35.498624][ T30] audit: type=1400 audit(1791142481.258:74): avc: denied { write } for pid=2953 comm="sh" path="pipe:[2313]" dev="pipefs" ino=2313 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1
[ 35.502003][ T30] audit: type=1400 audit(1791142481.258:75): avc: denied { rlimitinh } for pid=2953 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
Warning: Permanently added '10.128.0.174' (ED25519) to the list of known hosts.
2026/10/04 19:34:57 parsed 1 programs
[ 52.132684][ T30] kauditd_printk_skb: 1 callbacks suppressed
[ 52.133040][ T30] audit: type=1400 audit(1791142497.908:77): avc: denied { node_bind } for pid=2985 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1
[ 52.138791][ T30] audit: type=1400 audit(1791142497.908:78): avc: denied { module_request } for pid=2985 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1
2026/10/04 19:34:58 serving rpc on tcp://45599
[ 55.360348][ T30] audit: type=1400 audit(1791142501.128:79): avc: denied { mounton } for pid=2994 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 55.376284][ T30] audit: type=1400 audit(1791142501.128:80): avc: denied { mount } for pid=2994 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 55.387115][ T2994] cgroup: Unknown subsys name 'net'
[ 55.393997][ T30] audit: type=1400 audit(1791142501.168:81): avc: denied { unmount } for pid=2994 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 55.534446][ T2994] cgroup: Unknown subsys name 'cpuset'
[ 55.542845][ T2994] cgroup: Unknown subsys name 'rlimit'
[ 55.718049][ T30] audit: type=1400 audit(1791142501.488:82): avc: denied { setattr } for pid=2994 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 55.725033][ T30] audit: type=1400 audit(1791142501.498:83): avc: denied { create } for pid=2994 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 55.725218][ T30] audit: type=1400 audit(1791142501.498:84): avc: denied { write } for pid=2994 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 55.726833][ T30] audit: type=1400 audit(1791142501.498:85): avc: denied { read } for pid=2994 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 55.810740][ T30] audit: type=1400 audit(1791142501.578:86): avc: denied { sys_module } for pid=2994 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1
Setting up swapspace version 1, size = 127995904 bytes
[ 55.934398][ T3000] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped).
[ 55.960984][ T2994] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 57.522369][ T30] kauditd_printk_skb: 8 callbacks suppressed
[ 57.522425][ T30] audit: type=1400 audit(1791142503.288:95): avc: denied { execmem } for pid=3001 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 57.584703][ T30] audit: type=1400 audit(1791142503.358:96): avc: denied { read } for pid=3006 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 57.606195][ T30] audit: type=1400 audit(1791142503.358:97): avc: denied { open } for pid=3006 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 57.629576][ T30] audit: type=1400 audit(1791142503.388:98): avc: denied { mounton } for pid=3006 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1
[ 57.794689][ T30] audit: type=1400 audit(1791142503.558:99): avc: denied { mounton } for pid=3006 comm="syz-executor" path="/root/syzkaller.qOc8lN/syz-tmp" dev="sda1" ino=2043 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1
[ 57.794774][ T30] audit: type=1400 audit(1791142503.568:100): avc: denied { mount } for pid=3006 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1
[ 57.821686][ T30] audit: type=1400 audit(1791142503.568:101): avc: denied { mounton } for pid=3006 comm="syz-executor" path="/root/syzkaller.qOc8lN/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1
[ 57.836727][ T30] audit: type=1400 audit(1791142503.598:102): avc: denied { mount } for pid=3006 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1
[ 57.859538][ T30] audit: type=1400 audit(1791142503.618:103): avc: denied { mounton } for pid=3006 comm="syz-executor" path="/root/syzkaller.qOc8lN/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1
[ 57.880449][ T30] audit: type=1400 audit(1791142503.648:104): avc: denied { mounton } for pid=3006 comm="syz-executor" path="/root/syzkaller.qOc8lN/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=2546 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1
[ 58.211122][ T3007] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
2026/10/04 19:35:19 executed programs: 0
2026/10/04 19:36:11 executed programs: 10
[ 125.436256][ T30] kauditd_printk_skb: 17 callbacks suppressed
[ 125.436305][ T30] audit: type=1400 audit(1791142571.208:122): avc: denied { read write } for pid=5769 comm="syz.6.18" name="raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 125.436367][ T30] audit: type=1400 audit(1791142571.208:123): avc: denied { open } for pid=5769 comm="syz.6.18" path="/dev/raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 125.441053][ T30] audit: type=1400 audit(1791142571.208:124): avc: denied { ioctl } for pid=5769 comm="syz.6.18" path="/dev/raw-gadget" dev="devtmpfs" ino=236 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 125.703409][ T29] usb 7-1: new high-speed USB device number 2 using dummy_hcd
