Warning: Permanently added '[localhost]:30508' (ED25519) to the list of known hosts.
2026/10/18 13:34:21 parsed 1 programs
2026/10/18 13:34:21 serving rpc on tcp://34615
[ 36.906685][ T5742] cgroup: Unknown subsys name 'net'
[ 37.009843][ T5742] cgroup: Unknown subsys name 'cpuset'
[ 37.013453][ T5742] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 37.971720][ T5742] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 39.762363][ T5753] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 39.765038][ T5753] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 39.777534][ T5753] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 39.778054][ T5753] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 39.783577][ T5753] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 40.736436][ T1160] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 40.736452][ T1160] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 40.773186][ T1167] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 40.773200][ T1167] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 41.199919][ T5791] rxe_eth0 speed is unknown, defaulting to 1000
[ 41.200731][ T5791] rxe_eth0 speed is unknown, defaulting to 1000
[ 41.202105][ T5791] rxe_eth0 speed is unknown, defaulting to 1000
[ 41.368617][ T5791] infiniband rxe0: set active
[ 41.371563][ T5791] infiniband rxe0: added rxe_eth0
[ 41.374174][ T9] rxe_eth0 speed is unknown, defaulting to 1000
[ 41.382370][ T5791] smbdirect: ib_dev[rxe0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000
[ 41.382391][ T5791] smbdirect: ib_dev[rxe0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32
[ 41.382411][ T5791] smbdirect: ib_dev[rxe0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005
[ 41.414007][ T5791] RDS/IB: rxe0: added
[ 41.415010][ T5791] smc: adding ib device rxe0 with port count 1
[ 41.415079][ T5791] smc: ib device rxe0 port 1 has no pnetid
[ 41.416157][ T41] rxe_eth0 speed is unknown, defaulting to 1000
[ 41.417951][ T5791] rxe_eth0 speed is unknown, defaulting to 1000
[ 41.532747][ T5791] rxe_eth0 speed is unknown, defaulting to 1000
[ 41.818711][ T5791] bridge0: port 1(bridge_slave_0) entered blocking state
[ 41.819292][ T5791] bridge0: port 1(bridge_slave_0) entered disabled state
[ 41.819407][ T5791] bridge_slave_0: entered allmulticast mode
[ 41.821016][ T5791] bridge_slave_0: entered promiscuous mode
[ 41.823136][ T5791] bridge0: port 2(bridge_slave_1) entered blocking state
[ 41.823556][ T5791] bridge0: port 2(bridge_slave_1) entered disabled state
[ 41.823637][ T5791] bridge_slave_1: entered allmulticast mode
[ 41.824413][ T5791] bridge_slave_1: entered promiscuous mode
[ 41.837964][ T5791] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 41.839435][ T5791] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 41.850803][ T5791] team0: Port device team_slave_0 added
[ 41.851993][ T5791] team0: Port device team_slave_1 added
[ 41.863431][ T5791] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 41.863440][ T5791] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 41.863452][ T5791] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 41.864613][ T5791] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 41.864621][ T5791] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 41.864633][ T5791] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 41.883502][ T5791] hsr_slave_0: entered promiscuous mode
[ 41.883963][ T5791] hsr_slave_1: entered promiscuous mode
[ 41.970717][ T5791] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 41.976003][ T5791] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 41.976686][ T5791] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 41.981002][ T5791] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 41.981563][ T5791] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 41.987881][ T5791] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 41.989229][ T5791] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 41.994553][ T5791] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 42.013315][ T5791] bridge0: port 2(bridge_slave_1) entered blocking state
[ 42.013370][ T5791] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 42.013630][ T5791] bridge0: port 1(bridge_slave_0) entered blocking state
[ 42.013678][ T5791] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 42.047225][ T5791] 8021q: adding VLAN 0 to HW filter on device bond0
[ 42.057378][ T192] bridge0: port 1(bridge_slave_0) entered disabled state
[ 42.061031][ T192] bridge0: port 2(bridge_slave_1) entered disabled state
[ 42.073648][ T5791] 8021q: adding VLAN 0 to HW filter on device team0
[ 42.080764][ T192] bridge0: port 1(bridge_slave_0) entered blocking state
