Warning: Permanently added '10.128.1.140' (ED25519) to the list of known hosts.
2026/10/10 01:20:40 parsed 1 programs
2026/10/10 01:20:40 serving rpc on tcp://34945
[ 81.498539][ T5629] cgroup: Unknown subsys name 'net'
[ 81.599199][ T5629] cgroup: Unknown subsys name 'cpuset'
[ 81.602297][ T5629] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 83.373896][ T5629] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 86.661839][ T5643] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 86.665887][ T5643] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 86.697468][ T5643] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 86.698278][ T5643] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 86.705484][ T5643] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 86.832822][ T30] cfg80211: failed to load regulatory.db
[ 87.342669][ T54] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 87.343373][ T54] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 87.343861][ T54] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 87.344934][ T54] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 87.352703][ T54] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 89.149184][ T4077] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 89.149208][ T4077] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 89.190518][ T61] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 89.190541][ T61] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 90.400424][ T5709] bridge0: port 1(bridge_slave_0) entered blocking state
[ 90.401029][ T5709] bridge0: port 1(bridge_slave_0) entered disabled state
[ 90.401117][ T5709] bridge_slave_0: entered allmulticast mode
[ 90.402601][ T5709] bridge_slave_0: entered promiscuous mode
[ 90.407101][ T5709] bridge0: port 2(bridge_slave_1) entered blocking state
[ 90.407206][ T5709] bridge0: port 2(bridge_slave_1) entered disabled state
[ 90.407385][ T5709] bridge_slave_1: entered allmulticast mode
[ 90.409261][ T5709] bridge_slave_1: entered promiscuous mode
[ 90.444421][ T5709] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 90.447890][ T5709] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 90.483288][ T5709] team0: Port device team_slave_0 added
[ 90.485265][ T5709] team0: Port device team_slave_1 added
[ 90.509634][ T5709] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 90.509647][ T5709] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 90.509661][ T5709] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 90.511778][ T5709] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 90.511793][ T5709] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 90.511814][ T5709] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 90.566876][ T5709] hsr_slave_0: entered promiscuous mode
[ 90.568107][ T5709] hsr_slave_1: entered promiscuous mode
[ 90.732693][ T5709] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 90.745949][ T5709] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 90.747220][ T5709] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 90.750451][ T5709] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 90.751561][ T5709] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 90.754652][ T5709] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 90.778020][ T5709] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 90.788899][ T5709] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 90.822409][ T5709] bridge0: port 2(bridge_slave_1) entered blocking state
[ 90.822490][ T5709] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 90.822850][ T5709] bridge0: port 1(bridge_slave_0) entered blocking state
[ 90.822934][ T5709] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 90.910765][ T5709] 8021q: adding VLAN 0 to HW filter on device bond0
[ 90.931593][ T38] bridge0: port 1(bridge_slave_0) entered disabled state
[ 90.932364][ T38] bridge0: port 2(bridge_slave_1) entered disabled state
[ 90.956469][ T5709] 8021q: adding VLAN 0 to HW filter on device team0
[ 90.963736][ T4106] bridge0: port 1(bridge_slave_0) entered blocking state
[ 90.964145][ T4106] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 90.991989][ T4106] bridge0: port 2(bridge_slave_1) entered blocking state
[ 90.992084][ T4106] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 91.326029][ T5709] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 91.384151][ T5709] veth0_vlan: entered promiscuous mode
