Warning: Permanently added '10.128.0.9' (ED25519) to the list of known hosts.
2025/12/05 09:25:53 parsed 1 programs
[ 70.745373][ T4188] cgroup: Unknown subsys name 'net'
[ 70.876106][ T4188] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 71.472519][ T1421] ieee802154 phy0 wpan0: encryption failed: -22
[ 71.479037][ T1421] ieee802154 phy1 wpan1: encryption failed: -22
[ 72.588843][ T4188] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS
[ 75.519836][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 75.527908][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 75.559105][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 75.575099][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 75.584875][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 75.595345][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 76.088615][ T155] ODEBUG: Out of memory. ODEBUG disabled
[ 76.419209][ T4252] chnl_net:caif_netlink_parms(): no params data found
[ 76.466110][ T4252] bridge0: port 1(bridge_slave_0) entered blocking state
[ 76.473953][ T4252] bridge0: port 1(bridge_slave_0) entered disabled state
[ 76.482073][ T4252] device bridge_slave_0 entered promiscuous mode
[ 76.491103][ T4252] bridge0: port 2(bridge_slave_1) entered blocking state
[ 76.498205][ T4252] bridge0: port 2(bridge_slave_1) entered disabled state
[ 76.506923][ T4252] device bridge_slave_1 entered promiscuous mode
[ 76.529909][ T4252] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 76.541530][ T4252] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 76.565079][ T4252] team0: Port device team_slave_0 added
[ 76.572394][ T4252] team0: Port device team_slave_1 added
[ 76.591309][ T4252] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 76.598269][ T4252] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 76.624933][ T4252] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 76.637582][ T4252] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 76.644663][ T4252] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 76.670694][ T4252] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 76.702132][ T4252] device hsr_slave_0 entered promiscuous mode
[ 76.709067][ T4252] device hsr_slave_1 entered promiscuous mode
[ 76.818861][ T4252] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 76.830120][ T4252] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 76.839038][ T4252] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 76.849192][ T4252] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 76.923196][ T4252] 8021q: adding VLAN 0 to HW filter on device bond0
[ 76.953477][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 76.963682][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 76.971457][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 76.982961][ T4252] 8021q: adding VLAN 0 to HW filter on device team0
[ 77.010816][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 77.019522][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 77.028560][ T9] bridge0: port 1(bridge_slave_0) entered blocking state
[ 77.035775][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 77.044808][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 77.074748][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 77.083691][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 77.092482][ T4238] bridge0: port 2(bridge_slave_1) entered blocking state
[ 77.099603][ T4238] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 77.108074][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 77.141916][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 77.151801][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 77.164680][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 77.176795][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 77.206485][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 77.217527][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 77.312843][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 77.321205][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 77.347779][ T4252] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 77.365044][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 77.384347][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 77.393556][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 77.401991][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 77.412516][ T4252] device veth0_vlan entered promiscuous mode
[ 77.437479][ T4252] device veth1_vlan entered promiscuous mode
[ 77.456942][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 77.466277][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 77.481136][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 77.492777][ T4252] device veth0_macvtap entered promiscuous mode
[ 77.512003][ T4252] device veth1_macvtap entered promiscuous mode
[ 77.532184][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 77.545514][ T4252] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 77.553257][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 77.562252][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 77.573820][ T4252] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 77.584835][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 77.595537][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 77.607416][ T4252] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 77.616965][ T4252] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 77.626472][ T4252] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 77.635562][ T4252] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 77.759446][ T4252] syz-executor (4252) used greatest stack depth: 19912 bytes left
2025/12/05 09:26:03 executed programs: 0
[ 78.781192][ T4299] chnl_net:caif_netlink_parms(): no params data found
[ 78.846520][ T4299] bridge0: port 1(bridge_slave_0) entered blocking state
[ 78.853784][ T4299] bridge0: port 1(bridge_slave_0) entered disabled state
[ 78.861784][ T4299] device bridge_slave_0 entered promiscuous mode
[ 78.870091][ T4299] bridge0: port 2(bridge_slave_1) entered blocking state
[ 78.877239][ T4299] bridge0: port 2(bridge_slave_1) entered disabled state
[ 78.885730][ T4299] device bridge_slave_1 entered promiscuous mode
[ 78.918371][ T4299] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 78.932426][ T4299] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 78.961565][ T4299] team0: Port device team_slave_0 added
[ 78.968970][ T4299] team0: Port device team_slave_1 added
[ 78.989061][ T4299] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 78.996709][ T4299] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 79.024769][ T4299] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 79.037092][ T4299] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 79.044247][ T4299] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 79.071318][ T4299] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 79.115602][ T4299] device hsr_slave_0 entered promiscuous mode
