syzkaller login: [ 92.015169][ T9] cfg80211: failed to load regulatory.db Warning: Permanently added '[localhost]:2235' (ED25519) to the list of known hosts. 2026/10/20 21:02:46 parsed 1 programs 2026/10/20 21:02:46 serving rpc on tcp://44141 qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x400000) [ 101.983868][ T1026] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1 [ 101.984085][ T1026] ata1: failed to read log page 10h (errno=-5) [ 101.984100][ T1026] ata1.00: exception Emask 0x1 SAct 0x40000000 SErr 0x0 action 0x0 [ 101.984112][ T1026] ata1.00: irq_stat 0x41000008 [ 101.984124][ T1026] ata1.00: failed command: WRITE FPDMA QUEUED [ 101.984132][ T1026] ata1.00: cmd 61/00:f0:36:a1:04/20:00:00:00:00/40 tag 30 ncq dma 4194304 ou [ 101.984132][ T1026] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 101.984163][ T1026] ata1.00: status: { DRDY } [ 101.984169][ T1026] ata1.00: error: { ABRT } [ 102.026927][ T1026] ata1.00: configured for UDMA/100 [ 102.027394][ T1026] ata1: EH complete [ 104.754577][ T5295] cgroup: Unknown subsys name 'net' [ 104.827041][ T5295] cgroup: Unknown subsys name 'cpuset' [ 104.830539][ T5295] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 108.311340][ T5295] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 119.654734][ T5307] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 123.417858][ T14] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 123.417899][ T14] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 123.688971][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 123.688992][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 127.415838][ T48] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 127.417627][ T48] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 127.418024][ T48] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 127.418633][ T48] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 127.418974][ T48] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 131.042922][ T5364] rxe_eth0 speed is unknown, defaulting to 1000 [ 131.043903][ T5364] rxe_eth0 speed is unknown, defaulting to 1000 [ 131.045042][ T5364] rxe_eth0 speed is unknown, defaulting to 1000 [ 131.545179][ T9] rxe_eth0 speed is unknown, defaulting to 1000 [ 131.581612][ T5364] infiniband rxe0: set active [ 131.581632][ T5364] infiniband rxe0: added rxe_eth0 [ 131.717971][ T5364] smbdirect: ib_dev[rxe0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 131.718000][ T5364] smbdirect: ib_dev[rxe0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 131.718021][ T5364] smbdirect: ib_dev[rxe0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 131.814988][ T5364] RDS/IB: rxe0: added [ 131.817413][ T5364] smc: adding ib device rxe0 with port count 1 [ 131.817494][ T5364] smc: ib device rxe0 port 1 has no pnetid [ 131.818277][ T10] rxe_eth0 speed is unknown, defaulting to 1000 [ 132.060869][ T5364] rxe_eth0 speed is unknown, defaulting to 1000 [ 132.631990][ T10] rxe_eth0 speed is unknown, defaulting to 1000 [ 132.700356][ T10] rxe_eth0 speed is unknown, defaulting to 1000 [ 133.418630][ T5364] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.419846][ T5364] bridge0: port 1(bridge_slave_0) entered disabled state [ 133.419960][ T5364] bridge_slave_0: entered allmulticast mode [ 133.421241][ T5364] bridge_slave_0: entered promiscuous mode [ 133.462229][ T5364] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.473649][ T5364] bridge0: port 2(bridge_slave_1) entered disabled state [ 133.473875][ T5364] bridge_slave_1: entered allmulticast mode [ 133.475318][ T5364] bridge_slave_1: entered promiscuous mode [ 133.762954][ T5364] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 133.769771][ T5364] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 