Warning: Permanently added '[localhost]:14715' (ED25519) to the list of known hosts.
syzkaller login: qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x1af000)
2026/09/23 13:02:27 parsed 1 programs
2026/09/23 13:02:27 serving rpc on tcp://46101
[ 83.738771][ T5289] cgroup: Unknown subsys name 'net'
[ 83.811027][ T5289] cgroup: Unknown subsys name 'cpuset'
[ 83.813439][ T5289] cgroup: Unknown subsys name 'rlimit'
[ 91.789485][ T10] cfg80211: failed to load regulatory.db
[ 111.005809][ T1023] ata1.00: exception Emask 0x0 SAct 0x40000000 SErr 0x0 action 0x6 frozen
[ 111.005837][ T1023] ata1.00: failed command: WRITE FPDMA QUEUED
[ 111.005844][ T1023] ata1.00: cmd 61/78:f0:36:f1:04/0d:00:00:00:00/40 tag 30 ncq dma 1765376 ou
[ 111.005844][ T1023] res 40/00:00:00:00:00/00:00:00:00:00/00 Emask 0x4 (timeout)
[ 111.005875][ T1023] ata1.00: status: { DRDY }
[ 111.005922][ T1023] ata1: hard resetting link
[ 111.326450][ T1023] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
[ 111.328797][ T1023] ata1.00: configured for UDMA/100
[ 111.329002][ T1023] ata1: EH complete
Setting up swapspace version 1, size = 127995904 bytes
[ 112.781726][ T5289] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 117.940426][ T51] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 117.940444][ T51] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 118.031465][ T51] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 118.031482][ T51] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 118.197867][ T5307] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 123.087478][ T5342] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 123.091334][ T5342] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 123.091837][ T5342] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 123.093509][ T5342] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 123.094008][ T5342] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 125.068130][ T5365] bridge0: port 1(bridge_slave_0) entered blocking state
[ 125.068710][ T5365] bridge0: port 1(bridge_slave_0) entered disabled state
[ 125.068770][ T5365] bridge_slave_0: entered allmulticast mode
[ 125.069799][ T5365] bridge_slave_0: entered promiscuous mode
[ 125.088738][ T5365] bridge0: port 2(bridge_slave_1) entered blocking state
[ 125.088866][ T5365] bridge0: port 2(bridge_slave_1) entered disabled state
[ 125.088969][ T5365] bridge_slave_1: entered allmulticast mode
[ 125.090482][ T5365] bridge_slave_1: entered promiscuous mode
[ 125.131086][ T5365] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 125.133290][ T5365] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 125.164037][ T5365] team0: Port device team_slave_0 added
[ 125.169977][ T5365] team0: Port device team_slave_1 added
[ 125.193530][ T5365] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 125.193540][ T5365] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 125.193549][ T5365] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 125.213822][ T5365] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 125.213833][ T5365] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 125.213843][ T5365] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 125.259117][ T5365] hsr_slave_0: entered promiscuous mode
[ 125.259872][ T5365] hsr_slave_1: entered promiscuous mode
[ 125.452418][ T5365] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 125.466696][ T5365] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 125.469152][ T5365] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 125.474553][ T5365] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 125.488218][ T5365] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 125.492134][ T5365] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 125.493341][ T5365] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 125.511362][ T5365] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 125.541551][ T5365] bridge0: port 2(bridge_slave_1) entered blocking state
[ 125.541920][ T5365] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 125.542326][ T5365] bridge0: port 1(bridge_slave_0) entered blocking state
[ 125.542402][ T5365] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 125.684396][ T5365] 8021q: adding VLAN 0 to HW filter on device bond0
[ 125.708257][ T1053] bridge0: port 1(bridge_slave_0) entered disabled state
[ 125.713252][ T1053] bridge0: port 2(bridge_slave_1) entered disabled state
[ 125.745902][ T5365] 8021q: adding VLAN 0 to HW filter on device team0
[ 125.749709][ T1054] bridge0: port 1(bridge_slave_0) entered blocking state
[ 125.749752][ T1054] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 125.768718][ T1054] bridge0: port 2(bridge_slave_1) entered blocking state
