Warning: Permanently added '10.128.1.189' (ED25519) to the list of known hosts.
2026/09/05 21:32:19 parsed 1 programs
2026/09/05 21:32:19 serving rpc on tcp://44455
syzkaller login: [ 78.485675][ T5782] cgroup: Unknown subsys name 'net'
[ 78.623191][ T5782] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 80.075463][ T5782] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 82.622071][ T5831] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 82.630141][ T5831] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 82.638068][ T5831] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 82.646056][ T5831] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 82.656969][ T5831] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 82.664378][ T5831] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 82.903672][ T2961] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 82.917210][ T2961] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 82.950602][ T2975] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 82.958897][ T2975] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 83.667011][ T5847] chnl_net:caif_netlink_parms(): no params data found
[ 83.735558][ T5847] bridge0: port 1(bridge_slave_0) entered blocking state
[ 83.743607][ T5847] bridge0: port 1(bridge_slave_0) entered disabled state
[ 83.750874][ T5847] bridge_slave_0: entered allmulticast mode
[ 83.758219][ T5847] bridge_slave_0: entered promiscuous mode
[ 83.767538][ T5847] bridge0: port 2(bridge_slave_1) entered blocking state
[ 83.774702][ T5847] bridge0: port 2(bridge_slave_1) entered disabled state
[ 83.782080][ T5847] bridge_slave_1: entered allmulticast mode
[ 83.788907][ T5847] bridge_slave_1: entered promiscuous mode
[ 83.823072][ T5847] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 83.834578][ T5847] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 83.860186][ T5847] team0: Port device team_slave_0 added
[ 83.874874][ T5847] team0: Port device team_slave_1 added
[ 83.906219][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 83.915133][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 83.944614][ T5847] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 83.969281][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 83.976368][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 84.002701][ T5847] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 84.051722][ T5847] hsr_slave_0: entered promiscuous mode
[ 84.058757][ T5847] hsr_slave_1: entered promiscuous mode
[ 84.224755][ T5847] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 84.239096][ T5847] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 84.257828][ T5847] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 84.269111][ T5847] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 84.304183][ T5847] bridge0: port 2(bridge_slave_1) entered blocking state
[ 84.311419][ T5847] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 84.319483][ T5847] bridge0: port 1(bridge_slave_0) entered blocking state
[ 84.326570][ T5847] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 84.398929][ T5847] 8021q: adding VLAN 0 to HW filter on device bond0
[ 84.424520][ T2975] bridge0: port 1(bridge_slave_0) entered disabled state
[ 84.434619][ T2975] bridge0: port 2(bridge_slave_1) entered disabled state
[ 84.450052][ T5847] 8021q: adding VLAN 0 to HW filter on device team0
[ 84.464718][ T2961] bridge0: port 1(bridge_slave_0) entered blocking state
[ 84.471924][ T2961] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 84.491940][ T3526] bridge0: port 2(bridge_slave_1) entered blocking state
[ 84.499296][ T3526] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 84.673559][ T5847] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 84.713132][ T5847] veth0_vlan: entered promiscuous mode
[ 84.733297][ T5847] veth1_vlan: entered promiscuous mode
[ 84.767769][ T5847] veth0_macvtap: entered promiscuous mode
[ 84.776399][ T5847] veth1_macvtap: entered promiscuous mode
[ 84.794498][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 84.809147][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 84.823935][ T5847] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 84.832902][ T5847] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 84.842592][ T5847] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 84.851562][ T5847] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 85.192824][ T2913] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2026/09/05 21:32:29 executed programs: 0
[ 86.360124][ T5086] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 86.368268][ T5086] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 86.375954][ T5086] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 86.384873][ T5086] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 86.394312][ T5086] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 86.401716][ T5086] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 86.517050][ T5886] chnl_net:caif_netlink_parms(): no params data found
[ 86.579206][ T5886] bridge0: port 1(bridge_slave_0) entered blocking state
[ 86.586339][ T5886] bridge0: port 1(bridge_slave_0) entered disabled state
[ 86.593917][ T5886] bridge_slave_0: entered allmulticast mode
