no interfaces have a carrier
[ 68.790021][ T5249] 8021q: adding VLAN 0 to HW filter on device bond0
[ 68.822110][ T5249] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting crond: OK
Starting sshd: OK
syzkaller
syzkaller login: [ 92.608844][ T198] cfg80211: failed to load regulatory.db
Warning: Permanently added '10.128.0.25' (ED25519) to the list of known hosts.
2026/08/17 05:21:21 parsed 1 programs
2026/08/17 05:21:21 serving rpc on tcp://36047
[ 102.987992][ T5602] cgroup: Unknown subsys name 'net'
[ 103.240602][ T5602] cgroup: Unknown subsys name 'cpuset'
[ 103.283510][ T5602] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 105.256959][ T5602] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 109.032362][ T5615] bridge0: port 1(bridge_slave_0) entered blocking state
[ 109.033223][ T5615] bridge0: port 1(bridge_slave_0) entered disabled state
[ 109.033384][ T5615] bridge_slave_0: entered allmulticast mode
[ 109.045219][ T5615] bridge_slave_0: entered promiscuous mode
[ 109.068238][ T5615] bridge0: port 2(bridge_slave_1) entered blocking state
[ 109.068385][ T5615] bridge0: port 2(bridge_slave_1) entered disabled state
[ 109.068514][ T5615] bridge_slave_1: entered allmulticast mode
[ 109.070726][ T5615] bridge_slave_1: entered promiscuous mode
[ 109.126446][ T5615] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 109.130450][ T5615] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 109.181085][ T5615] team0: Port device team_slave_0 added
[ 109.190138][ T5615] team0: Port device team_slave_1 added
[ 109.225736][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 109.225750][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 109.225768][ T5615] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 109.228159][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 109.228175][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 109.228195][ T5615] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 109.359299][ T5615] hsr_slave_0: entered promiscuous mode
[ 109.360392][ T5615] hsr_slave_1: entered promiscuous mode
[ 109.615863][ T5615] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 109.647488][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 109.650281][ T5615] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 109.679097][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 109.681937][ T5615] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 109.717067][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 109.720099][ T5615] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 109.741678][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 109.803848][ T5615] bridge0: port 2(bridge_slave_1) entered blocking state
[ 109.803990][ T5615] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 109.804747][ T5615] bridge0: port 1(bridge_slave_0) entered blocking state
[ 109.804854][ T5615] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 109.908343][ T3349] bridge0: port 1(bridge_slave_0) entered disabled state
[ 109.923259][ T3349] bridge0: port 2(bridge_slave_1) entered disabled state
[ 110.112111][ T5615] 8021q: adding VLAN 0 to HW filter on device bond0
[ 110.152731][ T5615] 8021q: adding VLAN 0 to HW filter on device team0
[ 110.169093][ T3349] bridge0: port 1(bridge_slave_0) entered blocking state
[ 110.169348][ T3349] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 110.197527][ T3349] bridge0: port 2(bridge_slave_1) entered blocking state
[ 110.199426][ T3349] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 110.679600][ T5615] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 110.755227][ T5615] veth0_vlan: entered promiscuous mode
[ 110.771183][ T5615] veth1_vlan: entered promiscuous mode
[ 110.822780][ T5615] veth0_macvtap: entered promiscuous mode
[ 110.834586][ T5615] veth1_macvtap: entered promiscuous mode
[ 110.861777][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 110.886659][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 111.157213][ T3349] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 111.157831][ T3349] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 111.157872][ T3349] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 111.157908][ T3349] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 111.971022][ T3349] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 112.446452][ T3349] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 113.116537][ T3349] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 113.432556][ T3349] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 114.359947][ T3349] bridge_slave_1: left allmulticast mode
