ci-upstream-kasan-gce-selinux-root/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci-upstream-kasan-gce-selinux-root/syz-executor2646274892 <...> [ 86.314782][ T1222] cfg80211: failed to load regulatory.db Warning: Permanently added '10.128.0.152' (ED25519) to the list of known hosts. execve("ci-upstream-kasan-gce-selinux-root/syz-executor2646274892", ["ci-upstream-kasan-gce-selinux-root/syz-executor2646274892"], 0x7ffc7d1dc830 /* 10 vars */) = 0 brk(NULL) = 0x55556ed74000 brk(0x55556ed74d80) = 0x55556ed74d80 arch_prctl(ARCH_SET_FS, 0x55556ed74400) = 0 set_tid_address(0x55556ed746d0) = 5628 set_robust_list(0x55556ed746e0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci-upstream-kasan-gce-selinux-root/syz-executor2646274892", 4096) = 63 getrandom("\x8b\x1f\x81\x00\x0a\x9f\xc8\xf7", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55556ed74d80 brk(0x55556ed95d80) = 0x55556ed95d80 brk(0x55556ed96000) = 0x55556ed96000 mprotect(0x7fa8a6a9d000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556ed746d0) = 5629 ci-upstream-kasan-gce-selinux-root/strace-static-x86_64: Process 5629 attached [pid 5628] rt_sigprocmask(SIG_SETMASK, [] [pid 5629] set_robust_list(0x55556ed746e0, 24 [pid 5628] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5629] <... set_robust_list resumed>) = 0 [pid 5629] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5629] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5629] setpgid(0, 0) = 0 [pid 5629] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5629] write(3, "1000", 4) = 4 [pid 5629] close(3) = 0 [pid 5629] write(1, "executing program\n", 18) = 18 executing program [ 86.882429][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 86.882444][ T30] audit: type=1400 audit(1785878174.741:129): avc: denied { execmem } for pid=5628 comm="syz-executor264" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [pid 5629] openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3 [pid 5629] ioctl(3, USB_RAW_IOCTL_INIT, 0x7ffe696e70f0) = 0 [pid 5629] ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 [ 86.956563][ T30] audit: type=1400 audit(1785878174.821:130): avc: denied { read write } for pid=5629 comm="syz-executor264" name="raw-gadget" dev="devtmpfs" ino=821 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 86.980504][ T30] audit: type=1400 audit(1785878174.821:131): avc: denied { open } for pid=5629 comm="syz-executor264" path="/dev/raw-gadget" dev="devtmpfs" ino=821 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [pid 5629] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [ 87.005641][ T30] audit: type=1400 audit(1785878174.821:132): avc: denied { ioctl } for pid=5629 comm="syz-executor264" path="/dev/raw-gadget" dev="devtmpfs" ino=821 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [pid 5629] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [pid 5629] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [pid 5629] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [pid 5629] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe696e60e0) = 18 [pid 5629] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [ 87.243224][ T1222] usb 1-1: new high-speed USB device number 2 using dummy_hcd [pid 5629] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [pid 5629] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [pid 5629] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe696e60e0) = 18 [pid 5629] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [pid 5629] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe696e60e0) = 9 [pid 5629] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [pid 5629] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe696e60e0) = 39 [pid 5629] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [pid 5629] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe696e60e0) = 4 [pid 5629] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [pid 5629] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe696e60e0) = 8 [pid 5629] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [pid 5629] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe696e60e0) = 8 [ 87.446106][ T1222] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 87.456093][ T1222] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 87.466398][ T1222] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [pid 5629] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [pid 5629] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe696e60e0) = 8 [pid 5629] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [pid 5629] ioctl(3, USB_RAW_IOCTL_VBUS_DRAW, 0xfa) = 0 [pid 5629] ioctl(3, USB_RAW_IOCTL_CONFIGURE, 0) = 0 [pid 5629] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7fa8a6aa3b4c) = -1 EINVAL (Invalid argument) [ 87.530349][ T1222] usb 1-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice= 1.00 [ 87.539448][ T1222] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 87.547622][ T1222] usb 1-1: Product: syz [ 87.551822][ T1222] usb 1-1: Manufacturer: syz [ 87.556457][ T1222] usb 1-1: SerialNumber: syz [ 87.567968][ T5629] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [pid 5629] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7fa8a6aa3b5c) = -1 EINVAL (Invalid argument) [pid 5629] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7fa8a6aa3b6c) = -1 EINVAL (Invalid argument) [pid 5629] ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffe696e60e0) = 0 [ 87.585678][ T5629] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 87.593386][ T5629] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [pid 5629] exit_group(0) = ? [pid 5629] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5629, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce-selinux-root/strace-static-x86_64: Process 5632 attached , child_tidptr=0x55556ed746d0) = 5632 [pid 5632] set_robust_list(0x55556ed746e0, 24) = 0 [pid 5628] rt_sigprocmask(SIG_SETMASK, [] [pid 5632] rt_sigprocmask(SIG_SETMASK, [] [pid 5628] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5632] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5632] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5632] setpgid(0, 0) = 0 [pid 5632] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5632] write(3, "1000", 4) = 4 [pid 5632] close(3) = 0 executing program [pid 5632] write(1, "executing program\n", 18) = 18 [pid 5632] openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3 [pid 5632] ioctl(3, USB_RAW_IOCTL_INIT, 0x7ffe696e70f0) = 0 [ 87.818431][ T1222] redrat3 1-1:1.0: Problem fetching firmware ID [ 87.829207][ T1222] redrat3 1-1:1.0: Failed to read timeout from hardware [pid 5632] ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 [pid 5632] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [ 87.883113][ T1222] rc_core: IR keymap rc-hauppauge not found [ 87.889423][ T1222] Registered IR keymap rc-empty [ 87.896668][ T1222] rc rc0: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/rc/rc0 [ 87.908655][ T1222] input: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/rc/rc0/input5 [ 87.923670][ T1222] redrat3 1-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0 [ 87.932503][ T1222] redrat3 1-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0 [ 87.941474][ T1222] redrat3 1-1:1.0: redrat3_enable_detector: detector status: -5, should be 1 [ 87.952780][ T1222] redrat3 1-1:1.0: probe with driver redrat3 failed with error -5 [ 87.965498][ T1222] usb 1-1: USB disconnect, device number 2 [pid 5632] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [pid 5632] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [pid 5632] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [pid 5632] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe696e60e0) = 18 [pid 5632] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [ 88.263087][ T1222] usb 1-1: new high-speed USB device number 3 using dummy_hcd [pid 5632] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [pid 5632] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [pid 5632] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe696e60e0) = 18 [pid 5632] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [pid 5632] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe696e60e0) = 9 [pid 5632] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [pid 5632] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe696e60e0) = 39 [pid 5632] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [pid 5632] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe696e60e0) = 4 [pid 5632] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [pid 5632] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe696e60e0) = 8 [pid 5632] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [pid 5632] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe696e60e0) = 8 [pid 5632] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [pid 5632] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe696e60e0) = 8 [ 88.436610][ T1222] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 88.446542][ T1222] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 88.456411][ T1222] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [pid 5632] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [pid 5632] ioctl(3, USB_RAW_IOCTL_VBUS_DRAW, 0xfa) = 0 [pid 5632] ioctl(3, USB_RAW_IOCTL_CONFIGURE, 0) = 0 [ 88.509016][ T1222] usb 1-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice= 1.00 [ 88.518213][ T1222] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 88.526237][ T1222] usb 1-1: Product: syz [ 88.530382][ T1222] usb 1-1: Manufacturer: syz [ 88.534980][ T1222] usb 1-1: SerialNumber: syz [pid 5632] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7fa8a6aa3b4c) = -1 EINVAL (Invalid argument) [pid 5632] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7fa8a6aa3b5c) = -1 EINVAL (Invalid argument) [pid 5632] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7fa8a6aa3b6c) = -1 EINVAL (Invalid argument) [pid 5632] ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffe696e60e0) = 0 [ 88.571072][ T5632] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 88.578780][ T5632] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 88.591847][ T5632] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [pid 5632] exit_group(0) = ? [pid 5632] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5632, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce-selinux-root/strace-static-x86_64: Process 5636 attached , child_tidptr=0x55556ed746d0) = 5636 [pid 5636] set_robust_list(0x55556ed746e0, 24) = 0 [pid 5636] rt_sigprocmask(SIG_SETMASK, [] [pid 5628] rt_sigprocmask(SIG_SETMASK, [] [pid 5636] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5628] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5636] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5636] setpgid(0, 0) = 0 [pid 5636] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5636] write(3, "1000", 4) = 4 [pid 5636] close(3) = 0 [pid 5636] write(1, "executing program\n", 18) = 18 executing program [pid 5636] openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3 [pid 