Warning: Permanently added '10.128.1.171' (ED25519) to the list of known hosts.
2025/06/01 05:44:21 ignoring optional flag "sandboxArg"="0"
2025/06/01 05:44:23 parsed 1 programs
[ 126.177818][ T6282] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 130.050337][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 130.065032][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 130.102658][ T3546] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 130.112371][ T3546] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 131.445687][ T6341] chnl_net:caif_netlink_parms(): no params data found
[ 131.510941][ T6341] bridge0: port 1(bridge_slave_0) entered blocking state
[ 131.518330][ T6341] bridge0: port 1(bridge_slave_0) entered disabled state
[ 131.525684][ T6341] bridge_slave_0: entered allmulticast mode
[ 131.534271][ T6341] bridge_slave_0: entered promiscuous mode
[ 131.542684][ T6341] bridge0: port 2(bridge_slave_1) entered blocking state
[ 131.549891][ T6341] bridge0: port 2(bridge_slave_1) entered disabled state
[ 131.557485][ T6341] bridge_slave_1: entered allmulticast mode
[ 131.564604][ T6341] bridge_slave_1: entered promiscuous mode
[ 131.593100][ T6341] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 131.604530][ T6341] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 131.633886][ T6341] team0: Port device team_slave_0 added
[ 131.643279][ T6341] team0: Port device team_slave_1 added
[ 131.669017][ T6341] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 131.676372][ T6341] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 131.702436][ T6341] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 131.714561][ T6341] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 131.721965][ T6341] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 131.747933][ T6341] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 131.787491][ T6341] hsr_slave_0: entered promiscuous mode
[ 131.793827][ T6341] hsr_slave_1: entered promiscuous mode
[ 132.514673][ T6341] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 132.527363][ T6341] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 132.540069][ T6341] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 132.554934][ T6341] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 132.665975][ T6341] 8021q: adding VLAN 0 to HW filter on device bond0
[ 132.695001][ T6341] 8021q: adding VLAN 0 to HW filter on device team0
[ 132.708599][ T3546] bridge0: port 1(bridge_slave_0) entered blocking state
[ 132.716215][ T3546] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 132.733793][ T12] bridge0: port 2(bridge_slave_1) entered blocking state
[ 132.741000][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 132.946166][ T1301] ieee802154 phy0 wpan0: encryption failed: -22
[ 132.952805][ T1301] ieee802154 phy1 wpan1: encryption failed: -22
[ 133.033431][ T6341] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 133.095599][ T6341] veth0_vlan: entered promiscuous mode
[ 133.109930][ T6341] veth1_vlan: entered promiscuous mode
[ 133.159770][ T6341] veth0_macvtap: entered promiscuous mode
[ 133.173171][ T6341] veth1_macvtap: entered promiscuous mode
[ 133.202002][ T6341] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 133.221497][ T6341] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 133.239567][ T6341] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 133.250436][ T6341] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 133.261610][ T6341] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 133.272180][ T6341] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 133.456611][ T48] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 133.560091][ T48] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 133.659824][ T48] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 133.764224][ T48] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 133.779550][ T5151] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 133.789408][ T5151] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 133.797774][ T5151] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 133.809265][ T5151] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 133.818908][ T5151] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
