Warning: Permanently added '10.128.1.36' (ED25519) to the list of known hosts.
2026/07/30 19:14:01 parsed 1 programs
[ 109.476417][ T4727] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS
[ 112.851464][ T3081] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 112.863418][ T3081] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 112.883470][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 112.902219][ T3081] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 112.914351][ T3081] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 112.923698][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 113.373863][ T1166] ODEBUG: Out of memory. ODEBUG disabled
[ 113.397818][ T4906] chnl_net:caif_netlink_parms(): no params data found
[ 113.574527][ T4906] bridge0: port 1(bridge_slave_0) entered blocking state
[ 113.582023][ T4906] bridge0: port 1(bridge_slave_0) entered disabled state
[ 113.591410][ T4906] device bridge_slave_0 entered promiscuous mode
[ 113.601525][ T4906] bridge0: port 2(bridge_slave_1) entered blocking state
[ 113.609349][ T4906] bridge0: port 2(bridge_slave_1) entered disabled state
[ 113.619195][ T4906] device bridge_slave_1 entered promiscuous mode
[ 113.654507][ T4906] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 113.667080][ T4906] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 113.710660][ T4906] team0: Port device team_slave_0 added
[ 113.719005][ T4906] team0: Port device team_slave_1 added
[ 113.737649][ T4906] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 113.744715][ T4906] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 113.772385][ T4906] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 113.784754][ T4906] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 113.792191][ T4906] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 113.818347][ T4906] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 113.847548][ T4906] device hsr_slave_0 entered promiscuous mode
[ 113.855136][ T4906] device hsr_slave_1 entered promiscuous mode
[ 114.403830][ T4906] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 114.416920][ T4906] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 114.469880][ T4906] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 114.480255][ T4906] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 114.588653][ T4906] 8021q: adding VLAN 0 to HW filter on device bond0
[ 114.604118][ T3081] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 114.614728][ T3081] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 114.661734][ T4906] 8021q: adding VLAN 0 to HW filter on device team0
[ 114.673807][ T3081] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 114.683116][ T3081] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 114.693024][ T3081] bridge0: port 1(bridge_slave_0) entered blocking state
[ 114.700290][ T3081] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 114.710134][ T3081] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 114.722017][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 114.732206][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 114.741186][ T154] bridge0: port 2(bridge_slave_1) entered blocking state
[ 114.748443][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 114.766976][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 114.776132][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 114.785170][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 114.795817][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 114.808097][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 114.862492][ T4906] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[ 114.875414][ T4906] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 114.889383][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 114.902200][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 114.913741][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 114.923628][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 114.935136][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 114.944020][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 114.960547][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 115.132478][ T3081] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 115.140751][ T3081] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 115.171522][ T4906] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 115.194658][ T3081] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 115.204451][ T3081] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 115.233798][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 115.242820][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 115.253009][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 115.262251][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 115.276142][ T4906] device veth0_vlan entered promiscuous mode
