Warning: Permanently added '10.128.1.180' (ED25519) to the list of known hosts. 1970/01/01 00:00:48 ignoring optional flag "type"="gce" 1970/01/01 00:00:48 parsed 1 programs [ 48.653505][ T4293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS 1970/01/01 00:00:48 executed programs: 0 [ 48.736572][ T4309] chnl_net:caif_netlink_parms(): no params data found [ 48.756187][ T4309] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.757410][ T4309] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.758903][ T4309] device bridge_slave_0 entered promiscuous mode [ 48.761037][ T4309] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.762116][ T4309] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.763649][ T4309] device bridge_slave_1 entered promiscuous mode [ 48.772549][ T4309] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.774920][ T4309] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.784695][ T4309] team0: Port device team_slave_0 added [ 48.786559][ T4309] team0: Port device team_slave_1 added [ 48.793466][ T4309] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.794496][ T4309] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 48.798578][ T4309] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.801963][ T4309] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.803052][ T4309] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 48.806734][ T4309] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.840700][ T4309] device hsr_slave_0 entered promiscuous mode [ 48.869648][ T4309] device hsr_slave_1 entered promiscuous mode [ 49.493026][ T4309] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 49.521289][ T4309] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 49.600715][ T4309] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 49.621238][ T4309] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 49.668226][ T4309] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.669437][ T4309] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.670642][ T4309] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.671722][ T4309] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.690615][ T4309] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.694534][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 49.696313][ T136] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.698167][ T136] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.703011][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 49.708902][ T4309] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.720756][ T360] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 49.722242][ T360] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.723277][ T360] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.724564][ T360] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 49.726060][ T360] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.727113][ T360] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.729073][ T360] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 49.731322][ T360] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 49.736834][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 49.738312][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 49.742191][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 49.743815][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 49.745461][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 49.746829][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 49.749074][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 49.793069][ T4309] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.799919][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 