ci2-android-6-1/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-6-1/syz-executor2993557203
<...>
Warning: Permanently added '10.128.1.170' (ED25519) to the list of known hosts.
execve("ci2-android-6-1/syz-executor2993557203", ["ci2-android-6-1/syz-executor2993557203"], 0x7fff5e463d30 /* 10 vars */) = 0
brk(NULL) = 0x555566913000
brk(0x555566913d40) = 0x555566913d40
arch_prctl(ARCH_SET_FS, 0x5555669133c0) = 0
set_tid_address(0x555566913690) = 304
set_robust_list(0x5555669136a0, 24) = 0
rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented)
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-6-1/syz-executor2993557203", 4096) = 44
getrandom("\xc0\x20\xdc\x4b\xd4\x05\x76\x63", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x555566913d40
brk(0x555566934d40) = 0x555566934d40
brk(0x555566935000) = 0x555566935000
mprotect(0x7f9dcc275000, 20480, PROT_READ) = 0
mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000
mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000
mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000
write(1, "executing program\n", 18) = 18
mkdir("./config", 0777) = 0
mount(NULL, "./config", "configfs", 0, NULL) = 0
mkdir("./config/usb_gadget/g2", 0777) = 0
rmdir("./config/usb_gadget/g2") = 0
mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0
executing program
[ 31.569080][ T28] audit: type=1400 audit(1789624831.825:64): avc: denied { execmem } for pid=304 comm="syz-executor299" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 31.591069][ T304] ==================================================================
[ 31.594953][ T28] audit: type=1400 audit(1789624831.825:65): avc: denied { mounton } for pid=304 comm="syz-executor299" path="/root/config" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1
[ 31.599173][ T304] BUG: KASAN: use-after-free in kobject_get+0x113/0x120
[ 31.599229][ T304] Read of size 1 at addr ffff88811024603c by task syz-executor299/304
[ 31.623077][ T28] audit: type=1400 audit(1789624831.825:66): avc: denied { mount } for pid=304 comm="syz-executor299" name="/" dev="configfs" ino=12872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1
[ 31.629009][ T304]
[ 31.629018][ T304] CPU: 0 PID: 304 Comm: syz-executor299 Not tainted syzkaller #0
[ 31.629037][ T304] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 31.629065][ T304] Call Trace:
[ 31.637808][ T28] audit: type=1400 audit(1789624831.825:67): avc: denied { search } for pid=304 comm="syz-executor299" name="/" dev="configfs" ino=12872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 31.660342][ T304]
[ 31.660354][ T304] __dump_stack+0x21/0x24
[ 31.660389][ T304] dump_stack_lvl+0x110/0x170
[ 31.660416][ T304] ? __cfi_dump_stack_lvl+0x8/0x8
[ 31.664178][ T28] audit: type=1400 audit(1789624831.825:68): avc: denied { write } for pid=304 comm="syz-executor299" name="usb_gadget" dev="configfs" ino=12873 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 31.670478][ T304] ? __cfi__printk+0x8/0x8
[ 31.670508][ T304] ? kobject_get+0x113/0x120
[ 31.681218][ T28] audit: type=1400 audit(1789624831.825:69): avc: denied { add_name } for pid=304 comm="syz-executor299" name="g2" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 31.683872][ T304] print_address_description+0x71/0x200
[ 31.707079][ T28] audit: type=1400 audit(1789624831.825:70): avc: denied { create } for pid=304 comm="syz-executor299" name="g2" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1