[ 115.319092][ T4906] device veth1_vlan entered promiscuous mode
[ 115.402749][ T4906] device veth0_macvtap entered promiscuous mode
[ 115.411047][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 115.421443][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 115.431071][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 115.440925][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 115.452922][ T4906] device veth1_macvtap entered promiscuous mode
[ 115.463738][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 115.484717][ T4906] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 115.506847][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 115.526799][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 115.549321][ T4906] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 115.573902][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 115.597658][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 115.610987][ T4906] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 115.635992][ T4906] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 115.645388][ T4906] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 115.659267][ T4906] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
2026/07/30 19:14:13 executed programs: 0
[ 116.649328][ T5006] chnl_net:caif_netlink_parms(): no params data found
[ 116.794589][ T5006] bridge0: port 1(bridge_slave_0) entered blocking state
[ 116.812219][ T5006] bridge0: port 1(bridge_slave_0) entered disabled state
[ 116.821471][ T5006] device bridge_slave_0 entered promiscuous mode
[ 116.840839][ T5006] bridge0: port 2(bridge_slave_1) entered blocking state
[ 116.869127][ T5006] bridge0: port 2(bridge_slave_1) entered disabled state
[ 116.885810][ T5006] device bridge_slave_1 entered promiscuous mode
[ 116.953290][ T5006] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 116.978645][ T5006] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 117.055659][ T5006] team0: Port device team_slave_0 added
[ 117.078997][ T5006] team0: Port device team_slave_1 added
[ 117.137643][ T5006] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 117.145066][ T5006] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 117.174613][ T5006] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 117.194242][ T5006] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 117.216183][ T5006] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 117.266771][ T5006] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 117.352269][ T5006] device hsr_slave_0 entered promiscuous mode
[ 117.360008][ T5006] device hsr_slave_1 entered promiscuous mode
[ 117.366951][ T5006] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 117.375704][ T5006] Cannot create hsr debugfs directory
[ 117.563912][ T5006] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 118.446355][ T4212] Bluetooth: hci0: command 0x0409 tx timeout
[ 120.526297][ T4418] Bluetooth: hci0: command 0x041b tx timeout
[ 120.815981][ T5006] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 120.886692][ T5006] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 120.994693][ T5006] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 121.107842][ T5006] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 121.117318][ T5006] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 121.125863][ T5006] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 121.141406][ T5006] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 121.188529][ T5006] 8021q: adding VLAN 0 to HW filter on device bond0
[ 121.204324][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 121.212837][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 121.222914][ T5006] 8021q: adding VLAN 0 to HW filter on device team0
[ 121.239328][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 121.248622][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 121.257655][ T4477] bridge0: port 1(bridge_slave_0) entered blocking state
