Warning: Permanently added '10.128.0.18' (ED25519) to the list of known hosts. 1970/01/01 00:00:30 parsed 1 programs 1970/01/01 00:00:30 serving rpc on tcp://38133 [ 31.844491][ T4727] cgroup: Unknown subsys name 'net' [ 31.984512][ T4727] cgroup: Unknown subsys name 'cpuset' [ 31.986720][ T4727] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 32.169577][ T4727] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 33.886236][ T4735] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 34.488153][ T4760] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.488540][ T4760] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.488610][ T4760] bridge_slave_0: entered allmulticast mode [ 34.489068][ T4760] bridge_slave_0: entered promiscuous mode [ 34.490718][ T4760] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.490768][ T4760] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.490817][ T4760] bridge_slave_1: entered allmulticast mode [ 34.491212][ T4760] bridge_slave_1: entered promiscuous mode [ 34.498705][ T4760] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 34.499539][ T4760] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 34.505834][ T4760] team0: Port device team_slave_0 added [ 34.506531][ T4760] team0: Port device team_slave_1 added [ 34.512007][ T4760] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 34.512197][ T4760] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 34.512219][ T4760] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 34.514709][ T4760] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 34.514717][ T4760] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 34.514732][ T4760] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 34.526015][ T4760] hsr_slave_0: entered promiscuous mode [ 34.526354][ T4760] hsr_slave_1: entered promiscuous mode [ 34.574104][ T4760] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 34.577376][ T4760] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 34.579148][ T4760] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 34.581753][ T4760] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 34.583439][ T4760] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 34.585509][ T4760] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 34.587346][ T4760] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 34.589787][ T4760] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 34.599617][ T4760] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.599668][ T4760] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.599860][ T4760] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.599894][ T4760] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.618405][ T4760] 8021q: adding VLAN 0 to HW filter on device bond0 [ 34.621918][ T15] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.623520][ T15] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.628319][ T4760] 8021q: adding VLAN 0 to HW filter on device team0 [ 34.630605][ T3022] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.630647][ T3022] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.634985][ T3022] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.635034][ T3022] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.728020][ T4760] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 34.740884][ T4760] veth0_vlan: entered promiscuous mode [ 34.743421][ T4760] veth1_vlan: entered promiscuous mode [ 34.750104][ T4760] veth0_macvtap: entered promiscuous mode [ 34.751256][ T4760] veth1_macvtap: entered promiscuous mode [ 34.755963][ T4760] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 34.757111][ T4760] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 34.760206][ T15] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.762013][ T15] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.773402][ T3022] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.775663][ T3081] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.858926][ T3022] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 34.871222][ T901] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.871249][ T901] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.881282][ T3081] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.881310][ T3081] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.917582][ T4740] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 34.919459][ T4740] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 34.919811][ T3022] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 34.922193][ T4740] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 34.922538][ T4740] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 34.922765][ T4740] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 35.006567][ T3022] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.070802][ T3022] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 1970/01/01 00:00:35 executed programs: 0 [ 35.541786][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 35.542560][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 35.542763][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 35.543487][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 35.543701][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 35.675418][ T4828] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.675506][ T4828] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.675621][ T4828] bridge_slave_0: entered allmulticast mode [ 35.676047][ T4828] bridge_slave_0: entered promiscuous mode [ 35.677435][ T4828] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.677501][ T4828] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.677555][ T4828] bridge_slave_1: entered allmulticast mode [ 35.677972][ T4828] bridge_slave_1: entered promiscuous mode [ 35.685269][ T4828] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 35.686217][ T4828] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 35.693876][ T4828] team0: Port device team_slave_0 added [ 35.694716][ T4828] team0: Port device team_slave_1 added [ 35.701153][ T4828] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 35.701179][ T4828] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.701195][ T4828] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 35.701757][ T4828] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 35.701765][ T4828] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.701778][ T4828] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 35.711396][ T4828] hsr_slave_0: entered promiscuous mode [ 35.712260][ T4828] hsr_slave_1: entered promiscuous mode [ 35.712469][ T4828] debugfs: 'hsr0' already exists in 'hsr' [ 35.712517][ T4828] Cannot create hsr debugfs directory [ 37.593431][ T4740] Bluetooth: hci0: command tx timeout [ 37.807318][ T3022] bridge_slave_1: left allmulticast mode [ 37.807364][ T3022] bridge_slave_1: left promiscuous mode [ 37.807707][ T3022] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.811221][ T3022] bridge_slave_0: left allmulticast mode [ 37.811254][ T3022] bridge_slave_0: left promiscuous mode [ 37.811325][ T3022] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.868246][ T3022] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 37.914444][ T3022] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 37.963768][ T3022] bond0 (unregistering): Released all slaves [ 38.018165][ T3022] hsr_slave_0: left promiscuous mode [ 38.019689][ T3022] hsr_slave_1: left promiscuous mode [ 38.021213][ T3022] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 38.022531][ T3022] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 38.024497][ T3022] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 38.024670][ T3022] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 38.032718][ T3022] veth1_macvtap: left promiscuous mode [ 38.033194][ T3022] veth0_macvtap: left promiscuous mode [ 38.033249][ T3022] veth1_vlan: left promiscuous mode [ 38.033288][ T3022] veth0_vlan: left promiscuous mode [ 38.133251][ T3022] team0 (unregistering): Port device team_slave_1 removed [ 38.137200][ T3022] team0 (unregistering): Port device team_slave_0 removed [ 38.179819][ T4405] 8021q: adding VLAN 0 to HW filter on device eth0 [ 38.509301][ T4828] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 38.512835][ T4828] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 