[ 91.393921][ T5709] veth1_vlan: entered promiscuous mode
[ 91.422547][ T5709] veth0_macvtap: entered promiscuous mode
[ 91.427573][ T5709] veth1_macvtap: entered promiscuous mode
[ 91.446135][ T5709] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 91.454625][ T5709] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 91.479467][ T38] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 91.479512][ T38] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 91.479545][ T38] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 91.497298][ T38] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 91.652733][ T38] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 91.737986][ T38] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 91.842226][ T38] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 91.938128][ T38] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2026/10/10 01:20:53 executed programs: 0
[ 92.236319][ T4934] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 92.238475][ T4934] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 92.239278][ T4934] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 92.240524][ T4934] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 92.241243][ T4934] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 92.709249][ T5754] bridge0: port 1(bridge_slave_0) entered blocking state
[ 92.709386][ T5754] bridge0: port 1(bridge_slave_0) entered disabled state
[ 92.709467][ T5754] bridge_slave_0: entered allmulticast mode
[ 92.710590][ T5754] bridge_slave_0: entered promiscuous mode
[ 92.714775][ T5754] bridge0: port 2(bridge_slave_1) entered blocking state
[ 92.714881][ T5754] bridge0: port 2(bridge_slave_1) entered disabled state
[ 92.714996][ T5754] bridge_slave_1: entered allmulticast mode
[ 92.718136][ T5754] bridge_slave_1: entered promiscuous mode
[ 92.763717][ T5754] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 92.773563][ T5754] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 92.799452][ T5754] team0: Port device team_slave_0 added
[ 92.801329][ T5754] team0: Port device team_slave_1 added
[ 92.836318][ T5754] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 92.836336][ T5754] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 92.836351][ T5754] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 92.838532][ T5754] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 92.838547][ T5754] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 92.838569][ T5754] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 92.960988][ T5754] hsr_slave_0: entered promiscuous mode
[ 92.961720][ T5754] hsr_slave_1: entered promiscuous mode
[ 92.962289][ T5754] debugfs: 'hsr0' already exists in 'hsr'
[ 92.962364][ T5754] Cannot create hsr debugfs directory
[ 93.850191][ T38] bridge_slave_1: left allmulticast mode
[ 93.850235][ T38] bridge_slave_1: left promiscuous mode
[ 93.852487][ T38] bridge0: port 2(bridge_slave_1) entered disabled state
[ 93.886864][ T38] bridge_slave_0: left allmulticast mode
[ 93.886895][ T38] bridge_slave_0: left promiscuous mode
[ 93.887189][ T38] bridge0: port 1(bridge_slave_0) entered disabled state
[ 94.104381][ T38] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 94.134192][ T38] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 94.145119][ T38] bond0 (unregistering): Released all slaves
[ 94.251313][ T38] hsr_slave_0: left promiscuous mode
[ 94.252533][ T38] hsr_slave_1: left promiscuous mode
[ 94.253603][ T38] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 94.253633][ T38] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 94.254970][ T38] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 94.254990][ T38] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 94.261981][ T4934] Bluetooth: hci0: command tx timeout
[ 94.292676][ T38] veth1_macvtap: left promiscuous mode
[ 94.292731][ T38] veth0_macvtap: left promiscuous mode
[ 94.292883][ T38] veth1_vlan: left promiscuous mode
[ 94.292969][ T38] veth0_vlan: left promiscuous mode
[ 94.573047][ T38] team0 (unregistering): Port device team_slave_1 removed
[ 94.592852][ T38] team0 (unregistering): Port device team_slave_0 removed
[ 94.712587][ T5278] 8021q: adding VLAN 0 to HW filter on device eth1
