ci-upstream-kasan-gce-smack-root/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci-upstream-kasan-gce-smack-root/syz-executor411779582 <...> [ 91.943081][ T196] cfg80211: failed to load regulatory.db Warning: Permanently added '10.128.0.74' (ED25519) to the list of known hosts. execve("ci-upstream-kasan-gce-smack-root/syz-executor411779582", ["ci-upstream-kasan-gce-smack-root/syz-executor411779582"], 0x7ffef07fab10 /* 10 vars */) = 0 brk(NULL) = 0x55558fc65000 brk(0x55558fc65d80) = 0x55558fc65d80 arch_prctl(ARCH_SET_FS, 0x55558fc65400) = 0 set_tid_address(0x55558fc656d0) = 5604 set_robust_list(0x55558fc656e0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci-upstream-kasan-gce-smack-root/syz-executor411779582", 4096) = 60 getrandom("\xf7\x8a\x7a\x23\x09\x1d\x60\xf5", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55558fc65d80 brk(0x55558fc86d80) = 0x55558fc86d80 brk(0x55558fc87000) = 0x55558fc87000 mprotect(0x7f0a5e9bb000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce-smack-root/strace-static-x86_64: Process 5605 attached [pid 5605] set_robust_list(0x55558fc656e0, 24 [pid 5604] <... clone resumed>, child_tidptr=0x55558fc656d0) = 5605 [pid 5605] <... set_robust_list resumed>) = 0 [pid 5604] rt_sigprocmask(SIG_SETMASK, [] [pid 5605] rt_sigprocmask(SIG_SETMASK, [] [pid 5604] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5605] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5605] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5605] setpgid(0, 0) = 0 [pid 5605] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5605] write(3, "1000", 4) = 4 [pid 5605] close(3) = 0 [pid 5605] write(1, "executing program\n", 18) = 18 executing program [pid 5605] openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3 [pid 5605] ioctl(3, USB_RAW_IOCTL_INIT, 0x7ffd7c53c280) = 0 [pid 5605] ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 [pid 5605] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5605] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5605] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5605] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5605] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 18 [pid 5605] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [ 93.311436][ T196] usb 1-1: new full-speed USB device number 2 using dummy_hcd [pid 5605] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5605] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5605] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 18 [pid 5605] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5605] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 9 [pid 5605] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5605] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 69 [pid 5605] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5605] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 4 [pid 5605] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5605] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 8 [pid 5605] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5605] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 8 [pid 5605] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [ 93.487788][ T196] usb 1-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 93.504625][ T196] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 93.504835][ T196] usb 1-1: config 1 interface 0 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 93.504917][ T196] usb 1-1: config 1 interface 0 altsetting 1 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [pid 5605] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 8 [pid 5605] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5605] ioctl(3, USB_RAW_IOCTL_VBUS_DRAW, 0x32) = 0 [ 93.547289][ T196] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.552049][ T196] usb 1-1: Product: syz [ 93.552096][ T196] usb 1-1: Manufacturer: syz [ 93.552133][ T196] usb 1-1: SerialNumber: syz [pid 5605] ioctl(3, USB_RAW_IOCTL_CONFIGURE, 0) = 0 [pid 5605] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f0a5e9c1b4c) = 0 [pid 5605] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f0a5e9c1b5c) = 9 [pid 5605] ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffd7c53b270) = 0 [pid 5605] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c2b0) = 0 [pid 5605] ioctl(3, USB_RAW_IOCTL_EP_DISABLE, 0) = 0 [pid 5605] ioctl(3, USB_RAW_IOCTL_EP_DISABLE, 0x9) = 0 [pid 5605] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f0a5e9c1d5c) = 