[ 42.080866][ T192] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 42.087360][ T192] bridge0: port 2(bridge_slave_1) entered blocking state
[ 42.087444][ T192] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 42.412575][ T5791] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 42.448885][ T5791] veth0_vlan: entered promiscuous mode
[ 42.454670][ T5791] veth1_vlan: entered promiscuous mode
[ 42.473794][ T5791] veth0_macvtap: entered promiscuous mode
[ 42.476752][ T5791] veth1_macvtap: entered promiscuous mode
[ 42.485149][ T5791] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 42.493680][ T5791] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 42.520515][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 42.520556][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 42.520583][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 42.520624][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 42.608475][ T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 42.668608][ T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 42.687420][ T5833] rxe_eth0 speed is unknown, defaulting to 1000
[ 42.739726][ T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 42.836276][ T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 42.947589][ T5838] rxe_eth0 speed is unknown, defaulting to 1000
[ 43.132777][ T5843] rxe_eth0 speed is unknown, defaulting to 1000
[ 43.314556][ T5848] rxe_eth0 speed is unknown, defaulting to 1000
[ 43.510801][ T5853] rxe_eth0 speed is unknown, defaulting to 1000
[ 43.709883][ T5859] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 43.710730][ T5859] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 43.711220][ T5859] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 43.711956][ T5859] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 43.712438][ T5859] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 43.743277][ T5858] rxe_eth0 speed is unknown, defaulting to 1000
[ 43.980498][ T5865] rxe_eth0 speed is unknown, defaulting to 1000
2026/10/18 13:34:32 executed programs: 0
[ 44.817437][ T5101] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 44.818714][ T5101] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 44.819265][ T5101] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 44.820200][ T5101] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 44.820658][ T5101] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 44.986010][ T5869] rxe_eth0 speed is unknown, defaulting to 1000
[ 45.244153][ T5869] bridge0: port 1(bridge_slave_0) entered blocking state
[ 45.244204][ T5869] bridge0: port 1(bridge_slave_0) entered disabled state
[ 45.244259][ T5869] bridge_slave_0: entered allmulticast mode
[ 45.245341][ T5869] bridge_slave_0: entered promiscuous mode
[ 45.246618][ T5869] bridge0: port 2(bridge_slave_1) entered blocking state
[ 45.246694][ T5869] bridge0: port 2(bridge_slave_1) entered disabled state
[ 45.246749][ T5869] bridge_slave_1: entered allmulticast mode
[ 45.247795][ T5869] bridge_slave_1: entered promiscuous mode
[ 45.264467][ T5869] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 45.266450][ T5869] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 45.283310][ T5869] team0: Port device team_slave_0 added
[ 45.284660][ T5869] team0: Port device team_slave_1 added
[ 45.296511][ T5869] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 45.296521][ T5869] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 45.296533][ T5869] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 45.298006][ T5869] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 45.298018][ T5869] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 45.298037][ T5869] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 45.319796][ T5869] hsr_slave_0: entered promiscuous mode
[ 45.320496][ T5869] hsr_slave_1: entered promiscuous mode
[ 45.320994][ T5869] debugfs: 'hsr0' already exists in 'hsr'
[ 45.321080][ T5869] Cannot create hsr debugfs directory
[ 46.052057][ T13] bridge_slave_1: left allmulticast mode
[ 46.052089][ T13] bridge_slave_1: left promiscuous mode
[ 46.052816][ T13] bridge0: port 2(bridge_slave_1) entered disabled state
[ 46.059573][ T13] bridge_slave_0: left allmulticast mode
[ 46.059588][ T13] bridge_slave_0: left promiscuous mode
[ 46.059895][ T13] bridge0: port 1(bridge_slave_0) entered disabled state
[ 46.181267][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 46.184330][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 46.188869][ T13] bond0 (unregistering): Released all slaves
[ 46.360616][ T13] hsr_slave_0: left promiscuous mode
[ 46.361745][ T13] hsr_slave_1: left promiscuous mode
[ 46.362473][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 46.362495][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 46.363799][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 46.363813][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 46.373394][ T13] veth1_macvtap: left promiscuous mode
