ci2-upstream-fs/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-upstream-fs/syz-executor1301657849 <...> Warning: Permanently added '10.128.1.32' (ED25519) to the list of known hosts. execve("ci2-upstream-fs/syz-executor1301657849", ["ci2-upstream-fs/syz-executor1301657849"], 0x7ffd34ce85e0 /* 10 vars */) = 0 brk(NULL) = 0x55555d434000 brk(0x55555d434d80) = 0x55555d434d80 arch_prctl(ARCH_SET_FS, 0x55555d434400) = 0 set_tid_address(0x55555d4346d0) = 5601 set_robust_list(0x55555d4346e0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-upstream-fs/syz-executor1301657849", 4096) = 44 getrandom("\x6d\x82\x8e\xde\xc4\x82\x85\xe6", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55555d434d80 brk(0x55555d455d80) = 0x55555d455d80 brk(0x55555d456000) = 0x55555d456000 mprotect(0x7ff1f0747000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 mkdir("/syzcgroup", 0777) = 0 mkdir("/syzcgroup/unified", 0777) = 0 mount("none", "/syzcgroup/unified", "cgroup2", 0, NULL) = 0 chmod("/syzcgroup/unified", 0777) = 0 openat(AT_FDCWD, "/syzcgroup/unified/cgroup.subtree_control", O_WRONLY) = 3 write(3, "+cpu", 4) = 4 write(3, "+io", 3) = 3 write(3, "+pids", 5) = 5 close(3) = 0 mkdir("/syzcgroup/net", 0777) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "net") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio") = 0 [ 98.474411][ T5601] cgroup: Unknown subsys name 'net' umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "devices") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "blkio") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "freezer") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = 0 chmod("/syzcgroup/net", 0777) = 0 mkdir("/syzcgroup/cpu", 0777) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "hugetlb") = 0 [ 98.716057][ T5601] cgroup: Unknown subsys name 'cpuset' umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "rlimit") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/cpu", "cgroup", 0, "memory") = 0 umount2("/syzcgroup/cpu", 0) = 0 [ 98.795991][ T5601] cgroup: Unknown subsys name 'rlimit' mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = 0 chmod("/syzcgroup/cpu", 0777) = 0 openat(AT_FDCWD, "/syzcgroup/cpu/cgroup.clone_children", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/syzcgroup/cpu/cpuset.memory_pressure_enabled", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) getrandom("\xf1\x6c\xe8\x44\x66\xd2\xc1\x1d", 8, GRND_NONBLOCK) = 8 mkdir("./syzkaller.PIhmDs", 0700) = 0 chmod("./syzkaller.PIhmDs", 0777) = 0 chdir("./syzkaller.PIhmDs") = 0 unshare(CLONE_NEWPID) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5603 attached , child_tidptr=0x55555d4346d0) = 5603 [pid 5603] set_robust_list(0x55555d4346e0, 24 [pid 5601] rt_sigprocmask(SIG_SETMASK, [] [pid 5603] <... set_robust_list resumed>) = 0 [pid 5603] rt_sigprocmask(SIG_SETMASK, [] [pid 5601] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5603] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5603] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5603] getppid() = 0 [pid 5603] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5603] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5603] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5603] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5603] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5603] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5603] unshare(CLONE_NEWNS) = 0 [pid 5603] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5603] unshare(CLONE_NEWIPC) = 