Warning: Permanently added '10.128.1.210' (ED25519) to the list of known hosts. 2026/02/10 16:28:01 parsed 1 programs [ 132.796853][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.796947][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 Setting up swapspace version 1, size = 127995904 bytes [ 134.842479][ T6144] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 138.164041][ T6159] chnl_net:caif_netlink_parms(): no params data found [ 138.582349][ T6159] bridge0: port 1(bridge_slave_0) entered blocking state [ 138.582469][ T6159] bridge0: port 1(bridge_slave_0) entered disabled state [ 138.582598][ T6159] bridge_slave_0: entered allmulticast mode [ 138.583985][ T6159] bridge_slave_0: entered promiscuous mode [ 138.586002][ T6159] bridge0: port 2(bridge_slave_1) entered blocking state [ 138.586118][ T6159] bridge0: port 2(bridge_slave_1) entered disabled state [ 138.586211][ T6159] bridge_slave_1: entered allmulticast mode [ 138.587548][ T6159] bridge_slave_1: entered promiscuous mode [ 138.836472][ T6159] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 138.840280][ T6159] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 139.006505][ T6159] team0: Port device team_slave_0 added [ 139.008469][ T6159] team0: Port device team_slave_1 added [ 139.173841][ T6159] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 139.173857][ T6159] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 139.173878][ T6159] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 139.175112][ T6159] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 139.175123][ T6159] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 139.175143][ T6159] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 139.537709][ T6159] hsr_slave_0: entered promiscuous mode [ 139.538470][ T6159] hsr_slave_1: entered promiscuous mode [ 141.057018][ T6159] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 141.092827][ T6159] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 141.131837][ T6159] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 141.166010][ T6159] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 141.321023][ T6159] 8021q: adding VLAN 0 to HW filter on device bond0 [ 141.357496][ T6159] 8021q: adding VLAN 0 to HW filter on device team0 [ 141.375622][ T150] bridge0: port 1(bridge_slave_0) entered blocking state [ 141.385018][ T150] bridge0: port 1(bridge_slave_0) entered forwarding state [ 141.413029][ T150] bridge0: port 2(bridge_slave_1) entered blocking state [ 141.417536][ T150] bridge0: port 2(bridge_slave_1) entered forwarding state [ 141.708433][ T6159] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 141.768467][ T6159] veth0_vlan: entered promiscuous mode [ 141.776933][ T6159] veth1_vlan: entered promiscuous mode [ 141.828234][ T6159] veth0_macvtap: entered promiscuous mode [ 141.835903][ T6159] veth1_macvtap: entered promiscuous mode [ 141.856892][ T6159] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 141.867918][ T6159] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 141.877594][ T70] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 141.877813][ T70] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 141.877846][ T70] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 141.877876][ T70] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 142.718851][ T41] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 143.026358][ T41] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 143.440036][ T41] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 144.756353][ T41] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 145.606372][ T41] bridge_slave_1: left allmulticast mode [ 145.606401][ T41] bridge_slave_1: left promiscuous mode [ 145.606628][ T41] bridge0: port 2(bridge_slave_1) entered disabled state [ 145.673606][ T41] bridge_slave_0: left allmulticast mode [ 145.673633][ T41] bridge_slave_0: left promiscuous mode [ 145.673863][ T41] bridge0: port 1(bridge_slave_0) entered disabled state [ 147.372702][ T41] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 147.433020][ T41] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 147.474352][ T41] bond0 (unregistering): Released all slaves [ 147.786542][ T60] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 147.793143][ T60] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 147.806870][ T60] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 147.813571][ T60] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 147.814675][ T60] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 147.835742][ T41] hsr_slave_0: left promiscuous mode [ 147.883009][ T41] hsr_slave_1: left promiscuous mode [ 147.883915][ T41] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 147.883937][ T41] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 147.943101][ T41] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 147.943126][ T41] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 148.052163][ T41] veth1_macvtap: left promiscuous mode [ 148.052265][ T41] veth0_macvtap: left promiscuous mode [ 148.052509][ T41] veth1_vlan: left promiscuous mode [ 148.052663][ T41] veth0_vlan: left promiscuous mode [ 149.912146][ T60] Bluetooth: hci0: command tx timeout [ 150.122626][ T41] team0 (unregistering): Port device team_slave_1 removed [ 150.332590][ T41] team0 (unregistering): Port device team_slave_0 removed [ 151.993066][ T60] Bluetooth: hci0: command tx timeout [ 154.796364][ T165] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 154.796385][ T165] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 154.860049][ T165] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 154.860067][ T165] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2026/02/10 16:28:26 executed programs: 0 [ 155.818418][ T5111] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 155.821095][ T5111] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 155.836544][ T5111] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 155.849148][ T5111] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 155.849862][ T5111] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 156.181713][ T6474] chnl_net:caif_netlink_parms(): no params data found [ 156.723132][ T6474] bridge0: port 1(bridge_slave_0) entered blocking state [ 156.723322][ T6474] bridge0: port 1(bridge_slave_0) entered disabled state [ 156.723568][ T6474] bridge_slave_0: entered allmulticast mode [ 156.727547][ T6474] bridge_slave_0: entered promiscuous mode [ 156.730593][ T6474] bridge0: port 2(bridge_slave_1) entered blocking state [ 156.730767][ T6474] bridge0: port 2(bridge_slave_1) entered disabled state [ 156.730908][ T6474] bridge_slave_1: entered allmulticast mode [ 156.734589][ T6474] bridge_slave_1: entered promiscuous mode [ 157.208431][ T6474] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 157.244646][ T6474] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 157.483828][ T6474] team0: Port device team_slave_0 added [ 157.535535][ T6474] team0: Port device team_slave_1 added [ 157.694607][ T6474] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 157.694624][ T6474] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 157.694647][ T6474] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 157.696743][ T6474] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 157.696755][ T6474] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 157.696777][ T6474] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 157.912212][ T5111] Bluetooth: hci0: command tx timeout [ 157.969756][ T6474] hsr_slave_0: entered promiscuous mode [ 157.970458][ T6474] hsr_slave_1: entered promiscuous mode [ 159.831546][ T6474] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 159.876899][ T6474] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 159.916040][ T6474] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 159.961808][ T6474] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 159.992060][ T5111] Bluetooth: hci0: command tx timeout [ 160.132756][ T6474] 8021q: adding VLAN 0 to HW filter on device bond0 [ 160.151887][ T6474] 8021q: adding VLAN 0 to HW filter on device team0 [ 160.163809][ T70] bridge0: port 1(bridge_slave_0) entered blocking state [ 160.164002][ T70] bridge0: port 1(bridge_slave_0) entered forwarding state [ 160.179136][ T70] bridge0: port 2(bridge_slave_1) entered blocking state [ 160.179413][ T70] bridge0: port 2(bridge_slave_1) entered forwarding state [ 160.485891][ T6474] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 160.537967][ T6474] veth0_vlan: entered promiscuous mode [ 160.564373][ T6474] veth1_vlan: entered promiscuous mode [ 160.596302][ T6474] veth0_macvtap: entered promiscuous mode [ 160.601385][ T6474] veth1_macvtap: entered promiscuous mode [ 160.627375][ T6474] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 160.638118][ T6474] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 160.651333][ T70] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 160.652525][ T70] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 160.652561][ T70] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 160.652592][ T70] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 160.863571][ T70] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 160.863591][ T70] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 160.930082][ T58] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 160.930101][ T58] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2026/02/10 16:28:31 executed programs: 2 [ 161.449664][ T6567] loop0: detected capacity change from 0 to 32768 [ 161.513375][ T6567] XFS (loop0): Mounting V5 Filesystem ca7e2101-b8f1-4838-8e2d-7637b90620e6 [ 161.534617][ T6567] XFS (loop0): Log size 624 blocks too small, minimum size is 816 blocks [ 161.534632][ T6567] XFS (loop0): AAIEEE! Log failed size checks. Abort! [ 161.561078][ T6567] XFS (loop0): log mount failed [ 162.072109][ T5111] Bluetooth: hci0: command tx timeout [ 162.159776][ T6588] loop0: detected capacity change from 0 to 32768 [ 162.196479][ T6588] XFS (loop0): Mounting V5 Filesystem ca7e2101-b8f1-4838-8e2d-7637b90620e6 [ 162.207178][ T6588] XFS (loop0): Log size 624 blocks too small, minimum size is 816 blocks [ 162.207201][ T6588] XFS (loop0): AAIEEE! Log failed size checks. Abort! [ 162.245779][ T6588] XFS (loop0): log mount failed [ 162.937366][ T6608] loop0: detected capacity change from 0 to 32768 [ 162.967105][ T6608] XFS (loop0): Mounting V5 Filesystem ca7e2101-b8f1-4838-8e2d-7637b90620e6 [ 162.992213][ T6608] XFS (loop0): Log size 624 blocks too small, minimum size is 816 blocks [ 162.992237][ T6608] XFS (loop0): AAIEEE! Log failed size checks. Abort! [ 163.043265][ T6608] XFS (loop0): log mount failed [ 163.278094][ T6608] loop0: detected capacity change from 0 to 128 [ 163.279181][ T6608] ======================================================= [ 163.279181][ T6608] WARNING: The mand mount option has been deprecated and [ 163.279181][ T6608] and is ignored by this kernel. Remove the mand [ 163.279181][ T6608] option from the mount to silence this warning. [ 163.279181][ T6608] ======================================================= [ 163.294227][ T6608] hpfs: filesystem error: i[ 163.294227][ T6608] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 163.294397][ T6608] hpfs: filesystem error: improperly stopped [ 163.294410][ T6608] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 163.294422][ T6608] hpfs: You really don't want any checks? You are crazy... [ 163.295309][ T6608] hpfs: hpfs_map_sector(): read error [ 163.295319][ T6608] hpfs: code page support is disabled [ 163.296648][ T6608] hpfs: filesystem error: map_dirent: not a directory [ 163.296660][ T6608] [ 163.296670][ T6608] hpfs: hpfs_map_4sectors(): unaligned read [ 163.296678][ T6608] hpfs: filesystem error: unable to find root dir [ 163.301472][ T6608] ================================================================== [ 163.301484][ T6608] BUG: KASAN: slab-use-after-free in hpfs_bplus_lookup+0x4f4/0x880 [ 163.301519][ T6608] Read of size 4 at addr ffff88801d726004 by task syz.0.19/6608 [ 163.301533][ T6608] [ 163.301557][ T6608] CPU: 1 UID: 0 PID: 6608 Comm: syz.0.19 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 163.301576][ T6608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 163.301592][ T6608] Call Trace: [ 163.301603][ T6608] [ 163.301610][ T6608] dump_stack_lvl+0xe8/0x150 [ 163.301634][ T6608] print_report+0xba/0x230 [ 163.301653][ T6608] ? hpfs_bplus_lookup+0x4f4/0x880 [ 163.301672][ T6608] kasan_report+0x117/0x150 [ 163.301695][ T6608] ? hpfs_bplus_lookup+0x4f4/0x880 [ 163.301719][ T6608] hpfs_bplus_lookup+0x4f4/0x880 [ 163.301744][ T6608] ? __pfx_hpfs_bplus_lookup+0x10/0x10 [ 163.301767][ T6608] ? do_raw_spin_lock+0x12b/0x2f0 [ 163.301784][ T6608] hpfs_bmap+0x230/0x4e0 [ 163.301802][ T6608] ? __pfx_hpfs_bmap+0x10/0x10 [ 163.301817][ T6608] ? lockdep_hardirqs_on+0x7a/0x110 [ 163.301836][ T6608] ? mutex_lock_nested+0x152/0x1d0 [ 163.301864][ T6608] ? hpfs_get_block+0x98/0x6e0 [ 163.301881][ T6608] hpfs_get_block+0xa8/0x6e0 [ 163.301899][ T6608] do_mpage_readpage+0x801/0x1980 [ 163.301933][ T6608] mpage_readahead+0x407/0x830 [ 163.301959][ T6608] ? __pfx_mpage_readahead+0x10/0x10 [ 163.301987][ T6608] ? __pfx_hpfs_get_block+0x10/0x10 [ 163.302001][ T6608] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 163.302020][ T6608] ? reacquire_held_locks+0x104/0x190 [ 163.302041][ T6608] ? blk_start_plug+0x6e/0x1b0 [ 163.302061][ T6608] read_pages+0x193/0x5a0 [ 163.302082][ T6608] ? __pfx_read_pages+0x10/0x10 [ 163.302098][ T6608] ? __folio_batch_add_and_move+0x6ce/0xa90 [ 163.302121][ T6608] ? filemap_add_folio+0x3d9/0x610 [ 163.302142][ T6608] page_cache_ra_unbounded+0x68a/0x8c0 [ 163.302168][ T6608] filemap_get_pages+0x47c/0x1e60 [ 163.302189][ T6608] ? __lock_acquire+0x6b5/0x2cf0 [ 163.302211][ T6608] ? __lock_acquire+0x6b5/0x2cf0 [ 163.302234][ T6608] ? __pfx_filemap_get_pages+0x10/0x10 [ 163.302254][ T6608] ? unwind_next_frame+0xa5/0x23c0 [ 163.302275][ T6608] ? is_bpf_text_address+0x26/0x2b0 [ 163.302303][ T6608] filemap_read+0x44a/0x1240 [ 163.302322][ T6608] ? is_bpf_text_address+0x292/0x2b0 [ 163.302342][ T6608] ? is_bpf_text_address+0x26/0x2b0 [ 163.302364][ T6608] ? __kernel_text_address+0xd/0x30 [ 163.302385][ T6608] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 163.302411][ T6608] ? __pfx_filemap_read+0x10/0x10 [ 163.302440][ T6608] ? __kmalloc_cache_noprof+0x1f2/0x6b0 [ 163.302460][ T6608] ? generic_file_read_iter+0x8f/0x520 [ 163.302480][ T6608] ? __asan_memset+0x22/0x50 [ 163.302497][ T6608] ? iov_iter_kvec+0xb8/0x180 [ 163.302514][ T6608] __kernel_read+0x50d/0x9c0 [ 163.302534][ T6608] ? __pfx___kernel_read+0x10/0x10 [ 163.302562][ T6608] integrity_kernel_read+0x89/0xd0 [ 163.302578][ T6608] ? __pfx_integrity_kernel_read+0x10/0x10 [ 163.302595][ T6608] ? __kmalloc_cache_noprof+0x1f2/0x6b0 [ 163.302615][ T6608] ? ima_calc_file_hash+0x129b/0x1800 [ 163.302637][ T6608] ima_calc_file_hash+0x12cf/0x1800 [ 163.302659][ T6608] ? unwind_next_frame+0xa5/0x23c0 [ 163.302680][ T6608] ? __pfx_ima_calc_file_hash+0x10/0x10 [ 163.302713][ T6608] ? arch_stack_walk+0xfb/0x150 [ 163.302737][ T6608] ? stack_trace_save+0xa9/0x100 [ 163.302757][ T6608] ? __pfx_stack_trace_save+0x10/0x10 [ 163.302778][ T6608] ? make_vfsgid+0x49/0xa0 [ 163.302797][ T6608] ? generic_fillattr+0x63d/0x9a0 [ 163.302824][ T6608] ima_collect_measurement+0x491/0x930 [ 163.302854][ T6608] ? __pfx_ima_collect_measurement+0x10/0x10 [ 163.302876][ T6608] ? do_raw_spin_lock+0x12b/0x2f0 [ 163.302904][ T6608] ? __pfx_ima_get_hash_algo+0x10/0x10 [ 163.302920][ T6608] ? lockdep_hardirqs_on+0x7a/0x110 [ 163.302937][ T6608] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 163.302958][ T6608] process_measurement+0x12d9/0x1c90 [ 163.302983][ T6608] ? __pfx_process_measurement+0x10/0x10 [ 163.303001][ T6608] ? smack_log+0xf5/0x3f0 [ 163.303022][ T6608] ? __pfx_smack_log+0x10/0x10 [ 163.303041][ T6608] ? tomoyo_check_open_permission+0x1d3/0x470 [ 163.303068][ T6608] ? __pfx_smack_file_open+0x10/0x10 [ 163.303089][ T6608] ? tomoyo_file_open+0x167/0x220 [ 163.303112][ T6608] ima_file_check+0xdf/0x130 [ 163.303129][ T6608] ? do_dentry_open+0xd5a/0x13e0 [ 163.303151][ T6608] ? __pfx_ima_file_check+0x10/0x10 [ 163.303173][ T6608] security_file_post_open+0xb3/0x260 [ 163.303192][ T6608] path_openat+0x2e82/0x38a0 [ 163.303224][ T6608] ? __pfx_path_openat+0x10/0x10 [ 163.303243][ T6608] ? kasan_save_track+0x4f/0x80 [ 163.303260][ T6608] ? kasan_save_track+0x3e/0x80 [ 163.303276][ T6608] ? __kasan_slab_alloc+0x6c/0x80 [ 163.303294][ T6608] ? kmem_cache_alloc_noprof+0x188/0x6a0 [ 163.303313][ T6608] ? do_getname+0x2e/0x250 [ 163.303332][ T6608] ? do_sys_openat2+0xca/0x200 [ 163.303350][ T6608] ? do_raw_spin_lock+0x12b/0x2f0 [ 163.303369][ T6608] do_file_open+0x23e/0x4a0 [ 163.303386][ T6608] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 163.303405][ T6608] ? __pfx_do_file_open+0x10/0x10 [ 163.303422][ T6608] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 163.303452][ T6608] ? alloc_fd+0x64e/0x6c0 [ 163.303471][ T6608] do_sys_openat2+0x113/0x200 [ 163.303486][ T6608] ? __se_sys_futex+0x3a8/0x450 [ 163.303503][ T6608] ? __pfx_do_sys_openat2+0x10/0x10 [ 163.303521][ T6608] ? rcu_is_watching+0x15/0xb0 [ 163.303542][ T6608] __x64_sys_openat+0x138/0x170 [ 163.303559][ T6608] do_syscall_64+0xe2/0xf80 [ 163.303576][ T6608] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 163.303593][ T6608] ? trace_irq_disable+0x37/0x100 [ 163.303612][ T6608] ? clear_bhb_loop+0x60/0xb0 [ 163.303629][ T6608] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 163.303645][ T6608] RIP: 0033:0x7f3aa67daef9 [ 163.303667][ T6608] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 163.303681][ T6608] RSP: 002b:00007f3aa5e3e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 163.303698][ T6608] RAX: ffffffffffffffda RBX: 00007f3aa6a45fa0 RCX: 00007f3aa67daef9 [ 163.303711][ T6608] RDX: 0000000000000000 RSI: 0000200000004280 RDI: ffffffffffffff9c [ 163.303722][ T6608] RBP: 00007f3aa686fee0 R08: 0000000000000000 R09: 0000000000000000 [ 163.303733][ T6608] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 163.303743][ T6608] R13: 00007f3aa6a46038 R14: 00007f3aa6a45fa0 R15: 00007fff109c4378 [ 163.303762][ T6608] [ 163.303768][ T6608] [ 163.303776][ T6608] Allocated by task 58: [ 163.303784][ T6608] kasan_save_track+0x3e/0x80 [ 163.303801][ T6608] __kasan_slab_alloc+0x6c/0x80 [ 163.303818][ T6608] kmem_cache_alloc_node_noprof+0x22f/0x6d0 [ 163.303836][ T6608] __alloc_skb+0x1d7/0x390 [ 163.303858][ T6608] mld_newpack+0x14c/0xc90 [ 163.303879][ T6608] add_grhead+0x5a/0x2a0 [ 163.303896][ T6608] add_grec+0x1452/0x1740 [ 163.303914][ T6608] mld_send_initial_cr+0x288/0x550 [ 163.303932][ T6608] ipv6_mc_dad_complete+0x88/0x540 [ 163.303950][ T6608] addrconf_dad_completed+0x622/0xe60 [ 163.303968][ T6608] addrconf_dad_work+0xdc4/0x1680 [ 163.303985][ T6608] process_scheduled_works+0xaec/0x17a0 [ 163.303998][ T6608] worker_thread+0xda6/0x1360 [ 163.304012][ T6608] kthread+0x388/0x470 [ 163.304028][ T6608] ret_from_fork+0x51b/0xa40 [ 163.304042][ T6608] ret_from_fork_asm+0x1a/0x30 [ 163.304062][ T6608] [ 163.304065][ T6608] Freed by task 58: [ 163.304072][ T6608] kasan_save_track+0x3e/0x80 [ 163.304088][ T6608] kasan_save_free_info+0x46/0x50 [ 163.304101][ T6608] __kasan_slab_free+0x5c/0x80 [ 163.304118][ T6608] kmem_cache_free+0x18d/0x8c0 [ 163.304136][ T6608] nsim_start_xmit+0x322/0xd30 [ 163.304153][ T6608] dev_hard_start_xmit+0x2df/0x830 [ 163.304166][ T6608] sch_direct_xmit+0x251/0x4c0 [ 163.304180][ T6608] __dev_queue_xmit+0x1594/0x3990 [ 163.304194][ T6608] ip6_output+0x340/0x550 [ 163.304212][ T6608] NF_HOOK+0xa2/0x3a0 [ 163.304229][ T6608] mld_sendpack+0x8b4/0xe40 [ 163.304248][ T6608] ipv6_mc_dad_complete+0x88/0x540 [ 163.304266][ T6608] addrconf_dad_completed+0x622/0xe60 [ 163.304283][ T6608] addrconf_dad_work+0xdc4/0x1680 [ 163.304300][ T6608] process_scheduled_works+0xaec/0x17a0 [ 163.304314][ T6608] worker_thread+0xda6/0x1360 [ 163.304327][ T6608] kthread+0x388/0x470 [ 163.304343][ T6608] ret_from_fork+0x51b/0xa40 [ 163.304357][ T6608] ret_from_fork_asm+0x1a/0x30 [ 163.304376][ T6608] [ 163.304380][ T6608] The buggy address belongs to the object at ffff88801d726000 [ 163.304380][ T6608] which belongs to the cache skbuff_head_cache of size 240 [ 163.304394][ T6608] The buggy address is located 4 bytes inside of [ 163.304394][ T6608] freed 240-byte region [ffff88801d726000, ffff88801d7260f0) [ 163.304410][ T6608] [ 163.304415][ T6608] The buggy address belongs to the physical page: [ 163.304431][ T6608] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1d726 [ 163.304450][ T6608] flags: 0x80000000000000(node=0|zone=1) [ 163.304466][ T6608] page_type: f5(slab) [ 163.304482][ T6608] raw: 0080000000000000 ffff88814128aa00 ffffea0000f24880 0000000000000008 [ 163.304495][ T6608] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000 [ 163.304503][ T6608] page dumped because: kasan: bad access detected [ 163.304514][ T6608] page_owner tracks the page as allocated [ 163.304520][ T6608] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 70, tgid 70 (kworker/u8:4), ts 141817991857, free_ts 141793730073 [ 163.304548][ T6608] post_alloc_hook+0x228/0x280 [ 163.304567][ T6608] get_page_from_freelist+0x28bb/0x2950 [ 163.304587][ T6608] __alloc_frozen_pages_noprof+0x18d/0x380 [ 163.304606][ T6608] alloc_pages_mpol+0xd1/0x380 [ 163.304625][ T6608] allocate_slab+0x86/0x3a0 [ 163.304640][ T6608] ___slab_alloc+0xaf8/0x13d0 [ 163.304653][ T6608] __slab_alloc+0xc5/0x1f0 [ 163.304666][ T6608] kmem_cache_alloc_node_noprof+0x1ad/0x6d0 [ 163.304684][ T6608] __alloc_skb+0x1d7/0x390 [ 163.304700][ T6608] rtmsg_ifinfo_build_skb+0x84/0x260 [ 163.304715][ T6608] rtmsg_ifinfo+0x8c/0x1a0 [ 163.304729][ T6608] netif_state_change+0x297/0x3a0 [ 163.304745][ T6608] __linkwatch_run_queue+0x575/0x850 [ 163.304758][ T6608] linkwatch_event+0x4c/0x60 [ 163.304771][ T6608] process_scheduled_works+0xaec/0x17a0 [ 163.304784][ T6608] worker_thread+0xda6/0x1360 [ 163.304798][ T6608] page last free pid 20 tgid 20 stack trace: [ 163.304806][ T6608] __free_frozen_pages+0xfd0/0x1160 [ 163.304824][ T6608] rcu_cpu_kthread+0x99e/0x1470 [ 163.304846][ T6608] smpboot_thread_fn+0x541/0xa50 [ 163.304861][ T6608] kthread+0x388/0x470 [ 163.304877][ T6608] ret_from_fork+0x51b/0xa40 [ 163.304891][ T6608] ret_from_fork_asm+0x1a/0x30 [ 163.304910][ T6608] [ 163.304914][ T6608] Memory state around the buggy address: [ 163.304922][ T6608] ffff88801d725f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 163.304933][ T6608] ffff88801d725f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 163.304944][ T6608] >ffff88801d726000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 163.304952][ T6608] ^ [ 163.304959][ T6608] ffff88801d726080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc [ 163.304970][ T6608] ffff88801d726100: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 163.304978][ T6608] ================================================================== [ 163.334302][ T6608] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 163.334332][ T6608] CPU: 1 UID: 0 PID: 6608 Comm: syz.0.19 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 163.334351][ T6608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 163.334361][ T6608] Call Trace: [ 163.334368][ T6608] [ 163.334375][ T6608] vpanic+0x1e0/0x670 [ 163.334403][ T6608] panic+0xc5/0xd0 [ 163.334422][ T6608] ? __pfx_panic+0x10/0x10 [ 163.334442][ T6608] ? preempt_schedule_thunk+0x16/0x30 [ 163.334464][ T6608] ? hpfs_bplus_lookup+0x4f4/0x880 [ 163.334484][ T6608] check_panic_on_warn+0x89/0xb0 [ 163.334505][ T6608] ? hpfs_bplus_lookup+0x4f4/0x880 [ 163.334525][ T6608] end_report+0x6f/0x140 [ 163.334545][ T6608] kasan_report+0x128/0x150 [ 163.334565][ T6608] ? hpfs_bplus_lookup+0x4f4/0x880 [ 163.334589][ T6608] hpfs_bplus_lookup+0x4f4/0x880 [ 163.334614][ T6608] ? __pfx_hpfs_bplus_lookup+0x10/0x10 [ 163.334636][ T6608] ? do_raw_spin_lock+0x12b/0x2f0 [ 163.334654][ T6608] hpfs_bmap+0x230/0x4e0 [ 163.334672][ T6608] ? __pfx_hpfs_bmap+0x10/0x10 [ 163.334687][ T6608] ? lockdep_hardirqs_on+0x7a/0x110 [ 163.334706][ T6608] ? mutex_lock_nested+0x152/0x1d0 [ 163.334727][ T6608] ? hpfs_get_block+0x98/0x6e0 [ 163.334743][ T6608] hpfs_get_block+0xa8/0x6e0 [ 163.334762][ T6608] do_mpage_readpage+0x801/0x1980 [ 163.334796][ T6608] mpage_readahead+0x407/0x830 [ 163.334821][ T6608] ? __pfx_mpage_readahead+0x10/0x10 [ 163.334858][ T6608] ? __pfx_hpfs_get_block+0x10/0x10 [ 163.334873][ T6608] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 163.334893][ T6608] ? reacquire_held_locks+0x104/0x190 [ 163.334915][ T6608] ? blk_start_plug+0x6e/0x1b0 [ 163.334937][ T6608] read_pages+0x193/0x5a0 [ 163.334959][ T6608] ? __pfx_read_pages+0x10/0x10 [ 163.334977][ T6608] ? __folio_batch_add_and_move+0x6ce/0xa90 [ 163.335000][ T6608] ? filemap_add_folio+0x3d9/0x610 [ 163.335022][ T6608] page_cache_ra_unbounded+0x68a/0x8c0 [ 163.335048][ T6608] filemap_get_pages+0x47c/0x1e60 [ 163.335067][ T6608] ? __lock_acquire+0x6b5/0x2cf0 [ 163.335089][ T6608] ? __lock_acquire+0x6b5/0x2cf0 [ 163.335112][ T6608] ? __pfx_filemap_get_pages+0x10/0x10 [ 163.335133][ T6608] ? unwind_next_frame+0xa5/0x23c0 [ 163.335153][ T6608] ? is_bpf_text_address+0x26/0x2b0 [ 163.335181][ T6608] filemap_read+0x44a/0x1240 [ 163.335200][ T6608] ? is_bpf_text_address+0x292/0x2b0 [ 163.335220][ T6608] ? is_bpf_text_address+0x26/0x2b0 [ 163.335243][ T6608] ? __kernel_text_address+0xd/0x30 [ 163.335263][ T6608] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 163.335289][ T6608] ? __pfx_filemap_read+0x10/0x10 [ 163.335318][ T6608] ? __kmalloc_cache_noprof+0x1f2/0x6b0 [ 163.335339][ T6608] ? generic_file_read_iter+0x8f/0x520 [ 163.335359][ T6608] ? __asan_memset+0x22/0x50 [ 163.335376][ T6608] ? iov_iter_kvec+0xb8/0x180 [ 163.335393][ T6608] __kernel_read+0x50d/0x9c0 [ 163.335413][ T6608] ? __pfx___kernel_read+0x10/0x10 [ 163.335441][ T6608] integrity_kernel_read+0x89/0xd0 [ 163.335458][ T6608] ? __pfx_integrity_kernel_read+0x10/0x10 [ 163.335475][ T6608] ? __kmalloc_cache_noprof+0x1f2/0x6b0 [ 163.335496][ T6608] ? ima_calc_file_hash+0x129b/0x1800 [ 163.335517][ T6608] ima_calc_file_hash+0x12cf/0x1800 [ 163.335539][ T6608] ? unwind_next_frame+0xa5/0x23c0 [ 163.335561][ T6608] ? __pfx_ima_calc_file_hash+0x10/0x10 [ 163.335594][ T6608] ? arch_stack_walk+0xfb/0x150 [ 163.335618][ T6608] ? stack_trace_save+0xa9/0x100 [ 163.335639][ T6608] ? __pfx_stack_trace_save+0x10/0x10 [ 163.335660][ T6608] ? make_vfsgid+0x49/0xa0 [ 163.335680][ T6608] ? generic_fillattr+0x63d/0x9a0 [ 163.335706][ T6608] ima_collect_measurement+0x491/0x930 [ 163.335730][ T6608] ? __pfx_ima_collect_measurement+0x10/0x10 [ 163.335753][ T6608] ? do_raw_spin_lock+0x12b/0x2f0 [ 163.335781][ T6608] ? __pfx_ima_get_hash_algo+0x10/0x10 [ 163.335796][ T6608] ? lockdep_hardirqs_on+0x7a/0x110 [ 163.335814][ T6608] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 163.335835][ T6608] process_measurement+0x12d9/0x1c90 [ 163.335865][ T6608] ? __pfx_process_measurement+0x10/0x10 [ 163.335883][ T6608] ? smack_log+0xf5/0x3f0 [ 163.335905][ T6608] ? __pfx_smack_log+0x10/0x10 [ 163.335923][ T6608] ? tomoyo_check_open_permission+0x1d3/0x470 [ 163.335951][ T6608] ? __pfx_smack_file_open+0x10/0x10 [ 163.335973][ T6608] ? tomoyo_file_open+0x167/0x220 [ 163.335996][ T6608] ima_file_check+0xdf/0x130 [ 163.336014][ T6608] ? do_dentry_open+0xd5a/0x13e0 [ 163.336036][ T6608] ? __pfx_ima_file_check+0x10/0x10 [ 163.336057][ T6608] security_file_post_open+0xb3/0x260 [ 163.336077][ T6608] path_openat+0x2e82/0x38a0 [ 163.336109][ T6608] ? __pfx_path_openat+0x10/0x10 [ 163.336128][ T6608] ? kasan_save_track+0x4f/0x80 [ 163.336145][ T6608] ? kasan_save_track+0x3e/0x80 [ 163.336162][ T6608] ? __kasan_slab_alloc+0x6c/0x80 [ 163.336180][ T6608] ? kmem_cache_alloc_noprof+0x188/0x6a0 [ 163.336198][ T6608] ? do_getname+0x2e/0x250 [ 163.336218][ T6608] ? do_sys_openat2+0xca/0x200 [ 163.336235][ T6608] ? do_raw_spin_lock+0x12b/0x2f0 [ 163.336254][ T6608] do_file_open+0x23e/0x4a0 [ 163.336272][ T6608] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 163.336291][ T6608] ? __pfx_do_file_open+0x10/0x10 [ 163.336308][ T6608] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 163.336338][ T6608] ? alloc_fd+0x64e/0x6c0 [ 163.336357][ T6608] do_sys_openat2+0x113/0x200 [ 163.336372][ T6608] ? __se_sys_futex+0x3a8/0x450 [ 163.336390][ T6608] ? __pfx_do_sys_openat2+0x10/0x10 [ 163.336408][ T6608] ? rcu_is_watching+0x15/0xb0 [ 163.336429][ T6608] __x64_sys_openat+0x138/0x170 [ 163.336446][ T6608] do_syscall_64+0xe2/0xf80 [ 163.336464][ T6608] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 163.336480][ T6608] ? trace_irq_disable+0x37/0x100 [ 163.336499][ T6608] ? clear_bhb_loop+0x60/0xb0 [ 163.336516][ T6608] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 163.336532][ T6608] RIP: 0033:0x7f3aa67daef9 [ 163.336547][ T6608] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 163.336561][ T6608] RSP: 002b:00007f3aa5e3e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 163.336580][ T6608] RAX: ffffffffffffffda RBX: 00007f3aa6a45fa0 RCX: 00007f3aa67daef9 [ 163.336592][ T6608] RDX: 0000000000000000 RSI: 0000200000004280 RDI: ffffffffffffff9c [ 163.336603][ T6608] RBP: 00007f3aa686fee0 R08: 0000000000000000 R09: 0000000000000000 [ 163.336614][ T6608] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 163.336624][ T6608] R13: 00007f3aa6a46038 R14: 00007f3aa6a45fa0 R15: 00007fff109c4378 [ 163.336643][ T6608] [ 163.337003][ T6608] Kernel Offset: disabled