[ 121.264747][ T4477] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 121.273863][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 121.292960][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 121.301767][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 121.310744][ T154] bridge0: port 2(bridge_slave_1) entered blocking state
[ 121.318235][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 121.335999][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 121.349365][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 121.360798][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 121.372703][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 121.381615][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 121.391952][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 121.400906][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 121.419445][ T3081] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 121.428259][ T3081] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 121.439786][ T3081] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 121.449094][ T3081] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 121.459548][ T5006] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 121.520320][ T1166] device hsr_slave_0 left promiscuous mode
[ 121.530215][ T1166] device hsr_slave_1 left promiscuous mode
[ 121.538197][ T1166] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 121.546543][ T1166] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 121.554656][ T1166] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 121.564993][ T1166] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 121.572912][ T1166] device bridge_slave_1 left promiscuous mode
[ 121.580362][ T1166] bridge0: port 2(bridge_slave_1) entered disabled state
[ 121.588569][ T1166] device bridge_slave_0 left promiscuous mode
[ 121.594841][ T1166] bridge0: port 1(bridge_slave_0) entered disabled state
[ 121.607655][ T1166] device veth1_macvtap left promiscuous mode
[ 121.613751][ T1166] device veth0_macvtap left promiscuous mode
[ 121.620424][ T1166] device veth1_vlan left promiscuous mode
[ 121.626783][ T1166] device veth0_vlan left promiscuous mode
[ 121.754233][ T1166] team0 (unregistering): Port device team_slave_1 removed
[ 121.770735][ T1166] team0 (unregistering): Port device team_slave_0 removed
[ 121.782212][ T1166] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 121.797987][ T1166] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 121.852180][ T1166] bond0 (unregistering): Released all slaves
[ 121.904717][ T3081] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 121.912996][ T3081] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 121.925590][ T5006] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 121.947262][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 121.956547][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 121.984890][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 121.993374][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 122.002113][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 122.010603][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 122.020933][ T5006] device veth0_vlan entered promiscuous mode
[ 122.041071][ T5006] device veth1_vlan entered promiscuous mode
[ 122.063787][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 122.073399][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 122.083496][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 122.092966][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 122.104260][ T5006] device veth0_macvtap entered promiscuous mode
[ 122.115023][ T5006] device veth1_macvtap entered promiscuous mode
[ 122.134739][ T5006] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 122.142283][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 122.152040][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 122.160100][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 122.169280][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 122.180508][ T5006] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 122.191882][ T5006] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 122.201417][ T5006] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 122.210530][ T5006] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 122.220449][ T5006] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 122.231058][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 122.240053][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 122.320501][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 122.333796][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 122.346735][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