0 [pid 5605] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f0a5e9c1d6c) = 9 [pid 5605] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f0a5e9c1d7c) = -1 EINVAL (Invalid argument) [pid 5605] ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffd7c53b2a0) = 0 [pid 5605] mkdirat(AT_FDCWD, "./my_debugfs", 004) = 0 [pid 5605] mount(NULL, "./my_debugfs", "debugfs", 0, NULL) = 0 [pid 5605] openat(AT_FDCWD, "./my_debugfs/usb/devices", O_RDWR) = 4 [pid 5605] prlimit64(0, RLIMIT_RTPRIO, {rlim_cur=10, rlim_max=1125899906842765}, NULL) = 0 [pid 5605] sched_setscheduler(0, SCHED_RR, {sched_priority=8}) = 0 [pid 5605] sched_setaffinity(0, 0, NULL) = -1 EINVAL (Invalid argument) [pid 5605] llistxattr(NULL, NULL, 0) = -1 EFAULT (Bad address) [pid 5605] read(4, "\nT: Bus=01 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=480 MxCh= 1\nB: Alloc= 0/800 us ( 0%), #Int"..., 8224) = 8224 [pid 5605] exit_group(0) = ? [pid 5605] +++ exited with 0 +++ [ 94.045055][ C0] usb 1-1: received EP1 urb->status = -2 [ 94.045177][ T196] usb 1-1: unable to init card! (ret=-110) [ 94.049494][ T196] snd-usb-caiaq 1-1:1.0: probe with driver snd-usb-caiaq failed with error -110 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5605, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce-smack-root/strace-static-x86_64: Process 5607 attached , child_tidptr=0x55558fc656d0) = 5607 [pid 5604] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5607] set_robust_list(0x55558fc656e0, 24) = 0 [pid 5607] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5607] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5607] setpgid(0, 0) = 0 [pid 5607] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5607] write(3, "1000", 4) = 4 [pid 5607] close(3) = 0 [pid 5607] write(1, "executing program\n", 18) = 18 executing program [pid 5607] openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3 [ 94.092672][ T36] usb 1-1: USB disconnect, device number 2 [pid 5607] ioctl(3, USB_RAW_IOCTL_INIT, 0x7ffd7c53c280) = 0 [pid 5607] ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 [pid 5607] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5607] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5607] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5607] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5607] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 18 [pid 5607] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [ 94.481264][ T36] usb 1-1: new full-speed USB device number 3 using dummy_hcd [pid 5607] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5607] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5607] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 18 [pid 5607] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5607] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 9 [pid 5607] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5607] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 69 [pid 5607] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5607] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 4 [pid 5607] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5607] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 8 [pid 5607] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5607] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 8 [pid 5607] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5607] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 8 [ 94.673780][ T36] usb 1-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 94.687479][ T36] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 94.687576][ T36] usb 1-1: config 1 interface 0 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 94.687596][ T36] usb 1-1: config 1 interface 0 altsetting 1 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [pid 5607] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5607] ioctl(3, USB_RAW_IOCTL_VBUS_DRAW, 0x32) = 0 [pid 5607] ioctl(3, USB_RAW_IOCTL_CONFIGURE, 0) = 0 [pid 5607] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f0a5e9c1b4c) = 0 [pid 5607] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f0a5e9c1b5c) = 9 [pid 5607] ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffd7c53b270) = 0 [ 94.740347][ T36] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.741068][ T36] usb 1-1: Product: syz [ 94.741083][ T36] usb 1-1: Manufacturer: syz [ 94.741096][ T36] usb 1-1: SerialNumber: syz [pid 5607] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c2b0) = 