Warning: Permanently added '10.128.0.106' (ED25519) to the list of known hosts. 2025/08/27 10:19:21 parsed 1 programs [ 93.491342][ T6202] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 95.945376][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 95.952906][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 95.960858][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 95.968833][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 95.976352][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 97.036975][ T6271] chnl_net:caif_netlink_parms(): no params data found [ 97.079520][ T6271] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.086943][ T6271] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.094931][ T6271] bridge_slave_0: entered allmulticast mode [ 97.102039][ T6271] bridge_slave_0: entered promiscuous mode [ 97.109237][ T6271] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.116439][ T6271] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.123889][ T6271] bridge_slave_1: entered allmulticast mode [ 97.130533][ T6271] bridge_slave_1: entered promiscuous mode [ 97.147708][ T6271] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 97.180999][ T6271] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 97.200803][ T6271] team0: Port device team_slave_0 added [ 97.207666][ T6271] team0: Port device team_slave_1 added [ 97.230288][ T6271] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 97.237262][ T6271] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 97.264107][ T6271] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 97.275997][ T6271] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 97.283206][ T6271] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 97.309468][ T6271] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 97.337351][ T6271] hsr_slave_0: entered promiscuous mode [ 97.343654][ T6271] hsr_slave_1: entered promiscuous mode [ 97.632188][ T6271] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 97.645676][ T6271] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 97.655318][ T6271] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 97.671306][ T6271] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 97.695467][ T6271] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.702738][ T6271] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.710144][ T6271] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.717258][ T6271] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.762766][ T6271] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.776738][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.786412][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.800636][ T6271] 8021q: adding VLAN 0 to HW filter on device team0 [ 97.813306][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.820521][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.837723][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.844965][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 98.002805][ T6271] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 98.040454][ T6271] veth0_vlan: entered promiscuous mode [ 98.052964][ T6271] veth1_vlan: entered promiscuous mode [ 98.081969][ T6271] veth0_macvtap: entered promiscuous mode [ 98.091202][ T6271] veth1_macvtap: entered promiscuous mode [ 98.108356][ T6271] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 98.122874][ T6271] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 98.135979][ T3062] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.148886][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.167274][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.190394][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.245587][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 98.315299][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 98.377662][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 98.434469][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 98.473780][ T260] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.489595][ T260] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.512431][ T3075] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.520954][ T3075] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2025/08/27 10:19:30 executed programs: 0 [ 99.053870][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 99.065757][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 99.073249][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 99.081367][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 99.088763][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 99.229833][ T6378] chnl_net:caif_netlink_parms(): no params data found [ 99.316570][ T6378] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.323793][ T6378] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.331293][ T6378] bridge_slave_0: entered allmulticast mode [ 99.338145][ T6378] bridge_slave_0: entered promiscuous mode [ 99.346078][ T6378] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.353743][ T6378] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.362017][ T6378] bridge_slave_1: entered allmulticast mode [ 99.369102][ T6378] bridge_slave_1: entered promiscuous mode [ 99.395747][ T6378] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.407933][ T6378] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 99.439379][ T6378] team0: Port device team_slave_0 added [ 99.448161][ T6378] team0: Port device team_slave_1 added [ 99.480089][ T6378] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 99.487054][ T6378] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 99.515899][ T6378] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 99.528066][ T6378] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 99.535260][ T6378] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 99.561567][ T6378] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 99.602356][ T6378] hsr_slave_0: entered promiscuous mode [ 99.608910][ T6378] hsr_slave_1: entered promiscuous mode [ 99.615671][ T6378] debugfs: 'hsr0' already exists in 'hsr' [ 99.622663][ T6378] Cannot create hsr debugfs directory [ 101.052382][ T12] bridge_slave_1: left allmulticast mode [ 101.058049][ T12] bridge_slave_1: left promiscuous mode [ 101.064519][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.073467][ T12] bridge_slave_0: left allmulticast mode [ 101.079104][ T12] bridge_slave_0: left promiscuous mode [ 101.085048][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.109948][ T5952] Bluetooth: hci0: command tx timeout [ 101.164115][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 101.173836][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 101.183621][ T12] bond0 (unregistering): Released all slaves [ 101.310415][ T12] hsr_slave_0: left promiscuous mode [ 101.316375][ T12] hsr_slave_1: left promiscuous mode [ 101.322700][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 101.331089][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 101.338987][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 101.346619][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 101.359507][ T12] veth1_macvtap: left promiscuous mode [ 101.365763][ T12] veth0_macvtap: left promiscuous mode [ 101.373223][ T12] veth1_vlan: left promiscuous mode [ 101.378527][ T12] veth0_vlan: left promiscuous mode [ 101.514198][ T12] team0 (unregistering): Port device team_slave_1 removed [ 101.525460][ T12] team0 (unregistering): Port device team_slave_0 removed [ 101.761427][ T6378] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 101.774992][ T6378] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 101.785471][ T6378] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 101.800682][ T6378] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 101.879155][ T6378] 8021q: adding VLAN 0 to HW filter on device bond0 [ 101.895580][ T6378] 8021q: adding VLAN 0 to HW filter on device team0 [ 101.908652][ T3075] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.915910][ T3075] bridge0: port 1(bridge_slave_0) entered forwarding state [ 101.980278][ T3075] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.987380][ T3075] bridge0: port 2(bridge_slave_1) entered forwarding state [ 102.183561][ T6378] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 102.239163][ T6378] veth0_vlan: entered promiscuous mode [ 102.262797][ T6378] veth1_vlan: entered promiscuous mode [ 102.295883][ T6378] veth0_macvtap: entered promiscuous mode [ 102.305004][ T6378] veth1_macvtap: entered promiscuous mode [ 102.323004][ T6378] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 102.336136][ T6378] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 102.349333][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.368954][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.387049][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.395886][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.433147][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.449614][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.472006][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.481844][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.511822][ T6544] netlink: 40 bytes leftover after parsing attributes in process `syz.0.17'. [ 102.537179][ T6548] netlink: 40 bytes leftover after parsing attributes in process `syz.0.18'. [ 102.561967][ T6550] netlink: 40 bytes leftover after parsing attributes in process `syz.0.19'. [ 102.586801][ T6554] netlink: 40 bytes leftover after parsing attributes in process `syz.0.20'. [ 102.615286][ T6557] netlink: 40 bytes leftover after parsing attributes in process `syz.0.21'. [ 102.634820][ T6559] netlink: 40 bytes leftover after parsing attributes in process `syz.0.22'. [ 102.663746][ T6562] netlink: 40 bytes leftover after parsing attributes in process `syz.0.23'. [ 102.684966][ T6564] netlink: 40 bytes leftover after parsing attributes in process `syz.0.24'. [ 102.701222][ T6566] netlink: 40 bytes leftover after parsing attributes in process `syz.0.25'. [ 102.726208][ T6568] netlink: 40 bytes leftover after parsing attributes in process `syz.0.26'. [ 103.190057][ T5952] Bluetooth: hci0: command tx timeout 2025/08/27 10:19:35 executed programs: 87 [ 105.279956][ T5952] Bluetooth: hci0: command tx timeout [ 107.350242][ T5952] Bluetooth: hci0: command tx timeout [ 107.537741][ T7138] __nla_validate_parse: 284 callbacks suppressed [ 107.537754][ T7138] netlink: 40 bytes leftover after parsing attributes in process `syz.0.311'. [ 107.561602][ T7140] netlink: 40 bytes leftover after parsing attributes in process `syz.0.312'. [ 107.577936][ T7142] netlink: 40 bytes leftover after parsing attributes in process `syz.0.313'. [ 107.605082][ T7144] netlink: 40 bytes leftover after parsing attributes in process `syz.0.314'. [ 107.622346][ T7146] netlink: 40 bytes leftover after parsing attributes in process `syz.0.315'. [ 107.639353][ T7148] netlink: 40 bytes leftover after parsing attributes in process `syz.0.316'. [ 107.664829][ T7150] netlink: 40 bytes leftover after parsing attributes in process `syz.0.317'. [ 107.682451][ T7152] netlink: 40 bytes leftover after parsing attributes in process `syz.0.318'. [ 107.701197][ T7154] netlink: 40 bytes leftover after parsing attributes in process `syz.0.319'. [ 107.724191][ T7156] netlink: 40 bytes leftover after parsing attributes in process `syz.0.320'. 