Warning: Permanently added '10.128.1.93' (ED25519) to the list of known hosts. 1970/01/01 00:01:03 parsed 1 programs [ 64.494509][ T9] cfg80211: failed to load regulatory.db [ 64.494541][ T2413] ieee802154 phy0 wpan0: encryption failed: -22 [ 64.494622][ T2413] ieee802154 phy1 wpan1: encryption failed: -22 [ 65.171584][ T6866] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 69.540825][ T6885] chnl_net:caif_netlink_parms(): no params data found [ 69.582685][ T6885] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.582753][ T6885] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.582808][ T6885] bridge_slave_0: entered allmulticast mode [ 69.583212][ T6885] bridge_slave_0: entered promiscuous mode [ 69.584690][ T6885] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.584706][ T6885] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.584753][ T6885] bridge_slave_1: entered allmulticast mode [ 69.585155][ T6885] bridge_slave_1: entered promiscuous mode [ 69.600835][ T6885] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.603745][ T6885] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.610249][ T6885] team0: Port device team_slave_0 added [ 69.610918][ T6885] team0: Port device team_slave_1 added [ 69.627403][ T6885] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.627432][ T6885] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.628452][ T6885] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.629284][ T6885] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.629292][ T6885] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.629304][ T6885] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.651756][ T6885] hsr_slave_0: entered promiscuous mode [ 69.652026][ T6885] hsr_slave_1: entered promiscuous mode [ 70.012995][ T6885] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 70.015569][ T6885] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 70.017940][ T6885] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 70.020526][ T6885] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 70.031027][ T6885] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.031074][ T6885] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.031153][ T6885] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.031182][ T6885] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.050976][ T6885] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.055838][ T15] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.057162][ T15] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.060908][ T6885] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.062882][ T15] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.062913][ T15] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.068336][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.068511][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.121377][ T6885] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 70.135364][ T6885] veth0_vlan: entered promiscuous mode [ 70.138204][ T6885] veth1_vlan: entered promiscuous mode [ 70.147192][ T6885] veth0_macvtap: entered promiscuous mode [ 70.149323][ T6885] veth1_macvtap: entered promiscuous mode [ 70.156352][ T6885] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.160782][ T6885] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.168495][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.168539][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.168560][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.168575][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.342353][ T15] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 70.373252][ T15] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 70.437596][ T15] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 70.476219][ T15] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 70.949583][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.949615][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.961362][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.961393][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.134766][ T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 71.135086][ T52] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 71.135237][ T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 71.135527][ T52] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 71.135712][ T52] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 1970/01/01 00:01:11 executed programs: 0 [ 71.349045][ T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 71.349509][ T52] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 71.349702][ T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 71.349977][ T52] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 71.350150][ T52] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 71.399354][ T7133] chnl_net:caif_netlink_parms(): no params data found [ 71.417862][ T7133] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.419211][ T7133] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.420564][ T7133] bridge_slave_0: entered allmulticast mode [ 71.422392][ T7133] bridge_slave_0: entered promiscuous mode [ 71.425172][ T7133] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.426446][ T7133] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.427779][ T7133] bridge_slave_1: entered allmulticast mode [ 71.429222][ T7133] bridge_slave_1: entered promiscuous mode [ 71.438112][ T7133] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 71.439059][ T7133] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 71.446172][ T7133] team0: Port device team_slave_0 added [ 71.446925][ T7133] team0: Port device team_slave_1 added [ 71.453244][ T7133] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.453504][ T7133] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 71.453531][ T7133] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.454524][ T7133] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.454533][ T7133] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 71.454543][ T7133] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.474190][ T7133] hsr_slave_0: entered promiscuous mode [ 71.474519][ T7133] hsr_slave_1: entered promiscuous mode [ 71.474705][ T7133] debugfs: 'hsr0' already exists in 'hsr' [ 71.474716][ T7133] Cannot create hsr debugfs directory [ 73.369303][ T15] bridge_slave_1: left allmulticast mode [ 73.369338][ T15] bridge_slave_1: left promiscuous mode [ 73.369428][ T15] bridge0: port 2(bridge_slave_1) entered disabled state [ 73.373839][ T6118] Bluetooth: hci0: command tx timeout [ 73.375388][ T15] bridge_slave_0: left allmulticast mode [ 73.375997][ T15] bridge_slave_0: left promiscuous mode [ 73.376097][ T15] bridge0: port 1(bridge_slave_0) entered disabled state [ 73.497314][ T15] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 73.534496][ T15] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 73.554147][ T15] bond0 (unregistering): Released all slaves [ 73.656677][ T15] hsr_slave_0: left promiscuous mode [ 73.657759][ T15] hsr_slave_1: left promiscuous mode [ 73.657965][ T15] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 73.657976][ T15] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 73.658281][ T15] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 73.658290][ T15] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 73.662196][ T15] veth1_macvtap: left promiscuous mode [ 73.662226][ T15] veth0_macvtap: left promiscuous mode [ 73.662413][ T15] veth1_vlan: left promiscuous mode [ 73.662450][ T15] veth0_vlan: left promiscuous mode [ 73.774568][ T15] team0 (unregistering): Port device team_slave_1 removed [ 73.780711][ T15] team0 (unregistering): Port device team_slave_0 removed [ 74.005458][ T7133] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 74.007616][ T7133] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 74.009544][ T7133] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 74.011546][ T7133] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 74.034586][ T7133] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.039136][ T7133] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.040505][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.040535][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.042488][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.042516][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.058418][ T7133] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 74.058460][ T7133] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 74.109648][ T7133] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.120047][ T7133] veth0_vlan: entered promiscuous mode [ 74.121545][ T7133] veth1_vlan: entered promiscuous mode [ 74.127868][ T7133] veth0_macvtap: entered promiscuous mode [ 74.128784][ T7133] veth1_macvtap: entered promiscuous mode [ 74.132595][ T7133] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.134133][ T7133] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.135418][ T2094] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.135483][ T2094] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.135502][ T2094] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.135573][ T2094] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.157555][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.157579][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.292141][ T2094] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.292167][ T2094] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.573546][ T9] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 74.736968][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 74.738466][ T9] usb 1-1: New USB device found, idVendor=eb1a, idProduct=e303, bcdDevice=fc.a0 [ 74.738481][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 74.738491][ T9] usb 1-1: Product: syz [ 74.738496][ T9] usb 1-1: Manufacturer: syz [ 74.738501][ T9] usb 1-1: SerialNumber: syz [ 74.740168][ T9] usb 1-1: config 0 descriptor?? [ 74.742024][ T9] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (eb1a:e303, interface 0, class 0) [ 74.742038][ T9] em28xx 1-1:0.0: Video interface 0 found: [ 75.003563][ T9] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 75.100552][ T9] em28xx 1-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 75.100586][ T9] em28xx 1-1:0.0: board has no eeprom [ 75.153365][ T9] em28xx 1-1:0.0: Identified as Kaiomy TVnPC U2 (card=63) [ 75.153399][ T9] em28xx 1-1:0.0: analog set to bulk mode. [ 75.154233][ T6130] em28xx 1-1:0.0: Registering V4L2 extension [ 75.165631][ T9] usb 1-1: USB disconnect, device number 2 [ 75.166146][ T9] em28xx 1-1:0.0: Disconnecting em28xx [ 75.183458][ T6130] i2c i2c-1: Invalid 7-bit I2C address 0x00 [ 75.192795][ T6130] tuner: 1-0061: Tuner -1 found with type(s) Radio TV. [ 75.195482][ T6130] xc2028 1-0061: creating new instance [ 75.195509][ T6130] xc2028 1-0061: type set to XCeive xc2028/xc3028 tuner [ 75.196419][ T6130] em28xx 1-1:0.0: Config register raw data: 0xffffffed [ 75.196464][ T6130] em28xx 1-1:0.0: AC97 chip type couldn't be determined [ 75.196480][ T6130] em28xx 1-1:0.0: No AC97 audio processor [ 75.198259][ T6130] em28xx 1-1:0.0: Registered radio device as radio2 [ 75.198276][ T6130] usb 1-1: Decoder not found [ 75.198282][ T6130] em28xx 1-1:0.0: failed to create media graph [ 75.198296][ T6130] em28xx 1-1:0.0: V4L2 device radio2 deregistered [ 75.198884][ T6130] em28xx 1-1:0.0: V4L2 device video11 deregistered [ 75.199722][ T6130] xc2028 1-0061: ** replaying previous printk message ** [ 75.199722][ T6130] xc2028 1-0061: destroying instance [ 75.200136][ T6130] em28xx 1-1:0.0: Registering input extension [ 75.200373][ T9] em28xx 1-1:0.0: Closing input extension [ 75.202466][ T9] em28xx 1-1:0.0: Freeing device [ 75.207764][ T6130] usb 1-1:0.0: Direct firmware load for xc3028-v27.fw failed with error -2 [ 75.207777][ T6130] usb 1-1:0.0: Falling back to sysfs fallback for: xc3028-v27.fw [ 75.207814][ T6130] kobject: kobject_add_internal failed for firmware (error: -2 parent: 1-1:0.0) [ 75.207830][ T6130] firmware xc3028-v27.fw: fw_load_sysfs_fallback: device_register failed [ 75.207861][ T6130] ================================================================== [ 75.207866][ T6130] BUG: KASAN: slab-use-after-free in load_firmware_cb+0xbc/0x14f4 [ 75.207881][ T6130] Read of size 8 at addr ffff0000d542e318 by task kworker/0:2/6130 [ 75.207888][ T6130] [ 75.207892][ T6130] CPU: 0 UID: 0 PID: 6130 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT [ 75.207899][ T6130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 [ 75.207903][ T6130] Workqueue: events request_firmware_work_func [ 75.207914][ T6130] Call trace: [ 75.207916][ T6130] show_stack+0x2c/0x3c (C) [ 75.207925][ T6130] __dump_stack+0x30/0x40 [ 75.207930][ T6130] dump_stack_lvl+0xd8/0x12c [ 75.207935][ T6130] print_address_description+0xa8/0x238 [ 75.207942][ T6130] print_report+0x68/0x84 [ 75.207949][ T6130] kasan_report+0xb0/0x110 [ 75.207956][ T6130] __asan_report_load8_noabort+0x20/0x2c [ 75.207962][ T6130] load_firmware_cb+0xbc/0x14f4 [ 75.207967][ T6130] request_firmware_work_func+0xe8/0x19c [ 75.207973][ T6130] process_one_work+0x7e8/0x155c [ 75.207978][ T6130] worker_thread+0x958/0xed8 [ 75.207983][ T6130] kthread+0x5fc/0x75c [ 75.207989][ T6130] ret_from_fork+0x10/0x20 [ 75.207995][ T6130] [ 75.207997][ T6130] Allocated by task 6130: [ 75.208000][ T6130] kasan_save_track+0x40/0x78 [ 75.208006][ T6130] kasan_save_alloc_info+0x44/0x54 [ 75.208010][ T6130] __kasan_kmalloc+0x9c/0xb4 [ 75.208015][ T6130] __kmalloc_cache_noprof+0x2a4/0x3fc [ 75.208022][ T6130] tuner_probe+0xc4/0x1690 [ 75.208026][ T6130] i2c_device_probe+0x82c/0x9a0 [ 75.208032][ T6130] really_probe+0x3b4/0x944 [ 75.208039][ T6130] __driver_probe_device+0x180/0x2d4 [ 75.208045][ T6130] driver_probe_device+0x78/0x330 [ 75.208050][ T6130] __device_attach_driver+0x290/0x4e0 [ 75.208056][ T6130] bus_for_each_drv+0x220/0x2b4 [ 75.208061][ T6130] __device_attach+0x26c/0x388 [ 75.208067][ T6130] device_initial_probe+0x24/0x34 [ 75.208072][ T6130] bus_probe_device+0x178/0x240 [ 75.208077][ T6130] device_add+0x71c/0xa60 [ 75.208081][ T6130] device_register+0x28/0x38 [ 75.208085][ T6130] i2c_new_client_device+0x834/0xe9c [ 75.208091][ T6130] v4l2_i2c_new_subdev_board+0xb0/0x224 [ 75.208097][ T6130] v4l2_i2c_new_subdev+0x138/0x1c0 [ 75.208102][ T6130] em28xx_v4l2_init+0x6f4/0x2918 [ 75.208108][ T6130] em28xx_init_extension+0x10c/0x1b4 [ 75.208114][ T6130] request_module_async+0x68/0x98 [ 75.208119][ T6130] process_one_work+0x7e8/0x155c [ 75.208123][ T6130] worker_thread+0x958/0xed8 [ 75.208127][ T6130] kthread+0x5fc/0x75c [ 75.208132][ T6130] ret_from_fork+0x10/0x20 [ 75.208137][ T6130] [ 75.208138][ T6130] Freed by task 6130: [ 75.208141][ T6130] kasan_save_track+0x40/0x78 [ 75.208146][ T6130] kasan_save_free_info+0x58/0x70 [ 75.208150][ T6130] __kasan_slab_free+0x74/0x98 [ 75.208155][ T6130] kfree+0x17c/0x474 [ 75.208160][ T6130] tuner_remove+0x1d8/0x1f4 [ 75.208164][ T6130] i2c_device_remove+0x8c/0x1dc [ 75.208170][ T6130] device_release_driver_internal+0x3a8/0x68c [ 75.208176][ T6130] device_release_driver+0x28/0x38 [ 75.208182][ T6130] bus_remove_device+0x310/0x3b0 [ 75.208187][ T6130] device_del+0x47c/0x808 [ 75.208191][ T6130] device_unregister+0x2c/0xcc [ 75.208195][ T6130] i2c_unregister_device+0x1ac/0x208 [ 75.208201][ T6130] v4l2_i2c_subdev_unregister+0x68/0x78 [ 75.208206][ T6130] v4l2_device_unregister+0x170/0x248 [ 75.208212][ T6130] em28xx_v4l2_init+0x1328/0x2918 [ 75.208217][ T6130] em28xx_init_extension+0x10c/0x1b4 [ 75.208223][ T6130] request_module_async+0x68/0x98 [ 75.208228][ T6130] process_one_work+0x7e8/0x155c [ 75.208232][ T6130] worker_thread+0x958/0xed8 [ 75.208236][ T6130] kthread+0x5fc/0x75c [ 75.208241][ T6130] ret_from_fork+0x10/0x20 [ 75.208246][ T6130] [ 75.208247][ T6130] The buggy address belongs to the object at ffff0000d542e000 [ 75.208247][ T6130] which belongs to the cache kmalloc-2k of size 2048 [ 75.208252][ T6130] The buggy address is located 792 bytes inside of [ 75.208252][ T6130] freed 2048-byte region [ffff0000d542e000, ffff0000d542e800) [ 75.208257][ T6130] [ 75.208259][ T6130] The buggy address belongs to the physical page: [ 75.208262][ T6130] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115428 [ 75.208268][ T6130] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 75.208272][ T6130] flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 75.208278][ T6130] page_type: f5(slab) [ 75.208283][ T6130] raw: 05ffc00000000040 ffff0000c0002000 dead000000000122 0000000000000000 [ 75.208288][ T6130] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 