[ 138.413998][ T1301] ieee802154 phy0 wpan0: encryption failed: -22
[ 138.420814][ T1301] ieee802154 phy1 wpan1: encryption failed: -22
Warning: Permanently added '10.128.10.32' (ED25519) to the list of known hosts.
2025/06/01 06:00:51 ignoring optional flag "sandboxArg"="0"
2025/06/01 06:00:53 parsed 1 programs
[ 150.269116][ T6330] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 154.992271][ T6366] chnl_net:caif_netlink_parms(): no params data found
[ 155.087716][ T6366] bridge0: port 1(bridge_slave_0) entered blocking state
[ 155.095739][ T6366] bridge0: port 1(bridge_slave_0) entered disabled state
[ 155.104108][ T6366] bridge_slave_0: entered allmulticast mode
[ 155.112632][ T6366] bridge_slave_0: entered promiscuous mode
[ 155.121193][ T6366] bridge0: port 2(bridge_slave_1) entered blocking state
[ 155.128657][ T6366] bridge0: port 2(bridge_slave_1) entered disabled state
[ 155.136969][ T6366] bridge_slave_1: entered allmulticast mode
[ 155.145489][ T6366] bridge_slave_1: entered promiscuous mode
[ 155.208317][ T6366] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 155.222173][ T6366] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 155.277036][ T6366] team0: Port device team_slave_0 added
[ 155.285888][ T6366] team0: Port device team_slave_1 added
[ 155.318453][ T6366] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 155.326235][ T6366] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 155.355429][ T6366] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 155.368844][ T6366] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 155.376494][ T6366] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 155.404080][ T6366] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 155.458789][ T6366] hsr_slave_0: entered promiscuous mode
[ 155.466025][ T6366] hsr_slave_1: entered promiscuous mode
[ 156.104972][ T6366] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 156.118252][ T6366] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 156.132978][ T6366] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 156.146209][ T6366] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 156.272531][ T6366] 8021q: adding VLAN 0 to HW filter on device bond0
[ 156.305549][ T6366] 8021q: adding VLAN 0 to HW filter on device team0
[ 156.320571][ T1089] bridge0: port 1(bridge_slave_0) entered blocking state
[ 156.328325][ T1089] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 156.354535][ T1089] bridge0: port 2(bridge_slave_1) entered blocking state
[ 156.361828][ T1089] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 156.711732][ T6366] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 156.792356][ T6366] veth0_vlan: entered promiscuous mode
[ 156.809670][ T6366] veth1_vlan: entered promiscuous mode
[ 156.866091][ T6366] veth0_macvtap: entered promiscuous mode
[ 156.882873][ T6366] veth1_macvtap: entered promiscuous mode
[ 156.915684][ T6366] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 156.933999][ T6366] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 156.949724][ T6366] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 156.960232][ T6366] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 156.971961][ T6366] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 156.981203][ T6366] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 157.221770][ T3521] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 157.305134][ T3521] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 157.422730][ T3521] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 157.558074][ T3521] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 157.755922][ T1089] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 157.782186][ T1089] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 157.815858][ T1148] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 157.825888][ T1148] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 159.292759][ T3521] bridge_slave_1: left allmulticast mode
[ 159.298794][ T3521] bridge_slave_1: left promiscuous mode
[ 159.340565][ T3521] bridge0: port 2(bridge_slave_1) entered disabled state
[ 159.377815][ T3521] bridge_slave_0: left allmulticast mode
[ 159.395319][ T3521] bridge_slave_0: left promiscuous mode