0 [pid 5607] ioctl(3, USB_RAW_IOCTL_EP_DISABLE, 0) = 0 [pid 5607] ioctl(3, USB_RAW_IOCTL_EP_DISABLE, 0x9) = 0 [pid 5607] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f0a5e9c1d5c) = 0 [pid 5607] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f0a5e9c1d6c) = 9 [pid 5607] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f0a5e9c1d7c) = -1 EINVAL (Invalid argument) [pid 5607] ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffd7c53b2a0) = 0 [pid 5607] mkdirat(AT_FDCWD, "./my_debugfs", 004) = -1 EEXIST (File exists) [pid 5607] mount(NULL, "./my_debugfs", "debugfs", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5607] openat(AT_FDCWD, "./my_debugfs/usb/devices", O_RDWR) = 4 [pid 5607] prlimit64(0, RLIMIT_RTPRIO, {rlim_cur=10, rlim_max=1125899906842765}, NULL) = 0 [pid 5607] sched_setscheduler(0, SCHED_RR, {sched_priority=8}) = 0 [pid 5607] sched_setaffinity(0, 0, NULL) = -1 EINVAL (Invalid argument) [pid 5607] llistxattr(NULL, NULL, 0) = -1 EFAULT (Bad address) [pid 5607] read(4, "\nT: Bus=01 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=480 MxCh= 1\nB: Alloc= 0/800 us ( 0%), #Int"..., 8224) = 8224 [pid 5607] exit_group(0) = ? [pid 5607] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5607, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce-smack-root/strace-static-x86_64: Process 5613 attached [pid 5613] set_robust_list(0x55558fc656e0, 24) = 0 [pid 5604] <... clone resumed>, child_tidptr=0x55558fc656d0) = 5613 [pid 5604] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5613] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 95.251628][ C1] usb 1-1: received EP1 urb->status = -2 [ 95.251735][ T36] usb 1-1: unable to init card! (ret=-110) [ 95.252920][ T36] snd-usb-caiaq 1-1:1.0: probe with driver snd-usb-caiaq failed with error -110 [pid 5613] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5613] setpgid(0, 0) = 0 [pid 5613] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5613] write(3, "1000", 4) = 4 [pid 5613] close(3) = 0 [pid 5613] write(1, "executing program\n", 18) = 18 executing program [pid 5613] openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3 [pid 5613] ioctl(3, USB_RAW_IOCTL_INIT, 0x7ffd7c53c280) = 0 [ 95.309705][ T36] usb 1-1: USB disconnect, device number 3 [pid 5613] ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 [pid 5613] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5613] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5613] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5613] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5613] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 18 [pid 5613] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [ 95.641275][ T36] usb 1-1: new full-speed USB device number 4 using dummy_hcd [pid 5613] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5613] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5613] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 18 [pid 5613] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5613] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 9 [pid 5613] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [ 95.793153][ T36] usb 1-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 95.813138][ T36] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 95.813260][ T36] usb 1-1: config 1 interface 0 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [pid 5613] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 69 [pid 5613] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5613] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 4 [pid 5613] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5613] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 8 [pid 5613] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5613] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 8 [pid 5613] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5613] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 8 [pid 5613] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5613] ioctl(3, USB_RAW_IOCTL_VBUS_DRAW, 0x32) = 0 [pid 5613] ioctl(3, USB_RAW_IOCTL_CONFIGURE, 0) = 0 [pid 5613] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f0a5e9c1b4c) = 0 [pid 5613] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f0a5e9c1b5c) = 9 [pid 5613] ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffd7c53b270) = 0 [ 95.813286][ T36] usb 1-1: config 1 interface 0 altsetting 1 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 