Warning: Permanently added '10.128.0.104' (ED25519) to the list of known hosts. 2025/08/17 16:46:41 ignoring optional flag "sandboxArg"="0" 2025/08/17 16:46:42 parsed 1 programs [ 124.357607][ T6177] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 128.475763][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 128.484594][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 128.516189][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 128.524564][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 129.180788][ T6231] chnl_net:caif_netlink_parms(): no params data found [ 129.290222][ T6231] bridge0: port 1(bridge_slave_0) entered blocking state [ 129.297410][ T6231] bridge0: port 1(bridge_slave_0) entered disabled state [ 129.305611][ T6231] bridge_slave_0: entered allmulticast mode [ 129.312956][ T6231] bridge_slave_0: entered promiscuous mode [ 129.331781][ T6231] bridge0: port 2(bridge_slave_1) entered blocking state [ 129.338968][ T6231] bridge0: port 2(bridge_slave_1) entered disabled state [ 129.346104][ T6231] bridge_slave_1: entered allmulticast mode [ 129.353323][ T6231] bridge_slave_1: entered promiscuous mode [ 129.383997][ T6231] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 129.396804][ T6231] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 129.440649][ T6231] team0: Port device team_slave_0 added [ 129.450486][ T6231] team0: Port device team_slave_1 added [ 129.486129][ T6231] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 129.493249][ T6231] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 129.519303][ T6231] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 129.531846][ T6231] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 129.539165][ T6231] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 129.566189][ T6231] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 129.611060][ T6231] hsr_slave_0: entered promiscuous mode [ 129.617413][ T6231] hsr_slave_1: entered promiscuous mode [ 130.145372][ T6231] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 130.164583][ T6231] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 130.180415][ T6231] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 130.195951][ T6231] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 130.311000][ T6231] 8021q: adding VLAN 0 to HW filter on device bond0 [ 130.341934][ T6231] 8021q: adding VLAN 0 to HW filter on device team0 [ 130.356634][ T1041] bridge0: port 1(bridge_slave_0) entered blocking state [ 130.364377][ T1041] bridge0: port 1(bridge_slave_0) entered forwarding state [ 130.383371][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 130.390664][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 130.647020][ T6231] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 130.705955][ T6231] veth0_vlan: entered promiscuous mode [ 130.723792][ T6231] veth1_vlan: entered promiscuous mode [ 130.761627][ T6231] veth0_macvtap: entered promiscuous mode [ 130.775819][ T6231] veth1_macvtap: entered promiscuous mode [ 130.805904][ T6231] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 130.829713][ T6231] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 130.850743][ T49] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.861919][ T49] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.877645][ T49] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.896857][ T49] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 131.052582][ T49] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 131.072806][ T5181] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 131.087714][ T5181] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 131.101532][ T5181] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 131.114191][ T5181] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 131.124260][ T5181] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 131.170998][ T49] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 131.255014][ T49] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 131.331586][ T49] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 132.884262][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.891794][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 2025/08/17 16:46:55 executed programs: 0 [ 133.317544][ T5181] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 133.326922][ T5181] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 133.337751][ T5181] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 133.345931][ T5181] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 133.355034][ T5181] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 133.528079][ T49] bridge_slave_1: left allmulticast mode [ 133.536226][ T49] bridge_slave_1: left promiscuous mode [ 133.542464][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 133.553526][ T49] bridge_slave_0: left allmulticast mode [ 133.559621][ T49] bridge_slave_0: left promiscuous mode [ 133.565418][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 133.925379][ T49] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 133.937780][ T49] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 133.949336][ T49] bond0 (unregistering): Released all slaves [ 134.094664][ T49] hsr_slave_0: left promiscuous mode [ 134.100899][ T49] hsr_slave_1: left promiscuous mode [ 134.107164][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 134.119220][ T49] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 134.127932][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 134.135436][ T49] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 134.155307][ T49] veth1_macvtap: left promiscuous mode [ 134.161607][ T49] veth0_macvtap: left promiscuous mode [ 134.167406][ T49] veth1_vlan: left promiscuous mode [ 134.173309][ T49] veth0_vlan: left promiscuous mode [ 134.660334][ T49] team0 (unregistering): Port device