[ 114.360069][ T3349] bridge_slave_1: left promiscuous mode
[ 114.379139][ T3349] bridge0: port 2(bridge_slave_1) entered disabled state
[ 114.588180][ T3349] bridge_slave_0: left allmulticast mode
[ 114.588223][ T3349] bridge_slave_0: left promiscuous mode
[ 114.588477][ T3349] bridge0: port 1(bridge_slave_0) entered disabled state
[ 115.433840][ T3349] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 115.503588][ T3349] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 115.525970][ T3349] bond0 (unregistering): Released all slaves
[ 115.569201][ T5249] 8021q: adding VLAN 0 to HW filter on device eth1
[ 116.056420][ T3349] hsr_slave_0: left promiscuous mode
[ 116.113092][ T3349] hsr_slave_1: left promiscuous mode
[ 116.116153][ T3349] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 116.116216][ T3349] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 116.165936][ T3349] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 116.165963][ T3349] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 116.388351][ T3349] veth1_macvtap: left promiscuous mode
[ 116.388587][ T3349] veth0_macvtap: left promiscuous mode
[ 116.388873][ T3349] veth1_vlan: left promiscuous mode
[ 116.424918][ T3349] veth0_vlan: left promiscuous mode
[ 117.133682][ T3349] team0 (unregistering): Port device team_slave_1 removed
[ 117.193828][ T3349] team0 (unregistering): Port device team_slave_0 removed
[ 117.405284][ T5249] 8021q: adding VLAN 0 to HW filter on device eth2
[ 118.268451][ T5249] 8021q: adding VLAN 0 to HW filter on device eth3
[ 118.745377][ T4903] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 118.768366][ T4903] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 118.769918][ T4903] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 118.803049][ T4903] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 118.805934][ T4903] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 119.022208][ T5249] 8021q: adding VLAN 0 to HW filter on device eth4
[ 121.408143][ T55] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 121.408171][ T55] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 121.505034][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 121.505057][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
2026/08/17 05:21:44 executed programs: 0
[ 122.598579][ T4903] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 122.620798][ T4903] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 122.622135][ T4903] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 122.639168][ T4903] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 122.651413][ T4903] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 123.888071][ T5791] bridge0: port 1(bridge_slave_0) entered blocking state
[ 123.888226][ T5791] bridge0: port 1(bridge_slave_0) entered disabled state
[ 123.888338][ T5791] bridge_slave_0: entered allmulticast mode
[ 123.890249][ T5791] bridge_slave_0: entered promiscuous mode
[ 123.892612][ T5791] bridge0: port 2(bridge_slave_1) entered blocking state
[ 123.892760][ T5791] bridge0: port 2(bridge_slave_1) entered disabled state
[ 123.896121][ T5791] bridge_slave_1: entered allmulticast mode
[ 123.915093][ T5791] bridge_slave_1: entered promiscuous mode
[ 123.982316][ T5791] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 123.992798][ T5791] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 124.053736][ T5791] team0: Port device team_slave_0 added
[ 124.056347][ T5791] team0: Port device team_slave_1 added
[ 124.106425][ T5791] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 124.106444][ T5791] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 124.106462][ T5791] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 124.108247][ T5791] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 124.108257][ T5791] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 124.108275][ T5791] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 124.264192][ T5791] hsr_slave_0: entered promiscuous mode
[ 124.265171][ T5791] hsr_slave_1: entered promiscuous mode
[ 124.754576][ T59] Bluetooth: hci0: command tx timeout
[ 126.823027][ T59] Bluetooth: hci0: command tx timeout