95.853837][ T36] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.853905][ T36] usb 1-1: Product: syz [ 95.853922][ T36] usb 1-1: Manufacturer: syz [ 95.853953][ T36] usb 1-1: SerialNumber: syz [pid 5613] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c2b0) = 0 [pid 5613] ioctl(3, USB_RAW_IOCTL_EP_DISABLE, 0) = 0 [pid 5613] ioctl(3, USB_RAW_IOCTL_EP_DISABLE, 0x9) = 0 [pid 5613] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f0a5e9c1d5c) = 0 [pid 5613] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f0a5e9c1d6c) = 9 [pid 5613] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f0a5e9c1d7c) = -1 EINVAL (Invalid argument) [pid 5613] ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffd7c53b2a0) = 0 [pid 5613] mkdirat(AT_FDCWD, "./my_debugfs", 004) = -1 EEXIST (File exists) [pid 5613] mount(NULL, "./my_debugfs", "debugfs", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5613] openat(AT_FDCWD, "./my_debugfs/usb/devices", O_RDWR) = 4 [pid 5613] prlimit64(0, RLIMIT_RTPRIO, {rlim_cur=10, rlim_max=1125899906842765}, NULL) = 0 [pid 5613] sched_setscheduler(0, SCHED_RR, {sched_priority=8}) = 0 [pid 5613] sched_setaffinity(0, 0, NULL) = -1 EINVAL (Invalid argument) [pid 5613] llistxattr(NULL, NULL, 0) = -1 EFAULT (Bad address) [pid 5613] read(4, "\nT: Bus=01 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=480 MxCh= 1\nB: Alloc= 0/800 us ( 0%), #Int"..., 8224) = 8224 [pid 5613] exit_group(0) = ? [pid 5613] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5613, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce-smack-root/strace-static-x86_64: Process 5616 attached , child_tidptr=0x55558fc656d0) = 5616 [pid 5616] set_robust_list(0x55558fc656e0, 24 [pid 5604] rt_sigprocmask(SIG_SETMASK, [] [pid 5616] <... set_robust_list resumed>) = 0 [pid 5604] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5616] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5616] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5616] setpgid(0, 0) = 0 [pid 5616] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [ 96.341835][ C1] usb 1-1: received EP1 urb->status = -2 [ 96.341980][ T36] usb 1-1: unable to init card! (ret=-110) [ 96.352164][ T36] snd-usb-caiaq 1-1:1.0: probe with driver snd-usb-caiaq failed with error -110 [ 96.377140][ T36] usb 1-1: USB disconnect, device number 4 [pid 5616] write(3, "1000", 4) = 4 [pid 5616] close(3) = 0 [pid 5616] write(1, "executing program\n", 18) = 18 executing program [pid 5616] openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3 [pid 5616] ioctl(3, USB_RAW_IOCTL_INIT, 0x7ffd7c53c280) = 0 [pid 5616] ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 [pid 5616] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5616] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5616] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5616] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5616] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 18 [pid 5616] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [ 96.741315][ T36] usb 1-1: new full-speed USB device number 5 using dummy_hcd [pid 5616] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5616] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5616] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 18 [pid 5616] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5616] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 9 [pid 5616] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [ 96.893007][ T36] usb 1-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 96.911035][ T36] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 96.911218][ T36] usb 1-1: config 1 interface 0 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [pid 5616] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 69 [pid 5616] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5616] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 4 [pid 5616] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5616] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 8 [pid 5616] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5616] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 8 [pid 5616] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [ 96.911239][ T36] usb 1-1: config 1 interface 0 altsetting 1 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [pid 5616] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 8 [pid 5616] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5616] ioctl(3, USB_RAW_IOCTL_VBUS_DRAW, 