Warning: Permanently added '[localhost]:42870' (ED25519) to the list of known hosts.
2026/01/26 09:26:34 parsed 1 programs
syzkaller login: [ 63.897608][ T5833] cgroup: Unknown subsys name 'net'
[ 64.044753][ T5833] cgroup: Unknown subsys name 'cpuset'
[ 64.050967][ T5833] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 66.038599][ T5833] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 68.619289][ T5842] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 69.285729][ T5858] chnl_net:caif_netlink_parms(): no params data found
[ 69.343303][ T5858] bridge0: port 1(bridge_slave_0) entered blocking state
[ 69.346819][ T5858] bridge0: port 1(bridge_slave_0) entered disabled state
[ 69.349441][ T5858] bridge_slave_0: entered allmulticast mode
[ 69.353247][ T5858] bridge_slave_0: entered promiscuous mode
[ 69.357798][ T5858] bridge0: port 2(bridge_slave_1) entered blocking state
[ 69.360116][ T5858] bridge0: port 2(bridge_slave_1) entered disabled state
[ 69.362880][ T5858] bridge_slave_1: entered allmulticast mode
[ 69.365594][ T5858] bridge_slave_1: entered promiscuous mode
[ 69.385625][ T5858] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 69.390728][ T5858] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 69.408706][ T5858] team0: Port device team_slave_0 added
[ 69.412163][ T5858] team0: Port device team_slave_1 added
[ 69.427385][ T5858] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 69.429576][ T5858] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 69.438264][ T5858] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 69.445386][ T5858] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 69.447743][ T5858] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 69.456158][ T5858] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 69.492230][ T5858] hsr_slave_0: entered promiscuous mode
[ 69.494850][ T5858] hsr_slave_1: entered promiscuous mode
[ 69.626478][ T5858] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 69.634905][ T5858] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 69.639907][ T5858] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 69.645265][ T5858] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 69.668186][ T5858] bridge0: port 2(bridge_slave_1) entered blocking state
[ 69.670564][ T5858] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 69.673520][ T5858] bridge0: port 1(bridge_slave_0) entered blocking state
[ 69.676047][ T5858] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 69.714720][ T5858] 8021q: adding VLAN 0 to HW filter on device bond0
[ 69.727512][ T4527] bridge0: port 1(bridge_slave_0) entered disabled state
[ 69.731192][ T4527] bridge0: port 2(bridge_slave_1) entered disabled state
[ 69.743085][ T5858] 8021q: adding VLAN 0 to HW filter on device team0
[ 69.749933][ T4527] bridge0: port 1(bridge_slave_0) entered blocking state
[ 69.752246][ T4527] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 69.760149][ T4527] bridge0: port 2(bridge_slave_1) entered blocking state
[ 69.762382][ T4527] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 69.887697][ T5858] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 69.931754][ T5858] veth0_vlan: entered promiscuous mode
[ 69.937665][ T5858] veth1_vlan: entered promiscuous mode
[ 69.958456][ T5858] veth0_macvtap: entered promiscuous mode
[ 69.963767][ T5858] veth1_macvtap: entered promiscuous mode
[ 69.976968][ T5858] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 69.986910][ T5858] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 69.997581][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 70.001422][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 70.006214][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 70.013191][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 70.122035][ T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 70.165487][ T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 70.221869][ T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 70.291318][ T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 70.856007][ T5217] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 70.859337][ T5217] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 70.865331][ T5217] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 70.868407][ T5217] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 70.873130][ T5217] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 71.389219][ T2177] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 71.391961][ T2177] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 71.419806][ T4527] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 71.428024][ T4527] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