[ 125.873213][ T29] usb 7-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 125.883776][ T29] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 125.883838][ T29] usb 7-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 125.883893][ T29] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 125.922856][ T3038] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 126.091371][ T11] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 126.102264][ T3038] usb 1-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 126.106178][ T3038] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 126.106367][ T3038] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 126.106544][ T3038] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 126.251367][ T122] usb 4-1: new high-speed USB device number 2 using dummy_hcd
[ 126.291938][ T11] usb 5-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 126.294347][ T11] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 126.294494][ T11] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 126.294643][ T11] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 126.402167][ T122] usb 4-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 126.405252][ T122] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 126.405520][ T122] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 126.405725][ T122] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 126.411468][ T3071] usb 8-1: new high-speed USB device number 2 using dummy_hcd
[ 126.571945][ T3071] usb 8-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 126.577003][ T3071] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 126.577383][ T3071] usb 8-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 126.577659][ T3071] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 128.470585][ T29] usb 7-1: USB disconnect, device number 2
[ 128.687646][ T9] usb 1-1: USB disconnect, device number 2
[ 128.903696][ T11] usb 5-1: USB disconnect, device number 2
[ 129.030136][ T122] usb 4-1: USB disconnect, device number 2
[ 129.058398][ T33] rtsx_usb_ms rtsx_usb_ms.4.auto: Runtime PM usage count underflow!
[ 129.091508][ T29] usb 7-1: new high-speed USB device number 3 using dummy_hcd
[ 129.111699][ T9] usb 1-1: new high-speed USB device number 3 using dummy_hcd
[ 129.208663][ T3071] usb 8-1: USB disconnect, device number 2
[ 129.243320][ T29] usb 7-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 129.248076][ T62] rtsx_usb_ms rtsx_usb_ms.3.auto: Runtime PM usage count underflow!
[ 129.263565][ T9] usb 1-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 129.263665][ T29] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 129.263721][ T29] usb 7-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 129.263785][ T29] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 129.264990][ T9] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 129.265053][ T9] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 129.265175][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 129.431409][ T11] usb 5-1: new high-speed USB device number 3 using dummy_hcd
[ 129.461389][ T122] usb 4-1: new high-speed USB device number 3 using dummy_hcd
[ 129.582102][ T11] usb 5-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 129.585075][ T11] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 129.585329][ T11] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 129.585520][ T11] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 129.615585][ T122] usb 4-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 129.622499][ T122] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 129.622720][ T122] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 129.622930][ T122] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 129.643776][ T3071] usb 8-1: new high-speed USB device number 3 using dummy_hcd
[ 129.801997][ T3071] usb 8-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 129.807196][ T3071] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 129.807414][ T3071] usb 8-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 129.807621][ T3071] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
2026/10/04 19:36:17 executed programs: 20
[ 131.530291][ T29] usb 7-1: USB disconnect, device number 3
[ 131.563130][ T12] rtsx_usb_ms rtsx_usb_ms.2.auto: Runtime PM usage count underflow!
[ 131.769653][ T9] usb 1-1: USB disconnect, device number 3
[ 131.805737][ T12] rtsx_usb_ms rtsx_usb_ms.2.auto: Runtime PM usage count underflow!
[ 131.911412][ T29] usb 7-1: new high-speed USB device number 4 using dummy_hcd
[ 131.974680][ T11] usb 5-1: USB disconnect, device number 3
[ 132.016801][ T168] rtsx_usb_ms rtsx_usb_ms.2.auto: Runtime PM usage count underflow!
[ 132.063639][ T29] usb 7-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 132.069990][ T29] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 132.070150][ T29] usb 7-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 132.070293][ T29] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 132.139028][ T122] usb 4-1: USB disconnect, device number 3
[ 132.161421][ T9] usb 1-1: new high-speed USB device number 4 using dummy_hcd
[ 132.172231][ T33] rtsx_usb_ms rtsx_usb_ms.3.auto: Runtime PM usage count underflow!
