Warning: Permanently added '[localhost]:18977' (ED25519) to the list of known hosts.
2026/10/18 12:24:55 parsed 1 programs
2026/10/18 12:24:55 serving rpc on tcp://35593
[ 37.659984][ T5736] cgroup: Unknown subsys name 'net'
[ 37.844958][ T5736] cgroup: Unknown subsys name 'cpuset'
[ 37.848606][ T5736] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 38.961199][ T5736] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 41.183735][ T5756] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 41.198735][ T5756] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 41.205642][ T5756] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 41.206533][ T5756] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 41.220951][ T5756] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 42.163811][ T5783] rxe_eth0 speed is unknown, defaulting to 1000
[ 42.164684][ T5783] rxe_eth0 speed is unknown, defaulting to 1000
[ 42.166143][ T5783] rxe_eth0 speed is unknown, defaulting to 1000
[ 42.298905][ T5783] infiniband rxe0: set active
[ 42.299298][ T10] rxe_eth0 speed is unknown, defaulting to 1000
[ 42.299605][ T5783] infiniband rxe0: added rxe_eth0
[ 42.306188][ T5783] smbdirect: ib_dev[rxe0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000
[ 42.306208][ T5783] smbdirect: ib_dev[rxe0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32
[ 42.306228][ T5783] smbdirect: ib_dev[rxe0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005
[ 42.318822][ T5783] RDS/IB: rxe0: added
[ 42.318942][ T5783] smc: adding ib device rxe0 with port count 1
[ 42.318977][ T5783] smc: ib device rxe0 port 1 has no pnetid
[ 42.325679][ T10] rxe_eth0 speed is unknown, defaulting to 1000
[ 42.332538][ T5783] rxe_eth0 speed is unknown, defaulting to 1000
[ 42.339216][ T50] rxe_eth0 speed is unknown, defaulting to 1000
[ 42.344714][ T24] rxe_eth0 speed is unknown, defaulting to 1000
[ 42.368999][ T1041] rxe_eth0 speed is unknown, defaulting to 1000
[ 42.614617][ T5783] bridge0: port 1(bridge_slave_0) entered blocking state
[ 42.614694][ T5783] bridge0: port 1(bridge_slave_0) entered disabled state
[ 42.614777][ T5783] bridge_slave_0: entered allmulticast mode
[ 42.616745][ T5783] bridge_slave_0: entered promiscuous mode
[ 42.620302][ T5783] bridge0: port 2(bridge_slave_1) entered blocking state
[ 42.620374][ T5783] bridge0: port 2(bridge_slave_1) entered disabled state
[ 42.620450][ T5783] bridge_slave_1: entered allmulticast mode
[ 42.621929][ T5783] bridge_slave_1: entered promiscuous mode
[ 42.644143][ T5783] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 42.646304][ T5783] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 42.665921][ T5783] team0: Port device team_slave_0 added
[ 42.667926][ T5783] team0: Port device team_slave_1 added
[ 42.686460][ T5783] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 42.686471][ T5783] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 42.686490][ T5783] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 42.688282][ T5783] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 42.688292][ T5783] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 42.688306][ T5783] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 42.722344][ T5783] hsr_slave_0: entered promiscuous mode
[ 42.723240][ T5783] hsr_slave_1: entered promiscuous mode
[ 42.858240][ T5783] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 42.863997][ T5783] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 42.864763][ T5783] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 42.868007][ T5783] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 42.869035][ T5783] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 42.872182][ T5783] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 42.872702][ T5783] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 42.877188][ T5783] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 42.891788][ T5783] bridge0: port 2(bridge_slave_1) entered blocking state
[ 42.891839][ T5783] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 42.892239][ T5783] bridge0: port 1(bridge_slave_0) entered blocking state
[ 42.892286][ T5783] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 42.926481][ T5783] 8021q: adding VLAN 0 to HW filter on device bond0
[ 42.934660][ T1177] bridge0: port 1(bridge_slave_0) entered disabled state
[ 42.935697][ T1177] bridge0: port 2(bridge_slave_1) entered disabled state
[ 42.941215][ T5783] 8021q: adding VLAN 0 to HW filter on device team0
[ 42.947657][ T1177] bridge0: port 1(bridge_slave_0) entered blocking state
[ 42.947704][ T1177] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 42.953861][ T1177] bridge0: port 2(bridge_slave_1) entered blocking state
[ 42.953970][ T1177] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 43.243177][ T5783] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 43.267402][ T5783] veth0_vlan: entered promiscuous mode
