Warning: Permanently added '[localhost]:41538' (ED25519) to the list of known hosts.
2026/10/18 11:43:44 parsed 1 programs
2026/10/18 11:43:44 serving rpc on tcp://46019
[ 36.233607][ T5744] cgroup: Unknown subsys name 'net'
[ 36.377470][ T5744] cgroup: Unknown subsys name 'cpuset'
[ 36.381084][ T5744] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 37.313894][ T5744] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 39.172781][ T5752] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 39.177672][ T5752] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 39.187801][ T5752] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 39.188704][ T5752] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 39.197876][ T5752] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon.
[ 40.134700][ T5782] rxe_eth0 speed is unknown, defaulting to 1000
[ 40.135360][ T5782] rxe_eth0 speed is unknown, defaulting to 1000
[ 40.136069][ T5782] rxe_eth0 speed is unknown, defaulting to 1000
[ 40.223475][ T5782] infiniband rxe0: set active
[ 40.223849][ T1353] rxe_eth0 speed is unknown, defaulting to 1000
[ 40.224076][ T5782] infiniband rxe0: added rxe_eth0
[ 40.231346][ T5782] smbdirect: ib_dev[rxe0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000
[ 40.231365][ T5782] smbdirect: ib_dev[rxe0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32
[ 40.231386][ T5782] smbdirect: ib_dev[rxe0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005
[ 40.246173][ T5782] RDS/IB: rxe0: added
[ 40.246388][ T5782] smc: adding ib device rxe0 with port count 1
[ 40.246453][ T5782] smc: ib device rxe0 port 1 has no pnetid
[ 40.247404][ T1478] rxe_eth0 speed is unknown, defaulting to 1000
[ 40.266685][ T5782] rxe_eth0 speed is unknown, defaulting to 1000
[ 40.551984][ T5782] bridge0: port 1(bridge_slave_0) entered blocking state
[ 40.552636][ T5782] bridge0: port 1(bridge_slave_0) entered disabled state
[ 40.552736][ T5782] bridge_slave_0: entered allmulticast mode
[ 40.553551][ T5782] bridge_slave_0: entered promiscuous mode
[ 40.556741][ T5782] bridge0: port 2(bridge_slave_1) entered blocking state
[ 40.556781][ T5782] bridge0: port 2(bridge_slave_1) entered disabled state
[ 40.556836][ T5782] bridge_slave_1: entered allmulticast mode
[ 40.558061][ T5782] bridge_slave_1: entered promiscuous mode
[ 40.577784][ T5782] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 40.580237][ T5782] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 40.592329][ T5782] team0: Port device team_slave_0 added
[ 40.593635][ T5782] team0: Port device team_slave_1 added
[ 40.606007][ T5782] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 40.606018][ T5782] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 40.606030][ T5782] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 40.607477][ T5782] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 40.607484][ T5782] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 40.607496][ T5782] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 40.628689][ T5782] hsr_slave_0: entered promiscuous mode
[ 40.629430][ T5782] hsr_slave_1: entered promiscuous mode
[ 40.725719][ T5782] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 40.729724][ T5782] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 40.730333][ T5782] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 40.732293][ T5782] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 40.732924][ T5782] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 40.734979][ T5782] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 40.735524][ T5782] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 40.738373][ T5782] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 40.757557][ T5782] bridge0: port 2(bridge_slave_1) entered blocking state
[ 40.757607][ T5782] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 40.757856][ T5782] bridge0: port 1(bridge_slave_0) entered blocking state
[ 40.757918][ T5782] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 40.792030][ T5782] 8021q: adding VLAN 0 to HW filter on device bond0
[ 40.799282][ T158] bridge0: port 1(bridge_slave_0) entered disabled state
[ 40.799763][ T158] bridge0: port 2(bridge_slave_1) entered disabled state
[ 40.805823][ T5782] 8021q: adding VLAN 0 to HW filter on device team0
[ 40.811476][ T158] bridge0: port 1(bridge_slave_0) entered blocking state
[ 40.811521][ T158] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 40.816935][ T158] bridge0: port 2(bridge_slave_1) entered blocking state
[ 40.816978][ T158] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 41.134263][ T5782] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 41.165414][ T5782] veth0_vlan: entered promiscuous mode