[ 86.600793][ T5886] bridge_slave_0: entered promiscuous mode
[ 86.608434][ T5886] bridge0: port 2(bridge_slave_1) entered blocking state
[ 86.615504][ T5886] bridge0: port 2(bridge_slave_1) entered disabled state
[ 86.622957][ T5886] bridge_slave_1: entered allmulticast mode
[ 86.629649][ T5886] bridge_slave_1: entered promiscuous mode
[ 86.659883][ T5886] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 86.672330][ T5886] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 86.703603][ T5886] team0: Port device team_slave_0 added
[ 86.711769][ T5886] team0: Port device team_slave_1 added
[ 86.732293][ T5886] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 86.739674][ T5886] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 86.766244][ T5886] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 86.779609][ T5886] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 86.786575][ T5886] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 86.812755][ T5886] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 86.854643][ T5886] hsr_slave_0: entered promiscuous mode
[ 86.860952][ T5886] hsr_slave_1: entered promiscuous mode
[ 86.867890][ T5886] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 86.875737][ T5886] Cannot create hsr debugfs directory
[ 86.911070][ T9] cfg80211: failed to load regulatory.db
[ 87.858091][ T2913] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 88.428037][ T5086] Bluetooth: hci0: command tx timeout
[ 90.129925][ T2913] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 90.180881][ T2913] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 90.509075][ T5086] Bluetooth: hci0: command tx timeout
[ 91.125455][ T5886] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 91.135478][ T5886] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 91.145195][ T5886] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 91.154955][ T5886] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 91.172666][ T2913] hsr_slave_0: left promiscuous mode
[ 91.178976][ T2913] hsr_slave_1: left promiscuous mode
[ 91.184831][ T2913] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 91.192360][ T2913] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 91.200940][ T2913] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 91.208766][ T2913] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 91.216337][ T2913] bridge_slave_1: left allmulticast mode
[ 91.222064][ T2913] bridge_slave_1: left promiscuous mode
[ 91.228992][ T2913] bridge0: port 2(bridge_slave_1) entered disabled state
[ 91.239595][ T2913] bridge_slave_0: left allmulticast mode
[ 91.245243][ T2913] bridge_slave_0: left promiscuous mode
[ 91.252059][ T2913] bridge0: port 1(bridge_slave_0) entered disabled state
[ 91.271644][ T2913] veth1_macvtap: left promiscuous mode
[ 91.277648][ T2913] veth0_macvtap: left promiscuous mode
[ 91.283255][ T2913] veth1_vlan: left promiscuous mode
[ 91.289371][ T2913] veth0_vlan: left promiscuous mode
[ 91.650556][ T2913] team0 (unregistering): Port device team_slave_1 removed
[ 91.682822][ T2913] team0 (unregistering): Port device team_slave_0 removed
[ 91.710643][ T2913] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 91.739607][ T2913] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 91.928440][ T2913] bond0 (unregistering): Released all slaves
[ 92.082178][ T5886] 8021q: adding VLAN 0 to HW filter on device bond0
[ 92.104488][ T5886] 8021q: adding VLAN 0 to HW filter on device team0
[ 92.115744][ T2975] bridge0: port 1(bridge_slave_0) entered blocking state
[ 92.122879][ T2975] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 92.138265][ T3526] bridge0: port 2(bridge_slave_1) entered blocking state
[ 92.145401][ T3526] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 92.354688][ T5886] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 92.426483][ T5886] veth0_vlan: entered promiscuous mode
[ 92.440700][ T5886] veth1_vlan: entered promiscuous mode
[ 92.472690][ T5886] veth0_macvtap: entered promiscuous mode
[ 92.481972][ T5886] veth1_macvtap: entered promiscuous mode
[ 92.497533][ T5886] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 92.511728][ T5886] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 92.524737][ T5886] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 92.533942][ T5886] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 92.543412][ T5886] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 92.552244][ T5886] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 92.587307][ T5086] Bluetooth: hci0: command tx timeout
[ 92.620541][ T2961] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 92.628889][ T2961] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 92.663922][ T3526] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 92.673453][ T3526] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 92.997077][ T5854] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 93.189454][ T5854] usb 1-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 93.200532][ T5854] usb 1-1: config 0 interface 0 has no altsetting 0
[ 93.207309][ T5854] usb 1-1: New USB device found, idVendor=1038, idProduct=1410, bcdDevice= 0.00
[ 93.216371][ T5854] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 93.228041][ T5854] usb 1-1: config 0 descriptor??