0x32) = 0 [pid 5616] ioctl(3, USB_RAW_IOCTL_CONFIGURE, 0) = 0 [pid 5616] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f0a5e9c1b4c) = 0 [pid 5616] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f0a5e9c1b5c) = 9 [pid 5616] ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffd7c53b270) = 0 [ 96.974952][ T36] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 96.975024][ T36] usb 1-1: Product: syz [ 96.975041][ T36] usb 1-1: Manufacturer: syz [ 96.975056][ T36] usb 1-1: SerialNumber: syz [pid 5616] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c2b0) = 0 [pid 5616] ioctl(3, USB_RAW_IOCTL_EP_DISABLE, 0) = 0 [pid 5616] ioctl(3, USB_RAW_IOCTL_EP_DISABLE, 0x9) = 0 [pid 5616] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f0a5e9c1d5c) = 0 [pid 5616] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f0a5e9c1d6c) = 9 [pid 5616] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f0a5e9c1d7c) = -1 EINVAL (Invalid argument) [pid 5616] ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffd7c53b2a0) = 0 [pid 5616] mkdirat(AT_FDCWD, "./my_debugfs", 004) = -1 EEXIST (File exists) [pid 5616] mount(NULL, "./my_debugfs", "debugfs", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5616] openat(AT_FDCWD, "./my_debugfs/usb/devices", O_RDWR) = 4 [pid 5616] prlimit64(0, RLIMIT_RTPRIO, {rlim_cur=10, rlim_max=1125899906842765}, NULL) = 0 [pid 5616] sched_setscheduler(0, SCHED_RR, {sched_priority=8}) = 0 [pid 5616] sched_setaffinity(0, 0, NULL) = -1 EINVAL (Invalid argument) [pid 5616] llistxattr(NULL, NULL, 0) = -1 EFAULT (Bad address) [pid 5616] read(4, "\nT: Bus=01 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=480 MxCh= 1\nB: Alloc= 0/800 us ( 0%), #Int"..., 8224) = 8224 [pid 5616] exit_group(0) = ? [pid 5616] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5616, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce-smack-root/strace-static-x86_64: Process 5618 attached [pid 5618] set_robust_list(0x55558fc656e0, 24 [pid 5604] <... clone resumed>, child_tidptr=0x55558fc656d0) = 5618 [pid 5618] <... set_robust_list resumed>) = 0 [pid 5604] rt_sigprocmask(SIG_SETMASK, [] [pid 5618] rt_sigprocmask(SIG_SETMASK, [] [pid 5604] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5618] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5618] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5618] setpgid(0, 0) = 0 [pid 5618] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5618] write(3, "1000", 4) = 4 [pid 5618] close(3) = 0 executing program [pid 5618] write(1, "executing program\n", 18) = 18 [pid 5618] openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3 [pid 5618] ioctl(3, USB_RAW_IOCTL_INIT, 0x7ffd7c53c280) = 0 [ 97.431650][ C1] usb 1-1: received EP1 urb->status = -2 [ 97.432613][ T36] usb 1-1: unable to init card! (ret=-110) [ 97.434599][ T36] snd-usb-caiaq 1-1:1.0: probe with driver snd-usb-caiaq failed with error -110 [ 97.465022][ T36] usb 1-1: USB disconnect, device number 5 [pid 5618] ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 [pid 5618] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5618] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5618] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5618] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5618] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 18 [pid 5618] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [ 97.821310][ T36] usb 1-1: new full-speed USB device number 6 using dummy_hcd [pid 5618] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5618] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5618] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 18 [pid 5618] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5618] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 9 [pid 5618] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5618] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 69 [pid 5618] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [ 97.982949][ T36] usb 1-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 98.003419][ T36] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 98.003929][ T36] usb 1-1: config 1 interface 0 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [pid 5618] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 4 [pid 5618] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5618] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 8 [pid 5618] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5618] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 