[ 41.170479][ T5782] veth1_vlan: entered promiscuous mode
[ 41.188713][ T5782] veth0_macvtap: entered promiscuous mode
[ 41.192332][ T5782] veth1_macvtap: entered promiscuous mode
[ 41.203070][ T5782] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 41.208364][ T5782] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 41.255353][ T5592] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 41.274633][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 41.314743][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 41.335031][ T5592] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 41.348500][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 41.358871][ T5824] rxe_eth0 speed is unknown, defaulting to 1000
[ 41.413481][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 41.497453][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 41.511889][ T158] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 41.511902][ T158] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 41.529195][ T158] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 41.529206][ T158] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 41.552549][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 41.595964][ T64] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 41.597182][ T64] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 41.597632][ T64] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 41.598305][ T64] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 41.598729][ T64] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 41.618553][ T5831] rxe_eth0 speed is unknown, defaulting to 1000
[ 41.808129][ T5838] rxe_eth0 speed is unknown, defaulting to 1000
[ 41.958983][ T5843] rxe_eth0 speed is unknown, defaulting to 1000
[ 42.188477][ T5849] rxe_eth0 speed is unknown, defaulting to 1000
[ 42.439618][ T5854] rxe_eth0 speed is unknown, defaulting to 1000
[ 42.621225][ T5859] rxe_eth0 speed is unknown, defaulting to 1000
[ 42.810522][ T5863] rxe_eth0 speed is unknown, defaulting to 1000
[ 42.950558][ T5866] rxe_eth0 speed is unknown, defaulting to 1000
[ 43.323264][ T5099] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 43.324149][ T5099] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 43.325150][ T5099] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 43.326007][ T5099] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
2026/10/18 11:43:53 executed programs: 0
[ 43.326379][ T5099] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 43.513289][ T5870] rxe_eth0 speed is unknown, defaulting to 1000
[ 43.729591][ T12] bridge_slave_1: left allmulticast mode
[ 43.729624][ T12] bridge_slave_1: left promiscuous mode
[ 43.730181][ T12] bridge0: port 2(bridge_slave_1) entered disabled state
[ 43.734972][ T12] bridge_slave_0: left allmulticast mode
[ 43.734993][ T12] bridge_slave_0: left promiscuous mode
[ 43.735160][ T12] bridge0: port 1(bridge_slave_0) entered disabled state
[ 43.827981][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 43.830502][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 43.831377][ T12] bond0 (unregistering): Released all slaves
[ 43.891129][ T5870] bridge0: port 1(bridge_slave_0) entered blocking state
[ 43.891205][ T5870] bridge0: port 1(bridge_slave_0) entered disabled state
[ 43.891302][ T5870] bridge_slave_0: entered allmulticast mode
[ 43.892053][ T5870] bridge_slave_0: entered promiscuous mode
[ 43.893702][ T5870] bridge0: port 2(bridge_slave_1) entered blocking state
[ 43.893811][ T5870] bridge0: port 2(bridge_slave_1) entered disabled state
[ 43.893910][ T5870] bridge_slave_1: entered allmulticast mode
[ 43.895999][ T5870] bridge_slave_1: entered promiscuous mode
[ 43.943503][ T5870] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 43.947393][ T5870] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 43.991419][ T5870] team0: Port device team_slave_0 added
[ 43.994070][ T5870] team0: Port device team_slave_1 added
[ 44.023128][ T12] hsr_slave_0: left promiscuous mode
[ 44.023887][ T12] hsr_slave_1: left promiscuous mode
[ 44.024279][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 44.024294][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 44.033307][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 44.034634][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 44.041975][ T12] veth1_macvtap: left promiscuous mode
[ 44.042003][ T12] veth0_macvtap: left promiscuous mode
[ 44.042097][ T12] veth1_vlan: left promiscuous mode
[ 44.042185][ T12] veth0_vlan: left promiscuous mode
[ 44.198254][ T12] team0 (unregistering): Port device team_slave_1 removed
[ 44.216666][ T12] team0 (unregistering): Port device team_slave_0 removed
