[ 9.590982][ T3993] eql: remember to turn off Van-Jacobson compression on your slave devices Starting crond: [ 9.620607][ T9] gvnic 0000:00:00.0 enp0s0: Device link is up. [ 9.625292][ T1609] IPv6: ADDRCONF(NETDEV_CHANGE): enp0s0: link becomes ready OK Starting sshd: OK syzkaller Warning: Permanently added '10.128.10.21' (ED25519) to the list of known hosts. 1970/01/01 00:00:30 parsed 1 programs 1970/01/01 00:00:30 serving rpc on tcp://40203 syzkaller login: [ 32.007587][ T4340] cgroup: Unknown subsys name 'net' [ 32.287631][ T4340] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 32.564457][ T4340] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 37.620201][ T4387] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 37.621722][ T4387] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 37.623056][ T4387] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 37.624602][ T4387] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 37.626713][ T4387] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 37.628114][ T4387] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 37.888597][ T4397] chnl_net:caif_netlink_parms(): no params data found [ 37.918277][ T4397] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.919632][ T4397] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.921378][ T4397] device bridge_slave_0 entered promiscuous mode [ 37.924275][ T4397] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.926812][ T4397] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.928358][ T4397] device bridge_slave_1 entered promiscuous mode [ 37.936783][ T4397] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.939437][ T4397] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 37.946664][ T4397] team0: Port device team_slave_0 added [ 37.948527][ T4397] team0: Port device team_slave_1 added [ 37.954545][ T4397] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 37.956465][ T4397] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.960854][ T4397] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 37.964158][ T4397] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 37.966047][ T4397] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.970727][ T4397] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.026453][ T4397] device hsr_slave_0 entered promiscuous mode [ 38.075208][ T4397] device hsr_slave_1 entered promiscuous mode [ 38.167890][ T4397] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 38.217024][ T4397] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 38.258149][ T4397] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 38.307840][ T4397] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 38.377543][ T4397] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.382838][ T4397] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.384101][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 38.387742][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 38.392765][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 38.394844][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 38.396989][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.398303][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.400130][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 38.403243][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 38.408491][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 38.410104][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.411319][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.422216][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 38.427975][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 38.429988][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 38.432154][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 38.433795][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 38.435733][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 38.438345][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 38.440866][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 38.442581][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 38.446238][ T4420] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 38.447800][ T4420] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 38.450393][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 38.514832][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 38.516435][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 38.520249][ T4397] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.525874][ T4420] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 38.527461][ T4420] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 38.532699][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 38.534390][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 38.536898][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 