[ 31.709308][ T304] print_report+0x4a/0x60
[ 31.709339][ T304] kasan_report+0x122/0x150
[ 31.714329][ T28] audit: type=1400 audit(1789624831.825:71): avc: denied { remove_name } for pid=304 comm="syz-executor299" name="g2" dev="configfs" ino=14761 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 31.718358][ T304] ? kobject_get+0x113/0x120
[ 31.723883][ T28] audit: type=1400 audit(1789624831.825:72): avc: denied { rmdir } for pid=304 comm="syz-executor299" name="g2" dev="configfs" ino=14761 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 31.746472][ T304] ? kasan_save_alloc_info+0x1f/0x30
[ 31.746502][ T304] __asan_report_load1_noabort+0x14/0x20
[ 31.746522][ T304] kobject_get+0x113/0x120
[ 31.746540][ T304] device_add+0x2f0/0xec0
[ 31.880546][ T304] device_create+0x26c/0x300
[ 31.889840][ T304] ? __cfi_device_create+0x10/0x10
[ 31.894970][ T304] create_function_device+0x60/0x70
[ 31.900206][ T304] f_midi_alloc_inst+0x1a8/0x380
[ 31.905444][ T304] usb_get_function_instance+0xf3/0x310
[ 31.911017][ T304] function_make+0x118/0x360
[ 31.915629][ T304] ? __cfi_function_make+0x10/0x10
[ 31.920754][ T304] ? __cfi_mutex_lock+0x10/0x10
[ 31.925623][ T304] ? __kasan_kmalloc+0x95/0xb0
[ 31.930396][ T304] ? configfs_mkdir+0x444/0x9e0
[ 31.935256][ T304] ? __kmalloc+0xb4/0x1e0
[ 31.939589][ T304] ? __kasan_check_write+0x14/0x20
[ 31.944733][ T304] configfs_mkdir+0x518/0x9e0
[ 31.949415][ T304] vfs_mkdir+0x39c/0x580
[ 31.953662][ T304] do_mkdirat+0x174/0x4d0
[ 31.957994][ T304] __x64_sys_mkdirat+0x89/0xa0
[ 31.962763][ T304] x64_sys_call+0x73d/0x9a0
[ 31.967276][ T304] do_syscall_64+0x4c/0xa0
[ 31.971758][ T304] ? clear_bhb_loop+0x30/0x80
[ 31.976544][ T304] ? clear_bhb_loop+0x30/0x80
[ 31.981248][ T304] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 31.987168][ T304] RIP: 0033:0x7f9dcc1e4c79
[ 31.991600][ T304] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48
[ 32.011932][ T304] RSP: 002b:00007fffd0cf5df8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
[ 32.020465][ T304] RAX: ffffffffffffffda RBX: 0000200000000100 RCX: 00007f9dcc1e4c79
[ 32.028444][ T304] RDX: 00000000000001ff RSI: 0000200000000100 RDI: 00000000ffffff9c
[ 32.036531][ T304] RBP: 0032672f74656764 R08: 0000000000000000 R09: 0000000000000000
[ 32.044509][ T304] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffd0cf5f38
[ 32.052598][ T304] R13: 0000000000000002 R14: 00007f9dcc275ca0 R15: 0000000000000002
[ 32.060672][ T304]
[ 32.063690][ T304]
[ 32.066023][ T304] Allocated by task 304:
[ 32.070365][ T304] kasan_set_track+0x4b/0x70
[ 32.074974][ T304] kasan_save_alloc_info+0x1f/0x30
[ 32.080101][ T304] __kasan_kmalloc+0x95/0xb0
[ 32.084710][ T304] kmalloc_trace+0x40/0xb0
[ 32.090881][ T304] device_create+0x13a/0x300
[ 32.095491][ T304] gadgets_make+0x84a/0xad0
[ 32.100027][ T304] configfs_mkdir+0x518/0x9e0
[ 32.104707][ T304] vfs_mkdir+0x39c/0x580
[ 32.109046][ T304] do_mkdirat+0x174/0x4d0
[ 32.113400][ T304] __x64_sys_mkdir+0x6e/0x80
[ 32.117996][ T304] x64_sys_call+0x966/0x9a0
[ 32.122509][ T304] do_syscall_64+0x4c/0xa0
[ 32.126937][ T304] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 32.132831][ T304]
[ 32.135152][ T304] Freed by task 304:
[ 32.139038][ T304] kasan_set_track+0x4b/0x70
[ 32.143633][ T304] kasan_save_free_info+0x2b/0x40
[ 32.148667][ T304] ____kasan_slab_free+0x132/0x180
[ 32.153789][ T304] __kasan_slab_free+0x11/0x20
[ 32.158565][ T304] slab_free_freelist_hook+0xc2/0x190
[ 32.163957][ T304] __kmem_cache_free+0xb7/0x1b0
