Warning: Permanently added '10.128.1.154' (ED25519) to the list of known hosts.
[ 81.424332][ T30] kauditd_printk_skb: 35 callbacks suppressed
[ 81.424398][ T30] audit: type=1400 audit(1790464490.593:122): avc: denied { read write } for pid=4020 comm="syz-executor396" name="raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 81.430921][ T30] audit: type=1400 audit(1790464490.593:123): avc: denied { open } for pid=4020 comm="syz-executor396" path="/dev/raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 81.430980][ T30] audit: type=1400 audit(1790464490.593:124): avc: denied { ioctl } for pid=4020 comm="syz-executor396" path="/dev/raw-gadget" dev="devtmpfs" ino=236 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 81.668753][ T11] usb 3-1: new high-speed USB device number 2 using dummy_hcd
[ 81.819270][ T11] usb 3-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 81.821068][ T11] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 88.496824][ T813] ==================================================================
[ 88.496842][ T813] BUG: KASAN: slab-use-after-free in rtsx_usb_ms_handle_req+0x17cb/0x1a00
[ 88.496890][ T813] Read of size 1 at addr ffff88810933c071 by task kworker/1:2/813
[ 88.496909][ T813]
[ 88.496933][ T813] CPU: 1 UID: 0 PID: 813 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(lazy)
[ 88.496960][ T813] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 88.496978][ T813] Workqueue: events rtsx_usb_ms_handle_req
[ 88.497012][
** replaying previous printk message **
[ 88.497012][ T813] Call Trace:
[ 88.497020][ T813]
[ 88.497030][ T813] dump_stack_lvl+0x100/0x190
[ 88.497073][ T813] print_report+0x13d/0x4b0
[ 88.497109][ T813] ? __virt_addr_valid+0x239/0x430
[ 88.497150][ T813] ? rtsx_usb_ms_handle_req+0x17cb/0x1a00
[ 88.497176][ T813] kasan_report+0xdf/0x1c0
[ 88.497205][ T813] ? rtsx_usb_ms_handle_req+0x17cb/0x1a00
[ 88.497237][ T813] rtsx_usb_ms_handle_req+0x17cb/0x1a00
[ 88.497266][ T813] ? reacquire_held_locks+0xdd/0x1f0
[ 88.497295][ T813] ? __pfx_rtsx_usb_ms_handle_req+0x10/0x10
[ 88.497322][ T813] ? process_one_work+0xa2c/0x1b10
[ 88.497361][ T813] ? process_one_work+0x906/0x1b10
[ 88.497406][ T813] ? process_one_work+0x906/0x1b10
[ 88.497446][ T813] process_one_work+0xac7/0x1b10
[ 88.497491][ T813] ? __pfx_process_one_work+0x10/0x10
[ 88.497530][ T813] ? lock_acquire+0x1d1/0x380
[ 88.497558][ T813] ? __pfx_rtsx_usb_ms_handle_req+0x10/0x10
[ 88.497601][ T813] worker_thread+0x5ef/0xe50
[ 88.497649][ T813] ? __pfx_worker_thread+0x10/0x10
[ 88.497687][ T813] ? kthread+0x13a/0x450
[ 88.497720][ T813] ? __pfx_worker_thread+0x10/0x10
[ 88.497759][ T813] kthread+0x373/0x450
[ 88.497792][ T813] ? __pfx_kthread+0x10/0x10
[ 88.497828][ T813] ret_from_fork+0x69f/0xc90
[ 88.497854][ T813] ? __pfx_ret_from_fork+0x10/0x10
[ 88.497879][ T813] ? __switch_to+0x7f6/0x10e0
[ 88.497910][ T813] ? __switch_to_asm+0x39/0x70
[ 88.497937][ T813] ? __pfx_kthread+0x10/0x10
[ 88.497973][ T813] ret_from_fork_asm+0x1a/0x30
[ 88.498012][ T813]
[ 88.498021][ T813]
[ 88.498026][ T813] Allocated by task 48:
[ 88.498041][ T813] kasan_save_stack+0x30/0x50
[ 88.498062][ T813] kasan_save_track+0x14/0x30
[ 88.498082][ T813] __kasan_kmalloc+0x8f/0xa0
[ 88.498116][ T813] __kmalloc_cache_noprof+0x2d8/0x680
[ 88.498141][ T813] memstick_check+0x2c1/0x10d0
[ 88.498162][ T813] process_one_work+0xac7/0x1b10
[ 88.498197][ T813] worker_thread+0x5ef/0xe50
[ 88.498230][ T813] kthread+0x373/0x450
[ 88.498260][ T813] ret_from_fork+0x69f/0xc90
[ 88.498279][ T813] ret_from_fork_asm+0x1a/0x30
[ 88.498303][ T813]
[ 88.498308][ T813] Freed by task 48:
[ 88.498319][ T813] kasan_save_stack+0x30/0x50