[ 132.288986][ T3071] usb 8-1: USB disconnect, device number 3
[ 132.314633][ T9] usb 1-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 132.325893][ T9] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 132.325969][ T9] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 132.326040][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 132.406865][ T62] rtsx_usb_ms rtsx_usb_ms.2.auto: Runtime PM usage count underflow!
[ 132.541440][ T11] usb 5-1: new high-speed USB device number 4 using dummy_hcd
[ 132.542514][ T122] usb 4-1: new high-speed USB device number 4 using dummy_hcd
[ 132.691984][ T122] usb 4-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 132.693586][ T11] usb 5-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 132.697742][ T11] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 132.697959][ T11] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 132.698153][ T11] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 132.701199][ T122] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 132.701635][ T122] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 132.701846][ T122] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 132.764161][ T3071] usb 8-1: new high-speed USB device number 4 using dummy_hcd
[ 132.911905][ T3071] usb 8-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 132.920966][ T3071] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 132.921061][ T3071] usb 8-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 132.923044][ T3071] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 134.623961][ T29] usb 7-1: USB disconnect, device number 4
[ 134.974423][ T5784] usb 5-1: USB disconnect, device number 4
[ 135.001694][ T3071] ==================================================================
[ 135.001712][
** replaying previous printk message **
[ 135.001712][ T3071] BUG: KASAN: slab-use-after-free in rtsx_usb_ms_handle_req+0x17cb/0x1a00
[ 135.001774][ T3071] Read of size 1 at addr ffff8881102fd071 by task kworker/0:3/3071
[ 135.001800][ T3071]
[ 135.001826][ T3071] CPU: 0 UID: 0 PID: 3071 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(lazy)
[ 135.001859][ T3071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[ 135.001883][ T3071] Workqueue: events rtsx_usb_ms_handle_req
[ 135.001922][ T3071] Call Trace:
[ 135.001932][ T3071]
[ 135.001943][ T3071] dump_stack_lvl+0x100/0x190
[ 135.001994][ T3071] print_report+0x13d/0x4b0
[ 135.002036][ T3071] ? __virt_addr_valid+0x239/0x430
[ 135.002085][ T3071] ? rtsx_usb_ms_handle_req+0x17cb/0x1a00
[ 135.002116][ T3071] kasan_report+0xdf/0x1c0
[ 135.002149][ T3071] ? rtsx_usb_ms_handle_req+0x17cb/0x1a00
[ 135.002186][ T3071] rtsx_usb_ms_handle_req+0x17cb/0x1a00
[ 135.002222][ T3071] ? reacquire_held_locks+0xdd/0x1f0
[ 135.002272][ T3071] ? __pfx_rtsx_usb_ms_handle_req+0x10/0x10
[ 135.002309][ T3071] ? process_one_work+0xa2c/0x1b10
[ 135.002362][ T3071] ? process_one_work+0x906/0x1b10
[ 135.002413][ T3071] ? process_one_work+0x906/0x1b10
[ 135.002468][ T3071] process_one_work+0xac7/0x1b10
[ 135.002529][ T3071] ? __pfx_process_one_work+0x10/0x10
[ 135.002583][ T3071] ? lock_acquire+0x1d1/0x380
[ 135.002619][ T3071] ? __pfx_rtsx_usb_ms_handle_req+0x10/0x10
[ 135.002657][ T3071] worker_thread+0x5ef/0xe50
[ 135.002713][ T3071] ? __pfx_worker_thread+0x10/0x10
[ 135.002774][ T3071] ? kthread+0x13a/0x450
[ 135.002819][ T3071] ? __pfx_worker_thread+0x10/0x10
[ 135.002868][ T3071] kthread+0x373/0x450
[ 135.002914][ T3071] ? __pfx_kthread+0x10/0x10
[ 135.002962][ T3071] ret_from_fork+0x69f/0xc90
[ 135.002995][ T3071] ? __pfx_ret_from_fork+0x10/0x10