[ 125.768830][ T1054] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 126.353335][ T5365] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 126.407259][ T5365] veth0_vlan: entered promiscuous mode
[ 126.412992][ T5365] veth1_vlan: entered promiscuous mode
[ 126.448168][ T5365] veth0_macvtap: entered promiscuous mode
[ 126.452075][ T5365] veth1_macvtap: entered promiscuous mode
[ 126.472520][ T5365] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 126.485254][ T5365] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 126.556643][ T37] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 126.556679][ T37] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 126.556698][ T37] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 126.556717][ T37] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 126.756138][ T1054] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 126.830936][ T1054] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 126.909209][ T1054] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 126.989156][ T1054] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2026/09/23 13:03:14 executed programs: 0
[ 128.271773][ T4648] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 128.273967][ T4648] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 128.274514][ T4648] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 128.287345][ T4648] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 128.287799][ T4648] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 128.692179][ T1054] bridge_slave_1: left allmulticast mode
[ 128.692210][ T1054] bridge_slave_1: left promiscuous mode
[ 128.692977][ T1054] bridge0: port 2(bridge_slave_1) entered disabled state
[ 128.706383][ T1054] bridge_slave_0: left allmulticast mode
[ 128.706401][ T1054] bridge_slave_0: left promiscuous mode
[ 128.706532][ T1054] bridge0: port 1(bridge_slave_0) entered disabled state
[ 128.867304][ T1054] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 128.869456][ T1054] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 128.870694][ T1054] bond0 (unregistering): Released all slaves
[ 128.955148][ T1054] hsr_slave_0: left promiscuous mode
[ 128.957914][ T1054] hsr_slave_1: left promiscuous mode
[ 128.958500][ T1054] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 128.958521][ T1054] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 128.959383][ T1054] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 128.959394][ T1054] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 128.985823][ T1054] veth1_macvtap: left promiscuous mode
[ 128.986744][ T1054] veth0_macvtap: left promiscuous mode
[ 128.986967][ T1054] veth1_vlan: left promiscuous mode
[ 128.987094][ T1054] veth0_vlan: left promiscuous mode
[ 129.205472][ T1054] team0 (unregistering): Port device team_slave_1 removed
[ 129.217077][ T1054] team0 (unregistering): Port device team_slave_0 removed
[ 129.951369][ T4994] 8021q: adding VLAN 0 to HW filter on device eth2
[ 130.335224][ T5422] bridge0: port 1(bridge_slave_0) entered blocking state
[ 130.337203][ T5422] bridge0: port 1(bridge_slave_0) entered disabled state
[ 130.337293][ T5422] bridge_slave_0: entered allmulticast mode
[ 130.340338][ T5422] bridge_slave_0: entered promiscuous mode
[ 130.349488][ T4648] Bluetooth: hci0: command tx timeout
[ 130.362562][ T5422] bridge0: port 2(bridge_slave_1) entered blocking state
[ 130.363446][ T5422] bridge0: port 2(bridge_slave_1) entered disabled state
[ 130.363533][ T5422] bridge_slave_1: entered allmulticast mode
[ 130.374800][ T5422] bridge_slave_1: entered promiscuous mode
[ 130.432998][ T5422] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 130.444126][ T5422] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 130.497616][ T5422] team0: Port device team_slave_0 added
[ 130.502869][ T5422] team0: Port device team_slave_1 added
[ 130.530923][ T4994] 8021q: adding VLAN 0 to HW filter on device eth3
[ 130.549949][ T5422] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 130.549959][ T5422] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 130.549968][ T5422] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 130.554635][ T5422] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 130.554645][ T5422] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 130.554658][ T5422] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 130.646522][ T5422] hsr_slave_0: entered promiscuous mode
[ 130.647257][ T5422] hsr_slave_1: entered promiscuous mode
[ 130.949510][ T4994] 8021q: adding VLAN 0 to HW filter on device eth4
