Warning: Permanently added '10.128.1.173' (ED25519) to the list of known hosts.
2025/09/09 14:06:19 parsed 1 programs
[ 94.968413][ T5867] cgroup: Unknown subsys name 'net'
[ 95.106726][ T5867] cgroup: Unknown subsys name 'cpuset'
[ 95.116141][ T5867] cgroup: Unknown subsys name 'rlimit'
[ 96.900445][ T5867] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 97.523357][ T9] cfg80211: failed to load regulatory.db
[ 100.492115][ T5882] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 101.777432][ T5902] chnl_net:caif_netlink_parms(): no params data found
[ 101.896291][ T5902] bridge0: port 1(bridge_slave_0) entered blocking state
[ 101.905202][ T5902] bridge0: port 1(bridge_slave_0) entered disabled state
[ 101.912955][ T5902] bridge_slave_0: entered allmulticast mode
[ 101.921193][ T5902] bridge_slave_0: entered promiscuous mode
[ 101.931802][ T5902] bridge0: port 2(bridge_slave_1) entered blocking state
[ 101.940044][ T5902] bridge0: port 2(bridge_slave_1) entered disabled state
[ 101.948528][ T5902] bridge_slave_1: entered allmulticast mode
[ 101.956194][ T5902] bridge_slave_1: entered promiscuous mode
[ 101.999946][ T5902] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 102.015211][ T5902] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 102.065398][ T5902] team0: Port device team_slave_0 added
[ 102.074632][ T5902] team0: Port device team_slave_1 added
[ 102.105887][ T5902] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 102.113646][ T5902] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 102.140114][ T5902] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 102.155268][ T5902] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 102.162404][ T5902] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 102.188966][ T5902] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 102.242852][ T5902] hsr_slave_0: entered promiscuous mode
[ 102.249746][ T5902] hsr_slave_1: entered promiscuous mode
[ 102.428146][ T5902] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 102.442898][ T5902] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 102.454382][ T5902] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 102.466098][ T5902] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 102.505299][ T5902] bridge0: port 2(bridge_slave_1) entered blocking state
[ 102.512612][ T5902] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 102.521386][ T5902] bridge0: port 1(bridge_slave_0) entered blocking state
[ 102.528691][ T5902] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 102.600165][ T5902] 8021q: adding VLAN 0 to HW filter on device bond0
[ 102.624255][ T3568] bridge0: port 1(bridge_slave_0) entered disabled state
[ 102.635873][ T3568] bridge0: port 2(bridge_slave_1) entered disabled state
[ 102.656876][ T5902] 8021q: adding VLAN 0 to HW filter on device team0
[ 102.672369][ T3535] bridge0: port 1(bridge_slave_0) entered blocking state
[ 102.679918][ T3535] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 102.697283][ T3535] bridge0: port 2(bridge_slave_1) entered blocking state
[ 102.705608][ T3535] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 102.916014][ T5902] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 102.970405][ T5902] veth0_vlan: entered promiscuous mode
[ 102.985738][ T5902] veth1_vlan: entered promiscuous mode
[ 103.024918][ T5902] veth0_macvtap: entered promiscuous mode
[ 103.036488][ T5902] veth1_macvtap: entered promiscuous mode
[ 103.061319][ T5902] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 103.079220][ T5902] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 103.097763][ T3535] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 103.108157][ T3535] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 103.120439][ T3535] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 103.129795][ T3535] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 103.283524][ T3568] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 103.359988][ T3568] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 103.436374][ T3568] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 103.462007][ T50] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 103.470362][ T50] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 103.505746][ T1165] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 103.517991][ T1165] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 103.537129][ T3568] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 104.509887][ T5949] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 104.521435][ T5949] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 104.530463][ T5949] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 104.540084][ T5949] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 104.548256][ T5949] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 105.655120][ T3568] bridge_slave_1: left allmulticast mode
[ 105.665168][ T3568] bridge_slave_1: left promiscuous mode
[ 105.676774][ T3568] bridge0: port 2(bridge_slave_1) entered disabled state
[ 105.689932][ T3568] bridge_slave_0: left allmulticast mode
[ 105.698332][ T3568] bridge_slave_0: left promiscuous mode
[ 105.719439][ T3568] bridge0: port 1(bridge_slave_0) entered disabled state