team_slave_1 removed [ 134.697959][ T49] team0 (unregistering): Port device team_slave_0 removed [ 135.177818][ T6362] chnl_net:caif_netlink_parms(): no params data found [ 135.300164][ T6362] bridge0: port 1(bridge_slave_0) entered blocking state [ 135.308162][ T6362] bridge0: port 1(bridge_slave_0) entered disabled state [ 135.317328][ T6362] bridge_slave_0: entered allmulticast mode [ 135.326342][ T6362] bridge_slave_0: entered promiscuous mode [ 135.335819][ T6362] bridge0: port 2(bridge_slave_1) entered blocking state [ 135.343433][ T6362] bridge0: port 2(bridge_slave_1) entered disabled state [ 135.351023][ T6362] bridge_slave_1: entered allmulticast mode [ 135.359542][ T6362] bridge_slave_1: entered promiscuous mode [ 135.401580][ T6362] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 135.414423][ T6362] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 135.447549][ T5921] Bluetooth: hci0: command tx timeout [ 135.475208][ T6362] team0: Port device team_slave_0 added [ 135.484180][ T6362] team0: Port device team_slave_1 added [ 135.527854][ T6362] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 135.535956][ T6362] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 135.567924][ T6362] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 135.582275][ T6362] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 135.589692][ T6362] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 135.616913][ T6362] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 135.924437][ T6362] hsr_slave_0: entered promiscuous mode [ 135.945175][ T6362] hsr_slave_1: entered promiscuous mode [ 136.630374][ T6362] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 136.647395][ T6362] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 136.659601][ T6362] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 136.670877][ T6362] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 136.762835][ T6362] 8021q: adding VLAN 0 to HW filter on device bond0 [ 136.782314][ T6362] 8021q: adding VLAN 0 to HW filter on device team0 [ 136.794076][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 136.801272][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 136.815340][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 136.822637][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 136.980746][ T6362] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 137.018004][ T6362] veth0_vlan: entered promiscuous mode [ 137.031249][ T6362] veth1_vlan: entered promiscuous mode [ 137.059261][ T6362] veth0_macvtap: entered promiscuous mode [ 137.068201][ T6362] veth1_macvtap: entered promiscuous mode [ 137.086779][ T6362] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 137.101907][ T6362] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 137.115999][ T1041] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.125174][ T1041] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.145881][ T1041] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.155293][ T1041] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.206880][ T1041] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 137.218738][ T1041] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 137.242626][ T1041] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 137.251195][ T1041] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 137.528555][ T5921] Bluetooth: hci0: command tx timeout 2025/08/17 16:47:00 executed programs: 31 [ 138.480499][ T2153] hid-generic 0005:0C45:1011.0001: reserved main item tag 0xe [ 138.490026][ T2153] hid-generic 0005:0C45:1011.0001: unknown main item tag 0x0 [ 138.497562][ T2153] hid-generic 0005:0C45:1011.0001: unknown main item tag 0x0 [ 138.511903][ T2153] hid-generic 0005:0C45:1011.0001: unknown main item tag 0x0 [ 138.522115][ T2153] hid-generic 0005:0C45:1011.0001: unknown main item tag 0x0 [ 138.531038][ T2153] hid-generic 0005:0C45:1011.0001: unknown main item tag 0x0 [ 138.538981][ T2153] hid-generic 0005:0C45:1011.0001: unknown main item tag 0x0 [ 138.546500][ T2153] hid-generic 0005:0C45:1011.0001: unknown main item tag 0x0 [ 138.563076][ T2153] hid-generic 0005:0C45:1011.0001: unknown main item tag 0x0 [ 138.572154][ T2153] hid-generic 0005:0C45:1011.0001: unknown main item tag 0x0 [ 138.583079][ T2153] hid-generic 0005:0C45:1011.0001: unknown main item tag 0x0 [ 139.605312][ T5921] Bluetooth: hci0: command tx timeout [ 139.892205][ T2153] hid-generic 0005:0C45:1011.0001: hidraw0: BLUETOOTH HID v0.07 Device [syz0] on aa:aa:aa:aa:aa:aa [ 141.683005][ T5921] Bluetooth: hci0: command tx timeout 2025/08/17 16:47:05 executed programs: 238 [ 146.487387][ T5960] hid-generic 0005:0C45:1011.0002: reserved main item tag 0xe [ 146.495057][ T5960] hid_parser_main: 64892 callbacks suppressed [ 146.495076][ T5960] hid-generic 0005:0C45:1011.0002: unknown main item tag 0x0 [ 146.508894][ T5960] hid-generic 0005:0C45:1011.0002: unknown main item tag 0x0 [ 146.516314][ T5960] hid-generic 0005:0C45:1011.0002: unknown main item tag 0x0 [ 146.524179][ T5960] hid-generic 0005:0C45:1011.0002: unknown main item tag 0x0 [ 146.532046][ T5960] hid-generic 0005:0C45:1011.0002: unknown main item tag 0x0 [ 146.539898][ T5960] hid-generic 0005:0C45:1011.0002: unknown main item tag 0x0 [ 146.547318][ T5960] hid-generic 0005:0C45:1011.0002: unknown main item tag 0x0 [ 146.555409][ T5960] hid-generic 0005:0C45:1011.0002: unknown main item tag 0x0 [ 146.563147][ T5960] hid-generic 0005:0C45:1011.0002: unknown main item tag 0x0 [ 146.571255][ T5960] hid-generic 0005:0C45:1011.0002: unknown main item tag 0x0 [ 147.366877][ T5960] hid-generic 0005:0C45:1011.0002: hidraw0: BLUETOOTH HID v0.07 Device [syz0] on aa:aa:aa:aa:aa:aa 2025/08/17 16:47:10 executed programs: 483 [ 150.719177][ T5181] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 150.727946][ T5181] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 