[ 79.123913][ T4299] device hsr_slave_1 entered promiscuous mode
[ 79.132744][ T4299] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 79.142472][ T4299] Cannot create hsr debugfs directory
[ 79.241019][ T4299] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 80.672379][ T4269] Bluetooth: hci0: command 0x0409 tx timeout
[ 82.396743][ T4299] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 82.484592][ T4299] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 82.555486][ T4299] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 82.728363][ T4299] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 82.738592][ T4299] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 82.747933][ T4299] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 82.758585][ T4299] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 82.759793][ T4270] Bluetooth: hci0: command 0x041b tx timeout
[ 82.848016][ T4299] 8021q: adding VLAN 0 to HW filter on device bond0
[ 82.861968][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 82.870484][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 82.881353][ T4299] 8021q: adding VLAN 0 to HW filter on device team0
[ 82.901722][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 82.912113][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 82.921533][ T155] bridge0: port 1(bridge_slave_0) entered blocking state
[ 82.928745][ T155] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 82.937747][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 82.954446][ T9] device hsr_slave_0 left promiscuous mode
[ 82.961439][ T9] device hsr_slave_1 left promiscuous mode
[ 82.967932][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 82.976556][ T9] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 82.986988][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 82.996486][ T9] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 83.004565][ T9] device bridge_slave_1 left promiscuous mode
[ 83.011742][ T9] bridge0: port 2(bridge_slave_1) entered disabled state
[ 83.026144][ T9] device bridge_slave_0 left promiscuous mode
[ 83.032528][ T9] bridge0: port 1(bridge_slave_0) entered disabled state
[ 83.053020][ T9] device veth1_macvtap left promiscuous mode
[ 83.060148][ T9] device veth0_macvtap left promiscuous mode
[ 83.066258][ T9] device veth1_vlan left promiscuous mode
[ 83.072689][ T9] device veth0_vlan left promiscuous mode
[ 83.220627][ T9] team0 (unregistering): Port device team_slave_1 removed
[ 83.236513][ T9] team0 (unregistering): Port device team_slave_0 removed
[ 83.250526][ T9] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 83.265333][ T9] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 83.323703][ T9] bond0 (unregistering): Released all slaves
[ 83.397364][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 83.406573][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 83.415383][ T155] bridge0: port 2(bridge_slave_1) entered blocking state
[ 83.422517][ T155] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 83.433919][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 83.447895][ T4261] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 83.464143][ T4261] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 83.474934][ T4261] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 83.483687][ T4261] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 83.493127][ T4261] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 83.502051][ T4261] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 83.513662][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 83.522198][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 83.537847][ T4299] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 83.550914][ T4299] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 83.571990][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 83.580901][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 83.668463][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 83.682943][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 83.694250][ T4299] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 83.710970][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 83.722473][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 83.747802][ T4299] device veth0_vlan entered promiscuous mode
[ 83.760004][ T4299] device veth1_vlan entered promiscuous mode
[ 83.775387][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 83.783800][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 83.792730][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 83.801200][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 83.808934][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 83.830219][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 83.838288][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 83.846889][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 83.857217][ T4299] device veth0_macvtap entered promiscuous mode
[ 83.866411][ T4299] device veth1_macvtap entered promiscuous mode
[ 83.884372][ T4261] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 83.892993][ T4261] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 83.903414][ T4299] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 83.913550][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 83.922332][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 83.933553][ T4299] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 83.941732][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 83.951994][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 83.964357][ T4299] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.975253][ T4299] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.984254][ T4299] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.994888][ T4299] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 84.066242][ T4238] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 84.081169][ T4238] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 84.108799][ T4261] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 84.110094][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 84.118921][ T4261] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 84.135539][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 84.469452][ T4270] usb 1-1: new full-speed USB device number 2 using dummy_hcd
[ 84.829680][ T4270] usb 1-1: config 0 has an invalid interface number: 168 but max is 0
[ 84.839589][ T4270] usb 1-1: config 0 has no interface number 0
[ 84.845745][ T4270] usb 1-1: New USB device found, idVendor=05ab, idProduct=0060, bcdDevice=11.06
[ 84.855608][ T4270] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 84.870258][ T4270] usb 1-1: config 0 descriptor??