[ 127.109404][ T5791] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 127.147799][ T5791] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 127.150293][ T5791] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 127.192122][ T5791] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 127.198004][ T5791] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 127.260684][ T5791] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 127.274968][ T5791] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 127.320644][ T5791] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 127.756463][ T5791] 8021q: adding VLAN 0 to HW filter on device bond0
[ 127.827822][ T5791] 8021q: adding VLAN 0 to HW filter on device team0
[ 127.853507][ T3349] bridge0: port 1(bridge_slave_0) entered blocking state
[ 127.853646][ T3349] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 127.917704][ T3349] bridge0: port 2(bridge_slave_1) entered blocking state
[ 127.917859][ T3349] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 128.739659][ T5791] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 128.903058][ T59] Bluetooth: hci0: command tx timeout
[ 128.911781][ T5791] veth0_vlan: entered promiscuous mode
[ 128.964803][ T5791] veth1_vlan: entered promiscuous mode
[ 129.041401][ T5791] veth0_macvtap: entered promiscuous mode
[ 129.054522][ T5791] veth1_macvtap: entered promiscuous mode
[ 129.107130][ T5791] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 129.165377][ T5791] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 129.554375][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 129.562331][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 129.562375][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 129.562406][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 129.830206][ T1178] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 129.830226][ T1178] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 130.068485][ T3387] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 130.068510][ T3387] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
2026/08/17 05:21:52 executed programs: 2
[ 130.683306][ T1901] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 130.854814][ T1901] usb 1-1: Using ep0 maxpacket: 16
[ 130.857094][ T1901] usb 1-1: New USB device found, idVendor=2040, idProduct=0265, bcdDevice=4e.d1
[ 130.870621][ T1901] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83
[ 130.870706][ T1901] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 56, changing to 7
[ 130.870772][ T1901] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 57832, setting to 1024
[ 130.905578][ T1901] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 130.911199][ T1901] usb 1-1: Product: syz
[ 130.911252][ T1901] usb 1-1: Manufacturer: syz
[ 130.911293][ T1901] usb 1-1: SerialNumber: syz
[ 130.958101][ T1901] usb 1-1: config 0 descriptor??
[ 130.992958][ T59] Bluetooth: hci0: command tx timeout
[ 131.028858][ T1901] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0265, interface 0, class 0)
[ 131.028940][ T1901] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class)
[ 131.297827][ T1901] em28xx 1-1:0.0: unknown em28xx chip ID (0)
[ 131.298362][ T1901] em28xx 1-1:0.0: Config register raw data: 0xfffffffb
[ 131.298746][ T1901] em28xx 1-1:0.0: AC97 chip type couldn't be determined
[ 131.298767][ T1901] em28xx 1-1:0.0: No AC97 audio processor
[ 131.298847][ T1901] em28xx 1-1:0.0: We currently don't support analog TV or stream capture on dual tuners.
[ 131.355382][ T1901] em28xx 1-1:0.0: unknown em28xx chip ID (0)
[ 131.357290][ T1901] em28xx 1-1:0.0: Config register raw data: 0xfffffffb
[ 131.357631][ T1901] em28xx 1-1:0.0: AC97 chip type couldn't be determined
[ 131.357642][ T1901] em28xx 1-1:0.0: No AC97 audio processor
[ 131.619245][ T1901] usb 1-1: USB disconnect, device number 2
[ 131.658607][ T1901] em28xx 1-1:0.0: Disconnecting em28xx #1
[ 131.658630][ T1901] em28xx 1-1:0.0: Disconnecting em28xx
[ 131.687694][ T1901] em28xx 1-1:0.0: Freeing device
[ 131.687772][ T1901] em28xx 1-1:0.0: Freeing device
[ 132.149852][ T1901] usb 1-1: new high-speed USB device number 3 using dummy_hcd
[ 132.303073][ T1901] usb 1-1: Using ep0 maxpacket: 16
[ 132.305620][ T1901] usb 1-1: New USB device found, idVendor=2040, idProduct=0265, bcdDevice=4e.d1
[ 132.309953][ T1901] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83
[ 132.309994][ T1901] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 56, changing to 7
[ 132.310013][ T1901] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 57832, setting to 1024
[ 132.367129][ T1901] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 132.367151][ T1901] usb 1-1: Product: syz
[ 132.367161][ T1901] usb 1-1: Manufacturer: syz
[ 132.367172][ T1901] usb 1-1: SerialNumber: syz
[ 132.403789][ T1901] usb 1-1: config 0 descriptor??