2026/01/26 09:26:44 executed programs: 0
[ 71.926141][ T55] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 71.929389][ T55] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 71.932952][ T55] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 71.935574][ T55] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 71.938070][ T55] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 72.043029][ T5940] chnl_net:caif_netlink_parms(): no params data found
[ 72.095045][ T5940] bridge0: port 1(bridge_slave_0) entered blocking state
[ 72.097166][ T5940] bridge0: port 1(bridge_slave_0) entered disabled state
[ 72.099222][ T5940] bridge_slave_0: entered allmulticast mode
[ 72.102478][ T5940] bridge_slave_0: entered promiscuous mode
[ 72.106028][ T5940] bridge0: port 2(bridge_slave_1) entered blocking state
[ 72.108177][ T5940] bridge0: port 2(bridge_slave_1) entered disabled state
[ 72.111050][ T5940] bridge_slave_1: entered allmulticast mode
[ 72.113622][ T5940] bridge_slave_1: entered promiscuous mode
[ 72.133102][ T5940] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 72.137772][ T5940] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 72.157312][ T5940] team0: Port device team_slave_0 added
[ 72.161229][ T5940] team0: Port device team_slave_1 added
[ 72.177234][ T5940] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 72.179290][ T5940] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 72.187789][ T5940] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 72.192241][ T5940] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 72.194510][ T5940] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 72.204488][ T5940] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 72.231942][ T5940] hsr_slave_0: entered promiscuous mode
[ 72.234084][ T5940] hsr_slave_1: entered promiscuous mode
[ 72.236266][ T5940] debugfs: 'hsr0' already exists in 'hsr'
[ 72.238020][ T5940] Cannot create hsr debugfs directory
[ 72.800003][ T13] bridge_slave_1: left allmulticast mode
[ 72.804319][ T13] bridge_slave_1: left promiscuous mode
[ 72.807167][ T13] bridge0: port 2(bridge_slave_1) entered disabled state
[ 72.822078][ T13] bridge_slave_0: left allmulticast mode
[ 72.824477][ T13] bridge_slave_0: left promiscuous mode
[ 72.826315][ T13] bridge0: port 1(bridge_slave_0) entered disabled state
[ 73.062689][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 73.067098][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 73.070730][ T13] bond0 (unregistering): Released all slaves
[ 73.177500][ T13] hsr_slave_0: left promiscuous mode
[ 73.179723][ T13] hsr_slave_1: left promiscuous mode
[ 73.183156][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 73.185888][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 73.189315][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 73.196597][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 73.212267][ T13] veth1_macvtap: left promiscuous mode
[ 73.214437][ T13] veth0_macvtap: left promiscuous mode
[ 73.216561][ T13] veth1_vlan: left promiscuous mode
[ 73.218321][ T13] veth0_vlan: left promiscuous mode
[ 73.472840][ T13] team0 (unregistering): Port device team_slave_1 removed
[ 73.493530][ T13] team0 (unregistering): Port device team_slave_0 removed
[ 73.911611][ T5940] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 73.916726][ T5940] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 73.921880][ T5940] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 73.926922][ T5940] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 73.982450][ T5217] Bluetooth: hci0: command tx timeout