5636] ioctl(3, USB_RAW_IOCTL_INIT, 0x7ffe696e70f0) = 0 [pid 5636] ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 [pid 5636] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe696e70f0) = 0 [ 88.803807][ T1222] redrat3 1-1:1.0: Problem fetching firmware ID [ 88.814305][ T1222] redrat3 1-1:1.0: Failed to read timeout from hardware [ 88.875039][ T1222] rc_core: IR keymap rc-hauppauge not found [ 88.880971][ T1222] Registered IR keymap rc-empty [ 88.887949][ T1222] rc rc1: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/rc/rc1 [ 88.899820][ T1222] input: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/rc/rc1/input6 [ 88.914750][ T1222] redrat3 1-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0 [ 88.923642][ T1222] redrat3 1-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0 [ 88.932218][ T1222] redrat3 1-1:1.0: redrat3_enable_detector: detector status: -5, should be 1 [ 88.942867][ T1222] redrat3 1-1:1.0: probe with driver redrat3 failed with error -5 [ 88.953651][ T1222] usb 1-1: USB disconnect, device number 3 [ 88.960355][ T4977] ================================================================== [ 88.968423][ T4977] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 88.975360][ T4977] Read of size 1 at addr ffff88807aced758 by task udevd/4977 [ 88.982696][ T4977] [ 88.985003][ T4977] CPU: 1 UID: 0 PID: 4977 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) [ 88.985017][ T4977] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 88.985023][ T4977] Call Trace: [ 88.985027][ T4977] [ 88.985031][ T4977] dump_stack_lvl+0x100/0x190 [ 88.985045][ T4977] print_report+0x13d/0x4b0 [ 88.985061][ T4977] ? __virt_addr_valid+0x239/0x430 [ 88.985076][ T4977] ? string+0x471/0x4d0 [ 88.985086][ T4977] kasan_report+0xdf/0x1c0 [ 88.985100][ T4977] ? string+0x471/0x4d0 [ 88.985111][ T4977] string+0x471/0x4d0 [ 88.985121][ T4977] ? __pfx_string+0x10/0x10 [ 88.985133][ T4977] vsnprintf+0x422/0x1300 [ 88.985146][ T4977] ? __pfx_vsnprintf+0x10/0x10 [ 88.985158][ T4977] ? ksys_read+0x12a/0x250 [ 88.985173][ T4977] ? do_syscall_64+0x115/0x870 [ 88.985185][ T4977] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.985197][ T4977] add_uevent_var+0x183/0x3a0 [ 88.985207][ T4977] ? __pfx_add_uevent_var+0x10/0x10 [ 88.985218][ T4977] ? rc_dev_uevent+0x12d/0x1c0 [ 88.985235][ T4977] ? __pfx_rc_dev_uevent+0x10/0x10 [ 88.985250][ T4977] rc_dev_uevent+0x17d/0x1c0 [ 88.985270][ T4977] dev_uevent+0x2f1/0x870 [ 88.985292][ T4977] ? __pfx_dev_uevent+0x10/0x10 [ 88.985307][ T4977] ? kasan_save_track+0x14/0x30 [ 88.985319][ T4977] ? __kasan_kmalloc+0xaa/0xb0 [ 88.985330][ T4977] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 88.985347][ T4977] ? uevent_show+0x166/0x3a0 [ 88.985359][ T4977] ? __pfx_uevent_show+0x10/0x10 [ 88.985370][ T4977] uevent_show+0x1ca/0x3a0 [ 88.985382][ T4977] ? __pfx_uevent_show+0x10/0x10 [ 88.985393][ T4977] dev_attr_show+0x52/0xa0 [ 88.985409][ T4977] ? __pfx_dev_attr_show+0x10/0x10 [ 88.985424][ T4977] sysfs_kf_seq_show+0x217/0x3f0 [ 88.985441][ T4977] seq_read_iter+0x32f/0x1270 [ 88.985452][ T4977] ? cp_new_stat+0x484/0x5c0 [ 88.985465][ T4977] kernfs_fop_read_iter+0x46c/0x610 [ 88.985479][ T4977] ? rw_verify_area+0xce/0x6d0 [ 88.985493][ T4977] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 88.985508][ T4977] vfs_read+0x82e/0xb40 [ 88.985523][ T4977] ? __pfx_vfs_read+0x10/0x10 [ 88.985539][ T4977] ? __pfx___do_sys_newfstat+0x10/0x10 [ 88.985554][ T4977] ksys_read+0x12a/0x250 [ 88.985569][ T4977] ? __pfx_ksys_read+0x10/0x10 [ 88.985586][ T4977] do_syscall_64+0x115/0x870 [ 88.985598][ T4977] ? clear_bhb_loop+0x40/0x90 [ 88.985610][ T4977] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.985620][ T4977] RIP: 