[ 43.272296][ T5783] veth1_vlan: entered promiscuous mode
[ 43.295485][ T5783] veth0_macvtap: entered promiscuous mode
[ 43.302251][ T5783] veth1_macvtap: entered promiscuous mode
[ 43.312964][ T5783] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 43.319085][ T5783] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 43.361143][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 43.361182][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 43.361213][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 43.361240][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 43.440522][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 43.455820][ T5831] rxe_eth0 speed is unknown, defaulting to 1000
[ 43.513410][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 43.586352][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 43.618129][ T1177] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 43.618142][ T1177] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 43.647651][ T174] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 43.647664][ T174] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 43.669229][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 43.804195][ T5837] rxe_eth0 speed is unknown, defaulting to 1000
[ 44.020208][ T66] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 44.023451][ T66] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 44.024674][ T66] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 44.025385][ T66] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 44.025886][ T66] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 44.044886][ T5842] rxe_eth0 speed is unknown, defaulting to 1000
[ 44.273431][ T5849] rxe_eth0 speed is unknown, defaulting to 1000
[ 44.493220][ T5854] rxe_eth0 speed is unknown, defaulting to 1000
[ 44.728030][ T5859] rxe_eth0 speed is unknown, defaulting to 1000
[ 44.964175][ T5864] rxe_eth0 speed is unknown, defaulting to 1000
[ 45.131644][ T5869] rxe_eth0 speed is unknown, defaulting to 1000
2026/10/18 12:25:05 executed programs: 0
[ 45.524824][ T66] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 45.526048][ T66] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 45.526461][ T66] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 45.527448][ T66] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 45.527752][ T66] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 45.700473][ T5873] rxe_eth0 speed is unknown, defaulting to 1000
[ 45.948383][ T5873] bridge0: port 1(bridge_slave_0) entered blocking state
[ 45.948469][ T5873] bridge0: port 1(bridge_slave_0) entered disabled state
[ 45.948526][ T5873] bridge_slave_0: entered allmulticast mode
[ 45.949320][ T5873] bridge_slave_0: entered promiscuous mode
[ 45.951404][ T5873] bridge0: port 2(bridge_slave_1) entered blocking state
[ 45.951472][ T5873] bridge0: port 2(bridge_slave_1) entered disabled state
[ 45.951525][ T5873] bridge_slave_1: entered allmulticast mode
[ 45.952188][ T5873] bridge_slave_1: entered promiscuous mode
[ 45.968979][ T5873] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 45.971647][ T5873] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 45.985407][ T5873] team0: Port device team_slave_0 added
[ 45.987147][ T5873] team0: Port device team_slave_1 added
[ 45.998302][ T5873] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 45.998313][ T5873] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 45.998325][ T5873] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 45.999624][ T5873] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 45.999632][ T5873] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 45.999644][ T5873] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 46.026670][ T5873] hsr_slave_0: entered promiscuous mode
[ 46.027532][ T5873] hsr_slave_1: entered promiscuous mode
[ 46.028078][ T5873] debugfs: 'hsr0' already exists in 'hsr'
[ 46.028155][ T5873] Cannot create hsr debugfs directory
[ 46.655151][ T12] bridge_slave_1: left allmulticast mode
[ 46.655180][ T12] bridge_slave_1: left promiscuous mode
[ 46.656455][ T12] bridge0: port 2(bridge_slave_1) entered disabled state
[ 46.659619][ T12] bridge_slave_0: left allmulticast mode
[ 46.659632][ T12] bridge_slave_0: left promiscuous mode
[ 46.659725][ T12] bridge0: port 1(bridge_slave_0) entered disabled state
[ 46.737926][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 46.739635][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 46.740507][ T12] bond0 (unregistering): Released all slaves
[ 46.880152][ T12] hsr_slave_0: left promiscuous mode
[ 46.880838][ T12] hsr_slave_1: left promiscuous mode
