[ 70.619181][ T4245] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 70.668800][ T4245] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 70.749559][ T4245] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 71.347775][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.354518][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.443893][ T4245] device hsr_slave_0 left promiscuous mode [ 71.451241][ T4245] device hsr_slave_1 left promiscuous mode [ 71.459012][ T4245] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 71.467670][ T4245] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 71.475789][ T4245] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 71.483197][ T4245] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 71.492035][ T4245] device bridge_slave_1 left promiscuous mode [ 71.498625][ T4245] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.508288][ T4245] device bridge_slave_0 left promiscuous mode [ 71.515009][ T4245] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.526042][ T4245] device veth1_macvtap left promiscuous mode [ 71.532127][ T4245] device veth0_macvtap left promiscuous mode [ 71.538295][ T4245] device veth1_vlan left promiscuous mode [ 71.544471][ T4245] device veth0_vlan left promiscuous mode [ 71.653492][ T4245] team0 (unregistering): Port device team_slave_1 removed [ 71.665055][ T4245] team0 (unregistering): Port device team_slave_0 removed [ 71.676201][ T4245] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 71.690629][ T4245] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 71.737756][ T4245] bond0 (unregistering): Released all slaves Warning: Permanently added '10.128.1.104' (ED25519) to the list of known hosts. 2026/07/26 12:22:35 ignoring optional flag "type"="gce" 2026/07/26 12:22:35 parsed 1 programs [ 76.476662][ T13] cfg80211: failed to load regulatory.db [ 77.407314][ T4637] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 78.287613][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.304119][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.312953][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 78.333513][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.341953][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.350742][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 78.549268][ T4682] chnl_net:caif_netlink_parms(): no params data found [ 78.628674][ T4682] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.638045][ T4682] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.646801][ T4682] device bridge_slave_0 entered promiscuous mode [ 78.656294][ T4682] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.663433][ T4682] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.671865][ T4682] device bridge_slave_1 entered promiscuous mode [ 78.696390][ T4682] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.707965][ T4682] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.737048][ T4682] team0: Port device team_slave_0 added [ 78.746273][ T4682] team0: Port device team_slave_1 added [ 78.772155][ T4682] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.779620][ T4682] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.808504][ T4682] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.821097][ T4682] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.829402][ T4682] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.856746][ T4682] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.899302][ T4682] device hsr_slave_0 entered promiscuous mode [ 78.906294][ T4682] device hsr_slave_1 entered promiscuous mode [ 79.362753][ T4682] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 79.375354][ T4682] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 79.386552][ T4682] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 79.415496][ T4682] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 79.614949][ T4682] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.630130][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 79.640035][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 79.650709][ T4682] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.661397][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 79.672637][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 79.682609][ T154] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.689765][ T154] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.699390][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 79.715367][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 