last executing test programs: 3.274011669s ago: executing program 3 (id=4): syz_open_dev$video(&(0x7f0000000000), 0x80000001, 0x40c02) io_setup(0x8, &(0x7f0000004200)=0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') io_submit(r0, 0x1, &(0x7f0000004540)=[&(0x7f0000004280)={0x0, 0x0, 0x500, 0x5, 0x0, r1, 0x0}]) 2.751963223s ago: executing program 3 (id=6): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='vhci_hcd.0', 0xa) 1.998202088s ago: executing program 4 (id=5): openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) unshare(0x20000400) pselect6(0x40, &(0x7f0000000100)={0x0, 0x3, 0x0, 0x1, 0x800, 0x8, 0x0, 0x3}, 0x0, &(0x7f0000000240)={0x1f, 0x3, 0x8}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) 895.673998ms ago: executing program 4 (id=7): r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r0, 0x29, 0xc8, 0x0, 0xc000000) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x2, @loopback}, {0xa, 0x4, 0x0, @mcast2}, 0x1, {[0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x100]}}, 0x5c) setsockopt$MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, &(0x7f0000000300)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0xfffffffc, @mcast2}, 0x1, {[0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xfff]}}, 0x5c) 895.51161ms ago: executing program 1 (id=2): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x94, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}]}, 0x94}, 0x1, 0x0, 0x0, 0x4041}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={0x98, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa, 0x0, 0x5}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x4}]}, 0x98}}, 0x0) 583.81012ms ago: executing program 1 (id=8): r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x33, &(0x7f0000000000)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x1}]}, 0x10) bind$inet6(r0, &(0x7f0000000340)={0xa, 0x4e20, 0x409, @ipv4={'\x00', '\xff\xff', @empty}, 0x80ab}, 0x1c) 568.266259ms ago: executing program 4 (id=9): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6(0xa, 0x3, 0x2) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0xfff}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 0s ago: executing program 1 (id=10): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000e80)={0x44, r0, 0x801, 0x400, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_KEY={0x28, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "4abee33957edf8aaae14574df4"}, @NL80211_KEY_IDX={0x5, 0x2, 0x2}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac08}]}]}, 0x44}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.195' (ED25519) to the list of known hosts. [ 91.635647][ T5587] cgroup: Unknown subsys name 'net' [ 91.878227][ T5587] cgroup: Unknown subsys name 'cpuset' [ 91.930467][ T5587] cgroup: Unknown subsys name 'rlimit' [ 92.276759][ T10] cfg80211: failed to load regulatory.db Setting up swapspace version 1, size = 127995904 bytes [ 94.103873][ T5587] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 97.094505][ T5615] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 97.125350][ T5617] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 97.126943][ T5617] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 97.158504][ T5621] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 97.164245][ T5615] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 97.172242][ T5615] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 97.192872][ T5621] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 97.193935][ T5615] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 97.195671][ T5621] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 97.196227][ T5617] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 97.208915][ T5621] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 97.216461][ T5621] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 97.218199][ T5621] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 97.228163][ T5617] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 97.256406][ T4915] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 97.280346][ T4915] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 97.280831][ T4915] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 97.282514][ T4915] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 97.295479][ T4915] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 97.296713][ T4915] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 97.318553][ T60] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 97.335036][ T5616] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 97.351227][ T5617] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 97.354778][ T5616] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 97.360637][ T5611] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 99.462500][ T5616] Bluetooth: hci0: command tx timeout [ 99.539867][ T5617] Bluetooth: hci1: command tx timeout [ 99.540046][ T5616] Bluetooth: hci4: command tx timeout [ 99.619848][ T5617] Bluetooth: hci2: command tx timeout [ 99.620046][ T5616] Bluetooth: hci3: command tx timeout [ 100.407714][ T5604] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.409440][ T5604] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.409594][ T5604] bridge_slave_0: entered allmulticast mode [ 100.418920][ T5604] bridge_slave_0: entered promiscuous mode [ 100.444177][ T5605] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.444334][ T5605] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.448568][ T5605] bridge_slave_0: entered allmulticast mode [ 100.452518][ T5605] bridge_slave_0: entered promiscuous mode [ 100.458232][ T5603] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.458554][ T5603] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.477036][ T5603] bridge_slave_0: entered allmulticast mode [ 100.510486][ T5603] bridge_slave_0: entered promiscuous mode [ 100.555299][ T5604] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.555424][ T5604] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.555971][ T5604] bridge_slave_1: entered allmulticast mode [ 100.557948][ T5604] bridge_slave_1: entered promiscuous mode [ 100.559022][ T5605] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.559144][ T5605] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.559272][ T5605] bridge_slave_1: entered allmulticast mode [ 100.569384][ T5605] bridge_slave_1: entered promiscuous mode [ 100.591518][ T5603] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.591894][ T5603] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.595858][ T5603] bridge_slave_1: entered allmulticast mode [ 100.608172][ T5603] bridge_slave_1: entered promiscuous mode [ 100.611868][ T5602] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.612293][ T5602] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.613713][ T5602] bridge_slave_0: entered allmulticast mode [ 100.629296][ T5602] bridge_slave_0: entered promiscuous mode [ 100.733729][ T5602] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.733899][ T5602] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.734041][ T5602] bridge_slave_1: entered allmulticast mode [ 100.736011][ T5602] bridge_slave_1: entered promiscuous mode [ 100.737734][ T5601] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.737854][ T5601] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.737979][ T5601] bridge_slave_0: entered allmulticast mode [ 100.753671][ T5601] bridge_slave_0: entered promiscuous mode [ 100.863818][ T5601] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.863935][ T5601] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.864067][ T5601] bridge_slave_1: entered allmulticast mode [ 100.866063][ T5601] bridge_slave_1: entered promiscuous mode [ 100.880540][ T5604] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.914120][ T5605] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.930341][ T5603] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.977342][ T5604] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.996663][ T5605] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.999387][ T5603] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.021079][ T5602] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.099175][ T5602] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.115940][ T5601] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.202254][ T5601] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.204624][ T5604] team0: Port device team_slave_0 added [ 101.206984][ T5605] team0: Port device team_slave_0 added [ 101.209433][ T5603] team0: Port device team_slave_0 added [ 101.270753][ T5604] team0: Port device team_slave_1 added [ 101.272847][ T5605] team0: Port device team_slave_1 added [ 101.274850][ T5603] team0: Port device team_slave_1 added [ 101.276958][ T5602] team0: Port device team_slave_0 added [ 101.359481][ T5602] team0: Port device team_slave_1 added [ 101.367953][ T5601] team0: Port device team_slave_0 added [ 101.435541][ T5601] team0: Port device team_slave_1 added [ 101.436896][ T5604] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.436908][ T5604] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.436928][ T5604] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.453635][ T5605] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.453685][ T5605] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.453767][ T5605] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.477447][ T5603] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.477510][ T5603] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.477598][ T5603] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.539833][ T5616] Bluetooth: hci0: command tx timeout [ 101.605366][ T5604] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.605382][ T5604] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.605402][ T5604] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.606547][ T5605] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.606559][ T5605] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.606578][ T5605] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.607701][ T5603] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.607711][ T5603] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.607731][ T5603] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.609557][ T5602] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.609568][ T5602] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.609587][ T5602] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.620034][ T5616] Bluetooth: hci4: command tx timeout [ 101.620118][ T5616] Bluetooth: hci1: command tx timeout [ 101.699893][ T5617] Bluetooth: hci3: command tx timeout [ 101.699933][ T5617] Bluetooth: hci2: command tx timeout [ 101.841266][ T5602] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.841282][ T5602] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.841302][ T5602] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 102.381691][ T5601] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 102.381707][ T5601] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.381727][ T5601] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 102.437692][ T5601] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 102.437707][ T5601] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.437728][ T5601] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 102.634580][ T5604] hsr_slave_0: entered promiscuous mode [ 102.635842][ T5604] hsr_slave_1: entered promiscuous mode [ 102.655026][ T5605] hsr_slave_0: entered promiscuous mode [ 102.656062][ T5605] hsr_slave_1: entered promiscuous mode [ 102.657686][ T5605] debugfs: 'hsr0' already exists in 'hsr' [ 102.657787][ T5605] Cannot create hsr debugfs directory [ 102.688271][ T5603] hsr_slave_0: entered promiscuous mode [ 102.689263][ T5603] hsr_slave_1: entered promiscuous mode [ 102.701942][ T5603] debugfs: 'hsr0' already exists in 'hsr' [ 102.701965][ T5603] Cannot create hsr debugfs directory [ 102.753617][ T5602] hsr_slave_0: entered promiscuous mode [ 102.754577][ T5602] hsr_slave_1: entered promiscuous mode [ 102.755309][ T5602] debugfs: 'hsr0' already exists in 'hsr' [ 102.755328][ T5602] Cannot create hsr debugfs directory [ 102.813473][ T5601] hsr_slave_0: entered promiscuous mode [ 102.815229][ T5601] hsr_slave_1: entered promiscuous mode [ 102.815912][ T5601] debugfs: 'hsr0' already exists in 'hsr' [ 102.815931][ T5601] Cannot create hsr debugfs directory [ 103.620100][ T5616] Bluetooth: hci0: command tx timeout [ 103.699965][ T5616] Bluetooth: hci1: command tx timeout [ 103.700003][ T5616] Bluetooth: hci4: command tx timeout [ 103.780031][ T5616] Bluetooth: hci2: command tx timeout [ 103.780052][ T5617] Bluetooth: hci3: command tx timeout [ 103.937965][ T5604] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 104.003421][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.022978][ T5604] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 104.065787][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.079099][ T5604] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 104.105937][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.132393][ T5604] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 104.168784][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.304113][ T5602] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 104.353368][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.373565][ T5602] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 104.413931][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.416414][ T5602] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 104.455856][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.484403][ T5602] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 