[ 106.250810][ T3568] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 106.263725][ T3568] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 106.274388][ T3568] bond0 (unregistering): Released all slaves
[ 106.397882][ T3568] hsr_slave_0: left promiscuous mode
[ 106.404646][ T3568] hsr_slave_1: left promiscuous mode
[ 106.414223][ T3568] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 106.422261][ T3568] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 106.433661][ T3568] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 106.441239][ T3568] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 106.463124][ T3568] veth1_macvtap: left promiscuous mode
[ 106.469200][ T3568] veth0_macvtap: left promiscuous mode
[ 106.475876][ T3568] veth1_vlan: left promiscuous mode
[ 106.481702][ T3568] veth0_vlan: left promiscuous mode
[ 106.975405][ T3568] team0 (unregistering): Port device team_slave_1 removed
[ 107.005602][ T3568] team0 (unregistering): Port device team_slave_0 removed
2025/09/09 14:06:36 executed programs: 0
[ 108.125641][ T5949] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 108.136389][ T5949] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 108.150902][ T5949] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 108.159904][ T5949] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 108.168195][ T5949] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 108.792291][ T6017] chnl_net:caif_netlink_parms(): no params data found
[ 109.056586][ T6017] bridge0: port 1(bridge_slave_0) entered blocking state
[ 109.065971][ T6017] bridge0: port 1(bridge_slave_0) entered disabled state
[ 109.074004][ T6017] bridge_slave_0: entered allmulticast mode
[ 109.083310][ T6017] bridge_slave_0: entered promiscuous mode
[ 109.099804][ T6017] bridge0: port 2(bridge_slave_1) entered blocking state
[ 109.113321][ T6017] bridge0: port 2(bridge_slave_1) entered disabled state
[ 109.123725][ T6017] bridge_slave_1: entered allmulticast mode
[ 109.132261][ T6017] bridge_slave_1: entered promiscuous mode
[ 109.204281][ T6017] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 109.255898][ T6017] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 109.330546][ T6017] team0: Port device team_slave_0 added
[ 109.361587][ T6017] team0: Port device team_slave_1 added
[ 109.413523][ T6017] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 109.420682][ T6017] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 109.449755][ T6017] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 109.494712][ T6017] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 109.502362][ T6017] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 109.531796][ T6017] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 109.639696][ T6017] hsr_slave_0: entered promiscuous mode
[ 109.650092][ T6017] hsr_slave_1: entered promiscuous mode
[ 110.196741][ T6017] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 110.212212][ T6017] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 110.227199][ T6017] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 110.236303][ T5949] Bluetooth: hci0: command tx timeout
[ 110.257277][ T6017] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 110.377173][ T6017] 8021q: adding VLAN 0 to HW filter on device bond0
[ 110.409254][ T6017] 8021q: adding VLAN 0 to HW filter on device team0
[ 110.426813][ T3568] bridge0: port 1(bridge_slave_0) entered blocking state
[ 110.434307][ T3568] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 110.453778][ T50] bridge0: port 2(bridge_slave_1) entered blocking state
[ 110.461069][ T50] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 110.768646][ T6017] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 110.845124][ T6017] veth0_vlan: entered promiscuous mode
[ 110.867567][ T6017] veth1_vlan: entered promiscuous mode
[ 110.915506][ T6017] veth0_macvtap: entered promiscuous mode
[ 110.927864][ T6017] veth1_macvtap: entered promiscuous mode
[ 110.958649][ T6017] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 110.985528][ T6017] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 111.002238][ T1165] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 111.030116][ T1165] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 111.043004][ T1165] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 111.058080][ T1165] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 111.167185][ T1165] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 111.194738][ T1165] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 111.235574][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 111.243920][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 111.551332][ T981] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 111.733660][ T981] usb 1-1: Using ep0 maxpacket: 16
[ 111.747378][ T981] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0
[ 111.765373][ T981] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1
[ 111.777900][ T981] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 111.787268][ T981] usb 1-1: Product: syz
[ 111.793806][ T981] usb 1-1: Manufacturer: syz
[ 111.798561][ T981] usb 1-1: SerialNumber: syz
[ 111.813483][ T981] usb 1-1: config 0 descriptor??