[ 32.168824][ T304] kfree+0x6f/0xf0
[ 32.172542][ T304] device_create_release+0x15/0x20
[ 32.177650][ T304] device_release+0xa4/0x1d0
[ 32.182249][ T304] kobject_put+0x19d/0x280
[ 32.186670][ T304] device_destroy+0xb4/0xf0
[ 32.191286][ T304] gadgets_drop+0xa0/0xd0
[ 32.196140][ T304] configfs_rmdir+0x89b/0x980
[ 32.200846][ T304] vfs_rmdir+0x381/0x4f0
[ 32.205091][ T304] do_rmdir+0x261/0x6b0
[ 32.209269][ T304] __x64_sys_rmdir+0x49/0x50
[ 32.213871][ T304] x64_sys_call+0x68e/0x9a0
[ 32.218373][ T304] do_syscall_64+0x4c/0xa0
[ 32.222793][ T304] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 32.228689][ T304]
[ 32.231030][ T304] The buggy address belongs to the object at ffff888110246000
[ 32.231030][ T304] which belongs to the cache kmalloc-1k of size 1024
[ 32.245085][ T304] The buggy address is located 60 bytes inside of
[ 32.245085][ T304] 1024-byte region [ffff888110246000, ffff888110246400)
[ 32.258362][ T304]
[ 32.260690][ T304] The buggy address belongs to the physical page:
[ 32.267107][ T304] page:ffffea0004409000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x110240
[ 32.277347][ T304] head:ffffea0004409000 order:3 compound_mapcount:0 compound_pincount:0
[ 32.285667][ T304] flags: 0x4000000000010200(slab|head|zone=1)
[ 32.291777][ T304] raw: 4000000000010200 ffffea0004410400 dead000000000002 ffff888100043080
[ 32.300358][ T304] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[ 32.308934][ T304] page dumped because: kasan: bad access detected
[ 32.315348][ T304] page_owner tracks the page as allocated
[ 32.321053][ T304] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 91, tgid 91 (klogd), ts 5717214312, free_ts 0
[ 32.340502][ T304] post_alloc_hook+0x1f5/0x210
[ 32.345297][ T304] prep_new_page+0x1c/0x110
[ 32.349824][ T304] get_page_from_freelist+0x2ca9/0x2d20
[ 32.355379][ T304] __alloc_pages+0x1fa/0x610
[ 32.359972][ T304] alloc_slab_page+0x6e/0xf0
[ 32.364575][ T304] new_slab+0x98/0x3e0
[ 32.368648][ T304] ___slab_alloc+0x70f/0xb70
[ 32.373257][ T304] __slab_alloc+0x5e/0xa0
[ 32.377620][ T304] __kmem_cache_alloc_node+0x204/0x2d0
[ 32.383099][ T304] __kmalloc_node_track_caller+0xa1/0x1e0
[ 32.388813][ T304] __alloc_skb+0x226/0x4a0
[ 32.393235][ T304] alloc_skb_with_frags+0xa8/0x620
[ 32.398345][ T304] sock_alloc_send_pskb+0x87f/0x9a0
[ 32.403547][ T304] unix_dgram_sendmsg+0x5c1/0x1710
[ 32.408660][ T304] __sys_sendto+0x4ac/0x660
[ 32.413173][ T304] __x64_sys_sendto+0xe5/0x100
[ 32.417942][ T304] page_owner free stack trace missing
[ 32.423325][ T304]
[ 32.425653][ T304] Memory state around the buggy address:
[ 32.431279][ T304] ffff888110245f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 32.439769][ T304] ffff888110245f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 32.448081][ T304] >ffff888110246000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 32.456130][ T304] ^
[ 32.462021][ T304] ffff888110246080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 32.470078][ T304] ffff888110246100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 32.478322][ T304] ==================================================================
[ 32.487038][ T304] Disabling lock debugging due to kernel taint
[ 32.494841][ T304] ------------[ cut here ]------------
[ 32.495866][ T28] audit: type=1400 audit(1789624832.745:73): avc: denied { read } for pid=84 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1
[ 32.500354][ T304] refcount_t: addition on 0; use-after-free.