79.725262][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 79.733761][ T144] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.740901][ T144] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.758551][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 79.767985][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 79.778975][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 79.789288][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 79.799917][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 79.815421][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 79.825949][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 79.835373][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 79.843877][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 79.871991][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 79.881454][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 79.891113][ T4682] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 80.009211][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 80.016924][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 80.032219][ T4682] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.052338][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 80.062549][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 80.101071][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 80.110319][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 80.119720][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 80.128780][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 80.138976][ T4682] device veth0_vlan entered promiscuous mode [ 80.165019][ T4682] device veth1_vlan entered promiscuous mode [ 80.188428][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 80.197697][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 80.206934][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 80.216360][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 80.226976][ T4682] device veth0_macvtap entered promiscuous mode [ 80.258054][ T4682] device veth1_macvtap entered promiscuous mode [ 80.282814][ T4682] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.295700][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 80.308813][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 80.317072][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 80.327654][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 80.340198][ T4682] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.348153][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 80.357365][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 80.387385][ T4682] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.397400][ T4682] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.407124][ T4682] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.416855][ T4682] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 2026/07/26 12:22:40 executed programs: 0 [ 81.443094][ T4800] chnl_net:caif_netlink_parms(): no params data found [ 81.562206][ T4800] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.569616][ T4800] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.580399][ T4800] device bridge_slave_0 entered promiscuous mode [ 81.589654][ T4800] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.604629][ T4800] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.612711][ T4800] device bridge_slave_1 entered promiscuous mode [ 81.644812][ T4800] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.680457][ T4800] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.754795][ T4800] team0: Port device team_slave_0 added [ 81.767456][ T4800] team0: Port device team_slave_1 added [ 81.805404][ T4800] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.812383][ T4800] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.849574][ T4800] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.877318][ T4800] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.884285][ T4800] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.921396][ T4800] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.989492][ T4800] device hsr_slave_0 entered promiscuous mode [ 82.005185][ T4800] device hsr_slave_1 entered promiscuous mode [ 82.011984][ T4800] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 82.034574][ T4800] Cannot create hsr debugfs directory [ 82.212727][ T4800] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 83.265088][ T13] Bluetooth: hci0: command 0x0409 tx timeout [ 85.348334][ T4408] Bluetooth: hci0: command 0x041b tx timeout [ 85.357835][ T4800] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.410889][ T4800] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.461059][ T4800] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.560938][ T4800] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 85.577614][ T4800] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 85.586889][ T4800] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 85.595650][ T4800] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 85.644466][ T4800] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.656444][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 85.665148][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 85.677359][ T4800] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.693772][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 85.702646][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 85.711369][ T4397] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.719256][ T4397] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.728172][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 85.746064][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 85.755283][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 85.765321][ T4397] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.772684][ T4397] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.782974][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 85.801348][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 85.813070][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 85.822179][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 85.844780][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 85.852592][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 85.861492][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 85.871380][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 85.880214][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 85.898277][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 85.906925][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 85.917258][ T4800] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 85.929961][ T4245] device hsr_slave_0 left promiscuous mode [ 85.936919][ T4245] device hsr_slave_1 left promiscuous mode [ 85.943192][ T4245] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 85.951382][ T4245] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 85.959552][ T4245] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 85.967095][ T4245] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 85.976079][ T4245] device bridge_slave_1 left promiscuous mode [ 85.982378][ T4245] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.991395][ T4245] device bridge_slave_0 left promiscuous mode [ 85.997868][ T4245] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.009797][ T4245] device veth1_macvtap left promiscuous mode [ 86.015891][ T4245] device veth0_macvtap left promiscuous mode [ 86.021913][ T4245] device veth1_vlan left promiscuous mode [ 86.027711][ T4245] device veth0_vlan left promiscuous mode [ 86.146953][ T4245] team0 (unregistering): Port device team_slave_1 removed [ 86.158262][ T4245] team0 (unregistering): Port device team_slave_0 removed [ 86.172443][ T4245] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 86.186056][ T4245] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 86.231910][ T4245] bond0 (unregistering): Released all slaves [ 86.352586][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 86.360190][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 86.372743][ T4800] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.390834][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 86.401320][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 86.421500][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 86.430359][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 86.439661][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 86.447904][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 86.458572][ T4800] device veth0_vlan entered promiscuous mode [ 86.472982][ T4800] device veth1_vlan entered promiscuous mode [ 86.491260][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 86.499883][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 86.508227][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 86.517518][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 86.528255][ T4800] device veth0_macvtap entered promiscuous mode [ 86.538666][ T4800] device veth1_macvtap entered promiscuous mode [ 86.552656][ T4800] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 