[ 132.447052][ T1901] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0265, interface 0, class 0)
[ 132.447090][ T1901] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class)
[ 132.673526][ T1901] em28xx 1-1:0.0: unknown em28xx chip ID (0)
[ 132.673981][ T1901] em28xx 1-1:0.0: Config register raw data: 0xfffffffb
[ 132.674364][ T1901] em28xx 1-1:0.0: AC97 chip type couldn't be determined
[ 132.674376][ T1901] em28xx 1-1:0.0: No AC97 audio processor
[ 132.674404][ T1901] ==================================================================
[ 132.674452][ T1901] BUG: KASAN: slab-use-after-free in __list_add_valid_or_report+0x6a/0x130
[ 132.674506][ T1901] Read of size 8 at addr ffff888036270290 by task kworker/0:3/1901
[ 132.674525][ T1901]
[ 132.674546][ T1901] CPU: 0 UID: 0 PID: 1901 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
[ 132.674567][ T1901] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 132.674579][ T1901] Workqueue: usb_hub_wq hub_event
[ 132.674608][ T1901] Call Trace:
[ 132.674615][ T1901]
[ 132.674623][ T1901] dump_stack_lvl+0xe8/0x150
[ 132.674651][ T1901] print_address_description+0x55/0x1e0
[ 132.674674][ T1901] ? __list_add_valid_or_report+0x6a/0x130
[ 132.674698][ T1901] print_report+0x58/0x70
[ 132.674718][ T1901] kasan_report+0x117/0x150
[ 132.674736][ T1901] ? __list_add_valid_or_report+0x6a/0x130
[ 132.674764][ T1901] __list_add_valid_or_report+0x6a/0x130
[ 132.674790][ T1901] em28xx_init_extension+0x56/0x1d0
[ 132.674814][ T1901] ? media_device_init+0x2ed/0x530
[ 132.674839][ T1901] em28xx_init_dev+0x9f6/0x2210
[ 132.674863][ T1901] ? _dev_info+0x11e/0x180
[ 132.674887][ T1901] ? __pfx_em28xx_init_dev+0x10/0x10
[ 132.674910][ T1901] ? __pfx__dev_info+0x10/0x10
[ 132.674939][ T1901] em28xx_usb_probe+0x17b2/0x2dd0
[ 132.674973][ T1901] usb_probe_interface+0x653/0xc60
[ 132.674995][ T1901] ? __pfx_usb_probe_interface+0x10/0x10
[ 132.675014][ T1901] really_probe+0x254/0xae0
[ 132.675039][ T1901] __driver_probe_device+0x1e8/0x360
[ 132.675061][ T1901] driver_probe_device+0x4f/0x240
[ 132.675084][ T1901] __device_attach_driver+0x270/0x410
[ 132.675107][ T1901] bus_for_each_drv+0x25b/0x2f0
[ 132.675123][ T1901] ? __pfx___device_attach_driver+0x10/0x10
[ 132.675145][ T1901] ? __pfx_bus_for_each_drv+0x10/0x10
[ 132.675160][ T1901] ? rt_spin_unlock+0x163/0x200
[ 132.675178][ T1901] __device_attach+0x2c7/0x450
[ 132.675197][ T1901] ? rt_spin_unlock+0x157/0x200
[ 132.675211][ T1901] ? __pfx___device_attach+0x10/0x10
[ 132.675235][ T1901] device_initial_probe+0xa1/0xd0
[ 132.675256][ T1901] bus_probe_device+0x12d/0x220
[ 132.675272][ T1901] device_add+0x7d7/0xb80
[ 132.675291][ T1901] usb_set_configuration+0x1ad8/0x2180
[ 132.675319][ T1901] usb_generic_driver_probe+0x8d/0x150
[ 132.675337][ T1901] usb_probe_device+0x1c3/0x3b0
[ 132.675355][ T1901] ? __pfx_usb_probe_device+0x10/0x10
[ 132.675372][ T1901] really_probe+0x254/0xae0