[ 32.528718][ T304] WARNING: CPU: 0 PID: 304 at lib/refcount.c:25 refcount_warn_saturate+0x104/0x1a0
[ 32.538022][ T304] Modules linked in:
[ 32.542047][ T304] CPU: 0 PID: 304 Comm: syz-executor299 Tainted: G B syzkaller #0
[ 32.551287][ T304] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 32.561384][ T304] RIP: 0010:refcount_warn_saturate+0x104/0x1a0
[ 32.567572][ T304] Code: 05 01 48 c7 c7 00 15 ca 85 e8 b8 c8 d8 fe 0f 0b eb df e8 ef 42 08 ff c6 05 ff 81 26 05 01 48 c7 c7 40 14 ca 85 e8 9c c8 d8 fe <0f> 0b eb c3 e8 d3 42 08 ff c6 05 e4 81 26 05 01 48 c7 c7 a0 14 ca
[ 32.587232][ T304] RSP: 0018:ffffc90000dd7a18 EFLAGS: 00010246
[ 32.593447][ T304] RAX: 2d4165e011800300 RBX: 0000000000000002 RCX: ffff88810fa03cc0
[ 32.601463][ T304] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
[ 32.609487][ T304] RBP: ffffc90000dd7a28 R08: ffffc90000dd7727 R09: 1ffff920001baee4
[ 32.617476][ T304] R10: dffffc0000000000 R11: fffff520001baee5 R12: 1ffff11022048d0e
[ 32.625653][ T304] R13: dffffc0000000000 R14: 0000000000000002 R15: 0000000000000000
[ 32.633673][ T304] FS: 00005555669133c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
[ 32.642673][ T304] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 32.649320][ T304] CR2: 00007fe16df966e8 CR3: 0000000122683000 CR4: 00000000003506b0
[ 32.657310][ T304] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 32.665334][ T304] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 32.673368][ T304] Call Trace:
[ 32.676649][ T304]
[ 32.679615][ T304] kobject_get+0xfb/0x120
[ 32.683974][ T304] device_add+0x2f0/0xec0
[ 32.688319][ T304] device_create+0x26c/0x300
[ 32.692967][ T304] ? __cfi_device_create+0x10/0x10
[ 32.698132][ T304] create_function_device+0x60/0x70
[ 32.703392][ T304] f_midi_alloc_inst+0x1a8/0x380
[ 32.708358][ T304] usb_get_function_instance+0xf3/0x310
[ 32.713966][ T304] function_make+0x118/0x360
[ 32.718616][ T304] ? __cfi_function_make+0x10/0x10
[ 32.723737][ T304] ? __cfi_mutex_lock+0x10/0x10
[ 32.728702][ T304] ? __kasan_kmalloc+0x95/0xb0
[ 32.733598][ T304] ? configfs_mkdir+0x444/0x9e0
[ 32.738451][ T304] ? __kmalloc+0xb4/0x1e0
[ 32.742846][ T304] ? __kasan_check_write+0x14/0x20
[ 32.748134][ T304] configfs_mkdir+0x518/0x9e0
[ 32.752857][ T304] vfs_mkdir+0x39c/0x580
[ 32.757158][ T304] do_mkdirat+0x174/0x4d0
[ 32.761565][ T304] __x64_sys_mkdirat+0x89/0xa0
[ 32.766363][ T304] x64_sys_call+0x73d/0x9a0
[ 32.770930][ T304] do_syscall_64+0x4c/0xa0
[ 32.775464][ T304] ? clear_bhb_loop+0x30/0x80
[ 32.780295][ T304] ? clear_bhb_loop+0x30/0x80
[ 32.785278][ T304] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 32.791235][ T304] RIP: 0033:0x7f9dcc1e4c79
[ 32.795674][ T304] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48
