program:
syz_open_dev$evdev(&(0x7f00000000c0), 0x2000000003, 0x903d41)
syz_usb_connect(0x3, 0x63, &(0x7f0000000740)={{0x12, 0x1, 0x310, 0x78, 0xe8, 0x72, 0x20, 0x1f71, 0x3306, 0x2ac0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x51, 0x2, 0x3, 0x1, 0x80, 0x5, "", [{{0x9, 0x4, 0xdf, 0x0, 0x0, 0x46, 0x35, 0x34, 0xf}}, {{0x9, 0x4, 0x19, 0x6, 0x5, 0xfb, 0xdc, 0x42, 0x0, [], [{{0x9, 0x5, 0x80, 0x10, 0x200, 0x6, 0x6, 0x4, [@generic={0x9, 0x4, "df9b52d017dc73"}]}}, {{0x9, 0x5, 0xd, 0x0, 0x200, 0xaf, 0x2, 0x83}}, {{0x9, 0x5, 0x8b, 0x0, 0x20, 0x1, 0x8, 0x8}}, {{0x9, 0x5, 0x8, 0x0, 0x200, 0x8, 0x1b, 0x6}}, {{0x9, 0x5, 0xe, 0x1, 0x200, 0x3, 0x9, 0x40}}]}}]}}]}}, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0})
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="1201410130f56920ac05190272f00102030109021b00010000100009045507010349020009058203"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000340)=ANY=[@ANYBLOB='\x00N\b'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x40, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x0)
r1 = syz_usb_connect(0x2, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="03010000ac0fce405d0500904431000000010902120001000080040904"], 0x0)
syz_usb_disconnect(r1)
r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000cc0)=ANY=[], 0x0)
syz_usb_control_io$cdc_ecm(r2, &(0x7f0000000440)={0x14, &(0x7f0000000380)={0x0, 0x30, 0x2, {0x2, 0x7}}, &(0x7f0000000400)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000680)={0x1c, &(0x7f0000000480)={0x0, 0x1, 0xa3, "af63d59b864db2ae6716d5f9099892104325f3df6f0cb95267a65a44343f2d66af5bfad8556c29e3c3e9c83e4e90ff5c91a53fc240e842a4401df8967f65464913181287ad1950afa4eee53a7bc619d3011c55a8ed279dafb7d5e632736b620988e58aec4cad6cdddd0b0fd09f23ce7962e49769ec768e2d0091a1563c6534e38c0817998cafb23d40ad4f1af0af95bd2a2b6a304e913a24a93761931a7974d59d71c7"}, &(0x7f0000000540)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0x3}})
syz_usb_control_io(r2, 0x0, 0x0)
syz_usb_control_io(r2, 0x0, 0x0)
syz_usb_control_io$uac1(r2, 0x0, &(0x7f0000001480)={0x44, &(0x7f0000001180)=ANY=[@ANYBLOB="000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r2, 0x0, 0x0)
syz_usb_control_io$uac1(r2, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0)
r3 = syz_open_dev$evdev(&(0x7f0000000040), 0x8000000000000000, 0x400000)
ioctl$EVIOCGPHYS(r3, 0x80404507, &(0x7f0000000240)=""/236)
syz_usb_control_io$printer(r2, 0x0, 0x0)
syz_usb_control_io$uac1(r2, 0x0, 0x0)
syz_usb_control_io$printer(r2, 0x0, 0x0)
syz_usb_control_io$uac1(r2, 0x0, 0x0)
syz_usb_control_io$printer(r2, 0x0, &(0x7f0000001540)={0x34, &(0x7f0000001300)=ANY=[@ANYBLOB="0007ebffffff"], 0x0, 0x0, 0x0, 0x0, 0x0})
[ 131.632149][ T5283] Bluetooth: hci0: command tx timeout
[ 131.946116][ T10] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 132.096120][ T10] usb 5-1: Using ep0 maxpacket: 32
[ 132.098855][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short
[ 132.098895][ T10] usb 5-1: New USB device found, idVendor=1f71, idProduct=3306, bcdDevice=2a.c0
[ 132.101230][ T10] usb 5-1: config 3 has an invalid interface number: 223 but max is 1
[ 132.101248][ T10] usb 5-1: config 3 has an invalid interface number: 25 but max is 1
[ 132.101258][ T10] usb 5-1: config 3 has an invalid interface number: 223 but max is 1
