Warning: Permanently added '10.128.0.201' (ED25519) to the list of known hosts.
2026/10/10 12:11:55 parsed 1 programs
2026/10/10 12:11:55 serving rpc on tcp://44357
[ 71.296716][ T5625] cgroup: Unknown subsys name 'net'
[ 71.414125][ T5625] cgroup: Unknown subsys name 'cpuset'
[ 71.416995][ T5625] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 72.743259][ T5625] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 75.509925][ T5632] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 75.516656][ T5632] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 75.542001][ T5632] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 75.543252][ T5632] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 75.549360][ T5632] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 77.337142][ T5672] bridge0: port 1(bridge_slave_0) entered blocking state
[ 77.337826][ T5672] bridge0: port 1(bridge_slave_0) entered disabled state
[ 77.337921][ T5672] bridge_slave_0: entered allmulticast mode
[ 77.338945][ T5672] bridge_slave_0: entered promiscuous mode
[ 77.342868][ T5672] bridge0: port 2(bridge_slave_1) entered blocking state
[ 77.343006][ T5672] bridge0: port 2(bridge_slave_1) entered disabled state
[ 77.343125][ T5672] bridge_slave_1: entered allmulticast mode
[ 77.344818][ T5672] bridge_slave_1: entered promiscuous mode
[ 77.400374][ T5672] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 77.403944][ T5672] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 77.428356][ T5672] team0: Port device team_slave_0 added
[ 77.430063][ T5672] team0: Port device team_slave_1 added
[ 77.452023][ T5672] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 77.452035][ T5672] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 77.452054][ T5672] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 77.453690][ T5672] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 77.453702][ T5672] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 77.453726][ T5672] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 77.498493][ T5672] hsr_slave_0: entered promiscuous mode
[ 77.499687][ T5672] hsr_slave_1: entered promiscuous mode
[ 77.655258][ T5672] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 77.670910][ T5672] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 77.671687][ T5672] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 77.675191][ T5672] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 77.676226][ T5672] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 77.679247][ T5672] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 77.681853][ T5672] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 77.694585][ T5672] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 77.730302][ T5672] bridge0: port 2(bridge_slave_1) entered blocking state
[ 77.730434][ T5672] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 77.731282][ T5672] bridge0: port 1(bridge_slave_0) entered blocking state
[ 77.731406][ T5672] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 77.794758][ T5672] 8021q: adding VLAN 0 to HW filter on device bond0
[ 77.808656][ T50] bridge0: port 1(bridge_slave_0) entered disabled state
[ 77.809335][ T50] bridge0: port 2(bridge_slave_1) entered disabled state
[ 77.832162][ T5672] 8021q: adding VLAN 0 to HW filter on device team0
[ 77.837941][ T13] bridge0: port 1(bridge_slave_0) entered blocking state
[ 77.838034][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 77.852938][ T61] bridge0: port 2(bridge_slave_1) entered blocking state
[ 77.853035][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 78.145673][ T5672] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 78.189028][ T5672] veth0_vlan: entered promiscuous mode
[ 78.196622][ T5672] veth1_vlan: entered promiscuous mode
