ci-upstream-kasan-gce-selinux-root/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci-upstream-kasan-gce-selinux-root/syz-executor2422335330 <...> Warning: Permanently added '10.128.0.229' (ED25519) to the list of known hosts. execve("ci-upstream-kasan-gce-selinux-root/syz-executor2422335330", ["ci-upstream-kasan-gce-selinux-root/syz-executor2422335330"], 0x7ffd13c204f0 /* 10 vars */) = 0 brk(NULL) = 0x55558c513000 brk(0x55558c513d80) = 0x55558c513d80 arch_prctl(ARCH_SET_FS, 0x55558c513400) = 0 set_tid_address(0x55558c5136d0) = 5621 set_robust_list(0x55558c5136e0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci-upstream-kasan-gce-selinux-root/syz-executor2422335330", 4096) = 63 getrandom("\xc8\xda\x9e\x2e\x62\x1c\x17\x74", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55558c513d80 brk(0x55558c534d80) = 0x55558c534d80 brk(0x55558c535000) = 0x55558c535000 mprotect(0x7f516d9b5000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce-selinux-root/strace-static-x86_64: Process 5622 attached , child_tidptr=0x55558c5136d0) = 5622 [pid 5621] rt_sigprocmask(SIG_SETMASK, [] [pid 5622] set_robust_list(0x55558c5136e0, 24 [pid 5621] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5622] <... set_robust_list resumed>) = 0 [pid 5622] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 67.721928][ T30] audit: type=1400 audit(1785863170.251:129): avc: denied { execmem } for pid=5621 comm="syz-executor242" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [pid 5622] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5622] setpgid(0, 0) = 0 [pid 5622] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5622] write(3, "1000", 4) = 4 [pid 5622] close(3) = 0 [pid 5622] write(1, "executing program\n", 18) = 18 executing program [pid 5622] openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3 [pid 5622] ioctl(3, USB_RAW_IOCTL_INIT, 0x7ffcbea506c0) = 0 [ 67.827497][ T30] audit: type=1400 audit(1785863170.361:130): avc: denied { read write } for pid=5622 comm="syz-executor242" name="raw-gadget" dev="devtmpfs" ino=821 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 67.851607][ T30] audit: type=1400 audit(1785863170.361:131): avc: denied { open } for pid=5622 comm="syz-executor242" path="/dev/raw-gadget" dev="devtmpfs" ino=821 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [pid 5622] ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 [pid 5622] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [ 67.876354][ T30] audit: type=1400 audit(1785863170.391:132): avc: denied { ioctl } for pid=5622 comm="syz-executor242" path="/dev/raw-gadget" dev="devtmpfs" ino=821 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [pid 5622] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [pid 5622] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [pid 5622] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [pid 5622] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffcbea4f6b0) = 18 [pid 5622] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [ 68.112548][ T9] usb 1-1: new high-speed USB device number 2 using dummy_hcd [pid 5622] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [pid 5622] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [pid 5622] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffcbea4f6b0) = 18 [pid 5622] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [pid 5622] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffcbea4f6b0) = 9 [pid 5622] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [pid 5622] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffcbea4f6b0) = 39 [pid 5622] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [pid 5622] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffcbea4f6b0) = 4 [pid 