2025/06/01 05:44:36 executed programs: 0
[ 134.896945][ T5921] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 134.905943][ T5921] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 134.916286][ T5921] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 134.927425][ T5921] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 134.935399][ T5921] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 135.199236][ T6446] chnl_net:caif_netlink_parms(): no params data found
[ 135.325589][ T6446] bridge0: port 1(bridge_slave_0) entered blocking state
[ 135.334576][ T6446] bridge0: port 1(bridge_slave_0) entered disabled state
[ 135.343495][ T6446] bridge_slave_0: entered allmulticast mode
[ 135.354762][ T6446] bridge_slave_0: entered promiscuous mode
[ 135.364070][ T6446] bridge0: port 2(bridge_slave_1) entered blocking state
[ 135.373614][ T6446] bridge0: port 2(bridge_slave_1) entered disabled state
[ 135.382212][ T6446] bridge_slave_1: entered allmulticast mode
[ 135.390049][ T6446] bridge_slave_1: entered promiscuous mode
[ 135.473054][ T6446] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 135.538861][ T6446] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 135.599157][ T48] bridge_slave_1: left allmulticast mode
[ 135.606680][ T48] bridge_slave_1: left promiscuous mode
[ 135.614959][ T48] bridge0: port 2(bridge_slave_1) entered disabled state
[ 135.628958][ T48] bridge_slave_0: left allmulticast mode
[ 135.636587][ T48] bridge_slave_0: left promiscuous mode
[ 135.642878][ T48] bridge0: port 1(bridge_slave_0) entered disabled state
[ 136.013195][ T48] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 136.029609][ T48] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 136.043775][ T48] bond0 (unregistering): Released all slaves
[ 136.095707][ T6446] team0: Port device team_slave_0 added
[ 136.106962][ T6446] team0: Port device team_slave_1 added
[ 136.178234][ T48] hsr_slave_0: left promiscuous mode
[ 136.184518][ T48] hsr_slave_1: left promiscuous mode
[ 136.192343][ T48] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 136.199817][ T48] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 136.209634][ T48] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 136.217662][ T48] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 136.234536][ T48] veth1_macvtap: left promiscuous mode
[ 136.240079][ T48] veth0_macvtap: left promiscuous mode
[ 136.246227][ T48] veth1_vlan: left promiscuous mode
[ 136.252290][ T48] veth0_vlan: left promiscuous mode
[ 136.570007][ T48] team0 (unregistering): Port device team_slave_1 removed
[ 136.602537][ T48] team0 (unregistering): Port device team_slave_0 removed
[ 136.871330][ T6446] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 136.878367][ T6446] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 136.904572][ T6446] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 136.917434][ T6446] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 136.924648][ T6446] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 136.950873][ T6446] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 137.020775][ T5921] Bluetooth: hci0: command tx timeout
[ 137.053680][ T6446] hsr_slave_0: entered promiscuous mode
[ 137.060349][ T6446] hsr_slave_1: entered promiscuous mode
[ 137.802620][ T6446] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 137.821982][ T6446] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 137.834490][ T6446] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 137.845336][ T6446] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 137.956588][ T6446] 8021q: adding VLAN 0 to HW filter on device bond0
[ 137.986352][ T6446] 8021q: adding VLAN 0 to HW filter on device team0
[ 138.002029][ T12] bridge0: port 1(bridge_slave_0) entered blocking state
[ 138.009229][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 138.038254][ T12] bridge0: port 2(bridge_slave_1) entered blocking state
[ 138.045665][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 138.315896][ T6446] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 138.379410][ T6446] veth0_vlan: entered promiscuous mode
