Warning: Permanently added '10.128.1.116' (ED25519) to the list of known hosts. 1970/01/01 00:01:04 ignoring optional flag "sandboxArg"="0" 1970/01/01 00:01:04 parsed 1 programs [ 66.237800][ T4525] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 69.598205][ T7] cfg80211: failed to load regulatory.db [ 69.605062][ T2064] ieee802154 phy0 wpan0: encryption failed: -22 [ 69.606127][ T2064] ieee802154 phy1 wpan1: encryption failed: -22 [ 70.443068][ T148] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.444993][ T148] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.447086][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 70.456358][ T1606] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.457756][ T1606] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.459357][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 70.537529][ T4554] chnl_net:caif_netlink_parms(): no params data found [ 70.557108][ T4554] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.558483][ T4554] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.559979][ T4554] device bridge_slave_0 entered promiscuous mode [ 70.561980][ T4554] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.563144][ T4554] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.565052][ T4554] device bridge_slave_1 entered promiscuous mode [ 70.572881][ T4554] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.577499][ T4554] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.586695][ T4554] team0: Port device team_slave_0 added [ 70.588771][ T4554] team0: Port device team_slave_1 added [ 70.595766][ T4554] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.596925][ T4554] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 70.601073][ T4554] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.603343][ T4554] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.604655][ T4554] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 70.608691][ T4554] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.685192][ T4554] device hsr_slave_0 entered promiscuous mode [ 70.724135][ T4554] device hsr_slave_1 entered promiscuous mode [ 71.375370][ T4554] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 71.415286][ T4554] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 71.468152][ T4554] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 71.515107][ T4554] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 71.642039][ T4554] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.649366][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 71.650895][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 71.655895][ T4554] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.660561][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 71.662838][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 71.666126][ T136] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.667242][ T136] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.670528][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 71.672046][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 71.673564][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 71.676879][ T136] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.678036][ T136] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.685019][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 71.687352][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 71.688907][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 71.690699][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 71.697322][ T4554] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 71.698949][ T4554] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 71.716311][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 71.717873][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 71.719599][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 71.721190][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 71.726194][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 71.735172][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 71.736791][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 71.738716][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 71.779937][ T4554] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.781789][ T1606] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 71.783126][ T1606] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 71.790610][ T1606] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 71.792287][ T1606] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 71.799859][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 71.801460][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 71.803277][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 71.805383][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 71.807443][ T4554] device veth0_vlan entered promiscuous mode [ 71.810704][ T4554] device veth1_vlan entered promiscuous mode [ 71.821521][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 71.823115][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 71.826651][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 71.828227][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 71.830789][ T4554] device veth0_macvtap entered promiscuous mode [ 71.833309][ T4554] device veth1_macvtap entered promiscuous mode [ 71.841189][ T4554] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.842416][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 71.843894][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 71.846890][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 71.848569][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 71.851405][ T4554] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.853178][ T1606] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 71.857223][ T1606] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 71.859583][ T4554] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.860957][ T4554] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.862290][ T4554] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.863786][ T4554] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 1970/01/01 00:01:12 