Warning: Permanently added '10.128.1.25' (ED25519) to the list of known hosts. 1970/01/01 00:01:02 ignoring optional flag "sandboxArg"="0" 1970/01/01 00:01:02 ignoring optional flag "type"="gce" 1970/01/01 00:01:02 parsed 1 programs [ 62.664380][ T4338] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS 1970/01/01 00:01:02 executed programs: 0 [ 62.798404][ T4347] chnl_net:caif_netlink_parms(): no params data found [ 62.834491][ T4347] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.836738][ T4347] bridge0: port 1(bridge_slave_0) entered disabled state [ 62.839285][ T4347] device bridge_slave_0 entered promiscuous mode [ 62.842944][ T4347] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.844926][ T4347] bridge0: port 2(bridge_slave_1) entered disabled state [ 62.848928][ T4347] device bridge_slave_1 entered promiscuous mode [ 62.866680][ T4347] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 62.871824][ T4347] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 62.889077][ T4347] team0: Port device team_slave_0 added [ 62.892330][ T4347] team0: Port device team_slave_1 added [ 62.906188][ T4347] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 62.908262][ T4347] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 62.915358][ T4347] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 62.919947][ T4347] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 62.921842][ T4347] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 62.929055][ T4347] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 62.998510][ T4347] device hsr_slave_0 entered promiscuous mode [ 63.056917][ T4347] device hsr_slave_1 entered promiscuous mode [ 63.804743][ T4347] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 63.859794][ T4347] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 63.878593][ T4347] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 63.928689][ T4347] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 64.021434][ T4347] 8021q: adding VLAN 0 to HW filter on device bond0 [ 64.029865][ T600] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 64.032691][ T600] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 64.037830][ T4347] 8021q: adding VLAN 0 to HW filter on device team0 [ 64.047598][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 64.050529][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 64.053135][ T486] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.055150][ T486] bridge0: port 1(bridge_slave_0) entered forwarding state [ 64.059952][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 64.062882][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 64.065618][ T486] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.067969][ T486] bridge0: port 2(bridge_slave_1) entered forwarding state [ 64.070931][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 64.073877][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 64.082148][ T414] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 64.096218][ T4347] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 64.099836][ T4347] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 64.103906][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 64.109735][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 