[ 36.935677][ T1786] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 39.084369][ T1786] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 39.134619][ T1786] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 39.174973][ T1786] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.454448][ T1786] device hsr_slave_0 left promiscuous mode [ 40.510503][ T1786] device hsr_slave_1 left promiscuous mode [ 40.610767][ T1786] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 40.612053][ T1786] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 40.613993][ T1786] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 40.615305][ T1786] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 40.616747][ T1786] device bridge_slave_1 left promiscuous mode [ 40.618027][ T1786] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.662326][ T1786] device bridge_slave_0 left promiscuous mode [ 40.663511][ T1786] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.780596][ T1786] device veth1_macvtap left promiscuous mode [ 40.781635][ T1786] device veth0_macvtap left promiscuous mode [ 40.782576][ T1786] device veth1_vlan left promiscuous mode [ 40.783537][ T1786] device veth0_vlan left promiscuous mode [ 40.889938][ T1786] team0 (unregistering): Port device team_slave_1 removed [ 40.897410][ T1786] team0 (unregistering): Port device team_slave_0 removed [ 40.902295][ T1786] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 40.936330][ T1786] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 41.078625][ T1786] bond0 (unregistering): Released all slaves Warning: Permanently added '10.128.0.29' (ED25519) to the list of known hosts. 1970/01/01 00:00:41 ignoring optional flag "type"="gce" 1970/01/01 00:00:41 parsed 1 programs [ 41.542409][ T4259] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS 1970/01/01 00:00:41 executed programs: 0 [ 41.609475][ T4266] chnl_net:caif_netlink_parms(): no params data found [ 41.629471][ T4266] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.631098][ T4266] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.632757][ T4266] device bridge_slave_0 entered promiscuous mode [ 41.634818][ T4266] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.636130][ T4266] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.637690][ T4266] device bridge_slave_1 entered promiscuous mode [ 41.646663][ T4266] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 41.649335][ T4266] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 41.658090][ T4266] team0: Port device team_slave_0 added [ 41.659921][ T4266] team0: Port device team_slave_1 added [ 41.666837][ T4266] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 41.667956][ T4266] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 41.672663][ T4266] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 41.675061][ T4266] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 41.676179][ T4266] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 41.680489][ T4266] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 41.741581][ T4266] device hsr_slave_0 entered promiscuous mode [ 41.790499][ T4266] device hsr_slave_1 entered promiscuous mode [ 42.362825][ T4266] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 42.402244][ T4266] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 42.441591][ T4266] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 42.491505][ T4266] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 42.594865][ T4266] 8021q: adding VLAN 0 to HW filter on device bond0 [ 42.605355][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 42.607084][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 42.610271][ T4266] 8021q: adding VLAN 0 to HW filter on device team0 [ 42.613617][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 42.615288][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 42.616857][ T377] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.618163][ T377] bridge0: port 1(bridge_slave_0) entered forwarding state [ 42.619758][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 42.627136][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 42.628897][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 42.631357][ T136] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.632543][ T136] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.634069][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 42.635849][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 42.637511][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 42.639485][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 42.642575][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 42.650867][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 42.652600][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 42.654290][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 42.655857][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 42.657465][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 42.659058][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 42.666716][ T4266] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 42.726585][ T4266] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 42.731763][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 42.732955][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 42.736748][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 42.738369][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 42.746004][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 42.747607][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 42.749511][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 42.752061][ T377] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 42.754795][ T4266] device veth0_vlan entered promiscuous mode [ 42.758105][ T4266] device veth1_vlan entered promiscuous mode [ 42.766236][ T4266] device veth0_macvtap entered promiscuous mode [ 42.768367][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 42.769939][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 42.772813][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 42.774530][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 42.777784][ T4266] device veth1_macvtap entered promiscuous mode [ 42.779599][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 42.781369][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 42.786593][ T4266] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 42.789229][ T4266] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 42.791287][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 42.792870][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 42.794588][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 42.796175][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 42.799286][ T4266] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.801484][ T4266] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.802905][ T4266] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.804444][ T4266] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 43.620902][ T13] Bluetooth: hci0: command 0x0409 tx timeout [ 45.700693][ T13] Bluetooth: hci0: command 0x041b tx timeout 1970/01/01 00:00:46 executed programs: 279 [ 47.782664][ T4332] Bluetooth: hci0: command 0x040f tx timeout [ 49.860501][ T4332] Bluetooth: hci0: command 0x0419 