[ 78.225779][ T5672] veth0_macvtap: entered promiscuous mode
[ 78.229426][ T5672] veth1_macvtap: entered promiscuous mode
[ 78.253964][ T5672] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 78.262491][ T5672] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 78.293954][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 78.294640][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 78.324373][ T50] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 78.326850][ T61] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 78.437928][ T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 78.548102][ T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 78.642968][ T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 78.709385][ T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 79.138634][ T61] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 79.138659][ T61] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 79.183897][ T50] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 79.183917][ T50] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 79.311918][ T4933] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 79.314660][ T4933] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 79.315329][ T4933] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 79.316403][ T4933] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 79.317097][ T4933] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
2026/10/10 12:12:06 executed programs: 0
[ 80.203631][ T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 80.206255][ T52] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 80.207053][ T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 80.207950][ T52] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 80.208498][ T52] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 80.604984][ T5753] bridge0: port 1(bridge_slave_0) entered blocking state
[ 80.605096][ T5753] bridge0: port 1(bridge_slave_0) entered disabled state
[ 80.605205][ T5753] bridge_slave_0: entered allmulticast mode
[ 80.606132][ T5753] bridge_slave_0: entered promiscuous mode
[ 80.609480][ T5753] bridge0: port 2(bridge_slave_1) entered blocking state
[ 80.609631][ T5753] bridge0: port 2(bridge_slave_1) entered disabled state
[ 80.609746][ T5753] bridge_slave_1: entered allmulticast mode
[ 80.611624][ T5753] bridge_slave_1: entered promiscuous mode
[ 80.651043][ T5753] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 80.656548][ T5753] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 80.686544][ T5753] team0: Port device team_slave_0 added
[ 80.688292][ T5753] team0: Port device team_slave_1 added
[ 80.710547][ T5753] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 80.710563][ T5753] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 80.710586][ T5753] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 80.712607][ T5753] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 80.712621][ T5753] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 80.712645][ T5753] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 80.764421][ T5753] hsr_slave_0: entered promiscuous mode
[ 80.765684][ T5753] hsr_slave_1: entered promiscuous mode
[ 80.766421][ T5753] debugfs: 'hsr0' already exists in 'hsr'
[ 80.766499][ T5753] Cannot create hsr debugfs directory
[ 81.446459][ T13] bridge_slave_1: left allmulticast mode
[ 81.446498][ T13] bridge_slave_1: left promiscuous mode
[ 81.447239][ T13] bridge0: port 2(bridge_slave_1) entered disabled state
[ 81.452440][ T13] bridge_slave_0: left allmulticast mode
[ 81.452463][ T13] bridge_slave_0: left promiscuous mode
[ 81.453343][ T13] bridge0: port 1(bridge_slave_0) entered disabled state