[ 159.405920][ T3521] bridge0: port 1(bridge_slave_0) entered disabled state
[ 159.832199][ T3521] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 159.846688][ T3521] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 159.858600][ T3521] bond0 (unregistering): Released all slaves
[ 159.983297][ T3521] hsr_slave_0: left promiscuous mode
[ 159.989684][ T3521] hsr_slave_1: left promiscuous mode
[ 159.997748][ T3521] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 160.006232][ T3521] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 160.018816][ T3521] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 160.027677][ T3521] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 160.049865][ T3521] veth1_macvtap: left promiscuous mode
[ 160.056691][ T3521] veth0_macvtap: left promiscuous mode
[ 160.062965][ T3521] veth1_vlan: left promiscuous mode
[ 160.068714][ T3521] veth0_vlan: left promiscuous mode
[ 160.642506][ T3521] team0 (unregistering): Port device team_slave_1 removed
[ 160.686754][ T3521] team0 (unregistering): Port device team_slave_0 removed
[ 162.459364][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 162.482441][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 162.490848][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 162.504537][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 162.516710][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
2025/06/01 06:01:12 executed programs: 0
[ 163.988205][ T5915] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 163.997054][ T5915] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 164.006339][ T5915] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 164.024613][ T5915] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 164.033759][ T5915] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 164.374862][ T6570] chnl_net:caif_netlink_parms(): no params data found
[ 164.532651][ T6570] bridge0: port 1(bridge_slave_0) entered blocking state
[ 164.540413][ T6570] bridge0: port 1(bridge_slave_0) entered disabled state
[ 164.549173][ T6570] bridge_slave_0: entered allmulticast mode
[ 164.557682][ T6570] bridge_slave_0: entered promiscuous mode
[ 164.568249][ T6570] bridge0: port 2(bridge_slave_1) entered blocking state
[ 164.576082][ T6570] bridge0: port 2(bridge_slave_1) entered disabled state
[ 164.583870][ T6570] bridge_slave_1: entered allmulticast mode
[ 164.593103][ T6570] bridge_slave_1: entered promiscuous mode
[ 164.646733][ T6570] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 164.666622][ T6570] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 164.722125][ T6570] team0: Port device team_slave_0 added
[ 164.732888][ T6570] team0: Port device team_slave_1 added
[ 164.784068][ T6570] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 164.792090][ T6570] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 164.821100][ T6570] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 164.836731][ T6570] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 164.844434][ T6570] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 164.873082][ T6570] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 164.948014][ T6570] hsr_slave_0: entered promiscuous mode
[ 164.955600][ T6570] hsr_slave_1: entered promiscuous mode
[ 165.473145][ T6570] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 165.485636][ T6570] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 165.501796][ T6570] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 165.515648][ T6570] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 165.645713][ T6570] 8021q: adding VLAN 0 to HW filter on device bond0
[ 165.681337][ T6570] 8021q: adding VLAN 0 to HW filter on device team0
[ 165.700247][ T64] bridge0: port 1(bridge_slave_0) entered blocking state
[ 165.707666][ T64] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 165.734638][ T3521] bridge0: port 2(bridge_slave_1) entered blocking state
[ 165.742293][ T3521] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 166.091357][ T51] Bluetooth: hci0: command tx timeout
[ 166.113885][ T6570] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 166.192522][ T6570] veth0_vlan: entered promiscuous mode
[ 166.210049][ T6570] veth1_vlan: entered promiscuous mode
