[ 76.413892][ T3095] device hsr_slave_0 left promiscuous mode
[ 76.423633][ T3095] device hsr_slave_1 left promiscuous mode
[ 76.430557][ T3095] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 76.438542][ T3095] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 76.446696][ T3095] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 76.457674][ T3095] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 76.465915][ T3095] device bridge_slave_1 left promiscuous mode
[ 76.472185][ T3095] bridge0: port 2(bridge_slave_1) entered disabled state
[ 76.481812][ T3095] device bridge_slave_0 left promiscuous mode
[ 76.488504][ T3095] bridge0: port 1(bridge_slave_0) entered disabled state
[ 76.509878][ T3095] device veth1_macvtap left promiscuous mode
[ 76.516438][ T3095] device veth0_macvtap left promiscuous mode
[ 76.522526][ T3095] device veth1_vlan left promiscuous mode
[ 76.528812][ T3095] device veth0_vlan left promiscuous mode
[ 76.743153][ T3095] team0 (unregistering): Port device team_slave_1 removed
[ 76.760174][ T3095] team0 (unregistering): Port device team_slave_0 removed
[ 76.777450][ T3095] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 76.795238][ T3095] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 76.868986][ T3095] bond0 (unregistering): Released all slaves
Warning: Permanently added '10.128.1.130' (ED25519) to the list of known hosts.
[ 81.595264][ T1327] cfg80211: failed to load regulatory.db
2026/07/04 04:00:13 parsed 1 programs
[ 85.960612][ T4488] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS
[ 89.064600][ T3095] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 89.072581][ T3095] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 89.090167][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 89.125156][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 89.133023][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 89.154049][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 89.519025][ T9] ODEBUG: Out of memory. ODEBUG disabled
[ 90.036577][ T4623] chnl_net:caif_netlink_parms(): no params data found
[ 90.092161][ T4623] bridge0: port 1(bridge_slave_0) entered blocking state
[ 90.099422][ T4623] bridge0: port 1(bridge_slave_0) entered disabled state
[ 90.109001][ T4623] device bridge_slave_0 entered promiscuous mode
[ 90.118391][ T4623] bridge0: port 2(bridge_slave_1) entered blocking state
[ 90.126347][ T4623] bridge0: port 2(bridge_slave_1) entered disabled state
[ 90.134469][ T4623] device bridge_slave_1 entered promiscuous mode
[ 90.156188][ T4623] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 90.167436][ T4623] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 90.197886][ T4623] team0: Port device team_slave_0 added
[ 90.205755][ T4623] team0: Port device team_slave_1 added
[ 90.228287][ T4623] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 90.237025][ T4623] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 90.264756][ T4623] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 90.277215][ T4623] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 90.285546][ T4623] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 90.312797][ T4623] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 90.369807][ T4623] device hsr_slave_0 entered promiscuous mode
[ 90.379402][ T4623] device hsr_slave_1 entered promiscuous mode
[ 90.888910][ T4623] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 90.900391][ T4623] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 90.911712][ T4623] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 90.922891][ T4623] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 90.963126][ T4623] bridge0: port 2(bridge_slave_1) entered blocking state
[ 90.970273][ T4623] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 90.977718][ T4623] bridge0: port 1(bridge_slave_0) entered blocking state
[ 90.985097][ T4623] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 91.050705][ T4623] 8021q: adding VLAN 0 to HW filter on device bond0
