Warning: Permanently added '10.128.1.125' (ED25519) to the list of known hosts. 1970/01/01 00:00:30 parsed 1 programs 1970/01/01 00:00:30 serving rpc on tcp://36413 [ 31.505801][ T4340] cgroup: Unknown subsys name 'net' [ 31.742599][ T4340] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 32.025591][ T4340] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 35.863996][ T4364] chnl_net:caif_netlink_parms(): no params data found [ 35.881521][ T4364] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.882919][ T4364] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.884542][ T4364] device bridge_slave_0 entered promiscuous mode [ 35.886808][ T4364] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.888104][ T4364] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.889586][ T4364] device bridge_slave_1 entered promiscuous mode [ 35.896036][ T4364] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 35.898840][ T4364] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 35.905027][ T4364] team0: Port device team_slave_0 added [ 35.906849][ T4364] team0: Port device team_slave_1 added [ 35.913891][ T4364] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 35.915241][ T4364] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 35.919553][ T4364] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 35.922726][ T4364] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 35.923837][ T4364] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 35.927915][ T4364] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 35.991100][ T4364] device hsr_slave_0 entered promiscuous mode [ 36.030112][ T4364] device hsr_slave_1 entered promiscuous mode [ 36.105611][ T4364] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 36.132685][ T4364] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 36.202490][ T4364] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 36.262620][ T4364] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 36.319453][ T4364] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.320856][ T4364] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.322362][ T4364] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.323567][ T4364] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.341005][ T4364] 8021q: adding VLAN 0 to HW filter on device bond0 [ 36.344719][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 36.347248][ T1579] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.349223][ T1579] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.352198][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 36.356481][ T4364] 8021q: adding VLAN 0 to HW filter on device team0 [ 36.360537][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 36.362272][ T1579] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.363463][ T1579] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.366267][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 36.367840][ T1579] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.369101][ T1579] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.377660][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 36.379379][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 36.385337][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 36.388428][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 36.391960][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 36.394506][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 36.445986][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 36.447319][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 36.452066][ T4364] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 36.459590][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 36.466515][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 36.468410][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 36.469848][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 36.473020][ T4364] device veth0_vlan entered promiscuous mode [ 36.476230][ T4364] device veth1_vlan entered promiscuous mode [ 36.482805][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 36.484317][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 36.485949][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 36.488363][ T4364] device veth0_macvtap entered promiscuous mode [ 36.490984][ T4364] device veth1_macvtap entered promiscuous mode [ 36.496476][ T4364] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 36.497704][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 36.499714][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 36.551252][ T4364] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 36.553528][ T4364] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.555076][ T4364] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.556601][ T4364] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.558031][ T4364] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 36.561527][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 36.932001][ T188] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 36.956533][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 36.957906][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 36.959614][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 36.967679][ T1579] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 36.969046][ T1579] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 36.971309][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 37.719926][ T4414] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 37.721774][ T4414] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 37.723290][ T4414] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 37.724830][ T4414] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 37.726234][ T4414] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 37.727547][ T4414] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 1970/01/01 00:00:37 executed programs: 0 [ 38.022007][ T48] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 38.023574][ T48] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 38.025157][ T48] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 38.026669][ T48] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 38.028061][ T48] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 38.029381][ T48] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 38.075368][ T4427] chnl_net:caif_netlink_parms(): no params data found [ 38.093630][ T4427] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.094926][ T4427] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.096500][ T4427] device bridge_slave_0 entered promiscuous mode [ 38.098632][ T4427] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.099733][ T4427] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.102422][ T4427] device bridge_slave_1 entered promiscuous mode [ 38.109520][ T4427] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.112214][ T4427] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.118515][ T4427] team0: Port device team_slave_0 added [ 38.120721][ T4427] team0: Port device team_slave_1 added [ 38.126282][ T4427] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.127466][ T4427] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 38.131965][ T4427] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.134306][ T4427] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.135432][ T4427] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 38.139399][ T4427] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.181169][ T4427] device hsr_slave_0 entered promiscuous mode [ 38.220148][ T4427] device hsr_slave_1 entered promiscuous mode [ 38.260136][ T4427] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 38.261561][ T4427] Cannot create hsr debugfs directory [ 39.982220][ T188] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.080283][ T4414] Bluetooth: hci0: command 0x0409 tx timeout [ 42.160401][ T4414] Bluetooth: hci0: command 0x041b tx timeout [ 42.162550][ T188] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 42.251812][ T188] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 43.271693][ T4427] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 43.354403][ T4427] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 43.434365][ T4427] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 43.481137][ T4427] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 43.574522][ T4427] 8021q: adding VLAN 0 to HW filter on device bond0 [ 43.578051][ T1718] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 43.579723][ T1718] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 43.583421][ T4427] 8021q: adding VLAN 0 to HW filter on device team0 [ 43.586321][ T1718] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 43.587944][ T1718] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 43.589523][ T1718] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.590780][ T1718] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.592499][ T1718] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 43.615520][ T1718] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 43.617085][ T1718] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 43.618689][ T1718] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.619816][ T1718] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.623713][ T1718] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 43.626452][ T1718] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 43.629151][ T1718] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 43.630995][ T1718] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 43.633180][ T1718] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 43.635513][ T1718] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 43.637228][ T1718] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 43.640881][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 43.643000][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 43.646019][ T1718] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 43.647511][ T1718] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 43.649715][ T4427] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 43.720690][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 43.722174][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 43.725424][ T4427] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 43.734883][ T188] device hsr_slave_0 left promiscuous mode [ 43.780292][ T188] device hsr_slave_1 left promiscuous mode [ 43.859990][ T188] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 43.861265][ T188] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 43.863057][ T188] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 43.864244][ T188] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 43.865628][ T188] device bridge_slave_1 left promiscuous mode [ 43.867152][ T188] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.900606][ T188] device bridge_slave_0 left promiscuous mode [ 43.901727][ T188] bridge0: port 1(bridge_slave_0) entered disabled state [ 44.030168][ T188] device