Warning: Permanently added '10.128.1.28' (ED25519) to the list of known hosts. 2026/09/19 21:21:10 parsed 1 programs 2026/09/19 21:21:10 serving rpc on tcp://34139 Setting up swapspace version 1, size = 127995904 bytes [ 36.432229][ T30] kauditd_printk_skb: 31 callbacks suppressed [ 36.432242][ T30] audit: type=1400 audit(1789852871.128:105): avc: denied { unlink } for pid=412 comm="syz-executor" name="swap-file" dev="sda1" ino=2027 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 36.472358][ T412] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 37.114816][ T30] audit: type=1401 audit(1789852871.808:106): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 37.182252][ T30] audit: type=1400 audit(1789852871.878:107): avc: denied { create } for pid=441 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 37.249001][ T434] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.257812][ T434] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.290942][ T434] device bridge_slave_0 entered promiscuous mode [ 37.320586][ T434] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.328556][ T434] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.337352][ T434] device bridge_slave_1 entered promiscuous mode [ 37.530064][ T434] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.538098][ T434] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.545432][ T434] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.552657][ T434] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.584726][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 37.593001][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.601085][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.630067][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 37.640238][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 37.650373][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.658127][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.665752][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 37.674464][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.682511][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.690659][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 37.700229][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 37.711369][ T434] device veth0_vlan entered promiscuous mode [ 37.719331][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 37.728052][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 37.736931][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 37.747610][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 37.758546][ T434] device veth1_macvtap entered promiscuous mode [ 37.768369][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready 2026/09/19 21:21:12 executed programs: 0 [ 37.780591][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 37.917142][ T478] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.924763][ T478] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.933451][ T478] device bridge_slave_0 entered promiscuous mode [ 37.941928][ T478] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.949888][ T478] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.957575][ T478] device bridge_slave_1 entered promiscuous mode [ 38.067967][ T481] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.075617][ T481] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.085124][ T481] device bridge_slave_0 entered promiscuous mode [ 38.093922][ T481] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.102686][ T481] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.110833][ T481] device bridge_slave_1 entered promiscuous mode [ 38.165468][ T486] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.173813][ T486] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.181597][ T486] device bridge_slave_0 entered promiscuous mode [ 38.193021][ T486] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.200816][ T486] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.208390][ T486] device bridge_slave_1 entered promiscuous mode [ 38.227824][ T488] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.235593][ T488] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.244187][ T488] device bridge_slave_0 entered promiscuous mode [ 38.252619][ T488] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.260103][ T488] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.268030][ T488] device bridge_slave_1 entered promiscuous mode [ 38.349265][ T489] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.357415][ T489] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.365438][ T489] device bridge_slave_0 entered promiscuous mode [ 38.376895][ T489] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.384520][ T489] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.392748][ T489] device bridge_slave_1 entered promiscuous mode [ 38.495987][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 38.504923][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 38.521543][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 38.530942][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 