[ 91.066012][ T3095] bridge0: port 1(bridge_slave_0) entered disabled state
[ 91.075667][ T3095] bridge0: port 2(bridge_slave_1) entered disabled state
[ 91.085173][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 91.097154][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 91.105408][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 91.127552][ T4623] 8021q: adding VLAN 0 to HW filter on device team0
[ 91.159049][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 91.168302][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 91.178380][ T3095] bridge0: port 1(bridge_slave_0) entered blocking state
[ 91.185605][ T3095] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 91.196547][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 91.205893][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 91.215672][ T3095] bridge0: port 2(bridge_slave_1) entered blocking state
[ 91.222971][ T3095] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 91.247363][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 91.259242][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 91.269129][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 91.281613][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 91.302279][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 91.314588][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 91.323360][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 91.336278][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 91.354244][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 91.400635][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 91.415449][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 91.426840][ T4623] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 91.652122][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 91.664015][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 91.683254][ T4623] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 91.735940][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 91.745361][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 91.767251][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 91.776544][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 91.796021][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 91.814624][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 91.823025][ T4623] device veth0_vlan entered promiscuous mode
[ 91.846610][ T4623] device veth1_vlan entered promiscuous mode
[ 91.880375][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 91.889444][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 91.904314][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 91.921994][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 91.933448][ T4623] device veth0_macvtap entered promiscuous mode
[ 91.948635][ T4623] device veth1_macvtap entered promiscuous mode
[ 91.971264][ T4623] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 91.980006][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 91.989396][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 91.998591][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 92.007428][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 92.019786][ T4623] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 92.027865][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 92.040626][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 92.057852][ T4623] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 92.067145][ T4623] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 92.076268][ T4623] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 92.086521][ T4623] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 92.217306][ T4623] syz-executor (4623) used greatest stack depth: 20784 bytes left
2026/07/04 04:00:23 executed programs: 0
[ 93.268011][ T4762] chnl_net:caif_netlink_parms(): no params data found
[ 93.319300][ T9] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 93.357751][ T4762] bridge0: port 1(bridge_slave_0) entered blocking state