[ 81.617142][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 81.633651][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 81.635375][ T13] bond0 (unregistering): Released all slaves
[ 81.784730][ T13] hsr_slave_0: left promiscuous mode
[ 81.785534][ T13] hsr_slave_1: left promiscuous mode
[ 81.787067][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 81.787102][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 81.788329][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 81.788346][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 81.840784][ T13] veth1_macvtap: left promiscuous mode
[ 81.840839][ T13] veth0_macvtap: left promiscuous mode
[ 81.840940][ T13] veth1_vlan: left promiscuous mode
[ 81.841064][ T13] veth0_vlan: left promiscuous mode
[ 82.176199][ T13] team0 (unregistering): Port device team_slave_1 removed
[ 82.189097][ T13] team0 (unregistering): Port device team_slave_0 removed
[ 82.271641][ T52] Bluetooth: hci0: command tx timeout
[ 82.368870][ T5278] 8021q: adding VLAN 0 to HW filter on device eth1
[ 82.668845][ T5753] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 82.686806][ T5753] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 82.689462][ T5753] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 82.713832][ T5753] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 82.715021][ T5753] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 82.739231][ T5753] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 83.024728][ T5753] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 83.028018][ T5753] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 83.287913][ T5753] 8021q: adding VLAN 0 to HW filter on device bond0
[ 83.325795][ T5753] 8021q: adding VLAN 0 to HW filter on device team0
[ 83.364522][ T101] bridge0: port 1(bridge_slave_0) entered blocking state
[ 83.364604][ T101] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 83.389579][ T101] bridge0: port 2(bridge_slave_1) entered blocking state
[ 83.392786][ T101] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 84.067965][ T5753] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 84.124475][ T5753] veth0_vlan: entered promiscuous mode
[ 84.133261][ T5753] veth1_vlan: entered promiscuous mode
[ 84.170591][ T5753] veth0_macvtap: entered promiscuous mode
[ 84.175421][ T5753] veth1_macvtap: entered promiscuous mode
[ 84.189697][ T5753] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 84.204152][ T5753] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 84.231213][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 84.231516][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 84.231823][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 84.231857][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 84.305739][ T1175] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 84.305760][ T1175] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 84.342094][ T1163] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 84.342115][ T1163] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 84.350876][ T52] Bluetooth: hci0: command tx timeout
[ 84.641130][ T9] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 84.790748][ T9] usb 1-1: Using ep0 maxpacket: 32
[ 84.793185][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short
[ 84.793296][ T9] usb 1-1: New USB device found, idVendor=1f71, idProduct=3306, bcdDevice=2a.c0
[ 84.794930][ T9] usb 1-1: config 3 has an invalid interface number: 223 but max is 1
[ 84.794952][ T9] usb 1-1: config 3 has an invalid interface number: 25 but max is 1
[ 84.794969][ T9] usb 1-1: config 3 has an invalid interface number: 223 but max is 1
[ 84.794987][ T9] usb 1-1: config 3 has no interface number 0
[ 84.795001][ T9] usb 1-1: config 3 has no interface number 1
[ 84.795050][ T9] usb 1-1: config 3 interface 25 altsetting 6 has an invalid descriptor for endpoint zero, skipping