[ 46.373611][ T13] veth0_macvtap: left promiscuous mode
[ 46.373750][ T13] veth1_vlan: left promiscuous mode
[ 46.373940][ T13] veth0_vlan: left promiscuous mode
[ 46.542652][ T13] team0 (unregistering): Port device team_slave_1 removed
[ 46.548284][ T13] team0 (unregistering): Port device team_slave_0 removed
[ 46.726546][ T5869] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 46.737974][ T5869] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 46.738419][ T5869] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 46.742839][ T5869] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 46.743357][ T5869] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 46.746936][ T5869] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 46.747633][ T5869] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 46.752498][ T5869] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 46.819084][ T5869] 8021q: adding VLAN 0 to HW filter on device bond0
[ 46.831747][ T5869] 8021q: adding VLAN 0 to HW filter on device team0
[ 46.837962][ T1160] bridge0: port 1(bridge_slave_0) entered blocking state
[ 46.838105][ T1160] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 46.842941][ T1160] bridge0: port 2(bridge_slave_1) entered blocking state
[ 46.842985][ T1160] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 46.865489][ T5101] Bluetooth: hci0: command tx timeout
[ 47.240389][ T5869] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 47.260673][ T5869] veth0_vlan: entered promiscuous mode
[ 47.265298][ T5869] veth1_vlan: entered promiscuous mode
[ 47.279083][ T5869] veth0_macvtap: entered promiscuous mode
[ 47.281203][ T5869] veth1_macvtap: entered promiscuous mode
[ 47.291303][ T5869] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 47.301423][ T5869] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 47.325211][ T5782] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 47.325357][ T5782] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 47.325375][ T5782] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 47.325392][ T5782] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 47.348981][ T192] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 47.348994][ T192] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 47.392087][ T192] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 47.392101][ T192] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 47.684892][ T5531] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 47.835682][ T5531] usb 5-1: Using ep0 maxpacket: 32
[ 47.837641][ T5531] usb 5-1: unable to get BOS descriptor or descriptor too short
[ 47.837664][ T5531] usb 5-1: New USB device found, idVendor=1f71, idProduct=3306, bcdDevice=2a.c0
[ 47.839096][ T5531] usb 5-1: config 3 has an invalid interface number: 223 but max is 1
[ 47.839109][ T5531] usb 5-1: config 3 has an invalid interface number: 25 but max is 1
[ 47.839119][ T5531] usb 5-1: config 3 has an invalid interface number: 223 but max is 1
[ 47.839129][ T5531] usb 5-1: config 3 has no interface number 0
[ 47.839136][ T5531] usb 5-1: config 3 has no interface number 1
[ 47.839156][ T5531] usb 5-1: config 3 interface 25 altsetting 6 has an invalid descriptor for endpoint zero, skipping
[ 47.839166][ T5531] usb 5-1: config 3 interface 25 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 5
[ 47.839184][ T5531] usb 5-1: too many endpoints for config 3 interface 223 altsetting 155: 82, using maximum allowed: 30
[ 47.839201][ T5531] usb 5-1: config 3 interface 223 altsetting 155 endpoint 0xD has invalid maxpacket 512, setting to 64
[ 47.839214][ T5531] usb 5-1: config 3 interface 223 altsetting 155 endpoint 0x8 has invalid maxpacket 512, setting to 64
[ 47.839227][ T5531] usb 5-1: config 3 interface 223 altsetting 155 has 4 endpoint descriptors, different from the interface descriptor's value: 82
[ 47.839239][ T5531] usb 5-1: config 3 interface 223 has no altsetting 1
[ 47.839248][ T5531] usb 5-1: config 3 interface 25 has no altsetting 0
[ 47.840755][ T5531] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 47.840767][ T5531] usb 5-1: Product: syz
[ 47.840774][ T5531] usb 5-1: Manufacturer: syz
[ 47.840781][ T5531] usb 5-1: SerialNumber: syz
[ 48.089940][ T5531] usbtv 5-1:3.223: Fushicai USBTV007 Audio-Video Grabber
[ 48.093606][ T5531] usb 5-1: USB disconnect, device number 2
[ 48.122226][ T5531]
[ 48.123046][ T5531] =========================
[ 48.123619][ T5922] udevd[5922]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb5/5-1/sound/card3/controlC3/../uevent} for writing: No such file or directory
[ 48.129240][ T5531] WARNING: held lock freed!
