[ 34.061953][ T136] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 36.451198][ T136] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 36.490864][ T136] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 36.551613][ T136] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 37.650841][ T136] device hsr_slave_0 left promiscuous mode [ 37.698106][ T136] device hsr_slave_1 left promiscuous mode [ 37.787926][ T136] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 37.789452][ T136] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 37.791588][ T136] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 37.793038][ T136] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 37.794874][ T136] device bridge_slave_1 left promiscuous mode [ 37.796383][ T136] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.839129][ T136] device bridge_slave_0 left promiscuous mode [ 37.840576][ T136] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.988083][ T136] device veth1_macvtap left promiscuous mode [ 37.989299][ T136] device veth0_macvtap left promiscuous mode [ 37.990443][ T136] device veth1_vlan left promiscuous mode [ 37.991634][ T136] device veth0_vlan left promiscuous mode [ 38.075718][ T136] team0 (unregistering): Port device team_slave_1 removed [ 38.081657][ T136] team0 (unregistering): Port device team_slave_0 removed [ 38.085831][ T136] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 38.121283][ T136] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 38.251393][ T136] bond0 (unregistering): Released all slaves Warning: Permanently added '10.128.1.57' (ED25519) to the list of known hosts. 1970/01/01 00:00:38 ignoring optional flag "type"="gce" 1970/01/01 00:00:38 parsed 1 programs [ 38.678244][ T4247] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS 1970/01/01 00:00:38 executed programs: 0 [ 38.741498][ T4253] chnl_net:caif_netlink_parms(): no params data found [ 38.759637][ T4253] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.761177][ T4253] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.763033][ T4253] device bridge_slave_0 entered promiscuous mode [ 38.765272][ T4253] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.766855][ T4253] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.770568][ T4253] device bridge_slave_1 entered promiscuous mode [ 38.778209][ T4253] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.780960][ T4253] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.789634][ T4253] team0: Port device team_slave_0 added [ 38.791625][ T4253] team0: Port device team_slave_1 added [ 38.799085][ T4253] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.800427][ T4253] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 38.805868][ T4253] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.808883][ T4253] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.810243][ T4253] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 38.815172][ T4253] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.868865][ T4253] device hsr_slave_0 entered promiscuous mode [ 38.928094][ T4253] device hsr_slave_1 entered promiscuous mode [ 39.524463][ T4253] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 39.559667][ T4253] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 39.589362][ T4253] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 39.629695][ T4253] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 39.694135][ T4253] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.699887][ T561] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 39.701694][ T561] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 39.704630][ T4253] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.707384][ T561] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 39.709837][ T561] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 39.711903][ T561] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.713290][ T561] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.715325][ T561] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 39.725228][ T4253] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 39.727348][ T4253] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 