Warning: Permanently added '10.128.1.149' (ED25519) to the list of known hosts.
2025/08/11 11:45:36 ignoring optional flag "sandboxArg"="0"
2025/08/11 11:45:37 parsed 1 programs
[ 123.594569][ T6328] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 127.217634][ T5900] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 127.234576][ T5900] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 127.246187][ T5900] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 127.258100][ T5900] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 127.266505][ T5900] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 129.181872][ T6388] chnl_net:caif_netlink_parms(): no params data found
[ 129.292897][ T6388] bridge0: port 1(bridge_slave_0) entered blocking state
[ 129.300126][ T6388] bridge0: port 1(bridge_slave_0) entered disabled state
[ 129.307753][ T6388] bridge_slave_0: entered allmulticast mode
[ 129.315849][ T6388] bridge_slave_0: entered promiscuous mode
[ 129.324837][ T6388] bridge0: port 2(bridge_slave_1) entered blocking state
[ 129.333784][ T6388] bridge0: port 2(bridge_slave_1) entered disabled state
[ 129.340960][ T6388] bridge_slave_1: entered allmulticast mode
[ 129.348534][ T6388] bridge_slave_1: entered promiscuous mode
[ 129.381734][ T6388] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 129.395136][ T6388] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 129.444036][ T6388] team0: Port device team_slave_0 added
[ 129.455129][ T6388] team0: Port device team_slave_1 added
[ 129.483755][ T6388] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 129.490822][ T6388] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 129.517428][ T6388] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 129.529549][ T6388] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 129.536849][ T6388] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 129.562849][ T6388] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 129.600478][ T6388] hsr_slave_0: entered promiscuous mode
[ 129.606766][ T6388] hsr_slave_1: entered promiscuous mode
[ 130.175080][ T6388] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 130.189461][ T6388] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 130.203463][ T6388] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 130.215522][ T6388] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 130.318341][ T6388] 8021q: adding VLAN 0 to HW filter on device bond0
[ 130.341828][ T6388] 8021q: adding VLAN 0 to HW filter on device team0
[ 130.360806][ T13] bridge0: port 1(bridge_slave_0) entered blocking state
[ 130.368009][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 130.388015][ T13] bridge0: port 2(bridge_slave_1) entered blocking state
[ 130.395306][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 130.666492][ T6388] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 130.729002][ T6388] veth0_vlan: entered promiscuous mode
[ 130.743834][ T6388] veth1_vlan: entered promiscuous mode
[ 130.783381][ T6388] veth0_macvtap: entered promiscuous mode
[ 130.796494][ T6388] veth1_macvtap: entered promiscuous mode
[ 130.824812][ T6388] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 130.841735][ T6388] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 130.860858][ T1155] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 130.889371][ T1155] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 130.910879][ T1155] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 130.937365][ T1155] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 131.066786][ T1155] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 131.175571][ T1155] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 131.279235][ T1155] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 131.501719][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 131.523654][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 131.568044][ T60] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 131.577991][ T60] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