[ 48.130670][ T5531] syzkaller #0 Not tainted
[ 48.132175][ T5531] -------------------------
[ 48.133686][ T5531] kworker/1:2/5531 is freeing memory ffff888014c9c000-ffff888014c9c7ff, with a lock still held there!
[ 48.137101][ T5531] ffff888014c9c1a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb2/0x620
[ 48.140208][ T5531] locks held by kworker/1:2/5531: 5, last CPU#1:
[ 48.142243][ T5531] #0: ffff88802304f540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10
[ 48.145545][ T5531] #1: ffffc9000504fd08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10
[ 48.148963][ T5531] #2: ffff88802617d1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bb/0x4420
[ 48.151702][ T5531] #3: ffff8880272f71d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0x10a/0x9a0
[ 48.154558][ T5531] #4: ffff888014c9c1a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb2/0x620
[ 48.157793][ T5531]
[ 48.157793][ T5531] stack backtrace:
[ 48.159624][ T5531] CPU: 1 UID: 0 PID: 5531 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(full)
[ 48.162520][ T5531] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 48.165617][ T5531] Workqueue: usb_hub_wq hub_event
[ 48.167211][ T5531] Call Trace:
[ 48.168264][ T5531]
[ 48.169215][ T5531] dump_stack_lvl+0x100/0x190
[ 48.170702][ T5531] debug_check_no_locks_freed+0x115/0x120
[ 48.172498][ T5531] ? device_release+0x60/0x270
[ 48.174014][ T5531] ? device_release+0xd2/0x270
[ 48.175555][ T5531] kfree+0x180/0x6d0
[ 48.176793][ T5531] ? put_device+0x24/0x30
[ 48.178163][ T5531] ? __pfx_usb_release_interface+0x10/0x10
[ 48.179982][ T5531] device_release+0xd2/0x270
[ 48.181457][ T5531] kobject_put+0x1f7/0x640
[ 48.182877][ T5531] put_device+0x1f/0x30
[ 48.184191][ T5531] v4l2_device_disconnect+0x60/0xc0
[ 48.185827][ T5531] usbtv_video_free+0x25/0x30
[ 48.187307][ T5531] usbtv_disconnect+0x58/0xa0
[ 48.188792][ T5531] usb_unbind_interface+0x1dd/0x9e0
[ 48.190431][ T5531] ? __pfx_usb_unbind_interface+0x10/0x10
[ 48.192254][ T5531] device_remove+0x12a/0x180
[ 48.193731][ T5531] device_release_driver_internal+0x44e/0x620
[ 48.195635][ T5531] bus_remove_device+0x2bc/0x560
[ 48.197138][ T5531] ? __pfx_bus_remove_device+0x10/0x10
[ 48.198791][ T5531] ? __pfx_device_remove_attrs+0x10/0x10
[ 48.200451][ T5531] device_del+0x376/0x9b0
[ 48.201811][ T5531] ? __pfx_device_del+0x10/0x10
[ 48.203317][ T5531] ? __pfx___pm_runtime_barrier+0x10/0x10
[ 48.205024][ T5531] ? lock_acquire+0x1d1/0x380
[ 48.206492][ T5531] usb_disable_device+0x367/0x810
[ 48.208030][ T5531] ? mark_held_locks+0x40/0x70
[ 48.209516][ T5531] usb_disconnect+0x2e2/0x9a0
[ 48.210954][ T5531] hub_event+0x1bb1/0x4420
[ 48.212352][ T5531] ? __lock_acquire+0x5c0/0x1f40
[ 48.213808][ T5531] ? __pfx_hub_event+0x10/0x10
[ 48.215147][ T5531] ? down_read_trylock+0x180/0x440
[ 48.216621][ T5531] ? lock_acquire+0x1d1/0x380
[ 48.218051][ T5531] ? process_one_work+0xa2c/0x1b10
[ 48.219585][ T5531] ? process_one_work+0x906/0x1b10
[ 48.221151][ T5531] ? process_one_work+0x906/0x1b10
[ 48.222723][ T5531] process_one_work+0xac7/0x1b10