8 [ 98.003966][ T36] usb 1-1: config 1 interface 0 altsetting 1 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [pid 5618] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5618] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffd7c53b270) = 8 [pid 5618] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c280) = 0 [pid 5618] ioctl(3, USB_RAW_IOCTL_VBUS_DRAW, 0x32) = 0 [pid 5618] ioctl(3, USB_RAW_IOCTL_CONFIGURE, 0) = 0 [pid 5618] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f0a5e9c1b4c) = 0 [pid 5618] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f0a5e9c1b5c) = 9 [pid 5618] ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffd7c53b270) = 0 [ 98.055478][ T36] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.055700][ T36] usb 1-1: Product: syz [ 98.055718][ T36] usb 1-1: Manufacturer: syz [ 98.055742][ T36] usb 1-1: SerialNumber: syz [pid 5618] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffd7c53c2b0) = 0 [pid 5618] ioctl(3, USB_RAW_IOCTL_EP_DISABLE, 0) = 0 [pid 5618] ioctl(3, USB_RAW_IOCTL_EP_DISABLE, 0x9) = 0 [pid 5618] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f0a5e9c1d5c) = 0 [pid 5618] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f0a5e9c1d6c) = 9 [pid 5618] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f0a5e9c1d7c) = -1 EINVAL (Invalid argument) [pid 5618] ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffd7c53b2a0) = 0 [pid 5618] mkdirat(AT_FDCWD, "./my_debugfs", 004) = -1 EEXIST (File exists) [pid 5618] mount(NULL, "./my_debugfs", "debugfs", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5618] openat(AT_FDCWD, "./my_debugfs/usb/devices", O_RDWR) = 4 [pid 5618] prlimit64(0, RLIMIT_RTPRIO, {rlim_cur=10, rlim_max=1125899906842765}, NULL) = 0 [pid 5618] sched_setscheduler(0, SCHED_RR, {sched_priority=8}) = 0 [pid 5618] sched_setaffinity(0, 0, NULL) = -1 EINVAL (Invalid argument) [pid 5618] llistxattr(NULL, NULL, 0) = -1 EFAULT (Bad address) [pid 5618] read(4, "\nT: Bus=01 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=480 MxCh= 1\nB: Alloc= 0/800 us ( 0%), #Int"..., 8224) = 8224 [pid 5618] exit_group(0) = ? [ 98.533423][ C1] usb 1-1: received EP1 urb->status = -2 [ 98.533490][ T36] usb 1-1: unable to init card! (ret=-110) [ 98.533824][ T36] snd-usb-caiaq 1-1:1.0: probe with driver snd-usb-caiaq failed with error -110 [ 98.535135][ C1] ================================================================== [ 98.535148][ C1] BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 [ 98.535198][ C1] Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29 [ 98.535217][ C1] [ 98.535237][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 98.535263][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 98.535285][ C1] Call Trace: [ 98.535293][ C1] [ 98.535303][ C1] dump_stack_lvl+0xe8/0x150 [ 98.535338][ C1] print_address_description+0x55/0x1e0 [ 98.535373][ C1] ? usb_free_urb+0x24/0x120 [ 98.535395][ C1] print_report+0x58/0x70 [ 98.535425][ C1] kasan_report+0x117/0x150 [ 98.535460][ C1] ? usb_free_urb+0x24/0x120 [ 98.535487][ C1] kasan_check_range+0x264/0x2c0 [ 98.535522][ C1] usb_free_urb+0x24/0x120 [ 98.535546][ C1] dummy_timer+0xaac/0x4d50 [ 98.535587][ C1] ? __lock_acquire+0x6df/0x2e40 [ 98.535619][ C1] ? rtlock_slowlock_locked+0xfb/0x3c20 [ 98.535657][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 98.535678][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 98.535703][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 98.535720][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 98.535744][ C1] __hrtimer_run_queues+0x3eb/0xaf0 [ 98.535767][ C1] hrtimer_run_softirq+0x1e1/0x2e0 [ 98.535786][ C1] handle_softirqs+0x1da/0x6d0 [ 98.535811][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 98.535834][ C1] run_ktimerd+0x6a/0x100 [ 98.535856][ C1] smpboot_thread_fn+0x565/0xa70 [ 98.535880][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 98.535906][ C1] kthread+0x38b/0x470 [ 98.535921][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 98.535943][ C1] ? __pfx_kthread+0x10/0x10 [ 98.535958][ C1] ret_from_fork+0x514/0xb70 [ 98.535975][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 98.535990][ C1] ? __switch_to+0xc89/0x1420 [ 98.536020][ C1] ? __pfx_kthread+0x10/0x10 [ 98.536035][ C1] ret_from_fork_asm+0x1a/0x30 [ 98.536055][ C1] [ 98.536061][ C1] [ 98.536064][ C1] Allocated by task 36: [ 98.536072][ C1] kasan_save_track+0x3e/0x80 [ 98.536090][ C1] __kasan_kmalloc+0x93/0xb0 [ 98.536110][ C1] __kmalloc_noprof+0x41d/0x790 [ 98.536128][ C1] snd_card_new+0x7b/0x110 [ 98.536151][ C1] snd_probe+0x236/0x1af0 [ 98.536170][ C1] usb_probe_interface+0x788/0xe50 [ 98.536192][ C1] really_probe+0x254/0xae0 [ 98.536211][ C1] __driver_probe_device+0x1e8/0x360 [ 98.536230][ C1] driver_probe_device+0x4f/0x240 [ 98.536249][ C1] __device_attach_driver+0x270/0x410 [ 98.536268][ C1] bus_for_each_drv+0x25b/0x2f0 [ 98.536281][ C1] __device_attach+0x2c7/0x450 [ 98.536299][ C1] device_initial_probe+0xa1/0xd0 [ 98.536317][ C1] bus_probe_device+0x12d/0x220 [ 98.536329][ C1] device_add+0x7d7/0xb80 [ 98.536344][ C1] usb_set_configuration+0x1ad8/0x2180 [ 98.536364][ C1] usb_generic_driver_probe+0x8d/0x150 [ 98.536382][ C1] usb_probe_device+0x1c3/0x3b0 [ 98.536402][ C1] really_probe+0x254/0xae0 [ 98.536421][ C1] __driver_probe_device+0x1e8/0x360 [ 98.536439][ C1] driver_probe_device+0x4f/0x240 [ 98.536458][ C1] __device_attach_driver+0x270/0x410 [ 98.536478][ C1] bus_for_each_drv+0x25b/0x2f0 [ 98.536490][ C1] __device_attach+0x2c7/0x450 [ 98.536508][ C1] device_initial_probe+0xa1/0xd0 [ 98.536526][ C1] bus_probe_device+0x12d/0x220 [ 98.536538][ C1] device_add+0x7d7/0xb80 [ 98.536553][ C1] usb_new_device+0x99a/0x1680 [ 98.536568][ C1] hub_event+0x28cf/0x4cf0 [ 98.536586][ C1] process_scheduled_works+0xc3d/0x1630 [ 98.536605][ C1] worker_thread+0xa47/0xfb0 [ 98.536625][ C1] kthread+0x38b/0x470 [ 98.536637][ C1] ret_from_fork+0x514/0xb70 [ 98.536650][ C1] ret_from_fork_asm+0x1a/0x30 [ 98.536662][ C1] [ 98.536666][ C1] Freed by task 36: [ 98.536672][ C1] kasan_save_track+0x3e/0x80 [ 98.536690][ C1] kasan_save_free_info+0x40/0x50 [ 98.536704][ C1] __kasan_slab_free+0x5c/0x80 [ 98.536723][ C1] kfree+0x1c5/0x6d0 [ 98.536738][ C1] device_release+0xc4/0x1f0 [ 98.536759][ C1] kobject_put+0x222/0x550 [ 98.536776][ C1] snd_card_free+0x138/0x1d0 [ 98.536788][ C1] snd_probe+0x162b/0x1af0 [ 98.536807][ C1] usb_probe_interface+0x788/0xe50 [ 98.536828][ C1] really_probe+0x254/0xae0 [ 98.536846][ C1] __driver_probe_device+0x1e8/0x360 [ 98.536865][ C1] driver_probe_device+0x4f/0x240 [ 98.536884][ C1] __device_attach_driver+0x270/0x410 [ 98.536904][ C1] bus_for_each_drv+0x25b/0x2f0 [ 98.536916][ C1] __device_attach+0x2c7/0x450 [ 98.536934][ C1] device_initial_probe+0xa1/0xd0 [ 98.536952][ C1] bus_probe_device+0x12d/0x220 [ 98.536964][ C1] device_add+0x7d7/0xb80 [ 98.536979][ C1] usb_set_configuration+0x1ad8/0x2180 [ 98.537004][ C1] usb_generic_driver_probe+0x8d/0x150 [ 98.537022][ C1] usb_probe_device+0x1c3/0x3b0 [ 98.537042][ C1] really_probe+0x254/0xae0 [ 98.537060][ C1] __driver_probe_device+0x1e8/0x360 [ 98.537079][ C1] driver_probe_device+0x4f/0x240 [ 98.537098][ C1] __device_attach_driver+0x270/0x410 [ 98.537117][ C1] bus_for_each_drv+0x25b/0x2f0 [ 98.537130][ C1] __device_attach+0x2c7/0x450 [ 98.537147][ C1] device_initial_probe+0xa1/0xd0 [ 98.537165][ C1] bus_probe_device+0x12d/0x220 [ 98.537178][ C1] device_add+0x7d7/0xb80 [ 98.537193][ C1] usb_new_device+0x99a/0x1680 [ 98.537207][ C1] hub_event+0x28cf/0x4cf0 [ 98.537224][ C1] process_scheduled_works+0xc3d/0x1630 [ 98.537243][ C1] worker_thread+0xa47/0xfb0 [ 98.537263][ C1] kthread+0x38b/0x470 [ 98.537275][ C1] ret_from_fork+0x514/0xb70 [ 98.537288][ C1] ret_from_fork_asm+0x1a/0x30 [ 98.537300][ C1] [ 98.537304][ C1] The buggy address belongs to the object at ffff88803cee0000 [ 98.537304][ C1] which belongs to the cache kmalloc-8k of size 8192 [ 98.537317][ C1] The buggy address is located 4176 bytes inside of [ 98.537317][ C1] freed 8192-byte region [ffff88803cee0000, ffff88803cee2000) [ 98.537334][ C1] [ 98.537337][ C1] The buggy address belongs to the physical page: [ 98.537349][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3cee0 [ 98.537363][ C1] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 98.537376][ C1] flags: 0x80000000000040(head|node=0|zone=1) [ 98.537395][ C1] page_type: f5(slab) [ 98.537409][ C1] raw: 0080000000000040 ffff88813ff00280 dead000000000122 0000000000000000 [ 98.537422][ C1] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 98.537436][ C1] head: 0080000000000040 ffff88813ff00280 dead000000000122 0000000000000000 [ 98.537449][ C1] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 98.537464][ C1] head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 98.537479][ C1] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 98.537487][ C1] page dumped because: kasan: bad access detected [ 98.537497][ C1] page_owner tracks