2025/08/27 10:19:40 executed programs: 381 [ 112.544579][ T7715] __nla_validate_parse: 278 callbacks suppressed [ 112.544592][ T7715] netlink: 40 bytes leftover after parsing attributes in process `syz.0.599'. [ 112.569045][ T7717] netlink: 40 bytes leftover after parsing attributes in process `syz.0.600'. [ 112.586169][ T7719] netlink: 40 bytes leftover after parsing attributes in process `syz.0.601'. [ 112.614316][ T7721] netlink: 40 bytes leftover after parsing attributes in process `syz.0.602'. [ 112.633477][ T7723] netlink: 40 bytes leftover after parsing attributes in process `syz.0.603'. [ 112.651391][ T7725] netlink: 40 bytes leftover after parsing attributes in process `syz.0.604'. [ 112.675193][ T7727] netlink: 40 bytes leftover after parsing attributes in process `syz.0.605'. [ 112.694140][ T7729] netlink: 40 bytes leftover after parsing attributes in process `syz.0.606'. [ 112.712635][ T7731] netlink: 40 bytes leftover after parsing attributes in process `syz.0.607'. [ 112.744931][ T7733] netlink: 40 bytes leftover after parsing attributes in process `syz.0.608'. [ 112.941123][ T51] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 112.948406][ T51] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 112.956175][ T51] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 112.973162][ T51] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 112.980640][ T51] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 113.056136][ T7751] chnl_net:caif_netlink_parms(): no params data found [ 113.091246][ T7751] bridge0: port 1(bridge_slave_0) entered blocking state [ 113.098323][ T7751] bridge0: port 1(bridge_slave_0) entered disabled state [ 113.105810][ T7751] bridge_slave_0: entered allmulticast mode [ 113.113178][ T7751] bridge_slave_0: entered promiscuous mode [ 113.120811][ T7751] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.128338][ T7751] bridge0: port 2(bridge_slave_1) entered disabled state [ 113.135615][ T7751] bridge_slave_1: entered allmulticast mode [ 113.142183][ T7751] bridge_slave_1: entered promiscuous mode [ 113.161208][ T3075] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 113.174406][ T7751] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 113.185843][ T7751] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 113.206383][ T7751] team0: Port device team_slave_0 added [ 113.215747][ T3075] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 113.228672][ T7751] team0: Port device team_slave_1 added [ 113.245935][ T7751] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 113.253100][ T7751] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 113.280556][ T7751] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 113.294136][ T3075] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 113.306383][ T7751] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 113.313745][ T7751] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 113.340718][ T7751] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 113.359070][ T3075] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 113.382994][ T7751] hsr_slave_0: entered promiscuous mode [ 113.389108][ T7751] hsr_slave_1: entered promiscuous mode [ 113.469472][ T3075] bridge_slave_1: left allmulticast mode [ 113.475570][ T3075] bridge_slave_1: left promiscuous mode [ 113.481491][ T3075] bridge0: port 2(bridge_slave_1) entered disabled state [ 113.489752][ T3075] bridge_slave_0: left allmulticast mode [ 113.495491][ T3075] bridge_slave_0: left promiscuous mode [ 113.501431][ T3075] bridge0: port 1(bridge_slave_0) entered disabled state [ 113.598240][ T3075] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 113.609166][ T3075] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 113.618765][ T3075] bond0 (unregistering): Released all slaves [ 113.866455][ T3075] hsr_slave_0: left promiscuous mode [ 113.872484][ T3075] hsr_slave_1: left promiscuous mode [ 113.878405][ T3075] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 113.888598][ T3075] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 113.898548][ T3075] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 113.906760][ T3075] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 113.916576][ T3075] veth1_macvtap: left promiscuous mode [ 113.922223][ T3075] veth0_macvtap: left promiscuous mode [ 113.927994][ T3075] veth1_vlan: left promiscuous mode [ 113.934097][ T3075] veth0_vlan: left promiscuous mode [ 114.024296][ T3075] team0 (unregistering): Port device team_slave_1 removed [ 114.034947][ T3075] team0 (unregistering): Port device team_slave_0 removed [ 114.137543][ T7751] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 114.156480][ T7751] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 114.168314][ T7751] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 114.179321][ T7751] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 