Warning: Permanently added '10.128.1.108' (ED25519) to the list of known hosts. 2026/09/07 03:09:35 parsed 1 programs 2026/09/07 03:09:35 serving rpc on tcp://46711 [ 87.542184][ T5785] cgroup: Unknown subsys name 'net' [ 87.651642][ T5785] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 89.312559][ T5785] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 92.136946][ T27] cfg80211: failed to load regulatory.db [ 93.704948][ T5848] chnl_net:caif_netlink_parms(): no params data found [ 93.801775][ T5848] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.811045][ T5848] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.818392][ T5848] bridge_slave_0: entered allmulticast mode [ 93.829875][ T5848] bridge_slave_0: entered promiscuous mode [ 93.846168][ T5848] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.853519][ T5848] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.861039][ T5848] bridge_slave_1: entered allmulticast mode [ 93.868179][ T5848] bridge_slave_1: entered promiscuous mode [ 93.895601][ T5848] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 93.907330][ T5848] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 93.938056][ T5848] team0: Port device team_slave_0 added [ 93.946350][ T5848] team0: Port device team_slave_1 added [ 93.970576][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 93.977618][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 94.003709][ T5848] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 94.017536][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 94.024922][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 94.050954][ T5848] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 94.105280][ T5848] hsr_slave_0: entered promiscuous mode [ 94.111710][ T5848] hsr_slave_1: entered promiscuous mode [ 94.274377][ T5848] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 94.297000][ T5848] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 94.307244][ T5848] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 94.318195][ T5848] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 94.356517][ T5848] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.363912][ T5848] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.371759][ T5848] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.379017][ T5848] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.452258][ T5848] 8021q: adding VLAN 0 to HW filter on device bond0 [ 94.485711][ T59] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.494601][ T59] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.512558][ T5848] 8021q: adding VLAN 0 to HW filter on device team0 [ 94.534878][ T34] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.542048][ T34] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.556465][ T34] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.563683][ T34] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.819866][ T5848] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.867840][ T5848] veth0_vlan: entered promiscuous mode [ 94.879585][ T5848] veth1_vlan: entered promiscuous mode [ 94.909880][ T5848] veth0_macvtap: entered promiscuous mode [ 94.920284][ T5848] veth1_macvtap: entered promiscuous mode [ 94.940754][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.956057][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.969742][ T5848] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.978757][ T5848] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.987615][ T5848] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.997065][ T5848] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.175162][ T34] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 95.429342][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.441206][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.471100][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.479083][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.698097][ T5876] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 95.706890][ T5876] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 95.715776][ T5876] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 95.724917][ T5876] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 95.732755][ T5876] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 95.742192][ T5876] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 2026/09/07 03:09:47 executed programs: 0 [ 97.015680][ T5084] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 97.024451][ T5084] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 97.032239][ T5084] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 97.041363][ T5084] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 97.049648][ T5084] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 97.057320][ T5084] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 97.212544][ T5892] chnl_net:caif_netlink_parms(): no params data found [ 97.280478][ T5892] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.287908][ T5892] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.295505][ T5892] bridge_slave_0: entered allmulticast mode [ 97.302535][ T5892] bridge_slave_0: entered promiscuous mode [ 97.310943][ T5892] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.318203][ T5892] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.325666][ T5892] bridge_slave_1: entered allmulticast mode [ 97.332600][ T5892] bridge_slave_1: entered promiscuous mode [ 97.361985][ T5892] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 97.376126][ T5892] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 97.408650][ T5892] team0: Port device team_slave_0 added [ 97.418092][ T5892] team0: Port device team_slave_1 added [ 97.446228][ T5892] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 97.453404][ T5892] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 97.479813][ T5892] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 97.492086][ T5892] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 97.499284][ T5892] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 97.525282][ T5892] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 97.570787][ T5892] hsr_slave_0: entered promiscuous mode [ 97.577982][ T5892] hsr_slave_1: entered promiscuous mode [ 97.584696][ T5892] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 97.592601][ T5892] Cannot create hsr debugfs directory [ 98.016209][ T34] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.094554][ T5876] Bluetooth: hci0: command tx timeout [ 100.425653][ T34] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.497659][ T34] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 101.186332][ T5876] Bluetooth: hci0: command tx timeout [ 101.366632][ T5892] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 101.378513][ T5892] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 101.397447][ T5892] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 101.409834][ T5892] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 101.428696][ T34] hsr_slave_0: left promiscuous mode [ 101.437706][ T34] hsr_slave_1: left promiscuous mode [ 101.444716][ T34] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 101.452233][ T34] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 101.465136][ T34] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 101.472585][ T34] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 101.484249][ T34] bridge_slave_1: left allmulticast mode [ 101.489973][ T34] bridge_slave_1: left promiscuous mode [ 101.498179][ T34] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.512185][ T34] bridge_slave_0: left allmulticast mode [ 101.519329][ T34] bridge_slave_0: left promiscuous mode [ 101.525531][ T34] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.556774][ T34] veth1_macvtap: left promiscuous mode [ 101.562629][ T34] veth0_macvtap: left promiscuous mode [ 101.569194][ T34] veth1_vlan: left promiscuous mode [ 101.576396][ T34] veth0_vlan: left promiscuous mode [ 102.077935][ T34] team0 (unregistering): Port device team_slave_1 removed [ 102.109054][ T34] team0 (unregistering): Port device team_slave_0 removed [ 102.144894][ T34] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 102.177563][ T34] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 102.394278][ T34] bond0 (unregistering): Released all slaves [ 102.559431][ T5892] 8021q: adding VLAN 0 to HW filter on device bond0 [ 102.579637][ T5892] 8021q: adding VLAN 0 to HW filter on device team0 [ 102.597472][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.604752][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 102.632259][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.639461][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 102.878503][ T5892] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 102.958701][ T5892] veth0_vlan: entered promiscuous mode [ 102.977215][ T5892] veth1_vlan: entered promiscuous mode [ 103.017997][ T5892] veth0_macvtap: entered promiscuous mode [ 103.028422][ T5892] veth1_macvtap: entered promiscuous mode [ 103.048057][ T5892] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 103.062914][ T5892] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 103.075489][ T5892] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.085736][ T5892] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.100366][ T5892] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.109714][ T5892] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.171085][ T1007] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.182098][ T1007] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 2026/09/07 03:09:53 executed programs: 2 [ 103.231784][ T1148] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.239799][ T1148] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.253499][ T5876] Bluetooth: hci0: command tx timeout [ 103.379298][ T5934] ================================================================== [ 103.387423][ T5934] BUG: KASAN: slab-out-of-bounds in stack_map_get_build_id_offset+0x6c0/0x720 [ 103.396330][ T5934] Write of size 4 at addr ffff88802c7d3330 by task syz.0.18/5934 [ 103.404074][ T5934] [ 103.406428][ T5934] CPU: 1 PID: 5934 Comm: syz.0.18 Not tainted syzkaller #0 [ 103.413648][ T5934] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 103.423755][ T5934] Call Trace: [ 103.427055][ T5934] [ 103.430000][ T5934] dump_stack_lvl+0x18c/0x250 [ 103.434702][ T5934] ? __lock_acquire+0x7d80/0x7d80 [ 103.439741][ T5934] ? show_regs_print_info+0x20/0x20 [ 103.444979][ T5934] ? load_image+0x420/0x420 [ 103.449506][ T5934] ? __virt_addr_valid+0x10c/0x380 [ 103.454641][ T5934] ? __virt_addr_valid+0x10c/0x380 [ 103.459807][ T5934] ? __virt_addr_valid+0x10c/0x380 [ 103.464941][ T5934] print_report+0xa8/0x210 [ 103.469375][ T5934] ? stack_map_get_build_id_offset+0x6c0/0x720 [ 103.475578][ T5934] kasan_report+0x117/0x150 [ 103.480105][ T5934] ? stack_map_get_build_id_offset+0x6c0/0x720 [ 103.486284][ T5934] stack_map_get_build_id_offset+0x6c0/0x720 [ 103.492295][ T5934] ? pcpu_freelist_pop+0x12a/0x190 [ 103.497429][ T5934] ? __bpf_get_stackid+0x900/0x900 [ 103.502563][ T5934] ? perf_get_regs_user+0x5bb/0x6b0 [ 103.507779][ T5934] ? perf_reg_abi+0x62/0x90 [ 103.512298][ T5934] __bpf_get_stackid+0x564/0x900 [ 103.517264][ T5934] bpf_get_stackid_pe+0x343/0x410 [ 103.522319][ T5934] bpf_prog_2414a5d5030ea31b+0x29/0x2d [ 103.527819][ T5934] bpf_overflow_handler+0x1fc/0x510 [ 103.533035][ T5934] ? bpf_overflow_handler+0xde/0x510 [ 103.538339][ T5934] ? tp_perf_event_destroy+0x20/0x20 [ 103.543663][ T5934] ? mark_lock+0x94/0x320 [ 103.548020][ T5934] ? __perf_event_account_interrupt+0x187/0x280 [ 103.554300][ T5934] __perf_event_overflow+0x461/0x660 [ 103.559610][ T5934] perf_swevent_event+0x319/0x570 [ 103.564665][ T5934] ? perf_tp_event+0x1550/0x1550 [ 103.569629][ T5934] ___perf_sw_event+0x4ab/0x730 [ 103.574507][ T5934] ? ___perf_sw_event+0x19e/0x730 [ 103.579559][ T5934] ? perf_swevent_put_recursion_context+0xb0/0xb0 [ 103.585993][ T5934] ? __lock_acquire+0x1336/0x7d80 [ 103.591034][ T5934] ? rep_movs_alternative+0x15/0x90 [ 103.596253][ T5934] ? verify_lock_unused+0x140/0x140 [ 103.601480][ T5934] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 103.607486][ T5934] ? deref_stack_reg+0x1ab/0x230 [ 103.612444][ T5934] ? lock_chain_count+0x20/0x20 [ 103.617315][ T5934] __perf_sw_event+0x139/0x270 [ 103.622112][ T5934] do_user_addr_fault+0x1242/0x12d0 [ 103.627330][ T5934] ? rcu_is_watching+0x15/0xb0 [ 103.632116][ T5934] exc_page_fault+0x64/0x100 [ 103.636736][ T5934] asm_exc_page_fault+0x26/0x30 [ 103.641615][ T5934] RIP: 0010:rep_movs_alternative+0x15/0x90 [ 103.647454][ T5934] Code: 8b 1c 24 4c 8b 64 24 08 48 83 c4 10 c3 cc cc cc cc cc cc cc cc f3 0f 1e fa 48 83 f9 40 73 40 83 f9 08 73 21 85 c9 74 0f 8a 06 <88> 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 66 2e 0f 1f 84 00 00 00 [ 103.667071][ T5934] RSP: 0018:ffffc900031c6f50 EFLAGS: 00050206 [ 103.673162][ T5934] RAX: ffffffff8433ce30 RBX: 0000000000000003 RCX: 0000000000000003 [ 103.681168][ T5934] RDX: 0000000000000000 RSI: ffff88801ffb068c RDI: 000020000000cf3d [ 103.689162][ T5934] RBP: ffff88801ffb0668 R08: ffff88801ffb068e R09: 1ffff11003ff60d1 [ 103.697152][ T5934] R10: dffffc0000000000 R11: ffffed1003ff60d2 R12: 000020000000cf40 [ 103.705142][ T5934] R13: 0000000000000003 R14: 000020000000cf3d R15: ffff88801ffb068c [ 103.713137][ T5934] ? _copy_to_user+0x20/0xa0 [ 103.717758][ T5934] _copy_to_user+0x85/0xa0 [ 103.722193][ T5934] bpf_verifier_vlog+0x2f1/0x840 [ 103.727171][ T5934] verbose+0x11e/0x1a0 [ 103.731276][ T5934] ? check_func_arg_reg_off+0x2f0/0x2f0 [ 103.736868][ T5934] ? __kernel_text_address+0xd/0x30 [ 103.742122][ T5934] ? unwind_get_return_address+0x91/0xc0 [ 103.747789][ T5934] ? stack_trace_save+0x100/0x100 [ 103.752839][ T5934] ? arch_stack_walk+0x160/0x190 [ 103.757801][ T5934] print_insn_state+0x130/0x160 [ 103.762676][ T5934] do_check+0x4f08/0xd0a0 [ 103.767032][ T5934] ? stack_trace_snprint+0xf0/0xf0 [ 103.772161][ T5934] ? __stack_depot_save+0x1f/0x660 [ 103.777295][ T5934] ? kasan_set_track+0x5f/0x70 [ 103.782079][ T5934] ? __kasan_kmalloc+0x8f/0xa0 [ 103.786861][ T5934] ? __sys_bpf+0x5ba/0x890 [ 103.791292][ T5934] ? __x64_sys_bpf+0x7c/0x90 [ 