[ 93.645957][ T5854] steelseries 0003:1038:1410.0001: unknown main item tag 0x3
[ 93.655320][ T5854] steelseries 0003:1038:1410.0001: No inputs registered, leaving
[ 93.668542][ T5854] steelseries 0003:1038:1410.0001: hidraw0: USB HID v0.00 Joystick [HID 1038:1410] on usb-dummy_hcd.0-1/input0
[ 93.681808][ T5854] steelseries 0003:1038:1410.0001: implement() called with too large value 64 (n: 0)! (kworker/1:3)
[ 93.845767][ T174] usb 1-1: USB disconnect, device number 2
[ 93.855978][ T174] ==================================================================
[ 93.864051][ T174] BUG: KASAN: slab-out-of-bounds in __lock_acquire+0x10c/0x7d80
[ 93.871688][ T174] Read of size 8 at addr ffff888026d722d0 by task kworker/0:2/174
[ 93.879478][ T174]
[ 93.881824][ T174] CPU: 0 PID: 174 Comm: kworker/0:2 Not tainted syzkaller #0
[ 93.889183][ T174] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 93.899229][ T174] Workqueue: usb_hub_wq hub_event
[ 93.904425][ T174] Call Trace:
[ 93.907707][ T174]
[ 93.910631][ T174] dump_stack_lvl+0x18c/0x250
[ 93.915295][ T174] ? __lock_acquire+0x7d80/0x7d80
[ 93.920302][ T174] ? show_regs_print_info+0x20/0x20
[ 93.925480][ T174] ? load_image+0x420/0x420
[ 93.929974][ T174] ? __virt_addr_valid+0x10c/0x380
[ 93.935072][ T174] ? __virt_addr_valid+0x10c/0x380
[ 93.940165][ T174] ? __virt_addr_valid+0x10c/0x380
[ 93.945295][ T174] print_report+0xa8/0x210
[ 93.949704][ T174] ? __lock_acquire+0x10c/0x7d80
[ 93.954635][ T174] kasan_report+0x117/0x150
[ 93.959145][ T174] ? _raw_spin_unlock_irqrestore+0x86/0x120
[ 93.965063][ T174] ? __lock_acquire+0x10c/0x7d80
[ 93.970009][ T174] __lock_acquire+0x10c/0x7d80
[ 93.974776][ T174] ? hid_destroy_device+0x6a/0x100
[ 93.979884][ T174] ? verify_lock_unused+0x140/0x140
[ 93.985073][ T174] ? ret_from_fork+0x48/0x80
[ 93.989662][ T174] ? verify_lock_unused+0x140/0x140
[ 93.994867][ T174] ? mark_lock+0x94/0x320
[ 93.999188][ T174] ? verify_lock_unused+0x140/0x140
[ 94.004379][ T174] lock_acquire+0x19e/0x420
[ 94.008873][ T174] ? steelseries_remove+0x84/0x180
[ 94.013982][ T174] ? mark_lock+0x94/0x320
[ 94.018305][ T174] ? read_lock_is_recursive+0x20/0x20
[ 94.023669][ T174] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0
[ 94.029677][ T174] _raw_spin_lock_irqsave+0xb4/0x100
[ 94.034982][ T174] ? steelseries_remove+0x84/0x180
[ 94.040095][ T174] ? _raw_spin_lock+0x40/0x40
[ 94.044767][ T174] ? _raw_spin_unlock_irqrestore+0xc5/0x120
[ 94.050651][ T174] ? _raw_spin_unlock+0x40/0x40
[ 94.055489][ T174] ? steelseries_probe+0xe00/0xe00
[ 94.060596][ T174] steelseries_remove+0x84/0x180
[ 94.065526][ T174] hid_device_remove+0x222/0x360
[ 94.070456][ T174] ? hid_device_probe+0x5a0/0x5a0
[ 94.075517][ T174] device_release_driver_internal+0x408/0x6f0
[ 94.081694][ T174] bus_remove_device+0x43b/0x520
[ 94.086639][ T174] ? bus_probe_device+0x260/0x260
