ci-upstream-kasan-gce/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci-upstream-kasan-gce/syz-executor1785258514 <...> Warning: Permanently added '10.128.0.64' (ED25519) to the list of known hosts. execve("ci-upstream-kasan-gce/syz-executor1785258514", ["ci-upstream-kasan-gce/syz-executor1785258514"], 0x7ffe8c981510 /* 10 vars */) = 0 brk(NULL) = 0x555576e31000 brk(0x555576e31d80) = 0x555576e31d80 arch_prctl(ARCH_SET_FS, 0x555576e31400) = 0 set_tid_address(0x555576e316d0) = 5635 set_robust_list(0x555576e316e0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci-upstream-kasan-gce/syz-executor1785258514", 4096) = 50 getrandom("\xa8\x64\x15\x37\xcb\x23\x63\xd4", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555576e31d80 brk(0x555576e52d80) = 0x555576e52d80 brk(0x555576e53000) = 0x555576e53000 mprotect(0x7ff4a239d000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5636 attached , child_tidptr=0x555576e316d0) = 5636 [pid 5636] set_robust_list(0x555576e316e0, 24 [pid 5635] rt_sigprocmask(SIG_SETMASK, [] [pid 5636] <... set_robust_list resumed>) = 0 [pid 5635] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5636] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5636] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5636] setpgid(0, 0) = 0 [pid 5636] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5636] write(3, "1000", 4) = 4 [pid 5636] close(3) = 0 [pid 5636] write(1, "executing program\n", 18) = 18 executing program [pid 5636] openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3 [pid 5636] ioctl(3, USB_RAW_IOCTL_INIT, 0x7fffc6b1a610) = 0 [pid 5636] ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 [pid 5636] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fffc6b1a610) = 0 [pid 5636] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fffc6b1a610) = 0 [pid 5636] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fffc6b1a610) = 0 [pid 5636] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fffc6b1a610) = 0 [pid 5636] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fffc6b19600) = 18 [pid 5636] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fffc6b1a610) = 0 [pid 5636] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fffc6b1a610) = 0 [ 91.050052][ T190] usb 1-1: new high-speed USB device number 2 using dummy_hcd [pid 5636] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fffc6b1a610) = 0 [pid 5636] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fffc6b19600) = 18 [pid 5636] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fffc6b1a610) = 0 [pid 5636] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fffc6b19600) = 0 [pid 5636] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fffc6b1a610) = 0 [pid 5636] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fffc6b19600) = 0 [pid 5636] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fffc6b1a610) = 0 [pid 5636] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fffc6b19600) = 0 [pid 5636] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fffc6b1a610) = 0 [pid 5636] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fffc6b19600) = 9 [pid 5636] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fffc6b1a610) = 0 [ 91.199848][ T190] usb 1-1: Using ep0 maxpacket: 32 [ 91.226977][ T190] usb 1-1: unable to get BOS descriptor or descriptor too short [ 91.227132][ T190] usb 1-1: New USB device found, idVendor=1f71, idProduct=3306, bcdDevice=2a.c0 [pid 5636] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fffc6b19600) = 