[ 95.019159][ T5754] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 95.032728][ T5754] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 95.035529][ T5754] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 95.053943][ T5754] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 95.054852][ T5754] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 95.069053][ T5754] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 95.071455][ T5754] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 95.084650][ T5754] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 95.384782][ T5754] 8021q: adding VLAN 0 to HW filter on device bond0
[ 95.419577][ T5754] 8021q: adding VLAN 0 to HW filter on device team0
[ 95.437549][ T4106] bridge0: port 1(bridge_slave_0) entered blocking state
[ 95.437671][ T4106] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 95.463100][ T4077] bridge0: port 2(bridge_slave_1) entered blocking state
[ 95.463217][ T4077] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 96.137332][ T5754] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 96.289673][ T5754] veth0_vlan: entered promiscuous mode
[ 96.318442][ T5754] veth1_vlan: entered promiscuous mode
[ 96.335810][ T4934] Bluetooth: hci0: command tx timeout
[ 96.427226][ T5754] veth0_macvtap: entered promiscuous mode
[ 96.442680][ T5754] veth1_macvtap: entered promiscuous mode
[ 96.475098][ T5754] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 96.489230][ T5754] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 96.528788][ T4077] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 96.557416][ T4106] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 96.557786][ T4106] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 96.557824][ T4106] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 96.623181][ T38] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 96.623204][ T38] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 96.683380][ T4077] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 96.683404][ T4077] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 97.006264][ T5838] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 97.155796][ T5838] usb 1-1: Using ep0 maxpacket: 32
[ 97.158444][ T5838] usb 1-1: unable to get BOS descriptor or descriptor too short
[ 97.158556][ T5838] usb 1-1: New USB device found, idVendor=1f71, idProduct=3306, bcdDevice=2a.c0
[ 97.160345][ T5838] usb 1-1: config 3 has an invalid interface number: 223 but max is 1
[ 97.160371][ T5838] usb 1-1: config 3 has an invalid interface number: 25 but max is 1
[ 97.160389][ T5838] usb 1-1: config 3 has an invalid interface number: 223 but max is 1
[ 97.160406][ T5838] usb 1-1: config 3 has no interface number 0
[ 97.160419][ T5838] usb 1-1: config 3 has no interface number 1
[ 97.160488][ T5838] usb 1-1: config 3 interface 25 altsetting 6 has an invalid descriptor for endpoint zero, skipping
[ 97.160500][ T5838] usb 1-1: config 3 interface 25 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 5
[ 97.160514][ T5838] usb 1-1: too many endpoints for config 3 interface 223 altsetting 155: 82, using maximum allowed: 30
[ 97.160535][ T5838] usb 1-1: config 3 interface 223 altsetting 155 endpoint 0xD has invalid maxpacket 512, setting to 64
[ 97.160550][ T5838] usb 1-1: config 3 interface 223 altsetting 155 endpoint 0x8 has invalid maxpacket 512, setting to 64
[ 97.160564][ T5838] usb 1-1: config 3 interface 223 altsetting 155 has 4 endpoint descriptors, different from the interface descriptor's value: 82
[ 97.160578][ T5838] usb 1-1: config 3 interface 223 has no altsetting 1
[ 97.160588][ T5838] usb 1-1: config 3 interface 25 has no altsetting 0
[ 97.162559][ T5838] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 97.162580][ T5838] usb 1-1: Product: syz
[ 97.162593][ T5838] usb 1-1: Manufacturer: syz
[ 97.162605][ T5838] usb 1-1: SerialNumber: syz
[ 97.467252][ T5838] usbtv 1-1:3.223: Fushicai USBTV007 Audio-Video Grabber
[ 97.478566][ T5838] usb 1-1: USB disconnect, device number 2
[ 97.576816][ T5848] udevd[5848]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/sound/card3/controlC3/../uevent} for writing:
** replaying previous printk message **
[ 97.576816][ T5848] udevd[5848]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/sound/card3/controlC3/../uevent} for writing: No such file or directory
[ 97.597707][ T5838]
[ 97.619605][ T5838] =========================
[ 97.624129][ T5838] WARNING: held lock freed!
[ 97.628655][ T5838] syzkaller #0 Not tainted
[ 97.633084][ T5838] -------------------------
[ 97.637575][ T5838] kworker/0:4/5838 is freeing memory ffff8880798ff000-ffff8880798ff7ff, with a lock still held there!
