Warning: Permanently added '10.128.0.110' (ED25519) to the list of known hosts.
2026/10/10 14:14:06 parsed 1 programs
2026/10/10 14:14:06 serving rpc on tcp://45861
[ 77.032403][ T5628] cgroup: Unknown subsys name 'net'
[ 77.140782][ T5628] cgroup: Unknown subsys name 'cpuset'
[ 77.143479][ T5628] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 78.576339][ T5628] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 81.298983][ T5642] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 81.300073][ T5642] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 81.300676][ T5642] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 81.301657][ T5642] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 81.302225][ T5642] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 81.460835][ T5641] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 81.464471][ T5641] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 81.466707][ T5641] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 81.468168][ T5641] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 81.515481][ T5641] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 83.581724][ T5683] bridge0: port 1(bridge_slave_0) entered blocking state
[ 83.582243][ T5683] bridge0: port 1(bridge_slave_0) entered disabled state
[ 83.582338][ T5683] bridge_slave_0: entered allmulticast mode
[ 83.583370][ T5683] bridge_slave_0: entered promiscuous mode
[ 83.589175][ T5683] bridge0: port 2(bridge_slave_1) entered blocking state
[ 83.589352][ T5683] bridge0: port 2(bridge_slave_1) entered disabled state
[ 83.589489][ T5683] bridge_slave_1: entered allmulticast mode
[ 83.591266][ T5683] bridge_slave_1: entered promiscuous mode
[ 83.627545][ T5683] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 83.630872][ T5683] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 83.662967][ T5683] team0: Port device team_slave_0 added
[ 83.665175][ T5683] team0: Port device team_slave_1 added
[ 83.688241][ T5683] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 83.688258][ T5683] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 83.688281][ T5683] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 83.690402][ T5683] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 83.690418][ T5683] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 83.690441][ T5683] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 83.743828][ T5683] hsr_slave_0: entered promiscuous mode
[ 83.745014][ T5683] hsr_slave_1: entered promiscuous mode
[ 83.911119][ T5683] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 83.918248][ T5683] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 83.919213][ T5683] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 83.930711][ T5683] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 83.948653][ T5683] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 83.951381][ T5683] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 83.952710][ T5683] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 83.955684][ T5683] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 83.995608][ T5683] bridge0: port 2(bridge_slave_1) entered blocking state
[ 83.995680][ T5683] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 83.996035][ T5683] bridge0: port 1(bridge_slave_0) entered blocking state
[ 83.996099][ T5683] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 84.067271][ T5683] 8021q: adding VLAN 0 to HW filter on device bond0
[ 84.085899][ T59] bridge0: port 1(bridge_slave_0) entered disabled state
[ 84.087387][ T59] bridge0: port 2(bridge_slave_1) entered disabled state
[ 84.110590][ T5683] 8021q: adding VLAN 0 to HW filter on device team0
[ 84.117418][ T12] bridge0: port 1(bridge_slave_0) entered blocking state