[ 84.876948][ T4269] Bluetooth: hci0: command 0x040f tx timeout
[ 85.110190][ T4233] ==================================================================
[ 85.119050][ T4233] BUG: KASAN: slab-out-of-bounds in hci_le_meta_evt+0x12db/0x3b80
[ 85.126916][ T4233] Read of size 1 at addr ffff88802465e409 by task kworker/u5:2/4233
[ 85.134893][ T4233]
[ 85.137219][ T4233] CPU: 0 PID: 4233 Comm: kworker/u5:2 Not tainted syzkaller #0
[ 85.144759][ T4233] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 85.154949][ T4233] Workqueue: hci0 hci_rx_work
[ 85.159650][ T4233] Call Trace:
[ 85.162947][ T4233]
[ 85.165886][ T4233] dump_stack_lvl+0x168/0x230
[ 85.170569][ T4233] ? show_regs_print_info+0x20/0x20
[ 85.175770][ T4233] ? load_image+0x3b0/0x3b0
[ 85.180271][ T4233] ? _raw_spin_lock_irqsave+0xb0/0xf0
[ 85.185657][ T4233] print_address_description+0x60/0x2d0
[ 85.191400][ T4233] ? hci_le_meta_evt+0x12db/0x3b80
[ 85.196516][ T4233] kasan_report+0xdf/0x130
[ 85.200942][ T4233] ? hci_le_meta_evt+0x12db/0x3b80
[ 85.206496][ T4233] hci_le_meta_evt+0x12db/0x3b80
[ 85.211441][ T4233] ? hci_event_packet+0x2a0/0x12f0
[ 85.216574][ T4233] ? hci_remote_host_features_evt+0x280/0x280
[ 85.222677][ T4233] ? __mutex_unlock_slowpath+0x19e/0x6a0
[ 85.228336][ T4233] ? mark_lock+0x94/0x320
[ 85.232669][ T4233] ? mutex_unlock+0x10/0x10
[ 85.237291][ T4233] ? lockdep_hardirqs_on_prepare+0x3fc/0x760
[ 85.243293][ T4233] ? lock_chain_count+0x20/0x20
[ 85.248164][ T4233] ? __rwlock_init+0x140/0x140
[ 85.252930][ T4233] hci_event_packet+0xe05/0x12f0
[ 85.257871][ T4233] ? lockdep_hardirqs_on+0x94/0x140
[ 85.263086][ T4233] ? rcu_lock_release+0x20/0x20
[ 85.267987][ T4233] ? hci_send_to_monitor+0x9c/0x4a0
[ 85.273824][ T4233] hci_rx_work+0x255/0xa10
[ 85.278271][ T4233] process_one_work+0x863/0x1000
[ 85.283278][ T4233] ? worker_detach_from_pool+0x240/0x240
[ 85.288916][ T4233] ? lockdep_hardirqs_off+0x70/0x100
[ 85.294207][ T4233] ? _raw_spin_lock_irq+0xab/0xe0
[ 85.299235][ T4233] ? _raw_spin_lock_irqsave+0xf0/0xf0
[ 85.304842][ T4233] ? wq_worker_running+0x97/0x170
[ 85.309884][ T4233] worker_thread+0xaa8/0x12a0
[ 85.314597][ T4233] ? _raw_spin_unlock_irqrestore+0x82/0x100
[ 85.320788][ T4233] ? lockdep_hardirqs_on+0x94/0x140
[ 85.326017][ T4233] ? lockdep_hardirqs_on+0x94/0x140
[ 85.331249][ T4233] ? _raw_spin_unlock_irqrestore+0xaa/0x100
[ 85.337160][ T4233] kthread+0x436/0x520
[ 85.341248][ T4233] ? rcu_lock_release+0x20/0x20
[ 85.346102][ T4233] ? kthread_blkcg+0xd0/0xd0
[ 85.352000][ T4233] ret_from_fork+0x1f/0x30
[ 85.356440][ T4233]
[ 85.359458][ T4233]
[ 85.361789][ T4233] Allocated by task 4326:
[ 85.366111][ T4233] __kasan_kmalloc+0xb5/0xf0
[ 85.370875][ T4233] __alloc_skb+0x22c/0x750
[ 85.375289][ T4233] vhci_write+0xbc/0x450
[ 85.379531][ T4233] vfs_write+0x712/0xd00
[ 85.383817][ T4233] ksys_write+0x14d/0x250
[ 85.388143][ T4233] do_syscall_64+0x4c/0xa0
[ 85.392553][ T4233] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 85.398448][ T4233]