[ 97.648497][ T5838] ffff8880798ff1a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880
[ 97.658599][ T5838] locks held by kworker/0:4/5838: 5, last CPU#0:
[ 97.664965][ T5838] #0: ffff88801c189540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[ 97.676381][ T5838] #1: ffffc9000357fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[ 97.688215][ T5838] #2: ffff88802af141d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30
[ 97.697085][ T5838] #3: ffff88802caa51d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xfc/0x9a0
[ 97.706225][ T5838] #4: ffff8880798ff1a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880
[ 97.716756][ T5838]
[ 97.716756][ T5838] stack backtrace:
[ 97.722656][ T5838] CPU: 0 UID: 0 PID: 5838 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full)
[ 97.732028][ T5838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[ 97.742076][ T5838] Workqueue: usb_hub_wq hub_event
[ 97.747115][ T5838] Call Trace:
[ 97.750388][ T5838]
[ 97.753485][ T5838] dump_stack_lvl+0xe8/0x150
[ 97.758071][ T5838] debug_check_no_locks_freed+0x149/0x170
[ 97.763785][ T5838] kfree+0x12b/0x650
[ 97.767670][ T5838] ? device_release+0xc4/0x1f0
[ 97.772428][ T5838] ? __pfx_usb_release_interface+0x10/0x10
[ 97.778232][ T5838] device_release+0xc4/0x1f0
[ 97.782817][ T5838] kobject_put+0x222/0x550
[ 97.787253][ T5838] v4l2_device_disconnect+0x79/0xd0
[ 97.792445][ T5838] usbtv_video_free+0x25/0x30
[ 97.797116][ T5838] usbtv_disconnect+0x5c/0xa0
[ 97.801795][ T5838] usb_unbind_interface+0x295/0x9f0
[ 97.806988][ T5838] ? kernfs_remove_by_name_ns+0x101/0x140
[ 97.812716][ T5838] ? kernfs_remove_by_name_ns+0x101/0x140
[ 97.818443][ T5838] ? __pfx_usb_unbind_interface+0x10/0x10
[ 97.824165][ T5838] device_release_driver_internal+0x4f5/0x880
[ 97.830245][ T5838] bus_remove_device+0x444/0x560
[ 97.835179][ T5838] ? __pfx_bus_remove_device+0x10/0x10
[ 97.840642][ T5838] ? kernfs_remove_by_name_ns+0x101/0x140
[ 97.846357][ T5838] device_del+0x524/0x8f0
[ 97.850684][ T5838] ? __pfx_device_del+0x10/0x10
[ 97.855533][ T5838] ? __pfx___mutex_lock+0x10/0x10
[ 97.860594][ T5838] usb_disable_device+0x3d4/0x8d0
[ 97.865643][ T5838] usb_disconnect+0x346/0x9a0
[ 97.870360][ T5838] hub_event+0x1bbb/0x4d30
[ 97.874781][ T5838] ? do_raw_spin_unlock+0xf5/0x200
[ 97.879893][ T5838] ? register_lock_class+0x31/0x2e0
[ 97.885146][ T5838] ? __pfx_hub_event+0x10/0x10
[ 97.889910][ T5838] ? rcu_is_watching+0x16/0xb0
[ 97.894689][ T5838] ? process_scheduled_works+0x97a/0x1630
[ 97.900422][ T5838] process_scheduled_works+0xc3d/0x1630
[ 97.905979][ T5838] ? __pfx_process_scheduled_works+0x10/0x10
[ 97.911975][ T5838] ? assign_work+0x3cf/0x5d0
[ 97.916580][ T5838] worker_thread+0xa47/0xfb0
[ 97.921198][ T5838] ? __kthread_parkme+0x71/0x1f0
[ 97.926170][ T5838] kthread+0x38b/0x480
[ 97.930263][ T5838] ? __pfx_worker_thread+0x10/0x10
[ 97.935393][ T5838] ? __pfx_kthread+0x10/0x10
