ci-upstream-kasan-gce/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci-upstream-kasan-gce/syz-executor2687174496 <...> Warning: Permanently added '10.128.0.64' (ED25519) to the list of known hosts. execve("ci-upstream-kasan-gce/syz-executor2687174496", ["ci-upstream-kasan-gce/syz-executor2687174496"], 0x7ffc8f0120a0 /* 10 vars */) = 0 brk(NULL) = 0x5555771fb000 brk(0x5555771fbd80) = 0x5555771fbd80 arch_prctl(ARCH_SET_FS, 0x5555771fb400) = 0 set_tid_address(0x5555771fb6d0) = 5636 set_robust_list(0x5555771fb6e0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci-upstream-kasan-gce/syz-executor2687174496", 4096) = 50 getrandom("\x86\x1b\x33\x76\xf6\xb2\xe8\x3c", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555771fbd80 brk(0x55557721cd80) = 0x55557721cd80 brk(0x55557721d000) = 0x55557721d000 mprotect(0x7f839a958000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5637 attached [pid 5637] set_robust_list(0x5555771fb6e0, 24 [pid 5636] <... clone resumed>, child_tidptr=0x5555771fb6d0) = 5637 [pid 5637] <... set_robust_list resumed>) = 0 [pid 5637] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5637] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5637] setpgid(0, 0) = 0 [pid 5637] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5637] write(3, "1000", 4 [pid 5636] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5637] <... write resumed>) = 4 [pid 5637] close(3) = 0 [pid 5637] write(1, "executing program\n", 18) = 18 executing program [pid 5637] openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3 [pid 5637] ioctl(3, USB_RAW_IOCTL_INIT, 0x7ffe49c9b0c0) = 0 [pid 5637] ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 [pid 5637] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe49c9b0c0) = 0 [pid 5637] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe49c9b0c0) = 0 [pid 5637] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe49c9b0c0) = 0 [pid 5637] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe49c9b0c0) = 0 [pid 5637] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe49c9a0b0) = 18 [pid 5637] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe49c9b0c0) = 0 [ 74.625336][ T30] usb 1-1: new high-speed USB device number 2 using dummy_hcd [pid 5637] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe49c9b0c0) = 0 [pid 5637] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe49c9b0c0) = 0 [pid 5637] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe49c9a0b0) = 18 [pid 5637] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe49c9b0c0) = 0 [pid 5637] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe49c9a0b0) = 0 [pid 5637] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe49c9b0c0) = 0 [pid 5637] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe49c9a0b0) = 0 [pid 5637] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe49c9b0c0) = 0 [pid 5637] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe49c9a0b0) = 0 [pid 5637] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe49c9b0c0) = 0 [ 74.795171][ T30] usb 1-1: Using ep0 maxpacket: 32 [pid 5637] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe49c9a0b0) = 9 [pid 5637] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe49c9b0c0) = 0 [pid 5637] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe49c9a0b0) = 81 [pid 5637] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe49c9b0c0) = 0 [pid 5637] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe49c9a0b0) = 4 [ 74.823374][ T30] usb 1-1: unable to