[ 94.091668][ T174] ? up_write+0x1be/0x410
[ 94.095993][ T174] ? kernfs_remove_by_name_ns+0x117/0x150
[ 94.101709][ T174] device_del+0x51f/0x910
[ 94.106035][ T174] ? usbhid_disconnect+0x97/0xc0
[ 94.110963][ T174] ? kill_device+0x160/0x160
[ 94.115567][ T174] ? _raw_spin_lock_irq+0xbb/0xf0
[ 94.120586][ T174] hid_destroy_device+0x6a/0x100
[ 94.125515][ T174] usbhid_disconnect+0x9f/0xc0
[ 94.130273][ T174] usb_unbind_interface+0x207/0x870
[ 94.135496][ T174] ? kernfs_remove_by_name_ns+0x117/0x150
[ 94.141213][ T174] ? usb_driver_release_interface+0x1c0/0x1c0
[ 94.147280][ T174] device_release_driver_internal+0x458/0x6f0
[ 94.153345][ T174] bus_remove_device+0x43b/0x520
[ 94.158579][ T174] ? bus_probe_device+0x260/0x260
[ 94.163604][ T174] ? up_write+0x1be/0x410
[ 94.167927][ T174] ? kernfs_remove_by_name_ns+0x117/0x150
[ 94.173649][ T174] device_del+0x51f/0x910
[ 94.177976][ T174] ? kill_device+0x160/0x160
[ 94.182557][ T174] ? kobject_put+0x421/0x450
[ 94.187147][ T174] usb_disable_device+0x3ee/0x8a0
[ 94.192166][ T174] usb_disconnect+0x340/0x8a0
[ 94.196831][ T174] hub_event+0x1d69/0x4a80
[ 94.201252][ T174] ? hub_post_resume+0x120/0x120
[ 94.206174][ T174] ? read_lock_is_recursive+0x20/0x20
[ 94.211547][ T174] ? _raw_spin_unlock_irq+0x23/0x50
[ 94.216735][ T174] ? process_scheduled_works+0x975/0x1600
[ 94.222453][ T174] ? process_scheduled_works+0x975/0x1600
[ 94.228167][ T174] process_scheduled_works+0xa60/0x1600
[ 94.233714][ T174] ? worker_attach_to_pool+0x370/0x370
[ 94.239170][ T174] ? assign_work+0x3cc/0x5d0
[ 94.243751][ T174] worker_thread+0xa5e/0xfe0
[ 94.248342][ T174] kthread+0x2fa/0x390
[ 94.252396][ T174] ? pr_cont_work+0x550/0x550
[ 94.257070][ T174] ? kthread_blkcg+0xd0/0xd0
[ 94.261647][ T174] ret_from_fork+0x48/0x80
[ 94.266050][ T174] ? kthread_blkcg+0xd0/0xd0
[ 94.270627][ T174] ret_from_fork_asm+0x11/0x20
[ 94.275399][ T174]
[ 94.278420][ T174]
[ 94.280735][ T174] Allocated by task 5854:
[ 94.285052][ T174] kasan_set_track+0x4e/0x70
[ 94.289642][ T174] __kasan_kmalloc+0x8f/0xa0
[ 94.294218][ T174] steelseries_probe+0x1e1/0xe00
[ 94.299145][ T174] hid_device_probe+0x290/0x5a0
[ 94.303985][ T174] really_probe+0x247/0xae0
[ 94.308476][ T174] __driver_probe_device+0x1f5/0x390
[ 94.313754][ T174] driver_probe_device+0x4f/0x420
[ 94.318766][ T174] __device_attach_driver+0x2ca/0x510
[ 94.324122][ T174] bus_for_each_drv+0x252/0x2e0
[ 94.328989][ T174] __device_attach+0x2c1/0x420
[ 94.333762][ T174] bus_probe_device+0x180/0x260
[ 94.338602][ T174] device_add+0x87c/0xc40
[ 94.342917][ T174] hid_add_device+0x365/0x500
[ 94.347581][ T174] usbhid_probe+0xe43/0x1260
[ 94.352158][ T174] usb_probe_interface+0x5c2/0xaf0
[ 94.357260][ T174] really_probe+0x247/0xae0
[ 94.361752][ T174] __driver_probe_device+0x1f5/0x390
[ 94.367028][ T174] driver_probe_device+0x4f/0x420
[ 94.372035][ T174] __device_attach_driver+0x2ca/0x510