[ 131.246201][ T5422] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 131.252314][ T5422] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 131.253910][ T5422] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 131.276576][ T5422] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 131.277757][ T5422] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 131.282402][ T5422] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 131.285077][ T5422] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 131.312877][ T5422] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 131.480380][ T5422] 8021q: adding VLAN 0 to HW filter on device bond0
[ 131.499374][ T5422] 8021q: adding VLAN 0 to HW filter on device team0
[ 131.510651][ T1054] bridge0: port 1(bridge_slave_0) entered blocking state
[ 131.510720][ T1054] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 131.525052][ T37] bridge0: port 2(bridge_slave_1) entered blocking state
[ 131.525122][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 132.156827][ T5422] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 132.195138][ T5422] veth0_vlan: entered promiscuous mode
[ 132.202144][ T5422] veth1_vlan: entered promiscuous mode
[ 132.229659][ T5422] veth0_macvtap: entered promiscuous mode
[ 132.233175][ T5422] veth1_macvtap: entered promiscuous mode
[ 132.253483][ T5422] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 132.264441][ T5422] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 132.319186][ T37] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 132.319209][ T37] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 132.319221][ T37] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 132.319233][ T37] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 132.392346][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 132.392364][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 132.426118][ T4648] Bluetooth: hci0: command tx timeout
[ 132.440548][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 132.440559][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 132.785642][ T5399] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 132.935746][ T5399] usb 5-1: Using ep0 maxpacket: 32
[ 132.937821][ T5399] usb 5-1: unable to get BOS descriptor or descriptor too short
[ 132.937857][ T5399] usb 5-1: New USB device found, idVendor=1f71, idProduct=3306, bcdDevice=2a.c0
[ 132.939999][ T5399] usb 5-1: config 3 has an invalid interface number: 223 but max is 1
[ 132.940015][ T5399] usb 5-1: config 3 has an invalid interface number: 25 but max is 1
[ 132.940024][ T5399] usb 5-1: config 3 has an invalid interface number: 223 but max is 1
[ 132.940034][ T5399] usb 5-1: config 3 has no interface number 0
[ 132.940043][ T5399] usb 5-1: config 3 has no interface number 1
[ 132.940097][ T5399] usb 5-1: config 3 interface 25 altsetting 6 has an invalid descriptor for endpoint zero, skipping
[ 132.940108][ T5399] usb 5-1: config 3 interface 25 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 5
[ 132.940121][ T5399] usb 5-1: too many endpoints for config 3 interface 223 altsetting 155: 82, using maximum allowed: 30
[ 132.940144][ T5399] usb 5-1: config 3 interface 223 altsetting 155 endpoint 0xD has invalid maxpacket 512, setting to 64
[ 132.940158][ T5399] usb 5-1: config 3 interface 223 altsetting 155 endpoint 0x8 has invalid maxpacket 512, setting to 64
[ 132.940171][ T5399] usb 5-1: config 3 interface 223 altsetting 155 has 4 endpoint descriptors, different from the interface descriptor's value: 82
[ 132.940193][ T5399] usb 5-1: config 3 interface 223 has no altsetting 1
[ 132.940203][ T5399] usb 5-1: config 3 interface 25 has no altsetting 0
[ 132.945106][ T5399] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 132.945121][ T5399] usb 5-1: Product: syz
[ 132.945129][ T5399] usb 5-1: Manufacturer: syz
[ 132.945136][ T5399] usb 5-1: SerialNumber: syz
[ 133.238246][ T5492] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 133.238603][ T5492] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 133.242411][ T5492] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 133.244947][ T5492] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 133.460872][ T5492] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 133.464955][ T5492] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 133.575468][ T5399] usbtv 5-1:3.223: Fushicai USBTV007 Audio-Video Grabber
[ 133.594712][ T5399] usb 5-1: USB disconnect, device number 2
[ 133.710784][ T5496] udevd[5496]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb5/5-1/sound/card3/controlC3/../uevent} for writing: No such file or directory
[ 133.785060][ T5399]
[ 133.786205][ T5399] =========================
[ 133.788180][ T5399] WARNING: held lock freed!
[ 133.790102][ T5399] syzkaller #0 Not tainted
[ 133.792012][ T5399] -------------------------
[ 133.793958][ T5399] kworker/0:6/5399 is freeing memory ffff88803ef4c000-ffff88803ef4c7ff, with a lock still held there!