[ 138.397839][ T6446] veth1_vlan: entered promiscuous mode
[ 138.440369][ T6446] veth0_macvtap: entered promiscuous mode
[ 138.452219][ T6446] veth1_macvtap: entered promiscuous mode
[ 138.477025][ T6446] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 138.497006][ T6446] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 138.515974][ T6446] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 138.525385][ T6446] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 138.536305][ T6446] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 138.546139][ T6446] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 138.641920][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 138.649766][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 138.702969][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 138.715530][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 139.101443][ T5921] Bluetooth: hci0: command tx timeout
2025/06/01 05:44:41 executed programs: 39
[ 141.180947][ T5921] Bluetooth: hci0: command tx timeout
[ 143.260639][ T5921] Bluetooth: hci0: command tx timeout
2025/06/01 05:44:46 executed programs: 216
2025/06/01 05:44:51 executed programs: 434
[ 153.329855][ T5151] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 153.356079][ T5151] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 153.366709][ T5151] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 153.376640][ T5151] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 153.385453][ T5151] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 153.540008][ T1111] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 153.560436][ T7923] chnl_net:caif_netlink_parms(): no params data found
[ 153.608445][ T1111] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 153.654576][ T7923] bridge0: port 1(bridge_slave_0) entered blocking state
[ 153.663047][ T7923] bridge0: port 1(bridge_slave_0) entered disabled state
[ 153.670220][ T7923] bridge_slave_0: entered allmulticast mode
[ 153.677913][ T7923] bridge_slave_0: entered promiscuous mode
[ 153.686478][ T7923] bridge0: port 2(bridge_slave_1) entered blocking state
[ 153.694860][ T7923] bridge0: port 2(bridge_slave_1) entered disabled state
[ 153.702197][ T7923] bridge_slave_1: entered allmulticast mode
[ 153.709179][ T7923] bridge_slave_1: entered promiscuous mode
[ 153.732890][ T1111] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 153.759378][ T7923] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 153.772112][ T7923] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 153.804617][ T1111] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 153.833754][ T7923] team0: Port device team_slave_0 added
[ 153.844413][ T7923] team0: Port device team_slave_1 added
[ 153.876065][ T7923] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 153.883133][ T7923] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 153.909468][ T7923] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 153.922189][ T7923] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 153.929323][ T7923] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 153.955361][ T7923] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 154.030301][ T7923] hsr_slave_0: entered promiscuous mode
[ 154.037274][ T7923] hsr_slave_1: entered promiscuous mode
[ 154.043959][ T7923] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 154.052079][ T7923] Cannot create hsr debugfs directory
[ 154.110164][ T1111] bridge_slave_1: left allmulticast mode
[ 154.116061][ T1111] bridge_slave_1: left promiscuous mode
[ 154.122820][ T1111] bridge0: port 2(bridge_slave_1) entered disabled state
[ 154.133158][ T1111] bridge_slave_0: left allmulticast mode
[ 154.138849][ T1111] bridge_slave_0: left promiscuous mode
[ 154.145146][ T1111] bridge0: port 1(bridge_slave_0) entered disabled state
[ 154.372109][ T1111] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 154.383687][ T1111] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 154.394319][ T1111] bond0 (unregistering): Released all slaves
[ 154.673557][ T1111] hsr_slave_0: left promiscuous mode
[ 154.679898][ T1111] hsr_slave_1: left promiscuous mode