executed programs: 0 [ 72.863703][ T4805] chnl_net:caif_netlink_parms(): no params data found [ 72.885046][ T4805] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.886233][ T4805] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.887808][ T4805] device bridge_slave_0 entered promiscuous mode [ 72.890144][ T4805] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.891228][ T4805] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.892653][ T4805] device bridge_slave_1 entered promiscuous mode [ 72.901443][ T4805] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.904592][ T4805] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.913791][ T4805] team0: Port device team_slave_0 added [ 72.916464][ T4805] team0: Port device team_slave_1 added [ 72.923275][ T4805] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.924723][ T4805] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.928999][ T4805] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.931565][ T4805] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.932646][ T4805] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.937174][ T4805] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.976104][ T4805] device hsr_slave_0 entered promiscuous mode [ 73.004406][ T4805] device hsr_slave_1 entered promiscuous mode [ 73.064172][ T4805] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 73.065434][ T4805] Cannot create hsr debugfs directory [ 73.112116][ T4805] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 74.874097][ T4251] Bluetooth: hci0: command 0x0409 tx timeout [ 75.318526][ T4805] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 76.954045][ T7] Bluetooth: hci0: command 0x041b tx timeout [ 76.988424][ T4805] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 77.028948][ T4805] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 77.168954][ T4805] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 77.197268][ T4805] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 77.235401][ T4805] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 77.275402][ T4805] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 77.359715][ T4805] 8021q: adding VLAN 0 to HW filter on device bond0 [ 77.364502][ T1606] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 77.366072][ T1606] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 77.368698][ T4805] 8021q: adding VLAN 0 to HW filter on device team0 [ 77.371221][ T1606] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 77.372773][ T1606] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 77.375068][ T1606] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.376220][ T1606] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.377568][ T1606] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 77.398058][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 77.399633][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 77.401020][ T136] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.402223][ T136] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.405795][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 77.408693][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 77.411418][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 77.413322][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 77.416541][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 77.419202][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 77.420845][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 77.423500][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 77.425676][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 77.428241][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 77.429810][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 77.432108][ T4805] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 77.473286][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 77.475273][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 77.478901][ T4805] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.485392][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 77.487120][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 77.493816][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 77.495987][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 77.497903][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 77.499357][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 77.501290][ T4805] device veth0_vlan entered promiscuous mode [ 77.505216][ T4805] device veth1_vlan entered promiscuous mode [ 77.512222][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 77.513722][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 77.516033][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 77.517555][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 77.519964][ T4805] device veth0_macvtap entered promiscuous mode [ 77.522398][ T4805] device veth1_macvtap entered promiscuous mode [ 77.528914][ T4805] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 77.530574][ T4805] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.532765][ T4805] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 77.534418][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 77.535978][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 77.537432][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 77.539027][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 77.541507][ T4805] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 77.543139][ T4805] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.546985][ T4805] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 77.548230][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 77.549797][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 77.552489][ T4805] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.553889][ T4805] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.555475][ T4805] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.556883][ T4805] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.575953][ T136] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.580452][ T136] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.583084][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 