[ 44.270174][ T5870] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 44.270184][ T5870] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 44.270197][ T5870] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 44.272845][ T5453] 8021q: adding VLAN 0 to HW filter on device eth2
[ 44.273838][ T5870] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 44.273846][ T5870] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 44.273859][ T5870] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 44.298202][ T5870] hsr_slave_0: entered promiscuous mode
[ 44.298677][ T5870] hsr_slave_1: entered promiscuous mode
[ 44.478363][ T5453] 8021q: adding VLAN 0 to HW filter on device eth3
[ 45.013382][ T5870] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 45.018429][ T5870] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 45.022294][ T5870] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 45.030147][ T5870] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 45.030788][ T5870] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 45.036873][ T5870] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 45.047872][ T5870] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 45.049472][ T5870] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 45.099692][ T5870] 8021q: adding VLAN 0 to HW filter on device bond0
[ 45.111699][ T5870] 8021q: adding VLAN 0 to HW filter on device team0
[ 45.115457][ T72] bridge0: port 1(bridge_slave_0) entered blocking state
[ 45.115502][ T72] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 45.122651][ T72] bridge0: port 2(bridge_slave_1) entered blocking state
[ 45.122696][ T72] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 45.339459][ T5870] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 45.347198][ T64] Bluetooth: hci0: command tx timeout
[ 45.373641][ T5870] veth0_vlan: entered promiscuous mode
[ 45.377495][ T5870] veth1_vlan: entered promiscuous mode
[ 45.393484][ T5870] veth0_macvtap: entered promiscuous mode
[ 45.397018][ T5870] veth1_macvtap: entered promiscuous mode
[ 45.403383][ T5870] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 45.407026][ T5870] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 45.424561][ T5825] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 45.424603][ T5825] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 45.424620][ T5825] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 45.424637][ T5825] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 45.462915][ T72] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 45.462928][ T72] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 45.501766][ T72] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 45.501779][ T72] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 45.774590][ T1478] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 45.926691][ T1478] usb 5-1: Using ep0 maxpacket: 32
[ 45.928679][ T1478] usb 5-1: unable to get BOS descriptor or descriptor too short
[ 45.928702][ T1478] usb 5-1: New USB device found, idVendor=1f71, idProduct=3306, bcdDevice=2a.c0
[ 45.929843][ T1478] usb 5-1: config 3 has an invalid interface number: 223 but max is 1
[ 45.929855][ T1478] usb 5-1: config 3 has an invalid interface number: 25 but max is 1
[ 45.929864][ T1478] usb 5-1: config 3 has an invalid interface number: 223 but max is 1
[ 45.929874][ T1478] usb 5-1: config 3 has no interface number 0
[ 45.929881][ T1478] usb 5-1: config 3 has no interface number 1
[ 45.929902][ T1478] usb 5-1: config 3 interface 25 altsetting 6 has an invalid descriptor for endpoint zero, skipping
[ 45.929912][ T1478] usb 5-1: config 3 interface 25 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 5
[ 45.929924][ T1478] usb 5-1: too many endpoints for config 3 interface 223 altsetting 155: 82, using maximum allowed: 30
[ 45.929942][ T1478] usb 5-1: config 3 interface 223 altsetting 155 endpoint 0xD has invalid maxpacket 512, setting to 64
[ 45.929955][ T1478] usb 5-1: config 3 interface 223 altsetting 155 endpoint 0x8 has invalid maxpacket 512, setting to 64
[ 45.929968][ T1478] usb 5-1: config 3 interface 223 altsetting 155 has 4 endpoint descriptors, different from the interface descriptor's value: 82
[ 45.929980][ T1478] usb 5-1: config 3 interface 223 has no altsetting 1
[ 45.929989][ T1478] usb 5-1: config 3 interface 25 has no altsetting 0
[ 45.932036][ T1478] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 45.932047][ T1478] usb 5-1: Product: syz
[ 45.932054][ T1478] usb 5-1: Manufacturer: syz
[ 45.932061][ T1478] usb 5-1: SerialNumber: syz
[ 46.171172][ T1478] usbtv 5-1:3.223: Fushicai USBTV007 Audio-Video Grabber
[ 46.176744][ T1478] usb 5-1: USB disconnect, device number 2
[ 46.192459][ T1478]
[ 46.193251][ T1478] =========================
[ 46.194683][ T1478] WARNING: held lock freed!