[ 93.365157][ T4762] bridge0: port 1(bridge_slave_0) entered disabled state
[ 93.374300][ T4762] device bridge_slave_0 entered promiscuous mode
[ 93.383124][ T4762] bridge0: port 2(bridge_slave_1) entered blocking state
[ 93.390909][ T4762] bridge0: port 2(bridge_slave_1) entered disabled state
[ 93.398933][ T4762] device bridge_slave_1 entered promiscuous mode
[ 93.426176][ T4762] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 93.437624][ T4762] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 93.466505][ T4762] team0: Port device team_slave_0 added
[ 93.474261][ T4762] team0: Port device team_slave_1 added
[ 93.495674][ T4762] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 93.504951][ T4762] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 93.543818][ T4762] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 93.558014][ T4762] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 93.566268][ T4762] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 93.592784][ T4762] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 93.629028][ T4762] device hsr_slave_0 entered promiscuous mode
[ 93.636103][ T4762] device hsr_slave_1 entered promiscuous mode
[ 93.642710][ T4762] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 93.651538][ T4762] Cannot create hsr debugfs directory
[ 95.118306][ T4277] Bluetooth: hci0: command 0x0409 tx timeout
[ 96.407309][ T9] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 97.157763][ T9] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 97.194362][ T4268] Bluetooth: hci0: command 0x041b tx timeout
[ 97.218495][ T9] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 98.091993][ T4762] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 98.113126][ T4762] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 98.122304][ T4762] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 98.132579][ T4762] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 98.183430][ T4762] 8021q: adding VLAN 0 to HW filter on device bond0
[ 98.196948][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 98.205821][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 98.216963][ T4762] 8021q: adding VLAN 0 to HW filter on device team0
[ 98.235654][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 98.245089][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 98.253959][ T3095] bridge0: port 1(bridge_slave_0) entered blocking state
[ 98.262358][ T3095] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 98.275978][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 98.284729][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 98.294247][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 98.302846][ T3095] bridge0: port 2(bridge_slave_1) entered blocking state
[ 98.309971][ T3095] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 98.321600][ T9] device hsr_slave_0 left promiscuous mode
[ 98.328034][ T9] device hsr_slave_1 left promiscuous mode
[ 98.334884][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 98.342293][ T9] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 98.351116][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 98.358821][ T9] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 98.366650][ T9] device bridge_slave_1 left promiscuous mode
[ 98.373021][ T9] bridge0: port 2(bridge_slave_1) entered disabled state
[ 98.382630][ T9] device bridge_slave_0 left promiscuous mode
[ 98.389217][ T9] bridge0: port 1(bridge_slave_0) entered disabled state
[ 98.405671][ T9] device veth1_macvtap left promiscuous mode
[ 98.411806][ T9] device veth0_macvtap left promiscuous mode
[ 98.418035][ T9] device veth1_vlan left promiscuous mode
[ 98.424037][ T9] device veth0_vlan left promiscuous mode
[ 98.530997][ T9] team0 (unregistering): Port device team_slave_1 removed
[ 98.545998][ T9] team0 (unregistering): Port device team_slave_0 removed
[ 98.558192][ T9] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 98.571428][ T9] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 98.617238][ T9] bond0 (unregistering): Released all slaves