[ 85.400773][ T4233] The buggy address belongs to the object at ffff88802465e000
[ 85.400773][ T4233] which belongs to the cache kmalloc-1k of size 1024
[ 85.414823][ T4233] The buggy address is located 9 bytes to the right of
[ 85.414823][ T4233] 1024-byte region [ffff88802465e000, ffff88802465e400)
[ 85.428533][ T4233] The buggy address belongs to the page:
[ 85.434169][ T4233] page:ffffea0000919600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x24658
[ 85.444331][ T4233] head:ffffea0000919600 order:3 compound_mapcount:0 compound_pincount:0
[ 85.452647][ T4233] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 85.461253][ T4233] raw: 00fff00000010200 ffffea0000931000 0000000600000006 ffff888016841dc0
[ 85.470036][ T4233] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
[ 85.479223][ T4233] page dumped because: kasan: bad access detected
[ 85.485663][ T4233] page_owner tracks the page as allocated
[ 85.491389][ T4233] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4063, ts 54587769991, free_ts 42718037598
[ 85.509899][ T4233] get_page_from_freelist+0x1b77/0x1c60
[ 85.515484][ T4233] __alloc_pages+0x1e1/0x470
[ 85.520083][ T4233] new_slab+0xc0/0x4b0
[ 85.524150][ T4233] ___slab_alloc+0x81e/0xdf0
[ 85.528745][ T4233] __kmalloc_node_track_caller+0x1fc/0x3a0
[ 85.534546][ T4233] __alloc_skb+0x22c/0x750
[ 85.538991][ T4233] __tcp_send_ack+0x9d/0x5d0
[ 85.543590][ T4233] tcp_rcv_established+0xb97/0x1cb0
[ 85.548823][ T4233] tcp_v4_do_rcv+0x44b/0x9b0
[ 85.553505][ T4233] tcp_v4_rcv+0x268f/0x2cb0
[ 85.558047][ T4233] ip_protocol_deliver_rcu+0x3ad/0x770
[ 85.563508][ T4233] ip_local_deliver_finish+0x1d5/0x320
[ 85.568971][ T4233] NF_HOOK+0x2d6/0x360
[ 85.573039][ T4233] ip_sublist_rcv+0xa1f/0xce0
[ 85.577709][ T4233] ip_list_rcv+0x3df/0x430
[ 85.582123][ T4233] __netif_receive_skb_list_core+0x574/0x740
[ 85.588100][ T4233] page last free stack trace:
[ 85.592763][ T4233] free_unref_page_prepare+0x637/0x6c0
[ 85.598221][ T4233] free_unref_page+0x94/0x280
[ 85.603244][ T4233] __unfreeze_partials+0x1a5/0x200
[ 85.608364][ T4233] put_cpu_partial+0x12d/0x190
[ 85.613135][ T4233] qlist_free_all+0x35/0x90
[ 85.617677][ T4233] kasan_quarantine_reduce+0x150/0x160
[ 85.623168][ T4233] __kasan_slab_alloc+0x2f/0xd0
[ 85.628044][ T4233] slab_post_alloc_hook+0x4c/0x380
[ 85.633182][ T4233] kmem_cache_alloc+0x100/0x290
[ 85.638066][ T4233] __d_alloc+0x2a/0x6f0
[ 85.642247][ T4233] d_alloc_cursor+0x40/0xd0
[ 85.646772][ T4233] dcache_dir_open+0x37/0x70
[ 85.651515][ T4233] do_dentry_open+0x7ff/0xf80
[ 85.656657][ T4233] path_openat+0x2682/0x2f30
[ 85.661285][ T4233] do_filp_open+0x1b3/0x3e0
[ 85.665855][ T4233] do_sys_openat2+0x142/0x4a0
[ 85.670753][ T4233]
[ 85.673114][ T4233] Memory state around the buggy address:
[ 85.678897][ T4233] ffff88802465e300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 85.687150][ T4233] ffff88802465e380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 85.695225][ T4233] >ffff88802465e400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 85.703284][ T4233] ^