64.112495][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 64.116106][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 64.119050][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 64.121886][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 64.125063][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 64.128675][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 64.139241][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 64.141861][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 64.219917][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 64.222312][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 64.230706][ T4347] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 64.245840][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 64.249673][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 64.263814][ T600] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 64.267756][ T600] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 64.271002][ T600] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 64.273714][ T600] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 64.278907][ T4347] device veth0_vlan entered promiscuous mode [ 64.285185][ T4347] device veth1_vlan entered promiscuous mode [ 64.301433][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 64.304110][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 64.307137][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 64.310020][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 64.314477][ T4347] device veth0_macvtap entered promiscuous mode [ 64.320737][ T4347] device veth1_macvtap entered promiscuous mode [ 64.333772][ T4347] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 64.335955][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 64.341386][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 64.343977][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 64.347503][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 64.353096][ T4347] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 64.357957][ T600] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 64.360982][ T600] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 64.365396][ T4347] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.370052][ T4347] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.372506][ T4347] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.375099][ T4347] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.423273][ T600] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.425696][ T600] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.439100][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 64.443704][ T600] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.447435][ T600] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.451369][ T486] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 64.757374][ T13] Bluetooth: hci0: command 0x0409 tx timeout [ 66.836978][ T1972] Bluetooth: hci0: command 0x041b tx timeout 1970/01/01 00:01:07 executed programs: 95 [ 68.917076][ T1972] Bluetooth: hci0: command 0x040f tx timeout [ 69.640206][ T25] cfg80211: failed to load regulatory.db [ 69.643267][ T2058] ieee802154 phy0 wpan0: encryption failed: -22 [ 69.645273][ T2058] ieee802154 phy1 wpan1: encryption failed: -22 [ 70.996789][ T7] Bluetooth: hci0: command 0x0419 tx timeout 1970/01/01 00:01:12 executed programs: 288 1970/01/01 00:01:17 executed programs: 501 1970/01/01 00:01:22 executed programs: 727 1970/01/01 00:01:27 executed programs: 959 [ 92.176598][ C1] IPv4: Attempt to release TCP socket in state 8 00000000c43ac1a4 [ 92.178929][ C1] [ 92.179581][ C1] ========================= [ 92.180792][ C1] WARNING: held lock freed! [ 92.181965][ C1] 5.15.189-syzkaller #0 Not tainted [ 92.183367][ C1] ------------------------- [ 92.184572][ C1] syz-executor.0/7054 is freeing memory ffff0000cf0e6780-ffff0000cf0e725f, with a lock still held there! [ 92.187748][ C1] ffff0000cf0e68a0 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_sendmsg+0x154/0x284 [ 92.190324][ C1] 2 locks held by syz-executor.0/7054: [ 92.191801][ C1] #0: ffff0000cf0e68a0 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_sendmsg+0x154/0x284 [ 92.194471][ C1] #1: ffff800008017b80 ((&msk->sk.icsk_retransmit_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd0/0x858 [ 92.197515][ C1] [ 92.197515][ C1] stack backtrace: [ 92.199148][ C1] CPU: 1 PID: 7054 Comm: syz-executor.0 Not tainted 5.15.189-syzkaller #0 [ 92.201462][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 92.204233][ C1] Call trace: [ 92.205158][ C1] dump_backtrace+0x0/0x43c [ 92.206412][ C1] show_stack+0x2c/0x3c [ 92.207595][ C1] __dump_stack+0x30/0x40 [ 92.208823][ C1] dump_stack_lvl+0xf8/0x160 [ 92.210161][ C1] dump_stack+0x1c/0x5c [ 92.211333][ C1] debug_check_no_locks_freed+0x20c/0x2a0 [ 92.212989][ C1] slab_free_freelist_hook+0x88/0x1e8 [ 92.214561][ C1] kmem_cache_free+0xdc/0x3b4 [ 92.215893][ C1] __sk_destruct+0x40c/0x604 [ 92.217189][ C1] __sk_free+0x320/0x430 [ 92.218395][ C1] sk_free+0x68/0xdc [ 92.219472][ C1] mptcp_retransmit_timer+0x190/0x2b4 [ 92.220977][ C1] call_timer_fn+0x19c/0x858 [ 92.222251][ C1] __run_timers+0x46c/0x6c4 [ 92.223470][ C1] run_timer_softirq+0x7c/0x114 [ 92.224822][ C1] handle_softirqs+0x344/0xbf0 [ 92.226160][ C1] __irq_exit_rcu+0x240/0x440 [ 92.227482][ C1] irq_exit+0x14/0x88 [ 92.228611][ C1] handle_domain_irq+0x14c/0x1fc [ 92.229996][ C1] gic_handle_irq+0x78/0x1c8 [ 92.231278][ C1] call_on_irq_stack+0x24/0x30 [ 92.232614][ C1] do_interrupt_handler+0x6c/0x88 [ 92.233997][ C1] el1_interrupt+0x30/0x58 [ 92.235215][ C1] el1h_64_irq_handler+0x18/0x24 [ 92.236521][ C1] el1h_64_irq+0x78/0x7c [ 92.237728][ C1] _raw_spin_unlock_irqrestore+0xb8/0x14c [ 92.239273][ C1] __mod_timer+0x6e8/0xb44 [ 92.240484][ C1] mod_timer+0x2c/0x3c [ 92.241627][ C1] sk_reset_timer+0x30/0xfc [ 92.242807][ C1] __mptcp_push_pending+0x528/0x630 [ 92.244209][ C1] mptcp_sendmsg+0x14dc/0x19ec [ 92.245530][ C1] inet_sendmsg+0x154/0x284 [ 92.246761][ C1] ____sys_sendmsg+0x61c/0x920 [ 92.248062][ C1] ___sys_sendmsg+0x1d0/0x240 [ 92.249315][ C1] __arm64_sys_sendmsg+0x1a8/0x254 [ 92.250716][ C1] invoke_syscall+0x98/0x2b8 [ 92.251987][ C1] el0_svc_common+0x138/0x258 [ 92.253262][ C1] do_el0_svc+0x58/0x14c [ 92.254471][ C1] el0_svc+0x78/0x1e0 [ 92.255539][ C1] el0t_64_sync_handler+0xcc/0xe4 [ 92.256941][ C1] el0t_64_sync+0x1a0/0x1a4 [ 92.258743][ T7054] ------------[ cut here ]------------ [ 92.260347][ T7054] refcount_t: addition on 0; use-after-free. [ 92.262323][ T7054] WARNING: CPU: 1 PID: 7054 at lib/refcount.c:25 