[ 98.690964][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 98.703549][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 98.715768][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 98.726072][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 98.735229][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 98.756755][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 98.766192][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 98.775573][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 98.785321][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 98.797607][ T4762] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 98.809069][ T4762] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 98.817744][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 98.827595][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 98.922788][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 98.930764][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 98.942156][ T4762] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 98.958679][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 98.967974][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 98.988376][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 98.997067][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 99.006390][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 99.014232][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 99.024280][ T4762] device veth0_vlan entered promiscuous mode
[ 99.035538][ T4762] device veth1_vlan entered promiscuous mode
[ 99.058860][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 99.068363][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 99.076866][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 99.086323][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 99.098363][ T4762] device veth0_macvtap entered promiscuous mode
[ 99.108742][ T4762] device veth1_macvtap entered promiscuous mode
[ 99.126277][ T4762] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 99.133613][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 99.143560][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 99.151875][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 99.161531][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 99.175035][ T4762] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 99.184287][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 99.193548][ T3095] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 99.205258][ T4762] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 99.214913][ T4762] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 99.223949][ T4762] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 99.232820][ T4762] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 99.274190][ T4276] Bluetooth: hci0: command 0x040f tx timeout
[ 99.302491][ T3095] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 99.319273][ T3095] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 99.328202][ T1245] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 99.355793][ T3095] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 99.364367][ T3095] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
2026/07/04 04:00:29 executed programs: 2
[ 99.372663][ T1245] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 101.364128][ T4276] Bluetooth: hci0: command 0x0419 tx timeout
2026/07/04 04:00:34 executed programs: 8
[ 108.821865][ T3095] ==================================================================
[ 108.830056][ T3095] BUG: KASAN: use-after-free in __lock_acquire+0x107/0x7b50
[ 108.837466][ T3095] Read of size 8 at addr ffff88802c00cba0 by task kworker/u4:6/3095
[ 108.845433][ T3095]
[ 108.847869][ T3095] CPU: 1 PID: 3095 Comm: kworker/u4:6 Not tainted syzkaller #0
[ 108.855399][ T3095] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
[ 108.865632][ T3095] Workqueue: kkcmd kcm_tx_work
[ 108.870508][ T3095] Call Trace:
[ 108.873782][ T3095]