[ 46.196100][ T1478] syzkaller #0 Not tainted
[ 46.197525][ T1478] -------------------------
[ 46.198950][ T1478] kworker/1:2/1478 is freeing memory ffff888027009000-ffff8880270097ff, with a lock still held there!
[ 46.202253][ T1478] ffff8880270091a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb2/0x620
[ 46.205405][ T1478] locks held by kworker/1:2/1478: 5, last CPU#1:
[ 46.207375][ T1478] #0: ffff8880220b4140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10
[ 46.210682][ T1478] #1: ffffc90007b0fd08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10
[ 46.214156][ T1478] #2: ffff888000d801d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bb/0x4420
[ 46.216912][ T1478] #3: ffff8880152db1d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0x10a/0x9a0
[ 46.219763][ T1478] #4: ffff8880270091a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb2/0x620
[ 46.223030][ T1478]
[ 46.223030][ T1478] stack backtrace:
[ 46.224907][ T1478] CPU: 1 UID: 0 PID: 1478 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(full)
[ 46.227782][ T1478] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 46.230910][ T1478] Workqueue: usb_hub_wq hub_event
[ 46.232511][ T1478] Call Trace:
[ 46.233585][ T1478]
[ 46.234527][ T1478] dump_stack_lvl+0x100/0x190
[ 46.236008][ T1478] debug_check_no_locks_freed+0x115/0x120
[ 46.237791][ T1478] ? device_release+0x60/0x270
[ 46.239302][ T1478] ? device_release+0xd2/0x270
[ 46.240817][ T1478] kfree+0x180/0x6d0
[ 46.242073][ T1478] ? put_device+0x24/0x30
[ 46.243440][ T1478] ? __pfx_usb_release_interface+0x10/0x10
[ 46.245444][ T1478] device_release+0xd2/0x270
[ 46.246927][ T1478] kobject_put+0x1f7/0x640
[ 46.248343][ T1478] put_device+0x1f/0x30
[ 46.249669][ T1478] v4l2_device_disconnect+0x60/0xc0
[ 46.251309][ T1478] usbtv_video_free+0x25/0x30
[ 46.252834][ T1478] usbtv_disconnect+0x58/0xa0
[ 46.254327][ T1478] usb_unbind_interface+0x1dd/0x9e0
[ 46.255959][ T1478] ? __pfx_usb_unbind_interface+0x10/0x10
[ 46.257748][ T1478] device_remove+0x12a/0x180
[ 46.259200][ T1478] device_release_driver_internal+0x44e/0x620
[ 46.261102][ T1478] bus_remove_device+0x2bc/0x560
[ 46.262667][ T1478] ? __pfx_bus_remove_device+0x10/0x10
[ 46.264404][ T1478] ? __pfx_device_remove_attrs+0x10/0x10
[ 46.266161][ T1478] device_del+0x376/0x9b0
[ 46.267528][ T1478] ? __pfx_device_del+0x10/0x10
[ 46.269067][ T1478] ? __pfx___pm_runtime_barrier+0x10/0x10
[ 46.270842][ T1478] ? lock_acquire+0x1d1/0x380
[ 46.272346][ T1478] usb_disable_device+0x367/0x810
[ 46.273934][ T1478] ? mark_held_locks+0x40/0x70
[ 46.275445][ T1478] usb_disconnect+0x2e2/0x9a0
[ 46.276935][ T1478] hub_event+0x1bb1/0x4420
[ 46.278355][ T1478] ? __lock_acquire+0x5c0/0x1f40
[ 46.279923][ T1478] ? __pfx_hub_event+0x10/0x10
[ 46.281438][ T1478] ? down_read_trylock+0x180/0x440
[ 46.283043][ T1478] ? lock_acquire+0x1d1/0x380
[ 46.284539][ T1478] ? process_one_work+0xa2c/0x1b10
[ 46.286165][ T1478] ? process_one_work+0x906/0x1b10