104.515869][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.690915][ T5601] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 104.741418][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.753214][ T5601] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 104.785574][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.798385][ T5601] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 104.823779][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.858007][ T5601] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 104.894154][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 105.093338][ T5605] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 105.137147][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 105.153938][ T5605] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 105.194639][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 105.207432][ T5605] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 105.233193][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 105.273793][ T5605] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 105.316490][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 105.463008][ T5604] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.565107][ T5603] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 105.593880][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 105.608676][ T5603] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 105.645873][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 105.680081][ T5603] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 105.701866][ T5617] Bluetooth: hci0: command tx timeout [ 105.725661][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 105.742617][ T5603] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 105.780048][ T5617] Bluetooth: hci4: command tx timeout [ 105.780061][ T5616] Bluetooth: hci1: command tx timeout [ 105.786073][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 105.850958][ T5604] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.859934][ T5617] Bluetooth: hci3: command tx timeout [ 105.859988][ T5616] Bluetooth: hci2: command tx timeout [ 105.875730][ T5602] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.933362][ T1523] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.934379][ T1523] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.007013][ T1523] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.007135][ T1523] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.082062][ T5602] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.131961][ T1135] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.132123][ T1135] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.162993][ T5601] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.205611][ T1135] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.205952][ T1135] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.328525][ T5601] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.398484][ T1412] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.398645][ T1412] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.437342][ T5605] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.489478][ T1523] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.500056][ T1523] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.646837][ T5605] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.716313][ T5603] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.733062][ T1435] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.733174][ T1435] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.871738][ T1135] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.871882][ T1135] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.002176][ T5603] 8021q: adding VLAN 0 to HW filter on device team0 [ 107.074870][ T1435] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.075162][ T1435] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.210886][ T1435] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.211028][ T1435] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.947040][ T5604] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.101455][ T5602] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.663300][ T5602] veth0_vlan: entered promiscuous mode [ 108.744659][ T5601] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.798390][ T5602] veth1_vlan: entered promiscuous mode [ 109.169329][ T5602] veth0_macvtap: entered promiscuous mode [ 109.206402][ T5605] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.236660][ T5604] veth0_vlan: entered promiscuous mode [ 109.252017][ T5602] veth1_macvtap: entered promiscuous mode [ 109.268574][ T5601] veth0_vlan: entered promiscuous mode [ 109.286894][ T5603] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.326398][ T5604] veth1_vlan: entered promiscuous mode [ 109.345132][ T5601] veth1_vlan: entered promiscuous mode [ 109.372040][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.415818][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.476470][ T1523] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.505584][ T1523] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.528863][ T1523] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.554061][ T1523] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.641475][ T5605] veth0_vlan: entered promiscuous mode [ 109.673310][ T5604] veth0_macvtap: entered promiscuous mode [ 109.767439][ T5601] veth0_macvtap: entered promiscuous mode [ 109.796165][ T5603] veth0_vlan: entered promiscuous mode [ 109.798835][ T5604] veth1_macvtap: entered promiscuous mode [ 109.880081][ T5605] veth1_vlan: entered promiscuous mode [ 109.885987][ T5601] veth1_macvtap: entered promiscuous mode [ 110.022485][ T5603] veth1_vlan: entered promiscuous mode [ 110.107452][ T5604] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.125243][ T1135] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.125288][ T1135] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.153305][ T5601] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.198148][ T5604] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.243035][ T5601] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.282650][ T1435] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.334949][ T1435] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.355819][ T1435] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.383810][ T1435] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.389194][ T5605] veth0_macvtap: entered promiscuous mode [ 110.416048][ T1435] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.429257][ T1435] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.433954][ T1412] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.434017][ T1412] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.458875][ T1435] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.524745][ T1435] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.544077][ T5605] veth1_macvtap: entered promiscuous mode [ 110.594187][ T5603] veth0_macvtap: entered promiscuous mode [ 110.778861][ T5603] veth1_macvtap: entered promiscuous mode [ 111.168239][ T5605] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.410562][ T5605] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.441204][ T5603] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.459438][ T1435] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.459458][ T1435] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.642371][ T5603] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.642785][ T1435] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.668167][ T1435] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.684849][ T1435] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.685538][ T1504] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.685556][ T1504] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.722636][ T1435] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.775482][ T43] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.779340][ T43] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.836236][ T43] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.893606][ T43] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.896522][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.896543][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.151821][ T5801] vhci_hcd vhci_hcd.0: remove, state 4 [ 112.152058][ T5801] usb usb34: USB disconnect, device number 1 [ 112.205031][ T56] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.205055][ T56] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.158534][ T1523] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.158562][ T1523] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.501589][ T5801] vhci_hcd vhci_hcd.0: USB bus 34 deregistered [ 113.503777][ T1523] vhci_hcd vhci_hcd.0: stop threads [ 113.503795][ T1523] vhci_hcd vhci_hcd.0: release socket [ 113.503824][ T1523] vhci_hcd vhci_hcd.0: disconnect device [ 113.503871][ T1523] vhci_hcd vhci_hcd.0: stop threads [ 113.503881][ T1523] vhci_hcd vhci_hcd.0: release socket [ 113.503903][ T1523] vhci_hcd vhci_hcd.0: disconnect device [ 113.503934][ T1523] vhci_hcd