5622] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [pid 5622] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffcbea4f6b0) = 8 [pid 5622] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [pid 5622] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffcbea4f6b0) = 8 [pid 5622] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [ 68.286361][ T9] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 68.296266][ T9] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 68.306093][ T9] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [pid 5622] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffcbea4f6b0) = 8 [pid 5622] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [pid 5622] ioctl(3, USB_RAW_IOCTL_VBUS_DRAW, 0xfa) = 0 [pid 5622] ioctl(3, USB_RAW_IOCTL_CONFIGURE, 0) = 0 [ 68.360205][ T9] usb 1-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice= 1.00 [ 68.369288][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 68.377309][ T9] usb 1-1: Product: syz [ 68.381467][ T9] usb 1-1: Manufacturer: syz [ 68.386436][ T9] usb 1-1: SerialNumber: syz [pid 5622] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f516d9bbb4c) = -1 EINVAL (Invalid argument) [pid 5622] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f516d9bbb5c) = -1 EINVAL (Invalid argument) [pid 5622] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f516d9bbb6c) = -1 EINVAL (Invalid argument) [pid 5622] ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffcbea4f6b0) = 0 [ 68.421822][ T5622] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 68.439482][ T5622] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 68.450025][ T5622] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [pid 5622] exit_group(0) = ? [pid 5622] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5622, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55558c5136d0) = 5627 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci-upstream-kasan-gce-selinux-root/strace-static-x86_64: Process 5627 attached [pid 5627] set_robust_list(0x55558c5136e0, 24) = 0 [pid 5627] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5627] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5627] setpgid(0, 0) = 0 [pid 5627] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5627] write(3, "1000", 4) = 4 [pid 5627] close(3) = 0 [pid 5627] write(1, "executing program\n", 18) = 18 executing program [pid 5627] openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3 [pid 5627] ioctl(3, USB_RAW_IOCTL_INIT, 0x7ffcbea506c0) = 0 [pid 5627] ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 [ 68.672780][ T9] redrat3 1-1:1.0: Problem fetching firmware ID [ 68.687497][ T9] redrat3 1-1:1.0: Failed to read timeout from hardware [pid 5627] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [ 68.742452][ T9] rc_core: IR keymap rc-hauppauge not found [ 68.748377][ T9] Registered IR keymap rc-empty [ 68.757526][ T9] rc rc0: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/rc/rc0 [ 68.769711][ T9] input: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/rc/rc0/input5 [ 68.785086][ T9] redrat3 1-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0 [ 68.793968][ T9] redrat3 1-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0 [ 68.802601][ T9] redrat3 1-1:1.0: redrat3_enable_detector: detector status: -5, should be 1 [ 68.813940][ T9] redrat3 1-1:1.0: probe with driver redrat3 failed with error -5 [ 68.825455][ T9] usb 1-1: USB disconnect, device number 2 [pid 5627] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [pid 5627] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [pid 5627] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [pid 5627] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffcbea4f6b0) = 18 [pid 