[ 46.287773][ T1478] ? process_one_work+0x906/0x1b10
[ 46.289400][ T1478] process_one_work+0xac7/0x1b10
[ 46.290963][ T1478] ? __pfx_process_one_work+0x10/0x10
[ 46.292670][ T1478] ? lock_acquire+0x1d1/0x380
[ 46.294156][ T1478] ? __pfx_hub_event+0x10/0x10
[ 46.295666][ T1478] worker_thread+0x5ef/0xe50
[ 46.297132][ T1478] ? __pfx_worker_thread+0x10/0x10
[ 46.298759][ T1478] ? kthread+0x13a/0x450
[ 46.300098][ T1478] ? __pfx_worker_thread+0x10/0x10
[ 46.301713][ T1478] kthread+0x373/0x450
[ 46.303006][ T1478] ? __pfx_kthread+0x10/0x10
[ 46.304478][ T1478] ret_from_fork+0x730/0xd60
[ 46.305961][ T1478] ? __pfx_ret_from_fork+0x10/0x10
[ 46.307570][ T1478] ? __switch_to+0x800/0x10f0
[ 46.309137][ T1478] ? __pfx_kthread+0x10/0x10
[ 46.310541][ T1478] ret_from_fork_asm+0x1a/0x30
[ 46.312022][ T1478]
[ 46.314924][ T1478] ==================================================================
[ 46.314931][ T1478] BUG: KASAN: slab-use-after-free in usb_unbind_interface+0x935/0x9e0
[ 46.314949][ T1478] Read of size 8 at addr ffff888027009008 by task kworker/1:2/1478
[ 46.314957][ T1478]
[ 46.314964][ T1478] CPU: 1 UID: 0 PID: 1478 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(full)
[ 46.314975][ T1478] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 46.314983][ T1478] Workqueue: usb_hub_wq hub_event
[ 46.314997][ T1478] Call Trace:
[ 46.315001][ T1478]
[ 46.315005][ T1478] dump_stack_lvl+0x100/0x190
[ 46.315019][ T1478] print_report+0x13d/0x4b0
[ 46.315035][ T1478] ? __virt_addr_valid+0x239/0x430
[ 46.315052][ T1478] ? usb_unbind_interface+0x935/0x9e0
[ 46.315067][ T1478] kasan_report+0xdf/0x1c0
[ 46.315083][ T1478] ? usb_unbind_interface+0x935/0x9e0
[ 46.315100][ T1478] usb_unbind_interface+0x935/0x9e0
[ 46.315116][ T1478] ? __pfx_usb_unbind_interface+0x10/0x10
[ 46.315132][ T1478] device_remove+0x12a/0x180
[ 46.315143][ T1478] device_release_driver_internal+0x44e/0x620
[ 46.315157][ T1478] bus_remove_device+0x2bc/0x560
[ 46.315168][ T1478] ? __pfx_bus_remove_device+0x10/0x10
[ 46.315178][ T1478] ? __pfx_device_remove_attrs+0x10/0x10
[ 46.315190][ T1478] device_del+0x376/0x9b0
[ 46.315202][ T1478] ? __pfx_device_del+0x10/0x10
[ 46.315213][ T1478] ? __pfx___pm_runtime_barrier+0x10/0x10
[ 46.315225][ T1478] ? lock_acquire+0x1d1/0x380
[ 46.315245][ T1478] usb_disable_device+0x367/0x810
[ 46.315259][ T1478] ? mark_held_locks+0x40/0x70
[ 46.315276][ T1478] usb_disconnect+0x2e2/0x9a0
[ 46.315290][ T1478] hub_event+0x1bb1/0x4420
[ 46.315307][ T1478] ? __lock_acquire+0x5c0/0x1f40
[ 46.315323][ T1478] ? __pfx_hub_event+0x10/0x10
[ 46.315337][ T1478] ? down_read_trylock+0x180/0x440
[ 46.315347][ T1478] ? lock_acquire+0x1d1/0x380
[ 46.315362][ T1478] ? process_one_work+0xa2c/0x1b10
[ 46.315376][ T1478] ? process_one_work+0x906/0x1b10
[ 46.315388][ T1478] ? process_one_work+0x906/0x1b10
[ 46.315402][ T1478] process_one_work+0xac7/0x1b10
[ 46.315430][ T1478] ? __pfx_process_one_work+0x10/0x10
[ 46.315444][ T1478] ? lock_acquire+0x1d1/0x380