[ 94.377390][ T174] bus_for_each_drv+0x252/0x2e0
[ 94.382230][ T174] __device_attach+0x2c1/0x420
[ 94.386983][ T174] bus_probe_device+0x180/0x260
[ 94.391823][ T174] device_add+0x87c/0xc40
[ 94.396139][ T174] usb_set_configuration+0x1ad0/0x2150
[ 94.401592][ T174] usb_generic_driver_probe+0x8d/0x150
[ 94.407044][ T174] usb_probe_device+0x12a/0x260
[ 94.411885][ T174] really_probe+0x247/0xae0
[ 94.416373][ T174] __driver_probe_device+0x1f5/0x390
[ 94.421655][ T174] driver_probe_device+0x4f/0x420
[ 94.426669][ T174] __device_attach_driver+0x2ca/0x510
[ 94.432030][ T174] bus_for_each_drv+0x252/0x2e0
[ 94.436895][ T174] __device_attach+0x2c1/0x420
[ 94.441652][ T174] bus_probe_device+0x180/0x260
[ 94.446491][ T174] device_add+0x87c/0xc40
[ 94.450807][ T174] usb_new_device+0x995/0x1550
[ 94.455558][ T174] hub_event+0x29d5/0x4a80
[ 94.459960][ T174] process_scheduled_works+0xa60/0x1600
[ 94.465497][ T174] worker_thread+0xa5e/0xfe0
[ 94.470073][ T174] kthread+0x2fa/0x390
[ 94.474130][ T174] ret_from_fork+0x48/0x80
[ 94.478540][ T174] ret_from_fork_asm+0x11/0x20
[ 94.483299][ T174]
[ 94.485610][ T174] The buggy address belongs to the object at ffff888026d72200
[ 94.485610][ T174] which belongs to the cache kmalloc-192 of size 192
[ 94.499649][ T174] The buggy address is located 72 bytes to the right of
[ 94.499649][ T174] allocated 136-byte region [ffff888026d72200, ffff888026d72288)
[ 94.514214][ T174]
[ 94.516522][ T174] The buggy address belongs to the physical page:
[ 94.522930][ T174] page:ffffea00009b5c80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x26d72
[ 94.533068][ T174] flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 94.540600][ T174] page_type: 0xffffffff()
[ 94.544928][ T174] raw: 00fff00000000800 ffff888017c41a00 dead000000000122 0000000000000000
[ 94.553505][ T174] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[ 94.562067][ T174] page dumped because: kasan: bad access detected
[ 94.568473][ T174] page_owner tracks the page as allocated
[ 94.574169][ T174] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5141, tgid 5141 (udevd), ts 93309926442, free_ts 93102885541
[ 94.591784][ T174] post_alloc_hook+0x1c1/0x200
[ 94.596543][ T174] get_page_from_freelist+0x2181/0x22a0
[ 94.602076][ T174] __alloc_pages+0x1f0/0x460
[ 94.606653][ T174] alloc_slab_page+0x4f/0x180
[ 94.611326][ T174] new_slab+0x87/0x2d0
[ 94.615382][ T174] ___slab_alloc+0xc5c/0x12f0
[ 94.620043][ T174] __kmem_cache_alloc_node+0x11f/0x250
[ 94.625495][ T174] __kmalloc_node+0xa6/0x240
[ 94.630092][ T174] memcg_alloc_slab_cgroups+0x85/0x120
[ 94.635541][ T174] new_slab+0xc3/0x2d0
[ 94.639628][ T174] ___slab_alloc+0xc5c/0x12f0
[ 94.644293][ T174] kmem_cache_alloc_lru+0xfc/0x2b0
[ 94.649395][ T174] shmem_alloc_inode+0x28/0x40
[ 94.654148][ T174] new_inode_pseudo+0x63/0x1d0
[ 94.658901][ T174] new_inode+0x22/0x1d0
[ 94.663059][ T174] shmem_get_inode+0x34d/0xcd0
