Warning: Permanently added '10.128.1.187' (ED25519) to the list of known hosts. 1970/01/01 00:00:43 ignoring optional flag "sandboxArg"="0" 1970/01/01 00:00:44 parsed 1 programs [ 46.531540][ T4042] cgroup: Unknown subsys name 'net' [ 46.830845][ T4042] cgroup: Unknown subsys name 'rlimit' [ 47.204412][ T4042] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 56.071238][ T4082] chnl_net:caif_netlink_parms(): no params data found [ 56.117459][ T4082] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.119677][ T4082] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.122461][ T4082] device bridge_slave_0 entered promiscuous mode [ 56.186198][ T4082] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.188191][ T4082] bridge0: port 2(bridge_slave_1) entered disabled state [ 56.190864][ T4082] device bridge_slave_1 entered promiscuous mode [ 56.209581][ T4082] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 56.214171][ T4082] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 56.231983][ T4082] team0: Port device team_slave_0 added [ 56.236405][ T4082] team0: Port device team_slave_1 added [ 56.250063][ T4082] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 56.252000][ T4082] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 56.259149][ T4082] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 56.263887][ T4082] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 56.266136][ T4082] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 56.273064][ T4082] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 56.357739][ T4082] device hsr_slave_0 entered promiscuous mode [ 56.404676][ T4082] device hsr_slave_1 entered promiscuous mode [ 56.545590][ T4082] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 56.587962][ T4082] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 56.628041][ T4082] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 56.677996][ T4082] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 56.734159][ T4082] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.736300][ T4082] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.738738][ T4082] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.740738][ T4082] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.791939][ T4082] 8021q: adding VLAN 0 to HW filter on device bond0 [ 56.800966][ T1827] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 56.807181][ T1827] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.810994][ T1827] bridge0: port 2(bridge_slave_1) entered disabled state [ 56.814008][ T1827] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 56.822844][ T4082] 8021q: adding VLAN 0 to HW filter on device team0 [ 56.831290][ T1827] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 56.834234][ T1827] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.836306][ T1827] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.852381][ T1827] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 56.857828][ T1827] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.859894][ T1827] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.867248][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 56.870099][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 56.878831][ T1827] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 56.887968][ T1827] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 56.893613][ T1827] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 56.899634][ T4082] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 56.982870][ T1827] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 56.986126][ T1827] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 56.993308][ T4082] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 57.006590][ T1827] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 57.020609][ T4082] device veth0_vlan entered promiscuous mode [ 57.026849][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 57.030388][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 57.035131][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 57.039651][ T4082] device veth1_vlan entered promiscuous mode [ 57.055130][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 57.058099][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 57.061689][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 57.069566][ T4082] device veth0_macvtap entered promiscuous mode [ 57.075276][ T4082] device veth1_macvtap entered promiscuous mode [ 57.088256][ T4082] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 57.090450][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 57.093253][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 57.099811][ T4082] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 57.101993][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 57.106876][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 57.112022][ T4082] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.115285][ T4082] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.117718][ T4082] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.120062][ T4082] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.488029][ T153] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 60.072123][ T153] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 62.360900][ T153] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 62.424088][ T153] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 63.286987][ T136] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 63.289327][ T136] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 63.292209][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 63.319641][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 63.321790][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 63.327772][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 1970/01/01 00:01:03 executed programs: 0 [ 64.001211][ T4199] chnl_net:caif_netlink_parms(): no params data