2026/07/30 19:14:19 executed programs: 2
[ 122.366299][ T4477] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 122.374520][ T4477] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 122.396260][ T4477] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 122.606039][ T4418] Bluetooth: hci0: command 0x040f tx timeout
[ 124.696066][ T4405] Bluetooth: hci0: command 0x0419 tx timeout
2026/07/30 19:14:24 executed programs: 8
2026/07/30 19:14:30 executed programs: 14
[ 133.178461][ T1431] ieee802154 phy0 wpan0: encryption failed: -22
[ 133.184775][ T1431] ieee802154 phy1 wpan1: encryption failed: -22
[ 134.428384][ T4477] ==================================================================
[ 134.437451][ T4477] BUG: KASAN: use-after-free in __lock_acquire+0x107/0x7b50
[ 134.444760][ T4477] Read of size 8 at addr ffff888067cdf120 by task kworker/u4:5/4477
[ 134.452843][ T4477]
[ 134.455188][ T4477] CPU: 1 PID: 4477 Comm: kworker/u4:5 Not tainted syzkaller #0
[ 134.463398][ T4477] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 134.473781][ T4477] Workqueue: kkcmd kcm_tx_work
[ 134.478676][ T4477] Call Trace:
[ 134.481987][ T4477]
[ 134.485065][ T4477] dump_stack_lvl+0x188/0x250
[ 134.490141][ T4477] ? show_regs_print_info+0x20/0x20
[ 134.495396][ T4477] ? load_image+0x410/0x410
[ 134.500267][ T4477] ? _raw_spin_lock_irqsave+0xbc/0x100
[ 134.506029][ T4477] print_address_description+0x60/0x2d0
[ 134.511611][ T4477] ? __lock_acquire+0x107/0x7b50
[ 134.516588][ T4477] kasan_report+0xdf/0x130
[ 134.521021][ T4477] ? __lock_acquire+0x107/0x7b50
[ 134.526051][ T4477] __lock_acquire+0x107/0x7b50
[ 134.531000][ T4477] ? lockdep_hardirqs_on_prepare+0x448/0x7c0
[ 134.537300][ T4477] ? __lock_acquire+0x7b50/0x7b50
[ 134.542427][ T4477] ? lock_chain_count+0x20/0x20
[ 134.547308][ T4477] ? finish_lock_switch+0x12d/0x290
[ 134.552659][ T4477] ? finish_lock_switch+0x12d/0x290
[ 134.558230][ T4477] ? verify_lock_unused+0x140/0x140
[ 134.563442][ T4477] ? finish_task_switch+0x12f/0x650
[ 134.568727][ T4477] ? __schedule+0x11cb/0x4350
[ 134.573414][ T4477] lock_acquire+0x19e/0x400
[ 134.578400][ T4477] ? __lock_sock+0x166/0x2b0
[ 134.583093][ T4477] ? lockdep_hardirqs_on_prepare+0x7c0/0x7c0
[ 134.589099][ T4477] ? __local_bh_disable_ip+0x111/0x1a0
[ 134.594599][ T4477] ? read_lock_is_recursive+0x10/0x10
[ 134.600445][ T4477] ? __local_bh_enable_ip+0x136/0x1c0
[ 134.605808][ T4477] ? kthread_data+0x4b/0xc0
[ 134.610489][ T4477] ? kthread_data+0x4b/0xc0
[ 134.614987][ T4477] ? __lock_sock+0x166/0x2b0
[ 134.619950][ T4477] _raw_spin_lock_bh+0x32/0x50
[ 134.625062][ T4477] ? __lock_sock+0x166/0x2b0
[ 134.630175][ T4477] __lock_sock+0x166/0x2b0
[ 134.634609][ T4477] ? sk_page_frag_refill+0x200/0x200
[ 134.639977][ T4477] ? do_raw_spin_lock+0x128/0x2f0
[ 134.645134][ T4477] ? init_wait_entry+0xd0/0xd0
[ 134.650087][ T4477] ? __rwlock_init+0x140/0x140
[ 134.654989][ T4477] ? lockdep_hardirqs_on_prepare+0x448/0x7c0
[ 134.661359][ T4477] ? __lock_acquire+0x7b50/0x7b50
[ 134.666639][ T4477] ? lock_sock_nested+0x68/0x100
[ 134.671602][ T4477] lock_sock_nested+0x9d/0x100
[ 134.676370][ T4477] kcm_tx_work+0x2d/0x180
[ 134.680911][ T4477] process_one_work+0x867/0xff0
[ 134.685761][ T4477] ? worker_detach_from_pool+0x240/0x240
[ 134.691404][ T4477] ? lockdep_hardirqs_off+0x70/0x100
[ 134.696812][ T4477] ? _raw_spin_lock_irq+0xb7/0xf0
[ 134.701991][ T4477] ? _raw_spin_lock_irqsave+0x100/0x100
[ 134.707554][ T4477] ? wq_worker_running+0x97/0x170
[ 134.712774][ T4477] worker_thread+0xad7/0x12a0
[ 134.717447][ T4477] ? _raw_spin_unlock_irqrestore+0xc1/0x120
[ 134.723516][ T4477] kthread+0x42e/0x520
[ 134.727754][ T4477] ? rcu_lock_release+0x20/0x20
[ 134.732614][ T4477] ? kthread_blkcg+0xd0/0xd0
[ 134.737193][ T4477] ret_from_fork+0x1f/0x30
[ 134.741621][ T4477]
[ 134.744630][ T4477]
[ 134.746941][ T4477] Allocated by task 5329:
[ 134.751252][ T4477] __kasan_slab_alloc+0x92/0xc0
[ 134.756109][ T4477] slab_post_alloc_hook+0x4c/0x380
[ 134.761239][ T4477] kmem_cache_alloc+0x15d/0x280
[ 134.766100][ T4477] sk_prot_alloc+0x57/0x210
[ 134.770700][ T4477] sk_alloc+0x2f/0x310
[ 134.774765][ T4477] kcm_ioctl+0x20f/0xfd0
[ 134.779009][ T4477] sock_do_ioctl+0xfb/0x320
[ 134.783515][ T4477] sock_ioctl+0x48a/0x700
[ 134.787938][ T4477] __se_sys_ioctl+0xfa/0x170
[ 134.793103][ T4477] do_syscall_64+0x4c/0xa0