[ 166.254963][ T6570] veth0_macvtap: entered promiscuous mode
[ 166.268104][ T6570] veth1_macvtap: entered promiscuous mode
[ 166.295321][ T6570] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 166.315677][ T6570] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 166.330505][ T6570] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 166.341471][ T6570] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 166.352192][ T6570] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 166.361916][ T6570] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 166.478193][ T3521] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 166.495486][ T3521] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 166.538480][ T1089] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 166.547775][ T1089] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 168.170742][ T51] Bluetooth: hci0: command tx timeout
2025/06/01 06:01:17 executed programs: 66
[ 170.251696][ T51] Bluetooth: hci0: command tx timeout
[ 172.331094][ T51] Bluetooth: hci0: command tx timeout
2025/06/01 06:01:22 executed programs: 211
2025/06/01 06:01:27 executed programs: 455
[ 182.028805][ T5915] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 182.039097][ T5915] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 182.048220][ T5915] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 182.057375][ T5915] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 182.066184][ T5915] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 182.185103][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 182.276116][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 182.303567][ T7977] chnl_net:caif_netlink_parms(): no params data found
[ 182.341544][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 182.422376][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 182.438708][ T7977] bridge0: port 1(bridge_slave_0) entered blocking state
[ 182.446591][ T7977] bridge0: port 1(bridge_slave_0) entered disabled state
[ 182.454145][ T7977] bridge_slave_0: entered allmulticast mode
[ 182.462556][ T7977] bridge_slave_0: entered promiscuous mode
[ 182.472019][ T7977] bridge0: port 2(bridge_slave_1) entered blocking state
[ 182.479510][ T7977] bridge0: port 2(bridge_slave_1) entered disabled state
[ 182.487125][ T7977] bridge_slave_1: entered allmulticast mode
[ 182.495295][ T7977] bridge_slave_1: entered promiscuous mode
[ 182.539149][ T7977] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 182.553026][ T7977] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 182.649919][ T7977] team0: Port device team_slave_0 added
[ 182.662821][ T7977] team0: Port device team_slave_1 added
[ 182.698538][ T12] bridge_slave_1: left allmulticast mode
[ 182.704918][ T12] bridge_slave_1: left promiscuous mode
[ 182.711069][ T12] bridge0: port 2(bridge_slave_1) entered disabled state
[ 182.722289][ T12] bridge_slave_0: left allmulticast mode
[ 182.728103][ T12] bridge_slave_0: left promiscuous mode
[ 182.734741][ T12] bridge0: port 1(bridge_slave_0) entered disabled state
[ 183.001739][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 183.013914][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 183.024181][ T12] bond0 (unregistering): Released all slaves
[ 183.077491][ T7977] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 183.087778][ T7977] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 183.127953][ T7977] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 183.196509][ T7977] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 183.204803][ T7977] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 183.238939][ T7977] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 183.396510][ T7977] hsr_slave_0: entered promiscuous mode
[ 183.411321][ T7977] hsr_slave_1: entered promiscuous mode
[ 183.418479][ T7977] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 183.429100][ T7977] Cannot create hsr debugfs directory
[ 183.448169][ T12] hsr_slave_0: left promiscuous mode
[ 183.454941][ T12] hsr_slave_1: left promiscuous mode
[ 183.464899][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 183.473534][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 183.484757][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 183.492729][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 183.521587][ T12] veth1_macvtap: left promiscuous mode