0033:0x7f168bca7407 [ 88.985629][ T4977] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 88.985639][ T4977] RSP: 002b:00007ffda5a592a0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 88.985650][ T4977] RAX: ffffffffffffffda RBX: 00007f168c37c880 RCX: 00007f168bca7407 [ 88.985657][ T4977] RDX: 0000000000001000 RSI: 0000557455235f80 RDI: 000000000000000c [ 88.985663][ T4977] RBP: 00007f168bdefff0 R08: 0000000000000000 R09: 0000000000000000 [ 88.985669][ T4977] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 88.985675][ T4977] R13: 00007f168bdefea0 R14: 0000000000000000 R15: 0000557455215a60 [ 88.985684][ T4977] [ 88.985687][ T4977] [ 89.291566][ T4977] Allocated by task 1222: [ 89.295868][ T4977] kasan_save_stack+0x30/0x50 [ 89.300520][ T4977] kasan_save_track+0x14/0x30 [ 89.305165][ T4977] __kasan_kmalloc+0xaa/0xb0 [ 89.309735][ T4977] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 89.315083][ T4977] redrat3_dev_probe+0x326/0x2b50 [ 89.320083][ T4977] usb_probe_interface+0x303/0x8f0 [ 89.325166][ T4977] really_probe+0x241/0xa60 [ 89.329642][ T4977] __driver_probe_device+0x20e/0x450 [ 89.334897][ T4977] driver_probe_device+0x4a/0x140 [ 89.339902][ T4977] __device_attach_driver+0x1df/0x320 [ 89.345244][ T4977] bus_for_each_drv+0x159/0x1e0 [ 89.350070][ T4977] __device_attach+0x1e4/0x4d0 [ 89.354812][ T4977] device_initial_probe+0xaf/0xd0 [ 89.359821][ T4977] bus_probe_device+0x64/0x160 [ 89.364563][ T4977] device_add+0x121d/0x1970 [ 89.369039][ T4977] usb_set_configuration+0xd97/0x1c60 [ 89.374381][ T4977] usb_generic_driver_probe+0xa1/0xe0 [ 89.379733][ T4977] usb_probe_device+0xef/0x400 [ 89.384477][ T4977] really_probe+0x241/0xa60 [ 89.388952][ T4977] __driver_probe_device+0x20e/0x450 [ 89.394207][ T4977] driver_probe_device+0x4a/0x140 [ 89.399202][ T4977] __device_attach_driver+0x1df/0x320 [ 89.404545][ T4977] bus_for_each_drv+0x159/0x1e0 [ 89.409364][ T4977] __device_attach+0x1e4/0x4d0 [ 89.414098][ T4977] device_initial_probe+0xaf/0xd0 [ 89.419105][ T4977] bus_probe_device+0x64/0x160 [ 89.423838][ T4977] device_add+0x121d/0x1970 [ 89.428315][ T4977] usb_new_device.cold+0x685/0x115c [ 89.433496][ T4977] hub_event+0x30a3/0x4a60 [ 89.437891][ T4977] process_one_work+0xa23/0x1940 [ 89.442798][ T4977] worker_thread+0x5ef/0xe50 [ 89.447357][ T4977] kthread+0x370/0x450 [ 89.451400][ T4977] ret_from_fork+0x72b/0xd50 [ 89.455962][ T4977] ret_from_fork_asm+0x1a/0x30 [ 89.460705][ T4977] [ 89.462997][ T4977] Freed by task 1222: [ 89.466952][ T4977] kasan_save_stack+0x30/0x50 [ 89.471602][ T4977] kasan_save_track+0x14/0x30 [ 89.476263][ T4977] kasan_save_free_info+0x3b/0x70 [ 89.481262][ T4977] __kasan_slab_free+0x5f/0x80 [ 89.485996][ T4977] kfree+0x22b/0x6c0 [ 89.489865][ T4977] redrat3_dev_probe+0x107a/0x2b50 [ 89.494949][ T4977] usb_probe_interface+0x303/0x8f0 [ 89.500032][ T4977] really_probe+0x241/0xa60 [ 89.504506][ T4977] __driver_probe_device+0x20e/0x450 [ 89.509761][ T4977] driver_probe_device+0x4a/0x140 [ 89.514777][ T4977] __device_attach_driver+0x1df/0x320 [ 89.520145][ T4977] bus_for_each_drv+0x159/0x1e0 [ 89.524979][ T4977] __device_attach+0x1e4/0x4d0 [ 89.529719][ T4977] device_initial_probe+0xaf/0xd0 [ 89.534716][ T4977] bus_probe_device+0x64/0x160 [ 89.539448][ T4977] device_add+0x121d/0x1970 [ 89.543923][ T4977] usb_set_configuration+0xd97/0x1c60 [ 89.549273][ T4977] usb_generic_driver_probe+0xa1/0xe0 [ 89.554613][ T4977] usb_probe_device+0xef/0x400 [ 89.559353][ T4977] really_probe+0x241/0xa60 [ 89.563826][ T4977] __driver_probe_device+0x20e/0x450 [ 89.569096][ T4977] driver_probe_device+0x4a/0x140 [ 89.574100][ T4977] __device_attach_driver+0x1df/0x320 [ 89.579442][ T4977] bus_for_each_drv+0x159/0x1e0 [ 89.584267][ T4977] __device_attach+0x1e4/0x4d0 [ 89.589001][ T4977] device_initial_probe+0xaf/0xd0 [ 89.593996][ T4977] bus_probe_device+0x64/0x160 [ 89.598737][ T4977] device_add+0x121d/0x1970 [ 89.603219][ T4977] usb_new_device.cold+0x685/0x115c [ 89.608398][ T4977] hub_event+0x30a3/0x4a60 [ 89.612790][ T4977] process_one_work+0xa23/0x1940 [ 89.617697][ T4977] worker_thread+0x5ef/0xe50 [ 89.622265][ T4977] kthread+0x370/0x450 [ 89.626310][ T4977] ret_from_fork+0x72b/0xd50 [ 89.630879][ T4977] ret_from_fork_asm+0x1a/0x30 [ 89.635616][ T4977] [ 89.637917][ T4977] The buggy address belongs to the object at ffff88807aced000 [ 89.637917][ T4977] which belongs to the cache kmalloc-2k of size 2048 [ 89.651942][ T4977] The buggy address is located 1880 bytes inside of [ 89.651942][ T4977] freed 2048-byte region [ffff88807aced000, ffff88807aced800) [ 89.665879][ T4977] [ 89.668175][ T4977] The buggy address belongs to the physical page: [ 89.674551][ T4977] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7ace8 [ 89.683277][ T4977] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 89.691744][ T4977] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 89.699264][ T4977] page_type: f5(slab) [ 89.703219][ T4977] raw: 00fff00000000040 ffff88813fe28000 dead000000000100 dead000000000122 [ 89.711772][ T4977] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 89.720324][ T4977] head: 00fff00000000040 ffff88813fe28000 dead000000000100 dead000000000122 [ 89.729052][ T4977] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 89.737696][ T4977] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 89.746338][ T4977] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 89.754973][ T4977] page dumped because: kasan: bad access detected [ 89.761352][ T4977] page_owner tracks the page as allocated [ 89.767039][ T4977] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4966, tgid 4966 (klogd), ts 87973202656, free_ts 87882599427 [ 89.787757][ T4977] post_alloc_hook+0xfd/0x120 [ 89.792416][ T4977] get_page_from_freelist+0xf48/0x3530 [ 89.797845][ T4977] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 89.803706][ T4977] new_slab+0xa2/0x640 [ 89.807743][ T4977] refill_objects+0xe3/0x410 [ 89.812308][ T4977] __pcs_replace_empty_main+0x376/0x680 [ 89.817837][ T4977] __kmalloc_cache_noprof+0x479/0x6c0 [ 89.823196][ T4977] syslog_print+0xf8/0x620 [ 89.827616][ T4977] do_syslog+0x5bd/0x6d0 [ 89.831844][ T4977] __x64_sys_syslog+0x74/0xb0 [ 89.836510][ T4977] do_syscall_64+0x115/0x870 [ 89.841072][ T4977] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.846943][ T4977] page last free pid 4977 tgid 4977 stack trace: [ 89.853245][ T4977] __free_frozen_pages+0x79f/0x1090 [ 89.858417][ T4977] qlist_free_all+0x47/0xf0 [ 89.862890][ T4977] kasan_quarantine_reduce+0x1a0/0x1f0 [ 89.868317][ T4977] __kasan_slab_alloc+0x69/0x90 [ 89.873141][ T4977] kmem_cache_alloc_noprof+0x26b/0x6a0 [ 89.878575][ T4977] do_getname+0x35/0x390 [ 89.882795][ T4977] do_sys_openat2+0xc7/0x1e0 [ 89.887355][ T4977] __x64_sys_openat+0x12d/0x210 [ 89.892184][ T4977] do_syscall_64+0x115/0x870 [ 89.896744][ T4977] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.902615][ T4977] [ 89.904916][ T4977] Memory state around the buggy address: [ 89.910513][ T4977] ffff88807aced600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 89.918547][ T4977] ffff88807aced680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 89.926577][ T4977] >ffff88807aced700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 89.934603][ T4977] ^ [ 89.941509][ T4977] ffff88807aced780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 89.949545][ T4977] ffff88807aced800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 