[ 73.998247][ T5940] 8021q: adding VLAN 0 to HW filter on device bond0
[ 74.007237][ T5940] 8021q: adding VLAN 0 to HW filter on device team0
[ 74.018857][ T4527] bridge0: port 1(bridge_slave_0) entered blocking state
[ 74.021224][ T4527] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 74.034653][ T4527] bridge0: port 2(bridge_slave_1) entered blocking state
[ 74.036877][ T4527] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 74.477291][ T5940] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 74.587116][ T5940] veth0_vlan: entered promiscuous mode
[ 74.605864][ T5940] veth1_vlan: entered promiscuous mode
[ 74.650513][ T5940] veth0_macvtap: entered promiscuous mode
[ 74.696268][ T5940] veth1_macvtap: entered promiscuous mode
[ 74.707242][ T5940] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 74.726076][ T5940] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 74.737103][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 74.741094][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 74.743737][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 74.750678][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 74.814901][ T4527] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 74.817861][ T4527] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 74.843444][ T4527] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 74.846299][ T4527] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 76.060470][ T5217] Bluetooth: hci0: command tx timeout
[ 76.784834][ T1366] ieee802154 phy0 wpan0: encryption failed: -22
[ 76.786811][ T1366] ieee802154 phy1 wpan1: encryption failed: -22
[ 77.899342][ T5981] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[ 77.914050][ T5980] ==================================================================
[ 77.916748][ T5980] BUG: KASAN: slab-use-after-free in nci_unregister_device+0x123/0x230
[ 77.919305][ T5980] Read of size 8 at addr ffff888113d56628 by task syz.0.17/5980
[ 77.922410][ T5980]
[ 77.923120][ T5980] CPU: 1 UID: 0 PID: 5980 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 77.923131][ T5980] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 77.923137][ T5980] Call Trace:
[ 77.923141][ T5980]
[ 77.923145][ T5980] dump_stack_lvl+0xe8/0x150
[ 77.923158][ T5980] print_report+0xba/0x230
[ 77.923167][ T5980] ? nci_unregister_device+0x123/0x230
[ 77.923175][ T5980] kasan_report+0x117/0x150
[ 77.923185][ T5980] ? nci_unregister_device+0x123/0x230
[ 77.923194][ T5980] nci_unregister_device+0x123/0x230
[ 77.923202][ T5980] ? __pfx_virtual_ncidev_close+0x10/0x10
[ 77.923211][ T5980] virtual_ncidev_close+0x56/0x90
[ 77.923219][ T5980] __fput+0x44f/0xa70
[ 77.923231][ T5980] task_work_run+0x1d9/0x270
[ 77.923242][ T5980] ? __pfx_task_work_run+0x10/0x10
[ 77.923253][ T5980] exit_to_user_mode_loop+0xed/0x480
[ 77.923266][ T5980] ? rcu_is_watching+0x15/0xb0
[ 77.923276][ T5980] do_syscall_64+0x2b7/0xf80
[ 77.923308][ T5980] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.923315][ T5980] ? trace_irq_disable+0x37/0x100
[ 77.923326][ T5980] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.923334][ T5980] RIP: 0033:0x7f148199acb9
[ 77.923343][ T5980] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 77.923359][ T5980] RSP: 002b:00007fff4e2266c8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
[ 77.923368][ T5980] RAX: 0000000000000000 RBX: 00007f1481c17da0 RCX: 00007f148199acb9
[ 77.923373][ T5980] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
[ 77.923378][ T5980] RBP: 00007f1481c17da0 R08: 0000000000000006 R09: 0000000000000000
[ 77.923383][ T5980] R10: 00007f1481c17cb0 R11: 0000000000000246 R12: 0000000000012770
[ 77.923387][ T5980] R13: 00007f1481c1609c R14: 00000000000124bb R15: 00007f1481c16090
[ 77.923395][ T5980]
[ 77.923398][ T5980]
[ 77.985842][ T5980] Allocated by task 13:
[ 77.987398][ T5980] kasan_save_track+0x3e/0x80
[ 77.989121][ T5980] __kasan_kmalloc+0x93/0xb0
[ 77.990788][ T5980] __kmalloc_node_track_caller_noprof+0x558/0x7f0
[ 77.993036][ T5980] devm_kmalloc+0x7f/0x300
[ 77.994469][ T5980] nci_rsp_packet+0x894/0x3200