114.247432][ T7751] 8021q: adding VLAN 0 to HW filter on device bond0 [ 114.271369][ T7751] 8021q: adding VLAN 0 to HW filter on device team0 [ 114.283552][ T260] bridge0: port 1(bridge_slave_0) entered blocking state [ 114.290699][ T260] bridge0: port 1(bridge_slave_0) entered forwarding state [ 114.314138][ T260] bridge0: port 2(bridge_slave_1) entered blocking state [ 114.321285][ T260] bridge0: port 2(bridge_slave_1) entered forwarding state [ 114.468884][ T7751] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 114.497382][ T7751] veth0_vlan: entered promiscuous mode [ 114.505685][ T7751] veth1_vlan: entered promiscuous mode [ 114.522810][ T7751] veth0_macvtap: entered promiscuous mode [ 114.530968][ T7751] veth1_macvtap: entered promiscuous mode [ 114.543746][ T7751] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 114.555178][ T7751] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 114.566250][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.575610][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.585641][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.594709][ T260] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 2025/08/27 10:19:46 executed programs: 602 [ 114.628542][ T3062] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.637072][ T3062] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.654202][ T3062] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.662248][ T3062] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.031395][ T51] Bluetooth: hci1: command tx timeout [ 117.109933][ T51] Bluetooth: hci1: command tx timeout [ 117.553034][ T8147] __nla_validate_parse: 180 callbacks suppressed [ 117.553050][ T8147] netlink: 40 bytes leftover after parsing attributes in process `syz.0.789'. [ 117.575206][ T8149] netlink: 40 bytes leftover after parsing attributes in process `syz.0.790'. [ 117.594520][ T8151] netlink: 40 bytes leftover after parsing attributes in process `syz.0.791'. [ 117.610556][ T8153] netlink: 40 bytes leftover after parsing attributes in process `syz.0.792'. [ 117.626486][ T8155] netlink: 40 bytes leftover after parsing attributes in process `syz.0.793'. [ 117.669268][ T8157] netlink: 40 bytes leftover after parsing attributes in process `syz.0.794'. [ 117.686473][ T8159] netlink: 40 bytes leftover after parsing attributes in process `syz.0.795'. [ 117.703457][ T8161] netlink: 40 bytes leftover after parsing attributes in process `syz.0.796'. [ 117.736016][ T8163] netlink: 40 bytes leftover after parsing attributes in process `syz.0.797'. [ 117.752182][ T8165] netlink: 40 bytes leftover after parsing attributes in process `syz.0.798'. [ 119.190155][ T51] Bluetooth: hci1: command tx timeout 2025/08/27 10:19:51 executed programs: 897 [ 121.270846][ T51] Bluetooth: hci1: command tx timeout [ 122.560283][ T8737] __nla_validate_parse: 285 callbacks suppressed [ 122.560295][ T8737] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1084'. [ 122.595844][ T8739] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1085'. [ 122.615554][ T8741] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1086'. [ 122.632668][ T8743] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1087'. [ 122.654354][ T8745] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1088'. [ 122.671433][ T8747] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1089'. [ 122.689105][ T8749] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1090'. [ 122.714172][ T8751] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1091'. [ 122.732644][ T8753] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1092'. [ 122.749437][ T8755] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1093'. 2025/08/27 10:19:56 executed programs: 1191 [ 124.883652][ T5952] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 124.893490][ T5952] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 124.903985][ T5952] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 124.912804][ T5952] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 124.920556][ T5952] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 124.997855][ T9004] chnl_net:caif_netlink_parms(): no params data found [ 125.034132][ T9004] bridge0: port 1(bridge_slave_0) entered blocking state [ 125.041299][ T9004] bridge0: port 1(bridge_slave_0) entered disabled state [ 125.048415][ T9004] bridge_slave_0: entered allmulticast mode [ 125.055085][ T9004] bridge_slave_0: entered promiscuous mode [ 125.062675][ T9004] bridge0: port 2(bridge_slave_1) entered blocking state [ 125.069746][ T9004] bridge0: port 2(bridge_slave_1) entered disabled state [ 125.077119][ T9004] bridge_slave_1: entered allmulticast mode [ 125.084672][ T9004] bridge_slave_1: entered promiscuous mode [ 125.100644][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 125.119766][ T9004] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 125.132187][ T9004] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 125.143548][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 125.165979][ T9004] team0: Port device team_slave_0 added [ 125.173474][ T9004] team0: Port device team_slave_1 added [ 125.189410][ T9004] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 125.196935][ T9004] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 125.223256][ T9004] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 125.237141][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 