[ 132.675395][ T1901] __driver_probe_device+0x1e8/0x360
[ 132.675418][ T1901] driver_probe_device+0x4f/0x240
[ 132.675440][ T1901] __device_attach_driver+0x270/0x410
[ 132.675463][ T1901] bus_for_each_drv+0x25b/0x2f0
[ 132.675478][ T1901] ? __pfx___device_attach_driver+0x10/0x10
[ 132.675499][ T1901] ? __pfx_bus_for_each_drv+0x10/0x10
[ 132.675539][ T1901] ? rt_spin_unlock+0x163/0x200
[ 132.675556][ T1901] __device_attach+0x2c7/0x450
[ 132.675576][ T1901] ? __pfx___device_attach+0x10/0x10
[ 132.675601][ T1901] device_initial_probe+0xa1/0xd0
[ 132.675622][ T1901] bus_probe_device+0x12d/0x220
[ 132.675638][ T1901] device_add+0x7d7/0xb80
[ 132.675656][ T1901] usb_new_device+0x99a/0x1680
[ 132.675679][ T1901] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 132.675701][ T1901] ? __pfx_usb_new_device+0x10/0x10
[ 132.675728][ T1901] hub_event+0x28cf/0x4cf0
[ 132.675742][ T1901] ? lock_acquire+0x106/0x350
[ 132.675775][ T1901] ? __pfx_hub_event+0x10/0x10
[ 132.675790][ T1901] ? process_scheduled_works+0xa20/0x14e0
[ 132.675810][ T1901] ? rcu_is_watching+0x15/0xb0
[ 132.675829][ T1901] ? process_scheduled_works+0xa20/0x14e0
[ 132.675846][ T1901] process_scheduled_works+0xa8e/0x14e0
[ 132.675873][ T1901] ? __pfx_process_scheduled_works+0x10/0x10
[ 132.675892][ T1901] ? assign_work+0x3cf/0x5d0
[ 132.675910][ T1901] worker_thread+0xa47/0xfb0
[ 132.675933][ T1901] ? __kthread_parkme+0x71/0x1f0
[ 132.675955][ T1901] kthread+0x388/0x470
[ 132.675977][ T1901] ? __pfx_worker_thread+0x10/0x10
[ 132.675994][ T1901] ? __pfx_kthread+0x10/0x10
[ 132.676017][ T1901] ret_from_fork+0x514/0xb70
[ 132.676042][ T1901] ? __pfx_ret_from_fork+0x10/0x10
[ 132.676064][ T1901] ? __switch_to+0xc89/0x1420
[ 132.676084][ T1901] ? __pfx_kthread+0x10/0x10
[ 132.676106][ T1901] ret_from_fork_asm+0x1a/0x30
[ 132.676136][ T1901]
[ 132.676141][ T1901]
[ 132.676144][ T1901] Allocated by task 5949:
[ 132.676153][ T1901] kasan_save_track+0x3e/0x80
[ 132.676177][ T1901] __kasan_slab_alloc+0x6c/0x80
[ 132.676189][ T1901] kmem_cache_alloc_node_noprof+0x3eb/0x670
[ 132.676213][ T1901] __alloc_skb+0x276/0x7a0
[ 132.676228][ T1901] netlink_sendmsg+0x5d4/0xb40
[ 132.676246][ T1901] sock_sendmsg_nosec+0x13a/0x180
[ 132.676268][ T1901] ____sys_sendmsg+0x565/0x870
[ 132.676285][ T1901] ___sys_sendmsg+0x2a5/0x360
[ 132.676302][ T1901] __x64_sys_sendmsg+0x1b7/0x290
[ 132.676319][ T1901] do_syscall_64+0x174/0x580
[ 132.676336][ T1901] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 132.676351][ T1901]
[ 132.676354][ T1901] Freed by task 5949:
[ 132.676360][ T1901] kasan_save_track+0x3e/0x80
[ 132.676382][ T1901] kasan_save_free_info+0x40/0x50
[ 132.676401][ T1901] __kasan_slab_free+0x5c/0x80
[ 132.676414][ T1901] kfree+0x1c5/0x6c0
[ 132.676433][ T1901] skb_release_data+0x85e/0xab0
[ 132.676450][ T1901] __kfree_skb+0x5d/0x210
[ 132.676464][ T1901] netlink_unicast+0x7fd/0x990
[ 132.676479][ T1901] netlink_sendmsg+0x813/0xb40