103.795903][ T5934] ? do_syscall_64+0x55/0xb0 [ 103.800525][ T5934] ? init_func_state+0x2d10/0x2d10 [ 103.805668][ T5934] ? check_func_arg_reg_off+0x2f0/0x2f0 [ 103.811239][ T5934] ? print_verifier_state+0x2e70/0x2e70 [ 103.816810][ T5934] ? init_func_state+0x1dc6/0x2d10 [ 103.821957][ T5934] ? btf_check_subprog_arg_match+0x142/0x2a0 [ 103.827963][ T5934] do_check_common+0xacc/0x1410 [ 103.832867][ T5934] bpf_check+0x65d1/0xec30 [ 103.837319][ T5934] ? __lock_acquire+0x1336/0x7d80 [ 103.842365][ T5934] ? bpf_get_btf_vmlinux+0x20/0x20 [ 103.847500][ T5934] ? __lock_acquire+0x1262/0x7d80 [ 103.852545][ T5934] ? mark_lock+0x94/0x320 [ 103.856898][ T5934] ? __lock_acquire+0x1336/0x7d80 [ 103.861957][ T5934] ? verify_lock_unused+0x140/0x140 [ 103.867178][ T5934] ? verify_lock_unused+0x140/0x140 [ 103.872421][ T5934] ? verify_lock_unused+0x140/0x140 [ 103.877639][ T5934] ? pcpu_memcg_post_alloc_hook+0xef/0x3f0 [ 103.883476][ T5934] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 103.889463][ T5934] ? __lock_acquire+0x7d80/0x7d80 [ 103.894521][ T5934] ? lock_chain_count+0x20/0x20 [ 103.899398][ T5934] ? seqcount_lockdep_reader_access+0x12b/0x1d0 [ 103.905653][ T5934] ? lockdep_hardirqs_on+0x98/0x150 [ 103.910883][ T5934] ? ktime_get_with_offset+0x103/0x330 [ 103.916373][ T5934] ? seqcount_lockdep_reader_access+0x191/0x1d0 [ 103.922648][ T5934] ? ktime_get_real_ts64+0x440/0x440 [ 103.927959][ T5934] ? do_raw_spin_unlock+0x121/0x230 [ 103.933191][ T5934] ? bpf_obj_name_cpy+0x194/0x1e0 [ 103.938235][ T5934] bpf_prog_load+0x10fa/0x1610 [ 103.943028][ T5934] ? map_freeze+0x420/0x420 [ 103.947567][ T5934] ? __might_fault+0xaa/0x120 [ 103.952267][ T5934] ? __might_fault+0xc6/0x120 [ 103.956960][ T5934] ? __might_fault+0xaa/0x120 [ 103.961653][ T5934] ? bpf_lsm_bpf+0x9/0x10 [ 103.966001][ T5934] ? security_bpf+0x7e/0xa0 [ 103.970523][ T5934] __sys_bpf+0x5ba/0x890 [ 103.974788][ T5934] ? bpf_link_show_fdinfo+0x390/0x390 [ 103.980188][ T5934] ? lock_chain_count+0x20/0x20 [ 103.985064][ T5934] __x64_sys_bpf+0x7c/0x90 [ 103.989502][ T5934] do_syscall_64+0x55/0xb0 [ 103.993944][ T5934] ? clear_bhb_loop+0x40/0x90 [ 103.998658][ T5934] ? clear_bhb_loop+0x40/0x90 [ 104.003367][ T5934] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 104.009278][ T5934] RIP: 0033:0x7f9f3a79e159 [ 104.013713][ T5934] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 104.033343][ T5934] RSP: 002b:00007ffedf80c0a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 104.041811][ T5934] RAX: ffffffffffffffda RBX: 00007f9f3aa25fa0 RCX: 00007f9f3a79e159 [ 104.049795][ T5934] RDX: 0000000000000048 RSI: 0000200000000080 RDI: 0000000000000005 [ 104.057778][ T5934] RBP: 00007f9f3a835024 R08: 0000000000000000 R09: 0000000000000000 [ 104.065785][ T5934] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 104.073770][ T5934] R13: 00007f9f3aa25fac R14: 00007f9f3aa25fa0 R15: 00007f9f3aa25fa0 [ 104.081759][ T5934] [ 104.084786][ T5934] [ 104.087124][ T5934] Allocated by task 5934: [ 104.091459][ T5934] kasan_set_track+0x4e/0x70 [ 104.096075][ T5934] __kasan_kmalloc+0x8f/0xa0 [ 104.100688][ T5934] __kmalloc_node+0xb6/0x240 [ 104.105302][ T5934] bpf_map_area_alloc+0x5e/0x110 [ 104.110266][ T5934] prealloc_elems_and_freelist+0x86/0x1c0 [ 104.116007][ T5934] stack_map_alloc+0x32b/0x4b0 [ 104.120803][ T5934] map_create+0x877/0x12f0 [ 104.125253][ T5934] __sys_bpf+0x651/0x890 [ 104.129516][ T5934] __x64_sys_bpf+0x7c/0x90 [ 104.133956][ T5934] do_syscall_64+0x55/0xb0 [ 104.138405][ T5934] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 104.144313][ T5934] [ 