Warning: Permanently added '[localhost]:51221' (ED25519) to the list of known hosts. 2026/03/01 13:15:08 parsed 1 programs syzkaller login: [ 52.527288][ T5807] cgroup: Unknown subsys name 'net' [ 52.636715][ T5807] cgroup: Unknown subsys name 'cpuset' [ 52.640936][ T5807] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 53.877935][ T5807] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 55.836663][ T5820] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 56.002357][ T4975] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 56.005969][ T4975] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 56.059242][ T33] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 56.062804][ T33] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 56.711565][ T5862] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 56.720928][ T5862] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 56.723575][ T5862] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 56.726919][ T5862] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 56.730183][ T5862] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 57.462746][ T5876] chnl_net:caif_netlink_parms(): no params data found [ 57.803404][ T5876] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.814137][ T5876] bridge0: port 1(bridge_slave_0) entered disabled state [ 57.816969][ T5876] bridge_slave_0: entered allmulticast mode [ 57.822038][ T5876] bridge_slave_0: entered promiscuous mode [ 57.832477][ T5876] bridge0: port 2(bridge_slave_1) entered blocking state [ 57.837503][ T5876] bridge0: port 2(bridge_slave_1) entered disabled state [ 57.843797][ T5876] bridge_slave_1: entered allmulticast mode [ 57.850846][ T5876] bridge_slave_1: entered promiscuous mode [ 57.914005][ T5876] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 57.966739][ T5876] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 58.007429][ T5876] team0: Port device team_slave_0 added [ 58.011395][ T5876] team0: Port device team_slave_1 added [ 58.055092][ T5876] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 58.057333][ T5876] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 58.077055][ T5876] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 58.085789][ T5876] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 58.088306][ T5876] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 58.102887][ T5876] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 58.149815][ T5876] hsr_slave_0: entered promiscuous mode [ 58.152948][ T5876] hsr_slave_1: entered promiscuous mode [ 58.304928][ T5876] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 58.312932][ T5876] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 58.318902][ T5876] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 58.325988][ T5876] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 58.396487][ T5876] 8021q: adding VLAN 0 to HW filter on device bond0 [ 58.411800][ T5876] 8021q: adding VLAN 0 to HW filter on device team0 [ 58.421409][ T82] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.424635][ T82] bridge0: port 1(bridge_slave_0) entered forwarding state [ 58.435340][ T82] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.438282][ T82] bridge0: port 2(bridge_slave_1) entered forwarding state [ 58.577680][ T5876] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 58.613584][ T5876] veth0_vlan: entered promiscuous mode [ 58.621079][ T5876] veth1_vlan: entered promiscuous mode [ 58.641031][ T5876] veth0_macvtap: entered promiscuous mode [ 58.646564][ T5876] veth1_macvtap: entered promiscuous mode [ 58.659355][ T5876] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 58.667070][ T5876] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 58.676477][ T5675] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.679819][ T5675] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.682998][ T5675] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.687277][ T5675] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 2026/03/01 13:15:16 executed programs: 0 [ 58.815948][ T54] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 58.818850][ T54] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 58.821432][ T54] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 58.832122][ T54] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 58.844132][ T54] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 58.873446][ T5198] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 58.884320][ T5862] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 58.887817][ T5922] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 58.888139][ T5923] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 58.895404][ T5923] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 58.898254][ T5923] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 58.901213][ T5923] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 58.904581][ T5922] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 58.904693][ T5923] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 58.910044][ T5923] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 59.191620][ T5919] chnl_net:caif_netlink_parms(): no params data found [ 59.250483][ T5914] chnl_net:caif_netlink_parms(): no params data found [ 59.292221][ T13] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 59.372940][ T13] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 59.425974][ T5919] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.428957][ T5919] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.431824][ T5919] bridge_slave_0: entered allmulticast mode [ 59.435726][ T5919] bridge_slave_0: entered promiscuous mode [ 59.440304][ T5919] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.443269][ T5919] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.446296][ T5919] bridge_slave_1: entered allmulticast mode [ 59.450004][ T5919] bridge_slave_1: entered promiscuous mode [ 59.454025][ T5920] chnl_net:caif_netlink_parms(): no params data found [ 59.495738][ T5914] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.498588][ T5914] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.501456][ T5914] bridge_slave_0: entered allmulticast mode [ 59.505688][ T5914] bridge_slave_0: entered promiscuous mode [ 59.510034][ T5914] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.512885][ T5914] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.516585][ T5914] bridge_slave_1: entered allmulticast mode [ 59.520353][ T5914] bridge_slave_1: entered promiscuous mode [ 59.575036][ T5914] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 59.582991][ T5919] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 59.599545][ T5914] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 59.605353][ T5919] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 59.674543][ T5919] team0: Port device team_slave_0 added [ 59.678878][ T5914] team0: Port device team_slave_0 added [ 59.682711][ T5919] team0: Port device team_slave_1 added [ 59.685465][ T5920] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.688378][ T5920] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.691456][ T5920] bridge_slave_0: entered allmulticast mode [ 59.695734][ T5920] bridge_slave_0: entered promiscuous mode [ 59.700574][ T5920] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.703472][ T5920] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.707118][ T5920] bridge_slave_1: entered allmulticast mode [ 59.710688][ T5920] bridge_slave_1: entered promiscuous mode [ 59.716268][ T5914] team0: Port device team_slave_1 added [ 59.758685][ T5919] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 59.761415][ T5919] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 59.771426][ T5919] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 59.778398][ T5919] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 59.781191][ T5919] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 59.792489][ T5919] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 59.828736][ T5920] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 59.842640][ T5914] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 59.846301][ T5914] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 59.856655][ T5914] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 59.869696][ T5920] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 59.874161][ T5914] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 59.876918][ T5914] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 59.887118][ T5914] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 59.929669][ T5919] hsr_slave_0: entered promiscuous mode [ 59.932361][ T5919] hsr_slave_1: entered promiscuous mode [ 59.935431][ T5919] debugfs: 'hsr0' already exists in 'hsr' [ 59.937838][ T5919] Cannot create hsr debugfs directory [ 59.951692][ T5920] team0: Port device team_slave_0 added [ 59.968136][ T5914] hsr_slave_0: entered promiscuous mode [ 59.971086][ T5914] hsr_slave_1: entered promiscuous mode [ 59.974479][ T5914] debugfs: 'hsr0' already exists in 'hsr' [ 59.976879][ T5914] Cannot create hsr debugfs directory [ 59.990217][ T5920] team0: Port device team_slave_1 added [ 60.048730][ T5920] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 60.051335][ T5920] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 60.061474][ T5920] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 60.068341][ T5920] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 60.071025][ T5920] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 60.080797][ T5920] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 60.194359][ T5920] hsr_slave_0: entered promiscuous mode [ 60.197365][ T5920] hsr_slave_1: entered promiscuous mode [ 60.200288][ T5920] debugfs: 'hsr0' already exists in 'hsr' [ 60.202576][ T5920] Cannot create hsr debugfs directory [ 60.368947][ T13] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 60.376100][ T5914] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 60.380716][ T5914] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 60.395153][ T5914] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 60.403393][ T5914] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 60.451473][ T5919] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 60.457778][ T5919] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 60.462492][ T5919] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 60.468652][ T5919] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 60.546698][ T5914] 8021q: adding VLAN 0 to HW filter on device bond0 [ 60.551486][ T5919] 8021q: adding VLAN 0 to HW filter on device bond0 [ 60.568072][ T5919] 8021q: adding VLAN 0 to HW filter on device team0 [ 60.571707][ T5914] 8021q: adding VLAN 0 to HW filter on device team0 [ 60.580556][ T4975] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.582935][ T4975] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.587863][ T4975] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.590105][ T4975] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.598689][ T4975] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.600864][ T4975] bridge0: port 2(bridge_slave_1) entered forwarding state [ 60.606559][ T82] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.609224][ T82] bridge0: port 2(bridge_slave_1) entered forwarding state [ 60.648812][ T5919] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 60.777627][ T5919] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 60.787270][ T5914] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 60.828248][ T5919] veth0_vlan: entered promiscuous mode [ 60.833201][ T5914] veth0_vlan: entered promiscuous mode [ 60.840534][ T5919] veth1_vlan: entered promiscuous mode [ 60.845284][ T5914] veth1_vlan: entered promiscuous mode [ 60.872058][ T5914] veth0_macvtap: entered promiscuous mode [ 60.877809][ T5914] veth1_macvtap: entered promiscuous mode [ 60.881139][ T5919] veth0_macvtap: entered promiscuous mode [ 60.886565][ T5919] veth1_macvtap: entered promiscuous mode [ 60.899876][ T5919] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 60.904246][ T5922] Bluetooth: hci0: command tx timeout [ 60.912469][ T5914] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 60.919260][ T5919] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 60.929096][ T5914] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 60.937764][ T5943] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.941047][ T5943] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.951560][ T5943] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.956308][ T5943] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.961355][ T5943] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.975035][ T5943] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.978708][ T5943] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.981352][ T5943] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.984842][ T5922] Bluetooth: hci1: command tx timeout [ 60.994082][ T5922] Bluetooth: hci2: command tx timeout [ 61.041046][ T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 61.049629][ T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 61.055408][ T4975] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 61.058891][ T4975] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 61.076185][ T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 61.079448][ T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 61.104732][ T4975] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 61.108394][ T4975] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 61.122726][ T5967] loop1: detected capacity change from 0 to 512 [ 61.131179][ T5967] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 61.140062][ T5967] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 61.159950][ T5967] EXT4-fs error (device loop1): ext4_free_branches:1023: inode #11: comm syz.1.18: invalid indirect mapped block 9 (level 0) [ 61.166163][ T5967] loop1: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 61.167405][ T5971] loop0: detected capacity change from 0 to 512 [ 61.167572][ T5967] EXT4-fs (loop1): 1 truncate cleaned up [ 61.175154][ C1] EXT4-fs (loop1): error count since last fsck: 1 [ 61.175259][ C1] EXT4-fs (loop1): initial error at time 1772370918: ext4_free_branches:1023: inode 11 [ 61.175279][ C1] EXT4-fs (loop1): last error at time 1772370918: ext4_free_branches:1023: inode 11 [ 61.177774][ T5971] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 61.196456][ T5967] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 61.201976][ T5971] EXT4-fs error (device loop0): ext4_free_branches:1023: inode #11: comm syz.0.17: invalid indirect mapped block 9 (level 0) [ 61.207130][ T5971] loop0: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 61.207491][ T5971] EXT4-fs (loop0): 1 truncate cleaned up [ 61.212824][ T5971] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 61.220409][ T5919] EXT4-fs error (device loop1): htree_dirblock_to_tree:1080: inode #2: block 13: comm syz-executor: bad entry in directory: rec_len is smaller than minimal - offset=24, inode=11, rec_len=8, size=1024 fake=0 [ 61.227544][ T5914] EXT4-fs error (device loop0): htree_dirblock_to_tree:1080: inode #2: block 13: comm syz-executor: bad entry in directory: rec_len is smaller than minimal - offset=24, inode=11, rec_len=8, size=1024 fake=0 [ 61.715853][ T13] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 61.967739][ T13] bridge_slave_1: left allmulticast mode [ 61.969990][ T13] bridge_slave_1: left promiscuous mode [ 61.972805][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.978979][ T13] bridge_slave_0: left allmulticast mode [ 61.981094][ T13] bridge_slave_0: left promiscuous mode [ 61.983414][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 62.127746][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 62.133982][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 62.140517][ T13] bond0 (unregistering): Released all slaves [ 62.278007][ T13] hsr_slave_0: left promiscuous mode [ 62.280833][ T13] hsr_slave_1: left promiscuous mode [ 62.283533][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 62.287428][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 62.290913][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 62.293531][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 62.308393][ T13] veth1_macvtap: left promiscuous mode [ 62.310730][ T13] veth0_macvtap: left promiscuous mode [ 62.312996][ T13] veth1_vlan: left