[ 133.798526][ T5399] ffff88803ef4c1a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880
[ 133.802846][ T5399] locks held by kworker/0:6/5399: 5, last CPU#0:
[ 133.805500][ T5399] #0: ffff88801f764d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[ 133.810127][ T5399] #1: ffffc90003297c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[ 133.815048][ T5399] #2: ffff88801f5d81d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30
[ 133.818792][ T5399] #3: ffff88803fc981d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xfc/0x9a0
[ 133.822694][ T5399] #4: ffff88803ef4c1a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880
[ 133.827071][ T5399]
[ 133.827071][ T5399] stack backtrace:
[ 133.829586][ T5399] CPU: 0 UID: 0 PID: 5399 Comm: kworker/0:6 Not tainted syzkaller #0 PREEMPT(full)
[ 133.833496][ T5399] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 133.837703][ T5399] Workqueue: usb_hub_wq hub_event
[ 133.839831][ T5399] Call Trace:
[ 133.841258][ T5399]
[ 133.842517][ T5399] dump_stack_lvl+0xe8/0x150
[ 133.844512][ T5399] debug_check_no_locks_freed+0x149/0x170
[ 133.846929][ T5399] kfree+0x12b/0x650
[ 133.848563][ T5399] ? device_release+0xc4/0x1f0
[ 133.850614][ T5399] ? __pfx_usb_release_interface+0x10/0x10
[ 133.853017][ T5399] device_release+0xc4/0x1f0
[ 133.854933][ T5399] kobject_put+0x222/0x550
[ 133.856857][ T5399] v4l2_device_disconnect+0x79/0xd0
[ 133.859044][ T5399] usbtv_video_free+0x25/0x30
[ 133.861027][ T5399] usbtv_disconnect+0x5c/0xa0
[ 133.863024][ T5399] usb_unbind_interface+0x295/0x9f0
[ 133.865201][ T5399] ? kernfs_remove_by_name_ns+0x101/0x140
[ 133.867628][ T5399] ? kernfs_remove_by_name_ns+0x101/0x140
[ 133.870056][ T5399] ? __pfx_usb_unbind_interface+0x10/0x10
[ 133.872475][ T5399] device_release_driver_internal+0x4f5/0x880
[ 133.875110][ T5399] bus_remove_device+0x444/0x560
[ 133.877259][ T5399] ? __pfx_bus_remove_device+0x10/0x10
[ 133.879577][ T5399] ? kernfs_remove_by_name_ns+0x101/0x140
[ 133.881993][ T5399] device_del+0x524/0x8f0
[ 133.883924][ T5399] ? __pfx_device_del+0x10/0x10
[ 133.885991][ T5399] ? __pfx___mutex_lock+0x10/0x10
[ 133.888192][ T5399] usb_disable_device+0x3d4/0x8d0
[ 133.890285][ T5399] usb_disconnect+0x346/0x9a0
[ 133.892304][ T5399] hub_event+0x1bbb/0x4d30
[ 133.894224][ T5399] ? do_raw_spin_unlock+0x4d/0x200
[ 133.896511][ T5399] ? register_lock_class+0x31/0x2e0
[ 133.898716][ T5399] ? __pfx_hub_event+0x10/0x10
[ 133.900818][ T5399] ? rcu_is_watching+0x16/0xb0
[ 133.902867][ T5399] ? process_scheduled_works+0x97a/0x1630
[ 133.905251][ T5399] process_scheduled_works+0xc3d/0x1630
[ 133.907608][ T5399] ? __pfx_process_scheduled_works+0x10/0x10
[ 133.910161][ T5399] ? assign_work+0x3cf/0x5d0
[ 133.912223][ T5399] worker_thread+0xa47/0xfb0
[ 133.914241][ T5399] ? __kthread_parkme+0x71/0x1f0
[ 133.916469][ T5399] kthread+0x38b/0x480
[ 133.918228][ T5399] ? __pfx_worker_thread+0x10/0x10