[ 84.795060][ T9] usb 1-1: config 3 interface 25 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 5
[ 84.795073][ T9] usb 1-1: too many endpoints for config 3 interface 223 altsetting 155: 82, using maximum allowed: 30
[ 84.795093][ T9] usb 1-1: config 3 interface 223 altsetting 155 endpoint 0xD has invalid maxpacket 512, setting to 64
[ 84.795106][ T9] usb 1-1: config 3 interface 223 altsetting 155 endpoint 0x8 has invalid maxpacket 512, setting to 64
[ 84.795119][ T9] usb 1-1: config 3 interface 223 altsetting 155 has 4 endpoint descriptors, different from the interface descriptor's value: 82
[ 84.795131][ T9] usb 1-1: config 3 interface 223 has no altsetting 1
[ 84.795140][ T9] usb 1-1: config 3 interface 25 has no altsetting 0
[ 84.797061][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 84.797082][ T9] usb 1-1: Product: syz
[ 84.797094][ T9] usb 1-1: Manufacturer: syz
[ 84.797107][ T9] usb 1-1: SerialNumber: syz
[ 85.067540][ T9] usbtv 1-1:3.223: Fushicai USBTV007 Audio-Video Grabber
[ 85.081192][ T9] usb 1-1: USB disconnect, device number 2
[ 85.149271][ T5845] udevd[5845]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/sound/card3/controlC3/../uevent} for writing: No such file or directory
[ 85.178169][ T9]
[ 85.180530][ T9] =========================
[ 85.185028][ T9] WARNING: held lock freed!
[ 85.189631][ T9] syzkaller #0 Not tainted
[ 85.194049][ T9] -------------------------
[ 85.198547][ T9] kworker/0:0/9 is freeing memory ffff888079987000-ffff8880799877ff, with a lock still held there!
[ 85.209232][ T9] ffff8880799871a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880
[ 85.219372][ T9] locks held by kworker/0:0/9: 5, last CPU#0:
[ 85.225422][ T9] #0: ffff8880246e1940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[ 85.236710][ T9] #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[ 85.248518][ T9] #2: ffff88802b0391d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30
[ 85.257389][ T9] #3: ffff88802dfc61d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xfc/0x9a0
[ 85.266495][ T9] #4: ffff8880799871a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880
[ 85.276998][ T9]
[ 85.276998][ T9] stack backtrace:
[ 85.282892][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full)
[ 85.291978][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 85.302012][ T9] Workqueue: usb_hub_wq hub_event
[ 85.307037][ T9] Call Trace:
[ 85.310307][ T9]
[ 85.313217][ T9] dump_stack_lvl+0xe8/0x150
[ 85.317793][ T9] debug_check_no_locks_freed+0x149/0x170
[ 85.323507][ T9] kfree+0x12b/0x650
[ 85.327378][ T9] ? device_release+0xc4/0x1f0
[ 85.332184][ T9] ? __pfx_usb_release_interface+0x10/0x10
[ 85.338030][ T9] device_release+0xc4/0x1f0
[ 85.342638][ T9] kobject_put+0x222/0x550
[ 85.347045][ T9] v4l2_device_disconnect+0x79/0xd0
[ 85.352225][ T9] usbtv_video_free+0x25/0x30
[ 85.356884][ T9] usbtv_disconnect+0x5c/0xa0
[ 85.361541][ T9] usb_unbind_interface+0x295/0x9f0
[ 85.366722][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 85.372447][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 85.378152][ T9] ? __pfx_usb_unbind_interface+0x10/0x10
[ 85.383878][ T9] device_release_driver_internal+0x4f5/0x880
[ 85.389950][ T9] bus_remove_device+0x444/0x560
[ 85.394883][ T9] ? __pfx_bus_remove_device+0x10/0x10
[ 85.400321][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 85.406025][ T9] device_del+0x524/0x8f0
[ 85.410338][ T9] ? __pfx_device_del+0x10/0x10
[ 85.415176][ T9] ? __pfx___mutex_lock+0x10/0x10
[ 85.420181][ T9] usb_disable_device+0x3d4/0x8d0
[ 85.425192][ T9] usb_disconnect+0x346/0x9a0
[ 85.429848][ T9] hub_event+0x1bbb/0x4d30
[ 85.434247][ T9] ? do_raw_spin_unlock+0xf5/0x200
[ 85.439376][ T9] ? register_lock_class+0x31/0x2e0