[ 108.876709][ T3095] dump_stack_lvl+0x188/0x250
[ 108.881382][ T3095] ? show_regs_print_info+0x20/0x20
[ 108.886571][ T3095] ? load_image+0x410/0x410
[ 108.891065][ T3095] ? _raw_spin_lock_irqsave+0xbc/0x100
[ 108.896610][ T3095] print_address_description+0x60/0x2d0
[ 108.902151][ T3095] ? __lock_acquire+0x107/0x7b50
[ 108.907076][ T3095] kasan_report+0xdf/0x130
[ 108.911494][ T3095] ? __lock_acquire+0x107/0x7b50
[ 108.916424][ T3095] __lock_acquire+0x107/0x7b50
[ 108.921190][ T3095] ? lockdep_hardirqs_on_prepare+0x448/0x7c0
[ 108.927607][ T3095] ? __lock_acquire+0x7b50/0x7b50
[ 108.932634][ T3095] ? lock_chain_count+0x20/0x20
[ 108.937507][ T3095] ? finish_lock_switch+0x12d/0x290
[ 108.942987][ T3095] ? finish_lock_switch+0x12d/0x290
[ 108.948214][ T3095] ? verify_lock_unused+0x140/0x140
[ 108.953421][ T3095] ? finish_task_switch+0x12f/0x650
[ 108.958619][ T3095] ? __schedule+0x11cb/0x4350
[ 108.963322][ T3095] lock_acquire+0x19e/0x400
[ 108.968059][ T3095] ? __lock_sock+0x166/0x2b0
[ 108.972770][ T3095] ? lockdep_hardirqs_on_prepare+0x7c0/0x7c0
[ 108.978783][ T3095] ? __local_bh_disable_ip+0x111/0x1a0
[ 108.984497][ T3095] ? read_lock_is_recursive+0x10/0x10
[ 108.989861][ T3095] ? __local_bh_enable_ip+0x136/0x1c0
[ 108.995244][ T3095] ? kthread_data+0x4b/0xc0
[ 109.001402][ T3095] ? kthread_data+0x4b/0xc0
[ 109.005915][ T3095] ? __lock_sock+0x166/0x2b0
[ 109.010594][ T3095] _raw_spin_lock_bh+0x32/0x50
[ 109.015355][ T3095] ? __lock_sock+0x166/0x2b0
[ 109.019937][ T3095] __lock_sock+0x166/0x2b0
[ 109.024356][ T3095] ? sk_page_frag_refill+0x200/0x200
[ 109.029633][ T3095] ? do_raw_spin_lock+0x128/0x2f0
[ 109.034653][ T3095] ? init_wait_entry+0xd0/0xd0
[ 109.039425][ T3095] ? __rwlock_init+0x140/0x140
[ 109.044205][ T3095] ? lockdep_hardirqs_on_prepare+0x448/0x7c0
[ 109.050175][ T3095] ? __lock_acquire+0x7b50/0x7b50
[ 109.055189][ T3095] ? lock_sock_nested+0x68/0x100
[ 109.060118][ T3095] lock_sock_nested+0x9d/0x100
[ 109.064875][ T3095] kcm_tx_work+0x2d/0x180
[ 109.069296][ T3095] process_one_work+0x867/0xff0
[ 109.074250][ T3095] ? worker_detach_from_pool+0x240/0x240
[ 109.079909][ T3095] ? lockdep_hardirqs_off+0x70/0x100
[ 109.085226][ T3095] ? _raw_spin_lock_irq+0xb7/0xf0
[ 109.090252][ T3095] ? _raw_spin_lock_irqsave+0x100/0x100
[ 109.095797][ T3095] ? wq_worker_running+0x97/0x170
[ 109.100846][ T3095] worker_thread+0xad7/0x12a0
[ 109.105547][ T3095] ? _raw_spin_unlock_irqrestore+0xc1/0x120
[ 109.111592][ T3095] kthread+0x42e/0x520
[ 109.115831][ T3095] ? rcu_lock_release+0x20/0x20
[ 109.120713][ T3095] ? kthread_blkcg+0xd0/0xd0
[ 109.125308][ T3095] ret_from_fork+0x1f/0x30
[ 109.129721][ T3095]
[ 109.132727][ T3095]
[ 109.135040][ T3095] Allocated by task 5075:
[ 109.139440][ T3095] __kasan_slab_alloc+0x92/0xc0
[ 109.144294][ T3095] slab_post_alloc_hook+0x4c/0x380
[ 109.149400][ T3095] kmem_cache_alloc+0x15d/0x280
[ 109.154256][ T3095] sk_prot_alloc+0x57/0x210
[ 109.158855][ T3095] sk_alloc+0x2f/0x310
[ 109.162909][ T3095] kcm_ioctl+0x20f/0xfd0
[ 109.167215][ T3095] sock_do_ioctl+0xfb/0x320
[ 109.171703][ T3095] sock_ioctl+0x48a/0x700
[ 109.176011][ T3095] __se_sys_ioctl+0xfa/0x170
[ 109.180588][ T3095] do_syscall_64+0x4c/0xa0
[ 109.184986][ T3095] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 109.190869][ T3095]
[ 109.193183][ T3095] Freed by task 5076:
[ 109.197155][ T3095] kasan_set_track+0x4b/0x70
[ 109.201747][ T3095] kasan_set_free_info+0x1f/0x40
[ 109.206675][ T3095] ____kasan_slab_free+0xd5/0x110
[ 109.211695][ T3095] slab_free_freelist_hook+0xec/0x170
[ 109.217071][ T3095] kmem_cache_free+0x8f/0x210
[ 109.222010][ T3095] __sk_destruct+0x571/0x840
[ 109.226783][ T3095] kcm_release+0x504/0x590
[ 109.231284][ T3095] sock_close+0xbf/0x210
[ 109.235667][ T3095] __fput+0x212/0x8c0
[ 109.239641][ T3095] task_work_run+0x125/0x1a0
[ 109.244481][ T3095] exit_to_user_mode_loop+0x10f/0x130
[ 109.249943][ T3095] exit_to_user_mode_prepare+0xee/0x180
[ 109.255482][ T3095] syscall_exit_to_user_mode+0x16/0x40
[ 109.260939][ T3095] do_syscall_64+0x58/0xa0