[ 134.797536][ T4477] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 134.803621][ T4477]
[ 134.806029][ T4477] Freed by task 5330:
[ 134.810103][ T4477] kasan_set_track+0x4b/0x70
[ 134.814864][ T4477] kasan_set_free_info+0x1f/0x40
[ 134.819807][ T4477] ____kasan_slab_free+0xd5/0x110
[ 134.824826][ T4477] slab_free_freelist_hook+0xec/0x170
[ 134.830204][ T4477] kmem_cache_free+0x8f/0x210
[ 134.835064][ T4477] __sk_destruct+0x571/0x840
[ 134.839667][ T4477] kcm_release+0x504/0x590
[ 134.844084][ T4477] sock_close+0xbf/0x210
[ 134.848332][ T4477] __fput+0x212/0x8c0
[ 134.852338][ T4477] task_work_run+0x125/0x1a0
[ 134.856921][ T4477] exit_to_user_mode_loop+0x10f/0x130
[ 134.862323][ T4477] exit_to_user_mode_prepare+0xee/0x180
[ 134.867877][ T4477] syscall_exit_to_user_mode+0x16/0x40
[ 134.873344][ T4477] do_syscall_64+0x58/0xa0
[ 134.877755][ T4477] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 134.883637][ T4477]
[ 134.885953][ T4477] Last potentially related work creation:
[ 134.891841][ T4477] kasan_save_stack+0x35/0x60
[ 134.896521][ T4477] kasan_record_aux_stack+0xb8/0x100
[ 134.902156][ T4477] insert_work+0x54/0x3d0
[ 134.906515][ T4477] __queue_work+0x90b/0xc80
[ 134.911057][ T4477] queue_work_on+0x124/0x1f0
[ 134.915809][ T4477] kcm_unattach+0x89a/0xef0
[ 134.920416][ T4477] kcm_ioctl+0x749/0xfd0
[ 134.924650][ T4477] sock_do_ioctl+0xfb/0x320
[ 134.929468][ T4477] sock_ioctl+0x48a/0x700
[ 134.933825][ T4477] __se_sys_ioctl+0xfa/0x170
[ 134.939228][ T4477] do_syscall_64+0x4c/0xa0
[ 134.943837][ T4477] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 134.950023][ T4477]
[ 134.952361][ T4477] Second to last potentially related work creation:
[ 134.958993][ T4477] kasan_save_stack+0x35/0x60
[ 134.963715][ T4477] kasan_record_aux_stack+0xb8/0x100
[ 134.969659][ T4477] insert_work+0x54/0x3d0
[ 134.974348][ T4477] __queue_work+0x90b/0xc80
[ 134.978893][ T4477] queue_work_on+0x124/0x1f0
[ 134.983869][ T4477] kcm_ioctl+0xe32/0xfd0
[ 134.988161][ T4477] sock_do_ioctl+0xfb/0x320
[ 134.992756][ T4477] sock_ioctl+0x48a/0x700
[ 134.997871][ T4477] __se_sys_ioctl+0xfa/0x170
[ 135.002496][ T4477] do_syscall_64+0x4c/0xa0
[ 135.006944][ T4477] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 135.012946][ T4477]
[ 135.015267][ T4477] The buggy address belongs to the object at ffff888067cdf080
[ 135.015267][ T4477] which belongs to the cache KCM of size 1736
[ 135.028882][ T4477] The buggy address is located 160 bytes inside of
[ 135.028882][ T4477] 1736-byte region [ffff888067cdf080, ffff888067cdf748)
[ 135.042708][ T4477] The buggy address belongs to the page:
[ 135.048347][ T4477] page:ffffea00019f3600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x67cd8
[ 135.058503][ T4477] head:ffffea00019f3600 order:3 compound_mapcount:0 compound_pincount:0
[ 135.066824][ T4477] memcg:ffff888024f26901
[ 135.071072][ T4477] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 135.079063][ T4477] raw: 00fff00000010200 0000000000000000 dead000000000122 ffff88814c69a000
[ 135.087680][ T4477] raw: 0000000000000000 0000000080110011 00000001ffffffff ffff888024f26901
[ 135.096286][ T4477] page dumped because: kasan: bad access detected
[ 135.102886][ T4477] page_owner tracks the page as allocated
[ 135.108619][ T4477] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5273, ts 122522728253, free_ts 121862521662
[ 135.130042][ T4477] get_page_from_freelist+0x24f6/0x2670
[ 135.135685][ T4477] __alloc_pages+0x1ee/0x480
[ 135.140276][ T4477] new_slab+0xc0/0x4b0
[ 135.144394][ T4477] ___slab_alloc+0x807/0xdd0
[ 135.149010][ T4477] kmem_cache_alloc+0xf0/0x280
[ 135.154057][ T4477] sk_prot_alloc+0x57/0x210
[ 135.158578][ T4477] sk_alloc+0x2f/0x310
[ 135.163092][ T4477] kcm_ioctl+0x20f/0xfd0
[ 135.167641][ T4477] sock_do_ioctl+0xfb/0x320
[ 135.172202][ T4477] sock_ioctl+0x48a/0x700
[ 135.176661][ T4477] __se_sys_ioctl+0xfa/0x170
[ 135.181265][ T4477] do_syscall_64+0x4c/0xa0
[ 135.185692][ T4477] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 135.191588][ T4477] page last free stack trace:
[ 135.196273][ T4477] free_unref_page_prepare+0x637/0x6c0
[ 135.201826][ T4477] free_unref_page+0x8f/0x2a0
[ 135.206787][ T4477] __unfreeze_partials+0x188/0x1e0
[ 135.211927][ T4477] put_cpu_partial+0x12d/0x190
[ 135.217251][ T4477] qlist_free_all+0x35/0x90
[ 135.221838][ T4477] kasan_quarantine_reduce+0x150/0x160
[ 135.227298][ T4477] __kasan_slab_alloc+0x2f/0xc0
[ 135.232146][ T4477] slab_post_alloc_hook+0x4c/0x380
