ci-upstream-kasan-gce/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci-upstream-kasan-gce/syz-executor2747344160

<...>
Warning: Permanently added '10.128.1.75' (ED25519) to the list of known hosts.
execve("ci-upstream-kasan-gce/syz-executor2747344160", ["ci-upstream-kasan-gce/syz-executor2747344160"], 0x7ffd7e426550 /* 10 vars */) = 0
brk(NULL)                               = 0x55557100f000
brk(0x55557100fd80)                     = 0x55557100fd80
arch_prctl(ARCH_SET_FS, 0x55557100f400) = 0
set_tid_address(0x55557100f6d0)         = 5649
set_robust_list(0x55557100f6e0, 24)     = 0
rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci-upstream-kasan-gce/syz-executor2747344160", 4096) = 50
getrandom("\xb9\x1c\xe0\x8c\x54\xcd\x6f\x8c", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x55557100fd80
brk(0x555571030d80)                     = 0x555571030d80
brk(0x555571031000)                     = 0x555571031000
mprotect(0x7fc542330000, 20480, PROT_READ) = 0
mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000
mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000
mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000
write(1, "executing program\n", 18)     = 18
executing program
openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3
ioctl(3, USB_RAW_IOCTL_INIT, 0x7ffcb3082630) = 0
ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcb3082630) = 0
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcb3082630) = 0
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcb3082630) = 0
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcb3082630) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffcb3081620) = 18
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcb3082630) = 0
[   82.153603][  T990] usb 1-1: new high-speed USB device number 2 using dummy_hcd
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcb3082630) = 0
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcb3082630) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffcb3081620) = 18
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcb3082630) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffcb3081620) = 9
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcb3082630) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffcb3081620) = 18
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcb3082630) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffcb3081620) = 4
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcb3082630) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffcb3081620) = 8
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcb3082630) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffcb3081620) = 8
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcb3082630) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffcb3081620) = 8
[   82.314889][  T990] usb 1-1: New USB device found: idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b
[   82.318600][  T990] usb 1-1: config 0 has an invalid interface number: 1 but max is 0
[   82.318614][  T990] usb 1-1: config 0 has no interface number 0
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcb3082630) = 0
ioctl(3, USB_RAW_IOCTL_VBUS_DRAW, 0)    = 0
ioctl(3, USB_RAW_IOCTL_CONFIGURE, 0)    = 0
ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffcb3081620) = 0
[   82.378807][  T990] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   82.378831][  T990] usb 1-1: Product: syz
[   82.378843][  T990] usb 1-1: Manufacturer: syz
[   82.378855][  T990] usb 1-1: SerialNumber: syz
[   82.382552][  T990] usb 1-1: config 0 descriptor??
ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcb3082670) = 0
ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffcb3081660) = 1
[   82.630372][  T990] usb 1-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state
[   82.642787][  T990] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer
[   82.643077][  T990] dvbdev: DVB: registering new adapter (E3C EC168 reference design)
[   82.643115][  T990] usb 1-1: media controller created
[   82.674616][  T990] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
openat(AT_FDCWD, "/dev/i2c-1", O_RDWR|O_APPEND) = 4