[ 135.003028][ T3071] ? __switch_to+0x7f6/0x10e0
[ 135.003070][ T3071] ? __switch_to_asm+0x39/0x70
[ 135.003106][ T3071] ? __pfx_kthread+0x10/0x10
[ 135.003153][ T3071] ret_from_fork_asm+0x1a/0x30
[ 135.003205][ T3071]
[ 135.003216][ T3071]
[ 135.003224][ T3071] Allocated by task 62:
[ 135.003242][ T3071] kasan_save_stack+0x30/0x50
[ 135.003269][ T3071] kasan_save_track+0x14/0x30
[ 135.003295][ T3071] __kasan_kmalloc+0x8f/0xa0
[ 135.003340][ T3071] __kmalloc_cache_noprof+0x2d8/0x680
[ 135.003371][ T3071] memstick_check+0x2c1/0x10d0
[ 135.003398][ T3071] process_one_work+0xac7/0x1b10
[ 135.003457][ T3071] worker_thread+0x5ef/0xe50
[ 135.003500][ T3071] kthread+0x373/0x450
[ 135.003549][ T3071] ret_from_fork+0x69f/0xc90
[ 135.003572][ T3071] ret_from_fork_asm+0x1a/0x30
[ 135.003601][ T3071]
[ 135.003607][ T3071] Freed by task 62:
[ 135.003618][ T3071] kasan_save_stack+0x30/0x50
[ 135.003640][ T3071] kasan_save_track+0x14/0x30
[ 135.003662][ T3071] kasan_save_free_info+0x3b/0x70
[ 135.003695][ T3071] __kasan_slab_free+0x43/0x70
[ 135.003719][ T3071] kfree+0x20c/0x650
[ 135.003741][ T3071] memstick_check+0x72b/0x10d0
[ 135.003772][ T3071] process_one_work+0xac7/0x1b10
[ 135.003812][ T3071] worker_thread+0x5ef/0xe50
[ 135.003869][ T3071] kthread+0x373/0x450
[ 135.003907][ T3071] ret_from_fork+0x69f/0xc90
[ 135.003931][ T3071] ret_from_fork_asm+0x1a/0x30
[ 135.003962][ T3071]
[ 135.003968][ T3071] The buggy address belongs to the object at ffff8881102fd000
[ 135.003968][ T3071] which belongs to the cache kmalloc-2k of size 2048
[ 135.004001][ T3071] The buggy address is located 113 bytes inside of
[ 135.004001][ T3071] freed 2048-byte region [ffff8881102fd000, ffff8881102fd800)
[ 135.004027][ T3071]
[ 135.004033][ T3071] The buggy address belongs to the physical page:
[ 135.004055][ T3071] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1102f8
[ 135.004086][ T3071] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 135.004106][ T3071] flags: 0x200000000000040(head|node=0|zone=2)
[ 135.004134][ T3071] page_type: f5(slab)
[ 135.004157][ T3071] raw: 0200000000000040 ffff888100042000 dead000000000100 dead000000000122
[ 135.004185][ T3071] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 135.004210][ T3071] head: 0200000000000040 ffff888100042000 dead000000000100 dead000000000122
[ 135.004234][ T3071] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 135.004258][ T3071] head: 0200000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 135.004281][ T3071] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008
[ 135.004297][ T3071] page dumped because: kasan: bad access detected
[ 135.004309][ T3071] page_owner tracks the page as allocated
[ 135.004317][ T3071] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2000(__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 5089531560
[ 135.004355][ T3071] post_alloc_hook+0xfd/0x120
[ 135.004399][ T3071] get_page_from_freelist+0xf4b/0x3440
[ 135.004424][ T3071] __alloc_frozen_pages_noprof+0x2d7/0x2f70
[ 135.004452][ T3071] new_slab+0xa9/0x6e0
[ 135.004476][ T3071] refill_objects+0xe3/0x410
[ 135.004502][ T3071] __pcs_replace_empty_main+0x35e/0x650
[ 135.004528][ T3071] __kmalloc_cache_noprof+0x4a1/0x680
[ 135.004554][ T3071] device_create_groups_vargs+0x8a/0x270
[ 135.004588][ T3071] device_create+0xed/0x130
[ 135.004616][ T3071] bdi_register_va+0x114/0x820
[ 135.004652][ T3071] bdi_register+0xc7/0x100
[ 135.004687][ T3071] __add_disk+0xa6d/0xe40
[ 135.004721][ T3071] add_disk_fwnode+0x118/0x480
[ 135.004763][ T3071] loop_add+0x90b/0xb60
[ 135.004787][ T3071] loop_init+0x1d3/0x200