[ 94.667831][ T174] page last free stack trace:
[ 94.672493][ T174] free_unref_page_prepare+0x7d7/0x8f0
[ 94.677945][ T174] free_unref_page+0x32/0x2e0
[ 94.682611][ T174] __unfreeze_partials+0x1cf/0x210
[ 94.687718][ T174] put_cpu_partial+0x17c/0x250
[ 94.692470][ T174] __slab_free+0x319/0x400
[ 94.696868][ T174] qlist_free_all+0x75/0xd0
[ 94.701365][ T174] kasan_quarantine_reduce+0x143/0x160
[ 94.706815][ T174] __kasan_slab_alloc+0x22/0x80
[ 94.711673][ T174] slab_post_alloc_hook+0x6a/0x4d0
[ 94.716775][ T174] kmem_cache_alloc+0x17e/0x2c0
[ 94.721620][ T174] getname_flags+0xbb/0x500
[ 94.726115][ T174] do_sys_openat2+0xda/0x1d0
[ 94.730694][ T174] __x64_sys_openat+0x139/0x160
[ 94.735555][ T174] do_syscall_64+0x55/0xb0
[ 94.739967][ T174] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 94.745848][ T174]
[ 94.748155][ T174] Memory state around the buggy address:
[ 94.753774][ T174] ffff888026d72180: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 94.761820][ T174] ffff888026d72200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 94.769870][ T174] >ffff888026d72280: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.777927][ T174] ^
[ 94.784595][ T174] ffff888026d72300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 94.792647][ T174] ffff888026d72380: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
[ 94.800704][ T174] ==================================================================
[ 94.808759][ T174] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 94.815935][ T174] CPU: 0 PID: 174 Comm: kworker/0:2 Not tainted syzkaller #0
[ 94.823291][ T174] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 94.833338][ T174] Workqueue: usb_hub_wq hub_event
[ 94.838361][ T174] Call Trace:
[ 94.841638][ T174]
[ 94.844560][ T174] dump_stack_lvl+0x18c/0x250
[ 94.849243][ T174] ? show_regs_print_info+0x20/0x20
[ 94.854458][ T174] ? load_image+0x420/0x420
[ 94.858969][ T174] panic+0x2ca/0x720
[ 94.862872][ T174] ? bpf_jit_dump+0xd0/0xd0
[ 94.867375][ T174] ? _raw_spin_unlock_irqrestore+0xc5/0x120
[ 94.873259][ T174] ? _raw_spin_unlock+0x40/0x40
[ 94.878100][ T174] ? print_memory_metadata+0x314/0x400
[ 94.883551][ T174] ? __lock_acquire+0x10c/0x7d80
[ 94.888478][ T174] check_panic_on_warn+0x84/0xa0
[ 94.893408][ T174] ? __lock_acquire+0x10c/0x7d80
[ 94.898335][ T174] end_report+0x6f/0x130
[ 94.902567][ T174] kasan_report+0x128/0x150
[ 94.907145][ T174] ? _raw_spin_unlock_irqrestore+0x86/0x120
[ 94.913026][ T174] ? __lock_acquire+0x10c/0x7d80
[ 94.917956][ T174] __lock_acquire+0x10c/0x7d80
[ 94.922715][ T174] ? hid_destroy_device+0x6a/0x100
[ 94.927838][ T174] ? verify_lock_unused+0x140/0x140
[ 94.933023][ T174] ? ret_from_fork+0x48/0x80
[ 94.937605][ T174] ? verify_lock_unused+0x140/0x140
[ 94.942811][ T174] ? mark_lock+0x94/0x320
[ 94.947127][ T174] ? verify_lock_unused+0x140/0x140