38.538479][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 38.551367][ T4397] device veth0_vlan entered promiscuous mode [ 38.554557][ T4397] device veth1_vlan entered promiscuous mode [ 38.562138][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 38.563819][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 38.567231][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 38.568986][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 38.571521][ T4397] device veth0_macvtap entered promiscuous mode [ 38.574396][ T4397] device veth1_macvtap entered promiscuous mode [ 38.586734][ T4397] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 38.588131][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 38.589834][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 38.591343][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 38.592796][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 38.596218][ T4397] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 38.597783][ T4420] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 38.599411][ T4420] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 38.602011][ T4397] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.603506][ T4397] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.605536][ T4397] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.607086][ T4397] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.188937][ T4420] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.190495][ T4420] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.193494][ T4420] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 39.200027][ T4420] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.201401][ T4420] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.202788][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 39.636872][ T1609] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 1970/01/01 00:00:39 executed programs: 0 [ 39.903015][ T48] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 39.904577][ T48] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 39.908988][ T48] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 39.910855][ T48] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 39.912366][ T48] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 39.913753][ T48] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 39.961189][ T4446] chnl_net:caif_netlink_parms(): no params data found [ 39.976553][ T4446] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.977923][ T4446] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.979601][ T4446] device bridge_slave_0 entered promiscuous mode [ 39.981578][ T4446] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.982845][ T4446] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.984594][ T4446] device bridge_slave_1 entered promiscuous mode [ 39.991074][ T4446] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 39.993345][ T4446] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 40.001153][ T4446] team0: Port device team_slave_0 added [ 40.003154][ T4446] team0: Port device team_slave_1 added [ 40.008565][ T4446] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 40.009894][ T4446] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 40.014016][ T4446] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 40.017096][ T4446] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 40.018186][ T4446] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 40.022505][ T4446] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 40.066101][ T4446] device hsr_slave_0 entered promiscuous mode [ 40.105436][ T4446] device hsr_slave_1 entered promiscuous mode [ 40.155453][ T4446] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 40.156855][ T4446] Cannot create hsr debugfs directory [ 41.676470][ T1609] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.945104][ T48] Bluetooth: hci0: command 0x0409 tx timeout [ 44.025408][ T48] Bluetooth: hci0: command 0x041b tx timeout [ 44.326793][ T1609] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.407182][ T1609] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 45.447156][ T4446] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 45.536799][ T4446] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 45.586379][ T4446] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 45.676695][ T4446] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 45.786378][ T4446] 8021q: adding VLAN 0 to HW filter on device bond0 [ 45.790181][ T4420] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 45.791854][ T4420] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 45.794367][ T4446] 8021q: adding VLAN 0 to HW filter on device team0 [ 45.828385][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 45.830104][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 