get BOS descriptor or descriptor too short [ 74.823508][ T30] usb 1-1: New USB device found, idVendor=1f71, idProduct=3306, bcdDevice=2a.c0 [ 74.853946][ T30] usb 1-1: config 3 has an invalid interface number: 223 but max is 1 [ 74.853971][ T30] usb 1-1: config 3 has an invalid interface number: 25 but max is 1 [pid 5637] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe49c9b0c0) = 0 [pid 5637] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe49c9a0b0) = 8 [pid 5637] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe49c9b0c0) = 0 [pid 5637] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe49c9a0b0) = 8 [pid 5637] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe49c9b0c0) = 0 [ 74.853985][ T30] usb 1-1: config 3 has an invalid interface number: 223 but max is 1 [ 74.853999][ T30] usb 1-1: config 3 has no interface number 0 [ 74.854011][ T30] usb 1-1: config 3 has no interface number 1 [ 74.854087][ T30] usb 1-1: config 3 interface 25 altsetting 6 has an invalid descriptor for endpoint zero, skipping [ 74.854104][ T30] usb 1-1: config 3 interface 25 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [pid 5637] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffe49c9a0b0) = 8 [pid 5637] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe49c9b0c0) = 0 [pid 5637] ioctl(3, USB_RAW_IOCTL_VBUS_DRAW, 0x5) = 0 [pid 5637] ioctl(3, USB_RAW_IOCTL_CONFIGURE, 0) = 0 [pid 5637] ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffe49c9a0b0) = 0 [ 74.854124][ T30] usb 1-1: too many endpoints for config 3 interface 223 altsetting 155: 82, using maximum allowed: 30 [ 74.854155][ T30] usb 1-1: config 3 interface 223 altsetting 155 endpoint 0xD has invalid maxpacket 512, setting to 64 [ 74.854177][ T30] usb 1-1: config 3 interface 223 altsetting 155 endpoint 0x8 has invalid maxpacket 512, setting to 64 [ 74.854197][ T30] usb 1-1: config 3 interface 223 altsetting 155 has 4 endpoint descriptors, different from the interface descriptor's value: 82 [ 74.854216][ T30] usb 1-1: config 3 interface 223 has no altsetting 1 [ 74.854229][ T30] usb 1-1: config 3 interface 25 has no altsetting 0 [ 74.929177][ T30] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 74.929201][ T30] usb 1-1: Product: syz [ 74.929212][ T30] usb 1-1: Manufacturer: syz [ 74.929224][ T30] usb 1-1: SerialNumber: syz [pid 5637] exit_group(0) = ? [pid 5637] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5637, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5640 attached , child_tidptr=0x5555771fb6d0) = 5640 [pid 5636] rt_sigprocmask(SIG_SETMASK, [] [pid 5640] set_robust_list(0x5555771fb6e0, 24 [pid 5636] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5640] <... set_robust_list resumed>) = 0 [pid 5640] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5640] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5640] setpgid(0, 0) = 0 [pid 5640] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5640] write(3, "1000", 4) = 4 [pid 5640] close(3) = 0 [pid 5640] write(1, "executing program\n", 18) = 18 executing program [pid 5640] openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3 [pid 5640] ioctl(3, USB_RAW_IOCTL_INIT, 0x7ffe49c9b0c0) = 0 [pid 5640] ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 [pid 5640] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffe49c9b0c0) = 0 [ 75.203066][ T30] usbtv 1-1:3.223: Fushicai USBTV007 Audio-Video Grabber [ 75.213111][ T30] usb 1-1: USB disconnect, device number 2 [ 75.269013][ T5644] udevd[5644]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 75.297673][ T30] [ 75.300034][ T30] ========================= [ 75.304536][ T30] WARNING: held lock freed! [ 75.309054][ T30] syzkaller #0 Not tainted [ 75.313471][ T30] ------------------------- [ 75.317972][ T30] kworker/1:1/30 is freeing memory ffff88807ece6000-ffff88807ece67ff, with a lock still held there! [ 75.328736][ T30] ffff88807ece61a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 [ 75.338892][ T30] locks held by kworker/1:1/30: 5, last CPU#1: [ 75.345034][ T30] #0: ffff88801eae4d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 75.356354][ T30] #1: ffffc90000a57c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 75.368177][ T30] #2: ffff8880297ac1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 [ 75.377136][ T30] #3: ffff888035ec91d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xfc/0x9a0 [ 75.386257][ T30] #4: ffff88807ece61a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 [ 75.396774][ T30] [ 75.396774][ T30] stack backtrace: [ 75.402680][ T30] CPU: 1 UID: 0 PID: 30 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT(full) [ 75.412062][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 75.422115][ T30] Workqueue: usb_hub_wq hub_event [ 75.427167][ T30] Call Trace: [ 75.430455][ T30] [ 75.433380][ T30] dump_stack_lvl+0xe8/0x150 [ 75.437967][ T30] debug_check_no_locks_freed+0x149/0x170 [ 75.443681][ T30] kfree+0x12b/0x650 [ 75.447569][ T30] ? device_release+0xc4/0x1f0 [ 75.452327][ T30] ? __pfx_usb_release_interface+0x10/0x10 [ 75.458123][ T30] device_release+0xc4/0x1f0 [ 75.462741][ T30] kobject_put+0x222/0x550 [ 75.467153][ T30] v4l2_device_disconnect+0x79/0xd0 [ 75.472342][ T30] usbtv_video_free+0x25/0x30 [ 75.477010][ T30] usbtv_disconnect+0x5c/0xa0 [ 75.481682][ T30] usb_unbind_interface+0x295/0x9f0 [ 75.486875][ T30] ? kernfs_remove_by_name_ns+0x101/0x140 [ 75.492594][ T30] ? kernfs_remove_by_name_ns+0x101/0x140 [ 75.498308][ T30] ? __pfx_usb_unbind_interface+0x10/0x10 [ 75.504036][ T30] device_release_driver_internal+0x4f5/0x880 [ 75.510097][ T30] bus_remove_device+0x444/0x560 [ 75.515031][ T30] ? __pfx_bus_remove_device+0x10/0x10 [ 75.520488][ T30] ? kernfs_remove_by_name_ns+0x101/0x140 [ 75.526199][ T30] device_del+0x524/0x8f0 [ 75.530516][ T30] ? __pfx_device_del+0x10/0x10 [ 75.535351][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 75.540368][ T30] usb_disable_device+0x3d4/0x8d0 [ 75.545383][ T30] usb_disconnect+0x346/0x9a0 [ 75.550068][ T30] hub_event+0x1bbb/0x4d30 [ 75.554479][ T30] ? do_raw_spin_unlock+0xf5/0x200 [ 75.559585][ T30] ? register_lock_class+0x31/0x2e0 [ 75.564780][ T30] ? __pfx_hub_event+0x10/0x10 [ 75.569539][ T30] ? rcu_is_watching+0x16/0xb0 [ 75.574293][ T30] ? process_scheduled_works+0x97a/0x1630 [ 75.580004][ T30] process_scheduled_works+0xc3d/0x1630 [ 75.585548][ T30] ? __pfx_process_scheduled_works+0x10/0x10 [ 75.591520][ T30] ? assign_work+0x3cf/0x5d0 [ 75.596106][ T30] worker_thread+0xa47/0xfb0 [ 75.600693][ T30] kthread+0x38b/0x480 [ 75.604749][ T30] ? __pfx_worker_thread+0x10/0x10 [ 75.609853][ T30] ? __pfx_kthread+0x10/0x10 [ 75.614430][ T30] ret_from_fork+0x514/0xb70 [ 75.619007][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 75.624100][ T30] ? __switch_to+0xc89/0x1420 [ 75.628766][ T30] ? __pfx_kthread+0x10/0x10 [ 75.633520][ T30] ret_from_fork_asm+0x1a/0x30 [ 75.638280][ T30] [ 75.642534][ T30] ================================================================== [ 75.642546][ T30] BUG: KASAN: slab-use-after-free in usb_unbind_interface+0x2c2/0x9f0 [ 75.642573][ T30] Read of size 8 at addr ffff88807ece6008 by task kworker/1:1/30 [ 75.642586][ T30] [ 75.642595][ T30] CPU: 1 UID: 0 PID: 30 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT(full) [ 75.642615][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 75.642625][ T30] Workqueue: usb_hub_wq hub_event [ 75.642646][ T30] Call Trace: [ 75.642651][ T30] [ 75.642658][ T30] dump_stack_lvl+0xe8/0x150 [ 75.642683][ T30] print_address_description+0x55/0x1e0 [ 75.642706][ T30] ? usb_unbind_interface+0x2c2/0x9f0 [ 75.642731][ T30] print_report+0x58/0x70 [ 75.642750][ T30] kasan_report+0x117/0x150 [ 75.642772][ T30] ? usb_unbind_interface+0x2c2/0x9f0 [ 75.642804][ T30] usb_unbind_interface+0x2c2/0x9f0 [ 75.642824][ T30] ? kernfs_remove_by_name_ns+0x101/0x140 [ 75.642846][ T30] ? kernfs_remove_by_name_ns+0x101/0x140 [ 75.642865][ T30] ? __pfx_usb_unbind_interface+0x10/0x10 [ 75.642886][ T30] device_release_driver_internal+0x4f5/0x880 [ 75.642910][ T30] bus_remove_device+0x444/0x560 [ 75.642936][ T30] ? __pfx_bus_remove_device+0x10/0x10 [ 75.642962][ T30] ? kernfs_remove_by_name_ns+0x101/0x140 [ 75.642983][ T30] device_del+0x524/0x8f0 [ 75.643003][ T30] ? __pfx_device_del+0x10/0x10 [ 75.643021][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 75.643046][ T30] usb_disable_device+0x3d4/0x8d0 [ 75.643068][ T30] usb_disconnect+0x346/0x9a0 [ 75.643088][ T30] hub_event+0x1bbb/0x4d30 [ 75.643107][ T30] ? do_raw_spin_unlock+0xf5/0x200 [ 75.643134][ T30] ? register_lock_class+0x31/0x2e0 [ 75.643164][ T30] ? __pfx_hub_event+0x10/0x10 [ 75.643186][ T30] ? rcu_is_watching+0x16/0xb0 [ 75.643207][ T30] ? process_scheduled_works+0x97a/0x1630 [ 75.643229][ T30] process_scheduled_works+0xc3d/0x1630 [ 75.643261][ T30] ? __pfx_process_scheduled_works+0x10/0x10 [ 75.643284][ T30] ? assign_work+0x3cf/0x5d0 [ 75.643304][ T30] worker_thread+0xa47/0xfb0 [ 75.643334][ T30] kthread+0x38b/0x480 [ 75.643350][ T30] ? __pfx_worker_thread+0x10/0x10 [ 75.643371][ T30] ? __pfx_kthread+0x10/0x10 [ 75.643387][ T30] ret_from_fork+0x514/0xb70 [ 75.643405][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 75.643420][ T30] ? __switch_to+0xc89/0x1420 [ 75.643443][ T30] ? __pfx_kthread+0x10/0x10 [ 75.643459][ T30] ret_from_fork_asm+0x1a/0x30 [ 75.643489][ T30] [ 75.643495][ T30] [ 75.643499][ T30] Allocated by task 30: [ 75.643506][ T30] kasan_save_track+0x3e/0x80 [ 75.643522][ T30] __kasan_kmalloc+0x93/0xb0 [ 75.643538][ T30] __kmalloc_cache_noprof+0x321/0x600 [ 75.643553][ T30] usb_set_configuration+0x3cc/0x2180 [ 75.643572][ T30] usb_generic_driver_probe+0x8d/0x150 [ 75.643590][ T30] usb_probe_device+0x1c3/0x3b0 [ 75.643610][ T30] really_probe+0x254/0xae0 [ 75.643627][ T30] __driver_probe_device+0x1e8/0x360 [ 75.643645][ T30] driver_probe_device+0x4f/0x240 [ 75.643664][ T30] __device_attach_driver+0x270/0x410 [ 75.643683][ T30] bus_for_each_drv+0x258/0x2f0 [ 75.643705][ T30] __device_attach+0x2c4/0x450 [ 75.643722][ T30] device_initial_probe+0xa1/0xd0 [ 75.643740][ T30] bus_probe_device+0x12a/0x220 [ 75.643762][ T30] device_add+0x7d7/0xb80 [ 75.643785][ T30] usb_new_device+0x9aa/0x1690 [ 75.643800][ T30] hub_event+0x28e8/0x4d30 [ 75.643818][ T30] process_scheduled_works+0xc3d/0x1630 [ 75.643837][ T30] worker_thread+0xa47/0xfb0 [ 75.643856][ T30] kthread+0x38b/0x480 [ 75.643868][ T30] ret_from_fork+0x514/0xb70 [ 75.643881][ T30] ret_from_fork_asm+0x1a/0x30 [ 75.643903][ T30] [ 