[ 84.117531][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 84.125350][ T59] bridge0: port 2(bridge_slave_1) entered blocking state
[ 84.125458][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 84.439377][ T5683] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 84.486009][ T5683] veth0_vlan: entered promiscuous mode
[ 84.500885][ T5683] veth1_vlan: entered promiscuous mode
[ 84.532292][ T5683] veth0_macvtap: entered promiscuous mode
[ 84.536390][ T5683] veth1_macvtap: entered promiscuous mode
[ 84.554310][ T5683] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 84.560739][ T5683] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 84.628320][ T59] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 84.628366][ T59] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 84.628398][ T59] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 84.628428][ T59] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 84.745630][ T59] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 84.839225][ T59] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 84.908535][ T59] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 85.010844][ T59] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 85.706420][ T172] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 85.706446][ T172] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 85.750789][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 85.750812][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
2026/10/10 14:14:18 executed programs: 0
[ 86.425142][ T4934] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 86.426176][ T4934] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 86.426665][ T4934] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 86.436625][ T4934] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 86.445103][ T4934] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 86.762993][ T942] cfg80211: failed to load regulatory.db
[ 86.853088][ T5756] bridge0: port 1(bridge_slave_0) entered blocking state
[ 86.853198][ T5756] bridge0: port 1(bridge_slave_0) entered disabled state
[ 86.853278][ T5756] bridge_slave_0: entered allmulticast mode
[ 86.854291][ T5756] bridge_slave_0: entered promiscuous mode
[ 86.858396][ T5756] bridge0: port 2(bridge_slave_1) entered blocking state
[ 86.858569][ T5756] bridge0: port 2(bridge_slave_1) entered disabled state
[ 86.858997][ T5756] bridge_slave_1: entered allmulticast mode
[ 86.860728][ T5756] bridge_slave_1: entered promiscuous mode
[ 86.914685][ T5756] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 86.917724][ T5756] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 86.944314][ T5756] team0: Port device team_slave_0 added
[ 86.946187][ T5756] team0: Port device team_slave_1 added
[ 86.969562][ T5756] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 86.969579][ T5756] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 86.969602][ T5756] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 86.971261][ T5756] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 86.971274][ T5756] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 86.971298][ T5756] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 87.015865][ T5756] hsr_slave_0: entered promiscuous mode
[ 87.017055][ T5756] hsr_slave_1: entered promiscuous mode
[ 87.020219][ T5756] debugfs: 'hsr0' already exists in 'hsr'
[ 87.020306][ T5756] Cannot create hsr debugfs directory
[ 87.296312][ T59] bridge_slave_1: left allmulticast mode
[ 87.296455][ T59] bridge_slave_1: left promiscuous mode
[ 87.297486][ T59] bridge0: port 2(bridge_slave_1) entered disabled state
[ 87.321494][ T59] bridge_slave_0: left allmulticast mode
[ 87.321513][ T59] bridge_slave_0: left promiscuous mode