[ 111.844428][ T981] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0)
[ 111.857581][ T981] em28xx 1-1:0.0: DVB interface 0 found: bulk
[ 112.101354][ T981] em28xx 1-1:0.0: unknown em28xx chip ID (0)
[ 112.175940][ T981] em28xx 1-1:0.0: reading from i2c device at 0xa0 failed (error=-5)
[ 112.193568][ T981] em28xx 1-1:0.0: board has no eeprom
[ 112.270874][ T981] em28xx 1-1:0.0: Identified as PCTV tripleStick (292e) (card=94)
[ 112.278860][ T981] em28xx 1-1:0.0: dvb set to bulk mode.
[ 112.291097][ T43] em28xx 1-1:0.0: Binding DVB extension
[ 112.310664][ T981] usb 1-1: USB disconnect, device number 2
[ 112.311300][ T5949] Bluetooth: hci0: command tx timeout
[ 112.318955][ T981] em28xx 1-1:0.0: Disconnecting em28xx
[ 112.376819][ T43] em28xx 1-1:0.0: Registering input extension
[ 112.388959][ T981] em28xx 1-1:0.0: Closing input extension
[ 112.409949][ T981] ==================================================================
[ 112.418113][ T981] BUG: KASAN: slab-use-after-free in media_devnode_unregister+0xe2/0xf0
[ 112.426612][ T981] Read of size 4 at addr ffff888032f8b4f0 by task kworker/1:2/981
[ 112.434462][ T981]
[ 112.437039][ T981] CPU: 1 UID: 0 PID: 981 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(full)
[ 112.437074][ T981] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[ 112.437088][ T981] Workqueue: usb_hub_wq hub_event
[ 112.437126][ T981] Call Trace:
[ 112.437134][ T981]
[ 112.437142][ T981] dump_stack_lvl+0x189/0x250
[ 112.437178][ T981] ? rcu_is_watching+0x15/0xb0
[ 112.437201][ T981] ? __kasan_check_byte+0x12/0x40
[ 112.437224][ T981] ? __pfx_dump_stack_lvl+0x10/0x10
[ 112.437253][ T981] ? rcu_is_watching+0x15/0xb0
[ 112.437275][ T981] ? lock_release+0x4b/0x3e0
[ 112.437298][ T981] ? __virt_addr_valid+0x1c8/0x5c0
[ 112.437328][ T981] ? __virt_addr_valid+0x4a5/0x5c0
[ 112.437358][ T981] print_report+0xca/0x240
[ 112.437378][ T981] ? media_devnode_unregister+0xe2/0xf0
[ 112.437404][ T981] kasan_report+0x118/0x150
[ 112.437427][ T981] ? media_devnode_unregister+0xe2/0xf0
[ 112.437455][ T981] media_devnode_unregister+0xe2/0xf0
[ 112.437481][ T981] media_device_unregister+0x37c/0x400
[ 112.437509][ T981] em28xx_release_resources+0xac/0x240
[ 112.437554][ T981] em28xx_usb_disconnect+0x19f/0x2f0
[ 112.437584][ T981] usb_unbind_interface+0x26e/0x910
[ 112.437611][ T981] ? __pfx_usb_unbind_interface+0x10/0x10
[ 112.437633][ T981] device_release_driver_internal+0x4d6/0x800
[ 112.437664][ T981] bus_remove_device+0x34d/0x410
[ 112.437697][ T981] device_del+0x511/0x8e0
[ 112.437724][ T981] ? __pfx_device_del+0x10/0x10
[ 112.437744][ T981] ? kobject_put+0x446/0x480
[ 112.437779][ T981] usb_disable_device+0x3e9/0x8a0
[ 112.437804][ T981] usb_disconnect+0x330/0x950
[ 112.437837][ T981] hub_event+0x1cf5/0x4a20