[ 46.315461][ T1478] ? __pfx_hub_event+0x10/0x10
[ 46.315475][ T1478] worker_thread+0x5ef/0xe50
[ 46.315489][ T1478] ? __pfx_worker_thread+0x10/0x10
[ 46.315502][ T1478] ? kthread+0x13a/0x450
[ 46.315513][ T1478] ? __pfx_worker_thread+0x10/0x10
[ 46.315526][ T1478] kthread+0x373/0x450
[ 46.315537][ T1478] ? __pfx_kthread+0x10/0x10
[ 46.315549][ T1478] ret_from_fork+0x730/0xd60
[ 46.315559][ T1478] ? __pfx_ret_from_fork+0x10/0x10
[ 46.315569][ T1478] ? __switch_to+0x800/0x10f0
[ 46.315582][ T1478] ? __pfx_kthread+0x10/0x10
[ 46.315594][ T1478] ret_from_fork_asm+0x1a/0x30
[ 46.315606][ T1478]
[ 46.315610][ T1478]
[ 46.315612][ T1478] Allocated by task 1478:
[ 46.315618][ T1478] kasan_save_stack+0x30/0x50
[ 46.315632][ T1478] kasan_save_track+0x14/0x30
[ 46.315645][ T1478] __kasan_kmalloc+0xaa/0xb0
[ 46.315659][ T1478] __kmalloc_cache_noprof+0x2f8/0x6d0
[ 46.315670][ T1478] usb_set_configuration+0x10d0/0x1dc0
[ 46.315683][ T1478] usb_generic_driver_probe+0xa1/0xe0
[ 46.315695][ T1478] usb_probe_device+0xef/0x400
[ 46.315708][ T1478] really_probe+0x241/0xa60
[ 46.315718][ T1478] __driver_probe_device+0x210/0x460
[ 46.315729][ T1478] driver_probe_device+0x4a/0x140
[ 46.315740][ T1478] __device_attach_driver+0x1df/0x320
[ 46.315751][ T1478] bus_for_each_drv+0x159/0x1e0
[ 46.315766][ T1478] __device_attach+0x1e4/0x4d0
[ 46.315776][ T1478] device_initial_probe+0xaf/0xd0
[ 46.315788][ T1478] bus_probe_device+0x64/0x160
[ 46.315797][ T1478] device_add+0x121d/0x1970
[ 46.315809][ T1478] usb_new_device.part.0+0xcc2/0x1686
[ 46.315823][ T1478] hub_event.cold+0x1e3/0xe90
[ 46.315836][ T1478] process_one_work+0xac7/0x1b10
[ 46.315848][ T1478] worker_thread+0x5ef/0xe50
[ 46.315860][ T1478] kthread+0x373/0x450
[ 46.315870][ T1478] ret_from_fork+0x730/0xd60
[ 46.315878][ T1478] ret_from_fork_asm+0x1a/0x30
[ 46.315887][ T1478]
[ 46.315889][ T1478] Freed by task 1478:
[ 46.315893][ T1478] kasan_save_stack+0x30/0x50
[ 46.315907][ T1478] kasan_save_track+0x14/0x30
[ 46.315921][ T1478] kasan_save_free_info+0x3b/0x70
[ 46.315931][ T1478] __kasan_slab_free+0x5f/0x80
[ 46.315946][ T1478] kfree+0x22b/0x6d0
[ 46.315955][ T1478] device_release+0xd2/0x270
[ 46.315969][ T1478] kobject_put+0x1f7/0x640
[ 46.315980][ T1478] put_device+0x1f/0x30
[ 46.315994][ T1478] v4l2_device_disconnect+0x60/0xc0
[ 46.316009][ T1478] usbtv_video_free+0x25/0x30
[ 46.316024][ T1478] usbtv_disconnect+0x58/0xa0
[ 46.316037][ T1478] usb_unbind_interface+0x1dd/0x9e0
[ 46.316051][ T1478] device_remove+0x12a/0x180
[ 46.316061][ T1478] device_release_driver_internal+0x44e/0x620
[ 46.316073][ T1478] bus_remove_device+0x2bc/0x560
[ 46.316082][ T1478] device_del+0x376/0x9b0
[ 46.316092][ T1478] usb_disable_device+0x367/0x810
[ 46.316104][ T1478] usb_disconnect+0x2e2/0x9a0
[ 46.316116][ T1478] hub_event+0x1bb1/0x4420
[ 46.316129][ T1478] process_one_work+0xac7/0x1b10
[ 46.316141][ T1478] worker_thread+0x5ef/0xe50
[ 46.316152][ T1478] kthread+0x373/0x450
[ 46.316162][ T1478] ret_from_fork+0x730/0xd60