[ 97.939991][ T5838] ret_from_fork+0x514/0xb70
[ 97.944591][ T5838] ? __pfx_ret_from_fork+0x10/0x10
[ 97.949706][ T5838] ? __switch_to+0xc89/0x1420
[ 97.954394][ T5838] ? __pfx_kthread+0x10/0x10
[ 97.958985][ T5838] ret_from_fork_asm+0x1a/0x30
[ 97.963782][ T5838]
[ 97.977883][ T5838] ==================================================================
[ 97.977898][ T5838] BUG: KASAN: slab-use-after-free in usb_unbind_interface+0x2c2/0x9f0
** replaying previous printk message **
[ 97.977898][ T5838] BUG: KASAN: slab-use-after-free in usb_unbind_interface+0x2c2/0x9f0
[ 97.977935][ T5838] Read of size 8 at addr ffff8880798ff008 by task kworker/0:4/5838
[ 97.977951][ T5838]
[ 97.977960][ T5838] CPU: 0 UID: 0 PID: 5838 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full)
[ 97.977979][ T5838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[ 97.977989][ T5838] Workqueue: usb_hub_wq hub_event
[ 97.978015][ T5838] Call Trace:
[ 97.978021][ T5838]
[ 97.978028][ T5838] dump_stack_lvl+0xe8/0x150
[ 97.978054][ T5838] print_address_description+0x55/0x1e0
[ 97.978077][ T5838] ? usb_unbind_interface+0x2c2/0x9f0
[ 97.978100][ T5838] print_report+0x58/0x70
[ 97.978121][ T5838] kasan_report+0x117/0x150
[ 97.978145][ T5838] ? usb_unbind_interface+0x2c2/0x9f0
[ 97.978173][ T5838] usb_unbind_interface+0x2c2/0x9f0
[ 97.978196][ T5838] ? kernfs_remove_by_name_ns+0x101/0x140
[ 97.978232][ T5838] ? kernfs_remove_by_name_ns+0x101/0x140
[ 97.978255][ T5838] ? __pfx_usb_unbind_interface+0x10/0x10
[ 97.978280][ T5838] device_release_driver_internal+0x4f5/0x880
[ 97.978308][ T5838] bus_remove_device+0x444/0x560
[ 97.978329][ T5838] ? __pfx_bus_remove_device+0x10/0x10
[ 97.978350][ T5838] ? kernfs_remove_by_name_ns+0x101/0x140
[ 97.978374][ T5838] device_del+0x524/0x8f0
[ 97.978399][ T5838] ? __pfx_device_del+0x10/0x10
[ 97.978421][ T5838] ? __pfx___mutex_lock+0x10/0x10
[ 97.978445][ T5838] usb_disable_device+0x3d4/0x8d0
[ 97.978477][ T5838] usb_disconnect+0x346/0x9a0
[ 97.978500][ T5838] hub_event+0x1bbb/0x4d30
[ 97.978525][ T5838] ? do_raw_spin_unlock+0xf5/0x200
[ 97.978556][ T5838] ? register_lock_class+0x31/0x2e0
[ 97.978588][ T5838] ? __pfx_hub_event+0x10/0x10
[ 97.978615][ T5838] ? rcu_is_watching+0x16/0xb0
[ 97.978638][ T5838] ? process_scheduled_works+0x97a/0x1630
[ 97.978661][ T5838] process_scheduled_works+0xc3d/0x1630
[ 97.978695][ T5838] ? __pfx_process_scheduled_works+0x10/0x10
[ 97.978722][ T5838] ? assign_work+0x3cf/0x5d0
[ 97.978745][ T5838] worker_thread+0xa47/0xfb0
[ 97.978774][ T5838] ? __kthread_parkme+0x71/0x1f0
[ 97.978802][ T5838] kthread+0x38b/0x480
[ 97.978819][ T5838] ? __pfx_worker_thread+0x10/0x10
[ 97.978842][ T5838] ? __pfx_kthread+0x10/0x10
[ 97.978867][ T5838] ret_from_fork+0x514/0xb70
[ 97.978889][ T5838] ? __pfx_ret_from_fork+0x10/0x10
[ 97.978905][ T5838] ? __switch_to+0xc89/0x1420
[ 97.978929][ T5838] ? __pfx_kthread+0x10/0x10
[ 97.978947][ T5838] ret_from_fork_asm+0x1a/0x30