promiscuous mode [ 62.315765][ T13] veth0_vlan: left promiscuous mode [ 62.502060][ T13] team0 (unregistering): Port device team_slave_1 removed [ 62.512631][ T13] team0 (unregistering): Port device team_slave_0 removed [ 62.592412][ T5914] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 62.669072][ T54] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 62.673101][ T54] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 62.676937][ T54] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 62.680895][ T54] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 62.688829][ T54] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 62.929270][ T5920] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 62.945477][ T5920] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 62.952329][ T5920] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 62.965527][ T5920] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 63.015217][ T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 63.064257][ T54] Bluetooth: hci2: command tx timeout [ 63.070677][ T5980] chnl_net:caif_netlink_parms(): no params data found [ 63.079787][ T5919] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 63.129605][ T5922] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 63.132385][ T5922] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 63.135940][ T5922] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 63.139880][ T5922] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 63.143309][ T5922] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 63.181539][ T5980] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.184678][ T5980] bridge0: port 1(bridge_slave_0) entered disabled state [ 63.187173][ T5980] bridge_slave_0: entered allmulticast mode [ 63.190178][ T5980] bridge_slave_0: entered promiscuous mode [ 63.196773][ T5920] 8021q: adding VLAN 0 to HW filter on device bond0 [ 63.209215][ T5980] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.211734][ T5980] bridge0: port 2(bridge_slave_1) entered disabled state [ 63.215431][ T5980] bridge_slave_1: entered allmulticast mode [ 63.218011][ T5980] bridge_slave_1: entered promiscuous mode [ 63.263057][ T5920] 8021q: adding VLAN 0 to HW filter on device team0 [ 63.272935][ T5980] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 63.282690][ T5980] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 63.306298][ T33] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.309100][ T33] bridge0: port 1(bridge_slave_0) entered forwarding state [ 63.326841][ T5980] team0: Port device team_slave_0 added [ 63.331466][ T5980] team0: Port device team_slave_1 added [ 63.363267][ T5980] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 63.367099][ T5980] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 63.376770][ T5980] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 63.387210][ T516] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.390160][ T516] bridge0: port 2(bridge_slave_1) entered forwarding state [ 63.408681][ T5980] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 63.410932][ T5980] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 63.420071][ T5980] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 63.490609][ T5980] hsr_slave_0: entered promiscuous mode [ 63.493527][ T5980] hsr_slave_1: entered promiscuous mode [ 63.517144][ T5999] chnl_net:caif_netlink_parms(): no params data found [ 63.659297][ T5999] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.665122][ T5999] bridge0: port 1(bridge_slave_0) entered disabled state [ 63.668024][ T5999] bridge_slave_0: entered allmulticast mode [ 63.671643][ T5999] bridge_slave_0: entered promiscuous mode [ 63.676842][ T5999] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.679627][ T5999] bridge0: port 2(bridge_slave_1) entered disabled state [ 63.682398][ T5999] bridge_slave_1: entered allmulticast mode [ 63.688003][ T5999] bridge_slave_1: entered promiscuous mode [ 63.761691][ T5999] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 63.768692][ T5999] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 63.810272][ T5999] team0: Port device team_slave_0 added [ 63.817318][ T5999] team0: Port device team_slave_1 added [ 63.845712][ T5920] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 63.858729][ T5999] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 63.861513][ T5999] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 63.873140][ T5999] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 63.877942][ T5999] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 63.880037][ T5999] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 63.889222][ T5999] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 63.927416][ T5999] hsr_slave_0: entered promiscuous mode [ 63.929635][ T5999] hsr_slave_1: entered promiscuous mode [ 63.931682][ T5999] debugfs: 'hsr0' already exists in 'hsr' [ 63.933441][ T5999] Cannot create hsr debugfs directory [ 63.996865][ T5980] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 64.010551][ T5980] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 64.030738][ T5980] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 64.038632][ T5920] veth0_vlan: entered promiscuous mode [ 64.041524][ T5980] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 64.087334][ T5920] veth1_vlan: entered promiscuous mode [ 64.141037][ T5999] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 64.150003][ T5999] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 