vhci_hcd.0: stop threads [ 113.503944][ T1523] vhci_hcd vhci_hcd.0: release socket [ 113.503966][ T1523] vhci_hcd vhci_hcd.0: disconnect device [ 113.503997][ T1523] vhci_hcd vhci_hcd.0: stop threads [ 113.504007][ T1523] vhci_hcd vhci_hcd.0: release socket [ 113.504029][ T1523] vhci_hcd vhci_hcd.0: disconnect device [ 113.504060][ T1523] vhci_hcd vhci_hcd.0: stop threads [ 113.504071][ T1523] vhci_hcd vhci_hcd.0: release socket [ 113.504093][ T1523] vhci_hcd vhci_hcd.0: disconnect device [ 113.504135][ T1523] vhci_hcd vhci_hcd.0: stop threads [ 113.504145][ T1523] vhci_hcd vhci_hcd.0: release socket [ 113.504170][ T1523] vhci_hcd vhci_hcd.0: disconnect device [ 113.504208][ T1523] vhci_hcd vhci_hcd.0: stop threads [ 113.504220][ T1523] vhci_hcd vhci_hcd.0: release socket [ 113.504246][ T1523] vhci_hcd vhci_hcd.0: disconnect device [ 113.504305][ T1523] vhci_hcd vhci_hcd.0: stop threads [ 113.504317][ T1523] vhci_hcd vhci_hcd.0: release socket [ 113.504346][ T1523] vhci_hcd vhci_hcd.0: disconnect device [ 113.883628][ T5801] vhci_hcd vhci_hcd.0: remove, state 4 [ 113.883686][ T5801] usb usb33: USB disconnect, device number 1 [ 114.058914][ T1504] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.058943][ T1504] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.518472][ T2172] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.518495][ T2172] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.588783][ T5801] vhci_hcd vhci_hcd.0: USB bus 33 deregistered [ 114.591725][ T43] vhci_hcd vhci_hcd.0: stop threads [ 114.591769][ T43] vhci_hcd vhci_hcd.0: release socket [ 114.591864][ T43] vhci_hcd vhci_hcd.0: disconnect device [ 114.591939][ T43] vhci_hcd vhci_hcd.0: stop threads [ 114.591951][ T43] vhci_hcd vhci_hcd.0: release socket [ 114.592016][ T43] vhci_hcd vhci_hcd.0: disconnect device [ 114.592144][ T43] vhci_hcd vhci_hcd.0: stop threads [ 114.592164][ T43] vhci_hcd vhci_hcd.0: release socket [ 114.592191][ T43] vhci_hcd vhci_hcd.0: disconnect device [ 114.592265][ T43] vhci_hcd vhci_hcd.0: stop threads [ 114.592299][ T43] vhci_hcd vhci_hcd.0: release socket [ 114.592372][ T43] vhci_hcd vhci_hcd.0: disconnect device [ 114.592475][ T43] vhci_hcd vhci_hcd.0: stop threads [ 114.592508][ T43] vhci_hcd vhci_hcd.0: release socket [ 114.592583][ T43] vhci_hcd vhci_hcd.0: disconnect device [ 114.720547][ T43] ================================================================== [ 114.720568][ T43] BUG: KASAN: slab-use-after-free in rt_spin_lock+0x83/0x400 [ 114.720630][ T43] Read of size 1 at addr ffff888027e71250 by task kworker/u8:2/43 [ 114.720650][ T43] [ 114.720679][ T43] CPU: 0 UID: 0 PID: 43 Comm: kworker/u8:2 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 114.720711][ T43] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 114.720727][ T43] Workqueue: usbip_event event_handler [ 114.720773][ T43] Call Trace: [ 114.720784][ T43] [ 114.720794][ T43] dump_stack_lvl+0xe8/0x150 [ 114.720834][ T43] print_address_description+0x55/0x1e0 [ 114.720872][ T43] ? rt_spin_lock+0x83/0x400 [ 114.720908][ T43] print_report+0x58/0x70 [ 114.720942][ T43] kasan_report+0x117/0x150 [ 114.720983][ T43] ? rt_spin_lock+0x83/0x400 [ 114.721022][ T43] ? event_handler+0x2bc/0x4a0 [ 114.721051][ T43] __kasan_check_byte+0x2a/0x40 [ 114.721078][ T43] lock_acquire+0x84/0x350 [ 114.721106][ T43] ? _dev_info+0x11e/0x180 [ 114.721132][ T43] rt_spin_lock+0x83/0x400 [ 114.721166][ T43] ? event_handler+0x2bc/0x4a0 [ 114.721198][ T43] ? __pfx_rt_spin_lock+0x10/0x10 [ 114.721240][ T43] event_handler+0x2bc/0x4a0 [ 114.721274][ T43] ? process_scheduled_works+0xa20/0x14e0 [ 114.721306][ T43] process_scheduled_works+0xa8e/0x14e0 [ 114.721351][ T43] ? __pfx_process_scheduled_works+0x10/0x10 [ 114.721384][ T43] ? assign_work+0x3cf/0x5d0 [ 114.721415][ T43] worker_thread+0xa47/0xfb0 [ 114.721466][ T43] kthread+0x388/0x470 [ 114.721501][ T43] ? __pfx_worker_thread+0x10/0x10 [ 114.721531][ T43] ? __pfx_kthread+0x10/0x10 [ 114.721567][ T43] ret_from_fork+0x514/0xb70 [ 114.721607][ T43] ? __pfx_ret_from_fork+0x10/0x10 [ 114.721643][ T43] ? __switch_to+0xc89/0x1420 [ 114.721677][ T43] ? __pfx_kthread+0x10/0x10 [ 114.721712][ T43] ret_from_fork_asm+0x1a/0x30 [ 114.721745][ T43] [ 114.721754][ T43] [ 114.721790][ T43] Allocated by task 1: [ 114.721802][ T43] kasan_save_track+0x3e/0x80 [ 114.721824][ T43] __kasan_kmalloc+0x93/0xb0 [ 114.721847][ T43] __kmalloc_noprof+0x41a/0x780 [ 114.721871][ T43] __usb_create_hcd+0x67/0x900 [ 114.721901][ T43] vhci_hcd_probe+0x104/0x3f0 [ 114.721930][ T43] platform_probe+0xf9/0x190 [ 114.721956][ T43] really_probe+0x254/0xae0 [ 114.722002][ T43] __driver_probe_device+0x1e8/0x360 [ 114.722032][ T43] driver_probe_device+0x4f/0x240 [ 114.722064][ T43] __device_attach_driver+0x270/0x410 [ 114.722096][ T43] bus_for_each_drv+0x25b/0x2f0 [ 114.722126][ T43] __device_attach+0x2c7/0x450 [ 114.722155][ T43] device_initial_probe+0xa1/0xd0 [ 114.722184][ T43] bus_probe_device+0x12d/0x220 [ 114.722207][ T43] device_add+0x7d7/0xb80 [ 114.722232][ T43] platform_device_add+0x4bd/0x860 [ 114.722257][ T43] platform_device_register_full+0x62d/0x710 [ 114.722285][ T43] vhci_hcd_init+0x227/0x370 [ 114.722315][ T43] do_one_initcall+0x250/0x870 [ 114.722333][ T43] do_initcall_level+0x10a/0x1a0 [ 114.722364][ T43] do_initcalls+0x59/0xa0 [ 114.722392][ T43] kernel_init_freeable+0x29d/0x3e0 [ 114.722421][ T43] kernel_init+0x1d/0x1d0 [ 114.722454][ T43] ret_from_fork+0x514/0xb70 [ 114.722490][ T43] ret_from_fork_asm+0x1a/0x30 [ 114.722510][ T43] [ 114.722516][ T43] Freed by task 5801: [ 114.722526][ T43] kasan_save_track+0x3e/0x80 [ 114.722548][ T43] kasan_save_free_info+0x40/0x50 [ 114.722579][ T43] __kasan_slab_free+0x5c/0x80 [ 114.722602][ T43] kfree+0x1c5/0x6c0 [ 114.722620][ T43] vhci_hcd_remove+0xed/0x110 [ 114.722650][ T43] device_release_driver_internal+0x48b/0x880 [ 114.722681][ T43] unbind_store+0x1a4/0x1d0 [ 114.722707][ T43] kernfs_fop_write_iter+0x3a5/0x540 [ 114.722739][ T43] vfs_write+0x61e/0xbb0 [ 114.722767][ T43] ksys_write+0x156/0x270 [ 114.722796][ T43] do_syscall_64+0x174/0x580 [ 114.722824][ T43] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.722847][ T43] [ 114.722854][ T43] Last potentially related work creation: [ 114.722863][ T43] kasan_save_stack+0x3e/0x60 [ 114.722885][ T43] kasan_record_aux_stack+0xbd/0xd0 [ 114.722917][ T43] insert_work+0x3d/0x330 [ 114.722940][ T43] __queue_work+0xd1d/0x10f0 [ 114.722975][ T43] queue_work_on+0x106/0x1d0 [ 114.723004][ T43] unlink1+0x33d/0x3e0 [ 114.723030][ T43] usb_hcd_unlink_urb+0xda/0x1d0 [ 114.723056][ T43] usb_kill_urb+0x10b/0x2f0 [ 114.723090][ T43] hub_quiesce+0x20f/0x320 [ 114.723111][ T43] hub_suspend+0x904/0xad0 [ 114.723133][ T43] usb_suspend_both+0x285/0x1040 [ 114.723174][ T43] usb_runtime_suspend+0x58/0x110 [ 114.723211][ T43] __rpm_callback+0x2d6/0x930 [ 114.723256][ T43] rpm_suspend+0x8a0/0x17a0 [ 114.723285][ T43] __pm_runtime_suspend+0x12c/0x1a0 [ 114.723313][ T43] usb_new_device+0xacf/0x1610 [ 114.723346][ T43] register_root_hub+0x250/0x5c0 [ 114.723377][ T43] usb_add_hcd+0xac7/0xf80 [ 114.723407][ T43] vhci_hcd_probe+0x141/0x3f0 [ 114.723438][ T43] platform_probe+0xf9/0x190 [ 114.723465][ T43] really_probe+0x254/0xae0 [ 114.723496][ T43] __driver_probe_device+0x1e8/0x360 [ 114.723527][ T43] driver_probe_device+0x4f/0x240 [ 114.723559][ T43] __device_attach_driver+0x270/0x410 [ 114.723591][ T43] bus_for_each_drv+0x25b/0x2f0 [ 114.723613][ T43] __device_attach+0x2c7/0x450 [ 114.723643][ T43] device_initial_probe+0xa1/0xd0 [ 114.723673][ T43] bus_probe_device+0x12d/0x220 [ 114.723695][ T43] device_add+0x7d7/0xb80 [ 114.723721][ T43] platform_device_add+0x4bd/0x860 [ 114.723747][ T43] platform_device_register_full+0x62d/0x710 [ 114.723774][ T43] vhci_hcd_init+0x227/0x370 [ 114.723803][ T43] do_one_initcall+0x250/0x870 [ 114.723822][ T43] do_initcall_level+0x10a/0x1a0 [ 114.723850][ T43] do_initcalls+0x59/0xa0 [ 114.723878][ T43] kernel_init_freeable+0x29d/0x3e0 [ 114.723906][ T43] kernel_init+0x1d/0x1d0 [ 114.723938][ T43] ret_from_fork+0x514/0xb70 [ 114.723982][ T43] ret_from_fork_asm+0x1a/0x30 [ 114.724003][ T43] [ 114.724009][ T43] Second to last potentially related work creation: [ 114.724019][ T43] kasan_save_stack+0x3e/0x60 [ 114.724040][ T43] kasan_record_aux_stack+0xbd/0xd0 [ 114.724070][ T43] insert_work+0x3d/0x330 [ 114.724093][ T43] __queue_work+0xd1d/0x10f0 [ 114.724120][ T43] queue_work_on+0x106/0x1d0 [ 114.724149][ T43] usb_hcd_submit_urb+0xa2d/0x1b40 [ 114.724196][ T43] usb_start_wait_urb+0x13f/0x5b0 [ 114.724217][ T43] usb_control_msg+0x234/0x3e0 [ 114.724236][ T43] hub_ext_port_status+0x114/0x810 [ 114.724268][ T43] hub_activate+0x740/0x1b10 [ 114.724293][ T43] process_scheduled_works+0xa8e/0x14e0 [ 114.724319][ T43] worker_thread+0xa47/0xfb0 [ 114.724347][ T43] kthread+0x388/0x470 [ 114.724381][ T43] ret_from_fork+0x514/0xb70 [ 114.724416][ T43] ret_from_fork_asm+0x1a/0x30 [ 114.724436][ T43] [ 114.724442][ T43] The buggy address belongs to the object at ffff888027e70000 [ 114.724442][ T43] which belongs to the cache kmalloc-8k of size 8192 [ 114.724463][ T43] The buggy address is located 4688 bytes inside of [ 114.724463][ T43] freed 8192-byte region [ffff888027e70000, ffff888027e72000) [ 114.724488][ T43] [ 114.724494][ T43] The buggy address belongs to the physical page: [ 114.724522][ T43] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x27e70 [ 114.724546][ T43] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 114.724565][ T43] flags: 0x80000000000040(head|node=0|zone=1) [ 114.724590][ T43] page_type: f5(slab) [ 114.724611][ T43] raw: 0080000000000040 ffff88813ffb2280 dead000000000122 0000000000000000 [ 114.724632][ T43] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 114.724653][ T43] head: 0080000000000040 ffff88813ffb2280 dead000000000122 0000000000000000 [ 114.724673][ T43] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 114.724693][ T43] head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 114.724712][ T43] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 114.724724][ T43] page dumped because: kasan: bad access detected [ 114.724740][ T43] page_owner tracks the page as allocated [ 114.724749][ T43] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 9318303756, free_ts 0 [ 114.724789][ T43] post_alloc_hook+0x1f9/0x250 [ 114.724812][ T43] get_page_from_freelist+0x262a/0x26a0 [ 114.724840][ T43] __alloc_frozen_pages_noprof+0x18d/0x380 [ 114.724867][ T43] allocate_slab+0x79/0x5e0 [ 114.724898][ T43] refill_objects+0x2d8/0x350 [ 114.724931][ T43] __pcs_replace_empty_main+0x330/0x690 [ 114.724962][ T43] __kmalloc_noprof+0x544/0x780 [ 114.724992][ T43] scsi_host_alloc+0x30/0x1200 [ 114.725025][ T43] virtscsi_probe+0x218/0x1180 [ 114.725060][ T43] virtio_dev_probe+0xdf6/0x10c0 [ 114.725081][ T43] really_probe+0x254/0xae0 [ 114.725112][ T43] __driver_probe_device+0x1e8/0x360 [ 114.725143][ T43] driver_probe_device+0x4f/0x240 [ 114.725177][ T43] __driver_attach+0x339/0x600 [ 114.725208][ T43] bus_for_each_dev+0x23e/0x2c0 [ 114.725229][ T43] bus_add_driver+0x348/0x670 [ 114.725252][ T43] page_owner free stack trace missing [ 114.725260][ T43] [ 114.725266][ T43] Memory state around the buggy address: [ 114.725280][ T43] ffff888027e71100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 114.725296][ T43] ffff888027e71180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 114.725313][ T43] >ffff888027e71200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 114.725325][ T43] ^ [ 114.725338][ T43] ffff888027e71280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 114.725353][ T43] ffff888027e71300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 114.725366][ T43] ================================================================== [ 114.789243][ T43] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 114.789325][ T43] CPU: 0 UID: 0 PID: 43 Comm: kworker/u8:2 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 114.789419][ T43] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 114.789612][ T43] Workqueue: usbip_event event_handler [ 114.789692][ T43] Call Trace: [ 114.789701][ T43] [ 114.789711][ T43] vpanic+0x56c/0xa60 [ 114.789738][ T43] ? __pfx_vpanic+0x10/0x10 [ 114.789760][ T43] ? __pfx___schedule+0x10/0x10 [ 114.789786][ T43] panic+0xc5/0xd0 [ 114.789807][ T43] ? __pfx_panic+0x10/0x10 [ 114.789828][ T43] ? preempt_schedule_common+0x82/0xd0 [ 114.789863][ T43] ? rt_spin_lock+0x83/0x400 [ 114.789966][ T43] check_panic_on_warn+0x89/0xb0 [ 114.790033][ T43] ? rt_spin_lock+0x83/0x400 [ 114.790066][ T43] end_report+0x73/0x170 [ 114.790092][ T43] ? rt_spin_lock+0x83/0x400 [ 114.790120][ T43] kasan_report+0x128/0x150 [ 114.790146][ T43] ? rt_spin_lock+0x83/0x400 [ 114.790180][ T43] ? event_handler+0x2bc/0x4a0 [ 114.790204][ T43] __kasan_check_byte+0x2a/0x40 [ 114.790227][ T43] lock_acquire+0x84/0x350 [ 114.790253][ T43] ? _dev_info+0x11e/0x180 [ 114.790277][ T43] rt_spin_lock+0x83/0x400 [ 114.790307][ T43] ? event_handler+0x2bc/0x4a0 [ 114.790334][ T43] ? __pfx_rt_spin_lock+0x10/0x10 [ 114.790370][ T43] event_handler+0x2bc/0x4a0 [ 114.790399][ T43] ? process_scheduled_works+0xa20/0x14e0 [ 114.790425][ T43] process_scheduled_works+0xa8e/0x14e0 [ 114.790466][ T43] ? __pfx_process_scheduled_works+0x10/0x10 [ 114.790495][ T43] ? assign_work+0x3cf/0x5d0 [ 114.790523][ T43] worker_thread+0xa47/0xfb0 [ 114.790564][ T43] kthread+0x388/0x470 [ 114.790597][ T43] ? __pfx_worker_thread+0x10/0x10 [ 114.790622][ T43] ? __pfx_kthread+0x10/0x10 [ 114.790655][ T43] ret_from_fork+0x514/0xb70 [ 114.790693][ T43] ? __pfx_ret_from_fork+0x10/0x10 [ 114.790725][ T43] ? __switch_to+0xc89/0x1420 [ 114.790754][ T43] ? __pfx_kthread+0x10/0x10 [ 114.790786][ T43] ret_from_fork_asm+0x1a/0x30 [ 114.790816][ T43] [ 114.791415][ T43] Kernel Offset: disabled