[ 154.696881][ T1111] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 154.705334][ T1111] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 154.713426][ T1111] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 154.720979][ T1111] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 154.742757][ T1111] veth1_macvtap: left promiscuous mode
[ 154.748344][ T1111] veth0_macvtap: left promiscuous mode
[ 154.754128][ T1111] veth1_vlan: left promiscuous mode
[ 154.759481][ T1111] veth0_vlan: left promiscuous mode
[ 155.238588][ T1111] team0 (unregistering): Port device team_slave_1 removed
[ 155.271852][ T1111] team0 (unregistering): Port device team_slave_0 removed
[ 155.424238][ T5151] Bluetooth: hci1: command tx timeout
[ 155.814718][ T7923] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 155.837865][ T7923] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 155.854205][ T7923] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 155.867598][ T7923] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 155.985694][ T7923] 8021q: adding VLAN 0 to HW filter on device bond0
[ 156.012682][ T7923] 8021q: adding VLAN 0 to HW filter on device team0
[ 156.028757][ T48] bridge0: port 1(bridge_slave_0) entered blocking state
[ 156.036086][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 156.056085][ T48] bridge0: port 2(bridge_slave_1) entered blocking state
[ 156.063307][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 156.302749][ T7923] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 156.341971][ T7923] veth0_vlan: entered promiscuous mode
[ 156.353287][ T7923] veth1_vlan: entered promiscuous mode
[ 156.379686][ T7923] veth0_macvtap: entered promiscuous mode
[ 156.389007][ T7923] veth1_macvtap: entered promiscuous mode
[ 156.407931][ T7923] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 156.422727][ T7923] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 156.434022][ T7923] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 156.443948][ T7923] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 156.453107][ T7923] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 156.462585][ T7923] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 156.519032][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 156.530466][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 156.556428][ T1111] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
2025/06/01 05:44:57 executed programs: 602
[ 156.564824][ T1111] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 156.604335][ T7968] ==================================================================
[ 156.612457][ T7968] BUG: KASAN: slab-use-after-free in force_devcd_write+0x312/0x340
[ 156.620349][ T7968] Read of size 8 at addr ffff88807615f000 by task syz.0.616/7968
[ 156.628088][ T7968]
[ 156.630421][ T7968] CPU: 0 UID: 0 PID: 7968 Comm: syz.0.616 Not tainted 6.15.0-syzkaller-g7d4e49a77d99 #0 PREEMPT(full)
[ 156.630438][ T7968] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
[ 156.630450][ T7968] Call Trace:
[ 156.630456][ T7968]
[ 156.630465][ T7968] dump_stack_lvl+0x116/0x1f0
[ 156.630488][ T7968] print_report+0xcd/0x680
[ 156.630509][ T7968] ? __virt_addr_valid+0x81/0x610
[ 156.630536][ T7968] ? __phys_addr+0xe8/0x180
[ 156.630564][ T7968] ? force_devcd_write+0x312/0x340
[ 156.630593][ T7968] kasan_report+0xe0/0x110
[ 156.630622][ T7968] ? force_devcd_write+0x312/0x340
[ 156.630654][ T7968] force_devcd_write+0x312/0x340
[ 156.630683][ T7968] ? __pfx_force_devcd_write+0x10/0x10
[ 156.630714][ T7968] ? __debugfs_file_get+0x1fe/0x840
[ 156.630743][ T7968] ? __pfx___debugfs_file_get+0x10/0x10
[ 156.630777][ T7968] full_proxy_write+0x13c/0x200
[ 156.630816][ T7968] ? __pfx_full_proxy_write+0x10/0x10
[ 156.630846][ T7968] vfs_write+0x2a0/0x1150
[ 156.630876][ T7968] ? __pfx___mutex_lock+0x10/0x10
[ 156.630904][ T7968] ? __pfx_vfs_write+0x10/0x10
[ 156.630936][ T7968] ? __fget_files+0x20e/0x3c0
[ 156.630964][ T7968] ksys_write+0x12a/0x250
[ 156.630989][ T7968] ? __pfx_ksys_write+0x10/0x10
[ 156.631017][ T7968] do_syscall_64+0xcd/0x490
[ 156.631046][ T7968] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 156.631068][ T7968] RIP: 0033:0x7faf4c98d169