86.560827][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 86.569507][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 86.577681][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 86.586641][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 86.597854][ T4800] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.605951][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 86.615018][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 86.632243][ T4800] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.641854][ T4800] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.651341][ T4800] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.660380][ T4800] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.719779][ T4397] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.730630][ T4397] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.740185][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 86.762900][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.772038][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.780904][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 86.828526][ T4964] loop0: detected capacity change from 0 to 1024 [ 86.945807][ T4964] EXT4-fs (loop0): Ignoring removed orlov option [ 86.965430][ T4964] EXT4-fs (loop0): Ignoring removed nomblk_io_submit option [ 87.002176][ T4964] EXT4-fs (loop0): mounted filesystem without journal. Opts: noblock_validity,bsddf,sysvgroups,norecovery,debug_want_extra_isize=0x0000000000000080,orlov,errors=continue,noauto_da_alloc,nomblk_io_submit,,errors=continue. Quota mode: none. 2026/07/26 12:22:46 executed programs: 1 [ 87.080399][ T4800] ================================================================== [ 87.088729][ T4800] BUG: KASAN: use-after-free in ext4_xattr_delete_inode+0xc9a/0xca0 [ 87.096764][ T4800] Read of size 4 at addr ffff888073fba000 by task syz-executor/4800 [ 87.104756][ T4800] [ 87.107115][ T4800] CPU: 0 PID: 4800 Comm: syz-executor Not tainted syzkaller #0 [ 87.114771][ T4800] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 87.124846][ T4800] Call Trace: [ 87.128134][ T4800] [ 87.131082][ T4800] dump_stack_lvl+0x188/0x250 [ 87.135840][ T4800] ? show_regs_print_info+0x20/0x20 [ 87.141070][ T4800] ? load_image+0x410/0x410 [ 87.145597][ T4800] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 87.151279][ T4800] ? errseq_check+0x3c/0x70 [ 87.155906][ T4800] ? __ext4_journal_get_write_access+0x2ea/0x6e0 [ 87.162247][ T4800] print_address_description+0x60/0x2d0 [ 87.167916][ T4800] ? ext4_xattr_delete_inode+0xc9a/0xca0 [ 87.173556][ T4800] kasan_report+0xdf/0x130 [ 87.177979][ T4800] ? ext4_xattr_delete_inode+0xc9a/0xca0 [ 87.183628][ T4800] ext4_xattr_delete_inode+0xc9a/0xca0 [ 87.189103][ T4800] ? ext4_expand_extra_isize_ea+0x18e0/0x18e0 [ 87.195184][ T4800] ? __ext4_mark_inode_dirty+0x4b4/0x6c0 [ 87.200829][ T4800] ext4_evict_inode+0xc0c/0x1050 [ 87.205775][ T4800] ? ext4_inode_is_fast_symlink+0x390/0x390 [ 87.211810][ T4800] ? do_raw_spin_unlock+0x11d/0x230 [ 87.217035][ T4800] ? ext4_inode_is_fast_symlink+0x390/0x390 [ 87.222940][ T4800] evict+0x4b6/0x8b0 [ 87.227020][ T4800] ? __rwlock_init+0x140/0x140 [ 87.231889][ T4800] ? proc_nr_inodes+0x320/0x320 [ 87.236744][ T4800] ? do_raw_spin_unlock+0x11d/0x230 [ 87.241952][ T4800] ? _raw_spin_unlock+0x24/0x40 [ 87.246810][ T4800] ? iput+0x6ea/0x880 [ 87.251456][ T4800] vfs_rmdir+0x392/0x410 [ 87.255735][ T4800] do_rmdir+0x27f/0x710 [ 87.259895][ T4800] ? d_delete_notify+0x150/0x150 [ 87.264846][ T4800] ? getname_flags+0x1f9/0x4f0 [ 87.269615][ T4800] __x64_sys_unlinkat+0xc0/0xe0 [ 87.274472][ T4800] do_syscall_64+0x4c/0xa0 [ 87.279062][ T4800] ? clear_bhb_loop+0x30/0x80 [ 87.283732][ T4800] ? clear_bhb_loop+0x30/0x80 [ 87.288408][ T4800] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 87.294403][ T4800] RIP: 0033:0x7f61263a4ef7 [ 87.298906][ T4800] Code: 77 01 c3 48 c7 c2 d0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 b8 07 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d0 ff ff ff f7 d8 64 89 01 48 [ 87.318516][ T4800] RSP: 002b:00007ffc15e5c2d8 EFLAGS: 00000207 ORIG_RAX: 0000000000000107 [ 87.327466][ T4800] RAX: ffffffffffffffda RBX: 0000000000000065 RCX: 00007f61263a4ef7 [ 87.335710][ T4800] RDX: 0000000000000200 RSI: 00007ffc15e5d480 RDI: 00000000ffffff9c [ 87.343863][ T4800] RBP: 00007f612640936c R08: 00000000000085d0 R09: 00000000ffffffff [ 87.351935][ T4800] R10: 0000000000000100 R11: 0000000000000207 R12: 00007ffc15e5d480 [ 87.360092][ T4800] R13: 00007f612640936c R14: 0000000000015305 R15: 