[ 46.881510][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 46.881527][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 46.883512][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 46.883527][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 46.889410][ T12] veth1_macvtap: left promiscuous mode
[ 46.889677][ T12] veth0_macvtap: left promiscuous mode
[ 46.889764][ T12] veth1_vlan: left promiscuous mode
[ 46.889824][ T12] veth0_vlan: left promiscuous mode
[ 47.028391][ T12] team0 (unregistering): Port device team_slave_1 removed
[ 47.037823][ T12] team0 (unregistering): Port device team_slave_0 removed
[ 47.117105][ T5452] 8021q: adding VLAN 0 to HW filter on device eth2
[ 47.338599][ T5873] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 47.346223][ T5873] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 47.347143][ T5873] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 47.354847][ T5873] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 47.355322][ T5873] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 47.362349][ T5873] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 47.362819][ T5873] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 47.373118][ T5873] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 47.429796][ T5873] 8021q: adding VLAN 0 to HW filter on device bond0
[ 47.440260][ T5873] 8021q: adding VLAN 0 to HW filter on device team0
[ 47.450211][ T174] bridge0: port 1(bridge_slave_0) entered blocking state
[ 47.450266][ T174] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 47.454899][ T174] bridge0: port 2(bridge_slave_1) entered blocking state
[ 47.454942][ T174] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 47.561564][ T5097] Bluetooth: hci0: command tx timeout
[ 47.903226][ T5873] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 47.922268][ T5873] veth0_vlan: entered promiscuous mode
[ 47.927125][ T5873] veth1_vlan: entered promiscuous mode
[ 47.942959][ T5873] veth0_macvtap: entered promiscuous mode
[ 47.946571][ T5873] veth1_macvtap: entered promiscuous mode
[ 47.965543][ T5873] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 47.969948][ T5873] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 48.021075][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 48.021100][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 48.021117][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 48.021134][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 48.038660][ T174] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 48.038679][ T174] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 48.107032][ T174] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 48.107074][ T174] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 48.400776][ T50] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 48.582990][ T50] usb 5-1: Using ep0 maxpacket: 32
[ 48.589628][ T50] usb 5-1: unable to get BOS descriptor or descriptor too short
[ 48.589655][ T50] usb 5-1: New USB device found, idVendor=1f71, idProduct=3306, bcdDevice=2a.c0
[ 48.592300][ T50] usb 5-1: config 3 has an invalid interface number: 223 but max is 1
[ 48.592314][ T50] usb 5-1: config 3 has an invalid interface number: 25 but max is 1
[ 48.592324][ T50] usb 5-1: config 3 has an invalid interface number: 223 but max is 1
[ 48.592333][ T50] usb 5-1: config 3 has no interface number 0
[ 48.592341][ T50] usb 5-1: config 3 has no interface number 1
[ 48.592361][ T50] usb 5-1: config 3 interface 25 altsetting 6 has an invalid descriptor for endpoint zero, skipping
[ 48.592371][ T50] usb 5-1: config 3 interface 25 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 5
[ 48.592384][ T50] usb 5-1: too many endpoints for config 3 interface 223 altsetting 155: 82, using maximum allowed: 30
[ 48.592400][ T50] usb 5-1: config 3 interface 223 altsetting 155 endpoint 0xD has invalid maxpacket 512, setting to 64
[ 48.592413][ T50] usb 5-1: config 3 interface 223 altsetting 155 endpoint 0x8 has invalid maxpacket 512, setting to 64
[ 48.592426][ T50] usb 5-1: config 3 interface 223 altsetting 155 has 4 endpoint descriptors, different from the interface descriptor's value: 82
[ 48.592438][ T50] usb 5-1: config 3 interface 223 has no altsetting 1
[ 48.592447][ T50] usb 5-1: config 3 interface 25 has no altsetting 0
[ 48.594456][ T50] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 48.594469][ T50] usb 5-1: Product: syz
[ 48.594476][ T50] usb 5-1: Manufacturer: syz
[ 48.594483][ T50] usb 5-1: SerialNumber: syz
[ 48.840110][ T50] usbtv 5-1:3.223: Fushicai USBTV007 Audio-Video Grabber
[ 48.851575][ T50] usb 5-1: USB disconnect, device number 2
[
** replaying previous printk message **
[ 48.883905][ T5929] udevd[5929]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb5/5-1/sound/card3/controlC3/../uevent} for writing: No such file or directory
[ 48.891143][ T50]
[ 48.898626][ T50] =========================
[ 48.900220][ T50] WARNING: held lock freed!