38.540331][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.547980][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.555738][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 38.564245][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 38.573067][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.580522][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.595036][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 38.626107][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 38.634780][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 38.673463][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 38.681618][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 38.690206][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 38.699226][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 38.707817][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 38.733206][ T478] device veth0_vlan entered promiscuous mode [ 38.740955][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 38.750086][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 38.759085][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.766578][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.774919][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 38.784895][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.792971][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.800681][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 38.809304][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.817426][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.826634][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 38.835855][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.843577][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.852701][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 38.860862][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 38.869840][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 38.877820][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 38.886963][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 38.894646][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 38.919566][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 38.942486][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 38.950617][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 38.959754][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 38.968091][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 38.977521][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.985246][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.993369][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 39.003186][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.010883][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.018650][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 39.054124][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 39.062770][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 39.072467][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 39.082454][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 39.091532][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 39.101667][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.110039][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.118401][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 39.128497][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.137315][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.146620][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 39.164266][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 39.173076][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 39.181873][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 39.190742][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 39.199885][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 39.208885][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 39.218638][ T478] device veth1_macvtap entered promiscuous mode [ 39.226629][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 39.236899][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 39.246238][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 39.264292][ T489] device veth0_vlan entered promiscuous mode [ 39.275615][ T486] device veth0_vlan entered promiscuous mode [ 39.283105][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 39.292592][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 39.301665][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 39.310606][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 39.319540][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 39.327669][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 39.337255][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 39.345465][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 39.355098][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 39.363633][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 39.371789][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 39.379934][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 39.394405][ T489] device