[ 183.527416][ T12] veth0_macvtap: left promiscuous mode
[ 183.535578][ T12] veth1_vlan: left promiscuous mode
[ 183.541913][ T12] veth0_vlan: left promiscuous mode
[ 183.996113][ T12] team0 (unregistering): Port device team_slave_1 removed
[ 184.029521][ T12] team0 (unregistering): Port device team_slave_0 removed
[ 184.092999][ T51] Bluetooth: hci1: command tx timeout
[ 185.028444][ T7977] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 185.042200][ T7977] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 185.054873][ T7977] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 185.069298][ T7977] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 185.195977][ T7977] 8021q: adding VLAN 0 to HW filter on device bond0
[ 185.223824][ T7977] 8021q: adding VLAN 0 to HW filter on device team0
[ 185.242218][ T1089] bridge0: port 1(bridge_slave_0) entered blocking state
[ 185.249503][ T1089] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 185.263927][ T1161] bridge0: port 2(bridge_slave_1) entered blocking state
[ 185.271396][ T1161] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 185.330840][ T7977] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[ 185.342469][ T7977] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 185.622805][ T7977] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 185.696745][ T7977] veth0_vlan: entered promiscuous mode
[ 185.714202][ T7977] veth1_vlan: entered promiscuous mode
[ 185.765443][ T7977] veth0_macvtap: entered promiscuous mode
[ 185.783173][ T7977] veth1_macvtap: entered promiscuous mode
[ 185.817363][ T7977] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 185.837998][ T7977] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 185.858904][ T7977] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 185.870152][ T7977] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 185.882214][ T7977] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 185.892482][ T7977] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 186.001055][ T1089] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 186.008942][ T1089] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 186.068585][ T1089] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 186.078282][ T1089] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
2025/06/01 06:01:34 executed programs: 602
[ 186.155940][ T8037] ==================================================================
[ 186.164259][ T8037] BUG: KASAN: slab-use-after-free in force_devcd_write+0x312/0x340
[ 186.170816][ T51] Bluetooth: hci1: command tx timeout
[ 186.172300][ T8037] Read of size 8 at addr ffff88807ce36800 by task syz.0.616/8037
[ 186.185886][ T8037]
[ 186.188254][ T8037] CPU: 1 UID: 0 PID: 8037 Comm: syz.0.616 Not tainted 6.15.0-syzkaller-g7d4e49a77d99 #0 PREEMPT(full)
[ 186.188290][ T8037] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
[ 186.188307][ T8037] Call Trace:
[ 186.188317][ T8037]
[ 186.188328][ T8037] dump_stack_lvl+0x116/0x1f0
[ 186.188370][ T8037] print_report+0xcd/0x680
[ 186.188409][ T8037] ? __virt_addr_valid+0x81/0x610
[ 186.188449][ T8037] ? __phys_addr+0xe8/0x180
[ 186.188490][ T8037] ? force_devcd_write+0x312/0x340
[ 186.188539][ T8037] kasan_report+0xe0/0x110
[ 186.188578][ T8037] ? force_devcd_write+0x312/0x340
[ 186.188621][ T8037] force_devcd_write+0x312/0x340
[ 186.188661][ T8037] ? __pfx_force_devcd_write+0x10/0x10
[ 186.188704][ T8037] ? __debugfs_file_get+0x1fe/0x840
[ 186.188745][ T8037] ? __pfx___debugfs_file_get+0x10/0x10
[ 186.188791][ T8037] full_proxy_write+0x13c/0x200
[ 186.188832][ T8037] ? __pfx_full_proxy_write+0x10/0x10
[ 186.188871][ T8037] vfs_write+0x2a0/0x1150
[ 186.188907][ T8037] ? __pfx___mutex_lock+0x10/0x10
[ 186.188946][ T8037] ? __pfx_vfs_write+0x10/0x10
[ 186.188984][ T8037] ? __fget_files+0x20e/0x3c0
[ 186.189022][ T8037] ksys_write+0x12a/0x250
[ 186.189056][ T8037] ? __pfx_ksys_write+0x10/0x10
[ 186.189095][ T8037] do_syscall_64+0xcd/0x490
[ 186.189134][ T8037] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 186.189163][ T8037] RIP: 0033:0x7f312fd8d169