refcount_warn_saturate+0x134/0x1f8 [ 92.264974][ T7054] Modules linked in: [ 92.265997][ T7054] CPU: 1 PID: 7054 Comm: syz-executor.0 Not tainted 5.15.189-syzkaller #0 [ 92.268248][ T7054] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 92.271034][ T7054] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 92.273241][ T7054] pc : refcount_warn_saturate+0x134/0x1f8 [ 92.274839][ T7054] lr : refcount_warn_saturate+0x134/0x1f8 [ 92.276489][ T7054] sp : ffff800023ff74b0 [ 92.277616][ T7054] x29: ffff800023ff74b0 x28: 00000000000000d0 x27: 0000000000000000 [ 92.279869][ T7054] x26: ffff0000d72f8170 x25: 0000000000000000 x24: ffff0000cf0e6fc8 [ 92.282114][ T7054] x23: dfff800000000000 x22: ffff7000047feeac x21: ffff0000cf0e6e30 [ 92.284289][ T7054] x20: ffff0000cf0e6800 x19: ffff8000165b2000 x18: 0000000000000001 [ 92.286536][ T7054] x17: 0000000000000000 x16: ffff8000083020fc x15: 00000000ffffffff [ 92.288806][ T7054] x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 [ 92.291049][ T7054] x11: 0000000000000000 x10: 0000000000000000 x9 : ecd2a4f59fbce100 [ 92.293193][ T7054] x8 : ecd2a4f59fbce100 x7 : 0000000000000001 x6 : 0000000000000001 [ 92.295455][ T7054] x5 : ffff800023ff6d98 x4 : ffff80001424f400 x3 : ffff80000830220c [ 92.297750][ T7054] x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000002a [ 92.299913][ T7054] Call trace: [ 92.300777][ T7054] refcount_warn_saturate+0x134/0x1f8 [ 92.302218][ T7054] sk_reset_timer+0xcc/0xfc [ 92.303429][ T7054] __mptcp_push_pending+0x528/0x630 [ 92.304815][ T7054] mptcp_sendmsg+0x14dc/0x19ec [ 92.306188][ T7054] inet_sendmsg+0x154/0x284 [ 92.307499][ T7054] ____sys_sendmsg+0x61c/0x920 [ 92.308805][ T7054] ___sys_sendmsg+0x1d0/0x240 [ 92.310106][ T7054] __arm64_sys_sendmsg+0x1a8/0x254 [ 92.311479][ T7054] invoke_syscall+0x98/0x2b8 [ 92.312745][ T7054] el0_svc_common+0x138/0x258 [ 92.313970][ T7054] do_el0_svc+0x58/0x14c [ 92.315105][ T7054] el0_svc+0x78/0x1e0 [ 92.316155][ T7054] el0t_64_sync_handler+0xcc/0xe4 [ 92.317473][ T7054] el0t_64_sync+0x1a0/0x1a4 [ 92.318655][ T7054] irq event stamp: 1550 [ 92.319783][ T7054] hardirqs last enabled at (1550): [] kasan_quarantine_put+0xc4/0x204 [ 92.322521][ T7054] hardirqs last disabled at (1549): [] kasan_quarantine_put+0x108/0x204 [ 92.325301][ T7054] softirqs last enabled at (1516): [] mptcp_sendmsg+0xccc/0x19ec [ 92.327897][ T7054] softirqs last disabled at (1521): [] __irq_exit_rcu+0x240/0x440 [ 92.330459][ T7054] ---[ end trace 7f9a64b52405ba33 ]--- [ 92.334146][ T7053] ------------[ cut here ]------------ [ 92.335724][ T7053] refcount_t: saturated; leaking memory. [ 92.338732][ T7053] WARNING: CPU: 0 PID: 7053 at lib/refcount.c:22 refcount_warn_saturate+0x1b4/0x1f8 [ 92.341302][ T7053] Modules linked in: [ 92.342403][ T7053] CPU: 0 PID: 7053 Comm: syz-executor.0 Tainted: G W 5.15.189-syzkaller #0 [ 92.345098][ T7053] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 92.347877][ T7053] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 92.350065][ T7053] pc : refcount_warn_saturate+0x1b4/0x1f8 [ 92.351678][ T7053] lr : refcount_warn_saturate+0x1b4/0x1f8 [ 92.353289][ T7053] sp : ffff80001f2f79a0 [ 92.354507][ T7053] x29: ffff80001f2f79a0 x28: ffff0000e294e2f0 x27: 1fffe0001ba57e35 [ 92.356708][ T7053] x26: ffff0000cf0e6780 x25: ffff8000140ef000 