49.801037][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 49.802198][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 49.804412][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 49.812221][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 49.813795][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 49.816134][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 49.817553][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 49.821419][ T4309] device veth0_vlan entered promiscuous mode [ 49.824440][ T4309] device veth1_vlan entered promiscuous mode [ 49.833223][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 49.834612][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 49.836065][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 49.837493][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 49.840356][ T4309] device veth0_macvtap entered promiscuous mode [ 49.842877][ T4309] device veth1_macvtap entered promiscuous mode [ 49.849089][ T4309] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.850914][ T360] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 49.852308][ T360] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 49.853692][ T360] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 49.855183][ T360] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 49.858171][ T4309] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.859455][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 49.860971][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 49.867776][ T4309] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.869198][ T4309] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.872395][ T4309] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.873712][ T4309] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.740025][ T13] Bluetooth: hci0: command 0x0409 tx timeout [ 52.819841][ T13] Bluetooth: hci0: command 0x041b tx timeout 1970/01/01 00:00:53 executed programs: 250 [ 54.899460][ T13] Bluetooth: hci0: command 0x040f tx timeout [ 56.979688][ T13] Bluetooth: hci0: command 0x0419 tx timeout 1970/01/01 00:00:58 executed programs: 692 1970/01/01 00:01:03 executed programs: 1139 1970/01/01 00:01:08 executed programs: 1574 [ 69.624367][ T2463] cfg80211: failed to load regulatory.db [ 69.626489][ T2066] ieee802154 phy0 wpan0: encryption failed: -22 [ 69.627575][ T2066] ieee802154 phy1 wpan1: encryption failed: -22 [ 72.729368][ C0] IPv4: Attempt to release TCP socket in state 8 00000000c01b3ce3 [ 72.730737][ C0] [ 72.731049][ C0] ========================= [ 72.731718][ C0] WARNING: held lock freed! [ 72.732380][ C0] syzkaller #0 Not tainted [ 72.732972][ C0] ------------------------- [ 72.733575][ C0] syz-executor.0/8490 is freeing memory ffff0000c1560b80-ffff0000c156165f, with a lock still held there! [ 72.735143][ C0] ffff0000c1560ca0 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_sendmsg+0x154/0x284 [ 72.736461][ C0] 2 locks held by syz-executor.0/8490: [ 72.737217][ C0] #0: ffff0000c1560ca0 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_sendmsg+0x154/0x284 [ 72.738523][ C0] #1: ffff800008007b80 ((&msk->sk.icsk_retransmit_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd0/0x858 [ 72.740127][ C0] [ 72.740127][ C0] stack backtrace: [ 72.740943][ C0] CPU: 0 PID: 8490 Comm: syz-executor.0 Not tainted syzkaller #0 [ 72.742067][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 [ 72.743613][ C0] Call trace: [ 72.744148][ C0] dump_backtrace+0x0/0x43c [ 72.744845][ C0] show_stack+0x2c/0x3c [ 72.745462][ C0] __dump_stack+0x30/0x40 [ 72.746136][ C0] dump_stack_lvl+0xf8/0x160 [ 72.746806][ C0] dump_stack+0x1c/0x5c [ 72.747449][ C0] debug_check_no_locks_freed+0x20c/0x2a0 [ 72.748228][ C0] slab_free_freelist_hook+0x88/0x1e8 [ 72.749061][ C0] kmem_cache_free+0xdc/0x3b4 [ 72.749760][ C0] __sk_destruct+0x40c/0x604 [ 72.750451][ C0] __sk_free+0x320/0x430 [ 72.751048][ C0] sk_free+0x68/0xdc [ 72.751616][ C0] mptcp_retransmit_timer+0x190/0x2b4 [ 72.752371][ C0] call_timer_fn+0x19c/0x858 [ 72.752998][ C0] __run_timers+0x46c/0x6c4 [ 72.753644][ C0] run_timer_softirq+0x7c/0x114 [ 72.754336][ C0] handle_softirqs+0x344/0xbf0 [ 72.754999][ C0] __irq_exit_rcu+0x240/0x440 [ 72.755630][ C0] irq_exit+0x14/0x88 [ 72.756200][ C0] handle_domain_irq+0x14c/0x1fc [ 72.756865][ C0] gic_handle_irq+0x78/0x1c8 [ 72.757502][ C0] call_on_irq_stack+0x30/0x48 [ 72.758137][ C0] do_interrupt_handler+0x6c/0x88 [ 72.758903][ C0] el1_interrupt+0x30/0x58 [ 72.759610][ C0] el1h_64_irq_handler+0x18/0x24 [ 72.760392][ C0] el1h_64_irq+0x78/0x7c [ 72.761025][ C0] _raw_spin_unlock_irqrestore+0xb8/0x14c [ 72.761874][ C0] __mod_timer+0x6e8/0xb44 [ 72.762599][ C0] mod_timer+0x2c/0x3c [ 72.763184][ C0] sk_reset_timer+0x30/0xfc [ 72.763885][ C0] __mptcp_push_pending+0x55c/0x664 [ 72.764699][ C0] mptcp_sendmsg+0x14dc/0x19ec [ 72.765379][ C0] inet_sendmsg+0x154/0x284 [ 72.766026][ C0] ____sys_sendmsg+0x61c/0x920 [ 72.766699][ C0] ___sys_sendmsg+0x1d0/0x240 [ 72.767429][ C0] __arm64_sys_sendmsg+0x1a8/0x254 [ 72.768210][ C0] invoke_syscall+0x98/0x2b8 [ 72.768938][ C0] el0_svc_common+0x138/0x258 [ 72.769651][ C0] do_el0_svc+0x58/0x14c [ 72.770302][ C0] el0_svc+0x78/0x1e0 [ 72.770936][ C0] el0t_64_sync_handler+0xcc/0xe4 [ 72.771675][ C0] el0t_64_sync+0x1a0/0x1a4 [ 72.774791][ T8490] ------------[ cut here ]------------ [ 72.775599][ T8490] refcount_t: addition on 0; use-after-free. [ 72.776611][ T8490] WARNING: CPU: 0 PID: 8490 at lib/refcount.c:25 refcount_warn_saturate+0x134/0x1f8 [ 72.777974][ T8490] Modules linked in: [ 72.778537][ T8490] CPU: 0 PID: 8490 Comm: syz-executor.0 Not tainted syzkaller #0 [ 72.779614][ T8490] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 [ 72.781083][ T8490] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 72.782190][ T8490] pc : refcount_warn_saturate+0x134/0x1f8 [ 72.783020][ T8490] lr : refcount_warn_saturate+0x134/0x1f8 [ 72.783821][ T8490] sp : ffff8000214474b0 [ 72.784366][ T8490] x29: ffff8000214474b0 x28: 00000000000000d0 x27: 0000000000000000 [ 72.785501][ T8490] x26: ffff0000cde68170 x25: dfff800000000000 x24: ffff0000cde68180 [ 72.786706][ T8490] x23: ffff0000c15613f8 x22: 0000000000000000 x21: ffff0000c1561230 [ 72.787984][ T8490] x20: ffff0000c1560c00 x19: ffff8000165c5000 x18: 0000000000000001 [ 72.789193][ T8490] x17: 0000000000000000 x16: ffff8000111c8944 x15: 00000000ffffffff [ 72.790345][ T8490] x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 [ 72.791558][ T8490] x11: 0000000000000000 x10: 0000000000000000 x9 : 757b40b483071500 [ 72.792755][ T8490] x8 : 757b40b483071500 x7 : 0000000000000001 x6 : 0000000000000001 [ 72.794005][ T8490] x5 : ffff800021446d98 x4 : ffff80001425f420 x3 : ffff80000850471c [ 72.795295][ T8490] x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000002a [ 72.796564][ T8490] Call trace: [ 72.797033][ T8490] refcount_warn_saturate+0x134/0x1f8 [ 72.797875][ T8490] sk_reset_timer+0xcc/0xfc [ 72.798598][ T8490] __mptcp_push_pending+0x55c/0x664 [ 72.799376][ T8490] mptcp_sendmsg+0x14dc/0x19ec [ 72.800100][ T8490] inet_sendmsg+0x154/0x284 [ 72.800728][ T8490] ____sys_sendmsg+0x61c/0x920 [ 72.801420][ T8490] ___sys_sendmsg+0x1d0/0x240 [ 72.802137][ T8490] __arm64_sys_sendmsg+0x1a8/0x254 [ 72.802850][ T8490] invoke_syscall+0x98/0x2b8 [ 72.803474][ T8490] el0_svc_common+0x138/0x258 [ 72.804167][ T8490] do_el0_svc+0x58/0x14c [ 72.804765][ T8490] el0_svc+0x78/0x1e0 [ 72.805318][ T8490] el0t_64_sync_handler+0xcc/0xe4 [ 