[ 112.437871][ T981] ? do_raw_spin_lock+0x121/0x290
[ 112.437900][ T981] ? register_lock_class+0x51/0x320
[ 112.437929][ T981] ? __pfx_hub_event+0x10/0x10
[ 112.437948][ T981] ? process_scheduled_works+0x9ef/0x17b0
[ 112.437975][ T981] ? _raw_spin_unlock_irq+0x23/0x50
[ 112.438001][ T981] ? process_scheduled_works+0x9ef/0x17b0
[ 112.438024][ T981] ? process_scheduled_works+0x9ef/0x17b0
[ 112.438065][ T981] process_scheduled_works+0xae1/0x17b0
[ 112.438104][ T981] ? __pfx_process_scheduled_works+0x10/0x10
[ 112.438136][ T981] worker_thread+0x8a0/0xda0
[ 112.438161][ T981] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 112.438191][ T981] ? __kthread_parkme+0x7b/0x200
[ 112.438222][ T981] kthread+0x711/0x8a0
[ 112.438252][ T981] ? __pfx_worker_thread+0x10/0x10
[ 112.438275][ T981] ? __pfx_kthread+0x10/0x10
[ 112.438304][ T981] ? _raw_spin_unlock_irq+0x23/0x50
[ 112.438328][ T981] ? lockdep_hardirqs_on+0x9c/0x150
[ 112.438356][ T981] ? __pfx_kthread+0x10/0x10
[ 112.438384][ T981] ret_from_fork+0x47c/0x820
[ 112.438409][ T981] ? __pfx_ret_from_fork+0x10/0x10
[ 112.438435][ T981] ? __switch_to_asm+0x39/0x70
[ 112.438455][ T981] ? __switch_to_asm+0x33/0x70
[ 112.438475][ T981] ? __pfx_kthread+0x10/0x10
[ 112.438503][ T981] ret_from_fork_asm+0x1a/0x30
[ 112.438533][ T981]
[ 112.438542][ T981]
[ 112.731998][ T981] Allocated by task 981:
[ 112.736249][ T981] kasan_save_track+0x3e/0x80
[ 112.741029][ T981] __kasan_kmalloc+0x93/0xb0
[ 112.745630][ T981] __kmalloc_cache_noprof+0x3d5/0x6f0
[ 112.751198][ T981] __media_device_register+0x58/0x280
[ 112.757046][ T981] em28xx_usb_probe+0x1764/0x2a20
[ 112.762316][ T981] usb_probe_interface+0x665/0xc30
[ 112.767463][ T981] really_probe+0x26a/0x9e0
[ 112.771987][ T981] __driver_probe_device+0x18c/0x2f0
[ 112.777311][ T981] driver_probe_device+0x4f/0x430
[ 112.782380][ T981] __device_attach_driver+0x2ce/0x530
[ 112.787942][ T981] bus_for_each_drv+0x251/0x2e0
[ 112.792812][ T981] __device_attach+0x2b8/0x400
[ 112.797761][ T981] bus_probe_device+0x185/0x260
[ 112.802918][ T981] device_add+0x7b6/0xb50
[ 112.807266][ T981] usb_set_configuration+0x1a87/0x20e0
[ 112.812824][ T981] usb_generic_driver_probe+0x8d/0x150
[ 112.819162][ T981] usb_probe_device+0x1c1/0x390
[ 112.824026][ T981] really_probe+0x26a/0x9e0
[ 112.828538][ T981] __driver_probe_device+0x18c/0x2f0
[ 112.833882][ T981] driver_probe_device+0x4f/0x430
[ 112.838938][ T981] __device_attach_driver+0x2ce/0x530
[ 112.844493][ T981] bus_for_each_drv+0x251/0x2e0
[ 112.849356][ T981] __device_attach+0x2b8/0x400
[ 112.854220][ T981] bus_probe_device+0x185/0x260
[ 112.859084][ T981] device_add+0x7b6/0xb50
[ 112.863423][ T981] usb_new_device+0xa39/0x16f0
[ 112.868201][ T981] hub_event+0x2958/0x4a20
[ 112.872633][ T981] process_scheduled_works+0xae1/0x17b0