[ 85.444559][ T9] ? __pfx_hub_event+0x10/0x10
[ 85.449301][ T9] ? rcu_is_watching+0x16/0xb0
[ 85.454054][ T9] ? process_scheduled_works+0x97a/0x1630
[ 85.459753][ T9] process_scheduled_works+0xc3d/0x1630
[ 85.465297][ T9] ? __pfx_process_scheduled_works+0x10/0x10
[ 85.471256][ T9] ? assign_work+0x3cf/0x5d0
[ 85.475832][ T9] worker_thread+0xa47/0xfb0
[ 85.480413][ T9] kthread+0x38b/0x480
[ 85.484458][ T9] ? __pfx_worker_thread+0x10/0x10
[ 85.489552][ T9] ? __pfx_kthread+0x10/0x10
[ 85.494119][ T9] ret_from_fork+0x514/0xb70
[ 85.498684][ T9] ? __pfx_ret_from_fork+0x10/0x10
[ 85.503771][ T9] ? __switch_to+0xc89/0x1420
[ 85.508430][ T9] ? __pfx_kthread+0x10/0x10
[ 85.513014][ T9] ret_from_fork_asm+0x1a/0x30
[ 85.517773][ T9]
[ 85.524139][ T9] ==================================================================
[ 85.524151][ T9] BUG: KASAN: slab-use-after-free in usb_unbind_interface+0x2c2/0x9f0
[ 85.524174][ T9] Read of size 8 at addr ffff888079987008 by task kworker/0:0/9
[ 85.524189][ T9]
[ 85.524199][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full)
[ 85.524220][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 85.524231][ T9] Workqueue: usb_hub_wq hub_event
[ 85.524258][ T9] Call Trace:
[ 85.524265][ T9]
[ 85.524272][ T9] dump_stack_lvl+0xe8/0x150
[ 85.524298][ T9] print_address_description+0x55/0x1e0
[ 85.524322][ T9] ? usb_unbind_interface+0x2c2/0x9f0
[ 85.524346][ T9] print_report+0x58/0x70
[ 85.524369][ T9] kasan_report+0x117/0x150
[ 85.524394][ T9] ? usb_unbind_interface+0x2c2/0x9f0
[ 85.524412][ T9] usb_unbind_interface+0x2c2/0x9f0
[ 85.524429][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 85.524457][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 85.524481][ T9] ? __pfx_usb_unbind_interface+0x10/0x10
[ 85.524497][ T9] device_release_driver_internal+0x4f5/0x880
[ 85.524528][ T9] bus_remove_device+0x444/0x560
[ 85.524551][ T9] ? __pfx_bus_remove_device+0x10/0x10
[ 85.524574][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 85.524600][ T9] device_del+0x524/0x8f0
[ 85.524627][ T9] ? __pfx_device_del+0x10/0x10
[ 85.524649][ T9] ? __pfx___mutex_lock+0x10/0x10
[ 85.524674][ T9] usb_disable_device+0x3d4/0x8d0
[ 85.524702][ T9] usb_disconnect+0x346/0x9a0
[ 85.524728][ T9] hub_event+0x1bbb/0x4d30
[ 85.524753][ T9] ? do_raw_spin_unlock+0xf5/0x200
[ 85.524784][ T9] ? register_lock_class+0x31/0x2e0
[ 85.524815][ T9] ? __pfx_hub_event+0x10/0x10
[ 85.524843][ T9] ? rcu_is_watching+0x16/0xb0
[ 85.524866][ T9] ? process_scheduled_works+0x97a/0x1630
[ 85.524890][ T9] process_scheduled_works+0xc3d/0x1630
[ 85.524925][ T9] ? __pfx_process_scheduled_works+0x10/0x10
[ 85.524951][ T9] ? assign_work+0x3cf/0x5d0
[ 85.524975][ T9] worker_thread+0xa47/0xfb0
[ 85.525009][ T9] kthread+0x38b/0x480
[ 85.525027][ T9] ? __pfx_worker_thread+0x10/0x10
[ 85.525050][ T9] ? __pfx_kthread+0x10/0x10
[ 85.525068][ T9] ret_from_fork+0x514/0xb70
[ 85.525087][ T9] ? __pfx_ret_from_fork+0x10/0x10
[ 85.525103][ T9] ? __switch_to+0xc89/0x1420
[ 85.525128][ T9] ? __pfx_kthread+0x10/0x10
[ 85.525145][ T9] ret_from_fork_asm+0x1a/0x30
[ 85.525168][ T9]
[ 85.525175][ T9]
[ 85.525179][ T9] Allocated by task 9:
[ 85.525187][ T9] kasan_save_track+0x3e/0x80
[ 85.525207][ T9] __kasan_kmalloc+0x93/0xb0
[ 85.525227][ T9] __kmalloc_cache_noprof+0x321/0x600
[ 85.525246][ T9] usb_set_configuration+0x3c5/0x2260
[ 85.525273][ T9] usb_generic_driver_probe+0x8d/0x150
[ 85.525297][ T9] usb_probe_device+0x1c3/0x3b0
[ 85.525312][ T9] really_probe+0x254/0xae0
[ 85.525335][ T9] __driver_probe_device+0x1e8/0x360
[ 85.525365][ T9] driver_probe_device+0x4f/0x240
[ 85.525389][ T9] __device_attach_driver+0x270/0x410
[ 85.525412][ T9] bus_for_each_drv+0x258/0x2f0
[ 85.525428][ T9] __device_attach+0x2c4/0x450
[ 85.525449][ T9] device_initial_probe+0xa1/0xd0