75.208292][ T6130] head: 05ffc00000000040 ffff0000c0002000 dead000000000122 0000000000000000 [ 75.208296][ T6130] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 75.208300][ T6130] head: 05ffc00000000003 fffffdffc3550a01 00000000ffffffff 00000000ffffffff [ 75.208304][ T6130] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 75.208306][ T6130] page dumped because: kasan: bad access detected [ 75.208309][ T6130] [ 75.208310][ T6130] Memory state around the buggy address: [ 75.208313][ T6130] ffff0000d542e200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 75.208316][ T6130] ffff0000d542e280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 75.208319][ T6130] >ffff0000d542e300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 75.208322][ T6130] ^ [ 75.208325][ T6130] ffff0000d542e380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 75.208328][ T6130] ffff0000d542e400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 75.208330][ T6130] ================================================================== [ 75.208334][ T6130] Disabling lock debugging due to kernel taint [ 75.208343][ T6130] Unable to handle kernel paging request at virtual address dfff800000000005 [ 75.208347][ T6130] KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] [ 75.208350][ T6130] Mem abort info: [ 75.208353][ T6130] ESR = 0x0000000096000005 [ 75.208356][ T6130] EC = 0x25: DABT (current EL), IL = 32 bits [ 75.208360][ T6130] SET = 0, FnV = 0 [ 75.208362][ T6130] EA = 0, S1PTW = 0 [ 75.208365][ T6130] FSC = 0x05: level 1 translation fault [ 75.208369][ T6130] Data abort info: [ 75.208371][ T6130] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 75.208374][ T6130] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 75.208377][ T6130] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 75.208381][ T6130] [dfff800000000005] address between user and kernel address ranges [ 75.208386][ T6130] Internal error: Oops: 0000000096000005 [#1] SMP [ 75.304636][ T6130] Modules linked in: [ 75.305229][ T6130] CPU: 0 UID: 0 PID: 6130 Comm: kworker/0:2 Tainted: G B syzkaller #0 PREEMPT [ 75.306798][ T6130] Tainted: [B]=BAD_PAGE [ 75.307486][ T6130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 [ 75.309064][ T6130] Workqueue: events request_firmware_work_func [ 75.309990][ T6130] pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 75.311158][ T6130] pc : load_firmware_cb+0x22c/0x14f4 [ 75.311935][ T6130] lr : load_firmware_cb+0xe0/0x14f4 [ 75.312678][ T6130] sp : ffff8000a0417880 [ 75.313264][ T6130] x29: ffff8000a04179d0 x28: 1ffff00011efc299 x27: 0000000000000000 [ 75.314434][ T6130] x26: dfff800000000000 x25: ffff700014082f24 x24: 1fffe0001aa85c63 [ 75.315625][ T6130] x23: ffff8000a0417920 x22: 0000000000000000 x21: 0000000000000000 [ 75.316799][ T6130] x20: 0000000000000000 x19: ffff0000d542e318 x18: 00000000ffffffff [ 75.318018][ T6130] x17: 3d3d3d3d3d3d3d3d x16: ffff80008b00ff28 x15: 0000000000000001 [ 75.319319][ T6130] x14: 1ffff000126110fc x13: 0000000000000000 x12: 0000000000000000 [ 75.320543][ T6130] x11: ffff7000126110fd x10: 0000000000ff0100 x9 : 0000000000000000 [ 75.321806][ T6130] x8 : 0000000000000005 x7 : 0000000000000001 x6 : ffff800080563d2c [ 75.323065][ T6130] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000803c0884 [ 75.324318][ T6130] x2 : 0000000000000001 x1 : 0000000000000000 x0 : 0000000000000028 [ 75.325672][ T6130] Call trace: [ 75.326200][ T6130] load_firmware_cb+0x22c/0x14f4 (P) [ 75.327053][ T6130] request_firmware_work_func+0xe8/0x19c [ 75.327925][ T6130] process_one_work+0x7e8/0x155c [ 75.328749][ T6130] worker_thread+0x958/0xed8 [ 75.329482][ T6130] kthread+0x5fc/0x75c [ 75.330154][ T6130] ret_from_fork+0x10/0x20 [ 75.330876][ T6130] Code: b5fff65b f9403bf6 9100a2c0 d343fc08 (387a6908) [ 75.331968][ T6130] ---[ end trace 0000000000000000 ]--- [ 75.623744][ T6130] Kernel panic - not syncing: Oops: Fatal exception [ 75.624638][ T6130] SMP: stopping secondary CPUs [ 75.625312][ T6130] Kernel Offset: disabled [ 75.625965][ T6130] CPU features: 0x080000,0000f000,21381141,5427fea7 [ 75.626974][ T6130] Memory Limit: none [ 75.867722][ T6130] Rebooting in 86400 seconds..