[ 87.321671][ T59] bridge0: port 1(bridge_slave_0) entered disabled state
[ 87.451648][ T59] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 87.456316][ T59] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 87.459233][ T59] bond0 (unregistering): Released all slaves
[ 87.563118][ T59] hsr_slave_0: left promiscuous mode
[ 87.563932][ T59] hsr_slave_1: left promiscuous mode
[ 87.564953][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 87.564982][ T59] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 87.566128][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 87.566147][ T59] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 87.582596][ T59] veth1_macvtap: left promiscuous mode
[ 87.582652][ T59] veth0_macvtap: left promiscuous mode
[ 87.582753][ T59] veth1_vlan: left promiscuous mode
[ 87.582838][ T59] veth0_vlan: left promiscuous mode
[ 87.923401][ T59] team0 (unregistering): Port device team_slave_1 removed
[ 87.949714][ T59] team0 (unregistering): Port device team_slave_0 removed
[ 88.118572][ T5278] 8021q: adding VLAN 0 to HW filter on device eth1
[ 88.519488][ T4934] Bluetooth: hci0: command tx timeout
[ 89.001148][ T5756] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 89.033053][ T5756] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 89.046874][ T5756] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 89.086344][ T5756] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 89.098686][ T5756] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 89.120693][ T5756] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 89.190362][ T5756] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 89.194310][ T5756] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 89.468534][ T5756] 8021q: adding VLAN 0 to HW filter on device bond0
[ 89.513084][ T5756] 8021q: adding VLAN 0 to HW filter on device team0
[ 89.529736][ T12] bridge0: port 1(bridge_slave_0) entered blocking state
[ 89.530661][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 89.536447][ T12] bridge0: port 2(bridge_slave_1) entered blocking state
[ 89.536565][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 90.168812][ T5756] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 90.233251][ T5756] veth0_vlan: entered promiscuous mode
[ 90.249210][ T5756] veth1_vlan: entered promiscuous mode
[ 90.287728][ T5756] veth0_macvtap: entered promiscuous mode
[ 90.293411][ T5756] veth1_macvtap: entered promiscuous mode
[ 90.312033][ T5756] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 90.323736][ T5756] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 90.391889][ T59] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 90.392240][ T59] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 90.392280][ T59] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 90.444539][ T172] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 90.444562][ T172] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 90.459818][ T172] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 90.494895][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 90.494918][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 90.597509][ T4934] Bluetooth: hci0: command tx timeout
[ 90.828130][ T9] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 90.978483][ T9] usb 1-1: Using ep0 maxpacket: 32
[ 90.981320][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short
[ 90.981434][ T9] usb 1-1: New USB device found, idVendor=1f71, idProduct=3306, bcdDevice=2a.c0
[ 90.983097][ T9] usb 1-1: config 3 has an invalid interface number: 223 but max is 1
[ 90.983121][ T9] usb 1-1: config 3 has an invalid interface number: 25 but max is 1
[ 90.983139][ T9] usb 1-1: config 3 has an invalid interface number: 223 but max is 1
[ 90.983156][ T9] usb 1-1: config 3 has no interface number 0