5627] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [ 69.122404][ T9] usb 1-1: new high-speed USB device number 3 using dummy_hcd [pid 5627] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [pid 5627] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [pid 5627] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffcbea4f6b0) = 18 [pid 5627] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [pid 5627] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffcbea4f6b0) = 9 [pid 5627] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [pid 5627] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffcbea4f6b0) = 39 [pid 5627] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [pid 5627] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffcbea4f6b0) = 4 [pid 5627] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [pid 5627] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffcbea4f6b0) = 8 [pid 5627] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [pid 5627] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffcbea4f6b0) = 8 [pid 5627] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [pid 5627] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7ffcbea4f6b0) = 8 [ 69.324852][ T9] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 69.335231][ T9] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 69.345082][ T9] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [pid 5627] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [pid 5627] ioctl(3, USB_RAW_IOCTL_VBUS_DRAW, 0xfa) = 0 [pid 5627] ioctl(3, USB_RAW_IOCTL_CONFIGURE, 0) = 0 [pid 5627] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f516d9bbb4c) = -1 EINVAL (Invalid argument) [ 69.397941][ T9] usb 1-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice= 1.00 [ 69.407090][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 69.415127][ T9] usb 1-1: Product: syz [ 69.419286][ T9] usb 1-1: Manufacturer: syz [ 69.423911][ T9] usb 1-1: SerialNumber: syz [ 69.432708][ T5627] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [pid 5627] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f516d9bbb5c) = -1 EINVAL (Invalid argument) [pid 5627] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f516d9bbb6c) = -1 EINVAL (Invalid argument) [pid 5627] ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7ffcbea4f6b0) = 0 [ 69.450355][ T5627] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 69.457887][ T5627] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [pid 5627] exit_group(0) = ? [pid 5627] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5627, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce-selinux-root/strace-static-x86_64: Process 5630 attached , child_tidptr=0x55558c5136d0) = 5630 [pid 5630] set_robust_list(0x55558c5136e0, 24 [pid 5621] rt_sigprocmask(SIG_SETMASK, [] [pid 5630] <... set_robust_list resumed>) = 0 [pid 5630] rt_sigprocmask(SIG_SETMASK, [] [pid 5621] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5630] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5630] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5630] setpgid(0, 0) = 0 [ 69.697176][ T9] redrat3 1-1:1.0: Problem fetching firmware ID [ 69.705062][ T9] redrat3 1-1:1.0: Failed to read timeout from hardware [pid 5630] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5630] write(3, "1000", 4) = 4 [pid 5630] close(3) = 0 [pid 5630] write(1, "executing program\n", 18) = 18 executing program [pid 5630] openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3 [pid 5630] ioctl(3, USB_RAW_IOCTL_INIT, 0x7ffcbea506c0) = 0 [pid 5630] ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 [pid 5630] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7ffcbea506c0) = 0 [ 69.752391][ T9] rc_core: IR