125.248918][ T9004] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 125.256277][ T9004] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 125.282363][ T9004] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 125.308562][ T9004] hsr_slave_0: entered promiscuous mode [ 125.314603][ T9004] hsr_slave_1: entered promiscuous mode [ 125.320664][ T9004] debugfs: 'hsr0' already exists in 'hsr' [ 125.326501][ T9004] Cannot create hsr debugfs directory [ 125.335512][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 125.426713][ T12] bridge_slave_1: left allmulticast mode [ 125.432691][ T12] bridge_slave_1: left promiscuous mode [ 125.438345][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 125.446729][ T12] bridge_slave_0: left allmulticast mode [ 125.452626][ T12] bridge_slave_0: left promiscuous mode [ 125.458307][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 125.537235][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 125.547348][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 125.556904][ T12] bond0 (unregistering): Released all slaves [ 125.765870][ T12] hsr_slave_0: left promiscuous mode [ 125.772038][ T12] hsr_slave_1: left promiscuous mode [ 125.777801][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 125.785564][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 125.797621][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 125.806001][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 125.816684][ T12] veth1_macvtap: left promiscuous mode [ 125.823695][ T12] veth0_macvtap: left promiscuous mode [ 125.829277][ T12] veth1_vlan: left promiscuous mode [ 125.834853][ T12] veth0_vlan: left promiscuous mode [ 125.920808][ T12] team0 (unregistering): Port device team_slave_1 removed [ 125.935765][ T12] team0 (unregistering): Port device team_slave_0 removed [ 126.083971][ T9004] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 126.094423][ T9004] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 126.105841][ T9004] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 126.115831][ T9004] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 126.198321][ T9004] 8021q: adding VLAN 0 to HW filter on device bond0 [ 126.231343][ T9004] 8021q: adding VLAN 0 to HW filter on device team0 [ 126.243157][ T3075] bridge0: port 1(bridge_slave_0) entered blocking state [ 126.250374][ T3075] bridge0: port 1(bridge_slave_0) entered forwarding state [ 126.267075][ T3062] bridge0: port 2(bridge_slave_1) entered blocking state [ 126.274234][ T3062] bridge0: port 2(bridge_slave_1) entered forwarding state [ 126.381745][ T9004] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 126.408335][ T9004] veth0_vlan: entered promiscuous mode [ 126.418121][ T9004] veth1_vlan: entered promiscuous mode [ 126.435713][ T9004] veth0_macvtap: entered promiscuous mode [ 126.443811][ T9004] veth1_macvtap: entered promiscuous mode [ 126.455617][ T9004] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 126.468040][ T9004] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 126.481928][ T3075] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 126.490817][ T3075] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 126.499528][ T3075] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 126.511421][ T3075] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 126.541977][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 126.549946][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 126.568771][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 126.576965][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 126.950201][ T5952] Bluetooth: hci0: command tx timeout [ 127.604796][ T9173] __nla_validate_parse: 183 callbacks suppressed [ 127.604810][ T9173] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1277'. [ 127.627840][ T9175] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1278'. [ 127.643945][ T9177] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1279'. [ 127.675992][ T9179] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1280'. [ 127.692971][ T9181] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1281'. [ 127.709171][ T9183] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1282'. [ 127.734276][ T9185] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1283'. [ 127.751632][ T9187] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1284'. [ 127.768625][ T9189] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1285'. [ 127.795176][ T9191] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1286'. [ 129.030500][ T5952] Bluetooth: hci0: command tx timeout 2025/08/27 10:20:01 executed programs: 1383 [ 131.121766][ T5952] Bluetooth: hci0: command tx timeout [ 132.646666][ T9755] __nla_validate_parse: 281 callbacks suppressed [ 132.646680][ T9755] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1568'. [ 132.670349][ T9757] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1569'. [ 132.688104][ T9759] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1570'. [ 132.714644][ T9761] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1571'. [ 132.732762][ T9763] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1572'. [ 132.750914][ T9765] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1573'. [ 132.774904][ T9767] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1574'. [ 132.793042][ T9769] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1575'. [ 132.809511][ T9771] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1576'. [ 132.834420][ T9773] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1577'. [ 132.871632][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.878127][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.191391][ T5952] Bluetooth: hci0: command tx timeout 2025/08/27 10:20:06 executed programs: 1674 [ 136.937332][ T51] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 136.951599][ T51] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 136.959147][ T51] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 136.967018][ T51] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 136.974706][ T51] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 137.050667][T10253] chnl_net:caif_netlink_parms(): no params data found [ 137.080008][ T3075] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 137.102771][T10253] bridge0: port 1(bridge_slave_0) entered blocking state [ 137.110770][T10253] bridge0: port 1(bridge_slave_0) entered disabled state [ 137.117887][T10253] bridge_slave_0: entered allmulticast mode [ 137.124479][T10253] bridge_slave_0: entered promiscuous mode [ 137.131680][T10253] bridge0: port 2(bridge_slave_1) entered blocking state [ 137.138733][T10253] bridge0: port 2(bridge_slave_1) entered disabled state [ 137.146233][T10253] bridge_slave_1: entered allmulticast mode [ 137.152878][T10253] bridge_slave_1: entered promiscuous mode [ 137.167481][ T3075] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 137.186053][T10253] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 137.196552][T10253] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 137.216649][T10253] team0: Port device team_slave_0 added [ 137.224925][T10253] team0: Port device team_slave_1 added [ 137.232974][ T3075] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 137.255282][T10253] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 137.262435][T10253] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 137.289143][T10253] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 137.303430][ T3075] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 137.315594][T10253] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 137.322607][T10253] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 137.348780][T10253] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 137.374554][T10253] hsr_slave_0: entered promiscuous mode [ 137.380994][T10253] hsr_slave_1: entered promiscuous mode [ 137.447817][ T3075] bridge_slave_1: left allmulticast mode [ 137.453627][ T3075] bridge_slave_1: left promiscuous mode [ 137.459313][ T3075] bridge0: port 2(bridge_slave_1) entered disabled state [ 137.468351][ T3075] bridge_slave_0: left allmulticast mode [ 137.474380][ T3075] bridge_slave_0: left promiscuous mode [ 137.480556][ T3075] bridge0: port 1(bridge_slave_0) entered disabled state [ 137.557026][ T3075] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 137.567188][ T3075] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 137.576637][ T3075] bond0 (unregistering): Released all slaves [ 137.819992][ T3075] hsr_slave_0: left promiscuous mode [ 137.826398][ T3075] hsr_slave_1: left promiscuous mode [ 137.832500][ T3075] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 137.840230][ T3075] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 137.848237][ T3075] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 137.857787][ T3075] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 137.869689][ T3075] veth1_macvtap: left promiscuous mode [ 137.875459][ T3075] veth0_macvtap: left promiscuous mode [ 137.881119][ T3075] veth1_vlan: left promiscuous mode [ 137.886385][ T3075] veth0_vlan: left promiscuous mode [ 137.977868][ T3075] team0 (unregistering): Port device team_slave_1 removed [ 137.988348][ T3075] team0 (unregistering): Port device team_slave_0 removed [ 138.146303][T10253] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 138.156262][T10253] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 138.167916][T10253] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 138.178885][T10253] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 138.245558][T10253] 8021q: adding VLAN 0 to HW filter on device bond0 [ 138.267715][T10253] 8021q: adding VLAN 0 to HW filter on device team0 [ 138.283366][ T3062] bridge0: port 1(bridge_slave_0) entered blocking state [ 138.290515][ T3062] bridge0: port 1(bridge_slave_0) entered forwarding state [ 138.316235][ T3075] ================================================================== [ 138.324381][ T3075] BUG: KASAN: slab-use-after-free in __xfrm_state_delete+0x666/0xcd0 [ 138.332477][ T3075] Write of size 8 at addr ffff8880285bd9a8 by task kworker/u8:7/3075 [ 138.340557][ T3075] [ 138.343003][ T3075] CPU: 1 UID: 0 PID: 3075 Comm: kworker/u8:7 Not tainted syzkaller #0 PREEMPT(full) [ 138.343025][ T3075] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 138.343036][ T3075] Workqueue: netns cleanup_net [ 138.343062][ T3075] Call Trace: [ 138.343069][ T3075] [ 138.343077][ T3075] dump_stack_lvl+0x189/0x250 [ 138.343099][ T3075] ? __virt_addr_valid+0x1c8/0x5c0 [ 138.343119][ T3075] ? rcu_is_watching+0x15/0xb0 [ 138.343142][ T3075] ? __pfx_dump_stack_lvl+0x10/0x10 [ 138.343160][ T3075] ? rcu_is_watching+0x15/0xb0 [ 138.343175][ T3075] ? lock_release+0x4b/0x3e0 [ 138.343199][ T3075] ? __virt_addr_valid+0x1c8/0x5c0 [ 138.343217][ T3075] ? __virt_addr_valid+0x4a5/0x5c0 [ 138.343237][ T3075] print_report+0xca/0x240 [ 138.343250][ T3075] ? __xfrm_state_delete+0x666/0xcd0 [ 138.343264][ T3075] kasan_report+0x118/0x150 [ 138.343287][ T3075] ? __xfrm_state_delete+0x666/0xcd0 [ 138.343305][ T3075] __xfrm_state_delete+0x666/0xcd0 [ 138.343325][ T3075] xfrm_state_flush+0x487/0x7c0 [ 138.343346][ T3075] xfrm6_tunnel_net_exit+0x3c/0x100 [ 138.343365][ T3075] ops_undo_list+0x49a/0x990 [ 138.343383][ T3075] ? __pfx_ops_undo_list+0x10/0x10 [ 138.343399][ T3075] ? do_raw_spin_unlock+0x122/0x240 [ 138.343420][ T3075] cleanup_net+0x4c5/0x800 [ 138.343436][ T3075] ? __pfx_cleanup_net+0x10/0x10 [ 138.343453][ T3075] ? rcu_is_watching+0x15/0xb0 [ 138.343469][ T3075] ? process_scheduled_works+0x9ef/0x17b0 [ 138.343485][ T3075] ? process_scheduled_works+0x9ef/0x17b0 [ 138.343502][ T3075] process_scheduled_works+0xae1/0x17b0 [ 138.343529][ T3075] ? __pfx_process_scheduled_works+0x10/0x10 [ 138.343553][ T3075] worker_thread+0x8a0/0xda0 [ 138.343570][ T3075] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 138.343594][ T3075] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 138.343616][ T3075] ? __kthread_parkme+0x7b/0x200 [ 138.343637][ T3075] kthread+0x70e/0x8a0 [ 138.343658][ T3075] ? __pfx_worker_thread+0x10/0x10 [ 138.343674][ T3075] ? __pfx_kthread+0x10/0x10 [ 138.343694][ T3075] ? rcu_is_watching+0x15/0xb0 [ 138.343710][ T3075] ? __pfx_kthread+0x10/0x10 [ 138.343730][ T3075] ret_from_fork+0x3f9/0x770 [ 138.343747][ T3075] ? __pfx_ret_from_fork+0x10/0x10 [ 138.343766][ T3075] ? __switch_to_asm+0x39/0x70 [ 138.343786][ T3075] ? __switch_to_asm+0x33/0x70 [ 138.343805][ T3075] ? __pfx_kthread+0x10/0x10 [ 138.343825][ T3075] ret_from_fork_asm+0x1a/0x30 [ 138.343852][ T3075] [ 138.343858][ T3075] [ 138.413494][ T3062] bridge0: port 2(bridge_slave_1) entered blocking state [ 138.414352][ T3075] Allocated by task 10077: [ 138.418810][ T3062] bridge0: port 2(bridge_slave_1) entered forwarding state [ 138.424014][ T3075] kasan_save_track+0x3e/0x80 [ 138.424037][ T3075] __kasan_slab_alloc+0x6c/0x80 [ 138.424053][ T3075] kmem_cache_alloc_noprof+0x1c1/0x3c0 [ 138.424072][ T3075] xfrm_state_alloc+0x24/0x320 [ 138.440724][T10253] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 138.443832][ T3075] __find_acq_core+0x8a7/0x1c00 [ 138.449097][T10253] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 138.453667][ T3075] xfrm_find_acq+0x78/0xa0 [ 138.453682][ T3075] xfrm_alloc_userspi+0x6b3/0xc90 [ 138.453698][ T3075] xfrm_user_rcv_msg+0x7a3/0xab0 [ 138.569532][T10253] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 138.570406][ T3075] netlink_rcv_skb+0x208/0x470 [ 138.570433][ T3075] xfrm_netlink_rcv+0x79/0x90 [ 138.570449][ T3075] netlink_unicast+0x82f/0x9e0 [ 138.570467][ T3075] netlink_sendmsg+0x805/0xb30 [ 138.570479][ T3075] __sock_sendmsg+0x219/0x270 [ 138.570497][ T3075] ____sys_sendmsg+0x505/0x830 [ 138.570512][ T3075] ___sys_sendmsg+0x21f/0x2a0 [ 138.570526][ T3075] __x64_sys_sendmsg+0x19b/0x260 [ 138.570542][ T3075] do_syscall_64+0xfa/0x3b0 [ 138.570555][ T3075] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 138.570568][ T3075] [ 138.570573][ T3075] Freed by task 24: [ 138.570582][ T3075] kasan_save_track+0x3e/0x80 [ 138.570599][ T3075] kasan_save_free_info+0x46/0x50 [ 138.601267][T10253] veth0_vlan: entered promiscuous mode [ 138.604117][ T3075] __kasan_slab_free+0x5b/0x80 [ 138.613449][T10253] veth1_vlan: entered promiscuous mode [ 138.614390][ T3075] kmem_cache_free+0x18f/0x400 [ 138.642982][T10253] veth0_macvtap: entered promiscuous mode [ 138.645016][ T3075] xfrm_state_gc_task+0x52d/0x6b0 [ 138.652522][T10253] veth1_macvtap: entered promiscuous mode [ 138.654420][ T3075] process_scheduled_works+0xae1/0x17b0 [ 138.668265][T10253] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 138.670823][ T3075] worker_thread+0x8a0/0xda0 [ 138.670844][ T3075] kthread+0x70e/0x8a0 [ 138.670860][ T3075] ret_from_fork+0x3f9/0x770 [ 138.670873][ T3075] ret_from_fork_asm+0x1a/0x30 [ 138.670893][ T3075] [ 138.670898][ T3075] The buggy address belongs to the object at ffff8880285bd980 [ 138.670898][ T3075] which belongs to the cache xfrm_state of size 928 [ 138.670912][ T3075] The buggy address is located 40 bytes inside of [ 138.670912][ T3075] freed 928-byte region [ffff8880285bd980, ffff8880285bdd20) [ 138.670929][ T3075] [ 138.670934][ T3075] The buggy address belongs to the physical page: [ 138.670960][ T3075] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x285bc [ 138.670980][ T3075] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 138.670994][ T3075] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 138.671021][ T3075] page_type: f5(slab) [ 138.671036][ T3075] raw: 00fff00000000040 ffff88801fef0640 dead000000000100 dead000000000122 [ 138.685939][T10253] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 138.690051][ T3075] raw: 0000000000000000 00000000000f000f 00000000f5000000 0000000000000000 [ 138.690067][ T3075] head: 00fff00000000040 ffff88801fef0640 dead000000000100 dead000000000122 [ 138.690079][ T3075] head: 0000000000000000 00000000000f000f 00000000f5000000 0000000000000000 [ 138.907948][ T3075] head: 00fff00000000002 ffffea0000a16f01 00000000ffffffff 00000000ffffffff [ 138.916605][ T3075] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 138.925363][ T3075] page dumped because: kasan: bad access detected [ 138.931775][ T3075] page_owner tracks the page