2025/08/11 11:45:49 executed programs: 0
[ 132.245764][ T5900] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 132.255761][ T5900] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 132.264270][ T5900] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 132.272497][ T5900] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 132.281109][ T5900] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 132.363633][ T1155] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 132.575425][ T6491] chnl_net:caif_netlink_parms(): no params data found
[ 132.719899][ T6491] bridge0: port 1(bridge_slave_0) entered blocking state
[ 132.727323][ T6491] bridge0: port 1(bridge_slave_0) entered disabled state
[ 132.738393][ T6491] bridge_slave_0: entered allmulticast mode
[ 132.746582][ T6491] bridge_slave_0: entered promiscuous mode
[ 132.755851][ T6491] bridge0: port 2(bridge_slave_1) entered blocking state
[ 132.764276][ T6491] bridge0: port 2(bridge_slave_1) entered disabled state
[ 132.771520][ T6491] bridge_slave_1: entered allmulticast mode
[ 132.779821][ T6491] bridge_slave_1: entered promiscuous mode
[ 132.825011][ T6491] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 132.838595][ T6491] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 132.888588][ T6491] team0: Port device team_slave_0 added
[ 132.902764][ T1305] ieee802154 phy0 wpan0: encryption failed: -22
[ 132.909246][ T1305] ieee802154 phy1 wpan1: encryption failed: -22
[ 132.927779][ T6491] team0: Port device team_slave_1 added
[ 132.975015][ T6491] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 132.982020][ T6491] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 133.010181][ T6491] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 133.026562][ T6491] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 133.034118][ T6491] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 133.065018][ T6491] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 133.136358][ T6491] hsr_slave_0: entered promiscuous mode
[ 133.144406][ T6491] hsr_slave_1: entered promiscuous mode
[ 133.150935][ T6491] debugfs: 'hsr0' already exists in 'hsr'
[ 133.158328][ T6491] Cannot create hsr debugfs directory
[ 133.914543][ T1155] bridge_slave_1: left allmulticast mode
[ 133.920234][ T1155] bridge_slave_1: left promiscuous mode
[ 133.931532][ T1155] bridge0: port 2(bridge_slave_1) entered disabled state
[ 133.945554][ T1155] bridge_slave_0: left allmulticast mode
[ 133.951235][ T1155] bridge_slave_0: left promiscuous mode
[ 133.957495][ T1155] bridge0: port 1(bridge_slave_0) entered disabled state
[ 134.289993][ T1155] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 134.301553][ T1155] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 134.312636][ T1155] bond0 (unregistering): Released all slaves
[ 134.332529][ T5900] Bluetooth: hci0: command tx timeout
[ 134.417936][ T1155] hsr_slave_0: left promiscuous mode
[ 134.424144][ T1155] hsr_slave_1: left promiscuous mode
[ 134.430179][ T1155] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 134.438449][ T1155] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 134.447167][ T1155] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 134.459113][ T1155] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 134.484741][ T1155] veth1_macvtap: left promiscuous mode
[ 134.490333][ T1155] veth0_macvtap: left promiscuous mode
[ 134.496488][ T1155] veth1_vlan: left promiscuous mode