[ 156.631094][ T7968] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 156.631119][ T7968] RSP: 002b:00007faf4d7f4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 156.631140][ T7968] RAX: ffffffffffffffda RBX: 00007faf4cba5fa0 RCX: 00007faf4c98d169
[ 156.631156][ T7968] RDX: 000000000000000e RSI: 0000000000000000 RDI: 0000000000000003
[ 156.631171][ T7968] RBP: 00007faf4ca0e2a0 R08: 0000000000000000 R09: 0000000000000000
[ 156.631186][ T7968] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 156.631201][ T7968] R13: 0000000000000000 R14: 00007faf4cba5fa0 R15: 00007fff46d1adb8
[ 156.631225][ T7968]
[ 156.631234][ T7968]
[ 156.839688][ T7968] Allocated by task 6446:
[ 156.844009][ T7968] kasan_save_stack+0x33/0x60
[ 156.848953][ T7968] kasan_save_track+0x14/0x30
[ 156.853648][ T7968] __kasan_kmalloc+0xaa/0xb0
[ 156.858241][ T7968] vhci_open+0x4c/0x430
[ 156.862396][ T7968] misc_open+0x35d/0x420
[ 156.866631][ T7968] chrdev_open+0x234/0x6a0
[ 156.871048][ T7968] do_dentry_open+0x741/0x1c10
[ 156.875838][ T7968] vfs_open+0x82/0x3f0
[ 156.880003][ T7968] path_openat+0x1de4/0x2cb0
[ 156.884590][ T7968] do_filp_open+0x20b/0x470
[ 156.889116][ T7968] do_sys_openat2+0x11b/0x1d0
[ 156.893786][ T7968] __x64_sys_openat+0x174/0x210
[ 156.898627][ T7968] do_syscall_64+0xcd/0x490
[ 156.903123][ T7968] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 156.909012][ T7968]
[ 156.911341][ T7968] Freed by task 6446:
[ 156.915315][ T7968] kasan_save_stack+0x33/0x60
[ 156.919986][ T7968] kasan_save_track+0x14/0x30
[ 156.924662][ T7968] kasan_save_free_info+0x3b/0x60
[ 156.929674][ T7968] __kasan_slab_free+0x51/0x70
[ 156.934433][ T7968] kfree+0x2b4/0x4d0
[ 156.938337][ T7968] vhci_release+0xbb/0xf0
[ 156.942768][ T7968] __fput+0x3ff/0xb70
[ 156.946758][ T7968] task_work_run+0x150/0x240
[ 156.951364][ T7968] do_exit+0x864/0x2bd0
[ 156.955541][ T7968] do_group_exit+0xd3/0x2a0
[ 156.960040][ T7968] get_signal+0x2673/0x26d0
[ 156.964571][ T7968] arch_do_signal_or_restart+0x8f/0x790
[ 156.970125][ T7968] exit_to_user_mode_loop+0x84/0x110
[ 156.975420][ T7968] do_syscall_64+0x3f6/0x490
[ 156.980016][ T7968] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 156.985904][ T7968]
[ 156.988232][ T7968] The buggy address belongs to the object at ffff88807615f000
[ 156.988232][ T7968] which belongs to the cache kmalloc-1k of size 1024
[ 157.002291][ T7968] The buggy address is located 0 bytes inside of
[ 157.002291][ T7968] freed 1024-byte region [ffff88807615f000, ffff88807615f400)
[ 157.016016][ T7968]
[ 157.018364][ T7968] The buggy address belongs to the physical page:
[ 157.024865][ T7968] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x76158
[ 157.033643][ T7968] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 157.042132][ T7968] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 157.050128][ T7968] page_type: f5(slab)
[ 157.054109][ T7968] raw: 00fff00000000040 ffff88801b441dc0 0000000000000000 dead000000000001
[ 157.062684][ T7968] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 157.071273][ T7968] head: 00fff00000000040 ffff88801b441dc0 0000000000000000 dead000000000001
[ 157.079951][ T7968] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 157.088704][ T7968] head: 00fff00000000003 ffffea0001d85601 00000000ffffffff 00000000ffffffff
[ 157.097370][ T7968] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 157.106032][ T7968] page dumped because: kasan: bad access detected
[ 157.112619][ T7968] page_owner tracks the page as allocated
[ 157.118320][ T7968] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 3546, tgid 3546 (kworker/u8:9), ts 134307033459, free_ts 126677307077
[ 157.137762][ T7968] post_alloc_hook+0x1c0/0x230
[ 157.142535][ T7968] get_page_from_freelist+0x1321/0x3890
[ 157.148076][ T7968] __alloc_frozen_pages_noprof+0x261/0x23f0
[ 157.153992][ T7968] alloc_pages_mpol+0x1fb/0x550
[ 157.158840][ T7968] new_slab+0x23b/0x330
[ 157.162987][ T7968] ___slab_alloc+0xd9c/0x1940
[ 157.167653][ T7968] __slab_alloc.constprop.0+0x56/0xb0
[ 157.173018][ T7968] __kmalloc_noprof+0x2f2/0x510
[ 157.177863][ T7968] ___neigh_create+0x14e6/0x28c0
[ 157.182794][ T7968] ip6_finish_output2+0x1299/0x2020
[ 157.187988][ T7968] ip6_finish_output+0x3f9/0x1360
[ 157.193008][ T7968] ip6_output+0x1f9/0x540