as allocated [ 138.937490][ T3075] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 6998, tgid 6997 (syz.0.241), ts 106338851731, free_ts 105263132831 [ 138.956931][ T3075] post_alloc_hook+0x240/0x2a0 [ 138.961883][ T3075] get_page_from_freelist+0x21e4/0x22c0 [ 138.967428][ T3075] __alloc_frozen_pages_noprof+0x181/0x370 [ 138.973268][ T3075] alloc_pages_mpol+0x232/0x4a0 [ 138.978111][ T3075] allocate_slab+0x8a/0x370 [ 138.982615][ T3075] ___slab_alloc+0xbeb/0x1410 [ 138.987325][ T3075] kmem_cache_alloc_noprof+0x283/0x3c0 [ 138.992859][ T3075] xfrm_state_alloc+0x24/0x320 [ 138.997878][ T3075] __find_acq_core+0x8a7/0x1c00 [ 139.002709][ T3075] xfrm_find_acq+0x78/0xa0 [ 139.007161][ T3075] xfrm_alloc_userspi+0x6b3/0xc90 [ 139.012169][ T3075] xfrm_user_rcv_msg+0x7a3/0xab0 [ 139.017091][ T3075] netlink_rcv_skb+0x208/0x470 [ 139.021853][ T3075] xfrm_netlink_rcv+0x79/0x90 [ 139.026609][ T3075] netlink_unicast+0x82f/0x9e0 [ 139.031356][ T3075] netlink_sendmsg+0x805/0xb30 [ 139.036097][ T3075] page last free pid 6867 tgid 6867 stack trace: [ 139.042399][ T3075] __free_frozen_pages+0xbc4/0xd30 [ 139.047601][ T3075] __put_partials+0x156/0x1a0 [ 139.052257][ T3075] put_cpu_partial+0x17c/0x250 [ 139.057003][ T3075] __slab_free+0x2d5/0x3c0 [ 139.061482][ T3075] qlist_free_all+0x97/0x140 [ 139.066066][ T3075] kasan_quarantine_reduce+0x148/0x160 [ 139.071515][ T3075] __kasan_slab_alloc+0x22/0x80 [ 139.076370][ T3075] __kmalloc_noprof+0x224/0x4f0 [ 139.081213][ T3075] tomoyo_encode+0x28b/0x550 [ 139.085873][ T3075] tomoyo_path_perm+0x2b3/0x4b0 [ 139.090798][ T3075] tomoyo_path_symlink+0xa3/0xe0 [ 139.095718][ T3075] security_path_symlink+0x177/0x380 [ 139.100981][ T3075] do_symlinkat+0x107/0x3f0 [ 139.105568][ T3075] __x64_sys_symlinkat+0x95/0xb0 [ 139.110595][ T3075] do_syscall_64+0xfa/0x3b0 [ 139.115353][ T3075] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 139.121242][ T3075] [ 139.123556][ T3075] Memory state around the buggy address: [ 139.129168][ T3075] ffff8880285bd880: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 139.137304][ T3075] ffff8880285bd900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 139.145442][ T3075] >ffff8880285bd980: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 139.153481][ T3075] ^ [ 139.158833][ T3075] ffff8880285bda00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 139.167148][ T3075] ffff8880285bda80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 139.175188][ T3075] ================================================================== [ 139.183407][ T3075] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 139.190695][ T3075] CPU: 1 UID: 0 PID: 3075 Comm: kworker/u8:7 Not tainted syzkaller #0 PREEMPT(full) [ 139.200144][ T3075] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 139.210184][ T3075] Workqueue: netns cleanup_net [ 139.215036][ T3075] Call Trace: [ 139.218298][ T3075] [ 139.221216][ T3075] dump_stack_lvl+0x99/0x250 [ 139.225793][ T3075] ? __asan_memcpy+0x40/0x70 [ 139.230501][ T3075] ? __pfx_dump_stack_lvl+0x10/0x10 [ 139.235684][ T3075] ? __pfx__printk+0x10/0x10 [ 139.240268][ T3075] vpanic+0x281/0x750 [ 139.244300][ T3075] ? __pfx_print_hex_dump+0x10/0x10 [ 139.249487][ T3075] ? __pfx_vpanic+0x10/0x10 [ 139.253978][ T3075] ? rcu_is_watching+0x15/0xb0 [ 139.258726][ T3075] panic+0xb9/0xc0 [ 139.262453][ T3075] ? __pfx_panic+0x10/0x10 [ 139.266865][ T3075] ? _raw_spin_unlock_irqrestore+0xa8/0x110 [ 139.272756][ T3075] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 139.279085][ T3075] ? __xfrm_state_delete+0x666/0xcd0 [ 139.284358][ T3075] check_panic_on_warn+0x89/0xb0 [ 139.289294][ T3075] ? __xfrm_state_delete+0x666/0xcd0 [ 139.294560][ T3075] end_report+0x78/0x160 [ 139.298791][ T3075] kasan_report+0x129/0x150 [ 139.303306][ T3075] ? __xfrm_state_delete+0x666/0xcd0 [ 139.308575][ T3075] __xfrm_state_delete+0x666/0xcd0 [ 139.313685][ T3075] xfrm_state_flush+0x487/0x7c0 [ 139.318523][ T3075] xfrm6_tunnel_net_exit+0x3c/0x100 [ 139.323704][ T3075] ops_undo_list+0x49a/0x990 [ 139.328280][ T3075] ? __pfx_ops_undo_list+0x10/0x10 [ 139.333647][ T3075] ? do_raw_spin_unlock+0x122/0x240 [ 139.338838][ T3075] cleanup_net+0x4c5/0x800 [ 139.343249][ T3075] ? __pfx_cleanup_net+0x10/0x10 [ 139.348271][ T3075] ? rcu_is_watching+0x15/0xb0 [ 139.353025][ T3075] ? process_scheduled_works+0x9ef/0x17b0 [ 139.358726][ T3075] ? process_scheduled_works+0x9ef/0x17b0 [ 139.364425][ T3075] process_scheduled_works+0xae1/0x17b0 [ 139.369963][ T3075] ? __pfx_process_scheduled_works+0x10/0x10 [ 139.376123][ T3075] worker_thread+0x8a0/0xda0 [ 139.380716][ T3075] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 139.387082][ T3075] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 139.393001][ T3075] ? __kthread_parkme+0x7b/0x200 [ 139.397935][ T3075] kthread+0x70e/0x8a0 [ 139.402004][ T3075] ? __pfx_worker_thread+0x10/0x10 [ 139.407103][ T3075] ? __pfx_kthread+0x10/0x10 [ 139.411679][ T3075] ? rcu_is_watching+0x15/0xb0 [ 139.416599][ T3075] ? __pfx_kthread+0x10/0x10 [ 139.421173][ T3075] ret_from_fork+0x3f9/0x770 [ 139.425837][ T3075] ? __pfx_ret_from_fork+0x10/0x10 [ 139.430932][ T3075] ? __switch_to_asm+0x39/0x70 [ 139.435682][ T3075] ? __switch_to_asm+0x33/0x70 [ 139.440430][ T3075] ? __pfx_kthread+0x10/0x10 [ 139.445011][ T3075] ret_from_fork_asm+0x1a/0x30 [ 139.449854][ T3075] [ 139.453132][ T3075] Kernel Offset: disabled [ 139.457438][ T3075] Rebooting in 86400 seconds..