81 [pid 5636] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fffc6b1a610) = 0 [pid 5636] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fffc6b19600) = 4 [pid 5636] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fffc6b1a610) = 0 [pid 5636] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fffc6b19600) = 8 [ 91.260187][ T190] usb 1-1: config 3 has an invalid interface number: 223 but max is 1 [ 91.260352][ T190] usb 1-1: config 3 has an invalid interface number: 25 but max is 1 [ 91.260367][ T190] usb 1-1: config 3 has an invalid interface number: 223 but max is 1 [ 91.260381][ T190] usb 1-1: config 3 has no interface number 0 [ 91.260392][ T190] usb 1-1: config 3 has no interface number 1 [pid 5636] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fffc6b1a610) = 0 [pid 5636] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fffc6b19600) = 8 [pid 5636] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fffc6b1a610) = 0 [pid 5636] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fffc6b19600) = 8 [ 91.260430][ T190] usb 1-1: config 3 interface 25 altsetting 6 has an invalid descriptor for endpoint zero, skipping [ 91.260445][ T190] usb 1-1: config 3 interface 25 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 91.260463][ T190] usb 1-1: too many endpoints for config 3 interface 223 altsetting 155: 82, using maximum allowed: 30 [ 91.260489][ T190] usb 1-1: config 3 interface 223 altsetting 155 endpoint 0xD has invalid maxpacket 512, setting to 64 [ 91.260509][ T190] usb 1-1: config 3 interface 223 altsetting 155 endpoint 0x8 has invalid maxpacket 512, setting to 64 [pid 5636] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fffc6b1a610) = 0 [pid 5636] ioctl(3, USB_RAW_IOCTL_VBUS_DRAW, 0x5) = 0 [pid 5636] ioctl(3, USB_RAW_IOCTL_CONFIGURE, 0) = 0 [pid 5636] ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7fffc6b19600) = 0 [ 91.260528][ T190] usb 1-1: config 3 interface 223 altsetting 155 has 4 endpoint descriptors, different from the interface descriptor's value: 82 [ 91.260555][ T190] usb 1-1: config 3 interface 223 has no altsetting 1 [ 91.260567][ T190] usb 1-1: config 3 interface 25 has no altsetting 0 [ 91.364668][ T190] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 91.364760][ T190] usb 1-1: Product: syz [ 91.364796][ T190] usb 1-1: Manufacturer: syz [ 91.364844][ T190] usb 1-1: SerialNumber: syz [pid 5636] exit_group(0) = ? [pid 5636] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5636, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5639 attached [pid 5639] set_robust_list(0x555576e316e0, 24) = 0 [pid 5635] <... clone resumed>, child_tidptr=0x555576e316d0) = 5639 [pid 5639] rt_sigprocmask(SIG_SETMASK, [] [pid 5635] rt_sigprocmask(SIG_SETMASK, [] [pid 5639] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5635] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5639] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5639] setpgid(0, 0) = 0 [pid 5639] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5639] write(3, "1000", 4) = 4 [pid 5639] close(3) = 0 executing program [pid 5639] write(1, "executing program\n", 18) = 18 [pid 5639] openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3 [pid 5639] ioctl(3, USB_RAW_IOCTL_INIT, 0x7fffc6b1a610) = 0 [pid 5639] ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 [pid 5639] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fffc6b1a610) = 0 [ 91.725015][ T190] usbtv 