89.957580][ T4977] ================================================================== [ 89.966078][ T4977] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 89.973288][ T4977] CPU: 1 UID: 0 PID: 4977 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) [ 89.982114][ T4977] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 89.992146][ T4977] Call Trace: [ 89.995403][ T4977] [ 89.998312][ T4977] dump_stack_lvl+0x100/0x190 [ 90.002981][ T4977] vpanic+0x552/0x970 [ 90.006944][ T4977] ? __pfx_vpanic+0x10/0x10 [ 90.011426][ T4977] ? mark_held_locks+0x40/0x70 [ 90.016182][ T4977] ? string+0x471/0x4d0 [ 90.020317][ T4977] panic+0xd1/0xe0 [ 90.024014][ T4977] ? __pfx_panic+0x10/0x10 [ 90.028408][ T4977] ? string+0x471/0x4d0 [ 90.032539][ T4977] ? preempt_schedule_common+0x42/0xc0 [ 90.037986][ T4977] ? check_panic_on_warn+0x1f/0x90 [ 90.043075][ T4977] check_panic_on_warn.cold+0x19/0x34 [ 90.048426][ T4977] end_report.part.0+0x3a/0x90 [ 90.053175][ T4977] kasan_report.cold+0xe/0x18 [ 90.057835][ T4977] ? string+0x471/0x4d0 [ 90.061969][ T4977] string+0x471/0x4d0 [ 90.065929][ T4977] ? __pfx_string+0x10/0x10 [ 90.070414][ T4977] vsnprintf+0x422/0x1300 [ 90.074728][ T4977] ? __pfx_vsnprintf+0x10/0x10 [ 90.079470][ T4977] ? ksys_read+0x12a/0x250 [ 90.083872][ T4977] ? do_syscall_64+0x115/0x870 [ 90.088618][ T4977] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.094664][ T4977] add_uevent_var+0x183/0x3a0 [ 90.099327][ T4977] ? __pfx_add_uevent_var+0x10/0x10 [ 90.104517][ T4977] ? rc_dev_uevent+0x12d/0x1c0 [ 90.109278][ T4977] ? __pfx_rc_dev_uevent+0x10/0x10 [ 90.114373][ T4977] rc_dev_uevent+0x17d/0x1c0 [ 90.118959][ T4977] dev_uevent+0x2f1/0x870 [ 90.123275][ T4977] ? __pfx_dev_uevent+0x10/0x10 [ 90.128108][ T4977] ? kasan_save_track+0x14/0x30 [ 90.132946][ T4977] ? __kasan_kmalloc+0xaa/0xb0 [ 90.137691][ T4977] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 90.143228][ T4977] ? uevent_show+0x166/0x3a0 [ 90.147808][ T4977] ? __pfx_uevent_show+0x10/0x10 [ 90.152732][ T4977] uevent_show+0x1ca/0x3a0 [ 90.157139][ T4977] ? __pfx_uevent_show+0x10/0x10 [ 90.162062][ T4977] dev_attr_show+0x52/0xa0 [ 90.166475][ T4977] ? __pfx_dev_attr_show+0x10/0x10 [ 90.171569][ T4977] sysfs_kf_seq_show+0x217/0x3f0 [ 90.176494][ T4977] seq_read_iter+0x32f/0x1270 [ 90.181159][ T4977] ? cp_new_stat+0x484/0x5c0 [ 90.185733][ T4977] kernfs_fop_read_iter+0x46c/0x610 [ 90.190914][ T4977] ? rw_verify_area+0xce/0x6d0 [ 90.195659][ T4977] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 90.201370][ T4977] vfs_read+0x82e/0xb40 [ 90.205522][ T4977] ? __pfx_vfs_read+0x10/0x10 [ 90.210195][ T4977] ? __pfx___do_sys_newfstat+0x10/0x10 [ 90.215660][ T4977] ksys_read+0x12a/0x250 [ 90.219921][ T4977] ? __pfx_ksys_read+0x10/0x10 [ 90.224681][ T4977] do_syscall_64+0x115/0x870 [ 90.229255][ T4977] ? clear_bhb_loop+0x40/0x90 [ 90.233915][ T4977] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.239787][ T4977] RIP: 0033:0x7f168bca7407 [ 90.244180][ T4977] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 90.263771][ T4977] RSP: 002b:00007ffda5a592a0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 90.272159][ T4977] RAX: ffffffffffffffda RBX: 00007f168c37c880 RCX: 00007f168bca7407 [ 90.280107][ T4977] RDX: 0000000000001000 RSI: 0000557455235f80 RDI: 000000000000000c [ 90.288055][ T4977] RBP: 00007f168bdefff0 R08: 0000000000000000 R09: 0000000000000000 [ 90.296002][ T4977] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 90.303950][ T4977] R13: 00007f168bdefea0 R14: 0000000000000000 R15: 0000557455215a60 [ 90.311913][ T4977] [ 90.315114][ T4977] Kernel Offset: disabled [ 90.319419][ T4977] Rebooting in 86400 seconds..