[ 186.189185][ T8037] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 186.189213][ T8037] RSP: 002b:00007f3130b98038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 186.189240][ T8037] RAX: ffffffffffffffda RBX: 00007f312ffa5fa0 RCX: 00007f312fd8d169
[ 186.189260][ T8037] RDX: 000000000000000e RSI: 0000000000000000 RDI: 0000000000000003
[ 186.189276][ T8037] RBP: 00007f312fe0e2a0 R08: 0000000000000000 R09: 0000000000000000
[ 186.189294][ T8037] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 186.189310][ T8037] R13: 0000000000000000 R14: 00007f312ffa5fa0 R15: 00007ffc5f838458
[ 186.189337][ T8037]
[ 186.189347][ T8037]
[ 186.404360][ T8037] Allocated by task 6570:
[ 186.408826][ T8037] kasan_save_stack+0x33/0x60
[ 186.413922][ T8037] kasan_save_track+0x14/0x30
[ 186.418671][ T8037] __kasan_kmalloc+0xaa/0xb0
[ 186.423512][ T8037] vhci_open+0x4c/0x430
[ 186.427874][ T8037] misc_open+0x35d/0x420
[ 186.432289][ T8037] chrdev_open+0x234/0x6a0
[ 186.436847][ T8037] do_dentry_open+0x741/0x1c10
[ 186.441776][ T8037] vfs_open+0x82/0x3f0
[ 186.446019][ T8037] path_openat+0x1de4/0x2cb0
[ 186.450950][ T8037] do_filp_open+0x20b/0x470
[ 186.455698][ T8037] do_sys_openat2+0x11b/0x1d0
[ 186.460524][ T8037] __x64_sys_openat+0x174/0x210
[ 186.465681][ T8037] do_syscall_64+0xcd/0x490
[ 186.470421][ T8037] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 186.476371][ T8037]
[ 186.478732][ T8037] Freed by task 6570:
[ 186.482751][ T8037] kasan_save_stack+0x33/0x60
[ 186.488197][ T8037] kasan_save_track+0x14/0x30
[ 186.492944][ T8037] kasan_save_free_info+0x3b/0x60
[ 186.498033][ T8037] __kasan_slab_free+0x51/0x70
[ 186.502958][ T8037] kfree+0x2b4/0x4d0
[ 186.507055][ T8037] vhci_release+0xbb/0xf0
[ 186.511452][ T8037] __fput+0x3ff/0xb70
[ 186.515498][ T8037] task_work_run+0x150/0x240
[ 186.520238][ T8037] do_exit+0x864/0x2bd0
[ 186.524635][ T8037] do_group_exit+0xd3/0x2a0
[ 186.529369][ T8037] get_signal+0x2673/0x26d0
[ 186.534041][ T8037] arch_do_signal_or_restart+0x8f/0x790
[ 186.539926][ T8037] exit_to_user_mode_loop+0x84/0x110
[ 186.545626][ T8037] do_syscall_64+0x3f6/0x490
[ 186.550726][ T8037] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 186.556854][ T8037]
[ 186.559318][ T8037] The buggy address belongs to the object at ffff88807ce36800
[ 186.559318][ T8037] which belongs to the cache kmalloc-1k of size 1024
[ 186.574060][ T8037] The buggy address is located 0 bytes inside of
[ 186.574060][ T8037] freed 1024-byte region [ffff88807ce36800, ffff88807ce36c00)
[ 186.588007][ T8037]
[ 186.590374][ T8037] The buggy address belongs to the physical page:
[ 186.596916][ T8037] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7ce30
[ 186.605925][ T8037] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 186.614907][ T8037] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 186.622768][ T8037] page_type: f5(slab)
[ 186.626864][ T8037] raw: 00fff00000000040 ffff88801b441dc0 ffffea0001a41800 dead000000000002
[ 186.635708][ T8037] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[ 186.644786][ T8037] head: 00fff00000000040 ffff88801b441dc0 ffffea0001a41800 dead000000000002
[ 186.653870][ T8037] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[ 186.662691][ T8037] head: 00fff00000000003 ffffea0001f38c01 00000000ffffffff 00000000ffffffff
[ 186.671507][ T8037] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 186.680508][ T8037] page dumped because: kasan: bad access detected
[ 186.686972][ T8037] page_owner tracks the page as allocated
[ 186.692725][ T8037] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6547, tgid 6547 (syz-executor), ts 163069644702, free_ts 163030057077
[ 186.714800][ T8037] post_alloc_hook+0x1c0/0x230
[ 186.719717][ T8037] get_page_from_freelist+0x1321/0x3890
[ 186.725765][ T8037] __alloc_frozen_pages_noprof+0x261/0x23f0
[ 186.731889][ T8037] alloc_pages_mpol+0x1fb/0x550
[ 186.737008][ T8037] new_slab+0x23b/0x330
[ 186.741468][ T8037] ___slab_alloc+0xd9c/0x1940
[ 186.746565][ T8037] __slab_alloc.constprop.0+0x56/0xb0
[ 186.752343][ T8037] __kmalloc_cache_noprof+0xfb/0x3e0
[ 186.758305][ T8037] afs_alloc_call+0x51/0x640
[ 186.763130][ T8037] afs_charge_preallocation+0xf7/0x320
[ 186.768929][ T8037] afs_open_socket+0x323/0x400