[ 132.101268][ T10] usb 5-1: config 3 has no interface number 0
[ 132.101276][ T10] usb 5-1: config 3 has no interface number 1
[ 132.101305][ T10] usb 5-1: config 3 interface 25 altsetting 6 has an invalid descriptor for endpoint zero, skipping
[ 132.101316][ T10] usb 5-1: config 3 interface 25 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 5
[ 132.101329][ T10] usb 5-1: too many endpoints for config 3 interface 223 altsetting 155: 82, using maximum allowed: 30
[ 132.101353][ T10] usb 5-1: config 3 interface 223 altsetting 155 endpoint 0xD has invalid maxpacket 512, setting to 64
[ 132.101368][ T10] usb 5-1: config 3 interface 223 altsetting 155 endpoint 0x8 has invalid maxpacket 512, setting to 64
[ 132.101381][ T10] usb 5-1: config 3 interface 223 altsetting 155 has 4 endpoint descriptors, different from the interface descriptor's value: 82
[ 132.101395][ T10] usb 5-1: config 3 interface 223 has no altsetting 1
[ 132.101405][ T10] usb 5-1: config 3 interface 25 has no altsetting 0
[ 132.103687][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 132.103702][ T10] usb 5-1: Product: syz
[ 132.103710][ T10] usb 5-1: Manufacturer: syz
[ 132.103718][ T10] usb 5-1: SerialNumber: syz
[ 132.425793][ T5322] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 132.432815][ T5322] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 132.442095][ T5322] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 132.443936][ T5322] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 132.647920][ T5322] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 132.650560][ T5322] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 132.747524][ T10] usbtv 5-1:3.223: Fushicai USBTV007 Audio-Video Grabber
[ 132.783403][ T10] usb 5-1: USB disconnect, device number 2
[ 133.035102][ T10]
[ 133.036210][ T10] =========================
[ 133.038156][ T10] WARNING: held lock freed!
[ 133.040108][ T10] syzkaller #0 Not tainted
[ 133.042071][ T10] -------------------------
[ 133.043968][ T10] kworker/0:1/10 is freeing memory ffff8880007f3000-ffff8880007f37ff, with a lock still held there!
[ 133.048355][ T10] ffff8880007f31a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880
[ 133.052798][ T10] locks held by kworker/0:1/10: 5, last CPU#0:
[ 133.055574][ T10] #0: ffff88801fb70d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[ 133.060449][ T10] #1: ffffc9000023fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[ 133.065513][ T10] #2: ffff88801f9f81d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30
[ 133.069671][ T10] #3: ffff888012d781d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xfc/0x9a0
[ 133.073822][ T10] #4: ffff8880007f31a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880
[ 133.078528][ T10]
[ 133.078528][ T10] stack backtrace:
[ 133.081183][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full)
[ 133.085270][ T10] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 133.089633][ T10] Workqueue: usb_hub_wq hub_event
[ 133.091803][ T10] Call Trace:
[ 133.093293][ T10]
[ 133.094629][ T10] dump_stack_lvl+0xe8/0x150
[ 133.096648][ T10] debug_check_no_locks_freed+0x149/0x170
[ 133.098671][ T10] kfree+0x12b/0x650
[ 133.099995][ T10] ? device_release+0xc4/0x1f0
[ 133.101765][ T10] ? __pfx_usb_release_interface+0x10/0x10
