334][ T1277] kmem_cache_alloc+0x11e/0x2a0 [ 80.484205][ T1277] sk_prot_alloc+0x51/0x1c0 [ 80.488708][ T1277] sk_alloc+0x34/0x830 [ 80.492768][ T1277] kcm_ioctl+0x28e/0xe20 [ 80.497016][ T1277] sock_do_ioctl+0xd1/0x260 [ 80.501512][ T1277] sock_ioctl+0x4a7/0x560 [ 80.505860][ T1277] __se_sys_ioctl+0xad/0x100 [ 80.510762][ T1277] do_syscall_64+0x55/0xb0 [ 80.515257][ T1277] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 80.521151][ T1277] [ 80.523488][ T1277] Freed by task 3297: [ 80.527507][ T1277] kasan_set_track+0x4e/0x70 [ 80.532130][ T1277] kasan_save_free_info+0x2e/0x50 [ 80.537273][ T1277] ____kasan_slab_free+0x126/0x1e0 [ 80.542481][ T1277] slab_free_freelist_hook+0x130/0x1b0 [ 80.547945][ T1277] kmem_cache_free+0xe7/0x250 [ 80.552610][ T1277] __sk_destruct+0x38c/0x530 [ 80.557196][ T1277] kcm_release+0x379/0x4f0 [ 80.561604][ T1277] sock_close+0xb3/0x210 [ 80.566025][ T1277] __fput+0x1b1/0x790 [ 80.570030][ T1277] __se_sys_close+0x118/0x170 [ 80.574706][ T1277] do_syscall_64+0x55/0xb0 [ 80.579130][ T1277] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 80.585059][ T1277] [ 80.587468][ T1277] Last potentially related work creation: [ 80.593298][ T1277] kasan_save_stack+0x3e/0x60 [ 80.598064][ T1277] __kasan_record_aux_stack+0xaf/0xc0 [ 80.603550][ T1277] insert_work+0x37/0x1f0 [ 80.608147][ T1277] __queue_work+0x801/0xa50 [ 80.612784][ T1277] queue_work_on+0xbe/0x140 [ 80.617307][ T1277] kcm_unattach+0x8c2/0xe60 [ 80.621927][ T1277] kcm_ioctl+0x6d5/0xe20 [ 80.626177][ T1277] sock_do_ioctl+0xd1/0x260 [ 80.630739][ T1277] sock_ioctl+0x4a7/0x560 [ 80.635351][ T1277] __se_sys_ioctl+0xad/0x100 [ 80.640137][ T1277] do_syscall_64+0x55/0xb0 [ 80.644595][ T1277] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 80.650670][ T1277] [ 80.653018][ T1277] Second to last potentially related work creation: [ 80.659724][ T1277] kasan_save_stack+0x3e/0x60 [ 80.664401][ T1277] __kasan_record_aux_stack+0xaf/0xc0 [ 80.669884][ T1277] insert_work+0x37/0x1f0 [ 80.674304][ T1277] __queue_work+0x801/0xa50 [ 80.678806][ T1277] queue_work_on+0xbe/0x140 [ 80.683303][ T1277] kcm_ioctl+0xc9a/0xe20 [ 80.687551][ T1277] sock_do_ioctl+0xd1/0x260 [ 80.692096][ T1277] sock_ioctl+0x4a7/0x560 [ 80.696468][ T1277] __se_sys_ioctl+0xad/0x100 [ 80.701090][ T1277] do_syscall_64+0x55/0xb0 [ 80.705531][ T1277] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 80.711436][ T1277] [ 80.713768][ T1277] The buggy address belongs to the object at ffff888173802b80 [ 80.713768][ T1277] which belongs to the cache KCM of size 1720 [ 80.727217][ T1277] The buggy address is located 184 bytes inside of [ 80.727217][ T1277] freed 1720-byte region [ffff888173802b80, ffff888173803238) [ 80.741098][ T1277] [ 80.743425][ T1277] The buggy address belongs to the physical page: [ 80.749939][ T1277] page:ffffea0005ce0000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x173800 [ 80.760659][ T1277] head:ffffea0005ce0000 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 