[ 97.978971][ T5838]
[ 97.978977][ T5838]
[ 97.978982][ T5838] Allocated by task 5838:
[ 97.978990][ T5838] kasan_save_track+0x3e/0x80
[ 97.979012][ T5838] __kasan_kmalloc+0x93/0xb0
[ 97.979031][ T5838] __kmalloc_cache_noprof+0x321/0x600
[ 97.979049][ T5838] usb_set_configuration+0x3c5/0x2260
[ 97.979072][ T5838] usb_generic_driver_probe+0x8d/0x150
[ 97.979095][ T5838] usb_probe_device+0x1c3/0x3b0
[ 97.979109][ T5838] really_probe+0x254/0xae0
[ 97.979132][ T5838] __driver_probe_device+0x1e8/0x360
[ 97.979153][ T5838] driver_probe_device+0x4f/0x240
[ 97.979175][ T5838] __device_attach_driver+0x270/0x410
[ 97.979196][ T5838] bus_for_each_drv+0x258/0x2f0
[ 97.979213][ T5838] __device_attach+0x2c4/0x450
[ 97.979234][ T5838] device_initial_probe+0xa1/0xd0
[ 97.979257][ T5838] bus_probe_device+0x12a/0x220
[ 97.979273][ T5838] device_add+0x7d7/0xb80
[ 97.979292][ T5838] usb_new_device+0x9aa/0x1690
[ 97.979311][ T5838] hub_event+0x28e8/0x4d30
[ 97.979338][ T5838] process_scheduled_works+0xc3d/0x1630
[ 97.979360][ T5838] worker_thread+0xa47/0xfb0
[ 97.979381][ T5838] kthread+0x38b/0x480
[ 97.979397][ T5838] ret_from_fork+0x514/0xb70
[ 97.979412][ T5838] ret_from_fork_asm+0x1a/0x30
[ 97.979426][ T5838]
[ 97.979431][ T5838] Freed by task 5838:
[ 97.979440][ T5838] kasan_save_track+0x3e/0x80
[ 97.979459][ T5838] kasan_save_free_info+0x40/0x50
[ 97.979475][ T5838] __kasan_slab_free+0x5c/0x80
[ 97.979495][ T5838] kfree+0x1c5/0x650
[ 97.979510][ T5838] device_release+0xc4/0x1f0
[ 97.979525][ T5838] kobject_put+0x222/0x550
[ 97.979546][ T5838] v4l2_device_disconnect+0x79/0xd0
[ 97.979564][ T5838] usbtv_video_free+0x25/0x30
[ 97.979579][ T5838] usbtv_disconnect+0x5c/0xa0
[ 97.979595][ T5838] usb_unbind_interface+0x295/0x9f0
[ 97.979620][ T5838] device_release_driver_internal+0x4f5/0x880
[ 97.979645][ T5838] bus_remove_device+0x444/0x560
[ 97.979662][ T5838] device_del+0x524/0x8f0
[ 97.979681][ T5838] usb_disable_device+0x3d4/0x8d0
[ 97.979701][ T5838] usb_disconnect+0x346/0x9a0
[ 97.979720][ T5838] hub_event+0x1bbb/0x4d30
[ 97.979741][ T5838] process_scheduled_works+0xc3d/0x1630
[ 97.979763][ T5838] worker_thread+0xa47/0xfb0
[ 97.979783][ T5838] kthread+0x38b/0x480
[ 97.979798][ T5838] ret_from_fork+0x514/0xb70
[ 97.979812][ T5838] ret_from_fork_asm+0x1a/0x30
[ 97.979826][ T5838]
[ 97.979830][ T5838] The buggy address belongs to the object at ffff8880798ff000
[ 97.979830][ T5838] which belongs to the cache kmalloc-2k of size 2048
[ 97.979846][ T5838] The buggy address is located 8 bytes inside of
[ 97.979846][ T5838] freed 2048-byte region [ffff8880798ff000, ffff8880798ff800)
[ 97.979873][ T5838]
[ 97.979878][ T5838] The buggy address belongs to the physical page:
[ 97.979887][ T5838] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x798f8
[ 97.979905][ T5838] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 97.979919][ T5838] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 97.979935][ T5838] page_type: f5(slab)