[ 48.224222][ T5531] ? __pfx_process_one_work+0x10/0x10
[ 48.225833][ T5531] ? lock_acquire+0x1d1/0x380
[ 48.227269][ T5531] ? __pfx_hub_event+0x10/0x10
[ 48.228707][ T5531] worker_thread+0x5ef/0xe50
[ 48.230129][ T5531] ? kthread+0x13a/0x450
[ 48.231443][ T5531] ? __pfx_worker_thread+0x10/0x10
[ 48.233027][ T5531] kthread+0x373/0x450
[ 48.234272][ T5531] ? __pfx_kthread+0x10/0x10
[ 48.235680][ T5531] ret_from_fork+0x730/0xd60
[ 48.237096][ T5531] ? __pfx_ret_from_fork+0x10/0x10
[ 48.238713][ T5531] ? __switch_to+0x800/0x10f0
[ 48.240115][ T5531] ? __pfx_kthread+0x10/0x10
[ 48.241553][ T5531] ret_from_fork_asm+0x1a/0x30
[ 48.243014][ T5531]
[ 48.245956][ T5531] ==================================================================
[ 48.245964][ T5531] BUG: KASAN: slab-use-after-free in usb_unbind_interface+0x935/0x9e0
[ 48.245983][ T5531] Read of size 8 at addr ffff888014c9c008 by task kworker/1:2/5531
[ 48.245991][ T5531]
[ 48.245996][ T5531] CPU: 1 UID: 0 PID: 5531 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(full)
[ 48.246008][ T5531] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 48.246016][ T5531] Workqueue: usb_hub_wq hub_event
[ 48.246032][ T5531] Call Trace:
[ 48.246036][ T5531]
[ 48.246040][ T5531] dump_stack_lvl+0x100/0x190
[ 48.246055][ T5531] print_report+0x13d/0x4b0
[ 48.246071][ T5531] ? __virt_addr_valid+0x239/0x430
[ 48.246087][ T5531] ? usb_unbind_interface+0x935/0x9e0
[ 48.246102][ T5531] kasan_report+0xdf/0x1c0
[ 48.246119][ T5531] ? usb_unbind_interface+0x935/0x9e0
[ 48.246136][ T5531] usb_unbind_interface+0x935/0x9e0
[ 48.246152][ T5531] ? __pfx_usb_unbind_interface+0x10/0x10
[ 48.246168][ T5531] device_remove+0x12a/0x180
[ 48.246180][ T5531] device_release_driver_internal+0x44e/0x620
[ 48.246194][ T5531] bus_remove_device+0x2bc/0x560
[ 48.246205][ T5531] ? __pfx_bus_remove_device+0x10/0x10
[ 48.246215][ T5531] ? __pfx_device_remove_attrs+0x10/0x10
[ 48.246227][ T5531] device_del+0x376/0x9b0
[ 48.246238][ T5531] ? __pfx_device_del+0x10/0x10
[ 48.246249][ T5531] ? __pfx___pm_runtime_barrier+0x10/0x10
[ 48.246261][ T5531] ? lock_acquire+0x1d1/0x380
[ 48.246277][ T5531] usb_disable_device+0x367/0x810
[ 48.246291][ T5531] ? mark_held_locks+0x40/0x70
[ 48.246307][ T5531] usb_disconnect+0x2e2/0x9a0
[ 48.246322][ T5531] hub_event+0x1bb1/0x4420
[ 48.246339][ T5531] ? __lock_acquire+0x5c0/0x1f40
[ 48.246355][ T5531] ? __pfx_hub_event+0x10/0x10
[ 48.246368][ T5531] ? down_read_trylock+0x180/0x440
[ 48.246380][ T5531] ? lock_acquire+0x1d1/0x380
[ 48.246394][ T5531] ? process_one_work+0xa2c/0x1b10
[ 48.246422][ T5531] ? process_one_work+0x906/0x1b10
[ 48.246436][ T5531] ? process_one_work+0x906/0x1b10
[ 48.246449][ T5531] process_one_work+0xac7/0x1b10
[ 48.246465][ T5531] ? __pfx_process_one_work+0x10/0x10
[ 48.246478][ T5531] ? lock_acquire+0x1d1/0x380
[ 48.246495][ T5531] ? __pfx_hub_event+0x10/0x10
[ 48.246509][ T5531] worker_thread+0x5ef/0xe50
[ 48.246524][ T5531] ? kthread+0x13a/0x450
[ 48.246535][ T5531] ? __pfx_worker_thread+0x10/0x10
[ 48.246548][ T5531] kthread+0x373/0x450