72.806021][ T8490] el0t_64_sync+0x1a0/0x1a4 [ 72.806646][ T8490] irq event stamp: 1568 [ 72.807224][ T8490] hardirqs last enabled at (1568): [] kasan_quarantine_put+0xc4/0x204 [ 72.808570][ T8490] hardirqs last disabled at (1567): [] kasan_quarantine_put+0x108/0x204 [ 72.809896][ T8490] softirqs last enabled at (1532): [] mptcp_sendmsg+0xccc/0x19ec [ 72.811137][ T8490] softirqs last disabled at (1537): [] __irq_exit_rcu+0x240/0x440 [ 72.812480][ T8490] ---[ end trace 074ea26b3b453de9 ]--- [ 72.815384][ T8489] ------------[ cut here ]------------ [ 72.816210][ T8489] refcount_t: saturated; leaking memory. [ 72.817210][ T8489] WARNING: CPU: 0 PID: 8489 at lib/refcount.c:22 refcount_warn_saturate+0x1b4/0x1f8 [ 72.818518][ T8489] Modules linked in: [ 72.819087][ T8489] CPU: 0 PID: 8489 Comm: syz-executor.0 Tainted: G W syzkaller #0 [ 72.820376][ T8489] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 [ 72.821803][ T8489] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 72.822890][ T8489] pc : refcount_warn_saturate+0x1b4/0x1f8 [ 72.823718][ T8489] lr : refcount_warn_saturate+0x1b4/0x1f8 [ 72.824526][ T8489] sp : ffff800020fd79a0 [ 72.825113][ T8489] x29: ffff800020fd79a0 x28: ffff0000dd1eea48 x27: 1fffe00019b30c05 [ 72.826272][ T8489] x26: ffff0000c1560b80 x25: ffff8000140ff000 x24: 1ffff0000281fe30 [ 72.827432][ T8489] x23: ffff0000c1561548 x22: 00000000c0000000 x21: ffff0000c1560c00 [ 72.828650][ T8489] x20: ffff0000c1560c00 x19: ffff8000165c5000 x18: 0000000000000001 [ 72.829956][ T8489] x17: 0000000000000000 x16: ffff8000111c8944 x15: 00000000ffffffff [ 72.831243][ T8489] x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 [ 72.832426][ T8489] x11: 0000000000000000 x10: 0000000000000000 x9 : d66396acf052cc00 [ 72.833719][ T8489] x8 : d66396acf052cc00 x7 : 0000000000000001 x6 : 0000000000000001 [ 72.834878][ T8489] x5 : ffff800020fd7298 x4 : ffff80001425f420 x3 : ffff80000850471c [ 72.836043][ T8489] x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000026 [ 72.837069][ T8489] Call trace: [ 72.837563][ T8489] refcount_warn_saturate+0x1b4/0x1f8 [ 72.838398][ T8489] mptcp_close+0x738/0xa04 [ 72.839048][ T8489] inet_release+0x120/0x16c [ 72.839690][ T8489] sock_close+0xb4/0x1f8 [ 72.840271][ T8489] __fput+0x1c0/0x7f8 [ 72.840876][ T8489] ____fput+0x20/0x30 [ 72.841454][ T8489] task_work_run+0x12c/0x1e0 [ 72.842111][ T8489] do_notify_resume+0x24b4/0x3128 [ 72.842823][ T8489] el0_svc+0xf0/0x1e0 [ 72.843415][ T8489] el0t_64_sync_handler+0xcc/0xe4 [ 72.844175][ T8489] el0t_64_sync+0x1a0/0x1a4 [ 72.844769][ T8489] irq event stamp: 1480 [ 72.845355][ T8489] hardirqs last enabled at (1479): [] _raw_spin_unlock_irqrestore+0xa8/0x14c [ 72.846811][ T8489] hardirqs last disabled at (1480): [] __schedule+0x2ec/0x1bf8 [ 72.848041][ T8489] softirqs last enabled at (1462): [] local_bh_enable+0x10/0x34 [ 72.849362][ T8489] softirqs last disabled at (1460): [] local_bh_disable+0x10/0x34 [ 72.850814][ T8489] ---[ end trace 074ea26b3b453dea ]--- [ 72.851733][ T8489] ------------[ cut here ]------------ [ 72.852523][ T8489] ODEBUG: assert_init not available (active state 0) object type: timer_list hint: mptcp_retransmit_timer+0x0/0x2b4 [ 72.854403][ T8489] WARNING: CPU: 0 PID: 8489 at lib/debugobjects.c:521 debug_print_object+0x148/0x1d4 [ 72.855741][ T8489] Modules linked in: [ 72.856261][ T8489] CPU: 0 PID: 8489 Comm: syz-executor.0 Tainted: G W syzkaller #0 [ 72.857598][ T8489] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 [ 72.859001][ T8489] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 72.860055][ T8489] pc : debug_print_object+0x148/0x1d4 [ 72.860942][ T8489] lr : debug_print_object+0x148/0x1d4 [ 72.861674][ T8489] sp : ffff800020fd7790 [ 