133.820904][ T5364] team0: Port device team_slave_0 added [ 133.829215][ T5364] team0: Port device team_slave_1 added [ 133.871922][ T5364] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 133.871939][ T5364] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 133.871953][ T5364] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 133.911864][ T5364] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 133.911879][ T5364] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 133.911894][ T5364] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 134.245926][ T5364] hsr_slave_0: entered promiscuous mode [ 134.247099][ T5364] hsr_slave_1: entered promiscuous mode [ 134.616710][ T5364] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 134.648270][ T5364] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 134.649649][ T5364] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 134.669572][ T5364] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 134.677074][ T5364] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 134.692415][ T5364] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 134.708596][ T5364] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 134.724891][ T5364] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 135.296851][ T5364] 8021q: adding VLAN 0 to HW filter on device bond0 [ 135.350872][ T5364] 8021q: adding VLAN 0 to HW filter on device team0 [ 135.446440][ T14] bridge0: port 1(bridge_slave_0) entered blocking state [ 135.446803][ T14] bridge0: port 1(bridge_slave_0) entered forwarding state [ 135.497121][ T14] bridge0: port 2(bridge_slave_1) entered blocking state [ 135.497193][ T14] bridge0: port 2(bridge_slave_1) entered forwarding state [ 137.428546][ T5364] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 137.590847][ T5364] veth0_vlan: entered promiscuous mode [ 137.616077][ T5364] veth1_vlan: entered promiscuous mode [ 137.796963][ T5364] veth0_macvtap: entered promiscuous mode [ 137.829497][ T5364] veth1_macvtap: entered promiscuous mode [ 137.856837][ T5364] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 137.870576][ T5364] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 137.962649][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.962683][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.962700][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.962716][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 138.079129][ T1328] ieee802154 phy0 wpan0: encryption failed: -22 [ 138.079199][ T1328] ieee802154 phy1 wpan1: encryption failed: -22 [ 138.335178][ T184] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 138.434937][ T184] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 138.457839][ T5417] rxe_eth0 speed is unknown, defaulting to 1000 [ 138.541117][ T184] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 138.698964][ T184] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 139.209796][ T184] bridge_slave_1: left allmulticast mode [ 139.290689][ T184] bridge_slave_1: left promiscuous mode [ 139.291746][ T184] bridge0: port 2(bridge_slave_1) entered disabled state [ 139.343102][ T184] bridge_slave_0: left allmulticast mode [ 139.343128][ T184] bridge_slave_0: left promiscuous mode [ 139.344662][ T184] bridge0: port 1(bridge_slave_0) entered disabled state [ 140.019688][ T184] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 140.057015][ T184] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 140.067684][ T184] bond0 (unregistering): Released all slaves [ 140.452728][ T4991] 8021q: adding VLAN 0 to HW filter on device eth2 [ 141.502607][ T184] hsr_slave_0: left promiscuous mode [ 141.546949][ T184] hsr_slave_1: left promiscuous mode [ 141.548020][ T184] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 141.548053][ T184] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 141.637707][ T184] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 141.637726][ T184] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 141.706612][ T184] veth1_macvtap: left promiscuous mode [ 141.706683][ T184] veth0_macvtap: left promiscuous mode [ 141.707041][ T184] veth1_vlan: left promiscuous mode [ 141.707112][ T184] veth0_vlan: left promiscuous mode [ 143.067904][ T184] team0 (unregistering): Port device team_slave_1 removed [ 143.084644][ T184] team0 (unregistering): Port device team_slave_0 removed [ 143.314162][ T4991] 8021q: adding VLAN 0 to HW filter on device eth4 [ 143.402924][ T5435] rxe_eth0 speed is unknown, defaulting to 1000 [ 145.015815][ T4991] 8021q: adding VLAN 0 to HW filter on device eth3 [ 146.353974][ T5452] rxe_eth0 speed is unknown, defaulting to 1000 [ 146.783020][ T4991] 8021q: adding VLAN 0 to HW filter on device eth5 [ 146.785160][ T10] rxe_eth0 speed is unknown, defaulting to 1000 [ 147.820274][ T5468] rxe_eth0 speed is unknown, defaulting to 1000 2026/10/20 21:03:35 executed programs: 0 [ 149.520755][ T4646] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 149.534582][ T4646] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 149.538148][ T4646] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 149.539608][ T4646] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 149.540472][ T4646] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 150.884503][ T5479] rxe_eth0 speed is unknown, defaulting to 1000 [ 151.605301][ T4646] Bluetooth: hci0: command tx timeout [ 151.917620][ T5479] bridge0: port 1(bridge_slave_0) entered blocking state [ 151.917757][ T5479] bridge0: port 1(bridge_slave_0) entered disabled state [ 151.917894][ T5479] bridge_slave_0: entered allmulticast mode [ 151.920028][ T5479] bridge_slave_0: entered promiscuous mode [ 151.949951][ T5479] bridge0: port 2(bridge_slave_1) entered blocking state [ 151.950085][ T5479] bridge0: port 2(bridge_slave_1) entered disabled state [ 151.950177][ T5479] bridge_slave_1: entered allmulticast mode [ 152.010151][ T5479] bridge_slave_1: entered promiscuous mode [ 152.069259][ T5479] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 152.096176][ T5479] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 152.165484][ T5479] team0: Port device team_slave_0 added [ 152.168423][ T5479] team0: Port device team_slave_1 added [ 152.259158][ T5479] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 152.259175][ T5479] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 152.259190][ T5479] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 152.260774][ T5479] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 152.260785][ T5479] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 152.260797][ T5479] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 152.514819][ T5479] hsr_slave_0: entered promiscuous mode [ 152.515641][ T5479] hsr_slave_1: entered promiscuous mode [ 153.677595][ T4646] Bluetooth: hci0: command tx timeout [ 153.976672][ T5479] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 154.020980][ T5479] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 154.026877][ T5479] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 154.047000][ T5479] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 154.081975][ T5479] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 154.085339][ T5479] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 154.086244][ T5479] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 154.090380][ T5479] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 154.335768][ T5479] 8021q: adding VLAN 0 to HW filter on device bond0 [ 