[ 133.920416][ T5399] ? __pfx_kthread+0x10/0x10
[ 133.922386][ T5399] ret_from_fork+0x514/0xb70
[ 133.924393][ T5399] ? __pfx_ret_from_fork+0x10/0x10
[ 133.926320][ T5399] ? __switch_to+0xc89/0x1420
[ 133.928216][ T5399] ? __pfx_kthread+0x10/0x10
[ 133.930150][ T5399] ret_from_fork_asm+0x1a/0x30
[ 133.932196][ T5399]
[ 133.972034][ T5399] ==================================================================
[ 133.972042][ T5399] BUG: KASAN: slab-use-after-free in usb_unbind_interface+0x2c2/0x9f0
[ 133.972061][ T5399] Read of size 8 at addr ffff88803ef4c008 by task kworker/0:6/5399
[ 133.972067][ T5399]
[ 133.972072][ T5399] CPU: 0 UID: 0 PID: 5399 Comm: kworker/0:6 Not tainted syzkaller #0 PREEMPT(full)
[ 133.972080][ T5399] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 133.972085][ T5399] Workqueue: usb_hub_wq hub_event
[ 133.972094][ T5399] Call Trace:
[ 133.972097][ T5399]
[ 133.972101][ T5399] dump_stack_lvl+0xe8/0x150
[ 133.972111][ T5399] print_address_description+0x55/0x1e0
[ 133.972121][ T5399] ? usb_unbind_interface+0x2c2/0x9f0
[ 133.972128][ T5399] print_report+0x58/0x70
[ 133.972136][ T5399] kasan_report+0x117/0x150
[ 133.972144][ T5399] ? usb_unbind_interface+0x2c2/0x9f0
[ 133.972153][ T5399] usb_unbind_interface+0x2c2/0x9f0
[ 133.972163][ T5399] ? kernfs_remove_by_name_ns+0x101/0x140
[ 133.972174][ T5399] ? kernfs_remove_by_name_ns+0x101/0x140
[ 133.972183][ T5399] ? __pfx_usb_unbind_interface+0x10/0x10
[ 133.972194][ T5399] device_release_driver_internal+0x4f5/0x880
[ 133.972208][ T5399] bus_remove_device+0x444/0x560
[ 133.972223][ T5399] ? __pfx_bus_remove_device+0x10/0x10
[ 133.972238][ T5399] ? kernfs_remove_by_name_ns+0x101/0x140
[ 133.972248][ T5399] device_del+0x524/0x8f0
[ 133.972258][ T5399] ? __pfx_device_del+0x10/0x10
[ 133.972272][ T5399] ? __pfx___mutex_lock+0x10/0x10
[ 133.972287][ T5399] usb_disable_device+0x3d4/0x8d0
[ 133.972300][ T5399] usb_disconnect+0x346/0x9a0
[ 133.972317][ T5399] hub_event+0x1bbb/0x4d30
[ 133.972327][ T5399] ? do_raw_spin_unlock+0x4d/0x200
[ 133.972360][ T5399] ? register_lock_class+0x31/0x2e0
[ 133.972371][ T5399] ? __pfx_hub_event+0x10/0x10
[ 133.972378][ T5399] ? rcu_is_watching+0x16/0xb0
[ 133.972387][ T5399] ? process_scheduled_works+0x97a/0x1630
[ 133.972396][ T5399] process_scheduled_works+0xc3d/0x1630
[ 133.972408][ T5399] ? __pfx_process_scheduled_works+0x10/0x10
[ 133.972418][ T5399] ? assign_work+0x3cf/0x5d0
[ 133.972426][ T5399] worker_thread+0xa47/0xfb0
[ 133.972436][ T5399] ? __kthread_parkme+0x71/0x1f0
[ 133.972447][ T5399] kthread+0x38b/0x480
[ 133.972454][ T5399] ? __pfx_worker_thread+0x10/0x10
[ 133.972466][ T5399] ? __pfx_kthread+0x10/0x10
[ 133.972475][ T5399] ret_from_fork+0x514/0xb70
[ 133.972486][ T5399] ? __pfx_ret_from_fork+0x10/0x10
[ 133.972496][ T5399] ? __switch_to+0xc89/0x1420
[ 133.972512][ T5399] ? __pfx_kthread+0x10/0x10
[ 133.972522][ T5399] ret_from_fork_asm+0x1a/0x30