[ 90.983171][ T9] usb 1-1: config 3 has no interface number 1
[ 90.983223][ T9] usb 1-1: config 3 interface 25 altsetting 6 has an invalid descriptor for endpoint zero, skipping
[ 90.983233][ T9] usb 1-1: config 3 interface 25 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 5
[ 90.983246][ T9] usb 1-1: too many endpoints for config 3 interface 223 altsetting 155: 82, using maximum allowed: 30
[ 90.983264][ T9] usb 1-1: config 3 interface 223 altsetting 155 endpoint 0xD has invalid maxpacket 512, setting to 64
[ 90.983278][ T9] usb 1-1: config 3 interface 223 altsetting 155 endpoint 0x8 has invalid maxpacket 512, setting to 64
[ 90.983290][ T9] usb 1-1: config 3 interface 223 altsetting 155 has 4 endpoint descriptors, different from the interface descriptor's value: 82
[ 90.983302][ T9] usb 1-1: config 3 interface 223 has no altsetting 1
[ 90.983311][ T9] usb 1-1: config 3 interface 25 has no altsetting 0
[ 90.985176][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 90.985199][ T9] usb 1-1: Product: syz
[ 90.985212][ T9] usb 1-1: Manufacturer: syz
[ 90.985225][ T9] usb 1-1: SerialNumber: syz
[ 91.267937][ T9] usbtv 1-1:3.223: Fushicai USBTV007 Audio-Video Grabber
[ 91.283586][ T9] usb 1-1: USB disconnect, device number 2
[ 91.418374][ T9]
[ 91.420780][ T9] =========================
[ 91.425400][ T9] WARNING: held lock freed!
[ 91.429900][ T9] syzkaller #0 Not tainted
[ 91.434314][ T9] -------------------------
[ 91.438820][ T9] kworker/0:0/9 is freeing memory ffff888035377000-ffff8880353777ff, with a lock still held there!
[ 91.449654][ T9] ffff8880353771a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880
[ 91.460026][ T9] locks held by kworker/0:0/9: 5, last CPU#0:
[ 91.466411][ T9] #0: ffff888021ed5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[ 91.478327][ T9] #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[ 91.490678][ T9] #2: ffff88802b3511d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30
[ 91.500431][ T9] #3: ffff8880355781d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xfc/0x9a0
[ 91.510189][ T9] #4: ffff8880353771a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880
[ 91.521069][ T9]
[ 91.521069][ T9] stack backtrace:
[ 91.527930][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full)
[ 91.537481][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 91.547549][ T9] Workqueue: usb_hub_wq hub_event
[ 91.552618][ T9] Call Trace:
[ 91.556173][ T9]
[ 91.559103][ T9] dump_stack_lvl+0xe8/0x150
[ 91.563788][ T9] debug_check_no_locks_freed+0x149/0x170
[ 91.569787][ T9] kfree+0x12b/0x650
[ 91.573808][ T9] ? device_release+0xc4/0x1f0
[ 91.578597][ T9] ? __pfx_usb_release_interface+0x10/0x10
[ 91.585106][ T9] device_release+0xc4/0x1f0
[ 91.589711][ T9] kobject_put+0x222/0x550
[ 91.594207][ T9] v4l2_device_disconnect+0x79/0xd0
[ 91.599414][ T9] usbtv_video_free+0x25/0x30
[ 91.604147][ T9] usbtv_disconnect+0x5c/0xa0
[ 91.608841][ T9] usb_unbind_interface+0x295/0x9f0
[ 91.614032][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 91.619740][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 91.625448][ T9] ? __pfx_usb_unbind_interface+0x10/0x10
[ 91.631150][ T9] device_release_driver_internal+0x4f5/0x880
[ 91.637227][ T9] bus_remove_device+0x444/0x560
[ 91.642163][ T9] ? __pfx_bus_remove_device+0x10/0x10
[ 91.647656][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 91.653467][ T9] device_del+0x524/0x8f0
[ 91.657825][ T9] ? __pfx_device_del+0x10/0x10
[ 91.662691][ T9] ? __pfx___mutex_lock+0x10/0x10
[ 91.667707][ T9] usb_disable_device+0x3d4/0x8d0
[ 91.672726][ T9] usb_disconnect+0x346/0x9a0
[ 91.677398][ T9] hub_event+0x1bbb/0x4d30
[ 91.682172][ T9] ? do_raw_spin_unlock+0xf5/0x200
[ 91.687654][ T9] ? register_lock_class+0x31/0x2e0