[ 48.901775][ T50] syzkaller #0 Not tainted
[ 48.903457][ T50] -------------------------
[ 48.904936][ T50] kworker/2:1/50 is freeing memory ffff888023345000-ffff8880233457ff, with a lock still held there!
[ 48.908372][ T50] ffff8880233451a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb2/0x620
[ 48.911846][ T50] locks held by kworker/2:1/50: 5, last CPU#2:
[ 48.913771][ T50] #0: ffff88801f32e540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10
[ 48.917169][ T50] #1: ffffc9000071fd08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10
[ 48.920675][ T50] #2: ffff888022d031d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bb/0x4420
[ 48.923533][ T50] #3: ffff888025fdf1d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0x10a/0x9a0
[ 48.926407][ T50] #4: ffff8880233451a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb2/0x620
[ 48.929684][ T50]
[ 48.929684][ T50] stack backtrace:
[ 48.931584][ T50] CPU: 2 UID: 0 PID: 50 Comm: kworker/2:1 Not tainted syzkaller #0 PREEMPT(full)
[ 48.934452][ T50] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 48.937578][ T50] Workqueue: usb_hub_wq hub_event
[ 48.939207][ T50] Call Trace:
[ 48.940271][ T50]
[ 48.941239][ T50] dump_stack_lvl+0x100/0x190
[ 48.942789][ T50] debug_check_no_locks_freed+0x115/0x120
[ 48.944579][ T50] ? device_release+0x60/0x270
[ 48.946092][ T50] ? device_release+0xd2/0x270
[ 48.947611][ T50] kfree+0x180/0x6d0
[ 48.948855][ T50] ? put_device+0x24/0x30
[ 48.950234][ T50] ? __pfx_usb_release_interface+0x10/0x10
[ 48.952152][ T50] device_release+0xd2/0x270
[ 48.953619][ T50] kobject_put+0x1f7/0x640
[ 48.955048][ T50] put_device+0x1f/0x30
[ 48.956377][ T50] v4l2_device_disconnect+0x60/0xc0
[ 48.958019][ T50] usbtv_video_free+0x25/0x30
[ 48.959542][ T50] usbtv_disconnect+0x58/0xa0
[ 48.961051][ T50] usb_unbind_interface+0x1dd/0x9e0
[ 48.962742][ T50] ? __pfx_usb_unbind_interface+0x10/0x10
[ 48.964529][ T50] device_remove+0x12a/0x180
[ 48.965987][ T50] device_release_driver_internal+0x44e/0x620
[ 48.967895][ T50] bus_remove_device+0x2bc/0x560
[ 48.969456][ T50] ? __pfx_bus_remove_device+0x10/0x10
[ 48.971188][ T50] ? __pfx_device_remove_attrs+0x10/0x10
[ 48.973017][ T50] device_del+0x376/0x9b0
[ 48.974375][ T50] ? __pfx_device_del+0x10/0x10
[ 48.975922][ T50] ? __pfx___pm_runtime_barrier+0x10/0x10
[ 48.977715][ T50] ? lock_acquire+0x1d1/0x380
[ 48.979233][ T50] usb_disable_device+0x367/0x810
[ 48.980845][ T50] ? mark_held_locks+0x40/0x70
[ 48.982458][ T50] usb_disconnect+0x2e2/0x9a0
[ 48.983961][ T50] hub_event+0x1bb1/0x4420
[ 48.985389][ T50] ? __lock_acquire+0x5c0/0x1f40
[ 48.987044][ T50] ? __pfx_hub_event+0x10/0x10
[ 48.988567][ T50] ? down_read_trylock+0x180/0x440
[ 48.990198][ T50] ? lock_acquire+0x1d1/0x380
[ 48.991633][ T50] ? process_one_work+0xa2c/0x1b10
[ 48.993285][ T50] ? process_one_work+0x906/0x1b10
[ 48.994906][ T50] ? process_one_work+0x906/0x1b10
[ 48.996558][ T50] process_one_work+0xac7/0x1b10
[ 48.998141][ T50] ? __pfx_process_one_work+0x10/0x10