veth1_macvtap entered promiscuous mode [ 39.406341][ T488] device veth0_vlan entered promiscuous mode [ 39.423937][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 39.433552][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 39.443127][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 39.452215][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 39.461068][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 39.470071][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 39.479231][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 39.489386][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 39.498644][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 39.508421][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 39.517063][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 39.526463][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 39.535820][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 39.545398][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 39.553818][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 39.563573][ T486] device veth1_macvtap entered promiscuous mode [ 39.585217][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 39.593716][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 39.603422][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 39.612563][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 39.622934][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 39.641703][ T481] device veth0_vlan entered promiscuous mode [ 39.649393][ T30] audit: type=1400 audit(1789852874.338:108): avc: denied { mount } for pid=504 comm="syz.6.17" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 39.652575][ T488] device veth1_macvtap entered promiscuous mode [ 39.684978][ T30] audit: type=1400 audit(1789852874.338:109): avc: denied { mount } for pid=504 comm="syz.6.17" name="/" dev="configfs" ino=13729 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 39.713166][ T30] audit: type=1400 audit(1789852874.338:110): avc: denied { search } for pid=504 comm="syz.6.17" name="/" dev="configfs" ino=13729 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 39.739373][ T30] audit: type=1400 audit(1789852874.338:111): avc: denied { write } for pid=504 comm="syz.6.17" name="usb_gadget" dev="configfs" ino=13730 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 39.765548][ T30] audit: type=1400 audit(1789852874.348:112): avc: denied { add_name } for pid=504 comm="syz.6.17" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 39.767992][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 39.787406][ T30] audit: type=1400 audit(1789852874.348:113): avc: denied { create } for pid=504 comm="syz.6.17" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 39.797790][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 39.817812][ T30] audit: type=1400 audit(1789852874.378:114): avc: denied { read write } for pid=504 comm="syz.6.17" name="ttyGS0" dev="devtmpfs" ino=558 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 39.828664][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 39.860404][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 39.861999][ T504] ================================================================== [ 39.870686][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 39.877150][ T504] BUG: KASAN: use-after-free in check_tty_count+0x1a8/0x330 [ 39.885438][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 39.892473][ T504] Read of size 8 at addr ffff88811c566910 by task syz.6.17/504 [ 39.892492][ T504] [ 39.892507][ T504] CPU: 0 PID: 504 Comm: syz.6.17 Not tainted syzkaller #0 [ 39.892522][ T504] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 39.892538][ T504] Call Trace: [ 39.901229][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 39.908259][ T504] [ 39.908269][ T504] __dump_stack+0x21/0x30 [ 39.908292][ T504] dump_stack_lvl+0x110/0x170 [ 39.911580][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 39.918518][ T504] ? show_regs_print_info+0x20/0x20 [ 39.918545][ T504] ? load_image+0x3f0/0x3f0 [ 39.930066][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 39.932613][ T504] ? locks_remove_file+0x371/0xff0 [ 39.932641][ T504] print_address_description+0x7f/0x2c0 [ 39.941619][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 39.944004][ T504] ? check_tty_count+0x1a8/0x330 [ 39.944027][ T504] kasan_report+0x10f/0x150 [ 39.950631][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 39.953279][ T504] ? __kasan_check_write+0x14/0x20 [ 39.953306][ T504] ? check_tty_count+0x1a8/0x330 [ 40.028970][ T504] kasan_check_range+0x249/0x2a0 [ 40.035033][ T504] __kasan_check_read+0x11/0x20 [ 40.041079][ T504] check_tty_count+0x1a8/0x330 [ 40.046841][ T504] tty_release+0xc9/0x1330 [ 40.051536][ T504] ? _raw_spin_trylock_bh+0x150/0x150 [ 40.057775][ T504] ? task_work_add+0x1b2/0x1e0 [ 40.062997][ T504] ? tty_release_struct+0xe0/0xe0 [ 40.068730][ T504] __fput+0x22b/0x900 [ 40.072957][ T504] ____fput+0x15/0x20 [ 40.077636][ T504] task_work_run+0x127/0x190 [ 40.082582][ T504] exit_to_user_mode_loop+0xd0/0xe0 [ 40.088247][ T504] exit_to_user_mode_prepare+0x87/0xd0 [ 40.094772][ T504] syscall_exit_to_user_mode+0x1a/0x30 [ 40.101589][ T504] do_syscall_64+0x58/0xa0 [ 40.108059][ T504] ? clear_bhb_loop+0x50/0xa0 [ 40.113517][ T504] ? clear_bhb_loop+0x50/0xa0 [ 40.119588][ T504] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 40.126349][ T504] RIP: 0033:0x7fb9bae3e0d9 [ 40.132140][ T504] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 40.154797][ T504] RSP: 002b:00007ffd06c400b8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 40.165869][ T504] RAX: 0000000000000000 RBX: 00007fb9bb0c7da0 RCX: 00007fb9bae3e0d9 [ 40.174068][ T504] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 40.182468][ T504] RBP: 00007fb9bb0c7da0 R08: 00007fb9bb0c6038 R09: 0000000000000000 [ 40.190538][ T504] R10: 000000000003fda0 R11: 0000000000000246 R12: 0000000000009e02 [ 40.199255][ T504] R13: 00007fb9bb0c5fac R14: 0000000000009b20 R15: 00007ffd06c401c0 [ 40.208167][ T504] [ 40.211551][ T504] [ 40.213948][ T504] Allocated by task 505: [ 40.218254][ T504] __kasan_kmalloc+0xd4/0x100 [ 40.223100][ T504] kmem_cache_alloc_trace+0x119/0x270 [ 40.228829][ T504] gserial_alloc_line_no_console+0x238/0x700 [ 40.235909][ T504] gserial_alloc_line+0x15/0x20 [ 40.241585][ T504] acm_alloc_instance+0x86/0xe0 [ 40.247434][ T504] usb_get_function_instance+0xe2/0x2f0 [ 40.255016][ T504] function_make+0x118/0x350 [ 40.260743][ T504] configfs_mkdir+0x50a/0x9c0 [ 40.268216][ T504] vfs_mkdir+0x38b/0x590 [ 40.274333][ T504] do_mkdirat+0x174/0x4d0 [ 40.279325][ T504] __x64_sys_mkdirat+0x89/0xa0 [ 40.285415][ T504] x64_sys_call+0x37e/0x9a0 [ 40.290161][ T504] do_syscall_64+0x4c/0xa0 [ 40.294975][ T504] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 40.301576][ T504] [ 40.304330][ T504] Freed by task 505: [ 40.308801][ T504] kasan_set_track+0x4a/0x70 [ 40.313964][ T504] kasan_set_free_info+0x23/0x40 [ 40.321104][ T504] ____kasan_slab_free+0x125/0x160 [ 40.326865][ T504] __kasan_slab_free+0x11/0x20 [ 40.333337][ T504] slab_free_freelist_hook+0xc2/0x190 [ 40.339576][ T504] kfree+0xc4/0x270 [ 40.343912][ T504] gserial_free_port+0x245/0x2e0 [ 40.349562][ T504] gserial_free_line+0x9b/0x1a0 [ 40.354959][ T504] acm_free_instance+0x39/0x60 [ 40.359908][ T504] usb_put_function_instance+0x85/0xa0 [ 40.366217][ T504] acm_attr_release+0x15/0x20 [ 40.371282][ T504] config_item_put+0x158/0x210 [ 40.376232][ T504] configfs_rmdir+0x89f/0x960 [ 40.380990][ T504] vfs_rmdir+0x1ae/0x450 [ 40.385740][ T504] do_rmdir+0x261/0x6b0 [ 40.389971][ T504] __x64_sys_rmdir+0x49/0x50 [ 40.395008][ T504] x64_sys_call+0x25f/0x9a0 [ 40.400051][ T504] do_syscall_64+0x4c/0xa0 [ 40.405262][ T504] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 40.411573][ T504] [ 40.413967][ T504] The buggy address belongs to the object at ffff88811c566800 [ 40.413967][ T504] which belongs to the cache kmalloc-1k of size 1024 [ 40.428672][ T504] The buggy address is located 272 bytes inside of [ 40.428672][ T504] 1024-byte region [ffff88811c566800, ffff88811c566c00) [ 40.442565][ T504] The buggy address belongs to the page: [ 40.448424][ T504] page:ffffea0004715800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11c560 [ 40.459201][ T504] head:ffffea0004715800 order:3 compound_mapcount:0 compound_pincount:0 [ 40.468488][ T504] flags: 0x4000000000010200(slab|head|zone=1) [ 40.474916][ T504] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100043080 [ 40.483899][ T504] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 40.493251][ T504] page dumped because: kasan: bad access detected [ 40.500876][ T504] page_owner tracks the page as allocated [ 40.506806][ T504] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 488, ts 39650499761, free_ts 39622174485 [ 40.527379][ T504] post_alloc_hook+0x192/0x1b0 [ 40.532674][ T504] prep_new_page+0x1c/0x110 [ 40.537262][ T504] get_page_from_freelist+0x2c3a/0x2cd0 [ 40.543605][ T504] __alloc_pages+0x1a2/0x460 [ 40.548827][ T504] new_slab+0xa0/0x4d0 [ 40.553500][ T504] ___slab_alloc+0x3ac/0x840 [ 40.558365][ T504] __slab_alloc+0x49/0x90 [ 40.563062][ T504] __kmalloc_track_caller+0x169/0x2c0 [ 40.568961][ T504] __alloc_skb+0x210/0x730 [ 40.574306][ T504] inet6_rt_notify+0x293/0x480 [ 40.579246][ T504] fib6_add+0x223f/0x3d70 [ 40.584181][ T504] ip6_route_add+0x89/0x130 [ 40.590220][ T504] addrconf_permanent_addr+0x635/0x940 [ 40.596886][ T504] addrconf_notify+0x752/0xe00 [ 40.601785][ T504] raw_notifier_call_chain+0x90/0x100 [ 40.607234][ T504] __dev_notify_flags+0x2f4/0x5b0 [ 40.612244][ T504] page last free stack trace: [ 40.617202][ T504] free_unref_page_prepare+0x5fa/0x600 [ 40.623180][ T504] free_unref_page+0xae/0x540 [ 40.628408][ T504] __free_pages+0x6c/0x100 [ 40.633528][ T504] __free_slab+0xe5/0x1e0 [ 40.638577][ T504] __unfreeze_partials+0x15a/0x190 [ 40.644034][ T504] put_cpu_partial+0xc6/0x120 [ 40.649301][ T504] __slab_free+0x1d4/0x290 [ 40.654013][ T504] ___cache_free+0x104/0x120 [ 40.658953][ T504] qlink_free+0x4d/0x90 [ 40.663276][ T504] qlist_free_all+0x5f/0xb0 [ 40.668032][ T504] kasan_quarantine_reduce+0x14a/0x170 [ 40.673918][ T504] __kasan_slab_alloc+0x2f/0xe0 [ 40.679284][ T504] slab_post_alloc_hook+0x4f/0x2b0 [ 