[ 133.103705][ T10] device_release+0xc4/0x1f0
[ 133.105348][ T10] kobject_put+0x222/0x550
[ 133.106841][ T10] v4l2_device_disconnect+0x79/0xd0
[ 133.108576][ T10] usbtv_video_free+0x25/0x30
[ 133.110184][ T10] usbtv_disconnect+0x5c/0xa0
[ 133.111854][ T10] usb_unbind_interface+0x295/0x9f0
[ 133.113638][ T10] ? kernfs_remove_by_name_ns+0x101/0x140
[ 133.116115][ T10] ? kernfs_remove_by_name_ns+0x101/0x140
[ 133.118502][ T10] ? __pfx_usb_unbind_interface+0x10/0x10
[ 133.120698][ T10] device_release_driver_internal+0x4f5/0x880
[ 133.123048][ T10] bus_remove_device+0x444/0x560
[ 133.125023][ T10] ? __pfx_bus_remove_device+0x10/0x10
[ 133.127124][ T10] ? kernfs_remove_by_name_ns+0x101/0x140
[ 133.129295][ T10] device_del+0x524/0x8f0
[ 133.130978][ T10] ? __pfx_device_del+0x10/0x10
[ 133.132872][ T10] ? __pfx___mutex_lock+0x10/0x10
[ 133.134710][ T10] usb_disable_device+0x3d4/0x8d0
[ 133.136421][ T10] usb_disconnect+0x346/0x9a0
[ 133.138036][ T10] hub_event+0x1bbb/0x4d30
[ 133.139580][ T10] ? register_lock_class+0x31/0x2e0
[ 133.141437][ T10] ? __pfx_hub_event+0x10/0x10
[ 133.143125][ T10] ? rcu_is_watching+0x16/0xb0
[ 133.144850][ T10] ? process_scheduled_works+0x97a/0x1630
[ 133.146779][ T10] process_scheduled_works+0xc3d/0x1630
[ 133.148669][ T10] ? __pfx_process_scheduled_works+0x10/0x10
[ 133.151132][ T10] ? assign_work+0x3cf/0x5d0
[ 133.153182][ T10] worker_thread+0xa47/0xfb0
[ 133.155339][ T10] kthread+0x38b/0x480
[ 133.157216][ T10] ? __pfx_worker_thread+0x10/0x10
[ 133.159635][ T10] ? __pfx_kthread+0x10/0x10
[ 133.161875][ T10] ret_from_fork+0x514/0xb70
[ 133.164171][ T10] ? __pfx_ret_from_fork+0x10/0x10
[ 133.166633][ T10] ? __switch_to+0xc89/0x1420
[ 133.168895][ T10] ? __pfx_kthread+0x10/0x10
[ 133.171055][ T10] ret_from_fork_asm+0x1a/0x30
[ 133.173418][ T10]
[ 133.195426][ T10] ==================================================================
[ 133.195440][ T10] BUG: KASAN: slab-use-after-free in usb_unbind_interface+0x2c2/0x9f0
[ 133.195459][ T10] Read of size 8 at addr ffff8880007f3008 by task kworker/0:1/10
[ 133.195481][ T10]
[ 133.195488][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full)
[ 133.195501][ T10] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 133.195508][ T10] Workqueue: usb_hub_wq hub_event
[ 133.195523][ T10] Call Trace:
[ 133.195528][ T10]
[ 133.195534][ T10] dump_stack_lvl+0xe8/0x150
[ 133.195550][ T10] print_address_description+0x55/0x1e0
[ 133.195565][ T10] ? usb_unbind_interface+0x2c2/0x9f0
[ 133.195576][ T10] print_report+0x58/0x70
[ 133.195588][ T10] kasan_report+0x117/0x150
[ 133.195600][ T10] ? usb_unbind_interface+0x2c2/0x9f0
[ 133.195614][ T10] usb_unbind_interface+0x2c2/0x9f0
[ 133.195638][ T10] ? kernfs_remove_by_name_ns+0x101/0x140
[ 133.195651][ T10] ? kernfs_remove_by_name_ns+0x101/0x140
[ 133.195662][ T10] ? __pfx_usb_unbind_interface+0x10/0x10
[ 133.195672][ T10] device_release_driver_internal+0x4f5/0x880
[ 133.195715][ T10] bus_remove_device+0x444/0x560
[ 133.195731][ T10] ? __pfx_bus_remove_device+0x10/0x10
[ 133.195745][ T10] ? kernfs_remove_by_name_ns+0x101/0x140
[ 133.195756][ T10] device_del+0x524/0x8f0
[ 133.195767][ T10] ? __pfx_device_del+0x10/0x10
[ 133.195783][ T10] ? __pfx___mutex_lock+0x10/0x10
[ 133.195798][ T10] usb_disable_device+0x3d4/0x8d0