[ 109.265368][ T3095] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 109.271397][ T3095]
[ 109.273726][ T3095] Last potentially related work creation:
[ 109.279434][ T3095] kasan_save_stack+0x35/0x60
[ 109.284105][ T3095] kasan_record_aux_stack+0xb8/0x100
[ 109.289582][ T3095] insert_work+0x54/0x3d0
[ 109.293959][ T3095] __queue_work+0x90b/0xc80
[ 109.298489][ T3095] queue_work_on+0x124/0x1f0
[ 109.303179][ T3095] kcm_unattach+0x89a/0xef0
[ 109.307672][ T3095] kcm_ioctl+0x749/0xfd0
[ 109.311910][ T3095] sock_do_ioctl+0xfb/0x320
[ 109.316413][ T3095] sock_ioctl+0x48a/0x700
[ 109.320938][ T3095] __se_sys_ioctl+0xfa/0x170
[ 109.325617][ T3095] do_syscall_64+0x4c/0xa0
[ 109.330027][ T3095] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 109.335915][ T3095]
[ 109.338230][ T3095] Second to last potentially related work creation:
[ 109.344806][ T3095] kasan_save_stack+0x35/0x60
[ 109.349486][ T3095] kasan_record_aux_stack+0xb8/0x100
[ 109.354775][ T3095] insert_work+0x54/0x3d0
[ 109.359519][ T3095] __queue_work+0x90b/0xc80
[ 109.364023][ T3095] queue_work_on+0x124/0x1f0
[ 109.368607][ T3095] kcm_ioctl+0xe32/0xfd0
[ 109.373180][ T3095] sock_do_ioctl+0xfb/0x320
[ 109.377678][ T3095] sock_ioctl+0x48a/0x700
[ 109.382000][ T3095] __se_sys_ioctl+0xfa/0x170
[ 109.386636][ T3095] do_syscall_64+0x4c/0xa0
[ 109.391162][ T3095] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 109.397145][ T3095]
[ 109.399458][ T3095] The buggy address belongs to the object at ffff88802c00cb00
[ 109.399458][ T3095] which belongs to the cache KCM of size 1736
[ 109.412888][ T3095] The buggy address is located 160 bytes inside of
[ 109.412888][ T3095] 1736-byte region [ffff88802c00cb00, ffff88802c00d1c8)
[ 109.426514][ T3095] The buggy address belongs to the page:
[ 109.432149][ T3095] page:ffffea0000b00200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2c008
[ 109.442296][ T3095] head:ffffea0000b00200 order:3 compound_mapcount:0 compound_pincount:0
[ 109.450645][ T3095] memcg:ffff88801ea13601
[ 109.454970][ T3095] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 109.463142][ T3095] raw: 00fff00000010200 0000000000000000 dead000000000122 ffff88814bba03c0
[ 109.471719][ T3095] raw: 0000000000000000 0000000080110011 00000001ffffffff ffff88801ea13601
[ 109.480295][ T3095] page dumped because: kasan: bad access detected
[ 109.486733][ T3095] page_owner tracks the page as allocated
[ 109.492519][ T3095] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5030, ts 99425897475, free_ts 99096233631
[ 109.513239][ T3095] get_page_from_freelist+0x24f6/0x2670
[ 109.518892][ T3095] __alloc_pages+0x1ee/0x480
[ 109.523583][ T3095] new_slab+0xc0/0x4b0
[ 109.527648][ T3095] ___slab_alloc+0x807/0xdd0
[ 109.532244][ T3095] kmem_cache_alloc+0xf0/0x280
[ 109.537018][ T3095] sk_prot_alloc+0x57/0x210
[ 109.541546][ T3095] sk_alloc+0x2f/0x310
[ 109.545638][ T3095] kcm_create+0xfa/0x540
[ 109.549895][ T3095] __sock_create+0x473/0x910
[ 109.554479][ T3095] __sys_socket+0xe2/0x170
[ 109.558908][ T3095] __x64_sys_socket+0x76/0x80
[ 109.563569][ T3095] do_syscall_64+0x4c/0xa0
[ 109.568065][ T3095] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 109.573950][ T3095] page last free stack trace:
[ 109.578619][ T3095] free_unref_page_prepare+0x637/0x6c0
[ 109.584085][ T3095] free_unref_page+0x8f/0x2a0
[ 109.588856][ T3095] qlist_free_all+0x35/0x90
[ 109.593342][ T3095] kasan_quarantine_reduce+0x150/0x160
[ 109.598784][ T3095] __kasan_slab_alloc+0x2f/0xc0
[ 109.603717][ T3095] slab_post_alloc_hook+0x4c/0x380
[ 109.608835][ T3095] __kmalloc+0x189/0x340
[ 109.613202][ T3095] fib_create_info+0xad1/0x2450
[ 109.618126][ T3095] fib_table_insert+0xe4/0x1b70
[ 109.622985][ T3095] fib_magic+0x2ca/0x3b0
[ 109.627248][ T3095] fib_add_ifaddr+0x135/0x5c0
[ 109.632006][ T3095] fib_inetaddr_event+0x13c/0x1c0
[ 109.637035][ T3095] blocking_notifier_call_chain+0x103/0x1b0
[ 109.643033][ T3095] __inet_insert_ifa+0x9ea/0xbd0
[ 109.648110][ T3095] inet_rtm_newaddr+0x9cc/0x18c0
[ 109.653057][ T3095] rtnetlink_rcv_msg+0x82c/0xf00