40.685732][ T504] kmem_cache_alloc_trace+0xfb/0x270 [ 40.692151][ T504] ipv6_add_addr+0x408/0xd90 [ 40.697014][ T504] addrconf_add_linklocal+0x209/0x660 [ 40.702476][ T504] [ 40.705141][ T504] Memory state around the buggy address: [ 40.711217][ T504] ffff88811c566800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.719366][ T504] ffff88811c566880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.728297][ T504] >ffff88811c566900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.736823][ T504] ^ [ 40.741871][ T504] ffff88811c566980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.750842][ T504] ffff88811c566a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.759288][ T504] ================================================================== [ 40.767455][ T504] Disabling lock debugging due to kernel taint [ 40.829164][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 40.843966][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 40.854958][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 40.864248][ T504] ------------[ cut here ]------------ [ 40.873604][ T504] WARNING: CPU: 0 PID: 504 at drivers/usb/gadget/function/u_serial.c:686 gs_close+0x17d/0x9b0 [ 40.885865][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 40.887179][ T504] Modules linked in: [ 40.887191][ T504] CPU: 0 PID: 504 Comm: syz.6.17 Tainted: G B syzkaller #0 [ 40.887209][ T504] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 40.887218][ T504] RIP: 0010:gs_close+0x17d/0x9b0 [ 40.905387][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 40.908542][ T504] Code: 8e 3e fe 41 ff cc 42 0f b6 04 2b 84 c0 0f 85 c6 06 00 00 48 8b 44 24 20 44 89 20 48 8b 5c 24 38 e9 c2 02 00 00 e8 03 8e 3e fe <0f> 0b 48 8b 5c 24 38 e9 b1 02 00 00 e8 f2 8d 3e fe 49 8d bf 90 02 [ 40.908559][ T504] RSP: 0018:ffffc90001487be0 EFLAGS: 00010093 [ 40.908574][ T504] RAX: ffffffff832b399d RBX: 1ffff110238acd1a RCX: ffff88812ade8000 [ 40.908584][ T504] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 40.908593][ T504] RBP: ffffc90001487ce8 R08: 0000000000000003 R09: 0000000000000004 [ 40.908602][ T504] R10: dffffc0000000000 R11: fffff52000290f6c R12: 0000000000000000 [ 40.908611][ T504] R13: dffffc0000000000 R14: 1ffff92000290f84 R15: ffff88811c566800 [ 40.908624][ T504] FS: 00005555824b7500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 40.922305][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 40.926583][ T504] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 40.926605][ T504] CR2: 000056402f0f9678 CR3: 000000011b6f0000 CR4: 00000000003506b0 [ 40.926619][ T504] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 40.926627][ T504] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 41.071649][ T504] Call Trace: [ 41.075693][ T504] [ 41.078892][ T504] ? _raw_spin_trylock_bh+0x150/0x150 [ 41.084263][ T504] ? gs_open+0x410/0x410 [ 41.089061][ T504] ? _raw_spin_unlock+0x4d/0x70 [ 41.094185][ T504] ? fasync_remove_entry+0x19c/0x1d0 [ 41.099979][ T504] ? gs_open+0x410/0x410 [ 41.104542][ T504] tty_release+0x3c8/0x1330 [ 41.109314][ T504] ? _raw_spin_trylock_bh+0x150/0x150 [ 41.115485][ T504] ? tty_release_struct+0xe0/0xe0 [ 41.121045][ T504] __fput+0x22b/0x900 [ 41.125118][ T504] ____fput+0x15/0x20 [ 41.129170][ T504] task_work_run+0x127/0x190 [ 41.134542][ T504] exit_to_user_mode_loop+0xd0/0xe0 [ 41.140003][ T504] exit_to_user_mode_prepare+0x87/0xd0 [ 41.146323][ T504] syscall_exit_to_user_mode+0x1a/0x30 [ 41.152205][ T504] do_syscall_64+0x58/0xa0 [ 41.156917][ T504] ? clear_bhb_loop+0x50/0xa0 [ 41.161934][ T504] ? clear_bhb_loop+0x50/0xa0 [ 41.167313][ T504] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 41.173450][ T504] RIP: 0033:0x7fb9bae3e0d9 [ 41.178113][ T504] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 41.199035][ T504] RSP: 002b:00007ffd06c400b8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 41.208321][ T504] RAX: 0000000000000000 RBX: 00007fb9bb0c7da0 RCX: 00007fb9bae3e0d9 [ 41.217009][ T504] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 41.226178][ T504] RBP: 00007fb9bb0c7da0 R08: 00007fb9bb0c6038 R09: 0000000000000000 [ 41.234869][ T504] R10: 000000000003fda0 R11: 0000000000000246 R12: 0000000000009e02 [ 41.243871][ T504] R13: 00007fb9bb0c5fac R14: 0000000000009b20 R15: 00007ffd06c401c0 [ 41.252736][ T504] [ 41.255947][ T504] ---[ end trace 530c456b426f7478 ]--- [ 41.274968][ T481] device veth1_macvtap entered promiscuous mode [ 41.307909][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 41.315815][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 41.326284][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 41.342722][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 41.352127][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 41.739613][ T199] device bridge_slave_1 left promiscuous mode [ 41.746185][ T199] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.753988][ T199] device bridge_slave_0 left promiscuous mode [ 41.761066][ T199] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.769516][ T199] device veth1_macvtap left promiscuous mode [ 41.776204][ T199] device veth0_vlan left promiscuous mode