found [ 64.048131][ T4199] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.050192][ T4199] bridge0: port 1(bridge_slave_0) entered disabled state [ 64.053017][ T4199] device bridge_slave_0 entered promiscuous mode [ 64.056821][ T4199] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.058718][ T4199] bridge0: port 2(bridge_slave_1) entered disabled state [ 64.061282][ T4199] device bridge_slave_1 entered promiscuous mode [ 64.078910][ T4199] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 64.083581][ T4199] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 64.106549][ T4199] team0: Port device team_slave_0 added [ 64.109958][ T4199] team0: Port device team_slave_1 added [ 64.128343][ T4199] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 64.130282][ T4199] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 64.137674][ T4199] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 64.141983][ T4199] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 64.143946][ T4199] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 64.151447][ T4199] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 64.209835][ T4199] device hsr_slave_0 entered promiscuous mode [ 64.254861][ T4199] device hsr_slave_1 entered promiscuous mode [ 64.297222][ T4199] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 64.299464][ T4199] Cannot create hsr debugfs directory [ 64.902966][ T4199] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 64.936194][ T4199] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 64.977031][ T4199] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 65.027094][ T4199] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 65.167494][ T4199] 8021q: adding VLAN 0 to HW filter on device bond0 [ 65.176719][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 65.179376][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 65.184733][ T4199] 8021q: adding VLAN 0 to HW filter on device team0 [ 65.190165][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 65.193034][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 65.196901][ T136] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.198928][ T136] bridge0: port 1(bridge_slave_0) entered forwarding state [ 65.201808][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 65.214485][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 65.218632][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 65.221236][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.223197][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 65.228783][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 65.231720][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 65.243012][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 65.248037][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 65.251104][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 65.256037][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 65.258897][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 65.264180][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 65.269621][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 65.276255][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 65.278917][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 65.283864][ T4199] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 65.375486][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 65.377672][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 65.387613][ T4199] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 65.401414][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 65.405698][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 65.422426][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 65.425214][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 65.430276][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 65.432864][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 65.436999][ T4199] device veth0_vlan entered promiscuous mode [ 65.443707][ T4199] device veth1_vlan entered promiscuous mode [ 65.460352][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 65.462998][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 65.475159][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 65.479197][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 65.483661][ T4199] device veth0_macvtap entered promiscuous mode [ 65.492730][ T4199] device veth1_macvtap entered promiscuous mode [ 65.503627][ T4199] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 65.510072][ T4199] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 65.514181][ T4199] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 65.517053][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 65.519728][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 65.522444][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 65.528544][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 65.533399][ T4199] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 65.537968][ T4199] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 65.541672][ T4199] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 65.544174][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 65.550247][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 65.561716][ T153] device hsr_slave_0 left promiscuous mode [ 65.595097][ T153] device hsr_slave_1 left promiscuous mode [ 65.684774][ T153] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 65.686886][ T153] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 65.690105][ T153] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 65.692181][ T153] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 65.694904][ T153] device bridge_slave_1 left promiscuous mode [ 65.697346][ T153] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.747335][ T153] device bridge_slave_0 left promiscuous mode [ 65.749078][ T153] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.864936][ T153] device veth1_macvtap left promiscuous mode [ 65.866732][ T153] device veth0_macvtap left promiscuous mode [ 65.868755][ T153] device veth1_vlan left promiscuous mode [ 65.870492][ T153] device veth0_vlan left promiscuous mode [ 65.955981][ T4094] Bluetooth: hci0: command 0x0409 tx timeout [ 66.081205][ T153] team0 (unregistering): Port device team_slave_1 removed [ 66.091520][ T153] team0 (unregistering): Port device team_slave_0 removed [ 66.100485][ T153] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 66.123456][ T153] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 66.256045][ T153] bond0 (unregistering): Released all slaves [ 66.395480][ T4199] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.397988][ T4199] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.400418][ T4199] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.402782][ T4199] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.478485][ T136] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.480714][ T136] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.486007][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 66.499807][ T136] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.502044][ T136] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.506372][ T148] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 66.620959][ T4299] ================================================================== [ 66.623116][ T4299] BUG: KASAN: use-after-free in __lock_acquire+0xf0/0x651c [ 66.625011][ T4299] Read of size 8 at addr ffff0000d21f34b8 by task syz.0.16/4299 [ 66.627081][ T4299] [ 66.627703][ T4299] CPU: 1 PID: 4299 Comm: syz.0.16 Not tainted 5.15.189-syzkaller #0 [ 66.629816][ T4299] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 66.632502][ T4299] Call trace: [ 66.633369][ T4299] dump_backtrace+0x0/0x43c [ 66.634601][ T4299] show_stack+0x2c/0x3c [ 66.635710][ T4299] __dump_stack+0x30/0x40 [ 66.636854][ T4299] dump_stack_lvl+0xf8/0x160 [ 66.638058][ T4299] print_address_description+0x78/0x30c [ 66.639524][ T4299] kasan_report+0xec/0x15c [ 66.640688][ T4299] __asan_report_load8_noabort+0x44/0x50 [ 66.642172][ T4299] __lock_acquire+0xf0/0x651c [ 66.643418][ T4299] lock_acquire+0x1f4/0x620 [ 66.644634][ T4299] _raw_spin_lock_irq+0xcc/0x13c [ 66.645949][ T4299] io_poll_remove_entries+0x168/0x430 [ 66.647397][ T4299] io_poll_task_func+0xe8/0x250 [ 66.648656][ T4299] tctx_task_work+0x284/0x514 [ 66.649899][ T4299] task_work_run+0x12c/0x1e0 [ 66.651150][ T4299] do_exit+0x684/0x1f58 [ 66.652264][ T4299] do_group_exit+0x100/0x268 [ 66.653486][ T4299] __wake_up_parent+0x0/0x60 [ 66.654701][ T4299] invoke_syscall+0x98/0x2b8 [ 66.655908][ T4299] el0_svc_common+0x138/0x258 [ 66.657148][ T4299] do_el0_svc+0x58/0x14c [ 66.658262][ T4299] el0_svc+0x78/0x1e0 [ 66.659310][ T4299] el0t_64_sync_handler+0xcc/0xe4 [ 66.660684][ T4299] el0t_64_sync+0x1a0/0x1a4 [ 66.661870][ T4299] [ 66.662479][ T4299] Allocated by task 1: [ 66.663583][ T4299] __kasan_kmalloc+0xb0/0xf0 [ 66.664808][ T4299] kmem_cache_alloc_trace+0x274/0x3fc [ 66.666219][ T4299] comedi_device_postconfig+0x428/0xb48 [ 66.667696][ T4299] comedi_auto_config+0x228/0x328 [ 66.669033][ T4299] comedi_test_init+0xb0/0x14c [ 66.670301][ T4299] do_one_initcall+0x228/0x8b0 [ 66.671572][ T4299] do_initcall_level+0x154/0x214 [ 66.672906][ T4299] do_initcalls+0x58/0xac [ 66.674020][ T4299] do_basic_setup+0x8c/0xa0 [ 66.675298][ T4299] kernel_init_freeable+0x404/0x5fc [ 66.676669][ T4299] kernel_init+0x24/0x1d0 [ 66.677808][ T4299] ret_from_fork+0x10/0x20 [ 66.678970][ T4299] [ 66.679590][ T4299] Freed by task 4299: [ 66.680654][ T4299] kasan_set_track+0x4c/0x84 [ 66.681870][ T4299] kasan_set_free_info+0x28/0x4c [ 66.683177][ T4299] ____kasan_slab_free+0x118/0x164 [ 66.684522][ T4299] __kasan_slab_free+0x18/0x28 [ 66.685773][ T4299] slab_free_freelist_hook+0x128/0x1e8 [ 66.687211][ T4299] kfree+0x170/0x40c [ 66.688234][ T4299] comedi_device_detach+0x2c4/0x5d8 [ 66.689631][ T4299] comedi_unlocked_ioctl+0xb28/0xdcc [ 66.691025][ T4299] __arm64_sys_ioctl+0x14c/0x1c8 [ 66.692331][ T4299] invoke_syscall+0x98/0x2b8 [ 66.693555][ T4299] el0_svc_common+0x138/0x258 [ 66.694774][ T4299] do_el0_svc+0x58/0x14c [ 66.695917][ T4299] el0_svc+0x78/0x1e0 [ 66.696972][ T4299] el0t_64_sync_handler+0xcc/0xe4 [ 66.698279][ T4299] el0t_64_sync+0x1a0/0x1a4 [ 66.699549][ T4299] [ 66.700352][ T4299] The buggy address belongs to the object at ffff0000d21f3400 [ 66.700352][ T4299] which belongs to the cache kmalloc-256 of size 256 [ 66.704325][ T4299] The buggy address is located 184 bytes inside of [ 66.704325][ T4299] 256-byte region [ffff0000d21f3400, ffff0000d21f3500) [ 66.707958][ T4299] The buggy address belongs to the page: [ 66.709447][ T4299] page:00000000424eed5b refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1121f2 [ 66.712158][ T4299] head:00000000424eed5b order:1 compound_mapcount:0 [ 66.714021][ T4299] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 66.716227][ T4299] raw: 05ffc00000010200 dead000000000100 dead000000000122 ffff0000c0002480 [ 66.718640][ T4299] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 66.720976][ T4299] page dumped because: kasan: bad access detected [ 66.722820][ T4299] [ 66.723539][ T4299] Memory state around the buggy address: [ 66.725148][ T4299] ffff0000d21f3380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 66.727397][ T4299] ffff0000d21f3400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 66.729590][ T4299] >ffff0000d21f3480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 66.731847][ T4299] ^ [ 66.733418][ T4299] ffff0000d21f3500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 66.735658][ T4299] ffff0000d21f3580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 66.737803][ T4299] ================================================================== [ 66.740013][ T4299] Disabling lock debugging due to kernel taint