[ 48.999888][ T50] ? lock_acquire+0x1d1/0x380
[ 49.001539][ T50] ? __pfx_hub_event+0x10/0x10
[ 49.003096][ T50] worker_thread+0x5ef/0xe50
[ 49.004572][ T50] ? __pfx_worker_thread+0x10/0x10
[ 49.006183][ T50] ? kthread+0x13a/0x450
[ 49.007555][ T50] ? __pfx_worker_thread+0x10/0x10
[ 49.009174][ T50] kthread+0x373/0x450
[ 49.010467][ T50] ? __pfx_kthread+0x10/0x10
[ 49.012040][ T50] ret_from_fork+0x730/0xd60
[ 49.013549][ T50] ? __pfx_ret_from_fork+0x10/0x10
[ 49.015159][ T50] ? __switch_to+0x800/0x10f0
[ 49.016646][ T50] ? __pfx_kthread+0x10/0x10
[ 49.018101][ T50] ret_from_fork_asm+0x1a/0x30
[ 49.019634][ T50]
[ 49.023670][ T50] ==================================================================
[ 49.023678][ T50] BUG: KASAN: slab-use-after-free in usb_unbind_interface+0x935/0x9e0
[ 49.023697][ T50] Read of size 8 at addr ffff888023345008 by task kworker/2:1/50
[ 49.023705][ T50]
[ 49.023711][ T50] CPU: 2 UID: 0 PID: 50 Comm: kworker/2:1 Not tainted syzkaller #0 PREEMPT(full)
[ 49.023723][ T50] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 49.023730][ T50] Workqueue: usb_hub_wq hub_event
[ 49.023746][ T50] Call Trace:
[ 49.023749][ T50]
[ 49.023754][ T50] dump_stack_lvl+0x100/0x190
[ 49.023769][ T50] print_report+0x13d/0x4b0
[ 49.023786][ T50] ? __virt_addr_valid+0x239/0x430
[ 49.023811][ T50] ? usb_unbind_interface+0x935/0x9e0
[ 49.023826][ T50] kasan_report+0xdf/0x1c0
[ 49.023844][ T50] ? usb_unbind_interface+0x935/0x9e0
[ 49.023861][ T50] usb_unbind_interface+0x935/0x9e0
[ 49.023877][ T50] ? __pfx_usb_unbind_interface+0x10/0x10
[ 49.023893][ T50] device_remove+0x12a/0x180
[ 49.023905][ T50] device_release_driver_internal+0x44e/0x620
[ 49.023920][ T50] bus_remove_device+0x2bc/0x560
[ 49.023930][ T50] ? __pfx_bus_remove_device+0x10/0x10
[ 49.023940][ T50] ? __pfx_device_remove_attrs+0x10/0x10
[ 49.023952][ T50] device_del+0x376/0x9b0
[ 49.023963][ T50] ? __pfx_device_del+0x10/0x10
[ 49.023974][ T50] ? __pfx___pm_runtime_barrier+0x10/0x10
[ 49.024001][ T50] ? lock_acquire+0x1d1/0x380
[ 49.024019][ T50] usb_disable_device+0x367/0x810
[ 49.024033][ T50] ? mark_held_locks+0x40/0x70
[ 49.024049][ T50] usb_disconnect+0x2e2/0x9a0
[ 49.024064][ T50] hub_event+0x1bb1/0x4420
[ 49.024081][ T50] ? __lock_acquire+0x5c0/0x1f40
[ 49.024097][ T50] ? __pfx_hub_event+0x10/0x10
[ 49.024111][ T50] ? down_read_trylock+0x180/0x440
[ 49.024121][ T50] ? lock_acquire+0x1d1/0x380
[ 49.024136][ T50] ? process_one_work+0xa2c/0x1b10
[ 49.024150][ T50] ? process_one_work+0x906/0x1b10
[ 49.024163][ T50] ? process_one_work+0x906/0x1b10
[ 49.024177][ T50] process_one_work+0xac7/0x1b10
[ 49.024192][ T50] ? __pfx_process_one_work+0x10/0x10
[ 49.024205][ T50] ? lock_acquire+0x1d1/0x380
[ 49.024225][ T50] ? __pfx_hub_event+0x10/0x10
[ 49.024240][ T50] worker_thread+0x5ef/0xe50
[ 49.024254][ T50] ? __pfx_worker_thread+0x10/0x10
[ 49.024267][ T50] ? kthread+0x13a/0x450
[ 49.024279][ T50] ? __pfx_worker_thread+0x10/0x10