77.586583][ T136] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.587742][ T136] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.589433][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 77.623192][ T4970] ================================================================== [ 77.624530][ T4970] BUG: KASAN: use-after-free in __lock_acquire+0xf0/0x651c [ 77.625640][ T4970] Read of size 8 at addr ffff0000d186acb8 by task syz.0.16/4970 [ 77.626882][ T4970] [ 77.627270][ T4970] CPU: 1 PID: 4970 Comm: syz.0.16 Not tainted 5.15.189-syzkaller #0 [ 77.628572][ T4970] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 [ 77.630138][ T4970] Call trace: [ 77.630703][ T4970] dump_backtrace+0x0/0x43c [ 77.631480][ T4970] show_stack+0x2c/0x3c [ 77.632172][ T4970] __dump_stack+0x30/0x40 [ 77.632942][ T4970] dump_stack_lvl+0xf8/0x160 [ 77.633696][ T4970] print_address_description+0x78/0x30c [ 77.634633][ T4970] kasan_report+0xec/0x15c [ 77.635370][ T4970] __asan_report_load8_noabort+0x44/0x50 [ 77.636270][ T4970] __lock_acquire+0xf0/0x651c [ 77.637003][ T4970] lock_acquire+0x1f4/0x620 [ 77.637777][ T4970] _raw_spin_lock_irq+0xcc/0x13c [ 77.638569][ T4970] io_poll_remove_entries+0x168/0x430 [ 77.639413][ T4970] io_poll_task_func+0xe8/0x250 [ 77.640143][ T4970] tctx_task_work+0x284/0x514 [ 77.640806][ T4970] task_work_run+0x12c/0x1e0 [ 77.641497][ T4970] do_exit+0x684/0x1f58 [ 77.642105][ T4970] do_group_exit+0x100/0x268 [ 77.642813][ T4970] get_signal+0x73c/0x1340 [ 77.643467][ T4970] do_notify_resume+0x35c/0x3128 [ 77.644265][ T4970] el0_svc+0xf0/0x1e0 [ 77.644953][ T4970] el0t_64_sync_handler+0xcc/0xe4 [ 77.645769][ T4970] el0t_64_sync+0x1a0/0x1a4 [ 77.646513][ T4970] [ 77.646904][ T4970] Allocated by task 1: [ 77.647553][ T4970] __kasan_kmalloc+0xb0/0xf0 [ 77.648331][ T4970] kmem_cache_alloc_trace+0x274/0x3fc [ 77.649238][ T4970] comedi_device_postconfig+0x428/0xb48 [ 77.650107][ T4970] comedi_auto_config+0x228/0x328 [ 77.650880][ T4970] comedi_test_init+0xb0/0x14c [ 77.651639][ T4970] do_one_initcall+0x228/0x8b0 [ 77.652380][ T4970] do_initcall_level+0x154/0x214 [ 77.653172][ T4970] do_initcalls+0x58/0xac [ 77.653797][ T4970] do_basic_setup+0x8c/0xa0 [ 77.654443][ T4970] kernel_init_freeable+0x404/0x5fc [ 77.655301][ T4970] kernel_init+0x24/0x1d0 [ 77.655950][ T4970] ret_from_fork+0x10/0x20 [ 77.656673][ T4970] [ 77.657063][ T4970] Freed by task 4970: [ 77.657742][ T4970] kasan_set_track+0x4c/0x84 [ 77.658552][ T4970] kasan_set_free_info+0x28/0x4c [ 77.659398][ T4970] ____kasan_slab_free+0x118/0x164 [ 77.660178][ T4970] __kasan_slab_free+0x18/0x28 [ 77.660962][ T4970] slab_free_freelist_hook+0x128/0x1e8 [ 77.661875][ T4970] kfree+0x170/0x40c [ 77.662497][ T4970] comedi_device_detach+0x2c4/0x5d8 [ 77.663336][ T4970] comedi_unlocked_ioctl+0xb28/0xdcc [ 77.664205][ T4970] __arm64_sys_ioctl+0x14c/0x1c8 [ 77.665064][ T4970] invoke_syscall+0x98/0x2b8 [ 77.665839][ T4970] el0_svc_common+0x138/0x258 [ 77.666573][ T4970] do_el0_svc+0x58/0x14c [ 77.667240][ T4970] el0_svc+0x78/0x1e0 [ 77.667892][ T4970] el0t_64_sync_handler+0xcc/0xe4 [ 77.668681][ T4970] el0t_64_sync+0x1a0/0x1a4 [ 77.669413][ T4970] [ 77.669792][ T4970] The buggy address belongs to the object at ffff0000d186ac00 [ 77.669792][ T4970] which belongs to the cache kmalloc-256 of size 256 [ 77.672048][ T4970] The buggy address is located 184 bytes inside of [ 77.672048][ T4970] 256-byte region [ffff0000d186ac00, ffff0000d186ad00) [ 77.674276][ T4970] The buggy address belongs to the page: [ 77.675202][ T4970] page:0000000090cbf337 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11186a [ 77.676817][ T4970] head:0000000090cbf337 order:1 compound_mapcount:0 [ 77.677983][ T4970] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 77.679266][ T4970] raw: 05ffc00000010200 fffffc0003461a00 0000000800000008 ffff0000c0002480 [ 77.680654][ T4970] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 77.682057][ T4970] page dumped because: kasan: bad access detected [ 77.683122][ T4970] [ 77.683516][ T4970] Memory state around the buggy address: [ 77.684468][ T4970] ffff0000d186ab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.685769][ T4970] ffff0000d186ac00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 77.687051][ T4970] >ffff0000d186ac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 77.688345][ T4970] ^ [ 77.689297][ T4970] ffff0000d186ad00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.690627][ T4970] ffff0000d186ad80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.691944][ T4970] ================================================================== [ 77.693275][ T4970] Disabling lock debugging due to kernel taint 1970/01/01 00:01:17 executed programs: 6 [ 79.034382][ T7] Bluetooth: hci0: command 0x040f tx timeout [ 79.977612][ T346] device hsr_slave_0 left promiscuous mode [ 80.015754][ T346] device hsr_slave_1 left promiscuous mode [ 80.084846][ T346] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 80.086127][ T346] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 80.087658][ T346] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 80.088844][ T346] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 80.090183][ T346] device bridge_slave_1 left promiscuous mode [ 80.091212][ T346] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.136509][ T346] device bridge_slave_0 left promiscuous mode [ 80.137596][ T346] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.264184][ T346] device veth1_macvtap left promiscuous mode [ 80.265209][ T346] device veth0_macvtap left promiscuous mode [ 80.266201][ T346] device veth1_vlan left promiscuous mode [ 80.267063][ T346] device veth0_vlan left promiscuous mode [ 80.386179][ T346] team0 (unregistering): Port device team_slave_1 removed [ 80.389984][ T346] team0 (unregistering): Port device team_slave_0 removed [ 80.393387][ T346] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 80.427630][ T346] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 80.530070][ T346] bond0 (unregistering): Released all slaves [ 81.114814][ T4252] Bluetooth: hci0: command 0x0419 tx timeout 1970/01/01 00:01:22 executed programs: 287