104.146647][ T5934] The buggy address belongs to the object at ffff88802c7d3000 [ 104.146647][ T5934] which belongs to the cache kmalloc-cg-1k of size 1024 [ 104.160981][ T5934] The buggy address is located 0 bytes to the right of [ 104.160981][ T5934] allocated 816-byte region [ffff88802c7d3000, ffff88802c7d3330) [ 104.175485][ T5934] [ 104.177836][ T5934] The buggy address belongs to the physical page: [ 104.184271][ T5934] page:ffffea0000b1f400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2c7d0 [ 104.194440][ T5934] head:ffffea0000b1f400 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 104.203394][ T5934] memcg:ffff88801a75c901 [ 104.207682][ T5934] ksm flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 104.216042][ T5934] page_type: 0xffffffff() [ 104.220391][ T5934] raw: 00fff00000000840 ffff888017c4f280 ffffea0001da5200 0000000000000003 [ 104.228992][ T5934] raw: 0000000000000000 0000000080100010 00000001ffffffff ffff88801a75c901 [ 104.237635][ T5934] page dumped because: kasan: bad access detected [ 104.244070][ T5934] page_owner tracks the page as allocated [ 104.249799][ T5934] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5433, tgid 5433 (dhcpcd), ts 70188463112, free_ts 70187373247 [ 104.270658][ T5934] post_alloc_hook+0x1c1/0x200 [ 104.275453][ T5934] get_page_from_freelist+0x2181/0x22a0 [ 104.281020][ T5934] __alloc_pages+0x1f0/0x460 [ 104.285653][ T5934] alloc_slab_page+0x5d/0x180 [ 104.290356][ T5934] new_slab+0x87/0x2d0 [ 104.294438][ T5934] ___slab_alloc+0xc5c/0x12f0 [ 104.299133][ T5934] __kmem_cache_alloc_node+0x11f/0x250 [ 104.304641][ T5934] __kmalloc_node_track_caller+0xa4/0x230 [ 104.310387][ T5934] kmalloc_reserve+0x116/0x240 [ 104.315171][ T5934] __alloc_skb+0x138/0x2c0 [ 104.319606][ T5934] alloc_skb_with_frags+0xcd/0x7a0 [ 104.324739][ T5934] sock_alloc_send_pskb+0x883/0x9a0 [ 104.329958][ T5934] unix_dgram_sendmsg+0x5a9/0x16e0 [ 104.335093][ T5934] sock_write_iter+0x2dc/0x420 [ 104.339880][ T5934] do_iter_write+0x747/0xc50 [ 104.344496][ T5934] do_writev+0x27f/0x480 [ 104.348754][ T5934] page last free stack trace: [ 104.353435][ T5934] free_unref_page_prepare+0x7d7/0x8f0 [ 104.358910][ T5934] free_unref_page+0x32/0x2e0 [ 104.363607][ T5934] free_large_kmalloc+0x101/0x1b0 [ 104.368653][ T5934] skb_release_data+0x609/0x7f0 [ 104.373520][ T5934] consume_skb+0xb2/0x110 [ 104.377868][ T5934] netlink_recvmsg+0x5e7/0xe60 [ 104.382650][ T5934] ____sys_recvmsg+0x2bd/0x5d0 [ 104.387431][ T5934] ___sys_recvmsg+0x214/0x590 [ 104.392124][ T5934] __x64_sys_recvmsg+0x21e/0x2f0 [ 104.397084][ T5934] do_syscall_64+0x55/0xb0 [ 104.401519][ T5934] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 104.407436][ T5934] [ 104.409781][ T5934] Memory state around the buggy address: [ 104.415417][ T5934] ffff88802c7d3200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 104.423495][ T5934] ffff88802c7d3280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 104.431574][ T5934] >ffff88802c7d3300: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 104.439649][ T5934] ^ [ 104.445284][ T5934] ffff88802c7d3380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 104.453357][ T5934] ffff88802c7d3400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 104.461430][ T5934] ================================================================== [ 104.469506][ T5934] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 104.476706][ T5934] CPU: 1 PID: 5934 Comm: syz.0.18 Not tainted syzkaller #0 [ 104.483932][ T5934] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 104.494008][ T5934] Call Trace: [ 104.497316][ T5934] [ 104.500266][ T5934] dump_stack_lvl+0x18c/0x250 [ 104.504983][ T5934] ? show_regs_print_info+0x20/0x20 [ 104.510333][ T5934] ? load_image+0x420/0x420 [ 104.514899][ T5934] panic+0x2ca/0x720 [ 104.518842][ T5934] ? bpf_jit_dump+0xd0/0xd0 [ 104.523392][ T5934] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 104.529317][ T5934] ? _raw_spin_unlock+0x40/0x40 [ 104.534189][ T5934] ? print_memory_metadata+0x314/0x400 [ 104.539668][ T5934] ? stack_map_get_build_id_offset+0x6c0/0x720 [ 104.545839][ T5934] check_panic_on_warn+0x84/0xa0 [ 104.550798][ T5934] ? stack_map_get_build_id_offset+0x6c0/0x720 [ 104.556971][ T5934] end_report+0x6f/0x130 [ 104.561246][ T5934] kasan_report+0x128/0x150 [ 104.565767][ T5934] ? stack_map_get_build_id_offset+0x6c0/0x720 [ 104.571972][ T5934] stack_map_get_build_id_offset+0x6c0/0x720 [ 104.577998][ T5934] ? pcpu_freelist_pop+0x12a/0x190 [ 104.583137][ T5934] ? __bpf_get_stackid+0x900/0x900 [ 104.588269][ T5934] ? perf_get_regs_user+0x5bb/0x6b0 [ 104.593486][ T5934] ? perf_reg_abi+0x62/0x90 [ 104.598012][ T5934] __bpf_get_stackid+0x564/0x900 [ 104.602976][ T5934] bpf_get_stackid_pe+0x343/0x410 [ 104.608042][ T5934] bpf_prog_2414a5d5030ea31b+0x29/0x2d [ 104.613539][ T5934] bpf_overflow_handler+0x1fc/0x510 [ 104.618773][ T5934] ? bpf_overflow_handler+0xde/0x510 [ 104.624132][ T5934] ? tp_perf_event_destroy+0x20/0x20 [ 104.629482][ T5934] ? mark_lock+0x94/0x320 [ 104.633878][ T5934] ? __perf_event_account_interrupt+0x187/0x280 [ 104.640146][ T5934] __perf_event_overflow+0x461/0x660 [ 104.645484][ T5934] perf_swevent_event+0x319/0x570 [ 104.650575][ T5934] ? perf_tp_event+0x1550/0x1550 [ 104.655573][ T5934] ___perf_sw_event+0x4ab/0x730 [ 104.660451][ T5934] ? ___perf_sw_event+0x19e/0x730 [ 104.665492][ T5934] ? perf_swevent_put_recursion_context+0xb0/0xb0 [ 104.671949][ T5934] ? __lock_acquire+0x1336/0x7d80 [ 104.677018][ T5934] ? rep_movs_alternative+0x15/0x90 [ 104.682246][ T5934] ? verify_lock_unused+0x140/0x140 [ 104.687463][ T5934] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 104.693470][ T5934] ? deref_stack_reg+0x1ab/0x230 [ 104.698420][ T5934] ? lock_chain_count+0x20/0x20 [ 104.703297][ T5934] __perf_sw_event+0x139/0x270 [ 104.708087][ T5934] do_user_addr_fault+0x1242/0x12d0 [ 104.713321][ T5934] ? rcu_is_watching+0x15/0xb0 [ 104.718111][ T5934] exc_page_fault+0x64/0x100 [ 104.722738][ T5934] asm_exc_page_fault+0x26/0x30 [ 104.727621][ T5934] RIP: 0010:rep_movs_alternative+0x15/0x90 [ 104.733451][ T5934] Code: 8b 1c 24 4c 8b 64 24 08 48 83 c4 10 c3 cc cc cc cc cc cc cc cc f3 0f 1e fa 48 83 f9 40 73 40 83 f9 08 73 21 85 c9 74 0f 8a 06 <88> 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 66 2e 0f 1f 84 00 00 00 [ 104.753089][ T5934] RSP: 0018:ffffc900031c6f50 EFLAGS: 00050206 [ 104.759178][ T5934] RAX: ffffffff8433ce30 RBX: 0000000000000003 RCX: 0000000000000003 [ 104.767167][ T5934] RDX: 0000000000000000 RSI: ffff88801ffb068c RDI: 000020000000cf3d [ 104.775162][ T5934] RBP: ffff88801ffb0668 R08: ffff88801ffb068e R09: 1ffff11003ff60d1 [ 104.783152][ T5934] R10: dffffc0000000000 R11: ffffed1003ff60d2 R12: 000020000000cf40 [ 104.791132][ T5934] R13: 0000000000000003 R14: 000020000000cf3d R15: ffff88801ffb068c [ 104.799118][ T5934] ? _copy_to_user+0x20/0xa0 [ 104.803734][ T5934] _copy_to_user+0x85/0xa0 [ 104.808165][ T5934] bpf_verifier_vlog+0x2f1/0x840 [ 104.813136][ T5934] verbose+0x11e/0x1a0 [ 104.817253][ T5934] ? check_func_arg_reg_off+0x2f0/0x2f0 [ 104.822823][ T5934] ? __kernel_text_address+0xd/0x30 [ 104.828048][ T5934] ? unwind_get_return_address+0x91/0xc0 [ 104.833706][ T5934] ? stack_trace_save+0x100/0x100 [ 104.838749][ T5934] ? arch_stack_walk+0x160/0x190 [ 104.843719][ T5934] print_insn_state+0x130/0x160 [ 104.848627][ T5934] do_check+0x4f08/0xd0a0 [ 104.852976][ T5934] ? stack_trace_snprint+0xf0/0xf0 [ 104.858100][ T5934] ? __stack_depot_save+0x1f/0x660 [ 104.863228][ T5934] ? kasan_set_track+0x5f/0x70 [ 104.868018][ T5934] ? __kasan_kmalloc+0x8f/0xa0 [ 104.872818][ T5934] ? __sys_bpf+0x5ba/0x890 [ 104.877270][ T5934] ? __x64_sys_bpf+0x7c/0x90 [ 104.881874][ T5934] ? do_syscall_64+0x55/0xb0 [ 104.886495][ T5934] ? init_func_state+0x2d10/0x2d10 [ 104.891628][ T5934] ? check_func_arg_reg_off+0x2f0/0x2f0 [ 104.897211][ T5934] ? print_verifier_state+0x2e70/0x2e70 [ 104.902798][ T5934] ? init_func_state+0x1dc6/0x2d10 [ 104.907936][ T5934] ? btf_check_subprog_arg_match+0x142/0x2a0 [ 104.913938][ T5934] do_check_common+0xacc/0x1410 [ 104.918814][ T5934] bpf_check+0x65d1/0xec30 [ 104.923266][ T5934] ? __lock_acquire+0x1336/0x7d80 [ 104.928339][ T5934] ? bpf_get_btf_vmlinux+0x20/0x20 [ 104.933499][ T5934] ? __lock_acquire+0x1262/0x7d80 [ 104.938572][ T5934] ? mark_lock+0x94/0x320 [ 104.942919][ T5934] ? __lock_acquire+0x1336/0x7d80 [ 104.947972][ T5934] ? verify_lock_unused+0x140/0x140 [ 104.953193][ T5934] ? verify_lock_unused+0x140/0x140 [ 104.958421][ T5934] ? verify_lock_unused+0x140/0x140 [ 104.963662][ T5934] ? pcpu_memcg_post_alloc_hook+0xef/0x3f0 [ 104.969515][ T5934] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 104.975519][ T5934] ? __lock_acquire+0x7d80/0x7d80 [ 104.980568][ T5934] ? lock_chain_count+0x20/0x20 [ 104.985439][ T5934] ? seqcount_lockdep_reader_access+0x12b/0x1d0 [ 104.991739][ T5934] ? lockdep_hardirqs_on+0x98/0x150 [ 104.996966][ T5934] ? ktime_get_with_offset+0x103/0x330 [ 105.002449][ T5934] ? seqcount_lockdep_reader_access+0x191/0x1d0 [ 105.008709][ T5934] ? ktime_get_real_ts64+0x440/0x440 [ 105.014018][ T5934] ? do_raw_spin_unlock+0x121/0x230 [ 105.019249][ T5934] ? bpf_obj_name_cpy+0x194/0x1e0 [ 105.024299][ T5934] bpf_prog_load+0x10fa/0x1610 [ 105.029097][ T5934] ? map_freeze+0x420/0x420 [ 105.033640][ T5934] ? __might_fault+0xaa/0x120 [ 105.038344][ T5934] ? __might_fault+0xc6/0x120 [ 105.043035][ T5934] ? __might_fault+0xaa/0x120 [ 105.047730][ T5934] ? bpf_lsm_bpf+0x9/0x10 [ 105.052089][ T5934] ? security_bpf+0x7e/0xa0 [ 105.056621][ T5934] __sys_bpf+0x5ba/0x890 [ 105.060884][ T5934] ? bpf_link_show_fdinfo+0x390/0x390 [ 105.066287][ T5934] ? lock_chain_count+0x20/0x20 [ 105.071162][ T5934] __x64_sys_bpf+0x7c/0x90 [ 105.075611][ T5934] do_syscall_64+0x55/0xb0 [ 105.080054][ T5934] ? clear_bhb_loop+0x40/0x90 [ 105.084754][ T5934] ? clear_bhb_loop+0x40/0x90 [ 105.089450][ T5934] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 105.095361][ T5934] RIP: 0033:0x7f9f3a79e159 [ 105.099798][ T5934] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.119422][ T5934] RSP: 002b:00007ffedf80c0a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 105.127854][ T5934] RAX: ffffffffffffffda RBX: 00007f9f3aa25fa0 RCX: 00007f9f3a79e159 [ 105.135846][ T5934] RDX: 0000000000000048 RSI: 0000200000000080 RDI: 0000000000000005 [ 105.143840][ T5934] RBP: 00007f9f3a835024 R08: 0000000000000000 R09: 0000000000000000 [ 105.151851][ T5934] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 105.159839][ T5934] R13: 00007f9f3aa25fac R14: 00007f9f3aa25fa0 R15: 00007f9f3aa25fa0 [ 105.167845][ T5934] [ 105.171018][ T5934] Kernel Offset: disabled [ 105.175349][ T5934] Rebooting in 86400 seconds..