[ 157.197391][ T7968] ndisc_send_skb+0xa91/0x1e40
[ 157.202146][ T7968] ndisc_send_rs+0x129/0x670
[ 157.206730][ T7968] addrconf_dad_completed+0x49d/0x10d0
[ 157.212189][ T7968] addrconf_dad_work+0x84d/0x14e0
[ 157.217238][ T7968] page last free pid 6282 tgid 6282 stack trace:
[ 157.223559][ T7968] __free_frozen_pages+0x7fe/0x1180
[ 157.228757][ T7968] __folio_put+0x329/0x450
[ 157.233173][ T7968] skb_release_data+0x7fb/0x9c0
[ 157.238026][ T7968] __kfree_skb+0x4f/0x70
[ 157.242298][ T7968] tcp_ack+0x19b2/0x5c90
[ 157.246532][ T7968] tcp_rcv_established+0x53d/0x22e0
[ 157.251732][ T7968] tcp_v4_do_rcv+0x5ca/0xa90
[ 157.256334][ T7968] __release_sock+0x31b/0x400
[ 157.261020][ T7968] __sk_flush_backlog+0x27/0xc0
[ 157.265995][ T7968] tcp_sendmsg_locked+0x399a/0x4300
[ 157.271205][ T7968] tcp_sendmsg+0x2e/0x50
[ 157.275511][ T7968] inet_sendmsg+0xb9/0x140
[ 157.280040][ T7968] sock_write_iter+0x4aa/0x5b0
[ 157.284802][ T7968] vfs_write+0x6c7/0x1150
[ 157.289222][ T7968] ksys_write+0x1f8/0x250
[ 157.293556][ T7968] do_syscall_64+0xcd/0x490
[ 157.298109][ T7968]
[ 157.300432][ T7968] Memory state around the buggy address:
[ 157.306244][ T7968] ffff88807615ef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 157.314310][ T7968] ffff88807615ef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 157.322384][ T7968] >ffff88807615f000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 157.330453][ T7968] ^
[ 157.334544][ T7968] ffff88807615f080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 157.342733][ T7968] ffff88807615f100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 157.350830][ T7968] ==================================================================
[ 157.367991][ T7968] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 157.375241][ T7968] CPU: 0 UID: 0 PID: 7968 Comm: syz.0.616 Not tainted 6.15.0-syzkaller-g7d4e49a77d99 #0 PREEMPT(full)
[ 157.386289][ T7968] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
[ 157.396361][ T7968] Call Trace:
[ 157.399659][ T7968]
[ 157.402633][ T7968] dump_stack_lvl+0x3d/0x1f0
[ 157.407397][ T7968] panic+0x71c/0x800
[ 157.411306][ T7968] ? __pfx_panic+0x10/0x10
[ 157.415828][ T7968] ? mark_held_locks+0x49/0x80
[ 157.420604][ T7968] ? preempt_schedule_thunk+0x16/0x30
[ 157.425998][ T7968] ? force_devcd_write+0x312/0x340
[ 157.431131][ T7968] ? preempt_schedule_common+0x44/0xc0
[ 157.436623][ T7968] ? check_panic_on_warn+0x1f/0xb0
[ 157.441746][ T7968] ? force_devcd_write+0x312/0x340
[ 157.446865][ T7968] check_panic_on_warn+0xab/0xb0
[ 157.451815][ T7968] end_report+0x107/0x170
[ 157.456151][ T7968] kasan_report+0xee/0x110
[ 157.460579][ T7968] ? force_devcd_write+0x312/0x340
[ 157.465721][ T7968] force_devcd_write+0x312/0x340
[ 157.470678][ T7968] ? __pfx_force_devcd_write+0x10/0x10
[ 157.476360][ T7968] ? __debugfs_file_get+0x1fe/0x840
[ 157.481566][ T7968] ? __pfx___debugfs_file_get+0x10/0x10
[ 157.487122][ T7968] full_proxy_write+0x13c/0x200
[ 157.492102][ T7968] ? __pfx_full_proxy_write+0x10/0x10
[ 157.497654][ T7968] vfs_write+0x2a0/0x1150
[ 157.502076][ T7968] ? __pfx___mutex_lock+0x10/0x10
[ 157.507107][ T7968] ? __pfx_vfs_write+0x10/0x10
[ 157.511880][ T7968] ? __fget_files+0x20e/0x3c0
[ 157.516561][ T7968] ksys_write+0x12a/0x250
[ 157.520900][ T7968] ? __pfx_ksys_write+0x10/0x10
[ 157.525785][ T7968] do_syscall_64+0xcd/0x490
[ 157.530296][ T7968] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 157.536198][ T7968] RIP: 0033:0x7faf4c98d169
[ 157.540616][ T7968] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 157.560230][ T7968] RSP: 002b:00007faf4d7f4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 157.568648][ T7968] RAX: ffffffffffffffda RBX: 00007faf4cba5fa0 RCX: 00007faf4c98d169
[ 157.576618][ T7968] RDX: 000000000000000e RSI: 0000000000000000 RDI: 0000000000000003
[ 157.584588][ T7968] RBP: 00007faf4ca0e2a0 R08: 0000000000000000 R09: 0000000000000000
[ 157.592653][ T7968] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 157.600623][ T7968] R13: 0000000000000000 R14: 00007faf4cba5fa0 R15: 00007fff46d1adb8
[ 157.608600][ T7968]
[ 157.611887][ T7968] Kernel Offset: disabled
[ 157.616207][ T7968] Rebooting in 86400 seconds..