150.740069][ T5181] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 150.753909][ T5181] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 150.762607][ T5181] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 150.919363][ T7667] chnl_net:caif_netlink_parms(): no params data found [ 150.974624][ T1041] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.024004][ T7667] bridge0: port 1(bridge_slave_0) entered blocking state [ 151.031392][ T7667] bridge0: port 1(bridge_slave_0) entered disabled state [ 151.039016][ T7667] bridge_slave_0: entered allmulticast mode [ 151.045998][ T7667] bridge_slave_0: entered promiscuous mode [ 151.062336][ T1041] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.077781][ T7667] bridge0: port 2(bridge_slave_1) entered blocking state [ 151.085355][ T7667] bridge0: port 2(bridge_slave_1) entered disabled state [ 151.092782][ T7667] bridge_slave_1: entered allmulticast mode [ 151.100962][ T7667] bridge_slave_1: entered promiscuous mode [ 151.116714][ T1041] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.163531][ T1041] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.180215][ T7667] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 151.192069][ T7667] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 151.228227][ T7667] team0: Port device team_slave_0 added [ 151.236984][ T7667] team0: Port device team_slave_1 added [ 151.272953][ T7667] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 151.280324][ T7667] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 151.306377][ T7667] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 151.327904][ T7667] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 151.335350][ T7667] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 151.361876][ T7667] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 151.444826][ T7667] hsr_slave_0: entered promiscuous mode [ 151.452025][ T7667] hsr_slave_1: entered promiscuous mode [ 151.458039][ T7667] debugfs: 'hsr0' already exists in 'hsr' [ 151.464092][ T7667] Cannot create hsr debugfs directory [ 151.512737][ T1041] bridge_slave_1: left allmulticast mode [ 151.519549][ T1041] bridge_slave_1: left promiscuous mode [ 151.525437][ T1041] bridge0: port 2(bridge_slave_1) entered disabled state [ 151.536188][ T1041] bridge_slave_0: left allmulticast mode [ 151.542379][ T1041] bridge_slave_0: left promiscuous mode [ 151.548185][ T1041] bridge0: port 1(bridge_slave_0) entered disabled state [ 151.930015][ T1041] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 151.943032][ T1041] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 151.953494][ T1041] bond0 (unregistering): Released all slaves [ 152.292969][ T1041] hsr_slave_0: left promiscuous mode [ 152.300740][ T1041] hsr_slave_1: left promiscuous mode [ 152.306831][ T1041] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 152.315336][ T1041] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 152.325311][ T1041] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 152.334690][ T1041] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 152.364917][ T1041] veth1_macvtap: left promiscuous mode [ 152.370710][ T1041] veth0_macvtap: left promiscuous mode [ 152.376409][ T1041] veth1_vlan: left promiscuous mode [ 152.383770][ T1041] veth0_vlan: left promiscuous mode [ 152.765803][ T1041] team0 (unregistering): Port device team_slave_1 removed [ 152.792996][ T1041] team0 (unregistering): Port device team_slave_0 removed [ 152.800371][ T5921] Bluetooth: hci1: command tx timeout [ 153.293147][ T7667] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 153.304938][ T7667] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 153.317147][ T7667] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 153.335750][ T7667] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 153.463239][ T7667] 8021q: adding VLAN 0 to HW filter on device bond0 [ 153.491942][ T7667] 8021q: adding VLAN 0 to HW filter on device team0 [ 153.510015][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 153.517197][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 153.535680][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 153.542902][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 153.804811][ T7667] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 153.861855][ T7667] veth0_vlan: entered promiscuous mode [ 153.874963][ T7667] veth1_vlan: entered promiscuous mode [ 153.922850][ T7667] veth0_macvtap: entered promiscuous mode [ 153.936563][ T7667] veth1_macvtap: entered promiscuous mode [ 153.960695][ T7667] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 153.978100][ T7667] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 153.996062][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 154.008093][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 154.037058][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 154.057995][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 154.132737][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 154.147686][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 2025/08/17 16:47:16 executed programs: 602 [ 154.186013][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 154.194349][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 154.878676][ T5921] Bluetooth: hci1: command tx timeout [ 155.051028][ T24] hid-generic 0005:0C45:1011.0003: reserved main item tag 0xe [ 155.058940][ T24] hid_parser_main: 64892 callbacks suppressed [ 155.058959][ T24] hid-generic 0005:0C45:1011.0003: unknown main item tag 0x0 [ 155.074007][ T24] hid-generic 0005:0C45:1011.0003: unknown main item tag 0x0 [ 155.082055][ T24] hid-generic 0005:0C45:1011.0003: unknown main item tag 0x0 [ 155.091471][ T24] hid-generic 0005:0C45:1011.0003: unknown main item tag 0x0 [ 155.099502][ T24] hid-generic 0005:0C45:1011.0003: unknown main item tag 0x0 [ 155.106962][ T24] hid-generic 0005:0C45:1011.0003: unknown main item tag 0x0 [ 155.116050][ T24] hid-generic 0005:0C45:1011.0003: unknown main item tag 0x0 [ 155.128312][ T24] hid-generic 0005:0C45:1011.0003: unknown main item tag 0x0 [ 155.136933][ T24] hid-generic 0005:0C45:1011.0003: unknown main item tag 0x0 [ 155.144731][ T24] hid-generic 0005:0C45:1011.0003: unknown main item tag 0x0 [ 155.985690][ T24] hid-generic 0005:0C45:1011.0003: hidraw0: BLUETOOTH HID v0.07 Device [syz0] on aa:aa:aa:aa:aa:aa [ 156.959331][ T5921] Bluetooth: hci1: command tx timeout [ 159.042315][ T5921] Bluetooth: hci1: command tx timeout 2025/08/17 16:47:21 executed programs: 844 [ 163.136949][ T5884] hid-generic 0005:0C45:1011.0004: reserved main item tag 0xe [ 163.145310][ T5884] hid_parser_main: 64892 callbacks suppressed [ 163.145339][ T5884] hid-generic 0005:0C45:1011.0004: unknown main item tag 0x0 [ 163.161304][ T5884] hid-generic 0005:0C45:1011.0004: unknown main item tag 0x0 [ 163.172902][ T5884] hid-generic 0005:0C45:1011.0004: unknown main item tag 0x0 [ 163.181643][ T5884] hid-generic 0005:0C45:1011.0004: unknown main item tag 0x0 [ 163.189544][ T5884] hid-generic 0005:0C45:1011.0004: unknown main item tag 0x0 [ 163.196974][ T5884] hid-generic 0005:0C45:1011.0004: unknown main item tag 0x0 [ 163.205761][ T5884] hid-generic 0005:0C45:1011.0004: unknown main item tag 0x0 [ 163.213572][ T5884] hid-generic 0005:0C45:1011.0004: unknown main item tag 0x0 [ 163.222230][ T5884] hid-generic 0005:0C45:1011.0004: unknown main item tag 0x0 [ 163.231366][ T5884] hid-generic 0005:0C45:1011.0004: unknown main item tag 0x0 [ 164.081451][ T5884] hid-generic 0005:0C45:1011.0004: hidraw0: BLUETOOTH HID v0.07 Device [syz0] on aa:aa:aa:aa:aa:aa 2025/08/17 16:47:26 executed programs: 1089 [ 166.567556][ T5181] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 166.576592][ T5181] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 166.585403][ T5181] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 166.595031][ T5181] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 166.603334][ T5181] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 166.762536][ T8950] chnl_net:caif_netlink_parms(): no params data found [ 166.820131][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 166.869189][ T8950] bridge0: port 1(bridge_slave_0) entered blocking state [ 166.876630][ T8950] bridge0: port 1(bridge_slave_0) entered disabled state [ 166.885806][ T8950] bridge_slave_0: entered allmulticast mode [ 166.893700][ T8950] bridge_slave_0: entered promiscuous mode [ 166.901654][ T8950] bridge0: port 2(bridge_slave_1) entered blocking state [ 166.909604][ T8950] bridge0: port 2(bridge_slave_1) entered disabled state [ 166.916861][ T8950] bridge_slave_1: entered allmulticast mode [ 166.924160][ T8950] bridge_slave_1: entered promiscuous mode [ 166.967085][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 166.984051][ T8950] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 166.995835][ T8950] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 167.026242][ T8950] team0: Port device team_slave_0 added [ 167.033902][ T8950] team0: Port device team_slave_1 added [ 167.063642][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 167.090470][ T8950] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 167.097454][ T8950] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 167.123559][ T8950] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 167.135736][ T8950] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 167.142807][ T8950] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 167.168785][ T8950] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 167.201516][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 167.241863][ T8950] hsr_slave_0: entered promiscuous mode [ 167.248092][ T8950] hsr_slave_1: entered promiscuous mode [ 167.425912][ T12] bridge_slave_1: left allmulticast mode [ 167.432299][ T12] bridge_slave_1: left promiscuous mode [ 167.438026][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 167.447788][ T12] bridge_slave_0: left allmulticast mode [ 167.454998][ T12] bridge_slave_0: left promiscuous mode [ 167.461460][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 167.703665][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 167.714051][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 167.724109][ T12] bond0 (unregistering): Released all slaves [ 168.023221][ T12] hsr_slave_0: left promiscuous mode [ 168.036153][ T12] hsr_slave_1: left promiscuous mode [ 168.046120][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 168.054217][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 168.064179][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 168.071911][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 168.093668][ T12] veth1_macvtap: left promiscuous mode [ 168.102655][ T12] veth0_macvtap: left promiscuous mode [ 168.108348][ T12] veth1_vlan: left promiscuous mode [ 168.120665][ T12] veth0_vlan: left promiscuous mode [ 168.507827][ T12] team0 (unregistering): Port device team_slave_1 removed [ 168.537114][ T12] team0 (unregistering): Port device team_slave_0 removed [ 168.640999][ T5921] Bluetooth: hci0: command tx timeout [ 168.845137][ T8950] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 168.859069][ T8950] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 168.871329][ T8950] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 168.894415][ T8950] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 169.038692][ T8950] 8021q: adding VLAN 0 to HW filter on device bond0 [ 169.065527][ T8950] 8021q: adding VLAN 0 to HW filter on device team0 [ 169.095687][ T1041] bridge0: port 1(bridge_slave_0) entered blocking state [ 169.103433][ T1041] bridge0: port 1(bridge_slave_0) entered