[ 112.878276][ T981] worker_thread+0x8a0/0xda0
[ 112.882905][ T981] kthread+0x711/0x8a0
[ 112.887096][ T981] ret_from_fork+0x47c/0x820
[ 112.891690][ T981] ret_from_fork_asm+0x1a/0x30
[ 112.896462][ T981]
[ 112.898785][ T981] Freed by task 981:
[ 112.902749][ T981] kasan_save_track+0x3e/0x80
[ 112.907428][ T981] __kasan_save_free_info+0x46/0x50
[ 112.912819][ T981] __kasan_slab_free+0x5b/0x80
[ 112.917603][ T981] kfree+0x199/0x6d0
[ 112.921548][ T981] media_devnode_release+0x61/0xa0
[ 112.926706][ T981] device_release+0x9c/0x1c0
[ 112.931310][ T981] kobject_put+0x228/0x480
[ 112.935748][ T981] media_devnode_unregister+0x6d/0xf0
[ 112.941156][ T981] media_device_unregister+0x37c/0x400
[ 112.946649][ T981] em28xx_release_resources+0xac/0x240
[ 112.952188][ T981] em28xx_usb_disconnect+0x19f/0x2f0
[ 112.957756][ T981] usb_unbind_interface+0x26e/0x910
[ 112.962994][ T981] device_release_driver_internal+0x4d6/0x800
[ 112.969252][ T981] bus_remove_device+0x34d/0x410
[ 112.974227][ T981] device_del+0x511/0x8e0
[ 112.978605][ T981] usb_disable_device+0x3e9/0x8a0
[ 112.983651][ T981] usb_disconnect+0x330/0x950
[ 112.988518][ T981] hub_event+0x1cf5/0x4a20
[ 112.993290][ T981] process_scheduled_works+0xae1/0x17b0
[ 112.999060][ T981] worker_thread+0x8a0/0xda0
[ 113.003669][ T981] kthread+0x711/0x8a0
[ 113.008018][ T981] ret_from_fork+0x47c/0x820
[ 113.012874][ T981] ret_from_fork_asm+0x1a/0x30
[ 113.017997][ T981]
[ 113.020416][ T981] The buggy address belongs to the object at ffff888032f8b000
[ 113.020416][ T981] which belongs to the cache kmalloc-2k of size 2048
[ 113.034950][ T981] The buggy address is located 1264 bytes inside of
[ 113.034950][ T981] freed 2048-byte region [ffff888032f8b000, ffff888032f8b800)
[ 113.049763][ T981]
[ 113.052142][ T981] The buggy address belongs to the physical page:
[ 113.058725][ T981] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x32f88
[ 113.067598][ T981] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 113.076211][ T981] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 113.083858][ T981] page_type: f5(slab)
[ 113.088039][ T981] raw: 00fff00000000040 ffff88801a842000 dead000000000100 dead000000000122
[ 113.096797][ T981] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 113.105701][ T981] head: 00fff00000000040 ffff88801a842000 dead000000000100 dead000000000122
[ 113.114404][ T981] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 113.123233][ T981] head: 00fff00000000003 ffffea0000cbe201 00000000ffffffff 00000000ffffffff
[ 113.132207][ T981] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 113.141162][ T981] page dumped because: kasan: bad access detected
[ 113.147772][ T981] page_owner tracks the page as allocated