[ 49.024292][ T50] kthread+0x373/0x450
[ 49.024303][ T50] ? __pfx_kthread+0x10/0x10
[ 49.024314][ T50] ret_from_fork+0x730/0xd60
[ 49.024325][ T50] ? __pfx_ret_from_fork+0x10/0x10
[ 49.024335][ T50] ? __switch_to+0x800/0x10f0
[ 49.024348][ T50] ? __pfx_kthread+0x10/0x10
[ 49.024360][ T50] ret_from_fork_asm+0x1a/0x30
[ 49.024373][ T50]
[ 49.024377][ T50]
[ 49.024379][ T50] Allocated by task 50:
[ 49.024384][ T50] kasan_save_stack+0x30/0x50
[ 49.024398][ T50] kasan_save_track+0x14/0x30
[ 49.024412][ T50] __kasan_kmalloc+0xaa/0xb0
[ 49.024425][ T50] __kmalloc_cache_noprof+0x2f8/0x6d0
[ 49.024437][ T50] usb_set_configuration+0x10d0/0x1dc0
[ 49.024450][ T50] usb_generic_driver_probe+0xa1/0xe0
[ 49.024461][ T50] usb_probe_device+0xef/0x400
[ 49.024474][ T50] really_probe+0x241/0xa60
[ 49.024484][ T50] __driver_probe_device+0x210/0x460
[ 49.024495][ T50] driver_probe_device+0x4a/0x140
[ 49.024506][ T50] __device_attach_driver+0x1df/0x320
[ 49.024517][ T50] bus_for_each_drv+0x159/0x1e0
[ 49.024532][ T50] __device_attach+0x1e4/0x4d0
[ 49.024542][ T50] device_initial_probe+0xaf/0xd0
[ 49.024554][ T50] bus_probe_device+0x64/0x160
[ 49.024563][ T50] device_add+0x121d/0x1970
[ 49.024575][ T50] usb_new_device.part.0+0xcc2/0x1686
[ 49.024589][ T50] hub_event.cold+0x1e3/0xe90
[ 49.024602][ T50] process_one_work+0xac7/0x1b10
[ 49.024614][ T50] worker_thread+0x5ef/0xe50
[ 49.024625][ T50] kthread+0x373/0x450
[ 49.024636][ T50] ret_from_fork+0x730/0xd60
[ 49.024644][ T50] ret_from_fork_asm+0x1a/0x30
[ 49.024653][ T50]
[ 49.024655][ T50] Freed by task 50:
[ 49.024659][ T50] kasan_save_stack+0x30/0x50
[ 49.024672][ T50] kasan_save_track+0x14/0x30
[ 49.024686][ T50] kasan_save_free_info+0x3b/0x70
[ 49.024696][ T50] __kasan_slab_free+0x5f/0x80
[ 49.024711][ T50] kfree+0x22b/0x6d0
[ 49.024720][ T50] device_release+0xd2/0x270
[ 49.024734][ T50] kobject_put+0x1f7/0x640
[ 49.024745][ T50] put_device+0x1f/0x30
[ 49.024759][ T50] v4l2_device_disconnect+0x60/0xc0
[ 49.024774][ T50] usbtv_video_free+0x25/0x30
[ 49.024789][ T50] usbtv_disconnect+0x58/0xa0
[ 49.024802][ T50] usb_unbind_interface+0x1dd/0x9e0
[ 49.024816][ T50] device_remove+0x12a/0x180
[ 49.024826][ T50] device_release_driver_internal+0x44e/0x620
[ 49.024838][ T50] bus_remove_device+0x2bc/0x560
[ 49.024847][ T50] device_del+0x376/0x9b0
[ 49.024856][ T50] usb_disable_device+0x367/0x810
[ 49.024869][ T50] usb_disconnect+0x2e2/0x9a0
[ 49.024881][ T50] hub_event+0x1bb1/0x4420
[ 49.024893][ T50] process_one_work+0xac7/0x1b10
[ 49.024905][ T50] worker_thread+0x5ef/0xe50
[ 49.024917][ T50] kthread+0x373/0x450
[ 49.024927][ T50] ret_from_fork+0x730/0xd60
[ 49.024935][ T50] ret_from_fork_asm+0x1a/0x30
[ 49.024944][ T50]
[ 49.024946][ T50] The buggy address belongs to the object at ffff888023345000
[ 49.024946][ T50] which belongs to the cache kmalloc-2k of size 2048
[ 49.024954][ T50] The buggy address is located 8 bytes inside of
[ 49.024954][ T50] freed 2048-byte region [ffff888023345000, ffff888023345800)