38.520013][ T4828] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 38.522216][ T4828] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 38.525671][ T4828] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 38.527890][ T4828] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 38.529492][ T4828] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 38.532193][ T4828] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 38.689313][ T4828] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.695940][ T4828] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.698859][ T3081] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.698905][ T3081] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.701265][ T901] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.701321][ T901] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.829411][ T4828] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.840521][ T4828] veth0_vlan: entered promiscuous mode [ 38.843957][ T4828] veth1_vlan: entered promiscuous mode [ 38.850148][ T4828] veth0_macvtap: entered promiscuous mode [ 38.851214][ T4828] veth1_macvtap: entered promiscuous mode [ 38.870917][ T4828] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 38.876401][ T4828] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 38.952196][ T15] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 38.952229][ T15] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 38.959439][ T15] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 38.960980][ T15] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 38.965436][ T901] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.965487][ T901] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.965509][ T901] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.965524][ T901] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ ** replaying previous printk message ** [ 39.023622][ T4923] ================================================================== [ 39.023636][ T4923] BUG: KASAN: slab-use-after-free in dvb_device_open+0xd0/0x254 [ 39.023653][ T4923] Read of size 8 at addr ffff0000cb58ae18 by task syz.0.19/4923 [ 39.023660][ T4923] [ 39.023664][ T4923] CPU: 1 UID: 0 PID: 4923 Comm: syz.0.19 Not tainted syzkaller #0 PREEMPT [ 39.023673][ T4923] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 39.023677][ T4923] Call trace: [ 39.023680][ T4923] show_stack+0x2c/0x3c (C) [ 39.023693][ T4923] __dump_stack+0x30/0x40 [ 39.023703][ T4923] dump_stack_lvl+0xd8/0x12c [ 39.023712][ T4923] print_address_description+0xb0/0x238 [ 39.023720][ T4923] print_report+0x68/0x84 [ 39.023726][ T4923] kasan_report+0x8c/0xc4 [ 39.023736][ T4923] __asan_report_load8_noabort+0x20/0x2c [ 39.023745][ T4923] dvb_device_open+0xd0/0x254 [ 39.023752][ T4923] chrdev_open+0x398/0x3e8 [ 39.023761][ T4923] do_dentry_open+0x5c4/0xfc0 [ 39.023771][ T4923] vfs_open+0x44/0x2dc [ 39.023780][ T4923] path_openat+0x21fc/0x2a60 [ 39.023788][ T4923] do_file_open+0x1c8/0x2e8 [ 39.023796][ T4923] do_sys_openat2+0x114/0x1e8 [ 39.023805][ T4923] do_sys_open+0xb0/0xe0 [ 39.023814][ T4923] __arm64_sys_openat+0xa8/0xc4 [ 39.023823][ T4923] invoke_syscall+0x98/0x244 [ 39.023833][ T4923] el0_svc_common+0xec/0x23c [ 39.023842][ T4923] do_el0_svc+0x4c/0x5c [ 39.023851][ T4923] el0_svc+0x64/0x260 [ 39.023862][ T4923] el0t_64_sync_handler+0x48/0x148 [ 39.023872][ T4923] el0t_64_sync+0x198/0x19c [ 39.023880][ T4923] [ 39.023881][ T4923] Allocated by task 1: [ 39.023886][ T4923] kasan_save_track+0x40/0x78 [ 39.023893][ T4923] kasan_save_alloc_info+0x44/0x54 [ 39.023901][ T4923] __kasan_kmalloc+0x9c/0xb4 [ 39.023908][ T4923] __kmalloc_cache_noprof+0x2e8/0x5ec [ 39.023915][ T4923] dvb_register_device+0x1a4/0x16e0 [ 39.023920][ T4923] dvb_register_frontend+0x474/0x6d0 [ 39.023928][ T4923] vidtv_bridge_probe+0x5a4/0xa58 [ 39.023937][ T4923] platform_probe+0x100/0x1a4 [ 39.023943][ T4923] really_probe+0x29c/0x800 [ 39.023951][ T4923] __driver_probe_device+0x1e0/0x350 [ 39.023958][ T4923] driver_probe_device+0x6c/0x19c [ 39.023966][ T4923] __driver_attach+0x168/0x384 [ 39.023973][ T4923] bus_for_each_dev+0x128/0x1b4 [ 39.023980][ T4923] driver_attach+0x50/0x60 [ 39.023987][ T4923] bus_add_driver+0x208/0x500 [ 39.023994][ T4923] driver_register+0x220/0x310 [ 39.024001][ T4923] __platform_driver_register+0x90/0xa4 [ 39.024007][ T4923] vidtv_bridge_init+0x4c/0x74 [ 39.024015][ T4923] do_one_initcall+0x274/0xc38 [ 39.024023][ T4923] do_initcall_level+0x12c/0x1c4 [ 39.024032][ T4923] do_initcalls+0x70/0xd0 [ 39.024040][ T4923] do_basic_setup+0x7c/0x90 [ 39.024047][ T4923] kernel_init_freeable+0x268/0x3a8 [ 39.024055][ T4923] kernel_init+0x24/0x1dc [ 39.024062][ T4923] ret_from_fork+0x10/0x20 [ 39.024067][ T4923] [ 39.024068][ T4923] Freed by task 4922: [ 39.024071][ T4923] kasan_save_track+0x40/0x78 [ 39.024078][ T4923] kasan_save_free_info+0x58/0x70 [ 39.024086][ T4923] __kasan_slab_free+0x74/0xa4 [ 39.024092][ T4923] kfree+0x188/0x690 [ 39.024098][ T4923] dvb_device_put+0x64/0xd0 [ 39.024103][ T4923] dvb_device_open+0x23c/0x254 [ 39.024108][ T4923] chrdev_open+0x398/0x3e8 [ 39.024115][ T4923] do_dentry_open+0x5c4/0xfc0 [ 39.024123][ T4923] vfs_open+0x44/0x2dc [ 39.024130][ T4923] path_openat+0x21fc/0x2a60 [ 39.024137][ T4923] do_file_open+0x1c8/0x2e8 [ 39.024143][ T4923] do_sys_openat2+0x114/0x1e8 [ 39.024151][ T4923] do_sys_open+0xb0/0xe0 [ 39.024159][ T4923] __arm64_sys_openat+0xa8/0xc4 [ 39.024166][ T4923] invoke_syscall+0x98/0x244 [ 39.024174][ T4923] el0_svc_common+0xec/0x23c [ 39.024182][ T4923] do_el0_svc+0x4c/0x5c [ 39.024190][ T4923] el0_svc+0x64/0x260 [ 39.024198][ T4923] el0t_64_sync_handler+0x48/0x148 [ 39.024206][ T4923] el0t_64_sync+0x198/0x19c [ 39.024211][ T4923] [ 39.024213][ T4923] The buggy address belongs to the object at ffff0000cb58ae00 [ 39.024213][ T4923] which belongs to the cache kmalloc-256 of size 256 [ 39.024219][ T4923] The buggy address is located 24 bytes inside of [ 39.024219][ T4923] freed 256-byte region [ffff0000cb58ae00, ffff0000cb58af00) [ 39.024226][ T4923] [ 39.024228][ T4923] The buggy address belongs to the physical page: [ 39.024232][ T4923] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10b58a [ 39.024238][ T4923] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 39.024244][ T4923] flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 39.024252][ T4923] page_type: f5(slab) [ 39.024259][ T4923] raw: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122 [ 39.024264][ T4923] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 39.024270][ T4923] head: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122 [ 39.024275][ T4923] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 39.024281][ T4923] head: 05ffc00000000001 fffffdffc32d6281 00000000ffffffff 00000000ffffffff [ 39.024286][ T4923] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 39.024289][ T4923] page dumped because: kasan: bad access detected [ 39.024292][ T4923] [ 39.024293][ T4923] Memory state around the buggy address: [ 39.024297][ T4923] ffff0000cb58ad00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.024301][ T4923] ffff0000cb58ad80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.024306][ T4923] >ffff0000cb58ae00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 39.024309][ T4923] ^ [ 39.024312][ T4923] ffff0000cb58ae80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 39.024316][ T4923] ffff0000cb58af00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.024319][ T4923] ================================================================== [ 39.024333][ T4923] Disabling lock debugging due to kernel taint [ 39.024341][ T4923] ------------[ cut here ]------------ [ 39.024348][ T4923] refcount_t: addition on 0; use-after-free. [ 39.024457][ T4923] WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x134/0x1f8, CPU#1: syz.0.19/4923 [ 39.127946][ T4923] Modules linked in: [ 39.128651][ T4923] CPU: 1 UID: 0 PID: 4923 Comm: syz.0.19 Tainted: G B syzkaller #0 PREEMPT [ 39.130530][ T4923] Tainted: [B]=BAD_PAGE [ 39.131291][ T4923] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 39.133175][ T4923] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 39.134584][ T4923] pc : refcount_warn_saturate+0x134/0x1f8 [ 39.135646][ T4923] lr : refcount_warn_saturate+0x134/0x1f8 [ 39.136686][ T4923] sp : ffff8000947a7640 [ 39.137444][ T4923] x29: ffff8000947a7640 x28: dfff800000000000 x27: 1fffe00019fb2a39 [ 39.138911][ T4923] x26: dfff800000000000 x25: ffff7000128f4edc x24: dfff800000000000 [ 39.140416][ T4923] x23: ffff80008745d808 x22: ffff0000cb965800 x21: ffff0000cb58ae00 [ 39.141952][ T4923] x20: ffff0000cb58ae10 x19: ffff80008a188000 x18: 0000000000000000 [ 39.143420][ T4923] x17: 3d3d3d3d3d3d3d3d x16: 3d3d3d3d3d3d3d3d x15: 3d3d3d3d3d3d3d3d [ 39.144912][ T4923] x14: 3d3d3d3d3d3d3d3d x13: 0000000000000001 x12: 0000000000000000 [ 39.146398][ T4923] x11: 0000000000000000 x10: 0000000000000002 x9 : e73d1c18980abf00 [ 39.147886][ T4923] x8 : e73d1c18980abf00 x7 : 0000000000000000 x6 : ffff80008048e8f8 [ 39.149321][ T4923] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f8870 [ 39.150835][ T4923] x2 : 0000000100000000 x1 : ffff0000cc88ba80 x0 : 0000000000000000 [ 39.152343][ T4923] Call trace: [ 39.152934][ T4923] refcount_warn_saturate+0x134/0x1f8 (P) [ 39.153998][ T4923] dvb_device_get+0x9c/0xc0 [ 39.154841][ T4923] dvb_device_open+0x100/0x254 [ 39.155684][ T4923] chrdev_open+0x398/0x3e8 [ 39.156470][ T4923] do_dentry_open+0x5c4/0xfc0 [ 39.157271][ T4923] vfs_open+0x44/0x2dc [ 39.157946][ T4923] path_openat+0x21fc/0x2a60 [ 39.158766][ T4923] do_file_open+0x1c8/0x2e8 [ 39.159578][ T4923] do_sys_openat2+0x114/0x1e8 [ 39.160390][ T4923] do_sys_open+0xb0/0xe0 [ 39.161099][ T4923] __arm64_sys_openat+0xa8/0xc4 [ 39.161924][ T4923] invoke_syscall+0x98/0x244 [ 39.162723][ T4923] el0_svc_common+0xec/0x23c [ 39.163530][ T4923] do_el0_svc+0x4c/0x5c [ 39.164273][ T4923] el0_svc+0x64/0x260 [ 39.165007][ T4923] el0t_64_sync_handler+0x48/0x148 [ 39.165940][ T4923] el0t_64_sync+0x198/0x19c [ 39.166746][ T4923] irq event stamp: 1123 [ 39.167469][ T4923] hardirqs last enabled at (1123): [] arm64_exit_to_kernel_mode+0x80/0x94 [ 39.169204][ T4923] hardirqs last disabled at (1122): [] el1_interrupt+0x28/0x60 [ 39.170730][ T4923] softirqs last enabled at (1092): [] fpsimd_restore_current_state+0x39c/0x9c8 [ 39.172524][ T4923] softirqs last disabled at (1090): [] fpsimd_restore_current_state+0x44/0x9c8 [ 39.174314][ T4923] ---[ end trace 0000000000000000 ]--- [ ** replaying previous printk message ** [ 39.178399][ T4923] ------------[ cut here ]------------ [ 39.178419][ T4923] refcount_t: underflow; use-after-free. [ 39.178542][ T4923] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x154/0x1f8, CPU#1: syz.0.19/4923 [ 39.182828][ T4923] Modules linked in: [ 39.183523][ T4923] CPU: 1 UID: 0 PID: 4923 Comm: syz.0.19 Tainted: G B W syzkaller #0 PREEMPT [ 39.185315][ T4923] Tainted: [B]=BAD_PAGE, [W]=WARN [ 39.186218][ T4923] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 39.187851][ T4923] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 39.189148][ T4923] pc : refcount_warn_saturate+0x154/0x1f8 [ 39.190182][ T4923] lr : refcount_warn_saturate+0x154/0x1f8 [ 39.191167][ T4923] sp : ffff8000947a7540 [ 39.191891][ T4923] x29: ffff8000947a7540 x28: ffff0000cfd95180 x27: ffff0000cb29c010 [ 39.193268][ T4923] x26: dfff800000000000 x25: 1fffe000196b15c7 x24: ffff0000cb29c060 [ 39.194642][ T4923] x23: 00000000fffffffc x22: ffff0000cb58ae3c x21: 00000000c0000000 [ 39.195950][ T4923] x20: ffff0000cb58ae10 x19: ffff80008a188000 x18: 0000000000000000 [ 39.197284][ T4923] x17: 3d3d3d3d3d3d3d3d x16: 3d3d3d3d3d3d3d3d x15: 3d3d3d3d3d3d3d3d [ 39.198627][ T4923] x14: 3d3d3d3d3d3d3d3d x13: 0000000000000001 x12: 0000000000000000 [ 39.200004][ T4923] x11: 0000000000000000 x10: 0000000000000002 x9 : e73d1c18980abf00 [ 39.201330][ T4923] x8 : e73d1c18980abf00 x7 : 0000000000000000 x6 : ffff80008048e8f8 [ 39.202701][ T4923] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f8870 [ 39.204052][ T4923] x2 : 0000000100000000 x1 : ffff0000cc88ba80 x0 : 0000000000000000 [ 39.205386][ T4923] Call trace: [ 39.205932][ T4923] refcount_warn_saturate+0x154/0x1f8 (P) [ 39.206906][ T4923] dvb_device_put+0xac/0xd0 [ 39.207639][ T4923] dvb_generic_release+0xec/0x158 [ 39.208418][ T4923] dvb_frontend_open+0x9cc/0x10a8 [ 39.209248][ T4923] dvb_device_open+0x1f8/0x254 [ 39.210009][ T4923] chrdev_open+0x398/0x3e8 [ 39.210720][ T4923] do_dentry_open+0x5c4/0xfc0 [ 39.211513][ T4923] vfs_open+0x44/0x2dc [ 39.212176][ T4923] path_openat+0x21fc/0x2a60 [ 39.212913][ T4923] do_file_open+0x1c8/0x2e8 [ 39.213683][ T4923] do_sys_openat2+0x114/0x1e8 [ 39.214412][ T4923] do_sys_open+0xb0/0xe0 [ 39.215119][ T4923] __arm64_sys_openat+0xa8/0xc4 [ 39.215915][ T4923] invoke_syscall+0x98/0x244 [ 39.216672][ T4923] el0_svc_common+0xec/0x23c [ 39.217434][ T4923] do_el0_svc+0x4c/0x5c [ 39.218118][ T4923] el0_svc+0x64/0x260 [ 39.218753][ T4923] el0t_64_sync_handler+0x48/0x148 [ 39.219561][ T4923] el0t_64_sync+0x198/0x19c [ 39.220264][ T4923] irq event stamp: 1123 [ 39.220908][ T4923] hardirqs last enabled at (1123): [] arm64_exit_to_kernel_mode+0x80/0x94 [ 39.222555][ T4923] hardirqs last disabled at (1122): [] el1_interrupt+0x28/0x60 [ 39.224116][ T4923] softirqs last enabled at (1092): [] fpsimd_restore_current_state+0x39c/0x9c8 [ 39.225889][ T4923] softirqs last disabled at (1090): [] fpsimd_restore_current_state+0x44/0x9c8 [ 39.227679][ T4923] ---[ end trace 0000000000000000 ]--- [ 39 ** replaying previous printk message ** [ 39.235224][ T4924] ------------[ cut here ]------------ [ 39.235250][ T4924] refcount_t: saturated; leaking memory. [ 39.235362][ T4924] WARNING: lib/refcount.c:22 at refcount_warn_saturate+0x1b4/0x1f8, CPU#1: syz.0.20/4924 [ 39.239417][ T4924] Modules linked in: [ 39.240043][ T4924] CPU: 1 UID: 0 PID: 4924 Comm: syz.0.20 Tainted: G B W syzkaller #0 PREEMPT [ 39.241917][ T4924] Tainted: [B]=BAD_PAGE, [W]=WARN [ 39.242786][ T4924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 39.244692][ T4924] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 39.246296][ T4924] pc : refcount_warn_saturate+0x1b4/0x1f8 [ 39.247470][ T4924] lr : refcount_warn_saturate+0x1b4/0x1f8 [ 39.248672][ T4924] sp : ffff8000947a7640 [ 39.249534][ T4924] x29: ffff8000947a7640 x28: dfff800000000000 x27: 1fffe00019fb22e1 [ 39.251216][ T4924] x26: dfff800000000000 x25: ffff7000128f4edc x24: dfff800000000000 [ 39.252901][ T4924] x23: ffff80008745d808 x22: ffff0000cb965800 x21: 000000007ffffffe [ 39.254503][ T4924] x20: ffff0000cb58ae10 x19: ffff80008a188000 x18: 0000000000000000 [ 39.255974][ T4924] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 39.257374][ T4924] x14: 00000000ffff8000 x13: 0000000000000001 x12: 0000000000000000 [ 39.258895][ T4924] x11: 0000000000000000 x10: 0000000000000002 x9 : f38da0bfc1a74500 [ 39.260260][ T4924] x8 : f38da0bfc1a74500 x7 : 0000000000000000 x6 : ffff80008048e8f8 [ 39.261618][ T4924] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f8870 [ 39.263004][ T4924] x2 : 0000000100000000 x1 : ffff0000d3109d40 x0 : 0000000000000000 [ 39.264392][ T4924] Call trace: [ 39.264915][ T4924] refcount_warn_saturate+0x1b4/0x1f8 (P) [ 39.265848][ T4924] dvb_device_get+0x9c/0xc0 [ 39.266618][ T4924] dvb_device_open+0x100/0x254 [ 39.267421][ T4924] chrdev_open+0x398/0x3e8 [ 39.268151][ T4924] do_dentry_open+0x5c4/0xfc0 [ 39.268918][ T4924] vfs_open+0x44/0x2dc [ 39.269602][ T4924] path_openat+0x21fc/0x2a60 [ 39.270386][ T4924] do_file_open+0x1c8/0x2e8 [ 39.271176][ T4924] do_sys_openat2+0x114/0x1e8 [ 39.271949][ T4924] do_sys_open+0xb0/0xe0 [ 39.272672][ T4924] __arm64_sys_openat+0xa8/0xc4 [ 39.273517][ T4924] invoke_syscall+0x98/0x244 [ 39.274306][ T4924] el0_svc_common+0xec/0x23c [ 39.275072][ T4924] do_el0_svc+0x4c/0x5c [ 39.275766][ T4924] el0_svc+0x64/0x260 [ 39.276453][ T4924] el0t_64_sync_handler+0x48/0x148 [ 39.277289][ T4924] el0t_64_sync+0x198/0x19c [ 39.278019][ T4924] irq event stamp: 0 [ 39.278665][ T4924] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 39.279878][ T4924] hardirqs last disabled at (0): [] copy_process+0x1384/0x32e8 [ 39.281484][ T4924] softirqs last enabled at (0): [] copy_process+0x13a4/0x32e8 [ 39.282940][ T4924] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 39.284170][ T4924] ---[ end trace 0000000000000000 ]--- [ 39.673127][ T4740] Bluetooth: hci0: command tx timeout 1970/01/01 00:00:40 executed programs: 79 [ 41.753326][ T4740] Bluetooth: hci0: command tx timeout [ 43.833092][ T4740] Bluetooth: hci0: command tx timeout 1970/01/01 00:00:45 executed programs: 379