[ 134.501929][ T1155] veth0_vlan: left promiscuous mode
[ 134.937701][ T1155] team0 (unregistering): Port device team_slave_1 removed
[ 134.975031][ T1155] team0 (unregistering): Port device team_slave_0 removed
[ 135.497534][ T6491] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 135.511484][ T6491] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 135.528225][ T6491] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 135.540895][ T6491] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 135.797307][ T6491] 8021q: adding VLAN 0 to HW filter on device bond0
[ 135.835676][ T6491] 8021q: adding VLAN 0 to HW filter on device team0
[ 135.850810][ T1005] bridge0: port 1(bridge_slave_0) entered blocking state
[ 135.858042][ T1005] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 135.909643][ T1005] bridge0: port 2(bridge_slave_1) entered blocking state
[ 135.916855][ T1005] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 136.349927][ T6491] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 136.399063][ T6491] veth0_vlan: entered promiscuous mode
[ 136.413798][ T5900] Bluetooth: hci0: command tx timeout
[ 136.416092][ T6491] veth1_vlan: entered promiscuous mode
[ 136.470118][ T6491] veth0_macvtap: entered promiscuous mode
[ 136.485716][ T6491] veth1_macvtap: entered promiscuous mode
[ 136.511067][ T6491] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 136.527308][ T6491] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 136.548354][ T60] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 136.580856][ T60] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 136.606422][ T60] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 136.627599][ T60] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 136.692265][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 136.700104][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 136.741473][ T1005] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 136.751571][ T1005] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
2025/08/11 11:45:55 executed programs: 3
[ 138.492330][ T5900] Bluetooth: hci0: command tx timeout
[ 138.590944][ T1111] ==================================================================
[ 138.599062][ T1111] BUG: KASAN: slab-use-after-free in _raw_spin_lock_bh+0x36/0x50
[ 138.606901][ T1111] Read of size 1 at addr ffff888031789fd8 by task kworker/u8:6/1111
[ 138.614867][ T1111]
[ 138.617203][ T1111] CPU: 0 UID: 0 PID: 1111 Comm: kworker/u8:6 Not tainted 6.16.0-syzkaller-12256-g561c80369df0 #0 PREEMPT(full)
[ 138.617221][ T1111] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[ 138.617230][ T1111] Workqueue: kkcmd kcm_tx_work
[ 138.617258][ T1111] Call Trace:
[ 138.617264][ T1111]
[ 138.617270][ T1111] dump_stack_lvl+0x189/0x250
[ 138.617287][ T1111] ? __virt_addr_valid+0x1c8/0x5c0
[ 138.617304][ T1111] ? rcu_is_watching+0x15/0xb0
[ 138.617316][ T1111] ? __kasan_check_byte+0x12/0x40
[ 138.617335][ T1111] ? __pfx_dump_stack_lvl+0x10/0x10
[ 138.617349][ T1111] ? rcu_is_watching+0x15/0xb0
[ 138.617361][ T1111] ? lock_release+0x4b/0x3e0
[ 138.617381][ T1111] ? __virt_addr_valid+0x1c8/0x5c0
[ 138.617396][ T1111] ? __virt_addr_valid+0x4a5/0x5c0
[ 138.617412][ T1111] print_report+0xca/0x240
[ 138.617425][ T1111] ? _raw_spin_lock_bh+0x36/0x50
[ 138.617440][ T1111] kasan_report+0x118/0x150
[ 138.617458][ T1111] ? _raw_spin_lock_bh+0x36/0x50
[ 138.617475][ T1111] ? __lock_sock+0x156/0x2b0
[ 138.617489][ T1111] __kasan_check_byte+0x2a/0x40
[ 138.617506][ T1111] lock_acquire+0x8d/0x360
[ 138.617525][ T1111] ? schedule+0x91/0x360
[ 138.617539][ T1111] ? kthread_data+0x4f/0xc0
[ 138.617553][ T1111] ? __lock_sock+0x156/0x2b0
[ 138.617566][ T1111] _raw_spin_lock_bh+0x36/0x50