45.831738][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.832920][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 45.834709][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 45.838279][ T4420] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 45.839810][ T4420] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 45.841248][ T4420] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.842443][ T4420] bridge0: port 2(bridge_slave_1) entered forwarding state [ 45.844809][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 45.848889][ T4420] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 45.851476][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 45.853313][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 45.855137][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 45.857812][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 45.859840][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 45.862822][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 45.864357][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 45.868669][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 45.870161][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 45.872584][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 45.983673][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 45.985092][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 45.988738][ T4446] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 45.994287][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 45.997149][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 46.003240][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 46.004808][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 46.007159][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 46.008605][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 46.011254][ T4446] device veth0_vlan entered promiscuous mode [ 46.014400][ T4446] device veth1_vlan entered promiscuous mode [ 46.021928][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 46.023562][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 46.025532][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 46.027095][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 46.029632][ T4446] device veth0_macvtap entered promiscuous mode [ 46.031968][ T4446] device veth1_macvtap entered promiscuous mode [ 46.105095][ T48] Bluetooth: hci0: command 0x040f tx timeout [ 46.370171][ T4446] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 46.371873][ T4446] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 46.374032][ T4446] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 46.377090][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 46.378806][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 46.380451][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 46.382132][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 46.386034][ T4446] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 46.387921][ T4446] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 46.390173][ T4446] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 46.391409][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 46.393230][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 46.397259][ T4446] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 46.398825][ T4446] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 46.400389][ T4446] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 46.401902][ T4446] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 46.451276][ T4420] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 46.452772][ T4420] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 46.454743][ T4420] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 46.462985][ T4420] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 46.464333][ T4420] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 46.737322][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 46.796097][ T4536] FAULT_INJECTION: forcing a failure. [ 46.796097][ T4536] name failslab, interval 1, probability 0, space 0, times 1 [ 46.798218][ T4536] CPU: 1 PID: 4536 Comm: syz.0.17 Not tainted syzkaller #0 [ 46.799332][ T4536] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 46.800946][ T4536] Call trace: [ 46.801483][ T4536] dump_backtrace+0x1c4/0x1f0 [ 46.802267][ T4536] show_stack+0x2c/0x3c [ 46.803004][ T4536] __dump_stack+0x30/0x40 [ 46.803855][ T4536] dump_stack_lvl+0xf4/0x15c [ 46.804703][ T4536] dump_stack+0x1c/0x5c [ 46.805403][ T4536] should_fail_ex+0x3cc/0x524 [ 46.806289][ T4536] __should_failslab+0xc0/0x11c [ 46.807196][ T4536] should_failslab+0x10/0x28 [ 46.808005][ T4536] __kmem_cache_alloc_node+0x7c/0x318 [ 46.808937][ T4536] kmalloc_trace+0x48/0x94 [ 46.809796][ T4536] nvmet_fc_alloc_ls_iodlist+0x290/0x7ec [ 46.810797][ T4536] nvmet_fc_register_targetport+0x5d0/0x818 [ 46.811796][ T4536] fcloop_create_target_port+0x120/0x420 [ 46.812762][ T4536] dev_attr_store+0x6c/0x90 [ 46.813531][ T4536] sysfs_kf_write+0x1f8/0x274 [ 46.814360][ T4536] kernfs_fop_write_iter+0x390/0x4b4 [ 46.815268][ T4536] vfs_write+0x3c8/0x7c8 [ 46.816026][ T4536] ksys_write+0x12c/0x228 [ 46.816768][ T4536] __arm64_sys_write+0x7c/0x90 [ 46.817676][ T4536] invoke_syscall+0x98/0x290 [ 46.818465][ T4536] el0_svc_common+0x13c/0x258 [ 46.819260][ T4536] do_el0_svc+0x5c/0x134 [ 46.819981][ T4536] el0_svc+0x58/0x128 [ 46.820670][ T4536] el0t_64_sync_handler+0x84/0xf0 [ 46.821556][ T4536] el0t_64_sync+0x18c/0x190 [ 46.822950][ T4536] ------------[ cut here ]------------ [ 46.823951][ T4536] WARNING: CPU: 1 PID: 4536 at mm/slab_common.c:904 free_large_kmalloc+0x30/0x158 [ 46.825618][ T4536] Modules linked in: [ 46.826373][ T4536] CPU: 1 PID: 4536 Comm: syz.0.17 Not tainted syzkaller #0 [ 46.827752][ T4536] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 46.829599][ T4536] pstate: 42400005 (nZcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 46.830973][ T4536] pc : free_large_kmalloc+0x30/0x158 [ 46.831827][ T4536] lr : kfree+0xf4/0x1a8 [ 46.832541][ T4536] sp : ffff8000210577b0 [ 46.833329][ T4536] x29: ffff8000210577b0 x28: dead000000000100 x27: dfff800000000000 [ 46.834859][ T4536] x26: ffff0000d584ec38 x25: 0000000000000000 x24: ffff0000d584ec98 [ 46.836298][ T4536] x23: ffff0000ef9a0000 x22: ffff0000ef9a0000 x21: 0000000000040000 [ 46.837744][ T4536] x20: ffff0000ef99ff20 x19: fffffc0003be67c0 x18: 0000000000000000 [ 46.839277][ T4536] x17: 0000000000000000 x16: ffff800011b90080 x15: 0000000000000000 [ 46.840919][ T4536] x14: 0000000000000001 x13: 1ffff00002ac6fce x12: 0000000000000000 [ 46.842364][ T4536] x11: ff0080000808d058 x10: dead0000000000ff x9 : dead000000000100 [ 46.843774][ T4536] x8 : ffff800017d5d000 x7 : 0000000000000001 x6 : 0000000000000001 [ 46.845185][ T4536] x5 : 00000000ffffffff x4 : 0000000000000dc0 x3 : 0000000000000dc0 [ 46.846612][ T4536] x2 : ffff0000ef9a0010 x1 : ffff0000ef99ff20 x0 : fffffc0003be67c0 [ 46.848033][ T4536] Call trace: [ 46.848578][ T4536] free_large_kmalloc+0x30/0x158 [ 46.849466][ T4536] kfree+0xf4/0x1a8 [ 46.850118][ T4536] nvmet_fc_alloc_ls_iodlist+0x7c4/0x7ec [ 46.851109][ T4536] nvmet_fc_register_targetport+0x5d0/0x818 [ 46.852140][ T4536] fcloop_create_target_port+0x120/0x420 [ 46.853112][ T4536] dev_attr_store+0x6c/0x90 [ 46.853949][ T4536] sysfs_kf_write+0x1f8/0x274 [ 46.854774][ T4536] kernfs_fop_write_iter+0x390/0x4b4 [ 46.855778][ T4536] vfs_write+0x3c8/0x7c8 [ 46.856526][ T4536] ksys_write+0x12c/0x228 [ 46.857241][ T4536] __arm64_sys_write+0x7c/0x90 [ 46.857996][ T4536] invoke_syscall+0x98/0x290 [ 46.858772][ T4536] el0_svc_common+0x13c/0x258 [ 46.859617][ T4536] do_el0_svc+0x5c/0x134 [ 46.860348][ T4536] el0_svc+0x58/0x128 [ 46.861029][ T4536] el0t_64_sync_handler+0x84/0xf0 [ 46.861888][ T4536] el0t_64_sync+0x18c/0x190 [ 46.862634][ T4536] irq event stamp: 790 [ 46.863414][ T4536] hardirqs last enabled at (789): [] exit_to_kernel_mode+0xcc/0xfc [ 46.865068][ T4536] hardirqs last disabled at (790): [] el1_dbg+0x24/0x80 [ 46.866627][ T4536] softirqs last enabled at (784): [] handle_softirqs+0xb1c/0xc90 [ 46.868206][ T4536] softirqs last disabled at (731): [] __do_softirq+0x14/0x20 [ 46.869812][ T4536] ---[ end trace 0000000000000000 ]--- [ 46.871877][ T4536] object pointer: 0x00000000b337638b [ 46.872872][ T4536] ================================================================== [ 46.874292][ T4536] BUG: KASAN: invalid-free in kfree+0xf4/0x1a8 [ 46.875319][ T4536] Free of addr ffff0000ef99ff20 by task syz.0.17/4536 [ 46.876545][ T4536] [ 46.876964][ T4536] CPU: 0 PID: 4536 Comm: syz.0.17 Tainted: G W syzkaller #0 [ 46.878437][ T4536] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 46.880152][ T4536] Call trace: [ 46.880825][ T4536] dump_backtrace+0x1c4/0x1f0 [ 46.881672][ T4536] show_stack+0x2c/0x3c [ 46.882438][ T4536] __dump_stack+0x30/0x40 [ 46.883330][ T4536] dump_stack_lvl+0xf4/0x15c [ 46.884192][ T4536] print_address_description+0x88/0x218 [ 46.885232][ T4536] print_report+0x50/0x68 [ 46.885964][ T4536] kasan_report_invalid_free+0x98/0xe4 [ 46.886875][ T4536] __kasan_kfree_large+0xa4/0xc0 [ 46.887746][ T4536] free_large_kmalloc+0x68/0x158 [ 46.888608][ T4536] kfree+0xf4/0x1a8 [ 46.889258][ T4536] nvmet_fc_alloc_ls_iodlist+0x7c4/0x7ec [ 46.890229][ T4536] nvmet_fc_register_targetport+0x5d0/0x818 [ 46.891224][ T4536] fcloop_create_target_port+0x120/0x420 [ 46.892266][ T4536] dev_attr_store+0x6c/0x90 [ 46.892987][ T4536] sysfs_kf_write+0x1f8/0x274 [ 46.893761][ T4536] kernfs_fop_write_iter+0x390/0x4b4 [ 46.894638][ T4536] vfs_write+0x3c8/0x7c8 [ 46.895331][ T4536] ksys_write+0x12c/0x228 [ 46.896068][ T4536] __arm64_sys_write+0x7c/0x90 [ 46.896871][ T4536] invoke_syscall+0x98/0x290 [ 46.897611][ T4536] el0_svc_common+0x13c/0x258 [ 46.898404][ T4536] do_el0_svc+0x5c/0x134 [ 46.899091][ T4536] el0_svc+0x58/0x128 [ 46.899772][ T4536] el0t_64_sync_handler+0x84/0xf0 [ 46.900573][ T4536] el0t_64_sync+0x18c/0x190 [ 46.901330][ T4536] [ 46.901737][ T4536] The buggy address belongs to the physical page: [ 46.902792][ T4536] page:00000000c0cded69 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12f99f [ 46.904534][ T4536] flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) [ 46.905814][ T4536] raw: 05ffc00000000000 dead000000000100 dead000000000122 0000000000000000 [ 46.907162][ T4536] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 46.908610][ T4536] page dumped because: kasan: bad access detected [ 46.909685][ T4536] [ 46.910126][ T4536] Memory state around the buggy address: [ 46.911068][ T4536] ffff0000ef99fe00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 46.912440][ T4536] ffff0000ef99fe80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 46.913734][ T4536] >ffff0000ef99ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 46.914994][ T4536] ^ [ 46.915923][ T4536] ffff0000ef99ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 46.917306][ T4536] ffff0000ef9a0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 46.918618][ T4536] ================================================================== [ 46.924949][ T4536] Disabling lock debugging due to kernel taint [ 46.926165][ T4536] page:00000000c0cded69 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12f99f [ 46.928110][ T4536] flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) [ 46.929454][ T4536] raw: 05ffc00000000000 dead000000000100 dead000000000122 0000000000000000 [ 46.930870][ T4536] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 46.930876][ T1609] device hsr_slave_0 left promiscuous mode [ 46.932293][ T4536] page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0) [ 46.934698][ T4536] ------------[ cut here ]------------ [ 46.935741][ T4536] kernel BUG at include/linux/mm.h:780! [ 46.936730][ T4536] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP [ 46.938109][ T4536] Modules linked in: [ 46.938925][ T4536] CPU: 1 PID: 4536 Comm: syz.0.17 Tainted: G B W syzkaller #0 [ 46.940679][ T4536] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 46.942624][ T4536] pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 46.943970][ T4536] pc : __free_pages+0x160/0x1cc [ 46.944785][ T4536] lr : __free_pages+0x160/0x1cc [ 46.945571][ T4536] sp : ffff800021057770 [ 46.946263][ T4536] x29: ffff800021057770 x28: dead000000000100 x27: dfff800000000000 [ 46.947757][ T4536] x26: ffff0000d584ec38 x25: 0000000000000000 x24: ffff0000d584ec98 [ 46.949355][ T4536] x23: dfff800000000000 x22: 05ffc00000000000 x21: fffffc0003be67f4 [ 46.950815][ T4536] x20: 0000000000000000 x19: fffffc0003be67c0 x18: 1fffe00033e7697e [ 46.952359][ T4536] x17: 0000000000000000 x16: ffff800011b90080 x15: 0000000000000000 [ 46.953864][ T4536] x14: 0000000000000001 x13: 1fffe00033e769a3 x12: 0000000000000000 [ 46.955308][ T4536] x11: ff008000087c9780 x10: 0000000000000000 x9 : ffff8000087c9780 [ 46.956780][ T4536] x8 : ffff0000d51a9c00 x7 : 0000000000000001 x6 : 0000000000000001 [ 46.958219][ T4536] x5 : ffff8000210571b8 x4 : ffff800015464e80 x3 : ffff800008540904 [ 46.959664][ T4536] x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000003e [ 46.961118][ T4536] Call trace: [ 46.961674][ T4536] __free_pages+0x160/0x1cc [ 46.962480][ T4536] free_large_kmalloc+0xc8/0x158 [ 46.963329][ T4536] kfree+0xf4/0x1a8 [ 46.963949][ T4536] nvmet_fc_alloc_ls_iodlist+0x7c4/0x7ec [ 46.964953][ T4536] nvmet_fc_register_targetport+0x5d0/0x818 [ 46.966016][ T4536] fcloop_create_target_port+0x120/0x420 [ 46.966972][ T4536] dev_attr_store+0x6c/0x90 [ 46.967761][ T4536] sysfs_kf_write+0x1f8/0x274 [ 46.968592][ T4536] kernfs_fop_write_iter+0x390/0x4b4 [ 46.969517][ T4536] vfs_write+0x3c8/0x7c8 [ 46.970219][ T4536] ksys_write+0x12c/0x228 [ 46.970972][ T4536] __arm64_sys_write+0x7c/0x90 [ 46.971921][ T4536] invoke_syscall+0x98/0x290 [ 46.972811][ T4536] el0_svc_common+0x13c/0x258 [ 46.973631][ T4536] do_el0_svc+0x5c/0x134 [ 46.974363][ T4536] el0_svc+0x58/0x128 [ 46.975067][ T4536] el0t_64_sync_handler+0x84/0xf0 [ 46.975940][ T4536] el0t_64_sync+0x18c/0x190 [ 46.976752][ T4536] Code: d004a9c1 91328021 aa1303e0 97fdfec8 (d4210000) [ 46.977924][ T4536] ---[ end trace 0000000000000000 ]--- [ 47.185502][ T4536] Kernel panic - not syncing: Oops - BUG: Fatal exception [ 47.186766][ T4536] SMP: stopping secondary CPUs [ 47.187607][ T4536] Kernel Offset: disabled [ 47.188328][ T4536] CPU features: 0x0a0000,000f0097,a65bfea7 [ 47.189336][ T4536] Memory Limit: none [ 47.383150][ T4536] Rebooting in 86400 seconds..