[   83.774143][  T990] i2c i2c-1: ec100: i2c rd failed=-110 reg=33
[   83.774230][ T5649] ==================================================================
[   83.774243][ T5649] BUG: KASAN: slab-out-of-bounds in ec168_i2c_xfer+0x4d4/0x630
[   83.774272][ T5649] Read of size 1 at addr ffff888036fc5da1 by task syz-executor274/5649
[   83.774284][ T5649] 
[   83.774303][ T5649] CPU: 0 UID: 0 PID: 5649 Comm: syz-executor274 Not tainted syzkaller #0 PREEMPT(full) 
[   83.774336][ T5649] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
[   83.774364][ T5649] Call Trace:
[   83.774371][ T5649]  <TASK>
[   83.774379][ T5649]  dump_stack_lvl+0xe8/0x150
[   83.774408][ T5649]  print_address_description+0x55/0x1e0
[   83.774433][ T5649]  ? ec168_i2c_xfer+0x4d4/0x630
[   83.774464][ T5649]  print_report+0x58/0x70
[   83.774487][ T5649]  kasan_report+0x117/0x150
[   83.774505][ T5649]  ? ec168_i2c_xfer+0x4d4/0x630
[   83.774530][ T5649]  ec168_i2c_xfer+0x4d4/0x630
[   83.774555][ T5649]  __i2c_transfer+0x7bf/0x1fe0
[   83.774584][ T5649]  ? rt_mutex_lock_nested+0x15a/0x1c0
[   83.774606][ T5649]  ? i2c_transfer+0xc7/0x2d0
[   83.774627][ T5649]  i2c_transfer+0x1cb/0x2d0
[   83.774650][ T5649]  i2cdev_ioctl_rdwr+0x460/0x740
[   83.774671][ T5649]  i2cdev_ioctl+0x6a5/0x880
[   83.774696][ T5649]  ? __pfx_i2cdev_ioctl+0x10/0x10
[   83.774726][ T5649]  ? bpf_lsm_file_ioctl+0x9/0x20
[   83.774751][ T5649]  ? __pfx_i2cdev_ioctl+0x10/0x10
[   83.774776][ T5649]  __se_sys_ioctl+0xfc/0x170
[   83.774804][ T5649]  do_syscall_64+0x16a/0x530
[   83.774827][ T5649]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   83.774845][ T5649]  ? clear_bhb_loop+0x70/0xc0
[   83.774865][ T5649]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   83.774883][ T5649] RIP: 0033:0x7fc5422a0989
[   83.774905][ T5649] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48
[   83.774920][ T5649] RSP: 002b:00007ffcb3083688 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[   83.774944][ T5649] RAX: ffffffffffffffda RBX: 00007ffcb30837b8 RCX: 00007fc5422a0989
[   83.774956][ T5649] RDX: 0000200000000140 RSI: 0000000000000707 RDI: 0000000000000004
[   83.774968][ T5649] RBP: 0000000000000001 R08: 0000000000000000 R09: 00007ffcb30837b8
[   83.774979][ T5649] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcb30837a8
[   83.774991][ T5649] R13: 0000000000000002 R14: 00007fc542330ca0 R15: 0000000000000002
[   83.775011][ T5649]  </TASK>
[   83.775017][ T5649] 
[   83.775021][ T5649] Allocated by task 5649:
[   83.775030][ T5649]  kasan_save_track+0x3e/0x80
[   83.775052][ T5649]  __kasan_kmalloc+0x93/0xb0
[   83.775075][ T5649]  __kmalloc_node_track_caller_noprof+0x4af/0x720
[   83.775097][ T5649]  memdup_user+0x2b/0xd0
[   83.775115][ T5649]  i2cdev_ioctl_rdwr+0x1c6/0x740
[   83.775129][ T5649]  i2cdev_ioctl+0x6a5/0x880
[   83.775152][ T5649]  __se_sys_ioctl+0xfc/0x170
[   83.775174][ T5649]  do_syscall_64+0x16a/0x530
[   83.775194][ T5649]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   83.775210][ T5649] 
[   83.775214][ T5649] The buggy address belongs to the object at ffff888036fc5da0
[   83.775214][ T5649]  which belongs to the cache kmalloc-8 of size 8
[   83.775229][ T5649] The buggy address is located 0 bytes to the right of
[   83.775229][ T5649]  allocated 1-byte region [ffff888036fc5da0, ffff888036fc5da1)
[   83.775247][ T5649] 
[   83.775251][ T5649] The buggy address belongs to the physical page:
[   83.775268][ T5649] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888036fc5740 pfn:0x36fc5
[   83.775285][ T5649] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
[   83.775301][ T5649] page_type: f5(slab)
[   83.775317][ T5649] raw: 00fff00000000200 ffff88813ff25500 ffffea0000dd4d90 ffffea0000d86e50
[   83.775332][ T5649] raw: ffff888036fc5740 0000000000800065 00000000f5000000 0000000000000000
[   83.775341][ T5649] page dumped because: kasan: bad access detected
[   83.775353][ T5649] page_owner tracks the page as allocated
[   83.775363][ T5649] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 18777803496
[   83.775393][ T5649]  post_alloc_hook+0x1f9/0x250