[ 133.195810][ T10] usb_disconnect+0x346/0x9a0
[ 133.195827][ T10] hub_event+0x1bbb/0x4d30
[ 133.195841][ T10] ? register_lock_class+0x31/0x2e0
[ 133.195859][ T10] ? __pfx_hub_event+0x10/0x10
[ 133.195871][ T10] ? rcu_is_watching+0x16/0xb0
[ 133.195883][ T10] ? process_scheduled_works+0x97a/0x1630
[ 133.195898][ T10] process_scheduled_works+0xc3d/0x1630
[ 133.195916][ T10] ? __pfx_process_scheduled_works+0x10/0x10
[ 133.195931][ T10] ? assign_work+0x3cf/0x5d0
[ 133.195944][ T10] worker_thread+0xa47/0xfb0
[ 133.195962][ T10] kthread+0x38b/0x480
[ 133.195973][ T10] ? __pfx_worker_thread+0x10/0x10
[ 133.195986][ T10] ? __pfx_kthread+0x10/0x10
[ 133.195996][ T10] ret_from_fork+0x514/0xb70
[ 133.196008][ T10] ? __pfx_ret_from_fork+0x10/0x10
[ 133.196017][ T10] ? __switch_to+0xc89/0x1420
[ 133.196032][ T10] ? __pfx_kthread+0x10/0x10
[ 133.196042][ T10] ret_from_fork_asm+0x1a/0x30
[ 133.196060][ T10]
[ 133.196065][ T10]
[ 133.196067][ T10] Allocated by task 10:
[ 133.196086][ T10] kasan_save_track+0x3e/0x80
[ 133.196100][ T10] __kasan_kmalloc+0x93/0xb0
[ 133.196108][ T10] __kmalloc_cache_noprof+0x321/0x600
[ 133.196123][ T10] usb_set_configuration+0x3cc/0x2180
[ 133.196132][ T10] usb_generic_driver_probe+0x8d/0x150
[ 133.196142][ T10] usb_probe_device+0x1c3/0x3b0
[ 133.196152][ T10] really_probe+0x254/0xae0
[ 133.196162][ T10] __driver_probe_device+0x1e8/0x360
[ 133.196171][ T10] driver_probe_device+0x4f/0x240
[ 133.196180][ T10] __device_attach_driver+0x270/0x410
[ 133.196190][ T10] bus_for_each_drv+0x258/0x2f0
[ 133.196202][ T10] __device_attach+0x2c4/0x450
[ 133.196210][ T10] device_initial_probe+0xa1/0xd0
[ 133.196218][ T10] bus_probe_device+0x12a/0x220
[ 133.196230][ T10] device_add+0x7d7/0xb80
[ 133.196242][ T10] usb_new_device+0x9aa/0x1690
[ 133.196255][ T10] hub_event+0x28e8/0x4d30
[ 133.196264][ T10] process_scheduled_works+0xc3d/0x1630
[ 133.196276][ T10] worker_thread+0xa47/0xfb0
[ 133.196289][ T10] kthread+0x38b/0x480
[ 133.196297][ T10] ret_from_fork+0x514/0xb70
[ 133.196305][ T10] ret_from_fork_asm+0x1a/0x30
[ 133.196319][ T10]
[ 133.196321][ T10] Freed by task 10:
[ 133.196326][ T10] kasan_save_track+0x3e/0x80
[ 133.196339][ T10] kasan_save_free_info+0x40/0x50
[ 133.196351][ T10] __kasan_slab_free+0x5c/0x80
[ 133.196359][ T10] kfree+0x1c5/0x650
[ 133.196369][ T10] device_release+0xc4/0x1f0
[ 133.196380][ T10] kobject_put+0x222/0x550
[ 133.196392][ T10] v4l2_device_disconnect+0x79/0xd0
[ 133.196404][ T10] usbtv_video_free+0x25/0x30
[ 133.196415][ T10] usbtv_disconnect+0x5c/0xa0
[ 133.196424][ T10] usb_unbind_interface+0x295/0x9f0
[ 133.196434][ T10] device_release_driver_internal+0x4f5/0x880
[ 133.196444][ T10] bus_remove_device+0x444/0x560
[ 133.196455][ T10] device_del+0x524/0x8f0
[ 133.196463][ T10] usb_disable_device+0x3d4/0x8d0
[ 133.196471][ T10] usb_disconnect+0x346/0x9a0
[ 133.196484][ T10] hub_event+0x1bbb/0x4d30
[ 133.196493][ T10] process_scheduled_works+0xc3d/0x1630
[ 133.196505][ T10] worker_thread+0xa47/0xfb0
[ 133.196516][ T10] kthread+0x38b/0x480
[ 133.196525][ T10] ret_from_fork+0x514/0xb70
[ 133.196533][ T10] ret_from_fork_asm+0x1a/0x30
[ 133.196546][ T10]
[ 133.196548][ T10] The buggy address belongs to the object at ffff8880007f3000
[ 133.196548][ T10] which belongs to the cache kmalloc-2k of size 2048