[ 48.246559][ T5531] ? __pfx_kthread+0x10/0x10
[ 48.246570][ T5531] ret_from_fork+0x730/0xd60
[ 48.246581][ T5531] ? __pfx_ret_from_fork+0x10/0x10
[ 48.246591][ T5531] ? __switch_to+0x800/0x10f0
[ 48.246604][ T5531] ? __pfx_kthread+0x10/0x10
[ 48.246616][ T5531] ret_from_fork_asm+0x1a/0x30
[ 48.246632][ T5531]
[ 48.246636][ T5531]
[ 48.246638][ T5531] Allocated by task 5531:
[ 48.246644][ T5531] kasan_save_stack+0x30/0x50
[ 48.246658][ T5531] kasan_save_track+0x14/0x30
[ 48.246671][ T5531] __kasan_kmalloc+0xaa/0xb0
[ 48.246685][ T5531] __kmalloc_cache_noprof+0x2f8/0x6d0
[ 48.246696][ T5531] usb_set_configuration+0x10d0/0x1dc0
[ 48.246710][ T5531] usb_generic_driver_probe+0xa1/0xe0
[ 48.246721][ T5531] usb_probe_device+0xef/0x400
[ 48.246734][ T5531] really_probe+0x241/0xa60
[ 48.246744][ T5531] __driver_probe_device+0x210/0x460
[ 48.246755][ T5531] driver_probe_device+0x4a/0x140
[ 48.246766][ T5531] __device_attach_driver+0x1df/0x320
[ 48.246778][ T5531] bus_for_each_drv+0x159/0x1e0
[ 48.246793][ T5531] __device_attach+0x1e4/0x4d0
[ 48.246803][ T5531] device_initial_probe+0xaf/0xd0
[ 48.246815][ T5531] bus_probe_device+0x64/0x160
[ 48.246824][ T5531] device_add+0x121d/0x1970
[ 48.246836][ T5531] usb_new_device.part.0+0xcc2/0x1686
[ 48.246850][ T5531] hub_event.cold+0x1e3/0xe90
[ 48.246862][ T5531] process_one_work+0xac7/0x1b10
[ 48.246874][ T5531] worker_thread+0x5ef/0xe50
[ 48.246886][ T5531] kthread+0x373/0x450
[ 48.246896][ T5531] ret_from_fork+0x730/0xd60
[ 48.246905][ T5531] ret_from_fork_asm+0x1a/0x30
[ 48.246914][ T5531]
[ 48.246916][ T5531] Freed by task 5531:
[ 48.246920][ T5531] kasan_save_stack+0x30/0x50
[ 48.246933][ T5531] kasan_save_track+0x14/0x30
[ 48.246947][ T5531] kasan_save_free_info+0x3b/0x70
[ 48.246958][ T5531] __kasan_slab_free+0x5f/0x80
[ 48.246972][ T5531] kfree+0x22b/0x6d0
[ 48.246981][ T5531] device_release+0xd2/0x270
[ 48.246995][ T5531] kobject_put+0x1f7/0x640
[ 48.247007][ T5531] put_device+0x1f/0x30
[ 48.247022][ T5531] v4l2_device_disconnect+0x60/0xc0
[ 48.247036][ T5531] usbtv_video_free+0x25/0x30
[ 48.247051][ T5531] usbtv_disconnect+0x58/0xa0
[ 48.247064][ T5531] usb_unbind_interface+0x1dd/0x9e0
[ 48.247078][ T5531] device_remove+0x12a/0x180
[ 48.247088][ T5531] device_release_driver_internal+0x44e/0x620
[ 48.247100][ T5531] bus_remove_device+0x2bc/0x560
[ 48.247109][ T5531] device_del+0x376/0x9b0
[ 48.247119][ T5531] usb_disable_device+0x367/0x810
[ 48.247131][ T5531] usb_disconnect+0x2e2/0x9a0
[ 48.247143][ T5531] hub_event+0x1bb1/0x4420
[ 48.247156][ T5531] process_one_work+0xac7/0x1b10
[ 48.247168][ T5531] worker_thread+0x5ef/0xe50
[ 48.247180][ T5531] kthread+0x373/0x450
[ 48.247190][ T5531] ret_from_fork+0x730/0xd60
[ 48.247198][ T5531] ret_from_fork_asm+0x1a/0x30
[ 48.247207][ T5531]
[ 48.247209][ T5531] The buggy address belongs to the object at ffff888014c9c000
[ 48.247209][ T5531] which belongs to the cache kmalloc-2k of size 2048
[ 48.247217][ T5531] The buggy address is located 8 bytes inside of
[ 48.247217][ T5531] freed 2048-byte region [ffff888014c9c000, ffff888014c9c800)