[ 88.498339][ T813] kasan_save_track+0x14/0x30
[ 88.498359][ T813] kasan_save_free_info+0x3b/0x70
[ 88.498397][ T813] __kasan_slab_free+0x43/0x70
[ 88.498417][ T813] kfree+0x20c/0x650
[ 88.498435][ T813] memstick_check+0x72b/0x10d0
[ 88.498455][ T813] process_one_work+0xac7/0x1b10
[ 88.498486][ T813] worker_thread+0x5ef/0xe50
[ 88.498519][ T813] kthread+0x373/0x450
[ 88.498549][ T813] ret_from_fork+0x69f/0xc90
[ 88.498570][ T813] ret_from_fork_asm+0x1a/0x30
[ 88.498597][ T813]
[ 88.498602][ T813] The buggy address belongs to the object at ffff88810933c000
[ 88.498602][ T813] which belongs to the cache kmalloc-2k of size 2048
[ 88.498619][ T813] The buggy address is located 113 bytes inside of
[ 88.498619][ T813] freed 2048-byte region [ffff88810933c000, ffff88810933c800)
[ 88.498648][ T813]
[ 88.498654][ T813] The buggy address belongs to the physical page:
[ 88.498673][ T813] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109338
[ 88.498698][ T813] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 88.498716][ T813] flags: 0x200000000000040(head|node=0|zone=2)
[ 88.498739][ T813] page_type: f5(slab)
[ 88.498761][ T813] raw: 0200000000000040 ffff888100042000 dead000000000100 dead000000000122
[ 88.498787][ T813] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 88.498811][ T813] head: 0200000000000040 ffff888100042000 dead000000000100 dead000000000122
[ 88.498833][ T813] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 88.498856][ T813] head: 0200000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 88.498877][ T813] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008
[ 88.498891][ T813] page dumped because: kasan: bad access detected
[ 88.498903][ T813] page_owner tracks the page as allocated
[ 88.498910][ T813] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 11, tgid 11 (kworker/0:1), ts 84846591069
[ 88.498949][ T813] post_alloc_hook+0xfd/0x120
[ 88.498985][ T813] get_page_from_freelist+0xf4b/0x3440
[ 88.499008][ T813] __alloc_frozen_pages_noprof+0x2d7/0x2f70
[ 88.499032][ T813] new_slab+0xa9/0x6e0
[ 88.499054][ T813] refill_objects+0xe3/0x410
[ 88.499078][ T813] __pcs_replace_empty_main+0x35e/0x650
[ 88.499102][ T813] __kmalloc_noprof+0x61c/0x7e0
[ 88.499128][ T813] platform_device_alloc+0x35/0x260
[ 88.499163][ T813] mfd_add_device+0x102/0x17d0
[ 88.499187][ T813] mfd_add_devices+0xe0/0x170
[ 88.499211][ T813] rtsx_usb_probe+0x919/0xd30
[ 88.499245][ T813] usb_probe_interface+0x386/0x9b0
[ 88.499269][ T813] really_probe+0x241/0xa60
[ 88.499290][ T813] __driver_probe_device+0x210/0x460
[ 88.499312][ T813] driver_probe_device+0x4a/0x140
[ 88.499333][ T813] __device_attach_driver+0x1df/0x320
[ 88.499356][ T813] page last free pid 4026 tgid 4026 ts 81945508128 stack trace:
[ 88.499379][ T813] __free_frozen_pages+0x714/0xfc0
[ 88.499413][ T813] qlist_free_all+0x47/0xf0
[ 88.499445][ T813] kasan_quarantine_reduce+0x1a0/0x1f0
[ 88.499479][ T813] __kasan_slab_alloc+0x4e/0x70
[ 88.499501][ T813] kmem_cache_alloc_node_noprof+0x27d/0x690
[ 88.499530][ T813] __alloc_skb+0x140/0x710
[ 88.499552][ T813] alloc_skb_with_frags+0xdd/0x760
[ 88.499579][ T813] sock_alloc_send_pskb+0x801/0x980
[ 88.499615][ T813] unix_dgram_sendmsg+0x3c7/0x1810
[ 88.499651][ T813] sock_write_iter+0x53a/0x5b0
[ 88.499681][ T813] vfs_write+0x6af/0x1050
[ 88.499708][ T813] ksys_write+0x1f8/0x250
[ 88.499736][ T813] do_syscall_64+0x119/0x710
[ 88.499767][ T813] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.499792][ T813]
[ 88.499797][ T813] Memory state around the buggy address:
[ 88.499808][ T813] ffff88810933bf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 88.499826][ T813] ffff88810933bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 88.499843][ T813] >ffff88810933c000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 88.499856][ T813] ^
[ 88.499870][ T813] ffff88810933c080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 88.499887][ T813] ffff88810933c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 88.499900][ T813] ==================================================================
[ 88.515598][ T30] audit: type=1400 audit(1790464497.673:125): avc: denied { read } for pid=2850 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1
[ 88.515655][ T30] audit: type=1400 audit(1790464497.673:126): avc: denied { search } for pid=2850 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 88.517058][ T30] audit: type=1400 audit(1790464497.673:127): avc: denied { write search } for pid=2850 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 88.517112][ T30] audit: type=1400 audit(1790464497.673:128): avc: denied { add_name } for pid=2850 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 88.517159][ T30] audit: type=1400 audit(1790464497.673:129): avc: denied { create } for pid=2850 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 88.517292][ T30] audit: type=1400 audit(1790464497.693:130): avc: denied { append open } for pid=2850 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 88.517617][ T30] audit: type=1400 audit(1790464497.693:131): avc: denied { getattr } for pid=2850 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 88.553486][ T813] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 89.345346][ T813] CPU: 1 UID: 0 PID: 813 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(lazy)
[ 89.354630][ T813] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 89.364676][ T813] Workqueue: events rtsx_usb_ms_handle_req
[ 89.370480][ T813] Call Trace:
[ 89.373749][ T813]
[ 89.376685][ T813] dump_stack_lvl+0x100/0x190
[ 89.381363][ T813] vpanic+0x553/0x970
[ 89.385345][ T813] ? __pfx_vpanic+0x10/0x10
[ 89.389837][ T813] ? rtsx_usb_ms_handle_req+0x17cb/0x1a00
[ 89.395560][ T813] panic+0xd1/0xe0
[ 89.399271][ T813] ? __pfx_panic+0x10/0x10
[ 89.403693][ T813] ? rtsx_usb_ms_handle_req+0x17cb/0x1a00
[ 89.409401][ T813] ? preempt_schedule_common+0x3c/0xb0
[ 89.414940][ T813] check_panic_on_warn.cold+0x19/0x34
[ 89.420322][ T813] end_report.part.0+0x3a/0x90
[ 89.425083][ T813] kasan_report.cold+0xe/0x18
[ 89.429767][ T813] ? rtsx_usb_ms_handle_req+0x17cb/0x1a00
[ 89.435565][ T813] rtsx_usb_ms_handle_req+0x17cb/0x1a00
[ 89.441098][ T813] ? reacquire_held_locks+0xdd/0x1f0
[ 89.446369][ T813] ? __pfx_rtsx_usb_ms_handle_req+0x10/0x10
[ 89.452242][ T813] ? process_one_work+0xa2c/0x1b10
[ 89.457344][ T813] ? process_one_work+0x906/0x1b10
[ 89.462468][ T813] ? process_one_work+0x906/0x1b10
[ 89.467575][ T813] process_one_work+0xac7/0x1b10
[ 89.472513][ T813] ? __pfx_process_one_work+0x10/0x10
[ 89.477881][ T813] ? lock_acquire+0x1d1/0x380
[ 89.482545][ T813] ? __pfx_rtsx_usb_ms_handle_req+0x10/0x10
[ 89.488432][ T813] worker_thread+0x5ef/0xe50
[ 89.493017][ T813] ? __pfx_worker_thread+0x10/0x10
[ 89.498117][ T813] ? kthread+0x13a/0x450
[ 89.502441][ T813] ? __pfx_worker_thread+0x10/0x10
[ 89.507631][ T813] kthread+0x373/0x450
[ 89.511686][ T813] ? __pfx_kthread+0x10/0x10
[ 89.516264][ T813] ret_from_fork+0x69f/0xc90
[ 89.520859][ T813] ? __pfx_ret_from_fork+0x10/0x10
[ 89.525954][ T813] ? __switch_to+0x7f6/0x10e0
[ 89.530620][ T813] ? __switch_to_asm+0x39/0x70
[ 89.535379][ T813] ? __pfx_kthread+0x10/0x10
[ 89.539971][ T813] ret_from_fork_asm+0x1a/0x30
[ 89.544725][ T813]
[ 89.547972][ T813] Kernel Offset: disabled
[ 89.552291][ T813] Rebooting in 86400 seconds..