[ 135.237251][ T4477] kmem_cache_alloc_node+0x184/0x2c0
[ 135.242532][ T4477] __alloc_skb+0xf4/0x750
[ 135.246862][ T4477] inet_netconf_notify_devconf+0x16f/0x230
[ 135.252666][ T4477] inetdev_event+0x6f6/0x1350
[ 135.257423][ T4477] raw_notifier_call_chain+0xcb/0x160
[ 135.262990][ T4477] unregister_netdevice_many+0x109b/0x1a40
[ 135.268867][ T4477] default_device_exit_batch+0x364/0x3c0
[ 135.274595][ T4477] cleanup_net+0x78e/0xba0
[ 135.279193][ T4477]
[ 135.281653][ T4477] Memory state around the buggy address:
[ 135.287476][ T4477] ffff888067cdf000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 135.295566][ T4477] ffff888067cdf080: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 135.303645][ T4477] >ffff888067cdf100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 135.312072][ T4477] ^
[ 135.317178][ T4477] ffff888067cdf180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 135.325576][ T4477] ffff888067cdf200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 135.333631][ T4477] ==================================================================
[ 135.341859][ T4477] Disabling lock debugging due to kernel taint
[ 135.348234][ T4477] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 135.355520][ T4477] CPU: 1 PID: 4477 Comm: kworker/u4:5 Tainted: G B syzkaller #0
[ 135.364452][ T4477] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 135.374519][ T4477] Workqueue: kkcmd kcm_tx_work
[ 135.379669][ T4477] Call Trace:
[ 135.383247][ T4477]
[ 135.386376][ T4477] dump_stack_lvl+0x188/0x250
[ 135.391124][ T4477] ? show_regs_print_info+0x20/0x20
[ 135.396355][ T4477] ? load_image+0x410/0x410
[ 135.400884][ T4477] panic+0x2f8/0x850
[ 135.404815][ T4477] ? bpf_jit_dump+0xd0/0xd0
[ 135.409422][ T4477] ? _raw_spin_unlock_irqrestore+0xc1/0x120
[ 135.415654][ T4477] ? _raw_spin_unlock+0x40/0x40
[ 135.420622][ T4477] ? __lock_acquire+0x107/0x7b50
[ 135.425568][ T4477] check_panic_on_warn+0x80/0xa0
[ 135.430553][ T4477] ? __lock_acquire+0x107/0x7b50
[ 135.435507][ T4477] end_report+0x6d/0xf0
[ 135.439710][ T4477] kasan_report+0x102/0x130
[ 135.444229][ T4477] ? __lock_acquire+0x107/0x7b50
[ 135.449291][ T4477] __lock_acquire+0x107/0x7b50
[ 135.454302][ T4477] ? lockdep_hardirqs_on_prepare+0x448/0x7c0
[ 135.460465][ T4477] ? __lock_acquire+0x7b50/0x7b50
[ 135.466099][ T4477] ? lock_chain_count+0x20/0x20
[ 135.471464][ T4477] ? finish_lock_switch+0x12d/0x290
[ 135.476710][ T4477] ? finish_lock_switch+0x12d/0x290
[ 135.481936][ T4477] ? verify_lock_unused+0x140/0x140
[ 135.487386][ T4477] ? finish_task_switch+0x12f/0x650
[ 135.492833][ T4477] ? __schedule+0x11cb/0x4350
[ 135.497831][ T4477] lock_acquire+0x19e/0x400
[ 135.502363][ T4477] ? __lock_sock+0x166/0x2b0
[ 135.507116][ T4477] ? lockdep_hardirqs_on_prepare+0x7c0/0x7c0
[ 135.513243][ T4477] ? __local_bh_disable_ip+0x111/0x1a0
[ 135.518724][ T4477] ? read_lock_is_recursive+0x10/0x10
[ 135.524377][ T4477] ? __local_bh_enable_ip+0x136/0x1c0
[ 135.529767][ T4477] ? kthread_data+0x4b/0xc0
[ 135.534850][ T4477] ? kthread_data+0x4b/0xc0
[ 135.540165][ T4477] ? __lock_sock+0x166/0x2b0
[ 135.544940][ T4477] _raw_spin_lock_bh+0x32/0x50
[ 135.549950][ T4477] ? __lock_sock+0x166/0x2b0
[ 135.554739][ T4477] __lock_sock+0x166/0x2b0
[ 135.559241][ T4477] ? sk_page_frag_refill+0x200/0x200
[ 135.564526][ T4477] ? do_raw_spin_lock+0x128/0x2f0
[ 135.569639][ T4477] ? init_wait_entry+0xd0/0xd0
[ 135.574410][ T4477] ? __rwlock_init+0x140/0x140
[ 135.579188][ T4477] ? lockdep_hardirqs_on_prepare+0x448/0x7c0
[ 135.585210][ T4477] ? __lock_acquire+0x7b50/0x7b50
[ 135.590382][ T4477] ? lock_sock_nested+0x68/0x100
[ 135.595469][ T4477] lock_sock_nested+0x9d/0x100
[ 135.600260][ T4477] kcm_tx_work+0x2d/0x180
[ 135.604620][ T4477] process_one_work+0x867/0xff0
[ 135.609552][ T4477] ? worker_detach_from_pool+0x240/0x240
[ 135.615543][ T4477] ? lockdep_hardirqs_off+0x70/0x100
[ 135.620857][ T4477] ? _raw_spin_lock_irq+0xb7/0xf0
[ 135.625903][ T4477] ? _raw_spin_lock_irqsave+0x100/0x100
[ 135.632275][ T4477] ? wq_worker_running+0x97/0x170
[ 135.637442][ T4477] worker_thread+0xad7/0x12a0
[ 135.642154][ T4477] ? _raw_spin_unlock_irqrestore+0xc1/0x120
[ 135.648060][ T4477] kthread+0x42e/0x520
[ 135.652218][ T4477] ? rcu_lock_release+0x20/0x20
[ 135.657163][ T4477] ? kthread_blkcg+0xd0/0xd0
[ 135.661908][ T4477] ret_from_fork+0x1f/0x30
[ 135.666434][ T4477]
[ 135.670026][ T4477] Kernel Offset: disabled
[ 135.675063][ T4477] Rebooting in 86400 seconds..