72.862269][ T8489] x29: ffff800020fd7790 x28: dfff800000000000 x27: 0000000000000000 [ 72.863289][ T8489] x26: ffff800014180000 x25: ffff80000837e348 x24: dfff800000000000 [ 72.864363][ T8489] x23: 0000000000000000 x22: ffff8000110b86b0 x21: ffff8000117d99e0 [ 72.865474][ T8489] x20: ffff800011342cc0 x19: ffff8000117d9520 x18: 0000000000000001 [ 72.866712][ T8489] x17: 0000000000000000 x16: ffff8000111c8944 x15: 00000000ffffffff [ 72.867983][ T8489] x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 [ 72.869264][ T8489] x11: 0000000000000000 x10: 0000000000000000 x9 : d66396acf052cc00 [ 72.870492][ T8489] x8 : d66396acf052cc00 x7 : 0000000000000001 x6 : 0000000000000001 [ 72.871737][ T8489] x5 : ffff800020fd7078 x4 : ffff80001425f420 x3 : ffff80000a7281cc [ 72.872986][ T8489] x2 : ffff0001a10b3d50 x1 : 0000000100000000 x0 : 0000000000000071 [ 72.874243][ T8489] Call trace: [ 72.874789][ T8489] debug_print_object+0x148/0x1d4 [ 72.875582][ T8489] debug_object_assert_init+0x24c/0x2c4 [ 72.876426][ T8489] del_timer+0x48/0x1e4 [ 72.877008][ T8489] sk_stop_timer+0x24/0xd4 [ 72.877644][ T8489] __mptcp_destroy_sock+0x284/0x610 [ 72.878366][ T8489] mptcp_close+0x5b8/0xa04 [ 72.878951][ T8489] inet_release+0x120/0x16c [ 72.879572][ T8489] sock_close+0xb4/0x1f8 [ 72.880204][ T8489] __fput+0x1c0/0x7f8 [ 72.880799][ T8489] ____fput+0x20/0x30 [ 72.881385][ T8489] task_work_run+0x12c/0x1e0 [ 72.882080][ T8489] do_notify_resume+0x24b4/0x3128 [ 72.882900][ T8489] el0_svc+0xf0/0x1e0 [ 72.883519][ T8489] el0t_64_sync_handler+0xcc/0xe4 [ 72.884286][ T8489] el0t_64_sync+0x1a0/0x1a4 [ 72.884993][ T8489] irq event stamp: 1480 [ 72.885640][ T8489] hardirqs last enabled at (1479): [] _raw_spin_unlock_irqrestore+0xa8/0x14c [ 72.887346][ T8489] hardirqs last disabled at (1480): [] __schedule+0x2ec/0x1bf8 [ 72.888844][ T8489] softirqs last enabled at (1462): [] local_bh_enable+0x10/0x34 [ 72.890179][ T8489] softirqs last disabled at (1460): [] local_bh_disable+0x10/0x34 [ 72.891724][ T8489] ---[ end trace 074ea26b3b453deb ]--- [ 72.892667][ T8489] ------------[ cut here ]------------ [ 72.893545][ T8489] ODEBUG: assert_init not available (active state 0) object type: timer_list hint: mptcp_tout_timer+0x0/0xe8 [ 72.895521][ T8489] WARNING: CPU: 0 PID: 8489 at lib/debugobjects.c:521 debug_print_object+0x148/0x1d4 [ 72.896893][ T8489] Modules linked in: [ 72.897434][ T8489] CPU: 0 PID: 8489 Comm: syz-executor.0 Tainted: G W syzkaller #0 [ 72.899055][ T8489] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 [ 72.900598][ T8489] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 72.901774][ T8489] pc : debug_print_object+0x148/0x1d4 [ 72.902558][ T8489] lr : debug_print_object+0x148/0x1d4 [ 72.903312][ T8489] sp : ffff800020fd7790 [ 72.903967][ T8489] x29: ffff800020fd7790 x28: dfff800000000000 x27: 0000000000000000 [ 72.905149][ T8489] x26: ffff800014180000 x25: ffff80000837e348 x24: dfff800000000000 [ 72.906251][ T8489] x23: 0000000000000000 x22: ffff8000110b8964 x21: ffff8000117d99e0 [ 72.907596][ T8489] x20: ffff800011342cc0 x19: ffff8000117d9520 x18: 0000000000000001 [ 72.908882][ T8489] x17: 0000000000000000 x16: ffff8000111c8944 x15: 00000000ffffffff [ 72.910088][ T8489] x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 [ 72.911296][ T8489] x11: 0000000000000000 x10: 0000000000000000 x9 : d66396acf052cc00 [ 72.912519][ T8489] x8 : d66396acf052cc00 x7 : 0000000000000001 x6 : 0000000000000001 [ 72.913781][ T8489] x5 : ffff800020fd7078 x4 : ffff80001425f420 x3 : ffff80000a7281cc [ 72.915066][ T8489] x2 : ffff0001a10b3d50 x1 : 0000000100000000 x0 : 000000000000006a [ 72.916244][ T8489] Call trace: [ 72.916707][ T8489] debug_print_object+0x148/0x1d4 [ 72.917450][ T8489] debug_object_assert_init+0x24c/0x2c4 [ 72.918293][ T8489] del_timer+0x48/0x1e4 [ 72.918919][ T8489] sk_stop_timer+0x24/0xd4 [ 72.919591][ T8489] __mptcp_destroy_sock+0x290/0x610 [ 72.920382][ T8489] mptcp_close+0x5b8/0xa04 [ 72.921107][ T8489] inet_release+0x120/0x16c [ 72.921842][ T8489] sock_close+0xb4/0x1f8 [ 72.922488][ T8489] __fput+0x1c0/0x7f8 [ 72.923047][ T8489] ____fput+0x20/0x30 [ 72.923644][ T8489] task_work_run+0x12c/0x1e0 [ 72.924279][ T8489] do_notify_resume+0x24b4/0x3128 [ 72.924997][ T8489] el0_svc+0xf0/0x1e0 [ 72.925523][ T8489] el0t_64_sync_handler+0xcc/0xe4 [ 72.926227][ T8489] el0t_64_sync+0x1a0/0x1a4 [ 72.926844][ T8489] irq event stamp: 1480 [ 72.927416][ T8489] hardirqs last enabled at (1479): [] _raw_spin_unlock_irqrestore+0xa8/0x14c [ 72.928918][ T8489] hardirqs last disabled at (1480): [] __schedule+0x2ec/0x1bf8 [ 72.930181][ T8489] softirqs last enabled at (1462): [] local_bh_enable+0x10/0x34 [ 72.931556][ T8489] softirqs last disabled at (1460): [] local_bh_disable+0x10/0x34 [ 72.932972][ T8489] ---[ end trace 074ea26b3b453dec ]--- [ 72.933879][ T8489] ------------[ cut here ]------------ [ 72.934719][ T8489] refcount_t: underflow; use-after-free. [ 72.935652][ T8489] WARNING: CPU: 0 PID: 8489 at lib/refcount.c:28 refcount_warn_saturate+0x154/0x1f8 [ 72.936984][ T8489] Modules linked in: [ 72.937529][ T8489] CPU: 0 PID: 8489 Comm: syz-executor.0 Tainted: G W syzkaller #0 [ 72.938793][ T8489] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 [ 72.940262][ T8489] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 72.941357][ T8489] pc : refcount_warn_saturate+0x154/0x1f8 [ 72.942159][ T8489] lr : refcount_warn_saturate+0x154/0x1f8 [ 72.942888][ T8489] sp : ffff800020fd78c0 [ 72.943532][ T8489] x29: ffff800020fd78c0 x28: dfff800000000000 x27: 1ffff000041faf20 [ 72.944723][ T8489] x26: ffff0000c1560b80 x25: 1fffe000182ac2a9 x24: ffff0000c1561548 [ 72.945942][ T8489] x23: ffff0000c1561570 x22: 0000000000000000 x21: 00000000c0000000 [ 72.947189][ T8489] x20: ffff0000c1560c00 x19: ffff8000165c5000 x18: 0000000000000001 [ 72.948319][ T8489] x17: 0000000000000000 x16: ffff8000111c8944 x15: 00000000ffffffff [ 72.949455][ T8489] x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 [ 72.950591][ T8489] x11: 0000000000000000 x10: 0000000000000000 x9 : d66396acf052cc00 [ 72.951862][ T8489] x8 : d66396acf052cc00 x7 : 0000000000000001 x6 : 0000000000000001 [ 72.953093][ T8489] x5 : ffff800020fd71b8 x4 : ffff80001425f420 x3 : ffff80000a7281cc [ 72.954336][ T8489] x2 : ffff0001a10b3d50 x1 : 0000000100000000 x0 : 0000000000000026 [ 72.955491][ T8489] Call trace: [ 72.955966][ T8489] refcount_warn_saturate+0x154/0x1f8 [ 72.956727][ T8489] __mptcp_destroy_sock+0x564/0x610 [ 72.957448][ T8489] mptcp_close+0x5b8/0xa04 [ 72.958115][ T8489] inet_release+0x120/0x16c [ 72.958763][ T8489] sock_close+0xb4/0x1f8 [ 72.959410][ T8489] __fput+0x1c0/0x7f8 [ 72.960022][ T8489] ____fput+0x20/0x30 [ 72.960637][ T8489] task_work_run+0x12c/0x1e0 [ 72.961268][ T8489] do_notify_resume+0x24b4/0x3128 [ 72.961988][ T8489] el0_svc+0xf0/0x1e0 [ 72.962532][ T8489] el0t_64_sync_handler+0xcc/0xe4 [ 72.963229][ T8489] el0t_64_sync+0x1a0/0x1a4 [ 72.963953][ T8489] irq event stamp: 1480 [ 72.964576][ T8489] hardirqs last enabled at (1479): [] _raw_spin_unlock_irqrestore+0xa8/0x14c [ 72.966039][ T8489] hardirqs last disabled at (1480): [] __schedule+0x2ec/0x1bf8 [ 72.967315][ T8489] softirqs last enabled at (1462): [] local_bh_enable+0x10/0x34 [ 72.968583][ T8489] softirqs last disabled at (1460): [] local_bh_disable+0x10/0x34 [ 72.969878][ T8489] ---[ end trace 074ea26b3b453ded ]--- 1970/01/01 00:01:13 executed programs: 1988 1970/01/01 00:01:18 executed programs: 2556