forwarding state [ 169.124031][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 169.131254][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 169.403521][ T8950] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 169.461902][ T8950] veth0_vlan: entered promiscuous mode [ 169.473173][ T8950] veth1_vlan: entered promiscuous mode [ 169.502716][ T8950] veth0_macvtap: entered promiscuous mode [ 169.512042][ T8950] veth1_macvtap: entered promiscuous mode [ 169.530417][ T8950] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 169.544329][ T8950] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 169.557209][ T36] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 169.566464][ T36] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 169.577901][ T36] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 169.587981][ T36] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 2025/08/17 16:47:31 executed programs: 1202 [ 169.641710][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 169.655265][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 169.677808][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 169.686513][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 170.535808][ T979] hid-generic 0005:0C45:1011.0005: reserved main item tag 0xe [ 170.544630][ T979] hid_parser_main: 64892 callbacks suppressed [ 170.544651][ T979] hid-generic 0005:0C45:1011.0005: unknown main item tag 0x0 [ 170.558267][ T979] hid-generic 0005:0C45:1011.0005: unknown main item tag 0x0 [ 170.566746][ T979] hid-generic 0005:0C45:1011.0005: unknown main item tag 0x0 [ 170.574307][ T979] hid-generic 0005:0C45:1011.0005: unknown main item tag 0x0 [ 170.582010][ T979] hid-generic 0005:0C45:1011.0005: unknown main item tag 0x0 [ 170.589569][ T979] hid-generic 0005:0C45:1011.0005: unknown main item tag 0x0 [ 170.596991][ T979] hid-generic 0005:0C45:1011.0005: unknown main item tag 0x0 [ 170.604597][ T979] hid-generic 0005:0C45:1011.0005: unknown main item tag 0x0 [ 170.612140][ T979] hid-generic 0005:0C45:1011.0005: unknown main item tag 0x0 [ 170.623410][ T979] hid-generic 0005:0C45:1011.0005: unknown main item tag 0x0 [ 170.721169][ T5921] Bluetooth: hci0: command tx timeout [ 171.485127][ T979] hid-generic 0005:0C45:1011.0005: hidraw0: BLUETOOTH HID v0.07 Device [syz0] on aa:aa:aa:aa:aa:aa [ 172.798528][ T5921] Bluetooth: hci0: command tx timeout 2025/08/17 16:47:36 executed programs: 1442 [ 174.879267][ T5921] Bluetooth: hci0: command tx timeout [ 179.127730][ T5960] hid-generic 0005:0C45:1011.0006: reserved main item tag 0xe [ 179.138166][ T5960] hid_parser_main: 64892 callbacks suppressed [ 179.138185][ T5960] hid-generic 0005:0C45:1011.0006: unknown main item tag 0x0 [ 179.153566][ T5960] hid-generic 0005:0C45:1011.0006: unknown main item tag 0x0 [ 179.161346][ T5960] hid-generic 0005:0C45:1011.0006: unknown main item tag 0x0 [ 179.169270][ T5960] hid-generic 0005:0C45:1011.0006: unknown main item tag 0x0 [ 179.176699][ T5960] hid-generic 0005:0C45:1011.0006: unknown main item tag 0x0 [ 179.184609][ T5960] hid-generic 0005:0C45:1011.0006: unknown main item tag 0x0 [ 179.192679][ T5960] hid-generic 0005:0C45:1011.0006: unknown main item tag 0x0 [ 179.201565][ T5960] hid-generic 0005:0C45:1011.0006: unknown main item tag 0x0 [ 179.209395][ T5960] hid-generic 0005:0C45:1011.0006: unknown main item tag 0x0 [ 179.216831][ T5960] hid-generic 0005:0C45:1011.0006: unknown main item tag 0x0 2025/08/17 16:47:41 executed programs: 1691 [ 180.026275][ T5960] hid-generic 0005:0C45:1011.0006: hidraw0: BLUETOOTH HID v0.07 Device [syz0] on aa:aa:aa:aa:aa:aa [ 181.996950][ T5181] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 182.006937][ T5181] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 182.016122][ T5181] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 182.025872][ T5181] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 182.036900][ T5181] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 182.200112][T10208] chnl_net:caif_netlink_parms(): no params data found [ 182.252044][ T36] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.305365][ T36] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.330280][T10208] bridge0: port 1(bridge_slave_0) entered blocking state [ 182.337438][T10208] bridge0: port 1(bridge_slave_0) entered disabled state [ 182.345069][T10208] bridge_slave_0: entered allmulticast mode [ 182.353787][T10208] bridge_slave_0: entered promiscuous mode [ 182.371486][ T36] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.385939][T10208] bridge0: port 2(bridge_slave_1) entered blocking state [ 182.393393][T10208] bridge0: port 2(bridge_slave_1) entered disabled state [ 182.401090][T10208] bridge_slave_1: entered allmulticast mode [ 182.408123][T10208] bridge_slave_1: entered promiscuous mode [ 182.437330][ T36] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.465691][T10208] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 182.478897][T10208] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 182.516490][T10208] team0: Port device team_slave_0 added [ 182.525621][T10208] team0: Port device team_slave_1 added [ 182.569550][T10208] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 182.576714][T10208] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 182.603189][T10208] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 182.616478][T10208] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 182.623550][T10208] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 182.649896][T10208] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 182.707867][ T36] bridge_slave_1: left allmulticast mode [ 182.714380][ T36] bridge_slave_1: left promiscuous mode [ 182.720592][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 182.730931][ T36] bridge_slave_0: left allmulticast mode [ 182.736600][ T36] bridge_slave_0: left