[ 85.707610][ T4233] ffff88802465e480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 85.715770][ T4233] ffff88802465e500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 85.723840][ T4233] ==================================================================
[ 85.731906][ T4233] Disabling lock debugging due to kernel taint
[ 85.746382][ T4233] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 85.753635][ T4233] CPU: 0 PID: 4233 Comm: kworker/u5:2 Tainted: G B syzkaller #0
[ 85.762594][ T4233] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 85.772679][ T4233] Workqueue: hci0 hci_rx_work
[ 85.777389][ T4233] Call Trace:
[ 85.780678][ T4233]
[ 85.783620][ T4233] dump_stack_lvl+0x168/0x230
[ 85.788315][ T4233] ? show_regs_print_info+0x20/0x20
[ 85.793535][ T4233] ? load_image+0x3b0/0x3b0
[ 85.798064][ T4233] panic+0x2c9/0x7f0
[ 85.801984][ T4233] ? bpf_jit_dump+0xd0/0xd0
[ 85.806514][ T4233] ? _raw_spin_unlock_irqrestore+0xf6/0x100
[ 85.812426][ T4233] ? _raw_spin_unlock+0x40/0x40
[ 85.817291][ T4233] ? hci_le_meta_evt+0x12db/0x3b80
[ 85.822414][ T4233] check_panic_on_warn+0x80/0xa0
[ 85.827366][ T4233] ? hci_le_meta_evt+0x12db/0x3b80
[ 85.832496][ T4233] end_report+0x6d/0xf0
[ 85.836666][ T4233] kasan_report+0x102/0x130
[ 85.841190][ T4233] ? hci_le_meta_evt+0x12db/0x3b80
[ 85.846324][ T4233] hci_le_meta_evt+0x12db/0x3b80
[ 85.851280][ T4233] ? hci_event_packet+0x2a0/0x12f0
[ 85.856422][ T4233] ? hci_remote_host_features_evt+0x280/0x280
[ 85.862505][ T4233] ? __mutex_unlock_slowpath+0x19e/0x6a0
[ 85.868150][ T4233] ? mark_lock+0x94/0x320
[ 85.872501][ T4233] ? mutex_unlock+0x10/0x10
[ 85.877021][ T4233] ? lockdep_hardirqs_on_prepare+0x3fc/0x760
[ 85.883054][ T4233] ? lock_chain_count+0x20/0x20
[ 85.887921][ T4233] ? __rwlock_init+0x140/0x140
[ 85.892785][ T4233] hci_event_packet+0xe05/0x12f0
[ 85.897737][ T4233] ? lockdep_hardirqs_on+0x94/0x140
[ 85.902965][ T4233] ? rcu_lock_release+0x20/0x20
[ 85.907851][ T4233] ? hci_send_to_monitor+0x9c/0x4a0
[ 85.913068][ T4233] hci_rx_work+0x255/0xa10
[ 85.917516][ T4233] process_one_work+0x863/0x1000
[ 85.922479][ T4233] ? worker_detach_from_pool+0x240/0x240
[ 85.928221][ T4233] ? lockdep_hardirqs_off+0x70/0x100
[ 85.933534][ T4233] ? _raw_spin_lock_irq+0xab/0xe0
[ 85.938578][ T4233] ? _raw_spin_lock_irqsave+0xf0/0xf0
[ 85.943969][ T4233] ? wq_worker_running+0x97/0x170
[ 85.949010][ T4233] worker_thread+0xaa8/0x12a0
[ 85.953707][ T4233] ? _raw_spin_unlock_irqrestore+0x82/0x100
[ 85.959619][ T4233] ? lockdep_hardirqs_on+0x94/0x140
[ 85.964842][ T4233] ? lockdep_hardirqs_on+0x94/0x140
[ 85.970054][ T4233] ? _raw_spin_unlock_irqrestore+0xaa/0x100
[ 85.975971][ T4233] kthread+0x436/0x520
[ 85.980052][ T4233] ? rcu_lock_release+0x20/0x20
[ 85.984918][ T4233] ? kthread_blkcg+0xd0/0xd0
[ 85.989565][ T4233] ret_from_fork+0x1f/0x30
[ 85.994006][ T4233]
[ 85.997244][ T4233] Kernel Offset: disabled
[ 86.001589][ T4233] Rebooting in 86400 seconds..