[ 32.815999][ T304] RSP: 002b:00007fffd0cf5df8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
[ 32.824458][ T304] RAX: ffffffffffffffda RBX: 0000200000000100 RCX: 00007f9dcc1e4c79
[ 32.832488][ T304] RDX: 00000000000001ff RSI: 0000200000000100 RDI: 00000000ffffff9c
[ 32.840523][ T304] RBP: 0032672f74656764 R08: 0000000000000000 R09: 0000000000000000
[ 32.848615][ T304] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffd0cf5f38
[ 32.856612][ T304] R13: 0000000000000002 R14: 00007f9dcc275ca0 R15: 0000000000000002
[ 32.864642][ T304]
[ 32.867682][ T304] ---[ end trace 0000000000000000 ]---
[ 32.873274][ T304] ------------[ cut here ]------------
[ 32.878812][ T304] refcount_t: saturated; leaking memory.
[ 32.884540][ T304] WARNING: CPU: 0 PID: 304 at lib/refcount.c:22 refcount_warn_saturate+0x158/0x1a0
[ 32.894031][ T304] Modules linked in:
[ 32.897960][ T304] CPU: 0 PID: 304 Comm: syz-executor299 Tainted: G B W syzkaller #0
[ 32.907421][ T304] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 32.917530][ T304] RIP: 0010:refcount_warn_saturate+0x158/0x1a0
[ 32.923774][ T304] Code: 05 01 48 c7 c7 e0 13 ca 85 e8 64 c8 d8 fe 0f 0b eb 8b e8 9b 42 08 ff c6 05 aa 81 26 05 01 48 c7 c7 e0 13 ca 85 e8 48 c8 d8 fe <0f> 0b e9 6c ff ff ff e8 7c 42 08 ff c6 05 8f 81 26 05 01 48 c7 c7
[ 32.943451][ T304] RSP: 0018:ffffc90000dd78d8 EFLAGS: 00010246
[ 32.949570][ T304] RAX: 2d4165e011800300 RBX: 0000000000000001 RCX: ffff88810fa03cc0
[ 32.957660][ T304] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
[ 32.965692][ T304] RBP: ffffc90000dd78e8 R08: ffff8881f6e2759b R09: 1ffff1103edc4eb3
[ 32.973711][ T304] R10: dffffc0000000000 R11: ffffed103edc4eb4 R12: dffffc0000000000
[ 32.981745][ T304] R13: ffff888110246818 R14: 0000000000000001 R15: 00000000c0000000
[ 32.989799][ T304] FS: 00005555669133c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
[ 32.998802][ T304] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 33.005417][ T304] CR2: 00007fe16df966e8 CR3: 0000000122683000 CR4: 00000000003506b0
[ 33.013461][ T304] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 33.021470][ T304] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 33.029484][ T304] Call Trace:
[ 33.032782][ T304]
[ 33.035719][ T304] kobject_add_internal+0xa81/0xc20
[ 33.040969][ T304] kobject_add+0x165/0x230
[ 33.046075][ T304] ? __cfi_kobject_add+0x10/0x10
[ 33.051086][ T304] ? get_device_parent+0x12e/0x410
[ 33.056242][ T304] device_add+0x398/0xec0
[ 33.060659][ T304] device_create+0x26c/0x300
[ 33.065283][ T304] ? __cfi_device_create+0x10/0x10
[ 33.070451][ T304] create_function_device+0x60/0x70
[ 33.075673][ T304] f_midi_alloc_inst+0x1a8/0x380