tx timeout 1970/01/01 00:00:51 executed programs: 714 [ 54.400388][ C0] IPv4: Attempt to release TCP socket in state 8 00000000b8f02696 [ 54.401946][ C0] [ 54.402322][ C0] ========================= [ 54.403031][ C0] WARNING: held lock freed! [ 54.403797][ C0] syzkaller #0 Not tainted [ 54.404506][ C0] ------------------------- [ 54.405313][ C0] syz-executor.0/6433 is freeing memory ffff0000c1162280-ffff0000c1162d67, with a lock still held there! [ 54.407416][ C0] ffff0000c11623a0 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_sendmsg+0x154/0x27c [ 54.408995][ C0] 2 locks held by syz-executor.0/6433: [ 54.409949][ C0] #0: ffff0000c11623a0 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_sendmsg+0x154/0x27c [ 54.411594][ C0] #1: ffff800008007ba0 ((&msk->sk.icsk_retransmit_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd0/0x860 [ 54.413564][ C0] [ 54.413564][ C0] stack backtrace: [ 54.414590][ C0] CPU: 0 PID: 6433 Comm: syz-executor.0 Not tainted syzkaller #0 [ 54.415972][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 54.417726][ C0] Call trace: [ 54.418275][ C0] dump_backtrace+0x0/0x458 [ 54.419030][ C0] show_stack+0x2c/0x3c [ 54.419712][ C0] __dump_stack+0x30/0x40 [ 54.420458][ C0] dump_stack_lvl+0xf4/0x15c [ 54.421284][ C0] dump_stack+0x1c/0x5c [ 54.422026][ C0] debug_check_no_locks_freed+0x21c/0x2b0 [ 54.422989][ C0] slab_free_freelist_hook+0x88/0x1e4 [ 54.423937][ C0] kmem_cache_free+0xdc/0x3b4 [ 54.424761][ C0] __sk_destruct+0x434/0x618 [ 54.425619][ C0] __sk_free+0x324/0x434 [ 54.426351][ C0] sk_free+0x68/0xd4 [ 54.426981][ C0] mptcp_retransmit_timer+0x188/0x290 [ 54.427925][ C0] call_timer_fn+0x19c/0x860 [ 54.428752][ C0] __run_timers+0xabc/0xd00 [ 54.429543][ C0] run_timer_softirq+0x7c/0x114 [ 54.430444][ C0] handle_softirqs+0x344/0xc14 [ 54.431266][ C0] __irq_exit_rcu+0x240/0x434 [ 54.432065][ C0] irq_exit+0x14/0x88 [ 54.432785][ C0] handle_domain_irq+0x150/0x200 [ 54.433680][ C0] gic_handle_irq+0x78/0x1b8 [ 54.434569][ C0] call_on_irq_stack+0x30/0x48 [ 54.435426][ C0] do_interrupt_handler+0x6c/0x88 [ 54.436272][ C0] el1_interrupt+0x30/0x58 [ 54.437037][ C0] el1h_64_irq_handler+0x18/0x24 [ 54.437911][ C0] el1h_64_irq+0x78/0x7c [ 54.438635][ C0] _raw_spin_unlock_irqrestore+0xb8/0x14c [ 54.439636][ C0] __mod_timer+0x6dc/0xb54 [ 54.440318][ C0] mod_timer+0x2c/0x3c [ 54.440974][ C0] sk_reset_timer+0x30/0xf4 [ 54.441715][ C0] __mptcp_push_pending+0x530/0x650 [ 54.442558][ C0] mptcp_sendmsg+0x14a8/0x19d0 [ 54.443355][ C0] inet_sendmsg+0x154/0x27c [ 54.444076][ C0] ____sys_sendmsg+0x578/0x894 [ 54.444881][ C0] ___sys_sendmsg+0x1f0/0x27c [ 54.445676][ C0] __arm64_sys_sendmsg+0x1bc/0x278 [ 54.446664][ C0] invoke_syscall+0x98/0x28c [ 54.447433][ C0] el0_svc_common+0x13c/0x258 [ 54.448229][ C0] do_el0_svc+0x5c/0x140 [ 54.448990][ C0] el0_svc+0x78/0x1d0 [ 54.449666][ C0] el0t_64_sync_handler+0xcc/0xe4 [ 54.450510][ C0] el0t_64_sync+0x1a0/0x1a4 [ 54.452500][ T6433] ------------[ cut here ]------------ [ 54.453508][ T6433] refcount_t: addition on 0; use-after-free. [ 54.454698][ T6433] WARNING: CPU: 0 PID: 6433 at lib/refcount.c:25 refcount_warn_saturate+0x134/0x1f8 [ 54.456121][ T6433] Modules linked in: [ 54.456687][ T6433] CPU: 0 PID: 6433 Comm: syz-executor.0 Not tainted syzkaller #0 [ 54.457891][ T6433] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 54.459398][ T6433] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 54.460650][ T6433] pc : refcount_warn_saturate+0x134/0x1f8 [ 54.461578][ T6433] lr : refcount_warn_saturate+0x134/0x1f8 [ 54.462575][ T6433] sp : ffff800022927590 [ 54.463303][ T6433] x29: ffff800022927590 x28: 0000000000000000 x27: ffff0000d8710180 [ 54.464611][ T6433] x26: dfff800000000000 x25: ffff0000c1162c60 x24: 0000000000000000 [ 54.466052][ T6433] x23: ffff700004524ec0 x22: 0000000000000000 x21: ffff0000c1162938 [ 54.467423][ T6433] x20: ffff0000c1162300 x19: ffff8000167cf000 x18: 0000000000000001 [ 54.469097][ T6433] x17: 0000000000000000 x16: ffff80001134e478 x15: 0000000000000012 [ 54.470475][ T6433] x14: 0000000000000001 x13: 1fffe000341d02d7 x12: 0000000000000000 [ 54.471844][ T6433] x11: ff8080000830061c x10: 0000000000000000 x9 : a54e1dbe1381d100 [ 54.473285][ T6433] x8 : a54e1dbe1381d100 x7 : 0000000000000001 x6 : 0000000000000001 [ 54.474619][ T6433] x5 : ffff800022926e98 x4 : ffff80001446f500 x3 : ffff80000a79dba8 [ 54.475907][ T6433] x2 : ffff0001a0e75d50 x1 : 0000000100000000 x0 : 000000000000002a [ 54.477296][ T6433] Call trace: [ 54.477896][ T6433] refcount_warn_saturate+0x134/0x1f8 [ 54.478804][ T6433] sk_reset_timer+0xcc/0xf4 [ 54.479550][ T6433] __mptcp_push_pending+0x530/0x650 [ 54.480416][ T6433] mptcp_sendmsg+0x14a8/0x19d0 [ 54.481255][ T6433] inet_sendmsg+0x154/0x27c [ 54.482119][ T6433] ____sys_sendmsg+0x578/0x894 [ 54.482978][ T6433] ___sys_sendmsg+0x1f0/0x27c [ 54.483877][ T6433] __arm64_sys_sendmsg+0x1bc/0x278 [ 54.484745][ T6433] invoke_syscall+0x98/0x28c [ 54.485516][ T6433] el0_svc_common+0x13c/0x258 [ 54.486330][ T6433] do_el0_svc+0x5c/0x140 [ 54.487125][ T6433] el0_svc+0x78/0x1d0 [ 54.487850][ T6433] el0t_64_sync_handler+0xcc/0xe4 [ 54.488818][ T6433] el0t_64_sync+0x1a0/0x1a4 [ 54.489557][ T6433] irq event stamp: 1584 [ 54.490334][ T6433] hardirqs last enabled at (1584): [] kasan_quarantine_put+0xc4/0x200 [ 54.491994][ T6433] hardirqs last disabled at (1583): [] kasan_quarantine_put+0x108/0x200 [ 54.493932][ T6433] softirqs last enabled at (1546): [] mptcp_sendmsg+0xcb4/0x19d0 [ 54.495546][ T6433] softirqs last disabled at (1553): [] __irq_exit_rcu+0x240/0x434 [ 54.497148][ T6433] ---[ end trace 039c41c1e8f7ddb9 ]--- [ 54.499391][ T6432] ------------[ cut here ]------------ [ 54.500826][ T6432] refcount_t: saturated; leaking memory. [ 54.501815][ T6432] WARNING: CPU: 1 PID: 6432 at lib/refcount.c:22 refcount_warn_saturate+0x1b4/0x1f8 [ 54.503263][ T6432] Modules linked in: [ 54.503866][ T6432] CPU: 1 PID: 6432 Comm: syz-executor.0 Tainted: G W syzkaller #0 [ 54.505320][ T6432] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 54.507000][ T6432] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 54.508370][ T6432] pc : refcount_warn_saturate+0x1b4/0x1f8 [ 54.509332][ T6432] lr : refcount_warn_saturate+0x1b4/0x1f8 [ 54.510382][ T6432] sp : ffff8000228f79b0 [ 54.511031][ T6432] x29: ffff8000228f79b0 x28: ffff0000c1162292 x27: ffff0000c1162c50 [ 54.512343][ T6432] x26: dfff800000000000 x25: ffff0000c1162280 x24: ffff8000130acba0 [ 54.513635][ T6432] x23: ffff80001430f000 x22: 1ffff00002861e30 x21: 00000000c0000000 [ 54.514945][ T6432] x20: ffff0000c1162300 x19: ffff8000167cf000 x18: 0000000000000001 [ 54.516422][ T6432] x17: 0000000000000000 x16: ffff80001134e478 x15: 0000000000000012 [ 54.517807][ T6432] x14: 0000000000000001 x13: 1fffe000341d2dab x12: 0000000000000000 [ 54.519204][ T6432] x11: ff8080000830061c x10: 0000000000000000 x9 : 404f892ae3028c00 [ 54.520667][ T6432] x8 : 404f892ae3028c00 x7 : 0000000000000001 x6 : 0000000000000001 [ 54.522067][ T6432] x5 : ffff8000228f72b8 x4 : ffff80001446f500 x3 : ffff80000850f688 [ 54.523535][ T6432] x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000026 [ 54.524942][ T6432] Call trace: [ 54.525528][ T6432] refcount_warn_saturate+0x1b4/0x1f8 [ 54.526488][ T6432] mptcp_close+0x74c/0xa18 [ 54.527313][ T6432] inet_release+0x120/0x16c [ 54.528162][ T6432] sock_close+0xac/0x1ec [ 54.528909][ T6432] __fput+0x1b8/0x7e8 [ 54.529552][ T6432] ____fput+0x20/0x30 [ 54.530222][ T6432] task_work_run+0x13c/0x1e8 [ 54.530968][ T6432] do_notify_resume+0x2488/0x30a8 [ 54.531822][ T6432] el0_svc+0xf0/0x1d0 [ 54.532485][ T6432] el0t_64_sync_handler+0xcc/0xe4 [ 54.533412][ T6432] el0t_64_sync+0x1a0/0x1a4 [ 54.534240][ T6432] irq event stamp: 1556 [ 54.534963][ T6432] hardirqs last enabled at (1555): [] _raw_spin_unlock_irqrestore+0xa8/0x14c [ 54.536748][ T6432] hardirqs last disabled at (1556): [] __schedule+0x2ec/0x1c6c [ 54.540055][ T6432] softirqs last enabled at (1538): [] local_bh_enable+0x10/0x34 [ 54.541785][ T6432] softirqs last disabled at (1536): [] local_bh_disable+0x10/0x34 [ 54.543476][ T6432] ---[ end trace 039c41c1e8f7ddba ]--- [ 54.544961][ T6432] ------------[ cut here ]------------ [ 54.545880][ T6432] ODEBUG: assert_init not available (active state 0) object type: timer_list hint: mptcp_retransmit_timer+0x0/0x290 [ 54.547824][ T6432] WARNING: CPU: 1 PID: 6432 at lib/debugobjects.c:521 debug_print_object+0x140/0x1c8 [ 54.549280][ T6432] Modules linked in: [ 54.550023][ T6432] CPU: 1 PID: 6432 Comm: syz-executor.0 Tainted: G W syzkaller #0 [ 54.551723][ T6432] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 54.553450][ T6432] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 54.554850][ T6432] pc : debug_print_object+0x140/0x1c8 [ 54.555917][ T6432] lr : debug_print_object+0x140/0x1c8 [ 54.556901][ T6432] sp : ffff8000228f7780 [ 54.557702][ T6432] x29: ffff8000228f7780 x28: ffff0000c1162c50 x27: 1fffe0001822c58f [ 54.559167][ T6432] x26: 0000000000000000 x25: ffff8000228f77e8 x24: dfff800000000000 [ 54.560776][ T6432] x23: 0000000000000000 x22: ffff800011239694 x21: ffff80001195dba0 [ 54.562148][ T6432] x20: ffff8000114c3260 x19: ffff80001195d6e0 x18: 0000000000000001 [ 54.563728][ T6432] x17: 203a657079742074 x16: ffff80001134e478 x15: 2065746174732065 [ 54.565372][ T6432] x14: 0000000000000001 x13: 1fffe000341d44d7 x12: 0000000000000000 [ 54.567010][ T6432] x11: ff8080000830061c x10: 0000000000000000 x9 : 404f892ae3028c00 [ 54.568694][ T6432] x8 : 404f892ae3028c00 x7 : 0000000000000001 x6 : 0000000000000001 [ 54.570211][ T6432] x5 : ffff8000228f7098 x4 : ffff80001446f500 x3 : ffff80000a79dba8 [ 54.571579][ T6432] x2 : ffff0001a0e96d50 x1 : 0000000100000000 x0 : 0000000000000071 [ 54.572941][ T6432] Call trace: [ 54.573441][ T6432] debug_print_object+0x140/0x1c8 [ 54.574211][ T6432] debug_object_assert_init+0x24c/0x2c4 [ 54.575108][ T6432] __timer_delete+0x50/0x20c [ 54.575877][ T6432] timer_delete+0x24/0x34 [ 54.576575][ T6432] sk_stop_timer+0x24/0xcc [ 54.577307][ T6432] __mptcp_destroy_sock+0x294/0x61c [ 54.578164][ T6432] mptcp_close+0x5d0/0xa18 [ 54.578917][ T6432] inet_release+0x120/0x16c [ 54.579717][ T6432] sock_close+0xac/0x1ec [ 54.580425][ T6432] __fput+0x1b8/0x7e8 [ 54.581117][ T6432] ____fput+0x20/0x30 [ 54.581812][ T6432] task_work_run+0x13c/0x1e8 [ 54.582573][ T6432] do_notify_resume+0x2488/0x30a8 [ 54.583431][ T6432] el0_svc+0xf0/0x1d0 [ 54.584133][ T6432] el0t_64_sync_handler+0xcc/0xe4 [ 54.584973][ T6432] el0t_64_sync+0x1a0/0x1a4 [ 54.585699][ T6432] irq event stamp: 1556 [ 54.586355][ T6432] hardirqs last enabled at (1555): [] _raw_spin_unlock_irqrestore+0xa8/0x14c [ 54.588100][ T6432] hardirqs last disabled at (1556): [] __schedule+0x2ec/0x1c6c [ 54.589578][ T6432] softirqs last enabled at (1538): [] local_bh_enable+0x10/0x34 [ 54.591443][ T6432] softirqs last disabled at (1536): [] local_bh_disable+0x10/0x34 [ 54.593206][ T6432] ---[ end trace 039c41c1e8f7ddbb ]--- [ 54.595751][ T6432] ------------[ cut here ]------------ [ 54.596664][ T6432] ODEBUG: assert_init not available (active state 0) object type: timer_list hint: mptcp_tout_timer+0x0/0xe0 [ 54.598758][ T6432] WARNING: CPU: 0 PID: 6432 at lib/debugobjects.c:521 debug_print_object+0x140/0x1c8 [ 54.600328][ T6432] Modules linked in: [ 54.601042][ T6432] CPU: 0 PID: 6432 Comm: syz-executor.0 Tainted: G W syzkaller #0 [ 54.602568][ T6432] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 54.604317][ T6432] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 54.605739][ T6432] pc : debug_print_object+0x140/0x1c8 [ 54.606748][ T6432] lr : debug_print_object+0x140/0x1c8 [ 54.607611][ T6432] sp : ffff8000228f7780 [ 54.608278][ T6432] x29: ffff8000228f7780 x28: ffff0000c1162c50 x27: ffff0000d17887c0 [ 54.609631][ T6432] x26: 0000000000000001 x25: ffff8000228f77e8 x24: dfff800000000000 [ 54.610983][ T6432] x23: 0000000000000000 x22: ffff800011239924 x21: ffff80001195dba0 [ 54.612318][ T6432] x20: ffff8000114c3260 x19: ffff80001195d6e0 x18: 0000000000000001 [ 54.613731][ T6432] x17: 203a657079742074 x16: ffff80001134e478 x15: 2065746174732065 [ 54.615088][ T6432] x14: 0000000000000001 x13: 1fffe000341cebab x12: 0000000000000000 [ 54.616537][ T6432] x11: ff8080000830061c x10: 0000000000000000 x9 : 404f892ae3028c00 [ 54.617930][ T6432] x8 : 404f892ae3028c00 x7 : 0000000000000001 x6 : 0000000000000001 [ 54.619286][ T6432] x5 : ffff8000228f7098 x4 : ffff80001446f500 x3 : ffff80000850f688 [ 54.620641][ T6432] x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000006a [ 54.621953][ T6432] Call trace: [ 54.622489][ T6432] debug_print_object+0x140/0x1c8 [ 54.623333][ T6432] debug_object_assert_init+0x24c/0x2c4 [ 54.624289][ T6432] __timer_delete+0x50/0x20c [ 54.625070][ T6432] timer_delete+0x24/0x34 [ 54.625821][ T6432] sk_stop_timer+0x24/0xcc [ 54.626574][ T6432] __mptcp_destroy_sock+0x2a0/0x61c [ 54.627496][ T6432] mptcp_close+0x5d0/0xa18 [ 54.628234][ T6432] inet_release+0x120/0x16c [ 54.629007][ T6432] sock_close+0xac/0x1ec [ 54.629736][ T6432] __fput+0x1b8/0x7e8 [ 54.630385][ T6432] ____fput+0x20/0x30 [ 54.631071][ T6432] task_work_run+0x13c/0x1e8 [ 54.631855][ T6432] do_notify_resume+0x2488/0x30a8 [ 54.632709][ T6432] el0_svc+0xf0/0x1d0 [ 54.633423][ T6432] el0t_64_sync_handler+0xcc/0xe4 [ 54.634267][ T6432] el0t_64_sync+0x1a0/0x1a4 [ 54.635126][ T6432] irq event stamp: 1556 [ 54.635878][ T6432] hardirqs last enabled at (1555): [] _raw_spin_unlock_irqrestore+0xa8/0x14c [ 54.637660][ T6432] hardirqs last disabled at (1556): [] __schedule+0x2ec/0x1c6c [ 54.639338][ T6432] softirqs last enabled at (1538): [] local_bh_enable+0x10/0x34 [ 54.640924][ T6432] softirqs last disabled at (1536): [] local_bh_disable+0x10/0x34 [ 54.642557][ T6432] ---[ end trace 039c41c1e8f7ddbc ]--- [ 54.643629][ T6432] ------------[ cut here ]------------ [ 54.644602][ T6432] refcount_t: underflow; use-after-free. [ 54.645660][ T6432] WARNING: CPU: 0 PID: 6432 at lib/refcount.c:28 refcount_warn_saturate+0x154/0x1f8 [ 54.647145][ T6432] Modules linked in: [ 54.647801][ T6432] CPU: 0 PID: 6432 Comm: syz-executor.0 Tainted: G W syzkaller #0 [ 54.649324][ T6432] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 54.650965][ T6432] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 54.652305][ T6432] pc : refcount_warn_saturate+0x154/0x1f8 [ 54.653292][ T6432] lr : refcount_warn_saturate+0x154/0x1f8 [ 54.654280][ T6432] sp : ffff8000228f78e0 [ 54.654967][ T6432] x29: ffff8000228f78e0 x28: ffff0000c1162c50 x27: 1fffe0001822c58f [ 54.656401][ T6432] x26: 1fffe0001822c58a x25: ffff70000451ef20 x24: dfff800000000000 [ 54.657842][ T6432] x23: ffff80001430f000 x22: 0000000000000000 x21: 00000000c0000000 [ 54.659235][ T6432] x20: ffff0000c1162300 x19: ffff8000167cf000 x18: 0000000000000001 [ 54.660634][ T6432] x17: 0000000000000000 x16: ffff80001134e478 x15: 0000000000000012 [ 54.662033][ T6432] x14: 0000000000000001 x13: 1fffe000341d02d7 x12: 0000000000000000 [ 54.663330][ T6432] x11: ff8080000830061c x10: 0000000000000000 x9 : 404f892ae3028c00 [ 54.664725][ T6432] x8 : 404f892ae3028c00 x7 : 0000000000000001 x6 : 0000000000000001 [ 54.666159][ T6432] x5 : ffff8000228f71f8 x4 : ffff80001446f500 x3 : ffff80000a79dba8 [ 54.667595][ T6432] x2 : ffff0001a0e75d50 x1 : 0000000100000000 x0 : 0000000000000026 [ 54.668977][ T6432] Call trace: [ 54.669490][ T6432] refcount_warn_saturate+0x154/0x1f8 [ 54.670407][ T6432] __mptcp_destroy_sock+0x57c/0x61c [ 54.671316][ T6432] mptcp_close+0x5d0/0xa18 [ 54.672049][ T6432] inet_release+0x120/0x16c [ 54.672912][ T6432] sock_close+0xac/0x1ec [ 54.673633][ T6432] __fput+0x1b8/0x7e8 [ 54.674299][ T6432] ____fput+0x20/0x30 [ 54.674966][ T6432] task_work_run+0x13c/0x1e8 [ 54.675776][ T6432] do_notify_resume+0x2488/0x30a8 [ 54.676600][ T6432] el0_svc+0xf0/0x1d0 [ 54.677301][ T6432] el0t_64_sync_handler+0xcc/0xe4 [ 54.678175][ T6432] el0t_64_sync+0x1a0/0x1a4 [ 54.678955][ T6432] irq event stamp: 1556 [ 54.679651][ T6432] hardirqs last enabled at (1555): [] _raw_spin_unlock_irqrestore+0xa8/0x14c [ 54.681331][ T6432] hardirqs last disabled at (1556): [] __schedule+0x2ec/0x1c6c [ 54.682894][ T6432] softirqs last enabled at (1538): [] local_bh_enable+0x10/0x34 [ 54.684426][ T6432] softirqs last disabled at (1536): [] local_bh_disable+0x10/0x34 [ 54.686013][ T6432] ---[ end trace 039c41c1e8f7ddbd ]--- 1970/01/01 00:00:56 executed programs: 1177 [ 59.800365][ C1] IPv4: Attempt to release TCP socket in state 8 00000000e1ff381e [ 59.802044][ T7568] ------------[ cut here ]------------ [ 59.802953][ T7568] ODEBUG: assert_init not available (active state 0) object type: timer_list hint: mptcp_retransmit_timer+0x0/0x290 [ 59.805199][ T7568] WARNING: CPU: 1 PID: 7568 at lib/debugobjects.c:521 debug_print_object+0x140/0x1c8 [ 59.806721][ T7568] Modules linked in: [ 59.807378][ T7568] CPU: 1 PID: 7568 Comm: syz-executor.0 Tainted: G W syzkaller #0 [ 59.808992][ T7568] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 59.810718][ T7568] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 59.812011][ T7568] pc : debug_print_object+0x140/0x1c8 [ 59.812932][ T7568] lr : debug_print_object+0x140/0x1c8 [ 59.813847][ T7568] sp : ffff800021af7780 [ 59.814522][ T7568] x29: ffff800021af7780 x28: ffff0000dabde5d0 x27: 1fffe0001b57bcbf [ 59.815885][ T7568] x26: 0000000000000000 x25: ffff800021af77e8 x24: dfff800000000000 [ 59.817272][ T7568] x23: 0000000000000000 x22: ffff800011239694 x21: ffff80001195dba0 [ 59.818649][ T7568] x20: ffff8000114c3260 x19: ffff80001195d6e0 x18: 0000000000000001 [ 59.819932][ T7568] x17: 203a657079742074 x16: ffff80001134e478 x15: 2065746174732065 [ 59.821264][ T7568] x14: 0000000000000001 x13: 1fffe000341d2dab x12: 0000000000000000 [ 59.822504][ T7568] x11: ff8080000830061c x10: 0000000000000000 x9 : f3ca4fafc025ec00 [ 59.823878][ T7568] x8 : f3ca4fafc025ec00 x7 : 0000000000000001 x6 : 0000000000000001 [ 59.825257][ T7568] x5 : ffff800021af7098 x4 : ffff80001446f500 x3 : ffff80000850f688 [ 59.826628][ T7568] x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000071 [ 59.827959][ T7568] Call trace: [ 59.828473][ T7568] debug_print_object+0x140/0x1c8 [ 59.829325][ T7568] debug_object_assert_init+0x24c/0x2c4 [ 59.830272][ T7568] __timer_delete+0x50/0x20c [ 59.831033][ T7568] timer_delete+0x24/0x34 [ 59.831785][ T7568] sk_stop_timer+0x24/0xcc [ 59.832523][ T7568] __mptcp_destroy_sock+0x294/0x61c [ 59.833401][ T7568] mptcp_close+0x5d0/0xa18 [ 59.834162][ T7568] inet_release+0x120/0x16c [ 59.834906][ T7568] sock_close+0xac/0x1ec [ 59.835624][ T7568] __fput+0x1b8/0x7e8 [ 59.836285][ T7568] ____fput+0x20/0x30 [ 59.836960][ T7568] task_work_run+0x13c/0x1e8 [ 59.837698][ T7568] do_notify_resume+0x2488/0x30a8 [ 59.838513][ T7568] el0_svc+0xf0/0x1d0 [ 59.839199][ T7568] el0t_64_sync_handler+0xcc/0xe4 [ 59.839980][ T7568] el0t_64_sync+0x1a0/0x1a4 [ 59.840697][ T7568] irq event stamp: 0 [ 59.841316][ T7568] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 59.842488][ T7568] hardirqs last disabled at (0): [] copy_process+0x1210/0x3734 [ 59.843948][ T7568] softirqs last enabled at (0): [] copy_process+0x1244/0x3734 [ 59.845398][ T7568] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 59.846541][ T7568] ---[ end trace 039c41c1e8f7ddbe ]--- [ 59.848699][ T7568] ------------[ cut here ]------------ [ 59.849806][ T7568] ODEBUG: assert_init not available (active state 0) object type: timer_list hint: mptcp_tout_timer+0x0/0xe0 [ 59.853042][ T7568] WARNING: CPU: 0 PID: 7568 at lib/debugobjects.c:521 debug_print_object+0x140/0x1c8 [ 59.854762][ T7568] Modules linked in: [ 59.855459][ T7568] CPU: 0 PID: 7568 Comm: syz-executor.0 Tainted: G W syzkaller #0 [ 59.857043][ T7568] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 59.859058][ T7568] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 59.860609][ T7568] pc : debug_print_object+0x140/0x1c8 [ 59.861518][ T7568] lr : debug_print_object+0x140/0x1c8 [ 59.862396][ T7568] sp : ffff800021af7780 [ 59.863059][ T7568] x29: ffff800021af7780 x28: ffff0000dabde5d0 x27: 1fffe0001b57bcbf [ 59.864468][ T7568] x26: 0000000000000000 x25: ffff800021af77e8 x24: dfff800000000000 [ 59.865740][ T7568] x23: 0000000000000000 x22: ffff800011239924 x21: ffff80001195dba0 [ 59.866993][ T7568] x20: ffff8000114c3260 x19: ffff80001195d6e0 x18: 0000000000000002 [ 59.868358][ T7568] x17: 0000000040000000 x16: ffff80001134e478 x15: 0000000000000002 [ 59.869741][ T7568] x14: 0000000000000001 x13: 1fffe000341d02d7 x12: 0000000000000000 [ 59.871132][ T7568] x11: ff8080000830061c x10: 0000000000000000 x9 : f3ca4fafc025ec00 [ 59.872427][ T7568] x8 : f3ca4fafc025ec00 x7 : 0000000000000000 x6 : ffff80000824ba6c [ 59.873785][ T7568] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80000a79dba8 [ 59.875093][ T7568] x2 : ffff0001a0e75d50 x1 : 0000000100000000 x0 : 000000000000006a [ 59.876434][ T7568] Call trace: [ 59.877038][ T7568] debug_print_object+0x140/0x1c8 [ 59.877985][ T7568] debug_object_assert_init+0x24c/0x2c4 [ 59.879068][ T7568] __timer_delete+0x50/0x20c [ 59.879901][ T7568] timer_delete+0x24/0x34 [ 59.880742][ T7568] sk_stop_timer+0x24/0xcc [ 59.881564][ T7568] __mptcp_destroy_sock+0x2a0/0x61c [ 59.882496][ T7568] mptcp_close+0x5d0/0xa18 [ 59.883338][ T7568] inet_release+0x120/0x16c [ 59.884226][ T7568] sock_close+0xac/0x1ec [ 59.884994][ T7568] __fput+0x1b8/0x7e8 [ 59.885730][ T7568] ____fput+0x20/0x30 [ 59.886414][ T7568] task_work_run+0x13c/0x1e8 [ 59.887214][ T7568] do_notify_resume+0x2488/0x30a8 [ 59.888042][ T7568] el0_svc+0xf0/0x1d0 [ 59.888696][ T7568] el0t_64_sync_handler+0xcc/0xe4 [ 59.889543][ T7568] el0t_64_sync+0x1a0/0x1a4 [ 59.890252][ T7568] irq event stamp: 0 [ 59.890891][ T7568] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 59.892045][ T7568] hardirqs last disabled at (0): [] copy_process+0x1210/0x3734 [ 59.893525][ T7568] softirqs last enabled at (0): [] copy_process+0x1244/0x3734 [ 59.895041][ T7568] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 59.896243][ T7568] ---[ end trace 039c41c1e8f7ddbf ]--- 1970/01/01 00:01:01 executed programs: 1723