[ 85.525470][ T9] bus_probe_device+0x12a/0x220
[ 85.525488][ T9] device_add+0x7d7/0xb80
[ 85.525508][ T9] usb_new_device+0x9aa/0x1690
[ 85.525528][ T9] hub_event+0x28e8/0x4d30
[ 85.525551][ T9] process_scheduled_works+0xc3d/0x1630
[ 85.525572][ T9] worker_thread+0xa47/0xfb0
[ 85.525594][ T9] kthread+0x38b/0x480
[ 85.525608][ T9] ret_from_fork+0x514/0xb70
[ 85.525622][ T9] ret_from_fork_asm+0x1a/0x30
[ 85.525637][ T9]
[ 85.525640][ T9] Freed by task 9:
[ 85.525648][ T9] kasan_save_track+0x3e/0x80
[ 85.525668][ T9] kasan_save_free_info+0x40/0x50
[ 85.525684][ T9] __kasan_slab_free+0x5c/0x80
[ 85.525705][ T9] kfree+0x1c5/0x650
[ 85.525720][ T9] device_release+0xc4/0x1f0
[ 85.525734][ T9] kobject_put+0x222/0x550
[ 85.525755][ T9] v4l2_device_disconnect+0x79/0xd0
[ 85.525773][ T9] usbtv_video_free+0x25/0x30
[ 85.525789][ T9] usbtv_disconnect+0x5c/0xa0
[ 85.525804][ T9] usb_unbind_interface+0x295/0x9f0
[ 85.525819][ T9] device_release_driver_internal+0x4f5/0x880
[ 85.525842][ T9] bus_remove_device+0x444/0x560
[ 85.525859][ T9] device_del+0x524/0x8f0
[ 85.525879][ T9] usb_disable_device+0x3d4/0x8d0
[ 85.525903][ T9] usb_disconnect+0x346/0x9a0
[ 85.525922][ T9] hub_event+0x1bbb/0x4d30
[ 85.525945][ T9] process_scheduled_works+0xc3d/0x1630
[ 85.525966][ T9] worker_thread+0xa47/0xfb0
[ 85.525987][ T9] kthread+0x38b/0x480
[ 85.526002][ T9] ret_from_fork+0x514/0xb70
[ 85.526017][ T9] ret_from_fork_asm+0x1a/0x30
[ 85.526029][ T9]
[ 85.526034][ T9] The buggy address belongs to the object at ffff888079987000
[ 85.526034][ T9] which belongs to the cache kmalloc-2k of size 2048
[ 85.526050][ T9] The buggy address is located 8 bytes inside of
[ 85.526050][ T9] freed 2048-byte region [ffff888079987000, ffff888079987800)
[ 85.526068][ T9]
[ 85.526072][ T9] The buggy address belongs to the physical page:
[ 85.526090][ T9] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x79980
[ 85.526107][ T9] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 85.526122][ T9] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 85.526143][ T9] page_type: f5(slab)
[ 85.526160][ T9] raw: 00fff00000000040 ffff88801c042000 dead000000000100 dead000000000122
[ 85.526174][ T9] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 85.526191][ T9] head: 00fff00000000040 ffff88801c042000 dead000000000100 dead000000000122
[ 85.526207][ T9] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 85.526222][ T9] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 85.526238][ T9] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 85.526247][ T9] page dumped because: kasan: bad access detected
[ 85.526260][ T9] page_owner tracks the page as allocated
[ 85.526267][ T9] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 13, tgid 13 (kworker/u8:1), ts 84752203335
[ 85.526295][ T9] post_alloc_hook+0x1f9/0x250
[ 85.526312][ T9] get_page_from_freelist+0x2209/0x2280
[ 85.526332][ T9] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 85.526359][ T9] allocate_slab+0x7d/0x620
[ 85.526381][ T9] refill_objects+0x2d5/0x350
[ 85.526404][ T9] __pcs_replace_empty_main+0x2c8/0x6c0
[ 85.526427][ T9] __kmalloc_node_track_caller_noprof+0x548/0x720
[ 85.526447][ T9] __alloc_skb+0x2c1/0x7a0
[ 85.526461][ T9] mld_newpack+0x165/0xcb0
[ 85.526477][ T9] add_grec+0x119f/0x19d0
[ 85.526492][ T9] mld_send_initial_cr+0x288/0x550
[ 85.526517][ T9] ipv6_mc_dad_complete+0x87/0x410
[ 85.526542][ T9] addrconf_dad_completed+0x8af/0xe60
[ 85.526568][ T9] addrconf_dad_work+0xcf8/0x15c0
[ 85.526591][ T9] process_scheduled_works+0xc3d/0x1630
[ 85.526611][ T9] worker_thread+0xa47/0xfb0
[ 85.526632][ T9] page last free pid 5819 tgid 5819 ts 83656248018 stack trace:
[ 85.526643][ T9] __free_frozen_pages+0xc93/0xd90
[ 85.526659][ T9] __slab_free+0x274/0x2c0
[ 85.526676][ T9] qlist_free_all+0x99/0x100