[ 33.080668][ T304] usb_get_function_instance+0xf3/0x310
[ 33.086256][ T304] function_make+0x118/0x360
[ 33.090894][ T304] ? __cfi_function_make+0x10/0x10
[ 33.096029][ T304] ? __cfi_mutex_lock+0x10/0x10
[ 33.100955][ T304] ? __kasan_kmalloc+0x95/0xb0
[ 33.105748][ T304] ? configfs_mkdir+0x444/0x9e0
[ 33.110651][ T304] ? __kmalloc+0xb4/0x1e0
[ 33.115013][ T304] ? __kasan_check_write+0x14/0x20
[ 33.120195][ T304] configfs_mkdir+0x518/0x9e0
[ 33.124918][ T304] vfs_mkdir+0x39c/0x580
[ 33.129233][ T304] do_mkdirat+0x174/0x4d0
[ 33.133593][ T304] __x64_sys_mkdirat+0x89/0xa0
[ 33.138372][ T304] x64_sys_call+0x73d/0x9a0
[ 33.142929][ T304] do_syscall_64+0x4c/0xa0
[ 33.147377][ T304] ? clear_bhb_loop+0x30/0x80
[ 33.152094][ T304] ? clear_bhb_loop+0x30/0x80
[ 33.156790][ T304] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 33.162725][ T304] RIP: 0033:0x7f9dcc1e4c79
[ 33.167159][ T304] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48
[ 33.186954][ T304] RSP: 002b:00007fffd0cf5df8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
[ 33.195420][ T304] RAX: ffffffffffffffda RBX: 0000200000000100 RCX: 00007f9dcc1e4c79
[ 33.203461][ T304] RDX: 00000000000001ff RSI: 0000200000000100 RDI: 00000000ffffff9c
[ 33.212026][ T304] RBP: 0032672f74656764 R08: 0000000000000000 R09: 0000000000000000
[ 33.220104][ T304] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffd0cf5f38
[ 33.228113][ T304] R13: 0000000000000002 R14: 00007f9dcc275ca0 R15: 0000000000000002
[ 33.236191][ T304]
[ 33.239259][ T304] ---[ end trace 0000000000000000 ]---
[ 33.245128][ T304] ------------[ cut here ]------------
[ 33.250698][ T304] refcount_t: underflow; use-after-free.
[ 33.256515][ T304] WARNING: CPU: 1 PID: 304 at lib/refcount.c:28 refcount_warn_saturate+0x120/0x1a0
[ 33.266028][ T304] Modules linked in:
[ 33.269999][ T304] CPU: 1 PID: 304 Comm: syz-executor299 Tainted: G B W syzkaller #0
[ 33.279291][ T304] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 33.289579][ T304] RIP: 0010:refcount_warn_saturate+0x120/0x1a0
[ 33.295932][ T304] Code: 05 01 48 c7 c7 40 14 ca 85 e8 9c c8 d8 fe 0f 0b eb c3 e8 d3 42 08 ff c6 05 e4 81 26 05 01 48 c7 c7 a0 14 ca 85 e8 80 c8 d8 fe <0f> 0b eb a7 e8 b7 42 08 ff c6 05 c5 81 26 05 01 48 c7 c7 e0 13 ca
[ 33.316694][ T304] RSP: 0018:ffffc90000dd78a0 EFLAGS: 00010246
[ 33.322820][ T304] RAX: 2d4165e011800300 RBX: 0000000000000003 RCX: ffff88810fa03cc0
[ 33.330984][ T304] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
[ 33.339133][ T304] RBP: ffffc90000dd78b0 R08: ffff8881f6f2759b R09: 1ffff1103ede4eb3
[ 33.347118][ T304] R10: dffffc0000000000 R11: ffffed103ede4eb4 R12: 00000000c0000000
[ 33.355261][ T304] R13: ffff88811024603c R14: 0000000000000003 R15: ffff888110246038