0000000000000007 [ 87.368082][ T4800] [ 87.371102][ T4800] [ 87.373421][ T4800] Allocated by task 4612: [ 87.377734][ T4800] __kasan_slab_alloc+0x92/0xc0 [ 87.382948][ T4800] slab_post_alloc_hook+0x4c/0x380 [ 87.388280][ T4800] kmem_cache_alloc+0x15d/0x280 [ 87.393159][ T4800] __alloc_file+0x25/0x240 [ 87.397578][ T4800] alloc_empty_file+0x90/0x180 [ 87.402528][ T4800] alloc_file+0x5c/0x510 [ 87.407076][ T4800] alloc_file_pseudo+0x180/0x200 [ 87.412053][ T4800] anon_inode_getfile+0xc1/0x1a0 [ 87.417012][ T4800] __pidfd_prepare+0x7e/0x140 [ 87.421775][ T4800] copy_process+0x1f2f/0x3ec0 [ 87.426590][ T4800] kernel_clone+0x23f/0x990 [ 87.431107][ T4800] __x64_sys_clone+0x19a/0x210 [ 87.435959][ T4800] do_syscall_64+0x4c/0xa0 [ 87.440510][ T4800] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 87.446540][ T4800] [ 87.448971][ T4800] Freed by task 0: [ 87.452693][ T4800] kasan_set_track+0x4b/0x70 [ 87.457302][ T4800] kasan_set_free_info+0x1f/0x40 [ 87.462293][ T4800] ____kasan_slab_free+0xd5/0x110 [ 87.467342][ T4800] slab_free_freelist_hook+0xec/0x170 [ 87.472714][ T4800] kmem_cache_free+0x8f/0x210 [ 87.477384][ T4800] rcu_core+0x96e/0x1650 [ 87.481628][ T4800] handle_softirqs+0x336/0x830 [ 87.486385][ T4800] __irq_exit_rcu+0x13b/0x230 [ 87.491061][ T4800] irq_exit_rcu+0x5/0x20 [ 87.495297][ T4800] sysvec_apic_timer_interrupt+0xa0/0xc0 [ 87.500929][ T4800] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 87.507012][ T4800] [ 87.509433][ T4800] Last potentially related work creation: [ 87.515143][ T4800] kasan_save_stack+0x35/0x60 [ 87.519827][ T4800] kasan_record_aux_stack+0xb8/0x100 [ 87.525112][ T4800] call_rcu+0x189/0x900 [ 87.529268][ T4800] task_work_run+0x125/0x1a0 [ 87.533861][ T4800] exit_to_user_mode_loop+0x10f/0x130 [ 87.539337][ T4800] exit_to_user_mode_prepare+0xee/0x180 [ 87.544907][ T4800] syscall_exit_to_user_mode+0x16/0x40 [ 87.550441][ T4800] do_syscall_64+0x58/0xa0 [ 87.554928][ T4800] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 87.561241][ T4800] [ 87.563719][ T4800] Second to last potentially related work creation: [ 87.570379][ T4800] kasan_save_stack+0x35/0x60 [ 87.575044][ T4800] kasan_record_aux_stack+0xb8/0x100 [ 87.580313][ T4800] task_work_add+0x2f/0x1d0 [ 87.584804][ T4800] fput_many+0xde/0x1a0 [ 87.588948][ T4800] filp_close+0x10e/0x150 [ 87.593260][ T4800] do_close_on_exec+0x27b/0x360 [ 87.598283][ T4800] begin_new_exec+0x9c7/0x1180 [ 87.603043][ T4800] load_elf_binary+0x9af/0x2910 [ 87.607888][ T4800] bprm_execve+0xa8d/0x1740 [ 87.612408][ T4800] do_execveat_common+0x504/0x6b0 [ 87.617439][ T4800] __x64_sys_execve+0x8e/0xa0 [ 87.622100][ T4800] do_syscall_64+0x4c/0xa0 [ 87.626525][ T4800] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 87.632514][ T4800] [ 87.634829][ T4800] The buggy address belongs to the object at ffff888073fba000 [ 87.634829][ T4800] which belongs to the cache filp of size 464 [ 87.648776][ T4800] The buggy address is located 0 bytes inside of [ 87.648776][ T4800] 464-byte region [ffff888073fba000, ffff888073fba1d0) [ 87.661966][ T4800] The buggy address belongs to the page: [ 87.667594][ T4800] page:ffffea0001cfee80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x73fba [ 87.677746][ T4800] head:ffffea0001cfee80 order:1 compound_mapcount:0 [ 87.684326][ T4800] memcg:ffff888072549901 [ 87.688565][ T4800] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 87.696570][ T4800] raw: 00fff00000010200 0000000000000000 dead000000000122 ffff8881400068c0 [ 87.705149][ T4800] raw: 0000000000000000 00000000000c000c 00000001ffffffff ffff888072549901 [ 87.713724][ T4800] page dumped because: kasan: bad access detected [ 87.720159][ T4800] page_owner tracks the page as allocated [ 87.726144][ T4800] page last allocated via order 1, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 4612, ts 75763068673, free_ts 57080123197 [ 87.746897][ T4800] get_page_from_freelist+0x24f6/0x2670 [ 87.752622][ T4800] __alloc_pages+0x1ee/0x480 [ 87.757205][ T4800] new_slab+0xc0/0x4b0 [ 87.761259][ T4800] ___slab_alloc+0x807/0xdd0 [ 87.765838][ T4800] kmem_cache_alloc+0xf0/0x280 [ 87.770682][ T4800] __alloc_file+0x25/0x240 [ 87.775281][ T4800] alloc_empty_file+0x90/0x180 [ 87.780151][ T4800] alloc_file+0x5c/0x510 [ 87.784390][ T4800] alloc_file_pseudo+0x180/0x200 [ 87.789431][ T4800] anon_inode_getfile+0xc1/0x1a0 [ 87.794371][ T4800] __pidfd_prepare+0x7e/0x140 [ 87.799043][ T4800] copy_process+0x1f2f/0x3ec0 [ 87.803830][ T4800] kernel_clone+0x23f/0x990 [ 87.808350][ T4800] __x64_sys_clone+0x19a/0x210 [ 87.813132][ T4800] do_syscall_64+0x4c/0xa0 [ 87.817576][ T4800] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 87.823559][ T4800] page last free stack trace: [ 87.828212][ T4800] free_unref_page_prepare+0x637/0x6c0 [ 87.833655][ T4800] free_unref_page+0x8f/0x2a0 [ 87.838319][ T4800] __vunmap+0x8e0/0xa80 [ 87.842634][ T4800] kcov_close+0x27/0x50 [ 87.846776][ T4800] __fput+0x212/0x8c0 [ 87.850780][ T4800] task_work_run+0x125/0x1a0 [ 87.855403][ T4800] do_exit+0x635/0x2110 [ 87.859551][ T4800] do_group_exit+0x12c/0x2f0 [ 87.864119][ T4800] get_signal+0x7eb/0x12e0 [ 87.868526][ T4800] arch_do_signal_or_restart+0xe6/0x12a0 [ 87.874146][ T4800] exit_to_user_mode_loop+0x9e/0x130 [ 87.879412][ T4800] exit_to_user_mode_prepare+0xee/0x180 [ 87.884940][ T4800] syscall_exit_to_user_mode+0x16/0x40 [ 87.890387][ T4800] do_syscall_64+0x58/0xa0 [ 87.894795][ T4800] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 87.900674][ T4800] [ 87.903091][ T4800] Memory state around the buggy address: [ 87.908704][ T4800] ffff888073fb9f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 87.917225][ T4800] ffff888073fb9f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 87.925270][ T4800] >ffff888073fba000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.933406][ T4800] ^ [ 87.937453][ T4800] ffff888073fba080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.945509][ T4800] ffff888073fba100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.953549][ T4800] ================================================================== [ 87.961905][ T4800] Disabling lock debugging due to kernel taint [ 87.970100][ T4409] Bluetooth: hci0: command 0x040f tx timeout [ 87.973809][ T4800] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 87.983384][ T4800] CPU: 1 PID: 4800 Comm: syz-executor Tainted: G B syzkaller #0 [ 87.992321][ T4800] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 88.002383][ T4800] Call Trace: [ 88.005670][ T4800] [ 88.008600][ T4800] dump_stack_lvl+0x188/0x250 [ 88.013282][ T4800] ? show_regs_print_info+0x20/0x20 [ 88.018565][ T4800] ? load_image+0x410/0x410 [ 88.023071][ T4800] panic+0x2f8/0x850 [ 88.026948][ T4800] ? bpf_jit_dump+0xd0/0xd0 [ 88.031447][ T4800] ? _raw_spin_unlock_irqrestore+0x10d/0x120 [ 88.037653][ T4800] ? _raw_spin_unlock+0x40/0x40 [ 88.042519][ T4800] ? ext4_xattr_delete_inode+0xc9a/0xca0 [ 88.048225][ T4800] check_panic_on_warn+0x80/0xa0 [ 88.053291][ T4800] ? ext4_xattr_delete_inode+0xc9a/0xca0 [ 88.058924][ T4800] end_report+0x6d/0xf0 [ 88.063101][ T4800] kasan_report+0x102/0x130 [ 88.067851][ T4800] ? ext4_xattr_delete_inode+0xc9a/0xca0 [ 88.073572][ T4800] ext4_xattr_delete_inode+0xc9a/0xca0 [ 88.079025][ T4800] ? ext4_expand_extra_isize_ea+0x18e0/0x18e0 [ 88.085341][ T4800] ? __ext4_mark_inode_dirty+0x4b4/0x6c0 [ 88.091233][ T4800] ext4_evict_inode+0xc0c/0x1050 [ 88.096167][ T4800] ? ext4_inode_is_fast_symlink+0x390/0x390 [ 88.102055][ T4800] ? do_raw_spin_unlock+0x11d/0x230 [ 88.107282][ T4800] ? ext4_inode_is_fast_symlink+0x390/0x390 [ 88.113300][ T4800] evict+0x4b6/0x8b0 [ 88.117406][ T4800] ? __rwlock_init+0x140/0x140 [ 88.122195][ T4800] ? proc_nr_inodes+0x320/0x320 [ 88.127214][ T4800] ? do_raw_spin_unlock+0x11d/0x230 [ 88.132410][ T4800] ? _raw_spin_unlock+0x24/0x40 [ 88.137243][ T4800] ? iput+0x6ea/0x880 [ 88.141207][ T4800] vfs_rmdir+0x392/0x410 [ 88.145427][ T4800] do_rmdir+0x27f/0x710 [ 88.149597][ T4800] ? d_delete_notify+0x150/0x150 [ 88.154945][ T4800] ? getname_flags+0x1f9/0x4f0 [ 88.159682][ T4800] __x64_sys_unlinkat+0xc0/0xe0 [ 88.164514][ T4800] do_syscall_64+0x4c/0xa0 [ 88.168944][ T4800] ? clear_bhb_loop+0x30/0x80 [ 88.173603][ T4800] ? clear_bhb_loop+0x30/0x80 [ 88.178366][ T4800] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 88.184347][ T4800] RIP: 0033:0x7f61263a4ef7 [ 88.188932][ T4800] Code: 77 01 c3 48 c7 c2 d0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 b8 07 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d0 ff ff ff f7 d8 64 89 01 48 [ 88.208721][ T4800] RSP: 002b:00007ffc15e5c2d8 EFLAGS: 00000207 ORIG_RAX: 0000000000000107 [ 88.217127][ T4800] RAX: ffffffffffffffda RBX: 0000000000000065 RCX: 00007f61263a4ef7 [ 88.225240][ T4800] RDX: 0000000000000200 RSI: 00007ffc15e5d480 RDI: 00000000ffffff9c [ 88.233198][ T4800] RBP: 00007f612640936c R08: 00000000000085d0 R09: 00000000ffffffff [ 88.241150][ T4800] R10: 0000000000000100 R11: 0000000000000207 R12: 00007ffc15e5d480 [ 88.249104][ T4800] R13: 00007f612640936c R14: 0000000000015305 R15: 0000000000000007 [ 88.257062][ T4800] [ 88.260373][ T4800] Kernel Offset: disabled [ 88.264703][ T4800] Rebooting in 86400 seconds..