[ 135.004809][ T3071] do_one_initcall+0x11c/0x6f0
[ 135.004854][ T3071] page last free pid 24 tgid 24 ts 5082969480 stack trace:
[ 135.004872][ T3071] free_pages_prepare+0x558/0xd20
[ 135.004916][ T3071] __free_contig_range_common.constprop.0+0x12c/0x230
[ 135.004964][ T3071] free_pages_bulk+0x126/0x1f0
[ 135.004991][ T3071] vm_area_free_pages+0xb2/0x2a0
[ 135.005022][ T3071] vfree+0xf7/0x6d0
[ 135.005058][ T3071] delayed_vfree_work+0x56/0x80
[ 135.005097][ T3071] process_one_work+0xac7/0x1b10
[ 135.005140][ T3071] worker_thread+0x5ef/0xe50
[ 135.005183][ T3071] kthread+0x373/0x450
[ 135.005221][ T3071] ret_from_fork+0x69f/0xc90
[ 135.005246][ T3071] ret_from_fork_asm+0x1a/0x30
[ 135.005278][ T3071]
[ 135.005284][ T3071] Memory state around the buggy address:
[ 135.005298][ T3071] ffff8881102fcf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 135.005318][ T3071] ffff8881102fcf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 135.005338][ T3071] >ffff8881102fd000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 135.005354][ T3071] ^
[ 135.005371][ T3071] ffff8881102fd080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 135.005391][ T3071] ffff8881102fd100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 135.005407][ T3071] ==================================================================
[ 135.015799][ T3071] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 135.680173][ T3071] CPU: 0 UID: 0 PID: 3071 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(lazy)
[ 135.689581][ T3071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[ 135.699656][ T3071] Workqueue: events rtsx_usb_ms_handle_req
[ 135.705514][ T3071] Call Trace:
[ 135.708818][ T3071]
[ 135.711790][ T3071] dump_stack_lvl+0x100/0x190
[ 135.716517][ T3071] vpanic+0x553/0x970
[ 135.720540][ T3071] ? __pfx_vpanic+0x10/0x10
[ 135.725080][ T3071] ? rtsx_usb_ms_handle_req+0x17cb/0x1a00
[ 135.730842][ T3071] panic+0xd1/0xe0
[ 135.734603][ T3071] ? __pfx_panic+0x10/0x10
[ 135.739045][ T3071] ? rtsx_usb_ms_handle_req+0x17cb/0x1a00
[ 135.744798][ T3071] ? preempt_schedule_common+0x3c/0xb0
[ 135.750295][ T3071] check_panic_on_warn.cold+0x19/0x34
[ 135.755714][ T3071] end_report.part.0+0x3a/0x90
[ 135.760525][ T3071] kasan_report.cold+0xe/0x18
[ 135.765238][ T3071] ? rtsx_usb_ms_handle_req+0x17cb/0x1a00
[ 135.770995][ T3071] rtsx_usb_ms_handle_req+0x17cb/0x1a00
[ 135.776571][ T3071] ? reacquire_held_locks+0xdd/0x1f0
[ 135.781894][ T3071] ? __pfx_rtsx_usb_ms_handle_req+0x10/0x10
[ 135.787832][ T3071] ? process_one_work+0xa2c/0x1b10
[ 135.792995][ T3071] ? process_one_work+0x906/0x1b10
[ 135.798158][ T3071] ? process_one_work+0x906/0x1b10
[ 135.803330][ T3071] process_one_work+0xac7/0x1b10
[ 135.808332][ T3071] ? __pfx_process_one_work+0x10/0x10
[ 135.813766][ T3071] ? lock_acquire+0x1d1/0x380
[ 135.818487][ T3071] ? __pfx_rtsx_usb_ms_handle_req+0x10/0x10
[ 135.824414][ T3071] worker_thread+0x5ef/0xe50
[ 135.829054][ T3071] ? __pfx_worker_thread+0x10/0x10
[ 135.834222][ T3071] ? kthread+0x13a/0x450
[ 135.838498][ T3071] ? __pfx_worker_thread+0x10/0x10
[ 135.843650][ T3071] kthread+0x373/0x450
[ 135.847759][ T3071] ? __pfx_kthread+0x10/0x10
[ 135.852403][ T3071] ret_from_fork+0x69f/0xc90
[ 135.857032][ T3071] ? __pfx_ret_from_fork+0x10/0x10
[ 135.862167][ T3071] ? __switch_to+0x7f6/0x10e0
[ 135.866897][ T3071] ? __switch_to_asm+0x39/0x70
[ 135.871713][ T3071] ? __pfx_kthread+0x10/0x10
[ 135.876346][ T3071] ret_from_fork_asm+0x1a/0x30
[ 135.881157][ T3071]
[ 135.884752][ T3071] Kernel Offset: disabled
[ 135.889093][ T3071] Rebooting in 86400 seconds..