0 [pid 5603] unshare(CLONE_NEWCGROUP) = 0 [pid 5603] unshare(CLONE_NEWUTS) = 0 [pid 5603] unshare(CLONE_SYSVSEM) = 0 [pid 5603] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5603] write(3, "16777216", 8) = 8 [pid 5603] close(3) = 0 [pid 5603] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5603] write(3, "536870912", 9) = 9 [pid 5603] close(3) = 0 [pid 5603] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5603] write(3, "1024", 4) = 4 [pid 5603] close(3) = 0 [pid 5603] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5603] write(3, "8192", 4) = 4 [pid 5603] close(3) = 0 [pid 5603] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5603] write(3, "1024", 4) = 4 [pid 5603] close(3) = 0 [pid 5603] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5603] write(3, "1024", 4) = 4 [pid 5603] close(3) = 0 [pid 5603] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5603] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5603] close(3) = 0 [pid 5603] getpid() = 1 [pid 5603] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5605] set_robust_list(0x55555d4346e0, 24 [pid 5603] <... clone resumed>, child_tidptr=0x55555d4346d0) = 2 [pid 5605] <... set_robust_list resumed>) = 0 [pid 5603] rt_sigprocmask(SIG_SETMASK, [] [pid 5605] rt_sigprocmask(SIG_SETMASK, [] [pid 5603] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5605] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5605] chdir("./0") = 0 [pid 5605] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5605] setpgid(0, 0) = 0 [ 99.281954][ T5603] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [pid 5605] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5605] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5605] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5605] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5605] write(3, "1000", 4) = 4 [pid 5605] close(3) = 0 [pid 5605] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5605] write(1, "executing program\n", 18) = 18 [pid 5605] mkdirat(AT_FDCWD, "./gadget", 0777) = 0 [pid 5605] mount(NULL, "./gadget", "gadgetfs", 0, NULL) = 0 [pid 5605] openat(AT_FDCWD, "./gadget/dummy_udc", O_RDWR|O_NONBLOCK) = 3 [pid 5605] mkdirat(AT_FDCWD, "./cgroup.cpu/test", 03567) = 0 [pid 5605] openat(AT_FDCWD, "./cgroup.cpu/test/memory.limit_in_bytes", O_RDWR) = 4 [pid 5605] write(4, "10", 2) = 2 [pid 5605] openat(AT_FDCWD, "./cgroup.cpu/test/cgroup.procs", O_RDWR) = 5 [pid 5605] write(5, "0", 1) = 1 [ 99.445791][ T5605] syz-executor130 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 99.447307][ T5605] CPU: 0 UID: 0 PID: 5605 Comm: syz-executor130 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 99.447409][ T5605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 99.447467][ T5605] Call Trace: [ 99.447490][ T5605] [ 99.447520][ T5605] dump_stack_lvl+0xe8/0x150 [ 99.447651][ T5605] dump_header+0xd3/0x4b0 [ 99.447738][ T5605] oom_kill_process+0x3ab/0x9e0 [ 99.447844][ T5605] out_of_memory+0x1064/0x1480 [ 99.447974][ T5605] ? __pfx_out_of_memory+0x10/0x10 [ 99.448070][ T5605] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 99.448166][ T5605] ? _mutex_lock_killable+0x152/0x1d0 [ 99.448262][ T5605] ? try_charge_memcg+0xcc3/0x16f0 [ 99.448365][ T5605] try_charge_memcg+0xd82/0x16f0 [ 99.448512][ T5605] ? __pfx_try_charge_memcg+0x10/0x10 [ 99.448641][ T5605] ? percpu_ref_tryget+0x15/0x180 [ 99.448706][ T5605] ? __memcg_slab_post_alloc_hook+0x7d0/0xfe0 [ 99.448831][ T5605] ? __memcg_slab_post_alloc_hook+0x7d0/0xfe0 [ 99.448911][ T5605] ? __memcg_slab_post_alloc_hook+0x7d0/0xfe0 [ 99.448994][ T5605] __memcg_slab_post_alloc_hook+0x968/0xfe0 [ 99.449132][ T5605] ? alloc_inode+0xb8/0x1b0 [ 99.449234][ T5605] kmem_cache_alloc_lru_noprof+0x41c/0x680 [ 99.449307][ T5605] ? alloc_inode+0xb8/0x1b0 [ 99.449391][ T5605] ? alloc_inode+0xb8/0x1b0 [ 99.449495][ T5605] alloc_inode+0xb8/0x1b0 [ 99.449588][ T5605] new_inode+0x1f/0x170 [ 99.449655][ T5605] gadgetfs_bind+0x4b4/0xae0 [ 99.449793][ T5605] ? __pfx_gadgetfs_bind+0x10/0x10 [ 99.449861][ T5605] gadget_bind_driver+0x2ca/0x9e0 [ 99.449968][ T5605] ? __pfx_gadget_bind_driver+0x10/0x10 [ 99.450031][ T5605] really_probe+0x254/0xae0 [ 99.450154][ T5605] __driver ** replaying previous printk message ** [ 99.450154][ T5605] __driver_probe_device+0x1e8/0x360 [ 99.450258][ T5605] driver_probe_device+0x4f/0x240 [ 99.450354][ T5605] __driver_attach+0x339/0x600 [ 99.450450][ T5605] bus_for_each_dev+0x23e/0x2c0 [ 99.450522][ T5605] ? __pfx___driver_attach+0x10/0x10 [ 99.450605][ T5605] ? __pfx_bus_for_each_dev+0x10/0x10 [ 99.450662][ T5605] ? rt_spin_unlock+0x159/0x200 [ 99.450727][ T5605] ? rt_spin_unlock+0x165/0x200 [ 99.450784][ T5605] bus_add_driver+0x348/0x670 [ 99.450869][ T5605] driver_register+0x23a/0x320 [ 99.450933][ T5605] usb_gadget_register_driver_owner+0xf9/0x270 [ 99.451009][ T5605] dev_config+0xe4e/0x12c0 [ 99.451049][ T5605] ? __pfx_dev_config+0x10/0x10 [ 99.451088][ T5605] ? __pfx_dev_config+0x10/0x10 [ 99.451164][ T5605] vfs_write+0x29f/0xbb0 [ 99.451240][ T5605] ? reacquire_held_locks+0x117/0x1a0 [ 99.451344][ T5605] ? __pfx_vfs_write+0x10/0x10 [ 99.451428][ T5605] ? rt_spin_unlock+0x159/0x200 [ 99.451514][ T5605] ? rt_spin_unlock+0x165/0x200 [ 99.451614][ T5605] ksys_write+0x156/0x270 [ 99.451694][ T5605] ? __pfx_ksys_write+0x10/0x10 [ 99.451806][ T5605] do_syscall_64+0x166/0x520 [ 99.451872][ T5605] ? trace_irq_disable+0x3b/0x140 [ 99.451966][ T5605] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.452021][ T5605] ? clear_bhb_loop+0x70/0xc0 [ 99.452094][ T5605] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.452156][ T5605] RIP: 0033:0x7ff1f06b48e9 [ 99.452215][ T5605] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 99.452265][ T5605] RSP: 002b:00007fff13bd37f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 99.452335][ T5605] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007ff1f06b48e9 [ 99.452376][ T5605] RDX: 000000000000001f RSI: 0000200000000400 RDI: 0000000000000003 [ 99.452408][ T5605] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 99.452439][ T5605] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff1f071b042 [ 99.452478][ T5605] R13: 00007fff13bd3830 R14: 00007fff13bd3870 R15: 0000000000000000 [ 99.452531][ T5605] [ 99.454190][ T5605] memory: usage 0kB, limit 0kB, failcnt 19 [ 99.454241][ T5605] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 99.454288][ T5605] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 99.454328][ T5605] Memory cgroup stats for /syz0/test: [ 99.459124][ T5605] cache 0 [ 99.459135][ T5605] rss 0 [ 99.459143][ T5605] shmem 0 [ 99.459161][ T5605] mapped_file 0 [ 99.459170][ T5605] dirty 0 [ 99.459177][ T5605] writeback 0 [ 99.459185][ T5605] workingset_refault_anon 0 [ 99.459194][ T5605] workingset_refault_file 0 [ 99.459203][ T5605] swap 0 [ 99.459211][ T5605] swapcached 0 [ 99.459219][ T5605] pgpgin 0 [ 99.459226][ T5605] pgpgout 0 [ 