[   83.775412][ T5649]  get_page_from_freelist+0x2224/0x2290
[   83.775434][ T5649]  __alloc_frozen_pages_noprof+0x1fe/0x410
[   83.775461][ T5649]  allocate_slab+0x7d/0x5e0
[   83.775476][ T5649]  refill_objects+0x2d5/0x350
[   83.775492][ T5649]  __pcs_replace_empty_main+0x2c8/0x6c0
[   83.775507][ T5649]  __kmalloc_node_track_caller_noprof+0x543/0x720
[   83.775528][ T5649]  kstrdup+0x42/0x100
[   83.775544][ T5649]  kobject_set_name_vargs+0x61/0x110
[   83.775559][ T5649]  kobject_init_and_add+0xee/0x1a0
[   83.775574][ T5649]  lookup_or_create_module_kobject+0xe3/0x170
[   83.775599][ T5649]  kernel_add_sysfs_param+0x14/0xe0
[   83.775616][ T5649]  param_sysfs_builtin+0x199/0x250
[   83.775631][ T5649]  param_sysfs_builtin_init+0x23/0x30
[   83.775647][ T5649]  do_one_initcall+0x250/0x870
[   83.775661][ T5649]  do_initcall_level+0x10a/0x1a0
[   83.775679][ T5649] page_owner free stack trace missing
[   83.775685][ T5649] 
[   83.775689][ T5649] Memory state around the buggy address:
[   83.775698][ T5649]  ffff888036fc5c80: fa fc fc fc 00 fc fc fc 00 fc fc fc fa fc fc fc
[   83.775709][ T5649]  ffff888036fc5d00: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
[   83.775721][ T5649] >ffff888036fc5d80: fa fc fc fc 01 fc fc fc 00 fc fc fc fa fc fc fc
[   83.775729][ T5649]                                ^
[   83.775738][ T5649]  ffff888036fc5e00: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
[   83.775749][ T5649]  ffff888036fc5e80: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
[   83.775758][ T5649] ==================================================================
[   83.775772][ T5649] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   84.326143][ T5649] CPU: 0 UID: 0 PID: 5649 Comm: syz-executor274 Not tainted syzkaller #0 PREEMPT(full) 
[   84.335847][ T5649] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
[   84.345889][ T5649] Call Trace:
[   84.349158][ T5649]  <TASK>
[   84.352081][ T5649]  vpanic+0x26f/0x710
[   84.356060][ T5649]  panic+0xc5/0xd0
[   84.359767][ T5649]  ? __pfx_panic+0x10/0x10
[   84.364172][ T5649]  ? ec168_i2c_xfer+0x4d4/0x630
[   84.369013][ T5649]  ? rcu_is_watching+0x16/0xb0
[   84.373775][ T5649]  ? ec168_i2c_xfer+0x4d4/0x630
[   84.378613][ T5649]  check_panic_on_warn+0x89/0xb0
[   84.383536][ T5649]  ? ec168_i2c_xfer+0x4d4/0x630
[   84.388375][ T5649]  end_report+0x73/0x170
[   84.392599][ T5649]  ? ec168_i2c_xfer+0x4d4/0x630
[   84.397435][ T5649]  kasan_report+0x128/0x150
[   84.401922][ T5649]  ? ec168_i2c_xfer+0x4d4/0x630
[   84.406762][ T5649]  ec168_i2c_xfer+0x4d4/0x630
[   84.411432][ T5649]  __i2c_transfer+0x7bf/0x1fe0
[   84.416191][ T5649]  ? rt_mutex_lock_nested+0x15a/0x1c0
[   84.421557][ T5649]  ? i2c_transfer+0xc7/0x2d0
[   84.426136][ T5649]  i2c_transfer+0x1cb/0x2d0
[   84.430632][ T5649]  i2cdev_ioctl_rdwr+0x460/0x740
[   84.435562][ T5649]  i2cdev_ioctl+0x6a5/0x880
[   84.440059][ T5649]  ? __pfx_i2cdev_ioctl+0x10/0x10
[   84.445079][ T5649]  ? bpf_lsm_file_ioctl+0x9/0x20
[   84.450017][ T5649]  ? __pfx_i2cdev_ioctl+0x10/0x10
[   84.455030][ T5649]  __se_sys_ioctl+0xfc/0x170
[   84.459615][ T5649]  do_syscall_64+0x16a/0x530
[   84.464191][ T5649]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   84.470241][ T5649]  ? clear_bhb_loop+0x70/0xc0
[   84.474902][ T5649]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   84.480850][ T5649] RIP: 0033:0x7fc5422a0989
[   84.485255][ T5649] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48
[   84.504845][ T5649] RSP: 002b:00007ffcb3083688 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[   84.513244][ T5649] RAX: ffffffffffffffda RBX: 00007ffcb30837b8 RCX: 00007fc5422a0989
[   84.521202][ T5649] RDX: 0000200000000140 RSI: 0000000000000707 RDI: 0000000000000004
[   84.529155][ T5649] RBP: 0000000000000001 R08: 0000000000000000 R09: 00007ffcb30837b8
[   84.537109][ T5649] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcb30837a8
[   84.545065][ T5649] R13: 0000000000000002 R14: 00007fc542330ca0 R15: 0000000000000002
[   84.553029][ T5649]  </TASK>
[   84.556434][ T5649] Kernel Offset: disabled
[   84.560780][ T5649] Rebooting in 86400 seconds..