veth1_macvtap left promiscuous mode [ 44.031157][ T188] device veth0_macvtap left promiscuous mode [ 44.032198][ T188] device veth1_vlan left promiscuous mode [ 44.033240][ T188] device veth0_vlan left promiscuous mode [ 44.239921][ T4414] Bluetooth: hci0: command 0x040f tx timeout [ 46.121110][ T188] team0 (unregistering): Port device team_slave_1 removed [ 46.291011][ T188] team0 (unregistering): Port device team_slave_0 removed [ 46.319989][ T4414] Bluetooth: hci0: command 0x0419 tx timeout [ 46.501343][ T188] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 46.700312][ T188] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 48.290732][ T188] bond0 (unregistering): Released all slaves [ 48.601527][ T1718] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 48.603635][ T1718] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 48.607058][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 48.608898][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 48.611514][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 48.612940][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 48.614491][ T4427] device veth0_vlan entered promiscuous mode [ 48.617752][ T4427] device veth1_vlan entered promiscuous mode [ 48.624742][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 48.626337][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 48.627769][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 48.629444][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 48.636633][ T4427] device veth0_macvtap entered promiscuous mode [ 48.639138][ T4427] device veth1_macvtap entered promiscuous mode [ 48.644499][ T4427] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 48.645782][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 48.647252][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 48.648670][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 48.650820][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 48.653612][ T4427] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 48.654969][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 48.656518][ T1579] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 48.658908][ T4427] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.661065][ T4427] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.662556][ T4427] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.663916][ T4427] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.688728][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 48.690261][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 48.692067][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 48.697853][ T1579] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 48.699059][ T1579] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 48.700587][ T1718] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 1970/01/01 00:00:48 executed programs: 2 [ 48.763015][ T4501] md: pers->run() failed ... [ 48.783902][ T4501] md: could not open device unknown-block(1,2). [ 48.798739][ T4504] md: could not open device unknown-block(1,0). [ 48.812559][ T4504] md/raid1:md0: active with 1 out of 4 mirrors [ 48.817026][ T4504] md: could not open device unknown-block(1,2). [ 48.872719][ T4507] md: could not open device unknown-block(1,0). [ 48.872971][ T4508] md: recovery of RAID array md0 [ 48.874724][ T4508] md: md0: recovery done. [ 48.875569][ T4508] ================================================================== [ 48.876373][ T4507] md: could not open device unknown-block(1,2). [ 48.876881][ T4508] BUG: KASAN: use-after-free in r1buf_pool_alloc+0x184/0xbc8 [ 48.879195][ T4508] Read of size 8 at addr ffff0000ceb25200 by task md0_resync/4508 [ 48.880547][ T4508] [ 48.880949][ T4508] CPU: 1 PID: 4508 Comm: md0_resync Not tainted syzkaller #0 [ 48.882151][ T4508] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 48.883986][ T4508] Call trace: [ 48.884547][ T4508] dump_backtrace+0x1c4/0x1f0 [ 48.885363][ T4508] show_stack+0x2c/0x3c [ 48.886064][ T4508] __dump_stack+0x30/0x40 [ 48.886821][ T4508] dump_stack_lvl+0xf4/0x15c [ 48.887614][ T4508] print_address_description+0x88/0x218 [ 48.888582][ T4508] print_report+0x50/0x68 [ 48.889372][ T4508] kasan_report+0xa8/0xfc [ 48.890166][ T4508] __asan_report_load8_noabort+0x2c/0x38 [ 48.891178][ T4508] r1buf_pool_alloc+0x184/0xbc8 [ 48.891996][ T4508] mempool_init_node+0x1c4/0x470 [ 48.892821][ T4508] mempool_init+0x50/0x68 [ 48.893543][ T4508] raid1_sync_request+0x22c/0x26e4 [ 48.894429][ T4508] md_do_sync+0x2e18/0x36ec [ 48.895188][ T4508] md_thread+0x1e0/0x3cc [ 48.895929][ T4508] kthread+0x254/0x2e0 [ 48.896604][ T4508] ret_from_fork+0x10/0x20 [ 48.897378][ T4508] [ 48.897773][ T4508] Allocated by task 4504: [ 48.898495][ T4508] kasan_set_track+0x4c/0x80 [ 48.899236][ T4508] kasan_save_alloc_info+0x24/0x30 [ 48.900063][ T4508] __kasan_kmalloc+0xa0/0xb8 [ 48.900816][ T4508] kmalloc_trace+0x7c/0x94 [ 48.901589][ T4508] raid1_reshape+0x590/0x102c [ 48.902395][ T4508] chunk_size_store+0x1ec/0x358 [ 48.903266][ T4508] md_attr_store+0x168/0x234 [ 48.904060][ T4508] sysfs_kf_write+0x1f8/0x274 [ 48.904894][ T4508] kernfs_fop_write_iter+0x390/0x4b4 [ 48.905803][ T4508] vfs_write+0x3c8/0x7c8 [ 48.906532][ T4508] ksys_write+0x12c/0x228 [ 48.907288][ T4508] __arm64_sys_write+0x7c/0x90 [ 48.908113][ T4508] invoke_syscall+0x98/0x290 [ 48.908897][ T4508] el0_svc_common+0x13c/0x258 [ 48.909646][ T4508] do_el0_svc+0x5c/0x134 [ 48.910372][ T4508] el0_svc+0x58/0x128 [ 48.911047][ T4508] el0t_64_sync_handler+0x84/0xf0 [ 