[ 48.247226][ T5531]
[ 48.247228][ T5531] The buggy address belongs to the physical page:
[ 48.247233][ T5531] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14c98
[ 48.247243][ T5531] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 48.247251][ T5531] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 48.247261][ T5531] page_type: f5(slab)
[ 48.247270][ T5531] raw: 00fff00000000040 ffff88801d042f00 dead000000000100 dead000000000122
[ 48.247292][ T5531] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 48.247301][ T5531] head: 00fff00000000040 ffff88801d042f00 dead000000000100 dead000000000122
[ 48.247309][ T5531] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 48.247318][ T5531] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 48.247326][ T5531] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 48.247331][ T5531] page dumped because: kasan: bad access detected
[ 48.247336][ T5531] page_owner tracks the page as allocated
[ 48.247340][ T5531] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5848, tgid 5848 (syz-executor), ts 43312499787
[ 48.247356][ T5531] post_alloc_hook+0xfd/0x120
[ 48.247367][ T5531] get_page_from_freelist+0x110d/0x35d0
[ 48.247379][ T5531] __alloc_frozen_pages_noprof+0x2eb/0x3300
[ 48.247391][ T5531] new_slab+0xa9/0x6e0
[ 48.247401][ T5531] refill_objects+0xe3/0x410
[ 48.247412][ T5531] __pcs_replace_empty_main+0x35e/0x650
[ 48.247423][ T5531] __kmalloc_node_track_caller_noprof+0x6a8/0x870
[ 48.247437][ T5531] kmalloc_reserve+0xe8/0x350
[ 48.247452][ T5531] pskb_expand_head+0x249/0x10e0
[ 48.247464][ T5531] netlink_trim+0x22d/0x2f0
[ 48.247478][ T5531] netlink_broadcast_filtered+0x6d/0xfd0
[ 48.247488][ T5531] nlmsg_notify+0xb1/0x290
[ 48.247497][ T5531] rtmsg_ifinfo+0x177/0x1b0
[ 48.247511][ T5531] register_netdevice+0x1e5b/0x25a0
[ 48.247525][ T5531] register_netdev+0x34/0x50
[ 48.247538][ T5531] loopback_net_init+0x7a/0x170
[ 48.247553][ T5531] page last free pid 5153 tgid 5153 ts 11482523879 stack trace:
[ 48.247559][ T5531] __free_frozen_pages+0x79f/0x10f0
[ 48.247569][ T5531] qlist_free_all+0x47/0xf0
[ 48.247581][ T5531] kasan_quarantine_reduce+0x1a0/0x1f0
[ 48.247595][ T5531] __kasan_slab_alloc+0x69/0x90
[ 48.247609][ T5531] kmem_cache_alloc_noprof+0x269/0x6a0
[ 48.247625][ T5531] do_getname+0x35/0x390
[ 48.247635][ T5531] do_readlinkat+0xa9/0x370
[ 48.247650][ T5531] __x64_sys_readlink+0x78/0xc0
[ 48.247659][ T5531] do_syscall_64+0x121/0x770
[ 48.247668][ T5531] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 48.247678][ T5531]
[ 48.247680][ T5531] Memory state around the buggy address:
[ 48.247685][ T5531] ffff888014c9bf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 48.247692][ T5531] ffff888014c9bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 48.247698][ T5531] >ffff888014c9c000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 48.247703][ T5531] ^
[ 48.247708][ T5531] ffff888014c9c080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 48.247715][ T5531] ffff888014c9c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 48.247720][ T5531] ==================================================================