x24: 1ffff0000281de30 [ 92.358863][ T7053] x23: ffff0000cf0e7148 x22: 00000000c0000000 x21: ffff0000cf0e6800 [ 92.361093][ T7053] x20: ffff0000cf0e6800 x19: ffff8000165b2000 x18: 1fffe00034218b96 [ 92.363213][ T7053] x17: 1fffe00034218b96 x16: ffff8000111bc798 x15: ffff80001420eda0 [ 92.365379][ T7053] x14: ffff0001a10c5cc0 x13: ffff0001a10c5cbc x12: 0000000000ff0100 [ 92.367546][ T7053] x11: 0000000000000000 x10: 0000000000000000 x9 : 3dd2aeebd92b8300 [ 92.369741][ T7053] x8 : 3dd2aeebd92b8300 x7 : 0000000000000000 x6 : ffff80000824599c [ 92.371952][ T7053] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80000a723764 [ 92.374188][ T7053] x2 : ffff0001a10c5d50 x1 : 0000000100000000 x0 : 0000000000000026 [ 92.376474][ T7053] Call trace: [ 92.377390][ T7053] refcount_warn_saturate+0x1b4/0x1f8 [ 92.378992][ T7053] mptcp_close+0x738/0xa04 [ 92.380194][ T7053] inet_release+0x120/0x16c [ 92.381474][ T7053] sock_close+0xb4/0x1f8 [ 92.382700][ T7053] __fput+0x1c0/0x7f8 [ 92.383812][ T7053] ____fput+0x20/0x30 [ 92.384893][ T7053] task_work_run+0x12c/0x1e0 [ 92.386217][ T7053] do_notify_resume+0x24b4/0x3128 [ 92.387631][ T7053] el0_svc+0xf0/0x1e0 [ 92.388725][ T7053] el0t_64_sync_handler+0xcc/0xe4 [ 92.390059][ T7053] el0t_64_sync+0x1a0/0x1a4 [ 92.391297][ T7053] irq event stamp: 1426 [ 92.392457][ T7053] hardirqs last enabled at (1425): [] _raw_spin_unlock_irqrestore+0xa8/0x14c [ 92.395400][ T7053] hardirqs last disabled at (1426): [] __schedule+0x2ec/0x1c0c [ 92.397958][ T7053] softirqs last enabled at (1406): [] local_bh_enable+0x10/0x34 [ 92.400524][ T7053] softirqs last disabled at (1404): [] local_bh_disable+0x10/0x34 [ 92.403085][ T7053] ---[ end trace 7f9a64b52405ba34 ]--- [ 92.404780][ T7053] ------------[ cut here ]------------ [ 92.406243][ T7053] ODEBUG: assert_init not available (active state 0) object type: timer_list hint: mptcp_retransmit_timer+0x0/0x2b4 [ 92.409888][ T7053] WARNING: CPU: 0 PID: 7053 at lib/debugobjects.c:521 debug_print_object+0x148/0x1d4 [ 92.412618][ T7053] Modules linked in: [ 92.413671][ T7053] CPU: 0 PID: 7053 Comm: syz-executor.0 Tainted: G W 5.15.189-syzkaller #0 [ 92.416229][ T7053] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 92.419047][ T7053] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 92.421132][ T7053] pc : debug_print_object+0x148/0x1d4 [ 92.422550][ T7053] lr : debug_print_object+0x148/0x1d4 [ 92.424033][ T7053] sp : ffff80001f2f7790 [ 92.425227][ T7053] x29: ffff80001f2f7790 x28: dfff800000000000 x27: 0000000000000000 [ 92.427510][ T7053] x26: ffff800014170000 x25: ffff80000837e25c x24: dfff800000000000 [ 92.429762][ T7053] x23: 0000000000000000 x22: ffff8000110ac57c x21: ffff8000117c8f60 [ 92.431938][ T7053] x20: ffff800011332ce0 x19: ffff8000117c8aa0 x18: 0000000000000001 [ 92.434127][ T7053] x17: 0000000000000000 x16: ffff8000111bc798 x15: 00000000ffffffff [ 92.436446][ T7053] x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 [ 92.438593][ T7053] x11: 0000000000000000 x10: 0000000000000000 x9 : 3dd2aeebd92b8300 [ 92.440708][ T7053] x8 : 3dd2aeebd92b8300 x7 : 0000000000000001 x6 : 0000000000000001 [ 92.442868][ T7053] x5 : ffff80001f2f7078 x4 : ffff80001424f400 x3 : ffff80000a723764 [ 92.445038][ T7053] x2 : ffff0001a10c5d50 x1 : 0000000100000000 x0 : 0000000000000071 [ 92.447305][ T7053] Call trace: [ 92.448181][ T7053] debug_print_object+0x148/0x1d4 [ 92.449538][ T7053] debug_object_assert_init+0x24c/0x2c4 [ 92.451116][ T7053] del_timer+0x48/0x1e4 [ 92.452213][ T7053] sk_stop_timer+0x24/0xd4 [ 92.453426][ T7053] __mptcp_destroy_sock+0x284/0x610 [ 92.454814][ T7053] mptcp_close+0x5b8/0xa04 [ 92.456091][ T7053] inet_release+0x120/0x16c [ 92.457334][ T7053] sock_close+0xb4/0x1f8 [ 92.458502][ T7053] __fput+0x1c0/0x7f8 [ 92.459526][ T7053] ____fput+0x20/0x30 [ 92.460619][ T7053] task_work_run+0x12c/0x1e0 [ 92.462039][ T7053] do_notify_resume+0x24b4/0x3128 [ 92.463459][ T7053] el0_svc+0xf0/0x1e0 [ 92.464604][ T7053] el0t_64_sync_handler+0xcc/0xe4 [ 92.465955][ T7053] el0t_64_sync+0x1a0/0x1a4 [ 92.467167][ T7053] irq event stamp: 1426 [ 92.468282][ T7053] hardirqs last enabled at (1425): [] _raw_spin_unlock_irqrestore+0xa8/0x14c [ 92.471131][ T7053] hardirqs last disabled at (1426): [] __schedule+0x2ec/0x1c0c [ 92.473702][ T7053] softirqs last enabled at (1406): [] local_bh_enable+0x10/0x34 [ 92.476226][ T7053] softirqs last disabled at (1404): [] local_bh_disable+0x10/0x34 [ 92.478789][ T7053] ---[ end trace 7f9a64b52405ba35 ]--- [ 92.481145][ T7053] ------------[ cut here ]------------ [ 92.482659][ T7053] ODEBUG: assert_init not available (active state 0) object type: timer_list hint: mptcp_tout_timer+0x0/0xe8 [ 92.486231][ T7053] WARNING: CPU: 0 PID: 7053 at lib/debugobjects.c:521 debug_print_object+0x148/0x1d4 [ 92.488814][ T7053] Modules linked in: [ 92.489867][ T7053] CPU: 0 PID: 7053 Comm: syz-executor.0 Tainted: G W 5.15.189-syzkaller #0 [ 92.492552][ T7053] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 92.495360][ T7053] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 92.497549][ T7053] pc : debug_print_object+0x148/0x1d4 [ 92.498999][ T7053] lr : debug_print_object+0x148/0x1d4 [ 92.500533][ T7053] sp : ffff80001f2f7790 [ 92.501617][ T7053] x29: ffff80001f2f7790 x28: dfff800000000000 x27: 0000000000000001 [ 92.503889][ T7053] x26: ffff800014170000 x25: ffff80000837e25c x24: dfff800000000000 [ 92.506168][ T7053] x23: 0000000000000000 x22: ffff8000110ac830 x21: ffff8000117c8f60 [ 92.508377][ T7053] x20: ffff800011332ce0 x19: ffff8000117c8aa0 x18: 0000000000000001 [ 92.510534][ T7053] x17: 0000000000000000 x16: ffff8000111bc798 x15: 00000000ffffffff [ 92.512777][ T7053] x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 [ 92.514948][ T7053] x11: 0000000000000000 x10: 0000000000000000 x9 : 3dd2aeebd92b8300 [ 92.517133][ T7053] x8 : 3dd2aeebd92b8300 x7 : 0000000000000001 x6 : 0000000000000001 [ 92.519298][ T7053] x5 : ffff80001f2f7078 x4 : ffff80001424f400 x3 : ffff80000850433c [ 92.521520][ T7053] x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000006a [ 92.523723][ T7053] Call trace: [ 92.524581][ T7053] debug_print_object+0x148/0x1d4 [ 92.525953][ T7053] debug_object_assert_init+0x24c/0x2c4 [ 92.527436][ T7053] del_timer+0x48/0x1e4 [ 92.528612][ T7053] sk_stop_timer+0x24/0xd4 [ 92.529795][ T7053] __mptcp_destroy_sock+0x290/0x610 [ 92.531283][ T7053] mptcp_close+0x5b8/0xa04 [ 92.532550][ T7053] inet_release+0x120/0x16c [ 92.533796][ T7053] sock_close+0xb4/0x1f8 [ 92.534989][ T7053] __fput+0x1c0/0x7f8 [ 92.536107][ T7053] ____fput+0x20/0x30 [ 92.537227][ T7053] task_work_run+0x12c/0x1e0 [ 92.538489][ T7053] do_notify_resume+0x24b4/0x3128 [ 92.539909][ T7053] el0_svc+0xf0/0x1e0 [ 92.541034][ T7053] el0t_64_sync_handler+0xcc/0xe4 [ 92.542426][ T7053] el0t_64_sync+0x1a0/0x1a4 [ 92.543645][ T7053] irq event stamp: 1426 [ 92.544766][ T7053] hardirqs last enabled at (1425): [] _raw_spin_unlock_irqrestore+0xa8/0x14c [ 92.547722][ T7053] hardirqs last disabled at (1426): [] __schedule+0x2ec/0x1c0c [ 92.550235][ T7053] softirqs last enabled at (1406): [] local_bh_enable+0x10/0x34 [ 92.552784][ T7053] softirqs last disabled at (1404): [] local_bh_disable+0x10/0x34 [ 92.555304][ T7053] ---[ end trace 7f9a64b52405ba36 ]--- [ 92.556914][ T7053] ------------[ cut here ]------------ [ 92.558404][ T7053] refcount_t: underflow; use-after-free. [ 92.560123][ T7053] WARNING: CPU: 0 PID: 7053 at lib/refcount.c:28 refcount_warn_saturate+0x154/0x1f8 [ 92.562693][ T7053] Modules linked in: [ 92.563718][ T7053] CPU: 0 PID: 7053 Comm: syz-executor.0 Tainted: G W 5.15.189-syzkaller #0 [ 92.566361][ T7053] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 92.569132][ T7053] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 92.571243][ T7053] pc : refcount_warn_saturate+0x154/0x1f8 [ 92.572777][ T7053] lr : refcount_warn_saturate+0x154/0x1f8 [ 92.574493][ T7053] sp : ffff80001f2f78c0 [ 92.575530][ T7053] x29: ffff80001f2f78c0 x28: dfff800000000000 x27: 1ffff00003e5ef20 [ 92.577736][ T7053] x26: ffff0000cf0e6780 x25: 1fffe00019e1ce29 x24: ffff0000cf0e7148 [ 92.579877][ T7053] x23: ffff0000cf0e7170 x22: 0000000000000000 x21: 00000000c0000000 [ 92.582051][ T7053] x20: ffff0000cf0e6800 x19: ffff8000165b2000 x18: 0000000000000001 [ 92.584161][ T7053] x17: 0000000000000000 x16: ffff8000111bc798 x15: 00000000ffffffff [ 92.586316][ T7053] x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 [ 92.588565][ T7053] x11: 0000000000000000 x10: 0000000000000000 x9 : 3dd2aeebd92b8300 [ 92.590810][ T7053] x8 : 3dd2aeebd92b8300 x7 : 0000000000000001 x6 : 0000000000000001 [ 92.592965][ T7053] x5 : ffff80001f2f71b8 x4 : ffff80001424f400 x3 : ffff80000a723764 [ 92.595195][ T7053] x2 : ffff0001a10c5d50 x1 : 0000000100000000 x0 : 0000000000000026 [ 92.597464][ T7053] Call trace: [ 92.598390][ T7053] refcount_warn_saturate+0x154/0x1f8 [ 92.599882][ T7053] __mptcp_destroy_sock+0x564/0x610 [ 92.601338][ T7053] mptcp_close+0x5b8/0xa04 [ 92.602594][ T7053] inet_release+0x120/0x16c [ 92.604058][ T7053] sock_close+0xb4/0x1f8 [ 92.605151][ T7053] __fput+0x1c0/0x7f8 [ 92.606224][ T7053] ____fput+0x20/0x30 [ 92.607307][ T7053] task_work_run+0x12c/0x1e0 [ 92.608548][ T7053] do_notify_resume+0x24b4/0x3128 [ 92.609874][ T7053] el0_svc+0xf0/0x1e0 [ 92.610997][ T7053] el0t_64_sync_handler+0xcc/0xe4 [ 92.612391][ T7053] el0t_64_sync+0x1a0/0x1a4 [ 92.613671][ T7053] irq event stamp: 1426 [ 92.614815][ T7053] hardirqs last enabled at (1425): [] _raw_spin_unlock_irqrestore+0xa8/0x14c [ 92.617717][ T7053] hardirqs last disabled at (1426): [] __schedule+0x2ec/0x1c0c [ 92.620299][ T7053] softirqs last enabled at (1406): [] local_bh_enable+0x10/0x34 [ 92.622877][ T7053] softirqs last disabled at (1404): [] local_bh_disable+0x10/0x34 [ 92.625506][ T7053] ---[ end trace 7f9a64b52405ba37 ]--- 1970/01/01 00:01:32 executed programs: 1173 1970/01/01 00:01:37 executed programs: 1480