[ 33.363302][ T304] FS: 00005555669133c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
[ 33.372323][ T304] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 33.379146][ T304] CR2: 000055eec9bd8ce0 CR3: 0000000122683000 CR4: 00000000003506a0
[ 33.387141][ T304] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 33.395188][ T304] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 33.403233][ T304] Call Trace:
[ 33.406525][ T304]
[ 33.409514][ T304] kobject_put+0x244/0x280
[ 33.413959][ T304] kobject_add_internal+0x9a2/0xc20
[ 33.419235][ T304] kobject_add+0x165/0x230
[ 33.423680][ T304] ? __cfi_kobject_add+0x10/0x10
[ 33.428679][ T304] ? get_device_parent+0x12e/0x410
[ 33.433822][ T304] device_add+0x398/0xec0
[ 33.438186][ T304] device_create+0x26c/0x300
[ 33.442840][ T304] ? __cfi_device_create+0x10/0x10
[ 33.448199][ T304] create_function_device+0x60/0x70
[ 33.453507][ T304] f_midi_alloc_inst+0x1a8/0x380
[ 33.458567][ T304] usb_get_function_instance+0xf3/0x310
[ 33.464237][ T304] function_make+0x118/0x360
[ 33.468956][ T304] ? __cfi_function_make+0x10/0x10
[ 33.474104][ T304] ? __cfi_mutex_lock+0x10/0x10
[ 33.479015][ T304] ? __kasan_kmalloc+0x95/0xb0
[ 33.483809][ T304] ? configfs_mkdir+0x444/0x9e0
[ 33.488719][ T304] ? __kmalloc+0xb4/0x1e0
[ 33.493098][ T304] ? __kasan_check_write+0x14/0x20
[ 33.498236][ T304] configfs_mkdir+0x518/0x9e0
[ 33.502975][ T304] vfs_mkdir+0x39c/0x580
[ 33.507250][ T304] do_mkdirat+0x174/0x4d0
[ 33.511653][ T304] __x64_sys_mkdirat+0x89/0xa0
[ 33.516446][ T304] x64_sys_call+0x73d/0x9a0
[ 33.521026][ T304] do_syscall_64+0x4c/0xa0
[ 33.525481][ T304] ? clear_bhb_loop+0x30/0x80
[ 33.530243][ T304] ? clear_bhb_loop+0x30/0x80
[ 33.534951][ T304] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 33.540944][ T304] RIP: 0033:0x7f9dcc1e4c79
[ 33.545395][ T304] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48
[ 33.565087][ T304] RSP: 002b:00007fffd0cf5df8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
[ 33.573602][ T304] RAX: ffffffffffffffda RBX: 0000200000000100 RCX: 00007f9dcc1e4c79
[ 33.581724][ T304] RDX: 00000000000001ff RSI: 0000200000000100 RDI: 00000000ffffff9c
[ 33.589764][ T304] RBP: 0032672f74656764 R08: 0000000000000000 R09: 0000000000000000
[ 33.597752][ T304] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffd0cf5f38
[ 33.606006][ T304] R13: 0000000000000002 R14: 00007f9dcc275ca0 R15: 0000000000000002
[ 33.614085][ T304]
[ 33.617132][ T304] ---[ end trace 0000000000000000 ]---
mkdirat(AT_FDCWD, "./config/usb_gadget/g1/functions/midi.usb0", 0777) = -1 ENODEV (No such device)
exit_group(0) = ?
+++ exited with 0 +++
[ 33.622710][ T304] kobject_add_internal failed for f_midi (err