[ 132.676496][ T1901] sock_sendmsg_nosec+0x13a/0x180
[ 132.676523][ T1901] ____sys_sendmsg+0x565/0x870
[ 132.676539][ T1901] ___sys_sendmsg+0x2a5/0x360
[ 132.676556][ T1901] __x64_sys_sendmsg+0x1b7/0x290
[ 132.676573][ T1901] do_syscall_64+0x174/0x580
[ 132.676590][ T1901] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 132.676604][ T1901]
[ 132.676607][ T1901] The buggy address belongs to the object at ffff888036270000
[ 132.676607][ T1901] which belongs to the cache skbuff_small_head of size 704
[ 132.676620][ T1901] The buggy address is located 656 bytes inside of
[ 132.676620][ T1901] freed 704-byte region [ffff888036270000, ffff8880362702c0)
[ 132.676635][ T1901]
[ 132.676639][ T1901] The buggy address belongs to the physical page:
[ 132.676665][ T1901] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36270
[ 132.676679][ T1901] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 132.676692][ T1901] flags: 0x80000000000040(head|node=0|zone=1)
[ 132.676708][ T1901] page_type: f5(slab)
[ 132.676722][ T1901] raw: 0080000000000040 ffff888140ab8b40 dead000000000100 dead000000000122
[ 132.676736][ T1901] raw: 0000000000000000 0000000800130013 00000000f5000000 0000000000000000
[ 132.676751][ T1901] head: 0080000000000040 ffff888140ab8b40 dead000000000100 dead000000000122
[ 132.676764][ T1901] head: 0000000000000000 0000000800130013 00000000f5000000 0000000000000000
[ 132.676778][ T1901] head: 0080000000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff
[ 132.676790][ T1901] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000004
[ 132.676798][ T1901] page dumped because: kasan: bad access detected
[ 132.676809][ T1901] page_owner tracks the page as allocated
[ 132.676814][ T1901] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 16, tgid 16 (ktimers/0), ts 131725674181, free_ts 131687710812
[ 132.676840][ T1901] post_alloc_hook+0x1f9/0x250
[ 132.676863][ T1901] get_page_from_freelist+0x262a/0x26a0
[ 132.676878][ T1901] __alloc_frozen_pages_noprof+0x18d/0x380
[ 132.676894][ T1901] allocate_slab+0x79/0x5e0
[ 132.676912][ T1901] refill_objects+0x2d8/0x350
[ 132.676931][ T1901] __pcs_replace_empty_main+0x330/0x690
[ 132.676949][ T1901] kmem_cache_alloc_node_noprof+0x4dc/0x670
[ 132.676972][ T1901] __alloc_skb+0x276/0x7a0
[ 132.676986][ T1901] skb_copy+0x19d/0x870
[ 132.677004][ T1901] mac80211_hwsim_tx_frame_no_nl+0xfab/0x1760
[ 132.677031][ T1901] mac80211_hwsim_tx_frame+0x199/0x1f0
[ 132.677054][ T1901] mac80211_hwsim_beacon_tx+0x396/0x820
[ 132.677073][ T1901] __iterate_interfaces+0x2af/0x5a0
[ 132.677087][ T1901] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180
[ 132.677102][ T1901] mac80211_hwsim_beacon+0xb2/0x2b0
[ 132.677116][ T1901] __hrtimer_run_queues+0x3eb/0xaf0
[ 132.677136][ T1901] page last free pid 1901 tgid 1901 stack trace:
[ 132.677144][ T1901] __free_frozen_pages+0x10e7/0x11c0
[ 132.677167][ T1901] em28xx_usb_disconnect+0x27f/0x2f0