[ 133.972540][ T5399]
[ 133.972545][ T5399]
[ 133.972547][ T5399] Allocated by task 5399:
[ 133.972552][ T5399] kasan_save_track+0x3e/0x80
[ 133.972562][ T5399] __kasan_kmalloc+0x93/0xb0
[ 133.972567][ T5399] __kmalloc_cache_noprof+0x321/0x600
[ 133.972577][ T5399] usb_set_configuration+0x3cc/0x2180
[ 133.972583][ T5399] usb_generic_driver_probe+0x8d/0x150
[ 133.972591][ T5399] usb_probe_device+0x1c3/0x3b0
[ 133.972600][ T5399] really_probe+0x254/0xae0
[ 133.972609][ T5399] __driver_probe_device+0x1e8/0x360
[ 133.972617][ T5399] driver_probe_device+0x4f/0x240
[ 133.972627][ T5399] __device_attach_driver+0x270/0x410
[ 133.972636][ T5399] bus_for_each_drv+0x258/0x2f0
[ 133.972648][ T5399] __device_attach+0x2c4/0x450
[ 133.972656][ T5399] device_initial_probe+0xa1/0xd0
[ 133.972665][ T5399] bus_probe_device+0x12a/0x220
[ 133.972676][ T5399] device_add+0x7d7/0xb80
[ 133.972685][ T5399] usb_new_device+0x9aa/0x1690
[ 133.972693][ T5399] hub_event+0x28e8/0x4d30
[ 133.972699][ T5399] process_scheduled_works+0xc3d/0x1630
[ 133.972706][ T5399] worker_thread+0xa47/0xfb0
[ 133.972714][ T5399] kthread+0x38b/0x480
[ 133.972719][ T5399] ret_from_fork+0x514/0xb70
[ 133.972724][ T5399] ret_from_fork_asm+0x1a/0x30
[ 133.972736][ T5399]
[ 133.972738][ T5399] Freed by task 5399:
[ 133.972743][ T5399] kasan_save_track+0x3e/0x80
[ 133.972756][ T5399] kasan_save_free_info+0x40/0x50
[ 133.972767][ T5399] __kasan_slab_free+0x5c/0x80
[ 133.972775][ T5399] kfree+0x1c5/0x650
[ 133.972786][ T5399] device_release+0xc4/0x1f0
[ 133.972797][ T5399] kobject_put+0x222/0x550
[ 133.972810][ T5399] v4l2_device_disconnect+0x79/0xd0
[ 133.972822][ T5399] usbtv_video_free+0x25/0x30
[ 133.972830][ T5399] usbtv_disconnect+0x5c/0xa0
[ 133.972836][ T5399] usb_unbind_interface+0x295/0x9f0
[ 133.972843][ T5399] device_release_driver_internal+0x4f5/0x880
[ 133.972849][ T5399] bus_remove_device+0x444/0x560
[ 133.972856][ T5399] device_del+0x524/0x8f0
[ 133.972861][ T5399] usb_disable_device+0x3d4/0x8d0
[ 133.972867][ T5399] usb_disconnect+0x346/0x9a0
[ 133.972875][ T5399] hub_event+0x1bbb/0x4d30
[ 133.972881][ T5399] process_scheduled_works+0xc3d/0x1630
[ 133.972889][ T5399] worker_thread+0xa47/0xfb0
[ 133.972896][ T5399] kthread+0x38b/0x480
[ 133.972903][ T5399] ret_from_fork+0x514/0xb70
[ 133.972911][ T5399] ret_from_fork_asm+0x1a/0x30
[ 133.972924][ T5399]
[ 133.972927][ T5399] The buggy address belongs to the object at ffff88803ef4c000
[ 133.972927][ T5399] which belongs to the cache kmalloc-2k of size 2048
[ 133.972935][ T5399] The buggy address is located 8 bytes inside of
[ 133.972935][ T5399] freed 2048-byte region [ffff88803ef4c000, ffff88803ef4c800)
[ 133.972946][ T5399]
[ 133.972949][ T5399] The buggy address belongs to the physical page:
[ 133.972954][ T5399] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803ef4e000 pfn:0x3ef48