[ 97.979952][ T5838] raw: 00fff00000000040 ffff88801c042000 dead000000000100 dead000000000122
[ 97.979968][ T5838] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 97.979984][ T5838] head: 00fff00000000040 ffff88801c042000 dead000000000100 dead000000000122
[ 97.979997][ T5838] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 97.980012][ T5838] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 97.980026][ T5838] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 97.980034][ T5838] page dumped because: kasan: bad access detected
[ 97.980042][ T5838] page_owner tracks the page as allocated
[ 97.980049][ T5838] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4077, tgid 4077 (kworker/u8:8), ts 96989680203
[ 97.980077][ T5838] post_alloc_hook+0x1f9/0x250
[ 97.980095][ T5838] get_page_from_freelist+0x2209/0x2280
[ 97.980115][ T5838] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 97.980136][ T5838] allocate_slab+0x7d/0x620
[ 97.980159][ T5838] refill_objects+0x2d5/0x350
[ 97.980183][ T5838] __pcs_replace_empty_main+0x2c8/0x6c0
[ 97.980206][ T5838] __kmalloc_node_track_caller_noprof+0x548/0x720
[ 97.980226][ T5838] __alloc_skb+0x2c1/0x7a0
[ 97.980250][ T5838] mld_newpack+0x165/0xcb0
[ 97.980266][ T5838] add_grec+0x119f/0x19d0
[ 97.980280][ T5838] mld_send_initial_cr+0x288/0x550
[ 97.980303][ T5838] ipv6_mc_dad_complete+0x87/0x410
[ 97.980326][ T5838] addrconf_dad_completed+0x8af/0xe60
[ 97.980351][ T5838] addrconf_dad_work+0xcf8/0x15c0
[ 97.980373][ T5838] process_scheduled_works+0xc3d/0x1630
[ 97.980395][ T5838] worker_thread+0xa47/0xfb0
[ 97.980417][ T5838] page last free pid 10 tgid 10 ts 96916362282 stack trace:
[ 97.980430][ T5838] __free_frozen_pages+0xc93/0xd90
[ 97.980447][ T5838] __slab_free+0x274/0x2c0
[ 97.980465][ T5838] qlist_free_all+0x99/0x100
[ 97.980482][ T5838] kasan_quarantine_reduce+0x148/0x160
[ 97.980501][ T5838] __kasan_slab_alloc+0x22/0x80
[ 97.980522][ T5838] __kmalloc_cache_noprof+0x29f/0x600
[ 97.980540][ T5838] nsim_fib_event+0xf37/0xa3a0
[ 97.980559][ T5838] nsim_fib_event_work+0x244/0x3b0
[ 97.980576][ T5838] process_scheduled_works+0xc3d/0x1630
[ 97.980595][ T5838] worker_thread+0xa47/0xfb0
[ 97.980617][ T5838] kthread+0x38b/0x480
[ 97.980631][ T5838] ret_from_fork+0x514/0xb70
[ 97.980645][ T5838] ret_from_fork_asm+0x1a/0x30
[ 97.980659][ T5838]
[ 97.980664][ T5838] Memory state around the buggy address:
[ 97.980673][ T5838] ffff8880798fef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 97.980683][ T5838] ffff8880798fef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 97.980694][ T5838] >ffff8880798ff000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 97.980703][ T5838] ^
[ 97.980712][ T5838] ffff8880798ff080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 97.980724][ T5838] ffff8880798ff100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 97.980733][ T5838] ==================================================================