[ 91.692871][ T9] ? __pfx_hub_event+0x10/0x10
[ 91.697737][ T9] ? rcu_is_watching+0x16/0xb0
[ 91.702502][ T9] ? process_scheduled_works+0x97a/0x1630
[ 91.708401][ T9] process_scheduled_works+0xc3d/0x1630
[ 91.713959][ T9] ? __pfx_process_scheduled_works+0x10/0x10
[ 91.719954][ T9] ? assign_work+0x3cf/0x5d0
[ 91.724905][ T9] worker_thread+0xa47/0xfb0
[ 91.729513][ T9] kthread+0x38b/0x480
[ 91.734014][ T9] ? __pfx_worker_thread+0x10/0x10
[ 91.739227][ T9] ? __pfx_kthread+0x10/0x10
[ 91.743943][ T9] ret_from_fork+0x514/0xb70
[ 91.748645][ T9] ? __pfx_ret_from_fork+0x10/0x10
[ 91.753756][ T9] ? __switch_to+0xc89/0x1420
[ 91.758439][ T9] ? __pfx_kthread+0x10/0x10
[ 91.763037][ T9] ret_from_fork_asm+0x1a/0x30
[ 91.767806][ T9]
[ 91.773224][ T9] ==================================================================
[ 91.773239][ T9] BUG: KASAN: slab-use-after-free in usb_unbind_interface+0x2c2/0x9f0
[ 91.773264][ T9] Read of size 8 at addr ffff888035377008 by task kworker/0:0/9
[ 91.773279][ T9]
[ 91.773289][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full)
[ 91.773309][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 91.773321][ T9] Workqueue: usb_hub_wq hub_event
[ 91.773348][ T9] Call Trace:
[ 91.773355][ T9]
[ 91.773362][ T9] dump_stack_lvl+0xe8/0x150
[ 91.773387][ T9] print_address_description+0x55/0x1e0
[ 91.773411][ T9] ? usb_unbind_interface+0x2c2/0x9f0
[ 91.773428][ T9] print_report+0x58/0x70
[ 91.773451][ T9] kasan_report+0x117/0x150
[ 91.773482][ T9] ? usb_unbind_interface+0x2c2/0x9f0
[ 91.773503][ T9] usb_unbind_interface+0x2c2/0x9f0
[ 91.773523][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 91.773548][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 91.773571][ T9] ? __pfx_usb_unbind_interface+0x10/0x10
[ 91.773588][ T9] device_release_driver_internal+0x4f5/0x880
[ 91.773619][ T9] bus_remove_device+0x444/0x560
[ 91.773641][ T9] ? __pfx_bus_remove_device+0x10/0x10
[ 91.773664][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 91.773690][ T9] device_del+0x524/0x8f0
[ 91.773717][ T9] ? __pfx_device_del+0x10/0x10
[ 91.773740][ T9] ? __pfx___mutex_lock+0x10/0x10
[ 91.773765][ T9] usb_disable_device+0x3d4/0x8d0
[ 91.773794][ T9] usb_disconnect+0x346/0x9a0
[ 91.773818][ T9] hub_event+0x1bbb/0x4d30
[ 91.773842][ T9] ? do_raw_spin_unlock+0xf5/0x200
[ 91.773881][ T9] ? register_lock_class+0x31/0x2e0
[ 91.773913][ T9] ? __pfx_hub_event+0x10/0x10
[ 91.773943][ T9] ? rcu_is_watching+0x16/0xb0
[ 91.773967][ T9] ? process_scheduled_works+0x97a/0x1630
[ 91.773992][ T9] process_scheduled_works+0xc3d/0x1630
[ 91.774027][ T9] ? __pfx_process_scheduled_works+0x10/0x10
[ 91.774053][ T9] ? assign_work+0x3cf/0x5d0
[ 91.774077][ T9] worker_thread+0xa47/0xfb0
[ 91.774111][ T9] kthread+0x38b/0x480
[ 91.774128][ T9] ? __pfx_worker_thread+0x10/0x10
[ 91.774148][ T9] ? __pfx_kthread+0x10/0x10
[ 91.774163][ T9] ret_from_fork+0x514/0xb70
[ 91.774179][ T9] ? __pfx_ret_from_fork+0x10/0x10
[ 91.774193][ T9] ? __switch_to+0xc89/0x1420
[ 91.774214][ T9] ? __pfx_kthread+0x10/0x10
[ 91.774229][ T9] ret_from_fork_asm+0x1a/0x30
[ 91.774248][ T9]
[ 91.774254][ T9]
[ 91.774258][ T9] Allocated by task 9:
[ 91.774265][ T9] kasan_save_track+0x3e/0x80
[ 91.774282][ T9] __kasan_kmalloc+0x93/0xb0
[ 91.774299][ T9] __kmalloc_cache_noprof+0x321/0x600
[ 91.774315][ T9] usb_set_configuration+0x3c5/0x2260
[ 91.774336][ T9] usb_generic_driver_probe+0x8d/0x150
[ 91.774356][ T9] usb_probe_device+0x1c3/0x3b0
[ 91.774369][ T9] really_probe+0x254/0xae0
[ 91.774389][ T9] __driver_probe_device+0x1e8/0x360
[ 91.774408][ T9] driver_probe_device+0x4f/0x240
[ 91.774428][ T9] __device_attach_driver+0x270/0x410
[ 91.774448][ T9] bus_for_each_drv+0x258/0x2f0
[ 91.774463][ T9] __device_attach+0x2c4/0x450