keymap rc-hauppauge not found [ 69.758518][ T9] Registered IR keymap rc-empty [ 69.764205][ T9] rc rc1: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/rc/rc1 [ 69.777826][ T9] input: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/rc/rc1/input6 [ 69.795353][ T9] redrat3 1-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0 [ 69.804245][ T9] redrat3 1-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0 [ 69.813190][ T9] redrat3 1-1:1.0: redrat3_enable_detector: detector status: -5, should be 1 [ 69.823884][ T9] redrat3 1-1:1.0: probe with driver redrat3 failed with error -5 [ 69.836199][ T9] usb 1-1: USB disconnect, device number 3 [ 69.840100][ T4978] ================================================================== [ 69.850066][ T4978] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 69.856992][ T4978] Read of size 1 at addr ffff88807560d758 by task udevd/4978 [ 69.864335][ T4978] [ 69.866632][ T4978] CPU: 1 UID: 0 PID: 4978 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) [ 69.866646][ T4978] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 69.866652][ T4978] Call Trace: [ 69.866656][ T4978] [ 69.866665][ T4978] dump_stack_lvl+0x100/0x190 [ 69.866680][ T4978] print_report+0x13d/0x4b0 [ 69.866695][ T4978] ? __virt_addr_valid+0x239/0x430 [ 69.866710][ T4978] ? string+0x471/0x4d0 [ 69.866720][ T4978] kasan_report+0xdf/0x1c0 [ 69.866735][ T4978] ? string+0x471/0x4d0 [ 69.866745][ T4978] string+0x471/0x4d0 [ 69.866756][ T4978] ? __pfx_string+0x10/0x10 [ 69.866768][ T4978] vsnprintf+0x422/0x1300 [ 69.866781][ T4978] ? __pfx_vsnprintf+0x10/0x10 [ 69.866792][ T4978] ? ksys_read+0x12a/0x250 [ 69.866808][ T4978] ? do_syscall_64+0x115/0x870 [ 69.866820][ T4978] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 69.866832][ T4978] add_uevent_var+0x183/0x3a0 [ 69.866842][ T4978] ? __pfx_add_uevent_var+0x10/0x10 [ 69.866854][ T4978] ? rc_dev_uevent+0x12d/0x1c0 [ 69.866870][ T4978] ? __pfx_rc_dev_uevent+0x10/0x10 [ 69.866885][ T4978] rc_dev_uevent+0x17d/0x1c0 [ 69.866901][ T4978] dev_uevent+0x2f1/0x870 [ 69.866924][ T4978] ? __pfx_dev_uevent+0x10/0x10 [ 69.866939][ T4978] ? kasan_save_track+0x14/0x30 [ 69.866951][ T4978] ? __kasan_kmalloc+0xaa/0xb0 [ 69.866963][ T4978] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 69.866980][ T4978] ? uevent_show+0x166/0x3a0 [ 69.866992][ T4978] ? __pfx_uevent_show+0x10/0x10 [ 69.867003][ T4978] uevent_show+0x1ca/0x3a0 [ 69.867015][ T4978] ? __pfx_uevent_show+0x10/0x10 [ 69.867026][ T4978] dev_attr_show+0x52/0xa0 [ 69.867041][ T4978] ? __pfx_dev_attr_show+0x10/0x10 [ 69.867056][ T4978] sysfs_kf_seq_show+0x217/0x3f0 [ 69.867073][ T4978] seq_read_iter+0x32f/0x1270 [ 69.867084][ T4978] ? cp_new_stat+0x484/0x5c0 [ 69.867097][ T4978] kernfs_fop_read_iter+0x46c/0x610 [ 69.867112][ T4978] ? rw_verify_area+0xce/0x6d0 [ 69.867125][ T4978] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 69.867143][ T4978] vfs_read+0x82e/0xb40 [ 69.867159][ T4978] ? __pfx_vfs_read+0x10/0x10 [ 69.867175][ T4978] ? __pfx___do_sys_newfstat+0x10/0x10 [ 69.867190][ T4978] ksys_read+0x12a/0x250 [ 69.867205][ T4978] ? __pfx_ksys_read+0x10/0x10 [ 69.867222][ T4978] do_syscall_64+0x115/0x870 [ 69.867234][ T4978] ? clear_bhb_loop+0x40/0x90 [ 69.867246][ T4978] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 69.867257][ T4978] RIP: 0033:0x7f58934a7407 [ 69.867266][ T4978] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 69.867276][ T4978] RSP: 002b:00007fff44415f30 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 69.867287][ T4978] RAX: ffffffffffffffda RBX: 00007f5893bf5880 RCX: 00007f58934a7407 [ 69.867293][ T4978] RDX: 0000000000001000 RSI: 0000562be7142b50 RDI: 000000000000000c [ 69.867299][ T4978] RBP: 00007f58935efff0 R08: 