promiscuous mode [ 182.742826][ T36] bridge0: port 1(bridge_slave_0) entered disabled state [ 182.973641][ T36] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 182.984453][ T36] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 182.994903][ T36] bond0 (unregistering): Released all slaves [ 183.061983][T10208] hsr_slave_0: entered promiscuous mode [ 183.069157][T10208] hsr_slave_1: entered promiscuous mode [ 183.075628][T10208] debugfs: 'hsr0' already exists in 'hsr' [ 183.081796][T10208] Cannot create hsr debugfs directory [ 183.319321][ T36] hsr_slave_0: left promiscuous mode [ 183.325964][ T36] hsr_slave_1: left promiscuous mode [ 183.336879][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 183.344412][ T36] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 183.354435][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 183.362181][ T36] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 183.385747][ T36] veth1_macvtap: left promiscuous mode [ 183.394080][ T36] veth0_macvtap: left promiscuous mode [ 183.399855][ T36] veth1_vlan: left promiscuous mode [ 183.405270][ T36] veth0_vlan: left promiscuous mode [ 183.834875][ T36] team0 (unregistering): Port device team_slave_1 removed [ 183.868949][ T36] team0 (unregistering): Port device team_slave_0 removed [ 184.079407][ T5181] Bluetooth: hci1: command tx timeout [ 184.511841][T10208] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 184.524456][T10208] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 184.538217][T10208] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 184.554723][T10208] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 184.675749][T10208] 8021q: adding VLAN 0 to HW filter on device bond0 [ 184.700901][T10208] 8021q: adding VLAN 0 to HW filter on device team0 [ 184.715312][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 184.722554][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 184.736820][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 184.744281][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 184.993088][T10208] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 185.054811][T10208] veth0_vlan: entered promiscuous mode [ 185.073468][T10208] veth1_vlan: entered promiscuous mode [ 185.118071][T10208] veth0_macvtap: entered promiscuous mode [ 185.130088][T10208] veth1_macvtap: entered promiscuous mode [ 185.155224][T10208] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 185.176629][T10208] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 185.195987][ T36] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 185.224035][ T36] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 185.251882][ T36] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 185.261551][ T36] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 185.336150][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 185.357126][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 2025/08/17 16:47:47 executed programs: 1802 [ 185.397960][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 185.407703][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 186.159184][ T5181] Bluetooth: hci1: command tx timeout [ 186.498679][ T6267] hid-generic 0005:0C45:1011.0007: reserved main item tag 0xe [ 186.506951][ T6267] hid_parser_main: 64892 callbacks suppressed [ 186.506969][ T6267] hid-generic 0005:0C45:1011.0007: unknown main item tag 0x0 [ 186.521215][ T6267] hid-generic 0005:0C45:1011.0007: unknown main item tag 0x0 [ 186.528713][ T6267] hid-generic 0005:0C45:1011.0007: unknown main item tag 0x0 [ 186.536201][ T6267] hid-generic 0005:0C45:1011.0007: unknown main item tag 0x0 [ 186.547174][ T6267] hid-generic 0005:0C45:1011.0007: unknown main item tag 0x0 [ 186.555037][ T6267] hid-generic 0005:0C45:1011.0007: unknown main item tag 0x0 [ 186.563488][ T6267] hid-generic 0005:0C45:1011.0007: unknown main item tag 0x0 [ 186.571816][ T6267] hid-generic 0005:0C45:1011.0007: unknown main item tag 0x0 [ 186.580344][ T6267] hid-generic 0005:0C45:1011.0007: unknown main item tag 0x0 [ 186.587868][ T6267] hid-generic 0005:0C45:1011.0007: unknown main item tag 0x0 [ 187.472793][ T6267] hid-generic 0005:0C45:1011.0007: hidraw0: BLUETOOTH HID v0.07 Device [syz0] on aa:aa:aa:aa:aa:aa [ 188.238757][ T5181] Bluetooth: hci1: command tx timeout [ 190.320363][ T5181] Bluetooth: hci1: command tx timeout 2025/08/17 16:47:52 executed programs: 2032 [ 194.322986][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.330139][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.464595][ T5884] hid-generic 0005:0C45:1011.0008: reserved main item tag 0xe [ 194.472920][ T5884] hid_parser_main: 64892 callbacks suppressed [ 194.472940][ T5884] hid-generic 0005:0C45:1011.0008: unknown main item tag 0x0 [ 194.486493][ T5884] hid-generic 0005:0C45:1011.0008: unknown main item tag 0x0 [ 194.495008][ T5884] hid-generic 0005:0C45:1011.0008: unknown main item tag 0x0 [ 194.502793][ T5884] hid-generic 0005:0C45:1011.0008: unknown main item tag 0x0 [ 194.511460][ T5884] hid-generic 0005:0C45:1011.0008: unknown main item tag 0x0 [ 194.520167][ T5884] hid-generic 0005:0C45:1011.0008: unknown main item tag 0x0 [ 194.527605][ T5884] hid-generic 0005:0C45:1011.0008: unknown main item tag 0x0 [ 194.536182][ T5884] hid-generic 0005:0C45:1011.0008: unknown main item tag 0x0 [ 194.543989][ T5884] hid-generic 0005:0C45:1011.0008: unknown main item tag 0x0 [ 194.552508][ T5884] hid-generic 0005:0C45:1011.0008: unknown main item tag 0x0 [ 195.381008][ T5884] hid-generic 0005:0C45:1011.0008: hidraw0: BLUETOOTH HID v0.07 Device [syz0] on aa:aa:aa:aa:aa:aa 2025/08/17 16:47:57 executed programs: 2280 [ 197.960869][ T5921] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 197.975374][ T5921] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 197.978526][T11072] ================================================================== [ 