154.430569][ T5479] 8021q: adding VLAN 0 to HW filter on device team0 [ 154.454644][ T184] bridge0: port 1(bridge_slave_0) entered blocking state [ 154.454713][ T184] bridge0: port 1(bridge_slave_0) entered forwarding state [ 154.461039][ T109] bridge0: port 2(bridge_slave_1) entered blocking state [ 154.461109][ T109] bridge0: port 2(bridge_slave_1) entered forwarding state [ 155.753074][ T4646] Bluetooth: hci0: command tx timeout [ 156.355220][ T5479] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 156.499605][ T5479] veth0_vlan: entered promiscuous mode [ 156.530677][ T5479] veth1_vlan: entered promiscuous mode [ 156.631458][ T5479] veth0_macvtap: entered promiscuous mode [ 156.668064][ T5479] veth1_macvtap: entered promiscuous mode [ 156.717415][ T5479] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 156.732827][ T5479] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 156.774444][ T184] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 156.804822][ T74] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 156.805398][ T74] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 156.805441][ T74] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 157.132622][ T74] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 157.132657][ T74] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 157.378658][ T184] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 157.378678][ T184] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2026/10/20 21:03:43 executed programs: 2 [ 157.833974][ T4646] Bluetooth: hci0: command tx timeout [ 157.958605][ T5413] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 158.111705][ T5413] usb 5-1: Using ep0 maxpacket: 16 [ 158.113598][ T5413] usb 5-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 158.115106][ T5413] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 158.115143][ T5413] usb 5-1: config 0 interface 0 has no altsetting 0 [ 158.119673][ T5413] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 158.119693][ T5413] usb 5-1: Product: syz [ 158.119701][ T5413] usb 5-1: Manufacturer: syz [ 158.119709][ T5413] usb 5-1: SerialNumber: syz [ 158.252660][ T5413] usb 5-1: config 0 descriptor?? qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x190000) [ 158.405748][ T1026] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1 [ 158.405767][ T1026] ata1: failed to read log page 10h (errno=-5) [ 158.405780][ T1026] ata1.00: exception Emask 0x1 SAct 0x800 SErr 0x0 action 0x0 [ 158.405857][ T1026] ata1.00: irq_stat 0x41000008 [ 158.405870][ T1026] ata1.00: failed command: READ FPDMA QUEUED [ 158.405877][ T1026] ata1.00: cmd 60/80:58:ee:32:01/0c:00:00:00:00/40 tag 11 ncq dma 1638400 in [ 158.405877][ T1026] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 158.405907][ T1026] ata1.00: status: { DRDY } [ 158.405914][ T1026] ata1.00: error: { ABRT } [ 158.409782][ T1026] ata1.00: configured for UDMA/100 [ 158.410710][ T1026] sd 0:0:0:0: [sda] tag#11 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s [ 158.410840][ T1026] sd 0:0:0:0: [sda] tag#11 Sense Key : Aborted Command [current] [ 158.410917][ T1026] sd 0:0:0:0: [sda] tag#11 Add. Sense: No additional sense information [ 158.411011][ T1026] sd 0:0:0:0: [sda] tag#11 CDB: Read(10) 28 00 00 01 32 ee 00 0c 80 00 [ 158.411028][ T1026] I/O error, dev sda, sector 78574 op 0x0:(READ) flags 0x80700 phys_seg 149 prio class 2 [ 158.411357][ T1026] ata1: EH complete [ 158.618022][ C0] imon 5-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 158.658664][ T5413] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/input/input5 [ 158.736907][ T5413] imon:send_packet: packet tx failed (-71) [ 158.752074][ T5413] imon 5-1:0.0: panel buttons/knobs setup failed [ 158.922954][ T5413] rc_core: IR keymap rc-imon-pad not found [ 158.922973][ T5413] Registered IR keymap rc-empty [ 158.923033][ T5413] imon 5-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 158.923043][ T5413] imon 5-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 158.924664][ T5413] imon:send_packet: packet tx failed (-71) [ 158.965704][ T5413] imon 5-1:0.0: remote input dev register failed [ 158.965818][ T5413] imon 5-1:0.0: imon_init_intf0: rc device setup failed [ 159.046696][ T5413] imon 5-1:0.0: unable to initialize intf0, err 0 [ 159.046714][ T5413] imon:imon_probe: failed to initialize context! [ 159.046721][ T5413] imon 5-1:0.0: unable to register, err -19 [ 159.140824][ T5413] usb 5-1: USB disconnect, device number 2 [ 159.655253][ T5413] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 159.802701][ T5413] usb 5-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 159.803877][ T5413] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 159.803897][ T5413] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid maxpacket 198, setting to 64 [ 159.803910][ T5413] usb 5-1: config 0 interface 0 has no altsetting 0 [ 159.806270][ T5413] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 159.806288][ T5413] usb 5-1: Product: syz [ 159.806296][ T5413] usb 5-1: Manufacturer: syz [ 159.806303][ T5413] usb 5-1: SerialNumber: syz [ 159.900611][ T5413] usb 5-1: config 0 descriptor?? [ 159.914776][ T5544] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 160.119227][ C0] imon 5-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 160.132570][ T5413] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/input/input7 [ 160.401842][ T5413] rc_core: IR keymap rc-imon-pad not found [ 160.401862][ T5413] Registered IR keymap rc-empty [ 160.401918][ T5413] imon 5-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 160.401929][ T5413] imon 5-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 160.544003][ T5413] rc rc0: iMON Remote (15c2:0045) as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/rc/rc0 [ 160.546614][ T5413] input: iMON Remote (15c2:0045) as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/rc/rc0/input8 [ 160.608666][ T5413] imon 5-1:0.0: iMON device (15c2:0045, intf0) on usb<5:3> initialized [ 160.809799][ T10] usb 5-1: USB disconnect, device number 3 [ 161.589979][ T5544] ================================================================== [ 161.590019][ T5544] BUG: KASAN: slab-use-after-free in dev_driver_string+0x35/0xd0 [ 161.590149][ T5544] Read of size 8 at addr ffff8880134820e0 by task syz.0.17/5544 [ 161.590182][ T5544] [ 161.590248][ T5544] CPU: 0 UID: 0 PID: 5544 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 161.590266][ T5544] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 161.590281][ T5544] Call Trace: [ 161.590312][ T5544] [ 161.590342][ T5544] dump_stack_lvl+0xe8/0x150 [ 161.590388][ T5544] print_address_description+0x55/0x1e0 [ 161.590404][ T5544] ? dev_driver_string+0x35/0xd0 [ 161.590414][ T5544] print_report+0x58/0x70 [ 161.590427][ T5544] kasan_report+0x117/0x150 [ 161.590460][ T5544] ? dev_driver_string+0x35/0xd0 [ 161.590471][ T5544] dev_driver_string+0x35/0xd0 [ 161.590482][ T5544] __dynamic_dev_dbg+0x1ae/0x2e0 [ 161.590497][ T5544] ? __mutex_lock+0x30a/0x15a0 [ 161.590555][ T5544] ? __pfx___dynamic_dev_dbg+0x10/0x10 [ 161.590572][ T5544] ? __pfx_ima_file_free+0x10/0x10 [ 161.590586][ T5544] ? __asan_memset+0x22/0x50 [ 161.590616][ T5544] ? __fsnotify_parent+0x267/0x620 [ 161.590642][ T5544] ? display_close+0x4b/0x240 [ 161.590662][ T5544] display_close+0x1f9/0x240 [ 161.590676][ T5544] ? __pfx_display_close+0x10/0x10 [ 161.590691][ T5544] __fput+0x40d/0xa50 [ 161.590726][ T5544] fput_close_sync+0x11f/0x240 [ 161.590736][ T5544] ? __pfx_fput_close_sync+0x10/0x10 [ 161.590748][ T5544] filp_close_sync+0x6e/0xa0 [ 161.590759][ T5544] __se_sys_close_range+0xa77/0xef0 [ 161.590781][ T5544] ? __pfx___se_sys_close_range+0x10/0x10 [ 161.590794][ T5544] do_syscall_64+0x166/0x520 [ 161.590805][ T5544] ? trace_irq_disable+0x3b/0x140 [ 161.590824][ T5544] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.590834][ T5544] ? clear_bhb_loop+0x70/0xc0 [ 161.590844][ T5544] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.590854][ T5544] RIP: 0033:0x7f0e0139f559 [ 161.590864][ T5544] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 161.590921][ T5544] RSP: 002b:00007ffd65588368 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 161.590947][ T5544] RAX: ffffffffffffffda RBX: 00007ffd65588450 RCX: 00007f0e0139f559 [ 161.590954][ T5544] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 161.590961][ T5544] RBP: 000000000002674e R08: 0000000000000001 R09: 0000000000000000 [ 161.590967][ T5544] R10: 0000001b32620000 R11: 0000000000000246 R12: 0000000000000000 [ 161.590974][ T5544] R13: 00007f0e01625fac R14: 00007f0e01625fa8 R15: 00007f0e01625fa0 [ 161.590984][ T5544] [ 161.590987][ T5544] [ 161.590989][ T5544] Allocated by task 5413: [ 161.591004][ T5544] kasan_save_track+0x3e/0x80 [ 161.591013][ T5544] __kasan_kmalloc+0x93/0xb0 [ 161.591021][ T5544] __kmalloc_cache_noprof+0x321/0x600 [ 161.591029][ T5544] usb_set_configuration+0x3c5/0x2260 [ 161.591041][ T5544] usb_generic_driver_probe+0x8d/0x150 [ 161.591052][ T5544] usb_probe_device+0x1c3/0x3b0 [ 161.591062][ T5544] really_probe+0x254/0xae0 [ 161.591073][ T5544] __driver_probe_device+0x1e8/0x360 [ 161.591083][ T5544] driver_probe_device+0x4f/0x240 [ 161.591094][ T5544] __device_attach_driver+0x270/0x410 [ 161.591105][ T5544] bus_for_each_drv+0x258/0x2f0 [ 161.591113][ T5544] __device_attach+0x2c4/0x450 [ 161.591124][ T5544] device_initial_probe+0xa1/0xd0 [ 161.591134][ T5544] bus_probe_device+0x12a/0x220 [ 161.591143][ T5544] device_add+0x7d7/0xb80 [ 161.591152][ T5544] usb_new_device+0x9aa/0x1690 [ 161.591164][ T5544] hub_event+0x28e8/0x4d30 [ 161.591177][ T5544] process_scheduled_works+0xc3d/0x1630 [ 161.591200][ T5544] worker_thread+0xa47/0xfb0 [ 161.591211][ T5544] kthread+0x38b/0x480 [ 161.591219][ T5544] ret_from_fork+0x514/0xb70 [ 161.591243][ T5544] ret_from_fork_asm+0x1a/0x30 [ 161.591252][ T5544] [ 161.591254][ T5544] Freed by task 10: [ 161.591259][ T5544] kasan_save_track+0x3e/0x80 [ 161.591267][ T5544] kasan_save_free_info+0x40/0x50 [ 161.591278][ T5544] __kasan_slab_free+0x5c/0x80 [ 161.591286][ T5544] kfree+0x1c5/0x650 [ 161.591297][ T5544] device_release+0xc4/0x1f0 [ 161.591308][ T5544] kobject_put+0x222/0x550 [ 161.591318][ T5544] usb_disable_device+0x611/0x8d0 [ 161.591328][ T5544] usb_disconnect+0x346/0x9a0 [ 161.591343][ T5544] hub_event+0x1bbb/0x4d30 [ 161.591353][ T5544] process_scheduled_works+0xc3d/0x1630 [ 161.591362][ T5544] worker_thread+0xa47/0xfb0 [ 161.591372][ T5544] kthread+0x38b/0x480 [ 161.591403][ T5544] ret_from_fork+0x514/0xb70 [ 161.591411][ T5544] ret_from_fork_asm+0x1a/0x30 [ 161.591418][ T5544] [ 161.591421][ T5544] The buggy address belongs to the object at ffff888013482000 [ 161.591421][ T5544] which belongs to the cache kmalloc-2k of size 2048 [ 161.591429][ T5544] The buggy address is located 224 bytes inside of [ 161.591429][ T5544] freed 2048-byte region [ffff888013482000, ffff888013482800) [ 161.591439][ T5544] [ 161.591442][ T5544] The buggy address belongs to the physical page: [ 161.591449][ T5544] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13480 [ 161.591496][ T5544] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 161.591506][ T5544] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 