48.911911][ T4508] el0t_64_sync+0x18c/0x190 [ 48.912693][ T4508] [ 48.913095][ T4508] Freed by task 4507: [ 48.913749][ T4508] kasan_set_track+0x4c/0x80 [ 48.914543][ T4508] kasan_save_free_info+0x38/0x5c [ 48.915354][ T4508] ____kasan_slab_free+0x148/0x1b0 [ 48.916205][ T4508] __kasan_slab_free+0x18/0x28 [ 48.917029][ T4508] slab_free_freelist_hook+0x16c/0x1e8 [ 48.918014][ T4508] __kmem_cache_free+0xbc/0x21c [ 48.918881][ T4508] kfree+0xd0/0x1a8 [ 48.919533][ T4508] raid1_reshape+0xc74/0x102c [ 48.920381][ T4508] chunk_size_store+0x1ec/0x358 [ 48.921199][ T4508] md_attr_store+0x168/0x234 [ 48.921962][ T4508] sysfs_kf_write+0x1f8/0x274 [ 48.922796][ T4508] kernfs_fop_write_iter+0x390/0x4b4 [ 48.923709][ T4508] vfs_write+0x3c8/0x7c8 [ 48.924403][ T4508] ksys_write+0x12c/0x228 [ 48.925123][ T4508] __arm64_sys_write+0x7c/0x90 [ 48.925926][ T4508] invoke_syscall+0x98/0x290 [ 48.926706][ T4508] el0_svc_common+0x13c/0x258 [ 48.927492][ T4508] do_el0_svc+0x5c/0x134 [ 48.928208][ T4508] el0_svc+0x58/0x128 [ 48.928857][ T4508] el0t_64_sync_handler+0x84/0xf0 [ 48.929688][ T4508] el0t_64_sync+0x18c/0x190 [ 48.930448][ T4508] [ 48.930830][ T4508] The buggy address belongs to the object at ffff0000ceb25200 [ 48.930830][ T4508] which belongs to the cache kmalloc-128 of size 128 [ 48.933294][ T4508] The buggy address is located 0 bytes inside of [ 48.933294][ T4508] 128-byte region [ffff0000ceb25200, ffff0000ceb25280) [ 48.935448][ T4508] [ 48.935872][ T4508] The buggy address belongs to the physical page: [ 48.936907][ T4508] page:00000000d7cf963a refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10eb25 [ 48.938609][ T4508] flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff) [ 48.939905][ T4508] raw: 05ffc00000000200 0000000000000000 dead000000000122 ffff0000c0002300 [ 48.941328][ T4508] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 48.942749][ T4508] page dumped because: kasan: bad access detected [ 48.943817][ T4508] [ 48.944222][ T4508] Memory state around the buggy address: [ 48.945180][ T4508] ffff0000ceb25100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 48.946486][ T4508] ffff0000ceb25180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.947813][ T4508] >ffff0000ceb25200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 48.949109][ T4508] ^ [ 48.949765][ T4508] ffff0000ceb25280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.951063][ T4508] ffff0000ceb25300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 48.952359][ T4508] ================================================================== [ 48.955540][ T4508] Disabling lock debugging due to kernel taint [ 48.956601][ T4508] Unable to handle kernel paging request at virtual address dfff800000000008 [ 48.962290][ T4508] KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] [ 48.963674][ T4508] Mem abort info: [ 48.964298][ T4508] ESR = 0x0000000096000006 [ 48.965061][ T4508] EC = 0x25: DABT (current EL), IL = 32 bits [ 48.966016][ T4508] SET = 0, FnV = 0 [ 48.966637][ T4508] EA = 0, S1PTW = 0 [ 48.967249][ T4508] FSC = 0x06: level 2 translation fault [ 48.968144][ T4508] Data abort info: [ 48.968748][ T4508] ISV = 0, ISS = 0x00000006 [ 48.969486][ T4508] CM = 0, WnR = 0 [ 48.970963][ T4508] [dfff800000000008] address between user and kernel address ranges [ 48.972271][ T4508] Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP [ 48.973414][ T4508] Modules linked in: [ 48.974051][ T4508] CPU: 1 PID: 4508 Comm: md0_resync Tainted: G B syzkaller #0 [ 48.975519][ T4508] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 48.977166][ T4508] pstate: 02400005 (nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 48.978430][ T4508] pc : r1buf_pool_alloc+0x69c/0xbc8 [ 48.979257][ T4508] lr : r1buf_pool_alloc+0x688/0xbc8 [ 48.980081][ T4508] sp : ffff800021637450 [ 48.980814][ T4508] x29: ffff8000216374a0 x28: 0000000000000087 x27: fffffc000328db74 [ 48.982237][ T4508] x26: 0000000000000040 x25: ffff0000d568e440 x24: ffff0000d568e448 [ 48.983610][ T4508] x23: 0000000000000cc0 x22: 0000000000000078 x21: dfff800000000000 [ 48.985034][ T4508] x20: 0000000000000001 x19: ffff0000d568e448 x18: 1fffe00033e7697e [ 48.986372][ T4508] x17: 0000000000000000 x16: ffff800011b90080 x15: fffffc000330ed00 [ 48.987758][ T4508] x14: 0000000000000001 x13: 1fffff8000651b6e x12: 0000000000000000 [ 48.989177][ T4508] x11: ff0080000ea37f14 x10: 0000000000000000 x9 : ffff0000d6cf4c00 [ 48.990601][ T4508] x8 : 0000000000000008 x7 : fffffc000354a4c0 x6 : fffffc00033349c0 [ 48.992035][ T4508] x5 : ffff0000d568e4c8 x4 : ffff0000d568e088 x3 : ffff80000ea37f28 [ 48.993429][ T4508] x2 : 0000000000000001 x1 : 0000000000000008 x0 : 0000000000000000 [ 48.994898][ T4508] Call trace: [ 48.995495][ T4508] r1buf_pool_alloc+0x69c/0xbc8 [ 48.996355][ T4508] mempool_init_node+0x1c4/0x470 [ 48.997224][ T4508] mempool_init+0x50/0x68 [ 48.997988][ T4508] raid1_sync_request+0x22c/0x26e4 [ 48.998827][ T4508] md_do_sync+0x2e18/0x36ec [ 48.999595][ T4508] md_thread+0x1e0/0x3cc [ 49.000347][ T4508] kthread+0x254/0x2e0 [ 49.001073][ T4508] ret_from_fork+0x10/0x20 [ 49.001871][ T4508] Code: f9400be9 9101011a f9000329 d343ff48 (38756908) [ 49.003025][ T4508] ---[ end trace 0000000000000000 ]--- [ 49.175231][ T4508] Kernel panic - not syncing: Oops: Fatal exception [ 49.176396][ T4508] SMP: stopping secondary CPUs [ 49.177171][ T4508] Kernel Offset: disabled [ 49.177891][ T4508] CPU features: 0x0a0000,000f0097,a65bfea7 [ 49.178880][ T4508] Memory Limit: none [ 49.354850][ T4508] Rebooting in 86400 seconds..