39.730781][ T561] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 39.732843][ T561] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 39.734655][ T561] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.736170][ T561] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.739255][ T561] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 39.741291][ T561] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 39.743172][ T561] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 39.745336][ T561] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 39.747245][ T561] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 39.749386][ T561] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 39.752397][ T561] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 39.754472][ T561] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 39.756361][ T561] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 39.758854][ T561] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 39.778824][ T561] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 39.780603][ T561] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 39.833994][ T4253] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.838396][ T346] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 39.839970][ T346] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 39.848838][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 39.850688][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 39.852456][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 39.854336][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 39.856622][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 39.859340][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 39.861547][ T4253] device veth0_vlan entered promiscuous mode [ 39.864661][ T4253] device veth1_vlan entered promiscuous mode [ 39.873621][ T1636] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 39.875361][ T1636] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 39.877106][ T1636] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 39.879286][ T1636] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 39.882233][ T4253] device veth0_macvtap entered promiscuous mode [ 39.884897][ T4253] device veth1_macvtap entered promiscuous mode [ 39.891142][ T4253] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.892767][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 39.894535][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 39.896211][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 39.898765][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 39.902230][ T4253] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.904495][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 39.906442][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 39.910204][ T4253] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.911996][ T4253] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.913833][ T4253] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.915769][ T4253] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.958770][ T4376] loop0: detected capacity change from 0 to 4096 [ 39.968821][ T4376] ================================================================== [ 39.970404][ T4376] BUG: KASAN: use-after-free in ntfs_attr_find+0x610/0xa14 [ 39.971920][ T4376] Read of size 2 at addr ffff0000e2d2b442 by task syz-executor.0/4376 [ 39.973639][ T4376] [ 39.974117][ T4376] CPU: 1 PID: 4376 Comm: syz-executor.0 Not tainted syzkaller #0 [ 39.975614][ T4376] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 39.977388][ T4376] Call trace: [ 39.977990][ T4376] dump_backtrace+0x0/0x458 [ 39.978969][ T4376] show_stack+0x2c/0x3c [ 39.979831][ T4376] __dump_stack+0x30/0x40 [ 39.980737][ T4376] dump_stack_lvl+0xf4/0x15c [ 39.981684][ T4376] print_address_description+0x78/0x30c [ 39.982792][ T4376] kasan_report+0xec/0x158 [ 39.983682][ T4376] __asan_report_load_n_noabort+0x40/0x4c [ 39.984844][ T4376] ntfs_attr_find+0x610/0xa14 [ 39.985773][ T4376] ntfs_attr_lookup+0x1c0/0x1b94 [ 39.986774][ T4376] ntfs_read_locked_inode+0x8b4/0x3a70 [ 39.987920][ T4376] ntfs_iget+0x100/0x19c [ 39.988793][ T4376] load_system_files+0xc4/0x4398 [ 39.989787][ T4376] ntfs_fill_super+0x15a0/0x2450 [ 39.990787][ T4376] mount_bdev+0x264/0x35c [ 39.991742][ T4376] ntfs_mount+0x44/0x58 [ 39.992606][ T4376] legacy_get_tree+0xd8/0x174 [ 39.993577][ T4376] vfs_get_tree+0x90/0x278 [ 39.994445][ T4376] do_new_mount+0x228/0x804 [ 39.995394][ T4376] path_mount+0x57c/0xfe8 [ 39.996264][ T4376] __arm64_sys_mount+0x488/0x5f8 [ 39.997383][ T4376] invoke_syscall+0x98/0x28c [ 39.998352][ T4376] el0_svc_common+0x13c/0x258 [ 39.999299][ T4376] do_el0_svc+0x5c/0x140 [ 40.000173][ T4376] el0_svc+0x78/0x1d4 [ 40.000973][ T4376] el0t_64_sync_handler+0xcc/0xe4 [ 40.002183][ T4376] el0t_64_sync+0x1a0/0x1a4 [ 40.003173][ T4376] [ 40.003683][ T4376] The buggy address belongs to the page: [ 40.004917][ T4376] page:000000004a61dab2 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x122d2b [ 40.007119][ T4376] flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) [ 40.008755][ T4376] raw: 05ffc00000000000 fffffc00038b4b08 ffff0001a0e44520 0000000000000000 [ 40.010493][ T4376] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 40.012274][ T4376] page dumped because: kasan: bad access detected [ 40.013562][ T4376] [ 40.014066][ T4376] Memory state around the buggy address: [ 40.015291][ T4376] ffff0000e2d2b300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 40.017037][ T4376] ffff0000e2d2b380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 40.018741][ T4376] >ffff0000e2d2b400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 40.020353][ T4376] ^ [ 40.021627][ T4376] ffff0000e2d2b480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 40.023140][ T4376] ffff0000e2d2b500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 40.024732][ T4376] ================================================================== [ 40.026243][ T4376] Disabling lock debugging due to kernel taint [ 40.028802][ T4376] ntfs: (device loop0): ntfs_attr_find(): Inode is corrupt. Run chkdsk. [ 40.030705][ T4376] ntfs: (device loop0): ntfs_read_locked_inode(): Failed to lookup attribute list attribute. [ 40.032618][ T4376] ntfs: (device loop0): ntfs_read_locked_inode(): Failed with error code -5. Marking corrupt inode 0x1 as bad. Run chkdsk. [ 40.035088][ T4376] ntfs: (device loop0): load_system_files(): Failed to load $MFTMirr. Will not be able to remount read-write. Run ntfsfix and/or chkdsk. [ 40.038701][ T4376] ntfs: (device loop0): map_mft_record_page(): Mft record 0xa is corrupt. Run chkdsk. [ 40.040414][ T4376] ntfs: (device loop0): map_mft_record(): Failed with error code 5. [ 40.042157][ T4376] ntfs: (device loop0): ntfs_read_locked_inode(): Failed with error code -5. Marking corrupt inode 0xa as bad. Run chkdsk. [ 40.044781][ T4376] ntfs: (device loop0): load_and_init_upcase(): Failed to load $UpCase from the volume. Using default. [ 40.047778][ T4376] attempt to access beyond end of device [ 40.047778][ T4376] loop0: rw=0, want=32770, limit=4096 [ 40.050589][ T4376] ntfs: (device loop0): ntfs_end_buffer_async_read(): Buffer I/O error, logical block 0x4000. [ 40.052516][ T4376] attempt to access beyond end of device [ 40.052516][ T4376] loop0: rw=0, want=32772, limit=4096 [ 40.054743][ T4376] ntfs: (device loop0): ntfs_end_buffer_async_read(): Buffer I/O error, logical block 0x4001. [ 40.056801][ T4376] attempt to access beyond end of device [ 40.056801][ T4376] loop0: rw=0, want=32774, limit=4096 [ 40.133992][ T4402] loop0: detected capacity change from 0 to 4096 [ 40.173811][ T4402] attempt to access beyond end of device [ 40.173811][ T4402] loop0: rw=0, want=32770, limit=4096 [ 40.175970][ T4402] attempt to access beyond end of device [ 40.175970][ T4402] loop0: rw=0, want=32772, limit=4096 [ 40.179615][ T4402] attempt to access beyond end of device [ 40.179615][ T4402] loop0: rw=0, want=32774, limit=4096 [ 40.241000][ T4415] loop0: detected capacity change from 0 to 4096 [ 40.244528][ T4415] attempt to access beyond end of device [ 40.244528][ T4415] loop0: rw=0, want=32770, limit=4096 [ 40.246911][ T4415] attempt to access beyond end of device [ 40.246911][ T4415] loop0: rw=0, want=32772, limit=4096 [ 40.249737][ T4415] attempt to access beyond end of device [ 40.249737][ T4415] loop0: rw=0, want=32774, limit=4096 [ 40.299464][ T4428] loop0: detected capacity change from 0 to 4096 [ 40.342649][ T4428] attempt to access beyond end of device [ 40.342649][ T4428] loop0: rw=0, want=32770, limit=4096 [ 40.405027][ T4449] loop0: detected capacity change from 0 to 4096 [ 40.544523][ T4476] loop0: detected capacity change from 0 to 4096 [ 40.738235][ T1540] Bluetooth: hci0: command 0x0409 tx timeout [ 40.755501][ T4479] loop0: detected capacity change from 0 to 4096 [ 40.849095][ T4481] loop0: detected capacity change from 0 to 4096 [ 40.889027][ T4483] loop0: detected capacity change from 0 to 4096 [ 40.938993][ T4485] loop0: detected capacity change from 0 to 4096 [ 42.827894][ T7] Bluetooth: hci0: command 0x041b tx timeout 1970/01/01 00:00:43 executed programs: 35 [ 44.897898][ T1540] Bluetooth: hci0: command 0x040f tx timeout [ 44.989114][ T4560] set_capacity_and_notify: 34 callbacks suppressed [ 44.989123][ T4560] loop0: detected capacity change from 0 to 4096 [ 45.059381][ T4562] loop0: detected capacity change from 0 to 4096 [ 45.063312][ T4562] __ntfs_error: 575 callbacks suppressed [ 45.063320][ T4562] ntfs: (device loop0): ntfs_attr_find(): Inode is corrupt. Run chkdsk. [ 45.066393][ T4562] ntfs: (device loop0): ntfs_read_locked_inode(): Failed to lookup attribute list attribute. [ 45.068857][ T4562] ntfs: (device loop0): ntfs_read_locked_inode(): Failed with error code -5. Marking corrupt inode 0x1 as bad. Run chkdsk. [ 45.071492][ T4562] ntfs: (device loop0): load_system_files(): Failed to load $MFTMirr. Will not be able to remount read-write. Run ntfsfix and/or chkdsk. [ 45.074289][ T4562] ntfs: (device loop0): map_mft_record_page(): Mft record 0xa is corrupt. Run chkdsk. [ 45.076302][ T4562] ntfs: (device loop0): map_mft_record(): Failed with error code 5. [ 45.078389][ T4562] ntfs: (device loop0): ntfs_read_locked_inode(): Failed with error code -5. Marking corrupt inode 0xa as bad. Run chkdsk. [ 45.080918][ T4562] ntfs: (device loop0): load_and_init_upcase(): Failed to load $UpCase from the volume. Using default. [ 45.083301][ T4562] handle_bad_sector: 125 callbacks suppressed [ 45.083307][ T4562] attempt to access beyond end of device [ 45.083307][ T4562] loop0: rw=0, want=32770, limit=4096 [ 45.086574][ T4562] ntfs: (device loop0): ntfs_end_buffer_async_read(): Buffer I/O error, logical block 0x4000. [ 45.088804][ T4562] attempt to access beyond end of device [ 45.088804][ T4562] loop0: rw=0, want=32772, limit=4096 [ 45.090869][ T4562] ntfs: (device loop0): ntfs_end_buffer_async_read(): Buffer I/O error, logical block 0x4001. [ 45.092833][ T4562] attempt to access beyond end of device [ 45.092833][ T4562] loop0: rw=0, want=32774, limit=4096 [ 45.139030][ T4564] loop0: detected capacity change from 0 to 4096 [ 45.143799][ T4564] attempt to access beyond end of device [ 45.143799][ T4564] loop0: rw=0, want=32770, limit=4096 [ 45.145784][ T4564] attempt to access beyond end of device [ 45.145784][ T4564] loop0: rw=0, want=32772, limit=4096 [ 45.147843][ T4564] attempt to access beyond end of device [ 45.147843][ T4564] loop0: rw=0, want=32774, limit=4096 [ 45.208842][ T4566] loop0: detected capacity change from 0 to 4096 [ 45.253404][ T4566] attempt to access beyond end of device [ 45.253404][ T4566] loop0: rw=0, want=32770, limit=4096 [ 45.255718][ T4566] attempt to access beyond end of device [ 45.255718][ T4566] loop0: rw=0, want=32772, limit=4096 [ 45.258050][ T4566] attempt to access beyond end of device [ 45.258050][ T4566] loop0: rw=0, want=32774, limit=4096 [ 45.299391][ T4568] loop0: detected capacity change from 0 to 4096 [ 45.303925][ T4568] attempt to access beyond end of device [ 45.303925][ T4568] loop0: rw=0, want=32770, limit=4096 [ 45.358903][ T4570] loop0: detected capacity change from 0 to 4096 [ 45.438753][ T4572] loop0: detected capacity change from 0 to 4096 [ 45.588902][ T4574] loop0: detected capacity change from 0 to 4096 [ 45.709365][ T4576] loop0: detected capacity change from 0 to 4096 [ 45.838575][ T4578] loop0: detected capacity change from 0 to 4096 [ 46.977887][ T1540] Bluetooth: hci0: command 0x0419 tx timeout 1970/01/01 00:00:48 executed programs: 81