[ 91.774481][ T9] device_initial_probe+0xa1/0xd0
[ 91.774501][ T9] bus_probe_device+0x12a/0x220
[ 91.774515][ T9] device_add+0x7d7/0xb80
[ 91.774532][ T9] usb_new_device+0x9aa/0x1690
[ 91.774549][ T9] hub_event+0x28e8/0x4d30
[ 91.774567][ T9] process_scheduled_works+0xc3d/0x1630
[ 91.774585][ T9] worker_thread+0xa47/0xfb0
[ 91.774604][ T9] kthread+0x38b/0x480
[ 91.774616][ T9] ret_from_fork+0x514/0xb70
[ 91.774628][ T9] ret_from_fork_asm+0x1a/0x30
[ 91.774640][ T9]
[ 91.774643][ T9] Freed by task 9:
[ 91.774650][ T9] kasan_save_track+0x3e/0x80
[ 91.774666][ T9] kasan_save_free_info+0x40/0x50
[ 91.774679][ T9] __kasan_slab_free+0x5c/0x80
[ 91.774695][ T9] kfree+0x1c5/0x650
[ 91.774707][ T9] device_release+0xc4/0x1f0
[ 91.774720][ T9] kobject_put+0x222/0x550
[ 91.774738][ T9] v4l2_device_disconnect+0x79/0xd0
[ 91.774753][ T9] usbtv_video_free+0x25/0x30
[ 91.774766][ T9] usbtv_disconnect+0x5c/0xa0
[ 91.774779][ T9] usb_unbind_interface+0x295/0x9f0
[ 91.774791][ T9] device_release_driver_internal+0x4f5/0x880
[ 91.774812][ T9] bus_remove_device+0x444/0x560
[ 91.774827][ T9] device_del+0x524/0x8f0
[ 91.774844][ T9] usb_disable_device+0x3d4/0x8d0
[ 91.774869][ T9] usb_disconnect+0x346/0x9a0
[ 91.774885][ T9] hub_event+0x1bbb/0x4d30
[ 91.774904][ T9] process_scheduled_works+0xc3d/0x1630
[ 91.774922][ T9] worker_thread+0xa47/0xfb0
[ 91.774939][ T9] kthread+0x38b/0x480
[ 91.774952][ T9] ret_from_fork+0x514/0xb70
[ 91.774964][ T9] ret_from_fork_asm+0x1a/0x30
[ 91.774975][ T9]
[ 91.774979][ T9] The buggy address belongs to the object at ffff888035377000
[ 91.774979][ T9] which belongs to the cache kmalloc-2k of size 2048
[ 91.774992][ T9] The buggy address is located 8 bytes inside of
[ 91.774992][ T9] freed 2048-byte region [ffff888035377000, ffff888035377800)
[ 91.775008][ T9]
[ 91.775011][ T9] The buggy address belongs to the physical page:
[ 91.775028][ T9] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x35370
[ 91.775043][ T9] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 91.775056][ T9] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 91.775074][ T9] page_type: f5(slab)
[ 91.775088][ T9] raw: 00fff00000000040 ffff88801c042000 dead000000000100 dead000000000122
[ 91.775101][ T9] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 91.775115][ T9] head: 00fff00000000040 ffff88801c042000 dead000000000100 dead000000000122
[ 91.775127][ T9] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 91.775140][ T9] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 91.775152][ T9] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 91.775160][ T9] page dumped because: kasan: bad access detected
[ 91.775172][ T9] page_owner tracks the page as allocated
[ 91.775178][ T9] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 59, tgid 59 (kworker/u8:4), ts 90839021176
[ 91.775202][ T9] post_alloc_hook+0x1f9/0x250
[ 91.775217][ T9] get_page_from_freelist+0x2209/0x2280
[ 91.775235][ T9] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 91.775252][ T9] allocate_slab+0x7d/0x620
[ 91.775271][ T9] refill_objects+0x2d5/0x350
[ 91.775291][ T9] __pcs_replace_empty_main+0x2c8/0x6c0
[ 91.775310][ T9] __kmalloc_node_track_caller_noprof+0x548/0x720
[ 91.775326][ T9] __alloc_skb+0x2c1/0x7a0
[ 91.775338][ T9] mld_newpack+0x165/0xcb0
[ 91.775352][ T9] add_grec+0x119f/0x19d0
[ 91.775365][ T9] mld_send_initial_cr+0x288/0x550
[ 91.775385][ T9] ipv6_mc_dad_complete+0x87/0x410
[ 91.775405][ T9] addrconf_dad_completed+0x8af/0xe60
[ 91.775426][ T9] addrconf_dad_work+0xcf8/0x15c0
[ 91.775445][ T9] process_scheduled_works+0xc3d/0x1630
[ 91.775463][ T9] worker_thread+0xa47/0xfb0
[ 91.775482][ T9] page last free pid 990 tgid 990 ts 90797855715 stack trace:
[ 91.775494][ T9] __free_frozen_pages+0xc93/0xd90