[ 49.024963][ T50]
[ 49.024966][ T50] The buggy address belongs to the physical page:
[ 49.024971][ T50] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x23340
[ 49.024981][ T50] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 49.024988][ T50] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 49.024998][ T50] page_type: f5(slab)
[ 49.025007][ T50] raw: 00fff00000000040 ffff88801d042f00 dead000000000100 dead000000000122
[ 49.025027][ T50] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 49.025036][ T50] head: 00fff00000000040 ffff88801d042f00 dead000000000100 dead000000000122
[ 49.025045][ T50] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 49.025054][ T50] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 49.025062][ T50] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 49.025067][ T50] page dumped because: kasan: bad access detected
[ 49.025073][ T50] page_owner tracks the page as allocated
[ 49.025076][ T50] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5778, tgid 5778 (syz-executor), ts 41877194758
[ 49.025093][ T50] post_alloc_hook+0xfd/0x120
[ 49.025103][ T50] get_page_from_freelist+0x110d/0x35d0
[ 49.025115][ T50] __alloc_frozen_pages_noprof+0x2eb/0x3300
[ 49.025128][ T50] new_slab+0xa9/0x6e0
[ 49.025138][ T50] refill_objects+0xe3/0x410
[ 49.025149][ T50] __pcs_replace_empty_main+0x35e/0x650
[ 49.025160][ T50] __kmalloc_cache_noprof+0x4f4/0x6d0
[ 49.025171][ T50] rxrpc_alloc_connection+0xa3/0x770
[ 49.025186][ T50] rxrpc_prealloc_service_connection+0x26/0x390
[ 49.025202][ T50] rxrpc_service_prealloc_one+0x2c5/0x1040
[ 49.025218][ T50] rxrpc_kernel_charge_accept+0xdd/0x120
[ 49.025229][ T50] afs_charge_preallocation+0xd8/0x360
[ 49.025243][ T50] afs_open_socket+0x31e/0x3f0
[ 49.025255][ T50] afs_net_init+0x825/0xb00
[ 49.025264][ T50] ops_init+0x1e2/0x5f0
[ 49.025276][ T50] setup_net+0x118/0x3a0
[ 49.025288][ T50] page last free pid 5234 tgid 5234 ts 15717008867 stack trace:
[ 49.025295][ T50] __free_frozen_pages+0x79f/0x10f0
[ 49.025304][ T50] qlist_free_all+0x47/0xf0
[ 49.025317][ T50] kasan_quarantine_reduce+0x1a0/0x1f0
[ 49.025330][ T50] __kasan_slab_alloc+0x69/0x90
[ 49.025345][ T50] kmem_cache_alloc_noprof+0x269/0x6a0
[ 49.025358][ T50] do_getname+0x35/0x390
[ 49.025367][ T50] do_sys_openat2+0xc7/0x1e0
[ 49.025376][ T50] __x64_sys_openat+0x12d/0x210
[ 49.025386][ T50] do_syscall_64+0x121/0x770
[ 49.025395][ T50] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 49.025405][ T50]
[ 49.025407][ T50] Memory state around the buggy address:
[ 49.025412][ T50] ffff888023344f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 49.025418][ T50] ffff888023344f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 49.025425][ T50] >ffff888023345000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 49.025430][ T50] ^
[ 49.025435][ T50] ffff888023345080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 49.025441][ T50] ffff888023345100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 49.025447][ T50] ==================================================================