[ 46.316171][ T1478] ret_from_fork_asm+0x1a/0x30
[ 46.316179][ T1478]
[ 46.316182][ T1478] The buggy address belongs to the object at ffff888027009000
[ 46.316182][ T1478] which belongs to the cache kmalloc-2k of size 2048
[ 46.316189][ T1478] The buggy address is located 8 bytes inside of
[ 46.316189][ T1478] freed 2048-byte region [ffff888027009000, ffff888027009800)
[ 46.316198][ T1478]
[ 46.316200][ T1478] The buggy address belongs to the physical page:
[ 46.316205][ T1478] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x27008
[ 46.316214][ T1478] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 46.316222][ T1478] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 46.316231][ T1478] page_type: f5(slab)
[ 46.316243][ T1478] raw: 00fff00000000040 ffff88801d042f00 dead000000000100 dead000000000122
[ 46.316252][ T1478] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 46.316261][ T1478] head: 00fff00000000040 ffff88801d042f00 dead000000000100 dead000000000122
[ 46.316269][ T1478] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 46.316278][ T1478] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 46.316286][ T1478] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 46.316291][ T1478] page dumped because: kasan: bad access detected
[ 46.316296][ T1478] page_owner tracks the page as allocated
[ 46.316299][ T1478] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 4573068104
[ 46.316315][ T1478] post_alloc_hook+0xfd/0x120
[ 46.316325][ T1478] get_page_from_freelist+0x110d/0x35d0
[ 46.316337][ T1478] __alloc_frozen_pages_noprof+0x2eb/0x3300
[ 46.316349][ T1478] new_slab+0xa9/0x6e0
[ 46.316360][ T1478] refill_objects+0xe3/0x410
[ 46.316371][ T1478] __pcs_replace_empty_main+0x35e/0x650
[ 46.316382][ T1478] __kmalloc_cache_noprof+0x4f4/0x6d0
[ 46.316392][ T1478] serial_base_ctrl_add+0x48/0x1c0
[ 46.316406][ T1478] serial_core_register_port+0x3a3/0x1690
[ 46.316419][ T1478] serial8250_register_8250_port+0x16c7/0x2440
[ 46.316435][ T1478] serial_pnp_probe+0x443/0x950
[ 46.316443][ T1478] pnp_device_probe+0x2b3/0x4a0
[ 46.316455][ T1478] really_probe+0x241/0xa60
[ 46.316465][ T1478] __driver_probe_device+0x210/0x460
[ 46.316476][ T1478] driver_probe_device+0x4a/0x140
[ 46.316487][ T1478] __driver_attach+0x21f/0x5b0
[ 46.316497][ T1478] page_owner free stack trace missing
[ 46.316501][ T1478]
[ 46.316503][ T1478] Memory state around the buggy address:
[ 46.316507][ T1478] ffff888027008f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 46.316514][ T1478] ffff888027008f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 46.316520][ T1478] >ffff888027009000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 46.316526][ T1478] ^
[ 46.316530][ T1478] ffff888027009080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 46.316537][ T1478] ffff888027009100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 46.316542][ T1478] ==================================================================