[ 94.952317][ T174] lock_acquire+0x19e/0x420
[ 94.956810][ T174] ? steelseries_remove+0x84/0x180
[ 94.961920][ T174] ? mark_lock+0x94/0x320
[ 94.966241][ T174] ? read_lock_is_recursive+0x20/0x20
[ 94.971603][ T174] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0
[ 94.977576][ T174] _raw_spin_lock_irqsave+0xb4/0x100
[ 94.982867][ T174] ? steelseries_remove+0x84/0x180
[ 94.987992][ T174] ? _raw_spin_lock+0x40/0x40
[ 94.992670][ T174] ? _raw_spin_unlock_irqrestore+0xc5/0x120
[ 94.998556][ T174] ? _raw_spin_unlock+0x40/0x40
[ 95.003404][ T174] ? steelseries_probe+0xe00/0xe00
[ 95.008516][ T174] steelseries_remove+0x84/0x180
[ 95.013452][ T174] hid_device_remove+0x222/0x360
[ 95.018389][ T174] ? hid_device_probe+0x5a0/0x5a0
[ 95.023406][ T174] device_release_driver_internal+0x408/0x6f0
[ 95.029473][ T174] bus_remove_device+0x43b/0x520
[ 95.034410][ T174] ? bus_probe_device+0x260/0x260
[ 95.039425][ T174] ? up_write+0x1be/0x410
[ 95.043747][ T174] ? kernfs_remove_by_name_ns+0x117/0x150
[ 95.049461][ T174] device_del+0x51f/0x910
[ 95.053788][ T174] ? usbhid_disconnect+0x97/0xc0
[ 95.058723][ T174] ? kill_device+0x160/0x160
[ 95.063306][ T174] ? _raw_spin_lock_irq+0xbb/0xf0
[ 95.068324][ T174] hid_destroy_device+0x6a/0x100
[ 95.073259][ T174] usbhid_disconnect+0x9f/0xc0
[ 95.078014][ T174] usb_unbind_interface+0x207/0x870
[ 95.083216][ T174] ? kernfs_remove_by_name_ns+0x117/0x150
[ 95.088934][ T174] ? usb_driver_release_interface+0x1c0/0x1c0
[ 95.094994][ T174] device_release_driver_internal+0x458/0x6f0
[ 95.101061][ T174] bus_remove_device+0x43b/0x520
[ 95.105999][ T174] ? bus_probe_device+0x260/0x260
[ 95.111018][ T174] ? up_write+0x1be/0x410
[ 95.115345][ T174] ? kernfs_remove_by_name_ns+0x117/0x150
[ 95.121064][ T174] device_del+0x51f/0x910
[ 95.125389][ T174] ? kill_device+0x160/0x160
[ 95.129971][ T174] ? kobject_put+0x421/0x450
[ 95.134560][ T174] usb_disable_device+0x3ee/0x8a0
[ 95.139583][ T174] usb_disconnect+0x340/0x8a0
[ 95.144251][ T174] hub_event+0x1d69/0x4a80
[ 95.148672][ T174] ? hub_post_resume+0x120/0x120
[ 95.153599][ T174] ? read_lock_is_recursive+0x20/0x20
[ 95.158964][ T174] ? _raw_spin_unlock_irq+0x23/0x50
[ 95.164155][ T174] ? process_scheduled_works+0x975/0x1600
[ 95.169870][ T174] ? process_scheduled_works+0x975/0x1600
[ 95.175585][ T174] process_scheduled_works+0xa60/0x1600
[ 95.181132][ T174] ? worker_attach_to_pool+0x370/0x370
[ 95.186585][ T174] ? assign_work+0x3cc/0x5d0
[ 95.191169][ T174] worker_thread+0xa5e/0xfe0
[ 95.195762][ T174] kthread+0x2fa/0x390
[ 95.199821][ T174] ? pr_cont_work+0x550/0x550
[ 95.204488][ T174] ? kthread_blkcg+0xd0/0xd0
[ 95.209068][ T174] ret_from_fork+0x48/0x80
[ 95.213476][ T174] ? kthread_blkcg+0xd0/0xd0
[ 95.218056][ T174] ret_from_fork_asm+0x11/0x20
[ 95.222816][ T174]
[ 95.225958][ T174] Kernel Offset: disabled
[ 95.230289][ T174] Rebooting in 86400 seconds..