[ 133.196557][ T10] The buggy address is located 8 bytes inside of
[ 133.196557][ T10] freed 2048-byte region [ffff8880007f3000, ffff8880007f3800)
[ 133.196568][ T10]
[ 133.196571][ T10] The buggy address belongs to the physical page:
[ 133.196577][ T10] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7f0
[ 133.196587][ T10] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 133.196596][ T10] flags: 0x7ff00000000040(head|node=0|zone=0|lastcpupid=0x7ff)
[ 133.196606][ T10] page_type: f5(slab)
[ 133.196616][ T10] raw: 007ff00000000040 ffff88801b042000 dead000000000100 dead000000000122
[ 133.196631][ T10] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 133.196640][ T10] head: 007ff00000000040 ffff88801b042000 dead000000000100 dead000000000122
[ 133.196649][ T10] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 133.196658][ T10] head: 007ff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 133.196667][ T10] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 133.196672][ T10] page dumped because: kasan: bad access detected
[ 133.196678][ T10] page_owner tracks the page as allocated
[ 133.196682][ T10] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5282, tgid 5282 (syz-executor), ts 127965732262
[ 133.196700][ T10] post_alloc_hook+0x1f9/0x250
[ 133.196713][ T10] get_page_from_freelist+0x2209/0x2280
[ 133.196727][ T10] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 133.196740][ T10] allocate_slab+0x7d/0x620
[ 133.196751][ T10] refill_objects+0x2d5/0x350
[ 133.196761][ T10] __pcs_replace_empty_main+0x2c8/0x6c0
[ 133.196771][ T10] __kmalloc_cache_noprof+0x39b/0x600
[ 133.196784][ T10] rtnl_newlink+0x143/0x1c30
[ 133.196795][ T10] rtnetlink_rcv_msg+0x802/0xc00
[ 133.196804][ T10] netlink_rcv_skb+0x226/0x4a0
[ 133.196817][ T10] netlink_unicast+0x7bd/0x940
[ 133.196828][ T10] netlink_sendmsg+0x813/0xb40
[ 133.196841][ T10] sock_sendmsg_nosec+0x13a/0x180
[ 133.196855][ T10] __sys_sendto+0x408/0x5a0
[ 133.196865][ T10] __x64_sys_sendto+0xde/0x100
[ 133.196874][ T10] do_syscall_64+0x166/0x520
[ 133.196886][ T10] page last free pid 822 tgid 822 ts 11238234562 stack trace:
[ 133.196893][ T10] __free_frozen_pages+0xc93/0xd90
[ 133.196905][ T10] __slab_free+0x274/0x2c0
[ 133.196919][ T10] qlist_free_all+0x99/0x100
[ 133.196931][ T10] kasan_quarantine_reduce+0x148/0x160
[ 133.196945][ T10] __kasan_slab_alloc+0x22/0x80
[ 133.196953][ T10] kmem_cache_alloc_noprof+0x2b9/0x600
[ 133.196966][ T10] prepare_kernel_cred+0x31/0x650
[ 133.196977][ T10] call_usermodehelper_exec_async+0xcf/0x360
[ 133.196989][ T10] ret_from_fork+0x514/0xb70
[ 133.196998][ T10] ret_from_fork_asm+0x1a/0x30
[ 133.197011][ T10]
[ 133.197014][ T10] Memory state around the buggy address:
[ 133.197019][ T10] ffff8880007f2f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 133.197027][ T10] ffff8880007f2f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 133.197033][ T10] >ffff8880007f3000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 133.197038][ T10] ^
[ 133.197044][ T10] ffff8880007f3080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 133.197050][ T10] ffff8880007f3100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 133.197055][ T10] ==================================================================