64.158450][ T5920] veth0_macvtap: entered promiscuous mode [ 64.161825][ T5999] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 64.166648][ T5999] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 64.178335][ T5920] veth1_macvtap: entered promiscuous mode [ 64.208653][ T5920] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 64.220038][ T5920] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 64.232614][ T5675] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.236062][ T5675] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.245105][ T5675] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.250364][ T5980] 8021q: adding VLAN 0 to HW filter on device bond0 [ 64.257175][ T5675] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.280982][ T5980] 8021q: adding VLAN 0 to HW filter on device team0 [ 64.305421][ T797] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.307987][ T797] bridge0: port 1(bridge_slave_0) entered forwarding state [ 64.311721][ T797] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.314103][ T797] bridge0: port 2(bridge_slave_1) entered forwarding state [ 64.350037][ T5999] 8021q: adding VLAN 0 to HW filter on device bond0 [ 64.379078][ T33] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.381541][ T33] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.401060][ T5999] 8021q: adding VLAN 0 to HW filter on device team0 [ 64.428629][ T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 64.443057][ T33] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.448726][ T516] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.451501][ T516] bridge0: port 1(bridge_slave_0) entered forwarding state [ 64.455630][ T33] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.483025][ T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 64.500699][ T516] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.504083][ T516] bridge0: port 2(bridge_slave_1) entered forwarding state 2026/03/01 13:15:21 executed programs: 12 [ 64.556212][ T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 64.562319][ T6030] loop2: detected capacity change from 0 to 512 [ 64.571963][ T6030] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 64.586813][ T6030] EXT4-fs error (device loop2): ext4_free_branches:1023: inode #11: comm syz.2.19: invalid indirect mapped block 9 (level 0) [ 64.594313][ T6030] loop2: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 64.594647][ T6030] EXT4-fs (loop2): 1 truncate cleaned up [ 64.595905][ T5980] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 64.598117][ T6030] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 64.617510][ T5980] veth0_vlan: entered promiscuous mode [ 64.625234][ T5980] veth1_vlan: entered promiscuous mode [ 64.640936][ T5980] veth0_macvtap: entered promiscuous mode [ 64.645526][ T5980] veth1_macvtap: entered promiscuous mode [ 64.667601][ T5920] EXT4-fs error (device loop2): htree_dirblock_to_tree:1080: inode #2: block 13: comm syz-executor: bad entry in directory: rec_len is smaller than minimal - offset=24, inode=11, rec_len=8, size=1024 fake=0 [ 64.690084][ T5980] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 64.710680][ T5980] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 64.752072][ T13] bridge_slave_1: left allmulticast mode [ 64.754339][ T5922] Bluetooth: hci0: command tx timeout [ 64.756817][ T13] bridge_slave_1: left promiscuous mode [ 64.759039][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 64.762897][ T13] bridge_slave_0: left allmulticast mode [ 64.766195][ T13] bridge_slave_0: left promiscuous mode [ 64.768350][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 64.908113][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 64.913260][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 64.918320][ T13] bond0 (unregistering): Released all slaves [ 64.936818][ T5832] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.950021][ T5832] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.956368][ T5832] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.968400][ T5832] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.007672][ T5999] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 65.112667][ T82] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.119495][ T82] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.159323][ T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.169453][ T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.237350][ T5922] Bluetooth: hci1: command tx timeout [ 65.245827][ T13] hsr_slave_0: left promiscuous mode [ 65.248298][ T13] hsr_slave_1: left promiscuous mode [ 65.252314][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 65.257567][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 65.263272][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 65.266000][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 65.271945][ T13] veth1_macvtap: left promiscuous mode [ 65.274434][ T13] veth0_macvtap: left promiscuous mode [ 65.276416][ T13] veth1_vlan: left promiscuous mode [ 65.278390][ T13] veth0_vlan: left promiscuous mode [ 65.406300][ T13] team0 (unregistering): Port device team_slave_1 removed [ 65.436745][ T13] team0 (unregistering): Port device team_slave_0 removed [ 65.487682][ T5920] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 65.538878][ T54] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 65.541900][ T54] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 65.545314][ T54] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 