99.459234][ T5605] pgfault 0 [ 99.459242][ T5605] pgmajfault 0 [ 99.459250][ T5605] inactive_anon 0 [ 99.459258][ T5605] active_anon 0 [ 99.459266][ T5605] inactive_file 0 [ 99.459274][ T5605] active_file 0 [ 99.459282][ T5605] unevictable 0 [ 99.459290][ T5605] hierarchical_memory_limit 0 [ 99.459299][ T5605] hierarchical_memsw_limit 9223372036854771712 [ 99.459309][ T5605] total_cache 0 [ 99.459317][ T5605] total_rss 0 [ 99.459325][ T5605] total_shmem 0 [ 99.459333][ T5605] total_mapped_file 0 [ 99.459341][ T5605] total_dirty 0 [ 99.459349][ T5605] total_writeback 0 [ 99.459358][ T5605] total_workingset_refault_anon 0 [ 99.459367][ T5605] total_workingset_refault_file 0 [ 99.459376][ T5605] total_swap 0 [ 99.459384][ T5605] total_swapcached 0 [ 99.459393][ T5605] total_pgpgin 0 [ 99.459401][ T5605] total_pgpgout 0 [ 99.459409][ T5605] total_pgfault 0 [ 99.459417][ T5605] total_pgmajfault 0 [ 99.459425][ T5605] total_inactive_anon 0 [ 99.459433][ T5605] total_active_anon 0 [ 99.459441][ T5605] total_inactive_file 0 [ 99.459449][ T5605] total_active_file 0 [ 99.459489][ T5605] total_unevictable 0 [ 99.459517][ T5605] anon_cost 0 [ 99.459538][ T5605] file_cost 0 [ 99.459569][ T5605] Tasks state (memory values in pages): [ 99.459591][ T5605] [ pid ] uid tgid total_vm rss rss_anon rss_file rss_shmem pgtables_bytes swapents oom_score_adj name [ 99.459688][ T5605] [ 5605] 0 5605 4360 111 15 96 0 45056 0 1000 syz-executor130 [ 99.459798][ T5605] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz0/test,task_memcg=/syz0/test,task=syz-executor130,pid=5605,uid=0 [ 99.460454][ T5605] Memory cgroup out of memory: Killed process 5605 (syz-executor130) total-vm:17440kB, anon-rss:60kB, file-rss:384kB, shmem-rss:0kB, UID:0 pgtables:44kB oom_score_adj:1000 [ 99.520394][ T5605] udc dummy_udc.0: failed to start USB Gadget filesystem: -12 [ 99.520467][ T5605] gadgetfs gadget.0: probe with driver gadgetfs failed with error -12 [ 99.613700][ T5605] udc dummy_udc.1: failed to start USB Gadget filesystem: -12 [ 99.613783][ T5605] gadgetfs gadget.1: probe with driver gadgetfs failed with error -12 [ 99.617458][ T5605] ================================================================== [ 99.617497][ T5605] BUG: KASAN: slab-use-after-free in gadgetfs_bind+0xd8/0xae0 [ 99.617573][ T5605] Write of size 8 at addr ffff888039a35100 by task syz-executor130/5605 [ 99.617591][ T5605] [ 99.617611][ T5605] CPU: 0 UID: 0 PID: 5605 Comm: syz-executor130 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 99.617685][ T5605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 99.617724][ T5605] Call Trace: [ 99.617756][ T5605] [ 99.617794][ T5605] dump_stack_lvl+0xe8/0x150 [ 99.617896][ T5605] print_address_description+0x55/0x1e0 [ 99.617987][ T5605] ? gadgetfs_bind+0xd8/0xae0 [ 99.618054][ T5605] print_report+0x58/0x70 [ 99.618138][ T5605] kasan_report+0x117/0x150 [ 99.618231][ T5605] ? gadgetfs_bind+0xd8/0xae0 [ 99.618309][ T5605] gadgetfs_bind+0xd8/0xae0 [ 99.618404][ T5605] ? __pfx_gadgetfs_bind+0x10/0x10 [ 99.618473][ T5605] gadget_bind_driver+0x2ca/0x9e0 [ 99.618568][ T5605] ? __pfx_gadget_bind_driver+0x10/0x10 [ 99.618633][ T5605] really_probe+0x254/0xae0 [ 99.618715][ T5605] __driver_probe_device+0x1e8/0x360 [ 99.618807][ T5605] driver_probe_device+0x4f/0x240 [ 99.618894][ T5605] __driver_attach+0x339/0x600 [ 99.618976][ T5605] bus_for_each_dev+0x23e/0x2c0 [ 99.619007][ T5605] ? __pfx___driver_attach+0x10/0x10 [ 99.619066][ T5605] ? __pfx_bus_for_each_dev+0x10/0x10 [ 99.619143][ T5605] ? rt_spin_unlock+0x159/0x200 [ 99.619212][ T5605] ? rt_spin_unlock+0x165/0x200 [ 99.619274][ T5605] bus_add_driver+0x348/0x670 [ 99.619347][ T5605] driver_register+0x23a/0x320 [ 99.619401][ T5605] usb_gadget_register_driver_owner+0xf9/0x270 [ 99.619480][ T5605] dev_config+0xe4e/0x12c0 [ 99.619556][ T5605] ? __pfx_dev_config+0x10/0x10 [ 99.619643][ T5605] ? __pfx_dev_config+0x10/0x10 [ 99.619716][ T5605] vfs_write+0x29f/0xbb0 [ 99.619781][ T5605] ? reacquire_held_locks+0x117/0x1a0 [ 99.619873][ T5605] ? __pfx_vfs_write+0x10/0x10 [ 99.619937][ T5605] ? rt_spin_unlock+0x159/0x200 [ 99.619999][ T5605] ? rt_spin_unlock+0x165/0x200 [ 99.620061][ T5605] ksys_write+0x156/0x270 [ 99.620144][ T5605] ? __pfx_ksys_write+0x10/0x10 [ 99.620221][ T5605] do_syscall_64+0x166/0x520 [ 99.620292][ T5605] ? trace_irq_disable+0x3b/0x140 [ 99.620364][ T5605] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.620419][ T5605] ? clear_bhb_loop+0x70/0xc0 [ 99.620460][ T5605] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.620528][ T5605] RIP: 0033:0x7ff1f06b48e9 [ 99.620593][ T5605] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 99.620637][ T5605] RSP: 002b:00007fff13bd37f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 99.620693][ T5605] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007ff1f06b48e9 [ 99.620729][ T5605] RDX: 000000000000001f RSI: 0000200000000400 RDI: 0000000000000003 [ 99.620756][ T5605] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 99.620787][ T5605] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff1f071b042 [ 99.620828][ T5605] R13: 00007fff13bd3830 R14: 00007fff13bd3870 R15: 0000000000000000 [ 99.620884][ T5605] [ 99.620905][ T5605] [ 99.620922][ T5605] Allocated by task 5603: [ 99.620945][ T5605] kasan_save_track+0x3e/0x80 [ 99.621018][ T5605] __kasan_kmalloc+0x93/0xb0 [ 99.621093][ T5605] __kmalloc_cache_noprof+0x3d5/0x680 [ 99.621175][ T5605] gadgetfs_fill_super+0x27b/0x7a0 [ 99.621245][ T5605] get_tree_single+0xc0/0x150 [ 99.621300][ T5605] vfs_get_tree+0x92/0x2a0 [ 99.621361][ T5605] do_new_mount+0x319/0xdc0 [ 99.621407][ T5605] __se_sys_mount+0x31d/0x420 [ 99.621458][ T5605] do_syscall_64+0x166/0x520 [ 99.621521][ T5605] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.621573][ T5605] [ 99.621585][ T5605] Freed by task 5605: [ 99.621607][ T5605] kasan_save_track+0x3e/0x80 [ 99.621676][ T5605] kasan_save_free_info+0x40/0x50 [ 99.621738][ T5605] __kasan_slab_free+0x5c/0x80 [ 99.621805][ T5605] kfree+0x1c5/0x6d0 [ 99.621867][ T5605] gadgetfs_bind+0x942/0xae0 [ 99.621939][ T5605] gadget_bind_driver+0x2ca/0x9e0 [ 99.621997][ T5605] really_probe+0x254/0xae0 [ 99.622079][ T5605] __driver_probe_device+0x1e8/0x360 [ 99.622124][ T5605] driver_probe_device+0x4f/0x240 [ 99.622198][ T5605] __driver_attach+0x339/0x600 [ 99.622286][ T5605] bus_for_each_dev+0x23e/0x2c0 [ 99.622345][ T5605] bus_add_driver+0x348/0x670 [ 99.622404][ T5605] driver_register+0x23a/0x320 [ 99.622447][ T5605] usb_gadget_register_driver_owner+0xf9/0x270 [ 99.622503][ T5605] dev_config+0xe4e/0x12c0 [ 99.622566][ T5605] vfs_write+0x29f/0xbb0 [ 99.622613][ T5605] ksys_write+0x156/0x270 [ 99.622661][ T5605] do_syscall_64+0x166/0x520 [ 99.622729][ T5605] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.622782][ T5605] [ 99.622794][ T5605] The buggy address belongs to the object at ffff888039a35000 [ 99.622794][ T5605] which belongs to the cache kmalloc-1k of size 1024 [ 99.622843][ T5605] The buggy address is located 256 bytes inside of [ 99.622843][ T5605] freed 1024-byte region [ffff888039a35000, ffff888039a35400) [ 99.622898][ T5605] [ 99.622917][ T5605] The buggy address belongs to the physical page: [ 99.622950][ T5605] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x39a30 [ 99.623003][ T5605] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 99.623046][ T5605] flags: 0x80000000000040(head|node=0|zone=1) [ 99.623090][ T5605] page_type: f5(slab) [ 99.623151][ T5605] raw: 0080000000000040 ffff88813ff00dc0 dead000000000100 dead000000000122 [ 99.623194][ T5605] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 99.623248][ T5605] head: 0080000000000040 ffff88813ff00dc0 dead000000000100 dead000000000122 [ 99.623299][ T5605] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 99.623351][ T5605] head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 99.623394][ T5605] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 99.623425][ T5605] page dumped because: kasan: bad access detected [ 99.623455][ T5605] page_owner tracks the page as allocated [ 99.623475][ T5605] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5603, tgid 5603 (syz-executor130), ts 99116881136 [ 99.623542][ T5605] post_alloc_hook+0x1f9/0x250 [ 99.623575][ T5605] get_page_from_freelist+0x2591/0x2600 [ 99.623670][ T5605] __alloc_frozen_pages_noprof+0x230/0x5c0 [ 99.623759][ T5605] allocate_slab+0x7d/0x620 [ 99.623812][ T5605] refill_objects+0x2d8/0x350 [ 99.623866][ T5605] __pcs_replace_empty_main+0x339/0x690 [ 99.623918][ T5605] __kmalloc_cache_noprof+0x46f/0x680 [ 99.623976][ T5605] afs_alloc_call+0x79/0x580 [ 99.624049][ T5605] afs_charge_preallocation+0x273/0x570 [ 99.624123][ T5605] afs_open_socket+0x33c/0x3f0 [ 99.624197][ T5605] afs_net_init+0x6ce/0x8f0 [ 99.624259][ T5605] ops_init+0x35d/0x5d0 [ 99.624323][ T5605] setup_net+0x118/0x350 [ 99.624384][ T5605] copy_net_ns+0x53b/0x780 [ 99.624446][ T5605] create_new_namespaces+0x3f0/0x6b0 [ 99.624511][ T5605] unshare_nsproxy_namespaces+0x149/0x190 [ 99.624583][ T5605] page last free pid 5603 tgid 5603 ts 99048237162 stack trace: [ 99.624623][ T5605] __free_frozen_pages+0xf8e/0x1070 [ 99.624669][ T5605] __slab_free+0x250/0x2a0 [ 99.624700][ T5605] qlist_free_all+0x99/0x100 [ 99.624724][ T5605] kasan_quarantine_reduce+0x148/0x160 [ 99.624749][ T5605] __kasan_slab_alloc+0x22/0x80 [ 99.624777][ T5605] __kmalloc_noprof+0x3b9/0x790 [ 99.624802][ T5605] ops_init+0x7b/0x5d0 [ 99.624826][ T5605] setup_net+0x118/0x350 [ 99.624848][ T5605] copy_net_ns+0x53b/0x780 [ 99.624871][ T5605] create_new_namespaces+0x3f0/0x6b0 [ 99.624896][ T5605] unshare_nsproxy_namespaces+0x149/0x190 [ 99.624920][ T5605] ksys_unshare+0x5a7/0x950 [ 99.624945][ T5605] __x64_sys_unshare+0x38/0x50 [ 99.624970][ T5605] do_syscall_64+0x166/0x520 [ 99.624991][ T5605] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.625007][ T5605] [ 99.625011][ T5605] Memory state around the buggy address: [ 99.625020][ T5605] ffff888039a35000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 99.625032][ T5605] ffff888039a35080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 99.625044][ T5605] >ffff888039a35100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 99.625053][ T5605] ^ [ 99.625062][ T5605] ffff888039a35180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 99.625073][ T5605] ffff888039a35200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 99.625082][ T5605] ================================================================== [ 99.625169][ T5605] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 100.951143][ T5605] CPU: 0 UID: 0 PID: 5605 Comm: syz-executor130 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 100.961401][ T5605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 100.971474][ T5605] Call Trace: [ 100.974771][ T5605] [ 100.977747][ T5605] vpanic+0x56d/0xa60 [ 100.981754][ T5605] ? rcu_is_watching+0x16/0xb0 [ 100.986557][ T5605] ? __pfx_vpanic+0x10/0x10 [ 100.991089][ T5605] panic+0xc5/0xd0 [ 100.994843][ T5605] ? __pfx_panic+0x10/0x10 [ 100.999278][ T5605] ? preempt_schedule_thunk+0x16/0x40 [ 101.004676][ T5605] ? gadgetfs_bind+0xd8/0xae0 [ 101.009472][ T5605] ? preempt_schedule_thunk+0x16/0x40 [ 101.014866][ T5605] ? gadgetfs_bind+0xd8/0xae0 [ 101.019565][ T5605] check_panic_on_warn+0x89/0xb0 [ 101.024523][ T5605] ? gadgetfs_bind+0xd8/0xae0 [ 101.029219][ T5605] end_report+0x73/0x170 [ 101.033492][ T5605] ? gadgetfs_bind+0xd8/0xae0 [ 101.038191][ T5605] kasan_report+0x128/0x150 [ 101.042726][ T5605] ? gadgetfs_bind+0xd8/0xae0 [ 101.047450][ T5605] gadgetfs_bind+0xd8/0xae0 [ 101.051986][ T5605] ? __pfx_gadgetfs_bind+0x10/0x10 [ 101.057207][ T5605] gadget_bind_driver+0x2ca/0x9e0 [ 101.062261][ T5605] ? __pfx_gadget_bind_driver+0x10/0x10 [ 101.067877][ T5605] really_probe+0x254/0xae0 [ 101.072505][ T5605] __driver_probe_device+0x1e8/0x360 [ 101.077824][ T5605] driver_probe_device+0x4f/0x240 [ 101.082984][ T5605] __driver_attach+0x339/0x600 [ 101.087774][ T5605] bus_for_each_dev+0x23e/0x2c0 [ 101.092660][ T5605] ? __pfx___driver_attach+0x10/0x10 [ 101.098016][ T5605] ? __pfx_bus_for_each_dev+0x10/0x10 [ 101.103408][ T5605] ? rt_spin_unlock+0x159/0x200 [ 101.108279][ T5605] ? rt_spin_unlock+0x165/0x200 [ 101.113143][ T5605] bus_add_driver+0x348/0x670 [ 101.117848][ T5605] driver_register+0x23a/0x320 [ 101.122630][ T5605] usb_gadget_register_driver_owner+0xf9/0x270 [ 101.128812][ T5605] dev_config+0xe4e/0x12c0 [ 101.133257][ T5605] ? __pfx_dev_config+0x10/0x10 [ 101.138235][ T5605] ? __pfx_dev_config+0x10/0x10 [ 101.143115][ T5605] vfs_write+0x29f/0xbb0 [ 101.147389][ T5605] ? reacquire_held_locks+0x117/0x1a0 [ 101.152791][ T5605] ? __pfx_vfs_write+0x10/0x10 [ 101.157577][ T5605] ? rt_spin_unlock+0x159/0x200 [ 101.162445][ T5605] ? rt_spin_unlock+0x165/0x200 [ 101.167345][ T5605] ksys_write+0x156/0x270 [ 101.171706][ T5605] ? __pfx_ksys_write+0x10/0x10 [ 101.176587][ T5605] do_syscall_64+0x166/0x520 [ 101.181209][ T5605] ? trace_irq_disable+0x3b/0x140 [ 101.186260][ T5605] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.192361][ T5605] ? clear_bhb_loop+0x70/0xc0 [ 101.197070][ T5605] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.202994][ T5605] RIP: 0033:0x7ff1f06b48e9 [ 101.207440][ T5605] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 101.227100][ T5605] RSP: 002b:00007fff13bd37f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 101.235537][ T5605] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007ff1f06b48e9 [ 101.243536][ T5605] RDX: 000000000000001f RSI: 0000200000000400 RDI: 0000000000000003 [ 101.251549][ T5605] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 101.259541][ T5605] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff1f071b042 [ 101.267538][ T5605] R13: 00007fff13bd3830 R14: 00007fff13bd3870 R15: 0000000000000000 [ 101.275553][ T5605] [ 101.279188][ T5605] Kernel Offset: disabled [ 101.283523][ T5605] Rebooting in 86400 seconds..