[ 85.526692][ T9] kasan_quarantine_reduce+0x148/0x160
[ 85.526711][ T9] __kasan_slab_alloc+0x22/0x80
[ 85.526730][ T9] kmem_cache_alloc_noprof+0x2b9/0x600
[ 85.526747][ T9] vm_area_dup+0x28/0x760
[ 85.526764][ T9] __split_vma+0x1d7/0xa60
[ 85.526784][ T9] vms_gather_munmap_vmas+0x322/0x1370
[ 85.526806][ T9] mmap_region+0x925/0x25b0
[ 85.526829][ T9] do_mmap+0xe0a/0x1300
[ 85.526851][ T9] vm_mmap_pgoff+0x272/0x4e0
[ 85.526873][ T9] ksys_mmap_pgoff+0x4dc/0x760
[ 85.526896][ T9] do_syscall_64+0x166/0x520
[ 85.526914][ T9] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.526931][ T9]
[ 85.526935][ T9] Memory state around the buggy address:
[ 85.526945][ T9] ffff888079986f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 85.526957][ T9] ffff888079986f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 85.526968][ T9] >ffff888079987000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 85.526977][ T9] ^
[ 85.526985][ T9] ffff888079987080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 85.526996][ T9] ffff888079987100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 85.527005][ T9] ==================================================================
[ 85.527038][ T9] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 86.368441][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.377539][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 86.387587][ T9] Workqueue: usb_hub_wq hub_event
[ 86.392621][ T9] Call Trace:
[ 86.395889][ T9]
[ 86.398810][ T9] vpanic+0x56d/0xa60
[ 86.402791][ T9] ? rcu_is_watching+0x16/0xb0
[ 86.407549][ T9] ? __pfx_vpanic+0x10/0x10
[ 86.412047][ T9] ? __pfx___schedule+0x10/0x10
[ 86.416890][ T9] panic+0xc5/0xd0
[ 86.420611][ T9] ? __pfx_panic+0x10/0x10
[ 86.425022][ T9] ? preempt_schedule_thunk+0x16/0x40
[ 86.430384][ T9] ? usb_unbind_interface+0x2c2/0x9f0
[ 86.435751][ T9] check_panic_on_warn+0x89/0xb0
[ 86.440693][ T9] ? usb_unbind_interface+0x2c2/0x9f0
[ 86.446055][ T9] end_report+0x73/0x170
[ 86.450293][ T9] ? usb_unbind_interface+0x2c2/0x9f0
[ 86.455656][ T9] kasan_report+0x128/0x150
[ 86.460169][ T9] ? usb_unbind_interface+0x2c2/0x9f0
[ 86.465538][ T9] usb_unbind_interface+0x2c2/0x9f0
[ 86.470725][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 86.476447][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 86.482162][ T9] ? __pfx_usb_unbind_interface+0x10/0x10
[ 86.487873][ T9] device_release_driver_internal+0x4f5/0x880
[ 86.493938][ T9] bus_remove_device+0x444/0x560
[ 86.498902][ T9] ? __pfx_bus_remove_device+0x10/0x10
[ 86.504353][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 86.510067][ T9] device_del+0x524/0x8f0
[ 86.514391][ T9] ? __pfx_device_del+0x10/0x10
[ 86.519235][ T9] ? __pfx___mutex_lock+0x10/0x10
[ 86.524255][ T9] usb_disable_device+0x3d4/0x8d0
[ 86.529279][ T9] usb_disconnect+0x346/0x9a0
[ 86.533957][ T9] hub_event+0x1bbb/0x4d30
[ 86.538374][ T9] ? do_raw_spin_unlock+0xf5/0x200
[ 86.543484][ T9] ? register_lock_class+0x31/0x2e0
[ 86.548687][ T9] ? __pfx_hub_event+0x10/0x10
[ 86.553476][ T9] ? rcu_is_watching+0x16/0xb0
[ 86.558233][ T9] ? process_scheduled_works+0x97a/0x1630
[ 86.563949][ T9] process_scheduled_works+0xc3d/0x1630
[ 86.569503][ T9] ? __pfx_process_scheduled_works+0x10/0x10
[ 86.575493][ T9] ? assign_work+0x3cf/0x5d0
[ 86.580080][ T9] worker_thread+0xa47/0xfb0
[ 86.584673][ T9] kthread+0x38b/0x480
[ 86.588733][ T9] ? __pfx_worker_thread+0x10/0x10
[ 86.593844][ T9] ? __pfx_kthread+0x10/0x10
[ 86.598423][ T9] ret_from_fork+0x514/0xb70
[ 86.603001][ T9] ? __pfx_ret_from_fork+0x10/0x10
[ 86.608099][ T9] ? __switch_to+0xc89/0x1420
[ 86.612771][ T9] ? __pfx_kthread+0x10/0x10
[ 86.617349][ T9] ret_from_fork_asm+0x1a/0x30
[ 86.622106][ T9]
[ 86.625369][ T9] Kernel Offset: disabled
[ 86.629682][ T9] Rebooting in 86400 seconds..