[ 133.972965][ T5399] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 133.972974][ T5399] flags: 0x4fff00000000240(workingset|head|node=1|zone=1|lastcpupid=0x7ff)
[ 133.972985][ T5399] page_type: f5(slab)
[ 133.972992][ T5399] raw: 04fff00000000240 ffff88801b042000 ffffea0000ff2610 ffffea0000f18810
[ 133.972998][ T5399] raw: ffff88803ef4e000 0000000000080005 00000000f5000000 0000000000000000
[ 133.973004][ T5399] head: 04fff00000000240 ffff88801b042000 ffffea0000ff2610 ffffea0000f18810
[ 133.973010][ T5399] head: ffff88803ef4e000 0000000000080005 00000000f5000000 0000000000000000
[ 133.973018][ T5399] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 133.973026][ T5399] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 133.973031][ T5399] page dumped because: kasan: bad access detected
[ 133.973036][ T5399] page_owner tracks the page as allocated
[ 133.973039][ T5399] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5329, tgid 5329 (syz-executor), ts 121977350445
[ 133.973062][ T5399] post_alloc_hook+0x1f9/0x250
[ 133.973075][ T5399] get_page_from_freelist+0x2209/0x2280
[ 133.973090][ T5399] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 133.973103][ T5399] allocate_slab+0x7d/0x620
[ 133.973109][ T5399] refill_objects+0x2d5/0x350
[ 133.973116][ T5399] __pcs_replace_empty_main+0x2c8/0x6c0
[ 133.973122][ T5399] __kmalloc_noprof+0x47b/0x720
[ 133.973130][ T5399] sk_prot_alloc+0xe7/0x210
[ 133.973138][ T5399] sk_alloc+0x3a/0x390
[ 133.973144][ T5399] __netlink_create+0x62/0x260
[ 133.973153][ T5399] __netlink_kernel_create+0x13d/0x720
[ 133.973161][ T5399] rtnetlink_net_init+0xb1/0x140
[ 133.973168][ T5399] ops_init+0x35d/0x5d0
[ 133.973174][ T5399] setup_net+0x118/0x350
[ 133.973179][ T5399] copy_net_ns+0x53b/0x780
[ 133.973185][ T5399] create_new_namespaces+0x3f0/0x6b0
[ 133.973192][ T5399] page last free pid 51 tgid 51 ts 118842037838 stack trace:
[ 133.973197][ T5399] __free_pages_ok+0xb6c/0xc60
[ 133.973205][ T5399] ovs_ct_exit_finish+0xa0/0x210
[ 133.973214][ T5399] ovs_exit_net+0xec/0x7a0
[ 133.973219][ T5399] ops_undo_list+0x43d/0x8d0
[ 133.973225][ T5399] cleanup_net+0x572/0x810
[ 133.973231][ T5399] process_scheduled_works+0xc3d/0x1630
[ 133.973239][ T5399] worker_thread+0xa47/0xfb0
[ 133.973247][ T5399] kthread+0x38b/0x480
[ 133.973252][ T5399] ret_from_fork+0x514/0xb70
[ 133.973257][ T5399] ret_from_fork_asm+0x1a/0x30
[ 133.973266][ T5399]
[ 133.973267][ T5399] Memory state around the buggy address:
[ 133.973271][ T5399] ffff88803ef4bf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 133.973276][ T5399] ffff88803ef4bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 133.973280][ T5399] >ffff88803ef4c000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 133.973285][ T5399] ^
[ 133.973290][ T5399] ffff88803ef4c080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 133.973296][ T5399] ffff88803ef4c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 133.973301][ T5399] ==================================================================