[ 113.153582][ T981] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5882, tgid 5882 (syz-executor), ts 100442260604, free_ts 100371447343
[ 113.175138][ T981] post_alloc_hook+0x240/0x2a0
[ 113.180112][ T981] get_page_from_freelist+0x21e4/0x22c0
[ 113.185690][ T981] __alloc_frozen_pages_noprof+0x181/0x370
[ 113.191535][ T981] alloc_pages_mpol+0x232/0x4a0
[ 113.196672][ T981] allocate_slab+0x8a/0x330
[ 113.201376][ T981] ___slab_alloc+0xbd1/0x13f0
[ 113.206239][ T981] __slab_alloc+0x55/0xa0
[ 113.210782][ T981] __kmalloc_node_track_caller_noprof+0x5c7/0x800
[ 113.217499][ T981] kmalloc_reserve+0x136/0x290
[ 113.222468][ T981] __alloc_skb+0x142/0x2d0
[ 113.226994][ T981] rtmsg_ifinfo_build_skb+0x84/0x260
[ 113.232399][ T981] rtmsg_ifinfo+0x8c/0x1a0
[ 113.236883][ T981] register_netdevice+0x1712/0x1ae0
[ 113.242138][ T981] __ip_tunnel_create+0x3e7/0x560
[ 113.247306][ T981] ip_tunnel_init_net+0x2ba/0x800
[ 113.252344][ T981] vti_init_net+0x2f/0x100
[ 113.256813][ T981] page last free pid 5233 tgid 5233 stack trace:
[ 113.263440][ T981] __free_frozen_pages+0xbc4/0xd30
[ 113.268912][ T981] __put_partials+0x146/0x170
[ 113.273607][ T981] put_cpu_partial+0x17c/0x250
[ 113.278400][ T981] __slab_free+0x2b9/0x390
[ 113.282844][ T981] qlist_free_all+0x97/0x140
[ 113.287729][ T981] kasan_quarantine_reduce+0x148/0x160
[ 113.293195][ T981] __kasan_slab_alloc+0x22/0x80
[ 113.298077][ T981] kmem_cache_alloc_noprof+0x367/0x6e0
[ 113.303583][ T981] getname_flags+0xb8/0x540
[ 113.308109][ T981] __x64_sys_unlink+0x3a/0x50
[ 113.312893][ T981] do_syscall_64+0xfa/0xfa0
[ 113.317757][ T981] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 113.323684][ T981]
[ 113.326018][ T981] Memory state around the buggy address:
[ 113.331765][ T981] ffff888032f8b380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 113.339917][ T981] ffff888032f8b400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 113.347997][ T981] >ffff888032f8b480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 113.356095][ T981] ^
[ 113.363857][ T981] ffff888032f8b500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 113.372019][ T981] ffff888032f8b580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 113.380114][ T981] ==================================================================
[ 113.431780][ T981] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 113.439148][ T981] CPU: 1 UID: 0 PID: 981 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(full)
[ 113.448673][ T981] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[ 113.458862][ T981] Workqueue: usb_hub_wq hub_event
[ 113.463918][ T981] Call Trace:
[ 113.467470][ T981]
[ 113.470409][ T981] dump_stack_lvl+0x99/0x250
[ 113.475145][ T981] ? __asan_memcpy+0x40/0x70
[ 113.479966][ T981] ? __pfx_dump_stack_lvl+0x10/0x10
[ 113.485305][ T981] ? __pfx__printk+0x10/0x10