80.769756][ T1277] memcg:ffff88817774f601 [ 80.773990][ T1277] flags: 0x100000000000840(slab|head|node=0|zone=2) [ 80.780589][ T1277] page_type: 0xffffffff() [ 80.785202][ T1277] raw: 0100000000000840 ffff888106b3ea00 dead000000000122 0000000000000000 [ 80.793802][ T1277] raw: 0000000000000000 0000000080110011 00000001ffffffff ffff88817774f601 [ 80.802565][ T1277] page dumped because: kasan: bad access detected [ 80.808997][ T1277] page_owner tracks the page as allocated [ 80.814738][ T1277] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 3276, tgid 3273 (syz.2.16), ts 76025339353, free_ts 75946438942 [ 80.837240][ T1277] post_alloc_hook+0x26b/0x290 [ 80.842133][ T1277] get_page_from_freelist+0x3447/0x35f0 [ 80.847694][ T1277] __alloc_pages+0x1e3/0x430 [ 80.852303][ T1277] alloc_slab_page+0x5d/0x170 [ 80.857111][ T1277] new_slab+0x70/0x260 [ 80.861291][ T1277] ___slab_alloc+0xa3e/0xee0 [ 80.865896][ T1277] kmem_cache_alloc+0x19c/0x2a0 [ 80.870756][ T1277] sk_prot_alloc+0x51/0x1c0 [ 80.875272][ T1277] sk_alloc+0x34/0x830 [ 80.879345][ T1277] kcm_ioctl+0x28e/0xe20 [ 80.883591][ T1277] sock_do_ioctl+0xd1/0x260 [ 80.888455][ T1277] sock_ioctl+0x4a7/0x560 [ 80.892906][ T1277] __se_sys_ioctl+0xad/0x100 [ 80.897549][ T1277] do_syscall_64+0x55/0xb0 [ 80.902009][ T1277] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 80.908035][ T1277] page last free stack trace: [ 80.912712][ T1277] free_unref_page_prepare+0x7f9/0x910 [ 80.918288][ T1277] free_unref_page+0x32/0x290 [ 80.923594][ T1277] __unfreeze_partials+0x1a4/0x1e0 [ 80.928705][ T1277] put_cpu_partial+0x14c/0x1b0 [ 80.933461][ T1277] __slab_free+0x297/0x380 [ 80.937963][ T1277] qlist_free_all+0x75/0xe0 [ 80.942505][ T1277] kasan_quarantine_reduce+0x143/0x160 [ 80.948079][ T1277] __kasan_slab_alloc+0x22/0x80 [ 80.952982][ T1277] slab_post_alloc_hook+0x66/0x430 [ 80.958089][ T1277] kmem_cache_alloc+0x11e/0x2a0 [ 80.962949][ T1277] vm_area_alloc+0x1f/0x190 [ 80.967444][ T1277] mmap_region+0xac9/0x1810 [ 80.972050][ T1277] do_mmap+0x710/0xc30 [ 80.976138][ T1277] vm_mmap_pgoff+0x191/0x350 [ 80.980749][ T1277] ksys_mmap_pgoff+0x2c2/0x3b0 [ 80.985522][ T1277] do_syscall_64+0x55/0xb0 [ 80.989968][ T1277] [ 80.992307][ T1277] Memory state around the buggy address: [ 80.998038][ T1277] ffff888173802b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 81.006106][ T1277] ffff888173802b80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 81.014253][ T1277] >ffff888173802c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 81.022489][ T1277] ^ [ 81.028398][ T1277] ffff888173802c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 81.036489][ T1277] ffff888173802d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 81.044581][ T1277] ================================================================== [ 81.052674][ T1277] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 81.060614][ T1277] Kernel Offset: disabled [ 81.064939][ T1277] Rebooting in 86400 seconds..