[ 77.995923][ T5980] nci_rx_work+0x1f8/0x3f0
[ 77.997463][ T5980] process_scheduled_works+0xaec/0x17a0
[ 77.999119][ T5980] worker_thread+0x89f/0xd90
[ 78.000542][ T5980] kthread+0x726/0x8b0
[ 78.001835][ T5980] ret_from_fork+0x51b/0xa40
[ 78.003227][ T5980] ret_from_fork_asm+0x1a/0x30
[ 78.004807][ T5980]
[ 78.005568][ T5980] Freed by task 5980:
[ 78.006942][ T5980] kasan_save_track+0x3e/0x80
[ 78.008300][ T5980] kasan_save_free_info+0x46/0x50
[ 78.010028][ T5980] __kasan_slab_free+0x5c/0x80
[ 78.011654][ T5980] kfree+0x1be/0x650
[ 78.012964][ T5980] devres_release_all+0x1b2/0x240
[ 78.014464][ T5980] device_del+0x736/0x8f0
[ 78.015896][ T5980] nfc_unregister_device+0x19c/0x330
[ 78.017666][ T5980] nci_unregister_device+0x42/0x230
[ 78.019482][ T5980] virtual_ncidev_close+0x56/0x90
[ 78.021307][ T5980] __fput+0x44f/0xa70
[ 78.022777][ T5980] task_work_run+0x1d9/0x270
[ 78.024122][ T5980] exit_to_user_mode_loop+0xed/0x480
[ 78.025659][ T5980] do_syscall_64+0x2b7/0xf80
[ 78.027022][ T5980] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 78.028728][ T5980]
[ 78.029621][ T5980] The buggy address belongs to the object at ffff888113d56600
[ 78.029621][ T5980] which belongs to the cache kmalloc-128 of size 128
[ 78.034548][ T5980] The buggy address is located 40 bytes inside of
[ 78.034548][ T5980] freed 128-byte region [ffff888113d56600, ffff888113d56680)
[ 78.039441][ T5980]
[ 78.040348][ T5980] The buggy address belongs to the physical page:
[ 78.042652][ T5980] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888113d56900 pfn:0x113d56
[ 78.046309][ T5980] flags: 0x17ff00000000200(workingset|node=0|zone=2|lastcpupid=0x7ff)
[ 78.049202][ T5980] page_type: f5(slab)
[ 78.050622][ T5980] raw: 017ff00000000200 ffff888100041a00 ffff888100040648 ffffea00044fbf90
[ 78.053708][ T5980] raw: ffff888113d56900 000000000010000c 00000000f5000000 0000000000000000
[ 78.056824][ T5980] page dumped because: kasan: bad access detected
[ 78.059201][ T5980] page_owner tracks the page as allocated
[ 78.061325][ T5980] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5277, tgid 5277 (udevadm), ts 29935854573, free_ts 29929951093
[ 78.067975][ T5980] post_alloc_hook+0x228/0x280
[ 78.069823][ T5980] get_page_from_freelist+0x24dc/0x2580
[ 78.071885][ T5980] __alloc_frozen_pages_noprof+0x18d/0x380
[ 78.074021][ T5980] alloc_pages_mpol+0x232/0x4a0
[ 78.075889][ T5980] allocate_slab+0x86/0x3a0
[ 78.077580][ T5980] ___slab_alloc+0xd82/0x1760
[ 78.079311][ T5980] __slab_alloc+0x65/0x100
[ 78.080992][ T5980] __kmalloc_cache_noprof+0x40d/0x6e0
[ 78.082926][ T5980] kernfs_fop_open+0x7b5/0xca0
[ 78.084670][ T5980] do_dentry_open+0x7ce/0x1420
[ 78.086455][ T5980] vfs_open+0x3b/0x340
[ 78.087975][ T5980] path_openat+0x3486/0x3e20
[ 78.089669][ T5980] do_filp_open+0x22d/0x490
[ 78.091319][ T5980] do_sys_openat2+0x12f/0x220
[ 78.092999][ T5980] __x64_sys_openat+0x138/0x170
[ 78.094759][ T5980] do_syscall_64+0xe2/0xf80
[ 78.096422][ T5980] page last free pid 5277 tgid 5277 stack trace:
[ 78.098665][ T5980] __free_frozen_pages+0xbb0/0xd10
[ 78.100517][ T5980] __slab_free+0x2ce/0x320
[ 78.102097][ T5980] qlist_free_all+0x97/0x100
[ 78.103736][ T5980] kasan_quarantine_reduce+0x148/0x160
[ 78.105747][ T5980] __kasan_slab_alloc+0x22/0x80
[ 78.107472][ T5980] __kmalloc_noprof+0x3c2/0x7e0
[ 78.109189][ T5980] kernfs_fop_write_iter+0x158/0x540
[ 78.111119][ T5980] vfs_write+0x61d/0xb90
[ 78.112737][ T5980] ksys_write+0x150/0x270
[ 78.114329][ T5980] do_syscall_64+0xe2/0xf80
[ 78.116044][ T5980] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 78.117998][ T5980]
[ 78.118699][ T5980] Memory state around the buggy address:
[ 78.120606][ T5980] ffff888113d56500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.123578][ T5980] ffff888113d56580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.126655][ T5980] >ffff888113d56600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.129682][ T5980] ^
[ 78.131673][ T5980] ffff888113d56680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.134671][ T5980] ffff888113d56700: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