[ 132.677189][ T1901] usb_unbind_interface+0x295/0x9f0
[ 132.677204][ T1901] device_release_driver_internal+0x4f5/0x880
[ 132.677225][ T1901] bus_remove_device+0x449/0x560
[ 132.677238][ T1901] device_del+0x528/0x8f0
[ 132.677255][ T1901] usb_disable_device+0x3d4/0x8d0
[ 132.677268][ T1901] usb_disconnect+0x32d/0x990
[ 132.677291][ T1901] hub_event+0x1bb7/0x4cf0
[ 132.677304][ T1901] process_scheduled_works+0xa8e/0x14e0
[ 132.677320][ T1901] worker_thread+0xa47/0xfb0
[ 132.677335][ T1901] kthread+0x388/0x470
[ 132.677354][ T1901] ret_from_fork+0x514/0xb70
[ 132.677375][ T1901] ret_from_fork_asm+0x1a/0x30
[ 132.677397][ T1901]
[ 132.677400][ T1901] Memory state around the buggy address:
[ 132.677408][ T1901] ffff888036270180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 132.677419][ T1901] ffff888036270200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 132.677430][ T1901] >ffff888036270280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 132.677437][ T1901] ^
[ 132.677445][ T1901] ffff888036270300: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 132.677455][ T1901] ffff888036270380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 132.677463][ T1901] ==================================================================
[ 132.677606][ T1901] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 132.677623][ T1901] CPU: 0 UID: 0 PID: 1901 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
[ 132.677645][ T1901] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 132.677659][ T1901] Workqueue: usb_hub_wq hub_event
[ 132.677680][ T1901] Call Trace:
[ 132.677689][ T1901]
[ 132.677703][ T1901] vpanic+0x56c/0xa60
[ 132.677728][ T1901] ? rcu_is_watching+0x15/0xb0
[ 132.677746][ T1901] ? __pfx_vpanic+0x10/0x10
[ 132.677773][ T1901] panic+0xc5/0xd0
[ 132.677796][ T1901] ? __pfx_panic+0x10/0x10
[ 132.677820][ T1901] ? preempt_schedule_thunk+0x16/0x40
[ 132.677839][ T1901] ? __list_add_valid_or_report+0x6a/0x130
[ 132.677863][ T1901] ? preempt_schedule_thunk+0x16/0x40
[ 132.677880][ T1901] ? __list_add_valid_or_report+0x6a/0x130
[ 132.677904][ T1901] check_panic_on_warn+0x89/0xb0
[ 132.677945][ T1901] ? __list_add_valid_or_report+0x6a/0x130
[ 132.677978][ T1901] end_report+0x73/0x170
[ 132.678001][ T1901] ? __list_add_valid_or_report+0x6a/0x130
[ 132.678030][ T1901] kasan_report+0x128/0x150
[ 132.678050][ T1901] ? __list_add_valid_or_report+0x6a/0x130
[ 132.678085][ T1901] __list_add_valid_or_report+0x6a/0x130
[ 132.678117][ T1901] em28xx_init_extension+0x56/0x1d0
[ 132.678145][ T1901] ? media_device_init+0x2ed/0x530
[ 132.678177][ T1901] em28xx_init_dev+0x9f6/0x2210
[ 132.678207][ T1901] ? _dev_info+0x11e/0x180
[ 132.678237][ T1901] ? __pfx_em28xx_init_dev+0x10/0x10
[ 132.678267][ T1901] ? __pfx__dev_info+0x10/0x10
[ 132.678307][ T1901] em28xx_usb_probe+0x17b2/0x2dd0
[ 132.678351][ T1901] usb_probe_interface+0x653/0xc60