197.990465][T11072] BUG: KASAN: slab-use-after-free in __mutex_lock+0x7fc/0x1360 [ 197.998039][T11072] Read of size 8 at addr ffff888024eac0a0 by task khidpd_0c451011/11072 [ 198.006352][T11072] [ 198.008684][T11072] CPU: 0 UID: 0 PID: 11072 Comm: khidpd_0c451011 Not tainted 6.17.0-rc1-syzkaller-g715c7a36d59f #0 PREEMPT(full) [ 198.008702][T11072] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 198.008718][T11072] Call Trace: [ 198.008725][T11072] [ 198.008733][T11072] dump_stack_lvl+0x189/0x250 [ 198.008752][T11072] ? __kasan_check_byte+0x12/0x40 [ 198.008772][T11072] ? __pfx_dump_stack_lvl+0x10/0x10 [ 198.008787][T11072] ? lock_release+0x4b/0x3e0 [ 198.008812][T11072] ? __virt_addr_valid+0x4a5/0x5c0 [ 198.008829][T11072] print_report+0xca/0x240 [ 198.008842][T11072] ? __mutex_lock+0x7fc/0x1360 [ 198.008859][T11072] kasan_report+0x118/0x150 [ 198.008877][T11072] ? __mutex_lock+0x7fc/0x1360 [ 198.008896][T11072] __mutex_lock+0x7fc/0x1360 [ 198.008913][T11072] ? __mutex_lock+0x5b6/0x1360 [ 198.008932][T11072] ? l2cap_unregister_user+0x6a/0x1b0 [ 198.008948][T11072] ? __pfx___mutex_lock+0x10/0x10 [ 198.008968][T11072] ? __pfx___timer_delete_sync+0x10/0x10 [ 198.008987][T11072] l2cap_unregister_user+0x6a/0x1b0 [ 198.009003][T11072] hidp_session_thread+0x3c9/0x410 [ 198.009020][T11072] ? __pfx_hidp_session_thread+0x10/0x10 [ 198.009034][T11072] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 198.009050][T11072] ? __pfx_hidp_session_wake_function+0x10/0x10 [ 198.009067][T11072] ? __pfx_hidp_session_wake_function+0x10/0x10 [ 198.009082][T11072] ? __kthread_parkme+0x7b/0x200 [ 198.009096][T11072] ? __kthread_parkme+0x1a1/0x200 [ 198.009112][T11072] kthread+0x70e/0x8a0 [ 198.009128][T11072] ? __pfx_hidp_session_thread+0x10/0x10 [ 198.009142][T11072] ? __pfx_kthread+0x10/0x10 [ 198.009157][T11072] ? _raw_spin_unlock_irq+0x23/0x50 [ 198.009172][T11072] ? lockdep_hardirqs_on+0x9c/0x150 [ 198.009188][T11072] ? __pfx_kthread+0x10/0x10 [ 198.009203][T11072] ret_from_fork+0x3f9/0x770 [ 198.009217][T11072] ? __pfx_ret_from_fork+0x10/0x10 [ 198.009232][T11072] ? __switch_to_asm+0x39/0x70 [ 198.009247][T11072] ? __switch_to_asm+0x33/0x70 [ 198.009262][T11072] ? __pfx_kthread+0x10/0x10 [ 198.009277][T11072] ret_from_fork_asm+0x1a/0x30 [ 198.009297][T11072] [ 198.009302][T11072] [ 198.213096][T11072] Allocated by task 10208: [ 198.217498][T11072] kasan_save_track+0x3e/0x80 [ 198.222206][T11072] __kasan_kmalloc+0x93/0xb0 [ 198.226883][T11072] __kmalloc_noprof+0x27a/0x4f0 [ 198.231733][T11072] hci_alloc_dev_priv+0x28/0x2060 [ 198.236761][T11072] vhci_create_device+0x120/0x6e0 [ 198.241784][T11072] vhci_write+0x3ce/0x4a0 [ 198.246101][T11072] vfs_write+0x5c6/0xb30 [ 198.250678][T11072] ksys_write+0x145/0x250 [ 198.254995][T11072] do_syscall_64+0xfa/0x3b0 [ 198.259499][T11072] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 198.265383][T11072] [ 198.267694][T11072] Freed by task 10208: [ 198.271744][T11072] kasan_save_track+0x3e/0x80 [ 198.276416][T11072] kasan_save_free_info+0x46/0x50 [ 198.281427][T11072] __kasan_slab_free+0x5b/0x80 [ 198.286178][T11072] kfree+0x18e/0x440 [ 198.290083][T11072] bt_host_release+0x82/0x90 [ 198.294658][T11072] device_release+0x99/0x1c0 [ 198.299234][T11072] kobject_put+0x22b/0x480 [ 198.303637][T11072] vhci_release+0x88/0xd0 [ 198.307963][T11072] __fput+0x449/0xa70 [ 198.311929][T11072] task_work_run+0x1d4/0x260 [ 198.316504][T11072] do_exit+0x6b5/0x2300 [ 198.320647][T11072] do_group_exit+0x21c/0x2d0 [ 198.325226][T11072] get_signal+0x1286/0x1340 [ 198.329715][T11072] arch_do_signal_or_restart+0x9a/0x750 [ 198.335271][T11072] exit_to_user_mode_loop+0x75/0x110 [ 198.340551][T11072] do_syscall_64+0x2bd/0x3b0 [ 198.345134][T11072] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 198.351016][T11072] [ 198.353327][T11072] Last potentially related work creation: [ 198.359021][T11072] kasan_save_stack+0x3e/0x60 [ 198.363777][T11072] kasan_record_aux_stack+0xbd/0xd0 [ 198.369048][T11072] insert_work+0x3d/0x330 [ 198.373370][T11072] __queue_work+0xbaf/0xfb0 [ 198.377962][T11072] queue_work_on+0x181/0x270 [ 198.382550][T11072] process_scheduled_works+0xade/0x17b0 [ 198.388180][T11072] worker_thread+0x8a0/0xda0 [ 198.392760][T11072] kthread+0x70e/0x8a0 [ 198.396821][T11072] ret_from_fork+0x3f9/0x770 [ 198.401410][T11072] ret_from_fork_asm+0x1a/0x30 [ 198.406170][T11072] [ 198.408487][T11072] Second to last potentially related work creation: [ 198.415151][T11072] kasan_save_stack+0x3e/0x60 [ 198.420025][T11072] kasan_record_aux_stack+0xbd/0xd0 [ 198.425333][T11072] insert_work+0x3d/0x330 [ 198.429665][T11072] __queue_work+0xcd2/0xfb0 [ 198.434591][T11072] call_timer_fn+0x17b/0x5f0 [ 198.439175][T11072] __run_timer_base+0x646/0x860 [ 198.444030][T11072] run_timer_softirq+0xb7/0x180 [ 198.448870][T11072] handle_softirqs+0x283/0x870 [ 198.453622][T11072] __irq_exit_rcu+0xca/0x1f0 [ 198.458196][T11072] irq_exit_rcu+0x9/0x30 [ 198.462422][T11072] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 198.468041][T11072] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 198.474006][T11072] [ 198.476313][T11072] The buggy address belongs to the object at ffff888024eac000 [ 198.476313][T11072] which belongs to the cache kmalloc-8k of size 8192 [ 198.490349][T11072] The buggy address is located 160 bytes inside of [ 198.490349][T11072] freed 8192-byte region [ffff888024eac000, ffff888024eae000) [ 198.504247][T11072] [ 198.506583][T11072] The buggy address belongs to the physical page: [ 198.513010][T11072] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888024ea8000 pfn:0x24ea8 [ 198.523100][T11072] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 198.531628][T11072] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 198.540326][T11072] page_type: f5(slab) [ 198.544306][T11072] raw: 00fff00000000240 