65.548428][ T54] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 65.551034][ T54] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 65.608781][ T6059] loop3: detected capacity change from 0 to 512 [ 65.617934][ T6059] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 65.635969][ T6059] EXT4-fs error (device loop3): ext4_free_branches:1023: inode #11: comm syz.3.23: invalid indirect mapped block 9 (level 0) [ 65.640951][ T6059] loop3: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 65.641266][ T6059] EXT4-fs (loop3): 1 truncate cleaned up [ 65.645010][ C1] EXT4-fs (loop3): error count since last fsck: 1 [ 65.645024][ C1] EXT4-fs (loop3): initial error at time 1772370923: ext4_free_branches:1023: inode 11 [ 65.645044][ C1] EXT4-fs (loop3): last error at time 1772370923: ext4_free_branches:1023: inode 11 [ 65.686061][ T6059] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 65.725520][ T5980] EXT4-fs error (device loop3): htree_dirblock_to_tree:1080: inode #2: block 13: comm syz-executor: bad entry in directory: rec_len is smaller than minimal - offset=24, inode=11, rec_len=8, size=1024 fake=0 [ 65.739271][ T5999] veth0_vlan: entered promiscuous mode [ 65.748684][ T6056] chnl_net:caif_netlink_parms(): no params data found [ 65.772755][ T5999] veth1_vlan: entered promiscuous mode [ 65.855012][ T6056] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.857675][ T6056] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.860548][ T6056] bridge_slave_0: entered allmulticast mode [ 65.864776][ T6056] bridge_slave_0: entered promiscuous mode [ 65.877426][ T6056] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.880066][ T6056] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.882700][ T6056] bridge_slave_1: entered allmulticast mode [ 65.894698][ T6056] bridge_slave_1: entered promiscuous mode [ 65.913531][ T5999] veth0_macvtap: entered promiscuous mode [ 65.921368][ T5999] veth1_macvtap: entered promiscuous mode [ 65.937378][ T6056] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.944303][ T6056] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.965755][ T6056] team0: Port device team_slave_0 added [ 65.972249][ T5999] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 65.978052][ T5999] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 65.981771][ T6056] team0: Port device team_slave_1 added [ 66.005053][ T6056] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.007337][ T6056] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.016254][ T6056] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.021977][ T6056] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.026375][ T6056] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 66.034849][ T6056] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.044038][ T5943] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.079606][ T13] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 66.087447][ T5943] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.091004][ T5943] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.115924][ T5943] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.171597][ T6056] hsr_slave_0: entered promiscuous mode [ 66.174941][ T6056] hsr_slave_1: entered promiscuous mode [ 66.177211][ T6056] debugfs: 'hsr0' already exists in 'hsr' [ 66.179187][ T6056] Cannot create hsr debugfs directory [ 66.220321][ T82] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.222877][ T82] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.286203][ T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.289944][ T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.365627][ T6084] loop4: detected capacity change from 0 to 512 [ 66.374893][ T6056] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 66.380510][ T6084] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 66.391472][ T6056] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 66.405096][ T6056] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 66.409808][ T6084] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #11: comm syz.4.25: invalid indirect mapped block 9 (level 0) [ 66.416538][ T6056] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 66.417206][ T6084] loop4: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 66.419414][ T6084] EXT4-fs (loop4): 1 truncate cleaned up [ 66.425604][ C1] EXT4-fs (loop4): error count since last fsck: 1 [ 66.425614][ C1] EXT4-fs (loop4): initial error at time 1772370923: ext4_free_branches:1023: inode 11 [ 66.425627][ C1] EXT4-fs (loop4): last error at time 1772370923: ext4_free_branches:1023: inode 11 [ 66.440266][ T6084] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 66.458024][ T13] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 66.466198][ T5999] EXT4-fs error (device loop4): htree_dirblock_to_tree:1080: inode #2: block 13: comm syz-executor: bad entry in directory: rec_len is smaller than minimal - offset=24, inode=11, rec_len=8, size=1024 fake=0 [ 66.540835][ T6056] 8021q: adding VLAN 0 to HW filter on device bond0 [ 66.556112][ T6056] 8021q: adding VLAN 0 to HW filter on device team0 [ 66.563022][ T797] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.565775][ T797] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.575479][ T797] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.578276][ T797] bridge0: port 2(bridge_slave_1) entered forwarding state [ 66.701002][ T6056] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 66.821742][ T6056] veth0_vlan: entered promiscuous mode [ 66.831818][ T13] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 66.845009][ T6056] veth1_vlan: entered promiscuous mode [ 66.865096][ T13] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 66.885782][ T6056] veth0_macvtap: entered promiscuous mode [ 66.891006][ T6056] veth1_macvtap: entered promiscuous mode [ 66.905983][ T6056] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 66.916009][ T6056] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 66.923273][ T5943] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.927438][ T5943] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.930626][ T5943] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.945054][ T5943] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.998319][ T13] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 67.020404][ T4975] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.027164][ T4975] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.040782][ T33] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.043231][ T33] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.072109][ T13] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 67.097720][ T6108] loop5: detected capacity change from 0 to 512 [ 67.101071][ T6108] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 67.109220][ T6108] EXT4-fs error (device loop5): ext4_free_branches:1023: inode #11: comm syz.5.28: invalid indirect mapped block 9 (level 0) [ 67.114314][ T6108] loop5: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 67.118690][ T6108] EXT4-fs (loop5): 1 truncate cleaned up [ 67.124253][ C0] EXT4-fs (loop5): error count since last fsck: 1 [ 67.124268][ C0] EXT4-fs (loop5): initial error at time 1772370924: ext4_free_branches:1023: inode 11 [ 67.124286][ C0] EXT4-fs (loop5): last error at time 1772370924: ext4_free_branches:1023: inode 11 [ 67.135004][ T6108] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 67.151886][ T13] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 67.154948][ T6056] EXT4-fs error (device loop5): htree_dirblock_to_tree:1080: inode #2: block 13: comm syz-executor: bad entry in directory: rec_len is smaller than minimal - offset=24, inode=11, rec_len=8, size=1024 fake=0 [ 67.180538][ T5999] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 67.220591][ T13] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 67.237932][ T54] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 67.241553][ T54] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 67.248237][ T54] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 67.251960][ T54] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 67.255233][ T54] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 67.308077][ T5980] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 67.310973][ T6060] ================================================================== [ 67.313351][ T6060] BUG: KASAN: slab-use-after-free in do_exit+0x1892/0x2320 [ 67.315675][ T6060] Read of size 8 at addr ffffc900039c0748 by task kworker/R-ext4-/6060 [ 67.319000][ T6060] [ 67.319784][ T6060] CPU: 1 UID: 0 PID: 6060 Comm: kworker/R-ext4- Not tainted syzkaller #0 PREEMPT(full) [ 67.319793][ T6060] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 67.319798][ T6060] Call Trace: [ 67.319802][ T6060] [ 67.319805][ T6060] dump_stack_lvl+0xe8/0x150 [ 67.319818][ T6060] print_report+0xba/0x230 [ 67.319827][ T6060] ? do_exit+0x1892/0x2320 [ 67.319834][ T6060] kasan_report+0x117/0x150 [ 67.319843][ T6060] ? do_exit+0x1892/0x2320 [ 67.319850][ T6060] do_exit+0x1892/0x2320 [ 67.319857][ T6060] ? __pfx_do_exit+0x10/0x10 [ 67.319863][ T6060] ? rescuer_thread+0xbb/0x1120 [ 67.319875][ T6060] ? __kthread_parkme+0x7a/0x1f0 [ 67.319886][ T6060] kthread_exit+0x22b/0x280 [ 67.319894][ T6060] kthread+0x3a6/0x470 [ 67.319900][ T6060] ? __pfx_rescuer_thread+0x10/0x10 [ 67.319909][ T6060] ? __pfx_kthread+0x10/0x10 [ 67.319915][ T6060] ret_from_fork+0x51e/0xb90 [ 67.319924][ T6060] ? __pfx_ret_from_fork+0x10/0x10 [ 67.319932][ T6060] ? __switch_to+0xc7d/0x1450 [ 67.319940][ T6060] ? __pfx_kthread+0x10/0x10 [ 67.319945][ T6060] ret_from_fork_asm+0x1a/0x30 [ 67.319957][ T6060] [ 67.319960][ T6060] [ 67.355960][ T6060] The buggy address belongs to stack of task kworker/R-ext4-/6060 [ 67.358358][ T6060] [ 67.359121][ T6060] The buggy address belongs to a 8-page vmalloc region starting at 0xffffc900039c0000 allocated at copy_process+0x508/0x3cf0 [ 67.363008][ T6060] The buggy address belongs to the physical page: [ 67.364975][ T6060] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11ade0 [ 67.367708][ T6060] flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff) [ 67.370162][ T6060] raw: 017ff00000000000 0000000000000000 dead000000000122 0000000000000000 [ 67.373172][ T6060] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 67.375822][ T6060] page dumped because: kasan: bad access detected [ 67.377803][ T6060] page_owner tracks the page as allocated [ 67.379454][ T6060] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 2, tgid 2 (kthreadd), ts 65632032727, free_ts 57080349786 [ 67.385160][ T6060] post_alloc_hook+0x231/0x280 [ 67.386662][ T6060] get_page_from_freelist+0x24dc/0x2580 [ 67.388363][ T6060] __alloc_frozen_pages_noprof+0x18d/0x380 [ 67.390192][ T6060] alloc_pages_mpol+0x232/0x4a0 [ 67.391715][ T6060] alloc_pages_noprof+0xa8/0x190 [ 67.393226][ T6060] __vmalloc_node_range_noprof+0x79b/0x1730 [ 67.395092][ T6060] __vmalloc_node_noprof+0xc2/0x100 [ 67.396769][ T6060] dup_task_struct+0x228/0x9a0 [ 67.398252][ T6060] copy_process+0x508/0x3cf0 [ 67.399699][ T6060] kernel_clone+0x248/0x8e0 [ 67.401091][ T6060] kernel_thread+0x13f/0x1b0 [ 67.402542][ T6060] kthreadd+0x4ec/0x6e0 [ 67.403891][ T6060] ret_from_fork+0x51e/0xb90 [ 67.405589][ T6060] ret_from_fork_asm+0x1a/0x30 [ 67.407221][ T6060] page last free pid 5859 tgid 5859 stack trace: [ 67.409224][ T6060] __free_frozen_pages+0xc2b/0xdb0 [ 67.410850][ T6060] vfree+0x25a/0x400 [ 67.412327][ T6060] kcov_close+0x28/0x50 [ 67.413737][ T6060] __fput+0x44f/0xa70 [ 67.415009][ T6060] task_work_run+0x1d9/0x270 [ 67.416446][ T6060] do_exit+0x69b/0x2320 [ 67.417771][ T6060] do_group_exit+0x21b/0x2d0 [ 67.419182][ T6060] get_signal+0x1284/0x1330 [ 67.420589][ T6060] arch_do_signal_or_restart+0xbc/0x830 [ 67.422319][ T6060] exit_to_user_mode_loop+0x86/0x480 [ 67.423987][ T6060] do_syscall_64+0x32d/0xf80 [ 67.425810][ T6060] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 67.428148][ T6060] [ 67.429123][ T6060] Memory state around the buggy address: [ 67.431429][ T6060] ffffc900039c0600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.433961][ T6060] ffffc900039c0680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.436702][ T6060] >ffffc900039c0700: 00 00 00 00 00 00 00 00 00 fb 1d 00 01 00 00 00 [ 67.439910][ T6060] ^ [ 67.442528][ T6060] ffffc900039c0780: 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 [ 67.445832][ T6060] ffffc900039c0800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.449110][ T6060] ================================================================== [ 67.459719][ T6060] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 67.462287][ T6060] CPU: 1 UID: 0 PID: 6060 Comm: kworker/R-ext4- Not tainted syzkaller #0 PREEMPT(full) [ 67.466304][ T6060] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 67.470439][ T6060] Call Trace: [ 67.471859][ T6060] [ 67.473111][ T6060] vpanic+0x56c/0xa60 [ 67.474765][ T6060] ? __pfx_vpanic+0x10/0x10 [ 67.476552][ T6060] panic+0xc5/0xd0 [ 67.478077][ T6060] ? __pfx_panic+0x10/0x10 [ 67.479921][ T6060] ? preempt_schedule_thunk+0x16/0x30 [ 67.482105][ T6060] ? do_exit+0x1892/0x2320 [ 67.483960][ T6060] ? preempt_schedule_thunk+0x16/0x30 [ 67.486184][ T6060] ? do_exit+0x1892/0x2320 [ 67.488042][ T6060] check_panic_on_warn+0x89/0xb0 [ 67.489696][ T6060] ? do_exit+0x1892/0x2320 [ 67.491193][ T6060] end_report+0x73/0x180 [ 67.492977][ T6060] ? do_exit+0x1892/0x2320 [ 67.494862][ T6060] kasan_report+0x128/0x150 [ 67.496771][ T6060] ? do_exit+0x1892/0x2320 [ 67.498629][ T6060] do_exit+0x1892/0x2320 [ 67.500338][ T6060] ? __pfx_do_exit+0x10/0x10 [ 67.502185][ T6060] ? rescuer_thread+0xbb/0x1120 [ 67.504170][ T6060] ? __kthread_parkme+0x7a/0x1f0 [ 67.506210][ T6060] kthread_exit+0x22b/0x280 [ 67.508090][ T6060] kthread+0x3a6/0x470 [ 67.509768][ T6060] ? __pfx_rescuer_thread+0x10/0x10 [ 67.511933][ T6060] ? __pfx_kthread+0x10/0x10 [ 67.513507][ T6060] ret_from_fork+0x51e/0xb90 [ 67.515106][ T6060] ? __pfx_ret_from_fork+0x10/0x10 [ 67.516742][ T6060] ? __switch_to+0xc7d/0x1450 [ 67.518444][ T6060] ? __pfx_kthread+0x10/0x10 [ 67.520023][ T6060] ret_from_fork_asm+0x1a/0x30 [ 67.521545][ T6060] [ 67.523310][ T6060] Kernel Offset: disabled [ 67.524769][ T6060] Rebooting in 86400 seconds.. VM DIAGNOSIS: 13:15:24 Registers: info registers vcpu 0 CPU#0 RAX=00000000000000fb RBX=00000000000000fb RCX=0000000000000830 RDX=0000000000000001 RSI=00000000000000fb RDI=0000000000000001 RBP=ffffc900039b7438 RSP=ffffc900039b7350 R8 =ffffffff90118cb7 R9 =1ffffffff2023196 R10=dffffc0000000000 R11=ffffffff8173e380 R12=dffffc0000000000 R13=1ffff92000736e74 R14=ffff88823c6201b0 R15=ffffffff8e1ab798 RIP=ffffffff8174f5a3 RFL=00000006 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00005555674c2500 ffffffff 00c00000 GS =0000 ffff88818de63000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000555d8b6aa000 CR3=000000016a5b2000 CR4=000006f0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000 XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000 XMM04=ffffffffffffffff ffff0000ff000000 XMM05=0000000000000041 0000000000007374 XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000 XMM08=ffffffffffffff00 ffffffffffff0000 XMM09=0000000000000041 0000000000007374 XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000 XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000 XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000000074 RBX=0000000000000074 RCX=0000000000000000 RDX=00000000000003f8 RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc900039c7690 R8 =ffff88816be28237 R9 =1ffff1102d7c5046 R10=dffffc0000000000 R11=ffffffff854014b0 R12=dffffc0000000000 R13=ffffffff9a2b3a83 R14=ffffffff9a5cb8a0 R15=0000000000000000 RIP=ffffffff8540152c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8882a9463000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f0c37613a48 CR3=0000000114092000 CR4=000006f0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0000000000000000 0000000000000000 XMM01=ffffffffffffffff ffffffffffffffff XMM02=ffff000000000000 ffffffffffffffff XMM03=ffffffffffffffff ffffffffffffffff XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000 XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000 XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000 XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000 XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000 XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000