[ 138.617581][ T1111] ? __lock_sock+0x156/0x2b0
[ 138.617594][ T1111] __lock_sock+0x156/0x2b0
[ 138.617608][ T1111] ? __pfx___lock_sock+0x10/0x10
[ 138.617621][ T1111] ? do_raw_spin_lock+0x121/0x290
[ 138.617636][ T1111] ? __pfx_autoremove_wake_function+0x10/0x10
[ 138.617654][ T1111] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 138.617671][ T1111] ? lock_sock_nested+0x6a/0x100
[ 138.617687][ T1111] lock_sock_nested+0x9f/0x100
[ 138.617704][ T1111] kcm_tx_work+0x31/0x180
[ 138.617718][ T1111] ? process_scheduled_works+0x9ef/0x17b0
[ 138.617731][ T1111] process_scheduled_works+0xade/0x17b0
[ 138.617753][ T1111] ? __pfx_process_scheduled_works+0x10/0x10
[ 138.617771][ T1111] worker_thread+0x8a0/0xda0
[ 138.617785][ T1111] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 138.617803][ T1111] ? __kthread_parkme+0x7b/0x200
[ 138.617819][ T1111] kthread+0x70e/0x8a0
[ 138.617836][ T1111] ? __pfx_worker_thread+0x10/0x10
[ 138.617848][ T1111] ? __pfx_kthread+0x10/0x10
[ 138.617863][ T1111] ? _raw_spin_unlock_irq+0x23/0x50
[ 138.617878][ T1111] ? lockdep_hardirqs_on+0x9c/0x150
[ 138.617900][ T1111] ? __pfx_kthread+0x10/0x10
[ 138.617915][ T1111] ret_from_fork+0x3fc/0x770
[ 138.617929][ T1111] ? __pfx_ret_from_fork+0x10/0x10
[ 138.617944][ T1111] ? __switch_to_asm+0x39/0x70
[ 138.617960][ T1111] ? __switch_to_asm+0x33/0x70
[ 138.617975][ T1111] ? __pfx_kthread+0x10/0x10
[ 138.617991][ T1111] ret_from_fork_asm+0x1a/0x30
[ 138.618012][ T1111]
[ 138.618017][ T1111]
[ 138.885438][ T1111] Allocated by task 6708:
[ 138.889766][ T1111] kasan_save_track+0x3e/0x80
[ 138.894430][ T1111] __kasan_slab_alloc+0x6c/0x80
[ 138.899269][ T1111] kmem_cache_alloc_noprof+0x1c1/0x3c0
[ 138.904720][ T1111] sk_prot_alloc+0x57/0x220
[ 138.909251][ T1111] sk_alloc+0x3a/0x370
[ 138.913314][ T1111] kcm_ioctl+0x214/0xff0
[ 138.917549][ T1111] sock_do_ioctl+0xdc/0x300
[ 138.922133][ T1111] sock_ioctl+0x576/0x790
[ 138.926454][ T1111] __se_sys_ioctl+0xfc/0x170
[ 138.931028][ T1111] do_syscall_64+0xfa/0x3b0
[ 138.935519][ T1111] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 138.941403][ T1111]
[ 138.943717][ T1111] Freed by task 6709:
[ 138.947682][ T1111] kasan_save_track+0x3e/0x80
[ 138.952368][ T1111] kasan_save_free_info+0x46/0x50
[ 138.957389][ T1111] __kasan_slab_free+0x5b/0x80
[ 138.962243][ T1111] kmem_cache_free+0x18f/0x400
[ 138.967014][ T1111] __sk_destruct+0x4d2/0x660
[ 138.971646][ T1111] kcm_release+0x528/0x5c0
[ 138.976063][ T1111] sock_close+0xc3/0x240
[ 138.980327][ T1111] __fput+0x449/0xa70
[ 138.984387][ T1111] fput_close_sync+0x119/0x200
[ 138.989238][ T1111] __x64_sys_close+0x7f/0x110
[ 138.993918][ T1111] do_syscall_64+0xfa/0x3b0
[ 138.998409][ T1111] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 139.004287][ T1111]
[ 139.006591][ T1111] Last potentially related work creation:
[ 139.012284][ T1111] kasan_save_stack+0x3e/0x60
[ 139.016947][ T1111] kasan_record_aux_stack+0xbd/0xd0
[ 139.022127][ T1111] insert_work+0x3d/0x330
[ 139.026452][ T1111] __queue_work+0xcd2/0xfb0
[ 139.030941][ T1111] queue_work_on+0x181/0x270
[ 139.035513][ T1111] kcm_unattach+0x863/0xe90
[ 139.040000][ T1111] kcm_ioctl+0x794/0xff0
[ 139.044227][ T1111] sock_do_ioctl+0xdc/0x300
[ 139.048719][ T1111] sock_ioctl+0x576/0x790
[ 139.053035][ T1111] __se_sys_ioctl+0xfc/0x170
[ 139.057631][ T1111] do_syscall_64+0xfa/0x3b0
[ 139.062129][ T1111] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 139.068014][ T1111]
[ 139.070333][ T1111] Second to last potentially related work creation:
[ 139.076901][ T1111] kasan_save_stack+0x3e/0x60
[ 139.081563][ T1111] kasan_record_aux_stack+0xbd/0xd0
[ 139.086753][ T1111] insert_work+0x3d/0x330
[ 139.091101][ T1111] __queue_work+0xcd2/0xfb0