the page as allocated [ 98.537503][ C1] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2000(__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5616, tgid 5616 (syz-executor411), ts 97458631629 [ 98.537528][ C1] post_alloc_hook+0x1f9/0x250 [ 98.537544][ C1] get_page_from_freelist+0x2591/0x2600 [ 98.537565][ C1] __alloc_frozen_pages_noprof+0x230/0x5c0 [ 98.537585][ C1] allocate_slab+0x7d/0x620 [ 98.537598][ C1] refill_objects+0x2d8/0x350 [ 98.537612][ C1] __pcs_replace_empty_main+0x339/0x690 [ 98.537635][ C1] __kmalloc_cache_noprof+0x46f/0x680 [ 98.537654][ C1] usb_device_dump+0xd0/0x2200 [ 98.537684][ C1] usb_device_read+0x1b4/0x2c0 [ 98.537701][ C1] full_proxy_read+0x127/0x1f0 [ 98.537716][ C1] vfs_read+0x219/0xa90 [ 98.537728][ C1] ksys_read+0x156/0x270 [ 98.537741][ C1] do_syscall_64+0x166/0x520 [ 98.537756][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.537770][ C1] page last free pid 5598 tgid 5598 ts 96447293579 stack trace: [ 98.537779][ C1] __free_frozen_pages+0xf8e/0x1070 [ 98.537795][ C1] __slab_free+0x250/0x2a0 [ 98.537812][ C1] qlist_free_all+0x99/0x100 [ 98.537828][ C1] kasan_quarantine_reduce+0x148/0x160 [ 98.537845][ C1] __kasan_slab_alloc+0x22/0x80 [ 98.537863][ C1] __kmalloc_cache_noprof+0x353/0x680 [ 98.537881][ C1] kernfs_fop_open+0x3a7/0xcf0 [ 98.537900][ C1] do_dentry_open+0x849/0x1420 [ 98.537919][ C1] vfs_open+0x3b/0x350 [ 98.537936][ C1] path_openat+0x1448/0x1d60 [ 98.537952][ C1] do_file_open+0x23e/0x4a0 [ 98.537966][ C1] do_sys_openat2+0x115/0x200 [ 98.537985][ C1] __x64_sys_openat+0x138/0x170 [ 98.538011][ C1] do_syscall_64+0x166/0x520 [ 98.538025][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.538038][ C1] [ 98.538041][ C1] Memory state around the buggy address: [ 98.538049][ C1] ffff88803cee0f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 98.538058][ C1] ffff88803cee0f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 98.538068][ C1] >ffff88803cee1000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 98.538075][ C1] ^ [ 98.538083][ C1] ffff88803cee1080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 98.538093][ C1] ffff88803cee1100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 98.538100][ C1] ================================================================== [ 98.544085][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 99.487954][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 99.497539][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 99.507603][ C1] Call Trace: [ 99.510895][ C1] [ 99.513860][ C1] vpanic+0x56d/0xa60 [ 99.517883][ C1] ? __pfx_vpanic+0x10/0x10 [ 99.522416][ C1] panic+0xc5/0xd0 [ 99.526145][ C1] ? __pfx_panic+0x10/0x10 [ 99.530570][ C1] ? preempt_schedule_thunk+0x16/0x40 [ 99.535958][ C1] ? usb_free_urb+0x24/0x120 [ 99.540555][ C1] ? preempt_schedule_thunk+0x16/0x40 [ 99.545939][ C1] ? usb_free_urb+0x24/0x120 [ 99.550539][ C1] check_panic_on_warn+0x89/0xb0 [ 99.555502][ C1] ? usb_free_urb+0x24/0x120 [ 99.560107][ C1] end_report+0x73/0x170 [ 99.564367][ C1] ? usb_free_urb+0x24/0x120 [ 99.568991][ C1] kasan_report+0x128/0x150 [ 99.573517][ C1] ? usb_free_urb+0x24/0x120 [ 99.578120][ C1] kasan_check_range+0x264/0x2c0 [ 99.583078][ C1] usb_free_urb+0x24/0x120 [ 99.587532][ C1] dummy_timer+0xaac/0x4d50 [ 99.592063][ C1] ? __lock_acquire+0x6df/0x2e40 [ 99.597016][ C1] ? rtlock_slowlock_locked+0xfb/0x3c20 [ 99.602609][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 99.608025][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 99.612984][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 99.618810][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 99.623772][ C1] __hrtimer_run_queues+0x3eb/0xaf0 [ 99.628993][ C1] hrtimer_run_softirq+0x1e1/0x2e0 [ 99.634125][ C1] handle_softirqs+0x1da/0x6d0 [ 99.638915][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 99.643975][ C1] run_ktimerd+0x6a/0x100 [ 99.648335][ C1] smpboot_thread_fn+0x565/0xa70 [ 99.653302][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 99.658354][ C1] kthread+0x38b/0x470 [ 99.662445][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 99.667928][ C1] ? __pfx_kthread+0x10/0x10 [ 99.672533][ C1] ret_from_fork+0x514/0xb70 [ 99.677140][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 99.682279][ C1] ? __switch_to+0xc89/0x1420 [ 99.686975][ C1] ? __pfx_kthread+0x10/0x10 [ 99.691577][ C1] ret_from_fork_asm+0x1a/0x30 [ 99.696366][ C1] [ 99.700018][ C1] Kernel Offset: disabled [ 99.704401][ C1] Rebooting in 86400 seconds..