[ 49.025475][ T50] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 49.335232][ T50] CPU: 2 UID: 0 PID: 50 Comm: kworker/2:1 Not tainted syzkaller #0 PREEMPT(full)
[ 49.338648][ T50] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 49.342476][ T50] Workqueue: usb_hub_wq hub_event
[ 49.344332][ T50] Call Trace:
[ 49.345400][ T50]
[ 49.346471][ T50] dump_stack_lvl+0x100/0x190
[ 49.348398][ T50] vpanic+0x553/0x970
[ 49.349815][ T50] ? __pfx_vpanic+0x10/0x10
[ 49.351261][ T50] ? rcu_is_watching+0x13/0xc0
[ 49.353197][ T50] ? trace_irq_enable.constprop.0+0x122/0x160
[ 49.355643][ T50] ? usb_unbind_interface+0x935/0x9e0
[ 49.357800][ T50] panic+0xd1/0xe0
[ 49.359021][ T50] ? __pfx_panic+0x10/0x10
[ 49.360764][ T50] ? trace_irq_enable.constprop.0+0x2f/0x160
[ 49.363189][ T50] check_panic_on_warn.cold+0x19/0x34
[ 49.365352][ T50] end_report.part.0+0x3a/0x90
[ 49.367120][ T50] kasan_report.cold+0xe/0x18
[ 49.368749][ T50] ? usb_unbind_interface+0x935/0x9e0
[ 49.370906][ T50] usb_unbind_interface+0x935/0x9e0
[ 49.373042][ T50] ? __pfx_usb_unbind_interface+0x10/0x10
[ 49.375357][ T50] device_remove+0x12a/0x180
[ 49.377044][ T50] device_release_driver_internal+0x44e/0x620
[ 49.379265][ T50] bus_remove_device+0x2bc/0x560
[ 49.381252][ T50] ? __pfx_bus_remove_device+0x10/0x10
[ 49.383458][ T50] ? __pfx_device_remove_attrs+0x10/0x10
[ 49.385645][ T50] device_del+0x376/0x9b0
[ 49.387015][ T50] ? __pfx_device_del+0x10/0x10
[ 49.388992][ T50] ? __pfx___pm_runtime_barrier+0x10/0x10
[ 49.391298][ T50] ? lock_acquire+0x1d1/0x380
[ 49.393203][ T50] usb_disable_device+0x367/0x810
[ 49.395244][ T50] ? mark_held_locks+0x40/0x70
[ 49.397196][ T50] usb_disconnect+0x2e2/0x9a0
[ 49.398739][ T50] hub_event+0x1bb1/0x4420
[ 49.400526][ T50] ? __lock_acquire+0x5c0/0x1f40
[ 49.402536][ T50] ? __pfx_hub_event+0x10/0x10
[ 49.404490][ T50] ? down_read_trylock+0x180/0x440
[ 49.406553][ T50] ? lock_acquire+0x1d1/0x380
[ 49.408356][ T50] ? process_one_work+0xa2c/0x1b10
[ 49.410019][ T50] ? process_one_work+0x906/0x1b10
[ 49.412088][ T50] ? process_one_work+0x906/0x1b10
[ 49.414155][ T50] process_one_work+0xac7/0x1b10
[ 49.416154][ T50] ? __pfx_process_one_work+0x10/0x10
[ 49.418307][ T50] ? lock_acquire+0x1d1/0x380
[ 49.420229][ T50] ? __pfx_hub_event+0x10/0x10
[ 49.422200][ T50] worker_thread+0x5ef/0xe50
[ 49.424094][ T50] ? __pfx_worker_thread+0x10/0x10
[ 49.426153][ T50] ? kthread+0x13a/0x450
[ 49.427874][ T50] ? __pfx_worker_thread+0x10/0x10
[ 49.429938][ T50] kthread+0x373/0x450
[ 49.431270][ T50] ? __pfx_kthread+0x10/0x10
[ 49.432806][ T50] ret_from_fork+0x730/0xd60
[ 49.434681][ T50] ? __pfx_ret_from_fork+0x10/0x10
[ 49.436469][ T50] ? __switch_to+0x800/0x10f0
[ 49.438006][ T50] ? __pfx_kthread+0x10/0x10
[ 49.439898][ T50] ret_from_fork_asm+0x1a/0x30
[ 49.441840][ T50]
[ 49.443735][ T50] Kernel Offset: disabled
[ 49.445187][ T50] Rebooting in 86400 seconds..