1-1:3.223: Fushicai USBTV007 Audio-Video Grabber [ 91.743562][ T190] usb 1-1: USB disconnect, device number 2 [ 91.834596][ T190] [ 91.836998][ T190] ========================= [ 91.841534][ T190] WARNING: held lock freed! [ 91.846103][ T190] syzkaller #0 Not tainted [ 91.850562][ T190] ------------------------- [ 91.855147][ T190] kworker/0:2/190 is freeing memory ffff8880222f6000-ffff8880222f67ff, with a lock still held there! [ 91.866137][ T190] ffff8880222f61a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 [ 91.876332][ T190] locks held by kworker/0:2/190: 5, last CPU#0: [ 91.882842][ T190] #0: ffff888022aaa140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 91.894334][ T190] #1: ffffc9000301fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 91.906484][ T190] #2: ffff888029c621d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 [ 91.915770][ T190] #3: ffff8880226851d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xfc/0x9a0 [ 91.925126][ T190] #4: ffff8880222f61a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 [ 91.935988][ T190] [ 91.935988][ T190] stack backtrace: [ 91.941932][ T190] CPU: 0 UID: 0 PID: 190 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) [ 91.951332][ T190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 91.961452][ T190] Workqueue: usb_hub_wq hub_event [ 91.966586][ T190] Call Trace: [ 91.969956][ T190] [ 91.971195][ T25] cfg80211: failed to load regulatory.db [ 91.978584][ T190] dump_stack_lvl+0xe8/0x150 [ 91.983312][ T190] debug_check_no_locks_freed+0x149/0x170 [ 91.989550][ T190] kfree+0x12b/0x650 [ 91.993492][ T190] ? device_release+0xc4/0x1f0 [ 91.998299][ T190] ? __pfx_usb_release_interface+0x10/0x10 [ 92.004135][ T190] device_release+0xc4/0x1f0 [ 92.008805][ T190] kobject_put+0x222/0x550 [ 92.013257][ T190] v4l2_device_disconnect+0x79/0xd0 [ 92.018509][ T190] usbtv_video_free+0x25/0x30 [ 92.023484][ T190] usbtv_disconnect+0x5c/0xa0 [ 92.028198][ T190] usb_unbind_interface+0x295/0x9f0 [ 92.033466][ T190] ? kernfs_remove_by_name_ns+0x101/0x140 [ 92.039424][ T190] ? kernfs_remove_by_name_ns+0x101/0x140 [ 92.045213][ T190] ? __pfx_usb_unbind_interface+0x10/0x10 [ 92.051259][ T190] device_release_driver_internal+0x4f5/0x880 [ 92.057485][ T190] bus_remove_device+0x444/0x560 [ 92.062483][ T190] ? __pfx_bus_remove_device+0x10/0x10 [ 92.068005][ T190] ? kernfs_remove_by_name_ns+0x101/0x140 [ 92.073764][ T190] device_del+0x524/0x8f0 [ 92.078154][ T190] ? __pfx_device_del+0x10/0x10 [ 92.083211][ T190] ? __pfx___mutex_lock+0x10/0x10 [ 92.088304][ T190] usb_disable_device+0x3d4/0x8d0 [ 92.093366][ T190] usb_disconnect+0x346/0x9a0 [ 92.098197][ T190] hub_event+0x1bbb/0x4d30 [ 92.102651][ T190] ? do_raw_spin_unlock+0xf5/0x200 [ 92.107799][ T190] ? register_lock_class+0x31/0x2e0 [ 92.113051][ T190] ? __pfx_hub_event+0x10/0x10 [ 92.117852][ T190] ? rcu_is_watching+0x16/0xb0 [ 92.122731][ T190] ? process_scheduled_works+0x97a/0x1630 [ 92.128483][ T190] process_scheduled_works+0xc3d/0x1630 [ 92.134072][ T190] ? __pfx_process_scheduled_works+0x10/0x10 [ 92.140088][ T190] ? assign_work+0x3cf/0x5d0 [ 92.144973][ T190] worker_thread+0xa47/0xfb0 [ 92.149643][ T190] ? __kthread_parkme+0x71/0x1f0 [ 92.154721][ T190] kthread+0x38b/0x480 [ 92.158846][ T190] ? __pfx_worker_thread+0x10/0x10 [ 92.163985][ T190] ? __pfx_kthread+0x10/0x10 [ 92.168651][ T190] ret_from_fork+0x514/0xb70 [ 92.173306][ T190] ? __pfx_ret_from_fork+0x10/0x10 [ 92.178526][ T190] ? __switch_to+0xc89/0x1420 [ 92.183231][ T190] ? __pfx_kthread+0x10/0x10 [ 92.187845][ T190] ret_from_fork_asm+0x1a/0x30 [ 92.192648][ T190] [ 92.198329][ T190] ================================================================== [ 92.198343][ T190] BUG: KASAN: slab-use-after-free in usb_unbind_interface+0x2c2/0x9f0 [ 92.198378][ T190] Read of size 8 at addr ffff8880222f6008 by task kworker/0:2/190 [ 92.198395][ T190] [ 92.198406][ T190] CPU: 0 UID: 0 PID: 190 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) [ 92.198440][ T190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 92.198454][ T190] Workqueue: usb_hub_wq hub_event [ 92.198482][ T190] Call Trace: [ 92.198490][ T190] [ 92.198498][ T190] dump_stack_lvl+0xe8/0x150 [ 92.198531][ T190] print_address_description+0x55/0x1e0 [ 92.198560][ T190] ? usb_unbind_interface+0x2c2/0x9f0 [ 92.198587][ T190] print_report+0x58/0x70 [ 92.198613][ T190] kasan_report+0x117/0x150 [ 92.198640][ T190] ? usb_unbind_interface+0x2c2/0x9f0 [ 92.198672][ T190] usb_unbind_interface+0x2c2/0x9f0 [ 92.198700][ T190] ? kernfs_remove_by_name_ns+0x101/0x140 [ 92.198729][ T190] ? kernfs_remove_by_name_ns+0x101/0x140 [ 92.198755][ T190] ? __pfx_usb_unbind_interface+0x10/0x10 [ 92.198781][ T190] device_release_driver_internal+0x4f5/0x880 [ 92.198812][ T190] bus_remove_device+0x444/0x560 [ 92.198848][ T190] ? __pfx_bus_remove_device+0x10/0x10 [ 92.198882][ T190] ? kernfs_remove_by_name_ns+0x101/0x140 [ 92.198909][ T190] device_del+0x524/0x8f0 [ 92.198936][ T190] ? __pfx_device_del+0x10/0x10 [ 92.198959][ T190] ? __pfx___mutex_lock+0x10/0x10 [ 92.198991][ T190] usb_disable_device+0x3d4/0x8d0 [ 92.199022][ T190] usb_disconnect+0x346/0x9a0 [ 92.199047][ T190] hub_event+0x1bbb/0x4d30 [ 92.199072][ T190] ? do_raw_spin_unlock+0xf5/0x200 [ 92.199109][ T190] ? register_lock_class+0x31/0x2e0 [ 92.199145][ T190] ? __pfx_hub_event+0x10/0x10 [ 92.199174][ T190] ? rcu_is_watching+0x16/0xb0 [ 92.199201][ T190] ? process_scheduled_works+0x97a/0x1630 [ 92.199230][ T190] process_scheduled_works+0xc3d/0x1630 [ 92.199271][ T190] ? __pfx_process_scheduled_works+0x10/0x10 [ 92.199303][ T190] ? assign_work+0x3cf/0x5d0 [ 92.199333][ T190] worker_thread+0xa47/0xfb0 [ 92.199369][ T190] ? __kthread_parkme+0x71/0x1f0 [ 92.199403][ T190] kthread+0x38b/0x480 [ 92.199422][ T190] ? __pfx_worker_thread+0x10/0x10 [ 92.199463][ T190] ? __pfx_kthread+0x10/0x10 [ 92.199483][ T190] ret_from_fork+0x514/0xb70 [ 92.199503][ T190] ? __pfx_ret_from_fork+0x10/0x10 [ 92.199521][ T190] ? __switch_to+0xc89/0x1420 [ 92.199552][ T190] ? __pfx_kthread+0x10/0x10 [ 92.199572][ T190] ret_from_fork_asm+0x1a/0x30 [ 92.199610][ T190] [ 92.199618][ T190] [ 92.199623][ T190] Allocated by task 190: [ 92.199632][ T190] kasan_save_track+0x3e/0x80 [ 92.199653][ T190] __kasan_kmalloc+0x93/0xb0 [ 92.199673][ T190] __kmalloc_cache_noprof+0x321/0x600 [ 92.199692][ T190] usb_set_configuration+0x3cc/0x2180 [ 92.199731][ T190] usb_generic_driver_probe+0x8d/0x150 [ 92.199755][ T190] usb_probe_device+0x1c3/0x3b0 [ 92.199780][ T190] really_probe+0x254/0xae0 [ 92.199803][ T190] __driver_probe_device+0x1e8/0x360 [ 92.199826][ T190] driver_probe_device+0x4f/0x240 [ 92.199850][ T190] __device_attach_driver+0x270/0x410 [ 92.199875][ T190] bus_for_each_drv+0x258/0x2f0 [ 92.199904][ T190] __device_attach+0x2c4/0x450 [ 92.199925][ T190] device_initial_probe+0xa1/0xd0 [ 92.199948][ T190] bus_probe_device+0x12a/0x220 [ 92.199977][ T190] device_add+0x7d7/0xb80 [ 92.199995][ T190] usb_new_device+0x9aa/0x1690 [ 92.200014][ T190] hub_event+0x28e8/0x4d30 [ 92.200036][ T190] process_scheduled_works+0xc3d/0x1630 [ 92.200061][ T190] worker_thread+0xa47/0xfb0 [ 92.200087][ T190] kthread+0x38b/0x480 [ 92.200104][ T190] ret_from_fork+0x514/0xb70 [ 92.200121][ T190] ret_from_fork_asm+0x1a/0x30 [ 92.200151][ T190] [ 92.200156][ T190] Freed by task 190: [ 92.200166][ T190] kasan_save_track+0x3e/0x80 [ 92.200185][ T190] kasan_save_free_info+0x40/0x50 [ 92.200214][ T190] __kasan_slab_free+0x5c/0x80 [ 92.200235][ T190] kfree+0x1c5/0x650 [ 92.200262][ T190] device_release+0xc4/0x1f0 [ 92.200287][ T190] kobject_put+0x222/0x550 [ 92.200316][ T190] v4l2_device_disconnect+0x79/0xd0 [ 92.200344][ T190] usbtv_video_free+0x25/0x30 [ 92.200371][ T190] usbtv_disconnect+0x5c/0xa0 [ 92.200396][ T190] usb_unbind_interface+0x295/0x9f0 [ 92.200429][ T190] device_release_driver_internal+0x4f5/0x880 [ 92.200453][ T190] bus_remove_device+0x444/0x560 [ 92.200482][ T190] device_del+0x524/0x8f0 [ 92.200501][ T190] usb_disable_device+0x3d4/0x8d0 [ 92.200524][ T190] usb_disconnect+0x346/0x9a0 [ 92.200543][ T190] hub_event+0x1bbb/0x4d30 [ 92.200565][ T190] process_scheduled_works+0xc3d/0x1630 [ 92.200591][ T190] worker_thread+0xa47/0xfb0 [ 92.200617][ T190] kthread+0x38b/0x480 [ 92.200634][ T190] ret_from_fork+0x514/0xb70 [ 92.200650][ T190] ret_from_fork_asm+0x1a/0x30 [ 92.200681][ T190] [ 92.200686][ T190] The buggy address belongs to the object at ffff8880222f6000 [ 92.200686][ T190] which belongs to the cache kmalloc-2k of size 2048 [ 92.200703][ T190] The buggy address is located 8 bytes inside of [ 92.200703][ T190] freed 2048-byte region [ffff8880222f6000, ffff8880222f6800) [ 92.200725][ T190] [ 92.200730][ T190] The buggy address belongs to the physical page: [ 92.200751][ T190] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x222f0 [ 92.200770][ T190] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 92.200787][ T190] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 92.200811][ T190] page_type: f5(slab) [ 92.200831][ T190] raw: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122 [ 92.200849][ T190] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 92.200869][ T190] head: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122 [ 92.200887][ T190] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 92.200907][ T190] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 92.200925][ T190] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 92.200936][ T190] page dumped because: kasan: bad access detected [ 92.200956][ T190] page_owner tracks the page as allocated [ 92.200963][ T190] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 3789322522 [ 92.200996][ T190] post_alloc_hook+0x1f9/0x250 [ 92.201026][ T190] get_page_from_freelist+0x2209/0x2280 [ 92.201047][ T190] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 92.201068][ T190] allocate_slab+0x7d/0x620 [ 92.201093][ T190] refill_objects+0x2d5/0x350 [ 92.201119][ T190] __pcs_replace_empty_main+0x2c8/0x6c0 [ 92.201144][ T190] __kmalloc_cache_noprof+0x39b/0x600 [ 92.201163][ T190] acpi_add_single_object+0xde/0x1b60 [ 92.201189][ T190] acpi_bus_check_add+0x2b7/0x8a0 [ 92.201212][ T190] acpi_ns_walk_namespace+0x273/0x700 [ 92.201244][ T190] acpi_walk_namespace+0x125/0x190 [ 92.201261][ T190] acpi_bus_scan+0x465/0x4f0 [ 92.201284][ T190] acpi_scan_init+0x1b1/0x470 [ 92.201318][ T190] acpi_init+0x130/0x1f0 [ 92.201338][ T190] do_one_initcall+0x250/0x870 [ 92.201367][ T190] do_initcall_level+0x10a/0x1a0 [ 92.201396][ T190] page_owner free stack trace missing [ 92.201403][ T190] [ 92.201408][ T190] Memory state around the buggy address: [ 92.201419][ T190] ffff8880222f5f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 92.201440][ T190] ffff8880222f5f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 92.201454][ T190] >ffff8880222f6000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.201464][ T190] ^ [ 92.201475][ T190] ffff8880222f6080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.201489][ T190] ffff8880222f6100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.201500][ T190] ================================================================== [ 92.352091][ T190] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 92.987405][ T190] CPU: 0 UID: 0 PID: 190 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) [ 92.996722][ T190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 93.006812][ T190] Workqueue: usb_hub_wq hub_event [ 93.011885][ T190] Call Trace: [ 93.015202][ T190] [ 93.018251][ T190] vpanic+0x56d/0xa60 [ 93.022285][ T190] ? __pfx_vpanic+0x10/0x10 [ 93.026922][ T190] ? __pfx___schedule+0x10/0x10 [ 93.031803][ T190] panic+0xc5/0xd0 [ 93.035562][ T190] ? __pfx_panic+0x10/0x10 [ 93.040028][ T190] ? preempt_schedule_thunk+0x16/0x40 [ 93.045523][ T190] ? usb_unbind_interface+0x2c2/0x9f0 [ 93.050929][ T190] check_panic_on_warn+0x89/0xb0 [ 93.055894][ T190] ? usb_unbind_interface+0x2c2/0x9f0 [ 93.061301][ T190] end_report+0x73/0x170 [ 93.065578][ T190] ? usb_unbind_interface+0x2c2/0x9f0 [ 93.071021][ T190] kasan_report+0x128/0x150 [ 93.075648][ T190] ? usb_unbind_interface+0x2c2/0x9f0 [ 93.081063][ T190] usb_unbind_interface+0x2c2/0x9f0 [ 93.086387][ T190] ? kernfs_remove_by_name_ns+0x101/0x140 [ 93.092162][ T190] ? kernfs_remove_by_name_ns+0x101/0x140 [ 93.098036][ T190] ? __pfx_usb_unbind_interface+0x10/0x10 [ 93.103808][ T190] device_release_driver_internal+0x4f5/0x880 [ 93.109927][ T190] bus_remove_device+0x444/0x560 [ 93.114940][ T190] ? __pfx_bus_remove_device+0x10/0x10 [ 93.120463][ T190] ? kernfs_remove_by_name_ns+0x101/0x140 [ 93.126343][ T190] device_del+0x524/0x8f0 [ 93.131150][ T190] ? __pfx_device_del+0x10/0x10 [ 93.136034][ T190] ? __pfx___mutex_lock+0x10/0x10 [ 93.141110][ T190] usb_disable_device+0x3d4/0x8d0 [ 93.146177][ T190] usb_disconnect+0x346/0x9a0 [ 93.150971][ T190] hub_event+0x1bbb/0x4d30 [ 93.155465][ T190] ? do_raw_spin_unlock+0xf5/0x200 [ 93.160819][ T190] ? register_lock_class+0x31/0x2e0 [ 93.166072][ T190] ? __pfx_hub_event+0x10/0x10 [ 93.171099][ T190] ? rcu_is_watching+0x16/0xb0 [ 93.175905][ T190] ? process_scheduled_works+0x97a/0x1630 [ 93.181662][ T190] process_scheduled_works+0xc3d/0x1630 [ 93.187265][ T190] ? __pfx_process_scheduled_works+0x10/0x10 [ 93.193388][ T190] ? assign_work+0x3cf/0x5d0 [ 93.198013][ T190] worker_thread+0xa47/0xfb0 [ 93.202654][ T190] ? __kthread_parkme+0x71/0x1f0 [ 93.207629][ T190] kthread+0x38b/0x480 [ 93.211722][ T190] ? __pfx_worker_thread+0x10/0x10 [ 93.216865][ T190] ? __pfx_kthread+0x10/0x10 [ 93.221577][ T190] ret_from_fork+0x514/0xb70 [ 93.226483][ T190] ? __pfx_ret_from_fork+0x10/0x10 [ 93.231690][ T190] ? __switch_to+0xc89/0x1420 [ 93.236429][ T190] ? __pfx_kthread+0x10/0x10 [ 93.241158][ T190] ret_from_fork_asm+0x1a/0x30 [ 93.246079][ T190] [ 93.249726][ T190] Kernel Offset: disabled [ 93.254073][ T190] Rebooting in 86400 seconds..