[ 91.775509][ T9] __slab_free+0x274/0x2c0
[ 91.775526][ T9] qlist_free_all+0x99/0x100
[ 91.775544][ T9] kasan_quarantine_reduce+0x148/0x160
[ 91.775563][ T9] __kasan_slab_alloc+0x22/0x80
[ 91.775583][ T9] __kmalloc_cache_noprof+0x29f/0x600
[ 91.775601][ T9] nsim_fib_event+0x4c8/0xa3a0
[ 91.775622][ T9] nsim_fib_event_work+0x244/0x3b0
[ 91.775641][ T9] process_scheduled_works+0xc3d/0x1630
[ 91.775662][ T9] worker_thread+0xa47/0xfb0
[ 91.775685][ T9] kthread+0x38b/0x480
[ 91.775700][ T9] ret_from_fork+0x514/0xb70
[ 91.775716][ T9] ret_from_fork_asm+0x1a/0x30
[ 91.775731][ T9]
[ 91.775735][ T9] Memory state around the buggy address:
[ 91.775745][ T9] ffff888035376f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 91.775758][ T9] ffff888035376f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 91.775770][ T9] >ffff888035377000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 91.775779][ T9] ^
[ 91.775788][ T9] ffff888035377080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 91.775799][ T9] ffff888035377100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 91.775808][ T9] ==================================================================
[ 91.775847][ T9] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 92.644074][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full)
[ 92.654174][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 92.664320][ T9] Workqueue: usb_hub_wq hub_event
[ 92.669361][ T9] Call Trace:
[ 92.672636][ T9]
[ 92.675563][ T9] vpanic+0x56d/0xa60
[ 92.679640][ T9] ? rcu_is_watching+0x16/0xb0
[ 92.684431][ T9] ? __pfx_vpanic+0x10/0x10
[ 92.688955][ T9] ? __pfx___schedule+0x10/0x10
[ 92.693813][ T9] panic+0xc5/0xd0
[ 92.697575][ T9] ? __pfx_panic+0x10/0x10
[ 92.701997][ T9] ? preempt_schedule_thunk+0x16/0x40
[ 92.707376][ T9] ? usb_unbind_interface+0x2c2/0x9f0
[ 92.712757][ T9] check_panic_on_warn+0x89/0xb0
[ 92.717699][ T9] ? usb_unbind_interface+0x2c2/0x9f0
[ 92.723092][ T9] end_report+0x73/0x170
[ 92.727347][ T9] ? usb_unbind_interface+0x2c2/0x9f0
[ 92.732721][ T9] kasan_report+0x128/0x150
[ 92.737239][ T9] ? usb_unbind_interface+0x2c2/0x9f0
[ 92.742622][ T9] usb_unbind_interface+0x2c2/0x9f0
[ 92.747817][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 92.753546][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 92.759268][ T9] ? __pfx_usb_unbind_interface+0x10/0x10
[ 92.764987][ T9] device_release_driver_internal+0x4f5/0x880
[ 92.771061][ T9] bus_remove_device+0x444/0x560
[ 92.776089][ T9] ? __pfx_bus_remove_device+0x10/0x10
[ 92.781831][ T9] ? kernfs_remove_by_name_ns+0x101/0x140
[ 92.787566][ T9] device_del+0x524/0x8f0
[ 92.792085][ T9] ? __pfx_device_del+0x10/0x10
[ 92.796950][ T9] ? __pfx___mutex_lock+0x10/0x10
[ 92.802414][ T9] usb_disable_device+0x3d4/0x8d0
[ 92.807448][ T9] usb_disconnect+0x346/0x9a0
[ 92.812403][ T9] hub_event+0x1bbb/0x4d30
[ 92.816838][ T9] ? do_raw_spin_unlock+0xf5/0x200
[ 92.821964][ T9] ? register_lock_class+0x31/0x2e0
[ 92.827183][ T9] ? __pfx_hub_event+0x10/0x10
[ 92.832011][ T9] ? rcu_is_watching+0x16/0xb0
[ 92.837133][ T9] ? process_scheduled_works+0x97a/0x1630
[ 92.842944][ T9] process_scheduled_works+0xc3d/0x1630
[ 92.848851][ T9] ? __pfx_process_scheduled_works+0x10/0x10
[ 92.854858][ T9] ? assign_work+0x3cf/0x5d0
[ 92.859455][ T9] worker_thread+0xa47/0xfb0
[ 92.864166][ T9] kthread+0x38b/0x480
[ 92.868318][ T9] ? __pfx_worker_thread+0x10/0x10
[ 92.873460][ T9] ? __pfx_kthread+0x10/0x10
[ 92.878066][ T9] ret_from_fork+0x514/0xb70
[ 92.882691][ T9] ? __pfx_ret_from_fork+0x10/0x10
[ 92.887801][ T9] ? __switch_to+0xc89/0x1420
[ 92.892515][ T9] ? __pfx_kthread+0x10/0x10
[ 92.897186][ T9] ret_from_fork_asm+0x1a/0x30
[ 92.901950][ T9]
[ 92.905238][ T9] Kernel Offset: disabled
[ 92.909561][ T9] Rebooting in 86400 seconds..