[ 98.000935][ T5838] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 98.838545][ T5838] CPU: 0 UID: 0 PID: 5838 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full)
[ 98.847917][ T5838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[ 98.858062][ T5838] Workqueue: usb_hub_wq hub_event
[ 98.863125][ T5838] Call Trace:
[ 98.866403][ T5838]
[ 98.869337][ T5838] vpanic+0x56d/0xa60
[ 98.873329][ T5838] ? rcu_is_watching+0x16/0xb0
[ 98.878265][ T5838] ? __pfx_vpanic+0x10/0x10
[ 98.882803][ T5838] ? __pfx___schedule+0x10/0x10
[ 98.887662][ T5838] panic+0xc5/0xd0
[ 98.891409][ T5838] ? __pfx_panic+0x10/0x10
[ 98.895843][ T5838] ? preempt_schedule_thunk+0x16/0x40
[ 98.901248][ T5838] ? usb_unbind_interface+0x2c2/0x9f0
[ 98.906646][ T5838] check_panic_on_warn+0x89/0xb0
[ 98.911589][ T5838] ? usb_unbind_interface+0x2c2/0x9f0
[ 98.916968][ T5838] end_report+0x73/0x170
[ 98.921228][ T5838] ? usb_unbind_interface+0x2c2/0x9f0
[ 98.926612][ T5838] kasan_report+0x128/0x150
[ 98.931123][ T5838] ? usb_unbind_interface+0x2c2/0x9f0
[ 98.936505][ T5838] usb_unbind_interface+0x2c2/0x9f0
[ 98.941742][ T5838] ? kernfs_remove_by_name_ns+0x101/0x140
[ 98.947495][ T5838] ? kernfs_remove_by_name_ns+0x101/0x140
[ 98.953234][ T5838] ? __pfx_usb_unbind_interface+0x10/0x10
[ 98.958995][ T5838] device_release_driver_internal+0x4f5/0x880
[ 98.965078][ T5838] bus_remove_device+0x444/0x560
[ 98.970023][ T5838] ? __pfx_bus_remove_device+0x10/0x10
[ 98.975486][ T5838] ? kernfs_remove_by_name_ns+0x101/0x140
[ 98.981213][ T5838] device_del+0x524/0x8f0
[ 98.985552][ T5838] ? __pfx_device_del+0x10/0x10
[ 98.990408][ T5838] ? __pfx___mutex_lock+0x10/0x10
[ 98.995437][ T5838] usb_disable_device+0x3d4/0x8d0
[ 99.000471][ T5838] usb_disconnect+0x346/0x9a0
[ 99.005162][ T5838] hub_event+0x1bbb/0x4d30
[ 99.009589][ T5838] ? do_raw_spin_unlock+0xf5/0x200
[ 99.014715][ T5838] ? register_lock_class+0x31/0x2e0
[ 99.019950][ T5838] ? __pfx_hub_event+0x10/0x10
[ 99.024725][ T5838] ? rcu_is_watching+0x16/0xb0
[ 99.029497][ T5838] ? process_scheduled_works+0x97a/0x1630
[ 99.035240][ T5838] process_scheduled_works+0xc3d/0x1630
[ 99.040810][ T5838] ? __pfx_process_scheduled_works+0x10/0x10
[ 99.046796][ T5838] ? assign_work+0x3cf/0x5d0
[ 99.051398][ T5838] worker_thread+0xa47/0xfb0
[ 99.056001][ T5838] ? __kthread_parkme+0x71/0x1f0
[ 99.060968][ T5838] kthread+0x38b/0x480
[ 99.065053][ T5838] ? __pfx_worker_thread+0x10/0x10
[ 99.070183][ T5838] ? __pfx_kthread+0x10/0x10
[ 99.074811][ T5838] ret_from_fork+0x514/0xb70
[ 99.079459][ T5838] ? __pfx_ret_from_fork+0x10/0x10
[ 99.084584][ T5838] ? __switch_to+0xc89/0x1420
[ 99.089270][ T5838] ? __pfx_kthread+0x10/0x10
[ 99.093886][ T5838] ret_from_fork_asm+0x1a/0x30
[ 99.098660][ T5838]
[ 99.101812][ T5838] Kernel Offset: disabled
[ 99.106129][ T5838] Rebooting in 86400 seconds..