[ 78.137771][ T5980] ==================================================================
[ 78.140780][ T5217] Bluetooth: hci0: command tx timeout
[ 78.146629][ T5980] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 78.149312][ T5980] CPU: 1 UID: 0 PID: 5980 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 78.152472][ T5980] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 78.155458][ T5980] Call Trace:
[ 78.156434][ T5980]
[ 78.157417][ T5980] vpanic+0x1e0/0x670
[ 78.158763][ T5980] panic+0xc5/0xd0
[ 78.159949][ T5980] ? __pfx_panic+0x10/0x10
[ 78.161521][ T5980] ? preempt_schedule_thunk+0x16/0x30
[ 78.163136][ T5980] ? nci_unregister_device+0x123/0x230
[ 78.164719][ T5980] check_panic_on_warn+0x89/0xb0
[ 78.166258][ T5980] ? nci_unregister_device+0x123/0x230
[ 78.167966][ T5980] end_report+0x6f/0x140
[ 78.169284][ T5980] kasan_report+0x128/0x150
[ 78.170659][ T5980] ? nci_unregister_device+0x123/0x230
[ 78.172596][ T5980] nci_unregister_device+0x123/0x230
[ 78.174221][ T5980] ? __pfx_virtual_ncidev_close+0x10/0x10
[ 78.176038][ T5980] virtual_ncidev_close+0x56/0x90
[ 78.177573][ T5980] __fput+0x44f/0xa70
[ 78.178757][ T5980] task_work_run+0x1d9/0x270
[ 78.180111][ T5980] ? __pfx_task_work_run+0x10/0x10
[ 78.181761][ T5980] exit_to_user_mode_loop+0xed/0x480
[ 78.183458][ T5980] ? rcu_is_watching+0x15/0xb0
[ 78.184835][ T5980] do_syscall_64+0x2b7/0xf80
[ 78.186288][ T5980] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 78.188054][ T5980] ? trace_irq_disable+0x37/0x100
[ 78.189657][ T5980] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 78.191478][ T5980] RIP: 0033:0x7f148199acb9
[ 78.192871][ T5980] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 78.199921][ T5980] RSP: 002b:00007fff4e2266c8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
[ 78.203094][ T5980] RAX: 0000000000000000 RBX: 00007f1481c17da0 RCX: 00007f148199acb9
[ 78.205997][ T5980] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
[ 78.208849][ T5980] RBP: 00007f1481c17da0 R08: 0000000000000006 R09: 0000000000000000
[ 78.211751][ T5980] R10: 00007f1481c17cb0 R11: 0000000000000246 R12: 0000000000012770
[ 78.214793][ T5980] R13: 00007f1481c1609c R14: 00000000000124bb R15: 00007f1481c16090
[ 78.217667][ T5980]
[ 78.219463][ T5980] Kernel Offset: disabled
[ 78.221048][ T5980] Rebooting in 86400 seconds..
VM DIAGNOSIS:
09:26:50 Registers:
info registers vcpu 0
CPU#0
RAX=00000000000d243d RBX=ffffffff81984a0d RCX=0000000080000001 RDX=0000000000000001
RSI=ffffffff8dacf929 RDI=ffffffff8be73880 RBP=ffffffff8e007eb0 RSP=ffffffff8e007dc0
R8 =ffff8881210336db R9 =1ffff110242066db R10=dffffc0000000000 R11=ffffed10242066dc
R12=ffffffff8fced970 R13=1ffffffff1c12a78 R14=0000000000000000 R15=0000000000000000
RIP=ffffffff8b78ab2f RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff88818e328000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007f14827f4ff8 CR3=000000016128e000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=00ff000000000000 ff00000000000000 XMM05=0000000000000036 0000000000003030
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=ffffffffffffff00 ffffffffffff0000 XMM09=6c6c696b66722f36 7968702f31313230
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1
CPU#1
RAX=1ffffffff3420260 RBX=00000000000003fd RCX=0000000000000000 RDX=00000000000003fd
RSI=0000000000000000 RDI=0000000000000020 RBP=ffffffff9a101530 RSP=ffffc900039f7670
R8 =ffff88816aad0237 R9 =1ffff1102d55a046 R10=dffffc0000000000 R11=ffffffff852571a0
R12=dffffc0000000000 R13=0000000000000000 R14=ffffffff9a1012a0 R15=0000000000000000
RIP=ffffffff85257217 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000555558dcb500 ffffffff 00c00000
GS =0000 ffff8882a9928000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000048000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007f14819e8400 CR3=000000016ab62000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=00ff000000000000 ff00000000000000 XMM05=0000000000000036 0000000000003030
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=ffffffffffffff00 ffffffffffff0000 XMM09=6c6c696b66722f36 7968702f31313230
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000