[ 48.247747][ T5531] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 48.510372][ T5531] CPU: 1 UID: 0 PID: 5531 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(full)
[ 48.513290][ T5531] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 48.516396][ T5531] Workqueue: usb_hub_wq hub_event
[ 48.517992][ T5531] Call Trace:
[ 48.519048][ T5531]
[ 48.519989][ T5531] dump_stack_lvl+0x100/0x190
[ 48.521516][ T5531] vpanic+0x553/0x970
[ 48.522788][ T5531] ? __pfx_vpanic+0x10/0x10
[ 48.524173][ T5531] ? rcu_is_watching+0x13/0xc0
[ 48.525645][ T5531] ? trace_irq_enable.constprop.0+0x122/0x160
[ 48.527466][ T5531] ? usb_unbind_interface+0x935/0x9e0
[ 48.529080][ T5531] panic+0xd1/0xe0
[ 48.530226][ T5531] ? __pfx_panic+0x10/0x10
[ 48.531571][ T5531] ? trace_irq_enable.constprop.0+0x2f/0x160
[ 48.533385][ T5531] check_panic_on_warn.cold+0x19/0x34
[ 48.534999][ T5531] end_report.part.0+0x3a/0x90
[ 48.536446][ T5531] kasan_report.cold+0xe/0x18
[ 48.537893][ T5531] ? usb_unbind_interface+0x935/0x9e0
[ 48.539522][ T5531] usb_unbind_interface+0x935/0x9e0
[ 48.541122][ T5531] ? __pfx_usb_unbind_interface+0x10/0x10
[ 48.542839][ T5531] device_remove+0x12a/0x180
[ 48.544245][ T5531] device_release_driver_internal+0x44e/0x620
[ 48.546054][ T5531] bus_remove_device+0x2bc/0x560
[ 48.547609][ T5531] ? __pfx_bus_remove_device+0x10/0x10
[ 48.549278][ T5531] ? __pfx_device_remove_attrs+0x10/0x10
[ 48.551059][ T5531] device_del+0x376/0x9b0
[ 48.552446][ T5531] ? __pfx_device_del+0x10/0x10
[ 48.553983][ T5531] ? __pfx___pm_runtime_barrier+0x10/0x10
[ 48.555757][ T5531] ? lock_acquire+0x1d1/0x380
[ 48.557255][ T5531] usb_disable_device+0x367/0x810
[ 48.558766][ T5531] ? mark_held_locks+0x40/0x70
[ 48.560279][ T5531] usb_disconnect+0x2e2/0x9a0
[ 48.561801][ T5531] hub_event+0x1bb1/0x4420
[ 48.563236][ T5531] ? __lock_acquire+0x5c0/0x1f40
[ 48.564807][ T5531] ? __pfx_hub_event+0x10/0x10
[ 48.566323][ T5531] ? down_read_trylock+0x180/0x440
[ 48.567934][ T5531] ? lock_acquire+0x1d1/0x380
[ 48.569415][ T5531] ? process_one_work+0xa2c/0x1b10
[ 48.571022][ T5531] ? process_one_work+0x906/0x1b10
[ 48.572645][ T5531] ? process_one_work+0x906/0x1b10
[ 48.574260][ T5531] process_one_work+0xac7/0x1b10
[ 48.575824][ T5531] ? __pfx_process_one_work+0x10/0x10
[ 48.577513][ T5531] ? lock_acquire+0x1d1/0x380
[ 48.579004][ T5531] ? __pfx_hub_event+0x10/0x10
[ 48.580513][ T5531] worker_thread+0x5ef/0xe50
[ 48.582005][ T5531] ? kthread+0x13a/0x450
[ 48.583343][ T5531] ? __pfx_worker_thread+0x10/0x10
[ 48.584952][ T5531] kthread+0x373/0x450
[ 48.586247][ T5531] ? __pfx_kthread+0x10/0x10
[ 48.587707][ T5531] ret_from_fork+0x730/0xd60
[ 48.589171][ T5531] ? __pfx_ret_from_fork+0x10/0x10
[ 48.590777][ T5531] ? __switch_to+0x800/0x10f0
[ 48.592275][ T5531] ? __pfx_kthread+0x10/0x10
[ 48.593750][ T5531] ret_from_fork_asm+0x1a/0x30
[ 48.595261][ T5531]
[ 48.596816][ T5531] Kernel Offset: disabled
[ 48.598185][ T5531] Rebooting in 86400 seconds..