[ 133.973388][ T5399] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 134.307729][ T5399] CPU: 0 UID: 0 PID: 5399 Comm: kworker/0:6 Not tainted syzkaller #0 PREEMPT(full)
[ 134.311759][ T5399] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 134.316429][ T5399] Workqueue: usb_hub_wq hub_event
[ 134.318528][ T5399] Call Trace:
[ 134.319974][ T5399]
[ 134.321185][ T5399] vpanic+0x56d/0xa60
[ 134.322878][ T5399] ? rcu_is_watching+0x16/0xb0
[ 134.324992][ T5399] ? __pfx_vpanic+0x10/0x10
[ 134.327005][ T5399] ? __pfx___schedule+0x10/0x10
[ 134.328997][ T5399] panic+0xc5/0xd0
[ 134.330649][ T5399] ? __pfx_panic+0x10/0x10
[ 134.332594][ T5399] ? preempt_schedule_thunk+0x16/0x40
[ 134.334696][ T5399] ? usb_unbind_interface+0x2c2/0x9f0
[ 134.336845][ T5399] check_panic_on_warn+0x89/0xb0
[ 134.338904][ T5399] ? usb_unbind_interface+0x2c2/0x9f0
[ 134.341079][ T5399] end_report+0x73/0x170
[ 134.342913][ T5399] ? usb_unbind_interface+0x2c2/0x9f0
[ 134.345290][ T5399] kasan_report+0x128/0x150
[ 134.347259][ T5399] ? usb_unbind_interface+0x2c2/0x9f0
[ 134.349429][ T5399] usb_unbind_interface+0x2c2/0x9f0
[ 134.351586][ T5399] ? kernfs_remove_by_name_ns+0x101/0x140
[ 134.353839][ T5399] ? kernfs_remove_by_name_ns+0x101/0x140
[ 134.356104][ T5399] ? __pfx_usb_unbind_interface+0x10/0x10
[ 134.358296][ T5399] device_release_driver_internal+0x4f5/0x880
[ 134.360847][ T5399] bus_remove_device+0x444/0x560
[ 134.362868][ T5399] ? __pfx_bus_remove_device+0x10/0x10
[ 134.365002][ T5399] ? kernfs_remove_by_name_ns+0x101/0x140
[ 134.367466][ T5399] device_del+0x524/0x8f0
[ 134.369355][ T5399] ? __pfx_device_del+0x10/0x10
[ 134.371367][ T5399] ? __pfx___mutex_lock+0x10/0x10
[ 134.373457][ T5399] usb_disable_device+0x3d4/0x8d0
[ 134.375590][ T5399] usb_disconnect+0x346/0x9a0
[ 134.377535][ T5399] hub_event+0x1bbb/0x4d30
[ 134.379393][ T5399] ? do_raw_spin_unlock+0x4d/0x200
[ 134.381546][ T5399] ? register_lock_class+0x31/0x2e0
[ 134.383678][ T5399] ? __pfx_hub_event+0x10/0x10
[ 134.385718][ T5399] ? rcu_is_watching+0x16/0xb0
[ 134.387727][ T5399] ? process_scheduled_works+0x97a/0x1630
[ 134.390096][ T5399] process_scheduled_works+0xc3d/0x1630
[ 134.392434][ T5399] ? __pfx_process_scheduled_works+0x10/0x10
[ 134.395016][ T5399] ? assign_work+0x3cf/0x5d0
[ 134.396936][ T5399] worker_thread+0xa47/0xfb0
[ 134.398899][ T5399] ? __kthread_parkme+0x71/0x1f0
[ 134.401012][ T5399] kthread+0x38b/0x480
[ 134.402838][ T5399] ? __pfx_worker_thread+0x10/0x10
[ 134.404981][ T5399] ? __pfx_kthread+0x10/0x10
[ 134.407219][ T5399] ret_from_fork+0x514/0xb70
[ 134.409238][ T5399] ? __pfx_ret_from_fork+0x10/0x10
[ 134.411379][ T5399] ? __switch_to+0xc89/0x1420
[ 134.413379][ T5399] ? __pfx_kthread+0x10/0x10
[ 134.415286][ T5399] ret_from_fork_asm+0x1a/0x30
[ 134.417218][ T5399]
[ 134.418859][ T5399] Kernel Offset: disabled
[ 134.420710][ T5399] Rebooting in 86400 seconds..