75.643907][ T30] Freed by task 30: [ 75.643915][ T30] kasan_save_track+0x3e/0x80 [ 75.643930][ T30] kasan_save_free_info+0x40/0x50 [ 75.643951][ T30] __kasan_slab_free+0x5c/0x80 [ 75.643967][ T30] kfree+0x1c5/0x650 [ 75.643987][ T30] device_release+0xc4/0x1f0 [ 75.644007][ T30] kobject_put+0x222/0x550 [ 75.644028][ T30] v4l2_device_disconnect+0x79/0xd0 [ 75.644049][ T30] usbtv_video_free+0x25/0x30 [ 75.644069][ T30] usbtv_disconnect+0x5c/0xa0 [ 75.644088][ T30] usb_unbind_interface+0x295/0x9f0 [ 75.644107][ T30] device_release_driver_internal+0x4f5/0x880 [ 75.644125][ T30] bus_remove_device+0x444/0x560 [ 75.644147][ T30] device_del+0x524/0x8f0 [ 75.644161][ T30] usb_disable_device+0x3d4/0x8d0 [ 75.644178][ T30] usb_disconnect+0x346/0x9a0 [ 75.644193][ T30] hub_event+0x1bbb/0x4d30 [ 75.644209][ T30] process_scheduled_works+0xc3d/0x1630 [ 75.644229][ T30] worker_thread+0xa47/0xfb0 [ 75.644248][ T30] kthread+0x38b/0x480 [ 75.644261][ T30] ret_from_fork+0x514/0xb70 [ 75.644274][ T30] ret_from_fork_asm+0x1a/0x30 [ 75.644294][ T30] [ 75.644298][ T30] The buggy address belongs to the object at ffff88807ece6000 [ 75.644298][ T30] which belongs to the cache kmalloc-2k of size 2048 [ 75.644310][ T30] The buggy address is located 8 bytes inside of [ 75.644310][ T30] freed 2048-byte region [ffff88807ece6000, ffff88807ece6800) [ 75.644326][ T30] [ 75.644330][ T30] The buggy address belongs to the physical page: [ 75.644346][ T30] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7ece0 [ 75.644362][ T30] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 75.644375][ T30] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 75.644398][ T30] page_type: f5(slab) [ 75.644413][ T30] raw: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122 [ 75.644427][ T30] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 75.644443][ T30] head: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122 [ 75.644456][ T30] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 75.644471][ T30] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 75.644484][ T30] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 75.644491][ T30] page dumped because: kasan: bad access detected [ 75.644506][ T30] page_owner tracks the page as allocated [ 75.644512][ T30] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4974, tgid 4974 (acpid), ts 23881056629 [ 75.644538][ T30] post_alloc_hook+0x1f9/0x250 [ 75.644562][ T30] get_page_from_freelist+0x2209/0x2280 [ 75.644578][ T30] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 75.644595][ T30] allocate_slab+0x7d/0x620 [ 75.644614][ T30] refill_objects+0x2d5/0x350 [ 75.644634][ T30] __pcs_replace_empty_main+0x2c8/0x6c0 [ 75.644654][ T30] __kvmalloc_node_noprof+0x63c/0x820 [ 75.644671][ T30] evdev_open+0xeb/0x5d0 [ 75.644686][ T30] chrdev_open+0x4d9/0x600 [ 75.644703][ T30] do_dentry_open+0x816/0x1380 [ 75.644721][ T30] vfs_open+0x3b/0x340 [ 75.644737][ T30] path_openat+0x1443/0x1d60 [ 75.644750][ T30] do_file_open+0x23e/0x4a0 [ 75.644763][ T30] do_sys_openat2+0x115/0x200 [ 75.644787][ T30] __x64_sys_openat+0x138/0x170 [ 75.644806][ T30] do_syscall_64+0x166/0x520 [ 75.644824][ T30] page last free pid 1 tgid 1 ts 21978497596 stack trace: [ 75.644835][ T30] free_pages_prepare+0x9eb/0xaf0 [ 75.644857][ T30] __free_contig_range_common+0x174/0x340 [ 75.644876][ T30] destroy_args+0x4e5/0x570 [ 75.644899][ T30] debug_vm_pgtable+0x3f8/0x410 [ 75.644920][ T30] do_one_initcall+0x250/0x870 [ 75.644942][ T30] do_initcall_level+0x10a/0x1a0 [ 75.644964][ T30] do_initcalls+0x59/0xa0 [ 75.644985][ T30] kernel_init_freeable+0x29d/0x3e0 [ 75.645006][ T30] kernel_init+0x22/0x1d0 [ 75.645027][ T30] ret_from_fork+0x514/0xb70 [ 75.645041][ T30] ret_from_fork_asm+0x1a/0x30 [ 75.645062][ T30] [ 75.645066][ T30] Memory state around the buggy address: [ 75.645074][ T30] ffff88807ece5f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 75.645083][ T30] ffff88807ece5f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 75.645093][ T30] >ffff88807ece6000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 75.645100][ T30] ^ [ 75.645108][ T30] ffff88807ece6080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 75.645119][ T30] ffff88807ece6100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 75.645127][ T30] ================================================================== [ 75.645194][ T30] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 76.463901][ T30] CPU: 1 UID: 0 PID: 30 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT(full) [ 76.473087][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 76.483132][ T30] Workqueue: usb_hub_wq hub_event [ 76.488180][ T30] Call Trace: [ 76.491507][ T30] [ 76.494438][ T30] vpanic+0x56d/0xa60 [ 76.498416][ T30] ? __pfx_vpanic+0x10/0x10 [ 76.502909][ T30] ? __pfx___schedule+0x10/0x10 [ 76.507753][ T30] panic+0xc5/0xd0 [ 76.511467][ T30] ? __pfx_panic+0x10/0x10 [ 76.515882][ T30] ? preempt_schedule_thunk+0x16/0x40 [ 76.521253][ T30] ? usb_unbind_interface+0x2c2/0x9f0 [ 76.526613][ T30] check_panic_on_warn+0x89/0xb0 [ 76.531539][ T30] ? usb_unbind_interface+0x2c2/0x9f0 [ 76.536900][ T30] end_report+0x73/0x170 [ 76.541133][ T30] ? usb_unbind_interface+0x2c2/0x9f0 [ 76.546494][ T30] kasan_report+0x128/0x150 [ 76.550987][ T30] ? usb_unbind_interface+0x2c2/0x9f0 [ 76.556352][ T30] usb_unbind_interface+0x2c2/0x9f0 [ 76.561542][ T30] ? kernfs_remove_by_name_ns+0x101/0x140 [ 76.567260][ T30] ? kernfs_remove_by_name_ns+0x101/0x140 [ 76.572967][ T30] ? __pfx_usb_unbind_interface+0x10/0x10 [ 76.578762][ T30] device_release_driver_internal+0x4f5/0x880 [ 76.584826][ T30] bus_remove_device+0x444/0x560 [ 76.589763][ T30] ? __pfx_bus_remove_device+0x10/0x10 [ 76.595218][ T30] ? kernfs_remove_by_name_ns+0x101/0x140 [ 76.600930][ T30] device_del+0x524/0x8f0 [ 76.605256][ T30] ? __pfx_device_del+0x10/0x10 [ 76.610097][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 76.615115][ T30] usb_disable_device+0x3d4/0x8d0 [ 76.620132][ T30] usb_disconnect+0x346/0x9a0 [ 76.624798][ T30] hub_event+0x1bbb/0x4d30 [ 76.629241][ T30] ? do_raw_spin_unlock+0xf5/0x200 [ 76.634350][ T30] ? register_lock_class+0x31/0x2e0 [ 76.639542][ T30] ? __pfx_hub_event+0x10/0x10 [ 76.644297][ T30] ? rcu_is_watching+0x16/0xb0 [ 76.649058][ T30] ? process_scheduled_works+0x97a/0x1630 [ 76.654770][ T30] process_scheduled_works+0xc3d/0x1630 [ 76.660323][ T30] ? __pfx_process_scheduled_works+0x10/0x10 [ 76.666296][ T30] ? assign_work+0x3cf/0x5d0 [ 76.670879][ T30] worker_thread+0xa47/0xfb0 [ 76.675510][ T30] kthread+0x38b/0x480 [ 76.679578][ T30] ? __pfx_worker_thread+0x10/0x10 [ 76.684699][ T30] ? __pfx_kthread+0x10/0x10 [ 76.689283][ T30] ret_from_fork+0x514/0xb70 [ 76.693872][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 76.698974][ T30] ? __switch_to+0xc89/0x1420 [ 76.703655][ T30] ? __pfx_kthread+0x10/0x10 [ 76.708249][ T30] ret_from_fork_asm+0x1a/0x30 [ 76.713028][ T30] [ 76.716293][ T30] Kernel Offset: disabled [ 76.720640][ T30] Rebooting in 86400 seconds..