[ 132.678380][ T1901] ? __pfx_usb_probe_interface+0x10/0x10
[ 132.678405][ T1901] really_probe+0x254/0xae0
[ 132.678437][ T1901] __driver_probe_device+0x1e8/0x360
[ 132.678468][ T1901] driver_probe_device+0x4f/0x240
[ 132.678501][ T1901] __device_attach_driver+0x270/0x410
[ 132.678544][ T1901] bus_for_each_drv+0x25b/0x2f0
[ 132.678566][ T1901] ? __pfx___device_attach_driver+0x10/0x10
[ 132.678595][ T1901] ? __pfx_bus_for_each_drv+0x10/0x10
[ 132.678615][ T1901] ? rt_spin_unlock+0x163/0x200
[ 132.678639][ T1901] __device_attach+0x2c7/0x450
[ 132.678665][ T1901] ? rt_spin_unlock+0x157/0x200
[ 132.678686][ T1901] ? __pfx___device_attach+0x10/0x10
[ 132.678717][ T1901] device_initial_probe+0xa1/0xd0
[ 132.678745][ T1901] bus_probe_device+0x12d/0x220
[ 132.678769][ T1901] device_add+0x7d7/0xb80
[ 132.678796][ T1901] usb_set_configuration+0x1ad8/0x2180
[ 132.678832][ T1901] usb_generic_driver_probe+0x8d/0x150
[ 132.678857][ T1901] usb_probe_device+0x1c3/0x3b0
[ 132.678883][ T1901] ? __pfx_usb_probe_device+0x10/0x10
[ 132.678906][ T1901] really_probe+0x254/0xae0
[ 132.678937][ T1901] __driver_probe_device+0x1e8/0x360
[ 132.678966][ T1901] driver_probe_device+0x4f/0x240
[ 132.678998][ T1901] __device_attach_driver+0x270/0x410
[ 132.679031][ T1901] bus_for_each_drv+0x25b/0x2f0
[ 132.679054][ T1901] ? __pfx___device_attach_driver+0x10/0x10
[ 132.679084][ T1901] ? __pfx_bus_for_each_drv+0x10/0x10
[ 132.679105][ T1901] ? rt_spin_unlock+0x163/0x200
[ 132.679128][ T1901] __device_attach+0x2c7/0x450
[ 132.679154][ T1901] ? __pfx___device_attach+0x10/0x10
[ 132.679187][ T1901] device_initial_probe+0xa1/0xd0
[ 132.679215][ T1901] bus_probe_device+0x12d/0x220
[ 132.679238][ T1901] device_add+0x7d7/0xb80
[ 132.679263][ T1901] usb_new_device+0x99a/0x1680
[ 132.679292][ T1901] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 132.679323][ T1901] ? __pfx_usb_new_device+0x10/0x10
[ 132.679357][ T1901] hub_event+0x28cf/0x4cf0
[ 132.679377][ T1901] ? lock_acquire+0x106/0x350
[ 132.679421][ T1901] ? __pfx_hub_event+0x10/0x10
[ 132.679441][ T1901] ? process_scheduled_works+0xa20/0x14e0
[ 132.679468][ T1901] ? rcu_is_watching+0x15/0xb0
[ 132.679493][ T1901] ? process_scheduled_works+0xa20/0x14e0
[ 132.679525][ T1901] process_scheduled_works+0xa8e/0x14e0
[ 132.679563][ T1901] ? __pfx_process_scheduled_works+0x10/0x10
[ 132.679591][ T1901] ? assign_work+0x3cf/0x5d0
[ 132.679616][ T1901] worker_thread+0xa47/0xfb0
[ 132.679649][ T1901] ? __kthread_parkme+0x71/0x1f0
[ 132.679681][ T1901] kthread+0x388/0x470
[ 132.679711][ T1901] ? __pfx_worker_thread+0x10/0x10
[ 132.679735][ T1901] ? __pfx_kthread+0x10/0x10
[ 132.679765][ T1901] ret_from_fork+0x514/0xb70
[ 132.679796][ T1901] ? __pfx_ret_from_fork+0x10/0x10
[ 132.679827][ T1901] ? __switch_to+0xc89/0x1420
[ 132.679855][ T1901] ? __pfx_kthread+0x10/0x10
[ 132.679883][ T1901] ret_from_fork_asm+0x1a/0x30
[ 132.679926][ T1901]
[ 132.680554][ T1901] Kernel Offset: disabled