[ 113.490044][ T981] vpanic+0x237/0x6d0
[ 113.494071][ T981] ? __pfx_vpanic+0x10/0x10
[ 113.498645][ T981] ? preempt_schedule+0xae/0xc0
[ 113.503528][ T981] ? __pfx_preempt_schedule+0x10/0x10
[ 113.508928][ T981] panic+0xb9/0xc0
[ 113.512682][ T981] ? __pfx_panic+0x10/0x10
[ 113.517368][ T981] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 113.523285][ T981] ? media_devnode_unregister+0xe2/0xf0
[ 113.528951][ T981] check_panic_on_warn+0x89/0xb0
[ 113.533913][ T981] ? media_devnode_unregister+0xe2/0xf0
[ 113.539712][ T981] end_report+0x78/0x160
[ 113.543986][ T981] kasan_report+0x129/0x150
[ 113.548596][ T981] ? media_devnode_unregister+0xe2/0xf0
[ 113.554160][ T981] media_devnode_unregister+0xe2/0xf0
[ 113.559545][ T981] media_device_unregister+0x37c/0x400
[ 113.565131][ T981] em28xx_release_resources+0xac/0x240
[ 113.570701][ T981] em28xx_usb_disconnect+0x19f/0x2f0
[ 113.576012][ T981] usb_unbind_interface+0x26e/0x910
[ 113.581252][ T981] ? __pfx_usb_unbind_interface+0x10/0x10
[ 113.586980][ T981] device_release_driver_internal+0x4d6/0x800
[ 113.593149][ T981] bus_remove_device+0x34d/0x410
[ 113.598127][ T981] device_del+0x511/0x8e0
[ 113.602503][ T981] ? __pfx_device_del+0x10/0x10
[ 113.607461][ T981] ? kobject_put+0x446/0x480
[ 113.612169][ T981] usb_disable_device+0x3e9/0x8a0
[ 113.617212][ T981] usb_disconnect+0x330/0x950
[ 113.621919][ T981] hub_event+0x1cf5/0x4a20
[ 113.626371][ T981] ? do_raw_spin_lock+0x121/0x290
[ 113.631416][ T981] ? register_lock_class+0x51/0x320
[ 113.636989][ T981] ? __pfx_hub_event+0x10/0x10
[ 113.641771][ T981] ? process_scheduled_works+0x9ef/0x17b0
[ 113.647550][ T981] ? _raw_spin_unlock_irq+0x23/0x50
[ 113.652826][ T981] ? process_scheduled_works+0x9ef/0x17b0
[ 113.658830][ T981] ? process_scheduled_works+0x9ef/0x17b0
[ 113.664694][ T981] process_scheduled_works+0xae1/0x17b0
[ 113.670390][ T981] ? __pfx_process_scheduled_works+0x10/0x10
[ 113.676512][ T981] worker_thread+0x8a0/0xda0
[ 113.681152][ T981] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 113.687830][ T981] ? __kthread_parkme+0x7b/0x200
[ 113.692812][ T981] kthread+0x711/0x8a0
[ 113.696930][ T981] ? __pfx_worker_thread+0x10/0x10
[ 113.702148][ T981] ? __pfx_kthread+0x10/0x10
[ 113.706755][ T981] ? _raw_spin_unlock_irq+0x23/0x50
[ 113.712060][ T981] ? lockdep_hardirqs_on+0x9c/0x150
[ 113.717450][ T981] ? __pfx_kthread+0x10/0x10
[ 113.722081][ T981] ret_from_fork+0x47c/0x820
[ 113.726695][ T981] ? __pfx_ret_from_fork+0x10/0x10
[ 113.732089][ T981] ? __switch_to_asm+0x39/0x70
[ 113.736866][ T981] ? __switch_to_asm+0x33/0x70
[ 113.741746][ T981] ? __pfx_kthread+0x10/0x10
[ 113.746467][ T981] ret_from_fork_asm+0x1a/0x30
[ 113.751252][ T981]
[ 113.754677][ T981] Kernel Offset: disabled
[ 113.759009][ T981] Rebooting in 86400 seconds..