[ 109.658156][ T3095]
[ 109.660744][ T3095] Memory state around the buggy address:
[ 109.666866][ T3095] ffff88802c00ca80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 109.674912][ T3095] ffff88802c00cb00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 109.683059][ T3095] >ffff88802c00cb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 109.691098][ T3095] ^
[ 109.696276][ T3095] ffff88802c00cc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 109.704663][ T3095] ffff88802c00cc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 109.713083][ T3095] ==================================================================
[ 109.721566][ T3095] Disabling lock debugging due to kernel taint
[ 109.727805][ T3095] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 109.735065][ T3095] CPU: 1 PID: 3095 Comm: kworker/u4:6 Tainted: G B syzkaller #0
[ 109.744004][ T3095] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
[ 109.754267][ T3095] Workqueue: kkcmd kcm_tx_work
[ 109.759023][ T3095] Call Trace:
[ 109.762283][ T3095]
[ 109.765204][ T3095] dump_stack_lvl+0x188/0x250
[ 109.769954][ T3095] ? show_regs_print_info+0x20/0x20
[ 109.775236][ T3095] ? load_image+0x410/0x410
[ 109.779817][ T3095] panic+0x2f8/0x850
[ 109.783803][ T3095] ? bpf_jit_dump+0xd0/0xd0
[ 109.788296][ T3095] ? _raw_spin_unlock_irqrestore+0xc1/0x120
[ 109.794263][ T3095] ? _raw_spin_unlock+0x40/0x40
[ 109.799452][ T3095] ? __lock_acquire+0x107/0x7b50
[ 109.804469][ T3095] check_panic_on_warn+0x80/0xa0
[ 109.809398][ T3095] ? __lock_acquire+0x107/0x7b50
[ 109.814323][ T3095] end_report+0x6d/0xf0
[ 109.818474][ T3095] kasan_report+0x102/0x130
[ 109.823087][ T3095] ? __lock_acquire+0x107/0x7b50
[ 109.828008][ T3095] __lock_acquire+0x107/0x7b50
[ 109.832759][ T3095] ? lockdep_hardirqs_on_prepare+0x448/0x7c0
[ 109.838815][ T3095] ? __lock_acquire+0x7b50/0x7b50
[ 109.843829][ T3095] ? lock_chain_count+0x20/0x20
[ 109.848663][ T3095] ? finish_lock_switch+0x12d/0x290
[ 109.853848][ T3095] ? finish_lock_switch+0x12d/0x290
[ 109.859143][ T3095] ? verify_lock_unused+0x140/0x140
[ 109.864324][ T3095] ? finish_task_switch+0x12f/0x650
[ 109.869600][ T3095] ? __schedule+0x11cb/0x4350
[ 109.874372][ T3095] lock_acquire+0x19e/0x400
[ 109.878968][ T3095] ? __lock_sock+0x166/0x2b0
[ 109.883545][ T3095] ? lockdep_hardirqs_on_prepare+0x7c0/0x7c0
[ 109.889702][ T3095] ? __local_bh_disable_ip+0x111/0x1a0
[ 109.895147][ T3095] ? read_lock_is_recursive+0x10/0x10
[ 109.900602][ T3095] ? __local_bh_enable_ip+0x136/0x1c0
[ 109.905961][ T3095] ? kthread_data+0x4b/0xc0
[ 109.910448][ T3095] ? kthread_data+0x4b/0xc0
[ 109.914965][ T3095] ? __lock_sock+0x166/0x2b0
[ 109.919544][ T3095] _raw_spin_lock_bh+0x32/0x50
[ 109.924380][ T3095] ? __lock_sock+0x166/0x2b0
[ 109.929056][ T3095] __lock_sock+0x166/0x2b0
[ 109.933562][ T3095] ? sk_page_frag_refill+0x200/0x200
[ 109.938845][ T3095] ? do_raw_spin_lock+0x128/0x2f0
[ 109.943860][ T3095] ? init_wait_entry+0xd0/0xd0
[ 109.948612][ T3095] ? __rwlock_init+0x140/0x140
[ 109.953363][ T3095] ? lockdep_hardirqs_on_prepare+0x448/0x7c0
[ 109.959325][ T3095] ? __lock_acquire+0x7b50/0x7b50
[ 109.964411][ T3095] ? lock_sock_nested+0x68/0x100
[ 109.969331][ T3095] lock_sock_nested+0x9d/0x100
[ 109.974083][ T3095] kcm_tx_work+0x2d/0x180
[ 109.978395][ T3095] process_one_work+0x867/0xff0
[ 109.983234][ T3095] ? worker_detach_from_pool+0x240/0x240
[ 109.988855][ T3095] ? lockdep_hardirqs_off+0x70/0x100
[ 109.994214][ T3095] ? _raw_spin_lock_irq+0xb7/0xf0
[ 109.999225][ T3095] ? _raw_spin_lock_irqsave+0x100/0x100
[ 110.004774][ T3095] ? wq_worker_running+0x97/0x170
[ 110.009870][ T3095] worker_thread+0xad7/0x12a0
[ 110.014539][ T3095] ? _raw_spin_unlock_irqrestore+0xc1/0x120
[ 110.020414][ T3095] kthread+0x42e/0x520
[ 110.024462][ T3095] ? rcu_lock_release+0x20/0x20
[ 110.029290][ T3095] ? kthread_blkcg+0xd0/0xd0
[ 110.033873][ T3095] ret_from_fork+0x1f/0x30
[ 110.038628][ T3095]
[ 110.042124][ T3095] Kernel Offset: disabled
[ 110.046464][ T3095] Rebooting in 86400 seconds..