0000000000000000 R09: 0000000000000000 [ 69.867306][ T4978] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 69.867311][ T4978] R13: 00007f58935efea0 R14: 0000000000000000 R15: 0000562be71381e0 [ 69.867320][ T4978] [ 69.867324][ T4978] [ 70.172981][ T4978] Allocated by task 9: [ 70.177012][ T4978] kasan_save_stack+0x30/0x50 [ 70.181659][ T4978] kasan_save_track+0x14/0x30 [ 70.186304][ T4978] __kasan_kmalloc+0xaa/0xb0 [ 70.190865][ T4978] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 70.196211][ T4978] redrat3_dev_probe+0x326/0x2b50 [ 70.201212][ T4978] usb_probe_interface+0x303/0x8f0 [ 70.206302][ T4978] really_probe+0x241/0xa60 [ 70.210783][ T4978] __driver_probe_device+0x20e/0x450 [ 70.216045][ T4978] driver_probe_device+0x4a/0x140 [ 70.221047][ T4978] __device_attach_driver+0x1df/0x320 [ 70.226398][ T4978] bus_for_each_drv+0x159/0x1e0 [ 70.231216][ T4978] __device_attach+0x1e4/0x4d0 [ 70.235958][ T4978] device_initial_probe+0xaf/0xd0 [ 70.240953][ T4978] bus_probe_device+0x64/0x160 [ 70.245684][ T4978] device_add+0x121d/0x1970 [ 70.250166][ T4978] usb_set_configuration+0xd97/0x1c60 [ 70.255519][ T4978] usb_generic_driver_probe+0xa1/0xe0 [ 70.260867][ T4978] usb_probe_device+0xef/0x400 [ 70.265608][ T4978] really_probe+0x241/0xa60 [ 70.270081][ T4978] __driver_probe_device+0x20e/0x450 [ 70.275335][ T4978] driver_probe_device+0x4a/0x140 [ 70.280331][ T4978] __device_attach_driver+0x1df/0x320 [ 70.285681][ T4978] bus_for_each_drv+0x159/0x1e0 [ 70.290508][ T4978] __device_attach+0x1e4/0x4d0 [ 70.295241][ T4978] device_initial_probe+0xaf/0xd0 [ 70.300243][ T4978] bus_probe_device+0x64/0x160 [ 70.304981][ T4978] device_add+0x121d/0x1970 [ 70.309464][ T4978] usb_new_device.cold+0x685/0x115c [ 70.314641][ T4978] hub_event+0x30a3/0x4a60 [ 70.319033][ T4978] process_one_work+0xa23/0x1940 [ 70.323945][ T4978] worker_thread+0x5ef/0xe50 [ 70.328509][ T4978] kthread+0x370/0x450 [ 70.332546][ T4978] ret_from_fork+0x72b/0xd50 [ 70.337115][ T4978] ret_from_fork_asm+0x1a/0x30 [ 70.341857][ T4978] [ 70.344149][ T4978] Freed by task 9: [ 70.347834][ T4978] kasan_save_stack+0x30/0x50 [ 70.352480][ T4978] kasan_save_track+0x14/0x30 [ 70.357128][ T4978] kasan_save_free_info+0x3b/0x70 [ 70.362129][ T4978] __kasan_slab_free+0x5f/0x80 [ 70.366876][ T4978] kfree+0x22b/0x6c0 [ 70.370746][ T4978] redrat3_dev_probe+0x107a/0x2b50 [ 70.375838][ T4978] usb_probe_interface+0x303/0x8f0 [ 70.380922][ T4978] really_probe+0x241/0xa60 [ 70.385392][ T4978] __driver_probe_device+0x20e/0x450 [ 70.390659][ T4978] driver_probe_device+0x4a/0x140 [ 70.395659][ T4978] __device_attach_driver+0x1df/0x320 [ 70.401003][ T4978] bus_for_each_drv+0x159/0x1e0 [ 70.405821][ T4978] __device_attach+0x1e4/0x4d0 [ 70.410555][ T4978] device_initial_probe+0xaf/0xd0 [ 70.415551][ T4978] bus_probe_device+0x64/0x160 [ 70.420291][ T4978] device_add+0x121d/0x1970 [ 70.424771][ T4978] usb_set_configuration+0xd97/0x1c60 [ 70.430112][ T4978] usb_generic_driver_probe+0xa1/0xe0 [ 70.435456][ T4978] usb_probe_device+0xef/0x400 [ 70.440190][ T4978] really_probe+0x241/0xa60 [ 70.444662][ T4978] __driver_probe_device+0x20e/0x450 [ 70.449924][ T4978] driver_probe_device+0x4a/0x140 [ 70.454925][ T4978] __device_attach_driver+0x1df/0x320 [ 70.460268][ T4978] bus_for_each_drv+0x159/0x1e0 [ 70.465095][ T4978] __device_attach+0x1e4/0x4d0 [ 70.469828][ T4978] device_initial_probe+0xaf/0xd0 [ 70.474822][ T4978] bus_probe_device+0x64/0x160 [ 70.479565][ T4978] device_add+0x121d/0x1970 [ 70.484040][ T4978] usb_new_device.cold+0x685/0x115c [ 70.489210][ T4978] hub_event+0x30a3/0x4a60 [ 70.493605][ T4978] process_one_work+0xa23/0x1940 [ 70.498510][ T4978] worker_thread+0x5ef/0xe50 [ 70.503070][ T4978] kthread+0x370/0x450 [ 70.507106][ T4978] ret_from_fork+0x72b/0xd50 [ 70.511675][ T4978] ret_from_fork_asm+0x1a/0x30 [ 70.516411][ T4978] [ 70.518705][ T4978] The buggy address belongs to the object at ffff88807560d000 [ 70.518705][ T4978] which belongs to the cache kmalloc-2k of size 2048 [ 70.532728][ T4978] The buggy address is located 1880 bytes inside of [ 70.532728][ T4978] freed 2048-byte region [ffff88807560d000, ffff88807560d800) [ 70.546663][ T4978] [ 70.548957][ T4978] The buggy address belongs to the physical page: [ 70.555332][ T4978] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x75608 [ 70.564056][ T4978] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 70.572519][ T4978] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 70.580034][ T4978] page_type: f5(slab) [ 70.583991][ T4978] raw: 00fff00000000040 ffff88813fe28000 dead000000000100 dead000000000122 [ 70.592543][ T4978] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 70.601098][ T4978] head: 00fff00000000040 ffff88813fe28000 dead000000000100 dead000000000122 [ 70.609742][ T4978] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 70.618390][ T4978] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 70.627036][ T4978] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 70.635672][ T4978] page dumped because: kasan: bad access detected [ 70.642049][ T4978] page_owner tracks the page as allocated [ 70.647728][ T4978] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 9, tgid 9 (kworker/0:0), ts 68822026776, free_ts 68696688899 [ 70.668439][ T4978] post_alloc_hook+0xfd/0x120 [ 70.673090][ T4978] get_page_from_freelist+0xf48/0x3530 [ 70.678516][ T4978] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 70.684377][ T4978] new_slab+0xa2/0x640 [ 70.688413][ T4978] refill_objects+0xe3/0x410 [ 70.692970][ T4978] __pcs_replace_empty_main+0x376/0x680 [ 70.698488][ T4978] __kmalloc_cache_noprof+0x479/0x6c0 [ 70.703833][ T4978] usb_create_ep_devs+0x4d/0x2b0 [ 70.708741][ T4978] create_intf_ep_devs.isra.0+0x161/0x200 [ 70.714441][ T4978] usb_set_configuration+0xdb9/0x1c60 [ 70.719792][ T4978] usb_generic_driver_probe+0xa1/0xe0 [ 70.725142][ T4978] usb_probe_device+0xef/0x400 [ 70.729877][ T4978] really_probe+0x241/0xa60 [ 70.734351][ T4978] __driver_probe_device+0x20e/0x450 [ 70.739606][ T4978] driver_probe_device+0x4a/0x140 [ 70.744600][ T4978] __device_attach_driver+0x1df/0x320 [ 70.749949][ T4978] page last free pid 9 tgid 9 stack trace: [ 70.755716][ T4978] __free_frozen_pages+0x79f/0x1090 [ 70.760894][ T4978] qlist_free_all+0x47/0xf0 [ 70.765365][ T4978] kasan_quarantine_reduce+0x1a0/0x1f0 [ 70.770802][ T4978] __kasan_slab_alloc+0x69/0x90 [ 70.775625][ T4978] __kmalloc_node_track_caller_noprof+0x2cd/0x830 [ 70.782007][ T4978] kvasprintf+0xbc/0x150 [ 70.786222][ T4978] kvasprintf_const+0x66/0x1a0 [ 70.790959][ T4978] kobject_set_name_vargs+0x5a/0x140 [ 70.796217][ T4978] dev_set_name+0xc7/0x100 [ 70.800601][ T4978] rc_register_device+0x100/0x1900 [ 70.805681][ T4978] redrat3_dev_probe+0x2313/0x2b50 [ 70.810765][ T4978] usb_probe_interface+0x303/0x8f0 [ 70.815848][ T4978] really_probe+0x241/0xa60 [ 70.820321][ T4978] __driver_probe_device+0x20e/0x450 [ 70.825576][ T4978] driver_probe_device+0x4a/0x140 [ 70.830570][ T4978] __device_attach_driver+0x1df/0x320 [ 70.835917][ T4978] [ 70.838210][ T4978] Memory state around the buggy address: [ 70.843814][ T4978] ffff88807560d600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 70.851843][ T4978] ffff88807560d680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 70.859871][ T4978] >ffff88807560d700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 70.867896][ T4978] ^ [ 70.874797][ T4978] ffff88807560d780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 70.882825][ T4978] ffff88807560d800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 70.890850][ T4978] ================================================================== [ 70.899614][ T4978] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 70.906804][ T4978] CPU: 1 UID: 0 PID: 4978 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) [ 70.915642][ T4978] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 70.925669][ T4978] Call Trace: [ 70.928920][ T4978] [ 70.931822][ T4978] dump_stack_lvl+0x100/0x190 [ 70.936476][ T4978] vpanic+0x552/0x970 [ 70.940430][ T4978] ? __pfx_vpanic+0x10/0x10 [ 70.944914][ T4978] ? mark_held_locks+0x40/0x70 [ 70.949663][ T4978] ? string+0x471/0x4d0 [ 70.953797][ T4978] panic+0xd1/0xe0 [ 70.957499][ T4978] ? __pfx_panic+0x10/0x10 [ 70.961886][ T4978] ? string+0x471/0x4d0 [ 70.966012][ T4978] ? preempt_schedule_common+0x42/0xc0 [ 70.971443][ T4978] ? check_panic_on_warn+0x1f/0x90 [ 70.976535][ T4978] check_panic_on_warn.cold+0x19/0x34 [ 70.981878][ T4978] end_report.part.0+0x3a/0x90 [ 70.986626][ T4978] kasan_report.cold+0xe/0x18 [ 70.991279][ T4978] ? string+0x471/0x4d0 [ 70.995412][ T4978] string+0x471/0x4d0 [ 70.999367][ T4978] ? __pfx_string+0x10/0x10 [ 71.003927][ T4978] vsnprintf+0x422/0x1300 [ 71.008229][ T4978] ? __pfx_vsnprintf+0x10/0x10 [ 71.012973][ T4978] ? ksys_read+0x12a/0x250 [ 71.017374][ T4978] ? do_syscall_64+0x115/0x870 [ 71.022117][ T4978] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 71.028167][ T4978] add_uevent_var+0x183/0x3a0 [ 71.032815][ T4978] ? __pfx_add_uevent_var+0x10/0x10 [ 71.037986][ T4978] ? rc_dev_uevent+0x12d/0x1c0 [ 71.042732][ T4978] ? __pfx_rc_dev_uevent+0x10/0x10 [ 71.047905][ T4978] rc_dev_uevent+0x17d/0x1c0 [ 71.052471][ T4978] dev_uevent+0x2f1/0x870 [ 71.056776][ T4978] ? __pfx_dev_uevent+0x10/0x10 [ 71.061601][ T4978] ? kasan_save_track+0x14/0x30 [ 71.066423][ T4978] ? __kasan_kmalloc+0xaa/0xb0 [ 71.071158][ T4978] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 71.076684][ T4978] ? uevent_show+0x166/0x3a0 [ 71.081246][ T4978] ? __pfx_uevent_show+0x10/0x10 [ 71.086166][ T4978] uevent_show+0x1ca/0x3a0 [ 71.090564][ T4978] ? __pfx_uevent_show+0x10/0x10 [ 71.095481][ T4978] dev_attr_show+0x52/0xa0 [ 71.099882][ T4978] ? __pfx_dev_attr_show+0x10/0x10 [ 71.104968][ T4978] sysfs_kf_seq_show+0x217/0x3f0 [ 71.109884][ T4978] seq_read_iter+0x32f/0x1270 [ 71.114531][ T4978] ? cp_new_stat+0x484/0x5c0 [ 71.119094][ T4978] kernfs_fop_read_iter+0x46c/0x610 [ 71.124268][ T4978] ? rw_verify_area+0xce/0x6d0 [ 71.129005][ T4978] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 71.134706][ T4978] vfs_read+0x82e/0xb40 [ 71.138852][ T4978] ? __pfx_vfs_read+0x10/0x10 [ 71.143511][ T4978] ? __pfx___do_sys_newfstat+0x10/0x10 [ 71.148945][ T4978] ksys_read+0x12a/0x250 [ 71.153163][ T4978] ? __pfx_ksys_read+0x10/0x10 [ 71.157920][ T4978] do_syscall_64+0x115/0x870 [ 71.162493][ T4978] ? clear_bhb_loop+0x40/0x90 [ 71.167155][ T4978] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 71.173018][ T4978] RIP: 0033:0x7f58934a7407 [ 71.177409][ T4978] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 71.196993][ T4978] RSP: 002b:00007fff44415f30 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 71.205384][ T4978] RAX: ffffffffffffffda RBX: 00007f5893bf5880 RCX: 00007f58934a7407 [ 71.213329][ T4978] RDX: 0000000000001000 RSI: 0000562be7142b50 RDI: 000000000000000c [ 71.221273][ T4978] RBP: 00007f58935efff0 R08: 0000000000000000 R09: 0000000000000000 [ 71.229218][ T4978] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a [ 71.237170][ T4978] R13: 00007f58935efea0 R14: 0000000000000000 R15: 0000562be71381e0 [ 71.245125][ T4978] [ 71.248236][ T4978] Kernel Offset: disabled [ 71.252531][ T4978] Rebooting in 86400 seconds..