[ 46.316585][ T1478] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 46.571018][ T1478] CPU: 1 UID: 0 PID: 1478 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(full)
[ 46.573912][ T1478] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 46.577033][ T1478] Workqueue: usb_hub_wq hub_event
[ 46.578614][ T1478] Call Trace:
[ 46.579674][ T1478]
[ 46.580620][ T1478] dump_stack_lvl+0x100/0x190
[ 46.582123][ T1478] vpanic+0x553/0x970
[ 46.583386][ T1478] ? __pfx_vpanic+0x10/0x10
[ 46.584832][ T1478] ? rcu_is_watching+0x13/0xc0
[ 46.586339][ T1478] ? trace_irq_enable.constprop.0+0x122/0x160
[ 46.588230][ T1478] ? usb_unbind_interface+0x935/0x9e0
[ 46.589918][ T1478] panic+0xd1/0xe0
[ 46.591101][ T1478] ? __pfx_panic+0x10/0x10
[ 46.592519][ T1478] ? trace_irq_enable.constprop.0+0x2f/0x160
[ 46.594395][ T1478] check_panic_on_warn.cold+0x19/0x34
[ 46.596067][ T1478] end_report.part.0+0x3a/0x90
[ 46.597576][ T1478] kasan_report.cold+0xe/0x18
[ 46.599029][ T1478] ? usb_unbind_interface+0x935/0x9e0
[ 46.600726][ T1478] usb_unbind_interface+0x935/0x9e0
[ 46.602371][ T1478] ? __pfx_usb_unbind_interface+0x10/0x10
[ 46.604166][ T1478] device_remove+0x12a/0x180
[ 46.605635][ T1478] device_release_driver_internal+0x44e/0x620
[ 46.607535][ T1478] bus_remove_device+0x2bc/0x560
[ 46.609096][ T1478] ? __pfx_bus_remove_device+0x10/0x10
[ 46.610800][ T1478] ? __pfx_device_remove_attrs+0x10/0x10
[ 46.612580][ T1478] device_del+0x376/0x9b0
[ 46.613952][ T1478] ? __pfx_device_del+0x10/0x10
[ 46.615489][ T1478] ? __pfx___pm_runtime_barrier+0x10/0x10
[ 46.617278][ T1478] ? lock_acquire+0x1d1/0x380
[ 46.618750][ T1478] usb_disable_device+0x367/0x810
[ 46.620291][ T1478] ? mark_held_locks+0x40/0x70
[ 46.621788][ T1478] usb_disconnect+0x2e2/0x9a0
[ 46.623261][ T1478] hub_event+0x1bb1/0x4420
[ 46.624695][ T1478] ? __lock_acquire+0x5c0/0x1f40
[ 46.626235][ T1478] ? __pfx_hub_event+0x10/0x10
[ 46.627729][ T1478] ? down_read_trylock+0x180/0x440
[ 46.629338][ T1478] ? lock_acquire+0x1d1/0x380
[ 46.630812][ T1478] ? process_one_work+0xa2c/0x1b10
[ 46.632413][ T1478] ? process_one_work+0x906/0x1b10
[ 46.634024][ T1478] ? process_one_work+0x906/0x1b10
[ 46.635622][ T1478] process_one_work+0xac7/0x1b10
[ 46.637183][ T1478] ? __pfx_process_one_work+0x10/0x10
[ 46.638856][ T1478] ? lock_acquire+0x1d1/0x380
[ 46.640343][ T1478] ? __pfx_hub_event+0x10/0x10
[ 46.641847][ T1478] worker_thread+0x5ef/0xe50
[ 46.643306][ T1478] ? __pfx_worker_thread+0x10/0x10
[ 46.644917][ T1478] ? kthread+0x13a/0x450
[ 46.646248][ T1478] ? __pfx_worker_thread+0x10/0x10
[ 46.647847][ T1478] kthread+0x373/0x450
[ 46.649125][ T1478] ? __pfx_kthread+0x10/0x10
[ 46.650534][ T1478] ret_from_fork+0x730/0xd60
[ 46.651975][ T1478] ? __pfx_ret_from_fork+0x10/0x10
[ 46.653551][ T1478] ? __switch_to+0x800/0x10f0
[ 46.654986][ T1478] ? __pfx_kthread+0x10/0x10
[ 46.656394][ T1478] ret_from_fork_asm+0x1a/0x30
[ 46.657862][ T1478]
[ 46.659392][ T1478] Kernel Offset: disabled
[ 46.660722][ T1478] Rebooting in 86400 seconds..