161.591516][ T5544] page_type: f5(slab) [ 161.591525][ T5544] raw: 00fff00000000040 ffff88801c042000 dead000000000100 dead000000000122 [ 161.591533][ T5544] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 161.591540][ T5544] head: 00fff00000000040 ffff88801c042000 dead000000000100 dead000000000122 [ 161.591547][ T5544] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 161.591554][ T5544] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 161.591561][ T5544] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 161.591565][ T5544] page dumped because: kasan: bad access detected [ 161.591570][ T5544] page_owner tracks the page as allocated [ 161.591592][ T5544] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5314, tgid 5314 (syz-executor), ts 121890220655 [ 161.591607][ T5544] post_alloc_hook+0x1f9/0x250 [ 161.591628][ T5544] get_page_from_freelist+0x2209/0x2280 [ 161.591636][ T5544] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 161.591647][ T5544] allocate_slab+0x7d/0x620 [ 161.591656][ T5544] refill_objects+0x2d5/0x350 [ 161.591667][ T5544] __pcs_replace_empty_main+0x2c8/0x6c0 [ 161.591678][ T5544] __kmalloc_cache_noprof+0x39b/0x600 [ 161.591687][ T5544] rxrpc_alloc_connection+0x7b/0x590 [ 161.591699][ T5544] rxrpc_prealloc_service_connection+0x26/0x300 [ 161.591711][ T5544] rxrpc_service_prealloc_one+0x2d6/0xe10 [ 161.591726][ T5544] rxrpc_kernel_charge_accept+0xc7/0x120 [ 161.591738][ T5544] afs_charge_preallocation+0x3ec/0x570 [ 161.591750][ T5544] afs_open_socket+0x33c/0x3f0 [ 161.591760][ T5544] afs_net_init+0x67d/0x880 [ 161.591770][ T5544] ops_init+0x35d/0x5d0 [ 161.591787][ T5544] setup_net+0x118/0x350 [ 161.591797][ T5544] page last free pid 5295 tgid 5295 ts 112176681398 stack trace: [ 161.591804][ T5544] free_unref_folios+0xdc2/0x14e0 [ 161.591815][ T5544] folios_put_refs+0x9e9/0xb30 [ 161.591843][ T5544] free_pages_and_swap_cache+0x2ba/0x490 [ 161.591855][ T5544] tlb_flush_mmu+0x6d3/0xa30 [ 161.591862][ T5544] tlb_finish_mmu+0xf4/0x220 [ 161.591869][ T5544] unmap_region+0x2a5/0x330 [ 161.591877][ T5544] vms_complete_munmap_vmas+0x427/0xbe0 [ 161.591885][ T5544] do_vmi_align_munmap+0x3b7/0x4b0 [ 161.591893][ T5544] do_vmi_munmap+0x252/0x2d0 [ 161.591903][ T5544] __vm_munmap+0x241/0x3e0 [ 161.591914][ T5544] __x64_sys_munmap+0x60/0x70 [ 161.591926][ T5544] do_syscall_64+0x166/0x520 [ 161.591936][ T5544] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.591946][ T5544] [ 161.591948][ T5544] Memory state around the buggy address: [ 161.591980][ T5544] ffff888013481f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 161.591986][ T5544] ffff888013482000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 161.592002][ T5544] >ffff888013482080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 161.592007][ T5544] ^ [ 161.592011][ T5544] ffff888013482100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 161.592017][ T5544] ffff888013482180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 161.592021][ T5544] ================================================================== [ 162.233786][ T10] Added buffer head 0 to ffff888036059800 [ 162.233915][ T10] Added buffer head 1 to ffff888036059800 [ 162.234957][ C0] virtqueue callback for ffff888036059800 (ffffffff86307020) [ 162.235130][ T5544] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 162.256550][ T5544] CPU: 0 UID: 0 PID: 5544 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 162.262076][ T5544] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 162.267987][ T5544] Call Trace: [ 162.269397][ T5544] [ 162.270618][ T5544] vpanic+0x56d/0xa60 [ 162.272264][ T5544] ? __pfx_vpanic+0x10/0x10 [ 162.274573][ T5544] panic+0xc5/0xd0 [ 162.276599][ T5544] ? __pfx_panic+0x10/0x10 [ 162.278811][ T5544] ? preempt_schedule_thunk+0x16/0x40 [ 162.282031][ T5544] ? dev_driver_string+0x35/0xd0 [ 162.284879][ T5544] ? preempt_schedule_thunk+0x16/0x40 [ 162.287653][ T5544] ? dev_driver_string+0x35/0xd0 [ 162.291767][ T5544] check_panic_on_warn+0x89/0xb0 [ 162.294725][ T5544] ? dev_driver_string+0x35/0xd0 [ 162.301031][ T5544] end_report+0x73/0x170 [ 162.303739][ T5544] ? dev_driver_string+0x35/0xd0 [ 162.305739][ T5544] kasan_report+0x128/0x150 [ 162.307517][ T5544] ? dev_driver_string+0x35/0xd0 [ 162.310012][ T5544] dev_driver_string+0x35/0xd0 [ 162.312782][ T5544] __dynamic_dev_dbg+0x1ae/0x2e0 [ 162.315637][ T5544] ? __mutex_lock+0x30a/0x15a0 [ 162.322684][ T5544] ? __pfx___dynamic_dev_dbg+0x10/0x10 [ 162.326418][ T5544] ? __pfx_ima_file_free+0x10/0x10 [ 162.329477][ T5544] ? __asan_memset+0x22/0x50 [ 162.332857][ T5544] ? __fsnotify_parent+0x267/0x620 [ 162.337402][ T5544] ? display_close+0x4b/0x240 [ 162.341667][ T5544] display_close+0x1f9/0x240 [ 162.344918][ T5544] ? __pfx_display_close+0x10/0x10 [ 162.347996][ T5544] __fput+0x40d/0xa50 [ 162.350171][ T5544] fput_close_sync+0x11f/0x240 [ 162.352202][ T5544] ? __pfx_fput_close_sync+0x10/0x10 [ 162.354823][ T5544] filp_close_sync+0x6e/0xa0 [ 162.359195][ T5544] __se_sys_close_range+0xa77/0xef0 [ 162.362232][ T5544] ? __pfx___se_sys_close_range+0x10/0x10 [ 162.366755][ T5544] do_syscall_64+0x166/0x520 [ 162.369919][ T5544] ? trace_irq_disable+0x3b/0x140 [ 162.372554][ T5544] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 162.375098][ T5544] ? clear_bhb_loop+0x70/0xc0 [ 162.377079][ T5544] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 162.379528][ T5544] RIP: 0033:0x7f0e0139f559 [ 162.381394][ T5544] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 162.394352][ T5544] RSP: 002b:00007ffd65588368 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 162.399881][ T5544] RAX: ffffffffffffffda RBX: 00007ffd65588450 RCX: 00007f0e0139f559 [ 162.404823][ T5544] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 162.409441][ T5544] RBP: 000000000002674e R08: 0000000000000001 R09: 0000000000000000 [ 162.414005][ T5544] R10: 0000001b32620000 R11: 0000000000000246 R12: 0000000000000000 [ 162.418789][ T5544] R13: 00007f0e01625fac R14: 00007f0e01625fa8 R15: 00007f0e01625fa0 [ 162.423623][ T5544] [ 162.426193][ T5544] Kernel Offset: disabled [ 162.429638][ T5544] Rebooting in 86400 seconds.. VM DIAGNOSIS: 21:03:48 Registers: info registers vcpu 0 CPU#0 RAX=1ffffffff37ab660 RBX=00000000000003fd RCX=0000000000000000 RDX=00000000000003fd RSI=0000000000000000 RDI=0000000000000020 RBP=dffffc0000000000 RSP=ffffc900003478b8 R8 =0000000000000003 R9 =0000000000000004 R10=dffffc0000000000 R11=ffffffff8576b3b0 R12=dffffc0000000000 R13=0000000000000000 R14=ffffffff9bd5b220 R15=0000000000000000 RIP=ffffffff8576b427 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88808b0b0000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000560586550bc8 CR3=000000004103a000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000008000100 Opmask01=0000000000000000 Opmask02=00000000ffffffef Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 307a79732f74656e 2f70756f7267637a ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffd655886f6 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffd655886f6 00007ffd655886fc ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f0e0143714a ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f0e01437184 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f0e014372e8 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f0e01437176 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6379656b00657461 69746e6174736e69 246c746379656b00 7974697275636573 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000