[ 186.773945][ T8037] afs_net_init+0x825/0xb00
[ 186.778599][ T8037] ops_init+0x1e2/0x5f0
[ 186.782904][ T8037] setup_net+0x1ff/0x510
[ 186.787372][ T8037] copy_net_ns+0x2a6/0x5f0
[ 186.791833][ T8037] create_new_namespaces+0x3ea/0xa90
[ 186.797269][ T8037] page last free pid 6547 tgid 6547 stack trace:
[ 186.803724][ T8037] __free_frozen_pages+0x7fe/0x1180
[ 186.809153][ T8037] __put_partials+0x16d/0x1c0
[ 186.814073][ T8037] qlist_free_all+0x4d/0x120
[ 186.818728][ T8037] kasan_quarantine_reduce+0x195/0x1e0
[ 186.824261][ T8037] __kasan_slab_alloc+0x69/0x90
[ 186.829375][ T8037] __kmalloc_cache_noprof+0x1f1/0x3e0
[ 186.834891][ T8037] register_netdevice+0x4eb/0x2270
[ 186.840420][ T8037] register_netdev+0x34/0x50
[ 186.845413][ T8037] sit_init_net+0x286/0x630
[ 186.849971][ T8037] ops_init+0x1e2/0x5f0
[ 186.854182][ T8037] setup_net+0x1ff/0x510
[ 186.858702][ T8037] copy_net_ns+0x2a6/0x5f0
[ 186.863263][ T8037] create_new_namespaces+0x3ea/0xa90
[ 186.868702][ T8037] unshare_nsproxy_namespaces+0xc0/0x1f0
[ 186.874493][ T8037] ksys_unshare+0x45b/0xa40
[ 186.879217][ T8037] __x64_sys_unshare+0x31/0x40
[ 186.884135][ T8037]
[ 186.886492][ T8037] Memory state around the buggy address:
[ 186.892187][ T8037] ffff88807ce36700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 186.900565][ T8037] ffff88807ce36780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 186.908850][ T8037] >ffff88807ce36800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 186.917390][ T8037] ^
[ 186.921582][ T8037] ffff88807ce36880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 186.929864][ T8037] ffff88807ce36900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 186.938155][ T8037] ==================================================================
[ 186.949537][ T8037] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 186.957146][ T8037] CPU: 1 UID: 0 PID: 8037 Comm: syz.0.616 Not tainted 6.15.0-syzkaller-g7d4e49a77d99 #0 PREEMPT(full)
[ 186.968330][ T8037] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
[ 186.978705][ T8037] Call Trace:
[ 186.982025][ T8037]
[ 186.984998][ T8037] dump_stack_lvl+0x3d/0x1f0
[ 186.989746][ T8037] panic+0x71c/0x800
[ 186.993714][ T8037] ? __pfx_panic+0x10/0x10
[ 186.998434][ T8037] ? mark_held_locks+0x49/0x80
[ 187.003404][ T8037] ? preempt_schedule_thunk+0x16/0x30
[ 187.008832][ T8037] ? force_devcd_write+0x312/0x340
[ 187.014359][ T8037] ? preempt_schedule_common+0x44/0xc0
[ 187.019874][ T8037] ? check_panic_on_warn+0x1f/0xb0
[ 187.025048][ T8037] ? force_devcd_write+0x312/0x340
[ 187.030239][ T8037] check_panic_on_warn+0xab/0xb0
[ 187.035412][ T8037] end_report+0x107/0x170
[ 187.039904][ T8037] kasan_report+0xee/0x110
[ 187.044619][ T8037] ? force_devcd_write+0x312/0x340
[ 187.049984][ T8037] force_devcd_write+0x312/0x340
[ 187.055097][ T8037] ? __pfx_force_devcd_write+0x10/0x10
[ 187.060906][ T8037] ? __debugfs_file_get+0x1fe/0x840
[ 187.066278][ T8037] ? __pfx___debugfs_file_get+0x10/0x10
[ 187.072010][ T8037] full_proxy_write+0x13c/0x200
[ 187.076939][ T8037] ? __pfx_full_proxy_write+0x10/0x10
[ 187.082569][ T8037] vfs_write+0x2a0/0x1150
[ 187.087048][ T8037] ? __pfx___mutex_lock+0x10/0x10
[ 187.092410][ T8037] ? __pfx_vfs_write+0x10/0x10
[ 187.097439][ T8037] ? __fget_files+0x20e/0x3c0
[ 187.102733][ T8037] ksys_write+0x12a/0x250
[ 187.107310][ T8037] ? __pfx_ksys_write+0x10/0x10
[ 187.112250][ T8037] do_syscall_64+0xcd/0x490
[ 187.117112][ T8037] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 187.123159][ T8037] RIP: 0033:0x7f312fd8d169
[ 187.127639][ T8037] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 187.147829][ T8037] RSP: 002b:00007f3130b98038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 187.157000][ T8037] RAX: ffffffffffffffda RBX: 00007f312ffa5fa0 RCX: 00007f312fd8d169
[ 187.165270][ T8037] RDX: 000000000000000e RSI: 0000000000000000 RDI: 0000000000000003
[ 187.173569][ T8037] RBP: 00007f312fe0e2a0 R08: 0000000000000000 R09: 0000000000000000
[ 187.181686][ T8037] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 187.189883][ T8037] R13: 0000000000000000 R14: 00007f312ffa5fa0 R15: 00007ffc5f838458
[ 187.198089][ T8037]
[ 187.201586][ T8037] Kernel Offset: disabled
[ 187.205920][ T8037] Rebooting in 86400 seconds..