ffff88801a442280 ffffea0001e74e10 ffffea0001e52610 [ 198.552872][T11072] raw: ffff888024ea8000 0000000000020001 00000000f5000000 0000000000000000 [ 198.561451][T11072] head: 00fff00000000240 ffff88801a442280 ffffea0001e74e10 ffffea0001e52610 [ 198.570126][T11072] head: ffff888024ea8000 0000000000020001 00000000f5000000 0000000000000000 [ 198.579527][T11072] head: 00fff00000000003 ffffea000093aa01 00000000ffffffff 00000000ffffffff [ 198.588377][T11072] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 198.597552][T11072] page dumped because: kasan: bad access detected [ 198.604265][T11072] page_owner tracks the page as allocated [ 198.609981][T11072] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x528c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP), pid 6362, tgid 6362 (syz-executor), ts 136754411152, free_ts 136752414455 [ 198.630133][T11072] post_alloc_hook+0x240/0x2a0 [ 198.635008][T11072] get_page_from_freelist+0x21e4/0x22c0 [ 198.640909][T11072] __alloc_frozen_pages_noprof+0x181/0x370 [ 198.646729][T11072] alloc_pages_mpol+0x232/0x4a0 [ 198.651661][T11072] allocate_slab+0x8a/0x370 [ 198.656154][T11072] ___slab_alloc+0xbeb/0x1410 [ 198.660832][T11072] __kvmalloc_node_noprof+0x429/0x5f0 [ 198.666210][T11072] pfifo_fast_init+0x363/0x6b0 [ 198.670970][T11072] qdisc_create_dflt+0x13b/0x4e0 [ 198.675987][T11072] dev_activate+0x378/0x1150 [ 198.680568][T11072] __dev_open+0x69c/0x880 [ 198.684887][T11072] __dev_change_flags+0x1ea/0x6d0 [ 198.689893][T11072] netif_change_flags+0x88/0x1a0 [ 198.694812][T11072] do_setlink+0xc55/0x41c0 [ 198.699207][T11072] rtnl_newlink+0x160b/0x1c70 [ 198.703870][T11072] rtnetlink_rcv_msg+0x7cc/0xb70 [ 198.708796][T11072] page last free pid 6362 tgid 6362 stack trace: [ 198.715100][T11072] __free_frozen_pages+0xbc4/0xd30 [ 198.720199][T11072] __put_partials+0x156/0x1a0 [ 198.724857][T11072] put_cpu_partial+0x17c/0x250 [ 198.729610][T11072] __slab_free+0x2d5/0x3c0 [ 198.734008][T11072] qlist_free_all+0x97/0x140 [ 198.738650][T11072] kasan_quarantine_reduce+0x148/0x160 [ 198.744099][T11072] __kasan_slab_alloc+0x22/0x80 [ 198.748934][T11072] kmem_cache_alloc_node_noprof+0x1bb/0x3c0 [ 198.754815][T11072] __alloc_skb+0x112/0x2d0 [ 198.759222][T11072] netlink_ack+0x146/0xa50 [ 198.763625][T11072] netlink_rcv_skb+0x28c/0x470 [ 198.768377][T11072] netlink_unicast+0x82c/0x9e0 [ 198.773145][T11072] netlink_sendmsg+0x805/0xb30 [ 198.777897][T11072] __sock_sendmsg+0x219/0x270 [ 198.782583][T11072] __sys_sendto+0x3bd/0x520 [ 198.787092][T11072] __x64_sys_sendto+0xde/0x100 [ 198.791852][T11072] [ 198.794164][T11072] Memory state around the buggy address: [ 198.799957][T11072] ffff888024eabf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 198.808002][T11072] ffff888024eac000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 198.816345][T11072] >ffff888024eac080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 198.824398][T11072] ^ [ 198.829507][T11072] ffff888024eac100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 198.837812][T11072] ffff888024eac180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 198.846067][T11072] ================================================================== [ 198.855540][T11072] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 198.862863][T11072] CPU: 0 UID: 0 PID: 11072 Comm: khidpd_0c451011 Not tainted 6.17.0-rc1-syzkaller-g715c7a36d59f #0 PREEMPT(full) [ 198.874919][T11072] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 198.884992][T11072] Call Trace: [ 198.888264][T11072] [ 198.891184][T11072] dump_stack_lvl+0x99/0x250 [ 198.895769][T11072] ? __asan_memcpy+0x40/0x70 [ 198.900354][T11072] ? __pfx_dump_stack_lvl+0x10/0x10 [ 198.905538][T11072] ? __pfx__printk+0x10/0x10 [ 198.910141][T11072] vpanic+0x281/0x750 [ 198.914115][T11072] ? __pfx_vpanic+0x10/0x10 [ 198.918609][T11072] ? irqentry_exit+0x74/0x90 [ 198.923196][T11072] panic+0xb9/0xc0 [ 198.926904][T11072] ? __pfx_panic+0x10/0x10 [ 198.931317][T11072] ? _raw_spin_unlock_irqrestore+0xa8/0x110 [ 198.937202][T11072] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 198.943085][T11072] ? __mutex_lock+0x7fc/0x1360 [ 198.947857][T11072] check_panic_on_warn+0x89/0xb0 [ 198.952801][T11072] ? __mutex_lock+0x7fc/0x1360 [ 198.957575][T11072] end_report+0x78/0x160 [ 198.961811][T11072] kasan_report+0x129/0x150 [ 198.966304][T11072] ? __mutex_lock+0x7fc/0x1360 [ 198.971073][T11072] __mutex_lock+0x7fc/0x1360 [ 198.975673][T11072] ? __mutex_lock+0x5b6/0x1360 [ 198.980452][T11072] ? l2cap_unregister_user+0x6a/0x1b0 [ 198.985826][T11072] ? __pfx___mutex_lock+0x10/0x10 [ 198.990847][T11072] ? __pfx___timer_delete_sync+0x10/0x10 [ 198.996471][T11072] l2cap_unregister_user+0x6a/0x1b0 [ 199.001752][T11072] hidp_session_thread+0x3c9/0x410 [ 199.006884][T11072] ? __pfx_hidp_session_thread+0x10/0x10 [ 199.012510][T11072] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 199.018398][T11072] ? __pfx_hidp_session_wake_function+0x10/0x10 [ 199.024746][T11072] ? __pfx_hidp_session_wake_function+0x10/0x10 [ 199.030976][T11072] ? __kthread_parkme+0x7b/0x200 [ 199.035903][T11072] ? __kthread_parkme+0x1a1/0x200 [ 199.040925][T11072] kthread+0x70e/0x8a0 [ 199.045007][T11072] ? __pfx_hidp_session_thread+0x10/0x10 [ 199.050637][T11072] ? __pfx_kthread+0x10/0x10 [ 199.055407][T11072] ? _raw_spin_unlock_irq+0x23/0x50 [ 199.060840][T11072] ? lockdep_hardirqs_on+0x9c/0x150 [ 199.066146][T11072] ? __pfx_kthread+0x10/0x10 [ 199.070746][T11072] ret_from_fork+0x3f9/0x770 [ 199.075344][T11072] ? __pfx_ret_from_fork+0x10/0x10 [ 199.080481][T11072] ? __switch_to_asm+0x39/0x70 [ 199.085256][T11072] ? __switch_to_asm+0x33/0x70 [ 199.090022][T11072] ? __pfx_kthread+0x10/0x10 [ 199.094623][T11072] ret_from_fork_asm+0x1a/0x30 [ 199.099384][T11072] [ 199.102786][T11072] Kernel Offset: disabled [ 199.107144][T11072] Rebooting in 86400 seconds..