[ 139.095591][ T1111] queue_work_on+0x181/0x270
[ 139.100175][ T1111] kcm_ioctl+0xe52/0xff0
[ 139.104401][ T1111] sock_do_ioctl+0xdc/0x300
[ 139.108890][ T1111] sock_ioctl+0x576/0x790
[ 139.113206][ T1111] __se_sys_ioctl+0xfc/0x170
[ 139.117788][ T1111] do_syscall_64+0xfa/0x3b0
[ 139.122291][ T1111] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 139.128170][ T1111]
[ 139.130483][ T1111] The buggy address belongs to the object at ffff888031789e00
[ 139.130483][ T1111] which belongs to the cache KCM of size 1792
[ 139.143917][ T1111] The buggy address is located 472 bytes inside of
[ 139.143917][ T1111] freed 1792-byte region [ffff888031789e00, ffff88803178a500)
[ 139.157803][ T1111]
[ 139.160121][ T1111] The buggy address belongs to the physical page:
[ 139.166543][ T1111] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x31788
[ 139.175302][ T1111] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 139.184051][ T1111] memcg:ffff888079619701
[ 139.188273][ T1111] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 139.195811][ T1111] page_type: f5(slab)
[ 139.199776][ T1111] raw: 00fff00000000040 ffff88814c29bdc0 dead000000000122 0000000000000000
[ 139.208343][ T1111] raw: 0000000000000000 0000000080110011 00000000f5000000 ffff888079619701
[ 139.216916][ T1111] head: 00fff00000000040 ffff88814c29bdc0 dead000000000122 0000000000000000
[ 139.225673][ T1111] head: 0000000000000000 0000000080110011 00000000f5000000 ffff888079619701
[ 139.234336][ T1111] head: 00fff00000000003 ffffea0000c5e201 00000000ffffffff 00000000ffffffff
[ 139.242995][ T1111] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 139.251647][ T1111] page dumped because: kasan: bad access detected
[ 139.258059][ T1111] page_owner tracks the page as allocated
[ 139.263756][ T1111] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6626, tgid 6625 (syz.0.16), ts 136825910798, free_ts 136726294853
[ 139.284933][ T1111] post_alloc_hook+0x240/0x2a0
[ 139.289712][ T1111] get_page_from_freelist+0x21e4/0x22c0
[ 139.295255][ T1111] __alloc_frozen_pages_noprof+0x181/0x370
[ 139.301049][ T1111] alloc_pages_mpol+0x232/0x4a0
[ 139.305892][ T1111] allocate_slab+0x8a/0x370
[ 139.310391][ T1111] ___slab_alloc+0xbeb/0x1410
[ 139.315147][ T1111] kmem_cache_alloc_noprof+0x283/0x3c0
[ 139.320597][ T1111] sk_prot_alloc+0x57/0x220
[ 139.325079][ T1111] sk_alloc+0x3a/0x370
[ 139.329136][ T1111] kcm_create+0x100/0x580
[ 139.333447][ T1111] __sock_create+0x4b0/0x9f0
[ 139.338023][ T1111] __sys_socket+0xd7/0x1b0
[ 139.342453][ T1111] __x64_sys_socket+0x7a/0x90
[ 139.347126][ T1111] do_syscall_64+0xfa/0x3b0
[ 139.351723][ T1111] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 139.357615][ T1111] page last free pid 6491 tgid 6491 stack trace:
[ 139.363929][ T1111] __free_frozen_pages+0xbc4/0xd30
[ 139.369039][ T1111] __put_partials+0x156/0x1a0
[ 139.373701][ T1111] put_cpu_partial+0x17c/0x250
[ 139.378538][ T1111] __slab_free+0x2d5/0x3c0
[ 139.382940][ T1111] qlist_free_all+0x97/0x140
[ 139.387520][ T1111] kasan_quarantine_reduce+0x148/0x160
[ 139.392969][ T1111] __kasan_slab_alloc+0x22/0x80
[ 139.397803][ T1111] kmem_cache_alloc_node_noprof+0x1bb/0x3c0
[ 139.403769][ T1111] __alloc_skb+0x112/0x2d0
[ 139.408170][ T1111] rtmsg_ifinfo_build_skb+0x84/0x260
[ 139.413436][ T1111] rtmsg_ifinfo+0x8c/0x1a0
[ 139.417840][ T1111] register_netdevice+0x1712/0x1ae0
[ 139.423028][ T1111] cfg80211_register_netdevice+0x150/0x2f0
[ 139.428825][ T1111] ieee80211_if_add+0xe60/0x1390
[ 139.433743][ T1111] ieee80211_register_hw+0x3551/0x4080
[ 139.439185][ T1111] mac80211_hwsim_new_radio+0x2f0e/0x5340
[ 139.444889][ T1111]
[ 139.447193][ T1111] Memory state around the buggy address:
[ 139.452810][ T1111] ffff888031789e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 139.460853][ T1111] ffff888031789f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 139.468989][ T1111] >ffff888031789f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 139.477035][ T1111] ^
[ 139.484041][ T1111] ffff88803178a000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 139.492191][ T1111] ffff88803178a080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 139.500246][ T1111] ==================================================================
[ 139.508380][ T1111] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 139.515587][ T1111] CPU: 0 UID: 0 PID: 1111 Comm: kworker/u8:6 Not tainted 6.16.0-syzkaller-12256-g561c80369df0 #0 PREEMPT(full)
[ 139.527396][ T1111] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[ 139.537464][ T1111] Workqueue: kkcmd kcm_tx_work
[ 139.542238][ T1111] Call Trace:
[ 139.545506][ T1111]
[ 139.548421][ T1111] dump_stack_lvl+0x99/0x250
[ 139.553001][ T1111] ? __asan_memcpy+0x40/0x70
[ 139.557590][ T1111] ? __pfx_dump_stack_lvl+0x10/0x10
[ 139.562776][ T1111] ? __pfx__printk+0x10/0x10
[ 139.567365][ T1111] vpanic+0x281/0x750
[ 139.571357][ T1111] ? __pfx_print_hex_dump+0x10/0x10
[ 139.576546][ T1111] ? __pfx_vpanic+0x10/0x10
[ 139.581046][ T1111] ? irqentry_exit+0x74/0x90
[ 139.585781][ T1111] ? lockdep_hardirqs_on+0x9c/0x150
[ 139.590996][ T1111] panic+0xb9/0xc0
[ 139.594703][ T1111] ? __pfx_panic+0x10/0x10
[ 139.599103][ T1111] ? _raw_spin_unlock_irqrestore+0xa8/0x110
[ 139.604979][ T1111] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 139.611467][ T1111] ? _raw_spin_lock_bh+0x36/0x50
[ 139.616392][ T1111] check_panic_on_warn+0x89/0xb0
[ 139.621327][ T1111] ? _raw_spin_lock_bh+0x36/0x50
[ 139.626258][ T1111] end_report+0x78/0x160
[ 139.630488][ T1111] kasan_report+0x129/0x150
[ 139.634981][ T1111] ? _raw_spin_lock_bh+0x36/0x50
[ 139.639907][ T1111] ? __lock_sock+0x156/0x2b0
[ 139.644487][ T1111] __kasan_check_byte+0x2a/0x40
[ 139.649413][ T1111] lock_acquire+0x8d/0x360
[ 139.653818][ T1111] ? schedule+0x91/0x360
[ 139.658044][ T1111] ? kthread_data+0x4f/0xc0
[ 139.662568][ T1111] ? __lock_sock+0x156/0x2b0
[ 139.667149][ T1111] _raw_spin_lock_bh+0x36/0x50
[ 139.671897][ T1111] ? __lock_sock+0x156/0x2b0
[ 139.676471][ T1111] __lock_sock+0x156/0x2b0
[ 139.680874][ T1111] ? __pfx___lock_sock+0x10/0x10
[ 139.685798][ T1111] ? do_raw_spin_lock+0x121/0x290
[ 139.690816][ T1111] ? __pfx_autoremove_wake_function+0x10/0x10
[ 139.696874][ T1111] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 139.702243][ T1111] ? lock_sock_nested+0x6a/0x100
[ 139.707172][ T1111] lock_sock_nested+0x9f/0x100
[ 139.711929][ T1111] kcm_tx_work+0x31/0x180
[ 139.716245][ T1111] ? process_scheduled_works+0x9ef/0x17b0
[ 139.721947][ T1111] process_scheduled_works+0xade/0x17b0
[ 139.727484][ T1111] ? __pfx_process_scheduled_works+0x10/0x10
[ 139.733477][ T1111] worker_thread+0x8a0/0xda0
[ 139.738051][ T1111] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 139.744374][ T1111] ? __kthread_parkme+0x7b/0x200
[ 139.749305][ T1111] kthread+0x70e/0x8a0
[ 139.753360][ T1111] ? __pfx_worker_thread+0x10/0x10
[ 139.758453][ T1111] ? __pfx_kthread+0x10/0x10
[ 139.763117][ T1111] ? _raw_spin_unlock_irq+0x23/0x50
[ 139.768301][ T1111] ? lockdep_hardirqs_on+0x9c/0x150
[ 139.773486][ T1111] ? __pfx_kthread+0x10/0x10
[ 139.778062][ T1111] ret_from_fork+0x3fc/0x770
[ 139.782821][ T1111] ? __pfx_ret_from_fork+0x10/0x10
[ 139.787916][ T1111] ? __switch_to_asm+0x39/0x70
[ 139.792670][ T1111] ? __switch_to_asm+0x33/0x70
[ 139.797420][ T1111] ? __pfx_kthread+0x10/0x10
[ 139.802013][ T1111] ret_from_fork_asm+0x1a/0x30
[ 139.806785][ T1111]
[ 139.809937][ T1111] Kernel Offset: disabled
[ 139.814252][ T1111] Rebooting in 86400 seconds..